26 files changed, 298 insertions, 109 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index b13e5c766c11..13e6447f0398 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1624,7 +1624,6 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
         }
 
         skb_orphan(skb);
-        nf_reset(skb);
 
         if (unlikely(!is_skb_forwardable(dev, skb))) {
                 atomic_long_inc(&dev->rx_dropped);
@@ -3314,6 +3313,7 @@ int netdev_rx_handler_register(struct net_device *dev,
         if (dev->rx_handler)
                 return -EBUSY;
 
+        /* Note: rx_handler_data must be set before rx_handler */
         rcu_assign_pointer(dev->rx_handler_data, rx_handler_data);
         rcu_assign_pointer(dev->rx_handler, rx_handler);
 
@@ -3334,6 +3334,11 @@ void netdev_rx_handler_unregister(struct net_device *dev)
 
         ASSERT_RTNL();
         RCU_INIT_POINTER(dev->rx_handler, NULL);
+        /* a reader seeing a non NULL rx_handler in a rcu_read_lock()
+         * section has a guarantee to see a non NULL rx_handler_data
+         * as well.
+         */
+        synchronize_net();
         RCU_INIT_POINTER(dev->rx_handler_data, NULL);
 }
 EXPORT_SYMBOL_GPL(netdev_rx_handler_unregister);
diff --git a/net/core/flow.c b/net/core/flow.c
index c56ea6f7f6c7..2bfd081c59f7 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -328,7 +328,7 @@ static void flow_cache_flush_per_cpu(void *data)
         struct flow_flush_info *info = data;
         struct tasklet_struct *tasklet;
 
-        tasklet = this_cpu_ptr(&info->cache->percpu->flush_tasklet);
+        tasklet = &this_cpu_ptr(info->cache->percpu)->flush_tasklet;
         tasklet->data = (unsigned long)info;
         tasklet_schedule(tasklet);
 }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 5fb8d7e47294..b65441da74ab 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -496,8 +496,10 @@ static int rtnl_link_fill(struct sk_buff *skb, const struct net_device *dev)
         }
         if (ops->fill_info) {
                 data = nla_nest_start(skb, IFLA_INFO_DATA);
-                if (data == NULL)
+                if (data == NULL) {
+                        err = -EMSGSIZE;
                         goto err_cancel_link;
+                }
                 err = ops->fill_info(skb, dev);
                 if (err < 0)
                         goto err_cancel_data;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 26512250e095..a459c4f5b769 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2529,6 +2529,9 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
 static void init_loopback(struct net_device *dev)
 {
         struct inet6_dev  *idev;
+        struct net_device *sp_dev;
+        struct inet6_ifaddr *sp_ifa;
+        struct rt6_info *sp_rt;
 
         /* ::1 */
 
@@ -2540,6 +2543,30 @@ static void init_loopback(struct net_device *dev)
         }
 
         add_addr(idev, &in6addr_loopback, 128, IFA_HOST);
+
+        /* Add routes to other interface's IPv6 addresses */
+        for_each_netdev(dev_net(dev), sp_dev) {
+                if (!strcmp(sp_dev->name, dev->name))
+                        continue;
+
+                idev = __in6_dev_get(sp_dev);
+                if (!idev)
+                        continue;
+
+                read_lock_bh(&idev->lock);
+                list_for_each_entry(sp_ifa, &idev->addr_list, if_list) {
+
+                        if (sp_ifa->flags & (IFA_F_DADFAILED | IFA_F_TENTATIVE))
+                                continue;
+
+                        sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, 0);
+
+                        /* Failure cases are ignored */
+                        if (!IS_ERR(sp_rt))
+                                ip6_ins_rt(sp_rt);
+                }
+                read_unlock_bh(&idev->lock);
+        }
 }
 
 static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr *addr)
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index e33fe0ab2568..2bab2aa59745 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -118,6 +118,18 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
             ipv6_addr_loopback(&hdr->daddr))
                 goto err;
 
+        /* RFC4291 Errata ID: 3480
+         * Interface-Local scope spans only a single interface on a
+         * node and is useful only for loopback transmission of
+         * multicast.  Packets with interface-local scope received
+         * from another node must be discarded.
+         */
+        if (!(skb->pkt_type == PACKET_LOOPBACK ||
+              dev->flags & IFF_LOOPBACK) &&
+            ipv6_addr_is_multicast(&hdr->daddr) &&
+            IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 1)
+                goto err;
+
         /* RFC4291 2.7
          * Nodes must not originate a packet to a multicast address whose scope
          * field contains the reserved value 0; if such a packet is received, it
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 8555f331ea60..5b1e5af25713 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2693,6 +2693,7 @@ static int key_notify_policy_flush(const struct km_event *c)
         hdr->sadb_msg_pid = c->portid;
         hdr->sadb_msg_version = PF_KEY_V2;
         hdr->sadb_msg_errno = (uint8_t) 0;
+        hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
         pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
         return 0;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index baaa8608e52d..3bfe2612c8c2 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -349,21 +349,19 @@ static void ieee80211_set_default_queues(struct ieee80211_sub_if_data *sdata)
 static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
-        int ret = 0;
+        int ret;
 
         if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
                 return 0;
 
-        mutex_lock(&local->iflist_mtx);
+        ASSERT_RTNL();
 
         if (local->monitor_sdata)
-                goto out_unlock;
+                return 0;
 
         sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size, GFP_KERNEL);
-        if (!sdata) {
-                ret = -ENOMEM;
-                goto out_unlock;
-        }
+        if (!sdata)
+                return -ENOMEM;
 
         /* set up data */
         sdata->local = local;
@@ -377,13 +375,13 @@ static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
         if (WARN_ON(ret)) {
                 /* ok .. stupid driver, it asked for this! */
                 kfree(sdata);
-                goto out_unlock;
+                return ret;
         }
 
         ret = ieee80211_check_queues(sdata);
         if (ret) {
                 kfree(sdata);
-                goto out_unlock;
+                return ret;
         }
 
         ret = ieee80211_vif_use_channel(sdata, &local->monitor_chandef,
@@ -391,13 +389,14 @@ static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
         if (ret) {
                 drv_remove_interface(local, sdata);
                 kfree(sdata);
-                goto out_unlock;
+                return ret;
         }
 
+        mutex_lock(&local->iflist_mtx);
         rcu_assign_pointer(local->monitor_sdata, sdata);
- out_unlock:
         mutex_unlock(&local->iflist_mtx);
-        return ret;
+
+        return 0;
 }
 
 static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
@@ -407,14 +406,20 @@ static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
         if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
                 return;
 
+        ASSERT_RTNL();
+
         mutex_lock(&local->iflist_mtx);
 
         sdata = rcu_dereference_protected(local->monitor_sdata,
                                           lockdep_is_held(&local->iflist_mtx));
-        if (!sdata)
-                goto out_unlock;
+        if (!sdata) {
+                mutex_unlock(&local->iflist_mtx);
+                return;
+        }
 
         rcu_assign_pointer(local->monitor_sdata, NULL);
+        mutex_unlock(&local->iflist_mtx);
+
         synchronize_net();
 
         ieee80211_vif_release_channel(sdata);
@@ -422,8 +427,6 @@ static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
         drv_remove_interface(local, sdata);
 
         kfree(sdata);
- out_unlock:
-        mutex_unlock(&local->iflist_mtx);
 }
 
 /*
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 29ce2aa87e7b..4749b3858695 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -1060,7 +1060,8 @@ void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
 
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                if (ieee80211_vif_is_mesh(&sdata->vif))
+                if (ieee80211_vif_is_mesh(&sdata->vif) &&
+                    ieee80211_sdata_running(sdata))
                         ieee80211_queue_work(&local->hw, &sdata->work);
         rcu_read_unlock();
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 141577412d84..82cc30318a86 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3608,8 +3608,10 @@ void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
 
         /* Restart STA timers */
         rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                ieee80211_restart_sta_timer(sdata);
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (ieee80211_sdata_running(sdata))
+                        ieee80211_restart_sta_timer(sdata);
+        }
         rcu_read_unlock();
 }
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index bb73ed2d20b9..c6844ad080be 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2675,7 +2675,19 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
 
                 memset(nskb->cb, 0, sizeof(nskb->cb));
 
-                ieee80211_tx_skb(rx->sdata, nskb);
+                if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
+                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
+
+                        info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
+                                      IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
+                                      IEEE80211_TX_CTL_NO_CCK_RATE;
+                        if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
+                                info->hw_queue =
+                                        local->hw.offchannel_tx_hw_queue;
+                }
+
+                __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
+                                            status->band);
         }
         dev_kfree_skb(rx->skb);
         return RX_QUEUED;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index a79ce820cb50..238a0cca320e 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -766,6 +766,7 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
         struct ieee80211_local *local;
         struct ieee80211_sub_if_data *sdata;
         int ret, i;
+        bool have_key = false;
 
         might_sleep();
 
@@ -793,12 +794,19 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
         list_del_rcu(&sta->list);
 
         mutex_lock(&local->key_mtx);
-        for (i = 0; i < NUM_DEFAULT_KEYS; i++)
+        for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
                 __ieee80211_key_free(key_mtx_dereference(local, sta->gtk[i]));
-        if (sta->ptk)
+                have_key = true;
+        }
+        if (sta->ptk) {
                 __ieee80211_key_free(key_mtx_dereference(local, sta->ptk));
+                have_key = true;
+        }
         mutex_unlock(&local->key_mtx);
 
+        if (!have_key)
+                synchronize_net();
+
         sta->dead = true;
 
         local->num_sta--;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 13aa47aa2ffb..1bc210ffcba2 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -962,8 +962,11 @@ cbq_dequeue(struct Qdisc *sch)
                 cbq_update(q);
                 if ((incr -= incr2) < 0)
                         incr = 0;
+                q->now += incr;
+        } else {
+                if (now > q->now)
+                        q->now = now;
         }
-        q->now += incr;
         q->now_rt = now;
 
         for (;;) {
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 4e606fcb2534..55786283a3df 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -195,7 +195,7 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 flow->deficit = q->quantum;
                 flow->dropped = 0;
         }
-        if (++sch->q.qlen < sch->limit)
+        if (++sch->q.qlen <= sch->limit)
                 return NET_XMIT_SUCCESS;
 
         q->drop_overlimit++;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index ffad48109a22..eac7e0ee23c1 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -904,7 +904,7 @@ void psched_ratecfg_precompute(struct psched_ratecfg *r, u32 rate)
         u64 mult;
         int shift;
 
-        r->rate_bps = rate << 3;
+        r->rate_bps = (u64)rate << 3;
         r->shift = 0;
         r->mult = 1;
         /*
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index ca511c4f388a..d8079daf1bde 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -207,7 +207,7 @@ static struct sock *__vsock_find_bound_socket(struct sockaddr_vm *addr)
         struct vsock_sock *vsk;
 
         list_for_each_entry(vsk, vsock_bound_sockets(addr), bound_table)
-                if (vsock_addr_equals_addr_any(addr, &vsk->local_addr))
+                if (addr->svm_port == vsk->local_addr.svm_port)
                         return sk_vsock(vsk);
 
         return NULL;
@@ -220,8 +220,8 @@ static struct sock *__vsock_find_connected_socket(struct sockaddr_vm *src,
 
         list_for_each_entry(vsk, vsock_connected_sockets(src, dst),
                             connected_table) {
-                if (vsock_addr_equals_addr(src, &vsk->remote_addr)
-                    && vsock_addr_equals_addr(dst, &vsk->local_addr)) {
+                if (vsock_addr_equals_addr(src, &vsk->remote_addr) &&
+                    dst->svm_port == vsk->local_addr.svm_port) {
                         return sk_vsock(vsk);
                 }
         }
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index a70ace83a153..1f6508e249ae 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -464,19 +464,16 @@ static struct sock *vmci_transport_get_pending(
         struct vsock_sock *vlistener;
         struct vsock_sock *vpending;
         struct sock *pending;
+        struct sockaddr_vm src;
+
+        vsock_addr_init(&src, pkt->dg.src.context, pkt->src_port);
 
         vlistener = vsock_sk(listener);
 
         list_for_each_entry(vpending, &vlistener->pending_links,
                             pending_links) {
-                struct sockaddr_vm src;
-                struct sockaddr_vm dst;
-
-                vsock_addr_init(&src, pkt->dg.src.context, pkt->src_port);
-                vsock_addr_init(&dst, pkt->dg.dst.context, pkt->dst_port);
-
                 if (vsock_addr_equals_addr(&src, &vpending->remote_addr) &&
-                    vsock_addr_equals_addr(&dst, &vpending->local_addr)) {
+                    pkt->dst_port == vpending->local_addr.svm_port) {
                         pending = sk_vsock(vpending);
                         sock_hold(pending);
                         goto found;
@@ -739,10 +736,15 @@ static int vmci_transport_recv_stream_cb(void *data, struct vmci_datagram *dg)
          */
         bh_lock_sock(sk);
 
-        if (!sock_owned_by_user(sk) && sk->sk_state == SS_CONNECTED)
-                vmci_trans(vsk)->notify_ops->handle_notify_pkt(
-                                sk, pkt, true, &dst, &src,
-                                &bh_process_pkt);
+        if (!sock_owned_by_user(sk)) {
+                /* The local context ID may be out of date, update it. */
+                vsk->local_addr.svm_cid = dst.svm_cid;
+
+                if (sk->sk_state == SS_CONNECTED)
+                        vmci_trans(vsk)->notify_ops->handle_notify_pkt(
+                                        sk, pkt, true, &dst, &src,
+                                        &bh_process_pkt);
+        }
 
         bh_unlock_sock(sk);
 
@@ -902,6 +904,9 @@ static void vmci_transport_recv_pkt_work(struct work_struct *work)
 
         lock_sock(sk);
 
+        /* The local context ID may be out of date. */
+        vsock_sk(sk)->local_addr.svm_cid = pkt->dg.dst.context;
+
         switch (sk->sk_state) {
         case SS_LISTEN:
                 vmci_transport_recv_listen(sk, pkt);
@@ -958,6 +963,10 @@ static int vmci_transport_recv_listen(struct sock *sk,
         pending = vmci_transport_get_pending(sk, pkt);
         if (pending) {
                 lock_sock(pending);
+
+                /* The local context ID may be out of date. */
+                vsock_sk(pending)->local_addr.svm_cid = pkt->dg.dst.context;
+
                 switch (pending->sk_state) {
                 case SS_CONNECTING:
                         err = vmci_transport_recv_connecting_server(sk,
diff --git a/net/vmw_vsock/vsock_addr.c b/net/vmw_vsock/vsock_addr.c
index b7df1aea7c59..ec2611b4ea0e 100644
--- a/net/vmw_vsock/vsock_addr.c
+++ b/net/vmw_vsock/vsock_addr.c
@@ -64,16 +64,6 @@ bool vsock_addr_equals_addr(const struct sockaddr_vm *addr,
 }
 EXPORT_SYMBOL_GPL(vsock_addr_equals_addr);
 
-bool vsock_addr_equals_addr_any(const struct sockaddr_vm *addr,
-                                const struct sockaddr_vm *other)
-{
-        return (addr->svm_cid == VMADDR_CID_ANY ||
-                other->svm_cid == VMADDR_CID_ANY ||
-                addr->svm_cid == other->svm_cid) &&
-               addr->svm_port == other->svm_port;
-}
-EXPORT_SYMBOL_GPL(vsock_addr_equals_addr_any);
-
 int vsock_addr_cast(const struct sockaddr *addr,
                     size_t len, struct sockaddr_vm **out_addr)
 {
diff --git a/net/vmw_vsock/vsock_addr.h b/net/vmw_vsock/vsock_addr.h
index cdfbcefdf843..9ccd5316eac0 100644
--- a/net/vmw_vsock/vsock_addr.h
+++ b/net/vmw_vsock/vsock_addr.h
@@ -24,8 +24,6 @@ bool vsock_addr_bound(const struct sockaddr_vm *addr);
 void vsock_addr_unbind(struct sockaddr_vm *addr);
 bool vsock_addr_equals_addr(const struct sockaddr_vm *addr,
                             const struct sockaddr_vm *other);
-bool vsock_addr_equals_addr_any(const struct sockaddr_vm *addr,
-                                const struct sockaddr_vm *other);
 int vsock_addr_cast(const struct sockaddr *addr, size_t len,
                     struct sockaddr_vm **out_addr);
 
diff --git a/net/wireless/core.c b/net/wireless/core.c
index ea4155fe9733..6ddf74f0ae1e 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -212,6 +212,39 @@ static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data)
         rdev_rfkill_poll(rdev);
 }
 
+void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
+                              struct wireless_dev *wdev)
+{
+        lockdep_assert_held(&rdev->devlist_mtx);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_P2P_DEVICE))
+                return;
+
+        if (!wdev->p2p_started)
+                return;
+
+        rdev_stop_p2p_device(rdev, wdev);
+        wdev->p2p_started = false;
+
+        rdev->opencount--;
+
+        if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
+                bool busy = work_busy(&rdev->scan_done_wk);
+
+                /*
+                 * If the work isn't pending or running (in which case it would
+                 * be waiting for the lock we hold) the driver didn't properly
+                 * cancel the scan when the interface was removed. In this case
+                 * warn and leak the scan request object to not crash later.
+                 */
+                WARN_ON(!busy);
+
+                rdev->scan_req->aborted = true;
+                ___cfg80211_scan_done(rdev, !busy);
+        }
+}
+
 static int cfg80211_rfkill_set_block(void *data, bool blocked)
 {
         struct cfg80211_registered_device *rdev = data;
@@ -221,7 +254,8 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
                 return 0;
 
         rtnl_lock();
-        mutex_lock(&rdev->devlist_mtx);
+
+        /* read-only iteration need not hold the devlist_mtx */
 
         list_for_each_entry(wdev, &rdev->wdev_list, list) {
                 if (wdev->netdev) {
@@ -231,18 +265,18 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
                 /* otherwise, check iftype */
                 switch (wdev->iftype) {
                 case NL80211_IFTYPE_P2P_DEVICE:
-                        if (!wdev->p2p_started)
-                                break;
-                        rdev_stop_p2p_device(rdev, wdev);
-                        wdev->p2p_started = false;
-                        rdev->opencount--;
+                        /* but this requires it */
+                        mutex_lock(&rdev->devlist_mtx);
+                        mutex_lock(&rdev->sched_scan_mtx);
+                        cfg80211_stop_p2p_device(rdev, wdev);
+                        mutex_unlock(&rdev->sched_scan_mtx);
+                        mutex_unlock(&rdev->devlist_mtx);
                         break;
                 default:
                         break;
                 }
         }
 
-        mutex_unlock(&rdev->devlist_mtx);
         rtnl_unlock();
 
         return 0;
@@ -745,17 +779,13 @@ static void wdev_cleanup_work(struct work_struct *work)
         wdev = container_of(work, struct wireless_dev, cleanup_work);
         rdev = wiphy_to_dev(wdev->wiphy);
 
-        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
 
         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
                 rdev->scan_req->aborted = true;
                 ___cfg80211_scan_done(rdev, true);
         }
 
-        cfg80211_unlock_rdev(rdev);
-
-        mutex_lock(&rdev->sched_scan_mtx);
-
         if (WARN_ON(rdev->sched_scan_req &&
                     rdev->sched_scan_req->dev == wdev->netdev)) {
                 __cfg80211_stop_sched_scan(rdev, false);
@@ -781,21 +811,19 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev)
                 return;
 
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         list_del_rcu(&wdev->list);
         rdev->devlist_generation++;
 
         switch (wdev->iftype) {
         case NL80211_IFTYPE_P2P_DEVICE:
-                if (!wdev->p2p_started)
-                        break;
-                rdev_stop_p2p_device(rdev, wdev);
-                wdev->p2p_started = false;
-                rdev->opencount--;
+                cfg80211_stop_p2p_device(rdev, wdev);
                 break;
         default:
                 WARN_ON_ONCE(1);
                 break;
         }
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
 }
 EXPORT_SYMBOL(cfg80211_unregister_wdev);
@@ -936,6 +964,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                 cfg80211_update_iface_num(rdev, wdev->iftype, 1);
                 cfg80211_lock_rdev(rdev);
                 mutex_lock(&rdev->devlist_mtx);
+                mutex_lock(&rdev->sched_scan_mtx);
                 wdev_lock(wdev);
                 switch (wdev->iftype) {
 #ifdef CONFIG_CFG80211_WEXT
@@ -967,6 +996,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                         break;
                 }
                 wdev_unlock(wdev);
+                mutex_unlock(&rdev->sched_scan_mtx);
                 rdev->opencount++;
                 mutex_unlock(&rdev->devlist_mtx);
                 cfg80211_unlock_rdev(rdev);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 3aec0e429d8a..5845c2b37aa8 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -503,6 +503,9 @@ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
 void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
                                enum nl80211_iftype iftype, int num);
 
+void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
+                              struct wireless_dev *wdev);
+
 #define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10
 
 #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d44ab216c0ec..58e13a8c95f9 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4702,14 +4702,19 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->scan)
                 return -EOPNOTSUPP;
 
-        if (rdev->scan_req)
-                return -EBUSY;
+        mutex_lock(&rdev->sched_scan_mtx);
+        if (rdev->scan_req) {
+                err = -EBUSY;
+                goto unlock;
+        }
 
         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
                 n_channels = validate_scan_freqs(
                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
-                if (!n_channels)
-                        return -EINVAL;
+                if (!n_channels) {
+                        err = -EINVAL;
+                        goto unlock;
+                }
         } else {
                 enum ieee80211_band band;
                 n_channels = 0;
@@ -4723,23 +4728,29 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
                         n_ssids++;
 
-        if (n_ssids > wiphy->max_scan_ssids)
-                return -EINVAL;
+        if (n_ssids > wiphy->max_scan_ssids) {
+                err = -EINVAL;
+                goto unlock;
+        }
 
         if (info->attrs[NL80211_ATTR_IE])
                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         else
                 ie_len = 0;
 
-        if (ie_len > wiphy->max_scan_ie_len)
-                return -EINVAL;
+        if (ie_len > wiphy->max_scan_ie_len) {
+                err = -EINVAL;
+                goto unlock;
+        }
 
         request = kzalloc(sizeof(*request)
                         + sizeof(*request->ssids) * n_ssids
                         + sizeof(*request->channels) * n_channels
                         + ie_len, GFP_KERNEL);
-        if (!request)
-                return -ENOMEM;
+        if (!request) {
+                err = -ENOMEM;
+                goto unlock;
+        }
 
         if (n_ssids)
                 request->ssids = (void *)&request->channels[n_channels];
@@ -4876,6 +4887,8 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 kfree(request);
         }
 
+ unlock:
+        mutex_unlock(&rdev->sched_scan_mtx);
         return err;
 }
 
@@ -7749,20 +7762,9 @@ static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->stop_p2p_device)
                 return -EOPNOTSUPP;
 
-        if (!wdev->p2p_started)
-                return 0;
-
-        rdev_stop_p2p_device(rdev, wdev);
-        wdev->p2p_started = false;
-
-        mutex_lock(&rdev->devlist_mtx);
-        rdev->opencount--;
-        mutex_unlock(&rdev->devlist_mtx);
-
-        if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
-                rdev->scan_req->aborted = true;
-                ___cfg80211_scan_done(rdev, true);
-        }
+        mutex_lock(&rdev->sched_scan_mtx);
+        cfg80211_stop_p2p_device(rdev, wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
 
         return 0;
 }
@@ -8486,7 +8488,7 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
         struct nlattr *nest;
         int i;
 
-        ASSERT_RDEV_LOCK(rdev);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
 
         if (WARN_ON(!req))
                 return 0;
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 674aadca0079..fd99ea495b7e 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -169,7 +169,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
         union iwreq_data wrqu;
 #endif
 
-        ASSERT_RDEV_LOCK(rdev);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
 
         request = rdev->scan_req;
 
@@ -230,9 +230,9 @@ void __cfg80211_scan_done(struct work_struct *wk)
         rdev = container_of(wk, struct cfg80211_registered_device,
                             scan_done_wk);
 
-        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
         ___cfg80211_scan_done(rdev, false);
-        cfg80211_unlock_rdev(rdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
 }
 
 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
@@ -698,11 +698,6 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
         found = rb_find_bss(dev, tmp, BSS_CMP_REGULAR);
 
         if (found) {
-                found->pub.beacon_interval = tmp->pub.beacon_interval;
-                found->pub.signal = tmp->pub.signal;
-                found->pub.capability = tmp->pub.capability;
-                found->ts = tmp->ts;
-
                 /* Update IEs */
                 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
                         const struct cfg80211_bss_ies *old;
@@ -723,6 +718,8 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
 
                         if (found->pub.hidden_beacon_bss &&
                             !list_empty(&found->hidden_list)) {
+                                const struct cfg80211_bss_ies *f;
+
                                 /*
                                  * The found BSS struct is one of the probe
                                  * response members of a group, but we're
@@ -732,6 +729,10 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                                  * SSID to showing it, which is confusing so
                                  * drop this information.
                                  */
+
+                                f = rcu_access_pointer(tmp->pub.beacon_ies);
+                                kfree_rcu((struct cfg80211_bss_ies *)f,
+                                          rcu_head);
                                 goto drop;
                         }
 
@@ -761,6 +762,11 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                                 kfree_rcu((struct cfg80211_bss_ies *)old,
                                           rcu_head);
                 }
+
+                found->pub.beacon_interval = tmp->pub.beacon_interval;
+                found->pub.signal = tmp->pub.signal;
+                found->pub.capability = tmp->pub.capability;
+                found->ts = tmp->ts;
         } else {
                 struct cfg80211_internal_bss *new;
                 struct cfg80211_internal_bss *hidden;
@@ -1056,6 +1062,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         if (IS_ERR(rdev))
                 return PTR_ERR(rdev);
 
+        mutex_lock(&rdev->sched_scan_mtx);
         if (rdev->scan_req) {
                 err = -EBUSY;
                 goto out;
@@ -1162,6 +1169,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
                 dev_hold(dev);
         }
  out:
+        mutex_unlock(&rdev->sched_scan_mtx);
         kfree(creq);
         cfg80211_unlock_rdev(rdev);
         return err;
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index f432bd3755b1..09d994d192ff 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -85,6 +85,7 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
         ASSERT_RTNL();
         ASSERT_RDEV_LOCK(rdev);
         ASSERT_WDEV_LOCK(wdev);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
 
         if (rdev->scan_req)
                 return -EBUSY;
@@ -320,11 +321,9 @@ void cfg80211_sme_scan_done(struct net_device *dev)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
-        mutex_lock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
         wdev_lock(wdev);
         __cfg80211_sme_scan_done(dev);
         wdev_unlock(wdev);
-        mutex_unlock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
 }
 
 void cfg80211_sme_rx_auth(struct net_device *dev,
@@ -924,9 +923,12 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev,
         int err;
 
         mutex_lock(&rdev->devlist_mtx);
+        /* might request scan - scan_mtx -> wdev_mtx dependency */
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(dev->ieee80211_ptr);
         err = __cfg80211_connect(rdev, dev, connect, connkeys, NULL);
         wdev_unlock(dev->ieee80211_ptr);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
 
         return err;
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index b7a531380e19..7586de77a2f8 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -27,7 +27,8 @@
 #define WIPHY_PR_ARG    __entry->wiphy_name
 
 #define WDEV_ENTRY      __field(u32, id)
-#define WDEV_ASSIGN     (__entry->id) = (wdev ? wdev->identifier : 0)
+#define WDEV_ASSIGN     (__entry->id) = (!IS_ERR_OR_NULL(wdev)  \
+                                         ? wdev->identifier : 0)
 #define WDEV_PR_FMT     "wdev(%u)"
 #define WDEV_PR_ARG     (__entry->id)
 
@@ -1778,7 +1779,7 @@ TRACE_EVENT(rdev_set_mac_acl,
         ),
         TP_fast_assign(
                 WIPHY_ASSIGN;
-                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
                 __entry->acl_policy = params->acl_policy;
         ),
         TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", acl policy: %d",
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index fb9622f6d99c..e79cb5c0655a 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -89,6 +89,7 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
 
         cfg80211_lock_rdev(rdev);
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -135,6 +136,7 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         return err;
@@ -190,6 +192,7 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
 
         cfg80211_lock_rdev(rdev);
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         err = 0;
@@ -223,6 +226,7 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         return err;
@@ -285,6 +289,7 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
 
         cfg80211_lock_rdev(rdev);
         mutex_lock(&rdev->devlist_mtx);
+        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -313,6 +318,7 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
         mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         return err;
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 35754cc8a9e5..8dafe6d3c6e4 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -334,6 +334,70 @@ static void xfrm_replay_notify_bmp(struct xfrm_state *x, int event)
                 x->xflags &= ~XFRM_TIME_DEFER;
 }
 
+static void xfrm_replay_notify_esn(struct xfrm_state *x, int event)
+{
+        u32 seq_diff, oseq_diff;
+        struct km_event c;
+        struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
+        struct xfrm_replay_state_esn *preplay_esn = x->preplay_esn;
+
+        /* we send notify messages in case
+         *  1. we updated on of the sequence numbers, and the seqno difference
+         *     is at least x->replay_maxdiff, in this case we also update the
+         *     timeout of our timer function
+         *  2. if x->replay_maxage has elapsed since last update,
+         *     and there were changes
+         *
+         *  The state structure must be locked!
+         */
+
+        switch (event) {
+        case XFRM_REPLAY_UPDATE:
+                if (!x->replay_maxdiff)
+                        break;
+
+                if (replay_esn->seq_hi == preplay_esn->seq_hi)
+                        seq_diff = replay_esn->seq - preplay_esn->seq;
+                else
+                        seq_diff = ~preplay_esn->seq + replay_esn->seq + 1;
+
+                if (replay_esn->oseq_hi == preplay_esn->oseq_hi)
+                        oseq_diff = replay_esn->oseq - preplay_esn->oseq;
+                else
+                        oseq_diff = ~preplay_esn->oseq + replay_esn->oseq + 1;
+
+                if (seq_diff < x->replay_maxdiff &&
+                    oseq_diff < x->replay_maxdiff) {
+
+                        if (x->xflags & XFRM_TIME_DEFER)
+                                event = XFRM_REPLAY_TIMEOUT;
+                        else
+                                return;
+                }
+
+                break;
+
+        case XFRM_REPLAY_TIMEOUT:
+                if (memcmp(x->replay_esn, x->preplay_esn,
+                           xfrm_replay_state_esn_len(replay_esn)) == 0) {
+                        x->xflags |= XFRM_TIME_DEFER;
+                        return;
+                }
+
+                break;
+        }
+
+        memcpy(x->preplay_esn, x->replay_esn,
+               xfrm_replay_state_esn_len(replay_esn));
+        c.event = XFRM_MSG_NEWAE;
+        c.data.aevent = event;
+        km_state_notify(x, &c);
+
+        if (x->replay_maxage &&
+            !mod_timer(&x->rtimer, jiffies + x->replay_maxage))
+                x->xflags &= ~XFRM_TIME_DEFER;
+}
+
 static int xfrm_replay_overflow_esn(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err = 0;
@@ -510,7 +574,7 @@ static struct xfrm_replay xfrm_replay_esn = {
         .advance        = xfrm_replay_advance_esn,
         .check          = xfrm_replay_check_esn,
         .recheck        = xfrm_replay_recheck_esn,
-        .notify         = xfrm_replay_notify_bmp,
+        .notify         = xfrm_replay_notify_esn,
         .overflow       = xfrm_replay_overflow_esn,
 };