diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch
old mode 100644
new mode 100755
index e077acf..bb06dff
--- a/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/1113-mt76-mt7915-drop-packets-when-TWT-stations-use-more-.patch
@@ -1,19 +1,21 @@
-From 23de5ffe66f73e5fbd22a441f7ca1f612f1bd158 Mon Sep 17 00:00:00 2001
-From: Peter Chiu <chui-hao.chiu@mediatek.com>
-Date: Wed, 22 Jun 2022 10:58:37 +0800
-Subject: [PATCH 1113/1115] mt76: mt7915: drop packets when TWT stations use
- more tokens than 128
+From 9bc707077df60aa6423c89b1d17fd8a5f4e2d36b Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Mon, 4 Jul 2022 19:24:34 +0800
+Subject: [PATCH] mt76: mt7915: drop packets when TWT stations use
 
 ---
  mt7915/mac.c    | 21 ++++++++++++++++++---
  mt7915/mt7915.h |  2 ++
  2 files changed, 20 insertions(+), 3 deletions(-)
+ mode change 100644 => 100755 mt7915/mac.c
 
 diff --git a/mt7915/mac.c b/mt7915/mac.c
-index 8fd4618..fd0dd50 100644
+old mode 100644
+new mode 100755
+index 5e5df23d..55b38d16
 --- a/mt7915/mac.c
 +++ b/mt7915/mac.c
-@@ -724,6 +724,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -725,6 +725,7 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
  	struct ieee80211_key_conf *key = info->control.hw_key;
  	struct ieee80211_vif *vif = info->control.vif;
@@ -21,7 +23,7 @@
  	struct mt76_connac_fw_txp *txp;
  	struct mt76_txwi_cache *t;
  	int id, i, nbuf = tx_info->nbuf - 1;
-@@ -737,8 +738,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -738,8 +739,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  		wcid = &dev->mt76.global_wcid;
  
  	if (sta) {
@@ -30,7 +32,7 @@
  		msta = (struct mt7915_sta *)sta->drv_priv;
  
  		if (time_after(jiffies, msta->jiffies + HZ / 4)) {
-@@ -754,10 +753,22 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+@@ -755,10 +754,22 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
  	    mgmt->u.action.category == 0xff)
  		return -1;
  
@@ -51,9 +53,9 @@
 +	spin_unlock_bh(&mdev->token_lock);
 +
  	pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb);
- 	mt7915_mac_write_txwi(mdev, txwi_ptr, tx_info->skb, wcid, pid, key, 0);
- 
-@@ -937,6 +948,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+ 	mt7915_mac_write_txwi(mdev, txwi_ptr, tx_info->skb, wcid, pid, key,
+ 			      qid, 0);
+@@ -939,6 +950,7 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  	struct mt76_dev *mdev = &dev->mt76;
  	struct mt76_txwi_cache *txwi;
  	struct ieee80211_sta *sta = NULL;
@@ -61,7 +63,7 @@
  	LIST_HEAD(free_list);
  	void *end = data + len;
  	bool v3, wake = false;
-@@ -960,7 +972,6 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -962,7 +974,6 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  		 * 1'b0: msdu_id with the same 'wcid pair' as above.
  		 */
  		if (info & MT_TX_FREE_PAIR) {
@@ -69,7 +71,7 @@
  			struct mt76_wcid *wcid;
  			u16 idx;
  
-@@ -993,6 +1004,10 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
+@@ -995,6 +1006,10 @@ mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
  			txwi = mt76_token_release(mdev, msdu, &wake);
  			if (!txwi)
  				continue;
@@ -81,7 +83,7 @@
  			mt7915_txwi_free(dev, txwi, sta, &free_list);
  		}
 diff --git a/mt7915/mt7915.h b/mt7915/mt7915.h
-index ff92e55..6235014 100644
+index 7c7d6bd3..5f11b3fb 100644
 --- a/mt7915/mt7915.h
 +++ b/mt7915/mt7915.h
 @@ -136,6 +136,8 @@ struct mt7915_sta {
diff --git a/autobuild_mac80211_release/target/linux/mediatek/patches-5.4/9990-mt7622-backport-nf-hw-offload-framework-and-ups.patch b/autobuild_mac80211_release/target/linux/mediatek/patches-5.4/9990-mt7622-backport-nf-hw-offload-framework-and-ups.patch
index fee4d12..6b40b56 100755
--- a/autobuild_mac80211_release/target/linux/mediatek/patches-5.4/9990-mt7622-backport-nf-hw-offload-framework-and-ups.patch
+++ b/autobuild_mac80211_release/target/linux/mediatek/patches-5.4/9990-mt7622-backport-nf-hw-offload-framework-and-ups.patch
@@ -2261,7 +2261,7 @@
  
  int nf_conntrack_acct_init(void);
 diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
-index b37a7d608..7cf897677 100644
+index 68d7fc92..7cf89767 100644
 --- a/include/net/netfilter/nf_flow_table.h
 +++ b/include/net/netfilter/nf_flow_table.h
 @@ -8,31 +8,99 @@
@@ -2365,7 +2365,7 @@
  
  struct flow_offload_tuple {
  	union {
-@@ -52,11 +120,31 @@ struct flow_offload_tuple {
+@@ -52,13 +120,30 @@ struct flow_offload_tuple {
  
  	u8				l3proto;
  	u8				l4proto;
@@ -2379,7 +2379,9 @@
 +	/* All members above are keys for lookups, see flow_offload_hash(). */
 +	struct { }			__hash;
  
--	struct dst_entry		*dst_cache;
+-	struct {
+-		struct dst_entry *dst_cache;
+-		u32		dst_cookie;
 +	u8				dir:2,
 +					xmit_type:2,
 +					encap_num:2,
@@ -2396,11 +2398,10 @@
 +			u8		h_source[ETH_ALEN];
 +			u8		h_dest[ETH_ALEN];
 +		} out;
-+	};
+ 	};
  };
  
- struct flow_offload_tuple_rhash {
-@@ -64,52 +152,139 @@ struct flow_offload_tuple_rhash {
+@@ -67,52 +152,139 @@ struct flow_offload_tuple_rhash {
  	struct flow_offload_tuple	tuple;
  };
  
@@ -2562,7 +2563,7 @@
  
  struct flow_ports {
  	__be16 source, dest;
-@@ -123,4 +298,41 @@ unsigned int nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
+@@ -126,4 +298,41 @@ unsigned int nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
  #define MODULE_ALIAS_NF_FLOWTABLE(family)	\
  	MODULE_ALIAS("nf-flowtable-" __stringify(family))
  
@@ -3400,10 +3401,10 @@
  	nf_conntrack_standalone_init_tcp_sysctl(net, table);
  	nf_conntrack_standalone_init_sctp_sysctl(net, table);
 diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
-index e1ffc66b8..103655813 100644
+index f212cec0..10365581 100644
 --- a/net/netfilter/nf_flow_table_core.c
 +++ b/net/netfilter/nf_flow_table_core.c
-@@ -7,31 +7,21 @@
+@@ -7,43 +7,21 @@
  #include <linux/netdevice.h>
  #include <net/ip.h>
  #include <net/ip6_route.h>
@@ -3423,6 +3424,18 @@
  static DEFINE_MUTEX(flowtable_lock);
  static LIST_HEAD(flowtables);
  
+-static u32 flow_offload_dst_cookie(struct flow_offload_tuple *flow_tuple)
+-{
+-	const struct rt6_info *rt;
+-
+-	if (flow_tuple->l3proto == NFPROTO_IPV6) {
+-		rt = (const struct rt6_info *)flow_tuple->dst_cache;
+-		return rt6_get_cookie(rt);
+-	}
+-
+-	return 0;
+-}
+-
  static void
 -flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
 -		      struct nf_flow_route *route,
@@ -3437,7 +3450,7 @@
  
  	ft->dir = dir;
  
-@@ -39,12 +29,10 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
+@@ -51,12 +29,10 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
  	case NFPROTO_IPV4:
  		ft->src_v4 = ctt->src.u3.in;
  		ft->dst_v4 = ctt->dst.u3.in;
@@ -3450,13 +3463,14 @@
  		break;
  	}
  
-@@ -52,49 +40,32 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
+@@ -64,50 +40,32 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
  	ft->l4proto = ctt->dst.protonum;
  	ft->src_port = ctt->src.u.tcp.port;
  	ft->dst_port = ctt->dst.u.tcp.port;
 -
 -	ft->iifidx = other_dst->dev->ifindex;
 -	ft->dst_cache = dst;
+-	ft->dst_cookie = flow_offload_dst_cookie(ft);
  }
  
 -struct flow_offload *
@@ -3477,14 +3491,14 @@
  		goto err_ct_refcnt;
  
 -	flow = &entry->flow;
-+	flow->ct = ct;
- 
+-
 -	if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst))
 -		goto err_dst_cache_original;
 -
 -	if (!dst_hold_safe(route->tuple[FLOW_OFFLOAD_DIR_REPLY].dst))
 -		goto err_dst_cache_reply;
--
++	flow->ct = ct;
+ 
 -	entry->ct = ct;
 -
 -	flow_offload_fill_dir(flow, ct, route, FLOW_OFFLOAD_DIR_ORIGINAL);
@@ -3508,7 +3522,7 @@
  err_ct_refcnt:
  	nf_ct_put(ct);
  
-@@ -102,40 +73,135 @@ err_ct_refcnt:
+@@ -115,40 +73,135 @@ flow_offload_alloc(struct nf_conn *ct, struct nf_flow_route *route)
  }
  EXPORT_SYMBOL_GPL(flow_offload_alloc);
  
@@ -3579,8 +3593,7 @@
 +		break;
 +	}
 +	flow_tuple->xmit_type = route->tuple[dir].xmit_type;
- 
--static inline __s32 nf_flow_timeout_delta(unsigned int timeout)
++
 +	return 0;
 +}
 +
@@ -3615,7 +3628,8 @@
 +	return err;
 +}
 +EXPORT_SYMBOL_GPL(flow_offload_route_init);
-+
+ 
+-static inline __s32 nf_flow_timeout_delta(unsigned int timeout)
 +static void flow_offload_fixup_tcp(struct ip_ct_tcp *tcp)
  {
 -	return (__s32)(timeout - (u32)jiffies);
@@ -3664,7 +3678,7 @@
  }
  
  static void flow_offload_fixup_ct_state(struct nf_conn *ct)
-@@ -150,17 +216,23 @@ static void flow_offload_fixup_ct(struct nf_conn *ct)
+@@ -163,17 +216,23 @@ static void flow_offload_fixup_ct(struct nf_conn *ct)
  	flow_offload_fixup_ct_timeout(ct);
  }
  
@@ -3697,7 +3711,7 @@
  }
  EXPORT_SYMBOL_GPL(flow_offload_free);
  
-@@ -168,14 +240,14 @@ static u32 flow_offload_hash(const void *data, u32 len, u32 seed)
+@@ -181,14 +240,14 @@ static u32 flow_offload_hash(const void *data, u32 len, u32 seed)
  {
  	const struct flow_offload_tuple *tuple = data;
  
@@ -3714,7 +3728,7 @@
  }
  
  static int flow_offload_hash_cmp(struct rhashtable_compare_arg *arg,
-@@ -184,7 +256,7 @@ static int flow_offload_hash_cmp(struct rhashtable_compare_arg *arg,
+@@ -197,7 +256,7 @@ static int flow_offload_hash_cmp(struct rhashtable_compare_arg *arg,
  	const struct flow_offload_tuple *tuple = arg->key;
  	const struct flow_offload_tuple_rhash *x = ptr;
  
@@ -3723,7 +3737,7 @@
  		return 1;
  
  	return 0;
-@@ -198,30 +270,30 @@ static const struct rhashtable_params nf_flow_offload_rhash_params = {
+@@ -211,30 +270,30 @@ static const struct rhashtable_params nf_flow_offload_rhash_params = {
  	.automatic_shrinking	= true,
  };
  
@@ -3741,21 +3755,21 @@
 +	unsigned long timeout = NF_FLOW_TIMEOUT;
 +	struct net *net = nf_ct_net(flow->ct);
 +	int l4num = nf_ct_protonum(flow->ct);
-+
-+	if (l4num == IPPROTO_TCP) {
-+		struct nf_tcp_net *tn = nf_tcp_pernet(net);
  
 -	entry = container_of(flow, struct flow_offload_entry, flow);
 -	ct = entry->ct;
++	if (l4num == IPPROTO_TCP) {
++		struct nf_tcp_net *tn = nf_tcp_pernet(net);
+ 
+-	if (nf_ct_expires(ct) < DAY / 2)
+-		ct->timeout = nfct_time_stamp + DAY;
 +		timeout = tn->offload_timeout;
 +	} else if (l4num == IPPROTO_UDP) {
 +		struct nf_udp_net *tn = nf_udp_pernet(net);
 +
 +		timeout = tn->offload_timeout;
 +	}
- 
--	if (nf_ct_expires(ct) < DAY / 2)
--		ct->timeout = nfct_time_stamp + DAY;
++
 +	return timeout;
  }
  
@@ -3769,7 +3783,7 @@
  
  	err = rhashtable_insert_fast(&flow_table->rhashtable,
  				     &flow->tuplehash[0].node,
-@@ -239,10 +311,35 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
+@@ -252,10 +311,35 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
  		return err;
  	}
  
@@ -3805,7 +3819,7 @@
  static inline bool nf_flow_has_expired(const struct flow_offload *flow)
  {
  	return nf_flow_timeout_delta(flow->timeout) <= 0;
-@@ -251,8 +348,6 @@ static inline bool nf_flow_has_expired(const struct flow_offload *flow)
+@@ -264,8 +348,6 @@ static inline bool nf_flow_has_expired(const struct flow_offload *flow)
  static void flow_offload_del(struct nf_flowtable *flow_table,
  			     struct flow_offload *flow)
  {
@@ -3814,7 +3828,7 @@
  	rhashtable_remove_fast(&flow_table->rhashtable,
  			       &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node,
  			       nf_flow_offload_rhash_params);
-@@ -260,28 +355,21 @@ static void flow_offload_del(struct nf_flowtable *flow_table,
+@@ -273,28 +355,21 @@ static void flow_offload_del(struct nf_flowtable *flow_table,
  			       &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node,
  			       nf_flow_offload_rhash_params);
  
@@ -3839,17 +3853,17 @@
  void flow_offload_teardown(struct flow_offload *flow)
  {
 -	struct flow_offload_entry *e;
+-
+-	flow->flags |= FLOW_OFFLOAD_TEARDOWN;
 +	set_bit(NF_FLOW_TEARDOWN, &flow->flags);
  
--	flow->flags |= FLOW_OFFLOAD_TEARDOWN;
--
 -	e = container_of(flow, struct flow_offload_entry, flow);
 -	flow_offload_fixup_ct_state(e->ct);
 +	flow_offload_fixup_ct_state(flow->ct);
  }
  EXPORT_SYMBOL_GPL(flow_offload_teardown);
  
-@@ -291,7 +379,6 @@ flow_offload_lookup(struct nf_flowtable *flow_table,
+@@ -304,7 +379,6 @@ flow_offload_lookup(struct nf_flowtable *flow_table,
  {
  	struct flow_offload_tuple_rhash *tuplehash;
  	struct flow_offload *flow;
@@ -3857,7 +3871,7 @@
  	int dir;
  
  	tuplehash = rhashtable_lookup(&flow_table->rhashtable, tuple,
-@@ -301,19 +388,17 @@ flow_offload_lookup(struct nf_flowtable *flow_table,
+@@ -314,19 +388,17 @@ flow_offload_lookup(struct nf_flowtable *flow_table,
  
  	dir = tuplehash->tuple.dir;
  	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
@@ -3880,7 +3894,7 @@
  		      void (*iter)(struct flow_offload *flow, void *data),
  		      void *data)
  {
-@@ -326,7 +411,6 @@ nf_flow_table_iterate(struct nf_flowtable *flow_table,
+@@ -339,7 +411,6 @@ nf_flow_table_iterate(struct nf_flowtable *flow_table,
  	rhashtable_walk_start(&hti);
  
  	while ((tuplehash = rhashtable_walk_next(&hti))) {
@@ -3888,7 +3902,7 @@
  		if (IS_ERR(tuplehash)) {
  			if (PTR_ERR(tuplehash) != -EAGAIN) {
  				err = PTR_ERR(tuplehash);
-@@ -346,23 +430,49 @@ nf_flow_table_iterate(struct nf_flowtable *flow_table,
+@@ -359,23 +430,49 @@ nf_flow_table_iterate(struct nf_flowtable *flow_table,
  
  	return err;
  }
@@ -3949,7 +3963,7 @@
  }
  
  static void nf_flow_offload_work_gc(struct work_struct *work)
-@@ -374,30 +484,20 @@ static void nf_flow_offload_work_gc(struct work_struct *work)
+@@ -387,30 +484,20 @@ static void nf_flow_offload_work_gc(struct work_struct *work)
  	queue_delayed_work(system_power_efficient_wq, &flow_table->gc_work, HZ);
  }
  
@@ -3984,7 +3998,7 @@
  	udph = (void *)(skb_network_header(skb) + thoff);
  	if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
  		inet_proto_csum_replace2(&udph->check, skb, port,
-@@ -405,38 +505,28 @@ static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff,
+@@ -418,38 +505,28 @@ static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff,
  		if (!udph->check)
  			udph->check = CSUM_MANGLED_0;
  	}
@@ -4030,7 +4044,7 @@
  	hdr = (void *)(skb_network_header(skb) + thoff);
  
  	switch (dir) {
-@@ -450,25 +540,19 @@ int nf_flow_snat_port(const struct flow_offload *flow,
+@@ -463,25 +540,19 @@ int nf_flow_snat_port(const struct flow_offload *flow,
  		new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port;
  		hdr->dest = new_port;
  		break;
@@ -4060,7 +4074,7 @@
  	hdr = (void *)(skb_network_header(skb) + thoff);
  
  	switch (dir) {
-@@ -482,11 +566,9 @@ int nf_flow_dnat_port(const struct flow_offload *flow,
+@@ -495,11 +566,9 @@ int nf_flow_dnat_port(const struct flow_offload *flow,
  		new_port = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port;
  		hdr->source = new_port;
  		break;
@@ -4073,7 +4087,7 @@
  }
  EXPORT_SYMBOL_GPL(nf_flow_dnat_port);
  
-@@ -494,7 +576,9 @@ int nf_flow_table_init(struct nf_flowtable *flowtable)
+@@ -507,7 +576,9 @@ int nf_flow_table_init(struct nf_flowtable *flowtable)
  {
  	int err;
  
@@ -4084,7 +4098,7 @@
  
  	err = rhashtable_init(&flowtable->rhashtable,
  			      &nf_flow_offload_rhash_params);
-@@ -515,25 +599,24 @@ EXPORT_SYMBOL_GPL(nf_flow_table_init);
+@@ -528,25 +599,24 @@ EXPORT_SYMBOL_GPL(nf_flow_table_init);
  static void nf_flow_table_do_cleanup(struct flow_offload *flow, void *data)
  {
  	struct net_device *dev = data;
@@ -4116,7 +4130,7 @@
  }
  
  void nf_flow_table_cleanup(struct net_device *dev)
-@@ -542,7 +625,7 @@ void nf_flow_table_cleanup(struct net_device *dev)
+@@ -555,7 +625,7 @@ void nf_flow_table_cleanup(struct net_device *dev)
  
  	mutex_lock(&flowtable_lock);
  	list_for_each_entry(flowtable, &flowtables, list)
@@ -4125,7 +4139,7 @@
  	mutex_unlock(&flowtable_lock);
  }
  EXPORT_SYMBOL_GPL(nf_flow_table_cleanup);
-@@ -552,9 +635,14 @@ void nf_flow_table_free(struct nf_flowtable *flow_table)
+@@ -565,9 +635,14 @@ void nf_flow_table_free(struct nf_flowtable *flow_table)
  	mutex_lock(&flowtable_lock);
  	list_del(&flow_table->list);
  	mutex_unlock(&flowtable_lock);
@@ -4140,7 +4154,7 @@
  	rhashtable_destroy(&flow_table->rhashtable);
  }
  EXPORT_SYMBOL_GPL(nf_flow_table_free);
-@@ -578,12 +666,23 @@ static struct notifier_block flow_offload_netdev_notifier = {
+@@ -591,12 +666,23 @@ static struct notifier_block flow_offload_netdev_notifier = {
  
  static int __init nf_flow_table_module_init(void)
  {
@@ -4165,13 +4179,13 @@
  }
  
  module_init(nf_flow_table_module_init);
-@@ -591,3 +690,4 @@ module_exit(nf_flow_table_module_exit);
+@@ -604,3 +690,4 @@ module_exit(nf_flow_table_module_exit);
  
  MODULE_LICENSE("GPL");
  MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
 +MODULE_DESCRIPTION("Netfilter flow table module");
 diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
-index e92aa6b7e..6257d87c3 100644
+index 397129b2..6257d87c 100644
 --- a/net/netfilter/nf_flow_table_ip.c
 +++ b/net/netfilter/nf_flow_table_ip.c
 @@ -7,11 +7,13 @@
@@ -4425,22 +4439,7 @@
  
  	return 0;
  }
-@@ -215,14 +227,6 @@ static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
- 	return true;
- }
- 
--static int nf_flow_offload_dst_check(struct dst_entry *dst)
--{
--	if (unlikely(dst_xfrm(dst)))
--		return dst_check(dst, 0) ? 0 : -1;
--
--	return 0;
--}
--
- static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb,
- 				      const struct nf_hook_state *state,
- 				      struct dst_entry *dst)
-@@ -233,6 +237,75 @@ static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb,
+@@ -225,6 +237,75 @@ static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb,
  	return NF_STOLEN;
  }
  
@@ -4516,7 +4515,7 @@
  unsigned int
  nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
  			const struct nf_hook_state *state)
-@@ -243,15 +316,18 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
+@@ -235,15 +316,18 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
  	enum flow_offload_tuple_dir dir;
  	struct flow_offload *flow;
  	struct net_device *outdev;
@@ -4538,7 +4537,7 @@
  		return NF_ACCEPT;
  
  	tuplehash = flow_offload_lookup(flow_table, &tuple);
-@@ -260,75 +336,80 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
+@@ -252,75 +336,80 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
  
  	dir = tuplehash->tuple.dir;
  	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
@@ -4547,17 +4546,17 @@
 -
 -	if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
 -		return NF_ACCEPT;
--
+ 
 -	if (skb_try_make_writable(skb, sizeof(*iph)))
 -		return NF_DROP;
- 
+-
 -	thoff = ip_hdr(skb)->ihl * 4;
 -	if (nf_flow_state_check(flow, ip_hdr(skb)->protocol, skb, thoff))
 +	mtu = flow->tuplehash[dir].tuple.mtu + offset;
 +	if (unlikely(nf_flow_exceeds_mtu(skb, mtu)))
  		return NF_ACCEPT;
  
--	if (nf_flow_offload_dst_check(&rt->dst)) {
+-	if (!dst_check(&rt->dst, 0)) {
 -		flow_offload_teardown(flow);
 +	iph = (struct iphdr *)(skb_network_header(skb) + offset);
 +	thoff = (iph->ihl * 4) + offset;
@@ -4656,7 +4655,7 @@
  	udph = (void *)(skb_network_header(skb) + thoff);
  	if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
  		inet_proto_csum_replace16(&udph->check, skb, addr->s6_addr32,
-@@ -336,32 +417,26 @@ static int nf_flow_nat_ipv6_udp(struct sk_buff *skb, unsigned int thoff,
+@@ -328,32 +417,26 @@ static int nf_flow_nat_ipv6_udp(struct sk_buff *skb, unsigned int thoff,
  		if (!udph->check)
  			udph->check = CSUM_MANGLED_0;
  	}
@@ -4698,7 +4697,7 @@
  {
  	struct in6_addr addr, new_addr;
  
-@@ -376,17 +451,15 @@ static int nf_flow_snat_ipv6(const struct flow_offload *flow,
+@@ -368,17 +451,15 @@ static int nf_flow_snat_ipv6(const struct flow_offload *flow,
  		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6;
  		ip6h->daddr = new_addr;
  		break;
@@ -4721,7 +4720,7 @@
  {
  	struct in6_addr addr, new_addr;
  
-@@ -401,56 +474,60 @@ static int nf_flow_dnat_ipv6(const struct flow_offload *flow,
+@@ -393,56 +474,60 @@ static int nf_flow_dnat_ipv6(const struct flow_offload *flow,
  		new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6;
  		ip6h->saddr = new_addr;
  		break;
@@ -4807,7 +4806,7 @@
  	ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
  
  	tuple->src_v6		= ip6h->saddr;
-@@ -460,6 +537,7 @@ static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
+@@ -452,6 +537,7 @@ static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
  	tuple->l3proto		= AF_INET6;
  	tuple->l4proto		= ip6h->nexthdr;
  	tuple->iifidx		= dev->ifindex;
@@ -4815,7 +4814,7 @@
  
  	return 0;
  }
-@@ -475,13 +553,17 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
+@@ -467,13 +553,17 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
  	const struct in6_addr *nexthop;
  	struct flow_offload *flow;
  	struct net_device *outdev;
@@ -4835,30 +4834,30 @@
  		return NF_ACCEPT;
  
  	tuplehash = flow_offload_lookup(flow_table, &tuple);
-@@ -490,44 +572,57 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
+@@ -482,44 +572,57 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
  
  	dir = tuplehash->tuple.dir;
  	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
 -	rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache;
 -	outdev = rt->dst.dev;
--
--	if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
--		return NF_ACCEPT;
  
--	if (nf_flow_state_check(flow, ipv6_hdr(skb)->nexthdr, skb,
--				sizeof(*ip6h)))
+-	if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
 +	mtu = flow->tuplehash[dir].tuple.mtu + offset;
 +	if (unlikely(nf_flow_exceeds_mtu(skb, mtu)))
  		return NF_ACCEPT;
  
--	if (nf_flow_offload_dst_check(&rt->dst)) {
--		flow_offload_teardown(flow);
+-	if (nf_flow_state_check(flow, ipv6_hdr(skb)->nexthdr, skb,
+-				sizeof(*ip6h)))
 +	ip6h = (struct ipv6hdr *)(skb_network_header(skb) + offset);
 +	thoff = sizeof(*ip6h) + offset;
 +	if (nf_flow_state_check(flow, ip6h->nexthdr, skb, thoff))
  		return NF_ACCEPT;
--	}
  
+-	if (!dst_check(&rt->dst, tuplehash->tuple.dst_cookie)) {
+-		flow_offload_teardown(flow);
+-		return NF_ACCEPT;
+-	}
+-
 -	if (skb_try_make_writable(skb, sizeof(*ip6h)))
 +	if (skb_try_make_writable(skb, thoff + hdrsize))
  		return NF_DROP;