163 files changed, 1695 insertions, 1807 deletions
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index ad8d6e6b87ca..5e4199d5a388 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -278,7 +278,8 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
        return 0;
 out_free_newdev:
-        free_netdev(new_dev);
+        if (new_dev->reg_state == NETREG_UNINITIALIZED)
+                free_netdev(new_dev);
        return err;
 }
@@ -291,6 +292,10 @@ static void vlan_sync_address(struct net_device *dev,
        if (ether_addr_equal(vlan->real_dev_addr, dev->dev_addr))
                return;
+        /* vlan continues to inherit address of lower device */
+        if (vlan_dev_inherit_address(vlandev, dev))
+                goto out;
        /* vlan address was different from the old address and is equal to
         * the new address */
        if (!ether_addr_equal(vlandev->dev_addr, vlan->real_dev_addr) &&
@@ -303,6 +308,7 @@ static void vlan_sync_address(struct net_device *dev,
            !ether_addr_equal(vlandev->dev_addr, dev->dev_addr))
                dev_uc_add(dev, vlandev->dev_addr);
+out:
        ether_addr_copy(vlan->real_dev_addr, dev->dev_addr);
 }
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index 9d010a09ab98..cc1557978066 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -109,6 +109,8 @@ int vlan_check_real_dev(struct net_device *real_dev,
 void vlan_setup(struct net_device *dev);
 int register_vlan_dev(struct net_device *dev);
 void unregister_vlan_dev(struct net_device *dev, struct list_head *head);
+bool vlan_dev_inherit_address(struct net_device *dev,
+                              struct net_device *real_dev);
 static inline u32 vlan_get_ingress_priority(struct net_device *dev,
                                            u16 vlan_tci)
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index fded86508117..ca4dc9031073 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -244,6 +244,17 @@ void vlan_dev_get_realdev_name(const struct net_device *dev, char *result)
        strncpy(result, vlan_dev_priv(dev)->real_dev->name, 23);
 }
+bool vlan_dev_inherit_address(struct net_device *dev,
+                              struct net_device *real_dev)
+{
+        if (dev->addr_assign_type != NET_ADDR_STOLEN)
+                return false;
+        ether_addr_copy(dev->dev_addr, real_dev->dev_addr);
+        call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
+        return true;
+}
 static int vlan_dev_open(struct net_device *dev)
 {
        struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
@@ -254,7 +265,8 @@ static int vlan_dev_open(struct net_device *dev)
            !(vlan->flags & VLAN_FLAG_LOOSE_BINDING))
                return -ENETDOWN;
-        if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr)) {
+        if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr) &&
+            !vlan_dev_inherit_address(dev, real_dev)) {
                err = dev_uc_add(real_dev, dev->dev_addr);
                if (err < 0)
                        goto out;
@@ -558,8 +570,10 @@ static int vlan_dev_init(struct net_device *dev)
        /* ipv6 shared card related stuff */
        dev->dev_id = real_dev->dev_id;
-        if (is_zero_ether_addr(dev->dev_addr))
+        if (is_zero_ether_addr(dev->dev_addr)) {
-                eth_hw_addr_inherit(dev, real_dev);
+                ether_addr_copy(dev->dev_addr, real_dev->dev_addr);
+                dev->addr_assign_type = NET_ADDR_STOLEN;
+        }
        if (is_zero_ether_addr(dev->broadcast))
                memcpy(dev->broadcast, real_dev->broadcast, dev->addr_len);
diff --git a/net/9p/client.c b/net/9p/client.c
index ea79ee9a7348..f5feac4ff4ec 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -2101,6 +2101,10 @@ int p9_client_readdir(struct p9_fid *fid, char *data, u32 count, u64 offset)
                trace_9p_protocol_dump(clnt, req->rc);
                goto free_and_error;
        }
+        if (rsize < count) {
+                pr_err("bogus RREADDIR count (%d > %d)\n", count, rsize);
+                count = rsize;
+        }
        p9_debug(P9_DEBUG_9P, "<<< RREADDIR count %d\n", count);
diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
index 655a7d4c96e1..983f0b5e14f1 100644
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -264,7 +264,7 @@ void ax25_disconnect(ax25_cb *ax25, int reason)
 {
        ax25_clear_queues(ax25);
-        if (!sock_flag(ax25->sk, SOCK_DESTROY))
+        if (!ax25->sk || !sock_flag(ax25->sk, SOCK_DESTROY))
                ax25_stop_heartbeat(ax25);
        ax25_stop_t1timer(ax25);
        ax25_stop_t2timer(ax25);
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index b1eb8c09a660..c842f40c1173 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1164,7 +1164,8 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg,
        if (msg->msg_flags & MSG_OOB)
                return -EOPNOTSUPP;
-        if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE))
+        if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE|
+                               MSG_CMSG_COMPAT))
                return -EINVAL;
        if (len < 4 || len > HCI_MAX_FRAME_SIZE)
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 4b175df35184..906f88550cd8 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -23,6 +23,7 @@
 #include <linux/debugfs.h>
 #include <linux/crypto.h>
 #include <linux/scatterlist.h>
+#include <crypto/algapi.h>
 #include <crypto/b128ops.h>
 #include <net/bluetooth/bluetooth.h>
@@ -524,7 +525,7 @@ bool smp_irk_matches(struct hci_dev *hdev, const u8 irk[16],
        if (err)
                return false;
-        return !memcmp(bdaddr->b, hash, 3);
+        return !crypto_memneq(bdaddr->b, hash, 3);
 }
 int smp_generate_rpa(struct hci_dev *hdev, const u8 irk[16], bdaddr_t *rpa)
@@ -577,7 +578,7 @@ int smp_generate_oob(struct hci_dev *hdev, u8 hash[16], u8 rand[16])
                        /* This is unlikely, but we need to check that
                         * we didn't accidentially generate a debug key.
                         */
-                        if (memcmp(smp->local_sk, debug_sk, 32))
+                        if (crypto_memneq(smp->local_sk, debug_sk, 32))
                                break;
                }
                smp->debug_key = false;
@@ -991,7 +992,7 @@ static u8 smp_random(struct smp_chan *smp)
        if (ret)
                return SMP_UNSPECIFIED;
-        if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
+        if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) {
                BT_ERR("Pairing failed (confirmation values mismatch)");
                return SMP_CONFIRM_FAILED;
        }
@@ -1491,7 +1492,7 @@ static u8 sc_passkey_round(struct smp_chan *smp, u8 smp_op)
                           smp->rrnd, r, cfm))
                        return SMP_UNSPECIFIED;
-                if (memcmp(smp->pcnf, cfm, 16))
+                if (crypto_memneq(smp->pcnf, cfm, 16))
                        return SMP_CONFIRM_FAILED;
                smp->passkey_round++;
@@ -1875,7 +1876,7 @@ static u8 sc_send_public_key(struct smp_chan *smp)
                        /* This is unlikely, but we need to check that
                         * we didn't accidentially generate a debug key.
                         */
-                        if (memcmp(smp->local_sk, debug_sk, 32))
+                        if (crypto_memneq(smp->local_sk, debug_sk, 32))
                                break;
                }
        }
@@ -2140,7 +2141,7 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
                if (err)
                        return SMP_UNSPECIFIED;
-                if (memcmp(smp->pcnf, cfm, 16))
+                if (crypto_memneq(smp->pcnf, cfm, 16))
                        return SMP_CONFIRM_FAILED;
        } else {
                smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
@@ -2621,7 +2622,7 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
                if (err)
                        return SMP_UNSPECIFIED;
-                if (memcmp(cfm.confirm_val, smp->pcnf, 16))
+                if (crypto_memneq(cfm.confirm_val, smp->pcnf, 16))
                        return SMP_CONFIRM_FAILED;
        }
@@ -2654,7 +2655,7 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
        else
                hcon->pending_sec_level = BT_SECURITY_FIPS;
-        if (!memcmp(debug_pk, smp->remote_pk, 64))
+        if (!crypto_memneq(debug_pk, smp->remote_pk, 64))
                set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
        if (smp->method == DSP_PASSKEY) {
@@ -2753,7 +2754,7 @@ static int smp_cmd_dhkey_check(struct l2cap_conn *conn, struct sk_buff *skb)
        if (err)
                return SMP_UNSPECIFIED;
-        if (memcmp(check->e, e, 16))
+        if (crypto_memneq(check->e, e, 16))
                return SMP_DHKEY_CHECK_FAILED;
        if (!hcon->out) {
@@ -3463,7 +3464,7 @@ static int __init test_ah(struct crypto_blkcipher *tfm_aes)
        if (err)
                return err;
-        if (memcmp(res, exp, 3))
+        if (crypto_memneq(res, exp, 3))
                return -EINVAL;
        return 0;
@@ -3493,7 +3494,7 @@ static int __init test_c1(struct crypto_blkcipher *tfm_aes)
        if (err)
                return err;
-        if (memcmp(res, exp, 16))
+        if (crypto_memneq(res, exp, 16))
                return -EINVAL;
        return 0;
@@ -3518,7 +3519,7 @@ static int __init test_s1(struct crypto_blkcipher *tfm_aes)
        if (err)
                return err;
-        if (memcmp(res, exp, 16))
+        if (crypto_memneq(res, exp, 16))
                return -EINVAL;
        return 0;
@@ -3550,7 +3551,7 @@ static int __init test_f4(struct crypto_hash *tfm_cmac)
        if (err)
                return err;
-        if (memcmp(res, exp, 16))
+        if (crypto_memneq(res, exp, 16))
                return -EINVAL;
        return 0;
@@ -3584,10 +3585,10 @@ static int __init test_f5(struct crypto_hash *tfm_cmac)
        if (err)
                return err;
-        if (memcmp(mackey, exp_mackey, 16))
+        if (crypto_memneq(mackey, exp_mackey, 16))
                return -EINVAL;
-        if (memcmp(ltk, exp_ltk, 16))
+        if (crypto_memneq(ltk, exp_ltk, 16))
                return -EINVAL;
        return 0;
@@ -3620,7 +3621,7 @@ static int __init test_f6(struct crypto_hash *tfm_cmac)
        if (err)
                return err;
-        if (memcmp(res, exp, 16))
+        if (crypto_memneq(res, exp, 16))
                return -EINVAL;
        return 0;
@@ -3674,7 +3675,7 @@ static int __init test_h6(struct crypto_hash *tfm_cmac)
        if (err)
                return err;
-        if (memcmp(res, exp, 16))
+        if (crypto_memneq(res, exp, 16))
                return -EINVAL;
        return 0;
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index f7fba74108a9..e24754a0e052 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -29,6 +29,7 @@ EXPORT_SYMBOL(br_should_route_hook);
 static int
 br_netif_receive_skb(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
+        br_drop_fake_rtable(skb);
        return netif_receive_skb(skb);
 }
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index 7ddbe7ec81d6..97fc19f001bf 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -516,21 +516,6 @@ static unsigned int br_nf_pre_routing(void *priv,
 }
-/* PF_BRIDGE/LOCAL_IN ************************************************/
-/* The packet is locally destined, which requires a real
- * dst_entry, so detach the fake one.  On the way up, the
- * packet would pass through PRE_ROUTING again (which already
- * took place when the packet entered the bridge), but we
- * register an IPv4 PRE_ROUTING 'sabotage' hook that will
- * prevent this from happening. */
-static unsigned int br_nf_local_in(void *priv,
-                                   struct sk_buff *skb,
-                                   const struct nf_hook_state *state)
-{
-        br_drop_fake_rtable(skb);
-        return NF_ACCEPT;
-}
 /* PF_BRIDGE/FORWARD *************************************************/
 static int br_nf_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
@@ -901,12 +886,6 @@ static struct nf_hook_ops br_nf_ops[] __read_mostly = {
                .priority = NF_BR_PRI_BRNF,
        },
        {
-                .hook = br_nf_local_in,
-                .pf = NFPROTO_BRIDGE,
-                .hooknum = NF_BR_LOCAL_IN,
-                .priority = NF_BR_PRI_BRNF,
-        },
-        {
                .hook = br_nf_forward_ip,
                .pf = NFPROTO_BRIDGE,
                .hooknum = NF_BR_FORWARD,
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 40197ff8918a..ff8bb41d713f 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -768,23 +768,16 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
                        return -EPROTONOSUPPORT;
                }
        }
-#endif
-        return 0;
+        if (data[IFLA_BR_VLAN_DEFAULT_PVID]) {
-}
+                __u16 defpvid = nla_get_u16(data[IFLA_BR_VLAN_DEFAULT_PVID]);
-static int br_dev_newlink(struct net *src_net, struct net_device *dev,
-                          struct nlattr *tb[], struct nlattr *data[])
-{
-        struct net_bridge *br = netdev_priv(dev);
-        if (tb[IFLA_ADDRESS]) {
+                if (defpvid >= VLAN_VID_MASK)
-                spin_lock_bh(&br->lock);
+                        return -EINVAL;
-                br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS]));
-                spin_unlock_bh(&br->lock);
        }
+#endif
-        return register_netdevice(dev);
+        return 0;
 }
 static int br_port_slave_changelink(struct net_device *brdev,
@@ -1068,6 +1061,25 @@ static int br_changelink(struct net_device *brdev, struct nlattr *tb[],
        return 0;
 }
+static int br_dev_newlink(struct net *src_net, struct net_device *dev,
+                          struct nlattr *tb[], struct nlattr *data[])
+{
+        struct net_bridge *br = netdev_priv(dev);
+        int err;
+        if (tb[IFLA_ADDRESS]) {
+                spin_lock_bh(&br->lock);
+                br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS]));
+                spin_unlock_bh(&br->lock);
+        }
+        err = br_changelink(dev, tb, data);
+        if (err)
+                return err;
+        return register_netdevice(dev);
+}
 static size_t br_get_size(const struct net_device *brdev)
 {
        return nla_total_size(sizeof(u32)) +    /* IFLA_BR_FORWARD_DELAY  */
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 8a7ada8bb947..bcb4559e735d 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -166,6 +166,8 @@ static void br_stp_start(struct net_bridge *br)
                br_debug(br, "using kernel STP\n");
                /* To start timers on any ports left in blocking */
+                if (br->dev->flags & IFF_UP)
+                        mod_timer(&br->hello_timer, jiffies + br->hello_time);
                br_port_state_selection(br);
        }
diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index 5f0f5af0ec35..7dbe6a5c31eb 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
@@ -40,7 +40,7 @@ static void br_hello_timer_expired(unsigned long arg)
        if (br->dev->flags & IFF_UP) {
                br_config_bpdu_generation(br);
-                if (br->stp_enabled != BR_USER_STP)
+                if (br->stp_enabled == BR_KERNEL_STP)
                        mod_timer(&br->hello_timer,
                                  round_jiffies(jiffies + br->hello_time));
        }
diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c
index 59ce1fcc220c..71b6ab240dea 100644
--- a/net/caif/cfpkt_skbuff.c
+++ b/net/caif/cfpkt_skbuff.c
@@ -81,11 +81,7 @@ static struct cfpkt *cfpkt_create_pfx(u16 len, u16 pfx)
 {
        struct sk_buff *skb;
-        if (likely(in_interrupt()))
+        skb = alloc_skb(len + pfx, GFP_ATOMIC);
-                skb = alloc_skb(len + pfx, GFP_ATOMIC);
-        else
-                skb = alloc_skb(len + pfx, GFP_KERNEL);
        if (unlikely(skb == NULL))
                return NULL;
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 166d436196c1..928f58064098 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -445,6 +445,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
 * @func: callback function on filter match
 * @data: returned parameter for callback function
 * @ident: string for calling module identification
+ * @sk: socket pointer (might be NULL)
 *
 * Description:
 *  Invokes the callback function with the received sk_buff and the given
@@ -468,7 +469,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
 */
 int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
                    void (*func)(struct sk_buff *, void *), void *data,
-                    char *ident)
+                    char *ident, struct sock *sk)
 {
        struct receiver *r;
        struct hlist_head *rl;
@@ -496,6 +497,7 @@ int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
                r->func    = func;
                r->data    = data;
                r->ident   = ident;
+                r->sk      = sk;
                hlist_add_head_rcu(&r->list, rl);
                d->entries++;
@@ -520,8 +522,11 @@ EXPORT_SYMBOL(can_rx_register);
 static void can_rx_delete_receiver(struct rcu_head *rp)
 {
        struct receiver *r = container_of(rp, struct receiver, rcu);
+        struct sock *sk = r->sk;
        kmem_cache_free(rcv_cache, r);
+        if (sk)
+                sock_put(sk);
 }
 /**
@@ -596,8 +601,11 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
        spin_unlock(&can_rcvlists_lock);
        /* schedule the receiver item for deletion */
-        if (r)
+        if (r) {
+                if (r->sk)
+                        sock_hold(r->sk);
                call_rcu(&r->rcu, can_rx_delete_receiver);
+        }
 }
 EXPORT_SYMBOL(can_rx_unregister);
diff --git a/net/can/af_can.h b/net/can/af_can.h
index fca0fe9fc45a..b86f5129e838 100644
--- a/net/can/af_can.h
+++ b/net/can/af_can.h
@@ -50,13 +50,14 @@
 struct receiver {
        struct hlist_node list;
-        struct rcu_head rcu;
        canid_t can_id;
        canid_t mask;
        unsigned long matches;
        void (*func)(struct sk_buff *, void *);
        void *data;
        char *ident;
+        struct sock *sk;
+        struct rcu_head rcu;
 };
 #define CAN_SFF_RCV_ARRAY_SZ (1 << CAN_SFF_ID_BITS)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 8ef1afacad82..4ccfd356baed 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -710,14 +710,23 @@ static struct bcm_op *bcm_find_op(struct list_head *ops, canid_t can_id,
 static void bcm_remove_op(struct bcm_op *op)
 {
-        hrtimer_cancel(&op->timer);
+        if (op->tsklet.func) {
-        hrtimer_cancel(&op->thrtimer);
+                while (test_bit(TASKLET_STATE_SCHED, &op->tsklet.state) ||
+                       test_bit(TASKLET_STATE_RUN, &op->tsklet.state) ||
-        if (op->tsklet.func)
+                       hrtimer_active(&op->timer)) {
-                tasklet_kill(&op->tsklet);
+                        hrtimer_cancel(&op->timer);
+                        tasklet_kill(&op->tsklet);
+                }
+        }
-        if (op->thrtsklet.func)
+        if (op->thrtsklet.func) {
-                tasklet_kill(&op->thrtsklet);
+                while (test_bit(TASKLET_STATE_SCHED, &op->thrtsklet.state) ||
+                       test_bit(TASKLET_STATE_RUN, &op->thrtsklet.state) ||
+                       hrtimer_active(&op->thrtimer)) {
+                        hrtimer_cancel(&op->thrtimer);
+                        tasklet_kill(&op->thrtsklet);
+                }
+        }
        if ((op->frames) && (op->frames != &op->sframe))
                kfree(op->frames);
@@ -1170,7 +1179,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                                err = can_rx_register(dev, op->can_id,
                                                      REGMASK(op->can_id),
                                                      bcm_rx_handler, op,
-                                                      "bcm");
+                                                      "bcm", sk);
                                op->rx_reg_dev = dev;
                                dev_put(dev);
@@ -1179,7 +1188,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                } else
                        err = can_rx_register(NULL, op->can_id,
                                              REGMASK(op->can_id),
-                                              bcm_rx_handler, op, "bcm");
+                                              bcm_rx_handler, op, "bcm", sk);
                if (err) {
                        /* this bcm rx op is broken -> remove it */
                        list_del(&op->list);
diff --git a/net/can/gw.c b/net/can/gw.c
index 455168718c2e..77c8af4047ef 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -442,7 +442,7 @@ static inline int cgw_register_filter(struct cgw_job *gwj)
 {
        return can_rx_register(gwj->src.dev, gwj->ccgw.filter.can_id,
                               gwj->ccgw.filter.can_mask, can_can_gw_rcv,
-                               gwj, "gw");
+                               gwj, "gw", NULL);
 }
 static inline void cgw_unregister_filter(struct cgw_job *gwj)
diff --git a/net/can/raw.c b/net/can/raw.c
index 56af689ca999..e9403a26a1d5 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -190,7 +190,7 @@ static int raw_enable_filters(struct net_device *dev, struct sock *sk,
        for (i = 0; i < count; i++) {
                err = can_rx_register(dev, filter[i].can_id,
                                      filter[i].can_mask,
-                                      raw_rcv, sk, "raw");
+                                      raw_rcv, sk, "raw", sk);
                if (err) {
                        /* clean up successfully registered filters */
                        while (--i >= 0)
@@ -211,7 +211,7 @@ static int raw_enable_errfilter(struct net_device *dev, struct sock *sk,
        if (err_mask)
                err = can_rx_register(dev, 0, err_mask | CAN_ERR_FLAG,
-                                      raw_rcv, sk, "raw");
+                                      raw_rcv, sk, "raw", sk);
        return err;
 }
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index b8d927c56494..a6b2f2138c9d 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -7,6 +7,7 @@
 #include <linux/kthread.h>
 #include <linux/net.h>
 #include <linux/nsproxy.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/socket.h>
 #include <linux/string.h>
@@ -478,11 +479,16 @@ static int ceph_tcp_connect(struct ceph_connection *con)
 {
        struct sockaddr_storage *paddr = &con->peer_addr.in_addr;
        struct socket *sock;
+        unsigned int noio_flag;
        int ret;
        BUG_ON(con->sock);
+        /* sock_create_kern() allocates with GFP_KERNEL */
+        noio_flag = memalloc_noio_save();
        ret = sock_create_kern(read_pnet(&con->msgr->net), paddr->ss_family,
                               SOCK_STREAM, IPPROTO_TCP, &sock);
+        memalloc_noio_restore(noio_flag);
        if (ret)
                return ret;
        sock->sk->sk_allocation = GFP_NOFS;
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index ddc3573894b0..bc95e48d5cfb 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -1265,7 +1265,6 @@ static int decode_new_up_state_weight(void **p, void *end,
                if ((map->osd_state[osd] & CEPH_OSD_EXISTS) &&
                    (xorstate & CEPH_OSD_EXISTS)) {
                        pr_info("osd%d does not exist\n", osd);
-                        map->osd_weight[osd] = CEPH_OSD_IN;
                        ret = set_primary_affinity(map, osd,
                                                   CEPH_OSD_DEFAULT_PRIMARY_AFFINITY);
                        if (ret)
diff --git a/net/core/dev.c b/net/core/dev.c
index 6f203c7fb166..24d243084aab 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -182,7 +182,7 @@ EXPORT_SYMBOL(dev_base_lock);
 /* protects napi_hash addition/deletion and napi_gen_id */
 static DEFINE_SPINLOCK(napi_hash_lock);
-static unsigned int napi_gen_id;
+static unsigned int napi_gen_id = NR_CPUS;
 static DEFINE_HASHTABLE(napi_hash, 8);
 static seqcount_t devnet_rename_seq;
@@ -1246,8 +1246,9 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
        if (!new_ifalias)
                return -ENOMEM;
        dev->ifalias = new_ifalias;
+        memcpy(dev->ifalias, alias, len);
+        dev->ifalias[len] = 0;
-        strlcpy(dev->ifalias, alias, len+1);
        return len;
 }
@@ -1676,37 +1677,59 @@ EXPORT_SYMBOL_GPL(net_dec_ingress_queue);
 static struct static_key netstamp_needed __read_mostly;
 #ifdef HAVE_JUMP_LABEL
-/* We are not allowed to call static_key_slow_dec() from irq context
- * If net_disable_timestamp() is called from irq context, defer the
- * static_key_slow_dec() calls.
- */
 static atomic_t netstamp_needed_deferred;
+static atomic_t netstamp_wanted;
+static void netstamp_clear(struct work_struct *work)
+{
+        int deferred = atomic_xchg(&netstamp_needed_deferred, 0);
+        int wanted;
+        wanted = atomic_add_return(deferred, &netstamp_wanted);
+        if (wanted > 0)
+                static_key_enable(&netstamp_needed);
+        else
+                static_key_disable(&netstamp_needed);
+}
+static DECLARE_WORK(netstamp_work, netstamp_clear);
 #endif
 void net_enable_timestamp(void)
 {
 #ifdef HAVE_JUMP_LABEL
-        int deferred = atomic_xchg(&netstamp_needed_deferred, 0);
+        int wanted;
-        if (deferred) {
+        while (1) {
-                while (--deferred)
+                wanted = atomic_read(&netstamp_wanted);
-                        static_key_slow_dec(&netstamp_needed);
+                if (wanted <= 0)
-                return;
+                        break;
+                if (atomic_cmpxchg(&netstamp_wanted, wanted, wanted + 1) == wanted)
+                        return;
        }
-#endif
+        atomic_inc(&netstamp_needed_deferred);
+        schedule_work(&netstamp_work);
+#else
        static_key_slow_inc(&netstamp_needed);
+#endif
 }
 EXPORT_SYMBOL(net_enable_timestamp);
 void net_disable_timestamp(void)
 {
 #ifdef HAVE_JUMP_LABEL
-        if (in_interrupt()) {
+        int wanted;
-                atomic_inc(&netstamp_needed_deferred);
-                return;
+        while (1) {
+                wanted = atomic_read(&netstamp_wanted);
+                if (wanted <= 1)
+                        break;
+                if (atomic_cmpxchg(&netstamp_wanted, wanted, wanted - 1) == wanted)
+                        return;
        }
-#endif
+        atomic_dec(&netstamp_needed_deferred);
+        schedule_work(&netstamp_work);
+#else
        static_key_slow_dec(&netstamp_needed);
+#endif
 }
 EXPORT_SYMBOL(net_disable_timestamp);
@@ -2527,9 +2550,10 @@ EXPORT_SYMBOL(skb_mac_gso_segment);
 static inline bool skb_needs_check(struct sk_buff *skb, bool tx_path)
 {
        if (tx_path)
-                return skb->ip_summed != CHECKSUM_PARTIAL;
+                return skb->ip_summed != CHECKSUM_PARTIAL &&
-        else
+                       skb->ip_summed != CHECKSUM_UNNECESSARY;
-                return skb->ip_summed == CHECKSUM_NONE;
+        return skb->ip_summed == CHECKSUM_NONE;
 }
 /**
@@ -2548,11 +2572,12 @@ static inline bool skb_needs_check(struct sk_buff *skb, bool tx_path)
 struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
                                  netdev_features_t features, bool tx_path)
 {
+        struct sk_buff *segs;
        if (unlikely(skb_needs_check(skb, tx_path))) {
                int err;
-                skb_warn_bad_offload(skb);
+                /* We're going to init ->check field in TCP or UDP header */
                err = skb_cow_head(skb, 0);
                if (err < 0)
                        return ERR_PTR(err);
@@ -2567,7 +2592,12 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
        skb_reset_mac_header(skb);
        skb_reset_mac_len(skb);
-        return skb_mac_gso_segment(skb, features);
+        segs = skb_mac_gso_segment(skb, features);
+        if (unlikely(skb_needs_check(skb, tx_path)))
+                skb_warn_bad_offload(skb);
+        return segs;
 }
 EXPORT_SYMBOL(__skb_gso_segment);
@@ -2650,9 +2680,9 @@ static netdev_features_t harmonize_features(struct sk_buff *skb,
        if (skb->ip_summed != CHECKSUM_NONE &&
            !can_checksum_protocol(features, type)) {
                features &= ~NETIF_F_ALL_CSUM;
-        } else if (illegal_highdma(skb->dev, skb)) {
-                features &= ~NETIF_F_SG;
        }
+        if (illegal_highdma(skb->dev, skb))
+                features &= ~NETIF_F_SG;
        return features;
 }
@@ -3027,7 +3057,9 @@ struct netdev_queue *netdev_pick_tx(struct net_device *dev,
        int queue_index = 0;
 #ifdef CONFIG_XPS
-        if (skb->sender_cpu == 0)
+        u32 sender_cpu = skb->sender_cpu - 1;
+        if (sender_cpu >= (u32)NR_CPUS)
                skb->sender_cpu = raw_smp_processor_id() + 1;
 #endif
@@ -4350,6 +4382,12 @@ struct packet_offload *gro_find_complete_by_type(__be16 type)
 }
 EXPORT_SYMBOL(gro_find_complete_by_type);
+static void napi_skb_free_stolen_head(struct sk_buff *skb)
+{
+        skb_dst_drop(skb);
+        kmem_cache_free(skbuff_head_cache, skb);
+}
 static gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb)
 {
        switch (ret) {
@@ -4363,12 +4401,10 @@ static gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb)
                break;
        case GRO_MERGED_FREE:
-                if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD) {
+                if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD)
-                        skb_dst_drop(skb);
+                        napi_skb_free_stolen_head(skb);
-                        kmem_cache_free(skbuff_head_cache, skb);
+                else
-                } else {
                        __kfree_skb(skb);
-                }
                break;
        case GRO_HELD:
@@ -4434,10 +4470,16 @@ static gro_result_t napi_frags_finish(struct napi_struct *napi,
                break;
        case GRO_DROP:
-        case GRO_MERGED_FREE:
                napi_reuse_skb(napi, skb);
                break;
+        case GRO_MERGED_FREE:
+                if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD)
+                        napi_skb_free_stolen_head(skb);
+                else
+                        napi_reuse_skb(napi, skb);
+                break;
        case GRO_MERGED:
                break;
        }
@@ -4704,25 +4746,22 @@ EXPORT_SYMBOL_GPL(napi_by_id);
 void napi_hash_add(struct napi_struct *napi)
 {
-        if (!test_and_set_bit(NAPI_STATE_HASHED, &napi->state)) {
+        if (test_and_set_bit(NAPI_STATE_HASHED, &napi->state))
+                return;
-                spin_lock(&napi_hash_lock);
+        spin_lock(&napi_hash_lock);
-                /* 0 is not a valid id, we also skip an id that is taken
+        /* 0..NR_CPUS+1 range is reserved for sender_cpu use */
-                 * we expect both events to be extremely rare
+        do {
-                 */
+                if (unlikely(++napi_gen_id < NR_CPUS + 1))
-                napi->napi_id = 0;
+                        napi_gen_id = NR_CPUS + 1;
-                while (!napi->napi_id) {
+        } while (napi_by_id(napi_gen_id));
-                        napi->napi_id = ++napi_gen_id;
+        napi->napi_id = napi_gen_id;
-                        if (napi_by_id(napi->napi_id))
-                                napi->napi_id = 0;
-                }
-                hlist_add_head_rcu(&napi->napi_hash_node,
+        hlist_add_head_rcu(&napi->napi_hash_node,
-                        &napi_hash[napi->napi_id % HASH_SIZE(napi_hash)]);
+                           &napi_hash[napi->napi_id % HASH_SIZE(napi_hash)]);
-                spin_unlock(&napi_hash_lock);
+        spin_unlock(&napi_hash_lock);
-        }
 }
 EXPORT_SYMBOL_GPL(napi_hash_add);
@@ -7030,8 +7069,8 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
        } else {
                netdev_stats_to_stats64(storage, &dev->stats);
        }
-        storage->rx_dropped += atomic_long_read(&dev->rx_dropped);
+        storage->rx_dropped += (unsigned long)atomic_long_read(&dev->rx_dropped);
-        storage->tx_dropped += atomic_long_read(&dev->tx_dropped);
+        storage->tx_dropped += (unsigned long)atomic_long_read(&dev->tx_dropped);
        return storage;
 }
 EXPORT_SYMBOL(dev_get_stats);
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index 183ef95db502..2bded3ecf03d 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -28,6 +28,7 @@ static int dev_ifname(struct net *net, struct ifreq __user *arg)
        if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
                return -EFAULT;
+        ifr.ifr_name[IFNAMSIZ-1] = 0;
        error = netdev_get_name(net, ifr.ifr_name, ifr.ifr_ifindex);
        if (error)
diff --git a/net/core/dst.c b/net/core/dst.c
index a1656e3b8d72..e72d706f8d0c 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -151,13 +151,13 @@ int dst_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(dst_discard_out);
-const u32 dst_default_metrics[RTAX_MAX + 1] = {
+const struct dst_metrics dst_default_metrics = {
        /* This initializer is needed to force linker to place this variable
         * into const section. Otherwise it might end into bss section.
         * We really want to avoid false sharing on this variable, and catch
         * any writes on it.
         */
-        [RTAX_MAX] = 0xdeadbeef,
+        .refcnt = ATOMIC_INIT(1),
 };
 void dst_init(struct dst_entry *dst, struct dst_ops *ops,
@@ -169,7 +169,7 @@ void dst_init(struct dst_entry *dst, struct dst_ops *ops,
        if (dev)
                dev_hold(dev);
        dst->ops = ops;
-        dst_init_metrics(dst, dst_default_metrics, true);
+        dst_init_metrics(dst, dst_default_metrics.metrics, true);
        dst->expires = 0UL;
        dst->path = dst;
        dst->from = NULL;
@@ -315,25 +315,30 @@ EXPORT_SYMBOL(dst_release);
 u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old)
 {
-        u32 *p = kmalloc(sizeof(u32) * RTAX_MAX, GFP_ATOMIC);
+        struct dst_metrics *p = kmalloc(sizeof(*p), GFP_ATOMIC);
        if (p) {
-                u32 *old_p = __DST_METRICS_PTR(old);
+                struct dst_metrics *old_p = (struct dst_metrics *)__DST_METRICS_PTR(old);
                unsigned long prev, new;
-                memcpy(p, old_p, sizeof(u32) * RTAX_MAX);
+                atomic_set(&p->refcnt, 1);
+                memcpy(p->metrics, old_p->metrics, sizeof(p->metrics));
                new = (unsigned long) p;
                prev = cmpxchg(&dst->_metrics, old, new);
                if (prev != old) {
                        kfree(p);
-                        p = __DST_METRICS_PTR(prev);
+                        p = (struct dst_metrics *)__DST_METRICS_PTR(prev);
                        if (prev & DST_METRICS_READ_ONLY)
                                p = NULL;
+                } else if (prev & DST_METRICS_REFCOUNTED) {
+                        if (atomic_dec_and_test(&old_p->refcnt))
+                                kfree(old_p);
                }
        }
-        return p;
+        BUILD_BUG_ON(offsetof(struct dst_metrics, metrics) != 0);
+        return (u32 *)p;
 }
 EXPORT_SYMBOL(dst_cow_metrics_generic);
@@ -342,7 +347,7 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old)
 {
        unsigned long prev, new;
-        new = ((unsigned long) dst_default_metrics) | DST_METRICS_READ_ONLY;
+        new = ((unsigned long) &dst_default_metrics) | DST_METRICS_READ_ONLY;
        prev = cmpxchg(&dst->_metrics, old, new);
        if (prev == old)
                kfree(__DST_METRICS_PTR(old));
@@ -457,6 +462,20 @@ static int dst_dev_event(struct notifier_block *this, unsigned long event,
                spin_lock_bh(&dst_garbage.lock);
                dst = dst_garbage.list;
                dst_garbage.list = NULL;
+                /* The code in dst_ifdown places a hold on the loopback device.
+                 * If the gc entry processing is set to expire after a lengthy
+                 * interval, this hold can cause netdev_wait_allrefs() to hang
+                 * out and wait for a long time -- until the the loopback
+                 * interface is released.  If we're really unlucky, it'll emit
+                 * pr_emerg messages to console too.  Reset the interval here,
+                 * so dst cleanups occur in a more timely fashion.
+                 */
+                if (dst_garbage.timer_inc > DST_GC_INC) {
+                        dst_garbage.timer_inc = DST_GC_INC;
+                        dst_garbage.timer_expires = DST_GC_MIN;
+                        mod_delayed_work(system_wq, &dst_gc_work,
+                                         dst_garbage.timer_expires);
+                }
                spin_unlock_bh(&dst_garbage.lock);
                if (last)
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 29edf74846fc..b6bca625b0d2 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -886,9 +886,12 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
        if (regs.len > reglen)
                regs.len = reglen;
-        regbuf = vzalloc(reglen);
+        regbuf = NULL;
-        if (reglen && !regbuf)
+        if (reglen) {
-                return -ENOMEM;
+                regbuf = vzalloc(reglen);
+                if (!regbuf)
+                        return -ENOMEM;
+        }
        ops->get_regs(dev, &regs, regbuf);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 769cece9b00b..ae92131c4f89 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -859,7 +859,8 @@ static void neigh_probe(struct neighbour *neigh)
        if (skb)
                skb = skb_clone(skb, GFP_ATOMIC);
        write_unlock(&neigh->lock);
-        neigh->ops->solicit(neigh, skb);
+        if (neigh->ops->solicit)
+                neigh->ops->solicit(neigh, skb);
        atomic_inc(&neigh->probes);
        kfree_skb(skb);
 }
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 94acfc89ad97..440aa9f6e0a8 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -105,15 +105,21 @@ static void queue_process(struct work_struct *work)
        while ((skb = skb_dequeue(&npinfo->txq))) {
                struct net_device *dev = skb->dev;
                struct netdev_queue *txq;
+                unsigned int q_index;
                if (!netif_device_present(dev) || !netif_running(dev)) {
                        kfree_skb(skb);
                        continue;
                }
-                txq = skb_get_tx_queue(dev, skb);
                local_irq_save(flags);
+                /* check if skb->queue_mapping is still valid */
+                q_index = skb_get_queue_mapping(skb);
+                if (unlikely(q_index >= dev->real_num_tx_queues)) {
+                        q_index = q_index % dev->real_num_tx_queues;
+                        skb_set_queue_mapping(skb, q_index);
+                }
+                txq = netdev_get_tx_queue(dev, q_index);
                HARD_TX_LOCK(dev, txq, smp_processor_id());
                if (netif_xmit_frozen_or_stopped(txq) ||
                    netpoll_start_xmit(skb, dev, txq) != NETDEV_TX_OK) {
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index b94e165a4f79..5b3d611d8b5f 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -897,6 +897,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
               + nla_total_size(1) /* IFLA_LINKMODE */
               + nla_total_size(4) /* IFLA_CARRIER_CHANGES */
               + nla_total_size(4) /* IFLA_LINK_NETNSID */
+               + nla_total_size(4) /* IFLA_GROUP */
               + nla_total_size(ext_filter_mask
                                & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
               + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
@@ -1018,7 +1019,7 @@ static int rtnl_phys_port_name_fill(struct sk_buff *skb, struct net_device *dev)
                return err;
        }
-        if (nla_put(skb, IFLA_PHYS_PORT_NAME, strlen(name), name))
+        if (nla_put_string(skb, IFLA_PHYS_PORT_NAME, name))
                return -EMSGSIZE;
        return 0;
@@ -1089,6 +1090,8 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
        struct ifla_vf_mac vf_mac;
        struct ifla_vf_info ivi;
+        memset(&ivi, 0, sizeof(ivi));
        /* Not all SR-IOV capable drivers support the
         * spoofcheck and "RSS query enable" query.  Preset to
         * -1 so the user space tool can detect that the driver
@@ -1097,7 +1100,6 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
        ivi.spoofchk = -1;
        ivi.rss_query_en = -1;
        ivi.trusted = -1;
-        memset(ivi.mac, 0, sizeof(ivi.mac));
        /* The default value for VF link state is "auto"
         * IFLA_VF_LINK_STATE_AUTO which equals zero
         */
@@ -1370,6 +1372,7 @@ static const struct nla_policy ifla_policy[IFLA_MAX+1] = {
        [IFLA_PHYS_SWITCH_ID]   = { .type = NLA_BINARY, .len = MAX_PHYS_ITEM_ID_LEN },
        [IFLA_LINK_NETNSID]     = { .type = NLA_S32 },
        [IFLA_PROTO_DOWN]       = { .type = NLA_U8 },
+        [IFLA_GROUP]            = { .type = NLA_U32 },
 };
 static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
@@ -1458,13 +1461,13 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                                               cb->nlh->nlmsg_seq, 0,
                                               NLM_F_MULTI,
                                               ext_filter_mask);
-                        /* If we ran out of room on the first message,
-                         * we're in trouble
-                         */
-                        WARN_ON((err == -EMSGSIZE) && (skb->len == 0));
-                        if (err < 0)
+                        if (err < 0) {
-                                goto out;
+                                if (likely(skb->len))
+                                        goto out;
+                                goto out_err;
+                        }
                        nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 cont:
@@ -1472,10 +1475,12 @@ cont:
                }
        }
 out:
+        err = skb->len;
+out_err:
        cb->args[1] = idx;
        cb->args[0] = h;
-        return skb->len;
+        return err;
 }
 int rtnl_nla_parse_ifla(struct nlattr **tb, const struct nlattr *head, int len)
@@ -1737,7 +1742,8 @@ static int do_setlink(const struct sk_buff *skb,
                struct sockaddr *sa;
                int len;
-                len = sizeof(sa_family_t) + dev->addr_len;
+                len = sizeof(sa_family_t) + max_t(size_t, dev->addr_len,
+                                                  sizeof(*sa));
                sa = kmalloc(len, GFP_KERNEL);
                if (!sa) {
                        err = -ENOMEM;
@@ -3127,8 +3133,12 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
                                err = br_dev->netdev_ops->ndo_bridge_getlink(
                                                skb, portid, seq, dev,
                                                filter_mask, NLM_F_MULTI);
-                                if (err < 0 && err != -EOPNOTSUPP)
+                                if (err < 0 && err != -EOPNOTSUPP) {
-                                        break;
+                                        if (likely(skb->len))
+                                                break;
+                                        goto out_err;
+                                }
                        }
                        idx++;
                }
@@ -3139,16 +3149,22 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
                                                              seq, dev,
                                                              filter_mask,
                                                              NLM_F_MULTI);
-                                if (err < 0 && err != -EOPNOTSUPP)
+                                if (err < 0 && err != -EOPNOTSUPP) {
-                                        break;
+                                        if (likely(skb->len))
+                                                break;
+                                        goto out_err;
+                                }
                        }
                        idx++;
                }
        }
+        err = skb->len;
+out_err:
        rcu_read_unlock();
        cb->args[0] = idx;
-        return skb->len;
+        return err;
 }
 static inline size_t bridge_nlmsg_size(void)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 4968b5ddea69..73dfd7729bc9 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3678,13 +3678,14 @@ void skb_complete_tx_timestamp(struct sk_buff *skb,
        if (!skb_may_tx_timestamp(sk, false))
                return;
-        /* take a reference to prevent skb_orphan() from freeing the socket */
+        /* Take a reference to prevent skb_orphan() from freeing the socket,
-        sock_hold(sk);
+         * but only if the socket refcount is not zero.
+         */
-        *skb_hwtstamps(skb) = *hwtstamps;
+        if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) {
-        __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND);
+                *skb_hwtstamps(skb) = *hwtstamps;
+                __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND);
-        sock_put(sk);
+                sock_put(sk);
+        }
 }
 EXPORT_SYMBOL_GPL(skb_complete_tx_timestamp);
@@ -3735,7 +3736,7 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked)
 {
        struct sock *sk = skb->sk;
        struct sock_exterr_skb *serr;
-        int err;
+        int err = 1;
        skb->wifi_acked_valid = 1;
        skb->wifi_acked = acked;
@@ -3745,14 +3746,15 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked)
        serr->ee.ee_errno = ENOMSG;
        serr->ee.ee_origin = SO_EE_ORIGIN_TXSTATUS;
-        /* take a reference to prevent skb_orphan() from freeing the socket */
+        /* Take a reference to prevent skb_orphan() from freeing the socket,
-        sock_hold(sk);
+         * but only if the socket refcount is not zero.
+         */
-        err = sock_queue_err_skb(sk, skb);
+        if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) {
+                err = sock_queue_err_skb(sk, skb);
+                sock_put(sk);
+        }
        if (err)
                kfree_skb(skb);
-        sock_put(sk);
 }
 EXPORT_SYMBOL_GPL(skb_complete_wifi_ack);
diff --git a/net/core/sock.c b/net/core/sock.c
index f367df38c264..2871364e4420 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1459,6 +1459,11 @@ void sk_destruct(struct sock *sk)
                pr_debug("%s: optmem leakage (%d bytes) detected\n",
                         __func__, atomic_read(&sk->sk_omem_alloc));
+        if (sk->sk_frag.page) {
+                put_page(sk->sk_frag.page);
+                sk->sk_frag.page = NULL;
+        }
        if (sk->sk_peer_cred)
                put_cred(sk->sk_peer_cred);
        put_pid(sk->sk_peer_pid);
@@ -1552,6 +1557,12 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
                        is_charged = sk_filter_charge(newsk, filter);
                if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) {
+                        /* We need to make sure that we don't uncharge the new
+                         * socket if we couldn't charge it in the first place
+                         * as otherwise we uncharge the parent's filter.
+                         */
+                        if (!is_charged)
+                                RCU_INIT_POINTER(newsk->sk_filter, NULL);
                        /* It is still raw copy of parent, so invalidate
                         * destructor and make plain sk_free() */
                        newsk->sk_destruct = NULL;
@@ -1679,17 +1690,17 @@ EXPORT_SYMBOL(skb_set_owner_w);
 void skb_orphan_partial(struct sk_buff *skb)
 {
-        /* TCP stack sets skb->ooo_okay based on sk_wmem_alloc,
-         * so we do not completely orphan skb, but transfert all
-         * accounted bytes but one, to avoid unexpected reorders.
-         */
        if (skb->destructor == sock_wfree
 #ifdef CONFIG_INET
            || skb->destructor == tcp_wfree
 #endif
                ) {
-                atomic_sub(skb->truesize - 1, &skb->sk->sk_wmem_alloc);
+                struct sock *sk = skb->sk;
-                skb->truesize = 1;
+                if (atomic_inc_not_zero(&sk->sk_refcnt)) {
+                        atomic_sub(skb->truesize, &sk->sk_wmem_alloc);
+                        skb->destructor = sock_efree;
+                }
        } else {
                skb_orphan(skb);
        }
@@ -2694,11 +2705,6 @@ void sk_common_release(struct sock *sk)
        sk_refcnt_debug_release(sk);
-        if (sk->sk_frag.page) {
-                put_page(sk->sk_frag.page);
-                sk->sk_frag.page = NULL;
-        }
        sock_put(sk);
 }
 EXPORT_SYMBOL(sk_common_release);
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index f053198e730c..5e3a7302f774 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -749,6 +749,7 @@ static void ccid2_hc_tx_exit(struct sock *sk)
        for (i = 0; i < hc->tx_seqbufc; i++)
                kfree(hc->tx_seqbuf[i]);
        hc->tx_seqbufc = 0;
+        dccp_ackvec_parsed_cleanup(&hc->tx_av_chunks);
 }
 static void ccid2_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
diff --git a/net/dccp/feat.c b/net/dccp/feat.c
index 1704948e6a12..f227f002c73d 100644
--- a/net/dccp/feat.c
+++ b/net/dccp/feat.c
@@ -1471,9 +1471,12 @@ int dccp_feat_init(struct sock *sk)
         * singleton values (which always leads to failure).
         * These settings can still (later) be overridden via sockopts.
         */
-        if (ccid_get_builtin_ccids(&tx.val, &tx.len) ||
+        if (ccid_get_builtin_ccids(&tx.val, &tx.len))
-            ccid_get_builtin_ccids(&rx.val, &rx.len))
                return -ENOBUFS;
+        if (ccid_get_builtin_ccids(&rx.val, &rx.len)) {
+                kfree(tx.val);
+                return -ENOBUFS;
+        }
        if (!dccp_feat_prefer(sysctl_dccp_tx_ccid, tx.val, tx.len) ||
            !dccp_feat_prefer(sysctl_dccp_rx_ccid, rx.val, rx.len))
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 3bd14e885396..dbe2573f6ba1 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                        if (inet_csk(sk)->icsk_af_ops->conn_request(sk,
                                                                    skb) < 0)
                                return 1;
-                        goto discard;
+                        consume_skb(skb);
+                        return 0;
                }
                if (dh->dccph_type == DCCP_PKT_RESET)
                        goto discard;
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 0759f5b9180e..e217f17997a4 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -289,7 +289,8 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
        switch (type) {
        case ICMP_REDIRECT:
-                dccp_do_redirect(skb, sk);
+                if (!sock_owned_by_user(sk))
+                        dccp_do_redirect(skb, sk);
                goto out;
        case ICMP_SOURCE_QUENCH:
                /* Just silently ignore these. */
@@ -634,6 +635,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                goto drop_and_free;
        inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
+        reqsk_put(req);
        return 0;
 drop_and_free:
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 27c4e81efa24..09a9ab65f4e1 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -122,10 +122,12 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        np = inet6_sk(sk);
        if (type == NDISC_REDIRECT) {
-                struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
+                if (!sock_owned_by_user(sk)) {
+                        struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
-                if (dst)
+                        if (dst)
-                        dst->ops->redirect(dst, sk, skb);
+                                dst->ops->redirect(dst, sk, skb);
+                }
                goto out;
        }
@@ -374,6 +376,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                goto drop_and_free;
        inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
+        reqsk_put(req);
        return 0;
 drop_and_free:
@@ -420,6 +423,9 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
                newsk->sk_backlog_rcv = dccp_v4_do_rcv;
                newnp->pktoptions  = NULL;
                newnp->opt         = NULL;
+                newnp->ipv6_mc_list = NULL;
+                newnp->ipv6_ac_list = NULL;
+                newnp->ipv6_fl_list = NULL;
                newnp->mcast_oif   = inet6_iif(skb);
                newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
@@ -484,6 +490,9 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
        /* Clone RX bits */
        newnp->rxopt.all = np->rxopt.all;
+        newnp->ipv6_mc_list = NULL;
+        newnp->ipv6_ac_list = NULL;
+        newnp->ipv6_fl_list = NULL;
        newnp->pktoptions = NULL;
        newnp->opt        = NULL;
        newnp->mcast_oif  = inet6_iif(skb);
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index 1994f8af646b..68eed344b471 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -122,6 +122,7 @@ struct sock *dccp_create_openreq_child(const struct sock *sk,
                        /* It is still raw copy of parent, so invalidate
                         * destructor and make plain sk_free() */
                        newsk->sk_destruct = NULL;
+                        bh_unlock_sock(newsk);
                        sk_free(newsk);
                        return NULL;
                }
@@ -145,6 +146,13 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
        struct dccp_request_sock *dreq = dccp_rsk(req);
        bool own_req;
+        /* TCP/DCCP listeners became lockless.
+         * DCCP stores complex state in its request_sock, so we need
+         * a protection for them, now this code runs without being protected
+         * by the parent (listener) lock.
+         */
+        spin_lock_bh(&dreq->dreq_lock);
        /* Check for retransmitted REQUEST */
        if (dccp_hdr(skb)->dccph_type == DCCP_PKT_REQUEST) {
@@ -159,7 +167,7 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
                        inet_rtx_syn_ack(sk, req);
                }
                /* Network Duplicate, discard packet */
-                return NULL;
+                goto out;
        }
        DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_PACKET_ERROR;
@@ -185,20 +193,20 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
        child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL,
                                                         req, &own_req);
-        if (!child)
+        if (child) {
-                goto listen_overflow;
+                child = inet_csk_complete_hashdance(sk, child, req, own_req);
+                goto out;
-        return inet_csk_complete_hashdance(sk, child, req, own_req);
+        }
-listen_overflow:
-        dccp_pr_debug("listen_overflow!\n");
        DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_TOO_BUSY;
 drop:
        if (dccp_hdr(skb)->dccph_type != DCCP_PKT_RESET)
                req->rsk_ops->send_reset(sk, skb);
        inet_csk_reqsk_queue_drop(sk, req);
-        return NULL;
+out:
+        spin_unlock_bh(&dreq->dreq_lock);
+        return child;
 }
 EXPORT_SYMBOL_GPL(dccp_check_req);
@@ -249,6 +257,7 @@ int dccp_reqsk_init(struct request_sock *req,
 {
        struct dccp_request_sock *dreq = dccp_rsk(req);
+        spin_lock_init(&dreq->dreq_lock);
        inet_rsk(req)->ir_rmt_port = dccp_hdr(skb)->dccph_sport;
        inet_rsk(req)->ir_num      = ntohs(dccp_hdr(skb)->dccph_dport);
        inet_rsk(req)->acked       = 0;
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index b1dc096d22f8..403593bd2b83 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -188,12 +188,6 @@ static inline void dnrt_free(struct dn_route *rt)
        call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
 }
-static inline void dnrt_drop(struct dn_route *rt)
-{
-        dst_release(&rt->dst);
-        call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
-}
 static void dn_dst_check_expire(unsigned long dummy)
 {
        int i;
@@ -248,7 +242,7 @@ static int dn_dst_gc(struct dst_ops *ops)
                        }
                        *rtp = rt->dst.dn_next;
                        rt->dst.dn_next = NULL;
-                        dnrt_drop(rt);
+                        dnrt_free(rt);
                        break;
                }
                spin_unlock_bh(&dn_rt_hash_table[i].lock);
@@ -350,7 +344,7 @@ static int dn_insert_route(struct dn_route *rt, unsigned int hash, struct dn_rou
                        dst_use(&rth->dst, now);
                        spin_unlock_bh(&dn_rt_hash_table[hash].lock);
-                        dnrt_drop(rt);
+                        dst_free(&rt->dst);
                        *rp = rth;
                        return 0;
                }
@@ -380,7 +374,7 @@ static void dn_run_flush(unsigned long dummy)
                for(; rt; rt = next) {
                        next = rcu_dereference_raw(rt->dst.dn_next);
                        RCU_INIT_POINTER(rt->dst.dn_next, NULL);
-                        dst_free((struct dst_entry *)rt);
+                        dnrt_free(rt);
                }
 nothing_to_declare:
@@ -1187,7 +1181,7 @@ make_route:
        if (dev_out->flags & IFF_LOOPBACK)
                flags |= RTCF_LOCAL;
-        rt = dst_alloc(&dn_dst_ops, dev_out, 1, DST_OBSOLETE_NONE, DST_HOST);
+        rt = dst_alloc(&dn_dst_ops, dev_out, 0, DST_OBSOLETE_NONE, DST_HOST);
        if (rt == NULL)
                goto e_nobufs;
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index 85f2fdc360c2..29246bc9a7b4 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -102,7 +102,9 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb)
 {
        struct nlmsghdr *nlh = nlmsg_hdr(skb);
-        if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
+        if (skb->len < sizeof(*nlh) ||
+            nlh->nlmsg_len < sizeof(*nlh) ||
+            skb->len < nlh->nlmsg_len)
                return;
        if (!netlink_capable(skb, CAP_NET_ADMIN))
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 7bc787b095c8..554c2a961ad5 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1006,10 +1006,8 @@ static int dsa_slave_phy_connect(struct dsa_slave_priv *p,
        /* Use already configured phy mode */
        if (p->phy_interface == PHY_INTERFACE_MODE_NA)
                p->phy_interface = p->phy->interface;
-        phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link,
+        return phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link,
-                           p->phy_interface);
+                                  p->phy_interface);
-        return 0;
 }
 static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
@@ -1101,6 +1099,8 @@ int dsa_slave_suspend(struct net_device *slave_dev)
 {
        struct dsa_slave_priv *p = netdev_priv(slave_dev);
+        netif_device_detach(slave_dev);
        if (p->phy) {
                phy_stop(p->phy);
                p->old_pause = -1;
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index de85d4e1cf43..52dcd414c2af 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -353,6 +353,7 @@ void ether_setup(struct net_device *dev)
        dev->header_ops         = &eth_header_ops;
        dev->type               = ARPHRD_ETHER;
        dev->hard_header_len    = ETH_HLEN;
+        dev->min_header_len     = ETH_HLEN;
        dev->mtu                = ETH_DATA_LEN;
        dev->addr_len           = ETH_ALEN;
        dev->tx_queue_len       = 1000; /* Ethernet wants good queues */
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 68bf7bdf7fdb..b25a1b1ee657 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1029,7 +1029,7 @@ static struct inet_protosw inetsw_array[] =
                .type =       SOCK_DGRAM,
                .protocol =   IPPROTO_ICMP,
                .prot =       &ping_prot,
-                .ops =        &inet_dgram_ops,
+                .ops =        &inet_sockraw_ops,
                .flags =      INET_PROTOSW_REUSE,
       },
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 59b3e0e8fd51..711b4dfa17c3 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1250,7 +1250,7 @@ void __init arp_init(void)
 /*
 *      ax25 -> ASCII conversion
 */
-static char *ax2asc2(ax25_address *a, char *buf)
+static void ax2asc2(ax25_address *a, char *buf)
 {
        char c, *s;
        int n;
@@ -1272,10 +1272,10 @@ static char *ax2asc2(ax25_address *a, char *buf)
        *s++ = n + '0';
        *s++ = '\0';
-        if (*buf == '\0' || *buf == '-')
+        if (*buf == '\0' || *buf == '-') {
-                return "*";
+                buf[0] = '*';
+                buf[1] = '\0';
-        return buf;
+        }
 }
 #endif /* CONFIG_AX25 */
@@ -1309,7 +1309,7 @@ static void arp_format_neigh_entry(struct seq_file *seq,
        }
 #endif
        sprintf(tbuf, "%pI4", n->primary_key);
-        seq_printf(seq, "%-16s 0x%-10x0x%-10x%s     *        %s\n",
+        seq_printf(seq, "%-16s 0x%-10x0x%-10x%-17s     *        %s\n",
                   tbuf, hatype, arp_state_to_flags(n), hbuffer, dev->name);
        read_unlock(&n->lock);
 }
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index bdb2a07ec363..6cc3e1d602fb 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1657,6 +1657,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
                                goto validate_return_locked;
                        }
+                if (opt_iter + 1 == opt_len) {
+                        err_offset = opt_iter;
+                        goto validate_return_locked;
+                }
                tag_len = tag[1];
                if (tag_len > (opt_len - opt_iter)) {
                        err_offset = opt_iter + 1;
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 7e30c7b50a28..ee94bd32d6dc 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -758,7 +758,7 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
        unsigned int e = 0, s_e;
        struct fib_table *tb;
        struct hlist_head *head;
-        int dumped = 0;
+        int dumped = 0, err;
        if (nlmsg_len(cb->nlh) >= sizeof(struct rtmsg) &&
            ((struct rtmsg *) nlmsg_data(cb->nlh))->rtm_flags & RTM_F_CLONED)
@@ -778,20 +778,27 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
                        if (dumped)
                                memset(&cb->args[2], 0, sizeof(cb->args) -
                                                 2 * sizeof(cb->args[0]));
-                        if (fib_table_dump(tb, skb, cb) < 0)
+                        err = fib_table_dump(tb, skb, cb);
-                                goto out;
+                        if (err < 0) {
+                                if (likely(skb->len))
+                                        goto out;
+                                goto out_err;
+                        }
                        dumped = 1;
 next:
                        e++;
                }
        }
 out:
+        err = skb->len;
+out_err:
        rcu_read_unlock();
        cb->args[1] = e;
        cb->args[0] = h;
-        return skb->len;
+        return err;
 }
 /* Prepare and feed intra-kernel routing request.
@@ -1081,7 +1088,8 @@ static void nl_fib_input(struct sk_buff *skb)
        net = sock_net(skb->sk);
        nlh = nlmsg_hdr(skb);
-        if (skb->len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len ||
+        if (skb->len < nlmsg_total_size(sizeof(*frn)) ||
+            skb->len < nlh->nlmsg_len ||
            nlmsg_len(nlh) < sizeof(*frn))
                return;
@@ -1312,13 +1320,14 @@ static struct pernet_operations fib_net_ops = {
 void __init ip_fib_init(void)
 {
-        rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
+        fib_trie_init();
-        rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
-        rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
        register_pernet_subsys(&fib_net_ops);
        register_netdevice_notifier(&fib_netdev_notifier);
        register_inetaddr_notifier(&fib_inetaddr_notifier);
-        fib_trie_init();
+        rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
+        rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
+        rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
 }
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 840b450aab46..b2504712259f 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -204,6 +204,7 @@ static void rt_fibinfo_free_cpus(struct rtable __rcu * __percpu *rtp)
 static void free_fib_info_rcu(struct rcu_head *head)
 {
        struct fib_info *fi = container_of(head, struct fib_info, rcu);
+        struct dst_metrics *m;
        change_nexthops(fi) {
                if (nexthop_nh->nh_dev)
@@ -214,8 +215,9 @@ static void free_fib_info_rcu(struct rcu_head *head)
                rt_fibinfo_free(&nexthop_nh->nh_rth_input);
        } endfor_nexthops(fi);
-        if (fi->fib_metrics != (u32 *) dst_default_metrics)
+        m = fi->fib_metrics;
-                kfree(fi->fib_metrics);
+        if (m != &dst_default_metrics && atomic_dec_and_test(&m->refcnt))
+                kfree(m);
        kfree(fi);
 }
@@ -982,11 +984,11 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg)
                        val = 255;
                if (type == RTAX_FEATURES && (val & ~RTAX_FEATURE_MASK))
                        return -EINVAL;
-                fi->fib_metrics[type - 1] = val;
+                fi->fib_metrics->metrics[type - 1] = val;
        }
        if (ecn_ca)
-                fi->fib_metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
+                fi->fib_metrics->metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
        return 0;
 }
@@ -1044,11 +1046,12 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
                goto failure;
        fib_info_cnt++;
        if (cfg->fc_mx) {
-                fi->fib_metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
+                fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL);
                if (!fi->fib_metrics)
                        goto failure;
+                atomic_set(&fi->fib_metrics->refcnt, 1);
        } else
-                fi->fib_metrics = (u32 *) dst_default_metrics;
+                fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics;
        fi->fib_net = net;
        fi->fib_protocol = cfg->fc_protocol;
@@ -1251,7 +1254,7 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
        if (fi->fib_priority &&
            nla_put_u32(skb, RTA_PRIORITY, fi->fib_priority))
                goto nla_put_failure;
-        if (rtnetlink_put_metrics(skb, fi->fib_metrics) < 0)
+        if (rtnetlink_put_metrics(skb, fi->fib_metrics->metrics) < 0)
                goto nla_put_failure;
        if (fi->fib_prefsrc &&
@@ -1277,8 +1280,9 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
                    nla_put_u32(skb, RTA_FLOW, fi->fib_nh[0].nh_tclassid))
                        goto nla_put_failure;
 #endif
-                if (fi->fib_nh->nh_lwtstate)
+                if (fi->fib_nh->nh_lwtstate &&
-                        lwtunnel_fill_encap(skb, fi->fib_nh->nh_lwtstate);
+                    lwtunnel_fill_encap(skb, fi->fib_nh->nh_lwtstate) < 0)
+                        goto nla_put_failure;
        }
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
        if (fi->fib_nhs > 1) {
@@ -1314,8 +1318,10 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
                            nla_put_u32(skb, RTA_FLOW, nh->nh_tclassid))
                                goto nla_put_failure;
 #endif
-                        if (nh->nh_lwtstate)
+                        if (nh->nh_lwtstate &&
-                                lwtunnel_fill_encap(skb, nh->nh_lwtstate);
+                            lwtunnel_fill_encap(skb, nh->nh_lwtstate) < 0)
+                                goto nla_put_failure;
                        /* length of rtnetlink header + attributes */
                        rtnh->rtnh_len = nlmsg_get_pos(skb) - (void *) rtnh;
                } endfor_nexthops(fi);
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 7c52afb98c42..5c598f99a500 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1906,6 +1906,8 @@ static int fn_trie_dump_leaf(struct key_vector *l, struct fib_table *tb,
        /* rcu_read_lock is hold by caller */
        hlist_for_each_entry_rcu(fa, &l->leaf, fa_list) {
+                int err;
                if (i < s_i) {
                        i++;
                        continue;
@@ -1916,17 +1918,14 @@ static int fn_trie_dump_leaf(struct key_vector *l, struct fib_table *tb,
                        continue;
                }
-                if (fib_dump_info(skb, NETLINK_CB(cb->skb).portid,
+                err = fib_dump_info(skb, NETLINK_CB(cb->skb).portid,
-                                  cb->nlh->nlmsg_seq,
+                                    cb->nlh->nlmsg_seq, RTM_NEWROUTE,
-                                  RTM_NEWROUTE,
+                                    tb->tb_id, fa->fa_type,
-                                  tb->tb_id,
+                                    xkey, KEYLENGTH - fa->fa_slen,
-                                  fa->fa_type,
+                                    fa->fa_tos, fa->fa_info, NLM_F_MULTI);
-                                  xkey,
+                if (err < 0) {
-                                  KEYLENGTH - fa->fa_slen,
-                                  fa->fa_tos,
-                                  fa->fa_info, NLM_F_MULTI) < 0) {
                        cb->args[4] = i;
-                        return -1;
+                        return err;
                }
                i++;
        }
@@ -1948,10 +1947,13 @@ int fib_table_dump(struct fib_table *tb, struct sk_buff *skb,
        t_key key = cb->args[3];
        while ((l = leaf_walk_rcu(&tp, key)) != NULL) {
-                if (fn_trie_dump_leaf(l, tb, skb, cb) < 0) {
+                int err;
+                err = fn_trie_dump_leaf(l, tb, skb, cb);
+                if (err < 0) {
                        cb->args[3] = key;
                        cb->args[2] = count;
-                        return -1;
+                        return err;
                }
                ++count;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 17adfdaf5795..3809d523d012 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1102,6 +1102,7 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
        pmc = kzalloc(sizeof(*pmc), GFP_KERNEL);
        if (!pmc)
                return;
+        spin_lock_init(&pmc->lock);
        spin_lock_bh(&im->lock);
        pmc->interface = im->interface;
        in_dev_hold(in_dev);
@@ -2026,21 +2027,26 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
 static void ip_mc_clear_src(struct ip_mc_list *pmc)
 {
-        struct ip_sf_list *psf, *nextpsf;
+        struct ip_sf_list *psf, *nextpsf, *tomb, *sources;
-        for (psf = pmc->tomb; psf; psf = nextpsf) {
+        spin_lock_bh(&pmc->lock);
+        tomb = pmc->tomb;
+        pmc->tomb = NULL;
+        sources = pmc->sources;
+        pmc->sources = NULL;
+        pmc->sfmode = MCAST_EXCLUDE;
+        pmc->sfcount[MCAST_INCLUDE] = 0;
+        pmc->sfcount[MCAST_EXCLUDE] = 1;
+        spin_unlock_bh(&pmc->lock);
+        for (psf = tomb; psf; psf = nextpsf) {
                nextpsf = psf->sf_next;
                kfree(psf);
        }
-        pmc->tomb = NULL;
+        for (psf = sources; psf; psf = nextpsf) {
-        for (psf = pmc->sources; psf; psf = nextpsf) {
                nextpsf = psf->sf_next;
                kfree(psf);
        }
-        pmc->sources = NULL;
-        pmc->sfmode = MCAST_EXCLUDE;
-        pmc->sfcount[MCAST_INCLUDE] = 0;
-        pmc->sfcount[MCAST_EXCLUDE] = 1;
 }
 /* Join a multicast group
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index c97a2108cd61..a7e7aa1f6a47 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -669,6 +669,8 @@ struct sock *inet_csk_clone_lock(const struct sock *sk,
                inet_sk(newsk)->inet_sport = htons(inet_rsk(req)->ir_num);
                newsk->sk_write_space = sk_stream_write_space;
+                inet_sk(newsk)->mc_list = NULL;
                newsk->sk_mark = inet_rsk(req)->ir_mark;
                atomic64_set(&newsk->sk_cookie,
                             atomic64_read(&inet_rsk(req)->ir_cookie));
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 661bda968594..62e41d38da78 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -922,10 +922,12 @@ static int __ip_append_data(struct sock *sk,
                csummode = CHECKSUM_PARTIAL;
        cork->length += length;
-        if (((length > mtu) || (skb && skb_is_gso(skb))) &&
+        if ((skb && skb_is_gso(skb)) ||
+            (((length + (skb ? skb->len : fragheaderlen)) > mtu) &&
+            (skb_queue_len(queue) <= 1) &&
            (sk->sk_protocol == IPPROTO_UDP) &&
            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
-            (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
+            (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx)) {
                err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                                         hh_len, fragheaderlen, transhdrlen,
                                         maxfraglen, flags);
@@ -1241,6 +1243,7 @@ ssize_t	ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
                return -EINVAL;
        if ((size + skb->len > mtu) &&
+            (skb_queue_len(&sk->sk_write_queue) == 1) &&
            (sk->sk_protocol == IPPROTO_UDP) &&
            (rt->dst.dev->features & NETIF_F_UFO)) {
                if (skb->ip_summed != CHECKSUM_PARTIAL)
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 9ce202549e7a..f300d1cbfa91 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -105,10 +105,10 @@ static void ip_cmsg_recv_checksum(struct msghdr *msg, struct sk_buff *skb,
        if (skb->ip_summed != CHECKSUM_COMPLETE)
                return;
-        if (offset != 0)
+        if (offset != 0) {
-                csum = csum_sub(csum,
+                int tend_off = skb_transport_offset(skb) + tlen;
-                                csum_partial(skb->data + tlen,
+                csum = csum_sub(csum, skb_checksum(skb, tend_off, offset, 0));
-                                             offset, 0));
+        }
        put_cmsg(msg, SOL_IP, IP_CHECKSUM, sizeof(__wsum), &csum);
 }
@@ -1192,7 +1192,14 @@ void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb)
                pktinfo->ipi_ifindex = 0;
                pktinfo->ipi_spec_dst.s_addr = 0;
        }
-        skb_dst_drop(skb);
+        /* We need to keep the dst for __ip_options_echo()
+         * We could restrict the test to opt.ts_needtime || opt.srr,
+         * but the following is good enough as IP options are not often used.
+         */
+        if (unlikely(IPCB(skb)->opt.optlen))
+                skb_dst_force(skb);
+        else
+                skb_dst_drop(skb);
 }
 int ip_setsockopt(struct sock *sk, int level,
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 495fefe6a898..a989aba861e0 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -154,17 +154,18 @@ void ping_hash(struct sock *sk)
 void ping_unhash(struct sock *sk)
 {
        struct inet_sock *isk = inet_sk(sk);
        pr_debug("ping_unhash(isk=%p,isk->num=%u)\n", isk, isk->inet_num);
+        write_lock_bh(&ping_table.lock);
        if (sk_hashed(sk)) {
-                write_lock_bh(&ping_table.lock);
                hlist_nulls_del(&sk->sk_nulls_node);
                sk_nulls_node_init(&sk->sk_nulls_node);
                sock_put(sk);
                isk->inet_num = 0;
                isk->inet_sport = 0;
                sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
-                write_unlock_bh(&ping_table.lock);
        }
+        write_unlock_bh(&ping_table.lock);
 }
 EXPORT_SYMBOL_GPL(ping_unhash);
@@ -645,6 +646,8 @@ static int ping_v4_push_pending_frames(struct sock *sk, struct pingfakehdr *pfh,
 {
        struct sk_buff *skb = skb_peek(&sk->sk_write_queue);
+        if (!skb)
+                return 0;
        pfh->wcheck = csum_partial((char *)&pfh->icmph,
                sizeof(struct icmphdr), pfh->wcheck);
        pfh->icmph.checksum = csum_fold(pfh->wcheck);
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 6287418c1dfe..ca1031411aa7 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -354,6 +354,9 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,
                               rt->dst.dev->mtu);
                return -EMSGSIZE;
        }
+        if (length < sizeof(struct iphdr))
+                return -EINVAL;
        if (flags&MSG_PROBE)
                goto out;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 3708ff083211..fd15e55b28d1 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -792,6 +792,7 @@ static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buf
        struct rtable *rt;
        struct flowi4 fl4;
        const struct iphdr *iph = (const struct iphdr *) skb->data;
+        struct net *net = dev_net(skb->dev);
        int oif = skb->dev->ifindex;
        u8 tos = RT_TOS(iph->tos);
        u8 prot = iph->protocol;
@@ -799,7 +800,7 @@ static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buf
        rt = (struct rtable *) dst;
-        __build_flow_key(sock_net(sk), &fl4, sk, iph, oif, tos, prot, mark, 0);
+        __build_flow_key(net, &fl4, sk, iph, oif, tos, prot, mark, 0);
        __ip_do_redirect(rt, skb, &fl4, true);
 }
@@ -1361,8 +1362,12 @@ static void rt_add_uncached_list(struct rtable *rt)
 static void ipv4_dst_destroy(struct dst_entry *dst)
 {
+        struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst);
        struct rtable *rt = (struct rtable *) dst;
+        if (p != &dst_default_metrics && atomic_dec_and_test(&p->refcnt))
+                kfree(p);
        if (!list_empty(&rt->rt_uncached)) {
                struct uncached_list *ul = rt->rt_uncached_list;
@@ -1414,7 +1419,11 @@ static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
                        rt->rt_gateway = nh->nh_gw;
                        rt->rt_uses_gateway = 1;
                }
-                dst_init_metrics(&rt->dst, fi->fib_metrics, true);
+                dst_init_metrics(&rt->dst, fi->fib_metrics->metrics, true);
+                if (fi->fib_metrics != &dst_default_metrics) {
+                        rt->dst._metrics |= DST_METRICS_REFCOUNTED;
+                        atomic_inc(&fi->fib_metrics->refcnt);
+                }
 #ifdef CONFIG_IP_ROUTE_CLASSID
                rt->dst.tclassid = nh->nh_tclassid;
 #endif
@@ -1963,6 +1972,7 @@ int ip_route_input_noref(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 {
        int res;
+        tos &= IPTOS_RT_MASK;
        rcu_read_lock();
        /* Multicast recognition logic is moved from route cache to here.
@@ -2435,7 +2445,7 @@ static int rt_fill_info(struct net *net,  __be32 dst, __be32 src, u32 table_id,
        r->rtm_dst_len  = 32;
        r->rtm_src_len  = 0;
        r->rtm_tos      = fl4->flowi4_tos;
-        r->rtm_table    = table_id;
+        r->rtm_table    = table_id < 256 ? table_id : RT_TABLE_COMPAT;
        if (nla_put_u32(skb, RTA_TABLE, table_id))
                goto nla_put_failure;
        r->rtm_type     = rt->rt_type;
@@ -2569,7 +2579,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh)
        skb_reset_network_header(skb);
        /* Bugfix: need to give ip_route_input enough of an IP header to not gag. */
-        ip_hdr(skb)->protocol = IPPROTO_ICMP;
+        ip_hdr(skb)->protocol = IPPROTO_UDP;
        skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr));
        src = tb[RTA_SRC] ? nla_get_in_addr(tb[RTA_SRC]) : 0;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 2dc982b15df8..a2e1142145df 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -337,6 +337,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
        treq = tcp_rsk(req);
        treq->rcv_isn           = ntohl(th->seq) - 1;
        treq->snt_isn           = cookie;
+        treq->txhash            = net_tx_rndhash();
        req->mss                = mss;
        ireq->ir_num            = ntohs(th->dest);
        ireq->ir_rmt_port       = th->source;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index dc173e0d2184..48e6509426b0 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -783,6 +783,12 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
                                ret = -EAGAIN;
                                break;
                        }
+                        /* if __tcp_splice_read() got nothing while we have
+                         * an skb in receive queue, we do not want to loop.
+                         * This might happen with URG data.
+                         */
+                        if (!skb_queue_empty(&sk->sk_receive_queue))
+                                break;
                        sk_wait_data(sk, &timeo, NULL);
                        if (signal_pending(current)) {
                                ret = sock_intr_errno(timeo);
@@ -1065,9 +1071,12 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
                                int *copied, size_t size)
 {
        struct tcp_sock *tp = tcp_sk(sk);
+        struct sockaddr *uaddr = msg->msg_name;
        int err, flags;
-        if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE))
+        if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) ||
+            (uaddr && msg->msg_namelen >= sizeof(uaddr->sa_family) &&
+             uaddr->sa_family == AF_UNSPEC))
                return -EOPNOTSUPP;
        if (tp->fastopen_req)
                return -EALREADY; /* Another Fast Open is in progress */
@@ -1080,7 +1089,7 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
        tp->fastopen_req->size = size;
        flags = (msg->msg_flags & MSG_DONTWAIT) ? O_NONBLOCK : 0;
-        err = __inet_stream_connect(sk->sk_socket, msg->msg_name,
+        err = __inet_stream_connect(sk->sk_socket, uaddr,
                                    msg->msg_namelen, flags);
        *copied = tp->fastopen_req->copied;
        tcp_free_fastopen_req(tp);
@@ -2254,6 +2263,9 @@ int tcp_disconnect(struct sock *sk, int flags)
        tcp_init_send_head(sk);
        memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
        __sk_dst_reset(sk);
+        dst_release(sk->sk_rx_dst);
+        sk->sk_rx_dst = NULL;
+        tcp_saved_syn_free(tp);
        WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 882caa4e72bc..aafe68134763 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -183,6 +183,7 @@ void tcp_init_congestion_control(struct sock *sk)
 {
        const struct inet_connection_sock *icsk = inet_csk(sk);
+        tcp_sk(sk)->prior_ssthresh = 0;
        if (icsk->icsk_ca_ops->init)
                icsk->icsk_ca_ops->init(sk);
        if (tcp_ca_needs_ecn(sk))
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 55be6ac70cff..fca618272a01 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -112,7 +112,7 @@ static bool tcp_fastopen_cookie_gen(struct request_sock *req,
                struct tcp_fastopen_cookie tmp;
                if (__tcp_fastopen_cookie_gen(&ip6h->saddr, &tmp)) {
-                        struct in6_addr *buf = (struct in6_addr *) tmp.val;
+                        struct in6_addr *buf = &tmp.addr;
                        int i;
                        for (i = 0; i < 4; i++)
@@ -161,6 +161,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
         * scaled. So correct it appropriately.
         */
        tp->snd_wnd = ntohs(tcp_hdr(skb)->window);
+        tp->max_window = tp->snd_wnd;
        /* Activate the retrans timer so that SYNACK can be retransmitted.
         * The request socket is not added to the ehash
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 35e97ff3054a..b6d99c308bef 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1135,13 +1135,14 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
                 */
                if (pkt_len > mss) {
                        unsigned int new_len = (pkt_len / mss) * mss;
-                        if (!in_sack && new_len < pkt_len) {
+                        if (!in_sack && new_len < pkt_len)
                                new_len += mss;
-                                if (new_len >= skb->len)
-                                        return 0;
-                        }
                        pkt_len = new_len;
                }
+                if (pkt_len >= skb->len && !in_sack)
+                        return 0;
                err = tcp_fragment(sk, skb, pkt_len, mss, GFP_ATOMIC);
                if (err < 0)
                        return err;
@@ -2165,8 +2166,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        struct sk_buff *skb;
-        int cnt, oldcnt;
+        int cnt, oldcnt, lost;
-        int err;
        unsigned int mss;
        /* Use SACK to deduce losses of new sequences sent during recovery */
        const u32 loss_high = tcp_is_sack(tp) ?  tp->snd_nxt : tp->high_seq;
@@ -2206,9 +2206,10 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
                                break;
                        mss = tcp_skb_mss(skb);
-                        err = tcp_fragment(sk, skb, (packets - oldcnt) * mss,
+                        /* If needed, chop off the prefix to mark as lost. */
-                                           mss, GFP_ATOMIC);
+                        lost = (packets - oldcnt) * mss;
-                        if (err < 0)
+                        if (lost < skb->len &&
+                            tcp_fragment(sk, skb, lost, mss, GFP_ATOMIC) < 0)
                                break;
                        cnt = packets;
                }
@@ -2503,8 +2504,8 @@ static inline void tcp_end_cwnd_reduction(struct sock *sk)
        struct tcp_sock *tp = tcp_sk(sk);
        /* Reset cwnd to ssthresh in CWR or Recovery (unless it's undone) */
-        if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR ||
+        if (tp->snd_ssthresh < TCP_INFINITE_SSTHRESH &&
-            (tp->undo_marker && tp->snd_ssthresh < TCP_INFINITE_SSTHRESH)) {
+            (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR || tp->undo_marker)) {
                tp->snd_cwnd = tp->snd_ssthresh;
                tp->snd_cwnd_stamp = tcp_time_stamp;
        }
@@ -3220,7 +3221,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                        int delta;
                        /* Non-retransmitted hole got filled? That's reordering */
-                        if (reord < prior_fackets)
+                        if (reord < prior_fackets && reord <= tp->fackets_out)
                                tcp_update_reordering(sk, tp->fackets_out - reord, 0);
                        delta = tcp_is_fack(tp) ? pkts_acked :
@@ -5436,6 +5437,7 @@ void tcp_finish_connect(struct sock *sk, struct sk_buff *skb)
        struct inet_connection_sock *icsk = inet_csk(sk);
        tcp_set_state(sk, TCP_ESTABLISHED);
+        icsk->icsk_ack.lrcvtime = tcp_time_stamp;
        if (skb) {
                icsk->icsk_af_ops->sk_rx_dst_set(sk, skb);
@@ -5648,7 +5650,6 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                         * to stand against the temptation 8)     --ANK
                         */
                        inet_csk_schedule_ack(sk);
-                        icsk->icsk_ack.lrcvtime = tcp_time_stamp;
                        tcp_enter_quickack_mode(sk);
                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
                                                  TCP_DELACK_MAX, TCP_RTO_MAX);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 25309b137c43..a84f74af22f7 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -271,10 +271,13 @@ EXPORT_SYMBOL(tcp_v4_connect);
 */
 void tcp_v4_mtu_reduced(struct sock *sk)
 {
-        struct dst_entry *dst;
        struct inet_sock *inet = inet_sk(sk);
-        u32 mtu = tcp_sk(sk)->mtu_info;
+        struct dst_entry *dst;
+        u32 mtu;
+        if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
+                return;
+        mtu = tcp_sk(sk)->mtu_info;
        dst = inet_csk_update_pmtu(sk, mtu);
        if (!dst)
                return;
@@ -420,7 +423,8 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
        switch (type) {
        case ICMP_REDIRECT:
-                do_redirect(icmp_skb, sk);
+                if (!sock_owned_by_user(sk))
+                        do_redirect(icmp_skb, sk);
                goto out;
        case ICMP_SOURCE_QUENCH:
                /* Just silently ignore these. */
diff --git a/net/ipv4/tcp_lp.c b/net/ipv4/tcp_lp.c
index 1e70fa8fa793..3861dedd5365 100644
--- a/net/ipv4/tcp_lp.c
+++ b/net/ipv4/tcp_lp.c
@@ -264,13 +264,15 @@ static void tcp_lp_pkts_acked(struct sock *sk, u32 num_acked, s32 rtt_us)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        struct lp *lp = inet_csk_ca(sk);
+        u32 delta;
        if (rtt_us > 0)
                tcp_lp_rtt_sample(sk, rtt_us);
        /* calc inference */
-        if (tcp_time_stamp > tp->rx_opt.rcv_tsecr)
+        delta = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
-                lp->inference = 3 * (tcp_time_stamp - tp->rx_opt.rcv_tsecr);
+        if ((s32)delta > 0)
+                lp->inference = 3 * delta;
        /* test if within inference */
        if (lp->last_drop && (tcp_time_stamp - lp->last_drop < lp->inference))
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 9475a2748a9a..4c1c94fa8f08 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -472,6 +472,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
                newtp->mdev_us = jiffies_to_usecs(TCP_TIMEOUT_INIT);
                newtp->rtt_min[0].rtt = ~0U;
                newicsk->icsk_rto = TCP_TIMEOUT_INIT;
+                newicsk->icsk_ack.lrcvtime = tcp_time_stamp;
                newtp->packets_out = 0;
                newtp->retrans_out = 0;
@@ -546,6 +547,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
                        newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
                newtp->rx_opt.mss_clamp = req->mss;
                tcp_ecn_openreq_child(newtp, req);
+                newtp->fastopen_req = NULL;
                newtp->fastopen_rsk = NULL;
                newtp->syn_data_acked = 0;
                newtp->rack.mstamp.v64 = 0;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index ca3731721d81..4e88f93f71c8 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1221,7 +1221,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
 * eventually). The difference is that pulled data not copied, but
 * immediately discarded.
 */
-static void __pskb_trim_head(struct sk_buff *skb, int len)
+static int __pskb_trim_head(struct sk_buff *skb, int len)
 {
        struct skb_shared_info *shinfo;
        int i, k, eat;
@@ -1231,7 +1231,7 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
                __skb_pull(skb, eat);
                len -= eat;
                if (!len)
-                        return;
+                        return 0;
        }
        eat = len;
        k = 0;
@@ -1257,23 +1257,28 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
        skb_reset_tail_pointer(skb);
        skb->data_len -= len;
        skb->len = skb->data_len;
+        return len;
 }
 /* Remove acked data from a packet in the transmit queue. */
 int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
 {
+        u32 delta_truesize;
        if (skb_unclone(skb, GFP_ATOMIC))
                return -ENOMEM;
-        __pskb_trim_head(skb, len);
+        delta_truesize = __pskb_trim_head(skb, len);
        TCP_SKB_CB(skb)->seq += len;
        skb->ip_summed = CHECKSUM_PARTIAL;
-        skb->truesize        -= len;
+        if (delta_truesize) {
-        sk->sk_wmem_queued   -= len;
+                skb->truesize      -= delta_truesize;
-        sk_mem_uncharge(sk, len);
+                sk->sk_wmem_queued -= delta_truesize;
-        sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
+                sk_mem_uncharge(sk, delta_truesize);
+                sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
+        }
        /* Any change of skb->len requires recalculation of tso factor. */
        if (tcp_skb_pcount(skb) > 1)
@@ -2383,9 +2388,11 @@ u32 __tcp_select_window(struct sock *sk)
        int full_space = min_t(int, tp->window_clamp, allowed_space);
        int window;
-        if (mss > full_space)
+        if (unlikely(mss > full_space)) {
                mss = full_space;
+                if (mss <= 0)
+                        return 0;
+        }
        if (free_space < (full_space >> 1)) {
                icsk->icsk_ack.quick = 0;
@@ -3249,6 +3256,9 @@ int tcp_connect(struct sock *sk)
        struct sk_buff *buff;
        int err;
+        if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
+                return -EHOSTUNREACH; /* Routing failure or similar. */
        tcp_connect_init(sk);
        if (unlikely(tp->repair)) {
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 193ba1fa8a9a..1ec12a4f327e 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -223,7 +223,8 @@ void tcp_delack_timer_handler(struct sock *sk)
        sk_mem_reclaim_partial(sk);
-        if (sk->sk_state == TCP_CLOSE || !(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
+        if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
+            !(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
                goto out;
        if (time_after(icsk->icsk_ack.timeout, jiffies)) {
@@ -504,7 +505,8 @@ void tcp_write_timer_handler(struct sock *sk)
        struct inet_connection_sock *icsk = inet_csk(sk);
        int event;
-        if (sk->sk_state == TCP_CLOSE || !icsk->icsk_pending)
+        if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
+            !icsk->icsk_pending)
                goto out;
        if (time_after(icsk->icsk_timeout, jiffies)) {
@@ -604,7 +606,8 @@ static void tcp_keepalive_timer (unsigned long data)
                goto death;
        }
-        if (!sock_flag(sk, SOCK_KEEPOPEN) || sk->sk_state == TCP_CLOSE)
+        if (!sock_flag(sk, SOCK_KEEPOPEN) ||
+            ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT)))
                goto out;
        elapsed = keepalive_time_when(tp);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index ad3d1534c524..9ee5087b9b5e 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -819,7 +819,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4)
        if (is_udplite)                                  /*     UDP-Lite      */
                csum = udplite_csum(skb);
-        else if (sk->sk_no_check_tx) {   /* UDP csum disabled */
+        else if (sk->sk_no_check_tx && !skb_is_gso(skb)) {   /* UDP csum off */
                skb->ip_summed = CHECKSUM_NONE;
                goto send;
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 6396f1c80ae9..6dfc3daf7c21 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -231,7 +231,7 @@ static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
        if (uh->check == 0)
                uh->check = CSUM_MANGLED_0;
-        skb->ip_summed = CHECKSUM_NONE;
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
        /* Fragment the skb. IP headers of the fragments are updated in
         * inet_gso_segment()
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 1e541578a66d..2d2241006d35 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -112,6 +112,27 @@ static inline u32 cstamp_delta(unsigned long cstamp)
        return (cstamp - INITIAL_JIFFIES) * 100UL / HZ;
 }
+static inline s32 rfc3315_s14_backoff_init(s32 irt)
+{
+        /* multiply 'initial retransmission time' by 0.9 .. 1.1 */
+        u64 tmp = (900000 + prandom_u32() % 200001) * (u64)irt;
+        do_div(tmp, 1000000);
+        return (s32)tmp;
+}
+static inline s32 rfc3315_s14_backoff_update(s32 rt, s32 mrt)
+{
+        /* multiply 'retransmission timeout' by 1.9 .. 2.1 */
+        u64 tmp = (1900000 + prandom_u32() % 200001) * (u64)rt;
+        do_div(tmp, 1000000);
+        if ((s32)tmp > mrt) {
+                /* multiply 'maximum retransmission time' by 0.9 .. 1.1 */
+                tmp = (900000 + prandom_u32() % 200001) * (u64)mrt;
+                do_div(tmp, 1000000);
+        }
+        return (s32)tmp;
+}
 #ifdef CONFIG_SYSCTL
 static int addrconf_sysctl_register(struct inet6_dev *idev);
 static void addrconf_sysctl_unregister(struct inet6_dev *idev);
@@ -187,6 +208,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
        .dad_transmits          = 1,
        .rtr_solicits           = MAX_RTR_SOLICITATIONS,
        .rtr_solicit_interval   = RTR_SOLICITATION_INTERVAL,
+        .rtr_solicit_max_interval = RTR_SOLICITATION_MAX_INTERVAL,
        .rtr_solicit_delay      = MAX_RTR_SOLICITATION_DELAY,
        .use_tempaddr           = 0,
        .temp_valid_lft         = TEMP_VALID_LIFETIME,
@@ -202,6 +224,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
        .accept_ra_rtr_pref     = 1,
        .rtr_probe_interval     = 60 * HZ,
 #ifdef CONFIG_IPV6_ROUTE_INFO
+        .accept_ra_rt_info_min_plen = 0,
        .accept_ra_rt_info_max_plen = 0,
 #endif
 #endif
@@ -232,6 +255,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
        .dad_transmits          = 1,
        .rtr_solicits           = MAX_RTR_SOLICITATIONS,
        .rtr_solicit_interval   = RTR_SOLICITATION_INTERVAL,
+        .rtr_solicit_max_interval = RTR_SOLICITATION_MAX_INTERVAL,
        .rtr_solicit_delay      = MAX_RTR_SOLICITATION_DELAY,
        .use_tempaddr           = 0,
        .temp_valid_lft         = TEMP_VALID_LIFETIME,
@@ -247,6 +271,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
        .accept_ra_rtr_pref     = 1,
        .rtr_probe_interval     = 60 * HZ,
 #ifdef CONFIG_IPV6_ROUTE_INFO
+        .accept_ra_rt_info_min_plen = 0,
        .accept_ra_rt_info_max_plen = 0,
 #endif
 #endif
@@ -293,9 +318,9 @@ static void addrconf_mod_rs_timer(struct inet6_dev *idev,
 static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
                                   unsigned long delay)
 {
-        if (!delayed_work_pending(&ifp->dad_work))
+        in6_ifa_hold(ifp);
-                in6_ifa_hold(ifp);
+        if (mod_delayed_work(addrconf_wq, &ifp->dad_work, delay))
-        mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
+                in6_ifa_put(ifp);
 }
 static int snmp6_alloc_dev(struct inet6_dev *idev)
@@ -1774,17 +1799,7 @@ struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *add
 static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
 {
-        if (ifp->flags&IFA_F_PERMANENT) {
+        if (ifp->flags&IFA_F_TEMPORARY) {
-                spin_lock_bh(&ifp->lock);
-                addrconf_del_dad_work(ifp);
-                ifp->flags |= IFA_F_TENTATIVE;
-                if (dad_failed)
-                        ifp->flags |= IFA_F_DADFAILED;
-                spin_unlock_bh(&ifp->lock);
-                if (dad_failed)
-                        ipv6_ifa_notify(0, ifp);
-                in6_ifa_put(ifp);
-        } else if (ifp->flags&IFA_F_TEMPORARY) {
                struct inet6_ifaddr *ifpub;
                spin_lock_bh(&ifp->lock);
                ifpub = ifp->ifpub;
@@ -1797,6 +1812,16 @@ static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
                        spin_unlock_bh(&ifp->lock);
                }
                ipv6_del_addr(ifp);
+        } else if (ifp->flags&IFA_F_PERMANENT || !dad_failed) {
+                spin_lock_bh(&ifp->lock);
+                addrconf_del_dad_work(ifp);
+                ifp->flags |= IFA_F_TENTATIVE;
+                if (dad_failed)
+                        ifp->flags |= IFA_F_DADFAILED;
+                spin_unlock_bh(&ifp->lock);
+                if (dad_failed)
+                        ipv6_ifa_notify(0, ifp);
+                in6_ifa_put(ifp);
        } else {
                ipv6_del_addr(ifp);
        }
@@ -3170,6 +3195,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 {
        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        struct inet6_dev *idev = __in6_dev_get(dev);
+        struct net *net = dev_net(dev);
        int run_pending = 0;
        int err;
@@ -3185,7 +3211,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
        case NETDEV_CHANGEMTU:
                /* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
                if (dev->mtu < IPV6_MIN_MTU) {
-                        addrconf_ifdown(dev, 1);
+                        addrconf_ifdown(dev, dev != net->loopback_dev);
                        break;
                }
@@ -3238,9 +3264,15 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                        }
                        if (idev) {
-                                if (idev->if_flags & IF_READY)
+                                if (idev->if_flags & IF_READY) {
-                                        /* device is already configured. */
+                                        /* device is already configured -
+                                         * but resend MLD reports, we might
+                                         * have roamed and need to update
+                                         * multicast snooping switches
+                                         */
+                                        ipv6_mc_up(idev);
                                        break;
+                                }
                                idev->if_flags |= IF_READY;
                        }
@@ -3292,7 +3324,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                         * IPV6_MIN_MTU stop IPv6 on this interface.
                         */
                        if (dev->mtu < IPV6_MIN_MTU)
-                                addrconf_ifdown(dev, 1);
+                                addrconf_ifdown(dev, dev != net->loopback_dev);
                }
                break;
@@ -3333,6 +3365,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 */
 static struct notifier_block ipv6_dev_notf = {
        .notifier_call = addrconf_notify,
+        .priority = ADDRCONF_NOTIFY_PRIORITY,
 };
 static void addrconf_type_change(struct net_device *dev, unsigned long event)
@@ -3485,7 +3518,7 @@ static void addrconf_rs_timer(unsigned long data)
        if (idev->if_flags & IF_RA_RCVD)
                goto out;
-        if (idev->rs_probes++ < idev->cnf.rtr_solicits) {
+        if (idev->rs_probes++ < idev->cnf.rtr_solicits || idev->cnf.rtr_solicits < 0) {
                write_unlock(&idev->lock);
                if (!ipv6_get_lladdr(dev, &lladdr, IFA_F_TENTATIVE))
                        ndisc_send_rs(dev, &lladdr,
@@ -3494,11 +3527,13 @@ static void addrconf_rs_timer(unsigned long data)
                        goto put;
                write_lock(&idev->lock);
+                idev->rs_interval = rfc3315_s14_backoff_update(
+                        idev->rs_interval, idev->cnf.rtr_solicit_max_interval);
                /* The wait after the last probe can be shorter */
                addrconf_mod_rs_timer(idev, (idev->rs_probes ==
                                             idev->cnf.rtr_solicits) ?
                                      idev->cnf.rtr_solicit_delay :
-                                      idev->cnf.rtr_solicit_interval);
+                                      idev->rs_interval);
        } else {
                /*
                 * Note: we do not support deprecated "all on-link"
@@ -3726,7 +3761,7 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
        send_mld = ifp->scope == IFA_LINK && ipv6_lonely_lladdr(ifp);
        send_rs = send_mld &&
                  ipv6_accept_ra(ifp->idev) &&
-                  ifp->idev->cnf.rtr_solicits > 0 &&
+                  ifp->idev->cnf.rtr_solicits != 0 &&
                  (dev->flags&IFF_LOOPBACK) == 0;
        read_unlock_bh(&ifp->idev->lock);
@@ -3748,10 +3783,11 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
                write_lock_bh(&ifp->idev->lock);
                spin_lock(&ifp->lock);
+                ifp->idev->rs_interval = rfc3315_s14_backoff_init(
+                        ifp->idev->cnf.rtr_solicit_interval);
                ifp->idev->rs_probes = 1;
                ifp->idev->if_flags |= IF_RS_SENT;
-                addrconf_mod_rs_timer(ifp->idev,
+                addrconf_mod_rs_timer(ifp->idev, ifp->idev->rs_interval);
-                                      ifp->idev->cnf.rtr_solicit_interval);
                spin_unlock(&ifp->lock);
                write_unlock_bh(&ifp->idev->lock);
        }
@@ -4668,6 +4704,8 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
        array[DEVCONF_RTR_SOLICITS] = cnf->rtr_solicits;
        array[DEVCONF_RTR_SOLICIT_INTERVAL] =
                jiffies_to_msecs(cnf->rtr_solicit_interval);
+        array[DEVCONF_RTR_SOLICIT_MAX_INTERVAL] =
+                jiffies_to_msecs(cnf->rtr_solicit_max_interval);
        array[DEVCONF_RTR_SOLICIT_DELAY] =
                jiffies_to_msecs(cnf->rtr_solicit_delay);
        array[DEVCONF_FORCE_MLD_VERSION] = cnf->force_mld_version;
@@ -4689,6 +4727,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
        array[DEVCONF_RTR_PROBE_INTERVAL] =
                jiffies_to_msecs(cnf->rtr_probe_interval);
 #ifdef CONFIG_IPV6_ROUTE_INFO
+        array[DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN] = cnf->accept_ra_rt_info_min_plen;
        array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;
 #endif
 #endif
@@ -4876,7 +4915,7 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
                return -EINVAL;
        if (!ipv6_accept_ra(idev))
                return -EINVAL;
-        if (idev->cnf.rtr_solicits <= 0)
+        if (idev->cnf.rtr_solicits == 0)
                return -EINVAL;
        write_lock_bh(&idev->lock);
@@ -4901,8 +4940,10 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
        if (update_rs) {
                idev->if_flags |= IF_RS_SENT;
+                idev->rs_interval = rfc3315_s14_backoff_init(
+                        idev->cnf.rtr_solicit_interval);
                idev->rs_probes = 1;
-                addrconf_mod_rs_timer(idev, idev->cnf.rtr_solicit_interval);
+                addrconf_mod_rs_timer(idev, idev->rs_interval);
        }
        /* Well, that's kinda nasty ... */
@@ -5272,8 +5313,7 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
        struct net_device *dev;
        struct inet6_dev *idev;
-        rcu_read_lock();
+        for_each_netdev(net, dev) {
-        for_each_netdev_rcu(net, dev) {
                idev = __in6_dev_get(dev);
                if (idev) {
                        int changed = (!idev->cnf.disable_ipv6) ^ (!newf);
@@ -5282,7 +5322,6 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
                                dev_disable_change(idev);
                }
        }
-        rcu_read_unlock();
 }
 static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
@@ -5542,6 +5581,13 @@ static struct addrconf_sysctl_table
                        .proc_handler   = proc_dointvec_jiffies,
                },
                {
+                        .procname       = "router_solicitation_max_interval",
+                        .data           = &ipv6_devconf.rtr_solicit_max_interval,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = proc_dointvec_jiffies,
+                },
+                {
                        .procname       = "router_solicitation_delay",
                        .data           = &ipv6_devconf.rtr_solicit_delay,
                        .maxlen         = sizeof(int),
@@ -5651,6 +5697,13 @@ static struct addrconf_sysctl_table
                },
 #ifdef CONFIG_IPV6_ROUTE_INFO
                {
+                        .procname       = "accept_ra_rt_info_min_plen",
+                        .data           = &ipv6_devconf.accept_ra_rt_info_min_plen,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = proc_dointvec,
+                },
+                {
                        .procname       = "accept_ra_rt_info_max_plen",
                        .data           = &ipv6_devconf.accept_ra_rt_info_max_plen,
                        .maxlen         = sizeof(int),
@@ -5977,6 +6030,8 @@ int __init addrconf_init(void)
                goto errlo;
        }
+        ip6_route_init_special_entries();
        for (i = 0; i < IN6_ADDR_HSIZE; i++)
                INIT_HLIST_HEAD(&inet6_addr_lst[i]);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index cf2dfb222230..56528e9f3e01 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -76,18 +76,22 @@ static int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int a
                }
        }
-        addr_type = ipv6_addr_type(&usin->sin6_addr);
+        if (ipv6_addr_any(&usin->sin6_addr)) {
-        if (addr_type == IPV6_ADDR_ANY) {
                /*
                 *      connect to self
                 */
-                usin->sin6_addr.s6_addr[15] = 0x01;
+                if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
+                        ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
+                                               &usin->sin6_addr);
+                else
+                        usin->sin6_addr = in6addr_loopback;
        }
+        addr_type = ipv6_addr_type(&usin->sin6_addr);
        daddr = &usin->sin6_addr;
-        if (addr_type == IPV6_ADDR_MAPPED) {
+        if (addr_type & IPV6_ADDR_MAPPED) {
                struct sockaddr_in sin;
                if (__ipv6_only_sock(sk)) {
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index ed33abf57abd..9ac4f0cef27d 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -32,7 +32,6 @@ struct fib6_rule {
 struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
                                   int flags, pol_lookup_t lookup)
 {
-        struct rt6_info *rt;
        struct fib_lookup_arg arg = {
                .lookup_ptr = lookup,
                .flags = FIB_LOOKUP_NOREF,
@@ -41,21 +40,11 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
        fib_rules_lookup(net->ipv6.fib6_rules_ops,
                         flowi6_to_flowi(fl6), flags, &arg);
-        rt = arg.result;
+        if (arg.result)
+                return arg.result;
-        if (!rt) {
+        dst_hold(&net->ipv6.ip6_null_entry->dst);
-                dst_hold(&net->ipv6.ip6_null_entry->dst);
+        return &net->ipv6.ip6_null_entry->dst;
-                return &net->ipv6.ip6_null_entry->dst;
-        }
-        if (rt->rt6i_flags & RTF_REJECT &&
-            rt->dst.error == -EAGAIN) {
-                ip6_rt_put(rt);
-                rt = net->ipv6.ip6_null_entry;
-                dst_hold(&rt->dst);
-        }
-        return &rt->dst;
 }
 static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
@@ -116,7 +105,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                        flp6->saddr = saddr;
                }
                err = rt->dst.error;
-                goto out;
+                if (err != -EAGAIN)
+                        goto out;
        }
 again:
        ip6_rt_put(rt);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 34cf46d74554..f60e8caea767 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -290,8 +290,7 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
        struct rt6_info *rt;
        rt = lookup(net, net->ipv6.fib6_main_tbl, fl6, flags);
-        if (rt->rt6i_flags & RTF_REJECT &&
+        if (rt->dst.error == -EAGAIN) {
-            rt->dst.error == -EAGAIN) {
                ip6_rt_put(rt);
                rt = net->ipv6.ip6_null_entry;
                dst_hold(&rt->dst);
@@ -768,10 +767,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                                goto next_iter;
                        }
-                        if (iter->dst.dev == rt->dst.dev &&
+                        if (rt6_duplicate_nexthop(iter, rt)) {
-                            iter->rt6i_idev == rt->rt6i_idev &&
-                            ipv6_addr_equal(&iter->rt6i_gateway,
-                                            &rt->rt6i_gateway)) {
                                if (rt->rt6i_nsiblings)
                                        rt->rt6i_nsiblings = 0;
                                if (!(iter->rt6i_flags & RTF_EXPIRES))
@@ -903,6 +899,8 @@ add:
                        ins = &rt->dst.rt6_next;
                        iter = *ins;
                        while (iter) {
+                                if (iter->rt6i_metric > rt->rt6i_metric)
+                                        break;
                                if (rt6_qualify_for_ecmp(iter)) {
                                        *ins = iter->dst.rt6_next;
                                        fib6_purge_rt(iter, fn, info->nl_net);
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index eba61b42cd42..ab0efaca4a78 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -55,6 +55,7 @@
 #include <net/ip6_fib.h>
 #include <net/ip6_route.h>
 #include <net/ip6_tunnel.h>
+#include <net/gre.h>
 static bool log_ecn_error = true;
@@ -367,35 +368,37 @@ static void ip6gre_tunnel_uninit(struct net_device *dev)
 static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                u8 type, u8 code, int offset, __be32 info)
+                       u8 type, u8 code, int offset, __be32 info)
 {
-        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb->data;
+        const struct gre_base_hdr *greh;
-        __be16 *p = (__be16 *)(skb->data + offset);
+        const struct ipv6hdr *ipv6h;
-        int grehlen = offset + 4;
+        int grehlen = sizeof(*greh);
        struct ip6_tnl *t;
+        int key_off = 0;
        __be16 flags;
+        __be32 key;
-        flags = p[0];
+        if (!pskb_may_pull(skb, offset + grehlen))
-        if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) {
+                return;
-                if (flags&(GRE_VERSION|GRE_ROUTING))
+        greh = (const struct gre_base_hdr *)(skb->data + offset);
-                        return;
+        flags = greh->flags;
-                if (flags&GRE_KEY) {
+        if (flags & (GRE_VERSION | GRE_ROUTING))
-                        grehlen += 4;
+                return;
-                        if (flags&GRE_CSUM)
+        if (flags & GRE_CSUM)
-                                grehlen += 4;
+                grehlen += 4;
-                }
+        if (flags & GRE_KEY) {
+                key_off = grehlen + offset;
+                grehlen += 4;
        }
-        /* If only 8 bytes returned, keyed message will be dropped here */
+        if (!pskb_may_pull(skb, offset + grehlen))
-        if (!pskb_may_pull(skb, grehlen))
                return;
        ipv6h = (const struct ipv6hdr *)skb->data;
-        p = (__be16 *)(skb->data + offset);
+        greh = (const struct gre_base_hdr *)(skb->data + offset);
+        key = key_off ? *(__be32 *)(skb->data + key_off) : 0;
        t = ip6gre_tunnel_lookup(skb->dev, &ipv6h->daddr, &ipv6h->saddr,
-                                flags & GRE_KEY ?
+                                 key, greh->protocol);
-                                *(((__be32 *)p) + (grehlen / 4) - 1) : 0,
-                                p[1]);
        if (!t)
                return;
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 225f5f7f26ba..9e2ea4ae840d 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -62,7 +62,6 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
        const struct net_offload *ops;
        int proto;
        struct frag_hdr *fptr;
-        unsigned int unfrag_ip6hlen;
        u8 *prevhdr;
        int offset = 0;
        bool encap, udpfrag;
@@ -121,8 +120,12 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
                skb->network_header = (u8 *)ipv6h - skb->head;
                if (udpfrag) {
-                        unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
+                        int err = ip6_find_1stfragopt(skb, &prevhdr);
-                        fptr = (struct frag_hdr *)((u8 *)ipv6h + unfrag_ip6hlen);
+                        if (err < 0) {
+                                kfree_skb_list(segs);
+                                return ERR_PTR(err);
+                        }
+                        fptr = (struct frag_hdr *)((u8 *)ipv6h + err);
                        fptr->frag_off = htons(offset);
                        if (skb->next)
                                fptr->frag_off |= htons(IP6_MF);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 58900c21e4e4..e22339fad10b 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -571,7 +571,10 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
        int ptr, offset = 0, err = 0;
        u8 *prevhdr, nexthdr = 0;
-        hlen = ip6_find_1stfragopt(skb, &prevhdr);
+        err = ip6_find_1stfragopt(skb, &prevhdr);
+        if (err < 0)
+                goto fail;
+        hlen = err;
        nexthdr = *prevhdr;
        mtu = ip6_skb_dst_mtu(skb);
@@ -644,8 +647,6 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
                *prevhdr = NEXTHDR_FRAGMENT;
                tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
                if (!tmp_hdr) {
-                        IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
-                                      IPSTATS_MIB_FRAGFAILS);
                        err = -ENOMEM;
                        goto fail;
                }
@@ -742,13 +743,14 @@ slow_path:
         *      Fragment the datagram.
         */
-        *prevhdr = NEXTHDR_FRAGMENT;
        troom = rt->dst.dev->needed_tailroom;
        /*
         *      Keep copying data until we run out.
         */
        while (left > 0)        {
+                u8 *fragnexthdr_offset;
                len = left;
                /* IF: it doesn't fit, use 'mtu' - the data space left */
                if (len > mtu)
@@ -763,8 +765,6 @@ slow_path:
                frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
                                 hroom + troom, GFP_ATOMIC);
                if (!frag) {
-                        IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
-                                      IPSTATS_MIB_FRAGFAILS);
                        err = -ENOMEM;
                        goto fail;
                }
@@ -793,6 +793,10 @@ slow_path:
                 */
                skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
+                fragnexthdr_offset = skb_network_header(frag);
+                fragnexthdr_offset += prevhdr - skb_network_header(skb);
+                *fragnexthdr_offset = NEXTHDR_FRAGMENT;
                /*
                 *      Build fragment header.
                 */
@@ -996,6 +1000,11 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
                }
        }
 #endif
+        if (ipv6_addr_v4mapped(&fl6->saddr) &&
+            !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr))) {
+                err = -EAFNOSUPPORT;
+                goto out_err_release;
+        }
        return 0;
@@ -1348,11 +1357,12 @@ emsgsize:
         */
        cork->length += length;
-        if (((length > mtu) ||
+        if ((skb && skb_is_gso(skb)) ||
-             (skb && skb_is_gso(skb))) &&
+            (((length + (skb ? skb->len : headersize)) > mtu) &&
+            (skb_queue_len(queue) <= 1) &&
            (sk->sk_protocol == IPPROTO_UDP) &&
            (rt->dst.dev->features & NETIF_F_UFO) &&
-            (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
+            (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk))) {
                err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
                                          hh_len, fragheaderlen, exthdrlen,
                                          transhdrlen, mtu, flags, fl6);
@@ -1424,6 +1434,11 @@ alloc_new_skb:
                         */
                        alloclen += sizeof(struct frag_hdr);
+                        copy = datalen - transhdrlen - fraggap;
+                        if (copy < 0) {
+                                err = -EINVAL;
+                                goto error;
+                        }
                        if (transhdrlen) {
                                skb = sock_alloc_send_skb(sk,
                                                alloclen + hh_len,
@@ -1473,13 +1488,9 @@ alloc_new_skb:
                                data += fraggap;
                                pskb_trim_unique(skb_prev, maxfraglen);
                        }
-                        copy = datalen - transhdrlen - fraggap;
+                        if (copy > 0 &&
+                            getfrag(from, data + transhdrlen, offset,
-                        if (copy < 0) {
+                                    copy, fraggap, skb) < 0) {
-                                err = -EINVAL;
-                                kfree_skb(skb);
-                                goto error;
-                        } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
                                err = -EFAULT;
                                kfree_skb(skb);
                                goto error;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index c9bd1ee1f145..600975c5eacf 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -479,18 +479,19 @@ ip6_tnl_dev_uninit(struct net_device *dev)
 __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
 {
-        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) raw;
+        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw;
-        __u8 nexthdr = ipv6h->nexthdr;
+        unsigned int nhoff = raw - skb->data;
-        __u16 off = sizeof(*ipv6h);
+        unsigned int off = nhoff + sizeof(*ipv6h);
+        u8 next, nexthdr = ipv6h->nexthdr;
        while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
-                __u16 optlen = 0;
                struct ipv6_opt_hdr *hdr;
-                if (raw + off + sizeof(*hdr) > skb->data &&
+                u16 optlen;
-                    !pskb_may_pull(skb, raw - skb->data + off + sizeof (*hdr)))
+                if (!pskb_may_pull(skb, off + sizeof(*hdr)))
                        break;
-                hdr = (struct ipv6_opt_hdr *) (raw + off);
+                hdr = (struct ipv6_opt_hdr *)(skb->data + off);
                if (nexthdr == NEXTHDR_FRAGMENT) {
                        struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;
                        if (frag_hdr->frag_off)
@@ -501,20 +502,29 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
                } else {
                        optlen = ipv6_optlen(hdr);
                }
+                /* cache hdr->nexthdr, since pskb_may_pull() might
+                 * invalidate hdr
+                 */
+                next = hdr->nexthdr;
                if (nexthdr == NEXTHDR_DEST) {
-                        __u16 i = off + 2;
+                        u16 i = 2;
+                        /* Remember : hdr is no longer valid at this point. */
+                        if (!pskb_may_pull(skb, off + optlen))
+                                break;
                        while (1) {
                                struct ipv6_tlv_tnl_enc_lim *tel;
                                /* No more room for encapsulation limit */
-                                if (i + sizeof (*tel) > off + optlen)
+                                if (i + sizeof(*tel) > optlen)
                                        break;
-                                tel = (struct ipv6_tlv_tnl_enc_lim *) &raw[i];
+                                tel = (struct ipv6_tlv_tnl_enc_lim *)(skb->data + off + i);
                                /* return index of option if found and valid */
                                if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
                                    tel->length == 1)
-                                        return i;
+                                        return i + off - nhoff;
                                /* else jump to next option */
                                if (tel->type)
                                        i += tel->length + 2;
@@ -522,7 +532,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
                                        i++;
                        }
                }
-                nexthdr = hdr->nexthdr;
+                nexthdr = next;
                off += optlen;
        }
        return 0;
@@ -1039,7 +1049,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
        struct ip6_tnl *t = netdev_priv(dev);
        struct net *net = t->net;
        struct net_device_stats *stats = &t->dev->stats;
-        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+        struct ipv6hdr *ipv6h;
        struct ipv6_tel_txoption opt;
        struct dst_entry *dst = NULL, *ndst = NULL;
        struct net_device *tdev;
@@ -1051,26 +1061,28 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
        /* NBMA tunnel */
        if (ipv6_addr_any(&t->parms.raddr)) {
-                struct in6_addr *addr6;
+                if (skb->protocol == htons(ETH_P_IPV6)) {
-                struct neighbour *neigh;
+                        struct in6_addr *addr6;
-                int addr_type;
+                        struct neighbour *neigh;
+                        int addr_type;
-                if (!skb_dst(skb))
+                        if (!skb_dst(skb))
-                        goto tx_err_link_failure;
+                                goto tx_err_link_failure;
-                neigh = dst_neigh_lookup(skb_dst(skb),
+                        neigh = dst_neigh_lookup(skb_dst(skb),
-                                         &ipv6_hdr(skb)->daddr);
+                                                 &ipv6_hdr(skb)->daddr);
-                if (!neigh)
+                        if (!neigh)
-                        goto tx_err_link_failure;
+                                goto tx_err_link_failure;
-                addr6 = (struct in6_addr *)&neigh->primary_key;
+                        addr6 = (struct in6_addr *)&neigh->primary_key;
-                addr_type = ipv6_addr_type(addr6);
+                        addr_type = ipv6_addr_type(addr6);
-                if (addr_type == IPV6_ADDR_ANY)
+                        if (addr_type == IPV6_ADDR_ANY)
-                        addr6 = &ipv6_hdr(skb)->daddr;
+                                addr6 = &ipv6_hdr(skb)->daddr;
-                memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
+                        memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
-                neigh_release(neigh);
+                        neigh_release(neigh);
+                }
        } else if (!(t->parms.flags &
                     (IP6_TNL_F_USE_ORIG_TCLASS | IP6_TNL_F_USE_ORIG_FWMARK))) {
                /* enable the cache only only if the routing decision does
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 24fb9c0efd00..5b7433887eda 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -681,6 +681,10 @@ vti6_parm_to_user(struct ip6_tnl_parm2 *u, const struct __ip6_tnl_parm *p)
        u->link = p->link;
        u->i_key = p->i_key;
        u->o_key = p->o_key;
+        if (u->i_key)
+                u->i_flags |= GRE_KEY;
+        if (u->o_key)
+                u->o_flags |= GRE_KEY;
        u->proto = p->proto;
        memcpy(u->name, p->name, sizeof(u->name));
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index d9843e5a667f..8361d73ab653 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -774,7 +774,8 @@ failure:
 *      Delete a VIF entry
 */
-static int mif6_delete(struct mr6_table *mrt, int vifi, struct list_head *head)
+static int mif6_delete(struct mr6_table *mrt, int vifi, int notify,
+                       struct list_head *head)
 {
        struct mif_device *v;
        struct net_device *dev;
@@ -820,7 +821,7 @@ static int mif6_delete(struct mr6_table *mrt, int vifi, struct list_head *head)
                                             dev->ifindex, &in6_dev->cnf);
        }
-        if (v->flags & MIFF_REGISTER)
+        if ((v->flags & MIFF_REGISTER) && !notify)
                unregister_netdevice_queue(dev, head);
        dev_put(dev);
@@ -1330,7 +1331,6 @@ static int ip6mr_device_event(struct notifier_block *this,
        struct mr6_table *mrt;
        struct mif_device *v;
        int ct;
-        LIST_HEAD(list);
        if (event != NETDEV_UNREGISTER)
                return NOTIFY_DONE;
@@ -1339,10 +1339,9 @@ static int ip6mr_device_event(struct notifier_block *this,
                v = &mrt->vif6_table[0];
                for (ct = 0; ct < mrt->maxvif; ct++, v++) {
                        if (v->dev == dev)
-                                mif6_delete(mrt, ct, &list);
+                                mif6_delete(mrt, ct, 1, NULL);
                }
        }
-        unregister_netdevice_many(&list);
        return NOTIFY_DONE;
 }
@@ -1551,7 +1550,7 @@ static void mroute_clean_tables(struct mr6_table *mrt, bool all)
        for (i = 0; i < mrt->maxvif; i++) {
                if (!all && (mrt->vif6_table[i].flags & VIFF_STATIC))
                        continue;
-                mif6_delete(mrt, i, &list);
+                mif6_delete(mrt, i, 0, &list);
        }
        unregister_netdevice_many(&list);
@@ -1704,7 +1703,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
                if (copy_from_user(&mifi, optval, sizeof(mifi_t)))
                        return -EFAULT;
                rtnl_lock();
-                ret = mif6_delete(mrt, mifi, NULL);
+                ret = mif6_delete(mrt, mifi, 0, NULL);
                rtnl_unlock();
                return ret;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 84afb9a77278..3452f9037ad4 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1358,6 +1358,8 @@ skip_linkparms:
                        if (ri->prefix_len == 0 &&
                            !in6_dev->cnf.accept_ra_defrtr)
                                continue;
+                        if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
+                                continue;
                        if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
                                continue;
                        rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index 1d184322a7b1..f9f02581c4ca 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -78,15 +78,15 @@ EXPORT_SYMBOL(ipv6_select_ident);
 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 {
-        u16 offset = sizeof(struct ipv6hdr);
+        unsigned int offset = sizeof(struct ipv6hdr);
-        struct ipv6_opt_hdr *exthdr =
-                                (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
        unsigned int packet_len = skb_tail_pointer(skb) -
                skb_network_header(skb);
        int found_rhdr = 0;
        *nexthdr = &ipv6_hdr(skb)->nexthdr;
-        while (offset + 1 <= packet_len) {
+        while (offset <= packet_len) {
+                struct ipv6_opt_hdr *exthdr;
+                unsigned int len;
                switch (**nexthdr) {
@@ -107,13 +107,19 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
                        return offset;
                }
-                offset += ipv6_optlen(exthdr);
+                if (offset + sizeof(struct ipv6_opt_hdr) > packet_len)
-                *nexthdr = &exthdr->nexthdr;
+                        return -EINVAL;
                exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
                                                 offset);
+                len = ipv6_optlen(exthdr);
+                if (len + offset >= IPV6_MAXPLEN)
+                        return -EINVAL;
+                offset += len;
+                *nexthdr = &exthdr->nexthdr;
        }
-        return offset;
+        return -EINVAL;
 }
 EXPORT_SYMBOL(ip6_find_1stfragopt);
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 1737fc0f2988..4c753f4a3712 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -50,7 +50,7 @@ static struct inet_protosw pingv6_protosw = {
        .type =      SOCK_DGRAM,
        .protocol =  IPPROTO_ICMPV6,
        .prot =      &pingv6_prot,
-        .ops =       &inet6_dgram_ops,
+        .ops =       &inet6_sockraw_ops,
        .flags =     INET_PROTOSW_REUSE,
 };
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index d503b7f373a3..0ef8e114c8ab 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -630,6 +630,8 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
                ipv6_local_error(sk, EMSGSIZE, fl6, rt->dst.dev->mtu);
                return -EMSGSIZE;
        }
+        if (length < sizeof(struct ipv6hdr))
+                return -EINVAL;
        if (flags&MSG_PROBE)
                goto out;
@@ -1145,8 +1147,7 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
                spin_lock_bh(&sk->sk_receive_queue.lock);
                skb = skb_peek(&sk->sk_receive_queue);
                if (skb)
-                        amount = skb_tail_pointer(skb) -
+                        amount = skb->len;
-                                skb_transport_header(skb);
                spin_unlock_bh(&sk->sk_receive_queue.lock);
                return put_user(amount, (int __user *)arg);
        }
@@ -1303,7 +1304,7 @@ void raw6_proc_exit(void)
 #endif  /* CONFIG_PROC_FS */
 /* Same as inet6_dgram_ops, sans udp_poll.  */
-static const struct proto_ops inet6_sockraw_ops = {
+const struct proto_ops inet6_sockraw_ops = {
        .family            = PF_INET6,
        .owner             = THIS_MODULE,
        .release           = inet6_release,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 3c5d6bb3b850..d3f87ceb3408 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1759,6 +1759,10 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg)
        int addr_type;
        int err = -EINVAL;
+        /* RTF_PCPU is an internal flag; can not be set by userspace */
+        if (cfg->fc_flags & RTF_PCPU)
+                goto out;
        if (cfg->fc_dst_len > 128 || cfg->fc_src_len > 128)
                goto out;
 #ifndef CONFIG_IPV6_SUBTREES
@@ -2085,6 +2089,8 @@ static int ip6_route_del(struct fib6_config *cfg)
                                continue;
                        if (cfg->fc_metric && cfg->fc_metric != rt->rt6i_metric)
                                continue;
+                        if (cfg->fc_protocol && cfg->fc_protocol != rt->rt6i_protocol)
+                                continue;
                        dst_hold(&rt->dst);
                        read_unlock_bh(&table->tb6_lock);
@@ -2819,17 +2825,11 @@ static int ip6_route_info_append(struct list_head *rt6_nh_list,
                                 struct rt6_info *rt, struct fib6_config *r_cfg)
 {
        struct rt6_nh *nh;
-        struct rt6_info *rtnh;
        int err = -EEXIST;
        list_for_each_entry(nh, rt6_nh_list, next) {
                /* check if rt6_info already exists */
-                rtnh = nh->rt6_info;
+                if (rt6_duplicate_nexthop(nh->rt6_info, rt))
-                if (rtnh->dst.dev == rt->dst.dev &&
-                    rtnh->rt6i_idev == rt->rt6i_idev &&
-                    ipv6_addr_equal(&rtnh->rt6i_gateway,
-                                    &rt->rt6i_gateway))
                        return err;
        }
@@ -3188,7 +3188,8 @@ static int rt6_fill_node(struct net *net,
        if (nla_put_u8(skb, RTA_PREF, IPV6_EXTRACT_PREF(rt->rt6i_flags)))
                goto nla_put_failure;
-        lwtunnel_fill_encap(skb, rt->dst.lwtstate);
+        if (lwtunnel_fill_encap(skb, rt->dst.lwtstate) < 0)
+                goto nla_put_failure;
        nlmsg_end(skb, nlh);
        return 0;
@@ -3354,7 +3355,10 @@ static int ip6_route_dev_notify(struct notifier_block *this,
        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        struct net *net = dev_net(dev);
-        if (event == NETDEV_REGISTER && (dev->flags & IFF_LOOPBACK)) {
+        if (!(dev->flags & IFF_LOOPBACK))
+                return NOTIFY_OK;
+        if (event == NETDEV_REGISTER) {
                net->ipv6.ip6_null_entry->dst.dev = dev;
                net->ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(dev);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
@@ -3363,6 +3367,12 @@ static int ip6_route_dev_notify(struct notifier_block *this,
                net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
                net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
 #endif
+         } else if (event == NETDEV_UNREGISTER) {
+                in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+                in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
+                in6_dev_put(net->ipv6.ip6_blk_hole_entry->rt6i_idev);
+#endif
        }
        return NOTIFY_OK;
@@ -3669,9 +3679,24 @@ static struct pernet_operations ip6_route_net_late_ops = {
 static struct notifier_block ip6_route_dev_notifier = {
        .notifier_call = ip6_route_dev_notify,
-        .priority = 0,
+        .priority = ADDRCONF_NOTIFY_PRIORITY - 10,
 };
+void __init ip6_route_init_special_entries(void)
+{
+        /* Registering of the loopback is done before this portion of code,
+         * the loopback reference in rt6_info will not be taken, do it
+         * manually for init_net */
+        init_net.ipv6.ip6_null_entry->dst.dev = init_net.loopback_dev;
+        init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
+        init_net.ipv6.ip6_prohibit_entry->dst.dev = init_net.loopback_dev;
+        init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+        init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
+        init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+  #endif
+}
 int __init ip6_route_init(void)
 {
        int ret;
@@ -3698,17 +3723,6 @@ int __init ip6_route_init(void)
        ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep;
-        /* Registering of the loopback is done before this portion of code,
-         * the loopback reference in rt6_info will not be taken, do it
-         * manually for init_net */
-        init_net.ipv6.ip6_null_entry->dst.dev = init_net.loopback_dev;
-        init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
-  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
-        init_net.ipv6.ip6_prohibit_entry->dst.dev = init_net.loopback_dev;
-        init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
-        init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
-        init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
-  #endif
        ret = fib6_init();
        if (ret)
                goto out_register_subsys;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 3da2b16356eb..184f0fe35dc6 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1389,6 +1389,7 @@ static int ipip6_tunnel_init(struct net_device *dev)
        tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);
        if (!tunnel->dst_cache) {
                free_percpu(dev->tstats);
+                dev->tstats = NULL;
                return -ENOMEM;
        }
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 336843ca4e6b..7f3667635431 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -210,6 +210,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
        treq->snt_synack.v64    = 0;
        treq->rcv_isn = ntohl(th->seq) - 1;
        treq->snt_isn = cookie;
+        treq->txhash = net_tx_rndhash();
        /*
         * We need to lookup the dst_entry to get the correct window size.
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 8ed00c8a128a..4618f52a4abe 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -149,8 +149,13 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         *      connect() to INADDR_ANY means loopback (BSD'ism).
         */
-        if (ipv6_addr_any(&usin->sin6_addr))
+        if (ipv6_addr_any(&usin->sin6_addr)) {
-                usin->sin6_addr.s6_addr[15] = 0x1;
+                if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
+                        ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
+                                               &usin->sin6_addr);
+                else
+                        usin->sin6_addr = in6addr_loopback;
+        }
        addr_type = ipv6_addr_type(&usin->sin6_addr);
@@ -189,7 +194,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         *      TCP over IPv4
         */
-        if (addr_type == IPV6_ADDR_MAPPED) {
+        if (addr_type & IPV6_ADDR_MAPPED) {
                u32 exthdrlen = icsk->icsk_ext_hdr_len;
                struct sockaddr_in sin;
@@ -377,10 +382,12 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        np = inet6_sk(sk);
        if (type == NDISC_REDIRECT) {
-                struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
+                if (!sock_owned_by_user(sk)) {
+                        struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
-                if (dst)
+                        if (dst)
-                        dst->ops->redirect(dst, sk, skb);
+                                dst->ops->redirect(dst, sk, skb);
+                }
                goto out;
        }
@@ -976,6 +983,16 @@ drop:
        return 0; /* don't send reset */
 }
+static void tcp_v6_restore_cb(struct sk_buff *skb)
+{
+        /* We need to move header back to the beginning if xfrm6_policy_check()
+         * and tcp_v6_fill_cb() are going to be called again.
+         * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
+         */
+        memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
+                sizeof(struct inet6_skb_parm));
+}
 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
                                         struct request_sock *req,
                                         struct dst_entry *dst,
@@ -1023,6 +1040,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
                newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
 #endif
+                newnp->ipv6_mc_list = NULL;
                newnp->ipv6_ac_list = NULL;
                newnp->ipv6_fl_list = NULL;
                newnp->pktoptions  = NULL;
@@ -1092,6 +1110,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
           First: no IPv4 options.
         */
        newinet->inet_opt = NULL;
+        newnp->ipv6_mc_list = NULL;
        newnp->ipv6_ac_list = NULL;
        newnp->ipv6_fl_list = NULL;
@@ -1165,8 +1184,10 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
                                                      sk_gfp_atomic(sk, GFP_ATOMIC));
                        consume_skb(ireq->pktopts);
                        ireq->pktopts = NULL;
-                        if (newnp->pktoptions)
+                        if (newnp->pktoptions) {
+                                tcp_v6_restore_cb(newnp->pktoptions);
                                skb_set_owner_r(newnp->pktoptions, newsk);
+                        }
                }
        }
@@ -1181,16 +1202,6 @@ out:
        return NULL;
 }
-static void tcp_v6_restore_cb(struct sk_buff *skb)
-{
-        /* We need to move header back to the beginning if xfrm6_policy_check()
-         * and tcp_v6_fill_cb() are going to be called again.
-         * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
-         */
-        memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
-                sizeof(struct inet6_skb_parm));
-}
 /* The socket must have it's spinlock held when we get
 * here, unless it is a TCP_LISTEN socket.
 *
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 156a13c7ada8..cedced59ce15 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1136,6 +1136,10 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
                        if (addr_len < SIN6_LEN_RFC2133)
                                return -EINVAL;
                        daddr = &sin6->sin6_addr;
+                        if (ipv6_addr_any(daddr) &&
+                            ipv6_addr_v4mapped(&np->saddr))
+                                ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
+                                                       daddr);
                        break;
                case AF_INET:
                        goto do_udp_sendmsg;
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index 7441e1e63893..2e3c12eeca07 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -29,6 +29,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
        u8 frag_hdr_sz = sizeof(struct frag_hdr);
        __wsum csum;
        int tnl_hlen;
+        int err;
        mss = skb_shinfo(skb)->gso_size;
        if (unlikely(skb->len <= mss))
@@ -85,7 +86,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                if (uh->check == 0)
                        uh->check = CSUM_MANGLED_0;
-                skb->ip_summed = CHECKSUM_NONE;
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
                /* Check if there is enough headroom to insert fragment header. */
                tnl_hlen = skb_tnl_header_len(skb);
@@ -97,7 +98,10 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                /* Find the unfragmentable header and shift it left by frag_hdr_sz
                 * bytes to insert fragment header.
                 */
-                unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
+                err = ip6_find_1stfragopt(skb, &prevhdr);
+                if (err < 0)
+                        return ERR_PTR(err);
+                unfrag_ip6hlen = err;
                nexthdr = *prevhdr;
                *prevhdr = NEXTHDR_FRAGMENT;
                unfrag_len = (skb_network_header(skb) - skb_mac_header(skb)) +
diff --git a/net/ipv6/xfrm6_mode_ro.c b/net/ipv6/xfrm6_mode_ro.c
index 0e015906f9ca..07d36573f50b 100644
--- a/net/ipv6/xfrm6_mode_ro.c
+++ b/net/ipv6/xfrm6_mode_ro.c
@@ -47,6 +47,8 @@ static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb)
        iph = ipv6_hdr(skb);
        hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+        if (hdr_len < 0)
+                return hdr_len;
        skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
        skb_set_network_header(skb, -x->props.header_len);
        skb->transport_header = skb->network_header + hdr_len;
diff --git a/net/ipv6/xfrm6_mode_transport.c b/net/ipv6/xfrm6_mode_transport.c
index 4e344105b3fd..1d3bbe6e1183 100644
--- a/net/ipv6/xfrm6_mode_transport.c
+++ b/net/ipv6/xfrm6_mode_transport.c
@@ -28,6 +28,8 @@ static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb)
        iph = ipv6_hdr(skb);
        hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+        if (hdr_len < 0)
+                return hdr_len;
        skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
        skb_set_network_header(skb, -x->props.header_len);
        skb->transport_header = skb->network_header + hdr_len;
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 48d0dc89b58d..e735f781e4f3 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -1168,11 +1168,10 @@ static int ipxitf_ioctl(unsigned int cmd, void __user *arg)
                sipx->sipx_network      = ipxif->if_netnum;
                memcpy(sipx->sipx_node, ipxif->if_node,
                        sizeof(sipx->sipx_node));
-                rc = -EFAULT;
+                rc = 0;
                if (copy_to_user(arg, &ifr, sizeof(ifr)))
-                        break;
+                        rc = -EFAULT;
                ipxitf_put(ipxif);
-                rc = 0;
                break;
        }
        case SIOCAIPXITFCRT:
diff --git a/net/irda/irqueue.c b/net/irda/irqueue.c
index acbe61c7e683..160dc89335e2 100644
--- a/net/irda/irqueue.c
+++ b/net/irda/irqueue.c
@@ -383,9 +383,6 @@ EXPORT_SYMBOL(hashbin_new);
 *    for deallocating this structure if it's complex. If not the user can
 *    just supply kfree, which should take care of the job.
 */
-#ifdef CONFIG_LOCKDEP
-static int hashbin_lock_depth = 0;
-#endif
 int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func)
 {
        irda_queue_t* queue;
@@ -396,22 +393,27 @@ int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func)
        IRDA_ASSERT(hashbin->magic == HB_MAGIC, return -1;);
        /* Synchronize */
-        if ( hashbin->hb_type & HB_LOCK ) {
+        if (hashbin->hb_type & HB_LOCK)
-                spin_lock_irqsave_nested(&hashbin->hb_spinlock, flags,
+                spin_lock_irqsave(&hashbin->hb_spinlock, flags);
-                                         hashbin_lock_depth++);
-        }
        /*
         *  Free the entries in the hashbin, TODO: use hashbin_clear when
         *  it has been shown to work
         */
        for (i = 0; i < HASHBIN_SIZE; i ++ ) {
-                queue = dequeue_first((irda_queue_t**) &hashbin->hb_queue[i]);
+                while (1) {
-                while (queue ) {
+                        queue = dequeue_first((irda_queue_t**) &hashbin->hb_queue[i]);
-                        if (free_func)
-                                (*free_func)(queue);
+                        if (!queue)
-                        queue = dequeue_first(
+                                break;
-                                (irda_queue_t**) &hashbin->hb_queue[i]);
+                        if (free_func) {
+                                if (hashbin->hb_type & HB_LOCK)
+                                        spin_unlock_irqrestore(&hashbin->hb_spinlock, flags);
+                                free_func(queue);
+                                if (hashbin->hb_type & HB_LOCK)
+                                        spin_lock_irqsave(&hashbin->hb_spinlock, flags);
+                        }
                }
        }
@@ -420,12 +422,8 @@ int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func)
        hashbin->magic = ~HB_MAGIC;
        /* Release lock */
-        if ( hashbin->hb_type & HB_LOCK) {
+        if (hashbin->hb_type & HB_LOCK)
                spin_unlock_irqrestore(&hashbin->hb_spinlock, flags);
-#ifdef CONFIG_LOCKDEP
-                hashbin_lock_depth--;
-#endif
-        }
        /*
         *  Free the hashbin structure
diff --git a/net/key/af_key.c b/net/key/af_key.c
index f9c9ecb0cdd3..2e1050ec2cf0 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -63,8 +63,13 @@ struct pfkey_sock {
                } u;
                struct sk_buff  *skb;
        } dump;
+        struct mutex dump_lock;
 };
+static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
+                               xfrm_address_t *saddr, xfrm_address_t *daddr,
+                               u16 *family);
 static inline struct pfkey_sock *pfkey_sk(struct sock *sk)
 {
        return (struct pfkey_sock *)sk;
@@ -139,6 +144,7 @@ static int pfkey_create(struct net *net, struct socket *sock, int protocol,
 {
        struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
        struct sock *sk;
+        struct pfkey_sock *pfk;
        int err;
        if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
@@ -153,6 +159,9 @@ static int pfkey_create(struct net *net, struct socket *sock, int protocol,
        if (sk == NULL)
                goto out;
+        pfk = pfkey_sk(sk);
+        mutex_init(&pfk->dump_lock);
        sock->ops = &pfkey_ops;
        sock_init_data(sock, sk);
@@ -281,13 +290,23 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
        struct sadb_msg *hdr;
        int rc;
+        mutex_lock(&pfk->dump_lock);
+        if (!pfk->dump.dump) {
+                rc = 0;
+                goto out;
+        }
        rc = pfk->dump.dump(pfk);
-        if (rc == -ENOBUFS)
+        if (rc == -ENOBUFS) {
-                return 0;
+                rc = 0;
+                goto out;
+        }
        if (pfk->dump.skb) {
-                if (!pfkey_can_dump(&pfk->sk))
+                if (!pfkey_can_dump(&pfk->sk)) {
-                        return 0;
+                        rc = 0;
+                        goto out;
+                }
                hdr = (struct sadb_msg *) pfk->dump.skb->data;
                hdr->sadb_msg_seq = 0;
@@ -298,6 +317,9 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
        }
        pfkey_terminate_dump(pfk);
+out:
+        mutex_unlock(&pfk->dump_lock);
        return rc;
 }
@@ -1135,6 +1157,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                        goto out;
        }
+        err = -ENOBUFS;
        key = ext_hdrs[SADB_EXT_KEY_AUTH - 1];
        if (sa->sadb_sa_auth) {
                int keysize = 0;
@@ -1146,8 +1169,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                if (key)
                        keysize = (key->sadb_key_bits + 7) / 8;
                x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL);
-                if (!x->aalg)
+                if (!x->aalg) {
+                        err = -ENOMEM;
                        goto out;
+                }
                strcpy(x->aalg->alg_name, a->name);
                x->aalg->alg_key_len = 0;
                if (key) {
@@ -1166,8 +1191,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                                goto out;
                        }
                        x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL);
-                        if (!x->calg)
+                        if (!x->calg) {
+                                err = -ENOMEM;
                                goto out;
+                        }
                        strcpy(x->calg->alg_name, a->name);
                        x->props.calgo = sa->sadb_sa_encrypt;
                } else {
@@ -1181,8 +1208,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                        if (key)
                                keysize = (key->sadb_key_bits + 7) / 8;
                        x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL);
-                        if (!x->ealg)
+                        if (!x->ealg) {
+                                err = -ENOMEM;
                                goto out;
+                        }
                        strcpy(x->ealg->alg_name, a->name);
                        x->ealg->alg_key_len = 0;
                        if (key) {
@@ -1227,8 +1256,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                struct xfrm_encap_tmpl *natt;
                x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL);
-                if (!x->encap)
+                if (!x->encap) {
+                        err = -ENOMEM;
                        goto out;
+                }
                natt = x->encap;
                n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1];
@@ -1793,19 +1824,26 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
        struct xfrm_address_filter *filter = NULL;
        struct pfkey_sock *pfk = pfkey_sk(sk);
-        if (pfk->dump.dump != NULL)
+        mutex_lock(&pfk->dump_lock);
+        if (pfk->dump.dump != NULL) {
+                mutex_unlock(&pfk->dump_lock);
                return -EBUSY;
+        }
        proto = pfkey_satype2proto(hdr->sadb_msg_satype);
-        if (proto == 0)
+        if (proto == 0) {
+                mutex_unlock(&pfk->dump_lock);
                return -EINVAL;
+        }
        if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
                struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
                filter = kmalloc(sizeof(*filter), GFP_KERNEL);
-                if (filter == NULL)
+                if (filter == NULL) {
+                        mutex_unlock(&pfk->dump_lock);
                        return -ENOMEM;
+                }
                memcpy(&filter->saddr, &xfilter->sadb_x_filter_saddr,
                       sizeof(xfrm_address_t));
@@ -1821,6 +1859,7 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
        pfk->dump.dump = pfkey_dump_sa;
        pfk->dump.done = pfkey_dump_sa_done;
        xfrm_state_walk_init(&pfk->dump.u.state, proto, filter);
+        mutex_unlock(&pfk->dump_lock);
        return pfkey_do_dump(pfk);
 }
@@ -1913,19 +1952,14 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
        /* addresses present only in tunnel mode */
        if (t->mode == XFRM_MODE_TUNNEL) {
-                u8 *sa = (u8 *) (rq + 1);
+                int err;
-                int family, socklen;
-                family = pfkey_sockaddr_extract((struct sockaddr *)sa,
-                                                &t->saddr);
-                if (!family)
-                        return -EINVAL;
-                socklen = pfkey_sockaddr_len(family);
+                err = parse_sockaddr_pair(
-                if (pfkey_sockaddr_extract((struct sockaddr *)(sa + socklen),
+                        (struct sockaddr *)(rq + 1),
-                                           &t->id.daddr) != family)
+                        rq->sadb_x_ipsecrequest_len - sizeof(*rq),
-                        return -EINVAL;
+                        &t->saddr, &t->id.daddr, &t->encap_family);
-                t->encap_family = family;
+                if (err)
+                        return err;
        } else
                t->encap_family = xp->family;
@@ -1945,7 +1979,11 @@ parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol)
        if (pol->sadb_x_policy_len * 8 < sizeof(struct sadb_x_policy))
                return -EINVAL;
-        while (len >= sizeof(struct sadb_x_ipsecrequest)) {
+        while (len >= sizeof(*rq)) {
+                if (len < rq->sadb_x_ipsecrequest_len ||
+                    rq->sadb_x_ipsecrequest_len < sizeof(*rq))
+                        return -EINVAL;
                if ((err = parse_ipsecrequest(xp, rq)) < 0)
                        return err;
                len -= rq->sadb_x_ipsecrequest_len;
@@ -2408,7 +2446,6 @@ out:
        return err;
 }
-#ifdef CONFIG_NET_KEY_MIGRATE
 static int pfkey_sockaddr_pair_size(sa_family_t family)
 {
        return PFKEY_ALIGN8(pfkey_sockaddr_len(family) * 2);
@@ -2420,7 +2457,7 @@ static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
 {
        int af, socklen;
-        if (ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
+        if (ext_len < 2 || ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
                return -EINVAL;
        af = pfkey_sockaddr_extract(sa, saddr);
@@ -2436,6 +2473,7 @@ static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
        return 0;
 }
+#ifdef CONFIG_NET_KEY_MIGRATE
 static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
                                    struct xfrm_migrate *m)
 {
@@ -2443,13 +2481,14 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
        struct sadb_x_ipsecrequest *rq2;
        int mode;
-        if (len <= sizeof(struct sadb_x_ipsecrequest) ||
+        if (len < sizeof(*rq1) ||
-            len < rq1->sadb_x_ipsecrequest_len)
+            len < rq1->sadb_x_ipsecrequest_len ||
+            rq1->sadb_x_ipsecrequest_len < sizeof(*rq1))
                return -EINVAL;
        /* old endoints */
        err = parse_sockaddr_pair((struct sockaddr *)(rq1 + 1),
-                                  rq1->sadb_x_ipsecrequest_len,
+                                  rq1->sadb_x_ipsecrequest_len - sizeof(*rq1),
                                  &m->old_saddr, &m->old_daddr,
                                  &m->old_family);
        if (err)
@@ -2458,13 +2497,14 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
        rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len);
        len -= rq1->sadb_x_ipsecrequest_len;
-        if (len <= sizeof(struct sadb_x_ipsecrequest) ||
+        if (len <= sizeof(*rq2) ||
-            len < rq2->sadb_x_ipsecrequest_len)
+            len < rq2->sadb_x_ipsecrequest_len ||
+            rq2->sadb_x_ipsecrequest_len < sizeof(*rq2))
                return -EINVAL;
        /* new endpoints */
        err = parse_sockaddr_pair((struct sockaddr *)(rq2 + 1),
-                                  rq2->sadb_x_ipsecrequest_len,
+                                  rq2->sadb_x_ipsecrequest_len - sizeof(*rq2),
                                  &m->new_saddr, &m->new_daddr,
                                  &m->new_family);
        if (err)
@@ -2679,14 +2719,18 @@ static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, const struct sadb
 {
        struct pfkey_sock *pfk = pfkey_sk(sk);
-        if (pfk->dump.dump != NULL)
+        mutex_lock(&pfk->dump_lock);
+        if (pfk->dump.dump != NULL) {
+                mutex_unlock(&pfk->dump_lock);
                return -EBUSY;
+        }
        pfk->dump.msg_version = hdr->sadb_msg_version;
        pfk->dump.msg_portid = hdr->sadb_msg_pid;
        pfk->dump.dump = pfkey_dump_sp;
        pfk->dump.done = pfkey_dump_sp_done;
        xfrm_policy_walk_init(&pfk->dump.u.policy, XFRM_POLICY_TYPE_MAIN);
+        mutex_unlock(&pfk->dump_lock);
        return pfkey_do_dump(pfk);
 }
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index ec17cbe8a02b..d3dec414fd44 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -278,7 +278,8 @@ struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunn
 }
 EXPORT_SYMBOL_GPL(l2tp_session_find);
-struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
+struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
+                                          bool do_ref)
 {
        int hash;
        struct l2tp_session *session;
@@ -288,6 +289,9 @@ struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
        for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
                hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
                        if (++count > nth) {
+                                l2tp_session_inc_refcount(session);
+                                if (do_ref && session->ref)
+                                        session->ref(session);
                                read_unlock_bh(&tunnel->hlist_lock);
                                return session;
                        }
@@ -298,7 +302,7 @@ struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
        return NULL;
 }
-EXPORT_SYMBOL_GPL(l2tp_session_find_nth);
+EXPORT_SYMBOL_GPL(l2tp_session_get_nth);
 /* Lookup a session by interface name.
 * This is very inefficient but is only used by management interfaces.
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 5871537af387..555d962a62d2 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -243,7 +243,8 @@ out:
 struct l2tp_session *l2tp_session_find(struct net *net,
                                       struct l2tp_tunnel *tunnel,
                                       u32 session_id);
-struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth);
+struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
+                                          bool do_ref);
 struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname);
 struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id);
 struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth);
@@ -273,6 +274,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb,
 int l2tp_nl_register_ops(enum l2tp_pwtype pw_type,
                         const struct l2tp_nl_cmd_ops *ops);
 void l2tp_nl_unregister_ops(enum l2tp_pwtype pw_type);
+int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg);
 /* Session reference counts. Incremented when code obtains a reference
 * to a session.
diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index 2d6760a2ae34..d100aed3d06f 100644
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -53,7 +53,7 @@ static void l2tp_dfs_next_tunnel(struct l2tp_dfs_seq_data *pd)
 static void l2tp_dfs_next_session(struct l2tp_dfs_seq_data *pd)
 {
-        pd->session = l2tp_session_find_nth(pd->tunnel, pd->session_idx);
+        pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true);
        pd->session_idx++;
        if (pd->session == NULL) {
@@ -238,10 +238,14 @@ static int l2tp_dfs_seq_show(struct seq_file *m, void *v)
        }
        /* Show the tunnel or session context */
-        if (pd->session == NULL)
+        if (!pd->session) {
                l2tp_dfs_seq_tunnel_show(m, pd->tunnel);
-        else
+        } else {
                l2tp_dfs_seq_session_show(m, pd->session);
+                if (pd->session->deref)
+                        pd->session->deref(pd->session);
+                l2tp_session_dec_refcount(pd->session);
+        }
 out:
        return 0;
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index d0e906d39642..48ab93842322 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -11,6 +11,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <asm/ioctls.h>
 #include <linux/icmp.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
@@ -382,7 +383,7 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb)
 drop:
        IP_INC_STATS(sock_net(sk), IPSTATS_MIB_INDISCARDS);
        kfree_skb(skb);
-        return -1;
+        return 0;
 }
 /* Userspace will call sendmsg() on the tunnel socket to send L2TP
@@ -555,6 +556,30 @@ out:
        return err ? err : copied;
 }
+int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg)
+{
+        struct sk_buff *skb;
+        int amount;
+        switch (cmd) {
+        case SIOCOUTQ:
+                amount = sk_wmem_alloc_get(sk);
+                break;
+        case SIOCINQ:
+                spin_lock_bh(&sk->sk_receive_queue.lock);
+                skb = skb_peek(&sk->sk_receive_queue);
+                amount = skb ? skb->len : 0;
+                spin_unlock_bh(&sk->sk_receive_queue.lock);
+                break;
+        default:
+                return -ENOIOCTLCMD;
+        }
+        return put_user(amount, (int __user *)arg);
+}
+EXPORT_SYMBOL(l2tp_ioctl);
 static struct proto l2tp_ip_prot = {
        .name              = "L2TP/IP",
        .owner             = THIS_MODULE,
@@ -563,7 +588,7 @@ static struct proto l2tp_ip_prot = {
        .bind              = l2tp_ip_bind,
        .connect           = l2tp_ip_connect,
        .disconnect        = l2tp_ip_disconnect,
-        .ioctl             = udp_ioctl,
+        .ioctl             = l2tp_ioctl,
        .destroy           = l2tp_ip_destroy_sock,
        .setsockopt        = ip_setsockopt,
        .getsockopt        = ip_getsockopt,
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 0289208b0346..c8f483cd2ca9 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -715,7 +715,7 @@ static struct proto l2tp_ip6_prot = {
        .bind              = l2tp_ip6_bind,
        .connect           = l2tp_ip6_connect,
        .disconnect        = l2tp_ip6_disconnect,
-        .ioctl             = udp_ioctl,
+        .ioctl             = l2tp_ioctl,
        .destroy           = l2tp_ip6_destroy_sock,
        .setsockopt        = ipv6_setsockopt,
        .getsockopt        = ipv6_getsockopt,
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index 2caaa84ce92d..665cc74df5c5 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -827,7 +827,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
                                goto out;
                }
-                session = l2tp_session_find_nth(tunnel, si);
+                session = l2tp_session_get_nth(tunnel, si, false);
                if (session == NULL) {
                        ti++;
                        tunnel = NULL;
@@ -837,8 +837,11 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
                if (l2tp_nl_session_send(skb, NETLINK_CB(cb->skb).portid,
                                         cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                         session, L2TP_CMD_SESSION_GET) < 0)
+                                         session, L2TP_CMD_SESSION_GET) < 0) {
+                        l2tp_session_dec_refcount(session);
                        break;
+                }
+                l2tp_session_dec_refcount(session);
                si++;
        }
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 1ad18c55064c..8ab9c5d74416 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -467,6 +467,10 @@ static void pppol2tp_session_close(struct l2tp_session *session)
 static void pppol2tp_session_destruct(struct sock *sk)
 {
        struct l2tp_session *session = sk->sk_user_data;
+        skb_queue_purge(&sk->sk_receive_queue);
+        skb_queue_purge(&sk->sk_write_queue);
        if (session) {
                sk->sk_user_data = NULL;
                BUG_ON(session->magic != L2TP_SESSION_MAGIC);
@@ -505,9 +509,6 @@ static int pppol2tp_release(struct socket *sock)
                l2tp_session_queue_purge(session);
                sock_put(sk);
        }
-        skb_queue_purge(&sk->sk_receive_queue);
-        skb_queue_purge(&sk->sk_write_queue);
        release_sock(sk);
        /* This will delete the session context via
@@ -1574,7 +1575,7 @@ static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
 {
-        pd->session = l2tp_session_find_nth(pd->tunnel, pd->session_idx);
+        pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true);
        pd->session_idx++;
        if (pd->session == NULL) {
@@ -1701,10 +1702,14 @@ static int pppol2tp_seq_show(struct seq_file *m, void *v)
        /* Show the tunnel or session context.
         */
-        if (pd->session == NULL)
+        if (!pd->session) {
                pppol2tp_seq_tunnel_show(m, pd->tunnel);
-        else
+        } else {
                pppol2tp_seq_session_show(m, pd->session);
+                if (pd->session->deref)
+                        pd->session->deref(pd->session);
+                l2tp_session_dec_refcount(pd->session);
+        }
 out:
        return 0;
@@ -1863,4 +1868,4 @@ MODULE_DESCRIPTION("PPP over L2TP over UDP");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(PPPOL2TP_DRV_VERSION);
 MODULE_ALIAS("pppox-proto-" __stringify(PX_PROTO_OL2TP));
-MODULE_ALIAS_L2TP_PWTYPE(11);
+MODULE_ALIAS_L2TP_PWTYPE(7);
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 3e821daf9dd4..8bc5a1bd2d45 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -821,7 +821,10 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb)
                 * another trick required to cope with how the PROCOM state
                 * machine works. -acme
                 */
+                skb_orphan(skb);
+                sock_hold(sk);
                skb->sk = sk;
+                skb->destructor = sock_efree;
        }
        if (!sock_owned_by_user(sk))
                llc_conn_rcv(sk, skb);
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index d0e1e804ebd7..5404d0d195cc 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -290,7 +290,10 @@ static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb,
        ev->type   = LLC_SAP_EV_TYPE_PDU;
        ev->reason = 0;
+        skb_orphan(skb);
+        sock_hold(sk);
        skb->sk = sk;
+        skb->destructor = sock_efree;
        llc_sap_state_process(sap, skb);
 }
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index bd06799e2e69..3bbbcaf1ec0b 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -7,6 +7,7 @@
 * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
 * Copyright 2007-2010, Intel Corporation
+ * Copyright(c) 2015 Intel Deutschland GmbH
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
@@ -61,6 +62,14 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
 {
        struct ieee80211_local *local = sta->local;
        struct tid_ampdu_rx *tid_rx;
+        struct ieee80211_ampdu_params params = {
+                .sta = &sta->sta,
+                .action = IEEE80211_AMPDU_RX_STOP,
+                .tid = tid,
+                .amsdu = false,
+                .timeout = 0,
+                .ssn = 0,
+        };
        lockdep_assert_held(&sta->ampdu_mlme.mtx);
@@ -78,8 +87,7 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
               initiator == WLAN_BACK_RECIPIENT ? "recipient" : "inititator",
               (int)reason);
-        if (drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_STOP,
+        if (drv_ampdu_action(local, sta->sdata, &params))
-                             &sta->sta, tid, NULL, 0, false))
                sdata_info(sta->sdata,
                           "HW problem - can not stop rx aggregation for %pM tid %d\n",
                           sta->sta.addr, tid);
@@ -259,6 +267,15 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
 {
        struct ieee80211_local *local = sta->sdata->local;
        struct tid_ampdu_rx *tid_agg_rx;
+        struct ieee80211_ampdu_params params = {
+                .sta = &sta->sta,
+                .action = IEEE80211_AMPDU_RX_START,
+                .tid = tid,
+                .amsdu = false,
+                .timeout = timeout,
+                .ssn = start_seq_num,
+        };
        int i, ret = -EOPNOTSUPP;
        u16 status = WLAN_STATUS_REQUEST_DECLINED;
@@ -301,7 +318,10 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
        if (buf_size > sta->sta.max_rx_aggregation_subframes)
                buf_size = sta->sta.max_rx_aggregation_subframes;
-        ht_dbg(sta->sdata, "AddBA Req buf_size=%d\n", buf_size);
+        params.buf_size = buf_size;
+        ht_dbg(sta->sdata, "AddBA Req buf_size=%d for %pM\n",
+               buf_size, sta->sta.addr);
        if (sta->ampdu_mlme.tid_rx[tid]) {
                ht_dbg_ratelimited(sta->sdata,
@@ -346,8 +366,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
        for (i = 0; i < buf_size; i++)
                __skb_queue_head_init(&tid_agg_rx->reorder_buf[i]);
-        ret = drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_START,
+        ret = drv_ampdu_action(local, sta->sdata, &params);
-                               &sta->sta, tid, &start_seq_num, 0, false);
        ht_dbg(sta->sdata, "Rx A-MPDU request on %pM tid %d result %d\n",
               sta->sta.addr, tid, ret);
        if (ret) {
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index ff757181b0a8..4932e9f243a2 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -7,6 +7,7 @@
 * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
 * Copyright 2007-2010, Intel Corporation
+ * Copyright(c) 2015 Intel Deutschland GmbH
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
@@ -295,7 +296,14 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 {
        struct ieee80211_local *local = sta->local;
        struct tid_ampdu_tx *tid_tx;
-        enum ieee80211_ampdu_mlme_action action;
+        struct ieee80211_ampdu_params params = {
+                .sta = &sta->sta,
+                .tid = tid,
+                .buf_size = 0,
+                .amsdu = false,
+                .timeout = 0,
+                .ssn = 0,
+        };
        int ret;
        lockdep_assert_held(&sta->ampdu_mlme.mtx);
@@ -304,10 +312,10 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
        case AGG_STOP_DECLINED:
        case AGG_STOP_LOCAL_REQUEST:
        case AGG_STOP_PEER_REQUEST:
-                action = IEEE80211_AMPDU_TX_STOP_CONT;
+                params.action = IEEE80211_AMPDU_TX_STOP_CONT;
                break;
        case AGG_STOP_DESTROY_STA:
-                action = IEEE80211_AMPDU_TX_STOP_FLUSH;
+                params.action = IEEE80211_AMPDU_TX_STOP_FLUSH;
                break;
        default:
                WARN_ON_ONCE(1);
@@ -330,9 +338,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                spin_unlock_bh(&sta->lock);
                if (reason != AGG_STOP_DESTROY_STA)
                        return -EALREADY;
-                ret = drv_ampdu_action(local, sta->sdata,
+                params.action = IEEE80211_AMPDU_TX_STOP_FLUSH_CONT;
-                                       IEEE80211_AMPDU_TX_STOP_FLUSH_CONT,
+                ret = drv_ampdu_action(local, sta->sdata, &params);
-                                       &sta->sta, tid, NULL, 0, false);
                WARN_ON_ONCE(ret);
                return 0;
        }
@@ -381,8 +388,7 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                        WLAN_BACK_INITIATOR;
        tid_tx->tx_stop = reason == AGG_STOP_LOCAL_REQUEST;
-        ret = drv_ampdu_action(local, sta->sdata, action,
+        ret = drv_ampdu_action(local, sta->sdata, &params);
-                               &sta->sta, tid, NULL, 0, false);
        /* HW shall not deny going back to legacy */
        if (WARN_ON(ret)) {
@@ -445,7 +451,14 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
        struct tid_ampdu_tx *tid_tx;
        struct ieee80211_local *local = sta->local;
        struct ieee80211_sub_if_data *sdata = sta->sdata;
-        u16 start_seq_num;
+        struct ieee80211_ampdu_params params = {
+                .sta = &sta->sta,
+                .action = IEEE80211_AMPDU_TX_START,
+                .tid = tid,
+                .buf_size = 0,
+                .amsdu = false,
+                .timeout = 0,
+        };
        int ret;
        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
@@ -467,10 +480,8 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
         */
        synchronize_net();
-        start_seq_num = sta->tid_seq[tid] >> 4;
+        params.ssn = sta->tid_seq[tid] >> 4;
+        ret = drv_ampdu_action(local, sdata, &params);
-        ret = drv_ampdu_action(local, sdata, IEEE80211_AMPDU_TX_START,
-                               &sta->sta, tid, &start_seq_num, 0, false);
        if (ret) {
                ht_dbg(sdata,
                       "BA request denied - HW unavailable for %pM tid %d\n",
@@ -499,7 +510,7 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
        /* send AddBA request */
        ieee80211_send_addba_request(sdata, sta->sta.addr, tid,
-                                     tid_tx->dialog_token, start_seq_num,
+                                     tid_tx->dialog_token, params.ssn,
                                     IEEE80211_MAX_AMPDU_BUF,
                                     tid_tx->timeout);
 }
@@ -684,18 +695,24 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
                                         struct sta_info *sta, u16 tid)
 {
        struct tid_ampdu_tx *tid_tx;
+        struct ieee80211_ampdu_params params = {
+                .sta = &sta->sta,
+                .action = IEEE80211_AMPDU_TX_OPERATIONAL,
+                .tid = tid,
+                .timeout = 0,
+                .ssn = 0,
+        };
        lockdep_assert_held(&sta->ampdu_mlme.mtx);
        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
+        params.buf_size = tid_tx->buf_size;
+        params.amsdu = tid_tx->amsdu;
        ht_dbg(sta->sdata, "Aggregation is on for %pM tid %d\n",
               sta->sta.addr, tid);
-        drv_ampdu_action(local, sta->sdata,
+        drv_ampdu_action(local, sta->sdata, &params);
-                         IEEE80211_AMPDU_TX_OPERATIONAL,
-                         &sta->sta, tid, NULL, tid_tx->buf_size,
-                         tid_tx->amsdu);
        /*
         * synchronize with TX path, while splicing the TX path
diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c
index ca1fe5576103..c258f1041d33 100644
--- a/net/mac80211/driver-ops.c
+++ b/net/mac80211/driver-ops.c
@@ -284,9 +284,7 @@ int drv_switch_vif_chanctx(struct ieee80211_local *local,
 int drv_ampdu_action(struct ieee80211_local *local,
                     struct ieee80211_sub_if_data *sdata,
-                     enum ieee80211_ampdu_mlme_action action,
+                     struct ieee80211_ampdu_params *params)
-                     struct ieee80211_sta *sta, u16 tid,
-                     u16 *ssn, u8 buf_size, bool amsdu)
 {
        int ret = -EOPNOTSUPP;
@@ -296,12 +294,10 @@ int drv_ampdu_action(struct ieee80211_local *local,
        if (!check_sdata_in_driver(sdata))
                return -EIO;
-        trace_drv_ampdu_action(local, sdata, action, sta, tid,
+        trace_drv_ampdu_action(local, sdata, params);
-                               ssn, buf_size, amsdu);
        if (local->ops->ampdu_action)
-                ret = local->ops->ampdu_action(&local->hw, &sdata->vif, action,
+                ret = local->ops->ampdu_action(&local->hw, &sdata->vif, params);
-                                               sta, tid, ssn, buf_size, amsdu);
        trace_drv_return_int(local, ret);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 154ce4b13406..18b0d65baff0 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -585,9 +585,7 @@ static inline int drv_tx_last_beacon(struct ieee80211_local *local)
 int drv_ampdu_action(struct ieee80211_local *local,
                     struct ieee80211_sub_if_data *sdata,
-                     enum ieee80211_ampdu_mlme_action action,
+                     struct ieee80211_ampdu_params *params);
-                     struct ieee80211_sta *sta, u16 tid,
-                     u16 *ssn, u8 buf_size, bool amsdu);
 static inline int drv_get_survey(struct ieee80211_local *local, int idx,
                                struct survey_info *survey)
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 980e9e9b6684..24ba31601fc9 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -66,6 +66,8 @@ ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
                    2 + (IEEE80211_MAX_SUPP_RATES - 8) +
                    2 + sizeof(struct ieee80211_ht_cap) +
                    2 + sizeof(struct ieee80211_ht_operation) +
+                    2 + sizeof(struct ieee80211_vht_cap) +
+                    2 + sizeof(struct ieee80211_vht_operation) +
                    ifibss->ie_len;
        presp = kzalloc(sizeof(*presp) + frame_len, GFP_KERNEL);
        if (!presp)
@@ -486,14 +488,14 @@ int ieee80211_ibss_csa_beacon(struct ieee80211_sub_if_data *sdata,
        struct beacon_data *presp, *old_presp;
        struct cfg80211_bss *cbss;
        const struct cfg80211_bss_ies *ies;
-        u16 capability = 0;
+        u16 capability = WLAN_CAPABILITY_IBSS;
        u64 tsf;
        int ret = 0;
        sdata_assert_lock(sdata);
        if (ifibss->privacy)
-                capability = WLAN_CAPABILITY_PRIVACY;
+                capability |= WLAN_CAPABILITY_PRIVACY;
        cbss = cfg80211_get_bss(sdata->local->hw.wiphy, ifibss->chandef.chan,
                                ifibss->bssid, ifibss->ssid,
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 175ffcf7fb06..2ee53dc1ddf7 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -891,12 +891,17 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                supp_ht = supp_ht || sband->ht_cap.ht_supported;
                supp_vht = supp_vht || sband->vht_cap.vht_supported;
-                if (sband->ht_cap.ht_supported)
+                if (!sband->ht_cap.ht_supported)
-                        local->rx_chains =
+                        continue;
-                                max(ieee80211_mcs_to_chains(&sband->ht_cap.mcs),
-                                    local->rx_chains);
                /* TODO: consider VHT for RX chains, hopefully it's the same */
+                local->rx_chains =
+                        max(ieee80211_mcs_to_chains(&sband->ht_cap.mcs),
+                            local->rx_chains);
+                /* no need to mask, SM_PS_DISABLED has all bits set */
+                sband->ht_cap.cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
+                                     IEEE80211_HT_CAP_SM_PS_SHIFT;
        }
        /* if low-level driver supports AP, we also support VLAN */
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index f7bb6829b415..9063e8e736ad 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -355,7 +355,7 @@ int mesh_add_vendor_ies(struct ieee80211_sub_if_data *sdata,
        /* fast-forward to vendor IEs */
        offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0);
-        if (offset) {
+        if (offset < ifmsh->ie_len) {
                len = ifmsh->ie_len - offset;
                data = ifmsh->ie + offset;
                if (skb_tailroom(skb) < len)
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 00a43a70e1fc..0402fa45b343 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -168,6 +168,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                        break;
                }
+                flush_delayed_work(&sdata->dec_tailroom_needed_wk);
                drv_remove_interface(local, sdata);
        }
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 2b528389409f..3bcabc2ba4a6 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1455,12 +1455,16 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         */
        if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
            !ieee80211_has_morefrags(hdr->frame_control) &&
+            !ieee80211_is_back_req(hdr->frame_control) &&
            !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
            (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
             rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
-            /* PM bit is only checked in frames where it isn't reserved,
+            /*
+             * PM bit is only checked in frames where it isn't reserved,
             * in AP mode it's reserved in non-bufferable management frames
             * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
+             * BAR frames should be ignored as specified in
+             * IEEE 802.11-2012 10.2.1.2.
             */
            (!ieee80211_is_mgmt(hdr->frame_control) ||
             ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
@@ -3396,6 +3400,27 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
                            !ether_addr_equal(bssid, hdr->addr1))
                                return false;
                }
+                /*
+                 * 802.11-2016 Table 9-26 says that for data frames, A1 must be
+                 * the BSSID - we've checked that already but may have accepted
+                 * the wildcard (ff:ff:ff:ff:ff:ff).
+                 *
+                 * It also says:
+                 *      The BSSID of the Data frame is determined as follows:
+                 *      a) If the STA is contained within an AP or is associated
+                 *         with an AP, the BSSID is the address currently in use
+                 *         by the STA contained in the AP.
+                 *
+                 * So we should not accept data frames with an address that's
+                 * multicast.
+                 *
+                 * Accepting it also opens a security problem because stations
+                 * could encrypt it with the GTK and inject traffic that way.
+                 */
+                if (ieee80211_is_data(hdr->frame_control) && multicast)
+                        return false;
                return true;
        case NL80211_IFTYPE_WDS:
                if (bssid || !ieee80211_is_data(hdr->frame_control))
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index 56c6d6cfa5a1..913e959b03cf 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -80,7 +80,23 @@
 #define KEY_PR_FMT      " cipher:0x%x, flags=%#x, keyidx=%d, hw_key_idx=%d"
 #define KEY_PR_ARG      __entry->cipher, __entry->flags, __entry->keyidx, __entry->hw_key_idx
+#define AMPDU_ACTION_ENTRY      __field(enum ieee80211_ampdu_mlme_action,               \
+                                        ieee80211_ampdu_mlme_action)                    \
+                                STA_ENTRY                                               \
+                                __field(u16, tid)                                       \
+                                __field(u16, ssn)                                       \
+                                __field(u8, buf_size)                                   \
+                                __field(bool, amsdu)                                    \
+                                __field(u16, timeout)
+#define AMPDU_ACTION_ASSIGN     STA_NAMED_ASSIGN(params->sta);                          \
+                                __entry->tid = params->tid;                             \
+                                __entry->ssn = params->ssn;                             \
+                                __entry->buf_size = params->buf_size;                   \
+                                __entry->amsdu = params->amsdu;                         \
+                                __entry->timeout = params->timeout;
+#define AMPDU_ACTION_PR_FMT     STA_PR_FMT " tid %d, ssn %d, buf_size %u, amsdu %d, timeout %d"
+#define AMPDU_ACTION_PR_ARG     STA_PR_ARG, __entry->tid, __entry->ssn,                 \
+                                __entry->buf_size, __entry->amsdu, __entry->timeout
 /*
 * Tracing for driver callbacks.
@@ -970,38 +986,25 @@ DEFINE_EVENT(local_only_evt, drv_tx_last_beacon,
 TRACE_EVENT(drv_ampdu_action,
        TP_PROTO(struct ieee80211_local *local,
                 struct ieee80211_sub_if_data *sdata,
-                 enum ieee80211_ampdu_mlme_action action,
+                 struct ieee80211_ampdu_params *params),
-                 struct ieee80211_sta *sta, u16 tid,
-                 u16 *ssn, u8 buf_size, bool amsdu),
-        TP_ARGS(local, sdata, action, sta, tid, ssn, buf_size, amsdu),
+        TP_ARGS(local, sdata, params),
        TP_STRUCT__entry(
                LOCAL_ENTRY
-                STA_ENTRY
-                __field(u32, action)
-                __field(u16, tid)
-                __field(u16, ssn)
-                __field(u8, buf_size)
-                __field(bool, amsdu)
                VIF_ENTRY
+                AMPDU_ACTION_ENTRY
        ),
        TP_fast_assign(
                LOCAL_ASSIGN;
                VIF_ASSIGN;
-                STA_ASSIGN;
+                AMPDU_ACTION_ASSIGN;
-                __entry->action = action;
-                __entry->tid = tid;
-                __entry->ssn = ssn ? *ssn : 0;
-                __entry->buf_size = buf_size;
-                __entry->amsdu = amsdu;
        ),
        TP_printk(
-                LOCAL_PR_FMT VIF_PR_FMT STA_PR_FMT " action:%d tid:%d buf:%d amsdu:%d",
+                LOCAL_PR_FMT VIF_PR_FMT AMPDU_ACTION_PR_FMT,
-                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->action,
+                LOCAL_PR_ARG, VIF_PR_ARG, AMPDU_ACTION_PR_ARG
-                __entry->tid, __entry->buf_size, __entry->amsdu
        )
 );
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index d824c38971ed..e19ea1c53afa 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -16,6 +16,7 @@
 #include <asm/unaligned.h>
 #include <net/mac80211.h>
 #include <crypto/aes.h>
+#include <crypto/algapi.h>
 #include "ieee80211_i.h"
 #include "michael.h"
@@ -152,7 +153,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
        data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
        key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
        michael_mic(key, hdr, data, data_len, mic);
-        if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0)
+        if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN))
                goto mic_fail;
        /* remove Michael MIC from payload */
@@ -1044,7 +1045,7 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
                bip_aad(skb, aad);
                ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
                                   skb->data + 24, skb->len - 24, mic);
-                if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
                        key->u.aes_cmac.icverrors++;
                        return RX_DROP_UNUSABLE;
                }
@@ -1094,7 +1095,7 @@ ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx)
                bip_aad(skb, aad);
                ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
                                       skb->data + 24, skb->len - 24, mic);
-                if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
                        key->u.aes_cmac.icverrors++;
                        return RX_DROP_UNUSABLE;
                }
@@ -1198,7 +1199,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx)
                if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
                                       skb->data + 24, skb->len - 24,
                                       mic) < 0 ||
-                    memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                    crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
                        key->u.aes_gmac.icverrors++;
                        return RX_DROP_UNUSABLE;
                }
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 881bc2072809..52cfc4478511 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -1567,6 +1567,7 @@ static void mpls_net_exit(struct net *net)
        for (index = 0; index < platform_labels; index++) {
                struct mpls_route *rt = rtnl_dereference(platform_label[index]);
                RCU_INIT_POINTER(platform_label[index], NULL);
+                mpls_notify_route(net, index, rt, NULL, NULL);
                mpls_rt_free(rt);
        }
        rtnl_unlock();
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 4da560005b0e..dd1649caa2b2 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -845,10 +845,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
 {
        unsigned int verdict = NF_DROP;
-        if (IP_VS_FWD_METHOD(cp) != 0) {
+        if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
-                pr_err("shouldn't reach here, because the box is on the "
+                goto ignore_cp;
-                       "half connection in the tun/dr module.\n");
-        }
        /* Ensure the checksum is correct */
        if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) {
@@ -882,6 +880,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
                ip_vs_notrack(skb);
        else
                ip_vs_update_conntrack(skb, cp, 0);
+ignore_cp:
        verdict = NF_ACCEPT;
 out:
@@ -1242,8 +1242,11 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in
         */
        cp = pp->conn_out_get(ipvs, af, skb, &iph);
-        if (likely(cp))
+        if (likely(cp)) {
+                if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
+                        goto ignore_cp;
                return handle_response(af, skb, pd, cp, &iph, hooknum);
+        }
        if (sysctl_nat_icmp_send(ipvs) &&
            (pp->protocol == IPPROTO_TCP ||
             pp->protocol == IPPROTO_UDP ||
@@ -1285,9 +1288,15 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in
                        }
                }
        }
+out:
        IP_VS_DBG_PKT(12, af, pp, skb, iph.off,
                      "ip_vs_out: packet continues traversal as normal");
        return NF_ACCEPT;
+ignore_cp:
+        __ip_vs_conn_put(cp);
+        goto out;
 }
 /*
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index 1a9545965c0d..531ca55f1af6 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -53,7 +53,11 @@ nf_ct_ext_create(struct nf_ct_ext **ext, enum nf_ct_ext_id id,
        rcu_read_lock();
        t = rcu_dereference(nf_ct_ext_types[id]);
-        BUG_ON(t == NULL);
+        if (!t) {
+                rcu_read_unlock();
+                return NULL;
+        }
        off = ALIGN(sizeof(struct nf_ct_ext), t->align);
        len = off + t->len + var_alloc_len;
        alloc_size = t->alloc_size + var_alloc_len;
@@ -88,7 +92,10 @@ void *__nf_ct_ext_add_length(struct nf_conn *ct, enum nf_ct_ext_id id,
        rcu_read_lock();
        t = rcu_dereference(nf_ct_ext_types[id]);
-        BUG_ON(t == NULL);
+        if (!t) {
+                rcu_read_unlock();
+                return NULL;
+        }
        newoff = ALIGN(old->len, t->align);
        newlen = newoff + t->len + var_alloc_len;
@@ -186,6 +193,6 @@ void nf_ct_extend_unregister(struct nf_ct_ext_type *type)
        RCU_INIT_POINTER(nf_ct_ext_types[type->id], NULL);
        update_alloc_size(type);
        mutex_unlock(&nf_ct_ext_type_mutex);
-        rcu_barrier(); /* Wait for completion of call_rcu()'s */
+        synchronize_rcu();
 }
 EXPORT_SYMBOL_GPL(nf_ct_extend_unregister);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 9f5272968abb..e565b2becb14 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -45,6 +45,8 @@
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_timestamp.h>
 #include <net/netfilter/nf_conntrack_labels.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_synproxy.h>
 #ifdef CONFIG_NF_NAT_NEEDED
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_l4proto.h>
@@ -1798,6 +1800,8 @@ ctnetlink_create_conntrack(struct net *net,
        nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
        nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);
        nf_ct_labels_ext_add(ct);
+        nfct_seqadj_ext_add(ct);
+        nfct_synproxy_ext_add(ct);
        /* we must add conntrack extensions before confirmation. */
        ct->status |= IPS_CONFIRMED;
diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index 0975c993a94e..f11aa28b96ce 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -49,6 +49,7 @@
 #include <linux/notifier.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
+#include <net/inet_sock.h>
 struct idletimer_tg_attr {
        struct attribute attr;
@@ -355,7 +356,7 @@ static void reset_timer(const struct idletimer_tg_info *info,
                /* Stores the uid resposible for waking up the radio */
                if (skb && (skb->sk)) {
                        timer->uid = from_kuid_munged(current_user_ns(),
-                                                sock_i_uid(skb->sk));
+                                        sock_i_uid(skb_to_full_sk(skb)));
                }
                /* checks if there is a pending inactive notification*/
@@ -456,6 +457,7 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param *par)
                del_timer_sync(&info->timer->timer);
                sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr);
                unregister_pm_notifier(&info->timer->pm_nb);
+                cancel_work_sync(&info->timer->work);
                kfree(info->timer->attr.attr.name);
                kfree(info->timer);
        } else {
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index b7c43def0dc6..00f798b20b20 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -104,7 +104,7 @@ tcpmss_mangle_packet(struct sk_buff *skb,
        tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
        tcp_hdrlen = tcph->doff * 4;
-        if (len < tcp_hdrlen)
+        if (len < tcp_hdrlen || tcp_hdrlen < sizeof(struct tcphdr))
                return -1;
        if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
@@ -156,6 +156,10 @@ tcpmss_mangle_packet(struct sk_buff *skb,
        if (len > tcp_hdrlen)
                return 0;
+        /* tcph->doff has 4 bits, do not wrap it to 0 */
+        if (tcp_hdrlen >= 15 * 4)
+                return 0;
        /*
         * MSS Option not found ?! add it..
         */
diff --git a/net/netfilter/xt_qtaguid.c b/net/netfilter/xt_qtaguid.c
index 3bf0c59dab2f..0f5628a59917 100644
--- a/net/netfilter/xt_qtaguid.c
+++ b/net/netfilter/xt_qtaguid.c
@@ -1814,8 +1814,11 @@ ret_res:
 }
 #ifdef DDEBUG
-/* This function is not in xt_qtaguid_print.c because of locks visibility */
+/*
-static void prdebug_full_state(int indent_level, const char *fmt, ...)
+ * This function is not in xt_qtaguid_print.c because of locks visibility.
+ * The lock of sock_tag_list must be aquired before calling this function
+ */
+static void prdebug_full_state_locked(int indent_level, const char *fmt, ...)
 {
        va_list args;
        char *fmt_buff;
@@ -1836,16 +1839,12 @@ static void prdebug_full_state(int indent_level, const char *fmt, ...)
        kfree(buff);
        va_end(args);
-        spin_lock_bh(&sock_tag_list_lock);
        prdebug_sock_tag_tree(indent_level, &sock_tag_tree);
-        spin_unlock_bh(&sock_tag_list_lock);
-        spin_lock_bh(&sock_tag_list_lock);
        spin_lock_bh(&uid_tag_data_tree_lock);
        prdebug_uid_tag_data_tree(indent_level, &uid_tag_data_tree);
        prdebug_proc_qtu_data_tree(indent_level, &proc_qtu_data_tree);
        spin_unlock_bh(&uid_tag_data_tree_lock);
-        spin_unlock_bh(&sock_tag_list_lock);
        spin_lock_bh(&iface_stat_list_lock);
        prdebug_iface_stat_list(indent_level, &iface_stat_list);
@@ -1854,7 +1853,7 @@ static void prdebug_full_state(int indent_level, const char *fmt, ...)
        pr_debug("qtaguid: %s(): }\n", __func__);
 }
 #else
-static void prdebug_full_state(int indent_level, const char *fmt, ...) {}
+static void prdebug_full_state_locked(int indent_level, const char *fmt, ...) {}
 #endif
 struct proc_ctrl_print_info {
@@ -1977,8 +1976,11 @@ static int qtaguid_ctrl_proc_show(struct seq_file *m, void *v)
                           (u64)atomic64_read(&qtu_events.match_no_sk),
                           (u64)atomic64_read(&qtu_events.match_no_sk_file));
-                /* Count the following as part of the last item_index */
+                /* Count the following as part of the last item_index. No need
-                prdebug_full_state(0, "proc ctrl");
+                 * to lock the sock_tag_list here since it is already locked when
+                 * starting the seq_file operation
+                 */
+                prdebug_full_state_locked(0, "proc ctrl");
        }
        return 0;
@@ -2887,8 +2889,10 @@ static int qtudev_release(struct inode *inode, struct file *file)
        sock_tag_tree_erase(&st_to_free_tree);
-        prdebug_full_state(0, "%s(): pid=%u tgid=%u", __func__,
+        spin_lock_bh(&sock_tag_list_lock);
+        prdebug_full_state_locked(0, "%s(): pid=%u tgid=%u", __func__,
                           current->pid, current->tgid);
+        spin_unlock_bh(&sock_tag_list_lock);
        return 0;
 }
diff --git a/net/netlink/Kconfig b/net/netlink/Kconfig
index 2c5e95e9bfbd..5d6e8c05b3d4 100644
--- a/net/netlink/Kconfig
+++ b/net/netlink/Kconfig
@@ -2,15 +2,6 @@
 # Netlink Sockets
 #
-config NETLINK_MMAP
-        bool "NETLINK: mmaped IO"
-        ---help---
-          This option enables support for memory mapped netlink IO. This
-          reduces overhead by avoiding copying data between kernel- and
-          userspace.
-          If unsure, say N.
 config NETLINK_DIAG
        tristate "NETLINK: socket monitoring interface"
        default n
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 360700a2f46c..acfb16fdcd55 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -225,7 +225,7 @@ static int __netlink_deliver_tap_skb(struct sk_buff *skb,
        dev_hold(dev);
-        if (netlink_skb_is_mmaped(skb) || is_vmalloc_addr(skb->head))
+        if (is_vmalloc_addr(skb->head))
                nskb = netlink_to_full_skb(skb, GFP_ATOMIC);
        else
                nskb = skb_clone(skb, GFP_ATOMIC);
@@ -300,610 +300,8 @@ static void netlink_rcv_wake(struct sock *sk)
                wake_up_interruptible(&nlk->wait);
 }
-#ifdef CONFIG_NETLINK_MMAP
-static bool netlink_rx_is_mmaped(struct sock *sk)
-{
-        return nlk_sk(sk)->rx_ring.pg_vec != NULL;
-}
-static bool netlink_tx_is_mmaped(struct sock *sk)
-{
-        return nlk_sk(sk)->tx_ring.pg_vec != NULL;
-}
-static __pure struct page *pgvec_to_page(const void *addr)
-{
-        if (is_vmalloc_addr(addr))
-                return vmalloc_to_page(addr);
-        else
-                return virt_to_page(addr);
-}
-static void free_pg_vec(void **pg_vec, unsigned int order, unsigned int len)
-{
-        unsigned int i;
-        for (i = 0; i < len; i++) {
-                if (pg_vec[i] != NULL) {
-                        if (is_vmalloc_addr(pg_vec[i]))
-                                vfree(pg_vec[i]);
-                        else
-                                free_pages((unsigned long)pg_vec[i], order);
-                }
-        }
-        kfree(pg_vec);
-}
-static void *alloc_one_pg_vec_page(unsigned long order)
-{
-        void *buffer;
-        gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP | __GFP_ZERO |
-                          __GFP_NOWARN | __GFP_NORETRY;
-        buffer = (void *)__get_free_pages(gfp_flags, order);
-        if (buffer != NULL)
-                return buffer;
-        buffer = vzalloc((1 << order) * PAGE_SIZE);
-        if (buffer != NULL)
-                return buffer;
-        gfp_flags &= ~__GFP_NORETRY;
-        return (void *)__get_free_pages(gfp_flags, order);
-}
-static void **alloc_pg_vec(struct netlink_sock *nlk,
-                           struct nl_mmap_req *req, unsigned int order)
-{
-        unsigned int block_nr = req->nm_block_nr;
-        unsigned int i;
-        void **pg_vec;
-        pg_vec = kcalloc(block_nr, sizeof(void *), GFP_KERNEL);
-        if (pg_vec == NULL)
-                return NULL;
-        for (i = 0; i < block_nr; i++) {
-                pg_vec[i] = alloc_one_pg_vec_page(order);
-                if (pg_vec[i] == NULL)
-                        goto err1;
-        }
-        return pg_vec;
-err1:
-        free_pg_vec(pg_vec, order, block_nr);
-        return NULL;
-}
-static void
-__netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, bool tx_ring, void **pg_vec,
-                   unsigned int order)
-{
-        struct netlink_sock *nlk = nlk_sk(sk);
-        struct sk_buff_head *queue;
-        struct netlink_ring *ring;
-        queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
-        ring  = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
-        spin_lock_bh(&queue->lock);
-        ring->frame_max         = req->nm_frame_nr - 1;
-        ring->head              = 0;
-        ring->frame_size        = req->nm_frame_size;
-        ring->pg_vec_pages      = req->nm_block_size / PAGE_SIZE;
-        swap(ring->pg_vec_len, req->nm_block_nr);
-        swap(ring->pg_vec_order, order);
-        swap(ring->pg_vec, pg_vec);
-        __skb_queue_purge(queue);
-        spin_unlock_bh(&queue->lock);
-        WARN_ON(atomic_read(&nlk->mapped));
-        if (pg_vec)
-                free_pg_vec(pg_vec, order, req->nm_block_nr);
-}
-static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req,
-                            bool tx_ring)
-{
-        struct netlink_sock *nlk = nlk_sk(sk);
-        struct netlink_ring *ring;
-        void **pg_vec = NULL;
-        unsigned int order = 0;
-        ring  = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
-        if (atomic_read(&nlk->mapped))
-                return -EBUSY;
-        if (atomic_read(&ring->pending))
-                return -EBUSY;
-        if (req->nm_block_nr) {
-                if (ring->pg_vec != NULL)
-                        return -EBUSY;
-                if ((int)req->nm_block_size <= 0)
-                        return -EINVAL;
-                if (!PAGE_ALIGNED(req->nm_block_size))
-                        return -EINVAL;
-                if (req->nm_frame_size < NL_MMAP_HDRLEN)
-                        return -EINVAL;
-                if (!IS_ALIGNED(req->nm_frame_size, NL_MMAP_MSG_ALIGNMENT))
-                        return -EINVAL;
-                ring->frames_per_block = req->nm_block_size /
-                                         req->nm_frame_size;
-                if (ring->frames_per_block == 0)
-                        return -EINVAL;
-                if (ring->frames_per_block * req->nm_block_nr !=
-                    req->nm_frame_nr)
-                        return -EINVAL;
-                order = get_order(req->nm_block_size);
-                pg_vec = alloc_pg_vec(nlk, req, order);
-                if (pg_vec == NULL)
-                        return -ENOMEM;
-        } else {
-                if (req->nm_frame_nr)
-                        return -EINVAL;
-        }
-        mutex_lock(&nlk->pg_vec_lock);
-        if (atomic_read(&nlk->mapped) == 0) {
-                __netlink_set_ring(sk, req, tx_ring, pg_vec, order);
-                mutex_unlock(&nlk->pg_vec_lock);
-                return 0;
-        }
-        mutex_unlock(&nlk->pg_vec_lock);
-        if (pg_vec)
-                free_pg_vec(pg_vec, order, req->nm_block_nr);
-        return -EBUSY;
-}
-static void netlink_mm_open(struct vm_area_struct *vma)
-{
-        struct file *file = vma->vm_file;
-        struct socket *sock = file->private_data;
-        struct sock *sk = sock->sk;
-        if (sk)
-                atomic_inc(&nlk_sk(sk)->mapped);
-}
-static void netlink_mm_close(struct vm_area_struct *vma)
-{
-        struct file *file = vma->vm_file;
-        struct socket *sock = file->private_data;
-        struct sock *sk = sock->sk;
-        if (sk)
-                atomic_dec(&nlk_sk(sk)->mapped);
-}
-static const struct vm_operations_struct netlink_mmap_ops = {
-        .open   = netlink_mm_open,
-        .close  = netlink_mm_close,
-};
-static int netlink_mmap(struct file *file, struct socket *sock,
-                        struct vm_area_struct *vma)
-{
-        struct sock *sk = sock->sk;
-        struct netlink_sock *nlk = nlk_sk(sk);
-        struct netlink_ring *ring;
-        unsigned long start, size, expected;
-        unsigned int i;
-        int err = -EINVAL;
-        if (vma->vm_pgoff)
-                return -EINVAL;
-        mutex_lock(&nlk->pg_vec_lock);
-        expected = 0;
-        for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) {
-                if (ring->pg_vec == NULL)
-                        continue;
-                expected += ring->pg_vec_len * ring->pg_vec_pages * PAGE_SIZE;
-        }
-        if (expected == 0)
-                goto out;
-        size = vma->vm_end - vma->vm_start;
-        if (size != expected)
-                goto out;
-        start = vma->vm_start;
-        for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) {
-                if (ring->pg_vec == NULL)
-                        continue;
-                for (i = 0; i < ring->pg_vec_len; i++) {
-                        struct page *page;
-                        void *kaddr = ring->pg_vec[i];
-                        unsigned int pg_num;
-                        for (pg_num = 0; pg_num < ring->pg_vec_pages; pg_num++) {
-                                page = pgvec_to_page(kaddr);
-                                err = vm_insert_page(vma, start, page);
-                                if (err < 0)
-                                        goto out;
-                                start += PAGE_SIZE;
-                                kaddr += PAGE_SIZE;
-                        }
-                }
-        }
-        atomic_inc(&nlk->mapped);
-        vma->vm_ops = &netlink_mmap_ops;
-        err = 0;
-out:
-        mutex_unlock(&nlk->pg_vec_lock);
-        return err;
-}
-static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len)
-{
-#if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1
-        struct page *p_start, *p_end;
-        /* First page is flushed through netlink_{get,set}_status */
-        p_start = pgvec_to_page(hdr + PAGE_SIZE);
-        p_end   = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1);
-        while (p_start <= p_end) {
-                flush_dcache_page(p_start);
-                p_start++;
-        }
-#endif
-}
-static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr)
-{
-        smp_rmb();
-        flush_dcache_page(pgvec_to_page(hdr));
-        return hdr->nm_status;
-}
-static void netlink_set_status(struct nl_mmap_hdr *hdr,
-                               enum nl_mmap_status status)
-{
-        smp_mb();
-        hdr->nm_status = status;
-        flush_dcache_page(pgvec_to_page(hdr));
-}
-static struct nl_mmap_hdr *
-__netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos)
-{
-        unsigned int pg_vec_pos, frame_off;
-        pg_vec_pos = pos / ring->frames_per_block;
-        frame_off  = pos % ring->frames_per_block;
-        return ring->pg_vec[pg_vec_pos] + (frame_off * ring->frame_size);
-}
-static struct nl_mmap_hdr *
-netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos,
-                     enum nl_mmap_status status)
-{
-        struct nl_mmap_hdr *hdr;
-        hdr = __netlink_lookup_frame(ring, pos);
-        if (netlink_get_status(hdr) != status)
-                return NULL;
-        return hdr;
-}
-static struct nl_mmap_hdr *
-netlink_current_frame(const struct netlink_ring *ring,
-                      enum nl_mmap_status status)
-{
-        return netlink_lookup_frame(ring, ring->head, status);
-}
-static void netlink_increment_head(struct netlink_ring *ring)
-{
-        ring->head = ring->head != ring->frame_max ? ring->head + 1 : 0;
-}
-static void netlink_forward_ring(struct netlink_ring *ring)
-{
-        unsigned int head = ring->head;
-        const struct nl_mmap_hdr *hdr;
-        do {
-                hdr = __netlink_lookup_frame(ring, ring->head);
-                if (hdr->nm_status == NL_MMAP_STATUS_UNUSED)
-                        break;
-                if (hdr->nm_status != NL_MMAP_STATUS_SKIP)
-                        break;
-                netlink_increment_head(ring);
-        } while (ring->head != head);
-}
-static bool netlink_has_valid_frame(struct netlink_ring *ring)
-{
-        unsigned int head = ring->head, pos = head;
-        const struct nl_mmap_hdr *hdr;
-        do {
-                hdr = __netlink_lookup_frame(ring, pos);
-                if (hdr->nm_status == NL_MMAP_STATUS_VALID)
-                        return true;
-                pos = pos != 0 ? pos - 1 : ring->frame_max;
-        } while (pos != head);
-        return false;
-}
-static bool netlink_dump_space(struct netlink_sock *nlk)
-{
-        struct netlink_ring *ring = &nlk->rx_ring;
-        struct nl_mmap_hdr *hdr;
-        unsigned int n;
-        hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
-        if (hdr == NULL)
-                return false;
-        n = ring->head + ring->frame_max / 2;
-        if (n > ring->frame_max)
-                n -= ring->frame_max;
-        hdr = __netlink_lookup_frame(ring, n);
-        return hdr->nm_status == NL_MMAP_STATUS_UNUSED;
-}
-static unsigned int netlink_poll(struct file *file, struct socket *sock,
-                                 poll_table *wait)
-{
-        struct sock *sk = sock->sk;
-        struct netlink_sock *nlk = nlk_sk(sk);
-        unsigned int mask;
-        int err;
-        if (nlk->rx_ring.pg_vec != NULL) {
-                /* Memory mapped sockets don't call recvmsg(), so flow control
-                 * for dumps is performed here. A dump is allowed to continue
-                 * if at least half the ring is unused.
-                 */
-                while (nlk->cb_running && netlink_dump_space(nlk)) {
-                        err = netlink_dump(sk);
-                        if (err < 0) {
-                                sk->sk_err = -err;
-                                sk->sk_error_report(sk);
-                                break;
-                        }
-                }
-                netlink_rcv_wake(sk);
-        }
-        mask = datagram_poll(file, sock, wait);
-        /* We could already have received frames in the normal receive
-         * queue, that will show up as NL_MMAP_STATUS_COPY in the ring,
-         * so if mask contains pollin/etc already, there's no point
-         * walking the ring.
-         */
-        if ((mask & (POLLIN | POLLRDNORM)) != (POLLIN | POLLRDNORM)) {
-                spin_lock_bh(&sk->sk_receive_queue.lock);
-                if (nlk->rx_ring.pg_vec) {
-                        if (netlink_has_valid_frame(&nlk->rx_ring))
-                                mask |= POLLIN | POLLRDNORM;
-                }
-                spin_unlock_bh(&sk->sk_receive_queue.lock);
-        }
-        spin_lock_bh(&sk->sk_write_queue.lock);
-        if (nlk->tx_ring.pg_vec) {
-                if (netlink_current_frame(&nlk->tx_ring, NL_MMAP_STATUS_UNUSED))
-                        mask |= POLLOUT | POLLWRNORM;
-        }
-        spin_unlock_bh(&sk->sk_write_queue.lock);
-        return mask;
-}
-static struct nl_mmap_hdr *netlink_mmap_hdr(struct sk_buff *skb)
-{
-        return (struct nl_mmap_hdr *)(skb->head - NL_MMAP_HDRLEN);
-}
-static void netlink_ring_setup_skb(struct sk_buff *skb, struct sock *sk,
-                                   struct netlink_ring *ring,
-                                   struct nl_mmap_hdr *hdr)
-{
-        unsigned int size;
-        void *data;
-        size = ring->frame_size - NL_MMAP_HDRLEN;
-        data = (void *)hdr + NL_MMAP_HDRLEN;
-        skb->head       = data;
-        skb->data       = data;
-        skb_reset_tail_pointer(skb);
-        skb->end        = skb->tail + size;
-        skb->len        = 0;
-        skb->destructor = netlink_skb_destructor;
-        NETLINK_CB(skb).flags |= NETLINK_SKB_MMAPED;
-        NETLINK_CB(skb).sk = sk;
-}
-static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
-                                u32 dst_portid, u32 dst_group,
-                                struct scm_cookie *scm)
-{
-        struct netlink_sock *nlk = nlk_sk(sk);
-        struct netlink_ring *ring;
-        struct nl_mmap_hdr *hdr;
-        struct sk_buff *skb;
-        unsigned int maxlen;
-        int err = 0, len = 0;
-        mutex_lock(&nlk->pg_vec_lock);
-        ring   = &nlk->tx_ring;
-        maxlen = ring->frame_size - NL_MMAP_HDRLEN;
-        do {
-                unsigned int nm_len;
-                hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID);
-                if (hdr == NULL) {
-                        if (!(msg->msg_flags & MSG_DONTWAIT) &&
-                            atomic_read(&nlk->tx_ring.pending))
-                                schedule();
-                        continue;
-                }
-                nm_len = ACCESS_ONCE(hdr->nm_len);
-                if (nm_len > maxlen) {
-                        err = -EINVAL;
-                        goto out;
-                }
-                netlink_frame_flush_dcache(hdr, nm_len);
-                skb = alloc_skb(nm_len, GFP_KERNEL);
-                if (skb == NULL) {
-                        err = -ENOBUFS;
-                        goto out;
-                }
-                __skb_put(skb, nm_len);
-                memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len);
-                netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
-                netlink_increment_head(ring);
-                NETLINK_CB(skb).portid    = nlk->portid;
-                NETLINK_CB(skb).dst_group = dst_group;
-                NETLINK_CB(skb).creds     = scm->creds;
-                err = security_netlink_send(sk, skb);
-                if (err) {
-                        kfree_skb(skb);
-                        goto out;
-                }
-                if (unlikely(dst_group)) {
-                        atomic_inc(&skb->users);
-                        netlink_broadcast(sk, skb, dst_portid, dst_group,
-                                          GFP_KERNEL);
-                }
-                err = netlink_unicast(sk, skb, dst_portid,
-                                      msg->msg_flags & MSG_DONTWAIT);
-                if (err < 0)
-                        goto out;
-                len += err;
-        } while (hdr != NULL ||
-                 (!(msg->msg_flags & MSG_DONTWAIT) &&
-                  atomic_read(&nlk->tx_ring.pending)));
-        if (len > 0)
-                err = len;
-out:
-        mutex_unlock(&nlk->pg_vec_lock);
-        return err;
-}
-static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb)
-{
-        struct nl_mmap_hdr *hdr;
-        hdr = netlink_mmap_hdr(skb);
-        hdr->nm_len     = skb->len;
-        hdr->nm_group   = NETLINK_CB(skb).dst_group;
-        hdr->nm_pid     = NETLINK_CB(skb).creds.pid;
-        hdr->nm_uid     = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
-        hdr->nm_gid     = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
-        netlink_frame_flush_dcache(hdr, hdr->nm_len);
-        netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
-        NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED;
-        kfree_skb(skb);
-}
-static void netlink_ring_set_copied(struct sock *sk, struct sk_buff *skb)
-{
-        struct netlink_sock *nlk = nlk_sk(sk);
-        struct netlink_ring *ring = &nlk->rx_ring;
-        struct nl_mmap_hdr *hdr;
-        spin_lock_bh(&sk->sk_receive_queue.lock);
-        hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
-        if (hdr == NULL) {
-                spin_unlock_bh(&sk->sk_receive_queue.lock);
-                kfree_skb(skb);
-                netlink_overrun(sk);
-                return;
-        }
-        netlink_increment_head(ring);
-        __skb_queue_tail(&sk->sk_receive_queue, skb);
-        spin_unlock_bh(&sk->sk_receive_queue.lock);
-        hdr->nm_len     = skb->len;
-        hdr->nm_group   = NETLINK_CB(skb).dst_group;
-        hdr->nm_pid     = NETLINK_CB(skb).creds.pid;
-        hdr->nm_uid     = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
-        hdr->nm_gid     = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
-        netlink_set_status(hdr, NL_MMAP_STATUS_COPY);
-}
-#else /* CONFIG_NETLINK_MMAP */
-#define netlink_rx_is_mmaped(sk)        false
-#define netlink_tx_is_mmaped(sk)        false
-#define netlink_mmap                    sock_no_mmap
-#define netlink_poll                    datagram_poll
-#define netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, scm)       0
-#endif /* CONFIG_NETLINK_MMAP */
 static void netlink_skb_destructor(struct sk_buff *skb)
 {
-#ifdef CONFIG_NETLINK_MMAP
-        struct nl_mmap_hdr *hdr;
-        struct netlink_ring *ring;
-        struct sock *sk;
-        /* If a packet from the kernel to userspace was freed because of an
-         * error without being delivered to userspace, the kernel must reset
-         * the status. In the direction userspace to kernel, the status is
-         * always reset here after the packet was processed and freed.
-         */
-        if (netlink_skb_is_mmaped(skb)) {
-                hdr = netlink_mmap_hdr(skb);
-                sk = NETLINK_CB(skb).sk;
-                if (NETLINK_CB(skb).flags & NETLINK_SKB_TX) {
-                        netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
-                        ring = &nlk_sk(sk)->tx_ring;
-                } else {
-                        if (!(NETLINK_CB(skb).flags & NETLINK_SKB_DELIVERED)) {
-                                hdr->nm_len = 0;
-                                netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
-                        }
-                        ring = &nlk_sk(sk)->rx_ring;
-                }
-                WARN_ON(atomic_read(&ring->pending) == 0);
-                atomic_dec(&ring->pending);
-                sock_put(sk);
-                skb->head = NULL;
-        }
-#endif
        if (is_vmalloc_addr(skb->head)) {
                if (!skb->cloned ||
                    !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
@@ -936,18 +334,6 @@ static void netlink_sock_destruct(struct sock *sk)
        }
        skb_queue_purge(&sk->sk_receive_queue);
-#ifdef CONFIG_NETLINK_MMAP
-        if (1) {
-                struct nl_mmap_req req;
-                memset(&req, 0, sizeof(req));
-                if (nlk->rx_ring.pg_vec)
-                        __netlink_set_ring(sk, &req, false, NULL, 0);
-                memset(&req, 0, sizeof(req));
-                if (nlk->tx_ring.pg_vec)
-                        __netlink_set_ring(sk, &req, true, NULL, 0);
-        }
-#endif /* CONFIG_NETLINK_MMAP */
        if (!sock_flag(sk, SOCK_DEAD)) {
                printk(KERN_ERR "Freeing alive netlink socket %p\n", sk);
@@ -1201,9 +587,6 @@ static int __netlink_create(struct net *net, struct socket *sock,
                mutex_init(nlk->cb_mutex);
        }
        init_waitqueue_head(&nlk->wait);
-#ifdef CONFIG_NETLINK_MMAP
-        mutex_init(&nlk->pg_vec_lock);
-#endif
        sk->sk_destruct = netlink_sock_destruct;
        sk->sk_protocol = protocol;
@@ -1745,8 +1128,7 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
        nlk = nlk_sk(sk);
        if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
-             test_bit(NETLINK_S_CONGESTED, &nlk->state)) &&
+             test_bit(NETLINK_S_CONGESTED, &nlk->state))) {
-            !netlink_skb_is_mmaped(skb)) {
                DECLARE_WAITQUEUE(wait, current);
                if (!*timeo) {
                        if (!ssk || netlink_is_kernel(ssk))
@@ -1784,14 +1166,7 @@ static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
        netlink_deliver_tap(skb);
-#ifdef CONFIG_NETLINK_MMAP
+        skb_queue_tail(&sk->sk_receive_queue, skb);
-        if (netlink_skb_is_mmaped(skb))
-                netlink_queue_mmaped_skb(sk, skb);
-        else if (netlink_rx_is_mmaped(sk))
-                netlink_ring_set_copied(sk, skb);
-        else
-#endif /* CONFIG_NETLINK_MMAP */
-                skb_queue_tail(&sk->sk_receive_queue, skb);
        sk->sk_data_ready(sk);
        return len;
 }
@@ -1815,9 +1190,6 @@ static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation)
        int delta;
        WARN_ON(skb->sk != NULL);
-        if (netlink_skb_is_mmaped(skb))
-                return skb;
        delta = skb->end - skb->tail;
        if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize)
                return skb;
@@ -1897,71 +1269,6 @@ struct sk_buff *__netlink_alloc_skb(struct sock *ssk, unsigned int size,
                                    unsigned int ldiff, u32 dst_portid,
                                    gfp_t gfp_mask)
 {
-#ifdef CONFIG_NETLINK_MMAP
-        unsigned int maxlen, linear_size;
-        struct sock *sk = NULL;
-        struct sk_buff *skb;
-        struct netlink_ring *ring;
-        struct nl_mmap_hdr *hdr;
-        sk = netlink_getsockbyportid(ssk, dst_portid);
-        if (IS_ERR(sk))
-                goto out;
-        ring = &nlk_sk(sk)->rx_ring;
-        /* fast-path without atomic ops for common case: non-mmaped receiver */
-        if (ring->pg_vec == NULL)
-                goto out_put;
-        /* We need to account the full linear size needed as a ring
-         * slot cannot have non-linear parts.
-         */
-        linear_size = size + ldiff;
-        if (ring->frame_size - NL_MMAP_HDRLEN < linear_size)
-                goto out_put;
-        skb = alloc_skb_head(gfp_mask);
-        if (skb == NULL)
-                goto err1;
-        spin_lock_bh(&sk->sk_receive_queue.lock);
-        /* check again under lock */
-        if (ring->pg_vec == NULL)
-                goto out_free;
-        /* check again under lock */
-        maxlen = ring->frame_size - NL_MMAP_HDRLEN;
-        if (maxlen < linear_size)
-                goto out_free;
-        netlink_forward_ring(ring);
-        hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
-        if (hdr == NULL)
-                goto err2;
-        netlink_ring_setup_skb(skb, sk, ring, hdr);
-        netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
-        atomic_inc(&ring->pending);
-        netlink_increment_head(ring);
-        spin_unlock_bh(&sk->sk_receive_queue.lock);
-        return skb;
-err2:
-        kfree_skb(skb);
-        spin_unlock_bh(&sk->sk_receive_queue.lock);
-        netlink_overrun(sk);
-err1:
-        sock_put(sk);
-        return NULL;
-out_free:
-        kfree_skb(skb);
-        spin_unlock_bh(&sk->sk_receive_queue.lock);
-out_put:
-        sock_put(sk);
-out:
-#endif
        return alloc_skb(size, gfp_mask);
 }
 EXPORT_SYMBOL_GPL(__netlink_alloc_skb);
@@ -2242,8 +1549,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
        if (level != SOL_NETLINK)
                return -ENOPROTOOPT;
-        if (optname != NETLINK_RX_RING && optname != NETLINK_TX_RING &&
+        if (optlen >= sizeof(int) &&
-            optlen >= sizeof(int) &&
            get_user(val, (unsigned int __user *)optval))
                return -EFAULT;
@@ -2296,25 +1602,6 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
                }
                err = 0;
                break;
-#ifdef CONFIG_NETLINK_MMAP
-        case NETLINK_RX_RING:
-        case NETLINK_TX_RING: {
-                struct nl_mmap_req req;
-                /* Rings might consume more memory than queue limits, require
-                 * CAP_NET_ADMIN.
-                 */
-                if (!capable(CAP_NET_ADMIN))
-                        return -EPERM;
-                if (optlen < sizeof(req))
-                        return -EINVAL;
-                if (copy_from_user(&req, optval, sizeof(req)))
-                        return -EFAULT;
-                err = netlink_set_ring(sk, &req,
-                                       optname == NETLINK_TX_RING);
-                break;
-        }
-#endif /* CONFIG_NETLINK_MMAP */
        case NETLINK_LISTEN_ALL_NSID:
                if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_BROADCAST))
                        return -EPERM;
@@ -2484,18 +1771,6 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
                smp_rmb();
        }
-        /* It's a really convoluted way for userland to ask for mmaped
-         * sendmsg(), but that's what we've got...
-         */
-        if (netlink_tx_is_mmaped(sk) &&
-            iter_is_iovec(&msg->msg_iter) &&
-            msg->msg_iter.nr_segs == 1 &&
-            msg->msg_iter.iov->iov_base == NULL) {
-                err = netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group,
-                                           &scm);
-                goto out;
-        }
        err = -EMSGSIZE;
        if (len > sk->sk_sndbuf - 32)
                goto out;
@@ -2812,8 +2087,7 @@ static int netlink_dump(struct sock *sk)
                goto errout_skb;
        }
-        if (!netlink_rx_is_mmaped(sk) &&
+        if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
-            atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
                goto errout_skb;
        /* NLMSG_GOODSIZE is small to avoid high order allocations being
@@ -2833,7 +2107,7 @@ static int netlink_dump(struct sock *sk)
        if (!skb) {
                alloc_size = alloc_min_size;
                skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
-                                        (GFP_KERNEL & ~__GFP_DIRECT_RECLAIM));
+                                        GFP_KERNEL);
        }
        if (!skb)
                goto errout_skb;
@@ -2902,16 +2176,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
        struct netlink_sock *nlk;
        int ret;
-        /* Memory mapped dump requests need to be copied to avoid looping
+        atomic_inc(&skb->users);
-         * on the pending state in netlink_mmap_sendmsg() while the CB hold
-         * a reference to the skb.
-         */
-        if (netlink_skb_is_mmaped(skb)) {
-                skb = skb_copy(skb, GFP_KERNEL);
-                if (skb == NULL)
-                        return -ENOBUFS;
-        } else
-                atomic_inc(&skb->users);
        sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid);
        if (sk == NULL) {
@@ -3255,7 +2520,7 @@ static const struct proto_ops netlink_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       sock_no_accept,
        .getname =      netlink_getname,
-        .poll =         netlink_poll,
+        .poll =         datagram_poll,
        .ioctl =        sock_no_ioctl,
        .listen =       sock_no_listen,
        .shutdown =     sock_no_shutdown,
@@ -3263,7 +2528,7 @@ static const struct proto_ops netlink_ops = {
        .getsockopt =   netlink_getsockopt,
        .sendmsg =      netlink_sendmsg,
        .recvmsg =      netlink_recvmsg,
-        .mmap =         netlink_mmap,
+        .mmap =         sock_no_mmap,
        .sendpage =     sock_no_sendpage,
 };
diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h
index df32cb92d9fc..ea4600aea6b0 100644
--- a/net/netlink/af_netlink.h
+++ b/net/netlink/af_netlink.h
@@ -45,12 +45,6 @@ struct netlink_sock {
        int                     (*netlink_bind)(struct net *net, int group);
        void                    (*netlink_unbind)(struct net *net, int group);
        struct module           *module;
-#ifdef CONFIG_NETLINK_MMAP
-        struct mutex            pg_vec_lock;
-        struct netlink_ring     rx_ring;
-        struct netlink_ring     tx_ring;
-        atomic_t                mapped;
-#endif /* CONFIG_NETLINK_MMAP */
        struct rhash_head       node;
        struct rcu_head         rcu;
@@ -62,15 +56,6 @@ static inline struct netlink_sock *nlk_sk(struct sock *sk)
        return container_of(sk, struct netlink_sock, sk);
 }
-static inline bool netlink_skb_is_mmaped(const struct sk_buff *skb)
-{
-#ifdef CONFIG_NETLINK_MMAP
-        return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED;
-#else
-        return false;
-#endif /* CONFIG_NETLINK_MMAP */
-}
 struct netlink_table {
        struct rhashtable       hash;
        struct hlist_head       mc_list;
diff --git a/net/netlink/diag.c b/net/netlink/diag.c
index 3ee63a3cff30..8dd836a8dd60 100644
--- a/net/netlink/diag.c
+++ b/net/netlink/diag.c
@@ -8,41 +8,6 @@
 #include "af_netlink.h"
-#ifdef CONFIG_NETLINK_MMAP
-static int sk_diag_put_ring(struct netlink_ring *ring, int nl_type,
-                            struct sk_buff *nlskb)
-{
-        struct netlink_diag_ring ndr;
-        ndr.ndr_block_size = ring->pg_vec_pages << PAGE_SHIFT;
-        ndr.ndr_block_nr   = ring->pg_vec_len;
-        ndr.ndr_frame_size = ring->frame_size;
-        ndr.ndr_frame_nr   = ring->frame_max + 1;
-        return nla_put(nlskb, nl_type, sizeof(ndr), &ndr);
-}
-static int sk_diag_put_rings_cfg(struct sock *sk, struct sk_buff *nlskb)
-{
-        struct netlink_sock *nlk = nlk_sk(sk);
-        int ret;
-        mutex_lock(&nlk->pg_vec_lock);
-        ret = sk_diag_put_ring(&nlk->rx_ring, NETLINK_DIAG_RX_RING, nlskb);
-        if (!ret)
-                ret = sk_diag_put_ring(&nlk->tx_ring, NETLINK_DIAG_TX_RING,
-                                       nlskb);
-        mutex_unlock(&nlk->pg_vec_lock);
-        return ret;
-}
-#else
-static int sk_diag_put_rings_cfg(struct sock *sk, struct sk_buff *nlskb)
-{
-        return 0;
-}
-#endif
 static int sk_diag_dump_groups(struct sock *sk, struct sk_buff *nlskb)
 {
        struct netlink_sock *nlk = nlk_sk(sk);
@@ -87,10 +52,6 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
            sock_diag_put_meminfo(sk, skb, NETLINK_DIAG_MEMINFO))
                goto out_nlmsg_trim;
-        if ((req->ndiag_show & NDIAG_SHOW_RING_CFG) &&
-            sk_diag_put_rings_cfg(sk, skb))
-                goto out_nlmsg_trim;
        nlmsg_end(skb, nlh);
        return 0;
diff --git a/net/nfc/core.c b/net/nfc/core.c
index 1fe3d3b362c0..c5a2c7e733b3 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -969,6 +969,8 @@ static void nfc_release(struct device *d)
                        kfree(se);
        }
+        ida_simple_remove(&nfc_index_ida, dev->idx);
        kfree(dev);
 }
@@ -1043,6 +1045,7 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
                                    int tx_headroom, int tx_tailroom)
 {
        struct nfc_dev *dev;
+        int rc;
        if (!ops->start_poll || !ops->stop_poll || !ops->activate_target ||
            !ops->deactivate_target || !ops->im_transceive)
@@ -1055,6 +1058,15 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
        if (!dev)
                return NULL;
+        rc = ida_simple_get(&nfc_index_ida, 0, 0, GFP_KERNEL);
+        if (rc < 0)
+                goto err_free_dev;
+        dev->idx = rc;
+        dev->dev.class = &nfc_class;
+        dev_set_name(&dev->dev, "nfc%d", dev->idx);
+        device_initialize(&dev->dev);
        dev->ops = ops;
        dev->supported_protocols = supported_protocols;
        dev->tx_headroom = tx_headroom;
@@ -1077,6 +1089,11 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
        }
        return dev;
+err_free_dev:
+        kfree(dev);
+        return ERR_PTR(rc);
 }
 EXPORT_SYMBOL(nfc_allocate_device);
@@ -1091,14 +1108,6 @@ int nfc_register_device(struct nfc_dev *dev)
        pr_debug("dev_name=%s\n", dev_name(&dev->dev));
-        dev->idx = ida_simple_get(&nfc_index_ida, 0, 0, GFP_KERNEL);
-        if (dev->idx < 0)
-                return dev->idx;
-        dev->dev.class = &nfc_class;
-        dev_set_name(&dev->dev, "nfc%d", dev->idx);
-        device_initialize(&dev->dev);
        mutex_lock(&nfc_devlist_mutex);
        nfc_devlist_generation++;
        rc = device_add(&dev->dev);
@@ -1136,12 +1145,10 @@ EXPORT_SYMBOL(nfc_register_device);
 */
 void nfc_unregister_device(struct nfc_dev *dev)
 {
-        int rc, id;
+        int rc;
        pr_debug("dev_name=%s\n", dev_name(&dev->dev));
-        id = dev->idx;
        if (dev->rfkill) {
                rfkill_unregister(dev->rfkill);
                rfkill_destroy(dev->rfkill);
@@ -1166,8 +1173,6 @@ void nfc_unregister_device(struct nfc_dev *dev)
        nfc_devlist_generation++;
        device_del(&dev->dev);
        mutex_unlock(&nfc_devlist_mutex);
-        ida_simple_remove(&nfc_index_ida, id);
 }
 EXPORT_SYMBOL(nfc_unregister_device);
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index ecf0a0196f18..9c222a106c7f 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -76,7 +76,8 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
        struct sockaddr_nfc_llcp llcp_addr;
        int len, ret = 0;
-        if (!addr || addr->sa_family != AF_NFC)
+        if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
+            addr->sa_family != AF_NFC)
                return -EINVAL;
        pr_debug("sk %p addr %p family %d\n", sk, addr, addr->sa_family);
@@ -150,7 +151,8 @@ static int llcp_raw_sock_bind(struct socket *sock, struct sockaddr *addr,
        struct sockaddr_nfc_llcp llcp_addr;
        int len, ret = 0;
-        if (!addr || addr->sa_family != AF_NFC)
+        if (!addr || alen < offsetofend(struct sockaddr, sa_family) ||
+            addr->sa_family != AF_NFC)
                return -EINVAL;
        pr_debug("sk %p addr %p family %d\n", sk, addr, addr->sa_family);
@@ -655,8 +657,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
        pr_debug("sock %p sk %p flags 0x%x\n", sock, sk, flags);
-        if (!addr || len < sizeof(struct sockaddr_nfc) ||
+        if (!addr || len < sizeof(*addr) || addr->sa_family != AF_NFC)
-            addr->sa_family != AF_NFC)
                return -EINVAL;
        if (addr->service_name_len == 0 && addr->dsap == 0)
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 10c99a578421..67583ad7f610 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -1084,8 +1084,7 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops,
        return ndev;
 free_nfc:
-        kfree(ndev->nfc_dev);
+        nfc_free_device(ndev->nfc_dev);
 free_nci:
        kfree(ndev);
        return NULL;
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index f58c1fba1026..12dfb457275d 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -873,7 +873,9 @@ static int nfc_genl_activate_target(struct sk_buff *skb, struct genl_info *info)
        u32 device_idx, target_idx, protocol;
        int rc;
-        if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
+        if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
+            !info->attrs[NFC_ATTR_TARGET_INDEX] ||
+            !info->attrs[NFC_ATTR_PROTOCOLS])
                return -EINVAL;
        device_idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index e004067ec24a..6a2507f24b0f 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -501,7 +501,7 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
        /* The conntrack module expects to be working at L3. */
        nh_ofs = skb_network_offset(skb);
-        skb_pull(skb, nh_ofs);
+        skb_pull_rcsum(skb, nh_ofs);
        if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
                err = handle_fragments(net, key, info->zone.id, skb);
@@ -527,6 +527,7 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
                                        &info->labels.mask);
 err:
        skb_push(skb, nh_ofs);
+        skb_postpush_rcsum(skb, skb->data, nh_ofs);
        if (err)
                kfree_skb(skb);
        return err;
@@ -576,8 +577,8 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
        nla_for_each_nested(a, attr, rem) {
                int type = nla_type(a);
-                int maxlen = ovs_ct_attr_lens[type].maxlen;
+                int maxlen;
-                int minlen = ovs_ct_attr_lens[type].minlen;
+                int minlen;
                if (type > OVS_CT_ATTR_MAX) {
                        OVS_NLERR(log,
@@ -585,6 +586,9 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
                                  type, OVS_CT_ATTR_MAX);
                        return -EINVAL;
                }
+                maxlen = ovs_ct_attr_lens[type].maxlen;
+                minlen = ovs_ct_attr_lens[type].minlen;
                if (nla_len(a) < minlen || nla_len(a) > maxlen) {
                        OVS_NLERR(log,
                                  "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index d1bd4a45ca2d..d26b28def310 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -588,7 +588,7 @@ static int ip_tun_from_nlattr(const struct nlattr *attr,
                        ipv4 = true;
                        break;
                case OVS_TUNNEL_KEY_ATTR_IPV6_SRC:
-                        SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.dst,
+                        SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.src,
                                        nla_get_in6_addr(a), is_mask);
                        ipv6 = true;
                        break;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f223d1c80ccf..148ec130d99d 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1497,6 +1497,8 @@ static void __fanout_link(struct sock *sk, struct packet_sock *po)
        f->arr[f->num_members] = sk;
        smp_wmb();
        f->num_members++;
+        if (f->num_members == 1)
+                dev_add_pack(&f->prot_hook);
        spin_unlock(&f->lock);
 }
@@ -1513,6 +1515,8 @@ static void __fanout_unlink(struct sock *sk, struct packet_sock *po)
        BUG_ON(i >= f->num_members);
        f->arr[i] = f->arr[f->num_members - 1];
        f->num_members--;
+        if (f->num_members == 0)
+                __dev_remove_pack(&f->prot_hook);
        spin_unlock(&f->lock);
 }
@@ -1623,6 +1627,7 @@ static void fanout_release_data(struct packet_fanout *f)
 static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
 {
+        struct packet_rollover *rollover = NULL;
        struct packet_sock *po = pkt_sk(sk);
        struct packet_fanout *f, *match;
        u8 type = type_flags & 0xff;
@@ -1645,23 +1650,28 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
                return -EINVAL;
        }
+        mutex_lock(&fanout_mutex);
+        err = -EINVAL;
        if (!po->running)
-                return -EINVAL;
+                goto out;
+        err = -EALREADY;
        if (po->fanout)
-                return -EALREADY;
+                goto out;
        if (type == PACKET_FANOUT_ROLLOVER ||
            (type_flags & PACKET_FANOUT_FLAG_ROLLOVER)) {
-                po->rollover = kzalloc(sizeof(*po->rollover), GFP_KERNEL);
+                err = -ENOMEM;
-                if (!po->rollover)
+                rollover = kzalloc(sizeof(*rollover), GFP_KERNEL);
-                        return -ENOMEM;
+                if (!rollover)
-                atomic_long_set(&po->rollover->num, 0);
+                        goto out;
-                atomic_long_set(&po->rollover->num_huge, 0);
+                atomic_long_set(&rollover->num, 0);
-                atomic_long_set(&po->rollover->num_failed, 0);
+                atomic_long_set(&rollover->num_huge, 0);
+                atomic_long_set(&rollover->num_failed, 0);
+                po->rollover = rollover;
        }
-        mutex_lock(&fanout_mutex);
        match = NULL;
        list_for_each_entry(f, &fanout_list, list) {
                if (f->id == id &&
@@ -1691,7 +1701,6 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
                match->prot_hook.func = packet_rcv_fanout;
                match->prot_hook.af_packet_priv = match;
                match->prot_hook.id_match = match_fanout_group;
-                dev_add_pack(&match->prot_hook);
                list_add(&match->list, &fanout_list);
        }
        err = -EINVAL;
@@ -1708,36 +1717,40 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
                }
        }
 out:
-        mutex_unlock(&fanout_mutex);
+        if (err && rollover) {
-        if (err) {
+                kfree(rollover);
-                kfree(po->rollover);
                po->rollover = NULL;
        }
+        mutex_unlock(&fanout_mutex);
        return err;
 }
-static void fanout_release(struct sock *sk)
+/* If pkt_sk(sk)->fanout->sk_ref is zero, this function removes
+ * pkt_sk(sk)->fanout from fanout_list and returns pkt_sk(sk)->fanout.
+ * It is the responsibility of the caller to call fanout_release_data() and
+ * free the returned packet_fanout (after synchronize_net())
+ */
+static struct packet_fanout *fanout_release(struct sock *sk)
 {
        struct packet_sock *po = pkt_sk(sk);
        struct packet_fanout *f;
+        mutex_lock(&fanout_mutex);
        f = po->fanout;
-        if (!f)
+        if (f) {
-                return;
+                po->fanout = NULL;
-        mutex_lock(&fanout_mutex);
+                if (atomic_dec_and_test(&f->sk_ref))
-        po->fanout = NULL;
+                        list_del(&f->list);
+                else
+                        f = NULL;
-        if (atomic_dec_and_test(&f->sk_ref)) {
+                if (po->rollover)
-                list_del(&f->list);
+                        kfree_rcu(po->rollover, rcu);
-                dev_remove_pack(&f->prot_hook);
-                fanout_release_data(f);
-                kfree(f);
        }
        mutex_unlock(&fanout_mutex);
-        if (po->rollover)
+        return f;
-                kfree_rcu(po->rollover, rcu);
 }
 static bool packet_extra_vlan_len_allowed(const struct net_device *dev,
@@ -2637,7 +2650,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
        int vnet_hdr_len;
        struct packet_sock *po = pkt_sk(sk);
        unsigned short gso_type = 0;
-        int hlen, tlen;
+        int hlen, tlen, linear;
        int extra_len = 0;
        ssize_t n;
@@ -2741,8 +2754,9 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
        err = -ENOBUFS;
        hlen = LL_RESERVED_SPACE(dev);
        tlen = dev->needed_tailroom;
-        skb = packet_alloc_skb(sk, hlen + tlen, hlen, len,
+        linear = __virtio16_to_cpu(vio_le(), vnet_hdr.hdr_len);
-                               __virtio16_to_cpu(vio_le(), vnet_hdr.hdr_len),
+        linear = max(linear, min_t(int, len, dev->hard_header_len));
+        skb = packet_alloc_skb(sk, hlen + tlen, hlen, len, linear,
                               msg->msg_flags & MSG_DONTWAIT, &err);
        if (skb == NULL)
                goto out_unlock;
@@ -2845,6 +2859,7 @@ static int packet_release(struct socket *sock)
 {
        struct sock *sk = sock->sk;
        struct packet_sock *po;
+        struct packet_fanout *f;
        struct net *net;
        union tpacket_req_u req_u;
@@ -2884,9 +2899,14 @@ static int packet_release(struct socket *sock)
                packet_set_ring(sk, &req_u, 1, 1);
        }
-        fanout_release(sk);
+        f = fanout_release(sk);
        synchronize_net();
+        if (f) {
+                fanout_release_data(f);
+                kfree(f);
+        }
        /*
         *      Now the socket is dead. No more input will appear.
         */
@@ -3001,7 +3021,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
                            int addr_len)
 {
        struct sock *sk = sock->sk;
-        char name[15];
+        char name[sizeof(uaddr->sa_data) + 1];
        /*
         *      Check legality
@@ -3009,7 +3029,11 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
        if (addr_len != sizeof(struct sockaddr))
                return -EINVAL;
-        strlcpy(name, uaddr->sa_data, sizeof(name));
+        /* uaddr->sa_data comes from the userspace, it's not guaranteed to be
+         * zero-terminated.
+         */
+        memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data));
+        name[sizeof(uaddr->sa_data)] = 0;
        return packet_do_bind(sk, name, 0, pkt_sk(sk)->num);
 }
@@ -3598,12 +3622,19 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                if (optlen != sizeof(val))
                        return -EINVAL;
-                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-                        return -EBUSY;
                if (copy_from_user(&val, optval, sizeof(val)))
                        return -EFAULT;
-                po->tp_reserve = val;
+                if (val > INT_MAX)
-                return 0;
+                        return -EINVAL;
+                lock_sock(sk);
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
+                        ret = -EBUSY;
+                } else {
+                        po->tp_reserve = val;
+                        ret = 0;
+                }
+                release_sock(sk);
+                return ret;
        }
        case PACKET_LOSS:
        {
@@ -3860,7 +3891,6 @@ static int packet_notifier(struct notifier_block *this,
                                }
                                if (msg == NETDEV_UNREGISTER) {
                                        packet_cached_dev_reset(po);
-                                        fanout_release(sk);
                                        po->ifindex = -1;
                                        if (po->prot_hook.dev)
                                                dev_put(po->prot_hook.dev);
@@ -4115,8 +4145,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))
                        goto out;
                if (po->tp_version >= TPACKET_V3 &&
-                    (int)(req->tp_block_size -
+                    req->tp_block_size <=
-                          BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0)
+                          BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv))
                        goto out;
                if (unlikely(req->tp_frame_size < po->tp_hdrlen +
                                        po->tp_reserve))
@@ -4127,6 +4157,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                rb->frames_per_block = req->tp_block_size / req->tp_frame_size;
                if (unlikely(rb->frames_per_block == 0))
                        goto out;
+                if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr))
+                        goto out;
                if (unlikely((rb->frames_per_block * req->tp_block_nr) !=
                                        req->tp_frame_nr))
                        goto out;
@@ -4198,7 +4230,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                register_prot_hook(sk);
        }
        spin_unlock(&po->bind_lock);
-        if (closing && (po->tp_version > TPACKET_V2)) {
+        if (pg_vec && (po->tp_version > TPACKET_V2)) {
                /* Because we don't support block-based V3 on tx-ring */
                if (!tx_ring)
                        prb_shutdown_retire_blk_timer(po, rb_queue);
diff --git a/net/rds/cong.c b/net/rds/cong.c
index e6144b8246fd..6641bcf7c185 100644
--- a/net/rds/cong.c
+++ b/net/rds/cong.c
@@ -299,7 +299,7 @@ void rds_cong_set_bit(struct rds_cong_map *map, __be16 port)
        i = be16_to_cpu(port) / RDS_CONG_MAP_PAGE_BITS;
        off = be16_to_cpu(port) % RDS_CONG_MAP_PAGE_BITS;
-        __set_bit_le(off, (void *)map->m_page_addrs[i]);
+        set_bit_le(off, (void *)map->m_page_addrs[i]);
 }
 void rds_cong_clear_bit(struct rds_cong_map *map, __be16 port)
@@ -313,7 +313,7 @@ void rds_cong_clear_bit(struct rds_cong_map *map, __be16 port)
        i = be16_to_cpu(port) / RDS_CONG_MAP_PAGE_BITS;
        off = be16_to_cpu(port) % RDS_CONG_MAP_PAGE_BITS;
-        __clear_bit_le(off, (void *)map->m_page_addrs[i]);
+        clear_bit_le(off, (void *)map->m_page_addrs[i]);
 }
 static int rds_cong_test_bit(struct rds_cong_map *map, __be16 port)
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 0936a4a32b47..e353e3255206 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -78,7 +78,7 @@ int rds_tcp_accept_one(struct socket *sock)
        struct inet_sock *inet;
        struct rds_tcp_connection *rs_tcp;
-        ret = sock_create_kern(sock_net(sock->sk), sock->sk->sk_family,
+        ret = sock_create_lite(sock->sk->sk_family,
                               sock->sk->sk_type, sock->sk->sk_protocol,
                               &new_sock);
        if (ret)
diff --git a/net/rpmsg/rpmsg_proto.c b/net/rpmsg/rpmsg_proto.c
index 1c30815556eb..010a9aed6dbf 100644
--- a/net/rpmsg/rpmsg_proto.c
+++ b/net/rpmsg/rpmsg_proto.c
@@ -543,6 +543,11 @@ static void __rpmsg_proto_cb(struct device *dev, int from_vproc_id, void *data,
                         len, true);
 #endif
+        if (!sk) {
+                dev_warn(dev, "callback for deleted socket (from %d)\n", src);
+                return;
+        }
        lock_sock(sk);
        switch (sk->sk_state) {
@@ -590,6 +595,15 @@ static void rpmsg_proto_cb(struct rpmsg_channel *rpdev, void *data, int len,
 {
        int id = rpmsg_sock_get_proc_id(rpdev);
+        /* published rpmsg channels from remote side reuse their end-point's
+         * private field for storing the list of connected sockets, so cannot
+         * process messages.
+         */
+        if (rpdev->src >= RPMSG_RESERVED_ADDRESSES) {
+                dev_err(&rpdev->dev, "rpmsg_proto device not designed to receive any messages\n");
+                return;
+        }
        __rpmsg_proto_cb(&rpdev->dev, id, data, len, priv, src);
 }
@@ -609,8 +623,11 @@ static int rpmsg_proto_probe(struct rpmsg_channel *rpdev)
                dev_err(dev, "id %d already associated to different vrp\n",
                        id);
-        if (dst == RPMSG_ADDR_ANY)
+        if (dst == RPMSG_ADDR_ANY) {
+                /* Set announce to false and avoid extra delay when binding. */
+                rpdev->announce = false;
                return 0;
+        }
        /* associate id/vrp for later lookup in rpmsg_sock_bind() */
        if (!vrp) {
diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
index da3cc09f683e..91d43ab3a961 100644
--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
@@ -215,7 +215,7 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
                                       unsigned int *_toklen)
 {
        const __be32 *xdr = *_xdr;
-        unsigned int toklen = *_toklen, n_parts, loop, tmp;
+        unsigned int toklen = *_toklen, n_parts, loop, tmp, paddedlen;
        /* there must be at least one name, and at least #names+1 length
         * words */
@@ -245,16 +245,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
                toklen -= 4;
                if (tmp <= 0 || tmp > AFSTOKEN_STRING_MAX)
                        return -EINVAL;
-                if (tmp > toklen)
+                paddedlen = (tmp + 3) & ~3;
+                if (paddedlen > toklen)
                        return -EINVAL;
                princ->name_parts[loop] = kmalloc(tmp + 1, GFP_KERNEL);
                if (!princ->name_parts[loop])
                        return -ENOMEM;
                memcpy(princ->name_parts[loop], xdr, tmp);
                princ->name_parts[loop][tmp] = 0;
-                tmp = (tmp + 3) & ~3;
+                toklen -= paddedlen;
-                toklen -= tmp;
+                xdr += paddedlen >> 2;
-                xdr += tmp >> 2;
        }
        if (toklen < 4)
@@ -263,16 +263,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
        toklen -= 4;
        if (tmp <= 0 || tmp > AFSTOKEN_K5_REALM_MAX)
                return -EINVAL;
-        if (tmp > toklen)
+        paddedlen = (tmp + 3) & ~3;
+        if (paddedlen > toklen)
                return -EINVAL;
        princ->realm = kmalloc(tmp + 1, GFP_KERNEL);
        if (!princ->realm)
                return -ENOMEM;
        memcpy(princ->realm, xdr, tmp);
        princ->realm[tmp] = 0;
-        tmp = (tmp + 3) & ~3;
+        toklen -= paddedlen;
-        toklen -= tmp;
+        xdr += paddedlen >> 2;
-        xdr += tmp >> 2;
        _debug("%s/...@%s", princ->name_parts[0], princ->realm);
@@ -291,7 +291,7 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td,
                                         unsigned int *_toklen)
 {
        const __be32 *xdr = *_xdr;
-        unsigned int toklen = *_toklen, len;
+        unsigned int toklen = *_toklen, len, paddedlen;
        /* there must be at least one tag and one length word */
        if (toklen <= 8)
@@ -305,15 +305,17 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td,
        toklen -= 8;
        if (len > max_data_size)
                return -EINVAL;
+        paddedlen = (len + 3) & ~3;
+        if (paddedlen > toklen)
+                return -EINVAL;
        td->data_len = len;
        if (len > 0) {
                td->data = kmemdup(xdr, len, GFP_KERNEL);
                if (!td->data)
                        return -ENOMEM;
-                len = (len + 3) & ~3;
+                toklen -= paddedlen;
-                toklen -= len;
+                xdr += paddedlen >> 2;
-                xdr += len >> 2;
        }
        _debug("tag %x len %x", td->tag, td->data_len);
@@ -385,7 +387,7 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
                                    const __be32 **_xdr, unsigned int *_toklen)
 {
        const __be32 *xdr = *_xdr;
-        unsigned int toklen = *_toklen, len;
+        unsigned int toklen = *_toklen, len, paddedlen;
        /* there must be at least one length word */
        if (toklen <= 4)
@@ -397,6 +399,9 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
        toklen -= 4;
        if (len > AFSTOKEN_K5_TIX_MAX)
                return -EINVAL;
+        paddedlen = (len + 3) & ~3;
+        if (paddedlen > toklen)
+                return -EINVAL;
        *_tktlen = len;
        _debug("ticket len %u", len);
@@ -405,9 +410,8 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
                *_ticket = kmemdup(xdr, len, GFP_KERNEL);
                if (!*_ticket)
                        return -ENOMEM;
-                len = (len + 3) & ~3;
+                toklen -= paddedlen;
-                toklen -= len;
+                xdr += paddedlen >> 2;
-                xdr += len >> 2;
        }
        *_xdr = xdr;
@@ -550,7 +554,7 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep)
 {
        const __be32 *xdr = prep->data, *token;
        const char *cp;
-        unsigned int len, tmp, loop, ntoken, toklen, sec_ix;
+        unsigned int len, paddedlen, loop, ntoken, toklen, sec_ix;
        size_t datalen = prep->datalen;
        int ret;
@@ -576,22 +580,21 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep)
        if (len < 1 || len > AFSTOKEN_CELL_MAX)
                goto not_xdr;
        datalen -= 4;
-        tmp = (len + 3) & ~3;
+        paddedlen = (len + 3) & ~3;
-        if (tmp > datalen)
+        if (paddedlen > datalen)
                goto not_xdr;
        cp = (const char *) xdr;
        for (loop = 0; loop < len; loop++)
                if (!isprint(cp[loop]))
                        goto not_xdr;
-        if (len < tmp)
+        for (; loop < paddedlen; loop++)
-                for (; loop < tmp; loop++)
+                if (cp[loop])
-                        if (cp[loop])
+                        goto not_xdr;
-                                goto not_xdr;
        _debug("cellname: [%u/%u] '%*.*s'",
-               len, tmp, len, len, (const char *) xdr);
+               len, paddedlen, len, len, (const char *) xdr);
-        datalen -= tmp;
+        datalen -= paddedlen;
-        xdr += tmp >> 2;
+        xdr += paddedlen >> 2;
        /* get the token count */
        if (datalen < 12)
@@ -612,10 +615,11 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep)
                sec_ix = ntohl(*xdr);
                datalen -= 4;
                _debug("token: [%x/%zx] %x", toklen, datalen, sec_ix);
-                if (toklen < 20 || toklen > datalen)
+                paddedlen = (toklen + 3) & ~3;
+                if (toklen < 20 || toklen > datalen || paddedlen > datalen)
                        goto not_xdr;
-                datalen -= (toklen + 3) & ~3;
+                datalen -= paddedlen;
-                xdr += (toklen + 3) >> 2;
+                xdr += paddedlen >> 2;
        } while (--loop > 0);
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 06e7c4a37245..694a06f1e0d5 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -820,10 +820,8 @@ static int tca_action_flush(struct net *net, struct nlattr *nla,
                goto out_module_put;
        err = a.ops->walk(skb, &dcb, RTM_DELACTION, &a);
-        if (err < 0)
+        if (err <= 0)
                goto out_module_put;
-        if (err == 0)
-                goto noflush_out;
        nla_nest_end(skb, nest);
@@ -840,7 +838,6 @@ static int tca_action_flush(struct net *net, struct nlattr *nla,
 out_module_put:
        module_put(a.ops->owner);
 err_out:
-noflush_out:
        kfree_skb(skb);
        return err;
 }
diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index bb41699c6c49..7ecb14f3db54 100644
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -109,6 +109,9 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla,
        if (ret < 0)
                return ret;
+        if (!tb[TCA_CONNMARK_PARMS])
+                return -EINVAL;
        parm = nla_data(tb[TCA_CONNMARK_PARMS]);
        if (!tcf_hash_check(parm->index, a, bind)) {
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index d05869646515..0915d448ba23 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -42,8 +42,8 @@ static int ipt_init_target(struct xt_entry_target *t, char *table, unsigned int
                return PTR_ERR(target);
        t->u.kernel.target = target;
+        memset(&par, 0, sizeof(par));
        par.table     = table;
-        par.entryinfo = NULL;
        par.target    = target;
        par.targinfo  = t->data;
        par.hook_mask = hook;
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index e384d6aefa3a..1090a52c03cd 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -36,14 +36,15 @@ static DEFINE_SPINLOCK(mirred_list_lock);
 static void tcf_mirred_release(struct tc_action *a, int bind)
 {
        struct tcf_mirred *m = to_mirred(a);
-        struct net_device *dev = rcu_dereference_protected(m->tcfm_dev, 1);
+        struct net_device *dev;
        /* We could be called either in a RCU callback or with RTNL lock held. */
        spin_lock_bh(&mirred_list_lock);
        list_del(&m->tcfm_list);
-        spin_unlock_bh(&mirred_list_lock);
+        dev = rcu_dereference_protected(m->tcfm_dev, 1);
        if (dev)
                dev_put(dev);
+        spin_unlock_bh(&mirred_list_lock);
 }
 static const struct nla_policy mirred_policy[TCA_MIRRED_MAX + 1] = {
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 95b560f0b253..6d340cd6e2a7 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1004,6 +1004,9 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
                return sch;
        }
+        /* ops->init() failed, we call ->destroy() like qdisc_create_dflt() */
+        if (ops->destroy)
+                ops->destroy(sch);
 err_out3:
        dev_put(dev);
        kfree((char *) sch - sch->padded);
diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
index 13d6f83ec491..45d4b2f22f62 100644
--- a/net/sched/sch_hhf.c
+++ b/net/sched/sch_hhf.c
@@ -636,7 +636,9 @@ static int hhf_init(struct Qdisc *sch, struct nlattr *opt)
                        q->hhf_arrays[i] = hhf_zalloc(HHF_ARRAYS_LEN *
                                                      sizeof(u32));
                        if (!q->hhf_arrays[i]) {
-                                hhf_destroy(sch);
+                                /* Note: hhf_destroy() will be called
+                                 * by our caller.
+                                 */
                                return -ENOMEM;
                        }
                }
@@ -647,7 +649,9 @@ static int hhf_init(struct Qdisc *sch, struct nlattr *opt)
                        q->hhf_valid_bits[i] = hhf_zalloc(HHF_ARRAYS_LEN /
                                                          BITS_PER_BYTE);
                        if (!q->hhf_valid_bits[i]) {
-                                hhf_destroy(sch);
+                                /* Note: hhf_destroy() will be called
+                                 * by our caller.
+                                 */
                                return -ENOMEM;
                        }
                }
diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
index 3e82f047caaf..d9c84328e7eb 100644
--- a/net/sched/sch_mq.c
+++ b/net/sched/sch_mq.c
@@ -52,7 +52,7 @@ static int mq_init(struct Qdisc *sch, struct nlattr *opt)
        /* pre-allocate qdiscs, attachment can't fail */
        priv->qdiscs = kcalloc(dev->num_tx_queues, sizeof(priv->qdiscs[0]),
                               GFP_KERNEL);
-        if (priv->qdiscs == NULL)
+        if (!priv->qdiscs)
                return -ENOMEM;
        for (ntx = 0; ntx < dev->num_tx_queues; ntx++) {
@@ -60,18 +60,14 @@ static int mq_init(struct Qdisc *sch, struct nlattr *opt)
                qdisc = qdisc_create_dflt(dev_queue, default_qdisc_ops,
                                          TC_H_MAKE(TC_H_MAJ(sch->handle),
                                                    TC_H_MIN(ntx + 1)));
-                if (qdisc == NULL)
+                if (!qdisc)
-                        goto err;
+                        return -ENOMEM;
                priv->qdiscs[ntx] = qdisc;
                qdisc->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT;
        }
        sch->flags |= TCQ_F_MQROOT;
        return 0;
-err:
-        mq_destroy(sch);
-        return -ENOMEM;
 }
 static void mq_attach(struct Qdisc *sch)
diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index ad70ecf57ce7..66bccc5ff4ea 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -117,20 +117,17 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt)
        /* pre-allocate qdisc, attachment can't fail */
        priv->qdiscs = kcalloc(dev->num_tx_queues, sizeof(priv->qdiscs[0]),
                               GFP_KERNEL);
-        if (priv->qdiscs == NULL) {
+        if (!priv->qdiscs)
-                err = -ENOMEM;
+                return -ENOMEM;
-                goto err;
-        }
        for (i = 0; i < dev->num_tx_queues; i++) {
                dev_queue = netdev_get_tx_queue(dev, i);
                qdisc = qdisc_create_dflt(dev_queue, default_qdisc_ops,
                                          TC_H_MAKE(TC_H_MAJ(sch->handle),
                                                    TC_H_MIN(i + 1)));
-                if (qdisc == NULL) {
+                if (!qdisc)
-                        err = -ENOMEM;
+                        return -ENOMEM;
-                        goto err;
-                }
                priv->qdiscs[i] = qdisc;
                qdisc->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT;
        }
@@ -143,7 +140,7 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt)
                priv->hw_owned = 1;
                err = dev->netdev_ops->ndo_setup_tc(dev, qopt->num_tc);
                if (err)
-                        goto err;
+                        return err;
        } else {
                netdev_set_num_tc(dev, qopt->num_tc);
                for (i = 0; i < qopt->num_tc; i++)
@@ -157,10 +154,6 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt)
        sch->flags |= TCQ_F_MQROOT;
        return 0;
-err:
-        mqprio_destroy(sch);
-        return err;
 }
 static void mqprio_attach(struct Qdisc *sch)
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 498f0a2cb47f..4431e2833e45 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -742,9 +742,10 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt)
        q->ht = sfq_alloc(sizeof(q->ht[0]) * q->divisor);
        q->slots = sfq_alloc(sizeof(q->slots[0]) * q->maxflows);
        if (!q->ht || !q->slots) {
-                sfq_destroy(sch);
+                /* Note: sfq_destroy() will be called by our caller */
                return -ENOMEM;
        }
        for (i = 0; i < q->divisor; i++)
                q->ht[i] = SFQ_EMPTY_SLOT;
diff --git a/net/sctp/input.c b/net/sctp/input.c
index b6493b3f11a9..2d7859c03fd2 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -472,15 +472,14 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
                             struct sctp_association **app,
                             struct sctp_transport **tpp)
 {
+        struct sctp_init_chunk *chunkhdr, _chunkhdr;
        union sctp_addr saddr;
        union sctp_addr daddr;
        struct sctp_af *af;
        struct sock *sk = NULL;
        struct sctp_association *asoc;
        struct sctp_transport *transport = NULL;
-        struct sctp_init_chunk *chunkhdr;
        __u32 vtag = ntohl(sctphdr->vtag);
-        int len = skb->len - ((void *)sctphdr - (void *)skb->data);
        *app = NULL; *tpp = NULL;
@@ -515,13 +514,16 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
         * discard the packet.
         */
        if (vtag == 0) {
-                chunkhdr = (void *)sctphdr + sizeof(struct sctphdr);
+                /* chunk header + first 4 octects of init header */
-                if (len < sizeof(struct sctphdr) + sizeof(sctp_chunkhdr_t)
+                chunkhdr = skb_header_pointer(skb, skb_transport_offset(skb) +
-                          + sizeof(__be32) ||
+                                              sizeof(struct sctphdr),
+                                              sizeof(struct sctp_chunkhdr) +
+                                              sizeof(__be32), &_chunkhdr);
+                if (!chunkhdr ||
                    chunkhdr->chunk_hdr.type != SCTP_CID_INIT ||
-                    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag) {
+                    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag)
                        goto out;
-                }
        } else if (vtag != asoc->c.peer_vtag) {
                goto out;
        }
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index ce46f1c7f133..7527c168e471 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -239,12 +239,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
        struct sctp_bind_addr *bp;
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct sctp_sockaddr_entry *laddr;
-        union sctp_addr *baddr = NULL;
        union sctp_addr *daddr = &t->ipaddr;
        union sctp_addr dst_saddr;
        struct in6_addr *final_p, final;
        __u8 matchlen = 0;
-        __u8 bmatchlen;
        sctp_scope_t scope;
        memset(fl6, 0, sizeof(struct flowi6));
@@ -311,23 +309,37 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
         */
        rcu_read_lock();
        list_for_each_entry_rcu(laddr, &bp->address_list, list) {
-                if (!laddr->valid)
+                struct dst_entry *bdst;
+                __u8 bmatchlen;
+                if (!laddr->valid ||
+                    laddr->state != SCTP_ADDR_SRC ||
+                    laddr->a.sa.sa_family != AF_INET6 ||
+                    scope > sctp_scope(&laddr->a))
                        continue;
-                if ((laddr->state == SCTP_ADDR_SRC) &&
-                    (laddr->a.sa.sa_family == AF_INET6) &&
+                fl6->saddr = laddr->a.v6.sin6_addr;
-                    (scope <= sctp_scope(&laddr->a))) {
+                fl6->fl6_sport = laddr->a.v6.sin6_port;
-                        bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
-                        if (!baddr || (matchlen < bmatchlen)) {
-                                baddr = &laddr->a;
-                                matchlen = bmatchlen;
-                        }
-                }
-        }
-        if (baddr) {
-                fl6->saddr = baddr->v6.sin6_addr;
-                fl6->fl6_sport = baddr->v6.sin6_port;
                final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final);
-                dst = ip6_dst_lookup_flow(sk, fl6, final_p);
+                bdst = ip6_dst_lookup_flow(sk, fl6, final_p);
+                if (!IS_ERR(bdst) &&
+                    ipv6_chk_addr(dev_net(bdst->dev),
+                                  &laddr->a.v6.sin6_addr, bdst->dev, 1)) {
+                        if (!IS_ERR_OR_NULL(dst))
+                                dst_release(dst);
+                        dst = bdst;
+                        break;
+                }
+                bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
+                if (matchlen > bmatchlen)
+                        continue;
+                if (!IS_ERR_OR_NULL(dst))
+                        dst_release(dst);
+                dst = bdst;
+                matchlen = bmatchlen;
        }
        rcu_read_unlock();
@@ -662,6 +674,9 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
        newnp = inet6_sk(newsk);
        memcpy(newnp, np, sizeof(struct ipv6_pinfo));
+        newnp->ipv6_mc_list = NULL;
+        newnp->ipv6_ac_list = NULL;
+        newnp->ipv6_fl_list = NULL;
        rcu_read_lock();
        opt = rcu_dereference(np->opt);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index b5fd4ab56156..3ebf3b652d60 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -235,8 +235,12 @@ static struct sctp_transport *sctp_addr_id2transport(struct sock *sk,
                                              sctp_assoc_t id)
 {
        struct sctp_association *addr_asoc = NULL, *id_asoc = NULL;
-        struct sctp_transport *transport;
+        struct sctp_af *af = sctp_get_af_specific(addr->ss_family);
        union sctp_addr *laddr = (union sctp_addr *)addr;
+        struct sctp_transport *transport;
+        if (!af || sctp_verify_addr(sk, laddr, af->sockaddr_len))
+                return NULL;
        addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep,
                                               laddr,
@@ -4422,6 +4426,12 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
        if (!asoc)
                return -EINVAL;
+        /* If there is a thread waiting on more sndbuf space for
+         * sending on this asoc, it cannot be peeled.
+         */
+        if (waitqueue_active(&asoc->wait))
+                return -EBUSY;
        /* An association cannot be branched off from an already peeled-off
         * socket, nor is this supported for tcp style sockets.
         */
@@ -6388,6 +6398,9 @@ int sctp_inet_listen(struct socket *sock, int backlog)
        if (sock->state != SS_UNCONNECTED)
                goto out;
+        if (!sctp_sstate(sk, LISTENING) && !sctp_sstate(sk, CLOSED))
+                goto out;
        /* If backlog is zero, disable listening. */
        if (!backlog) {
                if (sctp_sstate(sk, CLOSED))
@@ -6960,7 +6973,6 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
                 */
                release_sock(sk);
                current_timeo = schedule_timeout(current_timeo);
-                BUG_ON(sk != asoc->base.sk);
                lock_sock(sk);
                *timeo_p = current_timeo;
diff --git a/net/socket.c b/net/socket.c
index 66d984ac2991..18aff3d804ec 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -520,11 +520,11 @@ static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
        return used;
 }
-int sockfs_setattr(struct dentry *dentry, struct iattr *iattr)
+static int sockfs_setattr(struct dentry *dentry, struct iattr *iattr)
 {
        int err = simple_setattr(dentry, iattr);
-        if (!err) {
+        if (!err && (iattr->ia_valid & ATTR_UID)) {
                struct socket *sock = SOCKET_I(d_inode(dentry));
                sock->sk->sk_uid = iattr->ia_uid;
@@ -2199,8 +2199,10 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
                return err;
        err = sock_error(sock->sk);
-        if (err)
+        if (err) {
+                datagrams = err;
                goto out_put;
+        }
        entry = mmsg;
        compat_entry = (struct compat_mmsghdr __user *)mmsg;
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 06095cc8815e..1f0687d8e3d7 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -541,9 +541,13 @@ gss_setup_upcall(struct gss_auth *gss_auth, struct rpc_cred *cred)
                return gss_new;
        gss_msg = gss_add_msg(gss_new);
        if (gss_msg == gss_new) {
-                int res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
+                int res;
+                atomic_inc(&gss_msg->count);
+                res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
                if (res) {
                        gss_unhash_msg(gss_new);
+                        atomic_dec(&gss_msg->count);
+                        gss_release_msg(gss_new);
                        gss_msg = ERR_PTR(res);
                }
        } else
@@ -836,6 +840,7 @@ gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
                        warn_gssd();
                gss_release_msg(gss_msg);
        }
+        gss_release_msg(gss_msg);
 }
 static void gss_pipe_dentry_destroy(struct dentry *dir,
diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
index eeeba5adee6d..2410d557ae39 100644
--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
@@ -260,7 +260,7 @@ static int gssx_dec_option_array(struct xdr_stream *xdr,
        if (!oa->data)
                return -ENOMEM;
-        creds = kmalloc(sizeof(struct svc_cred), GFP_KERNEL);
+        creds = kzalloc(sizeof(struct svc_cred), GFP_KERNEL);
        if (!creds) {
                kfree(oa->data);
                return -ENOMEM;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 7a93922457ff..f28aeb2cfd32 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -337,6 +337,11 @@ out:
 static DEFINE_IDA(rpc_clids);
+void rpc_cleanup_clids(void)
+{
+        ida_destroy(&rpc_clids);
+}
 static int rpc_alloc_clid(struct rpc_clnt *clnt)
 {
        int clid;
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index ee5d3d253102..3142f38d1104 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -119,6 +119,7 @@ out:
 static void __exit
 cleanup_sunrpc(void)
 {
+        rpc_cleanup_clids();
        rpcauth_remove_module();
        cleanup_socket_xprt();
        svc_cleanup_xprt_sock();
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 648f2a67f314..cb1381513c82 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -381,6 +381,10 @@ int tipc_enable_l2_media(struct net *net, struct tipc_bearer *b,
        dev = dev_get_by_name(net, driver_name);
        if (!dev)
                return -ENODEV;
+        if (tipc_mtu_bad(dev, 0)) {
+                dev_put(dev);
+                return -EINVAL;
+        }
        /* Associate TIPC bearer with L2 bearer */
        rcu_assign_pointer(b->media_ptr, dev);
@@ -570,14 +574,19 @@ static int tipc_l2_device_event(struct notifier_block *nb, unsigned long evt,
        if (!b_ptr)
                return NOTIFY_DONE;
-        b_ptr->mtu = dev->mtu;
        switch (evt) {
        case NETDEV_CHANGE:
                if (netif_carrier_ok(dev))
                        break;
        case NETDEV_GOING_DOWN:
+                tipc_reset_bearer(net, b_ptr);
+                break;
        case NETDEV_CHANGEMTU:
+                if (tipc_mtu_bad(dev, 0)) {
+                        bearer_disable(net, b_ptr);
+                        break;
+                }
+                b_ptr->mtu = dev->mtu;
                tipc_reset_bearer(net, b_ptr);
                break;
        case NETDEV_CHANGEADDR:
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index 552185bc4773..5f11e18b1fa1 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -39,6 +39,7 @@
 #include "netlink.h"
 #include "core.h"
+#include "msg.h"
 #include <net/genetlink.h>
 #define MAX_MEDIA       3
@@ -61,6 +62,9 @@
 #define TIPC_MEDIA_TYPE_IB      2
 #define TIPC_MEDIA_TYPE_UDP     3
+/* minimum bearer MTU */
+#define TIPC_MIN_BEARER_MTU     (MAX_H_SIZE + INT_H_SIZE)
 /**
 * struct tipc_node_map - set of node identifiers
 * @count: # of nodes in set
@@ -226,4 +230,13 @@ void tipc_bearer_xmit(struct net *net, u32 bearer_id,
 void tipc_bearer_bc_xmit(struct net *net, u32 bearer_id,
                         struct sk_buff_head *xmitq);
+/* check if device MTU is too low for tipc headers */
+static inline bool tipc_mtu_bad(struct net_device *dev, unsigned int reserve)
+{
+        if (dev->mtu >= TIPC_MIN_BEARER_MTU + reserve)
+                return false;
+        netdev_warn(dev, "MTU too low for tipc bearer\n");
+        return true;
+}
 #endif  /* _TIPC_BEARER_H */
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 03a842870c52..e2bdb07a49a2 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -69,6 +69,7 @@ static int __net_init tipc_init_net(struct net *net)
        if (err)
                goto out_nametbl;
+        INIT_LIST_HEAD(&tn->dist_queue);
        err = tipc_topsrv_start(net);
        if (err)
                goto out_subscr;
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 18e95a8020cd..fe3b89e9cde4 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -103,6 +103,9 @@ struct tipc_net {
        spinlock_t nametbl_lock;
        struct name_table *nametbl;
+        /* Name dist queue */
+        struct list_head dist_queue;
        /* Topology subscription server */
        struct tipc_server *topsrv;
        atomic_t subscription_count;
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index f51c8bdbea1c..c4c151bc000c 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -40,11 +40,6 @@
 int sysctl_tipc_named_timeout __read_mostly = 2000;
-/**
- * struct tipc_dist_queue - queue holding deferred name table updates
- */
-static struct list_head tipc_dist_queue = LIST_HEAD_INIT(tipc_dist_queue);
 struct distr_queue_item {
        struct distr_item i;
        u32 dtype;
@@ -67,6 +62,8 @@ static void publ_to_item(struct distr_item *i, struct publication *p)
 /**
 * named_prepare_buf - allocate & initialize a publication message
+ *
+ * The buffer returned is of size INT_H_SIZE + payload size
 */
 static struct sk_buff *named_prepare_buf(struct net *net, u32 type, u32 size,
                                         u32 dest)
@@ -171,9 +168,9 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
        struct publication *publ;
        struct sk_buff *skb = NULL;
        struct distr_item *item = NULL;
-        uint msg_dsz = (tipc_node_get_mtu(net, dnode, 0) / ITEM_SIZE) *
+        u32 msg_dsz = ((tipc_node_get_mtu(net, dnode, 0) - INT_H_SIZE) /
-                        ITEM_SIZE;
+                        ITEM_SIZE) * ITEM_SIZE;
-        uint msg_rem = msg_dsz;
+        u32 msg_rem = msg_dsz;
        list_for_each_entry(publ, pls, local_list) {
                /* Prepare next buffer: */
@@ -340,9 +337,11 @@ static bool tipc_update_nametbl(struct net *net, struct distr_item *i,
 * tipc_named_add_backlog - add a failed name table update to the backlog
 *
 */
-static void tipc_named_add_backlog(struct distr_item *i, u32 type, u32 node)
+static void tipc_named_add_backlog(struct net *net, struct distr_item *i,
+                                   u32 type, u32 node)
 {
        struct distr_queue_item *e;
+        struct tipc_net *tn = net_generic(net, tipc_net_id);
        unsigned long now = get_jiffies_64();
        e = kzalloc(sizeof(*e), GFP_ATOMIC);
@@ -352,7 +351,7 @@ static void tipc_named_add_backlog(struct distr_item *i, u32 type, u32 node)
        e->node = node;
        e->expires = now + msecs_to_jiffies(sysctl_tipc_named_timeout);
        memcpy(e, i, sizeof(*i));
-        list_add_tail(&e->next, &tipc_dist_queue);
+        list_add_tail(&e->next, &tn->dist_queue);
 }
 /**
@@ -362,10 +361,11 @@ static void tipc_named_add_backlog(struct distr_item *i, u32 type, u32 node)
 void tipc_named_process_backlog(struct net *net)
 {
        struct distr_queue_item *e, *tmp;
+        struct tipc_net *tn = net_generic(net, tipc_net_id);
        char addr[16];
        unsigned long now = get_jiffies_64();
-        list_for_each_entry_safe(e, tmp, &tipc_dist_queue, next) {
+        list_for_each_entry_safe(e, tmp, &tn->dist_queue, next) {
                if (time_after(e->expires, now)) {
                        if (!tipc_update_nametbl(net, &e->i, e->node, e->dtype))
                                continue;
@@ -405,7 +405,7 @@ void tipc_named_rcv(struct net *net, struct sk_buff_head *inputq)
                node = msg_orignode(msg);
                while (count--) {
                        if (!tipc_update_nametbl(net, item, node, mtype))
-                                tipc_named_add_backlog(item, mtype, node);
+                                tipc_named_add_backlog(net, item, mtype, node);
                        item++;
                }
                kfree_skb(skb);
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 3926b561f873..2df0b98d4a32 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -102,9 +102,10 @@ static unsigned int tipc_hashfn(u32 addr)
 static void tipc_node_kref_release(struct kref *kref)
 {
-        struct tipc_node *node = container_of(kref, struct tipc_node, kref);
+        struct tipc_node *n = container_of(kref, struct tipc_node, kref);
-        tipc_node_delete(node);
+        kfree(n->bc_entry.link);
+        kfree_rcu(n, rcu);
 }
 void tipc_node_put(struct tipc_node *node)
@@ -216,21 +217,20 @@ static void tipc_node_delete(struct tipc_node *node)
 {
        list_del_rcu(&node->list);
        hlist_del_rcu(&node->hash);
-        kfree(node->bc_entry.link);
+        tipc_node_put(node);
-        kfree_rcu(node, rcu);
+        del_timer_sync(&node->timer);
+        tipc_node_put(node);
 }
 void tipc_node_stop(struct net *net)
 {
-        struct tipc_net *tn = net_generic(net, tipc_net_id);
+        struct tipc_net *tn = tipc_net(net);
        struct tipc_node *node, *t_node;
        spin_lock_bh(&tn->node_list_lock);
-        list_for_each_entry_safe(node, t_node, &tn->node_list, list) {
+        list_for_each_entry_safe(node, t_node, &tn->node_list, list)
-                if (del_timer(&node->timer))
+                tipc_node_delete(node);
-                        tipc_node_put(node);
-                tipc_node_put(node);
-        }
        spin_unlock_bh(&tn->node_list_lock);
 }
@@ -313,9 +313,7 @@ static void tipc_node_timeout(unsigned long data)
                if (rc & TIPC_LINK_DOWN_EVT)
                        tipc_node_link_down(n, bearer_id, false);
        }
-        if (!mod_timer(&n->timer, jiffies + n->keepalive_intv))
+        mod_timer(&n->timer, jiffies + n->keepalive_intv);
-                tipc_node_get(n);
-        tipc_node_put(n);
 }
 /**
@@ -730,7 +728,7 @@ static void tipc_node_fsm_evt(struct tipc_node *n, int evt)
                        state = SELF_UP_PEER_UP;
                        break;
                case SELF_LOST_CONTACT_EVT:
-                        state = SELF_DOWN_PEER_LEAVING;
+                        state = SELF_DOWN_PEER_DOWN;
                        break;
                case SELF_ESTABL_CONTACT_EVT:
                case PEER_LOST_CONTACT_EVT:
@@ -749,7 +747,7 @@ static void tipc_node_fsm_evt(struct tipc_node *n, int evt)
                        state = SELF_UP_PEER_UP;
                        break;
                case PEER_LOST_CONTACT_EVT:
-                        state = SELF_LEAVING_PEER_DOWN;
+                        state = SELF_DOWN_PEER_DOWN;
                        break;
                case SELF_LOST_CONTACT_EVT:
                case PEER_ESTABL_CONTACT_EVT:
diff --git a/net/tipc/server.c b/net/tipc/server.c
index 922e04a43396..50f5b0ca7b3c 100644
--- a/net/tipc/server.c
+++ b/net/tipc/server.c
@@ -452,6 +452,11 @@ int tipc_conn_sendmsg(struct tipc_server *s, int conid,
        if (!con)
                return -EINVAL;
+        if (!test_bit(CF_CONNECTED, &con->flags)) {
+                conn_put(con);
+                return 0;
+        }
        e = tipc_alloc_entry(data, len);
        if (!e) {
                conn_put(con);
@@ -465,12 +470,8 @@ int tipc_conn_sendmsg(struct tipc_server *s, int conid,
        list_add_tail(&e->list, &con->outqueue);
        spin_unlock_bh(&con->outqueue_lock);
-        if (test_bit(CF_CONNECTED, &con->flags)) {
+        if (!queue_work(s->send_wq, &con->swork))
-                if (!queue_work(s->send_wq, &con->swork))
-                        conn_put(con);
-        } else {
                conn_put(con);
-        }
        return 0;
 }
@@ -494,7 +495,7 @@ static void tipc_send_to_sock(struct tipc_conn *con)
        int ret;
        spin_lock_bh(&con->outqueue_lock);
-        while (1) {
+        while (test_bit(CF_CONNECTED, &con->flags)) {
                e = list_entry(con->outqueue.next, struct outqueue_entry,
                               list);
                if ((struct list_head *) e == &con->outqueue)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index b26b7a127773..65171f8e8c45 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -777,9 +777,11 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq,
 * @tsk: receiving socket
 * @skb: pointer to message buffer.
 */
-static void tipc_sk_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb)
+static void tipc_sk_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb,
+                              struct sk_buff_head *xmitq)
 {
        struct sock *sk = &tsk->sk;
+        u32 onode = tsk_own_node(tsk);
        struct tipc_msg *hdr = buf_msg(skb);
        int mtyp = msg_type(hdr);
        int conn_cong;
@@ -792,7 +794,8 @@ static void tipc_sk_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb)
        if (mtyp == CONN_PROBE) {
                msg_set_type(hdr, CONN_PROBE_REPLY);
-                tipc_sk_respond(sk, skb, TIPC_OK);
+                if (tipc_msg_reverse(onode, &skb, TIPC_OK))
+                        __skb_queue_tail(xmitq, skb);
                return;
        } else if (mtyp == CONN_ACK) {
                conn_cong = tsk_conn_cong(tsk);
@@ -1647,7 +1650,8 @@ static unsigned int rcvbuf_limit(struct sock *sk, struct sk_buff *buf)
 *
 * Returns true if message was added to socket receive queue, otherwise false
 */
-static bool filter_rcv(struct sock *sk, struct sk_buff *skb)
+static bool filter_rcv(struct sock *sk, struct sk_buff *skb,
+                       struct sk_buff_head *xmitq)
 {
        struct socket *sock = sk->sk_socket;
        struct tipc_sock *tsk = tipc_sk(sk);
@@ -1657,7 +1661,7 @@ static bool filter_rcv(struct sock *sk, struct sk_buff *skb)
        int usr = msg_user(hdr);
        if (unlikely(msg_user(hdr) == CONN_MANAGER)) {
-                tipc_sk_proto_rcv(tsk, skb);
+                tipc_sk_proto_rcv(tsk, skb, xmitq);
                return false;
        }
@@ -1700,7 +1704,8 @@ static bool filter_rcv(struct sock *sk, struct sk_buff *skb)
        return true;
 reject:
-        tipc_sk_respond(sk, skb, err);
+        if (tipc_msg_reverse(tsk_own_node(tsk), &skb, err))
+                __skb_queue_tail(xmitq, skb);
        return false;
 }
@@ -1716,9 +1721,24 @@ reject:
 static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 {
        unsigned int truesize = skb->truesize;
+        struct sk_buff_head xmitq;
+        u32 dnode, selector;
-        if (likely(filter_rcv(sk, skb)))
+        __skb_queue_head_init(&xmitq);
+        if (likely(filter_rcv(sk, skb, &xmitq))) {
                atomic_add(truesize, &tipc_sk(sk)->dupl_rcvcnt);
+                return 0;
+        }
+        if (skb_queue_empty(&xmitq))
+                return 0;
+        /* Send response/rejected message */
+        skb = __skb_dequeue(&xmitq);
+        dnode = msg_destnode(buf_msg(skb));
+        selector = msg_origport(buf_msg(skb));
+        tipc_node_xmit_skb(sock_net(sk), skb, dnode, selector);
        return 0;
 }
@@ -1732,12 +1752,13 @@ static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 * Caller must hold socket lock
 */
 static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk,
-                            u32 dport)
+                            u32 dport, struct sk_buff_head *xmitq)
 {
+        unsigned long time_limit = jiffies + 2;
+        struct sk_buff *skb;
        unsigned int lim;
        atomic_t *dcnt;
-        struct sk_buff *skb;
+        u32 onode;
-        unsigned long time_limit = jiffies + 2;
        while (skb_queue_len(inputq)) {
                if (unlikely(time_after_eq(jiffies, time_limit)))
@@ -1749,20 +1770,22 @@ static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk,
                /* Add message directly to receive queue if possible */
                if (!sock_owned_by_user(sk)) {
-                        filter_rcv(sk, skb);
+                        filter_rcv(sk, skb, xmitq);
                        continue;
                }
                /* Try backlog, compensating for double-counted bytes */
                dcnt = &tipc_sk(sk)->dupl_rcvcnt;
-                if (sk->sk_backlog.len)
+                if (!sk->sk_backlog.len)
                        atomic_set(dcnt, 0);
                lim = rcvbuf_limit(sk, skb) + atomic_read(dcnt);
                if (likely(!sk_add_backlog(sk, skb, lim)))
                        continue;
                /* Overload => reject message back to sender */
-                tipc_sk_respond(sk, skb, TIPC_ERR_OVERLOAD);
+                onode = tipc_own_addr(sock_net(sk));
+                if (tipc_msg_reverse(onode, &skb, TIPC_ERR_OVERLOAD))
+                        __skb_queue_tail(xmitq, skb);
                break;
        }
 }
@@ -1775,12 +1798,14 @@ static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk,
 */
 void tipc_sk_rcv(struct net *net, struct sk_buff_head *inputq)
 {
+        struct sk_buff_head xmitq;
        u32 dnode, dport = 0;
        int err;
        struct tipc_sock *tsk;
        struct sock *sk;
        struct sk_buff *skb;
+        __skb_queue_head_init(&xmitq);
        while (skb_queue_len(inputq)) {
                dport = tipc_skb_peek_port(inputq, dport);
                tsk = tipc_sk_lookup(net, dport);
@@ -1788,9 +1813,14 @@ void tipc_sk_rcv(struct net *net, struct sk_buff_head *inputq)
                if (likely(tsk)) {
                        sk = &tsk->sk;
                        if (likely(spin_trylock_bh(&sk->sk_lock.slock))) {
-                                tipc_sk_enqueue(inputq, sk, dport);
+                                tipc_sk_enqueue(inputq, sk, dport, &xmitq);
                                spin_unlock_bh(&sk->sk_lock.slock);
                        }
+                        /* Send pending response/rejected messages, if any */
+                        while ((skb = __skb_dequeue(&xmitq))) {
+                                dnode = msg_destnode(buf_msg(skb));
+                                tipc_node_xmit_skb(net, skb, dnode, dport);
+                        }
                        sock_put(sk);
                        continue;
                }
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index 6af78c6276b4..78d6b78de29d 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -52,7 +52,7 @@
 /* IANA assigned UDP port */
 #define UDP_PORT_DEFAULT        6118
-#define UDP_MIN_HEADROOM        28
+#define UDP_MIN_HEADROOM        48
 static const struct nla_policy tipc_nl_udp_policy[TIPC_NLA_UDP_MAX + 1] = {
        [TIPC_NLA_UDP_UNSPEC]   = {.type = NLA_UNSPEC},
@@ -376,6 +376,11 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,
                udp_conf.local_ip.s_addr = htonl(INADDR_ANY);
                udp_conf.use_udp_checksums = false;
                ub->ifindex = dev->ifindex;
+                if (tipc_mtu_bad(dev, sizeof(struct iphdr) +
+                                      sizeof(struct udphdr))) {
+                        err = -EINVAL;
+                        goto err;
+                }
                b->mtu = dev->mtu - sizeof(struct iphdr)
                        - sizeof(struct udphdr);
 #if IS_ENABLED(CONFIG_IPV6)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 73f75258ce46..e05ec54ac53f 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -994,9 +994,11 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        unsigned int hash;
        struct unix_address *addr;
        struct hlist_head *list;
+        struct path path = { NULL, NULL };
        err = -EINVAL;
-        if (sunaddr->sun_family != AF_UNIX)
+        if (addr_len < offsetofend(struct sockaddr_un, sun_family) ||
+            sunaddr->sun_family != AF_UNIX)
                goto out;
        if (addr_len == sizeof(short)) {
@@ -1009,9 +1011,20 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                goto out;
        addr_len = err;
+        if (sun_path[0]) {
+                umode_t mode = S_IFSOCK |
+                       (SOCK_INODE(sock)->i_mode & ~current_umask());
+                err = unix_mknod(sun_path, mode, &path);
+                if (err) {
+                        if (err == -EEXIST)
+                                err = -EADDRINUSE;
+                        goto out;
+                }
+        }
        err = mutex_lock_interruptible(&u->bindlock);
        if (err)
-                goto out;
+                goto out_put;
        err = -EINVAL;
        if (u->addr)
@@ -1028,16 +1041,6 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        atomic_set(&addr->refcnt, 1);
        if (sun_path[0]) {
-                struct path path;
-                umode_t mode = S_IFSOCK |
-                       (SOCK_INODE(sock)->i_mode & ~current_umask());
-                err = unix_mknod(sun_path, mode, &path);
-                if (err) {
-                        if (err == -EEXIST)
-                                err = -EADDRINUSE;
-                        unix_release_addr(addr);
-                        goto out_up;
-                }
                addr->hash = UNIX_HASH_SIZE;
                hash = d_real_inode(path.dentry)->i_ino & (UNIX_HASH_SIZE - 1);
                spin_lock(&unix_table_lock);
@@ -1064,6 +1067,9 @@ out_unlock:
        spin_unlock(&unix_table_lock);
 out_up:
        mutex_unlock(&u->bindlock);
+out_put:
+        if (err)
+                path_put(&path);
 out:
        return err;
 }
@@ -1103,6 +1109,10 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
        unsigned int hash;
        int err;
+        err = -EINVAL;
+        if (alen < offsetofend(struct sockaddr, sa_family))
+                goto out;
        if (addr->sa_family != AF_UNSPEC) {
                err = unix_mkname(sunaddr, alen, &hash);
                if (err < 0)
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 6a0d48525fcf..c36757e72844 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -146,6 +146,7 @@ void unix_notinflight(struct user_struct *user, struct file *fp)
        if (s) {
                struct unix_sock *u = unix_sk(s);
+                BUG_ON(!atomic_long_read(&u->inflight));
                BUG_ON(list_empty(&u->link));
                if (atomic_long_dec_and_test(&u->inflight))
@@ -341,6 +342,14 @@ void unix_gc(void)
        }
        list_del(&cursor);
+        /* Now gc_candidates contains only garbage.  Restore original
+         * inflight counters for these as well, and remove the skbuffs
+         * which are creating the cycle(s).
+         */
+        skb_queue_head_init(&hitlist);
+        list_for_each_entry(u, &gc_candidates, link)
+                scan_children(&u->sk, inc_inflight, &hitlist);
        /* not_cycle_list contains those sockets which do not make up a
         * cycle.  Restore these to the inflight list.
         */
@@ -350,14 +359,6 @@ void unix_gc(void)
                list_move_tail(&u->link, &gc_inflight_list);
        }
-        /* Now gc_candidates contains only garbage.  Restore original
-         * inflight counters for these as well, and remove the skbuffs
-         * which are creating the cycle(s).
-         */
-        skb_queue_head_init(&hitlist);
-        list_for_each_entry(u, &gc_candidates, link)
-        scan_children(&u->sk, inc_inflight, &hitlist);
        spin_unlock(&unix_gc_lock);
        /* Here we are. Hitlist is filled. Die. */
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index 0a369bb440e7..662bdd20a748 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -842,7 +842,7 @@ static void vmci_transport_peer_detach_cb(u32 sub_id,
         * qp_handle.
         */
        if (vmci_handle_is_invalid(e_payload->handle) ||
-            vmci_handle_is_equal(trans->qp_handle, e_payload->handle))
+            !vmci_handle_is_equal(trans->qp_handle, e_payload->handle))
                return;
        /* We don't ask for delayed CBs when we subscribe to this event (we
@@ -2154,7 +2154,7 @@ module_exit(vmci_transport_exit);
 MODULE_AUTHOR("VMware, Inc.");
 MODULE_DESCRIPTION("VMCI transport for Virtual Sockets");
-MODULE_VERSION("1.0.2.0-k");
+MODULE_VERSION("1.0.3.0-k");
 MODULE_LICENSE("GPL v2");
 MODULE_ALIAS("vmware_vsock");
 MODULE_ALIAS_NETPROTO(PF_VSOCK);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 1f0de6d74daa..de10e3c0e2a4 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -302,8 +302,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
        [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
        [NL80211_ATTR_PID] = { .type = NLA_U32 },
        [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
-        [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
+        [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
-                                 .len = WLAN_PMKID_LEN },
        [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
        [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
        [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
@@ -359,6 +358,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
        [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
        [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
        [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
+        [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
        [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
        [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
        [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
@@ -492,21 +492,17 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 {
        int err;
-        rtnl_lock();
        if (!cb->args[0]) {
                err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
                                  nl80211_fam.attrbuf, nl80211_fam.maxattr,
                                  nl80211_policy);
                if (err)
-                        goto out_unlock;
+                        return err;
                *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
                                                   nl80211_fam.attrbuf);
-                if (IS_ERR(*wdev)) {
+                if (IS_ERR(*wdev))
-                        err = PTR_ERR(*wdev);
+                        return PTR_ERR(*wdev);
-                        goto out_unlock;
-                }
                *rdev = wiphy_to_rdev((*wdev)->wiphy);
                /* 0 is the first index - add 1 to parse only once */
                cb->args[0] = (*rdev)->wiphy_idx + 1;
@@ -516,10 +512,8 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
                struct wireless_dev *tmp;
-                if (!wiphy) {
+                if (!wiphy)
-                        err = -ENODEV;
+                        return -ENODEV;
-                        goto out_unlock;
-                }
                *rdev = wiphy_to_rdev(wiphy);
                *wdev = NULL;
@@ -530,21 +524,11 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                        }
                }
-                if (!*wdev) {
+                if (!*wdev)
-                        err = -ENODEV;
+                        return -ENODEV;
-                        goto out_unlock;
-                }
        }
        return 0;
- out_unlock:
-        rtnl_unlock();
-        return err;
-}
-static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
-{
-        rtnl_unlock();
 }
 /* IE validation */
@@ -3884,9 +3868,10 @@ static int nl80211_dump_station(struct sk_buff *skb,
        int sta_idx = cb->args[2];
        int err;
+        rtnl_lock();
        err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
        if (err)
-                return err;
+                goto out_err;
        if (!wdev->netdev) {
                err = -EINVAL;
@@ -3922,7 +3907,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
        cb->args[2] = sta_idx;
        err = skb->len;
 out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
        return err;
 }
@@ -4639,9 +4624,10 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
        int path_idx = cb->args[2];
        int err;
+        rtnl_lock();
        err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
        if (err)
-                return err;
+                goto out_err;
        if (!rdev->ops->dump_mpath) {
                err = -EOPNOTSUPP;
@@ -4675,7 +4661,7 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
        cb->args[2] = path_idx;
        err = skb->len;
 out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
        return err;
 }
@@ -4835,9 +4821,10 @@ static int nl80211_dump_mpp(struct sk_buff *skb,
        int path_idx = cb->args[2];
        int err;
+        rtnl_lock();
        err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
        if (err)
-                return err;
+                goto out_err;
        if (!rdev->ops->dump_mpp) {
                err = -EOPNOTSUPP;
@@ -4870,7 +4857,7 @@ static int nl80211_dump_mpp(struct sk_buff *skb,
        cb->args[2] = path_idx;
        err = skb->len;
 out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
        return err;
 }
@@ -5718,6 +5705,10 @@ static int validate_scan_freqs(struct nlattr *freqs)
        struct nlattr *attr1, *attr2;
        int n_channels = 0, tmp1, tmp2;
+        nla_for_each_nested(attr1, freqs, tmp1)
+                if (nla_len(attr1) != sizeof(u32))
+                        return 0;
        nla_for_each_nested(attr1, freqs, tmp1) {
                n_channels++;
                /*
@@ -6806,9 +6797,12 @@ static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
        int start = cb->args[2], idx = 0;
        int err;
+        rtnl_lock();
        err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
-        if (err)
+        if (err) {
+                rtnl_unlock();
                return err;
+        }
        wdev_lock(wdev);
        spin_lock_bh(&rdev->bss_lock);
@@ -6831,7 +6825,7 @@ static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
        wdev_unlock(wdev);
        cb->args[2] = idx;
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
        return skb->len;
 }
@@ -6915,9 +6909,10 @@ static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
        int res;
        bool radio_stats;
+        rtnl_lock();
        res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
        if (res)
-                return res;
+                goto out_err;
        /* prepare_wdev_dump parsed the attributes */
        radio_stats = nl80211_fam.attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
@@ -6958,7 +6953,7 @@ static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
        cb->args[2] = survey_idx;
        res = skb->len;
 out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
        return res;
 }
@@ -10158,17 +10153,13 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
        void *data = NULL;
        unsigned int data_len = 0;
-        rtnl_lock();
        if (cb->args[0]) {
                /* subtract the 1 again here */
                struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
                struct wireless_dev *tmp;
-                if (!wiphy) {
+                if (!wiphy)
-                        err = -ENODEV;
+                        return -ENODEV;
-                        goto out_unlock;
-                }
                *rdev = wiphy_to_rdev(wiphy);
                *wdev = NULL;
@@ -10189,13 +10180,11 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
                          nl80211_fam.attrbuf, nl80211_fam.maxattr,
                          nl80211_policy);
        if (err)
-                goto out_unlock;
+                return err;
        if (!nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID] ||
-            !nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
+            !nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
-                err = -EINVAL;
+                return -EINVAL;
-                goto out_unlock;
-        }
        *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
                                           nl80211_fam.attrbuf);
@@ -10204,10 +10193,8 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
        *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
                                           nl80211_fam.attrbuf);
-        if (IS_ERR(*rdev)) {
+        if (IS_ERR(*rdev))
-                err = PTR_ERR(*rdev);
+                return PTR_ERR(*rdev);
-                goto out_unlock;
-        }
        vid = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID]);
        subcmd = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
@@ -10220,19 +10207,15 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
                if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
                        continue;
-                if (!vcmd->dumpit) {
+                if (!vcmd->dumpit)
-                        err = -EOPNOTSUPP;
+                        return -EOPNOTSUPP;
-                        goto out_unlock;
-                }
                vcmd_idx = i;
                break;
        }
-        if (vcmd_idx < 0) {
+        if (vcmd_idx < 0)
-                err = -EOPNOTSUPP;
+                return -EOPNOTSUPP;
-                goto out_unlock;
-        }
        if (nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]) {
                data = nla_data(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
@@ -10249,9 +10232,6 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
        /* keep rtnl locked in successful case */
        return 0;
- out_unlock:
-        rtnl_unlock();
-        return err;
 }
 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
@@ -10266,9 +10246,10 @@ static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
        int err;
        struct nlattr *vendor_data;
+        rtnl_lock();
        err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
        if (err)
-                return err;
+                goto out;
        vcmd_idx = cb->args[2];
        data = (void *)cb->args[3];
@@ -10277,18 +10258,26 @@ static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
        if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
                           WIPHY_VENDOR_CMD_NEED_NETDEV)) {
-                if (!wdev)
+                if (!wdev) {
-                        return -EINVAL;
+                        err = -EINVAL;
+                        goto out;
+                }
                if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
-                    !wdev->netdev)
+                    !wdev->netdev) {
-                        return -EINVAL;
+                        err = -EINVAL;
+                        goto out;
+                }
                if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
                        if (wdev->netdev &&
-                            !netif_running(wdev->netdev))
+                            !netif_running(wdev->netdev)) {
-                                return -ENETDOWN;
+                                err = -ENETDOWN;
-                        if (!wdev->netdev && !wdev->p2p_started)
+                                goto out;
-                                return -ENETDOWN;
+                        }
+                        if (!wdev->netdev && !wdev->p2p_started) {
+                                err = -ENETDOWN;
+                                goto out;
+                        }
                }
        }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index b5e665b3cfb0..77055a362041 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1216,7 +1216,7 @@ static inline int policy_to_flow_dir(int dir)
 }
 static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
-                                                 const struct flowi *fl)
+                                                 const struct flowi *fl, u16 family)
 {
        struct xfrm_policy *pol;
        struct net *net = sock_net(sk);
@@ -1225,8 +1225,7 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
        read_lock_bh(&net->xfrm.xfrm_policy_lock);
        pol = rcu_dereference(sk->sk_policy[dir]);
        if (pol != NULL) {
-                bool match = xfrm_selector_match(&pol->selector, fl,
+                bool match = xfrm_selector_match(&pol->selector, fl, family);
-                                                 sk->sk_family);
                int err = 0;
                if (match) {
@@ -1776,43 +1775,6 @@ free_dst:
        goto out;
 }
-#ifdef CONFIG_XFRM_SUB_POLICY
-static int xfrm_dst_alloc_copy(void **target, const void *src, int size)
-{
-        if (!*target) {
-                *target = kmalloc(size, GFP_ATOMIC);
-                if (!*target)
-                        return -ENOMEM;
-        }
-        memcpy(*target, src, size);
-        return 0;
-}
-#endif
-static int xfrm_dst_update_parent(struct dst_entry *dst,
-                                  const struct xfrm_selector *sel)
-{
-#ifdef CONFIG_XFRM_SUB_POLICY
-        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
-        return xfrm_dst_alloc_copy((void **)&(xdst->partner),
-                                   sel, sizeof(*sel));
-#else
-        return 0;
-#endif
-}
-static int xfrm_dst_update_origin(struct dst_entry *dst,
-                                  const struct flowi *fl)
-{
-#ifdef CONFIG_XFRM_SUB_POLICY
-        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
-        return xfrm_dst_alloc_copy((void **)&(xdst->origin), fl, sizeof(*fl));
-#else
-        return 0;
-#endif
-}
 static int xfrm_expand_policies(const struct flowi *fl, u16 family,
                                struct xfrm_policy **pols,
                                int *num_pols, int *num_xfrms)
@@ -1884,16 +1846,6 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
        xdst = (struct xfrm_dst *)dst;
        xdst->num_xfrms = err;
-        if (num_pols > 1)
-                err = xfrm_dst_update_parent(dst, &pols[1]->selector);
-        else
-                err = xfrm_dst_update_origin(dst, fl);
-        if (unlikely(err)) {
-                dst_free(dst);
-                XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR);
-                return ERR_PTR(err);
-        }
        xdst->num_pols = num_pols;
        memcpy(xdst->pols, pols, sizeof(struct xfrm_policy *) * num_pols);
        xdst->policy_genid = atomic_read(&pols[0]->genid);
@@ -2221,7 +2173,7 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
        sk = sk_const_to_full_sk(sk);
        if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
                num_pols = 1;
-                pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
+                pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl, family);
                err = xfrm_expand_policies(fl, family, pols,
                                           &num_pols, &num_xfrms);
                if (err < 0)
@@ -2500,7 +2452,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
        pol = NULL;
        sk = sk_to_full_sk(sk);
        if (sk && sk->sk_policy[dir]) {
-                pol = xfrm_sk_policy_lookup(sk, dir, &fl);
+                pol = xfrm_sk_policy_lookup(sk, dir, &fl, family);
                if (IS_ERR(pol)) {
                        XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
                        return 0;
@@ -3030,6 +2982,11 @@ static int __net_init xfrm_net_init(struct net *net)
 {
        int rv;
+        /* Initialize the per-net locks here */
+        spin_lock_init(&net->xfrm.xfrm_state_lock);
+        rwlock_init(&net->xfrm.xfrm_policy_lock);
+        mutex_init(&net->xfrm.xfrm_cfg_mutex);
        rv = xfrm_statistics_init(net);
        if (rv < 0)
                goto out_statistics;
@@ -3046,11 +3003,6 @@ static int __net_init xfrm_net_init(struct net *net)
        if (rv < 0)
                goto out;
-        /* Initialize the per-net locks here */
-        spin_lock_init(&net->xfrm.xfrm_state_lock);
-        rwlock_init(&net->xfrm.xfrm_policy_lock);
-        mutex_init(&net->xfrm.xfrm_cfg_mutex);
        return 0;
 out:
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 805681a7d356..7a5a64e70b4d 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -412,7 +412,14 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es
        up = nla_data(rp);
        ulen = xfrm_replay_state_esn_len(up);
-        if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen)
+        /* Check the overall length and the internal bitmap length to avoid
+         * potential overflow. */
+        if (nla_len(rp) < ulen ||
+            xfrm_replay_state_esn_len(replay_esn) != ulen ||
+            replay_esn->bmp_len != up->bmp_len)
+                return -EINVAL;
+        if (up->replay_window > up->bmp_len * sizeof(__u32) * 8)
                return -EINVAL;
        return 0;