40 files changed, 220 insertions, 106 deletions

diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 9ee48cb30179..3d33ecf13327 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -368,7 +368,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                 const char *sptr = va_arg(ap, const char *);
                                 uint16_t len = 0;
                                 if (sptr)
-                                        len = min_t(uint16_t, strlen(sptr),
+                                        len = min_t(size_t, strlen(sptr),
                                                                 USHRT_MAX);
 
                                 errcode = p9pdu_writef(pdu, proto_version,
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 5af18d11b518..2a167658bb95 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -192,10 +192,10 @@ static int pack_sg_list(struct scatterlist *sg, int start,
                 s = rest_of_page(data);
                 if (s > count)
                         s = count;
+                BUG_ON(index > limit);
                 sg_set_buf(&sg[index++], data, s);
                 count -= s;
                 data += s;
-                BUG_ON(index > limit);
         }
 
         return index-start;
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 840e2c64a301..015471d801b4 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -617,6 +617,8 @@ int recv_tt_query(struct sk_buff *skb, struct hard_iface *recv_if)
                          * changes */
                         if (skb_linearize(skb) < 0)
                                 goto out;
+                        /* skb_linearize() possibly changed skb->data */
+                        tt_query = (struct tt_query_packet *)skb->data;
 
                         tt_len = tt_query->tt_data * sizeof(struct tt_change);
 
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index a66c2dcd1088..2ab83d7fb1f8 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -141,13 +141,14 @@ static void tt_orig_list_entry_free_rcu(struct rcu_head *rcu)
         struct tt_orig_list_entry *orig_entry;
 
         orig_entry = container_of(rcu, struct tt_orig_list_entry, rcu);
-        atomic_dec(&orig_entry->orig_node->tt_size);
         orig_node_free_ref(orig_entry->orig_node);
         kfree(orig_entry);
 }
 
 static void tt_orig_list_entry_free_ref(struct tt_orig_list_entry *orig_entry)
 {
+        /* to avoid race conditions, immediately decrease the tt counter */
+        atomic_dec(&orig_entry->orig_node->tt_size);
         call_rcu(&orig_entry->rcu, tt_orig_list_entry_free_rcu);
 }
 
@@ -910,7 +911,6 @@ void tt_global_del_orig(struct bat_priv *bat_priv,
                 }
                 spin_unlock_bh(list_lock);
         }
-        atomic_set(&orig_node->tt_size, 0);
         orig_node->tt_initialised = false;
 }
 
@@ -2031,10 +2031,10 @@ bool is_ap_isolated(struct bat_priv *bat_priv, uint8_t *src, uint8_t *dst)
 {
         struct tt_local_entry *tt_local_entry = NULL;
         struct tt_global_entry *tt_global_entry = NULL;
-        bool ret = true;
+        bool ret = false;
 
         if (!atomic_read(&bat_priv->ap_isolation))
-                return false;
+                goto out;
 
         tt_local_entry = tt_local_hash_find(bat_priv, dst);
         if (!tt_local_entry)
@@ -2044,10 +2044,10 @@ bool is_ap_isolated(struct bat_priv *bat_priv, uint8_t *src, uint8_t *dst)
         if (!tt_global_entry)
                 goto out;
 
-        if (_is_ap_isolated(tt_local_entry, tt_global_entry))
+        if (!_is_ap_isolated(tt_local_entry, tt_global_entry))
                 goto out;
 
-        ret = false;
+        ret = true;
 
 out:
         if (tt_global_entry)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 4eefb7f65cf6..94ad124a4ea3 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3043,6 +3043,50 @@ static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct
         hci_dev_unlock(hdev);
 }
 
+static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
+                                         struct sk_buff *skb)
+{
+        struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
+        struct hci_conn *conn;
+
+        BT_DBG("%s status %u handle %u", hdev->name, ev->status,
+               __le16_to_cpu(ev->handle));
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
+        if (!conn)
+                goto unlock;
+
+        if (!ev->status)
+                conn->sec_level = conn->pending_sec_level;
+
+        clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
+
+        if (ev->status && conn->state == BT_CONNECTED) {
+                hci_acl_disconn(conn, HCI_ERROR_AUTH_FAILURE);
+                hci_conn_put(conn);
+                goto unlock;
+        }
+
+        if (conn->state == BT_CONFIG) {
+                if (!ev->status)
+                        conn->state = BT_CONNECTED;
+
+                hci_proto_connect_cfm(conn, ev->status);
+                hci_conn_put(conn);
+        } else {
+                hci_auth_cfm(conn, ev->status);
+
+                hci_conn_hold(conn);
+                conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+                hci_conn_put(conn);
+        }
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
 static inline u8 hci_get_auth_req(struct hci_conn *conn)
 {
         /* If remote requests dedicated bonding follow that lead */
@@ -3559,6 +3603,10 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_extended_inquiry_result_evt(hdev, skb);
                 break;
 
+        case HCI_EV_KEY_REFRESH_COMPLETE:
+                hci_key_refresh_complete_evt(hdev, skb);
+                break;
+
         case HCI_EV_IO_CAPA_REQUEST:
                 hci_io_capa_request_evt(hdev, skb);
                 break;
diff --git a/net/bluetooth/hidp/Kconfig b/net/bluetooth/hidp/Kconfig
index 4deaca78e91e..9332bc7aa851 100644
--- a/net/bluetooth/hidp/Kconfig
+++ b/net/bluetooth/hidp/Kconfig
@@ -1,6 +1,6 @@
 config BT_HIDP
         tristate "HIDP protocol support"
-        depends on BT && INPUT && HID_SUPPORT
+        depends on BT && INPUT
         select HID
         help
           HIDP (Human Interface Device Protocol) is a transport layer
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 24f144b72a96..4554e80d16a3 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1295,7 +1295,12 @@ static void security_timeout(struct work_struct *work)
         struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
                                                 security_timer.work);
 
-        l2cap_conn_del(conn->hcon, ETIMEDOUT);
+        BT_DBG("conn %p", conn);
+
+        if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
+                smp_chan_destroy(conn);
+                l2cap_conn_del(conn->hcon, ETIMEDOUT);
+        }
 }
 
 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
@@ -2910,12 +2915,14 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
         while (len >= L2CAP_CONF_OPT_SIZE) {
                 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
 
-                switch (type) {
-                case L2CAP_CONF_RFC:
-                        if (olen == sizeof(rfc))
-                                memcpy(&rfc, (void *)val, olen);
-                        goto done;
-                }
+                if (type != L2CAP_CONF_RFC)
+                        continue;
+
+                if (olen != sizeof(rfc))
+                        break;
+
+                memcpy(&rfc, (void *)val, olen);
+                goto done;
         }
 
         /* Use sane default values in case a misbehaving remote device
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 25d220776079..3e5e3362ea00 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1598,7 +1598,7 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
         else
                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
 
-        if (!conn) {
+        if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
                                  MGMT_STATUS_NOT_CONNECTED);
                 goto failed;
@@ -1873,6 +1873,22 @@ static void pairing_complete_cb(struct hci_conn *conn, u8 status)
                 pairing_complete(cmd, mgmt_status(status));
 }
 
+static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
+{
+        struct pending_cmd *cmd;
+
+        BT_DBG("status %u", status);
+
+        if (!status)
+                return;
+
+        cmd = find_pairing(conn);
+        if (!cmd)
+                BT_DBG("Unable to find a pending command");
+        else
+                pairing_complete(cmd, mgmt_status(status));
+}
+
 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                        u16 len)
 {
@@ -1934,6 +1950,8 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         /* For LE, just connecting isn't a proof that the pairing finished */
         if (cp->addr.type == BDADDR_BREDR)
                 conn->connect_cfm_cb = pairing_complete_cb;
+        else
+                conn->connect_cfm_cb = le_connect_complete_cb;
 
         conn->security_cfm_cb = pairing_complete_cb;
         conn->disconn_cfm_cb = pairing_complete_cb;
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 6fc7c4708f3e..37df4e9b3896 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -648,7 +648,7 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
 
         auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
 
-        ret = tk_request(conn, 0, auth, rsp->io_capability, req->io_capability);
+        ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
         if (ret)
                 return SMP_UNSPECIFIED;
 
@@ -703,7 +703,7 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
         return 0;
 }
 
-static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
+static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
 {
         struct smp_ltk *key;
         struct hci_conn *hcon = conn->hcon;
@@ -712,6 +712,9 @@ static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
         if (!key)
                 return 0;
 
+        if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
+                return 0;
+
         if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
                 return 1;
 
@@ -732,7 +735,7 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
         hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
 
-        if (smp_ltk_encrypt(conn))
+        if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
                 return 0;
 
         if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
@@ -771,7 +774,7 @@ int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
                 return 1;
 
         if (hcon->link_mode & HCI_LM_MASTER)
-                if (smp_ltk_encrypt(conn))
+                if (smp_ltk_encrypt(conn, sec_level))
                         goto done;
 
         if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 0a942fbccc9a..e1144e1617be 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -240,6 +240,7 @@ int br_add_bridge(struct net *net, const char *name)
                 return -ENOMEM;
 
         dev_net_set(dev, net);
+        dev->rtnl_link_ops = &br_link_ops;
 
         res = register_netdev(dev);
         if (res)
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 2080485515f1..fe41260fbf38 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -208,7 +208,7 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
         return 0;
 }
 
-static struct rtnl_link_ops br_link_ops __read_mostly = {
+struct rtnl_link_ops br_link_ops __read_mostly = {
         .kind           = "bridge",
         .priv_size      = sizeof(struct net_bridge),
         .setup          = br_dev_setup,
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 1a8ad4fb9a6b..a768b2408edf 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -549,6 +549,7 @@ extern int (*br_fdb_test_addr_hook)(struct net_device *dev, unsigned char *addr)
 #endif
 
 /* br_netlink.c */
+extern struct rtnl_link_ops br_link_ops;
 extern int br_netlink_init(void);
 extern void br_netlink_fini(void);
 extern void br_ifinfo_notify(int event, struct net_bridge_port *port);
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index aa6f716524fd..554b31289607 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -4,8 +4,7 @@
  * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
  * License terms: GNU General Public License (GPL) version 2
  *
- * Borrowed heavily from file: pn_dev.c. Thanks to
- *  Remi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Borrowed heavily from file: pn_dev.c. Thanks to Remi Denis-Courmont
  *  and Sakari Ailus <sakari.ailus@nokia.com>
  */
 
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index fb8944355264..78f1cdad5b33 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -220,6 +220,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
                                                 cfsk_hold, cfsk_put);
                 cf_sk->sk.sk_state = CAIF_CONNECTED;
                 set_tx_flow_on(cf_sk);
+                cf_sk->sk.sk_shutdown = 0;
                 cf_sk->sk.sk_state_change(&cf_sk->sk);
                 break;
 
diff --git a/net/can/raw.c b/net/can/raw.c
index cde1b4a20f75..46cca3a91d19 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -681,9 +681,6 @@ static int raw_sendmsg(struct kiocb *iocb, struct socket *sock,
         if (err < 0)
                 goto free_skb;
 
-        /* to be able to check the received tx sock reference in raw_rcv() */
-        skb_shinfo(skb)->tx_flags |= SKBTX_DRV_NEEDS_SK_REF;
-
         skb->dev = dev;
         skb->sk  = sk;
 
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index a776f751edbf..ba4323bce0e9 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -504,13 +504,6 @@ void ceph_destroy_client(struct ceph_client *client)
         /* unmount */
         ceph_osdc_stop(&client->osdc);
 
-        /*
-         * make sure osd connections close out before destroying the
-         * auth module, which is needed to free those connections'
-         * ceph_authorizers.
-         */
-        ceph_msgr_flush();
-
         ceph_monc_stop(&client->monc);
 
         ceph_debugfs_client_cleanup(client);
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 524f4e4f598b..b332c3d76059 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -563,6 +563,10 @@ static void prepare_write_message(struct ceph_connection *con)
                 m->hdr.seq = cpu_to_le64(++con->out_seq);
                 m->needs_out_seq = false;
         }
+#ifdef CONFIG_BLOCK
+        else
+                m->bio_iter = NULL;
+#endif
 
         dout("prepare_write_message %p seq %lld type %d len %d+%d+%d %d pgs\n",
              m, con->out_seq, le16_to_cpu(m->hdr.type),
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 10d6008d31f2..d0649a9655be 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -847,6 +847,14 @@ void ceph_monc_stop(struct ceph_mon_client *monc)
 
         mutex_unlock(&monc->mutex);
 
+        /*
+         * flush msgr queue before we destroy ourselves to ensure that:
+         *  - any work that references our embedded con is finished.
+         *  - any osd_client or other work that may reference an authorizer
+         *    finishes before we shut down the auth subsystem.
+         */
+        ceph_msgr_flush();
+
         ceph_auth_destroy(monc->auth);
 
         ceph_msg_put(monc->m_auth);
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 1ffebed5ce0f..ca59e66c9787 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -139,15 +139,15 @@ void ceph_osdc_release_request(struct kref *kref)
 
         if (req->r_request)
                 ceph_msg_put(req->r_request);
-        if (req->r_reply)
-                ceph_msg_put(req->r_reply);
         if (req->r_con_filling_msg) {
                 dout("release_request revoking pages %p from con %p\n",
                      req->r_pages, req->r_con_filling_msg);
                 ceph_con_revoke_message(req->r_con_filling_msg,
                                       req->r_reply);
-                ceph_con_put(req->r_con_filling_msg);
+                req->r_con_filling_msg->ops->put(req->r_con_filling_msg);
         }
+        if (req->r_reply)
+                ceph_msg_put(req->r_reply);
         if (req->r_own_pages)
                 ceph_release_page_vector(req->r_pages,
                                          req->r_num_pages);
@@ -1216,7 +1216,7 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
         if (req->r_con_filling_msg == con && req->r_reply == msg) {
                 dout(" dropping con_filling_msg ref %p\n", con);
                 req->r_con_filling_msg = NULL;
-                ceph_con_put(con);
+                con->ops->put(con);
         }
 
         if (!req->r_got_reply) {
@@ -2028,7 +2028,7 @@ static struct ceph_msg *get_reply(struct ceph_connection *con,
                 dout("get_reply revoking msg %p from old con %p\n",
                      req->r_reply, req->r_con_filling_msg);
                 ceph_con_revoke_message(req->r_con_filling_msg, req->r_reply);
-                ceph_con_put(req->r_con_filling_msg);
+                req->r_con_filling_msg->ops->put(req->r_con_filling_msg);
                 req->r_con_filling_msg = NULL;
         }
 
@@ -2063,7 +2063,7 @@ static struct ceph_msg *get_reply(struct ceph_connection *con,
 #endif
         }
         *skip = 0;
-        req->r_con_filling_msg = ceph_con_get(con);
+        req->r_con_filling_msg = con->ops->get(con);
         dout("get_reply tid %lld %p\n", tid, m);
 
 out:
diff --git a/net/core/dev.c b/net/core/dev.c
index cd0981977f5c..6df214041a5e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2089,25 +2089,6 @@ static int dev_gso_segment(struct sk_buff *skb, netdev_features_t features)
         return 0;
 }
 
-/*
- * Try to orphan skb early, right before transmission by the device.
- * We cannot orphan skb if tx timestamp is requested or the sk-reference
- * is needed on driver level for other reasons, e.g. see net/can/raw.c
- */
-static inline void skb_orphan_try(struct sk_buff *skb)
-{
-        struct sock *sk = skb->sk;
-
-        if (sk && !skb_shinfo(skb)->tx_flags) {
-                /* skb_tx_hash() wont be able to get sk.
-                 * We copy sk_hash into skb->rxhash
-                 */
-                if (!skb->rxhash)
-                        skb->rxhash = sk->sk_hash;
-                skb_orphan(skb);
-        }
-}
-
 static bool can_checksum_protocol(netdev_features_t features, __be16 protocol)
 {
         return ((features & NETIF_F_GEN_CSUM) ||
@@ -2193,8 +2174,6 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                 if (!list_empty(&ptype_all))
                         dev_queue_xmit_nit(skb, dev);
 
-                skb_orphan_try(skb);
-
                 features = netif_skb_features(skb);
 
                 if (vlan_tx_tag_present(skb) &&
@@ -2304,7 +2283,7 @@ u16 __skb_tx_hash(const struct net_device *dev, const struct sk_buff *skb,
         if (skb->sk && skb->sk->sk_hash)
                 hash = skb->sk->sk_hash;
         else
-                hash = (__force u16) skb->protocol ^ skb->rxhash;
+                hash = (__force u16) skb->protocol;
         hash = jhash_1word(hash, hashrnd);
 
         return (u16) (((u64) hash * qcount) >> 32) + qoffset;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 74c21b924a79..608327661960 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1349,8 +1349,8 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                         if (w->leaf && fn->fn_flags & RTN_RTINFO) {
                                 int err;
 
-                                if (w->count < w->skip) {
-                                        w->count++;
+                                if (w->skip) {
+                                        w->skip--;
                                         continue;
                                 }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 999a982ad3fd..becb048d18d4 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2957,10 +2957,6 @@ static int __net_init ip6_route_net_init(struct net *net)
         net->ipv6.sysctl.ip6_rt_mtu_expires = 10*60*HZ;
         net->ipv6.sysctl.ip6_rt_min_advmss = IPV6_MIN_MTU - 20 - 40;
 
-#ifdef CONFIG_PROC_FS
-        proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
-        proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
-#endif
         net->ipv6.ip6_rt_gc_expire = 30*HZ;
 
         ret = 0;
@@ -2981,10 +2977,6 @@ out_ip6_dst_ops:
 
 static void __net_exit ip6_route_net_exit(struct net *net)
 {
-#ifdef CONFIG_PROC_FS
-        proc_net_remove(net, "ipv6_route");
-        proc_net_remove(net, "rt6_stats");
-#endif
         kfree(net->ipv6.ip6_null_entry);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
         kfree(net->ipv6.ip6_prohibit_entry);
@@ -2993,11 +2985,33 @@ static void __net_exit ip6_route_net_exit(struct net *net)
         dst_entries_destroy(&net->ipv6.ip6_dst_ops);
 }
 
+static int __net_init ip6_route_net_init_late(struct net *net)
+{
+#ifdef CONFIG_PROC_FS
+        proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
+        proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
+#endif
+        return 0;
+}
+
+static void __net_exit ip6_route_net_exit_late(struct net *net)
+{
+#ifdef CONFIG_PROC_FS
+        proc_net_remove(net, "ipv6_route");
+        proc_net_remove(net, "rt6_stats");
+#endif
+}
+
 static struct pernet_operations ip6_route_net_ops = {
         .init = ip6_route_net_init,
         .exit = ip6_route_net_exit,
 };
 
+static struct pernet_operations ip6_route_net_late_ops = {
+        .init = ip6_route_net_init_late,
+        .exit = ip6_route_net_exit_late,
+};
+
 static struct notifier_block ip6_route_dev_notifier = {
         .notifier_call = ip6_route_dev_notify,
         .priority = 0,
@@ -3047,19 +3061,25 @@ int __init ip6_route_init(void)
         if (ret)
                 goto xfrm6_init;
 
+        ret = register_pernet_subsys(&ip6_route_net_late_ops);
+        if (ret)
+                goto fib6_rules_init;
+
         ret = -ENOBUFS;
         if (__rtnl_register(PF_INET6, RTM_NEWROUTE, inet6_rtm_newroute, NULL, NULL) ||
             __rtnl_register(PF_INET6, RTM_DELROUTE, inet6_rtm_delroute, NULL, NULL) ||
             __rtnl_register(PF_INET6, RTM_GETROUTE, inet6_rtm_getroute, NULL, NULL))
-                goto fib6_rules_init;
+                goto out_register_late_subsys;
 
         ret = register_netdevice_notifier(&ip6_route_dev_notifier);
         if (ret)
-                goto fib6_rules_init;
+                goto out_register_late_subsys;
 
 out:
         return ret;
 
+out_register_late_subsys:
+        unregister_pernet_subsys(&ip6_route_net_late_ops);
 fib6_rules_init:
         fib6_rules_cleanup();
 xfrm6_init:
@@ -3078,6 +3098,7 @@ out_kmem_cache:
 void ip6_route_cleanup(void)
 {
         unregister_netdevice_notifier(&ip6_route_dev_notifier);
+        unregister_pernet_subsys(&ip6_route_net_late_ops);
         fib6_rules_cleanup();
         xfrm6_fini();
         fib6_gc_cleanup();
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 3a9aec29581a..9df64a50b075 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1212,7 +1212,8 @@ have_isn:
         tcp_rsk(req)->snt_isn = isn;
         tcp_rsk(req)->snt_synack = tcp_time_stamp;
 
-        security_inet_conn_request(sk, skb, req);
+        if (security_inet_conn_request(sk, skb, req))
+                goto drop_and_release;
 
         if (tcp_v6_send_synack(sk, req,
                                (struct request_values *)&tmp_ext,
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 07d7d55a1b93..cd6f7a991d80 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -372,7 +372,6 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
                         skb_trim(skb, skb->dev->mtu);
         }
         skb->protocol = ETH_P_AF_IUCV;
-        skb_shinfo(skb)->tx_flags |= SKBTX_DRV_NEEDS_SK_REF;
         nskb = skb_clone(skb, GFP_ATOMIC);
         if (!nskb)
                 return -ENOMEM;
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 185f12f4a5fa..47b259fccd27 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -42,6 +42,11 @@ struct l2tp_eth {
         struct sock             *tunnel_sock;
         struct l2tp_session     *session;
         struct list_head        list;
+        atomic_long_t           tx_bytes;
+        atomic_long_t           tx_packets;
+        atomic_long_t           rx_bytes;
+        atomic_long_t           rx_packets;
+        atomic_long_t           rx_errors;
 };
 
 /* via l2tp_session_priv() */
@@ -88,24 +93,40 @@ static int l2tp_eth_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         struct l2tp_eth *priv = netdev_priv(dev);
         struct l2tp_session *session = priv->session;
 
+        atomic_long_add(skb->len, &priv->tx_bytes);
+        atomic_long_inc(&priv->tx_packets);
+
         l2tp_xmit_skb(session, skb, session->hdr_len);
 
-        dev->stats.tx_bytes += skb->len;
-        dev->stats.tx_packets++;
+        return NETDEV_TX_OK;
+}
 
-        return 0;
+static struct rtnl_link_stats64 *l2tp_eth_get_stats64(struct net_device *dev,
+                                                      struct rtnl_link_stats64 *stats)
+{
+        struct l2tp_eth *priv = netdev_priv(dev);
+
+        stats->tx_bytes   = atomic_long_read(&priv->tx_bytes);
+        stats->tx_packets = atomic_long_read(&priv->tx_packets);
+        stats->rx_bytes   = atomic_long_read(&priv->rx_bytes);
+        stats->rx_packets = atomic_long_read(&priv->rx_packets);
+        stats->rx_errors  = atomic_long_read(&priv->rx_errors);
+        return stats;
 }
 
+
 static struct net_device_ops l2tp_eth_netdev_ops = {
         .ndo_init               = l2tp_eth_dev_init,
         .ndo_uninit             = l2tp_eth_dev_uninit,
         .ndo_start_xmit         = l2tp_eth_dev_xmit,
+        .ndo_get_stats64        = l2tp_eth_get_stats64,
 };
 
 static void l2tp_eth_dev_setup(struct net_device *dev)
 {
         ether_setup(dev);
-        dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+        dev->priv_flags         &= ~IFF_TX_SKB_SHARING;
+        dev->features           |= NETIF_F_LLTX;
         dev->netdev_ops         = &l2tp_eth_netdev_ops;
         dev->destructor         = free_netdev;
 }
@@ -114,17 +135,17 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
 {
         struct l2tp_eth_sess *spriv = l2tp_session_priv(session);
         struct net_device *dev = spriv->dev;
+        struct l2tp_eth *priv = netdev_priv(dev);
 
         if (session->debug & L2TP_MSG_DATA) {
                 unsigned int length;
-                u8 *ptr = skb->data;
 
                 length = min(32u, skb->len);
                 if (!pskb_may_pull(skb, length))
                         goto error;
 
                 pr_debug("%s: eth recv\n", session->name);
-                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
+                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length);
         }
 
         if (!pskb_may_pull(skb, sizeof(ETH_HLEN)))
@@ -139,15 +160,15 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
         nf_reset(skb);
 
         if (dev_forward_skb(dev, skb) == NET_RX_SUCCESS) {
-                dev->stats.rx_packets++;
-                dev->stats.rx_bytes += data_len;
-        } else
-                dev->stats.rx_errors++;
-
+                atomic_long_inc(&priv->rx_packets);
+                atomic_long_add(data_len, &priv->rx_bytes);
+        } else {
+                atomic_long_inc(&priv->rx_errors);
+        }
         return;
 
 error:
-        dev->stats.rx_errors++;
+        atomic_long_inc(&priv->rx_errors);
         kfree_skb(skb);
 }
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index e9cecca5c44d..7d5108a867ad 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2093,6 +2093,9 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         int i, ret;
 
+        if (!ieee80211_sdata_running(sdata))
+                return -ENETDOWN;
+
         if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
                 ret = drv_set_bitrate_mask(local, sdata, mask);
                 if (ret)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 91d84cc77bbf..66e4fcdd1c6b 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1352,6 +1352,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         if (WARN_ON(!ifmgd->associated))
                 return;
 
+        ieee80211_stop_poll(sdata);
+
         memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
 
         ifmgd->associated = NULL;
@@ -2612,8 +2614,6 @@ static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[DEAUTH_DISASSOC_LEN];
 
-        ieee80211_stop_poll(sdata);
-
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
                                false, frame_buf);
         mutex_unlock(&ifmgd->mtx);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 3bb24a121c95..a470e1123a55 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -271,6 +271,9 @@ struct sta_ampdu_mlme {
  * @plink_timer: peer link watch timer
  * @plink_timer_was_running: used by suspend/resume to restore timers
  * @t_offset: timing offset relative to this host
+ * @t_offset_setpoint: reference timing offset of this sta to be used when
+ *      calculating clockdrift
+ * @ch_type: peer's channel type
  * @debugfs: debug filesystem info
  * @dead: set to true when sta is unlinked
  * @uploaded: set to true when sta is uploaded to the driver
@@ -278,6 +281,8 @@ struct sta_ampdu_mlme {
  * @sta: station information we share with the driver
  * @sta_state: duplicates information about station state (for debug)
  * @beacon_loss_count: number of times beacon loss has triggered
+ * @supports_40mhz: tracks whether the station advertised 40 MHz support
+ *      as we overwrite its HT parameters with the currently used value
  */
 struct sta_info {
         /* General information, mostly static */
diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c
index 8781d8f904d9..434b6873b352 100644
--- a/net/mac802154/tx.c
+++ b/net/mac802154/tx.c
@@ -83,9 +83,10 @@ netdev_tx_t mac802154_tx(struct mac802154_priv *priv, struct sk_buff *skb,
 {
         struct xmit_work *work;
 
-        if (!(priv->phy->channels_supported[page] & (1 << chan)))
+        if (!(priv->phy->channels_supported[page] & (1 << chan))) {
                 WARN_ON(1);
                 return NETDEV_TX_OK;
+        }
 
         if (!(priv->hw.flags & IEEE802154_HW_OMIT_CKSUM)) {
                 u16 crc = crc_ccitt(0, skb->data, skb->len);
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index 779ce4ff92ec..5a940dbd74a3 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -5,8 +5,8 @@
  *
  * Copyright (C) 2008 Nokia Corporation.
  *
- * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
- * Original author: Sakari Ailus <sakari.ailus@nokia.com>
+ * Authors: Sakari Ailus <sakari.ailus@nokia.com>
+ *          Rémi Denis-Courmont
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
index bf35b4e1a14c..12c30f3e643e 100644
--- a/net/phonet/datagram.c
+++ b/net/phonet/datagram.c
@@ -5,8 +5,8 @@
  *
  * Copyright (C) 2008 Nokia Corporation.
  *
- * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
- * Original author: Sakari Ailus <sakari.ailus@nokia.com>
+ * Authors: Sakari Ailus <sakari.ailus@nokia.com>
+ *          Rémi Denis-Courmont
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index d01208968c83..a2fba7edfd1f 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -5,7 +5,7 @@
  *
  * Copyright (C) 2008 Nokia Corporation.
  *
- * Author: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Author: Rémi Denis-Courmont
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 9dd4f926f7d1..576f22c9c76e 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -5,7 +5,7 @@
  *
  * Copyright (C) 2008 Nokia Corporation.
  *
- * Author: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Author: Rémi Denis-Courmont
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 36f75a9e2c3d..5bf6341e2dd4 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -5,8 +5,8 @@
  *
  * Copyright (C) 2008 Nokia Corporation.
  *
- * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
- * Original author: Sakari Ailus <sakari.ailus@nokia.com>
+ * Authors: Sakari Ailus <sakari.ailus@nokia.com>
+ *          Rémi Denis-Courmont
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index cfdf135fcd69..7dd762a464e5 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c
@@ -5,8 +5,8 @@
  *
  * Copyright (C) 2008 Nokia Corporation.
  *
- * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
- * Original author: Sakari Ailus <sakari.ailus@nokia.com>
+ * Authors: Sakari Ailus <sakari.ailus@nokia.com>
+ *          Remi Denis-Courmont
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 89cfa9ce4939..0acc943f713a 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -5,8 +5,8 @@
  *
  * Copyright (C) 2008 Nokia Corporation.
  *
- * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
- * Original author: Sakari Ailus <sakari.ailus@nokia.com>
+ * Authors: Sakari Ailus <sakari.ailus@nokia.com>
+ *          Rémi Denis-Courmont
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/sysctl.c b/net/phonet/sysctl.c
index 696348fd31a1..d6bbbbd0af18 100644
--- a/net/phonet/sysctl.c
+++ b/net/phonet/sysctl.c
@@ -5,7 +5,7 @@
  *
  * Copyright (C) 2008 Nokia Corporation.
  *
- * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Author: Rémi Denis-Courmont
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 5942d27b1444..9c90811d1134 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -673,7 +673,9 @@ void sctp_addr_wq_timeout_handler(unsigned long arg)
                                 SCTP_DEBUG_PRINTK("sctp_addrwq_timo_handler: sctp_asconf_mgmt failed\n");
                         sctp_bh_unlock_sock(sk);
                 }
+#if IS_ENABLED(CONFIG_IPV6)
 free_next:
+#endif
                 list_del(&addrw->list);
                 kfree(addrw);
         }
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 15f347477a99..baf5704740ee 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1389,7 +1389,7 @@ static void reg_set_request_processed(void)
         spin_unlock(&reg_requests_lock);
 
         if (last_request->initiator == NL80211_REGDOM_SET_BY_USER)
-                cancel_delayed_work_sync(&reg_timeout);
+                cancel_delayed_work(&reg_timeout);
 
         if (need_more_processing)
                 schedule_work(&reg_work);
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 8f2d68fc3a44..316cfd00914f 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -804,7 +804,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
              ntype == NL80211_IFTYPE_P2P_CLIENT))
                 return -EBUSY;
 
-        if (ntype != otype) {
+        if (ntype != otype && netif_running(dev)) {
                 err = cfg80211_can_change_interface(rdev, dev->ieee80211_ptr,
                                                     ntype);
                 if (err)