diff --git a/controller/ofctrl.c b/controller/ofctrl.c
index a7c2d2011..17d40a708 100644
--- a/controller/ofctrl.c
+++ b/controller/ofctrl.c
@@ -943,7 +943,12 @@ link_installed_to_desired(struct installed_flow *i, struct desired_flow *d)
             break;
         }
     }
-    ovs_list_insert(&f->installed_ref_list_node, &d->installed_ref_list_node);
+    if (!f) {
+        ovs_list_insert(&i->desired_refs, &d->installed_ref_list_node);
+    } else {
+        ovs_list_insert(&f->installed_ref_list_node,
+                        &d->installed_ref_list_node);
+    }
     d->installed_flow = i;
     return installed_flow_get_active(i) == d;
 }
diff --git a/lib/actions.c b/lib/actions.c
index 7fe80f458..a3cf747db 100644
--- a/lib/actions.c
+++ b/lib/actions.c
@@ -2440,7 +2440,7 @@ validate_empty_lb_backends(struct action_context *ctx,
 
         switch (o->option->code) {
         case EMPTY_LB_VIP:
-            if (!inet_parse_active(c->string, 0, &ss, false)) {
+            if (!inet_parse_active(c->string, 0, &ss, false, NULL)) {
                 lexer_error(ctx->lexer, "Invalid load balancer VIP '%s'",
                             c->string);
                 return;
diff --git a/lib/expr.c b/lib/expr.c
index 47ef6108e..058390a16 100644
--- a/lib/expr.c
+++ b/lib/expr.c
@@ -211,16 +211,17 @@ expr_combine(enum expr_type type, struct expr *a, struct expr *b)
 }
 
 static void
-expr_insert_andor(struct expr *andor, struct expr *before, struct expr *new)
+expr_insert_andor(struct expr *andor, struct ovs_list *before,
+                  struct expr *new)
 {
     if (new->type == andor->type) {
         if (andor->type == EXPR_T_AND) {
             /* Conjunction junction, what's your function? */
         }
-        ovs_list_splice(&before->node, new->andor.next, &new->andor);
+        ovs_list_splice(before, new->andor.next, &new->andor);
         expr_destroy(new);
     } else {
-        ovs_list_insert(&before->node, &new->node);
+        ovs_list_insert(before, &new->node);
     }
 }
 
@@ -2101,7 +2102,8 @@ expr_annotate__(struct expr *expr, const struct shash *symtab,
                 expr_destroy(expr);
                 return NULL;
             }
-            expr_insert_andor(expr, next, new_sub);
+            expr_insert_andor(expr, next ? &next->node : &expr->andor,
+                              new_sub);
         }
         *errorp = NULL;
         return expr;
@@ -2301,7 +2303,7 @@ expr_evaluate_condition(struct expr *expr,
             struct expr *e = expr_evaluate_condition(sub, is_chassis_resident,
                                                      c_aux);
             e = expr_fix(e);
-            expr_insert_andor(expr, next, e);
+            expr_insert_andor(expr, next ? &next->node : &expr->andor, e);
         }
         return expr_fix(expr);
 
@@ -2334,7 +2336,8 @@ expr_simplify(struct expr *expr)
     case EXPR_T_OR:
         LIST_FOR_EACH_SAFE (sub, next, node, &expr->andor) {
             ovs_list_remove(&sub->node);
-            expr_insert_andor(expr, next, expr_simplify(sub));
+            expr_insert_andor(expr, next ? &next->node : &expr->andor,
+                              expr_simplify(sub));
         }
         return expr_fix(expr);
 
@@ -2444,12 +2447,13 @@ crush_and_string(struct expr *expr, const struct expr_symbol *symbol)
      * EXPR_T_OR with EXPR_T_CMP subexpressions. */
     struct expr *sub, *next = NULL;
     LIST_FOR_EACH_SAFE (sub, next, node, &expr->andor) {
+        struct ovs_list *next_list = next ? &next->node : &expr->andor;
         ovs_list_remove(&sub->node);
         struct expr *new = crush_cmps(sub, symbol);
         switch (new->type) {
         case EXPR_T_CMP:
             if (!singleton) {
-                ovs_list_insert(&next->node, &new->node);
+                ovs_list_insert(next_list, &new->node);
                 singleton = new;
             } else {
                 bool match = !strcmp(new->cmp.string, singleton->cmp.string);
@@ -2463,7 +2467,7 @@ crush_and_string(struct expr *expr, const struct expr_symbol *symbol)
         case EXPR_T_AND:
             OVS_NOT_REACHED();
         case EXPR_T_OR:
-            ovs_list_insert(&next->node, &new->node);
+            ovs_list_insert(next_list, &new->node);
             break;
         case EXPR_T_BOOLEAN:
             if (!new->boolean) {
@@ -2559,7 +2563,7 @@ crush_and_numeric(struct expr *expr, const struct expr_symbol *symbol)
         case EXPR_T_AND:
             OVS_NOT_REACHED();
         case EXPR_T_OR:
-            ovs_list_insert(&next->node, &new->node);
+            ovs_list_insert(next ? &next->node : &expr->andor, &new->node);
             break;
         case EXPR_T_BOOLEAN:
             if (!new->boolean) {
@@ -2725,7 +2729,8 @@ crush_or(struct expr *expr, const struct expr_symbol *symbol)
      * is now a disjunction of cmps over the same symbol. */
     LIST_FOR_EACH_SAFE (sub, next, node, &expr->andor) {
         ovs_list_remove(&sub->node);
-        expr_insert_andor(expr, next, crush_cmps(sub, symbol));
+        expr_insert_andor(expr, next ? &next->node : &expr->andor,
+                          crush_cmps(sub, symbol));
     }
     expr = expr_fix(expr);
     if (expr->type != EXPR_T_OR) {
@@ -2886,8 +2891,7 @@ expr_normalize_and(struct expr *expr)
 
     struct expr *a, *b;
     LIST_FOR_EACH_SAFE (a, b, node, &expr->andor) {
-        if (&b->node == &expr->andor
-            || a->type != EXPR_T_CMP || b->type != EXPR_T_CMP
+        if (!b || a->type != EXPR_T_CMP || b->type != EXPR_T_CMP
             || a->cmp.symbol != b->cmp.symbol) {
             continue;
         } else if (a->cmp.symbol->width
@@ -2964,7 +2968,8 @@ expr_normalize_or(struct expr *expr)
                 }
                 expr_destroy(new);
             } else {
-                expr_insert_andor(expr, next, new);
+                expr_insert_andor(expr, next ? &next->node : &expr->andor,
+                                  new);
             }
         } else {
             ovs_assert(sub->type == EXPR_T_CMP ||
diff --git a/lib/ovn-util.c b/lib/ovn-util.c
index a6bb5f03e..81f18d6df 100644
--- a/lib/ovn-util.c
+++ b/lib/ovn-util.c
@@ -735,7 +735,7 @@ ip_address_and_port_from_lb_key(const char *key, char **ip_address,
                                 uint16_t *port, int *addr_family)
 {
     struct sockaddr_storage ss;
-    if (!inet_parse_active(key, 0, &ss, false)) {
+    if (!inet_parse_active(key, 0, &ss, false, NULL)) {
         static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1);
         VLOG_WARN_RL(&rl, "bad ip address or port for load balancer key %s",
                      key);
diff --git a/ovs b/ovs
index 498cedc48..b16270e69 160000
--- a/ovs
+++ b/ovs
@@ -1 +1 @@
-Subproject commit 498cedc483f3239c839c55b4d9f2261b61fb6ace
+Subproject commit b16270e69b9c72284fe6f0ab186ce17e41d7af7a
diff --git a/utilities/ovn-nbctl.c b/utilities/ovn-nbctl.c
index 7bcc2c66a..7fcfa50d4 100644
--- a/utilities/ovn-nbctl.c
+++ b/utilities/ovn-nbctl.c
@@ -2856,7 +2856,7 @@ nbctl_lb_add(struct ctl_context *ctx)
     }
 
     struct sockaddr_storage ss_vip;
-    if (!inet_parse_active(lb_vip, 0, &ss_vip, false)) {
+    if (!inet_parse_active(lb_vip, 0, &ss_vip, false, NULL)) {
         ctl_error(ctx, "%s: should be an IP address (or an IP address "
                   "and a port number with : as a separator).", lb_vip);
         return;
@@ -2886,7 +2886,7 @@ nbctl_lb_add(struct ctl_context *ctx)
         struct sockaddr_storage ss_dst;
 
         if (lb_vip_port) {
-            if (!inet_parse_active(token, -1, &ss_dst, false)) {
+            if (!inet_parse_active(token, -1, &ss_dst, false, NULL)) {
                 ctl_error(ctx, "%s: should be an IP address and a port "
                           "number with : as a separator.", token);
                 goto out;
@@ -3032,7 +3032,7 @@ lb_info_add_smap(const struct nbrec_load_balancer *lb,
             const struct smap_node *node = nodes[i];
 
             struct sockaddr_storage ss;
-            if (!inet_parse_active(node->key, 0, &ss, false)) {
+            if (!inet_parse_active(node->key, 0, &ss, false, NULL)) {
                 continue;
             }
 
diff --git a/utilities/ovn-trace.c b/utilities/ovn-trace.c
index 4b652828d..9822618ae 100644
--- a/utilities/ovn-trace.c
+++ b/utilities/ovn-trace.c
@@ -214,7 +214,7 @@ static void
 parse_lb_option(const char *s)
 {
     struct sockaddr_storage ss;
-    if (!inet_parse_active(s, 0, &ss, false)) {
+    if (!inet_parse_active(s, 0, &ss, false, NULL)) {
         ovs_fatal(0, "%s: bad address", s);
     }
 
@@ -1388,7 +1388,8 @@ ovntrace_node_prune_summary(struct ovs_list *nodes)
             sub->type == OVNTRACE_NODE_TABLE) {
             /* Replace 'sub' by its children, if any, */
             ovs_list_remove(&sub->node);
-            ovs_list_splice(&next->node, sub->subs.next, &sub->subs);
+            ovs_list_splice(next ? &next->node : nodes, sub->subs.next,
+                            &sub->subs);
             ovntrace_node_destroy(sub);
         }
     }
@@ -1432,7 +1433,8 @@ ovntrace_node_prune_hard(struct ovs_list *nodes)
             sub->type == OVNTRACE_NODE_OUTPUT) {
             /* Replace 'sub' by its children, if any, */
             ovs_list_remove(&sub->node);
-            ovs_list_splice(&next->node, sub->subs.next, &sub->subs);
+            ovs_list_splice(next ? &next->node : nodes, sub->subs.next,
+                            &sub->subs);
             ovntrace_node_destroy(sub);
         }
     }
