48 files changed, 198 insertions, 173 deletions

diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 7fee50d637f9..7d424ac6e760 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1735,7 +1735,6 @@ static int atalk_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
                          size_t size, int flags)
 {
         struct sock *sk = sock->sk;
-        struct sockaddr_at *sat = (struct sockaddr_at *)msg->msg_name;
         struct ddpehdr *ddp;
         int copied = 0;
         int offset = 0;
@@ -1764,14 +1763,13 @@ static int atalk_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
         }
         err = skb_copy_datagram_iovec(skb, offset, msg->msg_iov, copied);
 
-        if (!err) {
-                if (sat) {
-                        sat->sat_family      = AF_APPLETALK;
-                        sat->sat_port        = ddp->deh_sport;
-                        sat->sat_addr.s_node = ddp->deh_snode;
-                        sat->sat_addr.s_net  = ddp->deh_snet;
-                }
-                msg->msg_namelen = sizeof(*sat);
+        if (!err && msg->msg_name) {
+                struct sockaddr_at *sat = msg->msg_name;
+                sat->sat_family      = AF_APPLETALK;
+                sat->sat_port        = ddp->deh_sport;
+                sat->sat_addr.s_node = ddp->deh_snode;
+                sat->sat_addr.s_net  = ddp->deh_snet;
+                msg->msg_namelen     = sizeof(*sat);
         }
 
         skb_free_datagram(sk, skb);     /* Free the datagram. */
diff --git a/net/atm/common.c b/net/atm/common.c
index 737bef59ce89..7b491006eaf4 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -531,8 +531,6 @@ int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         struct sk_buff *skb;
         int copied, error = -EINVAL;
 
-        msg->msg_namelen = 0;
-
         if (sock->state != SS_CONNECTED)
                 return -ENOTCONN;
 
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index a00123ebb0ae..7bb1605bdfd9 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1636,11 +1636,11 @@ static int ax25_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
 
-        if (msg->msg_namelen != 0) {
-                struct sockaddr_ax25 *sax = (struct sockaddr_ax25 *)msg->msg_name;
+        if (msg->msg_name) {
                 ax25_digi digi;
                 ax25_address src;
                 const unsigned char *mac = skb_mac_header(skb);
+                struct sockaddr_ax25 *sax = msg->msg_name;
 
                 memset(sax, 0, sizeof(struct full_sockaddr_ax25));
                 ax25_addr_parse(mac + 1, skb->data - mac - 1, &src, NULL,
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index f6a1671ea2ff..56ca494621c6 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -224,10 +224,9 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb) {
-                if (sk->sk_shutdown & RCV_SHUTDOWN) {
-                        msg->msg_namelen = 0;
+                if (sk->sk_shutdown & RCV_SHUTDOWN)
                         return 0;
-                }
+
                 return err;
         }
 
@@ -245,8 +244,6 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                 if (bt_sk(sk)->skb_msg_name)
                         bt_sk(sk)->skb_msg_name(skb, msg->msg_name,
                                                 &msg->msg_namelen);
-                else
-                        msg->msg_namelen = 0;
         }
 
         skb_free_datagram(sk, skb);
@@ -295,8 +292,6 @@ int bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (flags & MSG_OOB)
                 return -EOPNOTSUPP;
 
-        msg->msg_namelen = 0;
-
         BT_DBG("sk %p size %zu", sk, size);
 
         lock_sock(sk);
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 71f0be173080..6a6c8bb4fd72 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -856,8 +856,6 @@ static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (!skb)
                 return err;
 
-        msg->msg_namelen = 0;
-
         copied = skb->len;
         if (len < copied) {
                 msg->msg_flags |= MSG_TRUNC;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 0cef67707838..4af3821df880 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -2439,6 +2439,9 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
         int err;
         struct sk_buff_head seg_queue;
 
+        if (!chan->conn)
+                return -ENOTCONN;
+
         /* Connectionless channel */
         if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
                 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 94d06cbfbc18..facd8a79c038 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -694,6 +694,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = 0;
         addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
         if (*err < 0)
                 goto failed;
@@ -719,6 +720,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
         addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
         if (*err == 0 || *err == -EINPROGRESS)
                 return s;
@@ -1983,6 +1985,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
         addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
         if (err < 0) {
                 BT_ERR("Bind failed %d", err);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index c4d3d423f89b..3c2d3e4aa2f5 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -615,7 +615,6 @@ static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                 rfcomm_dlc_accept(d);
-                msg->msg_namelen = 0;
                 return 0;
         }
 
@@ -739,8 +738,9 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 {
         struct sock *sk = sock->sk;
+        struct sock *l2cap_sk;
+        struct l2cap_conn *conn;
         struct rfcomm_conninfo cinfo;
-        struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
         int len, err = 0;
         u32 opt;
 
@@ -783,6 +783,9 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
                         break;
                 }
 
+                l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
+                conn = l2cap_pi(l2cap_sk)->chan->conn;
+
                 memset(&cinfo, 0, sizeof(cinfo));
                 cinfo.hci_handle = conn->hcon->handle;
                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 12a0e51e21e1..24fa3964b3c8 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -711,7 +711,6 @@ static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
                 sco_conn_defer_accept(pi->conn->hcon, pi->setting);
                 sk->sk_state = BT_CONFIG;
-                msg->msg_namelen = 0;
 
                 release_sock(sk);
                 return 0;
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 85a2796cac61..4b07acb8293c 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -742,6 +742,9 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
         BT_DBG("conn %p", conn);
 
+        if (!(conn->hcon->link_mode & HCI_LM_MASTER))
+                return SMP_CMD_NOTSUPP;
+
         hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
 
         if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 6e6194fcd88e..4bf02adb5dc2 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -172,6 +172,8 @@ void br_dev_delete(struct net_device *dev, struct list_head *head)
                 del_nbp(p);
         }
 
+        br_fdb_delete_by_port(br, NULL, 1);
+
         br_vlan_flush(br);
         del_timer_sync(&br->gc_timer);
 
diff --git a/net/bridge/netfilter/ebt_ip6.c b/net/bridge/netfilter/ebt_ip6.c
index 99c85668f551..17fd5f2cb4b8 100644
--- a/net/bridge/netfilter/ebt_ip6.c
+++ b/net/bridge/netfilter/ebt_ip6.c
@@ -48,10 +48,12 @@ ebt_ip6_mt(const struct sk_buff *skb, struct xt_action_param *par)
         if (info->bitmask & EBT_IP6_TCLASS &&
            FWINV(info->tclass != ipv6_get_dsfield(ih6), EBT_IP6_TCLASS))
                 return false;
-        if (FWINV(ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk,
-                                       &info->saddr), EBT_IP6_SOURCE) ||
+        if ((info->bitmask & EBT_IP6_SOURCE &&
+            FWINV(ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk,
+                                       &info->saddr), EBT_IP6_SOURCE)) ||
+            (info->bitmask & EBT_IP6_DEST &&
             FWINV(ipv6_masked_addr_cmp(&ih6->daddr, &info->dmsk,
-                                       &info->daddr), EBT_IP6_DEST))
+                                       &info->daddr), EBT_IP6_DEST)))
                 return false;
         if (info->bitmask & EBT_IP6_PROTO) {
                 uint8_t nexthdr = ih6->nexthdr;
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 05a41c7ec304..d6be3edb7a43 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -286,8 +286,6 @@ static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (m->msg_flags&MSG_OOB)
                 goto read_error;
 
-        m->msg_namelen = 0;
-
         skb = skb_recv_datagram(sk, flags, 0 , &ret);
         if (!skb)
                 goto read_error;
@@ -361,8 +359,6 @@ static int caif_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (flags&MSG_OOB)
                 goto out;
 
-        msg->msg_namelen = 0;
-
         /*
          * Lock the socket to prevent queue disordering
          * while sleeps in memcpy_tomsg
diff --git a/net/compat.c b/net/compat.c
index 89032580bd1d..618c6a8a911b 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -93,7 +93,8 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
                         if (err < 0)
                                 return err;
                 }
-                kern_msg->msg_name = kern_address;
+                if (kern_msg->msg_name)
+                        kern_msg->msg_name = kern_address;
         } else
                 kern_msg->msg_name = NULL;
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 7e00a7342ee6..ba3b7ea5ebb3 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4996,7 +4996,7 @@ static void dev_change_rx_flags(struct net_device *dev, int flags)
 {
         const struct net_device_ops *ops = dev->netdev_ops;
 
-        if ((dev->flags & IFF_UP) && ops->ndo_change_rx_flags)
+        if (ops->ndo_change_rx_flags)
                 ops->ndo_change_rx_flags(dev, flags);
 }
 
diff --git a/net/core/iovec.c b/net/core/iovec.c
index 4cdb7c48dad6..b61869429f4c 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -48,7 +48,8 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
                         if (err < 0)
                                 return err;
                 }
-                m->msg_name = address;
+                if (m->msg_name)
+                        m->msg_name = address;
         } else {
                 m->msg_name = NULL;
         }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 8cec1e6b844d..2718fed53d8c 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2796,6 +2796,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
         struct sk_buff *segs = NULL;
         struct sk_buff *tail = NULL;
         struct sk_buff *fskb = skb_shinfo(skb)->frag_list;
+        skb_frag_t *skb_frag = skb_shinfo(skb)->frags;
         unsigned int mss = skb_shinfo(skb)->gso_size;
         unsigned int doffset = skb->data - skb_mac_header(skb);
         unsigned int offset = doffset;
@@ -2835,16 +2836,38 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                 if (hsize > len || !sg)
                         hsize = len;
 
-                if (!hsize && i >= nfrags) {
-                        BUG_ON(fskb->len != len);
+                if (!hsize && i >= nfrags && skb_headlen(fskb) &&
+                    (skb_headlen(fskb) == len || sg)) {
+                        BUG_ON(skb_headlen(fskb) > len);
+
+                        i = 0;
+                        nfrags = skb_shinfo(fskb)->nr_frags;
+                        skb_frag = skb_shinfo(fskb)->frags;
+                        pos += skb_headlen(fskb);
+
+                        while (pos < offset + len) {
+                                BUG_ON(i >= nfrags);
+
+                                size = skb_frag_size(skb_frag);
+                                if (pos + size > offset + len)
+                                        break;
+
+                                i++;
+                                pos += size;
+                                skb_frag++;
+                        }
 
-                        pos += len;
                         nskb = skb_clone(fskb, GFP_ATOMIC);
                         fskb = fskb->next;
 
                         if (unlikely(!nskb))
                                 goto err;
 
+                        if (unlikely(pskb_trim(nskb, len))) {
+                                kfree_skb(nskb);
+                                goto err;
+                        }
+
                         hsize = skb_end_offset(nskb);
                         if (skb_cow_head(nskb, doffset + headroom)) {
                                 kfree_skb(nskb);
@@ -2881,7 +2904,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                                                  nskb->data - tnl_hlen,
                                                  doffset + tnl_hlen);
 
-                if (fskb != skb_shinfo(skb)->frag_list)
+                if (nskb->len == len + doffset)
                         goto perform_csum_check;
 
                 if (!sg) {
@@ -2899,8 +2922,28 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
 
                 skb_shinfo(nskb)->tx_flags = skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG;
 
-                while (pos < offset + len && i < nfrags) {
-                        *frag = skb_shinfo(skb)->frags[i];
+                while (pos < offset + len) {
+                        if (i >= nfrags) {
+                                BUG_ON(skb_headlen(fskb));
+
+                                i = 0;
+                                nfrags = skb_shinfo(fskb)->nr_frags;
+                                skb_frag = skb_shinfo(fskb)->frags;
+
+                                BUG_ON(!nfrags);
+
+                                fskb = fskb->next;
+                        }
+
+                        if (unlikely(skb_shinfo(nskb)->nr_frags >=
+                                     MAX_SKB_FRAGS)) {
+                                net_warn_ratelimited(
+                                        "skb_segment: too many frags: %u %u\n",
+                                        pos, mss);
+                                goto err;
+                        }
+
+                        *frag = *skb_frag;
                         __skb_frag_ref(frag);
                         size = skb_frag_size(frag);
 
@@ -2913,6 +2956,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
 
                         if (pos + size <= offset + len) {
                                 i++;
+                                skb_frag++;
                                 pos += size;
                         } else {
                                 skb_frag_size_sub(frag, pos + size - (offset + len));
@@ -2922,25 +2966,6 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                         frag++;
                 }
 
-                if (pos < offset + len) {
-                        struct sk_buff *fskb2 = fskb;
-
-                        BUG_ON(pos + fskb->len != offset + len);
-
-                        pos += fskb->len;
-                        fskb = fskb->next;
-
-                        if (fskb2->next) {
-                                fskb2 = skb_clone(fskb2, GFP_ATOMIC);
-                                if (!fskb2)
-                                        goto err;
-                        } else
-                                skb_get(fskb2);
-
-                        SKB_FRAG_ASSERT(nskb);
-                        skb_shinfo(nskb)->frag_list = fskb2;
-                }
-
 skip_fraglist:
                 nskb->data_len = len - hsize;
                 nskb->len += nskb->data_len;
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index 01cffeaa0085..f13bd91d9a56 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -244,6 +244,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet,
 
         this_cpu_inc(snet->stats->cookie_valid);
         opts->mss = mss;
+        opts->options |= XT_SYNPROXY_OPT_MSS;
 
         if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
                 synproxy_check_timestamp_cookie(opts);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index f428935c50db..f8da28278014 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1776,8 +1776,12 @@ local_input:
                 rth->dst.error= -err;
                 rth->rt_flags   &= ~RTCF_LOCAL;
         }
-        if (do_cache)
-                rt_cache_route(&FIB_RES_NH(res), rth);
+        if (do_cache) {
+                if (unlikely(!rt_cache_route(&FIB_RES_NH(res), rth))) {
+                        rth->dst.flags |= DST_NOCACHE;
+                        rt_add_uncached_list(rth);
+                }
+        }
         skb_dst_set(skb, &rth->dst);
         err = 0;
         goto out;
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index bf9f612c1bc2..f78f41aca8e9 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -259,6 +259,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet,
 
         this_cpu_inc(snet->stats->cookie_valid);
         opts->mss = mss;
+        opts->options |= XT_SYNPROXY_OPT_MSS;
 
         if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
                 synproxy_check_timestamp_cookie(opts);
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 7a1e0fc1bd4d..e096025b477f 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -1823,8 +1823,6 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (skb->tstamp.tv64)
                 sk->sk_stamp = skb->tstamp;
 
-        msg->msg_namelen = sizeof(*sipx);
-
         if (sipx) {
                 sipx->sipx_family       = AF_IPX;
                 sipx->sipx_port         = ipx->ipx_source.sock;
@@ -1832,6 +1830,7 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
                 sipx->sipx_network      = IPX_SKB_CB(skb)->ipx_source_net;
                 sipx->sipx_type         = ipx->ipx_type;
                 sipx->sipx_zero         = 0;
+                msg->msg_namelen        = sizeof(*sipx);
         }
         rc = copied;
 
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 0f676908d15b..de7db23049f1 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1385,8 +1385,6 @@ static int irda_recvmsg_dgram(struct kiocb *iocb, struct socket *sock,
 
         IRDA_DEBUG(4, "%s()\n", __func__);
 
-        msg->msg_namelen = 0;
-
         skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                 flags & MSG_DONTWAIT, &err);
         if (!skb)
@@ -1451,8 +1449,6 @@ static int irda_recvmsg_stream(struct kiocb *iocb, struct socket *sock,
         target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
         timeo = sock_rcvtimeo(sk, noblock);
 
-        msg->msg_namelen = 0;
-
         do {
                 int chunk;
                 struct sk_buff *skb = skb_dequeue(&sk->sk_receive_queue);
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 168aff5e60de..c4b7218058b6 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1324,8 +1324,6 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         int err = 0;
         u32 offset;
 
-        msg->msg_namelen = 0;
-
         if ((sk->sk_state == IUCV_DISCONN) &&
             skb_queue_empty(&iucv->backlog_skb_q) &&
             skb_queue_empty(&sk->sk_receive_queue) &&
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 911ef03bf8fb..545f047868ad 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3616,7 +3616,6 @@ static int pfkey_recvmsg(struct kiocb *kiocb,
         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
                 goto out;
 
-        msg->msg_namelen = 0;
         skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err);
         if (skb == NULL)
                 goto out;
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index ffda81ef1a70..be5fadf34739 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -197,8 +197,6 @@ static int pppol2tp_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (sk->sk_state & PPPOX_BOUND)
                 goto end;
 
-        msg->msg_namelen = 0;
-
         err = 0;
         skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                 flags & MSG_DONTWAIT, &err);
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 6cba486353e8..7b01b9f5846c 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -720,8 +720,6 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
         int target;     /* Read at least this many bytes */
         long timeo;
 
-        msg->msg_namelen = 0;
-
         lock_sock(sk);
         copied = -ENOTCONN;
         if (unlikely(sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN))
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 48acec17e27a..c3398cd99b94 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -909,7 +909,7 @@ config NETFILTER_XT_MATCH_CONNLABEL
           connection simultaneously.
 
 config NETFILTER_XT_MATCH_CONNLIMIT
-        tristate '"connlimit" match support"'
+        tristate '"connlimit" match support'
         depends on NF_CONNTRACK
         depends on NETFILTER_ADVANCED
         ---help---
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index e22d950c60b3..43549eb7a7be 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -764,9 +764,10 @@ void nf_conntrack_free(struct nf_conn *ct)
         struct net *net = nf_ct_net(ct);
 
         nf_ct_ext_destroy(ct);
-        atomic_dec(&net->ct.count);
         nf_ct_ext_free(ct);
         kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
+        smp_mb__before_atomic_dec();
+        atomic_dec(&net->ct.count);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_free);
 
diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
index 5f9bfd060dea..17c1bcb182c6 100644
--- a/net/netfilter/nf_conntrack_seqadj.c
+++ b/net/netfilter/nf_conntrack_seqadj.c
@@ -41,8 +41,8 @@ int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
         spin_lock_bh(&ct->lock);
         this_way = &seqadj->seq[dir];
         if (this_way->offset_before == this_way->offset_after ||
-            before(this_way->correction_pos, seq)) {
-                this_way->correction_pos = seq;
+            before(this_way->correction_pos, ntohl(seq))) {
+                this_way->correction_pos = ntohl(seq);
                 this_way->offset_before  = this_way->offset_after;
                 this_way->offset_after  += off;
         }
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index cdf4567ba9b3..9858e3e51a3a 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -151,9 +151,10 @@ void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,
         opts->tsecr = opts->tsval;
         opts->tsval = tcp_time_stamp & ~0x3f;
 
-        if (opts->options & XT_SYNPROXY_OPT_WSCALE)
-                opts->tsval |= info->wscale;
-        else
+        if (opts->options & XT_SYNPROXY_OPT_WSCALE) {
+                opts->tsval |= opts->wscale;
+                opts->wscale = info->wscale;
+        } else
                 opts->tsval |= 0xf;
 
         if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index a82667c64729..da0c1f4ada12 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -128,7 +128,7 @@ static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1]
         [NFTA_RULE_COMPAT_FLAGS]        = { .type = NLA_U32 },
 };
 
-static u8 nft_parse_compat(const struct nlattr *attr, bool *inv)
+static int nft_parse_compat(const struct nlattr *attr, u8 *proto, bool *inv)
 {
         struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
         u32 flags;
@@ -148,7 +148,8 @@ static u8 nft_parse_compat(const struct nlattr *attr, bool *inv)
         if (flags & NFT_RULE_COMPAT_F_INV)
                 *inv = true;
 
-        return ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
+        *proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
+        return 0;
 }
 
 static int
@@ -166,8 +167,11 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
 
         target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info);
 
-        if (ctx->nla[NFTA_RULE_COMPAT])
-                proto = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &inv);
+        if (ctx->nla[NFTA_RULE_COMPAT]) {
+                ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
+                if (ret < 0)
+                        goto err;
+        }
 
         nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);
 
@@ -356,8 +360,11 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
 
         match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info);
 
-        if (ctx->nla[NFTA_RULE_COMPAT])
-                proto = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &inv);
+        if (ctx->nla[NFTA_RULE_COMPAT]) {
+                ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
+                if (ret < 0)
+                        goto err;
+        }
 
         nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv);
 
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index f0176e1a5a81..bca50b95c182 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2335,8 +2335,6 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         }
 #endif
 
-        msg->msg_namelen = 0;
-
         copied = data_skb->len;
         if (len < copied) {
                 msg->msg_flags |= MSG_TRUNC;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 7dbc4f732c75..4518a57aa5fe 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1045,7 +1045,7 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group,
 int genlmsg_multicast_allns(struct genl_family *family, struct sk_buff *skb,
                             u32 portid, unsigned int group, gfp_t flags)
 {
-        if (group >= family->n_mcgrps)
+        if (WARN_ON_ONCE(group >= family->n_mcgrps))
                 return -EINVAL;
         group = family->mcgrp_offset + group;
         return genlmsg_mcast(skb, portid, group, flags);
@@ -1062,7 +1062,7 @@ void genl_notify(struct genl_family *family,
         if (nlh)
                 report = nlmsg_report(nlh);
 
-        if (group >= family->n_mcgrps)
+        if (WARN_ON_ONCE(group >= family->n_mcgrps))
                 return;
         group = family->mcgrp_offset + group;
         nlmsg_notify(sk, skb, portid, group, report, flags);
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 698814bfa7ad..53c19a35fc6d 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1179,10 +1179,9 @@ static int nr_recvmsg(struct kiocb *iocb, struct socket *sock,
                 sax->sax25_family = AF_NETROM;
                 skb_copy_from_linear_data_offset(skb, 7, sax->sax25_call.ax25_call,
                               AX25_ADDR_LEN);
+                msg->msg_namelen = sizeof(*sax);
         }
 
-        msg->msg_namelen = sizeof(*sax);
-
         skb_free_datagram(sk, skb);
 
         release_sock(sk);
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index d308402b67d8..824c6056bf82 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -807,8 +807,6 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         pr_debug("%p %zu\n", sk, len);
 
-        msg->msg_namelen = 0;
-
         lock_sock(sk);
 
         if (sk->sk_state == LLCP_CLOSED &&
diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
index cd958b381f96..66bcd2eb5773 100644
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -244,8 +244,6 @@ static int rawsock_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (!skb)
                 return rc;
 
-        msg->msg_namelen = 0;
-
         copied = skb->len;
         if (len < copied) {
                 msg->msg_flags |= MSG_TRUNC;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 2e8286b47c28..ac27c86ef6d1 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -244,11 +244,15 @@ static void __fanout_link(struct sock *sk, struct packet_sock *po);
 static void register_prot_hook(struct sock *sk)
 {
         struct packet_sock *po = pkt_sk(sk);
+
         if (!po->running) {
-                if (po->fanout)
+                if (po->fanout) {
                         __fanout_link(sk, po);
-                else
+                } else {
                         dev_add_pack(&po->prot_hook);
+                        rcu_assign_pointer(po->cached_dev, po->prot_hook.dev);
+                }
+
                 sock_hold(sk);
                 po->running = 1;
         }
@@ -266,10 +270,13 @@ static void __unregister_prot_hook(struct sock *sk, bool sync)
         struct packet_sock *po = pkt_sk(sk);
 
         po->running = 0;
-        if (po->fanout)
+        if (po->fanout) {
                 __fanout_unlink(sk, po);
-        else
+        } else {
                 __dev_remove_pack(&po->prot_hook);
+                RCU_INIT_POINTER(po->cached_dev, NULL);
+        }
+
         __sock_put(sk);
 
         if (sync) {
@@ -2052,12 +2059,24 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
         return tp_len;
 }
 
+static struct net_device *packet_cached_dev_get(struct packet_sock *po)
+{
+        struct net_device *dev;
+
+        rcu_read_lock();
+        dev = rcu_dereference(po->cached_dev);
+        if (dev)
+                dev_hold(dev);
+        rcu_read_unlock();
+
+        return dev;
+}
+
 static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 {
         struct sk_buff *skb;
         struct net_device *dev;
         __be16 proto;
-        bool need_rls_dev = false;
         int err, reserve = 0;
         void *ph;
         struct sockaddr_ll *saddr = (struct sockaddr_ll *)msg->msg_name;
@@ -2070,7 +2089,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
         mutex_lock(&po->pg_vec_lock);
 
         if (saddr == NULL) {
-                dev = po->prot_hook.dev;
+                dev     = packet_cached_dev_get(po);
                 proto   = po->num;
                 addr    = NULL;
         } else {
@@ -2084,19 +2103,17 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                 proto   = saddr->sll_protocol;
                 addr    = saddr->sll_addr;
                 dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
-                need_rls_dev = true;
         }
 
         err = -ENXIO;
         if (unlikely(dev == NULL))
                 goto out;
-
-        reserve = dev->hard_header_len;
-
         err = -ENETDOWN;
         if (unlikely(!(dev->flags & IFF_UP)))
                 goto out_put;
 
+        reserve = dev->hard_header_len;
+
         size_max = po->tx_ring.frame_size
                 - (po->tp_hdrlen - sizeof(struct sockaddr_ll));
 
@@ -2173,8 +2190,7 @@ out_status:
         __packet_set_status(po, ph, status);
         kfree_skb(skb);
 out_put:
-        if (need_rls_dev)
-                dev_put(dev);
+        dev_put(dev);
 out:
         mutex_unlock(&po->pg_vec_lock);
         return err;
@@ -2212,7 +2228,6 @@ static int packet_snd(struct socket *sock,
         struct sk_buff *skb;
         struct net_device *dev;
         __be16 proto;
-        bool need_rls_dev = false;
         unsigned char *addr;
         int err, reserve = 0;
         struct virtio_net_hdr vnet_hdr = { 0 };
@@ -2228,7 +2243,7 @@ static int packet_snd(struct socket *sock,
          */
 
         if (saddr == NULL) {
-                dev = po->prot_hook.dev;
+                dev     = packet_cached_dev_get(po);
                 proto   = po->num;
                 addr    = NULL;
         } else {
@@ -2240,19 +2255,17 @@ static int packet_snd(struct socket *sock,
                 proto   = saddr->sll_protocol;
                 addr    = saddr->sll_addr;
                 dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex);
-                need_rls_dev = true;
         }
 
         err = -ENXIO;
-        if (dev == NULL)
+        if (unlikely(dev == NULL))
                 goto out_unlock;
-        if (sock->type == SOCK_RAW)
-                reserve = dev->hard_header_len;
-
         err = -ENETDOWN;
-        if (!(dev->flags & IFF_UP))
+        if (unlikely(!(dev->flags & IFF_UP)))
                 goto out_unlock;
 
+        if (sock->type == SOCK_RAW)
+                reserve = dev->hard_header_len;
         if (po->has_vnet_hdr) {
                 vnet_hdr_len = sizeof(vnet_hdr);
 
@@ -2386,15 +2399,14 @@ static int packet_snd(struct socket *sock,
         if (err > 0 && (err = net_xmit_errno(err)) != 0)
                 goto out_unlock;
 
-        if (need_rls_dev)
-                dev_put(dev);
+        dev_put(dev);
 
         return len;
 
 out_free:
         kfree_skb(skb);
 out_unlock:
-        if (dev && need_rls_dev)
+        if (dev)
                 dev_put(dev);
 out:
         return err;
@@ -2614,6 +2626,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
         po = pkt_sk(sk);
         sk->sk_family = PF_PACKET;
         po->num = proto;
+        RCU_INIT_POINTER(po->cached_dev, NULL);
 
         sk->sk_destruct = packet_sock_destruct;
         sk_refcnt_debug_inc(sk);
@@ -2660,7 +2673,6 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
         struct sock *sk = sock->sk;
         struct sk_buff *skb;
         int copied, err;
-        struct sockaddr_ll *sll;
         int vnet_hdr_len = 0;
 
         err = -EINVAL;
@@ -2744,22 +2756,10 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
                         goto out_free;
         }
 
-        /*
-         *      If the address length field is there to be filled in, we fill
-         *      it in now.
+        /* You lose any data beyond the buffer you gave. If it worries
+         * a user program they can ask the device for its MTU
+         * anyway.
          */
-
-        sll = &PACKET_SKB_CB(skb)->sa.ll;
-        if (sock->type == SOCK_PACKET)
-                msg->msg_namelen = sizeof(struct sockaddr_pkt);
-        else
-                msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
-
-        /*
-         *      You lose any data beyond the buffer you gave. If it worries a
-         *      user program they can ask the device for its MTU anyway.
-         */
-
         copied = skb->len;
         if (copied > len) {
                 copied = len;
@@ -2772,9 +2772,20 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         sock_recv_ts_and_drops(msg, sk, skb);
 
-        if (msg->msg_name)
+        if (msg->msg_name) {
+                /* If the address length field is there to be filled
+                 * in, we fill it in now.
+                 */
+                if (sock->type == SOCK_PACKET) {
+                        msg->msg_namelen = sizeof(struct sockaddr_pkt);
+                } else {
+                        struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
+                        msg->msg_namelen = sll->sll_halen +
+                                offsetof(struct sockaddr_ll, sll_addr);
+                }
                 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
                        msg->msg_namelen);
+        }
 
         if (pkt_sk(sk)->auxdata) {
                 struct tpacket_auxdata aux;
diff --git a/net/packet/internal.h b/net/packet/internal.h
index c4e4b4561207..1035fa2d909c 100644
--- a/net/packet/internal.h
+++ b/net/packet/internal.h
@@ -113,6 +113,7 @@ struct packet_sock {
         unsigned int            tp_loss:1;
         unsigned int            tp_tx_has_off:1;
         unsigned int            tp_tstamp;
+        struct net_device __rcu *cached_dev;
         struct packet_type      prot_hook ____cacheline_aligned_in_smp;
 };
 
diff --git a/net/rds/recv.c b/net/rds/recv.c
index 9f0f17cf6bf9..de339b24ca14 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -410,8 +410,6 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
 
         rdsdebug("size %zu flags 0x%x timeo %ld\n", size, msg_flags, timeo);
 
-        msg->msg_namelen = 0;
-
         if (msg_flags & MSG_OOB)
                 goto out;
 
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index e98fcfbe6007..33af77246bfe 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1216,7 +1216,6 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
 {
         struct sock *sk = sock->sk;
         struct rose_sock *rose = rose_sk(sk);
-        struct sockaddr_rose *srose = (struct sockaddr_rose *)msg->msg_name;
         size_t copied;
         unsigned char *asmptr;
         struct sk_buff *skb;
@@ -1252,8 +1251,11 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
 
-        if (srose != NULL) {
-                memset(srose, 0, msg->msg_namelen);
+        if (msg->msg_name) {
+                struct sockaddr_rose *srose;
+
+                memset(msg->msg_name, 0, sizeof(struct full_sockaddr_rose));
+                srose = msg->msg_name;
                 srose->srose_family = AF_ROSE;
                 srose->srose_addr   = rose->dest_addr;
                 srose->srose_call   = rose->dest_call;
diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
index 4b48687c3890..898492a8d61b 100644
--- a/net/rxrpc/ar-recvmsg.c
+++ b/net/rxrpc/ar-recvmsg.c
@@ -143,10 +143,13 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                 /* copy the peer address and timestamp */
                 if (!continue_call) {
-                        if (msg->msg_name && msg->msg_namelen > 0)
+                        if (msg->msg_name) {
+                                size_t len =
+                                        sizeof(call->conn->trans->peer->srx);
                                 memcpy(msg->msg_name,
-                                       &call->conn->trans->peer->srx,
-                                       sizeof(call->conn->trans->peer->srx));
+                                       &call->conn->trans->peer->srx, len);
+                                msg->msg_namelen = len;
+                        }
                         sock_recv_ts_and_drops(msg, &rx->sk, skb);
                 }
 
diff --git a/net/socket.c b/net/socket.c
index c226aceee65b..0b18693f2be6 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -221,12 +221,13 @@ static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
         int err;
         int len;
 
+        BUG_ON(klen > sizeof(struct sockaddr_storage));
         err = get_user(len, ulen);
         if (err)
                 return err;
         if (len > klen)
                 len = klen;
-        if (len < 0 || len > sizeof(struct sockaddr_storage))
+        if (len < 0)
                 return -EINVAL;
         if (len) {
                 if (audit_sockaddr(klen, kaddr))
@@ -1840,8 +1841,10 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
         msg.msg_iov = &iov;
         iov.iov_len = size;
         iov.iov_base = ubuf;
-        msg.msg_name = (struct sockaddr *)&address;
-        msg.msg_namelen = sizeof(address);
+        /* Save some cycles and don't copy the address if not needed */
+        msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
+        /* We assume all kernel code knows the size of sockaddr_storage */
+        msg.msg_namelen = 0;
         if (sock->file->f_flags & O_NONBLOCK)
                 flags |= MSG_DONTWAIT;
         err = sock_recvmsg(sock, &msg, size, flags);
@@ -2221,16 +2224,14 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
                         goto out;
         }
 
-        /*
-         *      Save the user-mode address (verify_iovec will change the
-         *      kernel msghdr to use the kernel address space)
+        /* Save the user-mode address (verify_iovec will change the
+         * kernel msghdr to use the kernel address space)
          */
-
         uaddr = (__force void __user *)msg_sys->msg_name;
         uaddr_len = COMPAT_NAMELEN(msg);
-        if (MSG_CMSG_COMPAT & flags) {
+        if (MSG_CMSG_COMPAT & flags)
                 err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
-        } else
+        else
                 err = verify_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
         if (err < 0)
                 goto out_freeiov;
@@ -2239,6 +2240,9 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
         cmsg_ptr = (unsigned long)msg_sys->msg_control;
         msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
 
+        /* We assume all kernel code knows the size of sockaddr_storage */
+        msg_sys->msg_namelen = 0;
+
         if (sock->file->f_flags & O_NONBLOCK)
                 flags |= MSG_DONTWAIT;
         err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 3906527259d1..3b61851bb927 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -980,9 +980,6 @@ static int recv_msg(struct kiocb *iocb, struct socket *sock,
                 goto exit;
         }
 
-        /* will be updated in set_orig_addr() if needed */
-        m->msg_namelen = 0;
-
         timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 restart:
 
@@ -1091,9 +1088,6 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
                 goto exit;
         }
 
-        /* will be updated in set_orig_addr() if needed */
-        m->msg_namelen = 0;
-
         target = sock_rcvlowat(sk, flags & MSG_WAITALL, buf_len);
         timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index c1f403bed683..01625ccc3ae6 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1754,7 +1754,6 @@ static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
 {
         struct unix_sock *u = unix_sk(sk);
 
-        msg->msg_namelen = 0;
         if (u->addr) {
                 msg->msg_namelen = u->addr->len;
                 memcpy(msg->msg_name, u->addr->name, u->addr->len);
@@ -1778,8 +1777,6 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (flags&MSG_OOB)
                 goto out;
 
-        msg->msg_namelen = 0;
-
         err = mutex_lock_interruptible(&u->readlock);
         if (err) {
                 err = sock_intr_errno(sock_rcvtimeo(sk, noblock));
@@ -1924,8 +1921,6 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
         target = sock_rcvlowat(sk, flags&MSG_WAITALL, size);
         timeo = sock_rcvtimeo(sk, flags&MSG_DONTWAIT);
 
-        msg->msg_namelen = 0;
-
         /* Lock the socket to prevent queue disordering
          * while sleeps in memcpy_tomsg
          */
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 545c08b8a1d4..5adfd94c5b85 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1662,8 +1662,6 @@ vsock_stream_recvmsg(struct kiocb *kiocb,
         vsk = vsock_sk(sk);
         err = 0;
 
-        msg->msg_namelen = 0;
-
         lock_sock(sk);
 
         if (sk->sk_state != SS_CONNECTED) {
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index 9d6986634e0b..687360da62d9 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -1746,8 +1746,6 @@ static int vmci_transport_dgram_dequeue(struct kiocb *kiocb,
         if (flags & MSG_OOB || flags & MSG_ERRQUEUE)
                 return -EOPNOTSUPP;
 
-        msg->msg_namelen = 0;
-
         /* Retrieve the head sk_buff from the socket's receive queue. */
         err = 0;
         skb = skb_recv_datagram(&vsk->sk, flags, noblock, &err);
diff --git a/net/wimax/stack.c b/net/wimax/stack.c
index ef2191b969a7..ec8b577db135 100644
--- a/net/wimax/stack.c
+++ b/net/wimax/stack.c
@@ -610,7 +610,6 @@ int __init wimax_subsys_init(void)
         d_fnend(4, NULL, "() = 0\n");
         return 0;
 
-        genl_unregister_family(&wimax_gnl_family);
 error_register_family:
         d_fnend(4, NULL, "() = %d\n", result);
         return result;
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 45a3ab5612c1..7622789d3750 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1340,10 +1340,9 @@ static int x25_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (sx25) {
                 sx25->sx25_family = AF_X25;
                 sx25->sx25_addr   = x25->dest_addr;
+                msg->msg_namelen = sizeof(*sx25);
         }
 
-        msg->msg_namelen = sizeof(struct sockaddr_x25);
-
         x25_check_rbuf(sk);
         rc = copied;
 out_free_dgram: