108 files changed, 745 insertions, 361 deletions

diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index d8e376a5f0f1..36a1a739ad68 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -658,14 +658,30 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args)
 static void p9_virtio_remove(struct virtio_device *vdev)
 {
         struct virtio_chan *chan = vdev->priv;
-
-        if (chan->inuse)
-                p9_virtio_close(chan->client);
-        vdev->config->del_vqs(vdev);
+        unsigned long warning_time;
 
         mutex_lock(&virtio_9p_lock);
+
+        /* Remove self from list so we don't get new users. */
         list_del(&chan->chan_list);
+        warning_time = jiffies;
+
+        /* Wait for existing users to close. */
+        while (chan->inuse) {
+                mutex_unlock(&virtio_9p_lock);
+                msleep(250);
+                if (time_after(jiffies, warning_time + 10 * HZ)) {
+                        dev_emerg(&vdev->dev,
+                                  "p9_virtio_remove: waiting for device in use.\n");
+                        warning_time = jiffies;
+                }
+                mutex_lock(&virtio_9p_lock);
+        }
+
         mutex_unlock(&virtio_9p_lock);
+
+        vdev->config->del_vqs(vdev);
+
         sysfs_remove_file(&(vdev->dev.kobj), &dev_attr_mount_tag.attr);
         kobject_uevent(&(vdev->dev.kobj), KOBJ_CHANGE);
         kfree(chan->tag);
diff --git a/net/bridge/br.c b/net/bridge/br.c
index fb57ab6b24f9..02c24cf63c34 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -190,6 +190,8 @@ static int __init br_init(void)
 {
         int err;
 
+        BUILD_BUG_ON(sizeof(struct br_input_skb_cb) > FIELD_SIZEOF(struct sk_buff, cb));
+
         err = stp_proto_register(&br_stp_proto);
         if (err < 0) {
                 pr_err("bridge: can't register sap for STP\n");
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index b087d278c679..1849d96b3c91 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -563,6 +563,8 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
          */
         del_nbp(p);
 
+        dev_set_mtu(br->dev, br_min_mtu(br));
+
         spin_lock_bh(&br->lock);
         changed_addr = br_stp_recalculate_bridge_id(br);
         spin_unlock_bh(&br->lock);
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 769b185fefbd..a6e2da0bc718 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -281,7 +281,7 @@ static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock,
         int copylen;
 
         ret = -EOPNOTSUPP;
-        if (m->msg_flags&MSG_OOB)
+        if (flags & MSG_OOB)
                 goto read_error;
 
         skb = skb_recv_datagram(sk, flags, 0 , &ret);
diff --git a/net/caif/cffrml.c b/net/caif/cffrml.c
index 8bc7caa28e64..434ba8557826 100644
--- a/net/caif/cffrml.c
+++ b/net/caif/cffrml.c
@@ -84,7 +84,7 @@ static int cffrml_receive(struct cflayer *layr, struct cfpkt *pkt)
         u16 tmp;
         u16 len;
         u16 hdrchks;
-        u16 pktchks;
+        int pktchks;
         struct cffrml *this;
         this = container_obj(layr);
 
diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c
index 1be0b521ac49..f6c3b2137eea 100644
--- a/net/caif/cfpkt_skbuff.c
+++ b/net/caif/cfpkt_skbuff.c
@@ -255,9 +255,9 @@ inline u16 cfpkt_getlen(struct cfpkt *pkt)
         return skb->len;
 }
 
-inline u16 cfpkt_iterate(struct cfpkt *pkt,
-                         u16 (*iter_func)(u16, void *, u16),
-                         u16 data)
+int cfpkt_iterate(struct cfpkt *pkt,
+                  u16 (*iter_func)(u16, void *, u16),
+                  u16 data)
 {
         /*
          * Don't care about the performance hit of linearizing,
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 66e08040ced7..32d710eaf1fc 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -259,6 +259,9 @@ int can_send(struct sk_buff *skb, int loop)
                 goto inval_skb;
         }
 
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+        skb_reset_mac_header(skb);
         skb_reset_network_header(skb);
         skb_reset_transport_header(skb);
 
diff --git a/net/compat.c b/net/compat.c
index 3236b4167a32..f7bd286a8280 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -49,6 +49,13 @@ ssize_t get_compat_msghdr(struct msghdr *kmsg,
             __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
             __get_user(kmsg->msg_flags, &umsg->msg_flags))
                 return -EFAULT;
+
+        if (!uaddr)
+                kmsg->msg_namelen = 0;
+
+        if (kmsg->msg_namelen < 0)
+                return -EINVAL;
+
         if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
                 kmsg->msg_namelen = sizeof(struct sockaddr_storage);
         kmsg->msg_control = compat_ptr(tmp3);
@@ -711,24 +718,18 @@ static unsigned char nas[21] = {
 
 COMPAT_SYSCALL_DEFINE3(sendmsg, int, fd, struct compat_msghdr __user *, msg, unsigned int, flags)
 {
-        if (flags & MSG_CMSG_COMPAT)
-                return -EINVAL;
         return __sys_sendmsg(fd, (struct user_msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
 COMPAT_SYSCALL_DEFINE4(sendmmsg, int, fd, struct compat_mmsghdr __user *, mmsg,
                        unsigned int, vlen, unsigned int, flags)
 {
-        if (flags & MSG_CMSG_COMPAT)
-                return -EINVAL;
         return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                               flags | MSG_CMSG_COMPAT);
 }
 
 COMPAT_SYSCALL_DEFINE3(recvmsg, int, fd, struct compat_msghdr __user *, msg, unsigned int, flags)
 {
-        if (flags & MSG_CMSG_COMPAT)
-                return -EINVAL;
         return __sys_recvmsg(fd, (struct user_msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
@@ -751,9 +752,6 @@ COMPAT_SYSCALL_DEFINE5(recvmmsg, int, fd, struct compat_mmsghdr __user *, mmsg,
         int datagrams;
         struct timespec ktspec;
 
-        if (flags & MSG_CMSG_COMPAT)
-                return -EINVAL;
-
         if (timeout == NULL)
                 return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                                       flags | MSG_CMSG_COMPAT, NULL);
diff --git a/net/core/dev.c b/net/core/dev.c
index 8f9710c62e20..45109b70664e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -946,7 +946,7 @@ bool dev_valid_name(const char *name)
                 return false;
 
         while (*name) {
-                if (*name == '/' || isspace(*name))
+                if (*name == '/' || *name == ':' || isspace(*name))
                         return false;
                 name++;
         }
@@ -2848,7 +2848,9 @@ static void skb_update_prio(struct sk_buff *skb)
 #define skb_update_prio(skb)
 #endif
 
-static DEFINE_PER_CPU(int, xmit_recursion);
+DEFINE_PER_CPU(int, xmit_recursion);
+EXPORT_SYMBOL(xmit_recursion);
+
 #define RECURSION_LIMIT 10
 
 /**
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 91f74f3eb204..aa378ecef186 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -98,6 +98,7 @@ static const char netdev_features_strings[NETDEV_FEATURE_COUNT][ETH_GSTRING_LEN]
         [NETIF_F_RXALL_BIT] =            "rx-all",
         [NETIF_F_HW_L2FW_DOFFLOAD_BIT] = "l2-fwd-offload",
         [NETIF_F_BUSY_POLL_BIT] =        "busy-poll",
+        [NETIF_F_HW_SWITCH_OFFLOAD_BIT] = "hw-switch-offload",
 };
 
 static const char
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 44706e81b2e0..e4fdc9dfb2c7 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -175,9 +175,9 @@ void fib_rules_unregister(struct fib_rules_ops *ops)
 
         spin_lock(&net->rules_mod_lock);
         list_del_rcu(&ops->list);
-        fib_rules_cleanup_ops(ops);
         spin_unlock(&net->rules_mod_lock);
 
+        fib_rules_cleanup_ops(ops);
         call_rcu(&ops->rcu, fib_rules_put_rcu);
 }
 EXPORT_SYMBOL_GPL(fib_rules_unregister);
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index 0c08062d1796..1e2f46a69d50 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -32,6 +32,9 @@ gnet_stats_copy(struct gnet_dump *d, int type, void *buf, int size)
         return 0;
 
 nla_put_failure:
+        kfree(d->xstats);
+        d->xstats = NULL;
+        d->xstats_len = 0;
         spin_unlock_bh(d->lock);
         return -1;
 }
@@ -305,7 +308,9 @@ int
 gnet_stats_copy_app(struct gnet_dump *d, void *st, int len)
 {
         if (d->compat_xstats) {
-                d->xstats = st;
+                d->xstats = kmemdup(st, len, GFP_ATOMIC);
+                if (!d->xstats)
+                        goto err_out;
                 d->xstats_len = len;
         }
 
@@ -313,6 +318,11 @@ gnet_stats_copy_app(struct gnet_dump *d, void *st, int len)
                 return gnet_stats_copy(d, TCA_STATS_APP, st, len);
 
         return 0;
+
+err_out:
+        d->xstats_len = 0;
+        spin_unlock_bh(d->lock);
+        return -1;
 }
 EXPORT_SYMBOL(gnet_stats_copy_app);
 
@@ -345,6 +355,9 @@ gnet_stats_finish_copy(struct gnet_dump *d)
                         return -1;
         }
 
+        kfree(d->xstats);
+        d->xstats = NULL;
+        d->xstats_len = 0;
         spin_unlock_bh(d->lock);
         return 0;
 }
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index cb5290b8c428..70d3450588b2 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -198,8 +198,10 @@ static int __peernet2id(struct net *net, struct net *peer, bool alloc)
  */
 int peernet2id(struct net *net, struct net *peer)
 {
-        int id = __peernet2id(net, peer, true);
+        bool alloc = atomic_read(&peer->count) == 0 ? false : true;
+        int id;
 
+        id = __peernet2id(net, peer, alloc);
         return id >= 0 ? id : NETNSA_NSID_NOT_ASSIGNED;
 }
 EXPORT_SYMBOL(peernet2id);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index b4899f5b7388..508155b283dd 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -1134,6 +1134,9 @@ static ssize_t pktgen_if_write(struct file *file,
                         return len;
 
                 i += len;
+                if ((value > 1) &&
+                    (!(pkt_dev->odev->priv_flags & IFF_TX_SKB_SHARING)))
+                        return -ENOTSUPP;
                 pkt_dev->burst = value < 1 ? 1 : value;
                 sprintf(pg_result, "OK: burst=%d", pkt_dev->burst);
                 return count;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index ab293a3066b3..7ebed55b5f7d 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1300,7 +1300,6 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         s_h = cb->args[0];
         s_idx = cb->args[1];
 
-        rcu_read_lock();
         cb->seq = net->dev_base_seq;
 
         /* A hack to preserve kernel<->userspace interface.
@@ -1322,7 +1321,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
                 head = &net->dev_index_head[h];
-                hlist_for_each_entry_rcu(dev, head, index_hlist) {
+                hlist_for_each_entry(dev, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
                         err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
@@ -1344,7 +1343,6 @@ cont:
                 }
         }
 out:
-        rcu_read_unlock();
         cb->args[1] = idx;
         cb->args[0] = h;
 
@@ -1934,10 +1932,10 @@ static int rtnl_group_changelink(const struct sk_buff *skb,
                 struct ifinfomsg *ifm,
                 struct nlattr **tb)
 {
-        struct net_device *dev;
+        struct net_device *dev, *aux;
         int err;
 
-        for_each_netdev(net, dev) {
+        for_each_netdev_safe(net, dev, aux) {
                 if (dev->group == group) {
                         err = do_setlink(skb, dev, ifm, tb, NULL, 0);
                         if (err < 0)
@@ -2012,8 +2010,8 @@ replay:
         }
 
         if (1) {
-                struct nlattr *attr[ops ? ops->maxtype + 1 : 0];
-                struct nlattr *slave_attr[m_ops ? m_ops->slave_maxtype + 1 : 0];
+                struct nlattr *attr[ops ? ops->maxtype + 1 : 1];
+                struct nlattr *slave_attr[m_ops ? m_ops->slave_maxtype + 1 : 1];
                 struct nlattr **data = NULL;
                 struct nlattr **slave_data = NULL;
                 struct net *dest_net, *link_net = NULL;
@@ -2122,6 +2120,10 @@ replay:
                 if (IS_ERR(dest_net))
                         return PTR_ERR(dest_net);
 
+                err = -EPERM;
+                if (!netlink_ns_capable(skb, dest_net->user_ns, CAP_NET_ADMIN))
+                        goto out;
+
                 if (tb[IFLA_LINK_NETNSID]) {
                         int id = nla_get_s32(tb[IFLA_LINK_NETNSID]);
 
@@ -2130,6 +2132,9 @@ replay:
                                 err =  -EINVAL;
                                 goto out;
                         }
+                        err = -EPERM;
+                        if (!netlink_ns_capable(skb, link_net->user_ns, CAP_NET_ADMIN))
+                                goto out;
                 }
 
                 dev = rtnl_create_link(link_net ? : dest_net, ifname,
@@ -2161,28 +2166,28 @@ replay:
                         }
                 }
                 err = rtnl_configure_link(dev, ifm);
-                if (err < 0) {
-                        if (ops->newlink) {
-                                LIST_HEAD(list_kill);
-
-                                ops->dellink(dev, &list_kill);
-                                unregister_netdevice_many(&list_kill);
-                        } else {
-                                unregister_netdevice(dev);
-                        }
-                        goto out;
-                }
-
+                if (err < 0)
+                        goto out_unregister;
                 if (link_net) {
                         err = dev_change_net_namespace(dev, dest_net, ifname);
                         if (err < 0)
-                                unregister_netdevice(dev);
+                                goto out_unregister;
                 }
 out:
                 if (link_net)
                         put_net(link_net);
                 put_net(dest_net);
                 return err;
+out_unregister:
+                if (ops->newlink) {
+                        LIST_HEAD(list_kill);
+
+                        ops->dellink(dev, &list_kill);
+                        unregister_netdevice_many(&list_kill);
+                } else {
+                        unregister_netdevice(dev);
+                }
+                goto out;
         }
 }
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 88c613eab142..8e4ac97c8477 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3621,13 +3621,14 @@ struct sk_buff *sock_dequeue_err_skb(struct sock *sk)
 {
         struct sk_buff_head *q = &sk->sk_error_queue;
         struct sk_buff *skb, *skb_next;
+        unsigned long flags;
         int err = 0;
 
-        spin_lock_bh(&q->lock);
+        spin_lock_irqsave(&q->lock, flags);
         skb = __skb_dequeue(q);
         if (skb && (skb_next = skb_peek(q)))
                 err = SKB_EXT_ERR(skb_next)->ee.ee_errno;
-        spin_unlock_bh(&q->lock);
+        spin_unlock_irqrestore(&q->lock, flags);
 
         sk->sk_err = err;
         if (err)
@@ -3732,9 +3733,13 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
                      struct sock *sk, int tstype)
 {
         struct sk_buff *skb;
-        bool tsonly = sk->sk_tsflags & SOF_TIMESTAMPING_OPT_TSONLY;
+        bool tsonly;
+
+        if (!sk)
+                return;
 
-        if (!sk || !skb_may_tx_timestamp(sk, tsonly))
+        tsonly = sk->sk_tsflags & SOF_TIMESTAMPING_OPT_TSONLY;
+        if (!skb_may_tx_timestamp(sk, tsonly))
                 return;
 
         if (tsonly)
@@ -4172,7 +4177,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
         skb->ignore_df = 0;
         skb_dst_drop(skb);
         skb->mark = 0;
-        skb->sender_cpu = 0;
+        skb_sender_cpu_clear(skb);
         skb_init_secmark(skb);
         secpath_reset(skb);
         nf_reset(skb);
diff --git a/net/core/sock.c b/net/core/sock.c
index 93c8b20c91e4..71e3e5f1eaa0 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -653,6 +653,25 @@ static inline void sock_valbool_flag(struct sock *sk, int bit, int valbool)
                 sock_reset_flag(sk, bit);
 }
 
+bool sk_mc_loop(struct sock *sk)
+{
+        if (dev_recursion_level())
+                return false;
+        if (!sk)
+                return true;
+        switch (sk->sk_family) {
+        case AF_INET:
+                return inet_sk(sk)->mc_loop;
+#if IS_ENABLED(CONFIG_IPV6)
+        case AF_INET6:
+                return inet6_sk(sk)->mc_loop;
+#endif
+        }
+        WARN_ON(1);
+        return true;
+}
+EXPORT_SYMBOL(sk_mc_loop);
+
 /*
  *      This is meant for all protocols to use and covers goings on
  *      at the socket level. Everything here is generic.
@@ -1655,6 +1674,10 @@ void sock_rfree(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(sock_rfree);
 
+/*
+ * Buffer destructor for skbs that are not used directly in read or write
+ * path, e.g. for error handler skbs. Automatically called from kfree_skb.
+ */
 void sock_efree(struct sk_buff *skb)
 {
         sock_put(skb->sk);
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 433424804284..8ce351ffceb1 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -25,6 +25,8 @@
 static int zero = 0;
 static int one = 1;
 static int ushort_max = USHRT_MAX;
+static int min_sndbuf = SOCK_MIN_SNDBUF;
+static int min_rcvbuf = SOCK_MIN_RCVBUF;
 
 static int net_msg_warn;        /* Unused, but still a sysctl */
 
@@ -237,7 +239,7 @@ static struct ctl_table net_core_table[] = {
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_sndbuf,
         },
         {
                 .procname       = "rmem_max",
@@ -245,7 +247,7 @@ static struct ctl_table net_core_table[] = {
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_rcvbuf,
         },
         {
                 .procname       = "wmem_default",
@@ -253,7 +255,7 @@ static struct ctl_table net_core_table[] = {
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_sndbuf,
         },
         {
                 .procname       = "rmem_default",
@@ -261,7 +263,7 @@ static struct ctl_table net_core_table[] = {
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_rcvbuf,
         },
         {
                 .procname       = "dev_weight",
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 1d7c1256e845..3b81092771f8 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -1062,7 +1062,7 @@ source_ok:
         if (decnet_debug_level & 16)
                 printk(KERN_DEBUG
                        "dn_route_output_slow: initial checks complete."
-                       " dst=%o4x src=%04x oif=%d try_hard=%d\n",
+                       " dst=%04x src=%04x oif=%d try_hard=%d\n",
                        le16_to_cpu(fld.daddr), le16_to_cpu(fld.saddr),
                        fld.flowidn_oif, try_hard);
 
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index faf7cc3483fe..9d66a0f72f90 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -248,7 +248,9 @@ void __init dn_fib_rules_init(void)
 
 void __exit dn_fib_rules_cleanup(void)
 {
+        rtnl_lock();
         fib_rules_unregister(dn_fib_rules_ops);
+        rtnl_unlock();
         rcu_barrier();
 }
 
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 2173402d87e0..4dea2e0681d1 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -501,12 +501,10 @@ static struct net_device *dev_to_net_device(struct device *dev)
 #ifdef CONFIG_OF
 static int dsa_of_setup_routing_table(struct dsa_platform_data *pd,
                                         struct dsa_chip_data *cd,
-                                        int chip_index,
+                                        int chip_index, int port_index,
                                         struct device_node *link)
 {
-        int ret;
         const __be32 *reg;
-        int link_port_addr;
         int link_sw_addr;
         struct device_node *parent_sw;
         int len;
@@ -519,6 +517,10 @@ static int dsa_of_setup_routing_table(struct dsa_platform_data *pd,
         if (!reg || (len != sizeof(*reg) * 2))
                 return -EINVAL;
 
+        /*
+         * Get the destination switch number from the second field of its 'reg'
+         * property, i.e. for "reg = <0x19 1>" sw_addr is '1'.
+         */
         link_sw_addr = be32_to_cpup(reg + 1);
 
         if (link_sw_addr >= pd->nr_chips)
@@ -535,20 +537,9 @@ static int dsa_of_setup_routing_table(struct dsa_platform_data *pd,
                 memset(cd->rtable, -1, pd->nr_chips * sizeof(s8));
         }
 
-        reg = of_get_property(link, "reg", NULL);
-        if (!reg) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        link_port_addr = be32_to_cpup(reg);
-
-        cd->rtable[link_sw_addr] = link_port_addr;
+        cd->rtable[link_sw_addr] = port_index;
 
         return 0;
-out:
-        kfree(cd->rtable);
-        return ret;
 }
 
 static void dsa_of_free_platform_data(struct dsa_platform_data *pd)
@@ -658,7 +649,7 @@ static int dsa_of_probe(struct platform_device *pdev)
                         if (!strcmp(port_name, "dsa") && link &&
                                         pd->nr_chips > 1) {
                                 ret = dsa_of_setup_routing_table(pd, cd,
-                                                chip_index, link);
+                                                chip_index, port_index, link);
                                 if (ret)
                                         goto out_free_chip;
                         }
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index a138d75751df..44d27469ae55 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -359,8 +359,11 @@ static void hsr_dev_destroy(struct net_device *hsr_dev)
         struct hsr_port *port;
 
         hsr = netdev_priv(hsr_dev);
+
+        rtnl_lock();
         hsr_for_each_port(hsr, port)
                 hsr_del_port(port);
+        rtnl_unlock();
 
         del_timer_sync(&hsr->prune_timer);
         del_timer_sync(&hsr->announce_timer);
diff --git a/net/hsr/hsr_main.c b/net/hsr/hsr_main.c
index 779d28b65417..cd37d0011b42 100644
--- a/net/hsr/hsr_main.c
+++ b/net/hsr/hsr_main.c
@@ -36,6 +36,10 @@ static int hsr_netdev_notify(struct notifier_block *nb, unsigned long event,
                         return NOTIFY_DONE;     /* Not an HSR device */
                 hsr = netdev_priv(dev);
                 port = hsr_port_get_hsr(hsr, HSR_PT_MASTER);
+                if (port == NULL) {
+                        /* Resend of notification concerning removed device? */
+                        return NOTIFY_DONE;
+                }
         } else {
                 hsr = port->hsr;
         }
diff --git a/net/hsr/hsr_slave.c b/net/hsr/hsr_slave.c
index a348dcbcd683..7d37366cc695 100644
--- a/net/hsr/hsr_slave.c
+++ b/net/hsr/hsr_slave.c
@@ -181,8 +181,10 @@ void hsr_del_port(struct hsr_port *port)
         list_del_rcu(&port->port_list);
 
         if (port != master) {
-                netdev_update_features(master->dev);
-                dev_set_mtu(master->dev, hsr_get_max_mtu(hsr));
+                if (master != NULL) {
+                        netdev_update_features(master->dev);
+                        dev_set_mtu(master->dev, hsr_get_max_mtu(hsr));
+                }
                 netdev_rx_handler_unregister(port->dev);
                 dev_set_promiscuity(port->dev, -1);
         }
@@ -192,5 +194,7 @@ void hsr_del_port(struct hsr_port *port)
          */
 
         synchronize_rcu();
-        dev_put(port->dev);
+
+        if (port != master)
+                dev_put(port->dev);
 }
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 57be71dd6a9e..23b9b3e86f4c 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1111,11 +1111,10 @@ static void ip_fib_net_exit(struct net *net)
 {
         unsigned int i;
 
+        rtnl_lock();
 #ifdef CONFIG_IP_MULTIPLE_TABLES
         fib4_rules_exit(net);
 #endif
-
-        rtnl_lock();
         for (i = 0; i < FIB_TABLE_HASHSZ; i++) {
                 struct fib_table *tb;
                 struct hlist_head *head;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 14d02ea905b6..3e44b9b0b78e 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -268,6 +268,7 @@ static int inet_csk_wait_for_connect(struct sock *sk, long timeo)
                 release_sock(sk);
                 if (reqsk_queue_empty(&icsk->icsk_accept_queue))
                         timeo = schedule_timeout(timeo);
+                sched_annotate_sleep();
                 lock_sock(sk);
                 err = 0;
                 if (!reqsk_queue_empty(&icsk->icsk_accept_queue))
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 81751f12645f..592aff37366b 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -71,6 +71,20 @@ static inline void inet_diag_unlock_handler(
         mutex_unlock(&inet_diag_table_mutex);
 }
 
+static size_t inet_sk_attr_size(void)
+{
+        return    nla_total_size(sizeof(struct tcp_info))
+                + nla_total_size(1) /* INET_DIAG_SHUTDOWN */
+                + nla_total_size(1) /* INET_DIAG_TOS */
+                + nla_total_size(1) /* INET_DIAG_TCLASS */
+                + nla_total_size(sizeof(struct inet_diag_meminfo))
+                + nla_total_size(sizeof(struct inet_diag_msg))
+                + nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
+                + nla_total_size(TCP_CA_NAME_MAX)
+                + nla_total_size(sizeof(struct tcpvegas_info))
+                + 64;
+}
+
 int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
                               struct sk_buff *skb, struct inet_diag_req_v2 *req,
                               struct user_namespace *user_ns,                   
@@ -326,9 +340,7 @@ int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *in_s
         if (err)
                 goto out;
 
-        rep = nlmsg_new(sizeof(struct inet_diag_msg) +
-                        sizeof(struct inet_diag_meminfo) +
-                        sizeof(struct tcp_info) + 64, GFP_KERNEL);
+        rep = nlmsg_new(inet_sk_attr_size(), GFP_KERNEL);
         if (!rep) {
                 err = -ENOMEM;
                 goto out;
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 787b3c294ce6..d9bc28ac5d1b 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -67,6 +67,7 @@ static int ip_forward_finish(struct sk_buff *skb)
         if (unlikely(opt->optlen))
                 ip_forward_options(skb);
 
+        skb_sender_cpu_clear(skb);
         return dst_output(skb);
 }
 
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index e5b6d0ddcb58..145a50c4d566 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -659,27 +659,30 @@ EXPORT_SYMBOL(ip_defrag);
 struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
 {
         struct iphdr iph;
+        int netoff;
         u32 len;
 
         if (skb->protocol != htons(ETH_P_IP))
                 return skb;
 
-        if (!skb_copy_bits(skb, 0, &iph, sizeof(iph)))
+        netoff = skb_network_offset(skb);
+
+        if (skb_copy_bits(skb, netoff, &iph, sizeof(iph)) < 0)
                 return skb;
 
         if (iph.ihl < 5 || iph.version != 4)
                 return skb;
 
         len = ntohs(iph.tot_len);
-        if (skb->len < len || len < (iph.ihl * 4))
+        if (skb->len < netoff + len || len < (iph.ihl * 4))
                 return skb;
 
         if (ip_is_fragment(&iph)) {
                 skb = skb_share_check(skb, GFP_ATOMIC);
                 if (skb) {
-                        if (!pskb_may_pull(skb, iph.ihl*4))
+                        if (!pskb_may_pull(skb, netoff + iph.ihl * 4))
                                 return skb;
-                        if (pskb_trim_rcsum(skb, len))
+                        if (pskb_trim_rcsum(skb, netoff + len))
                                 return skb;
                         memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
                         if (ip_defrag(skb, user))
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index d68199d9b2b0..a7aea2048a0d 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -888,7 +888,8 @@ static int __ip_append_data(struct sock *sk,
         cork->length += length;
         if (((length > mtu) || (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) {
+            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
+            (sk->sk_type == SOCK_DGRAM)) {
                 err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                                          hh_len, fragheaderlen, transhdrlen,
                                          maxfraglen, flags);
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 31d8c71986b4..5cd99271d3a6 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -432,17 +432,32 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf
                 kfree_skb(skb);
 }
 
-static bool ipv4_pktinfo_prepare_errqueue(const struct sock *sk,
-                                          const struct sk_buff *skb,
-                                          int ee_origin)
+/* IPv4 supports cmsg on all imcp errors and some timestamps
+ *
+ * Timestamp code paths do not initialize the fields expected by cmsg:
+ * the PKTINFO fields in skb->cb[]. Fill those in here.
+ */
+static bool ipv4_datagram_support_cmsg(const struct sock *sk,
+                                       struct sk_buff *skb,
+                                       int ee_origin)
 {
-        struct in_pktinfo *info = PKTINFO_SKB_CB(skb);
+        struct in_pktinfo *info;
+
+        if (ee_origin == SO_EE_ORIGIN_ICMP)
+                return true;
 
-        if ((ee_origin != SO_EE_ORIGIN_TIMESTAMPING) ||
-            (!(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_CMSG)) ||
+        if (ee_origin == SO_EE_ORIGIN_LOCAL)
+                return false;
+
+        /* Support IP_PKTINFO on tstamp packets if requested, to correlate
+         * timestamp with egress dev. Not possible for packets without dev
+         * or without payload (SOF_TIMESTAMPING_OPT_TSONLY).
+         */
+        if ((!(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_CMSG)) ||
             (!skb->dev))
                 return false;
 
+        info = PKTINFO_SKB_CB(skb);
         info->ipi_spec_dst.s_addr = ip_hdr(skb)->saddr;
         info->ipi_ifindex = skb->dev->ifindex;
         return true;
@@ -483,7 +498,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 
         serr = SKB_EXT_ERR(skb);
 
-        if (sin && skb->len) {
+        if (sin && serr->port) {
                 sin->sin_family = AF_INET;
                 sin->sin_addr.s_addr = *(__be32 *)(skb_network_header(skb) +
                                                    serr->addr_offset);
@@ -496,9 +511,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
         sin = &errhdr.offender;
         memset(sin, 0, sizeof(*sin));
 
-        if (skb->len &&
-            (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP ||
-             ipv4_pktinfo_prepare_errqueue(sk, skb, serr->ee.ee_origin))) {
+        if (ipv4_datagram_support_cmsg(sk, skb, serr->ee.ee_origin)) {
                 sin->sin_family = AF_INET;
                 sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
                 if (inet_sk(sk)->cmsg_flags)
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 9d78427652d2..fe54eba6d00d 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -268,7 +268,7 @@ static int __net_init ipmr_rules_init(struct net *net)
         return 0;
 
 err2:
-        kfree(mrt);
+        ipmr_free_table(mrt);
 err1:
         fib_rules_unregister(ops);
         return err;
@@ -278,11 +278,13 @@ static void __net_exit ipmr_rules_exit(struct net *net)
 {
         struct mr_table *mrt, *next;
 
+        rtnl_lock();
         list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) {
                 list_del(&mrt->list);
                 ipmr_free_table(mrt);
         }
         fib_rules_unregister(net->ipv4.mr_rules_ops);
+        rtnl_unlock();
 }
 #else
 #define ipmr_for_each_table(mrt, net) \
@@ -308,7 +310,10 @@ static int __net_init ipmr_rules_init(struct net *net)
 
 static void __net_exit ipmr_rules_exit(struct net *net)
 {
+        rtnl_lock();
         ipmr_free_table(net->ipv4.mrt);
+        net->ipv4.mrt = NULL;
+        rtnl_unlock();
 }
 #endif
 
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 99e810f84671..cf5e82f39d3b 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -272,9 +272,9 @@ static void trace_packet(const struct sk_buff *skb,
                     &chainname, &comment, &rulenum) != 0)
                         break;
 
-        nf_log_packet(net, AF_INET, hook, skb, in, out, &trace_loginfo,
-                      "TRACE: %s:%s:%s:%u ",
-                      tablename, chainname, comment, rulenum);
+        nf_log_trace(net, AF_INET, hook, skb, in, out, &trace_loginfo,
+                     "TRACE: %s:%s:%s:%u ",
+                     tablename, chainname, comment, rulenum);
 }
 #endif
 
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index e9f66e1cda50..208d5439e59b 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -259,6 +259,9 @@ int ping_init_sock(struct sock *sk)
         kgid_t low, high;
         int ret = 0;
 
+        if (sk->sk_family == AF_INET6)
+                sk->sk_ipv6only = 1;
+
         inet_get_ping_group_range_net(net, &low, &high);
         if (gid_lte(low, group) && gid_lte(group, high))
                 return 0;
@@ -305,6 +308,11 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
                 if (addr_len < sizeof(*addr))
                         return -EINVAL;
 
+                if (addr->sin_family != AF_INET &&
+                    !(addr->sin_family == AF_UNSPEC &&
+                      addr->sin_addr.s_addr == htonl(INADDR_ANY)))
+                        return -EAFNOSUPPORT;
+
                 pr_debug("ping_check_bind_addr(sk=%p,addr=%pI4,port=%d)\n",
                          sk, &addr->sin_addr.s_addr, ntohs(addr->sin_port));
 
@@ -330,7 +338,7 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
                         return -EINVAL;
 
                 if (addr->sin6_family != AF_INET6)
-                        return -EINVAL;
+                        return -EAFNOSUPPORT;
 
                 pr_debug("ping_check_bind_addr(sk=%p,addr=%pI6c,port=%d)\n",
                          sk, addr->sin6_addr.s6_addr, ntohs(addr->sin6_port));
@@ -716,7 +724,7 @@ static int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
                 if (msg->msg_namelen < sizeof(*usin))
                         return -EINVAL;
                 if (usin->sin_family != AF_INET)
-                        return -EINVAL;
+                        return -EAFNOSUPPORT;
                 daddr = usin->sin_addr.s_addr;
                 /* no remote port */
         } else {
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 9d72a0fcd928..995a2259bcfc 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -835,17 +835,13 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now,
                                        int large_allowed)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        u32 new_size_goal, size_goal, hlen;
+        u32 new_size_goal, size_goal;
 
         if (!large_allowed || !sk_can_gso(sk))
                 return mss_now;
 
-        /* Maybe we should/could use sk->sk_prot->max_header here ? */
-        hlen = inet_csk(sk)->icsk_af_ops->net_header_len +
-               inet_csk(sk)->icsk_ext_hdr_len +
-               tp->tcp_header_len;
-
-        new_size_goal = sk->sk_gso_max_size - 1 - hlen;
+        /* Note : tcp_tso_autosize() will eventually split this later */
+        new_size_goal = sk->sk_gso_max_size - 1 - MAX_TCP_HEADER;
         new_size_goal = tcp_bound_to_half_wnd(tp, new_size_goal);
 
         /* We try hard to avoid divides here */
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index d694088214cd..62856e185a93 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -378,6 +378,12 @@ EXPORT_SYMBOL_GPL(tcp_slow_start);
  */
 void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked)
 {
+        /* If credits accumulated at a higher w, apply them gently now. */
+        if (tp->snd_cwnd_cnt >= w) {
+                tp->snd_cwnd_cnt = 0;
+                tp->snd_cwnd++;
+        }
+
         tp->snd_cwnd_cnt += acked;
         if (tp->snd_cwnd_cnt >= w) {
                 u32 delta = tp->snd_cwnd_cnt / w;
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index 4b276d1ed980..06d3d665a9fd 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -306,8 +306,10 @@ tcp_friendliness:
                 }
         }
 
-        if (ca->cnt == 0)                       /* cannot be zero */
-                ca->cnt = 1;
+        /* The maximum rate of cwnd increase CUBIC allows is 1 packet per
+         * 2 packets ACKed, meaning cwnd grows at 1.5x per RTT.
+         */
+        ca->cnt = max(ca->cnt, 2U);
 }
 
 static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 8fdd27b17306..f501ac048366 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3105,10 +3105,11 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                         if (!first_ackt.v64)
                                 first_ackt = last_ackt;
 
-                        if (!(sacked & TCPCB_SACKED_ACKED))
+                        if (!(sacked & TCPCB_SACKED_ACKED)) {
                                 reord = min(pkts_acked, reord);
-                        if (!after(scb->end_seq, tp->high_seq))
-                                flag |= FLAG_ORIG_SACK_ACKED;
+                                if (!after(scb->end_seq, tp->high_seq))
+                                        flag |= FLAG_ORIG_SACK_ACKED;
+                        }
                 }
 
                 if (sacked & TCPCB_SACKED_ACKED)
@@ -4770,7 +4771,7 @@ static bool tcp_should_expand_sndbuf(const struct sock *sk)
                 return false;
 
         /* If we filled the congestion window, do not expand.  */
-        if (tp->packets_out >= tp->snd_cwnd)
+        if (tcp_packets_in_flight(tp) >= tp->snd_cwnd)
                 return false;
 
         return true;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5a2dfed4783b..f1756ee02207 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1518,7 +1518,7 @@ void tcp_v4_early_demux(struct sk_buff *skb)
                 skb->sk = sk;
                 skb->destructor = sock_edemux;
                 if (sk->sk_state != TCP_TIME_WAIT) {
-                        struct dst_entry *dst = sk->sk_rx_dst;
+                        struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
 
                         if (dst)
                                 dst = dst_check(dst, 0);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a2a796c5536b..1db253e36045 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2773,15 +2773,11 @@ void tcp_send_fin(struct sock *sk)
         } else {
                 /* Socket is locked, keep trying until memory is available. */
                 for (;;) {
-                        skb = alloc_skb_fclone(MAX_TCP_HEADER,
-                                               sk->sk_allocation);
+                        skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
                         if (skb)
                                 break;
                         yield();
                 }
-
-                /* Reserve space for headers and prepare control bits. */
-                skb_reserve(skb, MAX_TCP_HEADER);
                 /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
                 tcp_init_nondata_skb(skb, tp->write_seq,
                                      TCPHDR_ACK | TCPHDR_FIN);
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index d5f6bd9a210a..dab73813cb92 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -63,6 +63,7 @@ int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
                 return err;
 
         IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE;
+        skb->protocol = htons(ETH_P_IP);
 
         return x->outer_mode->output2(x, skb);
 }
@@ -71,7 +72,6 @@ EXPORT_SYMBOL(xfrm4_prepare_output);
 int xfrm4_output_finish(struct sk_buff *skb)
 {
         memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
-        skb->protocol = htons(ETH_P_IP);
 
 #ifdef CONFIG_NETFILTER
         IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 98e4a63d72bb..b6030025f411 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4903,6 +4903,21 @@ int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
         return ret;
 }
 
+static
+int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
+                        void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        struct inet6_dev *idev = ctl->extra1;
+        int min_mtu = IPV6_MIN_MTU;
+        struct ctl_table lctl;
+
+        lctl = *ctl;
+        lctl.extra1 = &min_mtu;
+        lctl.extra2 = idev ? &idev->dev->mtu : NULL;
+
+        return proc_dointvec_minmax(&lctl, write, buffer, lenp, ppos);
+}
+
 static void dev_disable_change(struct inet6_dev *idev)
 {
         struct netdev_notifier_info info;
@@ -5054,7 +5069,7 @@ static struct addrconf_sysctl_table
                         .data           = &ipv6_devconf.mtu6,
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .proc_handler   = addrconf_sysctl_mtu,
                 },
                 {
                         .procname       = "accept_ra",
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index c215be70cac0..ace8daca5c83 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -325,14 +325,34 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu)
         kfree_skb(skb);
 }
 
-static void ip6_datagram_prepare_pktinfo_errqueue(struct sk_buff *skb)
+/* IPv6 supports cmsg on all origins aside from SO_EE_ORIGIN_LOCAL.
+ *
+ * At one point, excluding local errors was a quick test to identify icmp/icmp6
+ * errors. This is no longer true, but the test remained, so the v6 stack,
+ * unlike v4, also honors cmsg requests on all wifi and timestamp errors.
+ *
+ * Timestamp code paths do not initialize the fields expected by cmsg:
+ * the PKTINFO fields in skb->cb[]. Fill those in here.
+ */
+static bool ip6_datagram_support_cmsg(struct sk_buff *skb,
+                                      struct sock_exterr_skb *serr)
 {
-        int ifindex = skb->dev ? skb->dev->ifindex : -1;
+        if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP ||
+            serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6)
+                return true;
+
+        if (serr->ee.ee_origin == SO_EE_ORIGIN_LOCAL)
+                return false;
+
+        if (!skb->dev)
+                return false;
 
         if (skb->protocol == htons(ETH_P_IPV6))
-                IP6CB(skb)->iif = ifindex;
+                IP6CB(skb)->iif = skb->dev->ifindex;
         else
-                PKTINFO_SKB_CB(skb)->ipi_ifindex = ifindex;
+                PKTINFO_SKB_CB(skb)->ipi_ifindex = skb->dev->ifindex;
+
+        return true;
 }
 
 /*
@@ -369,7 +389,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 
         serr = SKB_EXT_ERR(skb);
 
-        if (sin && skb->len) {
+        if (sin && serr->port) {
                 const unsigned char *nh = skb_network_header(skb);
                 sin->sin6_family = AF_INET6;
                 sin->sin6_flowinfo = 0;
@@ -394,14 +414,11 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
         memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
         sin = &errhdr.offender;
         memset(sin, 0, sizeof(*sin));
-        if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL && skb->len) {
+
+        if (ip6_datagram_support_cmsg(skb, serr)) {
                 sin->sin6_family = AF_INET6;
-                if (np->rxopt.all) {
-                        if (serr->ee.ee_origin != SO_EE_ORIGIN_ICMP &&
-                            serr->ee.ee_origin != SO_EE_ORIGIN_ICMP6)
-                                ip6_datagram_prepare_pktinfo_errqueue(skb);
+                if (np->rxopt.all)
                         ip6_datagram_recv_common_ctl(sk, msg, skb);
-                }
                 if (skb->protocol == htons(ETH_P_IPV6)) {
                         sin->sin6_addr = ipv6_hdr(skb)->saddr;
                         if (np->rxopt.all)
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index b4d5e1d97c1b..70bc6abc0639 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -104,6 +104,7 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                                 goto again;
                         flp6->saddr = saddr;
                 }
+                err = rt->dst.error;
                 goto out;
         }
 again:
@@ -321,7 +322,9 @@ out_fib6_rules_ops:
 
 static void __net_exit fib6_rules_net_exit(struct net *net)
 {
+        rtnl_lock();
         fib_rules_unregister(net->ipv6.fib6_rules_ops);
+        rtnl_unlock();
 }
 
 static struct pernet_operations fib6_rules_net_ops = {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7deebf102cba..36cf0ab685a0 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -318,6 +318,7 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)
 
 static inline int ip6_forward_finish(struct sk_buff *skb)
 {
+        skb_sender_cpu_clear(skb);
         return dst_output(skb);
 }
 
@@ -541,7 +542,8 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 {
         struct sk_buff *frag;
         struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
-        struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
+        struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
+                                inet6_sk(skb->sk) : NULL;
         struct ipv6hdr *tmp_hdr;
         struct frag_hdr *fh;
         unsigned int mtu, hlen, left, len;
@@ -1298,7 +1300,8 @@ emsgsize:
         if (((length > mtu) ||
              (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->dst.dev->features & NETIF_F_UFO)) {
+            (rt->dst.dev->features & NETIF_F_UFO) &&
+            (sk->sk_type == SOCK_DGRAM)) {
                 err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
                                           hh_len, fragheaderlen,
                                           transhdrlen, mtu, flags, rt);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 266a264ec212..ddd94eca19b3 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -314,7 +314,7 @@ out:
  *   Create tunnel matching given parameters.
  *
  * Return:
- *   created tunnel or NULL
+ *   created tunnel or error pointer
  **/
 
 static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
@@ -322,7 +322,7 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
         struct net_device *dev;
         struct ip6_tnl *t;
         char name[IFNAMSIZ];
-        int err;
+        int err = -ENOMEM;
 
         if (p->name[0])
                 strlcpy(name, p->name, IFNAMSIZ);
@@ -348,7 +348,7 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
 failed_free:
         ip6_dev_free(dev);
 failed:
-        return NULL;
+        return ERR_PTR(err);
 }
 
 /**
@@ -362,7 +362,7 @@ failed:
  *   tunnel device is created and registered for use.
  *
  * Return:
- *   matching tunnel or NULL
+ *   matching tunnel or error pointer
  **/
 
 static struct ip6_tnl *ip6_tnl_locate(struct net *net,
@@ -380,13 +380,13 @@ static struct ip6_tnl *ip6_tnl_locate(struct net *net,
                 if (ipv6_addr_equal(local, &t->parms.laddr) &&
                     ipv6_addr_equal(remote, &t->parms.raddr)) {
                         if (create)
-                                return NULL;
+                                return ERR_PTR(-EEXIST);
 
                         return t;
                 }
         }
         if (!create)
-                return NULL;
+                return ERR_PTR(-ENODEV);
         return ip6_tnl_create(net, p);
 }
 
@@ -1420,7 +1420,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         }
                         ip6_tnl_parm_from_user(&p1, &p);
                         t = ip6_tnl_locate(net, &p1, 0);
-                        if (t == NULL)
+                        if (IS_ERR(t))
                                 t = netdev_priv(dev);
                 } else {
                         memset(&p, 0, sizeof(p));
@@ -1445,7 +1445,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 ip6_tnl_parm_from_user(&p1, &p);
                 t = ip6_tnl_locate(net, &p1, cmd == SIOCADDTUNNEL);
                 if (cmd == SIOCCHGTUNNEL) {
-                        if (t != NULL) {
+                        if (!IS_ERR(t)) {
                                 if (t->dev != dev) {
                                         err = -EEXIST;
                                         break;
@@ -1457,14 +1457,15 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         else
                                 err = ip6_tnl_update(t, &p1);
                 }
-                if (t) {
+                if (!IS_ERR(t)) {
                         err = 0;
                         ip6_tnl_parm_to_user(&p, &t->parms);
                         if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
                                 err = -EFAULT;
 
-                } else
-                        err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
+                } else {
+                        err = PTR_ERR(t);
+                }
                 break;
         case SIOCDELTUNNEL:
                 err = -EPERM;
@@ -1478,7 +1479,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         err = -ENOENT;
                         ip6_tnl_parm_from_user(&p1, &p);
                         t = ip6_tnl_locate(net, &p1, 0);
-                        if (t == NULL)
+                        if (IS_ERR(t))
                                 break;
                         err = -EPERM;
                         if (t->dev == ip6n->fb_tnl_dev)
@@ -1672,12 +1673,13 @@ static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
                            struct nlattr *tb[], struct nlattr *data[])
 {
         struct net *net = dev_net(dev);
-        struct ip6_tnl *nt;
+        struct ip6_tnl *nt, *t;
 
         nt = netdev_priv(dev);
         ip6_tnl_netlink_parms(data, &nt->parms);
 
-        if (ip6_tnl_locate(net, &nt->parms, 0))
+        t = ip6_tnl_locate(net, &nt->parms, 0);
+        if (!IS_ERR(t))
                 return -EEXIST;
 
         return ip6_tnl_create2(dev);
@@ -1697,8 +1699,7 @@ static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
         ip6_tnl_netlink_parms(data, &p);
 
         t = ip6_tnl_locate(net, &p, 0);
-
-        if (t) {
+        if (!IS_ERR(t)) {
                 if (t->dev != dev)
                         return -EEXIST;
         } else
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 34b682617f50..312e0ff47339 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -252,7 +252,7 @@ static int __net_init ip6mr_rules_init(struct net *net)
         return 0;
 
 err2:
-        kfree(mrt);
+        ip6mr_free_table(mrt);
 err1:
         fib_rules_unregister(ops);
         return err;
@@ -267,8 +267,8 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
                 list_del(&mrt->list);
                 ip6mr_free_table(mrt);
         }
-        rtnl_unlock();
         fib_rules_unregister(net->ipv6.mr6_rules_ops);
+        rtnl_unlock();
 }
 #else
 #define ip6mr_for_each_table(mrt, net) \
@@ -336,7 +336,7 @@ static struct mr6_table *ip6mr_new_table(struct net *net, u32 id)
 
 static void ip6mr_free_table(struct mr6_table *mrt)
 {
-        del_timer(&mrt->ipmr_expire_timer);
+        del_timer_sync(&mrt->ipmr_expire_timer);
         mroute_clean_tables(mrt);
         kfree(mrt);
 }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 471ed24aabae..14ecdaf06bf7 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1218,7 +1218,14 @@ static void ndisc_router_discovery(struct sk_buff *skb)
         if (rt)
                 rt6_set_expires(rt, jiffies + (HZ * lifetime));
         if (ra_msg->icmph.icmp6_hop_limit) {
-                in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+                /* Only set hop_limit on the interface if it is higher than
+                 * the current hop_limit.
+                 */
+                if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
+                        in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
+                } else {
+                        ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
+                }
                 if (rt)
                         dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
                                        ra_msg->icmph.icmp6_hop_limit);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index e080fbbbc0e5..bb00c6f2a885 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -298,9 +298,9 @@ static void trace_packet(const struct sk_buff *skb,
                     &chainname, &comment, &rulenum) != 0)
                         break;
 
-        nf_log_packet(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
-                      "TRACE: %s:%s:%s:%u ",
-                      tablename, chainname, comment, rulenum);
+        nf_log_trace(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
+                     "TRACE: %s:%s:%s:%u ",
+                     tablename, chainname, comment, rulenum);
 }
 #endif
 
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index bd46f736f61d..a2dfff6ff227 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -102,9 +102,10 @@ int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         if (msg->msg_name) {
                 DECLARE_SOCKADDR(struct sockaddr_in6 *, u, msg->msg_name);
-                if (msg->msg_namelen < sizeof(struct sockaddr_in6) ||
-                    u->sin6_family != AF_INET6) {
+                if (msg->msg_namelen < sizeof(*u))
                         return -EINVAL;
+                if (u->sin6_family != AF_INET6) {
+                        return -EAFNOSUPPORT;
                 }
                 if (sk->sk_bound_dev_if &&
                     sk->sk_bound_dev_if != u->sin6_scope_id) {
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 5d46832c6f72..1f5e62229aaa 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1411,6 +1411,15 @@ static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
         TCP_SKB_CB(skb)->sacked = 0;
 }
 
+static void tcp_v6_restore_cb(struct sk_buff *skb)
+{
+        /* We need to move header back to the beginning if xfrm6_policy_check()
+         * and tcp_v6_fill_cb() are going to be called again.
+         */
+        memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
+                sizeof(struct inet6_skb_parm));
+}
+
 static int tcp_v6_rcv(struct sk_buff *skb)
 {
         const struct tcphdr *th;
@@ -1543,6 +1552,7 @@ do_time_wait:
                         inet_twsk_deschedule(tw, &tcp_death_row);
                         inet_twsk_put(tw);
                         sk = sk2;
+                        tcp_v6_restore_cb(skb);
                         goto process;
                 }
                 /* Fall through to ACK */
@@ -1551,6 +1561,7 @@ do_time_wait:
                 tcp_v6_timewait_ack(sk, skb);
                 break;
         case TCP_TW_RST:
+                tcp_v6_restore_cb(skb);
                 goto no_tcp_socket;
         case TCP_TW_SUCCESS:
                 ;
@@ -1585,7 +1596,7 @@ static void tcp_v6_early_demux(struct sk_buff *skb)
                 skb->sk = sk;
                 skb->destructor = sock_edemux;
                 if (sk->sk_state != TCP_TIME_WAIT) {
-                        struct dst_entry *dst = sk->sk_rx_dst;
+                        struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
 
                         if (dst)
                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index ab889bb16b3c..be2c0ba82c85 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -112,11 +112,9 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                 fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
                 fptr->nexthdr = nexthdr;
                 fptr->reserved = 0;
-                if (skb_shinfo(skb)->ip6_frag_id)
-                        fptr->identification = skb_shinfo(skb)->ip6_frag_id;
-                else
-                        ipv6_select_ident(fptr,
-                                          (struct rt6_info *)skb_dst(skb));
+                if (!skb_shinfo(skb)->ip6_frag_id)
+                        ipv6_proxy_select_ident(skb);
+                fptr->identification = skb_shinfo(skb)->ip6_frag_id;
 
                 /* Fragment the skb. ipv6 header and the remaining fields of the
                  * fragment header are updated in ipv6_gso_segment()
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index ca3f29b98ae5..010f8bd2d577 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -114,6 +114,7 @@ int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
                 return err;
 
         skb->ignore_df = 1;
+        skb->protocol = htons(ETH_P_IPV6);
 
         return x->outer_mode->output2(x, skb);
 }
@@ -122,7 +123,6 @@ EXPORT_SYMBOL(xfrm6_prepare_output);
 int xfrm6_output_finish(struct sk_buff *skb)
 {
         memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
-        skb->protocol = htons(ETH_P_IPV6);
 
 #ifdef CONFIG_NETFILTER
         IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 48bf5a06847b..8d2d01b4800a 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -200,6 +200,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
 
 #if IS_ENABLED(CONFIG_IPV6_MIP6)
                 case IPPROTO_MH:
+                        offset += ipv6_optlen(exthdr);
                         if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
                                 struct ip6_mh *mh;
 
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index 40695b9751c1..683346d2d633 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -798,7 +798,9 @@ static void ircomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
         orig_jiffies = jiffies;
 
         /* Set poll time to 200 ms */
-        poll_time = IRDA_MIN(timeout, msecs_to_jiffies(200));
+        poll_time = msecs_to_jiffies(200);
+        if (timeout)
+                poll_time = min_t(unsigned long, timeout, poll_time);
 
         spin_lock_irqsave(&self->spinlock, flags);
         while (self->tx_skb && self->tx_skb->len) {
@@ -811,7 +813,7 @@ static void ircomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
                         break;
         }
         spin_unlock_irqrestore(&self->spinlock, flags);
-        current->state = TASK_RUNNING;
+        __set_current_state(TASK_RUNNING);
 }
 
 /*
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 3c83a1e5ab03..1215693fdd22 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -305,7 +305,7 @@ irnet_ctrl_read(irnet_socket *	ap,
 
   /* Put ourselves on the wait queue to be woken up */
   add_wait_queue(&irnet_events.rwait, &wait);
-  current->state = TASK_INTERRUPTIBLE;
+  set_current_state(TASK_INTERRUPTIBLE);
   for(;;)
     {
       /* If there is unread events */
@@ -321,7 +321,7 @@ irnet_ctrl_read(irnet_socket *	ap,
       /* Yield and wait to be woken up */
       schedule();
     }
-  current->state = TASK_RUNNING;
+  __set_current_state(TASK_RUNNING);
   remove_wait_queue(&irnet_events.rwait, &wait);
 
   /* Did we got it ? */
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 2e9953b2db84..53d931172088 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1114,10 +1114,8 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                         noblock, &err);
         else
                 skb = sock_alloc_send_skb(sk, len, noblock, &err);
-        if (!skb) {
-                err = -ENOMEM;
+        if (!skb)
                 goto out;
-        }
         if (iucv->transport == AF_IUCV_TRANS_HIPER)
                 skb_reserve(skb, sizeof(struct af_iucv_trans_hdr) + ETH_HLEN);
         if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 895348e44c7d..a29a504492af 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1871,6 +1871,7 @@ static int __init l2tp_init(void)
         l2tp_wq = alloc_workqueue("l2tp", WQ_UNBOUND, 0);
         if (!l2tp_wq) {
                 pr_err("alloc_workqueue failed\n");
+                unregister_pernet_device(&l2tp_net_ops);
                 rc = -ENOMEM;
                 goto out;
         }
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index a48bad468880..7702978a4c99 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -49,8 +49,6 @@ static void ieee80211_free_tid_rx(struct rcu_head *h)
                 container_of(h, struct tid_ampdu_rx, rcu_head);
         int i;
 
-        del_timer_sync(&tid_rx->reorder_timer);
-
         for (i = 0; i < tid_rx->buf_size; i++)
                 __skb_queue_purge(&tid_rx->reorder_buf[i]);
         kfree(tid_rx->reorder_buf);
@@ -93,6 +91,12 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
 
         del_timer_sync(&tid_rx->session_timer);
 
+        /* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */
+        spin_lock_bh(&tid_rx->reorder_lock);
+        tid_rx->removed = true;
+        spin_unlock_bh(&tid_rx->reorder_lock);
+        del_timer_sync(&tid_rx->reorder_timer);
+
         call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
 }
 
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index ff0d2db09df9..5bcd4e5589d3 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -1508,6 +1508,8 @@ static void __ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
         if (ieee80211_chanctx_refcount(local, ctx) == 0)
                 ieee80211_free_chanctx(local, ctx);
 
+        sdata->radar_required = false;
+
         /* Unreserving may ready an in-place reservation. */
         if (use_reserved_switch)
                 ieee80211_vif_use_reserved_switch(local);
@@ -1566,6 +1568,9 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
         ieee80211_recalc_smps_chanctx(local, ctx);
         ieee80211_recalc_radar_chanctx(local, ctx);
  out:
+        if (ret)
+                sdata->radar_required = false;
+
         mutex_unlock(&local->chanctx_mtx);
         return ret;
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 3afe36824703..8d53d65bd2ab 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -58,13 +58,24 @@ struct ieee80211_local;
 #define IEEE80211_UNSET_POWER_LEVEL     INT_MIN
 
 /*
- * Some APs experience problems when working with U-APSD. Decrease the
- * probability of that happening by using legacy mode for all ACs but VO.
- * The AP that caused us trouble was a Cisco 4410N. It ignores our
- * setting, and always treats non-VO ACs as legacy.
+ * Some APs experience problems when working with U-APSD. Decreasing the
+ * probability of that happening by using legacy mode for all ACs but VO isn't
+ * enough.
+ *
+ * Cisco 4410N originally forced us to enable VO by default only because it
+ * treated non-VO ACs as legacy.
+ *
+ * However some APs (notably Netgear R7000) silently reclassify packets to
+ * different ACs. Since u-APSD ACs require trigger frames for frame retrieval
+ * clients would never see some frames (e.g. ARP responses) or would fetch them
+ * accidentally after a long time.
+ *
+ * It makes little sense to enable u-APSD queues by default because it needs
+ * userspace applications to be aware of it to actually take advantage of the
+ * possible additional powersavings. Implicitly depending on driver autotrigger
+ * frame support doesn't make much sense.
  */
-#define IEEE80211_DEFAULT_UAPSD_QUEUES \
-        IEEE80211_WMM_IE_STA_QOSINFO_AC_VO
+#define IEEE80211_DEFAULT_UAPSD_QUEUES 0
 
 #define IEEE80211_DEFAULT_MAX_SP_LEN            \
         IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL
@@ -453,6 +464,7 @@ struct ieee80211_if_managed {
         unsigned int flags;
 
         bool csa_waiting_bcn;
+        bool csa_ignored_same_chan;
 
         bool beacon_crc_valid;
         u32 beacon_crc;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 10ac6324c1d0..142f66aece18 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1150,6 +1150,17 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                 return;
         }
 
+        if (cfg80211_chandef_identical(&csa_ie.chandef,
+                                       &sdata->vif.bss_conf.chandef)) {
+                if (ifmgd->csa_ignored_same_chan)
+                        return;
+                sdata_info(sdata,
+                           "AP %pM tries to chanswitch to same channel, ignore\n",
+                           ifmgd->associated->bssid);
+                ifmgd->csa_ignored_same_chan = true;
+                return;
+        }
+
         mutex_lock(&local->mtx);
         mutex_lock(&local->chanctx_mtx);
         conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
@@ -1210,6 +1221,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         sdata->vif.csa_active = true;
         sdata->csa_chandef = csa_ie.chandef;
         sdata->csa_block_tx = csa_ie.mode;
+        ifmgd->csa_ignored_same_chan = false;
 
         if (sdata->csa_block_tx)
                 ieee80211_stop_vif_queues(local, sdata,
@@ -2090,6 +2102,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         sdata->vif.csa_active = false;
         ifmgd->csa_waiting_bcn = false;
+        ifmgd->csa_ignored_same_chan = false;
         if (sdata->csa_block_tx) {
                 ieee80211_wake_vif_queues(local, sdata,
                                           IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -3204,7 +3217,8 @@ static const u64 care_about_ies =
         (1ULL << WLAN_EID_CHANNEL_SWITCH) |
         (1ULL << WLAN_EID_PWR_CONSTRAINT) |
         (1ULL << WLAN_EID_HT_CAPABILITY) |
-        (1ULL << WLAN_EID_HT_OPERATION);
+        (1ULL << WLAN_EID_HT_OPERATION) |
+        (1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
 
 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_mgmt *mgmt, size_t len,
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 7c86a002df95..ef6e8a6c4253 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -373,7 +373,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
                 rate++;
                 mi->sample_deferred++;
         } else {
-                if (!msr->sample_limit != 0)
+                if (!msr->sample_limit)
                         return;
 
                 mi->sample_packets++;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 1101563357ea..1eb730bf8752 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -873,9 +873,10 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
 
  set_release_timer:
 
-                mod_timer(&tid_agg_rx->reorder_timer,
-                          tid_agg_rx->reorder_time[j] + 1 +
-                          HT_RX_REORDER_BUF_TIMEOUT);
+                if (!tid_agg_rx->removed)
+                        mod_timer(&tid_agg_rx->reorder_timer,
+                                  tid_agg_rx->reorder_time[j] + 1 +
+                                  HT_RX_REORDER_BUF_TIMEOUT);
         } else {
                 del_timer(&tid_agg_rx->reorder_timer);
         }
@@ -2214,6 +2215,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
         hdr = (struct ieee80211_hdr *) skb->data;
         mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
 
+        if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
+                return RX_DROP_MONITOR;
+
         /* frame is in RMC, don't forward */
         if (ieee80211_is_data(hdr->frame_control) &&
             is_multicast_ether_addr(hdr->addr1) &&
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 925e68fe64c7..fb0fc1302a58 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -175,6 +175,7 @@ struct tid_ampdu_tx {
  * @reorder_lock: serializes access to reorder buffer, see below.
  * @auto_seq: used for offloaded BA sessions to automatically pick head_seq_and
  *      and ssn.
+ * @removed: this session is removed (but might have been found due to RCU)
  *
  * This structure's lifetime is managed by RCU, assignments to
  * the array holding it must hold the aggregation mutex.
@@ -199,6 +200,7 @@ struct tid_ampdu_rx {
         u16 timeout;
         u8 dialog_token;
         bool auto_seq;
+        bool removed;
 };
 
 /**
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 88a18ffe2975..07bd8db00af8 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -566,6 +566,7 @@ ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
                 if (tx->sdata->control_port_no_encrypt)
                         info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
                 info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
+                info->flags |= IEEE80211_TX_CTL_USE_MINRATE;
         }
 
         return TX_CONTINUE;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 8428f4a95479..747bdcf72e92 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -3178,7 +3178,7 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
                 wdev_iter = &sdata_iter->wdev;
 
                 if (sdata_iter == sdata ||
-                    rcu_access_pointer(sdata_iter->vif.chanctx_conf) == NULL ||
+                    !ieee80211_sdata_running(sdata_iter) ||
                     local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
                         continue;
 
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index e55759056361..ed99448671c3 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3402,7 +3402,7 @@ static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
                 if (udest.af == 0)
                         udest.af = svc->af;
 
-                if (udest.af != svc->af) {
+                if (udest.af != svc->af && cmd != IPVS_CMD_DEL_DEST) {
                         /* The synchronization protocol is incompatible
                          * with mixed family services
                          */
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index c47ffd7a0a70..d93ceeb3ef04 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -896,6 +896,8 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
                         IP_VS_DBG(2, "BACKUP, add new conn. failed\n");
                         return;
                 }
+                if (!(flags & IP_VS_CONN_F_TEMPLATE))
+                        kfree(param->pe_data);
         }
 
         if (opt)
@@ -1169,6 +1171,7 @@ static inline int ip_vs_proc_sync_conn(struct net *net, __u8 *p, __u8 *msg_end)
                                 (opt_flags & IPVS_OPT_F_SEQ_DATA ? &opt : NULL)
                                 );
 #endif
+        ip_vs_pe_put(param.pe);
         return 0;
         /* Error exit */
 out:
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 0d8448f19dfe..675d12c69e32 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -212,6 +212,30 @@ void nf_log_packet(struct net *net,
 }
 EXPORT_SYMBOL(nf_log_packet);
 
+void nf_log_trace(struct net *net,
+                  u_int8_t pf,
+                  unsigned int hooknum,
+                  const struct sk_buff *skb,
+                  const struct net_device *in,
+                  const struct net_device *out,
+                  const struct nf_loginfo *loginfo, const char *fmt, ...)
+{
+        va_list args;
+        char prefix[NF_LOG_PREFIXLEN];
+        const struct nf_logger *logger;
+
+        rcu_read_lock();
+        logger = rcu_dereference(net->nf.nf_loggers[pf]);
+        if (logger) {
+                va_start(args, fmt);
+                vsnprintf(prefix, sizeof(prefix), fmt, args);
+                va_end(args);
+                logger->logfn(net, pf, hooknum, skb, in, out, loginfo, prefix);
+        }
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(nf_log_trace);
+
 #define S_SIZE (1024 - (sizeof(unsigned int) + 1))
 
 struct nf_log_buf {
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 199fd0f27b0e..ac1a9528dbf2 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -227,7 +227,7 @@ nft_rule_deactivate_next(struct net *net, struct nft_rule *rule)
 
 static inline void nft_rule_clear(struct net *net, struct nft_rule *rule)
 {
-        rule->genmask = 0;
+        rule->genmask &= ~(1 << gencursor_next(net));
 }
 
 static int
@@ -1225,7 +1225,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
 
         if (nla[NFTA_CHAIN_POLICY]) {
                 if ((chain != NULL &&
-                    !(chain->flags & NFT_BASE_CHAIN)) ||
+                    !(chain->flags & NFT_BASE_CHAIN)))
+                        return -EOPNOTSUPP;
+
+                if (chain == NULL &&
                     nla[NFTA_CHAIN_HOOK] == NULL)
                         return -EOPNOTSUPP;
 
@@ -1711,9 +1714,12 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
         }
         nla_nest_end(skb, list);
 
-        if (rule->ulen &&
-            nla_put(skb, NFTA_RULE_USERDATA, rule->ulen, nft_userdata(rule)))
-                goto nla_put_failure;
+        if (rule->udata) {
+                struct nft_userdata *udata = nft_userdata(rule);
+                if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
+                            udata->data) < 0)
+                        goto nla_put_failure;
+        }
 
         nlmsg_end(skb, nlh);
         return 0;
@@ -1896,11 +1902,12 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
         struct nft_table *table;
         struct nft_chain *chain;
         struct nft_rule *rule, *old_rule = NULL;
+        struct nft_userdata *udata;
         struct nft_trans *trans = NULL;
         struct nft_expr *expr;
         struct nft_ctx ctx;
         struct nlattr *tmp;
-        unsigned int size, i, n, ulen = 0;
+        unsigned int size, i, n, ulen = 0, usize = 0;
         int err, rem;
         bool create;
         u64 handle, pos_handle;
@@ -1968,12 +1975,19 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
                         n++;
                 }
         }
+        /* Check for overflow of dlen field */
+        err = -EFBIG;
+        if (size >= 1 << 12)
+                goto err1;
 
-        if (nla[NFTA_RULE_USERDATA])
+        if (nla[NFTA_RULE_USERDATA]) {
                 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
+                if (ulen > 0)
+                        usize = sizeof(struct nft_userdata) + ulen;
+        }
 
         err = -ENOMEM;
-        rule = kzalloc(sizeof(*rule) + size + ulen, GFP_KERNEL);
+        rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
         if (rule == NULL)
                 goto err1;
 
@@ -1981,10 +1995,13 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
 
         rule->handle = handle;
         rule->dlen   = size;
-        rule->ulen   = ulen;
+        rule->udata  = ulen ? 1 : 0;
 
-        if (ulen)
-                nla_memcpy(nft_userdata(rule), nla[NFTA_RULE_USERDATA], ulen);
+        if (ulen) {
+                udata = nft_userdata(rule);
+                udata->len = ulen - 1;
+                nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
+        }
 
         expr = nft_expr_first(rule);
         for (i = 0; i < n; i++) {
@@ -2031,12 +2048,6 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
 
 err3:
         list_del_rcu(&rule->list);
-        if (trans) {
-                list_del_rcu(&nft_trans_rule(trans)->list);
-                nft_rule_clear(net, nft_trans_rule(trans));
-                nft_trans_destroy(trans);
-                chain->use++;
-        }
 err2:
         nf_tables_rule_destroy(&ctx, rule);
 err1:
@@ -3612,12 +3623,11 @@ static int nf_tables_commit(struct sk_buff *skb)
                                                  &te->elem,
                                                  NFT_MSG_DELSETELEM, 0);
                         te->set->ops->get(te->set, &te->elem);
-                        te->set->ops->remove(te->set, &te->elem);
                         nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
-                        if (te->elem.flags & NFT_SET_MAP) {
-                                nft_data_uninit(&te->elem.data,
-                                                te->set->dtype);
-                        }
+                        if (te->set->flags & NFT_SET_MAP &&
+                            !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
+                                nft_data_uninit(&te->elem.data, te->set->dtype);
+                        te->set->ops->remove(te->set, &te->elem);
                         nft_trans_destroy(trans);
                         break;
                 }
@@ -3658,7 +3668,7 @@ static int nf_tables_abort(struct sk_buff *skb)
 {
         struct net *net = sock_net(skb->sk);
         struct nft_trans *trans, *next;
-        struct nft_set *set;
+        struct nft_trans_elem *te;
 
         list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
                 switch (trans->msg_type) {
@@ -3719,9 +3729,13 @@ static int nf_tables_abort(struct sk_buff *skb)
                         break;
                 case NFT_MSG_NEWSETELEM:
                         nft_trans_elem_set(trans)->nelems--;
-                        set = nft_trans_elem_set(trans);
-                        set->ops->get(set, &nft_trans_elem(trans));
-                        set->ops->remove(set, &nft_trans_elem(trans));
+                        te = (struct nft_trans_elem *)trans->data;
+                        te->set->ops->get(te->set, &te->elem);
+                        nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
+                        if (te->set->flags & NFT_SET_MAP &&
+                            !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
+                                nft_data_uninit(&te->elem.data, te->set->dtype);
+                        te->set->ops->remove(te->set, &te->elem);
                         nft_trans_destroy(trans);
                         break;
                 case NFT_MSG_DELSETELEM:
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 3b90eb2b2c55..2d298dccb6dd 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -94,10 +94,10 @@ static void nft_trace_packet(const struct nft_pktinfo *pkt,
 {
         struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
 
-        nf_log_packet(net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in,
-                      pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
-                      chain->table->name, chain->name, comments[type],
-                      rulenum);
+        nf_log_trace(net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in,
+                     pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
+                     chain->table->name, chain->name, comments[type],
+                     rulenum);
 }
 
 unsigned int
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index a5599fc51a6f..54330fb5efaf 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -77,6 +77,9 @@ nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple,
         if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM])
                 return -EINVAL;
 
+        /* Not all fields are initialized so first zero the tuple */
+        memset(tuple, 0, sizeof(struct nf_conntrack_tuple));
+
         tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));
         tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);
 
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index c598f74063a1..65f3e2b6be44 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -123,7 +123,7 @@ static void
 nft_target_set_tgchk_param(struct xt_tgchk_param *par,
                            const struct nft_ctx *ctx,
                            struct xt_target *target, void *info,
-                           union nft_entry *entry, u8 proto, bool inv)
+                           union nft_entry *entry, u16 proto, bool inv)
 {
         par->net        = ctx->net;
         par->table      = ctx->table->name;
@@ -133,11 +133,14 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
                 entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
                 break;
         case AF_INET6:
+                if (proto)
+                        entry->e6.ipv6.flags |= IP6T_F_PROTO;
+
                 entry->e6.ipv6.proto = proto;
                 entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                 break;
         case NFPROTO_BRIDGE:
-                entry->ebt.ethproto = proto;
+                entry->ebt.ethproto = (__force __be16)proto;
                 entry->ebt.invflags = inv ? EBT_IPROTO : 0;
                 break;
         }
@@ -171,7 +174,7 @@ static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1]
         [NFTA_RULE_COMPAT_FLAGS]        = { .type = NLA_U32 },
 };
 
-static int nft_parse_compat(const struct nlattr *attr, u8 *proto, bool *inv)
+static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv)
 {
         struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
         u32 flags;
@@ -203,7 +206,7 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
         struct xt_target *target = expr->ops->data;
         struct xt_tgchk_param par;
         size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO]));
-        u8 proto = 0;
+        u16 proto = 0;
         bool inv = false;
         union nft_entry e = {};
         int ret;
@@ -334,7 +337,7 @@ static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = {
 static void
 nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
                           struct xt_match *match, void *info,
-                          union nft_entry *entry, u8 proto, bool inv)
+                          union nft_entry *entry, u16 proto, bool inv)
 {
         par->net        = ctx->net;
         par->table      = ctx->table->name;
@@ -344,11 +347,14 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
                 entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
                 break;
         case AF_INET6:
+                if (proto)
+                        entry->e6.ipv6.flags |= IP6T_F_PROTO;
+
                 entry->e6.ipv6.proto = proto;
                 entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                 break;
         case NFPROTO_BRIDGE:
-                entry->ebt.ethproto = proto;
+                entry->ebt.ethproto = (__force __be16)proto;
                 entry->ebt.invflags = inv ? EBT_IPROTO : 0;
                 break;
         }
@@ -385,7 +391,7 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
         struct xt_match *match = expr->ops->data;
         struct xt_mtchk_param par;
         size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO]));
-        u8 proto = 0;
+        u16 proto = 0;
         bool inv = false;
         union nft_entry e = {};
         int ret;
@@ -625,8 +631,12 @@ nft_match_select_ops(const struct nft_ctx *ctx,
                 struct xt_match *match = nft_match->ops.data;
 
                 if (strcmp(match->name, mt_name) == 0 &&
-                    match->revision == rev && match->family == family)
+                    match->revision == rev && match->family == family) {
+                        if (!try_module_get(match->me))
+                                return ERR_PTR(-ENOENT);
+
                         return &nft_match->ops;
+                }
         }
 
         match = xt_request_find_match(family, mt_name, rev);
@@ -695,8 +705,12 @@ nft_target_select_ops(const struct nft_ctx *ctx,
                 struct xt_target *target = nft_target->ops.data;
 
                 if (strcmp(target->name, tg_name) == 0 &&
-                    target->revision == rev && target->family == family)
+                    target->revision == rev && target->family == family) {
+                        if (!try_module_get(target->me))
+                                return ERR_PTR(-ENOENT);
+
                         return &nft_target->ops;
+                }
         }
 
         target = xt_request_find_target(family, tg_name, rev);
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index 61e6c407476a..37c15e674884 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -153,6 +153,8 @@ static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,
                                 iter->err = err;
                                 goto out;
                         }
+
+                        continue;
                 }
 
                 if (iter->count < iter->skip)
@@ -192,8 +194,6 @@ static int nft_hash_init(const struct nft_set *set,
                 .key_offset = offsetof(struct nft_hash_elem, key),
                 .key_len = set->klen,
                 .hashfn = jhash,
-                .grow_decision = rht_grow_above_75,
-                .shrink_decision = rht_shrink_below_30,
         };
 
         return rhashtable_init(priv, &params);
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index ef8a926752a9..50e1e5aaf4ce 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -513,8 +513,8 @@ static int tproxy_tg6_check(const struct xt_tgchk_param *par)
 {
         const struct ip6t_ip6 *i = par->entryinfo;
 
-        if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP)
-            && !(i->flags & IP6T_INV_PROTO))
+        if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP) &&
+            !(i->invflags & IP6T_INV_PROTO))
                 return 0;
 
         pr_info("Can be used only in combination with "
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 30dbe34915ae..45e1b30e4fb2 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -378,12 +378,11 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
         mutex_lock(&recent_mutex);
         t = recent_table_lookup(recent_net, info->name);
         if (t != NULL) {
-                if (info->hit_count > t->nstamps_max_mask) {
-                        pr_info("hitcount (%u) is larger than packets to be remembered (%u) for table %s\n",
-                                info->hit_count, t->nstamps_max_mask + 1,
-                                info->name);
-                        ret = -EINVAL;
-                        goto out;
+                if (nstamp_mask > t->nstamps_max_mask) {
+                        spin_lock_bh(&recent_lock);
+                        recent_table_flush(t);
+                        t->nstamps_max_mask = nstamp_mask;
+                        spin_unlock_bh(&recent_lock);
                 }
 
                 t->refcnt++;
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 1ba67931eb1b..13332dbf291d 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -243,12 +243,13 @@ static int
 extract_icmp6_fields(const struct sk_buff *skb,
                      unsigned int outside_hdrlen,
                      int *protocol,
-                     struct in6_addr **raddr,
-                     struct in6_addr **laddr,
+                     const struct in6_addr **raddr,
+                     const struct in6_addr **laddr,
                      __be16 *rport,
-                     __be16 *lport)
+                     __be16 *lport,
+                     struct ipv6hdr *ipv6_var)
 {
-        struct ipv6hdr *inside_iph, _inside_iph;
+        const struct ipv6hdr *inside_iph;
         struct icmp6hdr *icmph, _icmph;
         __be16 *ports, _ports[2];
         u8 inside_nexthdr;
@@ -263,12 +264,14 @@ extract_icmp6_fields(const struct sk_buff *skb,
         if (icmph->icmp6_type & ICMPV6_INFOMSG_MASK)
                 return 1;
 
-        inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), sizeof(_inside_iph), &_inside_iph);
+        inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph),
+                                        sizeof(*ipv6_var), ipv6_var);
         if (inside_iph == NULL)
                 return 1;
         inside_nexthdr = inside_iph->nexthdr;
 
-        inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph),
+        inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) +
+                                              sizeof(*ipv6_var),
                                          &inside_nexthdr, &inside_fragoff);
         if (inside_hdrlen < 0)
                 return 1; /* hjm: Packet has no/incomplete transport layer headers. */
@@ -315,10 +318,10 @@ xt_socket_get_sock_v6(struct net *net, const u8 protocol,
 static bool
 socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        struct ipv6hdr ipv6_var, *iph = ipv6_hdr(skb);
         struct udphdr _hdr, *hp = NULL;
         struct sock *sk = skb->sk;
-        struct in6_addr *daddr = NULL, *saddr = NULL;
+        const struct in6_addr *daddr = NULL, *saddr = NULL;
         __be16 uninitialized_var(dport), uninitialized_var(sport);
         int thoff = 0, uninitialized_var(tproto);
         const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
@@ -342,7 +345,7 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
 
         } else if (tproto == IPPROTO_ICMPV6) {
                 if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr,
-                                         &sport, &dport))
+                                         &sport, &dport, &ipv6_var))
                         return false;
         } else {
                 return false;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 2702673f0f23..05919bf3f670 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -3126,8 +3126,6 @@ static int __init netlink_proto_init(void)
                 .key_len = sizeof(u32), /* portid */
                 .hashfn = jhash,
                 .max_shift = 16, /* 64K */
-                .grow_decision = rht_grow_above_75,
-                .shrink_decision = rht_shrink_below_30,
         };
 
         if (err != 0)
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index ae5e77cdc0ca..5bae7243c577 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -2194,14 +2194,55 @@ static int __net_init ovs_init_net(struct net *net)
         return 0;
 }
 
-static void __net_exit ovs_exit_net(struct net *net)
+static void __net_exit list_vports_from_net(struct net *net, struct net *dnet,
+                                            struct list_head *head)
 {
-        struct datapath *dp, *dp_next;
         struct ovs_net *ovs_net = net_generic(net, ovs_net_id);
+        struct datapath *dp;
+
+        list_for_each_entry(dp, &ovs_net->dps, list_node) {
+                int i;
+
+                for (i = 0; i < DP_VPORT_HASH_BUCKETS; i++) {
+                        struct vport *vport;
+
+                        hlist_for_each_entry(vport, &dp->ports[i], dp_hash_node) {
+                                struct netdev_vport *netdev_vport;
+
+                                if (vport->ops->type != OVS_VPORT_TYPE_INTERNAL)
+                                        continue;
+
+                                netdev_vport = netdev_vport_priv(vport);
+                                if (dev_net(netdev_vport->dev) == dnet)
+                                        list_add(&vport->detach_list, head);
+                        }
+                }
+        }
+}
+
+static void __net_exit ovs_exit_net(struct net *dnet)
+{
+        struct datapath *dp, *dp_next;
+        struct ovs_net *ovs_net = net_generic(dnet, ovs_net_id);
+        struct vport *vport, *vport_next;
+        struct net *net;
+        LIST_HEAD(head);
 
         ovs_lock();
         list_for_each_entry_safe(dp, dp_next, &ovs_net->dps, list_node)
                 __dp_destroy(dp);
+
+        rtnl_lock();
+        for_each_net(net)
+                list_vports_from_net(net, dnet, &head);
+        rtnl_unlock();
+
+        /* Detach all vports from given namespace. */
+        list_for_each_entry_safe(vport, vport_next, &head, detach_list) {
+                list_del(&vport->detach_list);
+                ovs_dp_detach_port(vport);
+        }
+
         ovs_unlock();
 
         cancel_work_sync(&ovs_net->dp_notify_work);
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 216f20b90aa5..22b18c145c92 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -2253,14 +2253,20 @@ static int masked_set_action_to_set_action_attr(const struct nlattr *a,
                                                 struct sk_buff *skb)
 {
         const struct nlattr *ovs_key = nla_data(a);
+        struct nlattr *nla;
         size_t key_len = nla_len(ovs_key) / 2;
 
         /* Revert the conversion we did from a non-masked set action to
          * masked set action.
          */
-        if (nla_put(skb, OVS_ACTION_ATTR_SET, nla_len(a) - key_len, ovs_key))
+        nla = nla_nest_start(skb, OVS_ACTION_ATTR_SET);
+        if (!nla)
                 return -EMSGSIZE;
 
+        if (nla_put(skb, nla_type(ovs_key), key_len, nla_data(ovs_key)))
+                return -EMSGSIZE;
+
+        nla_nest_end(skb, nla);
         return 0;
 }
 
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index ec2954ffc690..067a3fff1d2c 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -274,10 +274,8 @@ void ovs_vport_del(struct vport *vport)
         ASSERT_OVSL();
 
         hlist_del_rcu(&vport->hash_node);
-
-        vport->ops->destroy(vport);
-
         module_put(vport->ops->owner);
+        vport->ops->destroy(vport);
 }
 
 /**
diff --git a/net/openvswitch/vport.h b/net/openvswitch/vport.h
index f8ae295fb001..bc85331a6c60 100644
--- a/net/openvswitch/vport.h
+++ b/net/openvswitch/vport.h
@@ -103,6 +103,7 @@ struct vport_portids {
  * @ops: Class structure.
  * @percpu_stats: Points to per-CPU statistics used and maintained by vport
  * @err_stats: Points to error statistics used and maintained by vport
+ * @detach_list: list used for detaching vport in net-exit call.
  */
 struct vport {
         struct rcu_head rcu;
@@ -117,6 +118,7 @@ struct vport {
         struct pcpu_sw_netstats __percpu *percpu_stats;
 
         struct vport_err_stats err_stats;
+        struct list_head detach_list;
 };
 
 /**
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 9c28cec1a083..f8db7064d81c 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -698,6 +698,10 @@ static void prb_retire_rx_blk_timer_expired(unsigned long data)
 
         if (pkc->last_kactive_blk_num == pkc->kactive_blk_num) {
                 if (!frozen) {
+                        if (!BLOCK_NUM_PKTS(pbd)) {
+                                /* An empty block. Just refresh the timer. */
+                                goto refresh_timer;
+                        }
                         prb_retire_current_block(pkc, po, TP_STATUS_BLK_TMO);
                         if (!prb_dispatch_next_block(pkc, po))
                                 goto refresh_timer;
@@ -798,7 +802,11 @@ static void prb_close_block(struct tpacket_kbdq_core *pkc1,
                 h1->ts_last_pkt.ts_sec = last_pkt->tp_sec;
                 h1->ts_last_pkt.ts_nsec = last_pkt->tp_nsec;
         } else {
-                /* Ok, we tmo'd - so get the current time */
+                /* Ok, we tmo'd - so get the current time.
+                 *
+                 * It shouldn't really happen as we don't close empty
+                 * blocks. See prb_retire_rx_blk_timer_expired().
+                 */
                 struct timespec ts;
                 getnstimeofday(&ts);
                 h1->ts_last_pkt.ts_sec = ts.tv_sec;
@@ -1349,14 +1357,14 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
                 return 0;
         }
 
+        if (fanout_has_flag(f, PACKET_FANOUT_FLAG_DEFRAG)) {
+                skb = ip_check_defrag(skb, IP_DEFRAG_AF_PACKET);
+                if (!skb)
+                        return 0;
+        }
         switch (f->type) {
         case PACKET_FANOUT_HASH:
         default:
-                if (fanout_has_flag(f, PACKET_FANOUT_FLAG_DEFRAG)) {
-                        skb = ip_check_defrag(skb, IP_DEFRAG_AF_PACKET);
-                        if (!skb)
-                                return 0;
-                }
                 idx = fanout_demux_hash(f, skb, num);
                 break;
         case PACKET_FANOUT_LB:
@@ -3115,11 +3123,18 @@ static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
         return 0;
 }
 
-static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
+static void packet_dev_mclist_delete(struct net_device *dev,
+                                     struct packet_mclist **mlp)
 {
-        for ( ; i; i = i->next) {
-                if (i->ifindex == dev->ifindex)
-                        packet_dev_mc(dev, i, what);
+        struct packet_mclist *ml;
+
+        while ((ml = *mlp) != NULL) {
+                if (ml->ifindex == dev->ifindex) {
+                        packet_dev_mc(dev, ml, -1);
+                        *mlp = ml->next;
+                        kfree(ml);
+                } else
+                        mlp = &ml->next;
         }
 }
 
@@ -3196,12 +3211,11 @@ static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
                                         packet_dev_mc(dev, ml, -1);
                                 kfree(ml);
                         }
-                        rtnl_unlock();
-                        return 0;
+                        break;
                 }
         }
         rtnl_unlock();
-        return -EADDRNOTAVAIL;
+        return 0;
 }
 
 static void packet_flush_mclist(struct sock *sk)
@@ -3551,7 +3565,7 @@ static int packet_notifier(struct notifier_block *this,
                 switch (msg) {
                 case NETDEV_UNREGISTER:
                         if (po->mclist)
-                                packet_dev_mclist(dev, po->mclist, -1);
+                                packet_dev_mclist_delete(dev, &po->mclist);
                         /* fallthrough */
 
                 case NETDEV_DOWN:
diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
index a817705ce2d0..dba8d0864f18 100644
--- a/net/rds/iw_rdma.c
+++ b/net/rds/iw_rdma.c
@@ -88,7 +88,9 @@ static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
                         int *unpinned);
 static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
 
-static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id)
+static int rds_iw_get_device(struct sockaddr_in *src, struct sockaddr_in *dst,
+                             struct rds_iw_device **rds_iwdev,
+                             struct rdma_cm_id **cm_id)
 {
         struct rds_iw_device *iwdev;
         struct rds_iw_cm_id *i_cm_id;
@@ -112,15 +114,15 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
                                 src_addr->sin_port,
                                 dst_addr->sin_addr.s_addr,
                                 dst_addr->sin_port,
-                                rs->rs_bound_addr,
-                                rs->rs_bound_port,
-                                rs->rs_conn_addr,
-                                rs->rs_conn_port);
+                                src->sin_addr.s_addr,
+                                src->sin_port,
+                                dst->sin_addr.s_addr,
+                                dst->sin_port);
 #ifdef WORKING_TUPLE_DETECTION
-                        if (src_addr->sin_addr.s_addr == rs->rs_bound_addr &&
-                            src_addr->sin_port == rs->rs_bound_port &&
-                            dst_addr->sin_addr.s_addr == rs->rs_conn_addr &&
-                            dst_addr->sin_port == rs->rs_conn_port) {
+                        if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr &&
+                            src_addr->sin_port == src->sin_port &&
+                            dst_addr->sin_addr.s_addr == dst->sin_addr.s_addr &&
+                            dst_addr->sin_port == dst->sin_port) {
 #else
                         /* FIXME - needs to compare the local and remote
                          * ipaddr/port tuple, but the ipaddr is the only
@@ -128,7 +130,7 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
                          * zero'ed.  It doesn't appear to be properly populated
                          * during connection setup...
                          */
-                        if (src_addr->sin_addr.s_addr == rs->rs_bound_addr) {
+                        if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr) {
 #endif
                                 spin_unlock_irq(&iwdev->spinlock);
                                 *rds_iwdev = iwdev;
@@ -180,19 +182,13 @@ int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_i
 {
         struct sockaddr_in *src_addr, *dst_addr;
         struct rds_iw_device *rds_iwdev_old;
-        struct rds_sock rs;
         struct rdma_cm_id *pcm_id;
         int rc;
 
         src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
         dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
 
-        rs.rs_bound_addr = src_addr->sin_addr.s_addr;
-        rs.rs_bound_port = src_addr->sin_port;
-        rs.rs_conn_addr = dst_addr->sin_addr.s_addr;
-        rs.rs_conn_port = dst_addr->sin_port;
-
-        rc = rds_iw_get_device(&rs, &rds_iwdev_old, &pcm_id);
+        rc = rds_iw_get_device(src_addr, dst_addr, &rds_iwdev_old, &pcm_id);
         if (rc)
                 rds_iw_remove_cm_id(rds_iwdev, cm_id);
 
@@ -598,9 +594,17 @@ void *rds_iw_get_mr(struct scatterlist *sg, unsigned long nents,
         struct rds_iw_device *rds_iwdev;
         struct rds_iw_mr *ibmr = NULL;
         struct rdma_cm_id *cm_id;
+        struct sockaddr_in src = {
+                .sin_addr.s_addr = rs->rs_bound_addr,
+                .sin_port = rs->rs_bound_port,
+        };
+        struct sockaddr_in dst = {
+                .sin_addr.s_addr = rs->rs_conn_addr,
+                .sin_port = rs->rs_conn_port,
+        };
         int ret;
 
-        ret = rds_iw_get_device(rs, &rds_iwdev, &cm_id);
+        ret = rds_iw_get_device(&src, &dst, &rds_iwdev, &cm_id);
         if (ret || !cm_id) {
                 ret = -ENODEV;
                 goto out;
diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
index c6be17a959a6..e0547f521f20 100644
--- a/net/rxrpc/ar-ack.c
+++ b/net/rxrpc/ar-ack.c
@@ -218,7 +218,8 @@ static void rxrpc_resend(struct rxrpc_call *call)
         struct rxrpc_header *hdr;
         struct sk_buff *txb;
         unsigned long *p_txb, resend_at;
-        int loop, stop;
+        bool stop;
+        int loop;
         u8 resend;
 
         _enter("{%d,%d,%d,%d},",
@@ -226,7 +227,7 @@ static void rxrpc_resend(struct rxrpc_call *call)
                atomic_read(&call->sequence),
                CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
 
-        stop = 0;
+        stop = false;
         resend = 0;
         resend_at = 0;
 
@@ -255,11 +256,11 @@ static void rxrpc_resend(struct rxrpc_call *call)
                         _proto("Tx DATA %%%u { #%d }",
                                ntohl(sp->hdr.serial), ntohl(sp->hdr.seq));
                         if (rxrpc_send_packet(call->conn->trans, txb) < 0) {
-                                stop = 0;
+                                stop = true;
                                 sp->resend_at = jiffies + 3;
                         } else {
                                 sp->resend_at =
-                                        jiffies + rxrpc_resend_timeout * HZ;
+                                        jiffies + rxrpc_resend_timeout;
                         }
                 }
 
diff --git a/net/rxrpc/ar-error.c b/net/rxrpc/ar-error.c
index 5394b6be46ec..0610efa83d72 100644
--- a/net/rxrpc/ar-error.c
+++ b/net/rxrpc/ar-error.c
@@ -42,7 +42,8 @@ void rxrpc_UDP_error_report(struct sock *sk)
                 _leave("UDP socket errqueue empty");
                 return;
         }
-        if (!skb->len) {
+        serr = SKB_EXT_ERR(skb);
+        if (!skb->len && serr->ee.ee_origin == SO_EE_ORIGIN_TIMESTAMPING) {
                 _leave("UDP empty message");
                 kfree_skb(skb);
                 return;
@@ -50,7 +51,6 @@ void rxrpc_UDP_error_report(struct sock *sk)
 
         rxrpc_new_skb(skb);
 
-        serr = SKB_EXT_ERR(skb);
         addr = *(__be32 *)(skb_network_header(skb) + serr->addr_offset);
         port = serr->port;
 
diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
index 4575485ad1b4..19a560626dc4 100644
--- a/net/rxrpc/ar-recvmsg.c
+++ b/net/rxrpc/ar-recvmsg.c
@@ -87,7 +87,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
                 if (!skb) {
                         /* nothing remains on the queue */
                         if (copied &&
-                            (msg->msg_flags & MSG_PEEK || timeo == 0))
+                            (flags & MSG_PEEK || timeo == 0))
                                 goto out;
 
                         /* wait for a message to turn up */
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index 82c5d7fc1988..5f6288fa3f12 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -25,21 +25,41 @@ static int tcf_bpf(struct sk_buff *skb, const struct tc_action *a,
                    struct tcf_result *res)
 {
         struct tcf_bpf *b = a->priv;
-        int action;
-        int filter_res;
+        int action, filter_res;
 
         spin_lock(&b->tcf_lock);
+
         b->tcf_tm.lastuse = jiffies;
         bstats_update(&b->tcf_bstats, skb);
-        action = b->tcf_action;
 
         filter_res = BPF_PROG_RUN(b->filter, skb);
-        if (filter_res == 0) {
-                /* Return code 0 from the BPF program
-                 * is being interpreted as a drop here.
-                 */
-                action = TC_ACT_SHOT;
+
+        /* A BPF program may overwrite the default action opcode.
+         * Similarly as in cls_bpf, if filter_res == -1 we use the
+         * default action specified from tc.
+         *
+         * In case a different well-known TC_ACT opcode has been
+         * returned, it will overwrite the default one.
+         *
+         * For everything else that is unkown, TC_ACT_UNSPEC is
+         * returned.
+         */
+        switch (filter_res) {
+        case TC_ACT_PIPE:
+        case TC_ACT_RECLASSIFY:
+        case TC_ACT_OK:
+                action = filter_res;
+                break;
+        case TC_ACT_SHOT:
+                action = filter_res;
                 b->tcf_qstats.drops++;
+                break;
+        case TC_ACT_UNSPEC:
+                action = b->tcf_action;
+                break;
+        default:
+                action = TC_ACT_UNSPEC;
+                break;
         }
 
         spin_unlock(&b->tcf_lock);
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 09487afbfd51..95fdf4e40051 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -78,8 +78,11 @@ struct tc_u_hnode {
         struct tc_u_common      *tp_c;
         int                     refcnt;
         unsigned int            divisor;
-        struct tc_u_knode __rcu *ht[1];
         struct rcu_head         rcu;
+        /* The 'ht' field MUST be the last field in structure to allow for
+         * more entries allocated at end of structure.
+         */
+        struct tc_u_knode __rcu *ht[1];
 };
 
 struct tc_u_common {
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index 6742200b1307..fbb7ebfc58c6 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -228,6 +228,7 @@ static int tcf_em_validate(struct tcf_proto *tp,
                                  * to replay the request.
                                  */
                                 module_put(em->ops->owner);
+                                em->ops = NULL;
                                 err = -EAGAIN;
                         }
 #endif
diff --git a/net/socket.c b/net/socket.c
index bbedbfcb42c2..245330ca0015 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1702,6 +1702,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
 
         if (len > INT_MAX)
                 len = INT_MAX;
+        if (unlikely(!access_ok(VERIFY_READ, buff, len)))
+                return -EFAULT;
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (!sock)
                 goto out;
@@ -1760,6 +1762,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
 
         if (size > INT_MAX)
                 size = INT_MAX;
+        if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size)))
+                return -EFAULT;
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (!sock)
                 goto out;
diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c
index abbb7dcd1689..59eeed43eda2 100644
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
@@ -217,6 +217,8 @@ static void gssp_free_receive_pages(struct gssx_arg_accept_sec_context *arg)
 
         for (i = 0; i < arg->npages && arg->pages[i]; i++)
                 __free_page(arg->pages[i]);
+
+        kfree(arg->pages);
 }
 
 static int gssp_alloc_receive_pages(struct gssx_arg_accept_sec_context *arg)
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 224a82f24d3c..1095be9c80ab 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -463,6 +463,8 @@ static int rsc_parse(struct cache_detail *cd,
                 /* number of additional gid's */
                 if (get_int(&mesg, &N))
                         goto out;
+                if (N < 0 || N > NGROUPS_MAX)
+                        goto out;
                 status = -ENOMEM;
                 rsci.cred.cr_group_info = groups_alloc(N);
                 if (rsci.cred.cr_group_info == NULL)
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 33fb105d4352..5199bb1a017e 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -921,7 +921,7 @@ static unsigned int cache_poll(struct file *filp, poll_table *wait,
         poll_wait(filp, &queue_wait, wait);
 
         /* alway allow write */
-        mask = POLL_OUT | POLLWRNORM;
+        mask = POLLOUT | POLLWRNORM;
 
         if (!rp)
                 return mask;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 612aa73bbc60..e6ce1517367f 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -303,9 +303,7 @@ static int rpc_client_register(struct rpc_clnt *clnt,
         struct super_block *pipefs_sb;
         int err;
 
-        err = rpc_clnt_debugfs_register(clnt);
-        if (err)
-                return err;
+        rpc_clnt_debugfs_register(clnt);
 
         pipefs_sb = rpc_get_sb_net(net);
         if (pipefs_sb) {
diff --git a/net/sunrpc/debugfs.c b/net/sunrpc/debugfs.c
index e811f390f9f6..82962f7e6e88 100644
--- a/net/sunrpc/debugfs.c
+++ b/net/sunrpc/debugfs.c
@@ -129,48 +129,52 @@ static const struct file_operations tasks_fops = {
         .release        = tasks_release,
 };
 
-int
+void
 rpc_clnt_debugfs_register(struct rpc_clnt *clnt)
 {
-        int len, err;
+        int len;
         char name[24]; /* enough for "../../rpc_xprt/ + 8 hex digits + NULL */
+        struct rpc_xprt *xprt;
 
         /* Already registered? */
-        if (clnt->cl_debugfs)
-                return 0;
+        if (clnt->cl_debugfs || !rpc_clnt_dir)
+                return;
 
         len = snprintf(name, sizeof(name), "%x", clnt->cl_clid);
         if (len >= sizeof(name))
-                return -EINVAL;
+                return;
 
         /* make the per-client dir */
         clnt->cl_debugfs = debugfs_create_dir(name, rpc_clnt_dir);
         if (!clnt->cl_debugfs)
-                return -ENOMEM;
+                return;
 
         /* make tasks file */
-        err = -ENOMEM;
         if (!debugfs_create_file("tasks", S_IFREG | S_IRUSR, clnt->cl_debugfs,
                                  clnt, &tasks_fops))
                 goto out_err;
 
-        err = -EINVAL;
         rcu_read_lock();
+        xprt = rcu_dereference(clnt->cl_xprt);
+        /* no "debugfs" dentry? Don't bother with the symlink. */
+        if (!xprt->debugfs) {
+                rcu_read_unlock();
+                return;
+        }
         len = snprintf(name, sizeof(name), "../../rpc_xprt/%s",
-                        rcu_dereference(clnt->cl_xprt)->debugfs->d_name.name);
+                        xprt->debugfs->d_name.name);
         rcu_read_unlock();
+
         if (len >= sizeof(name))
                 goto out_err;
 
-        err = -ENOMEM;
         if (!debugfs_create_symlink("xprt", clnt->cl_debugfs, name))
                 goto out_err;
 
-        return 0;
+        return;
 out_err:
         debugfs_remove_recursive(clnt->cl_debugfs);
         clnt->cl_debugfs = NULL;
-        return err;
 }
 
 void
@@ -226,33 +230,33 @@ static const struct file_operations xprt_info_fops = {
         .release        = xprt_info_release,
 };
 
-int
+void
 rpc_xprt_debugfs_register(struct rpc_xprt *xprt)
 {
         int len, id;
         static atomic_t cur_id;
         char            name[9]; /* 8 hex digits + NULL term */
 
+        if (!rpc_xprt_dir)
+                return;
+
         id = (unsigned int)atomic_inc_return(&cur_id);
 
         len = snprintf(name, sizeof(name), "%x", id);
         if (len >= sizeof(name))
-                return -EINVAL;
+                return;
 
         /* make the per-client dir */
         xprt->debugfs = debugfs_create_dir(name, rpc_xprt_dir);
         if (!xprt->debugfs)
-                return -ENOMEM;
+                return;
 
         /* make tasks file */
         if (!debugfs_create_file("info", S_IFREG | S_IRUSR, xprt->debugfs,
                                  xprt, &xprt_info_fops)) {
                 debugfs_remove_recursive(xprt->debugfs);
                 xprt->debugfs = NULL;
-                return -ENOMEM;
         }
-
-        return 0;
 }
 
 void
@@ -266,14 +270,17 @@ void __exit
 sunrpc_debugfs_exit(void)
 {
         debugfs_remove_recursive(topdir);
+        topdir = NULL;
+        rpc_clnt_dir = NULL;
+        rpc_xprt_dir = NULL;
 }
 
-int __init
+void __init
 sunrpc_debugfs_init(void)
 {
         topdir = debugfs_create_dir("sunrpc", NULL);
         if (!topdir)
-                goto out;
+                return;
 
         rpc_clnt_dir = debugfs_create_dir("rpc_clnt", topdir);
         if (!rpc_clnt_dir)
@@ -283,10 +290,9 @@ sunrpc_debugfs_init(void)
         if (!rpc_xprt_dir)
                 goto out_remove;
 
-        return 0;
+        return;
 out_remove:
         debugfs_remove_recursive(topdir);
         topdir = NULL;
-out:
-        return -ENOMEM;
+        rpc_clnt_dir = NULL;
 }
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index e37fbed87956..ee5d3d253102 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -98,10 +98,7 @@ init_sunrpc(void)
         if (err)
                 goto out4;
 
-        err = sunrpc_debugfs_init();
-        if (err)
-                goto out5;
-
+        sunrpc_debugfs_init();
 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
         rpc_register_sysctl();
 #endif
@@ -109,8 +106,6 @@ init_sunrpc(void)
         init_socket_xprt();     /* clnt sock transport */
         return 0;
 
-out5:
-        unregister_rpc_pipefs();
 out4:
         unregister_pernet_subsys(&sunrpc_net_ops);
 out3:
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index e3015aede0d9..9949722d99ce 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1331,7 +1331,6 @@ static void xprt_init(struct rpc_xprt *xprt, struct net *net)
  */
 struct rpc_xprt *xprt_create_transport(struct xprt_create *args)
 {
-        int err;
         struct rpc_xprt *xprt;
         struct xprt_class *t;
 
@@ -1372,11 +1371,7 @@ found:
                 return ERR_PTR(-ENOMEM);
         }
 
-        err = rpc_xprt_debugfs_register(xprt);
-        if (err) {
-                xprt_destroy(xprt);
-                return ERR_PTR(err);
-        }
+        rpc_xprt_debugfs_register(xprt);
 
         dprintk("RPC:       created transport %p with %u slots\n", xprt,
                         xprt->max_reqs);
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 7e9acd9361c5..91ffde82fa0c 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -738,8 +738,9 @@ rpcrdma_reply_handler(struct rpcrdma_rep *rep)
         struct rpc_xprt *xprt = rep->rr_xprt;
         struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(xprt);
         __be32 *iptr;
-        int credits, rdmalen, status;
+        int rdmalen, status;
         unsigned long cwnd;
+        u32 credits;
 
         /* Check status. If bad, signal disconnect and return rep to pool */
         if (rep->rr_len == ~0U) {
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index d1b70397c60f..0a16fb6f0885 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -285,7 +285,7 @@ rpcr_to_rdmar(struct rpc_rqst *rqst)
  */
 struct rpcrdma_buffer {
         spinlock_t      rb_lock;        /* protects indexes */
-        int             rb_max_requests;/* client max requests */
+        u32             rb_max_requests;/* client max requests */
         struct list_head rb_mws;        /* optional memory windows/fmrs/frmrs */
         struct list_head rb_all;
         int             rb_send_index;
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 935205e6bcfe..be1c9fa60b09 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -152,11 +152,11 @@ out_netlink:
 static void __exit tipc_exit(void)
 {
         tipc_bearer_cleanup();
+        unregister_pernet_subsys(&tipc_net_ops);
         tipc_netlink_stop();
         tipc_netlink_compat_stop();
         tipc_socket_stop();
         tipc_unregister_sysctl();
-        unregister_pernet_subsys(&tipc_net_ops);
 
         pr_info("Deactivated\n");
 }
diff --git a/net/tipc/link.c b/net/tipc/link.c
index a4cf364316de..14f09b3cb87c 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -464,10 +464,11 @@ void tipc_link_reset(struct tipc_link *l_ptr)
         /* Clean up all queues, except inputq: */
         __skb_queue_purge(&l_ptr->outqueue);
         __skb_queue_purge(&l_ptr->deferred_queue);
-        skb_queue_splice_init(&l_ptr->wakeupq, &l_ptr->inputq);
-        if (!skb_queue_empty(&l_ptr->inputq))
+        if (!owner->inputq)
+                owner->inputq = &l_ptr->inputq;
+        skb_queue_splice_init(&l_ptr->wakeupq, owner->inputq);
+        if (!skb_queue_empty(owner->inputq))
                 owner->action_flags |= TIPC_MSG_EVT;
-        owner->inputq = &l_ptr->inputq;
         l_ptr->next_out = NULL;
         l_ptr->unacked_window = 0;
         l_ptr->checkpoint = 1;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index f73e975af80b..b4d4467d0bb0 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2364,8 +2364,6 @@ int tipc_sk_rht_init(struct net *net)
                 .hashfn = jhash,
                 .max_shift = 20, /* 1M */
                 .min_shift = 8,  /* 256 */
-                .grow_decision = rht_grow_above_75,
-                .shrink_decision = rht_shrink_below_30,
         };
 
         return rhashtable_init(&tn->sk_rht, &rht_params);
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 3af0ecf1cc16..2a0bbd22854b 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1199,6 +1199,7 @@ out_fail_wq:
         regulatory_exit();
 out_fail_reg:
         debugfs_remove(ieee80211_debugfs_dir);
+        nl80211_exit();
 out_fail_nl80211:
         unregister_netdevice_notifier(&cfg80211_netdev_notifier);
 out_fail_notifier:
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d78fd8b54515..b6f84f6a2a09 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2654,10 +2654,6 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                         return err;
         }
 
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
-        if (!msg)
-                return -ENOMEM;
-
         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                   &flags);
@@ -2666,6 +2662,10 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
                 return -EOPNOTSUPP;
 
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
         wdev = rdev_add_virtual_intf(rdev,
                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
                                 type, err ? NULL : &flags, &params);
@@ -4400,6 +4400,16 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
                 return -EINVAL;
 
+        /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
+         * as userspace might just pass through the capabilities from the IEs
+         * directly, rather than enforcing this restriction and returning an
+         * error in this case.
+         */
+        if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
+                params.ht_capa = NULL;
+                params.vht_capa = NULL;
+        }
+
         /* When you run into this, adjust the code below for the new flag */
         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
 
@@ -12528,9 +12538,7 @@ static int cfg80211_net_detect_results(struct sk_buff *msg,
                         }
 
                         for (j = 0; j < match->n_channels; j++) {
-                                if (nla_put_u32(msg,
-                                                NL80211_ATTR_WIPHY_FREQ,
-                                                match->channels[j])) {
+                                if (nla_put_u32(msg, j, match->channels[j])) {
                                         nla_nest_cancel(msg, nl_freqs);
                                         nla_nest_cancel(msg, nl_match);
                                         goto out;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index b586d0dcb09e..48dfc7b4e981 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -228,7 +228,7 @@ static DECLARE_DELAYED_WORK(reg_timeout, reg_timeout_work);
 
 /* We keep a static world regulatory domain in case of the absence of CRDA */
 static const struct ieee80211_regdomain world_regdom = {
-        .n_reg_rules = 6,
+        .n_reg_rules = 8,
         .alpha2 =  "00",
         .reg_rules = {
                 /* IEEE 802.11b/g, channels 1..11 */
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index cee479bc655c..638af0655aaf 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2269,11 +2269,9 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
                  * have the xfrm_state's. We need to wait for KM to
                  * negotiate new SA's or bail out with error.*/
                 if (net->xfrm.sysctl_larval_drop) {
-                        dst_release(dst);
-                        xfrm_pols_put(pols, drop_pols);
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
-
-                        return ERR_PTR(-EREMOTE);
+                        err = -EREMOTE;
+                        goto error;
                 }
 
                 err = -EAGAIN;
@@ -2324,7 +2322,8 @@ nopol:
 error:
         dst_release(dst);
 dropdst:
-        dst_release(dst_orig);
+        if (!(flags & XFRM_LOOKUP_KEEP_DST_REF))
+                dst_release(dst_orig);
         xfrm_pols_put(pols, drop_pols);
         return ERR_PTR(err);
 }
@@ -2338,7 +2337,8 @@ struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig,
                                     struct sock *sk, int flags)
 {
         struct dst_entry *dst = xfrm_lookup(net, dst_orig, fl, sk,
-                                            flags | XFRM_LOOKUP_QUEUE);
+                                            flags | XFRM_LOOKUP_QUEUE |
+                                            XFRM_LOOKUP_KEEP_DST_REF);
 
         if (IS_ERR(dst) && PTR_ERR(dst) == -EREMOTE)
                 return make_blackhole(net, dst_orig->ops->family, dst_orig);