grsecurity-3.1-4.3.5-20160131161120160131

12 files changed, 309 insertions, 2979 deletions

diff --git a/4.3.4/1003_linux-4.3.4.patch b/4.3.4/1003_linux-4.3.4.patch
deleted file mode 100644
index 0e103a4..0000000
--- a/4.3.4/1003_linux-4.3.4.patch
+++ /dev/null
@@ -1,1863 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 2070d16..69430ed 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 3
--SUBLEVEL = 3
-+SUBLEVEL = 4
- EXTRAVERSION =
- NAME = Blurry Fish Butt
- 
-diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
-index 739a4a6..2f6e3c6 100644
---- a/drivers/acpi/osl.c
-+++ b/drivers/acpi/osl.c
-@@ -81,6 +81,7 @@ static struct workqueue_struct *kacpid_wq;
- static struct workqueue_struct *kacpi_notify_wq;
- static struct workqueue_struct *kacpi_hotplug_wq;
- static bool acpi_os_initialized;
-+unsigned int acpi_sci_irq = INVALID_ACPI_IRQ;
- 
- /*
-  * This list of permanent mappings is for memory that may be accessed from
-@@ -856,17 +857,19 @@ acpi_os_install_interrupt_handler(u32 gsi, acpi_osd_handler handler,
- 		acpi_irq_handler = NULL;
- 		return AE_NOT_ACQUIRED;
- 	}
-+	acpi_sci_irq = irq;
- 
- 	return AE_OK;
- }
- 
--acpi_status acpi_os_remove_interrupt_handler(u32 irq, acpi_osd_handler handler)
-+acpi_status acpi_os_remove_interrupt_handler(u32 gsi, acpi_osd_handler handler)
- {
--	if (irq != acpi_gbl_FADT.sci_interrupt)
-+	if (gsi != acpi_gbl_FADT.sci_interrupt || !acpi_sci_irq_valid())
- 		return AE_BAD_PARAMETER;
- 
--	free_irq(irq, acpi_irq);
-+	free_irq(acpi_sci_irq, acpi_irq);
- 	acpi_irq_handler = NULL;
-+	acpi_sci_irq = INVALID_ACPI_IRQ;
- 
- 	return AE_OK;
- }
-@@ -1180,8 +1183,8 @@ void acpi_os_wait_events_complete(void)
- 	 * Make sure the GPE handler or the fixed event handler is not used
- 	 * on another CPU after removal.
- 	 */
--	if (acpi_irq_handler)
--		synchronize_hardirq(acpi_gbl_FADT.sci_interrupt);
-+	if (acpi_sci_irq_valid())
-+		synchronize_hardirq(acpi_sci_irq);
- 	flush_workqueue(kacpid_wq);
- 	flush_workqueue(kacpi_notify_wq);
- }
-diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
-index 2f0d4db..3fe1fbe 100644
---- a/drivers/acpi/sleep.c
-+++ b/drivers/acpi/sleep.c
-@@ -632,14 +632,16 @@ static int acpi_freeze_prepare(void)
- 	acpi_enable_wakeup_devices(ACPI_STATE_S0);
- 	acpi_enable_all_wakeup_gpes();
- 	acpi_os_wait_events_complete();
--	enable_irq_wake(acpi_gbl_FADT.sci_interrupt);
-+	if (acpi_sci_irq_valid())
-+		enable_irq_wake(acpi_sci_irq);
- 	return 0;
- }
- 
- static void acpi_freeze_restore(void)
- {
- 	acpi_disable_wakeup_devices(ACPI_STATE_S0);
--	disable_irq_wake(acpi_gbl_FADT.sci_interrupt);
-+	if (acpi_sci_irq_valid())
-+		disable_irq_wake(acpi_sci_irq);
- 	acpi_enable_all_runtime_gpes();
- }
- 
-diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
-index f8319a0..39be5ac 100644
---- a/drivers/char/tpm/tpm.h
-+++ b/drivers/char/tpm/tpm.h
-@@ -115,6 +115,13 @@ enum tpm2_startup_types {
- 	TPM2_SU_STATE	= 0x0001,
- };
- 
-+enum tpm2_start_method {
-+	TPM2_START_ACPI = 2,
-+	TPM2_START_FIFO = 6,
-+	TPM2_START_CRB = 7,
-+	TPM2_START_CRB_WITH_ACPI = 8,
-+};
-+
- struct tpm_chip;
- 
- struct tpm_vendor_specific {
-diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
-index 1267322..2b971b3 100644
---- a/drivers/char/tpm/tpm_crb.c
-+++ b/drivers/char/tpm/tpm_crb.c
-@@ -34,12 +34,6 @@ enum crb_defaults {
- 	CRB_ACPI_START_INDEX = 1,
- };
- 
--enum crb_start_method {
--	CRB_SM_ACPI_START = 2,
--	CRB_SM_CRB = 7,
--	CRB_SM_CRB_WITH_ACPI_START = 8,
--};
--
- struct acpi_tpm2 {
- 	struct acpi_table_header hdr;
- 	u16 platform_class;
-@@ -220,12 +214,6 @@ static int crb_acpi_add(struct acpi_device *device)
- 	u64 pa;
- 	int rc;
- 
--	chip = tpmm_chip_alloc(dev, &tpm_crb);
--	if (IS_ERR(chip))
--		return PTR_ERR(chip);
--
--	chip->flags = TPM_CHIP_FLAG_TPM2;
--
- 	status = acpi_get_table(ACPI_SIG_TPM2, 1,
- 				(struct acpi_table_header **) &buf);
- 	if (ACPI_FAILURE(status)) {
-@@ -233,13 +221,15 @@ static int crb_acpi_add(struct acpi_device *device)
- 		return -ENODEV;
- 	}
- 
--	/* At least some versions of AMI BIOS have a bug that TPM2 table has
--	 * zero address for the control area and therefore we must fail.
--	*/
--	if (!buf->control_area_pa) {
--		dev_err(dev, "TPM2 ACPI table has a zero address for the control area\n");
--		return -EINVAL;
--	}
-+	/* Should the FIFO driver handle this? */
-+	if (buf->start_method == TPM2_START_FIFO)
-+		return -ENODEV;
-+
-+	chip = tpmm_chip_alloc(dev, &tpm_crb);
-+	if (IS_ERR(chip))
-+		return PTR_ERR(chip);
-+
-+	chip->flags = TPM_CHIP_FLAG_TPM2;
- 
- 	if (buf->hdr.length < sizeof(struct acpi_tpm2)) {
- 		dev_err(dev, "TPM2 ACPI table has wrong size");
-@@ -259,11 +249,11 @@ static int crb_acpi_add(struct acpi_device *device)
- 	 * report only ACPI start but in practice seems to require both
- 	 * ACPI start and CRB start.
- 	 */
--	if (sm == CRB_SM_CRB || sm == CRB_SM_CRB_WITH_ACPI_START ||
-+	if (sm == TPM2_START_CRB || sm == TPM2_START_FIFO ||
- 	    !strcmp(acpi_device_hid(device), "MSFT0101"))
- 		priv->flags |= CRB_FL_CRB_START;
- 
--	if (sm == CRB_SM_ACPI_START || sm == CRB_SM_CRB_WITH_ACPI_START)
-+	if (sm == TPM2_START_ACPI || sm == TPM2_START_CRB_WITH_ACPI)
- 		priv->flags |= CRB_FL_ACPI_START;
- 
- 	priv->cca = (struct crb_control_area __iomem *)
-diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
-index f2dffa7..696ef1d 100644
---- a/drivers/char/tpm/tpm_tis.c
-+++ b/drivers/char/tpm/tpm_tis.c
-@@ -1,6 +1,6 @@
- /*
-  * Copyright (C) 2005, 2006 IBM Corporation
-- * Copyright (C) 2014 Intel Corporation
-+ * Copyright (C) 2014, 2015 Intel Corporation
-  *
-  * Authors:
-  * Leendert van Doorn <leendert@watson.ibm.com>
-@@ -28,6 +28,7 @@
- #include <linux/wait.h>
- #include <linux/acpi.h>
- #include <linux/freezer.h>
-+#include <acpi/actbl2.h>
- #include "tpm.h"
- 
- enum tis_access {
-@@ -65,6 +66,17 @@ enum tis_defaults {
- 	TIS_LONG_TIMEOUT = 2000,	/* 2 sec */
- };
- 
-+struct tpm_info {
-+	unsigned long start;
-+	unsigned long len;
-+	unsigned int irq;
-+};
-+
-+static struct tpm_info tis_default_info = {
-+	.start = TIS_MEM_BASE,
-+	.len = TIS_MEM_LEN,
-+	.irq = 0,
-+};
- 
- /* Some timeout values are needed before it is known whether the chip is
-  * TPM 1.0 or TPM 2.0.
-@@ -91,26 +103,54 @@ struct priv_data {
- };
- 
- #if defined(CONFIG_PNP) && defined(CONFIG_ACPI)
--static int is_itpm(struct pnp_dev *dev)
-+static int has_hid(struct acpi_device *dev, const char *hid)
- {
--	struct acpi_device *acpi = pnp_acpi_device(dev);
- 	struct acpi_hardware_id *id;
- 
--	if (!acpi)
--		return 0;
--
--	list_for_each_entry(id, &acpi->pnp.ids, list) {
--		if (!strcmp("INTC0102", id->id))
-+	list_for_each_entry(id, &dev->pnp.ids, list)
-+		if (!strcmp(hid, id->id))
- 			return 1;
--	}
- 
- 	return 0;
- }
-+
-+static inline int is_itpm(struct acpi_device *dev)
-+{
-+	return has_hid(dev, "INTC0102");
-+}
-+
-+static inline int is_fifo(struct acpi_device *dev)
-+{
-+	struct acpi_table_tpm2 *tbl;
-+	acpi_status st;
-+
-+	/* TPM 1.2 FIFO */
-+	if (!has_hid(dev, "MSFT0101"))
-+		return 1;
-+
-+	st = acpi_get_table(ACPI_SIG_TPM2, 1,
-+			    (struct acpi_table_header **) &tbl);
-+	if (ACPI_FAILURE(st)) {
-+		dev_err(&dev->dev, "failed to get TPM2 ACPI table\n");
-+		return 0;
-+	}
-+
-+	if (le32_to_cpu(tbl->start_method) != TPM2_START_FIFO)
-+		return 0;
-+
-+	/* TPM 2.0 FIFO */
-+	return 1;
-+}
- #else
--static inline int is_itpm(struct pnp_dev *dev)
-+static inline int is_itpm(struct acpi_device *dev)
- {
- 	return 0;
- }
-+
-+static inline int is_fifo(struct acpi_device *dev)
-+{
-+	return 1;
-+}
- #endif
- 
- /* Before we attempt to access the TPM we must see that the valid bit is set.
-@@ -600,9 +640,8 @@ static void tpm_tis_remove(struct tpm_chip *chip)
- 	release_locality(chip, chip->vendor.locality, 1);
- }
- 
--static int tpm_tis_init(struct device *dev, acpi_handle acpi_dev_handle,
--			resource_size_t start, resource_size_t len,
--			unsigned int irq)
-+static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info,
-+			acpi_handle acpi_dev_handle)
- {
- 	u32 vendor, intfcaps, intmask;
- 	int rc, i, irq_s, irq_e, probe;
-@@ -622,7 +661,7 @@ static int tpm_tis_init(struct device *dev, acpi_handle acpi_dev_handle,
- 	chip->acpi_dev_handle = acpi_dev_handle;
- #endif
- 
--	chip->vendor.iobase = devm_ioremap(dev, start, len);
-+	chip->vendor.iobase = devm_ioremap(dev, tpm_info->start, tpm_info->len);
- 	if (!chip->vendor.iobase)
- 		return -EIO;
- 
-@@ -707,7 +746,7 @@ static int tpm_tis_init(struct device *dev, acpi_handle acpi_dev_handle,
- 		  chip->vendor.iobase +
- 		  TPM_INT_ENABLE(chip->vendor.locality));
- 	if (interrupts)
--		chip->vendor.irq = irq;
-+		chip->vendor.irq = tpm_info->irq;
- 	if (interrupts && !chip->vendor.irq) {
- 		irq_s =
- 		    ioread8(chip->vendor.iobase +
-@@ -890,27 +929,27 @@ static SIMPLE_DEV_PM_OPS(tpm_tis_pm, tpm_pm_suspend, tpm_tis_resume);
- static int tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
- 				      const struct pnp_device_id *pnp_id)
- {
--	resource_size_t start, len;
--	unsigned int irq = 0;
-+	struct tpm_info tpm_info = tis_default_info;
- 	acpi_handle acpi_dev_handle = NULL;
- 
--	start = pnp_mem_start(pnp_dev, 0);
--	len = pnp_mem_len(pnp_dev, 0);
-+	tpm_info.start = pnp_mem_start(pnp_dev, 0);
-+	tpm_info.len = pnp_mem_len(pnp_dev, 0);
- 
- 	if (pnp_irq_valid(pnp_dev, 0))
--		irq = pnp_irq(pnp_dev, 0);
-+		tpm_info.irq = pnp_irq(pnp_dev, 0);
- 	else
- 		interrupts = false;
- 
--	if (is_itpm(pnp_dev))
--		itpm = true;
--
- #ifdef CONFIG_ACPI
--	if (pnp_acpi_device(pnp_dev))
-+	if (pnp_acpi_device(pnp_dev)) {
-+		if (is_itpm(pnp_acpi_device(pnp_dev)))
-+			itpm = true;
-+
- 		acpi_dev_handle = pnp_acpi_device(pnp_dev)->handle;
-+	}
- #endif
- 
--	return tpm_tis_init(&pnp_dev->dev, acpi_dev_handle, start, len, irq);
-+	return tpm_tis_init(&pnp_dev->dev, &tpm_info, acpi_dev_handle);
- }
- 
- static struct pnp_device_id tpm_pnp_tbl[] = {
-@@ -930,6 +969,7 @@ MODULE_DEVICE_TABLE(pnp, tpm_pnp_tbl);
- static void tpm_tis_pnp_remove(struct pnp_dev *dev)
- {
- 	struct tpm_chip *chip = pnp_get_drvdata(dev);
-+
- 	tpm_chip_unregister(chip);
- 	tpm_tis_remove(chip);
- }
-@@ -950,6 +990,79 @@ module_param_string(hid, tpm_pnp_tbl[TIS_HID_USR_IDX].id,
- MODULE_PARM_DESC(hid, "Set additional specific HID for this driver to probe");
- #endif
- 
-+#ifdef CONFIG_ACPI
-+static int tpm_check_resource(struct acpi_resource *ares, void *data)
-+{
-+	struct tpm_info *tpm_info = (struct tpm_info *) data;
-+	struct resource res;
-+
-+	if (acpi_dev_resource_interrupt(ares, 0, &res)) {
-+		tpm_info->irq = res.start;
-+	} else if (acpi_dev_resource_memory(ares, &res)) {
-+		tpm_info->start = res.start;
-+		tpm_info->len = resource_size(&res);
-+	}
-+
-+	return 1;
-+}
-+
-+static int tpm_tis_acpi_init(struct acpi_device *acpi_dev)
-+{
-+	struct list_head resources;
-+	struct tpm_info tpm_info = tis_default_info;
-+	int ret;
-+
-+	if (!is_fifo(acpi_dev))
-+		return -ENODEV;
-+
-+	INIT_LIST_HEAD(&resources);
-+	ret = acpi_dev_get_resources(acpi_dev, &resources, tpm_check_resource,
-+				     &tpm_info);
-+	if (ret < 0)
-+		return ret;
-+
-+	acpi_dev_free_resource_list(&resources);
-+
-+	if (!tpm_info.irq)
-+		interrupts = false;
-+
-+	if (is_itpm(acpi_dev))
-+		itpm = true;
-+
-+	return tpm_tis_init(&acpi_dev->dev, &tpm_info, acpi_dev->handle);
-+}
-+
-+static int tpm_tis_acpi_remove(struct acpi_device *dev)
-+{
-+	struct tpm_chip *chip = dev_get_drvdata(&dev->dev);
-+
-+	tpm_chip_unregister(chip);
-+	tpm_tis_remove(chip);
-+
-+	return 0;
-+}
-+
-+static struct acpi_device_id tpm_acpi_tbl[] = {
-+	{"MSFT0101", 0},	/* TPM 2.0 */
-+	/* Add new here */
-+	{"", 0},		/* User Specified */
-+	{"", 0}			/* Terminator */
-+};
-+MODULE_DEVICE_TABLE(acpi, tpm_acpi_tbl);
-+
-+static struct acpi_driver tis_acpi_driver = {
-+	.name = "tpm_tis",
-+	.ids = tpm_acpi_tbl,
-+	.ops = {
-+		.add = tpm_tis_acpi_init,
-+		.remove = tpm_tis_acpi_remove,
-+	},
-+	.drv = {
-+		.pm = &tpm_tis_pm,
-+	},
-+};
-+#endif
-+
- static struct platform_driver tis_drv = {
- 	.driver = {
- 		.name		= "tpm_tis",
-@@ -966,9 +1079,25 @@ static int __init init_tis(void)
- {
- 	int rc;
- #ifdef CONFIG_PNP
--	if (!force)
--		return pnp_register_driver(&tis_pnp_driver);
-+	if (!force) {
-+		rc = pnp_register_driver(&tis_pnp_driver);
-+		if (rc)
-+			return rc;
-+	}
-+#endif
-+#ifdef CONFIG_ACPI
-+	if (!force) {
-+		rc = acpi_bus_register_driver(&tis_acpi_driver);
-+		if (rc) {
-+#ifdef CONFIG_PNP
-+			pnp_unregister_driver(&tis_pnp_driver);
- #endif
-+			return rc;
-+		}
-+	}
-+#endif
-+	if (!force)
-+		return 0;
- 
- 	rc = platform_driver_register(&tis_drv);
- 	if (rc < 0)
-@@ -978,7 +1107,7 @@ static int __init init_tis(void)
- 		rc = PTR_ERR(pdev);
- 		goto err_dev;
- 	}
--	rc = tpm_tis_init(&pdev->dev, NULL, TIS_MEM_BASE, TIS_MEM_LEN, 0);
-+	rc = tpm_tis_init(&pdev->dev, &tis_default_info, NULL);
- 	if (rc)
- 		goto err_init;
- 	return 0;
-@@ -992,9 +1121,14 @@ err_dev:
- static void __exit cleanup_tis(void)
- {
- 	struct tpm_chip *chip;
--#ifdef CONFIG_PNP
-+#if defined(CONFIG_PNP) || defined(CONFIG_ACPI)
- 	if (!force) {
-+#ifdef CONFIG_ACPI
-+		acpi_bus_unregister_driver(&tis_acpi_driver);
-+#endif
-+#ifdef CONFIG_PNP
- 		pnp_unregister_driver(&tis_pnp_driver);
-+#endif
- 		return;
- 	}
- #endif
-diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
-index 2795d6d..8b5988e 100644
---- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
-+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
-@@ -1016,13 +1016,12 @@ static int atl1c_setup_ring_resources(struct atl1c_adapter *adapter)
- 		sizeof(struct atl1c_recv_ret_status) * rx_desc_count +
- 		8 * 4;
- 
--	ring_header->desc = pci_alloc_consistent(pdev, ring_header->size,
--				&ring_header->dma);
-+	ring_header->desc = dma_zalloc_coherent(&pdev->dev, ring_header->size,
-+						&ring_header->dma, GFP_KERNEL);
- 	if (unlikely(!ring_header->desc)) {
--		dev_err(&pdev->dev, "pci_alloc_consistend failed\n");
-+		dev_err(&pdev->dev, "could not get memory for DMA buffer\n");
- 		goto err_nomem;
- 	}
--	memset(ring_header->desc, 0, ring_header->size);
- 	/* init TPD ring */
- 
- 	tpd_ring[0].dma = roundup(ring_header->dma, 8);
-diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
-index ce38d26..bcb933e 100644
---- a/drivers/net/ethernet/freescale/gianfar.c
-+++ b/drivers/net/ethernet/freescale/gianfar.c
-@@ -894,7 +894,8 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
- 				     FSL_GIANFAR_DEV_HAS_VLAN |
- 				     FSL_GIANFAR_DEV_HAS_MAGIC_PACKET |
- 				     FSL_GIANFAR_DEV_HAS_EXTENDED_HASH |
--				     FSL_GIANFAR_DEV_HAS_TIMER;
-+				     FSL_GIANFAR_DEV_HAS_TIMER |
-+				     FSL_GIANFAR_DEV_HAS_RX_FILER;
- 
- 	err = of_property_read_string(np, "phy-connection-type", &ctype);
- 
-@@ -1393,8 +1394,9 @@ static int gfar_probe(struct platform_device *ofdev)
- 		priv->rx_queue[i]->rxic = DEFAULT_RXIC;
- 	}
- 
--	/* always enable rx filer */
--	priv->rx_filer_enable = 1;
-+	/* Always enable rx filer if available */
-+	priv->rx_filer_enable =
-+	    (priv->device_flags & FSL_GIANFAR_DEV_HAS_RX_FILER) ? 1 : 0;
- 	/* Enable most messages by default */
- 	priv->msg_enable = (NETIF_MSG_IFUP << 1 ) - 1;
- 	/* use pritority h/w tx queue scheduling for single queue devices */
-diff --git a/drivers/net/ethernet/freescale/gianfar.h b/drivers/net/ethernet/freescale/gianfar.h
-index 8c19948..3755372 100644
---- a/drivers/net/ethernet/freescale/gianfar.h
-+++ b/drivers/net/ethernet/freescale/gianfar.h
-@@ -917,6 +917,7 @@ struct gfar {
- #define FSL_GIANFAR_DEV_HAS_BD_STASHING		0x00000200
- #define FSL_GIANFAR_DEV_HAS_BUF_STASHING	0x00000400
- #define FSL_GIANFAR_DEV_HAS_TIMER		0x00000800
-+#define FSL_GIANFAR_DEV_HAS_RX_FILER		0x00002000
- 
- #if (MAXGROUPS == 2)
- #define DEFAULT_MAPPING 	0xAA
-diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
-index 2f87909..60ccc29 100644
---- a/drivers/net/ethernet/qualcomm/qca_spi.c
-+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
-@@ -736,9 +736,8 @@ qcaspi_netdev_tx_timeout(struct net_device *dev)
- 	netdev_info(qca->net_dev, "Transmit timeout at %ld, latency %ld\n",
- 		    jiffies, jiffies - dev->trans_start);
- 	qca->net_dev->stats.tx_errors++;
--	/* wake the queue if there is room */
--	if (qcaspi_tx_ring_has_space(&qca->txr))
--		netif_wake_queue(dev);
-+	/* Trigger tx queue flush and QCA7000 reset */
-+	qca->sync = QCASPI_SYNC_UNKNOWN;
- }
- 
- static int
-diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
-index a484d8b..f3cbf90c 100644
---- a/drivers/net/ethernet/renesas/sh_eth.c
-+++ b/drivers/net/ethernet/renesas/sh_eth.c
-@@ -1481,6 +1481,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
- 		if (mdp->cd->shift_rd0)
- 			desc_status >>= 16;
- 
-+		skb = mdp->rx_skbuff[entry];
- 		if (desc_status & (RD_RFS1 | RD_RFS2 | RD_RFS3 | RD_RFS4 |
- 				   RD_RFS5 | RD_RFS6 | RD_RFS10)) {
- 			ndev->stats.rx_errors++;
-@@ -1496,12 +1497,11 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
- 				ndev->stats.rx_missed_errors++;
- 			if (desc_status & RD_RFS10)
- 				ndev->stats.rx_over_errors++;
--		} else {
-+		} else	if (skb) {
- 			if (!mdp->cd->hw_swap)
- 				sh_eth_soft_swap(
- 					phys_to_virt(ALIGN(rxdesc->addr, 4)),
- 					pkt_len + 2);
--			skb = mdp->rx_skbuff[entry];
- 			mdp->rx_skbuff[entry] = NULL;
- 			if (mdp->cd->rpadir)
- 				skb_reserve(skb, NET_IP_ALIGN);
-diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
-index cf6312f..e13ad6c 100644
---- a/drivers/net/phy/micrel.c
-+++ b/drivers/net/phy/micrel.c
-@@ -339,9 +339,18 @@ static int ksz9021_config_init(struct phy_device *phydev)
- {
- 	const struct device *dev = &phydev->dev;
- 	const struct device_node *of_node = dev->of_node;
-+	const struct device *dev_walker;
- 
--	if (!of_node && dev->parent->of_node)
--		of_node = dev->parent->of_node;
-+	/* The Micrel driver has a deprecated option to place phy OF
-+	 * properties in the MAC node. Walk up the tree of devices to
-+	 * find a device with an OF node.
-+	 */
-+	dev_walker = &phydev->dev;
-+	do {
-+		of_node = dev_walker->of_node;
-+		dev_walker = dev_walker->parent;
-+
-+	} while (!of_node && dev_walker);
- 
- 	if (of_node) {
- 		ksz9021_load_values_from_of(phydev, of_node,
-diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
-index 5e0b432..0a37f84 100644
---- a/drivers/net/ppp/pppoe.c
-+++ b/drivers/net/ppp/pppoe.c
-@@ -568,6 +568,9 @@ static int pppoe_create(struct net *net, struct socket *sock, int kern)
- 	sk->sk_family		= PF_PPPOX;
- 	sk->sk_protocol		= PX_PROTO_OE;
- 
-+	INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work,
-+		  pppoe_unbind_sock_work);
-+
- 	return 0;
- }
- 
-@@ -632,8 +635,6 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
- 
- 	lock_sock(sk);
- 
--	INIT_WORK(&po->proto.pppoe.padt_work, pppoe_unbind_sock_work);
--
- 	error = -EINVAL;
- 	if (sp->sa_protocol != PX_PROTO_OE)
- 		goto end;
-@@ -663,8 +664,13 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
- 			po->pppoe_dev = NULL;
- 		}
- 
--		memset(sk_pppox(po) + 1, 0,
--		       sizeof(struct pppox_sock) - sizeof(struct sock));
-+		po->pppoe_ifindex = 0;
-+		memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa));
-+		memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay));
-+		memset(&po->chan, 0, sizeof(po->chan));
-+		po->next = NULL;
-+		po->num = 0;
-+
- 		sk->sk_state = PPPOX_NONE;
- 	}
- 
-diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
-index 686f37d..b910cae 100644
---- a/drivers/net/ppp/pptp.c
-+++ b/drivers/net/ppp/pptp.c
-@@ -418,6 +418,9 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr,
- 	struct pptp_opt *opt = &po->proto.pptp;
- 	int error = 0;
- 
-+	if (sockaddr_len < sizeof(struct sockaddr_pppox))
-+		return -EINVAL;
-+
- 	lock_sock(sk);
- 
- 	opt->src_addr = sp->sa_addr.pptp;
-@@ -439,6 +442,9 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
- 	struct flowi4 fl4;
- 	int error = 0;
- 
-+	if (sockaddr_len < sizeof(struct sockaddr_pppox))
-+		return -EINVAL;
-+
- 	if (sp->sa_protocol != PX_PROTO_PPTP)
- 		return -EINVAL;
- 
-diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
-index efc18e0..b6ea6ff 100644
---- a/drivers/net/usb/cdc_mbim.c
-+++ b/drivers/net/usb/cdc_mbim.c
-@@ -158,7 +158,7 @@ static int cdc_mbim_bind(struct usbnet *dev, struct usb_interface *intf)
- 	if (!cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
- 		goto err;
- 
--	ret = cdc_ncm_bind_common(dev, intf, data_altsetting, 0);
-+	ret = cdc_ncm_bind_common(dev, intf, data_altsetting, dev->driver_info->data);
- 	if (ret)
- 		goto err;
- 
-@@ -582,6 +582,26 @@ static const struct driver_info cdc_mbim_info_zlp = {
- 	.tx_fixup = cdc_mbim_tx_fixup,
- };
- 
-+/* The spefication explicitly allows NDPs to be placed anywhere in the
-+ * frame, but some devices fail unless the NDP is placed after the IP
-+ * packets.  Using the CDC_NCM_FLAG_NDP_TO_END flags to force this
-+ * behaviour.
-+ *
-+ * Note: The current implementation of this feature restricts each NTB
-+ * to a single NDP, implying that multiplexed sessions cannot share an
-+ * NTB. This might affect performace for multiplexed sessions.
-+ */
-+static const struct driver_info cdc_mbim_info_ndp_to_end = {
-+	.description = "CDC MBIM",
-+	.flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN,
-+	.bind = cdc_mbim_bind,
-+	.unbind = cdc_mbim_unbind,
-+	.manage_power = cdc_mbim_manage_power,
-+	.rx_fixup = cdc_mbim_rx_fixup,
-+	.tx_fixup = cdc_mbim_tx_fixup,
-+	.data = CDC_NCM_FLAG_NDP_TO_END,
-+};
-+
- static const struct usb_device_id mbim_devs[] = {
- 	/* This duplicate NCM entry is intentional. MBIM devices can
- 	 * be disguised as NCM by default, and this is necessary to
-@@ -597,6 +617,10 @@ static const struct usb_device_id mbim_devs[] = {
- 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bdb, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
- 	  .driver_info = (unsigned long)&cdc_mbim_info,
- 	},
-+	/* Huawei E3372 fails unless NDP comes after the IP packets */
-+	{ USB_DEVICE_AND_INTERFACE_INFO(0x12d1, 0x157d, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
-+	  .driver_info = (unsigned long)&cdc_mbim_info_ndp_to_end,
-+	},
- 	/* default entry */
- 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
- 	  .driver_info = (unsigned long)&cdc_mbim_info_zlp,
-diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
-index db40175..fa41a6d 100644
---- a/drivers/net/usb/cdc_ncm.c
-+++ b/drivers/net/usb/cdc_ncm.c
-@@ -1006,10 +1006,18 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm_ndp(struct cdc_ncm_ctx *ctx, struct sk_
- 	* NTH16 header as we would normally do. NDP isn't written to the SKB yet, and
- 	* the wNdpIndex field in the header is actually not consistent with reality. It will be later.
- 	*/
--	if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END)
-+	if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
- 		if (ctx->delayed_ndp16->dwSignature == sign)
- 			return ctx->delayed_ndp16;
- 
-+		/* We can only push a single NDP to the end. Return
-+		 * NULL to send what we've already got and queue this
-+		 * skb for later.
-+		 */
-+		else if (ctx->delayed_ndp16->dwSignature)
-+			return NULL;
-+	}
-+
- 	/* follow the chain of NDPs, looking for a match */
- 	while (ndpoffset) {
- 		ndp16 = (struct usb_cdc_ncm_ndp16 *)(skb->data + ndpoffset);
-diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
-index d9427ca..2e32c41 100644
---- a/drivers/net/usb/r8152.c
-+++ b/drivers/net/usb/r8152.c
-@@ -3067,17 +3067,6 @@ static int rtl8152_open(struct net_device *netdev)
- 
- 	mutex_lock(&tp->control);
- 
--	/* The WORK_ENABLE may be set when autoresume occurs */
--	if (test_bit(WORK_ENABLE, &tp->flags)) {
--		clear_bit(WORK_ENABLE, &tp->flags);
--		usb_kill_urb(tp->intr_urb);
--		cancel_delayed_work_sync(&tp->schedule);
--
--		/* disable the tx/rx, if the workqueue has enabled them. */
--		if (netif_carrier_ok(netdev))
--			tp->rtl_ops.disable(tp);
--	}
--
- 	tp->rtl_ops.up(tp);
- 
- 	rtl8152_set_speed(tp, AUTONEG_ENABLE,
-@@ -3124,12 +3113,6 @@ static int rtl8152_close(struct net_device *netdev)
- 	} else {
- 		mutex_lock(&tp->control);
- 
--		/* The autosuspend may have been enabled and wouldn't
--		 * be disable when autoresume occurs, because the
--		 * netif_running() would be false.
--		 */
--		rtl_runtime_suspend_enable(tp, false);
--
- 		tp->rtl_ops.down(tp);
- 
- 		mutex_unlock(&tp->control);
-@@ -3512,7 +3495,7 @@ static int rtl8152_resume(struct usb_interface *intf)
- 		netif_device_attach(tp->netdev);
- 	}
- 
--	if (netif_running(tp->netdev)) {
-+	if (netif_running(tp->netdev) && tp->netdev->flags & IFF_UP) {
- 		if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
- 			rtl_runtime_suspend_enable(tp, false);
- 			clear_bit(SELECTIVE_SUSPEND, &tp->flags);
-@@ -3532,6 +3515,8 @@ static int rtl8152_resume(struct usb_interface *intf)
- 		}
- 		usb_submit_urb(tp->intr_urb, GFP_KERNEL);
- 	} else if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
-+		if (tp->netdev->flags & IFF_UP)
-+			rtl_runtime_suspend_enable(tp, false);
- 		clear_bit(SELECTIVE_SUSPEND, &tp->flags);
- 	}
- 
-diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
-index c9e309c..374feba 100644
---- a/drivers/net/vrf.c
-+++ b/drivers/net/vrf.c
-@@ -581,6 +581,7 @@ static int vrf_newlink(struct net *src_net, struct net_device *dev,
- {
- 	struct net_vrf *vrf = netdev_priv(dev);
- 	struct net_vrf_dev *vrf_ptr;
-+	int err;
- 
- 	if (!data || !data[IFLA_VRF_TABLE])
- 		return -EINVAL;
-@@ -589,16 +590,25 @@ static int vrf_newlink(struct net *src_net, struct net_device *dev,
- 
- 	dev->priv_flags |= IFF_VRF_MASTER;
- 
-+	err = -ENOMEM;
- 	vrf_ptr = kmalloc(sizeof(*dev->vrf_ptr), GFP_KERNEL);
- 	if (!vrf_ptr)
--		return -ENOMEM;
-+		goto out_fail;
- 
- 	vrf_ptr->ifindex = dev->ifindex;
- 	vrf_ptr->tb_id = vrf->tb_id;
- 
-+	err = register_netdevice(dev);
-+	if (err < 0)
-+		goto out_fail;
-+
- 	rcu_assign_pointer(dev->vrf_ptr, vrf_ptr);
- 
--	return register_netdev(dev);
-+	return 0;
-+
-+out_fail:
-+	kfree(vrf_ptr);
-+	return err;
- }
- 
- static size_t vrf_nl_getsize(const struct net_device *dev)
-diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
-index f2372f4..d2de91c 100644
---- a/drivers/platform/x86/toshiba_acpi.c
-+++ b/drivers/platform/x86/toshiba_acpi.c
-@@ -2676,6 +2676,7 @@ static int toshiba_acpi_add(struct acpi_device *acpi_dev)
- 	ret = toshiba_function_keys_get(dev, &special_functions);
- 	dev->kbd_function_keys_supported = !ret;
- 
-+	dev->hotkey_event_type = 0;
- 	if (toshiba_acpi_setup_keyboard(dev))
- 		pr_info("Unable to activate hotkeys\n");
- 
-diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
-index b30e742..26ca4f9 100644
---- a/drivers/usb/class/cdc-acm.c
-+++ b/drivers/usb/class/cdc-acm.c
-@@ -1838,6 +1838,11 @@ static const struct usb_device_id acm_ids[] = {
- 	},
- #endif
- 
-+	/* Exclude Infineon Flash Loader utility */
-+	{ USB_DEVICE(0x058b, 0x0041),
-+	.driver_info = IGNORE_DEVICE,
-+	},
-+
- 	/* control interfaces without any protocol set */
- 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
- 		USB_CDC_PROTO_NONE) },
-diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
-index b9ddf0c..894894f 100644
---- a/drivers/usb/core/config.c
-+++ b/drivers/usb/core/config.c
-@@ -115,7 +115,8 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
- 		   USB_SS_MULT(desc->bmAttributes) > 3) {
- 		dev_warn(ddev, "Isoc endpoint has Mult of %d in "
- 				"config %d interface %d altsetting %d ep %d: "
--				"setting to 3\n", desc->bmAttributes + 1,
-+				"setting to 3\n",
-+				USB_SS_MULT(desc->bmAttributes),
- 				cfgno, inum, asnum, ep->desc.bEndpointAddress);
- 		ep->ss_ep_comp.bmAttributes = 2;
- 	}
-diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index 431839b..522f766 100644
---- a/drivers/usb/core/hub.c
-+++ b/drivers/usb/core/hub.c
-@@ -124,6 +124,10 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
- 
- int usb_device_supports_lpm(struct usb_device *udev)
- {
-+	/* Some devices have trouble with LPM */
-+	if (udev->quirks & USB_QUIRK_NO_LPM)
-+		return 0;
-+
- 	/* USB 2.1 (and greater) devices indicate LPM support through
- 	 * their USB 2.0 Extended Capabilities BOS descriptor.
- 	 */
-@@ -4503,6 +4507,8 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
- 		goto fail;
- 	}
- 
-+	usb_detect_quirks(udev);
-+
- 	if (udev->wusb == 0 && le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0201) {
- 		retval = usb_get_bos_descriptor(udev);
- 		if (!retval) {
-@@ -4701,7 +4707,6 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
- 		if (status < 0)
- 			goto loop;
- 
--		usb_detect_quirks(udev);
- 		if (udev->quirks & USB_QUIRK_DELAY_INIT)
- 			msleep(1000);
- 
-@@ -5317,9 +5322,6 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
- 	if (udev->usb2_hw_lpm_enabled == 1)
- 		usb_set_usb2_hardware_lpm(udev, 0);
- 
--	bos = udev->bos;
--	udev->bos = NULL;
--
- 	/* Disable LPM and LTM while we reset the device and reinstall the alt
- 	 * settings.  Device-initiated LPM settings, and system exit latency
- 	 * settings are cleared when the device is reset, so we have to set
-@@ -5328,15 +5330,18 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
- 	ret = usb_unlocked_disable_lpm(udev);
- 	if (ret) {
- 		dev_err(&udev->dev, "%s Failed to disable LPM\n.", __func__);
--		goto re_enumerate;
-+		goto re_enumerate_no_bos;
- 	}
- 	ret = usb_disable_ltm(udev);
- 	if (ret) {
- 		dev_err(&udev->dev, "%s Failed to disable LTM\n.",
- 				__func__);
--		goto re_enumerate;
-+		goto re_enumerate_no_bos;
- 	}
- 
-+	bos = udev->bos;
-+	udev->bos = NULL;
-+
- 	for (i = 0; i < SET_CONFIG_TRIES; ++i) {
- 
- 		/* ep0 maxpacket size may change; let the HCD know about it.
-@@ -5433,10 +5438,11 @@ done:
- 	return 0;
- 
- re_enumerate:
--	/* LPM state doesn't matter when we're about to destroy the device. */
--	hub_port_logical_disconnect(parent_hub, port1);
- 	usb_release_bos_descriptor(udev);
- 	udev->bos = bos;
-+re_enumerate_no_bos:
-+	/* LPM state doesn't matter when we're about to destroy the device. */
-+	hub_port_logical_disconnect(parent_hub, port1);
- 	return -ENODEV;
- }
- 
-diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
-index f5a3819..017c1de 100644
---- a/drivers/usb/core/quirks.c
-+++ b/drivers/usb/core/quirks.c
-@@ -199,6 +199,12 @@ static const struct usb_device_id usb_quirk_list[] = {
- 	{ USB_DEVICE(0x1a0a, 0x0200), .driver_info =
- 			USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
- 
-+	/* Blackmagic Design Intensity Shuttle */
-+	{ USB_DEVICE(0x1edb, 0xbd3b), .driver_info = USB_QUIRK_NO_LPM },
-+
-+	/* Blackmagic Design UltraStudio SDI */
-+	{ USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM },
-+
- 	{ }  /* terminating entry must be last */
- };
- 
-diff --git a/drivers/usb/gadget/udc/pxa27x_udc.c b/drivers/usb/gadget/udc/pxa27x_udc.c
-index 670ac0b..001a3b7 100644
---- a/drivers/usb/gadget/udc/pxa27x_udc.c
-+++ b/drivers/usb/gadget/udc/pxa27x_udc.c
-@@ -2536,6 +2536,9 @@ static int pxa_udc_suspend(struct platform_device *_dev, pm_message_t state)
- 	udc->pullup_resume = udc->pullup_on;
- 	dplus_pullup(udc, 0);
- 
-+	if (udc->driver)
-+		udc->driver->disconnect(&udc->gadget);
-+
- 	return 0;
- }
- 
-diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
-index 342ffd1..8c6e15b 100644
---- a/drivers/usb/host/ohci-at91.c
-+++ b/drivers/usb/host/ohci-at91.c
-@@ -473,6 +473,8 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
- 	if (!pdata)
- 		return -ENOMEM;
- 
-+	pdev->dev.platform_data = pdata;
-+
- 	if (!of_property_read_u32(np, "num-ports", &ports))
- 		pdata->ports = ports;
- 
-@@ -483,6 +485,7 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
- 		 */
- 		if (i >= pdata->ports) {
- 			pdata->vbus_pin[i] = -EINVAL;
-+			pdata->overcurrent_pin[i] = -EINVAL;
- 			continue;
- 		}
- 
-@@ -513,10 +516,8 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
- 	}
- 
- 	at91_for_each_port(i) {
--		if (i >= pdata->ports) {
--			pdata->overcurrent_pin[i] = -EINVAL;
--			continue;
--		}
-+		if (i >= pdata->ports)
-+			break;
- 
- 		pdata->overcurrent_pin[i] =
- 			of_get_named_gpio_flags(np, "atmel,oc-gpio", i, &flags);
-@@ -552,8 +553,6 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
- 		}
- 	}
- 
--	pdev->dev.platform_data = pdata;
--
- 	device_init_wakeup(&pdev->dev, 1);
- 	return usb_hcd_at91_probe(&ohci_at91_hc_driver, pdev);
- }
-diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
-index dc31c42..9f1c053 100644
---- a/drivers/usb/host/whci/qset.c
-+++ b/drivers/usb/host/whci/qset.c
-@@ -377,6 +377,10 @@ static int qset_fill_page_list(struct whc *whc, struct whc_std *std, gfp_t mem_f
- 	if (std->pl_virt == NULL)
- 		return -ENOMEM;
- 	std->dma_addr = dma_map_single(whc->wusbhc.dev, std->pl_virt, pl_len, DMA_TO_DEVICE);
-+	if (dma_mapping_error(whc->wusbhc.dev, std->dma_addr)) {
-+		kfree(std->pl_virt);
-+		return -EFAULT;
-+	}
- 
- 	for (p = 0; p < std->num_pointers; p++) {
- 		std->pl_virt[p].buf_ptr = cpu_to_le64(dma_addr);
-diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
-index 1f2037b..45c83ba 100644
---- a/drivers/usb/musb/Kconfig
-+++ b/drivers/usb/musb/Kconfig
-@@ -159,7 +159,7 @@ config USB_TI_CPPI_DMA
- 
- config USB_TI_CPPI41_DMA
- 	bool 'TI CPPI 4.1 (AM335x)'
--	depends on ARCH_OMAP
-+	depends on ARCH_OMAP && DMADEVICES
- 	select TI_CPPI41
- 
- config USB_TUSB_OMAP_DMA
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index eac7cca..7d4f51a 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -132,7 +132,6 @@ static const struct usb_device_id id_table[] = {
- 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
- 	{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
- 	{ USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
--	{ USB_DEVICE(0x10C4, 0xEA80) }, /* Silicon Labs factory default */
- 	{ USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */
- 	{ USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */
- 	{ USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */
-diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
-index 3658662..a204782 100644
---- a/drivers/usb/serial/usb-serial-simple.c
-+++ b/drivers/usb/serial/usb-serial-simple.c
-@@ -53,6 +53,7 @@ DEVICE(funsoft, FUNSOFT_IDS);
- 
- /* Infineon Flashloader driver */
- #define FLASHLOADER_IDS()		\
-+	{ USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \
- 	{ USB_DEVICE(0x8087, 0x0716) }
- DEVICE(flashloader, FLASHLOADER_IDS);
- 
-diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
-index f689219..43b1caf 100644
---- a/drivers/usb/storage/uas.c
-+++ b/drivers/usb/storage/uas.c
-@@ -796,6 +796,10 @@ static int uas_slave_configure(struct scsi_device *sdev)
- 	if (devinfo->flags & US_FL_NO_REPORT_OPCODES)
- 		sdev->no_report_opcodes = 1;
- 
-+	/* A few buggy USB-ATA bridges don't understand FUA */
-+	if (devinfo->flags & US_FL_BROKEN_FUA)
-+		sdev->broken_fua = 1;
-+
- 	scsi_change_queue_depth(sdev, devinfo->qdepth - 2);
- 	return 0;
- }
-diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
-index 6b24791..7ffe420 100644
---- a/drivers/usb/storage/unusual_devs.h
-+++ b/drivers/usb/storage/unusual_devs.h
-@@ -1987,7 +1987,7 @@ UNUSUAL_DEV(  0x14cd, 0x6600, 0x0201, 0x0201,
- 		US_FL_IGNORE_RESIDUE ),
- 
- /* Reported by Michael Büsch <m@bues.ch> */
--UNUSUAL_DEV(  0x152d, 0x0567, 0x0114, 0x0114,
-+UNUSUAL_DEV(  0x152d, 0x0567, 0x0114, 0x0116,
- 		"JMicron",
- 		"USB to ATA/ATAPI Bridge",
- 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
-index c85ea53..ccc113e 100644
---- a/drivers/usb/storage/unusual_uas.h
-+++ b/drivers/usb/storage/unusual_uas.h
-@@ -132,7 +132,7 @@ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
- 		"JMicron",
- 		"JMS567",
- 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
--		US_FL_NO_REPORT_OPCODES),
-+		US_FL_BROKEN_FUA | US_FL_NO_REPORT_OPCODES),
- 
- /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
- UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
-diff --git a/include/linux/acpi.h b/include/linux/acpi.h
-index 43856d1..1ae6ba0 100644
---- a/include/linux/acpi.h
-+++ b/include/linux/acpi.h
-@@ -193,6 +193,12 @@ int acpi_ioapic_registered(acpi_handle handle, u32 gsi_base);
- void acpi_irq_stats_init(void);
- extern u32 acpi_irq_handled;
- extern u32 acpi_irq_not_handled;
-+extern unsigned int acpi_sci_irq;
-+#define INVALID_ACPI_IRQ	((unsigned)-1)
-+static inline bool acpi_sci_irq_valid(void)
-+{
-+	return acpi_sci_irq != INVALID_ACPI_IRQ;
-+}
- 
- extern int sbf_port;
- extern unsigned long acpi_realmode_flags;
-diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
-index 9948c87..1d0043d 100644
---- a/include/linux/usb/quirks.h
-+++ b/include/linux/usb/quirks.h
-@@ -47,4 +47,7 @@
- /* device generates spurious wakeup, ignore remote wakeup capability */
- #define USB_QUIRK_IGNORE_REMOTE_WAKEUP		BIT(9)
- 
-+/* device can't handle Link Power Management */
-+#define USB_QUIRK_NO_LPM			BIT(10)
-+
- #endif /* __LINUX_USB_QUIRKS_H */
-diff --git a/include/net/dst.h b/include/net/dst.h
-index 9261d92..e7fa2e2 100644
---- a/include/net/dst.h
-+++ b/include/net/dst.h
-@@ -322,6 +322,39 @@ static inline void skb_dst_force(struct sk_buff *skb)
- 	}
- }
- 
-+/**
-+ * dst_hold_safe - Take a reference on a dst if possible
-+ * @dst: pointer to dst entry
-+ *
-+ * This helper returns false if it could not safely
-+ * take a reference on a dst.
-+ */
-+static inline bool dst_hold_safe(struct dst_entry *dst)
-+{
-+	if (dst->flags & DST_NOCACHE)
-+		return atomic_inc_not_zero(&dst->__refcnt);
-+	dst_hold(dst);
-+	return true;
-+}
-+
-+/**
-+ * skb_dst_force_safe - makes sure skb dst is refcounted
-+ * @skb: buffer
-+ *
-+ * If dst is not yet refcounted and not destroyed, grab a ref on it.
-+ */
-+static inline void skb_dst_force_safe(struct sk_buff *skb)
-+{
-+	if (skb_dst_is_noref(skb)) {
-+		struct dst_entry *dst = skb_dst(skb);
-+
-+		if (!dst_hold_safe(dst))
-+			dst = NULL;
-+
-+		skb->_skb_refdst = (unsigned long)dst;
-+	}
-+}
-+
- 
- /**
-  *	__skb_tunnel_rx - prepare skb for rx reinsert
-diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
-index 4a6009d..235c781 100644
---- a/include/net/inetpeer.h
-+++ b/include/net/inetpeer.h
-@@ -78,6 +78,7 @@ void inet_initpeers(void) __init;
- static inline void inetpeer_set_addr_v4(struct inetpeer_addr *iaddr, __be32 ip)
- {
- 	iaddr->a4.addr = ip;
-+	iaddr->a4.vif = 0;
- 	iaddr->family = AF_INET;
- }
- 
-diff --git a/include/net/sock.h b/include/net/sock.h
-index e237170..bca709a 100644
---- a/include/net/sock.h
-+++ b/include/net/sock.h
-@@ -387,6 +387,7 @@ struct sock {
- 				sk_no_check_rx : 1,
- 				sk_userlocks : 4,
- 				sk_protocol  : 8,
-+#define SK_PROTOCOL_MAX U8_MAX
- 				sk_type      : 16;
- 	kmemcheck_bitfield_end(flags);
- 	int			sk_wmem_queued;
-@@ -724,6 +725,8 @@ enum sock_flags {
- 	SOCK_SELECT_ERR_QUEUE, /* Wake select on error queue */
- };
- 
-+#define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE))
-+
- static inline void sock_copy_flags(struct sock *nsk, struct sock *osk)
- {
- 	nsk->sk_flags = osk->sk_flags;
-@@ -798,7 +801,7 @@ void sk_stream_write_space(struct sock *sk);
- static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb)
- {
- 	/* dont let skb dst not refcounted, we are going to leave rcu lock */
--	skb_dst_force(skb);
-+	skb_dst_force_safe(skb);
- 
- 	if (!sk->sk_backlog.tail)
- 		sk->sk_backlog.head = skb;
-diff --git a/include/net/vxlan.h b/include/net/vxlan.h
-index 480a319..f4a4972 100644
---- a/include/net/vxlan.h
-+++ b/include/net/vxlan.h
-@@ -79,7 +79,7 @@ struct vxlanhdr {
- };
- 
- /* VXLAN header flags. */
--#define VXLAN_HF_RCO BIT(24)
-+#define VXLAN_HF_RCO BIT(21)
- #define VXLAN_HF_VNI BIT(27)
- #define VXLAN_HF_GBP BIT(31)
- 
-diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
-index f7b2db4..7fc5733 100644
---- a/include/uapi/linux/Kbuild
-+++ b/include/uapi/linux/Kbuild
-@@ -186,6 +186,7 @@ header-y += if_tunnel.h
- header-y += if_vlan.h
- header-y += if_x25.h
- header-y += igmp.h
-+header-y += ila.h
- header-y += in6.h
- header-y += inet_diag.h
- header-y += in.h
-diff --git a/lib/rhashtable.c b/lib/rhashtable.c
-index a54ff89..aa388a7 100644
---- a/lib/rhashtable.c
-+++ b/lib/rhashtable.c
-@@ -503,10 +503,11 @@ int rhashtable_walk_init(struct rhashtable *ht, struct rhashtable_iter *iter)
- 	if (!iter->walker)
- 		return -ENOMEM;
- 
--	mutex_lock(&ht->mutex);
--	iter->walker->tbl = rht_dereference(ht->tbl, ht);
-+	spin_lock(&ht->lock);
-+	iter->walker->tbl =
-+		rcu_dereference_protected(ht->tbl, lockdep_is_held(&ht->lock));
- 	list_add(&iter->walker->list, &iter->walker->tbl->walkers);
--	mutex_unlock(&ht->mutex);
-+	spin_unlock(&ht->lock);
- 
- 	return 0;
- }
-@@ -520,10 +521,10 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_init);
-  */
- void rhashtable_walk_exit(struct rhashtable_iter *iter)
- {
--	mutex_lock(&iter->ht->mutex);
-+	spin_lock(&iter->ht->lock);
- 	if (iter->walker->tbl)
- 		list_del(&iter->walker->list);
--	mutex_unlock(&iter->ht->mutex);
-+	spin_unlock(&iter->ht->lock);
- 	kfree(iter->walker);
- }
- EXPORT_SYMBOL_GPL(rhashtable_walk_exit);
-@@ -547,14 +548,12 @@ int rhashtable_walk_start(struct rhashtable_iter *iter)
- {
- 	struct rhashtable *ht = iter->ht;
- 
--	mutex_lock(&ht->mutex);
-+	rcu_read_lock();
- 
-+	spin_lock(&ht->lock);
- 	if (iter->walker->tbl)
- 		list_del(&iter->walker->list);
--
--	rcu_read_lock();
--
--	mutex_unlock(&ht->mutex);
-+	spin_unlock(&ht->lock);
- 
- 	if (!iter->walker->tbl) {
- 		iter->walker->tbl = rht_dereference_rcu(ht->tbl, ht);
-@@ -723,9 +722,6 @@ int rhashtable_init(struct rhashtable *ht,
- 	if (params->nulls_base && params->nulls_base < (1U << RHT_BASE_SHIFT))
- 		return -EINVAL;
- 
--	if (params->nelem_hint)
--		size = rounded_hashtable_size(params);
--
- 	memset(ht, 0, sizeof(*ht));
- 	mutex_init(&ht->mutex);
- 	spin_lock_init(&ht->lock);
-@@ -745,6 +741,9 @@ int rhashtable_init(struct rhashtable *ht,
- 
- 	ht->p.min_size = max(ht->p.min_size, HASH_MIN_SIZE);
- 
-+	if (params->nelem_hint)
-+		size = rounded_hashtable_size(&ht->p);
-+
- 	/* The maximum (not average) chain length grows with the
- 	 * size of the hash table, at a rate of (log N)/(log log N).
- 	 * The value of 16 is selected so that even if the hash
-diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
-index ae3a47f..fbd0acf 100644
---- a/net/ax25/af_ax25.c
-+++ b/net/ax25/af_ax25.c
-@@ -805,6 +805,9 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol,
- 	struct sock *sk;
- 	ax25_cb *ax25;
- 
-+	if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
-+		return -EINVAL;
-+
- 	if (!net_eq(net, &init_net))
- 		return -EAFNOSUPPORT;
- 
-diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
-index f315c8d..15cb6c5 100644
---- a/net/bluetooth/sco.c
-+++ b/net/bluetooth/sco.c
-@@ -519,6 +519,9 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_le
- 	if (!addr || addr->sa_family != AF_BLUETOOTH)
- 		return -EINVAL;
- 
-+	if (addr_len < sizeof(struct sockaddr_sco))
-+		return -EINVAL;
-+
- 	lock_sock(sk);
- 
- 	if (sk->sk_state != BT_OPEN) {
-diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index fab4599..1c1f87c 100644
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -3643,7 +3643,8 @@ static void __skb_complete_tx_timestamp(struct sk_buff *skb,
- 	serr->ee.ee_info = tstype;
- 	if (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) {
- 		serr->ee.ee_data = skb_shinfo(skb)->tskey;
--		if (sk->sk_protocol == IPPROTO_TCP)
-+		if (sk->sk_protocol == IPPROTO_TCP &&
-+		    sk->sk_type == SOCK_STREAM)
- 			serr->ee.ee_data -= sk->sk_tskey;
- 	}
- 
-@@ -4268,7 +4269,8 @@ static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
- 		return NULL;
- 	}
- 
--	memmove(skb->data - ETH_HLEN, skb->data - VLAN_ETH_HLEN, 2 * ETH_ALEN);
-+	memmove(skb->data - ETH_HLEN, skb->data - skb->mac_len - VLAN_HLEN,
-+		2 * ETH_ALEN);
- 	skb->mac_header += VLAN_HLEN;
- 	return skb;
- }
-diff --git a/net/core/sock.c b/net/core/sock.c
-index 3307c02..dbbda99 100644
---- a/net/core/sock.c
-+++ b/net/core/sock.c
-@@ -422,8 +422,6 @@ static void sock_warn_obsolete_bsdism(const char *name)
- 	}
- }
- 
--#define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE))
--
- static void sock_disable_timestamp(struct sock *sk, unsigned long flags)
- {
- 	if (sk->sk_flags & flags) {
-@@ -862,7 +860,8 @@ set_rcvbuf:
- 
- 		if (val & SOF_TIMESTAMPING_OPT_ID &&
- 		    !(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)) {
--			if (sk->sk_protocol == IPPROTO_TCP) {
-+			if (sk->sk_protocol == IPPROTO_TCP &&
-+			    sk->sk_type == SOCK_STREAM) {
- 				if (sk->sk_state != TCP_ESTABLISHED) {
- 					ret = -EINVAL;
- 					break;
-diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
-index 675cf94..6feddca 100644
---- a/net/decnet/af_decnet.c
-+++ b/net/decnet/af_decnet.c
-@@ -678,6 +678,9 @@ static int dn_create(struct net *net, struct socket *sock, int protocol,
- {
- 	struct sock *sk;
- 
-+	if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
-+		return -EINVAL;
-+
- 	if (!net_eq(net, &init_net))
- 		return -EAFNOSUPPORT;
- 
-diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
-index 1d0c3ad..4b16cf3 100644
---- a/net/ipv4/af_inet.c
-+++ b/net/ipv4/af_inet.c
-@@ -261,6 +261,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
- 	int try_loading_module = 0;
- 	int err;
- 
-+	if (protocol < 0 || protocol >= IPPROTO_MAX)
-+		return -EINVAL;
-+
- 	sock->state = SS_UNCONNECTED;
- 
- 	/* Look for the requested type/protocol pair. */
-diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
-index e0fcbbb..bd903fe 100644
---- a/net/ipv4/fou.c
-+++ b/net/ipv4/fou.c
-@@ -24,6 +24,7 @@ struct fou {
- 	u16 type;
- 	struct udp_offload udp_offloads;
- 	struct list_head list;
-+	struct rcu_head rcu;
- };
- 
- #define FOU_F_REMCSUM_NOPARTIAL BIT(0)
-@@ -417,7 +418,7 @@ static void fou_release(struct fou *fou)
- 	list_del(&fou->list);
- 	udp_tunnel_sock_release(sock);
- 
--	kfree(fou);
-+	kfree_rcu(fou, rcu);
- }
- 
- static int fou_encap_init(struct sock *sk, struct fou *fou, struct fou_cfg *cfg)
-diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index a7739c8..d77be28 100644
---- a/net/ipv4/tcp_ipv4.c
-+++ b/net/ipv4/tcp_ipv4.c
-@@ -1509,7 +1509,7 @@ bool tcp_prequeue(struct sock *sk, struct sk_buff *skb)
- 	if (likely(sk->sk_rx_dst))
- 		skb_dst_drop(skb);
- 	else
--		skb_dst_force(skb);
-+		skb_dst_force_safe(skb);
- 
- 	__skb_queue_tail(&tp->ucopy.prequeue, skb);
- 	tp->ucopy.memory += skb->truesize;
-@@ -1710,8 +1710,7 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
- {
- 	struct dst_entry *dst = skb_dst(skb);
- 
--	if (dst) {
--		dst_hold(dst);
-+	if (dst && dst_hold_safe(dst)) {
- 		sk->sk_rx_dst = dst;
- 		inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
- 	}
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index 3dbee0d..c958596 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -3147,7 +3147,7 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
- {
- 	struct tcp_sock *tp = tcp_sk(sk);
- 	struct tcp_fastopen_request *fo = tp->fastopen_req;
--	int syn_loss = 0, space, err = 0, copied;
-+	int syn_loss = 0, space, err = 0;
- 	unsigned long last_syn_loss = 0;
- 	struct sk_buff *syn_data;
- 
-@@ -3185,17 +3185,18 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
- 		goto fallback;
- 	syn_data->ip_summed = CHECKSUM_PARTIAL;
- 	memcpy(syn_data->cb, syn->cb, sizeof(syn->cb));
--	copied = copy_from_iter(skb_put(syn_data, space), space,
--				&fo->data->msg_iter);
--	if (unlikely(!copied)) {
--		kfree_skb(syn_data);
--		goto fallback;
--	}
--	if (copied != space) {
--		skb_trim(syn_data, copied);
--		space = copied;
-+	if (space) {
-+		int copied = copy_from_iter(skb_put(syn_data, space), space,
-+					    &fo->data->msg_iter);
-+		if (unlikely(!copied)) {
-+			kfree_skb(syn_data);
-+			goto fallback;
-+		}
-+		if (copied != space) {
-+			skb_trim(syn_data, copied);
-+			space = copied;
-+		}
- 	}
--
- 	/* No more data pending in inet_wait_for_connect() */
- 	if (space == fo->size)
- 		fo->data = NULL;
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 3939dd2..ddd3511 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -349,6 +349,12 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
- 	setup_timer(&ndev->rs_timer, addrconf_rs_timer,
- 		    (unsigned long)ndev);
- 	memcpy(&ndev->cnf, dev_net(dev)->ipv6.devconf_dflt, sizeof(ndev->cnf));
-+
-+	if (ndev->cnf.stable_secret.initialized)
-+		ndev->addr_gen_mode = IN6_ADDR_GEN_MODE_STABLE_PRIVACY;
-+	else
-+		ndev->addr_gen_mode = IN6_ADDR_GEN_MODE_EUI64;
-+
- 	ndev->cnf.mtu6 = dev->mtu;
- 	ndev->cnf.sysctl = NULL;
- 	ndev->nd_parms = neigh_parms_alloc(dev, &nd_tbl);
-@@ -2453,7 +2459,7 @@ ok:
- #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
- 			if (in6_dev->cnf.optimistic_dad &&
- 			    !net->ipv6.devconf_all->forwarding && sllao)
--				addr_flags = IFA_F_OPTIMISTIC;
-+				addr_flags |= IFA_F_OPTIMISTIC;
- #endif
- 
- 			/* Do not allow to create too much of autoconfigured
-diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
-index 38d66dd..df095ee 100644
---- a/net/ipv6/af_inet6.c
-+++ b/net/ipv6/af_inet6.c
-@@ -109,6 +109,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
- 	int try_loading_module = 0;
- 	int err;
- 
-+	if (protocol < 0 || protocol >= IPPROTO_MAX)
-+		return -EINVAL;
-+
- 	/* Look for the requested type/protocol pair. */
- lookup_protocol:
- 	err = -ESOCKTNOSUPPORT;
-diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
-index 3c7b931..e5ea177 100644
---- a/net/ipv6/ip6_gre.c
-+++ b/net/ipv6/ip6_gre.c
-@@ -1571,13 +1571,11 @@ static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[],
- 			return -EEXIST;
- 	} else {
- 		t = nt;
--
--		ip6gre_tunnel_unlink(ign, t);
--		ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]);
--		ip6gre_tunnel_link(ign, t);
--		netdev_state_change(dev);
- 	}
- 
-+	ip6gre_tunnel_unlink(ign, t);
-+	ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]);
-+	ip6gre_tunnel_link(ign, t);
- 	return 0;
- }
- 
-diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 9e9b77b..8935dc1 100644
---- a/net/ipv6/tcp_ipv6.c
-+++ b/net/ipv6/tcp_ipv6.c
-@@ -93,10 +93,9 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
- {
- 	struct dst_entry *dst = skb_dst(skb);
- 
--	if (dst) {
-+	if (dst && dst_hold_safe(dst)) {
- 		const struct rt6_info *rt = (const struct rt6_info *)dst;
- 
--		dst_hold(dst);
- 		sk->sk_rx_dst = dst;
- 		inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
- 		inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
-diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
-index fae6822..25f63a8 100644
---- a/net/irda/af_irda.c
-+++ b/net/irda/af_irda.c
-@@ -1086,6 +1086,9 @@ static int irda_create(struct net *net, struct socket *sock, int protocol,
- 	struct sock *sk;
- 	struct irda_sock *self;
- 
-+	if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
-+		return -EINVAL;
-+
- 	if (net != &init_net)
- 		return -EAFNOSUPPORT;
- 
-diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
-index 5009582..cad8c4b 100644
---- a/net/openvswitch/conntrack.c
-+++ b/net/openvswitch/conntrack.c
-@@ -53,6 +53,8 @@ struct ovs_conntrack_info {
- 	struct md_labels labels;
- };
- 
-+static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info);
-+
- static u16 key_to_nfproto(const struct sw_flow_key *key)
- {
- 	switch (ntohs(key->eth.type)) {
-@@ -141,6 +143,7 @@ static void __ovs_ct_update_key(struct sw_flow_key *key, u8 state,
-  * previously sent the packet to conntrack via the ct action.
-  */
- static void ovs_ct_update_key(const struct sk_buff *skb,
-+			      const struct ovs_conntrack_info *info,
- 			      struct sw_flow_key *key, bool post_ct)
- {
- 	const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
-@@ -158,13 +161,15 @@ static void ovs_ct_update_key(const struct sk_buff *skb,
- 		zone = nf_ct_zone(ct);
- 	} else if (post_ct) {
- 		state = OVS_CS_F_TRACKED | OVS_CS_F_INVALID;
-+		if (info)
-+			zone = &info->zone;
- 	}
- 	__ovs_ct_update_key(key, state, zone, ct);
- }
- 
- void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key)
- {
--	ovs_ct_update_key(skb, key, false);
-+	ovs_ct_update_key(skb, NULL, key, false);
- }
- 
- int ovs_ct_put_key(const struct sw_flow_key *key, struct sk_buff *skb)
-@@ -418,7 +423,7 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
- 		}
- 	}
- 
--	ovs_ct_update_key(skb, key, true);
-+	ovs_ct_update_key(skb, info, key, true);
- 
- 	return 0;
- }
-@@ -708,7 +713,7 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
- 	nf_conntrack_get(&ct_info.ct->ct_general);
- 	return 0;
- err_free_ct:
--	nf_conntrack_free(ct_info.ct);
-+	__ovs_ct_free_action(&ct_info);
- 	return err;
- }
- 
-@@ -750,6 +755,11 @@ void ovs_ct_free_action(const struct nlattr *a)
- {
- 	struct ovs_conntrack_info *ct_info = nla_data(a);
- 
-+	__ovs_ct_free_action(ct_info);
-+}
-+
-+static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
-+{
- 	if (ct_info->helper)
- 		module_put(ct_info->helper->me);
- 	if (ct_info->ct)
-diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
-index 7ec667d..b5c2cf2 100644
---- a/net/sched/sch_api.c
-+++ b/net/sched/sch_api.c
-@@ -950,7 +950,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
- 		}
- 		lockdep_set_class(qdisc_lock(sch), &qdisc_tx_lock);
- 		if (!netif_is_multiqueue(dev))
--			sch->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT;
-+			sch->flags |= TCQ_F_ONETXQUEUE;
- 	}
- 
- 	sch->handle = handle;
-diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
-index e917d27..40677cf 100644
---- a/net/sctp/ipv6.c
-+++ b/net/sctp/ipv6.c
-@@ -635,6 +635,7 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
- 	struct sock *newsk;
- 	struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
- 	struct sctp6_sock *newsctp6sk;
-+	struct ipv6_txoptions *opt;
- 
- 	newsk = sk_alloc(sock_net(sk), PF_INET6, GFP_KERNEL, sk->sk_prot, 0);
- 	if (!newsk)
-@@ -654,6 +655,13 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
- 
- 	memcpy(newnp, np, sizeof(struct ipv6_pinfo));
- 
-+	rcu_read_lock();
-+	opt = rcu_dereference(np->opt);
-+	if (opt)
-+		opt = ipv6_dup_options(newsk, opt);
-+	RCU_INIT_POINTER(newnp->opt, opt);
-+	rcu_read_unlock();
-+
- 	/* Initialize sk's sport, dport, rcv_saddr and daddr for getsockname()
- 	 * and getpeername().
- 	 */
-diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
-index 7954c52..8d67d72 100644
---- a/net/sctp/sm_make_chunk.c
-+++ b/net/sctp/sm_make_chunk.c
-@@ -1652,7 +1652,7 @@ static sctp_cookie_param_t *sctp_pack_cookie(const struct sctp_endpoint *ep,
- 
- 	/* Set an expiration time for the cookie.  */
- 	cookie->c.expiration = ktime_add(asoc->cookie_life,
--					 ktime_get());
-+					 ktime_get_real());
- 
- 	/* Copy the peer's init packet.  */
- 	memcpy(&cookie->c.peer_init[0], init_chunk->chunk_hdr,
-@@ -1780,7 +1780,7 @@ no_hmac:
- 	if (sock_flag(ep->base.sk, SOCK_TIMESTAMP))
- 		kt = skb_get_ktime(skb);
- 	else
--		kt = ktime_get();
-+		kt = ktime_get_real();
- 
- 	if (!asoc && ktime_before(bear_cookie->expiration, kt)) {
- 		/*
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 3ec88be..84b1b50 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -7163,6 +7163,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
- 	newsk->sk_type = sk->sk_type;
- 	newsk->sk_bound_dev_if = sk->sk_bound_dev_if;
- 	newsk->sk_flags = sk->sk_flags;
-+	newsk->sk_tsflags = sk->sk_tsflags;
- 	newsk->sk_no_check_tx = sk->sk_no_check_tx;
- 	newsk->sk_no_check_rx = sk->sk_no_check_rx;
- 	newsk->sk_reuse = sk->sk_reuse;
-@@ -7195,6 +7196,9 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
- 	newinet->mc_ttl = 1;
- 	newinet->mc_index = 0;
- 	newinet->mc_list = NULL;
-+
-+	if (newsk->sk_flags & SK_FLAGS_TIMESTAMP)
-+		net_enable_timestamp();
- }
- 
- static inline void sctp_copy_descendant(struct sock *sk_to,
-diff --git a/net/socket.c b/net/socket.c
-index 9963a0b..f3fbe17 100644
---- a/net/socket.c
-+++ b/net/socket.c
-@@ -1702,6 +1702,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
- 	msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
- 	/* We assume all kernel code knows the size of sockaddr_storage */
- 	msg.msg_namelen = 0;
-+	msg.msg_iocb = NULL;
- 	if (sock->file->f_flags & O_NONBLOCK)
- 		flags |= MSG_DONTWAIT;
- 	err = sock_recvmsg(sock, &msg, iov_iter_count(&msg.msg_iter), flags);
-diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
-index 86f2e7c..73bdf1b 100644
---- a/net/tipc/udp_media.c
-+++ b/net/tipc/udp_media.c
-@@ -162,7 +162,7 @@ static int tipc_udp_send_msg(struct net *net, struct sk_buff *skb,
- 	if (skb_headroom(skb) < UDP_MIN_HEADROOM) {
- 		err = pskb_expand_head(skb, UDP_MIN_HEADROOM, 0, GFP_ATOMIC);
- 		if (err)
--			goto tx_error;
-+			return err;
- 	}
- 
- 	clone = skb_clone(skb, GFP_ATOMIC);
-diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 128b098..0fc6dba 100644
---- a/net/unix/af_unix.c
-+++ b/net/unix/af_unix.c
-@@ -2255,14 +2255,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state)
- 	/* Lock the socket to prevent queue disordering
- 	 * while sleeps in memcpy_tomsg
- 	 */
--	err = mutex_lock_interruptible(&u->readlock);
--	if (unlikely(err)) {
--		/* recvmsg() in non blocking mode is supposed to return -EAGAIN
--		 * sk_rcvtimeo is not honored by mutex_lock_interruptible()
--		 */
--		err = noblock ? -EAGAIN : -ERESTARTSYS;
--		goto out;
--	}
-+	mutex_lock(&u->readlock);
- 
- 	if (flags & MSG_PEEK)
- 		skip = sk_peek_offset(sk, flags);
-@@ -2306,12 +2299,12 @@ again:
- 			timeo = unix_stream_data_wait(sk, timeo, last,
- 						      last_len);
- 
--			if (signal_pending(current) ||
--			    mutex_lock_interruptible(&u->readlock)) {
-+			if (signal_pending(current)) {
- 				err = sock_intr_errno(timeo);
- 				goto out;
- 			}
- 
-+			mutex_lock(&u->readlock);
- 			continue;
- unlock:
- 			unix_state_unlock(sk);
-diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
-index 0b9ec78..26f0e0a 100644
---- a/security/keys/keyctl.c
-+++ b/security/keys/keyctl.c
-@@ -757,16 +757,16 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
- 
- 	/* the key is probably readable - now try to read it */
- can_read_key:
--	ret = key_validate(key);
--	if (ret == 0) {
--		ret = -EOPNOTSUPP;
--		if (key->type->read) {
--			/* read the data with the semaphore held (since we
--			 * might sleep) */
--			down_read(&key->sem);
-+	ret = -EOPNOTSUPP;
-+	if (key->type->read) {
-+		/* Read the data with the semaphore held (since we might sleep)
-+		 * to protect against the key being updated or revoked.
-+		 */
-+		down_read(&key->sem);
-+		ret = key_validate(key);
-+		if (ret == 0)
- 			ret = key->type->read(key, buffer, buflen);
--			up_read(&key->sem);
--		}
-+		up_read(&key->sem);
- 	}
- 
- error2:
-diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
-index 43b4cdd..7877e5c 100644
---- a/security/keys/process_keys.c
-+++ b/security/keys/process_keys.c
-@@ -794,6 +794,7 @@ long join_session_keyring(const char *name)
- 		ret = PTR_ERR(keyring);
- 		goto error2;
- 	} else if (keyring == new->session_keyring) {
-+		key_put(keyring);
- 		ret = 0;
- 		goto error2;
- 	}
diff --git a/4.3.4/0000_README b/4.3.5/0000_README
index ce73e44..e49fbae 100644
--- a/4.3.4/0000_README
+++ b/4.3.5/0000_README
@@ -2,11 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1003_linux-4.3.4.patch
-From:	http://www.kernel.org
-Desc:	Linux 4.3.4
-
-Patch:	4420_grsecurity-3.1-4.3.4-201601292206.patch
+Patch:	4420_grsecurity-3.1-4.3.5-201601311611.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/4.3.4/4420_grsecurity-3.1-4.3.4-201601292206.patch b/4.3.5/4420_grsecurity-3.1-4.3.5-201601311611.patch
index 92cf754..63ba087 100644
--- a/4.3.4/4420_grsecurity-3.1-4.3.4-201601292206.patch
+++ b/4.3.5/4420_grsecurity-3.1-4.3.5-201601311611.patch
@@ -452,7 +452,7 @@ index 6fccb69..60c7c7a 100644
  
  A toggle value indicating if modules are allowed to be loaded
 diff --git a/Makefile b/Makefile
-index 69430ed..8fa626c 100644
+index efc7a76..aa435e3 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -298,7 +298,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -4743,7 +4743,7 @@ index 7cd1514..0307305 100644
  }
  
 diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
-index b8efb8c..0b8f924 100644
+index 4d25fd0..0b8f924 100644
 --- a/arch/arm/net/bpf_jit_32.c
 +++ b/arch/arm/net/bpf_jit_32.c
 @@ -20,6 +20,7 @@
@@ -4819,24 +4819,7 @@ index b8efb8c..0b8f924 100644
  
  	return (u64)err << 32 | ntohl(ret);
  }
-@@ -182,31 +167,19 @@ static inline int mem_words_used(struct jit_ctx *ctx)
- 	return fls(ctx->seen & SEEN_MEM);
- }
- 
--static inline bool is_load_to_a(u16 inst)
--{
--	switch (inst) {
--	case BPF_LD | BPF_W | BPF_LEN:
--	case BPF_LD | BPF_W | BPF_ABS:
--	case BPF_LD | BPF_H | BPF_ABS:
--	case BPF_LD | BPF_B | BPF_ABS:
--		return true;
--	default:
--		return false;
--	}
--}
--
- static void jit_fill_hole(void *area, unsigned int size)
+@@ -186,8 +171,10 @@ static void jit_fill_hole(void *area, unsigned int size)
  {
  	u32 *ptr;
  	/* We are guaranteed to have aligned memory. */
@@ -4847,22 +4830,7 @@ index b8efb8c..0b8f924 100644
  }
  
  static void build_prologue(struct jit_ctx *ctx)
- {
- 	u16 reg_set = saved_regs(ctx);
--	u16 first_inst = ctx->skf->insns[0].code;
- 	u16 off;
- 
- #ifdef CONFIG_FRAME_POINTER
-@@ -236,7 +209,7 @@ static void build_prologue(struct jit_ctx *ctx)
- 		emit(ARM_MOV_I(r_X, 0), ctx);
- 
- 	/* do not leak kernel data to userspace */
--	if ((first_inst != (BPF_RET | BPF_K)) && !(is_load_to_a(first_inst)))
-+	if (bpf_needs_clear_a(&ctx->skf->insns[0]))
- 		emit(ARM_MOV_I(r_A, 0), ctx);
- 
- 	/* stack space for the BPF_MEM words */
-@@ -556,6 +529,9 @@ static int build_body(struct jit_ctx *ctx)
+@@ -542,6 +529,9 @@ static int build_body(struct jit_ctx *ctx)
  		case BPF_LD | BPF_B | BPF_ABS:
  			load_order = 0;
  load:
@@ -4872,7 +4840,7 @@ index b8efb8c..0b8f924 100644
  			emit_mov_i(r_off, k, ctx);
  load_common:
  			ctx->seen |= SEEN_DATA | SEEN_CALL;
-@@ -570,18 +546,6 @@ load_common:
+@@ -556,18 +546,6 @@ load_common:
  				condt = ARM_COND_HI;
  			}
  
@@ -4891,7 +4859,7 @@ index b8efb8c..0b8f924 100644
  			_emit(condt, ARM_ADD_R(r_scratch, r_off, r_skb_data),
  			      ctx);
  
-@@ -744,7 +708,8 @@ load_ind:
+@@ -730,7 +708,8 @@ load_ind:
  		case BPF_ALU | BPF_RSH | BPF_K:
  			if (unlikely(k > 31))
  				return -1;
@@ -7129,47 +7097,6 @@ index 5c81fdd..db158d3 100644
  int __virt_addr_valid(const volatile void *kaddr)
  {
  	return pfn_valid(PFN_DOWN(virt_to_phys(kaddr)));
-diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c
-index 0c4a133..26e947d 100644
---- a/arch/mips/net/bpf_jit.c
-+++ b/arch/mips/net/bpf_jit.c
-@@ -521,19 +521,6 @@ static inline u16 align_sp(unsigned int num)
- 	return num;
- }
- 
--static bool is_load_to_a(u16 inst)
--{
--	switch (inst) {
--	case BPF_LD | BPF_W | BPF_LEN:
--	case BPF_LD | BPF_W | BPF_ABS:
--	case BPF_LD | BPF_H | BPF_ABS:
--	case BPF_LD | BPF_B | BPF_ABS:
--		return true;
--	default:
--		return false;
--	}
--}
--
- static void save_bpf_jit_regs(struct jit_ctx *ctx, unsigned offset)
- {
- 	int i = 0, real_off = 0;
-@@ -614,7 +601,6 @@ static unsigned int get_stack_depth(struct jit_ctx *ctx)
- 
- static void build_prologue(struct jit_ctx *ctx)
- {
--	u16 first_inst = ctx->skf->insns[0].code;
- 	int sp_off;
- 
- 	/* Calculate the total offset for the stack pointer */
-@@ -641,7 +627,7 @@ static void build_prologue(struct jit_ctx *ctx)
- 		emit_jit_reg_move(r_X, r_zero, ctx);
- 
- 	/* Do not leak kernel data to userspace */
--	if ((first_inst != (BPF_RET | BPF_K)) && !(is_load_to_a(first_inst)))
-+	if (bpf_needs_clear_a(&ctx->skf->insns[0]))
- 		emit_jit_reg_move(r_A, r_zero, ctx);
- }
- 
 diff --git a/arch/mips/sgi-ip27/ip27-nmi.c b/arch/mips/sgi-ip27/ip27-nmi.c
 index a2358b4..7cead4f 100644
 --- a/arch/mips/sgi-ip27/ip27-nmi.c
@@ -8591,10 +8518,10 @@ index 62cfb0c..50c6402 100644
  #define _PAGE_NO_CACHE	0x020	/* I: cache inhibit */
  #define _PAGE_WRITETHRU	0x040	/* W: cache write-through */
 diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
-index a908ada..f3c8966 100644
+index 2220f7a..5a9420e 100644
 --- a/arch/powerpc/include/asm/reg.h
 +++ b/arch/powerpc/include/asm/reg.h
-@@ -252,6 +252,7 @@
+@@ -253,6 +253,7 @@
  #define SPRN_DBCR	0x136	/* e300 Data Breakpoint Control Reg */
  #define SPRN_DSISR	0x012	/* Data Storage Interrupt Status Register */
  #define   DSISR_NOHPTE		0x40000000	/* no translation found */
@@ -9014,10 +8941,10 @@ index c94d2e0..992a9ce 100644
  			    sechdrs, module);
  #endif
 diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
-index 75b6676..41c72b5 100644
+index 646bf4d..36d4d76 100644
 --- a/arch/powerpc/kernel/process.c
 +++ b/arch/powerpc/kernel/process.c
-@@ -1033,8 +1033,8 @@ void show_regs(struct pt_regs * regs)
+@@ -1051,8 +1051,8 @@ void show_regs(struct pt_regs * regs)
  	 * Lookup NIP late so we have the best change of getting the
  	 * above info out without failing
  	 */
@@ -9028,7 +8955,7 @@ index 75b6676..41c72b5 100644
  #endif
  	show_stack(current, (unsigned long *) regs->gpr[1]);
  	if (!user_mode(regs))
-@@ -1550,10 +1550,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
+@@ -1568,10 +1568,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
  		newsp = stack[0];
  		ip = stack[STACK_FRAME_LR_SAVE];
  		if (!firstframe || ip != lr) {
@@ -9041,7 +8968,7 @@ index 75b6676..41c72b5 100644
  				       (void *)current->ret_stack[curr_frame].ret);
  				curr_frame--;
  			}
-@@ -1573,7 +1573,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
+@@ -1591,7 +1591,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
  			struct pt_regs *regs = (struct pt_regs *)
  				(sp + STACK_FRAME_OVERHEAD);
  			lr = regs->link;
@@ -9050,7 +8977,7 @@ index 75b6676..41c72b5 100644
  			       regs->trap, (void *)regs->nip, (void *)lr);
  			firstframe = 1;
  		}
-@@ -1609,49 +1609,3 @@ void notrace __ppc64_runlatch_off(void)
+@@ -1627,49 +1627,3 @@ void notrace __ppc64_runlatch_off(void)
  	mtspr(SPRN_CTRLT, ctrl);
  }
  #endif /* CONFIG_PPC64 */
@@ -9140,10 +9067,10 @@ index 737c0d0..59c7417 100644
  
  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
 diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
-index 0dbee46..97b77b9 100644
+index ef7c24e..755a485 100644
 --- a/arch/powerpc/kernel/signal_32.c
 +++ b/arch/powerpc/kernel/signal_32.c
-@@ -1014,7 +1014,7 @@ int handle_rt_signal32(struct ksignal *ksig, sigset_t *oldset,
+@@ -1018,7 +1018,7 @@ int handle_rt_signal32(struct ksignal *ksig, sigset_t *oldset,
  	/* Save user registers on the stack */
  	frame = &rt_sf->uc.uc_mcontext;
  	addr = frame;
@@ -9153,10 +9080,10 @@ index 0dbee46..97b77b9 100644
  		tramp = current->mm->context.vdso_base + vdso32_rt_sigtramp;
  	} else {
 diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
-index 20756df..300e2a4 100644
+index c676ece..188c057 100644
 --- a/arch/powerpc/kernel/signal_64.c
 +++ b/arch/powerpc/kernel/signal_64.c
-@@ -765,7 +765,7 @@ int handle_rt_signal64(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs
+@@ -769,7 +769,7 @@ int handle_rt_signal64(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs
  	current->thread.fp_state.fpscr = 0;
  
  	/* Set up to return from userspace. */
@@ -9463,31 +9390,6 @@ index 0f432a7..abfe841 100644
  	/* If hint, make sure it matches our alignment restrictions */
  	if (!fixed && addr) {
  		addr = _ALIGN_UP(addr, 1ul << pshift);
-diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
-index 17cea18..264c473 100644
---- a/arch/powerpc/net/bpf_jit_comp.c
-+++ b/arch/powerpc/net/bpf_jit_comp.c
-@@ -78,18 +78,9 @@ static void bpf_jit_build_prologue(struct bpf_prog *fp, u32 *image,
- 		PPC_LI(r_X, 0);
- 	}
- 
--	switch (filter[0].code) {
--	case BPF_RET | BPF_K:
--	case BPF_LD | BPF_W | BPF_LEN:
--	case BPF_LD | BPF_W | BPF_ABS:
--	case BPF_LD | BPF_H | BPF_ABS:
--	case BPF_LD | BPF_B | BPF_ABS:
--		/* first instruction sets A register (or is RET 'constant') */
--		break;
--	default:
--		/* make sure we dont leak kernel information to user */
-+	/* make sure we dont leak kernel information to user */
-+	if (bpf_needs_clear_a(&filter[0]))
- 		PPC_LI(r_A, 0);
--	}
- }
- 
- static void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
 diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c
 index 5038fd5..87a2033 100644
 --- a/arch/powerpc/platforms/cell/spufs/file.c
@@ -12341,35 +12243,6 @@ index 4ac88b7..bac6cb2 100644
  #endif /* CONFIG_SMP */
  #endif /* CONFIG_DEBUG_DCFLUSH */
  }
-diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
-index f8b9f71..17e71d2 100644
---- a/arch/sparc/net/bpf_jit_comp.c
-+++ b/arch/sparc/net/bpf_jit_comp.c
-@@ -420,22 +420,9 @@ void bpf_jit_compile(struct bpf_prog *fp)
- 		}
- 		emit_reg_move(O7, r_saved_O7);
- 
--		switch (filter[0].code) {
--		case BPF_RET | BPF_K:
--		case BPF_LD | BPF_W | BPF_LEN:
--		case BPF_LD | BPF_W | BPF_ABS:
--		case BPF_LD | BPF_H | BPF_ABS:
--		case BPF_LD | BPF_B | BPF_ABS:
--			/* The first instruction sets the A register (or is
--			 * a "RET 'constant'")
--			 */
--			break;
--		default:
--			/* Make sure we dont leak kernel information to the
--			 * user.
--			 */
-+		/* Make sure we dont leak kernel information to the user. */
-+		if (bpf_needs_clear_a(&filter[0]))
- 			emit_clear(r_A); /* A = 0 */
--		}
- 
- 		for (i = 0; i < flen; i++) {
- 			unsigned int K = filter[i].k;
 diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
 index 106c21b..185bf0f 100644
 --- a/arch/tile/Kconfig
@@ -18490,7 +18363,7 @@ index cfe3b95..d01b118 100644
  	int bitpos = -1;
  	/*
 diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h
-index 4fa687a..4ca636f 100644
+index 6b8d6e8..3cbf4f8 100644
 --- a/arch/x86/include/asm/boot.h
 +++ b/arch/x86/include/asm/boot.h
 @@ -6,7 +6,7 @@
@@ -19789,7 +19662,7 @@ index 55234d5..7e3c4bf 100644
  	atomic_t perf_rdpmc_allowed;	/* nonzero if rdpmc is allowed */
  } mm_context_t;
 diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
-index 379cd36..8ef26be 100644
+index bfd9b2a..a931fef 100644
 --- a/arch/x86/include/asm/mmu_context.h
 +++ b/arch/x86/include/asm/mmu_context.h
 @@ -46,7 +46,7 @@ struct ldt_struct {
@@ -19825,7 +19698,7 @@ index 379cd36..8ef26be 100644
  	return 0;
  }
  static inline void destroy_context(struct mm_struct *mm) {}
-@@ -98,26 +115,95 @@ static inline void load_mm_ldt(struct mm_struct *mm)
+@@ -98,19 +115,84 @@ static inline void load_mm_ldt(struct mm_struct *mm)
  
  static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
  {
@@ -19910,18 +19783,19 @@ index 379cd36..8ef26be 100644
  		this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
  		this_cpu_write(cpu_tlbstate.active_mm, next);
  #endif
- 		cpumask_set_cpu(cpu, mm_cpumask(next));
- 
- 		/* Re-load page tables */
+@@ -144,7 +226,11 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ 		 * ordering guarantee we need.
+ 		 *
+ 		 */
 +#ifdef CONFIG_PAX_PER_CPU_PGD
 +		pax_switch_mm(next, cpu);
 +#else
  		load_cr3(next->pgd);
 +#endif
+ 
  		trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL);
  
- 		/* Stop flush ipis for the previous mm */
-@@ -142,9 +228,31 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+@@ -170,9 +256,31 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
  		if (unlikely(prev->context.ldt != next->context.ldt))
  			load_mm_ldt(next);
  #endif
@@ -19954,9 +19828,9 @@ index 379cd36..8ef26be 100644
  		this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
  		BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next);
  
-@@ -161,13 +269,30 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
- 			 * tlb flush IPI delivery. We must reload CR3
- 			 * to make sure to use no freed page tables.
+@@ -193,13 +301,30 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ 			 * As above, load_cr3() is serializing and orders TLB
+ 			 * fills with respect to the mm_cpumask write.
  			 */
 +
 +#ifndef CONFIG_PAX_PER_CPU_PGD
@@ -20162,10 +20036,10 @@ index b3bebf9..cb419e7 100644
  
  #define __phys_reloc_hide(x)	(x)
 diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
-index 10d0596..16a2a7c 100644
+index c759b3c..043875b 100644
 --- a/arch/x86/include/asm/paravirt.h
 +++ b/arch/x86/include/asm/paravirt.h
-@@ -530,7 +530,7 @@ static inline pmd_t __pmd(pmdval_t val)
+@@ -536,7 +536,7 @@ static inline pmd_t __pmd(pmdval_t val)
  	return (pmd_t) { ret };
  }
  
@@ -20174,7 +20048,7 @@ index 10d0596..16a2a7c 100644
  {
  	pmdval_t ret;
  
-@@ -596,6 +596,18 @@ static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
+@@ -602,6 +602,18 @@ static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
  			    val);
  }
  
@@ -20193,7 +20067,7 @@ index 10d0596..16a2a7c 100644
  static inline void pgd_clear(pgd_t *pgdp)
  {
  	set_pgd(pgdp, __pgd(0));
-@@ -680,6 +692,21 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
+@@ -686,6 +698,21 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
  	pv_mmu_ops.set_fixmap(idx, phys, flags);
  }
  
@@ -20215,7 +20089,7 @@ index 10d0596..16a2a7c 100644
  #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
  
  #ifdef CONFIG_QUEUED_SPINLOCKS
-@@ -903,7 +930,7 @@ extern void default_banner(void);
+@@ -909,7 +936,7 @@ extern void default_banner(void);
  
  #define PARA_PATCH(struct, off)        ((PARAVIRT_PATCH_##struct + (off)) / 4)
  #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
@@ -20224,7 +20098,7 @@ index 10d0596..16a2a7c 100644
  #endif
  
  #define INTERRUPT_RETURN						\
-@@ -973,6 +1000,21 @@ extern void default_banner(void);
+@@ -979,6 +1006,21 @@ extern void default_banner(void);
  	PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_usergs_sysret64),	\
  		  CLBR_NONE,						\
  		  jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_usergs_sysret64))
@@ -20247,10 +20121,10 @@ index 10d0596..16a2a7c 100644
  
  #endif /* __ASSEMBLY__ */
 diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
-index 31247b5..6b5b8ef 100644
+index 3d44191..1992d40 100644
 --- a/arch/x86/include/asm/paravirt_types.h
 +++ b/arch/x86/include/asm/paravirt_types.h
-@@ -84,7 +84,7 @@ struct pv_init_ops {
+@@ -89,7 +89,7 @@ struct pv_init_ops {
  	 */
  	unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
  			  unsigned long addr, unsigned len);
@@ -20259,7 +20133,7 @@ index 31247b5..6b5b8ef 100644
  
  
  struct pv_lazy_ops {
-@@ -92,12 +92,12 @@ struct pv_lazy_ops {
+@@ -97,12 +97,12 @@ struct pv_lazy_ops {
  	void (*enter)(void);
  	void (*leave)(void);
  	void (*flush)(void);
@@ -20274,7 +20148,7 @@ index 31247b5..6b5b8ef 100644
  
  struct pv_cpu_ops {
  	/* hooks for various privileged instructions */
-@@ -190,7 +190,7 @@ struct pv_cpu_ops {
+@@ -195,7 +195,7 @@ struct pv_cpu_ops {
  
  	void (*start_context_switch)(struct task_struct *prev);
  	void (*end_context_switch)(struct task_struct *next);
@@ -20283,7 +20157,7 @@ index 31247b5..6b5b8ef 100644
  
  struct pv_irq_ops {
  	/*
-@@ -213,7 +213,7 @@ struct pv_irq_ops {
+@@ -218,7 +218,7 @@ struct pv_irq_ops {
  #ifdef CONFIG_X86_64
  	void (*adjust_exception_frame)(void);
  #endif
@@ -20292,7 +20166,7 @@ index 31247b5..6b5b8ef 100644
  
  struct pv_apic_ops {
  #ifdef CONFIG_X86_LOCAL_APIC
-@@ -221,7 +221,7 @@ struct pv_apic_ops {
+@@ -226,7 +226,7 @@ struct pv_apic_ops {
  				 unsigned long start_eip,
  				 unsigned long start_esp);
  #endif
@@ -20301,7 +20175,7 @@ index 31247b5..6b5b8ef 100644
  
  struct pv_mmu_ops {
  	unsigned long (*read_cr2)(void);
-@@ -311,6 +311,7 @@ struct pv_mmu_ops {
+@@ -316,6 +316,7 @@ struct pv_mmu_ops {
  	struct paravirt_callee_save make_pud;
  
  	void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
@@ -20309,7 +20183,7 @@ index 31247b5..6b5b8ef 100644
  #endif	/* CONFIG_PGTABLE_LEVELS == 4 */
  #endif	/* CONFIG_PGTABLE_LEVELS >= 3 */
  
-@@ -322,7 +323,13 @@ struct pv_mmu_ops {
+@@ -327,7 +328,13 @@ struct pv_mmu_ops {
  	   an mfn.  We can tell which is which from the index. */
  	void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
  			   phys_addr_t phys, pgprot_t flags);
@@ -20324,7 +20198,7 @@ index 31247b5..6b5b8ef 100644
  
  struct arch_spinlock;
  #ifdef CONFIG_SMP
-@@ -344,11 +351,14 @@ struct pv_lock_ops {
+@@ -349,11 +356,14 @@ struct pv_lock_ops {
  	struct paravirt_callee_save lock_spinning;
  	void (*unlock_kick)(struct arch_spinlock *lock, __ticket_t ticket);
  #endif /* !CONFIG_QUEUED_SPINLOCKS */
@@ -20341,7 +20215,7 @@ index 31247b5..6b5b8ef 100644
  struct paravirt_patch_template {
  	struct pv_init_ops pv_init_ops;
  	struct pv_time_ops pv_time_ops;
-@@ -357,7 +367,7 @@ struct paravirt_patch_template {
+@@ -362,7 +372,7 @@ struct paravirt_patch_template {
  	struct pv_apic_ops pv_apic_ops;
  	struct pv_mmu_ops pv_mmu_ops;
  	struct pv_lock_ops pv_lock_ops;
@@ -20954,7 +20828,7 @@ index b12f810..aedcc13 100644
  
  /*
 diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
-index 19577dd..f4acc54 100644
+index b7692da..c888b3b 100644
 --- a/arch/x86/include/asm/processor.h
 +++ b/arch/x86/include/asm/processor.h
 @@ -136,7 +136,7 @@ struct cpuinfo_x86 {
@@ -21047,7 +20921,7 @@ index 19577dd..f4acc54 100644
  #else
  	/* sp0 on x86_32 is special in and around vm86 mode. */
  	return this_cpu_read_stable(cpu_current_top_of_stack);
-@@ -695,19 +702,29 @@ static inline void spin_lock_prefetch(const void *x)
+@@ -696,19 +703,29 @@ static inline void spin_lock_prefetch(const void *x)
  #define TOP_OF_INIT_STACK ((unsigned long)&init_stack + sizeof(init_stack) - \
  			   TOP_OF_KERNEL_STACK_PADDING)
  
@@ -21078,7 +20952,7 @@ index 19577dd..f4acc54 100644
  }
  
  extern unsigned long thread_saved_pc(struct task_struct *tsk);
-@@ -722,12 +739,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
+@@ -723,12 +740,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
   * "struct pt_regs" is possible, but they may contain the
   * completely wrong values.
   */
@@ -21092,7 +20966,7 @@ index 19577dd..f4acc54 100644
  
  #define KSTK_ESP(task)		(task_pt_regs(task)->sp)
  
-@@ -741,13 +753,13 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
+@@ -742,13 +754,13 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
   * particular problem by preventing anything from being mapped
   * at the maximum canonical address.
   */
@@ -21108,7 +20982,7 @@ index 19577dd..f4acc54 100644
  
  #define TASK_SIZE		(test_thread_flag(TIF_ADDR32) ? \
  					IA32_PAGE_OFFSET : TASK_SIZE_MAX)
-@@ -758,7 +770,8 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
+@@ -759,7 +771,8 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
  #define STACK_TOP_MAX		TASK_SIZE_MAX
  
  #define INIT_THREAD  { \
@@ -21118,7 +20992,7 @@ index 19577dd..f4acc54 100644
  }
  
  /*
-@@ -781,6 +794,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
+@@ -782,6 +795,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
   */
  #define TASK_UNMAPPED_BASE	(PAGE_ALIGN(TASK_SIZE / 3))
  
@@ -21129,7 +21003,7 @@ index 19577dd..f4acc54 100644
  #define KSTK_EIP(task)		(task_pt_regs(task)->ip)
  
  /* Get/set a process' ability to use the timestamp counter instruction */
-@@ -826,7 +843,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves)
+@@ -827,7 +844,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves)
  	return 0;
  }
  
@@ -21138,7 +21012,7 @@ index 19577dd..f4acc54 100644
  extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
  
  void default_idle(void);
-@@ -836,6 +853,6 @@ bool xen_set_default_idle(void);
+@@ -837,6 +854,6 @@ bool xen_set_default_idle(void);
  #define xen_set_default_idle 0
  #endif
  
@@ -24055,7 +23929,7 @@ index be4febc..f7af533 100644
  
  	return &cache_private_group;
 diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
-index 9d014b82..8186c29 100644
+index 6b2c822..84c8d34 100644
 --- a/arch/x86/kernel/cpu/mcheck/mce.c
 +++ b/arch/x86/kernel/cpu/mcheck/mce.c
 @@ -47,6 +47,7 @@
@@ -24134,7 +24008,7 @@ index 9d014b82..8186c29 100644
  		wait_for_panic();
  	if (!mca_cfg.monarch_timeout)
  		goto out;
-@@ -1654,7 +1654,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
+@@ -1665,7 +1665,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
  }
  
  /* Call the installed machine check handler for this CPU setup. */
@@ -24143,7 +24017,7 @@ index 9d014b82..8186c29 100644
  						unexpected_machine_check;
  
  /*
-@@ -1683,7 +1683,9 @@ void mcheck_cpu_init(struct cpuinfo_x86 *c)
+@@ -1694,7 +1694,9 @@ void mcheck_cpu_init(struct cpuinfo_x86 *c)
  		return;
  	}
  
@@ -24153,7 +24027,7 @@ index 9d014b82..8186c29 100644
  
  	__mcheck_cpu_init_generic();
  	__mcheck_cpu_init_vendor(c);
-@@ -1714,7 +1716,7 @@ void mcheck_cpu_clear(struct cpuinfo_x86 *c)
+@@ -1725,7 +1727,7 @@ void mcheck_cpu_clear(struct cpuinfo_x86 *c)
   */
  
  static DEFINE_SPINLOCK(mce_chrdev_state_lock);
@@ -24162,7 +24036,7 @@ index 9d014b82..8186c29 100644
  static int mce_chrdev_open_exclu;	/* already open exclusive? */
  
  static int mce_chrdev_open(struct inode *inode, struct file *file)
-@@ -1722,7 +1724,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
+@@ -1733,7 +1735,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
  	spin_lock(&mce_chrdev_state_lock);
  
  	if (mce_chrdev_open_exclu ||
@@ -24171,7 +24045,7 @@ index 9d014b82..8186c29 100644
  		spin_unlock(&mce_chrdev_state_lock);
  
  		return -EBUSY;
-@@ -1730,7 +1732,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
+@@ -1741,7 +1743,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
  
  	if (file->f_flags & O_EXCL)
  		mce_chrdev_open_exclu = 1;
@@ -24180,7 +24054,7 @@ index 9d014b82..8186c29 100644
  
  	spin_unlock(&mce_chrdev_state_lock);
  
-@@ -1741,7 +1743,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
+@@ -1752,7 +1754,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
  {
  	spin_lock(&mce_chrdev_state_lock);
  
@@ -24189,7 +24063,7 @@ index 9d014b82..8186c29 100644
  	mce_chrdev_open_exclu = 0;
  
  	spin_unlock(&mce_chrdev_state_lock);
-@@ -2421,7 +2423,7 @@ static __init void mce_init_banks(void)
+@@ -2432,7 +2434,7 @@ static __init void mce_init_banks(void)
  
  	for (i = 0; i < mca_cfg.banks; i++) {
  		struct mce_bank *b = &mce_banks[i];
@@ -24198,7 +24072,7 @@ index 9d014b82..8186c29 100644
  
  		sysfs_attr_init(&a->attr);
  		a->attr.name	= b->attrname;
-@@ -2528,7 +2530,7 @@ struct dentry *mce_get_debugfs_dir(void)
+@@ -2539,7 +2541,7 @@ struct dentry *mce_get_debugfs_dir(void)
  static void mce_reset(void)
  {
  	cpu_missing = 0;
@@ -28439,7 +28313,7 @@ index 2f355d2..e75ed0a 100644
  
  	return ret;
 diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
-index 02693dd..33a1546 100644
+index f660d63..564a120 100644
 --- a/arch/x86/kernel/reboot.c
 +++ b/arch/x86/kernel/reboot.c
 @@ -70,6 +70,11 @@ static int __init set_bios_reboot(const struct dmi_system_id *d)
@@ -28494,7 +28368,7 @@ index 02693dd..33a1546 100644
  
  	/* Acer */
  	{	/* Handle reboot issue on Acer Aspire one */
-@@ -511,7 +538,7 @@ void __attribute__((weak)) mach_reboot_fixups(void)
+@@ -519,7 +546,7 @@ void __attribute__((weak)) mach_reboot_fixups(void)
   * This means that this function can never return, it can misbehave
   * by not rebooting properly and hanging.
   */
@@ -28503,7 +28377,7 @@ index 02693dd..33a1546 100644
  {
  	int i;
  	int attempt = 0;
-@@ -631,13 +658,13 @@ void native_machine_shutdown(void)
+@@ -639,13 +666,13 @@ void native_machine_shutdown(void)
  #endif
  }
  
@@ -28519,7 +28393,7 @@ index 02693dd..33a1546 100644
  {
  	pr_notice("machine restart\n");
  
-@@ -646,7 +673,7 @@ static void native_machine_restart(char *__unused)
+@@ -654,7 +681,7 @@ static void native_machine_restart(char *__unused)
  	__machine_emergency_restart(0);
  }
  
@@ -28528,7 +28402,7 @@ index 02693dd..33a1546 100644
  {
  	/* Stop other cpus and apics */
  	machine_shutdown();
-@@ -656,7 +683,7 @@ static void native_machine_halt(void)
+@@ -664,7 +691,7 @@ static void native_machine_halt(void)
  	stop_this_cpu(NULL);
  }
  
@@ -28537,7 +28411,7 @@ index 02693dd..33a1546 100644
  {
  	if (pm_power_off) {
  		if (!reboot_force)
-@@ -665,9 +692,10 @@ static void native_machine_power_off(void)
+@@ -673,9 +700,10 @@ static void native_machine_power_off(void)
  	}
  	/* A fallback in case there is no PM info available */
  	tboot_shutdown(TB_SHUTDOWN_HALT);
@@ -28733,7 +28607,7 @@ index e4fcb87..9c06c55 100644
  		 * Up to this point, the boot CPU has been using .init.data
  		 * area.  Reload any changed state for the boot CPU.
 diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
-index da52e6b..8c18d64 100644
+index 7d2b2ed..6c92c5f 100644
 --- a/arch/x86/kernel/signal.c
 +++ b/arch/x86/kernel/signal.c
 @@ -189,7 +189,7 @@ static unsigned long align_sigframe(unsigned long sp)
@@ -28826,7 +28700,7 @@ index 12c8286..aa65d13 100644
  	.smp_prepare_cpus	= native_smp_prepare_cpus,
  	.smp_cpus_done		= native_smp_cpus_done,
 diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index 892ee2e5..be6b3f6 100644
+index fbabe4f..c686333 100644
 --- a/arch/x86/kernel/smpboot.c
 +++ b/arch/x86/kernel/smpboot.c
 @@ -213,14 +213,17 @@ static void notrace start_secondary(void *unused)
@@ -28851,7 +28725,7 @@ index 892ee2e5..be6b3f6 100644
  	/*
  	 * Check TSC synchronization with the BP:
  	 */
-@@ -809,16 +812,15 @@ void common_cpu_up(unsigned int cpu, struct task_struct *idle)
+@@ -810,16 +813,15 @@ void common_cpu_up(unsigned int cpu, struct task_struct *idle)
  	alternatives_enable_smp();
  
  	per_cpu(current_task, cpu) = idle;
@@ -28870,7 +28744,7 @@ index 892ee2e5..be6b3f6 100644
  }
  
  /*
-@@ -839,9 +841,11 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
+@@ -840,9 +842,11 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
  	unsigned long timeout;
  
  	idle->thread.sp = (unsigned long) (((struct pt_regs *)
@@ -28883,7 +28757,7 @@ index 892ee2e5..be6b3f6 100644
  	initial_code = (unsigned long)start_secondary;
  	stack_start  = idle->thread.sp;
  
-@@ -989,6 +993,15 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
+@@ -990,6 +994,15 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
  
  	common_cpu_up(cpu, tidle);
  
@@ -30121,48 +29995,10 @@ index 736e6ab..b2e3094 100644
  			goto error;
  		walker->ptep_user[walker->level - 1] = ptep_user;
 diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
-index d7f8938..bc95a50 100644
+index 22d1813..bc95a50 100644
 --- a/arch/x86/kvm/svm.c
 +++ b/arch/x86/kvm/svm.c
-@@ -1108,6 +1108,7 @@ static void init_vmcb(struct vcpu_svm *svm)
- 	set_exception_intercept(svm, UD_VECTOR);
- 	set_exception_intercept(svm, MC_VECTOR);
- 	set_exception_intercept(svm, AC_VECTOR);
-+	set_exception_intercept(svm, DB_VECTOR);
- 
- 	set_intercept(svm, INTERCEPT_INTR);
- 	set_intercept(svm, INTERCEPT_NMI);
-@@ -1642,20 +1643,13 @@ static void svm_set_segment(struct kvm_vcpu *vcpu,
- 	mark_dirty(svm->vmcb, VMCB_SEG);
- }
- 
--static void update_db_bp_intercept(struct kvm_vcpu *vcpu)
-+static void update_bp_intercept(struct kvm_vcpu *vcpu)
- {
- 	struct vcpu_svm *svm = to_svm(vcpu);
- 
--	clr_exception_intercept(svm, DB_VECTOR);
- 	clr_exception_intercept(svm, BP_VECTOR);
- 
--	if (svm->nmi_singlestep)
--		set_exception_intercept(svm, DB_VECTOR);
--
- 	if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
--		if (vcpu->guest_debug &
--		    (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
--			set_exception_intercept(svm, DB_VECTOR);
- 		if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
- 			set_exception_intercept(svm, BP_VECTOR);
- 	} else
-@@ -1761,7 +1755,6 @@ static int db_interception(struct vcpu_svm *svm)
- 		if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
- 			svm->vmcb->save.rflags &=
- 				~(X86_EFLAGS_TF | X86_EFLAGS_RF);
--		update_db_bp_intercept(&svm->vcpu);
- 	}
- 
- 	if (svm->vcpu.guest_debug &
-@@ -3595,7 +3588,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
+@@ -3588,7 +3588,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
  	int cpu = raw_smp_processor_id();
  
  	struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
@@ -30174,15 +30010,7 @@ index d7f8938..bc95a50 100644
  	load_TR_desc();
  }
  
-@@ -3761,7 +3758,6 @@ static void enable_nmi_window(struct kvm_vcpu *vcpu)
- 	 */
- 	svm->nmi_singlestep = true;
- 	svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
--	update_db_bp_intercept(vcpu);
- }
- 
- static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
-@@ -3991,6 +3987,10 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -3983,6 +3987,10 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
  #endif
  #endif
  
@@ -30193,7 +30021,7 @@ index d7f8938..bc95a50 100644
  	reload_tss(vcpu);
  
  	local_irq_disable();
-@@ -4364,7 +4364,7 @@ static void svm_sched_in(struct kvm_vcpu *vcpu, int cpu)
+@@ -4356,7 +4364,7 @@ static void svm_sched_in(struct kvm_vcpu *vcpu, int cpu)
  {
  }
  
@@ -30202,17 +30030,8 @@ index d7f8938..bc95a50 100644
  	.cpu_has_kvm_support = has_svm,
  	.disabled_by_bios = is_disabled,
  	.hardware_setup = svm_hardware_setup,
-@@ -4383,7 +4383,7 @@ static struct kvm_x86_ops svm_x86_ops = {
- 	.vcpu_load = svm_vcpu_load,
- 	.vcpu_put = svm_vcpu_put,
- 
--	.update_db_bp_intercept = update_db_bp_intercept,
-+	.update_db_bp_intercept = update_bp_intercept,
- 	.get_msr = svm_get_msr,
- 	.set_msr = svm_set_msr,
- 	.get_segment_base = svm_get_segment_base,
 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 343d369..95ade96 100644
+index 2e0bd48..c18c0bf 100644
 --- a/arch/x86/kvm/vmx.c
 +++ b/arch/x86/kvm/vmx.c
 @@ -1440,12 +1440,12 @@ static void vmcs_write64(unsigned long field, u64 value)
@@ -30262,7 +30081,7 @@ index 343d369..95ade96 100644
  {
  	u64 host_tsc, tsc_offset;
  
-@@ -4450,7 +4458,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+@@ -4451,7 +4459,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
  	unsigned long cr4;
  
  	vmcs_writel(HOST_CR0, read_cr0() & ~X86_CR0_TS);  /* 22.2.3 */
@@ -30273,7 +30092,7 @@ index 343d369..95ade96 100644
  
  	/* Save the most likely value for this task's CR4 in the VMCS. */
  	cr4 = cr4_read_shadow();
-@@ -4477,7 +4488,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+@@ -4478,7 +4489,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
  	vmcs_writel(HOST_IDTR_BASE, dt.address);   /* 22.2.4 */
  	vmx->host_idt_base = dt.address;
  
@@ -30282,7 +30101,7 @@ index 343d369..95ade96 100644
  
  	rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
  	vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
-@@ -6015,11 +6026,17 @@ static __init int hardware_setup(void)
+@@ -6016,11 +6027,17 @@ static __init int hardware_setup(void)
  	 * page upon invalidation.  No need to do anything if not
  	 * using the APIC_ACCESS_ADDR VMCS field.
  	 */
@@ -30302,7 +30121,7 @@ index 343d369..95ade96 100644
  
  	if (enable_ept && !cpu_has_vmx_ept_2m_page())
  		kvm_disable_largepages();
-@@ -6030,6 +6047,7 @@ static __init int hardware_setup(void)
+@@ -6031,6 +6048,7 @@ static __init int hardware_setup(void)
  	if (!cpu_has_vmx_apicv())
  		enable_apicv = 0;
  
@@ -30310,7 +30129,7 @@ index 343d369..95ade96 100644
  	if (enable_apicv)
  		kvm_x86_ops->update_cr8_intercept = NULL;
  	else {
-@@ -6038,6 +6056,7 @@ static __init int hardware_setup(void)
+@@ -6039,6 +6057,7 @@ static __init int hardware_setup(void)
  		kvm_x86_ops->deliver_posted_interrupt = NULL;
  		kvm_x86_ops->sync_pir_to_irr = vmx_sync_pir_to_irr_dummy;
  	}
@@ -30318,7 +30137,7 @@ index 343d369..95ade96 100644
  
  	vmx_disable_intercept_for_msr(MSR_FS_BASE, false);
  	vmx_disable_intercept_for_msr(MSR_GS_BASE, false);
-@@ -6092,10 +6111,12 @@ static __init int hardware_setup(void)
+@@ -6093,10 +6112,12 @@ static __init int hardware_setup(void)
  		enable_pml = 0;
  
  	if (!enable_pml) {
@@ -30331,7 +30150,7 @@ index 343d369..95ade96 100644
  	}
  
  	return alloc_kvm_area();
-@@ -8351,6 +8372,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -8352,6 +8373,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  		"jmp 2f \n\t"
  		"1: " __ex(ASM_VMX_VMRESUME) "\n\t"
  		"2: "
@@ -30344,7 +30163,7 @@ index 343d369..95ade96 100644
  		/* Save guest registers, load host registers, keep flags */
  		"mov %0, %c[wordsize](%%" _ASM_SP ") \n\t"
  		"pop %0 \n\t"
-@@ -8403,6 +8430,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -8404,6 +8431,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  #endif
  		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
  		[wordsize]"i"(sizeof(ulong))
@@ -30356,7 +30175,7 @@ index 343d369..95ade96 100644
  	      : "cc", "memory"
  #ifdef CONFIG_X86_64
  		, "rax", "rbx", "rdi", "rsi"
-@@ -8416,7 +8448,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -8417,7 +8449,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  	if (debugctlmsr)
  		update_debugctlmsr(debugctlmsr);
  
@@ -30365,7 +30184,7 @@ index 343d369..95ade96 100644
  	/*
  	 * The sysexit path does not restore ds/es, so we must set them to
  	 * a reasonable value ourselves.
-@@ -8425,8 +8457,18 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -8426,8 +8458,18 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  	 * may be executed in interrupt context, which saves and restore segments
  	 * around it, nullifying its effect.
  	 */
@@ -30386,7 +30205,7 @@ index 343d369..95ade96 100644
  #endif
  
  	vcpu->arch.regs_avail = ~((1 << VCPU_REGS_RIP) | (1 << VCPU_REGS_RSP)
-@@ -10280,7 +10322,7 @@ static void vmx_enable_log_dirty_pt_masked(struct kvm *kvm,
+@@ -10281,7 +10323,7 @@ static void vmx_enable_log_dirty_pt_masked(struct kvm *kvm,
  	kvm_mmu_clear_dirty_pt_masked(kvm, memslot, offset, mask);
  }
  
@@ -30396,7 +30215,7 @@ index 343d369..95ade96 100644
  	.disabled_by_bios = vmx_disabled_by_bios,
  	.hardware_setup = hardware_setup,
 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 43609af..f8b7b2c 100644
+index 37bbbf8..4a8338d 100644
 --- a/arch/x86/kvm/x86.c
 +++ b/arch/x86/kvm/x86.c
 @@ -1828,8 +1828,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
@@ -30455,7 +30274,7 @@ index 43609af..f8b7b2c 100644
  			guest_xsave->region, sizeof(struct fxregs_state));
  	}
  	return 0;
-@@ -6214,6 +6216,7 @@ void kvm_arch_mmu_notifier_invalidate_page(struct kvm *kvm,
+@@ -6215,6 +6217,7 @@ void kvm_arch_mmu_notifier_invalidate_page(struct kvm *kvm,
   * exiting to the userspace.  Otherwise, the value will be returned to the
   * userspace.
   */
@@ -30463,7 +30282,7 @@ index 43609af..f8b7b2c 100644
  static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
  {
  	int r;
-@@ -6437,6 +6440,7 @@ out:
+@@ -6438,6 +6441,7 @@ out:
  	return r;
  }
  
@@ -30471,7 +30290,7 @@ index 43609af..f8b7b2c 100644
  static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu)
  {
  	if (!kvm_arch_vcpu_runnable(vcpu)) {
-@@ -6976,7 +6980,7 @@ int kvm_arch_vcpu_ioctl_translate(struct kvm_vcpu *vcpu,
+@@ -6977,7 +6981,7 @@ int kvm_arch_vcpu_ioctl_translate(struct kvm_vcpu *vcpu,
  int kvm_arch_vcpu_ioctl_get_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
  {
  	struct fxregs_state *fxsave =
@@ -30480,7 +30299,7 @@ index 43609af..f8b7b2c 100644
  
  	memcpy(fpu->fpr, fxsave->st_space, 128);
  	fpu->fcw = fxsave->cwd;
-@@ -6993,7 +6997,7 @@ int kvm_arch_vcpu_ioctl_get_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
+@@ -6994,7 +6998,7 @@ int kvm_arch_vcpu_ioctl_get_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
  int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
  {
  	struct fxregs_state *fxsave =
@@ -30489,7 +30308,7 @@ index 43609af..f8b7b2c 100644
  
  	memcpy(fxsave->st_space, fpu->fpr, 128);
  	fxsave->cwd = fpu->fcw;
-@@ -7009,9 +7013,9 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
+@@ -7010,9 +7014,9 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
  
  static void fx_init(struct kvm_vcpu *vcpu)
  {
@@ -30501,7 +30320,7 @@ index 43609af..f8b7b2c 100644
  			host_xcr0 | XSTATE_COMPACTION_ENABLED;
  
  	/*
-@@ -7035,7 +7039,7 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
+@@ -7036,7 +7040,7 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
  	kvm_put_guest_xcr0(vcpu);
  	vcpu->guest_fpu_loaded = 1;
  	__kernel_fpu_begin();
@@ -30510,7 +30329,7 @@ index 43609af..f8b7b2c 100644
  	trace_kvm_fpu(1);
  }
  
-@@ -7324,6 +7328,8 @@ bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
+@@ -7325,6 +7329,8 @@ bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
  
  struct static_key kvm_no_apic_vcpu __read_mostly;
  
@@ -30519,7 +30338,7 @@ index 43609af..f8b7b2c 100644
  int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
  {
  	struct page *page;
-@@ -7340,11 +7346,14 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
+@@ -7341,11 +7347,14 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
  	else
  		vcpu->arch.mp_state = KVM_MP_STATE_UNINITIALIZED;
  
@@ -30538,7 +30357,7 @@ index 43609af..f8b7b2c 100644
  	vcpu->arch.pio_data = page_address(page);
  
  	kvm_set_tsc_khz(vcpu, max_tsc_khz);
-@@ -7398,6 +7407,9 @@ fail_mmu_destroy:
+@@ -7399,6 +7408,9 @@ fail_mmu_destroy:
  	kvm_mmu_destroy(vcpu);
  fail_free_pio_data:
  	free_page((unsigned long)vcpu->arch.pio_data);
@@ -30548,7 +30367,7 @@ index 43609af..f8b7b2c 100644
  fail:
  	return r;
  }
-@@ -7415,6 +7427,8 @@ void kvm_arch_vcpu_uninit(struct kvm_vcpu *vcpu)
+@@ -7416,6 +7428,8 @@ void kvm_arch_vcpu_uninit(struct kvm_vcpu *vcpu)
  	free_page((unsigned long)vcpu->arch.pio_data);
  	if (!irqchip_in_kernel(vcpu->kvm))
  		static_key_slow_dec(&kvm_no_apic_vcpu);
@@ -30558,7 +30377,7 @@ index 43609af..f8b7b2c 100644
  
  void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu)
 diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
-index a0d09f6..92ede76 100644
+index a43b2ea..e64e453 100644
 --- a/arch/x86/lguest/boot.c
 +++ b/arch/x86/lguest/boot.c
 @@ -1336,9 +1336,10 @@ static __init int early_put_chars(u32 vtermno, const char *buf, int count)
@@ -34975,7 +34794,7 @@ index 0057a7acc..95c7edd 100644
  	might_sleep();
  	if (is_enabled()) /* recheck and proper locking in *_core() */
 diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
-index 71fc79a..3dd1f49 100644
+index 78e47ff..17c3093 100644
 --- a/arch/x86/mm/mpx.c
 +++ b/arch/x86/mm/mpx.c
 @@ -193,7 +193,7 @@ static int mpx_insn_decode(struct insn *insn,
@@ -35673,7 +35492,7 @@ index 90555bf..f5f1828 100644
  }
  
 diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
-index 8ddb5d0..6f70318 100644
+index 8f4cc3d..7143a15 100644
 --- a/arch/x86/mm/tlb.c
 +++ b/arch/x86/mm/tlb.c
 @@ -45,7 +45,11 @@ void leave_mm(int cpu)
@@ -37148,7 +36967,7 @@ index c7b15f3..cc09a65 100644
  	  This is the Linux Xen port.  Enabling this will allow the
  	  kernel to boot in a paravirtualized environment under the
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 993b7a7..59dec9a 100644
+index aeb385d..ff5dc9e 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
 @@ -130,8 +130,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -37245,7 +37064,7 @@ index 993b7a7..59dec9a 100644
  
  	pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry;
  	pv_cpu_ops.load_gdt = xen_load_gdt;
-@@ -1567,7 +1566,17 @@ asmlinkage __visible void __init xen_start_kernel(void)
+@@ -1569,7 +1568,17 @@ asmlinkage __visible void __init xen_start_kernel(void)
  	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
  
  	/* Work out if we support NX */
@@ -37264,7 +37083,7 @@ index 993b7a7..59dec9a 100644
  
  	/* Get mfn list */
  	xen_build_dynamic_phys_to_machine();
-@@ -1595,13 +1604,6 @@ asmlinkage __visible void __init xen_start_kernel(void)
+@@ -1597,13 +1606,6 @@ asmlinkage __visible void __init xen_start_kernel(void)
  
  	machine_ops = xen_machine_ops;
  
@@ -40596,7 +40415,7 @@ index e3536da..b1617f0 100644
  	intf->proc_dir = NULL;
  
 diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
-index 654f6f3..b36fbf4 100644
+index 54bccf7..f7a4fa9 100644
 --- a/drivers/char/ipmi/ipmi_si_intf.c
 +++ b/drivers/char/ipmi/ipmi_si_intf.c
 @@ -300,7 +300,7 @@ struct smi_info {
@@ -40620,26 +40439,7 @@ index 654f6f3..b36fbf4 100644
  
  #define SI_MAX_PARMS 4
  
-@@ -1208,14 +1208,14 @@ static int smi_start_processing(void       *send_info,
- 
- 	new_smi->intf = intf;
- 
--	/* Try to claim any interrupts. */
--	if (new_smi->irq_setup)
--		new_smi->irq_setup(new_smi);
--
- 	/* Set up the timer that drives the interface. */
- 	setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
- 	smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
- 
-+	/* Try to claim any interrupts. */
-+	if (new_smi->irq_setup)
-+		new_smi->irq_setup(new_smi);
-+
- 	/*
- 	 * Check if the user forcefully enabled the daemon.
- 	 */
-@@ -3598,7 +3598,7 @@ static int try_smi_init(struct smi_info *new_smi)
+@@ -3613,7 +3613,7 @@ static int try_smi_init(struct smi_info *new_smi)
  	atomic_set(&new_smi->req_events, 0);
  	new_smi->run_to_completion = false;
  	for (i = 0; i < SI_NUM_STATS; i++)
@@ -41183,40 +40983,6 @@ index b5bcd77..0f7bd99 100644
  
  	return 0;
  }
-diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
-index 30f5228..c19e7fc 100644
---- a/drivers/connector/connector.c
-+++ b/drivers/connector/connector.c
-@@ -178,26 +178,21 @@ static int cn_call_callback(struct sk_buff *skb)
-  *
-  * It checks skb, netlink header and msg sizes, and calls callback helper.
-  */
--static void cn_rx_skb(struct sk_buff *__skb)
-+static void cn_rx_skb(struct sk_buff *skb)
- {
- 	struct nlmsghdr *nlh;
--	struct sk_buff *skb;
- 	int len, err;
- 
--	skb = skb_get(__skb);
--
- 	if (skb->len >= NLMSG_HDRLEN) {
- 		nlh = nlmsg_hdr(skb);
- 		len = nlmsg_len(nlh);
- 
- 		if (len < (int)sizeof(struct cn_msg) ||
- 		    skb->len < nlh->nlmsg_len ||
--		    len > CONNECTOR_MAX_MSG_SIZE) {
--			kfree_skb(skb);
-+		    len > CONNECTOR_MAX_MSG_SIZE)
- 			return;
--		}
- 
--		err = cn_call_callback(skb);
-+		err = cn_call_callback(skb_get(skb));
- 		if (err < 0)
- 			kfree_skb(skb);
- 	}
 diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
 index cec1ee2..d8e33a0 100644
 --- a/drivers/cpufreq/acpi-cpufreq.c
@@ -45350,7 +45116,7 @@ index 2106066..e759b59 100644
  	/* copy over all the bus versions */
  	if (dev->bus && dev->bus->pm) {
 diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
-index 70a11ac..9852312 100644
+index c0fbf4e..865f19d 100644
 --- a/drivers/hid/hid-core.c
 +++ b/drivers/hid/hid-core.c
 @@ -2575,7 +2575,7 @@ EXPORT_SYMBOL_GPL(hid_ignore);
@@ -46993,10 +46759,10 @@ index 532e2a2..a60aa73 100644
  	CMD_SET_TYPE(cmd, CMD_COMPL_WAIT);
  }
 diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
-index 286e890..c2220cc 100644
+index ef78620..5b5d477 100644
 --- a/drivers/iommu/arm-smmu-v3.c
 +++ b/drivers/iommu/arm-smmu-v3.c
-@@ -1516,7 +1516,7 @@ static int arm_smmu_domain_finalise(struct iommu_domain *domain)
+@@ -1517,7 +1517,7 @@ static int arm_smmu_domain_finalise(struct iommu_domain *domain)
  		.iommu_dev	= smmu->dev,
  	};
  
@@ -49283,18 +49049,6 @@ index 641ad8f..02eacb9 100644
  	select DVB_LNBP21 if MEDIA_SUBDRV_AUTOSELECT
  	select DVB_STV090x if MEDIA_SUBDRV_AUTOSELECT
  	select DVB_STB6100 if MEDIA_SUBDRV_AUTOSELECT
-diff --git a/drivers/media/platform/vivid/vivid-osd.c b/drivers/media/platform/vivid/vivid-osd.c
-index 084d346..e15eef6 100644
---- a/drivers/media/platform/vivid/vivid-osd.c
-+++ b/drivers/media/platform/vivid/vivid-osd.c
-@@ -85,6 +85,7 @@ static int vivid_fb_ioctl(struct fb_info *info, unsigned cmd, unsigned long arg)
- 	case FBIOGET_VBLANK: {
- 		struct fb_vblank vblank;
- 
-+		memset(&vblank, 0, sizeof(vblank));
- 		vblank.flags = FB_VBLANK_HAVE_COUNT | FB_VBLANK_HAVE_VCOUNT |
- 			FB_VBLANK_HAVE_VSYNC;
- 		vblank.count = 0;
 diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c
 index 82affae..42833ec 100644
 --- a/drivers/media/radio/radio-cadet.c
@@ -52173,7 +51927,7 @@ index 4421bf54..c07afb0 100644
  	netdev_tx_completed_queue(ring->tx_queue, packets, bytes);
  
 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
-index 443632d..7b43236 100644
+index 394744b..de2161e 100644
 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
 +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
 @@ -2025,8 +2025,11 @@ static void mlx5e_build_netdev(struct net_device *netdev)
@@ -52631,10 +52385,10 @@ index f761288..a1024be 100644
  
  	r = get_phy_id(bus, addr, &phy_id, is_c45, &c45_ids);
 diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
-index ed00446..943fe2c 100644
+index 9a863c6..8e2d8c9 100644
 --- a/drivers/net/ppp/ppp_generic.c
 +++ b/drivers/net/ppp/ppp_generic.c
-@@ -1047,7 +1047,6 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+@@ -1045,7 +1045,6 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
  	void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
  	struct ppp_stats stats;
  	struct ppp_comp_stats cstats;
@@ -52642,7 +52396,7 @@ index ed00446..943fe2c 100644
  
  	switch (cmd) {
  	case SIOCGPPPSTATS:
-@@ -1069,8 +1068,7 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+@@ -1067,8 +1066,7 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
  		break;
  
  	case SIOCGPPPVER:
@@ -52733,20 +52487,10 @@ index b910cae..f55670b 100644
   end:
  	release_sock(sk);
 diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
-index 079f7ad..7e59810 100644
+index 27ed252..80cffde 100644
 --- a/drivers/net/slip/slhc.c
 +++ b/drivers/net/slip/slhc.c
-@@ -94,6 +94,9 @@ slhc_init(int rslots, int tslots)
- 	register struct cstate *ts;
- 	struct slcompress *comp;
- 
-+	if (rslots <= 0 || tslots <= 0 || rslots >= 256 || tslots >= 256)
-+		goto out_fail;
-+
- 	comp = kzalloc(sizeof(struct slcompress), GFP_KERNEL);
- 	if (! comp)
- 		goto out_fail;
-@@ -487,7 +490,7 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize)
+@@ -491,7 +491,7 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize)
  	register struct tcphdr *thp;
  	register struct iphdr *ip;
  	register struct cstate *cs;
@@ -52756,7 +52500,7 @@ index 079f7ad..7e59810 100644
  
  	/* We've got a compressed packet; read the change byte */
 diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
-index 651d35e..4249181 100644
+index 59fefca..b1422b1 100644
 --- a/drivers/net/team/team.c
 +++ b/drivers/net/team/team.c
 @@ -2107,7 +2107,7 @@ static unsigned int team_get_num_rx_queues(void)
@@ -52976,10 +52720,10 @@ index 374feba..01ba30e 100644
  	.priv_size	= sizeof(struct net_vrf),
  
 diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
-index c1587ec..dcd13ca 100644
+index 40b5f8a..f934a2f 100644
 --- a/drivers/net/vxlan.c
 +++ b/drivers/net/vxlan.c
-@@ -3037,7 +3037,7 @@ static struct net *vxlan_get_link_net(const struct net_device *dev)
+@@ -3043,7 +3043,7 @@ static struct net *vxlan_get_link_net(const struct net_device *dev)
  	return vxlan->net;
  }
  
@@ -52988,7 +52732,7 @@ index c1587ec..dcd13ca 100644
  	.kind		= "vxlan",
  	.maxtype	= IFLA_VXLAN_MAX,
  	.policy		= vxlan_policy,
-@@ -3085,7 +3085,7 @@ static int vxlan_lowerdev_event(struct notifier_block *unused,
+@@ -3091,7 +3091,7 @@ static int vxlan_lowerdev_event(struct notifier_block *unused,
  	return NOTIFY_DONE;
  }
  
@@ -59213,7 +58957,7 @@ index 4d64e5c4..e21932a 100644
  			wake_up(&usb_kill_urb_queue);
  		usb_put_urb(urb);
 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index 522f766..6ddc50b 100644
+index 6208433..fe57c7f 100644
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
 @@ -26,6 +26,7 @@
@@ -59224,7 +58968,7 @@ index 522f766..6ddc50b 100644
  
  #include <asm/uaccess.h>
  #include <asm/byteorder.h>
-@@ -4665,6 +4666,10 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
+@@ -4702,6 +4703,10 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
  			goto done;
  		return;
  	}
@@ -59236,7 +58980,7 @@ index 522f766..6ddc50b 100644
  		unit_load = 150;
  	else
 diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
-index cfc68c1..38f943f 100644
+index c54fd8b..6e9f011 100644
 --- a/drivers/usb/core/sysfs.c
 +++ b/drivers/usb/core/sysfs.c
 @@ -244,7 +244,7 @@ static ssize_t urbnum_show(struct device *dev, struct device_attribute *attr,
@@ -59593,10 +59337,10 @@ index c47d3e4..35bcc1e 100644
  /* Device for a quirk */
  #define PCI_VENDOR_ID_FRESCO_LOGIC	0x1b73
 diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
-index 385f9f5..fe0610e 100644
+index e40c300..7eb36da 100644
 --- a/drivers/usb/host/xhci.c
 +++ b/drivers/usb/host/xhci.c
-@@ -4843,7 +4843,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
+@@ -4851,7 +4851,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
  	int			retval;
  
  	/* Accept arbitrarily long scatter-gather lists */
@@ -100260,36 +100004,6 @@ index 674e3e2..f68af19 100644
  void do_close_on_exec(struct files_struct *);
  int iterate_fd(struct files_struct *, unsigned,
  		int (*)(const void *, struct file *, unsigned),
-diff --git a/include/linux/filter.h b/include/linux/filter.h
-index fa2cab9..d42a5b8 100644
---- a/include/linux/filter.h
-+++ b/include/linux/filter.h
-@@ -459,6 +459,25 @@ static inline void bpf_jit_free(struct bpf_prog *fp)
- 
- #define BPF_ANC		BIT(15)
- 
-+static inline bool bpf_needs_clear_a(const struct sock_filter *first)
-+{
-+	switch (first->code) {
-+	case BPF_RET | BPF_K:
-+	case BPF_LD | BPF_W | BPF_LEN:
-+		return false;
-+
-+	case BPF_LD | BPF_W | BPF_ABS:
-+	case BPF_LD | BPF_H | BPF_ABS:
-+	case BPF_LD | BPF_B | BPF_ABS:
-+		if (first->k == SKF_AD_OFF + SKF_AD_ALU_XOR_X)
-+			return true;
-+		return false;
-+
-+	default:
-+		return true;
-+	}
-+}
-+
- static inline u16 bpf_anc_helper(const struct sock_filter *ftest)
- {
- 	BUG_ON(ftest->code & BPF_ANC);
 diff --git a/include/linux/fs.h b/include/linux/fs.h
 index 72d8a84..d67bd25 100644
 --- a/include/linux/fs.h
@@ -104183,7 +103897,7 @@ index 556ec1e..38c19c9 100644
  
  /*
 diff --git a/include/linux/sched.h b/include/linux/sched.h
-index b7b9501..f1e65cf 100644
+index f477e87..f1e65cf 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
 @@ -7,7 +7,7 @@
@@ -104250,11 +103964,10 @@ index b7b9501..f1e65cf 100644
  
  /*
   * Bits in flags field of signal_struct.
-@@ -830,12 +855,22 @@ struct user_struct {
- 	unsigned long mq_bytes;	/* How many bytes can be allocated to mqueue? */
+@@ -831,12 +856,21 @@ struct user_struct {
  #endif
  	unsigned long locked_shm; /* How many pages of mlocked shm ? */
-+	unsigned long unix_inflight;	/* How many files in flight in unix sockets */
+ 	unsigned long unix_inflight;	/* How many files in flight in unix sockets */
 +	atomic_long_t pipe_bufs;  /* how many pages are allocated in pipe buffers */
  
  #ifdef CONFIG_KEYS
@@ -104273,7 +103986,7 @@ index b7b9501..f1e65cf 100644
  	/* Hash table maintenance information */
  	struct hlist_node uidhash_node;
  	kuid_t uid;
-@@ -843,7 +878,7 @@ struct user_struct {
+@@ -844,7 +878,7 @@ struct user_struct {
  #ifdef CONFIG_PERF_EVENTS
  	atomic_long_t locked_vm;
  #endif
@@ -104282,7 +103995,7 @@ index b7b9501..f1e65cf 100644
  
  extern int uids_sysfs_init(void);
  
-@@ -1378,6 +1413,9 @@ struct tlbflush_unmap_batch {
+@@ -1379,6 +1413,9 @@ struct tlbflush_unmap_batch {
  struct task_struct {
  	volatile long state;	/* -1 unrunnable, 0 runnable, >0 stopped */
  	void *stack;
@@ -104292,7 +104005,7 @@ index b7b9501..f1e65cf 100644
  	atomic_t usage;
  	unsigned int flags;	/* per process flags, defined below */
  	unsigned int ptrace;
-@@ -1510,8 +1548,8 @@ struct task_struct {
+@@ -1511,8 +1548,8 @@ struct task_struct {
  	struct list_head thread_node;
  
  	struct completion *vfork_done;		/* for vfork() */
@@ -104303,7 +104016,7 @@ index b7b9501..f1e65cf 100644
  
  	cputime_t utime, stime, utimescaled, stimescaled;
  	cputime_t gtime;
-@@ -1534,11 +1572,6 @@ struct task_struct {
+@@ -1535,11 +1572,6 @@ struct task_struct {
  	struct task_cputime cputime_expires;
  	struct list_head cpu_timers[3];
  
@@ -104315,7 +104028,7 @@ index b7b9501..f1e65cf 100644
  	char comm[TASK_COMM_LEN]; /* executable name excluding path
  				     - access with [gs]et_task_comm (which lock
  				       it with task_lock())
-@@ -1554,6 +1587,8 @@ struct task_struct {
+@@ -1555,6 +1587,8 @@ struct task_struct {
  /* hung task detection */
  	unsigned long last_switch_count;
  #endif
@@ -104324,7 +104037,7 @@ index b7b9501..f1e65cf 100644
  /* filesystem information */
  	struct fs_struct *fs;
  /* open file information */
-@@ -1630,6 +1665,10 @@ struct task_struct {
+@@ -1631,6 +1665,10 @@ struct task_struct {
  	gfp_t lockdep_reclaim_gfp;
  #endif
  
@@ -104335,7 +104048,7 @@ index b7b9501..f1e65cf 100644
  /* journalling filesystem info */
  	void *journal_info;
  
-@@ -1668,6 +1707,10 @@ struct task_struct {
+@@ -1669,6 +1707,10 @@ struct task_struct {
  	/* cg_list protected by css_set_lock and tsk->alloc_lock */
  	struct list_head cg_list;
  #endif
@@ -104346,7 +104059,7 @@ index b7b9501..f1e65cf 100644
  #ifdef CONFIG_FUTEX
  	struct robust_list_head __user *robust_list;
  #ifdef CONFIG_COMPAT
-@@ -1783,7 +1826,7 @@ struct task_struct {
+@@ -1784,7 +1826,7 @@ struct task_struct {
  	 * Number of functions that haven't been traced
  	 * because of depth overrun.
  	 */
@@ -104355,7 +104068,7 @@ index b7b9501..f1e65cf 100644
  	/* Pause for the tracing */
  	atomic_t tracing_graph_pause;
  #endif
-@@ -1812,22 +1855,89 @@ struct task_struct {
+@@ -1813,22 +1855,89 @@ struct task_struct {
  	unsigned long	task_state_change;
  #endif
  	int pagefault_disabled;
@@ -104455,7 +104168,7 @@ index b7b9501..f1e65cf 100644
  /* Future-safe accessor for struct task_struct's cpus_allowed. */
  #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
  
-@@ -1909,7 +2019,7 @@ struct pid_namespace;
+@@ -1910,7 +2019,7 @@ struct pid_namespace;
  pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
  			struct pid_namespace *ns);
  
@@ -104464,7 +104177,7 @@ index b7b9501..f1e65cf 100644
  {
  	return tsk->pid;
  }
-@@ -2270,6 +2380,25 @@ extern u64 sched_clock_cpu(int cpu);
+@@ -2271,6 +2380,25 @@ extern u64 sched_clock_cpu(int cpu);
  
  extern void sched_clock_init(void);
  
@@ -104490,7 +104203,7 @@ index b7b9501..f1e65cf 100644
  #ifndef CONFIG_HAVE_UNSTABLE_SCHED_CLOCK
  static inline void sched_clock_tick(void)
  {
-@@ -2398,7 +2527,9 @@ extern void set_curr_task(int cpu, struct task_struct *p);
+@@ -2399,7 +2527,9 @@ extern void set_curr_task(int cpu, struct task_struct *p);
  void yield(void);
  
  union thread_union {
@@ -104500,7 +104213,7 @@ index b7b9501..f1e65cf 100644
  	unsigned long stack[THREAD_SIZE/sizeof(long)];
  };
  
-@@ -2431,6 +2562,7 @@ extern struct pid_namespace init_pid_ns;
+@@ -2432,6 +2562,7 @@ extern struct pid_namespace init_pid_ns;
   */
  
  extern struct task_struct *find_task_by_vpid(pid_t nr);
@@ -104508,7 +104221,7 @@ index b7b9501..f1e65cf 100644
  extern struct task_struct *find_task_by_pid_ns(pid_t nr,
  		struct pid_namespace *ns);
  
-@@ -2462,7 +2594,7 @@ extern void proc_caches_init(void);
+@@ -2463,7 +2594,7 @@ extern void proc_caches_init(void);
  extern void flush_signals(struct task_struct *);
  extern void ignore_signals(struct task_struct *);
  extern void flush_signal_handlers(struct task_struct *, int force_default);
@@ -104517,7 +104230,7 @@ index b7b9501..f1e65cf 100644
  
  static inline int dequeue_signal_lock(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
  {
-@@ -2608,7 +2740,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
+@@ -2609,7 +2740,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
  extern void exit_itimers(struct signal_struct *);
  extern void flush_itimer_signals(void);
  
@@ -104526,7 +104239,7 @@ index b7b9501..f1e65cf 100644
  
  extern int do_execve(struct filename *,
  		     const char __user * const __user *,
-@@ -2723,11 +2855,13 @@ static inline int thread_group_empty(struct task_struct *p)
+@@ -2724,11 +2855,13 @@ static inline int thread_group_empty(struct task_struct *p)
   * It must not be nested with write_lock_irq(&tasklist_lock),
   * neither inside nor outside.
   */
@@ -104540,7 +104253,7 @@ index b7b9501..f1e65cf 100644
  static inline void task_unlock(struct task_struct *p)
  {
  	spin_unlock(&p->alloc_lock);
-@@ -2813,9 +2947,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
+@@ -2814,9 +2947,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
  #define task_stack_end_corrupted(task) \
  		(*(end_of_stack(task)) != STACK_END_MAGIC)
  
@@ -104763,7 +104476,7 @@ index ab1e039..ad4229e 100644
  
  static inline void disallow_signal(int sig)
 diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
-index 4398411..4856c34 100644
+index 23ce309..861c28f 100644
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
 @@ -799,7 +799,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t priority, int flags,
@@ -105274,7 +104987,7 @@ index e7a018e..49f8b17 100644
  extern dma_addr_t swiotlb_map_page(struct device *dev, struct page *page,
  				   unsigned long offset, size_t size,
 diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
-index a460e2e..de02ef1 100644
+index 42c36bb..ac90c15 100644
 --- a/include/linux/syscalls.h
 +++ b/include/linux/syscalls.h
 @@ -102,7 +102,12 @@ union bpf_attr;
@@ -105571,7 +105284,7 @@ index 00c9d68..bc0188b 100644
  
  struct tty_ldisc {
 diff --git a/include/linux/types.h b/include/linux/types.h
-index c314989..4e6e3a4 100644
+index 89f63da..66ab9c0 100644
 --- a/include/linux/types.h
 +++ b/include/linux/types.h
 @@ -176,10 +176,26 @@ typedef struct {
@@ -105699,7 +105412,7 @@ index 99c1b4d..562e6f3 100644
  
  static inline void put_unaligned_le16(u16 val, void *p)
 diff --git a/include/linux/usb.h b/include/linux/usb.h
-index 447fe29..07a9cf0 100644
+index 4aec211..0181378 100644
 --- a/include/linux/usb.h
 +++ b/include/linux/usb.h
 @@ -363,7 +363,7 @@ struct usb_bus {
@@ -105711,7 +105424,7 @@ index 447fe29..07a9cf0 100644
  
  	int devnum_next;		/* Next open device number in
  					 * round-robin allocation */
-@@ -592,7 +592,7 @@ struct usb_device {
+@@ -596,7 +596,7 @@ struct usb_device {
  	int maxchild;
  
  	u32 quirks;
@@ -105720,7 +105433,7 @@ index 447fe29..07a9cf0 100644
  
  	unsigned long active_duration;
  
-@@ -1785,10 +1785,10 @@ void usb_sg_wait(struct usb_sg_request *io);
+@@ -1789,10 +1789,10 @@ void usb_sg_wait(struct usb_sg_request *io);
  
  /* NOTE:  these are not the standard USB_ENDPOINT_XFER_* values!! */
  /* (yet ... they're the values used by usbfs) */
@@ -108404,27 +108117,6 @@ index 35bac8e..8de1d69 100644
  
  	if (!access_ok(VERIFY_READ, uattr, 1))
  		return -EFAULT;
-diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
-index b074b23..36c6efe 100644
---- a/kernel/bpf/verifier.c
-+++ b/kernel/bpf/verifier.c
-@@ -1058,6 +1058,16 @@ static int check_alu_op(struct reg_state *regs, struct bpf_insn *insn)
- 			return -EINVAL;
- 		}
- 
-+		if ((opcode == BPF_LSH || opcode == BPF_RSH ||
-+		     opcode == BPF_ARSH) && BPF_SRC(insn->code) == BPF_K) {
-+			int size = BPF_CLASS(insn->code) == BPF_ALU64 ? 64 : 32;
-+
-+			if (insn->imm < 0 || insn->imm >= size) {
-+				verbose("invalid shift %d\n", insn->imm);
-+				return -EINVAL;
-+			}
-+		}
-+
- 		/* pattern match 'bpf_add Rx, imm' instruction */
- 		if (opcode == BPF_ADD && BPF_CLASS(insn->code) == BPF_ALU64 &&
- 		    regs[insn->dst_reg].type == FRAME_PTR &&
 diff --git a/kernel/capability.c b/kernel/capability.c
 index 45432b5..988f1e4 100644
 --- a/kernel/capability.c
@@ -114066,10 +113758,10 @@ index 44d2cc0..337ccab 100644
  	write_seqcount_begin(&tk_core.seq);
  
 diff --git a/kernel/time/timer.c b/kernel/time/timer.c
-index 84190f0..6f4ccad 100644
+index 101240b..f2822a4 100644
 --- a/kernel/time/timer.c
 +++ b/kernel/time/timer.c
-@@ -1406,7 +1406,7 @@ void update_process_times(int user_tick)
+@@ -1422,7 +1422,7 @@ void update_process_times(int user_tick)
  /*
   * This function runs timers and the timer-tq in bottom half context.
   */
@@ -117229,7 +116921,7 @@ index 842ecd7..c8f2fc5 100644
  		err = -EPERM;
  		goto out;
 diff --git a/mm/mlock.c b/mm/mlock.c
-index 25936680..d0eff96 100644
+index 25936680..1770c1d 100644
 --- a/mm/mlock.c
 +++ b/mm/mlock.c
 @@ -14,6 +14,7 @@
@@ -117271,15 +116963,18 @@ index 25936680..d0eff96 100644
  		/* Here we know that  vma->vm_start <= nstart < vma->vm_end. */
  
  		newflags = vma->vm_flags & ~VM_LOCKED;
-@@ -628,6 +637,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, start, size_t, len)
+@@ -628,6 +637,10 @@ SYSCALL_DEFINE2(mlock, unsigned long, start, size_t, len)
  	locked += current->mm->locked_vm;
  
  	/* check against resource limits */
-+	gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
++	if (locked > (ULONG_MAX >> PAGE_SHIFT))
++		gr_learn_resource(current, RLIMIT_MEMLOCK, ULONG_MAX, 1);
++	else
++		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
  	if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
  		error = do_mlock(start, len, 1);
  
-@@ -669,6 +679,11 @@ static int do_mlockall(int flags)
+@@ -669,6 +682,11 @@ static int do_mlockall(int flags)
  	for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
  		vm_flags_t newflags;
  
@@ -117291,15 +116986,17 @@ index 25936680..d0eff96 100644
  		newflags = vma->vm_flags & ~VM_LOCKED;
  		if (flags & MCL_CURRENT)
  			newflags |= VM_LOCKED;
-@@ -700,8 +715,10 @@ SYSCALL_DEFINE1(mlockall, int, flags)
+@@ -700,8 +718,12 @@ SYSCALL_DEFINE1(mlockall, int, flags)
  	lock_limit >>= PAGE_SHIFT;
  
  	ret = -ENOMEM;
-+
-+	gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
-+
- 	down_write(&current->mm->mmap_sem);
--
+-	down_write(&current->mm->mmap_sem);
+ 
++	down_write(&current->mm->mmap_sem);
++	if (current->mm->total_vm > (ULONG_MAX >> PAGE_SHIFT))
++		gr_learn_resource(current, RLIMIT_MEMLOCK, ULONG_MAX, 1);
++	else
++		gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
  	if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
  	    capable(CAP_IPC_LOCK))
  		ret = do_mlockall(flags);
@@ -117317,7 +117014,7 @@ index fdadf91..5f527d1 100644
  	.priority = IPC_CALLBACK_PRI, /* use lowest priority */
  };
 diff --git a/mm/mmap.c b/mm/mmap.c
-index 79bcc9f..481e0f5c 100644
+index 79bcc9f..ee68a7e 100644
 --- a/mm/mmap.c
 +++ b/mm/mmap.c
 @@ -42,6 +42,7 @@
@@ -117547,15 +117244,18 @@ index 79bcc9f..481e0f5c 100644
  		mm->stack_vm += pages;
  }
  #endif /* CONFIG_PROC_FS */
-@@ -1251,6 +1340,7 @@ static inline int mlock_future_check(struct mm_struct *mm,
+@@ -1251,6 +1340,10 @@ static inline int mlock_future_check(struct mm_struct *mm,
  		locked += mm->locked_vm;
  		lock_limit = rlimit(RLIMIT_MEMLOCK);
  		lock_limit >>= PAGE_SHIFT;
-+		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
++		if (locked > (ULONG_MAX >> PAGE_SHIFT))
++			gr_learn_resource(current, RLIMIT_MEMLOCK, ULONG_MAX, 1);
++		else
++			gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
  		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
  			return -EAGAIN;
  	}
-@@ -1278,7 +1368,7 @@ unsigned long do_mmap(struct file *file, unsigned long addr,
+@@ -1278,7 +1371,7 @@ unsigned long do_mmap(struct file *file, unsigned long addr,
  	 * (the exception is when the underlying filesystem is noexec
  	 *  mounted, in which case we dont add PROT_EXEC.)
  	 */
@@ -117564,7 +117264,7 @@ index 79bcc9f..481e0f5c 100644
  		if (!(file && path_noexec(&file->f_path)))
  			prot |= PROT_EXEC;
  
-@@ -1301,7 +1391,7 @@ unsigned long do_mmap(struct file *file, unsigned long addr,
+@@ -1301,7 +1394,7 @@ unsigned long do_mmap(struct file *file, unsigned long addr,
  	/* Obtain the address to map to. we verify (or select) it and ensure
  	 * that it represents a valid section of the address space.
  	 */
@@ -117573,7 +117273,7 @@ index 79bcc9f..481e0f5c 100644
  	if (addr & ~PAGE_MASK)
  		return addr;
  
-@@ -1312,6 +1402,43 @@ unsigned long do_mmap(struct file *file, unsigned long addr,
+@@ -1312,6 +1405,43 @@ unsigned long do_mmap(struct file *file, unsigned long addr,
  	vm_flags |= calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
  			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
  
@@ -117617,7 +117317,7 @@ index 79bcc9f..481e0f5c 100644
  	if (flags & MAP_LOCKED)
  		if (!can_do_mlock())
  			return -EPERM;
-@@ -1399,6 +1526,9 @@ unsigned long do_mmap(struct file *file, unsigned long addr,
+@@ -1399,6 +1529,9 @@ unsigned long do_mmap(struct file *file, unsigned long addr,
  			vm_flags |= VM_NORESERVE;
  	}
  
@@ -117627,7 +117327,7 @@ index 79bcc9f..481e0f5c 100644
  	addr = mmap_region(file, addr, len, vm_flags, pgoff);
  	if (!IS_ERR_VALUE(addr) &&
  	    ((vm_flags & VM_LOCKED) ||
-@@ -1493,7 +1623,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
+@@ -1493,7 +1626,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
  	const struct vm_operations_struct *vm_ops = vma->vm_ops;
  
  	/* If it was private or non-writable, the write bit is already clear */
@@ -117636,7 +117336,7 @@ index 79bcc9f..481e0f5c 100644
  		return 0;
  
  	/* The backer wishes to know when pages are first written to? */
-@@ -1544,7 +1674,22 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+@@ -1544,7 +1677,22 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
  	struct rb_node **rb_link, *rb_parent;
  	unsigned long charged = 0;
  
@@ -117659,7 +117359,7 @@ index 79bcc9f..481e0f5c 100644
  	if (!may_expand_vm(mm, len >> PAGE_SHIFT)) {
  		unsigned long nr_pages;
  
-@@ -1567,6 +1712,7 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+@@ -1567,6 +1715,7 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
  			      &rb_parent)) {
  		if (do_munmap(mm, addr, len))
  			return -ENOMEM;
@@ -117667,7 +117367,7 @@ index 79bcc9f..481e0f5c 100644
  	}
  
  	/*
-@@ -1598,6 +1744,16 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+@@ -1598,6 +1747,16 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
  		goto unacct_error;
  	}
  
@@ -117684,7 +117384,7 @@ index 79bcc9f..481e0f5c 100644
  	vma->vm_mm = mm;
  	vma->vm_start = addr;
  	vma->vm_end = addr + len;
-@@ -1628,6 +1784,13 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+@@ -1628,6 +1787,13 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
  		if (error)
  			goto unmap_and_free_vma;
  
@@ -117698,7 +117398,7 @@ index 79bcc9f..481e0f5c 100644
  		/* Can addr have changed??
  		 *
  		 * Answer: Yes, several device drivers can do it in their
-@@ -1646,6 +1809,12 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+@@ -1646,6 +1812,12 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
  	}
  
  	vma_link(mm, vma, prev, rb_link, rb_parent);
@@ -117711,7 +117411,7 @@ index 79bcc9f..481e0f5c 100644
  	/* Once vma denies write, undo our temporary denial count */
  	if (file) {
  		if (vm_flags & VM_SHARED)
-@@ -1658,6 +1827,7 @@ out:
+@@ -1658,6 +1830,7 @@ out:
  	perf_event_mmap(vma);
  
  	vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
@@ -117719,7 +117419,7 @@ index 79bcc9f..481e0f5c 100644
  	if (vm_flags & VM_LOCKED) {
  		if (!((vm_flags & VM_SPECIAL) || is_vm_hugetlb_page(vma) ||
  					vma == get_gate_vma(current->mm)))
-@@ -1695,6 +1865,12 @@ allow_write_and_free_vma:
+@@ -1695,6 +1868,12 @@ allow_write_and_free_vma:
  	if (vm_flags & VM_DENYWRITE)
  		allow_write_access(file);
  free_vma:
@@ -117732,7 +117432,7 @@ index 79bcc9f..481e0f5c 100644
  	kmem_cache_free(vm_area_cachep, vma);
  unacct_error:
  	if (charged)
-@@ -1702,7 +1878,63 @@ unacct_error:
+@@ -1702,7 +1881,63 @@ unacct_error:
  	return error;
  }
  
@@ -117797,7 +117497,7 @@ index 79bcc9f..481e0f5c 100644
  {
  	/*
  	 * We implement the search by looking for an rbtree node that
-@@ -1750,11 +1982,29 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
+@@ -1750,11 +1985,29 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
  			}
  		}
  
@@ -117828,7 +117528,7 @@ index 79bcc9f..481e0f5c 100644
  		if (gap_end >= low_limit && gap_end - gap_start >= length)
  			goto found;
  
-@@ -1804,7 +2054,7 @@ found:
+@@ -1804,7 +2057,7 @@ found:
  	return gap_start;
  }
  
@@ -117837,7 +117537,7 @@ index 79bcc9f..481e0f5c 100644
  {
  	struct mm_struct *mm = current->mm;
  	struct vm_area_struct *vma;
-@@ -1858,6 +2108,24 @@ check_current:
+@@ -1858,6 +2111,24 @@ check_current:
  		gap_end = vma->vm_start;
  		if (gap_end < low_limit)
  			return -ENOMEM;
@@ -117862,7 +117562,7 @@ index 79bcc9f..481e0f5c 100644
  		if (gap_start <= high_limit && gap_end - gap_start >= length)
  			goto found;
  
-@@ -1921,6 +2189,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1921,6 +2192,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
  	struct mm_struct *mm = current->mm;
  	struct vm_area_struct *vma;
  	struct vm_unmapped_area_info info;
@@ -117870,7 +117570,7 @@ index 79bcc9f..481e0f5c 100644
  
  	if (len > TASK_SIZE - mmap_min_addr)
  		return -ENOMEM;
-@@ -1928,11 +2197,15 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1928,11 +2200,15 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
  	if (flags & MAP_FIXED)
  		return addr;
  
@@ -117887,7 +117587,7 @@ index 79bcc9f..481e0f5c 100644
  			return addr;
  	}
  
-@@ -1941,6 +2214,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1941,6 +2217,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
  	info.low_limit = mm->mmap_base;
  	info.high_limit = TASK_SIZE;
  	info.align_mask = 0;
@@ -117895,7 +117595,7 @@ index 79bcc9f..481e0f5c 100644
  	return vm_unmapped_area(&info);
  }
  #endif
-@@ -1959,6 +2233,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1959,6 +2236,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  	struct mm_struct *mm = current->mm;
  	unsigned long addr = addr0;
  	struct vm_unmapped_area_info info;
@@ -117903,7 +117603,7 @@ index 79bcc9f..481e0f5c 100644
  
  	/* requested length too big for entire address space */
  	if (len > TASK_SIZE - mmap_min_addr)
-@@ -1967,12 +2242,16 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1967,12 +2245,16 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  	if (flags & MAP_FIXED)
  		return addr;
  
@@ -117921,7 +117621,7 @@ index 79bcc9f..481e0f5c 100644
  			return addr;
  	}
  
-@@ -1981,6 +2260,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1981,6 +2263,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  	info.low_limit = max(PAGE_SIZE, mmap_min_addr);
  	info.high_limit = mm->mmap_base;
  	info.align_mask = 0;
@@ -117929,7 +117629,7 @@ index 79bcc9f..481e0f5c 100644
  	addr = vm_unmapped_area(&info);
  
  	/*
-@@ -1993,6 +2273,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1993,6 +2276,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  		VM_BUG_ON(addr != -ENOMEM);
  		info.flags = 0;
  		info.low_limit = TASK_UNMAPPED_BASE;
@@ -117942,7 +117642,7 @@ index 79bcc9f..481e0f5c 100644
  		info.high_limit = TASK_SIZE;
  		addr = vm_unmapped_area(&info);
  	}
-@@ -2093,6 +2379,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
+@@ -2093,6 +2382,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
  	return vma;
  }
  
@@ -117971,7 +117671,7 @@ index 79bcc9f..481e0f5c 100644
  /*
   * Verify that the stack growth is acceptable and
   * update accounting. This is shared with both the
-@@ -2110,8 +2418,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2110,8 +2421,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
  
  	/* Stack limit test */
  	actual_size = size;
@@ -117981,15 +117681,18 @@ index 79bcc9f..481e0f5c 100644
  	if (actual_size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur))
  		return -ENOMEM;
  
-@@ -2122,6 +2429,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2122,6 +2432,10 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
  		locked = mm->locked_vm + grow;
  		limit = READ_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
  		limit >>= PAGE_SHIFT;
-+		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
++		if (locked > (ULONG_MAX >> PAGE_SHIFT))
++			gr_learn_resource(current, RLIMIT_MEMLOCK, ULONG_MAX, 1);
++		else
++			gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
  		if (locked > limit && !capable(CAP_IPC_LOCK))
  			return -ENOMEM;
  	}
-@@ -2151,37 +2459,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2151,37 +2465,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
   * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
   * vma is the last one with address > vma->vm_end.  Have to extend vma.
   */
@@ -118047,7 +117750,7 @@ index 79bcc9f..481e0f5c 100644
  		unsigned long size, grow;
  
  		size = address - vma->vm_start;
-@@ -2216,6 +2535,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+@@ -2216,6 +2541,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
  			}
  		}
  	}
@@ -118056,7 +117759,7 @@ index 79bcc9f..481e0f5c 100644
  	vma_unlock_anon_vma(vma);
  	khugepaged_enter_vma_merge(vma, vma->vm_flags);
  	validate_mm(vma->vm_mm);
-@@ -2230,6 +2551,8 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2230,6 +2557,8 @@ int expand_downwards(struct vm_area_struct *vma,
  				   unsigned long address)
  {
  	int error;
@@ -118065,7 +117768,7 @@ index 79bcc9f..481e0f5c 100644
  
  	/*
  	 * We must make sure the anon_vma is allocated
-@@ -2243,6 +2566,15 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2243,6 +2572,15 @@ int expand_downwards(struct vm_area_struct *vma,
  	if (error)
  		return error;
  
@@ -118081,7 +117784,7 @@ index 79bcc9f..481e0f5c 100644
  	vma_lock_anon_vma(vma);
  
  	/*
-@@ -2252,9 +2584,17 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2252,9 +2590,17 @@ int expand_downwards(struct vm_area_struct *vma,
  	 */
  
  	/* Somebody else might have raced and expanded it already */
@@ -118100,7 +117803,7 @@ index 79bcc9f..481e0f5c 100644
  		size = vma->vm_end - address;
  		grow = (vma->vm_start - address) >> PAGE_SHIFT;
  
-@@ -2279,13 +2619,27 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2279,13 +2625,27 @@ int expand_downwards(struct vm_area_struct *vma,
  				vma->vm_pgoff -= grow;
  				anon_vma_interval_tree_post_update_vma(vma);
  				vma_gap_update(vma);
@@ -118128,7 +117831,7 @@ index 79bcc9f..481e0f5c 100644
  	khugepaged_enter_vma_merge(vma, vma->vm_flags);
  	validate_mm(vma->vm_mm);
  	return error;
-@@ -2385,6 +2739,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2385,6 +2745,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
  	do {
  		long nrpages = vma_pages(vma);
  
@@ -118142,7 +117845,7 @@ index 79bcc9f..481e0f5c 100644
  		if (vma->vm_flags & VM_ACCOUNT)
  			nr_accounted += nrpages;
  		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
-@@ -2429,6 +2790,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2429,6 +2796,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
  	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
  	vma->vm_prev = NULL;
  	do {
@@ -118159,7 +117862,7 @@ index 79bcc9f..481e0f5c 100644
  		vma_rb_erase(vma, &mm->mm_rb);
  		mm->map_count--;
  		tail_vma = vma;
-@@ -2456,14 +2827,33 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2456,14 +2833,33 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  	struct vm_area_struct *new;
  	int err;
  
@@ -118193,7 +117896,7 @@ index 79bcc9f..481e0f5c 100644
  	/* most fields are the same, copy all, and then fixup */
  	*new = *vma;
  
-@@ -2476,6 +2866,22 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2476,6 +2872,22 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
  	}
  
@@ -118216,7 +117919,7 @@ index 79bcc9f..481e0f5c 100644
  	err = vma_dup_policy(vma, new);
  	if (err)
  		goto out_free_vma;
-@@ -2496,6 +2902,38 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2496,6 +2908,38 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  	else
  		err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
  
@@ -118255,7 +117958,7 @@ index 79bcc9f..481e0f5c 100644
  	/* Success. */
  	if (!err)
  		return 0;
-@@ -2505,10 +2943,18 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2505,10 +2949,18 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  		new->vm_ops->close(new);
  	if (new->vm_file)
  		fput(new->vm_file);
@@ -118275,7 +117978,7 @@ index 79bcc9f..481e0f5c 100644
  	kmem_cache_free(vm_area_cachep, new);
  	return err;
  }
-@@ -2520,6 +2966,15 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2520,6 +2972,15 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  	      unsigned long addr, int new_below)
  {
@@ -118291,7 +117994,7 @@ index 79bcc9f..481e0f5c 100644
  	if (mm->map_count >= sysctl_max_map_count)
  		return -ENOMEM;
  
-@@ -2531,11 +2986,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2531,11 +2992,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
   * work.  This now handles partial unmappings.
   * Jeremy Fitzhardinge <jeremy@goop.org>
   */
@@ -118322,7 +118025,7 @@ index 79bcc9f..481e0f5c 100644
  	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
  		return -EINVAL;
  
-@@ -2613,6 +3087,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+@@ -2613,6 +3093,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
  	/* Fix up all other VM information */
  	remove_vma_list(mm, vma);
  
@@ -118331,7 +118034,7 @@ index 79bcc9f..481e0f5c 100644
  	return 0;
  }
  
-@@ -2621,6 +3097,13 @@ int vm_munmap(unsigned long start, size_t len)
+@@ -2621,6 +3103,13 @@ int vm_munmap(unsigned long start, size_t len)
  	int ret;
  	struct mm_struct *mm = current->mm;
  
@@ -118345,7 +118048,7 @@ index 79bcc9f..481e0f5c 100644
  	down_write(&mm->mmap_sem);
  	ret = do_munmap(mm, start, len);
  	up_write(&mm->mmap_sem);
-@@ -2667,6 +3150,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
+@@ -2667,6 +3156,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
  	down_write(&mm->mmap_sem);
  	vma = find_vma(mm, start);
  
@@ -118357,7 +118060,7 @@ index 79bcc9f..481e0f5c 100644
  	if (!vma || !(vma->vm_flags & VM_SHARED))
  		goto out;
  
-@@ -2703,16 +3191,6 @@ out:
+@@ -2703,16 +3197,6 @@ out:
  	return ret;
  }
  
@@ -118374,7 +118077,7 @@ index 79bcc9f..481e0f5c 100644
  /*
   *  this is really a simplified "do_mmap".  it only handles
   *  anonymous maps.  eventually we may be able to do some
-@@ -2726,6 +3204,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2726,6 +3210,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	struct rb_node **rb_link, *rb_parent;
  	pgoff_t pgoff = addr >> PAGE_SHIFT;
  	int error;
@@ -118382,7 +118085,7 @@ index 79bcc9f..481e0f5c 100644
  
  	len = PAGE_ALIGN(len);
  	if (!len)
-@@ -2733,10 +3212,24 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2733,10 +3218,24 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  
  	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
  
@@ -118407,7 +118110,7 @@ index 79bcc9f..481e0f5c 100644
  	error = mlock_future_check(mm, mm->def_flags, len);
  	if (error)
  		return error;
-@@ -2754,16 +3247,17 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2754,16 +3253,17 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  			      &rb_parent)) {
  		if (do_munmap(mm, addr, len))
  			return -ENOMEM;
@@ -118427,7 +118130,7 @@ index 79bcc9f..481e0f5c 100644
  		return -ENOMEM;
  
  	/* Can we just expand an old private anonymous mapping? */
-@@ -2777,7 +3271,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2777,7 +3277,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	 */
  	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
  	if (!vma) {
@@ -118436,7 +118139,7 @@ index 79bcc9f..481e0f5c 100644
  		return -ENOMEM;
  	}
  
-@@ -2791,10 +3285,11 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2791,10 +3291,11 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	vma_link(mm, vma, prev, rb_link, rb_parent);
  out:
  	perf_event_mmap(vma);
@@ -118450,7 +118153,7 @@ index 79bcc9f..481e0f5c 100644
  	return addr;
  }
  
-@@ -2856,6 +3351,7 @@ void exit_mmap(struct mm_struct *mm)
+@@ -2856,6 +3357,7 @@ void exit_mmap(struct mm_struct *mm)
  	while (vma) {
  		if (vma->vm_flags & VM_ACCOUNT)
  			nr_accounted += vma_pages(vma);
@@ -118458,7 +118161,7 @@ index 79bcc9f..481e0f5c 100644
  		vma = remove_vma(vma);
  	}
  	vm_unacct_memory(nr_accounted);
-@@ -2870,6 +3366,10 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2870,6 +3372,10 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
  	struct vm_area_struct *prev;
  	struct rb_node **rb_link, *rb_parent;
  
@@ -118469,7 +118172,7 @@ index 79bcc9f..481e0f5c 100644
  	if (find_vma_links(mm, vma->vm_start, vma->vm_end,
  			   &prev, &rb_link, &rb_parent))
  		return -ENOMEM;
-@@ -2877,6 +3377,9 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2877,6 +3383,9 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
  	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
  		return -ENOMEM;
  
@@ -118479,7 +118182,7 @@ index 79bcc9f..481e0f5c 100644
  	/*
  	 * The vm_pgoff of a purely anonymous vma should be irrelevant
  	 * until its first write fault, when page's anon_vma and index
-@@ -2894,7 +3397,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2894,7 +3403,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
  		vma->vm_pgoff = vma->vm_start >> PAGE_SHIFT;
  	}
  
@@ -118501,7 +118204,7 @@ index 79bcc9f..481e0f5c 100644
  	return 0;
  }
  
-@@ -2913,6 +3430,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2913,6 +3436,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	struct rb_node **rb_link, *rb_parent;
  	bool faulted_in_anon_vma = true;
  
@@ -118510,7 +118213,7 @@ index 79bcc9f..481e0f5c 100644
  	/*
  	 * If anonymous vma has not yet been faulted, update new pgoff
  	 * to match new location, to increase its chance of merging.
-@@ -2979,6 +3498,39 @@ out:
+@@ -2979,6 +3504,39 @@ out:
  	return NULL;
  }
  
@@ -118550,15 +118253,19 @@ index 79bcc9f..481e0f5c 100644
  /*
   * Return true if the calling process may expand its vm space by the passed
   * number of pages
-@@ -2990,6 +3542,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+@@ -2990,6 +3548,11 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
  
  	lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
  
-+	gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
++	if ((cur + npages) > (ULONG_MAX >> PAGE_SHIFT))
++		gr_learn_resource(current, RLIMIT_AS, ULONG_MAX, 1);
++	else
++		gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
++
  	if (cur + npages > lim)
  		return 0;
  	return 1;
-@@ -3064,6 +3617,22 @@ static struct vm_area_struct *__install_special_mapping(
+@@ -3064,6 +3627,22 @@ static struct vm_area_struct *__install_special_mapping(
  	vma->vm_start = addr;
  	vma->vm_end = addr + len;
  
@@ -121892,22 +121599,6 @@ index ea748c9..79056c3 100644
  	.kind			= "bridge",
  	.priv_size		= sizeof(struct net_bridge),
  	.setup			= br_dev_setup,
-diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
-index 4ca449a..49d8d28 100644
---- a/net/bridge/br_stp_if.c
-+++ b/net/bridge/br_stp_if.c
-@@ -130,7 +130,10 @@ static void br_stp_start(struct net_bridge *br)
- 	char *envp[] = { NULL };
- 	struct net_bridge_port *p;
- 
--	r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
-+	if (net_eq(dev_net(br->dev), &init_net))
-+		r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
-+	else
-+		r = -ENOENT;
- 
- 	spin_lock_bh(&br->lock);
- 
 diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
 index 48b6b01..cf544f3 100644
 --- a/net/bridge/netfilter/ebtables.c
@@ -122219,7 +121910,7 @@ index 617088a..0364f4f 100644
  
  	return err;
 diff --git a/net/core/dev.c b/net/core/dev.c
-index c14748d..b500378 100644
+index 6369c45..86ce9a7 100644
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
 @@ -1748,7 +1748,7 @@ int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
@@ -122231,7 +121922,7 @@ index c14748d..b500378 100644
  		kfree_skb(skb);
  		return NET_RX_DROP;
  	}
-@@ -3162,7 +3162,7 @@ recursion_alert:
+@@ -3167,7 +3167,7 @@ recursion_alert:
  drop:
  	rcu_read_unlock_bh();
  
@@ -122240,7 +121931,7 @@ index c14748d..b500378 100644
  	kfree_skb_list(skb);
  	return rc;
  out:
-@@ -3514,7 +3514,7 @@ drop:
+@@ -3519,7 +3519,7 @@ drop:
  
  	local_irq_restore(flags);
  
@@ -122249,7 +121940,7 @@ index c14748d..b500378 100644
  	kfree_skb(skb);
  	return NET_RX_DROP;
  }
-@@ -3591,7 +3591,7 @@ int netif_rx_ni(struct sk_buff *skb)
+@@ -3596,7 +3596,7 @@ int netif_rx_ni(struct sk_buff *skb)
  }
  EXPORT_SYMBOL(netif_rx_ni);
  
@@ -122258,7 +121949,7 @@ index c14748d..b500378 100644
  {
  	struct softnet_data *sd = this_cpu_ptr(&softnet_data);
  
-@@ -3929,7 +3929,7 @@ ncls:
+@@ -3934,7 +3934,7 @@ ncls:
  			ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
  	} else {
  drop:
@@ -122267,7 +121958,7 @@ index c14748d..b500378 100644
  		kfree_skb(skb);
  		/* Jamal, now you will not able to escape explaining
  		 * me how you were going to use this. :-)
-@@ -4822,7 +4822,7 @@ out_unlock:
+@@ -4827,7 +4827,7 @@ out_unlock:
  	return work;
  }
  
@@ -122276,7 +121967,7 @@ index c14748d..b500378 100644
  {
  	struct softnet_data *sd = this_cpu_ptr(&softnet_data);
  	unsigned long time_limit = jiffies + 2;
-@@ -6914,8 +6914,8 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
+@@ -6919,8 +6919,8 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
  	} else {
  		netdev_stats_to_stats64(storage, &dev->stats);
  	}
@@ -122306,27 +121997,8 @@ index b94b1d2..da3ed7c 100644
  }
  EXPORT_SYMBOL(dev_load);
  
-diff --git a/net/core/dst.c b/net/core/dst.c
-index d6a5a0b..8852021 100644
---- a/net/core/dst.c
-+++ b/net/core/dst.c
-@@ -301,12 +301,13 @@ void dst_release(struct dst_entry *dst)
- {
- 	if (dst) {
- 		int newrefcnt;
-+		unsigned short nocache = dst->flags & DST_NOCACHE;
- 
- 		newrefcnt = atomic_dec_return(&dst->__refcnt);
- 		if (unlikely(newrefcnt < 0))
- 			net_warn_ratelimited("%s: dst:%p refcnt:%d\n",
- 					     __func__, dst, newrefcnt);
--		if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE))
-+		if (!newrefcnt && unlikely(nocache))
- 			call_rcu(&dst->rcu_head, dst_destroy_rcu);
- 	}
- }
 diff --git a/net/core/filter.c b/net/core/filter.c
-index bb18c36..a0c92a7 100644
+index 49b4487..a0c92a7 100644
 --- a/net/core/filter.c
 +++ b/net/core/filter.c
 @@ -584,7 +584,11 @@ do_pass:
@@ -122351,19 +122023,7 @@ index bb18c36..a0c92a7 100644
  
  	masks = kmalloc_array(flen, sizeof(*masks), GFP_KERNEL);
  	if (!masks)
-@@ -781,6 +785,11 @@ static int bpf_check_classic(const struct sock_filter *filter,
- 			if (ftest->k == 0)
- 				return -EINVAL;
- 			break;
-+		case BPF_ALU | BPF_LSH | BPF_K:
-+		case BPF_ALU | BPF_RSH | BPF_K:
-+			if (ftest->k >= 32)
-+				return -EINVAL;
-+			break;
- 		case BPF_LD | BPF_MEM:
- 		case BPF_LDX | BPF_MEM:
- 		case BPF_ST:
-@@ -1057,7 +1066,7 @@ int bpf_prog_create(struct bpf_prog **pfp, struct sock_fprog_kern *fprog)
+@@ -1062,7 +1066,7 @@ int bpf_prog_create(struct bpf_prog **pfp, struct sock_fprog_kern *fprog)
  	if (!fp)
  		return -ENOMEM;
  
@@ -122552,10 +122212,10 @@ index 8bdada2..d7048c2 100644
  		iph->ttl      = 64;
  		iph->protocol = IPPROTO_UDP;
 diff --git a/net/core/pktgen.c b/net/core/pktgen.c
-index de8d5cc..bf8443a 100644
+index 4da4d51..ef1aa60 100644
 --- a/net/core/pktgen.c
 +++ b/net/core/pktgen.c
-@@ -3827,7 +3827,7 @@ static int __net_init pg_net_init(struct net *net)
+@@ -3829,7 +3829,7 @@ static int __net_init pg_net_init(struct net *net)
  	pn->net = net;
  	INIT_LIST_HEAD(&pn->pktgen_threads);
  	pn->pktgen_exiting = false;
@@ -124028,7 +123688,7 @@ index ade7737..70ed9be 100644
  		goto err_reg;
  
 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index 0a2b61d..e6e7d27 100644
+index 064f1a0..e6e7d27 100644
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
 @@ -786,7 +786,7 @@ static void tcp_update_pacing_rate(struct sock *sk)
@@ -124040,17 +123700,7 @@ index 0a2b61d..e6e7d27 100644
  						sk->sk_max_pacing_rate);
  }
  
-@@ -2525,6 +2525,9 @@ static void tcp_cwnd_reduction(struct sock *sk, const int prior_unsacked,
- 	int newly_acked_sacked = prior_unsacked -
- 				 (tp->packets_out - tp->sacked_out);
- 
-+	if (newly_acked_sacked <= 0 || WARN_ON_ONCE(!tp->prior_cwnd))
-+		return;
-+
- 	tp->prr_delivered += newly_acked_sacked;
- 	if (delta < 0) {
- 		u64 dividend = (u64)tp->snd_ssthresh * tp->prr_delivered +
-@@ -4647,7 +4650,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
+@@ -4650,7 +4650,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
   * simplifies code)
   */
  static void
@@ -124059,7 +123709,7 @@ index 0a2b61d..e6e7d27 100644
  	     struct sk_buff *head, struct sk_buff *tail,
  	     u32 start, u32 end)
  {
-@@ -5642,6 +5645,7 @@ discard:
+@@ -5645,6 +5645,7 @@ discard:
  	    tcp_paws_reject(&tp->rx_opt, 0))
  		goto discard_and_undo;
  
@@ -124067,7 +123717,7 @@ index 0a2b61d..e6e7d27 100644
  	if (th->syn) {
  		/* We see SYN without ACK. It is attempt of
  		 * simultaneous connect with crossed SYNs.
-@@ -5693,6 +5697,7 @@ discard:
+@@ -5696,6 +5697,7 @@ discard:
  		goto discard;
  #endif
  	}
@@ -124075,7 +123725,7 @@ index 0a2b61d..e6e7d27 100644
  	/* "fifth, if neither of the SYN or RST bits is set then
  	 * drop the segment and return."
  	 */
-@@ -5739,7 +5744,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -5742,7 +5744,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  			goto discard;
  
  		if (th->syn) {
@@ -124084,7 +123734,7 @@ index 0a2b61d..e6e7d27 100644
  				goto discard;
  			if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
  				return 1;
-@@ -6069,7 +6074,7 @@ struct request_sock *inet_reqsk_alloc(const struct request_sock_ops *ops,
+@@ -6072,7 +6074,7 @@ struct request_sock *inet_reqsk_alloc(const struct request_sock_ops *ops,
  
  		kmemcheck_annotate_bitfield(ireq, flags);
  		ireq->opt = NULL;
@@ -124353,7 +124003,7 @@ index fd840c7..b517627 100644
  	struct iphdr *iph = ip_hdr(skb);
  	int ihl = iph->ihl * 4;
 diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
-index c10a9ee..c621a01 100644
+index 126ff90..e9ba962 100644
 --- a/net/ipv4/xfrm4_policy.c
 +++ b/net/ipv4/xfrm4_policy.c
 @@ -192,11 +192,11 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
@@ -124372,7 +124022,7 @@ index c10a9ee..c621a01 100644
  
 @@ -274,19 +274,18 @@ static struct ctl_table xfrm4_policy_table[] = {
  
- static int __net_init xfrm4_net_init(struct net *net)
+ static int __net_init xfrm4_net_sysctl_init(struct net *net)
  {
 -	struct ctl_table *table;
 +	ctl_table_no_const *table = NULL;
@@ -124395,7 +124045,7 @@ index c10a9ee..c621a01 100644
  	if (!hdr)
  		goto err_reg;
  
-@@ -294,8 +293,7 @@ static int __net_init xfrm4_net_init(struct net *net)
+@@ -294,8 +293,7 @@ static int __net_init xfrm4_net_sysctl_init(struct net *net)
  	return 0;
  
  err_reg:
@@ -124418,7 +124068,7 @@ index 983bb99..ebc39e1 100644
  	  Support for IPsec ESP.
  
 diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index ddd3511..22c903e 100644
+index 5462bfd..22c903e 100644
 --- a/net/ipv6/addrconf.c
 +++ b/net/ipv6/addrconf.c
 @@ -178,7 +178,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
@@ -124554,25 +124204,7 @@ index ddd3511..22c903e 100644
  	struct net *net = ctl->extra2;
  	struct ipv6_stable_secret *secret = ctl->data;
  
-@@ -5349,13 +5356,10 @@ static int addrconf_sysctl_stable_secret(struct ctl_table *ctl, int write,
- 		goto out;
- 	}
- 
--	if (!write) {
--		err = snprintf(str, sizeof(str), "%pI6",
--			       &secret->secret);
--		if (err >= sizeof(str)) {
--			err = -EIO;
--			goto out;
--		}
-+	err = snprintf(str, sizeof(str), "%pI6", &secret->secret);
-+	if (err >= sizeof(str)) {
-+		err = -EIO;
-+		goto out;
- 	}
- 
- 	err = proc_dostring(&lctl, write, buffer, lenp, ppos);
-@@ -5403,7 +5407,7 @@ int addrconf_sysctl_ignore_routes_with_linkdown(struct ctl_table *ctl,
+@@ -5400,7 +5407,7 @@ int addrconf_sysctl_ignore_routes_with_linkdown(struct ctl_table *ctl,
  	int *valp = ctl->data;
  	int val = *valp;
  	loff_t pos = *ppos;
@@ -125107,7 +124739,7 @@ index 45243bb..cdb398e 100644
  	struct ctl_table *ipv6_icmp_table;
  	int err;
 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 8935dc1..bdfd1ee 100644
+index a71fb26..072547c 100644
 --- a/net/ipv6/tcp_ipv6.c
 +++ b/net/ipv6/tcp_ipv6.c
 @@ -102,6 +102,10 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
@@ -125121,7 +124753,7 @@ index 8935dc1..bdfd1ee 100644
  static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
  {
  	return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
-@@ -1285,6 +1289,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1287,6 +1291,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
  	return 0;
  
  reset:
@@ -125131,7 +124763,7 @@ index 8935dc1..bdfd1ee 100644
  	tcp_v6_send_reset(sk, skb);
  discard:
  	if (opt_skb)
-@@ -1394,12 +1401,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
+@@ -1396,12 +1403,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
  
  	sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
  				inet6_iif(skb));
@@ -125154,7 +124786,7 @@ index 8935dc1..bdfd1ee 100644
  
  	if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
  		NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
-@@ -1451,6 +1466,10 @@ csum_error:
+@@ -1453,6 +1468,10 @@ csum_error:
  bad_packet:
  		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
  	} else {
@@ -125218,7 +124850,7 @@ index 8379fc2..faac798 100644
  
  	kfree_skb(skb);
 diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
-index da55e0c..3c30bd8 100644
+index d51a18d..36a6399 100644
 --- a/net/ipv6/xfrm6_policy.c
 +++ b/net/ipv6/xfrm6_policy.c
 @@ -218,11 +218,11 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
@@ -125237,7 +124869,7 @@ index da55e0c..3c30bd8 100644
  
 @@ -329,19 +329,19 @@ static struct ctl_table xfrm6_policy_table[] = {
  
- static int __net_init xfrm6_net_init(struct net *net)
+ static int __net_init xfrm6_net_sysctl_init(struct net *net)
  {
 -	struct ctl_table *table;
 +	ctl_table_no_const *table = NULL;
@@ -125260,7 +124892,7 @@ index da55e0c..3c30bd8 100644
  	if (!hdr)
  		goto err_reg;
  
-@@ -349,8 +349,7 @@ static int __net_init xfrm6_net_init(struct net *net)
+@@ -349,8 +349,7 @@ static int __net_init xfrm6_net_sysctl_init(struct net *net)
  	return 0;
  
  err_reg:
@@ -127088,7 +126720,7 @@ index f226709..0e735a8 100644
  
  	ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
 diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
-index e82a1ad..a7df216b 100644
+index 16bc83b..a7df216b 100644
 --- a/net/sched/sch_generic.c
 +++ b/net/sched/sch_generic.c
 @@ -349,7 +349,7 @@ void netif_carrier_on(struct net_device *dev)
@@ -127109,18 +126741,6 @@ index e82a1ad..a7df216b 100644
  		linkwatch_fire_event(dev);
  	}
  }
-@@ -658,8 +658,10 @@ static void qdisc_rcu_free(struct rcu_head *head)
- {
- 	struct Qdisc *qdisc = container_of(head, struct Qdisc, rcu_head);
- 
--	if (qdisc_is_percpu_stats(qdisc))
-+	if (qdisc_is_percpu_stats(qdisc)) {
- 		free_percpu(qdisc->cpu_bstats);
-+		free_percpu(qdisc->cpu_qstats);
-+	}
- 
- 	kfree((char *) qdisc - qdisc->padded);
- }
 diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
 index 40677cf..9656f92 100644
 --- a/net/sctp/ipv6.c
@@ -127259,7 +126879,7 @@ index 6098d4c..9920c54 100644
  		 * We should no longer have much work to do here as the
  		 * real work has been done as explicit commands above.
 diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
-index d7eaa73..9042a5d 100644
+index c89586e..dd962f7 100644
 --- a/net/sctp/sm_statefuns.c
 +++ b/net/sctp/sm_statefuns.c
 @@ -2976,7 +2976,7 @@ sctp_disposition_t sctp_sf_eat_data_6_2(struct net *net,
@@ -127306,9 +126926,9 @@ index d7eaa73..9042a5d 100644
 -
 -	retval = SCTP_DISPOSITION_CONSUME;
  
- 	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
- 
-@@ -4844,7 +4837,7 @@ sctp_disposition_t sctp_sf_do_9_1_prm_abort(
+ 	if (abort)
+ 		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
+@@ -4845,7 +4838,7 @@ sctp_disposition_t sctp_sf_do_9_1_prm_abort(
  	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
  	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
  
@@ -127317,7 +126937,7 @@ index d7eaa73..9042a5d 100644
  }
  
  /* We tried an illegal operation on an association which is closed.  */
-@@ -4959,12 +4952,10 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
+@@ -4960,12 +4953,10 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
  	sctp_cmd_seq_t *commands)
  {
  	struct sctp_chunk *abort = arg;
@@ -127328,9 +126948,9 @@ index d7eaa73..9042a5d 100644
  			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
 -	retval = SCTP_DISPOSITION_CONSUME;
  
- 	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
- 
-@@ -4983,7 +4974,7 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
+ 	if (abort)
+ 		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
+@@ -4985,7 +4976,7 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
  	sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
  			SCTP_PERR(SCTP_ERROR_USER_ABORT));
  
@@ -127340,7 +126960,7 @@ index d7eaa73..9042a5d 100644
  
  /*
 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 84b1b50..e2a95d3 100644
+index 9dee804..7e2f09d 100644
 --- a/net/sctp/socket.c
 +++ b/net/sctp/socket.c
 @@ -972,7 +972,7 @@ static int sctp_setsockopt_bindx(struct sock *sk,
@@ -127374,7 +126994,7 @@ index 84b1b50..e2a95d3 100644
  	if (unlikely(!kaddrs))
  		return -ENOMEM;
  
-@@ -2194,11 +2197,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
+@@ -2193,11 +2196,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
  {
  	struct sctp_association *asoc;
  	struct sctp_ulpevent *event;
@@ -127389,7 +127009,7 @@ index 84b1b50..e2a95d3 100644
  
  	/* At the time when a user app subscribes to SCTP_SENDER_DRY_EVENT,
  	 * if there is no data to be sent or retransmit, the stack will
-@@ -4373,13 +4378,16 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
+@@ -4372,13 +4377,16 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
  static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
  				  int __user *optlen)
  {
@@ -127407,7 +127027,7 @@ index 84b1b50..e2a95d3 100644
  		return -EFAULT;
  	return 0;
  }
-@@ -4397,6 +4405,8 @@ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
+@@ -4396,6 +4404,8 @@ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
   */
  static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optval, int __user *optlen)
  {
@@ -127416,7 +127036,7 @@ index 84b1b50..e2a95d3 100644
  	/* Applicable to UDP-style socket only */
  	if (sctp_style(sk, TCP))
  		return -EOPNOTSUPP;
-@@ -4405,7 +4415,8 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
+@@ -4404,7 +4414,8 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
  	len = sizeof(int);
  	if (put_user(len, optlen))
  		return -EFAULT;
@@ -127426,7 +127046,7 @@ index 84b1b50..e2a95d3 100644
  		return -EFAULT;
  	return 0;
  }
-@@ -4779,12 +4790,15 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
+@@ -4778,12 +4789,15 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
   */
  static int sctp_getsockopt_initmsg(struct sock *sk, int len, char __user *optval, int __user *optlen)
  {
@@ -127443,7 +127063,7 @@ index 84b1b50..e2a95d3 100644
  		return -EFAULT;
  	return 0;
  }
-@@ -4825,6 +4839,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
+@@ -4824,6 +4838,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
  			      ->addr_to_user(sp, &temp);
  		if (space_left < addrlen)
  			return -ENOMEM;
@@ -127452,7 +127072,7 @@ index 84b1b50..e2a95d3 100644
  		if (copy_to_user(to, &temp, addrlen))
  			return -EFAULT;
  		to += addrlen;
-@@ -4928,7 +4944,7 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
+@@ -4927,7 +4943,7 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
  	to = optval + offsetof(struct sctp_getaddrs, addrs);
  	space_left = len - offsetof(struct sctp_getaddrs, addrs);
  
@@ -127461,7 +127081,7 @@ index 84b1b50..e2a95d3 100644
  	if (!addrs)
  		return -ENOMEM;
  
-@@ -5777,7 +5793,7 @@ static int sctp_getsockopt_assoc_ids(struct sock *sk, int len,
+@@ -5776,7 +5792,7 @@ static int sctp_getsockopt_assoc_ids(struct sock *sk, int len,
  
  	len = sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num;
  
@@ -127471,10 +127091,10 @@ index 84b1b50..e2a95d3 100644
  		return -ENOMEM;
  
 diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
-index 26d50c5..289fe22 100644
+index 3e0fc51..289fe22 100644
 --- a/net/sctp/sysctl.c
 +++ b/net/sctp/sysctl.c
-@@ -317,10 +317,10 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
+@@ -317,7 +317,7 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
  				loff_t *ppos)
  {
  	struct net *net = current->nsproxy->net_ns;
@@ -127482,11 +127102,7 @@ index 26d50c5..289fe22 100644
 +	ctl_table_no_const tbl;
  	bool changed = false;
  	char *none = "none";
--	char tmp[8];
-+	char tmp[8] = {0};
- 	int ret;
- 
- 	memset(&tbl, 0, sizeof(struct ctl_table));
+ 	char tmp[8] = {0};
 @@ -365,7 +365,7 @@ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
  	struct net *net = current->nsproxy->net_ns;
  	unsigned int min = *(unsigned int *) ctl->extra1;
@@ -128221,7 +127837,7 @@ index 350cca3..a108fc5 100644
  	sub->evt.event = htohl(event, sub->swap);
  	sub->evt.found_lower = htohl(found_lower, sub->swap);
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 0fc6dba..8355d2c 100644
+index 7926de1..8355d2c 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
 @@ -918,6 +918,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -128251,186 +127867,27 @@ index 0fc6dba..8355d2c 100644
  			if (dentry)
  				touch_atime(&unix_sk(u)->path);
  		} else
-@@ -952,32 +965,26 @@ fail:
- 	return NULL;
- }
- 
--static int unix_mknod(const char *sun_path, umode_t mode, struct path *res)
-+static int unix_mknod(struct dentry *dentry, struct path *path, umode_t mode,
-+		      struct path *res)
- {
--	struct dentry *dentry;
--	struct path path;
--	int err = 0;
--	/*
--	 * Get the parent directory, calculate the hash for last
--	 * component.
--	 */
--	dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
--	err = PTR_ERR(dentry);
--	if (IS_ERR(dentry))
--		return err;
-+	int err;
+@@ -959,13 +972,19 @@ static int unix_mknod(struct dentry *dentry, struct path *path, umode_t mode,
  
--	/*
--	 * All right, let's create it.
--	 */
--	err = security_path_mknod(&path, dentry, mode, 0);
-+	err = security_path_mknod(path, dentry, mode, 0);
+ 	err = security_path_mknod(path, dentry, mode, 0);
  	if (!err) {
--		err = vfs_mknod(d_inode(path.dentry), dentry, mode, 0);
 +		if (!gr_acl_handle_mknod(dentry, path->dentry, path->mnt, mode)) {
 +			err = -EACCES;
 +			goto out;
 +		}
-+		err = vfs_mknod(d_inode(path->dentry), dentry, mode, 0);
+ 		err = vfs_mknod(d_inode(path->dentry), dentry, mode, 0);
  		if (!err) {
--			res->mnt = mntget(path.mnt);
-+			res->mnt = mntget(path->mnt);
+ 			res->mnt = mntget(path->mnt);
  			res->dentry = dget(dentry);
 +			gr_handle_create(dentry, path->mnt);
  		}
  	}
--	done_path_create(&path, dentry);
-+
-+out:
- 	return err;
- }
- 
-@@ -988,10 +995,12 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
- 	struct unix_sock *u = unix_sk(sk);
- 	struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
- 	char *sun_path = sunaddr->sun_path;
--	int err;
-+	int err, name_err;
- 	unsigned int hash;
- 	struct unix_address *addr;
- 	struct hlist_head *list;
-+	struct path path;
-+	struct dentry *dentry;
- 
- 	err = -EINVAL;
- 	if (sunaddr->sun_family != AF_UNIX)
-@@ -1007,14 +1016,34 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
- 		goto out;
- 	addr_len = err;
- 
-+	name_err = 0;
-+	dentry = NULL;
-+	if (sun_path[0]) {
-+		/* Get the parent directory, calculate the hash for last
-+		 * component.
-+		 */
-+		dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
-+
-+		if (IS_ERR(dentry)) {
-+			/* delay report until after 'already bound' check */
-+			name_err = PTR_ERR(dentry);
-+			dentry = NULL;
-+		}
-+	}
-+
- 	err = mutex_lock_interruptible(&u->readlock);
- 	if (err)
--		goto out;
-+		goto out_path;
- 
- 	err = -EINVAL;
- 	if (u->addr)
- 		goto out_up;
  
-+	if (name_err) {
-+		err = name_err == -EEXIST ? -EADDRINUSE : name_err;
-+		goto out_up;
-+	}
-+
- 	err = -ENOMEM;
- 	addr = kmalloc(sizeof(*addr)+addr_len, GFP_KERNEL);
- 	if (!addr)
-@@ -1025,11 +1054,11 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
- 	addr->hash = hash ^ sk->sk_type;
- 	atomic_set(&addr->refcnt, 1);
- 
--	if (sun_path[0]) {
--		struct path path;
-+	if (dentry) {
-+		struct path u_path;
- 		umode_t mode = S_IFSOCK |
- 		       (SOCK_INODE(sock)->i_mode & ~current_umask());
--		err = unix_mknod(sun_path, mode, &path);
-+		err = unix_mknod(dentry, &path, mode, &u_path);
- 		if (err) {
- 			if (err == -EEXIST)
- 				err = -EADDRINUSE;
-@@ -1037,9 +1066,9 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
- 			goto out_up;
- 		}
- 		addr->hash = UNIX_HASH_SIZE;
--		hash = d_backing_inode(path.dentry)->i_ino & (UNIX_HASH_SIZE-1);
-+		hash = d_backing_inode(dentry)->i_ino & (UNIX_HASH_SIZE - 1);
- 		spin_lock(&unix_table_lock);
--		u->path = path;
-+		u->path = u_path;
- 		list = &unix_socket_table[hash];
- 	} else {
- 		spin_lock(&unix_table_lock);
-@@ -1062,6 +1091,10 @@ out_unlock:
- 	spin_unlock(&unix_table_lock);
- out_up:
- 	mutex_unlock(&u->readlock);
-+out_path:
-+	if (dentry)
-+		done_path_create(&path, dentry);
-+
- out:
++out:
  	return err;
  }
-@@ -1498,6 +1531,21 @@ static void unix_destruct_scm(struct sk_buff *skb)
- 	sock_wfree(skb);
- }
  
-+/*
-+ * The "user->unix_inflight" variable is protected by the garbage
-+ * collection lock, and we just read it locklessly here. If you go
-+ * over the limit, there might be a tiny race in actually noticing
-+ * it across threads. Tough.
-+ */
-+static inline bool too_many_unix_fds(struct task_struct *p)
-+{
-+	struct user_struct *user = current_user();
-+
-+	if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
-+		return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
-+	return false;
-+}
-+
- #define MAX_RECURSION_LEVEL 4
- 
- static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
-@@ -1506,6 +1554,9 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
- 	unsigned char max_level = 0;
- 	int unix_sock_count = 0;
- 
-+	if (too_many_unix_fds(current))
-+		return -ETOOMANYREFS;
-+
- 	for (i = scm->fp->count - 1; i >= 0; i--) {
- 		struct sock *sk = unix_get_socket(scm->fp->fp[i]);
- 
-@@ -1527,10 +1578,8 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
- 	if (!UNIXCB(skb).fp)
- 		return -ENOMEM;
- 
--	if (unix_sock_count) {
--		for (i = scm->fp->count - 1; i >= 0; i--)
--			unix_inflight(scm->fp->fp[i]);
--	}
-+	for (i = scm->fp->count - 1; i >= 0; i--)
-+		unix_inflight(scm->fp->fp[i]);
- 	return max_level;
- }
- 
-@@ -2301,6 +2350,7 @@ again:
+@@ -2331,6 +2350,7 @@ again:
  
  			if (signal_pending(current)) {
  				err = sock_intr_errno(timeo);
@@ -128438,7 +127895,7 @@ index 0fc6dba..8355d2c 100644
  				goto out;
  			}
  
-@@ -2765,9 +2815,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2795,9 +2815,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  		seq_puts(seq, "Num       RefCount Protocol Flags    Type St "
  			 "Inode Path\n");
  	else {
@@ -128453,7 +127910,7 @@ index 0fc6dba..8355d2c 100644
  
  		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
  			s,
-@@ -2792,10 +2846,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2822,10 +2846,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  				seq_putc(seq, '@');
  				i++;
  			}
@@ -128487,56 +127944,6 @@ index 0fc6dba..8355d2c 100644
  		seq_putc(seq, '\n');
  	}
  
-diff --git a/net/unix/garbage.c b/net/unix/garbage.c
-index a73a226..8fcdc22 100644
---- a/net/unix/garbage.c
-+++ b/net/unix/garbage.c
-@@ -120,11 +120,11 @@ void unix_inflight(struct file *fp)
- {
- 	struct sock *s = unix_get_socket(fp);
- 
-+	spin_lock(&unix_gc_lock);
-+
- 	if (s) {
- 		struct unix_sock *u = unix_sk(s);
- 
--		spin_lock(&unix_gc_lock);
--
- 		if (atomic_long_inc_return(&u->inflight) == 1) {
- 			BUG_ON(!list_empty(&u->link));
- 			list_add_tail(&u->link, &gc_inflight_list);
-@@ -132,25 +132,28 @@ void unix_inflight(struct file *fp)
- 			BUG_ON(list_empty(&u->link));
- 		}
- 		unix_tot_inflight++;
--		spin_unlock(&unix_gc_lock);
- 	}
-+	fp->f_cred->user->unix_inflight++;
-+	spin_unlock(&unix_gc_lock);
- }
- 
- void unix_notinflight(struct file *fp)
- {
- 	struct sock *s = unix_get_socket(fp);
- 
-+	spin_lock(&unix_gc_lock);
-+
- 	if (s) {
- 		struct unix_sock *u = unix_sk(s);
- 
--		spin_lock(&unix_gc_lock);
- 		BUG_ON(list_empty(&u->link));
- 
- 		if (atomic_long_dec_and_test(&u->inflight))
- 			list_del_init(&u->link);
- 		unix_tot_inflight--;
--		spin_unlock(&unix_gc_lock);
- 	}
-+	fp->f_cred->user->unix_inflight--;
-+	spin_unlock(&unix_gc_lock);
- }
- 
- static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
 diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c
 index b3d5150..ff3a837 100644
 --- a/net/unix/sysctl_net_unix.c
@@ -128692,7 +128099,7 @@ index 0917f04..f4e3d8c 100644
  
  	if (!proc_create("x25/route", S_IRUGO, init_net.proc_net,
 diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
-index 94af3d0..7db10b8 100644
+index bacd30b..f8ddfe7 100644
 --- a/net/xfrm/xfrm_policy.c
 +++ b/net/xfrm/xfrm_policy.c
 @@ -325,7 +325,7 @@ static void xfrm_policy_kill(struct xfrm_policy *policy)
@@ -128744,7 +128151,7 @@ index 94af3d0..7db10b8 100644
  			return 0;
  
  		mtu = dst_mtu(dst->child);
-@@ -2832,8 +2833,6 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
+@@ -2831,8 +2832,6 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
  			dst_ops->link_failure = xfrm_link_failure;
  		if (likely(dst_ops->neigh_lookup == NULL))
  			dst_ops->neigh_lookup = xfrm_neigh_lookup;
@@ -128753,7 +128160,7 @@ index 94af3d0..7db10b8 100644
  		rcu_assign_pointer(xfrm_policy_afinfo[afinfo->family], afinfo);
  	}
  	spin_unlock(&xfrm_policy_afinfo_lock);
-@@ -2887,7 +2886,6 @@ int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
+@@ -2866,7 +2865,6 @@ int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
  		dst_ops->check = NULL;
  		dst_ops->negative_advice = NULL;
  		dst_ops->link_failure = NULL;
@@ -128761,7 +128168,7 @@ index 94af3d0..7db10b8 100644
  	}
  	return err;
  }
-@@ -3285,7 +3283,7 @@ static int xfrm_policy_migrate(struct xfrm_policy *pol,
+@@ -3247,7 +3245,7 @@ static int xfrm_policy_migrate(struct xfrm_policy *pol,
  			       sizeof(pol->xfrm_vec[i].saddr));
  			pol->xfrm_vec[i].encap_family = mp->new_family;
  			/* flush bundles */
@@ -131348,27 +130755,6 @@ index ffd2025..df062c9 100644
  
  /* PCM3052 register definitions */
  
-diff --git a/sound/core/hrtimer.c b/sound/core/hrtimer.c
-index f845ecf..656d9a9 100644
---- a/sound/core/hrtimer.c
-+++ b/sound/core/hrtimer.c
-@@ -90,7 +90,7 @@ static int snd_hrtimer_start(struct snd_timer *t)
- 	struct snd_hrtimer *stime = t->private_data;
- 
- 	atomic_set(&stime->running, 0);
--	hrtimer_cancel(&stime->hrt);
-+	hrtimer_try_to_cancel(&stime->hrt);
- 	hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution),
- 		      HRTIMER_MODE_REL);
- 	atomic_set(&stime->running, 1);
-@@ -101,6 +101,7 @@ static int snd_hrtimer_stop(struct snd_timer *t)
- {
- 	struct snd_hrtimer *stime = t->private_data;
- 	atomic_set(&stime->running, 0);
-+	hrtimer_try_to_cancel(&stime->hrt);
- 	return 0;
- }
- 
 diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
 index 58550cc..4687a93 100644
 --- a/sound/core/oss/pcm_oss.c
@@ -131445,7 +130831,7 @@ index 58550cc..4687a93 100644
  				}
  			} else if (runtime->access == SNDRV_PCM_ACCESS_RW_NONINTERLEAVED) {
 diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
-index b48b434..e2ba787 100644
+index 9630e9f..2071ac2 100644
 --- a/sound/core/pcm_compat.c
 +++ b/sound/core/pcm_compat.c
 @@ -31,7 +31,7 @@ static int snd_pcm_ioctl_delay_compat(struct snd_pcm_substream *substream,
@@ -131476,7 +130862,7 @@ index 75888dd..c940854 100644
  	default:
  		result = -EINVAL;
 diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
-index b64f20d..a68addd 100644
+index 13cfa81..a68addd 100644
 --- a/sound/core/seq/seq_clientmgr.c
 +++ b/sound/core/seq/seq_clientmgr.c
 @@ -446,7 +446,7 @@ static ssize_t snd_seq_read(struct file *file, char __user *buf, size_t count,
@@ -131504,15 +130890,6 @@ index b64f20d..a68addd 100644
  				event.data.ext.ptr = ptr;
  			}
  #endif
-@@ -1962,7 +1962,7 @@ static int snd_seq_ioctl_remove_events(struct snd_seq_client *client,
- 		 * No restrictions so for a user client we can clear
- 		 * the whole fifo
- 		 */
--		if (client->type == USER_CLIENT)
-+		if (client->type == USER_CLIENT && client->data.user.fifo)
- 			snd_seq_fifo_clear(client->data.user.fifo);
- 	}
- 
 @@ -2420,7 +2420,7 @@ int snd_seq_kernel_client_ctl(int clientid, unsigned int cmd, void *arg)
  	if (client == NULL)
  		return -ENXIO;
@@ -131523,10 +130900,10 @@ index b64f20d..a68addd 100644
  	return result;
  }
 diff --git a/sound/core/seq/seq_compat.c b/sound/core/seq/seq_compat.c
-index 81f7c10..296bd6fd 100644
+index 6517590..9905cee 100644
 --- a/sound/core/seq/seq_compat.c
 +++ b/sound/core/seq/seq_compat.c
-@@ -59,7 +59,7 @@ static int snd_seq_call_port_info_ioctl(struct snd_seq_client *client, unsigned
+@@ -60,7 +60,7 @@ static int snd_seq_call_port_info_ioctl(struct snd_seq_client *client, unsigned
  	data->kernel = NULL;
  
  	fs = snd_enter_user();
@@ -131566,21 +130943,6 @@ index 8010766..4bd361f 100644
  					err = -EFAULT;
  					goto __error;
  				}
-diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
-index 7dfd0f4..0bec02e 100644
---- a/sound/core/seq/seq_queue.c
-+++ b/sound/core/seq/seq_queue.c
-@@ -142,8 +142,10 @@ static struct snd_seq_queue *queue_new(int owner, int locked)
- static void queue_delete(struct snd_seq_queue *q)
- {
- 	/* stop and release the timer */
-+	mutex_lock(&q->timer_mutex);
- 	snd_seq_timer_stop(q->timer);
- 	snd_seq_timer_close(q);
-+	mutex_unlock(&q->timer_mutex);
- 	/* wait until access free */
- 	snd_use_lock_sync(&q->use_lock);
- 	/* release resources... */
 diff --git a/sound/core/sound.c b/sound/core/sound.c
 index 175f9e4..3518d31 100644
 --- a/sound/core/sound.c
@@ -131594,171 +130956,6 @@ index 175f9e4..3518d31 100644
  }
  
  #endif	/* modular kernel */
-diff --git a/sound/core/timer.c b/sound/core/timer.c
-index 31f40f0..4e8d7bf 100644
---- a/sound/core/timer.c
-+++ b/sound/core/timer.c
-@@ -73,7 +73,7 @@ struct snd_timer_user {
- 	struct timespec tstamp;		/* trigger tstamp */
- 	wait_queue_head_t qchange_sleep;
- 	struct fasync_struct *fasync;
--	struct mutex tread_sem;
-+	struct mutex ioctl_lock;
- };
- 
- /* list of timers */
-@@ -215,11 +215,13 @@ static void snd_timer_check_master(struct snd_timer_instance *master)
- 		    slave->slave_id == master->slave_id) {
- 			list_move_tail(&slave->open_list, &master->slave_list_head);
- 			spin_lock_irq(&slave_active_lock);
-+			spin_lock(&master->timer->lock);
- 			slave->master = master;
- 			slave->timer = master->timer;
- 			if (slave->flags & SNDRV_TIMER_IFLG_RUNNING)
- 				list_add_tail(&slave->active_list,
- 					      &master->slave_active_head);
-+			spin_unlock(&master->timer->lock);
- 			spin_unlock_irq(&slave_active_lock);
- 		}
- 	}
-@@ -346,15 +348,18 @@ int snd_timer_close(struct snd_timer_instance *timeri)
- 		    timer->hw.close)
- 			timer->hw.close(timer);
- 		/* remove slave links */
-+		spin_lock_irq(&slave_active_lock);
-+		spin_lock(&timer->lock);
- 		list_for_each_entry_safe(slave, tmp, &timeri->slave_list_head,
- 					 open_list) {
--			spin_lock_irq(&slave_active_lock);
--			_snd_timer_stop(slave, 1, SNDRV_TIMER_EVENT_RESOLUTION);
- 			list_move_tail(&slave->open_list, &snd_timer_slave_list);
- 			slave->master = NULL;
- 			slave->timer = NULL;
--			spin_unlock_irq(&slave_active_lock);
-+			list_del_init(&slave->ack_list);
-+			list_del_init(&slave->active_list);
- 		}
-+		spin_unlock(&timer->lock);
-+		spin_unlock_irq(&slave_active_lock);
- 		mutex_unlock(&register_mutex);
- 	}
-  out:
-@@ -441,9 +446,12 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri)
- 
- 	spin_lock_irqsave(&slave_active_lock, flags);
- 	timeri->flags |= SNDRV_TIMER_IFLG_RUNNING;
--	if (timeri->master)
-+	if (timeri->master && timeri->timer) {
-+		spin_lock(&timeri->timer->lock);
- 		list_add_tail(&timeri->active_list,
- 			      &timeri->master->slave_active_head);
-+		spin_unlock(&timeri->timer->lock);
-+	}
- 	spin_unlock_irqrestore(&slave_active_lock, flags);
- 	return 1; /* delayed start */
- }
-@@ -489,6 +497,8 @@ static int _snd_timer_stop(struct snd_timer_instance * timeri,
- 		if (!keep_flag) {
- 			spin_lock_irqsave(&slave_active_lock, flags);
- 			timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
-+			list_del_init(&timeri->ack_list);
-+			list_del_init(&timeri->active_list);
- 			spin_unlock_irqrestore(&slave_active_lock, flags);
- 		}
- 		goto __end;
-@@ -694,7 +704,7 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
- 		} else {
- 			ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
- 			if (--timer->running)
--				list_del(&ti->active_list);
-+				list_del_init(&ti->active_list);
- 		}
- 		if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) ||
- 		    (ti->flags & SNDRV_TIMER_IFLG_FAST))
-@@ -1253,7 +1263,7 @@ static int snd_timer_user_open(struct inode *inode, struct file *file)
- 		return -ENOMEM;
- 	spin_lock_init(&tu->qlock);
- 	init_waitqueue_head(&tu->qchange_sleep);
--	mutex_init(&tu->tread_sem);
-+	mutex_init(&tu->ioctl_lock);
- 	tu->ticks = 1;
- 	tu->queue_size = 128;
- 	tu->queue = kmalloc(tu->queue_size * sizeof(struct snd_timer_read),
-@@ -1273,8 +1283,10 @@ static int snd_timer_user_release(struct inode *inode, struct file *file)
- 	if (file->private_data) {
- 		tu = file->private_data;
- 		file->private_data = NULL;
-+		mutex_lock(&tu->ioctl_lock);
- 		if (tu->timeri)
- 			snd_timer_close(tu->timeri);
-+		mutex_unlock(&tu->ioctl_lock);
- 		kfree(tu->queue);
- 		kfree(tu->tqueue);
- 		kfree(tu);
-@@ -1512,7 +1524,6 @@ static int snd_timer_user_tselect(struct file *file,
- 	int err = 0;
- 
- 	tu = file->private_data;
--	mutex_lock(&tu->tread_sem);
- 	if (tu->timeri) {
- 		snd_timer_close(tu->timeri);
- 		tu->timeri = NULL;
-@@ -1556,7 +1567,6 @@ static int snd_timer_user_tselect(struct file *file,
- 	}
- 
-       __err:
--      	mutex_unlock(&tu->tread_sem);
- 	return err;
- }
- 
-@@ -1769,7 +1779,7 @@ enum {
- 	SNDRV_TIMER_IOCTL_PAUSE_OLD = _IO('T', 0x23),
- };
- 
--static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
-+static long __snd_timer_user_ioctl(struct file *file, unsigned int cmd,
- 				 unsigned long arg)
- {
- 	struct snd_timer_user *tu;
-@@ -1786,17 +1796,11 @@ static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
- 	{
- 		int xarg;
- 
--		mutex_lock(&tu->tread_sem);
--		if (tu->timeri)	{	/* too late */
--			mutex_unlock(&tu->tread_sem);
-+		if (tu->timeri)	/* too late */
- 			return -EBUSY;
--		}
--		if (get_user(xarg, p)) {
--			mutex_unlock(&tu->tread_sem);
-+		if (get_user(xarg, p))
- 			return -EFAULT;
--		}
- 		tu->tread = xarg ? 1 : 0;
--		mutex_unlock(&tu->tread_sem);
- 		return 0;
- 	}
- 	case SNDRV_TIMER_IOCTL_GINFO:
-@@ -1829,6 +1833,18 @@ static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
- 	return -ENOTTY;
- }
- 
-+static long snd_timer_user_ioctl(struct file *file, unsigned int cmd,
-+				 unsigned long arg)
-+{
-+	struct snd_timer_user *tu = file->private_data;
-+	long ret;
-+
-+	mutex_lock(&tu->ioctl_lock);
-+	ret = __snd_timer_user_ioctl(file, cmd, arg);
-+	mutex_unlock(&tu->ioctl_lock);
-+	return ret;
-+}
-+
- static int snd_timer_user_fasync(int fd, struct file * file, int on)
- {
- 	struct snd_timer_user *tu;
 diff --git a/sound/drivers/mts64.c b/sound/drivers/mts64.c
 index 2a008a9..a1efb3f 100644
 --- a/sound/drivers/mts64.c
diff --git a/4.3.4/4425_grsec_remove_EI_PAX.patch b/4.3.5/4425_grsec_remove_EI_PAX.patch
index 2a1aa6c..2a1aa6c 100644
--- a/4.3.4/4425_grsec_remove_EI_PAX.patch
+++ b/4.3.5/4425_grsec_remove_EI_PAX.patch
diff --git a/4.3.4/4427_force_XATTR_PAX_tmpfs.patch b/4.3.5/4427_force_XATTR_PAX_tmpfs.patch
index d03130d..d03130d 100644
--- a/4.3.4/4427_force_XATTR_PAX_tmpfs.patch
+++ b/4.3.5/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/4.3.4/4430_grsec-remove-localversion-grsec.patch b/4.3.5/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/4.3.4/4430_grsec-remove-localversion-grsec.patch
+++ b/4.3.5/4430_grsec-remove-localversion-grsec.patch
diff --git a/4.3.4/4435_grsec-mute-warnings.patch b/4.3.5/4435_grsec-mute-warnings.patch
index b7564e4..b7564e4 100644
--- a/4.3.4/4435_grsec-mute-warnings.patch
+++ b/4.3.5/4435_grsec-mute-warnings.patch
diff --git a/4.3.4/4440_grsec-remove-protected-paths.patch b/4.3.5/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/4.3.4/4440_grsec-remove-protected-paths.patch
+++ b/4.3.5/4440_grsec-remove-protected-paths.patch
diff --git a/4.3.4/4450_grsec-kconfig-default-gids.patch b/4.3.5/4450_grsec-kconfig-default-gids.patch
index c56ca90..c56ca90 100644
--- a/4.3.4/4450_grsec-kconfig-default-gids.patch
+++ b/4.3.5/4450_grsec-kconfig-default-gids.patch
diff --git a/4.3.4/4465_selinux-avc_audit-log-curr_ip.patch b/4.3.5/4465_selinux-avc_audit-log-curr_ip.patch
index d2e466f..d2e466f 100644
--- a/4.3.4/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/4.3.5/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/4.3.4/4470_disable-compat_vdso.patch b/4.3.5/4470_disable-compat_vdso.patch
index 8fd85dc..8fd85dc 100644
--- a/4.3.4/4470_disable-compat_vdso.patch
+++ b/4.3.5/4470_disable-compat_vdso.patch
diff --git a/4.3.4/4475_emutramp_default_on.patch b/4.3.5/4475_emutramp_default_on.patch
index afd6019..afd6019 100644
--- a/4.3.4/4475_emutramp_default_on.patch
+++ b/4.3.5/4475_emutramp_default_on.patch