[gentoo-commits] proj/hardened-patchset:master commit in: 3.14.39/, 3.19.6/, 3.19.5/, 3.14.40/

[Anthony G. Basile]

commit:     dedbb02500624b2c5ddd456afd9fd9b6441a10eb
Author:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Thu Apr 30 18:00:49 2015 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Thu Apr 30 18:00:49 2015 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-patchset.git/commit/?id=dedbb025

Grsec/PaX: 3.1-{3.14.40,3.19.6}-201504290821

 {3.14.39 => 3.14.40}/0000_README                   |    6 +-
 3.14.40/1039_linux-3.14.40.patch                   | 2462 ++++++++++++++++++++
 .../4420_grsecurity-3.1-3.14.40-201504290821.patch |  336 ++-
 {3.19.5 => 3.14.40}/4425_grsec_remove_EI_PAX.patch |    0
 .../4427_force_XATTR_PAX_tmpfs.patch               |    0
 .../4430_grsec-remove-localversion-grsec.patch     |    0
 .../4435_grsec-mute-warnings.patch                 |    0
 .../4440_grsec-remove-protected-paths.patch        |    0
 .../4450_grsec-kconfig-default-gids.patch          |    0
 .../4465_selinux-avc_audit-log-curr_ip.patch       |    0
 .../4470_disable-compat_vdso.patch                 |    0
 {3.19.5 => 3.14.40}/4475_emutramp_default_on.patch |    0
 {3.19.5 => 3.19.6}/0000_README                     |    6 +-
 3.19.6/1005_linux-3.19.6.patch                     | 1674 +++++++++++++
 .../4420_grsecurity-3.1-3.19.6-201504290821.patch  |  303 +--
 {3.14.39 => 3.19.6}/4425_grsec_remove_EI_PAX.patch |    0
 .../4427_force_XATTR_PAX_tmpfs.patch               |    0
 .../4430_grsec-remove-localversion-grsec.patch     |    0
 {3.19.5 => 3.19.6}/4435_grsec-mute-warnings.patch  |    0
 .../4440_grsec-remove-protected-paths.patch        |    0
 .../4450_grsec-kconfig-default-gids.patch          |    0
 .../4465_selinux-avc_audit-log-curr_ip.patch       |    0
 {3.19.5 => 3.19.6}/4470_disable-compat_vdso.patch  |    0
 {3.14.39 => 3.19.6}/4475_emutramp_default_on.patch |    0
 24 files changed, 4363 insertions(+), 424 deletions(-)

diff --git a/3.14.39/0000_README b/3.14.40/0000_README
similarity index 92%
rename from 3.14.39/0000_README
rename to 3.14.40/0000_README
index 7ed8450..79dc6c4 100644
--- a/3.14.39/0000_README
+++ b/3.14.40/0000_README
@@ -2,7 +2,11 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.1-3.14.39-201504270826.patch
+Patch:	1039_linux-3.14.40.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.14.40
+
+Patch:	4420_grsecurity-3.1-3.14.40-201504290821.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/3.14.40/1039_linux-3.14.40.patch b/3.14.40/1039_linux-3.14.40.patch
new file mode 100644
index 0000000..6afa4bd
--- /dev/null
+++ b/3.14.40/1039_linux-3.14.40.patch
@@ -0,0 +1,2462 @@
+diff --git a/Makefile b/Makefile
+index b40845e..070e0eb 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 14
+-SUBLEVEL = 39
++SUBLEVEL = 40
+ EXTRAVERSION =
+ NAME = Remembering Coco
+ 
+diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
+index 98838a0..9d0ac09 100644
+--- a/arch/alpha/mm/fault.c
++++ b/arch/alpha/mm/fault.c
+@@ -156,6 +156,8 @@ retry:
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto do_sigbus;
+ 		BUG();
+diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
+index 9c69552..01e18b5 100644
+--- a/arch/arc/mm/fault.c
++++ b/arch/arc/mm/fault.c
+@@ -162,6 +162,8 @@ good_area:
+ 	/* TBD: switch to pagefault_out_of_memory() */
+ 	if (fault & VM_FAULT_OOM)
+ 		goto out_of_memory;
++	else if (fault & VM_FAULT_SIGSEGV)
++		goto bad_area;
+ 	else if (fault & VM_FAULT_SIGBUS)
+ 		goto do_sigbus;
+ 
+diff --git a/arch/arm/include/asm/pgtable-3level-hwdef.h b/arch/arm/include/asm/pgtable-3level-hwdef.h
+index 626989f..9fd61c7 100644
+--- a/arch/arm/include/asm/pgtable-3level-hwdef.h
++++ b/arch/arm/include/asm/pgtable-3level-hwdef.h
+@@ -43,7 +43,7 @@
+ #define PMD_SECT_BUFFERABLE	(_AT(pmdval_t, 1) << 2)
+ #define PMD_SECT_CACHEABLE	(_AT(pmdval_t, 1) << 3)
+ #define PMD_SECT_USER		(_AT(pmdval_t, 1) << 6)		/* AP[1] */
+-#define PMD_SECT_RDONLY		(_AT(pmdval_t, 1) << 7)		/* AP[2] */
++#define PMD_SECT_AP2		(_AT(pmdval_t, 1) << 7)		/* read only */
+ #define PMD_SECT_S		(_AT(pmdval_t, 3) << 8)
+ #define PMD_SECT_AF		(_AT(pmdval_t, 1) << 10)
+ #define PMD_SECT_nG		(_AT(pmdval_t, 1) << 11)
+@@ -72,6 +72,7 @@
+ #define PTE_TABLE_BIT		(_AT(pteval_t, 1) << 1)
+ #define PTE_BUFFERABLE		(_AT(pteval_t, 1) << 2)		/* AttrIndx[0] */
+ #define PTE_CACHEABLE		(_AT(pteval_t, 1) << 3)		/* AttrIndx[1] */
++#define PTE_AP2			(_AT(pteval_t, 1) << 7)		/* AP[2] */
+ #define PTE_EXT_SHARED		(_AT(pteval_t, 3) << 8)		/* SH[1:0], inner shareable */
+ #define PTE_EXT_AF		(_AT(pteval_t, 1) << 10)	/* Access Flag */
+ #define PTE_EXT_NG		(_AT(pteval_t, 1) << 11)	/* nG */
+diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h
+index 85c60ad..06e0bc0 100644
+--- a/arch/arm/include/asm/pgtable-3level.h
++++ b/arch/arm/include/asm/pgtable-3level.h
+@@ -79,18 +79,19 @@
+ #define L_PTE_PRESENT		(_AT(pteval_t, 3) << 0)		/* Present */
+ #define L_PTE_FILE		(_AT(pteval_t, 1) << 2)		/* only when !PRESENT */
+ #define L_PTE_USER		(_AT(pteval_t, 1) << 6)		/* AP[1] */
+-#define L_PTE_RDONLY		(_AT(pteval_t, 1) << 7)		/* AP[2] */
+ #define L_PTE_SHARED		(_AT(pteval_t, 3) << 8)		/* SH[1:0], inner shareable */
+ #define L_PTE_YOUNG		(_AT(pteval_t, 1) << 10)	/* AF */
+ #define L_PTE_XN		(_AT(pteval_t, 1) << 54)	/* XN */
+-#define L_PTE_DIRTY		(_AT(pteval_t, 1) << 55)	/* unused */
+-#define L_PTE_SPECIAL		(_AT(pteval_t, 1) << 56)	/* unused */
++#define L_PTE_DIRTY		(_AT(pteval_t, 1) << 55)
++#define L_PTE_SPECIAL		(_AT(pteval_t, 1) << 56)
+ #define L_PTE_NONE		(_AT(pteval_t, 1) << 57)	/* PROT_NONE */
++#define L_PTE_RDONLY		(_AT(pteval_t, 1) << 58)	/* READ ONLY */
+ 
+-#define PMD_SECT_VALID		(_AT(pmdval_t, 1) << 0)
+-#define PMD_SECT_DIRTY		(_AT(pmdval_t, 1) << 55)
+-#define PMD_SECT_SPLITTING	(_AT(pmdval_t, 1) << 56)
+-#define PMD_SECT_NONE		(_AT(pmdval_t, 1) << 57)
++#define L_PMD_SECT_VALID	(_AT(pmdval_t, 1) << 0)
++#define L_PMD_SECT_DIRTY	(_AT(pmdval_t, 1) << 55)
++#define L_PMD_SECT_SPLITTING	(_AT(pmdval_t, 1) << 56)
++#define L_PMD_SECT_NONE		(_AT(pmdval_t, 1) << 57)
++#define L_PMD_SECT_RDONLY	(_AT(pteval_t, 1) << 58)
+ 
+ /*
+  * To be used in assembly code with the upper page attributes.
+@@ -207,27 +208,32 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr)
+ #define pte_huge(pte)		(pte_val(pte) && !(pte_val(pte) & PTE_TABLE_BIT))
+ #define pte_mkhuge(pte)		(__pte(pte_val(pte) & ~PTE_TABLE_BIT))
+ 
+-#define pmd_young(pmd)		(pmd_val(pmd) & PMD_SECT_AF)
++#define pmd_isset(pmd, val)	((u32)(val) == (val) ? pmd_val(pmd) & (val) \
++						: !!(pmd_val(pmd) & (val)))
++#define pmd_isclear(pmd, val)	(!(pmd_val(pmd) & (val)))
++
++#define pmd_young(pmd)		(pmd_isset((pmd), PMD_SECT_AF))
+ 
+ #define __HAVE_ARCH_PMD_WRITE
+-#define pmd_write(pmd)		(!(pmd_val(pmd) & PMD_SECT_RDONLY))
++#define pmd_write(pmd)		(pmd_isclear((pmd), L_PMD_SECT_RDONLY))
++#define pmd_dirty(pmd)		(pmd_isset((pmd), L_PMD_SECT_DIRTY))
+ 
+ #define pmd_hugewillfault(pmd)	(!pmd_young(pmd) || !pmd_write(pmd))
+ #define pmd_thp_or_huge(pmd)	(pmd_huge(pmd) || pmd_trans_huge(pmd))
+ 
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+-#define pmd_trans_huge(pmd)	(pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT))
+-#define pmd_trans_splitting(pmd) (pmd_val(pmd) & PMD_SECT_SPLITTING)
++#define pmd_trans_huge(pmd)	(pmd_val(pmd) && !pmd_table(pmd))
++#define pmd_trans_splitting(pmd) (pmd_isset((pmd), L_PMD_SECT_SPLITTING))
+ #endif
+ 
+ #define PMD_BIT_FUNC(fn,op) \
+ static inline pmd_t pmd_##fn(pmd_t pmd) { pmd_val(pmd) op; return pmd; }
+ 
+-PMD_BIT_FUNC(wrprotect,	|= PMD_SECT_RDONLY);
++PMD_BIT_FUNC(wrprotect,	|= L_PMD_SECT_RDONLY);
+ PMD_BIT_FUNC(mkold,	&= ~PMD_SECT_AF);
+-PMD_BIT_FUNC(mksplitting, |= PMD_SECT_SPLITTING);
+-PMD_BIT_FUNC(mkwrite,   &= ~PMD_SECT_RDONLY);
+-PMD_BIT_FUNC(mkdirty,   |= PMD_SECT_DIRTY);
++PMD_BIT_FUNC(mksplitting, |= L_PMD_SECT_SPLITTING);
++PMD_BIT_FUNC(mkwrite,   &= ~L_PMD_SECT_RDONLY);
++PMD_BIT_FUNC(mkdirty,   |= L_PMD_SECT_DIRTY);
+ PMD_BIT_FUNC(mkyoung,   |= PMD_SECT_AF);
+ 
+ #define pmd_mkhuge(pmd)		(__pmd(pmd_val(pmd) & ~PMD_TABLE_BIT))
+@@ -241,8 +247,8 @@ PMD_BIT_FUNC(mkyoung,   |= PMD_SECT_AF);
+ 
+ static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
+ {
+-	const pmdval_t mask = PMD_SECT_USER | PMD_SECT_XN | PMD_SECT_RDONLY |
+-				PMD_SECT_VALID | PMD_SECT_NONE;
++	const pmdval_t mask = PMD_SECT_USER | PMD_SECT_XN | L_PMD_SECT_RDONLY |
++				L_PMD_SECT_VALID | L_PMD_SECT_NONE;
+ 	pmd_val(pmd) = (pmd_val(pmd) & ~mask) | (pgprot_val(newprot) & mask);
+ 	return pmd;
+ }
+@@ -253,8 +259,13 @@ static inline void set_pmd_at(struct mm_struct *mm, unsigned long addr,
+ 	BUG_ON(addr >= TASK_SIZE);
+ 
+ 	/* create a faulting entry if PROT_NONE protected */
+-	if (pmd_val(pmd) & PMD_SECT_NONE)
+-		pmd_val(pmd) &= ~PMD_SECT_VALID;
++	if (pmd_val(pmd) & L_PMD_SECT_NONE)
++		pmd_val(pmd) &= ~L_PMD_SECT_VALID;
++
++	if (pmd_write(pmd) && pmd_dirty(pmd))
++		pmd_val(pmd) &= ~PMD_SECT_AP2;
++	else
++		pmd_val(pmd) |= PMD_SECT_AP2;
+ 
+ 	*pmdp = __pmd(pmd_val(pmd) | PMD_SECT_nG);
+ 	flush_pmd_entry(pmdp);
+diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
+index 7d59b52..89dba13 100644
+--- a/arch/arm/include/asm/pgtable.h
++++ b/arch/arm/include/asm/pgtable.h
+@@ -214,12 +214,16 @@ static inline pte_t *pmd_page_vaddr(pmd_t pmd)
+ 
+ #define pte_clear(mm,addr,ptep)	set_pte_ext(ptep, __pte(0), 0)
+ 
++#define pte_isset(pte, val)	((u32)(val) == (val) ? pte_val(pte) & (val) \
++						: !!(pte_val(pte) & (val)))
++#define pte_isclear(pte, val)	(!(pte_val(pte) & (val)))
++
+ #define pte_none(pte)		(!pte_val(pte))
+-#define pte_present(pte)	(pte_val(pte) & L_PTE_PRESENT)
+-#define pte_write(pte)		(!(pte_val(pte) & L_PTE_RDONLY))
+-#define pte_dirty(pte)		(pte_val(pte) & L_PTE_DIRTY)
+-#define pte_young(pte)		(pte_val(pte) & L_PTE_YOUNG)
+-#define pte_exec(pte)		(!(pte_val(pte) & L_PTE_XN))
++#define pte_present(pte)	(pte_isset((pte), L_PTE_PRESENT))
++#define pte_write(pte)		(pte_isclear((pte), L_PTE_RDONLY))
++#define pte_dirty(pte)		(pte_isset((pte), L_PTE_DIRTY))
++#define pte_young(pte)		(pte_isset((pte), L_PTE_YOUNG))
++#define pte_exec(pte)		(pte_isclear((pte), L_PTE_XN))
+ #define pte_special(pte)	(0)
+ 
+ #define pte_present_user(pte)  (pte_present(pte) && (pte_val(pte) & L_PTE_USER))
+diff --git a/arch/arm/mm/proc-v7-3level.S b/arch/arm/mm/proc-v7-3level.S
+index 22e3ad6..eb81123 100644
+--- a/arch/arm/mm/proc-v7-3level.S
++++ b/arch/arm/mm/proc-v7-3level.S
+@@ -86,8 +86,13 @@ ENTRY(cpu_v7_set_pte_ext)
+ 	tst	rh, #1 << (57 - 32)		@ L_PTE_NONE
+ 	bicne	rl, #L_PTE_VALID
+ 	bne	1f
+-	tst	rh, #1 << (55 - 32)		@ L_PTE_DIRTY
+-	orreq	rl, #L_PTE_RDONLY
++
++	eor	ip, rh, #1 << (55 - 32)	@ toggle L_PTE_DIRTY in temp reg to
++					@ test for !L_PTE_DIRTY || L_PTE_RDONLY
++	tst	ip, #1 << (55 - 32) | 1 << (58 - 32)
++	orrne	rl, #PTE_AP2
++	biceq	rl, #PTE_AP2
++
+ 1:	strd	r2, r3, [r0]
+ 	ALT_SMP(W(nop))
+ 	ALT_UP (mcr	p15, 0, r0, c7, c10, 1)		@ flush_pte
+diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
+index 0eca933..d223a8b 100644
+--- a/arch/avr32/mm/fault.c
++++ b/arch/avr32/mm/fault.c
+@@ -142,6 +142,8 @@ good_area:
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto do_sigbus;
+ 		BUG();
+diff --git a/arch/cris/mm/fault.c b/arch/cris/mm/fault.c
+index 1790f22..2686a7a 100644
+--- a/arch/cris/mm/fault.c
++++ b/arch/cris/mm/fault.c
+@@ -176,6 +176,8 @@ retry:
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto do_sigbus;
+ 		BUG();
+diff --git a/arch/frv/mm/fault.c b/arch/frv/mm/fault.c
+index 9a66372..ec4917d 100644
+--- a/arch/frv/mm/fault.c
++++ b/arch/frv/mm/fault.c
+@@ -168,6 +168,8 @@ asmlinkage void do_page_fault(int datammu, unsigned long esr0, unsigned long ear
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto do_sigbus;
+ 		BUG();
+diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
+index 7225dad..ba5ba7a 100644
+--- a/arch/ia64/mm/fault.c
++++ b/arch/ia64/mm/fault.c
+@@ -172,6 +172,8 @@ retry:
+ 		 */
+ 		if (fault & VM_FAULT_OOM) {
+ 			goto out_of_memory;
++		} else if (fault & VM_FAULT_SIGSEGV) {
++			goto bad_area;
+ 		} else if (fault & VM_FAULT_SIGBUS) {
+ 			signal = SIGBUS;
+ 			goto bad_area;
+diff --git a/arch/m32r/mm/fault.c b/arch/m32r/mm/fault.c
+index e9c6a80..e3d4d48901 100644
+--- a/arch/m32r/mm/fault.c
++++ b/arch/m32r/mm/fault.c
+@@ -200,6 +200,8 @@ good_area:
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto do_sigbus;
+ 		BUG();
+diff --git a/arch/m68k/mm/fault.c b/arch/m68k/mm/fault.c
+index 2bd7487..b2f04ae 100644
+--- a/arch/m68k/mm/fault.c
++++ b/arch/m68k/mm/fault.c
+@@ -145,6 +145,8 @@ good_area:
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto map_err;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto bus_err;
+ 		BUG();
+diff --git a/arch/metag/mm/fault.c b/arch/metag/mm/fault.c
+index 332680e..2de5dc6 100644
+--- a/arch/metag/mm/fault.c
++++ b/arch/metag/mm/fault.c
+@@ -141,6 +141,8 @@ good_area:
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto do_sigbus;
+ 		BUG();
+diff --git a/arch/microblaze/mm/fault.c b/arch/microblaze/mm/fault.c
+index fa4cf52..d46a5eb 100644
+--- a/arch/microblaze/mm/fault.c
++++ b/arch/microblaze/mm/fault.c
+@@ -224,6 +224,8 @@ good_area:
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto do_sigbus;
+ 		BUG();
+diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
+index becc42b..70ab5d6 100644
+--- a/arch/mips/mm/fault.c
++++ b/arch/mips/mm/fault.c
+@@ -158,6 +158,8 @@ good_area:
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto do_sigbus;
+ 		BUG();
+diff --git a/arch/mn10300/mm/fault.c b/arch/mn10300/mm/fault.c
+index 3516cbd..0c2cc5d 100644
+--- a/arch/mn10300/mm/fault.c
++++ b/arch/mn10300/mm/fault.c
+@@ -262,6 +262,8 @@ good_area:
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto do_sigbus;
+ 		BUG();
+diff --git a/arch/openrisc/mm/fault.c b/arch/openrisc/mm/fault.c
+index 0703acf..230ac20 100644
+--- a/arch/openrisc/mm/fault.c
++++ b/arch/openrisc/mm/fault.c
+@@ -171,6 +171,8 @@ good_area:
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto do_sigbus;
+ 		BUG();
+diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
+index d72197f..d27e388 100644
+--- a/arch/parisc/mm/fault.c
++++ b/arch/parisc/mm/fault.c
+@@ -256,6 +256,8 @@ good_area:
+ 		 */
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto bad_area;
+ 		BUG();
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index 51ab9e7..010fabf 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -432,6 +432,8 @@ good_area:
+ 	 */
+ 	fault = handle_mm_fault(mm, vma, address, flags);
+ 	if (unlikely(fault & (VM_FAULT_RETRY|VM_FAULT_ERROR))) {
++		if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		rc = mm_fault_error(regs, address, fault);
+ 		if (rc >= MM_FAULT_RETURN)
+ 			goto bail;
+diff --git a/arch/powerpc/platforms/cell/spu_fault.c b/arch/powerpc/platforms/cell/spu_fault.c
+index 641e727..62f3e4e 100644
+--- a/arch/powerpc/platforms/cell/spu_fault.c
++++ b/arch/powerpc/platforms/cell/spu_fault.c
+@@ -75,7 +75,7 @@ int spu_handle_mm_fault(struct mm_struct *mm, unsigned long ea,
+ 		if (*flt & VM_FAULT_OOM) {
+ 			ret = -ENOMEM;
+ 			goto out_unlock;
+-		} else if (*flt & VM_FAULT_SIGBUS) {
++		} else if (*flt & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) {
+ 			ret = -EFAULT;
+ 			goto out_unlock;
+ 		}
+diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
+index 87ba7cf..65d633f 100644
+--- a/arch/powerpc/platforms/cell/spufs/inode.c
++++ b/arch/powerpc/platforms/cell/spufs/inode.c
+@@ -164,7 +164,7 @@ static void spufs_prune_dir(struct dentry *dir)
+ 	struct dentry *dentry, *tmp;
+ 
+ 	mutex_lock(&dir->d_inode->i_mutex);
+-	list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_u.d_child) {
++	list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_child) {
+ 		spin_lock(&dentry->d_lock);
+ 		if (!(d_unhashed(dentry)) && dentry->d_inode) {
+ 			dget_dlock(dentry);
+diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
+index d95265b2..8e95432 100644
+--- a/arch/s390/mm/fault.c
++++ b/arch/s390/mm/fault.c
+@@ -239,6 +239,12 @@ static noinline void do_fault_error(struct pt_regs *regs, int fault)
+ 				do_no_context(regs);
+ 			else
+ 				pagefault_out_of_memory();
++		} else if (fault & VM_FAULT_SIGSEGV) {
++			/* Kernel mode? Handle exceptions or die */
++			if (!user_mode(regs))
++				do_no_context(regs);
++			else
++				do_sigsegv(regs, SEGV_MAPERR);
+ 		} else if (fault & VM_FAULT_SIGBUS) {
+ 			/* Kernel mode? Handle exceptions or die */
+ 			if (!user_mode(regs))
+diff --git a/arch/score/mm/fault.c b/arch/score/mm/fault.c
+index 52238983..6860beb 100644
+--- a/arch/score/mm/fault.c
++++ b/arch/score/mm/fault.c
+@@ -114,6 +114,8 @@ good_area:
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto do_sigbus;
+ 		BUG();
+diff --git a/arch/sh/mm/fault.c b/arch/sh/mm/fault.c
+index 541dc61..a58fec9 100644
+--- a/arch/sh/mm/fault.c
++++ b/arch/sh/mm/fault.c
+@@ -353,6 +353,8 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
+ 	} else {
+ 		if (fault & VM_FAULT_SIGBUS)
+ 			do_sigbus(regs, error_code, address);
++		else if (fault & VM_FAULT_SIGSEGV)
++			bad_area(regs, error_code, address);
+ 		else
+ 			BUG();
+ 	}
+diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
+index 59dbd46..163c787 100644
+--- a/arch/sparc/mm/fault_32.c
++++ b/arch/sparc/mm/fault_32.c
+@@ -252,6 +252,8 @@ good_area:
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto do_sigbus;
+ 		BUG();
+diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
+index 45a413e..0d6de79 100644
+--- a/arch/sparc/mm/fault_64.c
++++ b/arch/sparc/mm/fault_64.c
+@@ -448,6 +448,8 @@ good_area:
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto do_sigbus;
+ 		BUG();
+diff --git a/arch/tile/mm/fault.c b/arch/tile/mm/fault.c
+index 6c05712..c6d2a76 100644
+--- a/arch/tile/mm/fault.c
++++ b/arch/tile/mm/fault.c
+@@ -444,6 +444,8 @@ good_area:
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto do_sigbus;
+ 		BUG();
+diff --git a/arch/um/kernel/trap.c b/arch/um/kernel/trap.c
+index 974b874..53b8320 100644
+--- a/arch/um/kernel/trap.c
++++ b/arch/um/kernel/trap.c
+@@ -80,6 +80,8 @@ good_area:
+ 		if (unlikely(fault & VM_FAULT_ERROR)) {
+ 			if (fault & VM_FAULT_OOM) {
+ 				goto out_of_memory;
++			} else if (fault & VM_FAULT_SIGSEGV) {
++				goto out;
+ 			} else if (fault & VM_FAULT_SIGBUS) {
+ 				err = -EACCES;
+ 				goto out;
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 09651d4..cf1eeea 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -2258,7 +2258,7 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
+ 	 * Not recognized on AMD in compat mode (but is recognized in legacy
+ 	 * mode).
+ 	 */
+-	if ((ctxt->mode == X86EMUL_MODE_PROT32) && (efer & EFER_LMA)
++	if ((ctxt->mode != X86EMUL_MODE_PROT64) && (efer & EFER_LMA)
+ 	    && !vendor_intel(ctxt))
+ 		return emulate_ud(ctxt);
+ 
+@@ -2271,25 +2271,13 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
+ 	setup_syscalls_segments(ctxt, &cs, &ss);
+ 
+ 	ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data);
+-	switch (ctxt->mode) {
+-	case X86EMUL_MODE_PROT32:
+-		if ((msr_data & 0xfffc) == 0x0)
+-			return emulate_gp(ctxt, 0);
+-		break;
+-	case X86EMUL_MODE_PROT64:
+-		if (msr_data == 0x0)
+-			return emulate_gp(ctxt, 0);
+-		break;
+-	default:
+-		break;
+-	}
++	if ((msr_data & 0xfffc) == 0x0)
++		return emulate_gp(ctxt, 0);
+ 
+ 	ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
+-	cs_sel = (u16)msr_data;
+-	cs_sel &= ~SELECTOR_RPL_MASK;
++	cs_sel = (u16)msr_data & ~SELECTOR_RPL_MASK;
+ 	ss_sel = cs_sel + 8;
+-	ss_sel &= ~SELECTOR_RPL_MASK;
+-	if (ctxt->mode == X86EMUL_MODE_PROT64 || (efer & EFER_LMA)) {
++	if (efer & EFER_LMA) {
+ 		cs.d = 0;
+ 		cs.l = 1;
+ 	}
+@@ -2298,10 +2286,11 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
+ 	ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
+ 
+ 	ops->get_msr(ctxt, MSR_IA32_SYSENTER_EIP, &msr_data);
+-	ctxt->_eip = msr_data;
++	ctxt->_eip = (efer & EFER_LMA) ? msr_data : (u32)msr_data;
+ 
+ 	ops->get_msr(ctxt, MSR_IA32_SYSENTER_ESP, &msr_data);
+-	*reg_write(ctxt, VCPU_REGS_RSP) = msr_data;
++	*reg_write(ctxt, VCPU_REGS_RSP) = (efer & EFER_LMA) ? msr_data :
++							      (u32)msr_data;
+ 
+ 	return X86EMUL_CONTINUE;
+ }
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index a10c8c7..ebc551c 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -833,11 +833,8 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
+ 	  unsigned int fault)
+ {
+ 	struct task_struct *tsk = current;
+-	struct mm_struct *mm = tsk->mm;
+ 	int code = BUS_ADRERR;
+ 
+-	up_read(&mm->mmap_sem);
+-
+ 	/* Kernel mode? Handle exceptions or die: */
+ 	if (!(error_code & PF_USER)) {
+ 		no_context(regs, error_code, address, SIGBUS, BUS_ADRERR);
+@@ -868,7 +865,6 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
+ 	       unsigned long address, unsigned int fault)
+ {
+ 	if (fatal_signal_pending(current) && !(error_code & PF_USER)) {
+-		up_read(&current->mm->mmap_sem);
+ 		no_context(regs, error_code, address, 0, 0);
+ 		return;
+ 	}
+@@ -876,14 +872,11 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
+ 	if (fault & VM_FAULT_OOM) {
+ 		/* Kernel mode? Handle exceptions or die: */
+ 		if (!(error_code & PF_USER)) {
+-			up_read(&current->mm->mmap_sem);
+ 			no_context(regs, error_code, address,
+ 				   SIGSEGV, SEGV_MAPERR);
+ 			return;
+ 		}
+ 
+-		up_read(&current->mm->mmap_sem);
+-
+ 		/*
+ 		 * We ran out of memory, call the OOM killer, and return the
+ 		 * userspace (which will retry the fault, or kill us if we got
+@@ -894,6 +887,8 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
+ 		if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON|
+ 			     VM_FAULT_HWPOISON_LARGE))
+ 			do_sigbus(regs, error_code, address, fault);
++		else if (fault & VM_FAULT_SIGSEGV)
++			bad_area_nosemaphore(regs, error_code, address);
+ 		else
+ 			BUG();
+ 	}
+@@ -1216,6 +1211,7 @@ good_area:
+ 		return;
+ 
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
++		up_read(&mm->mmap_sem);
+ 		mm_fault_error(regs, error_code, address, fault);
+ 		return;
+ 	}
+diff --git a/arch/xtensa/mm/fault.c b/arch/xtensa/mm/fault.c
+index b57c4f9..9e3571a 100644
+--- a/arch/xtensa/mm/fault.c
++++ b/arch/xtensa/mm/fault.c
+@@ -117,6 +117,8 @@ good_area:
+ 	if (unlikely(fault & VM_FAULT_ERROR)) {
+ 		if (fault & VM_FAULT_OOM)
+ 			goto out_of_memory;
++		else if (fault & VM_FAULT_SIGSEGV)
++			goto bad_area;
+ 		else if (fault & VM_FAULT_SIGBUS)
+ 			goto do_sigbus;
+ 		BUG();
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index f667e37..5afe556 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -62,51 +62,59 @@ static const struct usb_device_id ath3k_table[] = {
+ 	{ USB_DEVICE(0x0CF3, 0x3000) },
+ 
+ 	/* Atheros AR3011 with sflash firmware*/
++	{ USB_DEVICE(0x0489, 0xE027) },
++	{ USB_DEVICE(0x0489, 0xE03D) },
++	{ USB_DEVICE(0x0930, 0x0215) },
+ 	{ USB_DEVICE(0x0CF3, 0x3002) },
+ 	{ USB_DEVICE(0x0CF3, 0xE019) },
+ 	{ USB_DEVICE(0x13d3, 0x3304) },
+-	{ USB_DEVICE(0x0930, 0x0215) },
+-	{ USB_DEVICE(0x0489, 0xE03D) },
+-	{ USB_DEVICE(0x0489, 0xE027) },
+ 
+ 	/* Atheros AR9285 Malbec with sflash firmware */
+ 	{ USB_DEVICE(0x03F0, 0x311D) },
+ 
+ 	/* Atheros AR3012 with sflash firmware*/
+-	{ USB_DEVICE(0x0CF3, 0x0036) },
+-	{ USB_DEVICE(0x0CF3, 0x3004) },
+-	{ USB_DEVICE(0x0CF3, 0x3008) },
+-	{ USB_DEVICE(0x0CF3, 0x311D) },
+-	{ USB_DEVICE(0x0CF3, 0x817a) },
+-	{ USB_DEVICE(0x13d3, 0x3375) },
++	{ USB_DEVICE(0x0489, 0xe04d) },
++	{ USB_DEVICE(0x0489, 0xe04e) },
++	{ USB_DEVICE(0x0489, 0xe057) },
++	{ USB_DEVICE(0x0489, 0xe056) },
++	{ USB_DEVICE(0x0489, 0xe05f) },
++	{ USB_DEVICE(0x0489, 0xe078) },
++	{ USB_DEVICE(0x04c5, 0x1330) },
+ 	{ USB_DEVICE(0x04CA, 0x3004) },
+ 	{ USB_DEVICE(0x04CA, 0x3005) },
+ 	{ USB_DEVICE(0x04CA, 0x3006) },
+ 	{ USB_DEVICE(0x04CA, 0x3007) },
+ 	{ USB_DEVICE(0x04CA, 0x3008) },
+ 	{ USB_DEVICE(0x04CA, 0x300b) },
+-	{ USB_DEVICE(0x13d3, 0x3362) },
+-	{ USB_DEVICE(0x0CF3, 0xE004) },
+-	{ USB_DEVICE(0x0CF3, 0xE005) },
++	{ USB_DEVICE(0x04CA, 0x3010) },
+ 	{ USB_DEVICE(0x0930, 0x0219) },
+ 	{ USB_DEVICE(0x0930, 0x0220) },
+-	{ USB_DEVICE(0x0489, 0xe057) },
+-	{ USB_DEVICE(0x13d3, 0x3393) },
+-	{ USB_DEVICE(0x0489, 0xe04e) },
+-	{ USB_DEVICE(0x0489, 0xe056) },
+-	{ USB_DEVICE(0x0489, 0xe04d) },
+-	{ USB_DEVICE(0x04c5, 0x1330) },
+-	{ USB_DEVICE(0x13d3, 0x3402) },
++	{ USB_DEVICE(0x0930, 0x0227) },
++	{ USB_DEVICE(0x0b05, 0x17d0) },
++	{ USB_DEVICE(0x0CF3, 0x0036) },
++	{ USB_DEVICE(0x0CF3, 0x3004) },
++	{ USB_DEVICE(0x0CF3, 0x3008) },
++	{ USB_DEVICE(0x0CF3, 0x311D) },
++	{ USB_DEVICE(0x0CF3, 0x311E) },
++	{ USB_DEVICE(0x0CF3, 0x311F) },
+ 	{ USB_DEVICE(0x0cf3, 0x3121) },
++	{ USB_DEVICE(0x0CF3, 0x817a) },
+ 	{ USB_DEVICE(0x0cf3, 0xe003) },
+-	{ USB_DEVICE(0x0489, 0xe05f) },
++	{ USB_DEVICE(0x0CF3, 0xE004) },
++	{ USB_DEVICE(0x0CF3, 0xE005) },
++	{ USB_DEVICE(0x13d3, 0x3362) },
++	{ USB_DEVICE(0x13d3, 0x3375) },
++	{ USB_DEVICE(0x13d3, 0x3393) },
++	{ USB_DEVICE(0x13d3, 0x3402) },
++	{ USB_DEVICE(0x13d3, 0x3408) },
++	{ USB_DEVICE(0x13d3, 0x3432) },
+ 
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xE02C) },
+ 
+ 	/* Atheros AR5BBU22 with sflash firmware */
+-	{ USB_DEVICE(0x0489, 0xE03C) },
+ 	{ USB_DEVICE(0x0489, 0xE036) },
++	{ USB_DEVICE(0x0489, 0xE03C) },
+ 
+ 	{ }	/* Terminating entry */
+ };
+@@ -119,37 +127,45 @@ MODULE_DEVICE_TABLE(usb, ath3k_table);
+ static const struct usb_device_id ath3k_blist_tbl[] = {
+ 
+ 	/* Atheros AR3012 with sflash firmware*/
+-	{ USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0x311E), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0x311F), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+ 
+ 	/* Atheros AR5BBU22 with sflash firmware */
+-	{ USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
+ 
+ 	{ }	/* Terminating entry */
+ };
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index e00c3f8..03b3317 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -49,6 +49,7 @@ static struct usb_driver btusb_driver;
+ #define BTUSB_WRONG_SCO_MTU	0x40
+ #define BTUSB_ATH3012		0x80
+ #define BTUSB_INTEL		0x100
++#define BTUSB_INTEL_BOOT	0x200
+ 
+ static const struct usb_device_id btusb_table[] = {
+ 	/* Generic Bluetooth USB device */
+@@ -101,21 +102,31 @@ static const struct usb_device_id btusb_table[] = {
+ 	{ USB_DEVICE(0x0c10, 0x0000) },
+ 
+ 	/* Broadcom BCM20702A0 */
++	{ USB_DEVICE(0x0489, 0xe042) },
++	{ USB_DEVICE(0x04ca, 0x2003) },
+ 	{ USB_DEVICE(0x0b05, 0x17b5) },
+ 	{ USB_DEVICE(0x0b05, 0x17cb) },
+-	{ USB_DEVICE(0x04ca, 0x2003) },
+-	{ USB_DEVICE(0x0489, 0xe042) },
+ 	{ USB_DEVICE(0x413c, 0x8197) },
+ 
+ 	/* Foxconn - Hon Hai */
+ 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },
+ 
+-	/*Broadcom devices with vendor specific id */
++	/* Broadcom devices with vendor specific id */
+ 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) },
+ 
++	/* ASUSTek Computer - Broadcom based */
++	{ USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01) },
++
+ 	/* Belkin F8065bf - Broadcom based */
+ 	{ USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
+ 
++	/* IMC Networks - Broadcom based */
++	{ USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) },
++
++	/* Intel Bluetooth USB Bootloader (RAM module) */
++	{ USB_DEVICE(0x8087, 0x0a5a),
++	  .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
++
+ 	{ }	/* Terminating entry */
+ };
+ 
+@@ -129,56 +140,64 @@ static const struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
+ 
+ 	/* Atheros 3011 with sflash firmware */
++	{ USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
++	{ USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
++	{ USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
+ 	{ USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
+ 	{ USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
+ 	{ USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
+-	{ USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
+-	{ USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
+-	{ USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
+ 
+ 	/* Atheros AR9285 Malbec with sflash firmware */
+ 	{ USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
+ 
+ 	/* Atheros 3012 with sflash firmware */
+-	{ USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
+-	{ USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+ 
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
+ 
+ 	/* Atheros AR5BBU12 with sflash firmware */
+-	{ USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
+ 
+ 	/* Broadcom BCM2035 */
+-	{ USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
+-	{ USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
+ 	{ USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
++	{ USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
++	{ USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
+ 
+ 	/* Broadcom BCM2045 */
+ 	{ USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
+@@ -1491,6 +1510,9 @@ static int btusb_probe(struct usb_interface *intf,
+ 	if (id->driver_info & BTUSB_INTEL)
+ 		hdev->setup = btusb_setup_intel;
+ 
++	if (id->driver_info & BTUSB_INTEL_BOOT)
++		set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
++
+ 	/* Interface numbers are hardcoded in the specification */
+ 	data->isoc = usb_ifnum_to_if(data->udev, 1);
+ 
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index 54e2abe..c611bcc 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -285,8 +285,9 @@ static const u32 correrrthrsld[] = {
+  * sbridge structs
+  */
+ 
+-#define NUM_CHANNELS	4
+-#define MAX_DIMMS	3		/* Max DIMMS per channel */
++#define NUM_CHANNELS		4
++#define MAX_DIMMS		3	/* Max DIMMS per channel */
++#define CHANNEL_UNSPECIFIED	0xf	/* Intel IA32 SDM 15-14 */
+ 
+ enum type {
+ 	SANDY_BRIDGE,
+@@ -1750,6 +1751,9 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci,
+ 
+ 	/* FIXME: need support for channel mask */
+ 
++	if (channel == CHANNEL_UNSPECIFIED)
++		channel = -1;
++
+ 	/* Call the helper to output message */
+ 	edac_mc_handle_error(tp_event, mci, core_err_cnt,
+ 			     m->addr >> PAGE_SHIFT, m->addr & ~PAGE_MASK, 0,
+diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
+index dcde5605..3177498 100644
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -2479,7 +2479,7 @@ out:
+ 	return NETDEV_TX_OK;
+ err_free:
+ 	/* no suitable interface, frame not sent */
+-	kfree_skb(skb);
++	dev_kfree_skb_any(skb);
+ 	goto out;
+ }
+ 
+diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
+index e8f133e..c67bbc9 100644
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -1479,7 +1479,7 @@ int bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev)
+ 	}
+ 
+ 	/* no suitable interface, frame not sent */
+-	kfree_skb(skb);
++	dev_kfree_skb_any(skb);
+ out:
+ 	return NETDEV_TX_OK;
+ }
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 1537982..32b0e705 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3568,7 +3568,7 @@ static void bond_xmit_slave_id(struct bonding *bond, struct sk_buff *skb, int sl
+ 		}
+ 	}
+ 	/* no slave that can tx has been found */
+-	kfree_skb(skb);
++	dev_kfree_skb_any(skb);
+ }
+ 
+ /**
+@@ -3650,7 +3650,7 @@ static int bond_xmit_activebackup(struct sk_buff *skb, struct net_device *bond_d
+ 	if (slave)
+ 		bond_dev_queue_xmit(bond, skb, slave->dev);
+ 	else
+-		kfree_skb(skb);
++		dev_kfree_skb_any(skb);
+ 
+ 	return NETDEV_TX_OK;
+ }
+@@ -3698,7 +3698,7 @@ static int bond_xmit_broadcast(struct sk_buff *skb, struct net_device *bond_dev)
+ 	if (slave && IS_UP(slave->dev) && slave->link == BOND_LINK_UP)
+ 		bond_dev_queue_xmit(bond, skb, slave->dev);
+ 	else
+-		kfree_skb(skb);
++		dev_kfree_skb_any(skb);
+ 
+ 	return NETDEV_TX_OK;
+ }
+@@ -3785,7 +3785,7 @@ static netdev_tx_t __bond_start_xmit(struct sk_buff *skb, struct net_device *dev
+ 		pr_err("%s: Error: Unknown bonding mode %d\n",
+ 		       dev->name, bond->params.mode);
+ 		WARN_ON_ONCE(1);
+-		kfree_skb(skb);
++		dev_kfree_skb_any(skb);
+ 		return NETDEV_TX_OK;
+ 	}
+ }
+@@ -3806,7 +3806,7 @@ static netdev_tx_t bond_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	if (bond_has_slaves(bond))
+ 		ret = __bond_start_xmit(skb, dev);
+ 	else
+-		kfree_skb(skb);
++		dev_kfree_skb_any(skb);
+ 	rcu_read_unlock();
+ 
+ 	return ret;
+diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
+index 6c9e1c9..0c8a168 100644
+--- a/drivers/net/ethernet/broadcom/bnx2.c
++++ b/drivers/net/ethernet/broadcom/bnx2.c
+@@ -2886,7 +2886,7 @@ bnx2_tx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
+ 		sw_cons = BNX2_NEXT_TX_BD(sw_cons);
+ 
+ 		tx_bytes += skb->len;
+-		dev_kfree_skb(skb);
++		dev_kfree_skb_any(skb);
+ 		tx_pkt++;
+ 		if (tx_pkt == budget)
+ 			break;
+@@ -6640,7 +6640,7 @@ bnx2_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 
+ 	mapping = dma_map_single(&bp->pdev->dev, skb->data, len, PCI_DMA_TODEVICE);
+ 	if (dma_mapping_error(&bp->pdev->dev, mapping)) {
+-		dev_kfree_skb(skb);
++		dev_kfree_skb_any(skb);
+ 		return NETDEV_TX_OK;
+ 	}
+ 
+@@ -6733,7 +6733,7 @@ dma_error:
+ 			       PCI_DMA_TODEVICE);
+ 	}
+ 
+-	dev_kfree_skb(skb);
++	dev_kfree_skb_any(skb);
+ 	return NETDEV_TX_OK;
+ }
+ 
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 8206113..bc65dc8 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -6593,7 +6593,7 @@ static void tg3_tx(struct tg3_napi *tnapi)
+ 		pkts_compl++;
+ 		bytes_compl += skb->len;
+ 
+-		dev_kfree_skb(skb);
++		dev_kfree_skb_any(skb);
+ 
+ 		if (unlikely(tx_bug)) {
+ 			tg3_tx_recover(tp);
+@@ -6925,7 +6925,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
+ 		if (len > (tp->dev->mtu + ETH_HLEN) &&
+ 		    skb->protocol != htons(ETH_P_8021Q) &&
+ 		    skb->protocol != htons(ETH_P_8021AD)) {
+-			dev_kfree_skb(skb);
++			dev_kfree_skb_any(skb);
+ 			goto drop_it_no_recycle;
+ 		}
+ 
+@@ -7808,7 +7808,7 @@ static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi,
+ 					  PCI_DMA_TODEVICE);
+ 		/* Make sure the mapping succeeded */
+ 		if (pci_dma_mapping_error(tp->pdev, new_addr)) {
+-			dev_kfree_skb(new_skb);
++			dev_kfree_skb_any(new_skb);
+ 			ret = -1;
+ 		} else {
+ 			u32 save_entry = *entry;
+@@ -7823,13 +7823,13 @@ static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi,
+ 					    new_skb->len, base_flags,
+ 					    mss, vlan)) {
+ 				tg3_tx_skb_unmap(tnapi, save_entry, -1);
+-				dev_kfree_skb(new_skb);
++				dev_kfree_skb_any(new_skb);
+ 				ret = -1;
+ 			}
+ 		}
+ 	}
+ 
+-	dev_kfree_skb(skb);
++	dev_kfree_skb_any(skb);
+ 	*pskb = new_skb;
+ 	return ret;
+ }
+@@ -7872,7 +7872,7 @@ static int tg3_tso_bug(struct tg3 *tp, struct sk_buff *skb)
+ 	} while (segs);
+ 
+ tg3_tso_bug_end:
+-	dev_kfree_skb(skb);
++	dev_kfree_skb_any(skb);
+ 
+ 	return NETDEV_TX_OK;
+ }
+@@ -8110,7 +8110,7 @@ dma_error:
+ 	tg3_tx_skb_unmap(tnapi, tnapi->tx_prod, --i);
+ 	tnapi->tx_buffers[tnapi->tx_prod].skb = NULL;
+ drop:
+-	dev_kfree_skb(skb);
++	dev_kfree_skb_any(skb);
+ drop_nofree:
+ 	tp->tx_dropped++;
+ 	return NETDEV_TX_OK;
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index 80bfa03..075e7e7 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -1883,7 +1883,7 @@ static u16 be_tx_compl_process(struct be_adapter *adapter,
+ 		queue_tail_inc(txq);
+ 	} while (cur_index != last_index);
+ 
+-	kfree_skb(sent_skb);
++	dev_kfree_skb_any(sent_skb);
+ 	return num_wrbs;
+ }
+ 
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index ad5a5aa..70eb4d2 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -2152,13 +2152,13 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 		skb_new = skb_realloc_headroom(skb, fcb_len);
+ 		if (!skb_new) {
+ 			dev->stats.tx_errors++;
+-			kfree_skb(skb);
++			dev_kfree_skb_any(skb);
+ 			return NETDEV_TX_OK;
+ 		}
+ 
+ 		if (skb->sk)
+ 			skb_set_owner_w(skb_new, skb->sk);
+-		consume_skb(skb);
++		dev_consume_skb_any(skb);
+ 		skb = skb_new;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_main.c b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
+index 57e390c..f42c201 100644
+--- a/drivers/net/ethernet/intel/ixgb/ixgb_main.c
++++ b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
+@@ -1521,12 +1521,12 @@ ixgb_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
+ 	int tso;
+ 
+ 	if (test_bit(__IXGB_DOWN, &adapter->flags)) {
+-		dev_kfree_skb(skb);
++		dev_kfree_skb_any(skb);
+ 		return NETDEV_TX_OK;
+ 	}
+ 
+ 	if (skb->len <= 0) {
+-		dev_kfree_skb(skb);
++		dev_kfree_skb_any(skb);
+ 		return NETDEV_TX_OK;
+ 	}
+ 
+@@ -1543,7 +1543,7 @@ ixgb_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
+ 
+ 	tso = ixgb_tso(adapter, skb);
+ 	if (tso < 0) {
+-		dev_kfree_skb(skb);
++		dev_kfree_skb_any(skb);
+ 		return NETDEV_TX_OK;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 2f83f34..8be0f3e 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -2497,13 +2497,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
+ 	netif_carrier_off(dev);
+ 	mlx4_en_set_default_moderation(priv);
+ 
+-	err = register_netdev(dev);
+-	if (err) {
+-		en_err(priv, "Netdev registration failed for port %d\n", port);
+-		goto out;
+-	}
+-	priv->registered = 1;
+-
+ 	en_warn(priv, "Using %d TX rings\n", prof->tx_ring_num);
+ 	en_warn(priv, "Using %d RX rings\n", prof->rx_ring_num);
+ 
+@@ -2543,6 +2536,14 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
+ 		queue_delayed_work(mdev->workqueue, &priv->service_task,
+ 				   SERVICE_TASK_DELAY);
+ 
++	err = register_netdev(dev);
++	if (err) {
++		en_err(priv, "Netdev registration failed for port %d\n", port);
++		goto out;
++	}
++
++	priv->registered = 1;
++
+ 	return 0;
+ 
+ out:
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+index 1345703..019a04a 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+@@ -325,7 +325,7 @@ static u32 mlx4_en_free_tx_desc(struct mlx4_en_priv *priv,
+ 			}
+ 		}
+ 	}
+-	dev_kfree_skb(skb);
++	dev_kfree_skb_any(skb);
+ 	return tx_info->nr_txbb;
+ }
+ 
+diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
+index 737c1a8..a3c1daa 100644
+--- a/drivers/net/ethernet/realtek/8139cp.c
++++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -899,7 +899,7 @@ out_unlock:
+ 
+ 	return NETDEV_TX_OK;
+ out_dma_error:
+-	kfree_skb(skb);
++	dev_kfree_skb_any(skb);
+ 	cp->dev->stats.tx_dropped++;
+ 	goto out_unlock;
+ }
+diff --git a/drivers/net/ethernet/realtek/8139too.c b/drivers/net/ethernet/realtek/8139too.c
+index da5972e..8cb2f35 100644
+--- a/drivers/net/ethernet/realtek/8139too.c
++++ b/drivers/net/ethernet/realtek/8139too.c
+@@ -1717,9 +1717,9 @@ static netdev_tx_t rtl8139_start_xmit (struct sk_buff *skb,
+ 		if (len < ETH_ZLEN)
+ 			memset(tp->tx_buf[entry], 0, ETH_ZLEN);
+ 		skb_copy_and_csum_dev(skb, tp->tx_buf[entry]);
+-		dev_kfree_skb(skb);
++		dev_kfree_skb_any(skb);
+ 	} else {
+-		dev_kfree_skb(skb);
++		dev_kfree_skb_any(skb);
+ 		dev->stats.tx_dropped++;
+ 		return NETDEV_TX_OK;
+ 	}
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 3ff7bc3..90c14d1 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -5834,7 +5834,7 @@ static void rtl8169_tx_clear_range(struct rtl8169_private *tp, u32 start,
+ 					     tp->TxDescArray + entry);
+ 			if (skb) {
+ 				tp->dev->stats.tx_dropped++;
+-				dev_kfree_skb(skb);
++				dev_kfree_skb_any(skb);
+ 				tx_skb->skb = NULL;
+ 			}
+ 		}
+@@ -6059,7 +6059,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
+ err_dma_1:
+ 	rtl8169_unmap_tx_skb(d, tp->tx_skb + entry, txd);
+ err_dma_0:
+-	dev_kfree_skb(skb);
++	dev_kfree_skb_any(skb);
+ err_update_stats:
+ 	dev->stats.tx_dropped++;
+ 	return NETDEV_TX_OK;
+@@ -6142,7 +6142,7 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp)
+ 			tp->tx_stats.packets++;
+ 			tp->tx_stats.bytes += tx_skb->skb->len;
+ 			u64_stats_update_end(&tp->tx_stats.syncp);
+-			dev_kfree_skb(tx_skb->skb);
++			dev_kfree_skb_any(tx_skb->skb);
+ 			tx_skb->skb = NULL;
+ 		}
+ 		dirty_tx++;
+diff --git a/drivers/staging/lustre/lustre/llite/dcache.c b/drivers/staging/lustre/lustre/llite/dcache.c
+index cbd663e..19405ed 100644
+--- a/drivers/staging/lustre/lustre/llite/dcache.c
++++ b/drivers/staging/lustre/lustre/llite/dcache.c
+@@ -278,7 +278,7 @@ void ll_invalidate_aliases(struct inode *inode)
+ 	       inode->i_ino, inode->i_generation, inode);
+ 
+ 	ll_lock_dcache(inode);
+-	ll_d_hlist_for_each_entry(dentry, p, &inode->i_dentry, d_alias) {
++	ll_d_hlist_for_each_entry(dentry, p, &inode->i_dentry, d_u.d_alias) {
+ 		CDEBUG(D_DENTRY, "dentry in drop %.*s (%p) parent %p "
+ 		       "inode %p flags %d\n", dentry->d_name.len,
+ 		       dentry->d_name.name, dentry, dentry->d_parent,
+diff --git a/drivers/staging/lustre/lustre/llite/llite_lib.c b/drivers/staging/lustre/lustre/llite/llite_lib.c
+index 6cfdb9e..5ae562e 100644
+--- a/drivers/staging/lustre/lustre/llite/llite_lib.c
++++ b/drivers/staging/lustre/lustre/llite/llite_lib.c
+@@ -678,7 +678,7 @@ void lustre_dump_dentry(struct dentry *dentry, int recur)
+ 		return;
+ 
+ 	list_for_each(tmp, &dentry->d_subdirs) {
+-		struct dentry *d = list_entry(tmp, struct dentry, d_u.d_child);
++		struct dentry *d = list_entry(tmp, struct dentry, d_child);
+ 		lustre_dump_dentry(d, recur - 1);
+ 	}
+ }
+diff --git a/drivers/staging/lustre/lustre/llite/namei.c b/drivers/staging/lustre/lustre/llite/namei.c
+index fc8d264..8e9a9e9 100644
+--- a/drivers/staging/lustre/lustre/llite/namei.c
++++ b/drivers/staging/lustre/lustre/llite/namei.c
+@@ -175,14 +175,14 @@ static void ll_invalidate_negative_children(struct inode *dir)
+ 	struct ll_d_hlist_node *p;
+ 
+ 	ll_lock_dcache(dir);
+-	ll_d_hlist_for_each_entry(dentry, p, &dir->i_dentry, d_alias) {
++	ll_d_hlist_for_each_entry(dentry, p, &dir->i_dentry, d_u.d_alias) {
+ 		spin_lock(&dentry->d_lock);
+ 		if (!list_empty(&dentry->d_subdirs)) {
+ 			struct dentry *child;
+ 
+ 			list_for_each_entry_safe(child, tmp_subdir,
+ 						 &dentry->d_subdirs,
+-						 d_u.d_child) {
++						 d_child) {
+ 				if (child->d_inode == NULL)
+ 					d_lustre_invalidate(child, 1);
+ 			}
+@@ -364,7 +364,7 @@ static struct dentry *ll_find_alias(struct inode *inode, struct dentry *dentry)
+ 	discon_alias = invalid_alias = NULL;
+ 
+ 	ll_lock_dcache(inode);
+-	ll_d_hlist_for_each_entry(alias, p, &inode->i_dentry, d_alias) {
++	ll_d_hlist_for_each_entry(alias, p, &inode->i_dentry, d_u.d_alias) {
+ 		LASSERT(alias != dentry);
+ 
+ 		spin_lock(&alias->d_lock);
+@@ -953,7 +953,7 @@ static void ll_get_child_fid(struct inode * dir, struct qstr *name,
+ {
+ 	struct dentry *parent, *child;
+ 
+-	parent = ll_d_hlist_entry(dir->i_dentry, struct dentry, d_alias);
++	parent = ll_d_hlist_entry(dir->i_dentry, struct dentry, d_u.d_alias);
+ 	child = d_lookup(parent, name);
+ 	if (child) {
+ 		if (child->d_inode)
+diff --git a/drivers/staging/lustre/lustre/llite/vvp_io.c b/drivers/staging/lustre/lustre/llite/vvp_io.c
+index 93cbfbb..6096771 100644
+--- a/drivers/staging/lustre/lustre/llite/vvp_io.c
++++ b/drivers/staging/lustre/lustre/llite/vvp_io.c
+@@ -642,7 +642,7 @@ static int vvp_io_kernel_fault(struct vvp_fault_io *cfio)
+ 		return 0;
+ 	}
+ 
+-	if (cfio->fault.ft_flags & VM_FAULT_SIGBUS) {
++	if (cfio->fault.ft_flags & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) {
+ 		CDEBUG(D_PAGE, "got addr %p - SIGBUS\n", vmf->virtual_address);
+ 		return -EFAULT;
+ 	}
+diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c
+index d9a4367..9cca0ea 100644
+--- a/fs/affs/amigaffs.c
++++ b/fs/affs/amigaffs.c
+@@ -126,7 +126,7 @@ affs_fix_dcache(struct inode *inode, u32 entry_ino)
+ {
+ 	struct dentry *dentry;
+ 	spin_lock(&inode->i_lock);
+-	hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ 		if (entry_ino == (u32)(long)dentry->d_fsdata) {
+ 			dentry->d_fsdata = (void *)inode->i_ino;
+ 			break;
+diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
+index 394e90b..edb46e6 100644
+--- a/fs/autofs4/expire.c
++++ b/fs/autofs4/expire.c
+@@ -91,7 +91,7 @@ static struct dentry *get_next_positive_subdir(struct dentry *prev,
+ 	spin_lock(&root->d_lock);
+ 
+ 	if (prev)
+-		next = prev->d_u.d_child.next;
++		next = prev->d_child.next;
+ 	else {
+ 		prev = dget_dlock(root);
+ 		next = prev->d_subdirs.next;
+@@ -105,13 +105,13 @@ cont:
+ 		return NULL;
+ 	}
+ 
+-	q = list_entry(next, struct dentry, d_u.d_child);
++	q = list_entry(next, struct dentry, d_child);
+ 
+ 	spin_lock_nested(&q->d_lock, DENTRY_D_LOCK_NESTED);
+ 	/* Already gone or negative dentry (under construction) - try next */
+ 	if (!d_count(q) || !simple_positive(q)) {
+ 		spin_unlock(&q->d_lock);
+-		next = q->d_u.d_child.next;
++		next = q->d_child.next;
+ 		goto cont;
+ 	}
+ 	dget_dlock(q);
+@@ -161,13 +161,13 @@ again:
+ 				goto relock;
+ 			}
+ 			spin_unlock(&p->d_lock);
+-			next = p->d_u.d_child.next;
++			next = p->d_child.next;
+ 			p = parent;
+ 			if (next != &parent->d_subdirs)
+ 				break;
+ 		}
+ 	}
+-	ret = list_entry(next, struct dentry, d_u.d_child);
++	ret = list_entry(next, struct dentry, d_child);
+ 
+ 	spin_lock_nested(&ret->d_lock, DENTRY_D_LOCK_NESTED);
+ 	/* Negative dentry - try next */
+@@ -461,7 +461,7 @@ found:
+ 	spin_lock(&sbi->lookup_lock);
+ 	spin_lock(&expired->d_parent->d_lock);
+ 	spin_lock_nested(&expired->d_lock, DENTRY_D_LOCK_NESTED);
+-	list_move(&expired->d_parent->d_subdirs, &expired->d_u.d_child);
++	list_move(&expired->d_parent->d_subdirs, &expired->d_child);
+ 	spin_unlock(&expired->d_lock);
+ 	spin_unlock(&expired->d_parent->d_lock);
+ 	spin_unlock(&sbi->lookup_lock);
+diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
+index cc87c1a..9e016e6 100644
+--- a/fs/autofs4/root.c
++++ b/fs/autofs4/root.c
+@@ -655,7 +655,7 @@ static void autofs_clear_leaf_automount_flags(struct dentry *dentry)
+ 	/* only consider parents below dentrys in the root */
+ 	if (IS_ROOT(parent->d_parent))
+ 		return;
+-	d_child = &dentry->d_u.d_child;
++	d_child = &dentry->d_child;
+ 	/* Set parent managed if it's becoming empty */
+ 	if (d_child->next == &parent->d_subdirs &&
+ 	    d_child->prev == &parent->d_subdirs)
+diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
+index 5e0982a..18e14cf 100644
+--- a/fs/ceph/dir.c
++++ b/fs/ceph/dir.c
+@@ -111,7 +111,7 @@ static int fpos_cmp(loff_t l, loff_t r)
+ /*
+  * When possible, we try to satisfy a readdir by peeking at the
+  * dcache.  We make this work by carefully ordering dentries on
+- * d_u.d_child when we initially get results back from the MDS, and
++ * d_child when we initially get results back from the MDS, and
+  * falling back to a "normal" sync readdir if any dentries in the dir
+  * are dropped.
+  *
+@@ -146,11 +146,11 @@ static int __dcache_readdir(struct file *file, struct dir_context *ctx)
+ 		p = parent->d_subdirs.prev;
+ 		dout(" initial p %p/%p\n", p->prev, p->next);
+ 	} else {
+-		p = last->d_u.d_child.prev;
++		p = last->d_child.prev;
+ 	}
+ 
+ more:
+-	dentry = list_entry(p, struct dentry, d_u.d_child);
++	dentry = list_entry(p, struct dentry, d_child);
+ 	di = ceph_dentry(dentry);
+ 	while (1) {
+ 		dout(" p %p/%p %s d_subdirs %p/%p\n", p->prev, p->next,
+@@ -172,7 +172,7 @@ more:
+ 		     !dentry->d_inode ? " null" : "");
+ 		spin_unlock(&dentry->d_lock);
+ 		p = p->prev;
+-		dentry = list_entry(p, struct dentry, d_u.d_child);
++		dentry = list_entry(p, struct dentry, d_child);
+ 		di = ceph_dentry(dentry);
+ 	}
+ 
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 6471f9c..ee24490 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -1289,7 +1289,7 @@ retry_lookup:
+ 			/* reorder parent's d_subdirs */
+ 			spin_lock(&parent->d_lock);
+ 			spin_lock_nested(&dn->d_lock, DENTRY_D_LOCK_NESTED);
+-			list_move(&dn->d_u.d_child, &parent->d_subdirs);
++			list_move(&dn->d_child, &parent->d_subdirs);
+ 			spin_unlock(&dn->d_lock);
+ 			spin_unlock(&parent->d_lock);
+ 		}
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index f2ddcf7..7ee427e 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -883,7 +883,7 @@ inode_has_hashed_dentries(struct inode *inode)
+ 	struct dentry *dentry;
+ 
+ 	spin_lock(&inode->i_lock);
+-	hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ 		if (!d_unhashed(dentry) || IS_ROOT(dentry)) {
+ 			spin_unlock(&inode->i_lock);
+ 			return true;
+diff --git a/fs/coda/cache.c b/fs/coda/cache.c
+index 1da168c..9bc1147 100644
+--- a/fs/coda/cache.c
++++ b/fs/coda/cache.c
+@@ -92,7 +92,7 @@ static void coda_flag_children(struct dentry *parent, int flag)
+ 	struct dentry *de;
+ 
+ 	spin_lock(&parent->d_lock);
+-	list_for_each_entry(de, &parent->d_subdirs, d_u.d_child) {
++	list_for_each_entry(de, &parent->d_subdirs, d_child) {
+ 		/* don't know what to do with negative dentries */
+ 		if (de->d_inode ) 
+ 			coda_flag_inode(de->d_inode, flag);
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 4366127..c345f5f 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -44,7 +44,7 @@
+ /*
+  * Usage:
+  * dcache->d_inode->i_lock protects:
+- *   - i_dentry, d_alias, d_inode of aliases
++ *   - i_dentry, d_u.d_alias, d_inode of aliases
+  * dcache_hash_bucket lock protects:
+  *   - the dcache hash table
+  * s_anon bl list spinlock protects:
+@@ -59,7 +59,7 @@
+  *   - d_unhashed()
+  *   - d_parent and d_subdirs
+  *   - childrens' d_child and d_parent
+- *   - d_alias, d_inode
++ *   - d_u.d_alias, d_inode
+  *
+  * Ordering:
+  * dentry->d_inode->i_lock
+@@ -239,7 +239,6 @@ static void __d_free(struct rcu_head *head)
+ {
+ 	struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu);
+ 
+-	WARN_ON(!hlist_unhashed(&dentry->d_alias));
+ 	if (dname_external(dentry))
+ 		kfree(dentry->d_name.name);
+ 	kmem_cache_free(dentry_cache, dentry); 
+@@ -250,6 +249,7 @@ static void __d_free(struct rcu_head *head)
+  */
+ static void d_free(struct dentry *dentry)
+ {
++	WARN_ON(!hlist_unhashed(&dentry->d_u.d_alias));
+ 	BUG_ON((int)dentry->d_lockref.count > 0);
+ 	this_cpu_dec(nr_dentry);
+ 	if (dentry->d_op && dentry->d_op->d_release)
+@@ -288,7 +288,7 @@ static void dentry_iput(struct dentry * dentry)
+ 	struct inode *inode = dentry->d_inode;
+ 	if (inode) {
+ 		dentry->d_inode = NULL;
+-		hlist_del_init(&dentry->d_alias);
++		hlist_del_init(&dentry->d_u.d_alias);
+ 		spin_unlock(&dentry->d_lock);
+ 		spin_unlock(&inode->i_lock);
+ 		if (!inode->i_nlink)
+@@ -313,7 +313,7 @@ static void dentry_unlink_inode(struct dentry * dentry)
+ 	struct inode *inode = dentry->d_inode;
+ 	__d_clear_type(dentry);
+ 	dentry->d_inode = NULL;
+-	hlist_del_init(&dentry->d_alias);
++	hlist_del_init(&dentry->d_u.d_alias);
+ 	dentry_rcuwalk_barrier(dentry);
+ 	spin_unlock(&dentry->d_lock);
+ 	spin_unlock(&inode->i_lock);
+@@ -435,7 +435,7 @@ static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent)
+ 	__releases(parent->d_lock)
+ 	__releases(dentry->d_inode->i_lock)
+ {
+-	list_del(&dentry->d_u.d_child);
++	list_del(&dentry->d_child);
+ 	/*
+ 	 * Inform d_walk() that we are no longer attached to the
+ 	 * dentry tree
+@@ -737,7 +737,7 @@ static struct dentry *__d_find_alias(struct inode *inode, int want_discon)
+ 
+ again:
+ 	discon_alias = NULL;
+-	hlist_for_each_entry(alias, &inode->i_dentry, d_alias) {
++	hlist_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
+ 		spin_lock(&alias->d_lock);
+  		if (S_ISDIR(inode->i_mode) || !d_unhashed(alias)) {
+ 			if (IS_ROOT(alias) &&
+@@ -790,7 +790,7 @@ void d_prune_aliases(struct inode *inode)
+ 	struct dentry *dentry;
+ restart:
+ 	spin_lock(&inode->i_lock);
+-	hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ 		spin_lock(&dentry->d_lock);
+ 		if (!dentry->d_lockref.count) {
+ 			/*
+@@ -1091,7 +1091,7 @@ repeat:
+ resume:
+ 	while (next != &this_parent->d_subdirs) {
+ 		struct list_head *tmp = next;
+-		struct dentry *dentry = list_entry(tmp, struct dentry, d_u.d_child);
++		struct dentry *dentry = list_entry(tmp, struct dentry, d_child);
+ 		next = tmp->next;
+ 
+ 		spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+@@ -1143,7 +1143,7 @@ resume:
+ 			goto rename_retry;
+ 		}
+ 		rcu_read_unlock();
+-		next = child->d_u.d_child.next;
++		next = child->d_child.next;
+ 		goto resume;
+ 	}
+ 	if (need_seqretry(&rename_lock, seq)) {
+@@ -1524,8 +1524,8 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+ 	INIT_HLIST_BL_NODE(&dentry->d_hash);
+ 	INIT_LIST_HEAD(&dentry->d_lru);
+ 	INIT_LIST_HEAD(&dentry->d_subdirs);
+-	INIT_HLIST_NODE(&dentry->d_alias);
+-	INIT_LIST_HEAD(&dentry->d_u.d_child);
++	INIT_HLIST_NODE(&dentry->d_u.d_alias);
++	INIT_LIST_HEAD(&dentry->d_child);
+ 	d_set_d_op(dentry, dentry->d_sb->s_d_op);
+ 
+ 	this_cpu_inc(nr_dentry);
+@@ -1555,7 +1555,7 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name)
+ 	 */
+ 	__dget_dlock(parent);
+ 	dentry->d_parent = parent;
+-	list_add(&dentry->d_u.d_child, &parent->d_subdirs);
++	list_add(&dentry->d_child, &parent->d_subdirs);
+ 	spin_unlock(&parent->d_lock);
+ 
+ 	return dentry;
+@@ -1648,7 +1648,7 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode)
+ 	spin_lock(&dentry->d_lock);
+ 	__d_set_type(dentry, add_flags);
+ 	if (inode)
+-		hlist_add_head(&dentry->d_alias, &inode->i_dentry);
++		hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry);
+ 	dentry->d_inode = inode;
+ 	dentry_rcuwalk_barrier(dentry);
+ 	spin_unlock(&dentry->d_lock);
+@@ -1672,7 +1672,7 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode)
+  
+ void d_instantiate(struct dentry *entry, struct inode * inode)
+ {
+-	BUG_ON(!hlist_unhashed(&entry->d_alias));
++	BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
+ 	if (inode)
+ 		spin_lock(&inode->i_lock);
+ 	__d_instantiate(entry, inode);
+@@ -1711,7 +1711,7 @@ static struct dentry *__d_instantiate_unique(struct dentry *entry,
+ 		return NULL;
+ 	}
+ 
+-	hlist_for_each_entry(alias, &inode->i_dentry, d_alias) {
++	hlist_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
+ 		/*
+ 		 * Don't need alias->d_lock here, because aliases with
+ 		 * d_parent == entry->d_parent are not subject to name or
+@@ -1737,7 +1737,7 @@ struct dentry *d_instantiate_unique(struct dentry *entry, struct inode *inode)
+ {
+ 	struct dentry *result;
+ 
+-	BUG_ON(!hlist_unhashed(&entry->d_alias));
++	BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
+ 
+ 	if (inode)
+ 		spin_lock(&inode->i_lock);
+@@ -1768,7 +1768,7 @@ EXPORT_SYMBOL(d_instantiate_unique);
+  */
+ int d_instantiate_no_diralias(struct dentry *entry, struct inode *inode)
+ {
+-	BUG_ON(!hlist_unhashed(&entry->d_alias));
++	BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
+ 
+ 	spin_lock(&inode->i_lock);
+ 	if (S_ISDIR(inode->i_mode) && !hlist_empty(&inode->i_dentry)) {
+@@ -1807,7 +1807,7 @@ static struct dentry * __d_find_any_alias(struct inode *inode)
+ 
+ 	if (hlist_empty(&inode->i_dentry))
+ 		return NULL;
+-	alias = hlist_entry(inode->i_dentry.first, struct dentry, d_alias);
++	alias = hlist_entry(inode->i_dentry.first, struct dentry, d_u.d_alias);
+ 	__dget(alias);
+ 	return alias;
+ }
+@@ -1884,7 +1884,7 @@ struct dentry *d_obtain_alias(struct inode *inode)
+ 	spin_lock(&tmp->d_lock);
+ 	tmp->d_inode = inode;
+ 	tmp->d_flags |= add_flags;
+-	hlist_add_head(&tmp->d_alias, &inode->i_dentry);
++	hlist_add_head(&tmp->d_u.d_alias, &inode->i_dentry);
+ 	hlist_bl_lock(&tmp->d_sb->s_anon);
+ 	hlist_bl_add_head(&tmp->d_hash, &tmp->d_sb->s_anon);
+ 	hlist_bl_unlock(&tmp->d_sb->s_anon);
+@@ -2327,7 +2327,7 @@ int d_validate(struct dentry *dentry, struct dentry *dparent)
+ 	struct dentry *child;
+ 
+ 	spin_lock(&dparent->d_lock);
+-	list_for_each_entry(child, &dparent->d_subdirs, d_u.d_child) {
++	list_for_each_entry(child, &dparent->d_subdirs, d_child) {
+ 		if (dentry == child) {
+ 			spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+ 			__dget_dlock(dentry);
+@@ -2574,8 +2574,8 @@ static void __d_move(struct dentry * dentry, struct dentry * target)
+ 	/* Unhash the target: dput() will then get rid of it */
+ 	__d_drop(target);
+ 
+-	list_del(&dentry->d_u.d_child);
+-	list_del(&target->d_u.d_child);
++	list_del(&dentry->d_child);
++	list_del(&target->d_child);
+ 
+ 	/* Switch the names.. */
+ 	switch_names(dentry, target);
+@@ -2585,15 +2585,15 @@ static void __d_move(struct dentry * dentry, struct dentry * target)
+ 	if (IS_ROOT(dentry)) {
+ 		dentry->d_parent = target->d_parent;
+ 		target->d_parent = target;
+-		INIT_LIST_HEAD(&target->d_u.d_child);
++		INIT_LIST_HEAD(&target->d_child);
+ 	} else {
+ 		swap(dentry->d_parent, target->d_parent);
+ 
+ 		/* And add them back to the (new) parent lists */
+-		list_add(&target->d_u.d_child, &target->d_parent->d_subdirs);
++		list_add(&target->d_child, &target->d_parent->d_subdirs);
+ 	}
+ 
+-	list_add(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs);
++	list_add(&dentry->d_child, &dentry->d_parent->d_subdirs);
+ 
+ 	write_seqcount_end(&target->d_seq);
+ 	write_seqcount_end(&dentry->d_seq);
+@@ -2700,9 +2700,9 @@ static void __d_materialise_dentry(struct dentry *dentry, struct dentry *anon)
+ 	swap(dentry->d_name.hash, anon->d_name.hash);
+ 
+ 	dentry->d_parent = dentry;
+-	list_del_init(&dentry->d_u.d_child);
++	list_del_init(&dentry->d_child);
+ 	anon->d_parent = dparent;
+-	list_move(&anon->d_u.d_child, &dparent->d_subdirs);
++	list_move(&anon->d_child, &dparent->d_subdirs);
+ 
+ 	write_seqcount_end(&dentry->d_seq);
+ 	write_seqcount_end(&anon->d_seq);
+@@ -3333,7 +3333,7 @@ void d_tmpfile(struct dentry *dentry, struct inode *inode)
+ {
+ 	inode_dec_link_count(inode);
+ 	BUG_ON(dentry->d_name.name != dentry->d_iname ||
+-		!hlist_unhashed(&dentry->d_alias) ||
++		!hlist_unhashed(&dentry->d_u.d_alias) ||
+ 		!d_unlinked(dentry));
+ 	spin_lock(&dentry->d_parent->d_lock);
+ 	spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index 1ff8fe5..4a9f0e0 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -552,7 +552,7 @@ void debugfs_remove_recursive(struct dentry *dentry)
+ 	 * use the d_u.d_child as the rcu head and corrupt this list.
+ 	 */
+ 	spin_lock(&parent->d_lock);
+-	list_for_each_entry(child, &parent->d_subdirs, d_u.d_child) {
++	list_for_each_entry(child, &parent->d_subdirs, d_child) {
+ 		if (!debugfs_positive(child))
+ 			continue;
+ 
+diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
+index 48a359d..831d4f0 100644
+--- a/fs/exportfs/expfs.c
++++ b/fs/exportfs/expfs.c
+@@ -50,7 +50,7 @@ find_acceptable_alias(struct dentry *result,
+ 
+ 	inode = result->d_inode;
+ 	spin_lock(&inode->i_lock);
+-	hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ 		dget(dentry);
+ 		spin_unlock(&inode->i_lock);
+ 		if (toput)
+diff --git a/fs/libfs.c b/fs/libfs.c
+index a184424..868c0b7 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -113,18 +113,18 @@ loff_t dcache_dir_lseek(struct file *file, loff_t offset, int whence)
+ 
+ 			spin_lock(&dentry->d_lock);
+ 			/* d_lock not required for cursor */
+-			list_del(&cursor->d_u.d_child);
++			list_del(&cursor->d_child);
+ 			p = dentry->d_subdirs.next;
+ 			while (n && p != &dentry->d_subdirs) {
+ 				struct dentry *next;
+-				next = list_entry(p, struct dentry, d_u.d_child);
++				next = list_entry(p, struct dentry, d_child);
+ 				spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
+ 				if (simple_positive(next))
+ 					n--;
+ 				spin_unlock(&next->d_lock);
+ 				p = p->next;
+ 			}
+-			list_add_tail(&cursor->d_u.d_child, p);
++			list_add_tail(&cursor->d_child, p);
+ 			spin_unlock(&dentry->d_lock);
+ 		}
+ 	}
+@@ -149,7 +149,7 @@ int dcache_readdir(struct file *file, struct dir_context *ctx)
+ {
+ 	struct dentry *dentry = file->f_path.dentry;
+ 	struct dentry *cursor = file->private_data;
+-	struct list_head *p, *q = &cursor->d_u.d_child;
++	struct list_head *p, *q = &cursor->d_child;
+ 
+ 	if (!dir_emit_dots(file, ctx))
+ 		return 0;
+@@ -158,7 +158,7 @@ int dcache_readdir(struct file *file, struct dir_context *ctx)
+ 		list_move(q, &dentry->d_subdirs);
+ 
+ 	for (p = q->next; p != &dentry->d_subdirs; p = p->next) {
+-		struct dentry *next = list_entry(p, struct dentry, d_u.d_child);
++		struct dentry *next = list_entry(p, struct dentry, d_child);
+ 		spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
+ 		if (!simple_positive(next)) {
+ 			spin_unlock(&next->d_lock);
+@@ -286,7 +286,7 @@ int simple_empty(struct dentry *dentry)
+ 	int ret = 0;
+ 
+ 	spin_lock(&dentry->d_lock);
+-	list_for_each_entry(child, &dentry->d_subdirs, d_u.d_child) {
++	list_for_each_entry(child, &dentry->d_subdirs, d_child) {
+ 		spin_lock_nested(&child->d_lock, DENTRY_D_LOCK_NESTED);
+ 		if (simple_positive(child)) {
+ 			spin_unlock(&child->d_lock);
+diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c
+index c320ac5..dc9747d 100644
+--- a/fs/ncpfs/dir.c
++++ b/fs/ncpfs/dir.c
+@@ -406,7 +406,7 @@ ncp_dget_fpos(struct dentry *dentry, struct dentry *parent, unsigned long fpos)
+ 	spin_lock(&parent->d_lock);
+ 	next = parent->d_subdirs.next;
+ 	while (next != &parent->d_subdirs) {
+-		dent = list_entry(next, struct dentry, d_u.d_child);
++		dent = list_entry(next, struct dentry, d_child);
+ 		if ((unsigned long)dent->d_fsdata == fpos) {
+ 			if (dent->d_inode)
+ 				dget(dent);
+diff --git a/fs/ncpfs/ncplib_kernel.h b/fs/ncpfs/ncplib_kernel.h
+index 32c0658..6d5e7c5 100644
+--- a/fs/ncpfs/ncplib_kernel.h
++++ b/fs/ncpfs/ncplib_kernel.h
+@@ -194,7 +194,7 @@ ncp_renew_dentries(struct dentry *parent)
+ 	spin_lock(&parent->d_lock);
+ 	next = parent->d_subdirs.next;
+ 	while (next != &parent->d_subdirs) {
+-		dentry = list_entry(next, struct dentry, d_u.d_child);
++		dentry = list_entry(next, struct dentry, d_child);
+ 
+ 		if (dentry->d_fsdata == NULL)
+ 			ncp_age_dentry(server, dentry);
+@@ -216,7 +216,7 @@ ncp_invalidate_dircache_entries(struct dentry *parent)
+ 	spin_lock(&parent->d_lock);
+ 	next = parent->d_subdirs.next;
+ 	while (next != &parent->d_subdirs) {
+-		dentry = list_entry(next, struct dentry, d_u.d_child);
++		dentry = list_entry(next, struct dentry, d_child);
+ 		dentry->d_fsdata = NULL;
+ 		ncp_age_dentry(server, dentry);
+ 		next = next->next;
+diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c
+index 66984a9..5b8ab0e 100644
+--- a/fs/nfs/getroot.c
++++ b/fs/nfs/getroot.c
+@@ -58,7 +58,7 @@ static int nfs_superblock_set_dummy_root(struct super_block *sb, struct inode *i
+ 		 */
+ 		spin_lock(&sb->s_root->d_inode->i_lock);
+ 		spin_lock(&sb->s_root->d_lock);
+-		hlist_del_init(&sb->s_root->d_alias);
++		hlist_del_init(&sb->s_root->d_u.d_alias);
+ 		spin_unlock(&sb->s_root->d_lock);
+ 		spin_unlock(&sb->s_root->d_inode->i_lock);
+ 	}
+diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
+index 9d3e9c5..7001299 100644
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -63,14 +63,14 @@ void __fsnotify_update_child_dentry_flags(struct inode *inode)
+ 	spin_lock(&inode->i_lock);
+ 	/* run all of the dentries associated with this inode.  Since this is a
+ 	 * directory, there damn well better only be one item on this list */
+-	hlist_for_each_entry(alias, &inode->i_dentry, d_alias) {
++	hlist_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
+ 		struct dentry *child;
+ 
+ 		/* run all of the children of the original inode and fix their
+ 		 * d_flags to indicate parental interest (their parent is the
+ 		 * original inode) */
+ 		spin_lock(&alias->d_lock);
+-		list_for_each_entry(child, &alias->d_subdirs, d_u.d_child) {
++		list_for_each_entry(child, &alias->d_subdirs, d_child) {
+ 			if (!child->d_inode)
+ 				continue;
+ 
+diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
+index 0d3a97d..1167485 100644
+--- a/fs/ocfs2/dcache.c
++++ b/fs/ocfs2/dcache.c
+@@ -173,7 +173,7 @@ struct dentry *ocfs2_find_local_alias(struct inode *inode,
+ 	struct dentry *dentry;
+ 
+ 	spin_lock(&inode->i_lock);
+-	hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ 		spin_lock(&dentry->d_lock);
+ 		if (ocfs2_match_dentry(dentry, parent_blkno, skip_unhashed)) {
+ 			trace_ocfs2_find_local_alias(dentry->d_name.len,
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index c254671..eaa7374 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -993,9 +993,8 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
+ 	struct vm_area_struct *vma;
+ 	struct pagemapread *pm = walk->private;
+ 	spinlock_t *ptl;
+-	pte_t *pte;
++	pte_t *pte, *orig_pte;
+ 	int err = 0;
+-	pagemap_entry_t pme = make_pme(PM_NOT_PRESENT(pm->v2));
+ 
+ 	/* find the first VMA at or above 'addr' */
+ 	vma = find_vma(walk->mm, addr);
+@@ -1009,6 +1008,7 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
+ 
+ 		for (; addr != end; addr += PAGE_SIZE) {
+ 			unsigned long offset;
++			pagemap_entry_t pme;
+ 
+ 			offset = (addr & ~PAGEMAP_WALK_MASK) >>
+ 					PAGE_SHIFT;
+@@ -1023,32 +1023,55 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
+ 
+ 	if (pmd_trans_unstable(pmd))
+ 		return 0;
+-	for (; addr != end; addr += PAGE_SIZE) {
+-		int flags2;
+-
+-		/* check to see if we've left 'vma' behind
+-		 * and need a new, higher one */
+-		if (vma && (addr >= vma->vm_end)) {
+-			vma = find_vma(walk->mm, addr);
+-			if (vma && (vma->vm_flags & VM_SOFTDIRTY))
+-				flags2 = __PM_SOFT_DIRTY;
+-			else
+-				flags2 = 0;
+-			pme = make_pme(PM_NOT_PRESENT(pm->v2) | PM_STATUS2(pm->v2, flags2));
++
++	while (1) {
++		/* End of address space hole, which we mark as non-present. */
++		unsigned long hole_end;
++
++		if (vma)
++			hole_end = min(end, vma->vm_start);
++		else
++			hole_end = end;
++
++		for (; addr < hole_end; addr += PAGE_SIZE) {
++			pagemap_entry_t pme = make_pme(PM_NOT_PRESENT(pm->v2));
++
++			err = add_to_pagemap(addr, &pme, pm);
++			if (err)
++				return err;
+ 		}
+ 
+-		/* check that 'vma' actually covers this address,
+-		 * and that it isn't a huge page vma */
+-		if (vma && (vma->vm_start <= addr) &&
+-		    !is_vm_hugetlb_page(vma)) {
+-			pte = pte_offset_map(pmd, addr);
++		if (!vma || vma->vm_start >= end)
++			break;
++		/*
++		 * We can't possibly be in a hugetlb VMA. In general,
++		 * for a mm_walk with a pmd_entry and a hugetlb_entry,
++		 * the pmd_entry can only be called on addresses in a
++		 * hugetlb if the walk starts in a non-hugetlb VMA and
++		 * spans a hugepage VMA. Since pagemap_read walks are
++		 * PMD-sized and PMD-aligned, this will never be true.
++		 */
++		BUG_ON(is_vm_hugetlb_page(vma));
++
++		/* Addresses in the VMA. */
++		orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
++		for (; addr < min(end, vma->vm_end); pte++, addr += PAGE_SIZE) {
++			pagemap_entry_t pme;
++
+ 			pte_to_pagemap_entry(&pme, pm, vma, addr, *pte);
+-			/* unmap before userspace copy */
+-			pte_unmap(pte);
++			err = add_to_pagemap(addr, &pme, pm);
++			if (err)
++				break;
+ 		}
+-		err = add_to_pagemap(addr, &pme, pm);
++		pte_unmap_unlock(orig_pte, ptl);
++
+ 		if (err)
+ 			return err;
++
++		if (addr == end)
++			break;
++
++		vma = find_vma(walk->mm, addr);
+ 	}
+ 
+ 	cond_resched();
+diff --git a/include/linux/dcache.h b/include/linux/dcache.h
+index 3b50cac..0f0eb1c 100644
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -124,15 +124,15 @@ struct dentry {
+ 	void *d_fsdata;			/* fs-specific data */
+ 
+ 	struct list_head d_lru;		/* LRU list */
++	struct list_head d_child;	/* child of parent list */
++	struct list_head d_subdirs;	/* our children */
+ 	/*
+-	 * d_child and d_rcu can share memory
++	 * d_alias and d_rcu can share memory
+ 	 */
+ 	union {
+-		struct list_head d_child;	/* child of parent list */
++		struct hlist_node d_alias;	/* inode alias list */
+ 	 	struct rcu_head d_rcu;
+ 	} d_u;
+-	struct list_head d_subdirs;	/* our children */
+-	struct hlist_node d_alias;	/* inode alias list */
+ };
+ 
+ /*
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 46b8ab5..a7b311d 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1009,6 +1009,7 @@ static inline int page_mapped(struct page *page)
+ #define VM_FAULT_WRITE	0x0008	/* Special case for get_user_pages */
+ #define VM_FAULT_HWPOISON 0x0010	/* Hit poisoned small page */
+ #define VM_FAULT_HWPOISON_LARGE 0x0020  /* Hit poisoned large page. Index encoded in upper bits */
++#define VM_FAULT_SIGSEGV 0x0040
+ 
+ #define VM_FAULT_NOPAGE	0x0100	/* ->fault installed the pte, not return page */
+ #define VM_FAULT_LOCKED	0x0200	/* ->fault locked the returned page */
+@@ -1017,8 +1018,9 @@ static inline int page_mapped(struct page *page)
+ 
+ #define VM_FAULT_HWPOISON_LARGE_MASK 0xf000 /* encodes hpage index for large hwpoison */
+ 
+-#define VM_FAULT_ERROR	(VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_HWPOISON | \
+-			 VM_FAULT_FALLBACK | VM_FAULT_HWPOISON_LARGE)
++#define VM_FAULT_ERROR	(VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | \
++			 VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE | \
++			 VM_FAULT_FALLBACK)
+ 
+ /* Encode hstate index for a hwpoisoned large page */
+ #define VM_FAULT_SET_HINDEX(x) ((x) << 12)
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 911718f..bf46cc8 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1880,6 +1880,12 @@ void netdev_freemem(struct net_device *dev);
+ void synchronize_net(void);
+ int init_dummy_netdev(struct net_device *dev);
+ 
++DECLARE_PER_CPU(int, xmit_recursion);
++static inline int dev_recursion_level(void)
++{
++	return this_cpu_read(xmit_recursion);
++}
++
+ struct net_device *dev_get_by_index(struct net *net, int ifindex);
+ struct net_device *__dev_get_by_index(struct net *net, int ifindex);
+ struct net_device *dev_get_by_index_rcu(struct net *net, int ifindex);
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 218b058..91fe6a3 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1695,7 +1695,7 @@ static inline pid_t task_tgid_vnr(struct task_struct *tsk)
+ }
+ 
+ 
+-static int pid_alive(const struct task_struct *p);
++static inline int pid_alive(const struct task_struct *p);
+ static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns)
+ {
+ 	pid_t pid = 0;
+diff --git a/include/net/ip.h b/include/net/ip.h
+index 3446cdd..5128fa7 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -407,22 +407,6 @@ static __inline__ void inet_reset_saddr(struct sock *sk)
+ 
+ #endif
+ 
+-static inline int sk_mc_loop(struct sock *sk)
+-{
+-	if (!sk)
+-		return 1;
+-	switch (sk->sk_family) {
+-	case AF_INET:
+-		return inet_sk(sk)->mc_loop;
+-#if IS_ENABLED(CONFIG_IPV6)
+-	case AF_INET6:
+-		return inet6_sk(sk)->mc_loop;
+-#endif
+-	}
+-	WARN_ON(1);
+-	return 1;
+-}
+-
+ bool ip_call_ra_chain(struct sk_buff *skb);
+ 
+ /*
+diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
+index 2e74c6c..ee2d53a 100644
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -168,7 +168,8 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
+ 
+ static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
+ {
+-	struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
++	struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
++				inet6_sk(skb->sk) : NULL;
+ 
+ 	return (np && np->pmtudisc >= IPV6_PMTUDISC_PROBE) ?
+ 	       skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
+diff --git a/include/net/sock.h b/include/net/sock.h
+index f66b2b1..0c79a74 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1815,6 +1815,8 @@ struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie);
+ 
+ struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie);
+ 
++bool sk_mc_loop(struct sock *sk);
++
+ static inline bool sk_can_gso(const struct sock *sk)
+ {
+ 	return net_gso_ok(sk->sk_route_caps, sk->sk_gso_type);
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index 550e205..18711f3 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -971,7 +971,7 @@ static void cgroup_d_remove_dir(struct dentry *dentry)
+ 	parent = dentry->d_parent;
+ 	spin_lock(&parent->d_lock);
+ 	spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+-	list_del_init(&dentry->d_u.d_child);
++	list_del_init(&dentry->d_child);
+ 	spin_unlock(&dentry->d_lock);
+ 	spin_unlock(&parent->d_lock);
+ 	remove_dir(dentry);
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 813b021..a2d62b3 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -6158,7 +6158,7 @@ static int instance_mkdir (struct inode *inode, struct dentry *dentry, umode_t m
+ 	int ret;
+ 
+ 	/* Paranoid: Make sure the parent is the "instances" directory */
+-	parent = hlist_entry(inode->i_dentry.first, struct dentry, d_alias);
++	parent = hlist_entry(inode->i_dentry.first, struct dentry, d_u.d_alias);
+ 	if (WARN_ON_ONCE(parent != trace_instance_dir))
+ 		return -ENOENT;
+ 
+@@ -6185,7 +6185,7 @@ static int instance_rmdir(struct inode *inode, struct dentry *dentry)
+ 	int ret;
+ 
+ 	/* Paranoid: Make sure the parent is the "instances" directory */
+-	parent = hlist_entry(inode->i_dentry.first, struct dentry, d_alias);
++	parent = hlist_entry(inode->i_dentry.first, struct dentry, d_u.d_alias);
+ 	if (WARN_ON_ONCE(parent != trace_instance_dir))
+ 		return -ENOENT;
+ 
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index e4c4efc..c6646a5 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -428,7 +428,7 @@ static void remove_event_file_dir(struct ftrace_event_file *file)
+ 
+ 	if (dir) {
+ 		spin_lock(&dir->d_lock);	/* probably unneeded */
+-		list_for_each_entry(child, &dir->d_subdirs, d_u.d_child) {
++		list_for_each_entry(child, &dir->d_subdirs, d_child) {
+ 			if (child->d_inode)	/* probably unneeded */
+ 				child->d_inode->i_private = NULL;
+ 		}
+diff --git a/mm/ksm.c b/mm/ksm.c
+index 68710e8..5e706e3 100644
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -376,7 +376,7 @@ static int break_ksm(struct vm_area_struct *vma, unsigned long addr)
+ 		else
+ 			ret = VM_FAULT_WRITE;
+ 		put_page(page);
+-	} while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_OOM)));
++	} while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | VM_FAULT_OOM)));
+ 	/*
+ 	 * We must loop because handle_mm_fault() may back out if there's
+ 	 * any difficulty e.g. if pte accessed bit gets updated concurrently.
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index a98c7fc..ffc7bf0 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1645,8 +1645,6 @@ static int __soft_offline_page(struct page *page, int flags)
+ 			 * setting PG_hwpoison.
+ 			 */
+ 			if (!is_free_buddy_page(page))
+-				lru_add_drain_all();
+-			if (!is_free_buddy_page(page))
+ 				drain_all_pages();
+ 			SetPageHWPoison(page);
+ 			if (!is_free_buddy_page(page))
+diff --git a/mm/memory.c b/mm/memory.c
+index 102af09..749e1c6 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1836,7 +1836,8 @@ long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+ 						else
+ 							return -EFAULT;
+ 					}
+-					if (ret & VM_FAULT_SIGBUS)
++					if (ret & (VM_FAULT_SIGBUS |
++						   VM_FAULT_SIGSEGV))
+ 						return i ? i : -EFAULT;
+ 					BUG();
+ 				}
+@@ -1946,7 +1947,7 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
+ 			return -ENOMEM;
+ 		if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
+ 			return -EHWPOISON;
+-		if (ret & VM_FAULT_SIGBUS)
++		if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
+ 			return -EFAULT;
+ 		BUG();
+ 	}
+@@ -3235,7 +3236,7 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 
+ 	/* Check if we need to add a guard page to the stack */
+ 	if (check_stack_guard_page(vma, address) < 0)
+-		return VM_FAULT_SIGBUS;
++		return VM_FAULT_SIGSEGV;
+ 
+ 	/* Use the zero-page for reads */
+ 	if (!(flags & FAULT_FLAG_WRITE)) {
+diff --git a/net/core/dev.c b/net/core/dev.c
+index f6d8d7f..73abbd7 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2775,7 +2775,9 @@ static void skb_update_prio(struct sk_buff *skb)
+ #define skb_update_prio(skb)
+ #endif
+ 
+-static DEFINE_PER_CPU(int, xmit_recursion);
++DEFINE_PER_CPU(int, xmit_recursion);
++EXPORT_SYMBOL(xmit_recursion);
++
+ #define RECURSION_LIMIT 10
+ 
+ /**
+diff --git a/net/core/sock.c b/net/core/sock.c
+index c806956..650dd58 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -659,6 +659,25 @@ static inline void sock_valbool_flag(struct sock *sk, int bit, int valbool)
+ 		sock_reset_flag(sk, bit);
+ }
+ 
++bool sk_mc_loop(struct sock *sk)
++{
++	if (dev_recursion_level())
++		return false;
++	if (!sk)
++		return true;
++	switch (sk->sk_family) {
++	case AF_INET:
++		return inet_sk(sk)->mc_loop;
++#if IS_ENABLED(CONFIG_IPV6)
++	case AF_INET6:
++		return inet6_sk(sk)->mc_loop;
++#endif
++	}
++	WARN_ON(1);
++	return true;
++}
++EXPORT_SYMBOL(sk_mc_loop);
++
+ /*
+  *	This is meant for all protocols to use and covers goings on
+  *	at the socket level. Everything here is generic.
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 2291791..9fbd69e 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3064,10 +3064,11 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
+ 			if (seq_rtt < 0) {
+ 				seq_rtt = ca_seq_rtt;
+ 			}
+-			if (!(sacked & TCPCB_SACKED_ACKED))
++			if (!(sacked & TCPCB_SACKED_ACKED)) {
+ 				reord = min(pkts_acked, reord);
+-			if (!after(scb->end_seq, tp->high_seq))
+-				flag |= FLAG_ORIG_SACK_ACKED;
++				if (!after(scb->end_seq, tp->high_seq))
++					flag |= FLAG_ORIG_SACK_ACKED;
++			}
+ 		}
+ 
+ 		if (sacked & TCPCB_SACKED_ACKED)
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index b7effad..e2f8bd0 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -1875,7 +1875,7 @@ void tcp_v4_early_demux(struct sk_buff *skb)
+ 		skb->sk = sk;
+ 		skb->destructor = sock_edemux;
+ 		if (sk->sk_state != TCP_TIME_WAIT) {
+-			struct dst_entry *dst = sk->sk_rx_dst;
++			struct dst_entry *dst = ACCESS_ONCE(sk->sk_rx_dst);
+ 
+ 			if (dst)
+ 				dst = dst_check(dst, 0);
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 96f64e5..8c70c73 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2796,6 +2796,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
+ 	}
+ #endif
+ 
++	/* Do not fool tcpdump (if any), clean our debris */
++	skb->tstamp.tv64 = 0;
+ 	return skb;
+ }
+ EXPORT_SYMBOL(tcp_make_synack);
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index d7907ec..066d0b0 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -555,7 +555,8 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+ {
+ 	struct sk_buff *frag;
+ 	struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
+-	struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
++	struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
++				inet6_sk(skb->sk) : NULL;
+ 	struct ipv6hdr *tmp_hdr;
+ 	struct frag_hdr *fh;
+ 	unsigned int mtu, hlen, left, len;
+diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
+index 09a22f4..bcd6518 100644
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -1193,7 +1193,14 @@ static void ndisc_router_discovery(struct sk_buff *skb)
+ 	if (rt)
+ 		rt6_set_expires(rt, jiffies + (HZ * lifetime));
+ 	if (ra_msg->icmph.icmp6_hop_limit) {
+-		in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
++		/* Only set hop_limit on the interface if it is higher than
++		 * the current hop_limit.
++		 */
++		if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
++			in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
++		} else {
++			ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
++		}
+ 		if (rt)
+ 			dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
+ 				       ra_msg->icmph.icmp6_hop_limit);
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index a4f890d..9d4332d 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1633,7 +1633,7 @@ static void tcp_v6_early_demux(struct sk_buff *skb)
+ 		skb->sk = sk;
+ 		skb->destructor = sock_edemux;
+ 		if (sk->sk_state != TCP_TIME_WAIT) {
+-			struct dst_entry *dst = sk->sk_rx_dst;
++			struct dst_entry *dst = ACCESS_ONCE(sk->sk_rx_dst);
+ 
+ 			if (dst)
+ 				dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
+diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
+index d25f293..957c1db 100644
+--- a/net/netfilter/nf_conntrack_proto_generic.c
++++ b/net/netfilter/nf_conntrack_proto_generic.c
+@@ -14,6 +14,30 @@
+ 
+ static unsigned int nf_ct_generic_timeout __read_mostly = 600*HZ;
+ 
++static bool nf_generic_should_process(u8 proto)
++{
++	switch (proto) {
++#ifdef CONFIG_NF_CT_PROTO_SCTP_MODULE
++	case IPPROTO_SCTP:
++		return false;
++#endif
++#ifdef CONFIG_NF_CT_PROTO_DCCP_MODULE
++	case IPPROTO_DCCP:
++		return false;
++#endif
++#ifdef CONFIG_NF_CT_PROTO_GRE_MODULE
++	case IPPROTO_GRE:
++		return false;
++#endif
++#ifdef CONFIG_NF_CT_PROTO_UDPLITE_MODULE
++	case IPPROTO_UDPLITE:
++		return false;
++#endif
++	default:
++		return true;
++	}
++}
++
+ static inline struct nf_generic_net *generic_pernet(struct net *net)
+ {
+ 	return &net->ct.nf_ct_proto.generic;
+@@ -67,7 +91,7 @@ static int generic_packet(struct nf_conn *ct,
+ static bool generic_new(struct nf_conn *ct, const struct sk_buff *skb,
+ 			unsigned int dataoff, unsigned int *timeouts)
+ {
+-	return true;
++	return nf_generic_should_process(nf_ct_protonum(ct));
+ }
+ 
+ #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index 6c4cbd9..fc68bf6 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -1200,7 +1200,7 @@ static void sel_remove_entries(struct dentry *de)
+ 	spin_lock(&de->d_lock);
+ 	node = de->d_subdirs.next;
+ 	while (node != &de->d_subdirs) {
+-		struct dentry *d = list_entry(node, struct dentry, d_u.d_child);
++		struct dentry *d = list_entry(node, struct dentry, d_child);
+ 
+ 		spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED);
+ 		list_del_init(node);
+@@ -1674,12 +1674,12 @@ static void sel_remove_classes(void)
+ 
+ 	list_for_each(class_node, &class_dir->d_subdirs) {
+ 		struct dentry *class_subdir = list_entry(class_node,
+-					struct dentry, d_u.d_child);
++					struct dentry, d_child);
+ 		struct list_head *class_subdir_node;
+ 
+ 		list_for_each(class_subdir_node, &class_subdir->d_subdirs) {
+ 			struct dentry *d = list_entry(class_subdir_node,
+-						struct dentry, d_u.d_child);
++						struct dentry, d_child);
+ 
+ 			if (d->d_inode)
+ 				if (d->d_inode->i_mode & S_IFDIR)

diff --git a/3.14.39/4420_grsecurity-3.1-3.14.39-201504270826.patch b/3.14.40/4420_grsecurity-3.1-3.14.40-201504290821.patch
similarity index 99%
rename from 3.14.39/4420_grsecurity-3.1-3.14.39-201504270826.patch
rename to 3.14.40/4420_grsecurity-3.1-3.14.40-201504290821.patch
index 3fbeaa8..47246da 100644
--- a/3.14.39/4420_grsecurity-3.1-3.14.39-201504270826.patch
+++ b/3.14.40/4420_grsecurity-3.1-3.14.40-201504290821.patch
@@ -295,7 +295,7 @@ index 5d91ba1..ef1d374 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index b40845e..c9b79e2 100644
+index 070e0eb..e3359b0 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -703,7 +703,7 @@ index 1402fcc..0b1abd2 100644
  	return addr;
  }
 diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
-index 98838a0..b304fb4 100644
+index 9d0ac09..479a962 100644
 --- a/arch/alpha/mm/fault.c
 +++ b/arch/alpha/mm/fault.c
 @@ -53,6 +53,124 @@ __load_new_mm_context(struct mm_struct *next_mm)
@@ -2003,10 +2003,10 @@ index 219ac88..73ec32a 100644
   * These are the memory types, defined to be compatible with
   * pre-ARMv6 CPUs cacheable and bufferable bits:   XXCB
 diff --git a/arch/arm/include/asm/pgtable-3level-hwdef.h b/arch/arm/include/asm/pgtable-3level-hwdef.h
-index 626989f..9d67a33 100644
+index 9fd61c7..f8f1cff 100644
 --- a/arch/arm/include/asm/pgtable-3level-hwdef.h
 +++ b/arch/arm/include/asm/pgtable-3level-hwdef.h
-@@ -75,6 +75,7 @@
+@@ -76,6 +76,7 @@
  #define PTE_EXT_SHARED		(_AT(pteval_t, 3) << 8)		/* SH[1:0], inner shareable */
  #define PTE_EXT_AF		(_AT(pteval_t, 1) << 10)	/* Access Flag */
  #define PTE_EXT_NG		(_AT(pteval_t, 1) << 11)	/* nG */
@@ -2015,18 +2015,18 @@ index 626989f..9d67a33 100644
  
  /*
 diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h
-index 85c60ad..b0bbd7e 100644
+index 06e0bc0..e60c2d3 100644
 --- a/arch/arm/include/asm/pgtable-3level.h
 +++ b/arch/arm/include/asm/pgtable-3level.h
-@@ -82,6 +82,7 @@
- #define L_PTE_RDONLY		(_AT(pteval_t, 1) << 7)		/* AP[2] */
+@@ -81,6 +81,7 @@
+ #define L_PTE_USER		(_AT(pteval_t, 1) << 6)		/* AP[1] */
  #define L_PTE_SHARED		(_AT(pteval_t, 3) << 8)		/* SH[1:0], inner shareable */
  #define L_PTE_YOUNG		(_AT(pteval_t, 1) << 10)	/* AF */
 +#define L_PTE_PXN		(_AT(pteval_t, 1) << 53)	/* PXN */
  #define L_PTE_XN		(_AT(pteval_t, 1) << 54)	/* XN */
- #define L_PTE_DIRTY		(_AT(pteval_t, 1) << 55)	/* unused */
- #define L_PTE_SPECIAL		(_AT(pteval_t, 1) << 56)	/* unused */
-@@ -95,6 +96,7 @@
+ #define L_PTE_DIRTY		(_AT(pteval_t, 1) << 55)
+ #define L_PTE_SPECIAL		(_AT(pteval_t, 1) << 56)
+@@ -96,6 +97,7 @@
  /*
   * To be used in assembly code with the upper page attributes.
   */
@@ -2035,7 +2035,7 @@ index 85c60ad..b0bbd7e 100644
  #define L_PTE_DIRTY_HIGH	(1 << (55 - 32))
  
 diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
-index 7d59b52..27a12f8 100644
+index 89dba13..ca1cf20 100644
 --- a/arch/arm/include/asm/pgtable.h
 +++ b/arch/arm/include/asm/pgtable.h
 @@ -33,6 +33,9 @@
@@ -2118,7 +2118,7 @@ index 7d59b52..27a12f8 100644
   */
  #define _L_PTE_DEFAULT	L_PTE_PRESENT | L_PTE_YOUNG
  
-@@ -262,7 +310,7 @@ static inline pte_t pte_mkspecial(pte_t pte) { return pte; }
+@@ -266,7 +314,7 @@ static inline pte_t pte_mkspecial(pte_t pte) { return pte; }
  static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
  {
  	const pteval_t mask = L_PTE_XN | L_PTE_RDONLY | L_PTE_USER |
@@ -4884,7 +4884,7 @@ index 479330b..53717a8 100644
  
  #endif /* __ASM_AVR32_KMAP_TYPES_H */
 diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
-index 0eca933..eb78c7b 100644
+index d223a8b..69c5210 100644
 --- a/arch/avr32/mm/fault.c
 +++ b/arch/avr32/mm/fault.c
 @@ -41,6 +41,23 @@ static inline int notify_page_fault(struct pt_regs *regs, int trap)
@@ -4911,7 +4911,7 @@ index 0eca933..eb78c7b 100644
  /*
   * This routine handles page faults. It determines the address and the
   * problem, and then passes it off to one of the appropriate routines.
-@@ -176,6 +193,16 @@ bad_area:
+@@ -178,6 +195,16 @@ bad_area:
  	up_read(&mm->mmap_sem);
  
  	if (user_mode(regs)) {
@@ -5473,7 +5473,7 @@ index 84f8a52..7c76178 100644
  	 * ensure percpu data fits
  	 * into percpu page size
 diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
-index 7225dad..2a7c8256 100644
+index ba5ba7a..36e9d3a 100644
 --- a/arch/ia64/mm/fault.c
 +++ b/arch/ia64/mm/fault.c
 @@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned long address)
@@ -7213,7 +7213,7 @@ index 897c605..c421760 100644
  	int ret;
  
 diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
-index becc42b..9e43d4b 100644
+index 70ab5d6..62940fe 100644
 --- a/arch/mips/mm/fault.c
 +++ b/arch/mips/mm/fault.c
 @@ -28,6 +28,23 @@
@@ -7240,7 +7240,7 @@ index becc42b..9e43d4b 100644
  /*
   * This routine handles page faults.  It determines the address,
   * and the problem, and then passes it off to one of the appropriate
-@@ -199,6 +216,14 @@ bad_area:
+@@ -201,6 +218,14 @@ bad_area:
  bad_area_nosemaphore:
  	/* User mode accesses just cause a SIGSEGV */
  	if (user_mode(regs)) {
@@ -7866,7 +7866,7 @@ index 47ee620..1107387 100644
  				fault_space = regs->iasq[0];
  
 diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
-index d72197f..c017c84 100644
+index d27e388..addd2dc 100644
 --- a/arch/parisc/mm/fault.c
 +++ b/arch/parisc/mm/fault.c
 @@ -15,6 +15,7 @@
@@ -8962,7 +8962,7 @@ index 5eea6f3..5d10396 100644
  EXPORT_SYMBOL(copy_in_user);
  
 diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
-index 51ab9e7..7d3c78b 100644
+index 010fabf..e5c18a4 100644
 --- a/arch/powerpc/mm/fault.c
 +++ b/arch/powerpc/mm/fault.c
 @@ -33,6 +33,10 @@
@@ -9037,7 +9037,7 @@ index 51ab9e7..7d3c78b 100644
  			goto bad_area;
  #endif /* CONFIG_PPC_STD_MMU */
  
-@@ -483,6 +514,23 @@ bad_area:
+@@ -485,6 +516,23 @@ bad_area:
  bad_area_nosemaphore:
  	/* User mode accesses cause a SIGSEGV */
  	if (user_mode(regs)) {
@@ -11200,7 +11200,7 @@ index 30c3ecc..736f015 100644
  obj-$(CONFIG_SPARC64)   += ultra.o tlb.o tsb.o gup.o
  obj-y                   += fault_$(BITS).o
 diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
-index 59dbd46..1dd7f5e 100644
+index 163c787..6f9ee6c 100644
 --- a/arch/sparc/mm/fault_32.c
 +++ b/arch/sparc/mm/fault_32.c
 @@ -21,6 +21,9 @@
@@ -11517,7 +11517,7 @@ index 59dbd46..1dd7f5e 100644
  		if (!(vma->vm_flags & (VM_READ | VM_EXEC)))
  			goto bad_area;
 diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
-index 45a413e..fff0231 100644
+index 0d6de79..32851cb 100644
 --- a/arch/sparc/mm/fault_64.c
 +++ b/arch/sparc/mm/fault_64.c
 @@ -22,6 +22,9 @@
@@ -28725,63 +28725,10 @@ index c697625..a032162 100644
  
  out:
 diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index 09651d4..cdb8f22 100644
+index cf1eeea..cdb8f22 100644
 --- a/arch/x86/kvm/emulate.c
 +++ b/arch/x86/kvm/emulate.c
-@@ -2258,7 +2258,7 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
- 	 * Not recognized on AMD in compat mode (but is recognized in legacy
- 	 * mode).
- 	 */
--	if ((ctxt->mode == X86EMUL_MODE_PROT32) && (efer & EFER_LMA)
-+	if ((ctxt->mode != X86EMUL_MODE_PROT64) && (efer & EFER_LMA)
- 	    && !vendor_intel(ctxt))
- 		return emulate_ud(ctxt);
- 
-@@ -2271,25 +2271,13 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
- 	setup_syscalls_segments(ctxt, &cs, &ss);
- 
- 	ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data);
--	switch (ctxt->mode) {
--	case X86EMUL_MODE_PROT32:
--		if ((msr_data & 0xfffc) == 0x0)
--			return emulate_gp(ctxt, 0);
--		break;
--	case X86EMUL_MODE_PROT64:
--		if (msr_data == 0x0)
--			return emulate_gp(ctxt, 0);
--		break;
--	default:
--		break;
--	}
-+	if ((msr_data & 0xfffc) == 0x0)
-+		return emulate_gp(ctxt, 0);
- 
- 	ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
--	cs_sel = (u16)msr_data;
--	cs_sel &= ~SELECTOR_RPL_MASK;
-+	cs_sel = (u16)msr_data & ~SELECTOR_RPL_MASK;
- 	ss_sel = cs_sel + 8;
--	ss_sel &= ~SELECTOR_RPL_MASK;
--	if (ctxt->mode == X86EMUL_MODE_PROT64 || (efer & EFER_LMA)) {
-+	if (efer & EFER_LMA) {
- 		cs.d = 0;
- 		cs.l = 1;
- 	}
-@@ -2298,10 +2286,11 @@ static int em_sysenter(struct x86_emulate_ctxt *ctxt)
- 	ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
- 
- 	ops->get_msr(ctxt, MSR_IA32_SYSENTER_EIP, &msr_data);
--	ctxt->_eip = msr_data;
-+	ctxt->_eip = (efer & EFER_LMA) ? msr_data : (u32)msr_data;
- 
- 	ops->get_msr(ctxt, MSR_IA32_SYSENTER_ESP, &msr_data);
--	*reg_write(ctxt, VCPU_REGS_RSP) = msr_data;
-+	*reg_write(ctxt, VCPU_REGS_RSP) = (efer & EFER_LMA) ? msr_data :
-+							      (u32)msr_data;
- 
- 	return X86EMUL_CONTINUE;
- }
-@@ -3401,7 +3390,7 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
+@@ -3390,7 +3390,7 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
  	int cr = ctxt->modrm_reg;
  	u64 efer = 0;
  
@@ -28790,7 +28737,7 @@ index 09651d4..cdb8f22 100644
  		0xffffffff00000000ULL,
  		0, 0, 0, /* CR3 checked later */
  		CR4_RESERVED_BITS,
-@@ -3436,7 +3425,7 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
+@@ -3425,7 +3425,7 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
  
  		ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
  		if (efer & EFER_LMA)
@@ -28799,7 +28746,7 @@ index 09651d4..cdb8f22 100644
  		else if (ctxt->ops->get_cr(ctxt, 4) & X86_CR4_PAE)
  			rsvd = CR3_PAE_RESERVED_BITS;
  		else if (ctxt->ops->get_cr(ctxt, 0) & X86_CR0_PG)
-@@ -3668,8 +3657,8 @@ static const struct opcode group5[] = {
+@@ -3657,8 +3657,8 @@ static const struct opcode group5[] = {
  };
  
  static const struct opcode group6[] = {
@@ -31927,7 +31874,7 @@ index 903ec1e..c4166b2 100644
  }
  
 diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
-index a10c8c7..35a5abb 100644
+index ebc551c..b8ee77e 100644
 --- a/arch/x86/mm/fault.c
 +++ b/arch/x86/mm/fault.c
 @@ -14,11 +14,18 @@
@@ -32172,7 +32119,7 @@ index a10c8c7..35a5abb 100644
  		/* Kernel addresses are always protection faults: */
  		if (address >= TASK_SIZE)
  			error_code |= PF_PROT;
-@@ -856,7 +968,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
+@@ -853,7 +965,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
  	if (fault & (VM_FAULT_HWPOISON|VM_FAULT_HWPOISON_LARGE)) {
  		printk(KERN_ERR
  	"MCE: Killing %s:%d due to hardware memory corruption fault at %lx\n",
@@ -32181,7 +32128,7 @@ index a10c8c7..35a5abb 100644
  		code = BUS_MCEERR_AR;
  	}
  #endif
-@@ -910,6 +1022,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
+@@ -905,6 +1017,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
  	return 1;
  }
  
@@ -32281,7 +32228,7 @@ index a10c8c7..35a5abb 100644
  /*
   * Handle a spurious fault caused by a stale TLB entry.
   *
-@@ -976,6 +1181,9 @@ int show_unhandled_signals = 1;
+@@ -971,6 +1176,9 @@ int show_unhandled_signals = 1;
  static inline int
  access_error(unsigned long error_code, struct vm_area_struct *vma)
  {
@@ -32291,7 +32238,7 @@ index a10c8c7..35a5abb 100644
  	if (error_code & PF_WRITE) {
  		/* write, present and write, not present: */
  		if (unlikely(!(vma->vm_flags & VM_WRITE)))
-@@ -1010,7 +1218,7 @@ static inline bool smap_violation(int error_code, struct pt_regs *regs)
+@@ -1005,7 +1213,7 @@ static inline bool smap_violation(int error_code, struct pt_regs *regs)
  	if (error_code & PF_USER)
  		return false;
  
@@ -32300,7 +32247,7 @@ index a10c8c7..35a5abb 100644
  		return false;
  
  	return true;
-@@ -1038,6 +1246,22 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code,
+@@ -1033,6 +1241,22 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code,
  	tsk = current;
  	mm = tsk->mm;
  
@@ -32323,7 +32270,7 @@ index a10c8c7..35a5abb 100644
  	/*
  	 * Detect and handle instructions that would cause a page fault for
  	 * both a tracked kernel page and a userspace page.
-@@ -1115,7 +1339,7 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code,
+@@ -1110,7 +1334,7 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code,
  	 * User-mode registers count as a user access even for any
  	 * potential system fault or CPU buglet:
  	 */
@@ -32332,7 +32279,7 @@ index a10c8c7..35a5abb 100644
  		local_irq_enable();
  		error_code |= PF_USER;
  		flags |= FAULT_FLAG_USER;
-@@ -1162,6 +1386,11 @@ retry:
+@@ -1157,6 +1381,11 @@ retry:
  		might_sleep();
  	}
  
@@ -32344,7 +32291,7 @@ index a10c8c7..35a5abb 100644
  	vma = find_vma(mm, address);
  	if (unlikely(!vma)) {
  		bad_area(regs, error_code, address);
-@@ -1173,18 +1402,24 @@ retry:
+@@ -1168,18 +1397,24 @@ retry:
  		bad_area(regs, error_code, address);
  		return;
  	}
@@ -32380,7 +32327,7 @@ index a10c8c7..35a5abb 100644
  	if (unlikely(expand_stack(vma, address))) {
  		bad_area(regs, error_code, address);
  		return;
-@@ -1296,3 +1531,292 @@ trace_do_page_fault(struct pt_regs *regs, unsigned long error_code)
+@@ -1292,3 +1527,292 @@ trace_do_page_fault(struct pt_regs *regs, unsigned long error_code)
  	exception_exit(prev_state);
  }
  #endif /* CONFIG_TRACING */
@@ -48025,7 +47972,7 @@ index c05b66d..ed69872 100644
  	break;
      }
 diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
-index 80bfa03..1114364 100644
+index 075e7e7..1dbbe03 100644
 --- a/drivers/net/ethernet/emulex/benet/be_main.c
 +++ b/drivers/net/ethernet/emulex/benet/be_main.c
 @@ -534,7 +534,7 @@ static void accumulate_16bit_val(u32 *acc, u16 val)
@@ -48261,7 +48208,7 @@ index 7763962..c3499a7 100644
  	struct qlcnic_hardware_context *ahw;
  	void *temp_buffer;
 diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
-index 3ff7bc3..366091b 100644
+index 90c14d1..3bd4467 100644
 --- a/drivers/net/ethernet/realtek/r8169.c
 +++ b/drivers/net/ethernet/realtek/r8169.c
 @@ -758,22 +758,22 @@ struct rtl8169_private {
@@ -52400,7 +52347,7 @@ index 52b7731..d604da0 100644
  				     strlen(filename), mode, LUSTRE_OPC_MKDIR,
  				     lump);
 diff --git a/drivers/staging/lustre/lustre/llite/llite_lib.c b/drivers/staging/lustre/lustre/llite/llite_lib.c
-index 6cfdb9e..1ddab59 100644
+index 5ae562e..6b661ff 100644
 --- a/drivers/staging/lustre/lustre/llite/llite_lib.c
 +++ b/drivers/staging/lustre/lustre/llite/llite_lib.c
 @@ -576,7 +576,7 @@ static int client_common_fill_super(struct super_block *sb, char *md, char *dt,
@@ -59982,7 +59929,7 @@ index ebaff36..7e3ea26 100644
  			kunmap(page);
  			file_end_write(file);
 diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
-index 5e0982a..ca18377 100644
+index 18e14cf..9ca3e26 100644
 --- a/fs/ceph/dir.c
 +++ b/fs/ceph/dir.c
 @@ -128,6 +128,8 @@ static int __dcache_readdir(struct file *file, struct dir_context *ctx)
@@ -60529,7 +60476,7 @@ index 43eb136..f17e718 100644
  	return rc;
  }
 diff --git a/fs/coda/cache.c b/fs/coda/cache.c
-index 1da168c..8bc7ff6 100644
+index 9bc1147..fd15753 100644
 --- a/fs/coda/cache.c
 +++ b/fs/coda/cache.c
 @@ -24,7 +24,7 @@
@@ -60885,13 +60832,13 @@ index a93f7e6..d58bcbe 100644
  		return 0;
  	while (nr) {
 diff --git a/fs/dcache.c b/fs/dcache.c
-index 4366127..b8c2cf9 100644
+index c345f5f..abbda68 100644
 --- a/fs/dcache.c
 +++ b/fs/dcache.c
 @@ -250,7 +250,7 @@ static void __d_free(struct rcu_head *head)
-  */
  static void d_free(struct dentry *dentry)
  {
+ 	WARN_ON(!hlist_unhashed(&dentry->d_u.d_alias));
 -	BUG_ON((int)dentry->d_lockref.count > 0);
 +	BUG_ON((int)__lockref_read(&dentry->d_lockref) > 0);
  	this_cpu_dec(nr_dentry);
@@ -60937,7 +60884,7 @@ index 4366127..b8c2cf9 100644
  }
 @@ -792,7 +792,7 @@ restart:
  	spin_lock(&inode->i_lock);
- 	hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
+ 	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
  		spin_lock(&dentry->d_lock);
 -		if (!dentry->d_lockref.count) {
 +		if (!__lockref_read(&dentry->d_lockref)) {
@@ -61068,7 +61015,7 @@ index 4366127..b8c2cf9 100644
  	dcache_init();
  	inode_init();
 diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
-index 1ff8fe5..31407fe 100644
+index 4a9f0e0..54ea0cc 100644
 --- a/fs/debugfs/inode.c
 +++ b/fs/debugfs/inode.c
 @@ -422,10 +422,20 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
@@ -64443,13 +64390,13 @@ index 4d45705..b35e0bd 100644
  		free_page((unsigned long)page);
  }
 diff --git a/fs/libfs.c b/fs/libfs.c
-index a184424..944ddce 100644
+index 868c0b7..1831f93 100644
 --- a/fs/libfs.c
 +++ b/fs/libfs.c
 @@ -159,6 +159,9 @@ int dcache_readdir(struct file *file, struct dir_context *ctx)
  
  	for (p = q->next; p != &dentry->d_subdirs; p = p->next) {
- 		struct dentry *next = list_entry(p, struct dentry, d_u.d_child);
+ 		struct dentry *next = list_entry(p, struct dentry, d_child);
 +		char d_name[sizeof(next->d_iname)];
 +		const unsigned char *name;
 +
@@ -67616,7 +67563,7 @@ index dbd0272..3cd5915 100644
  	seq_printf(p, "softirq %llu", (unsigned long long)sum_softirq);
  
 diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index c254671..c09368e 100644
+index eaa7374..c531bc5 100644
 --- a/fs/proc/task_mmu.c
 +++ b/fs/proc/task_mmu.c
 @@ -13,12 +13,19 @@
@@ -67783,7 +67730,7 @@ index c254671..c09368e 100644
  		   mss.resident >> 10,
  		   (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
  		   mss.shared_clean  >> 10,
-@@ -1391,6 +1442,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
+@@ -1414,6 +1465,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
  	char buffer[64];
  	int nid;
  
@@ -67797,7 +67744,7 @@ index c254671..c09368e 100644
  	if (!mm)
  		return 0;
  
-@@ -1408,11 +1466,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
+@@ -1431,11 +1489,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
  	mpol_to_str(buffer, sizeof(buffer), pol);
  	mpol_cond_put(pol);
  
@@ -82261,7 +82208,7 @@ index 653589e..4ef254a 100644
  	return c | 0x20;
  }
 diff --git a/include/linux/dcache.h b/include/linux/dcache.h
-index 3b50cac..a3b0c8a 100644
+index 0f0eb1c..776283e 100644
 --- a/include/linux/dcache.h
 +++ b/include/linux/dcache.h
 @@ -123,6 +123,9 @@ struct dentry {
@@ -82272,12 +82219,12 @@ index 3b50cac..a3b0c8a 100644
 +	atomic_t chroot_refcnt;		/* tracks use of directory in chroot */
 +#endif
  	struct list_head d_lru;		/* LRU list */
- 	/*
- 	 * d_child and d_rcu can share memory
+ 	struct list_head d_child;	/* child of parent list */
+ 	struct list_head d_subdirs;	/* our children */
 @@ -133,7 +136,7 @@ struct dentry {
+ 		struct hlist_node d_alias;	/* inode alias list */
+ 	 	struct rcu_head d_rcu;
  	} d_u;
- 	struct list_head d_subdirs;	/* our children */
- 	struct hlist_node d_alias;	/* inode alias list */
 -};
 +} __randomize_layout;
  
@@ -84751,7 +84698,7 @@ index 5bba088..7ad4ae7 100644
  static inline int
  vma_dup_policy(struct vm_area_struct *src, struct vm_area_struct *dst)
 diff --git a/include/linux/mm.h b/include/linux/mm.h
-index 46b8ab5..6823be2 100644
+index a7b311d..5aef73c 100644
 --- a/include/linux/mm.h
 +++ b/include/linux/mm.h
 @@ -127,6 +127,11 @@ extern unsigned int kobjsize(const void *objp);
@@ -84794,7 +84741,7 @@ index 46b8ab5..6823be2 100644
  static inline void compound_lock(struct page *page)
  {
  #ifdef CONFIG_TRANSPARENT_HUGEPAGE
-@@ -1120,8 +1128,8 @@ int follow_pfn(struct vm_area_struct *vma, unsigned long address,
+@@ -1122,8 +1130,8 @@ int follow_pfn(struct vm_area_struct *vma, unsigned long address,
  	unsigned long *pfn);
  int follow_phys(struct vm_area_struct *vma, unsigned long address,
  		unsigned int flags, unsigned long *prot, resource_size_t *phys);
@@ -84805,7 +84752,7 @@ index 46b8ab5..6823be2 100644
  
  static inline void unmap_shared_mapping_range(struct address_space *mapping,
  		loff_t const holebegin, loff_t const holelen)
-@@ -1161,9 +1169,9 @@ static inline int fixup_user_fault(struct task_struct *tsk,
+@@ -1163,9 +1171,9 @@ static inline int fixup_user_fault(struct task_struct *tsk,
  }
  #endif
  
@@ -84818,7 +84765,7 @@ index 46b8ab5..6823be2 100644
  
  long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
  		      unsigned long start, unsigned long nr_pages,
-@@ -1195,34 +1203,6 @@ int set_page_dirty(struct page *page);
+@@ -1197,34 +1205,6 @@ int set_page_dirty(struct page *page);
  int set_page_dirty_lock(struct page *page);
  int clear_page_dirty_for_io(struct page *page);
  
@@ -84853,7 +84800,7 @@ index 46b8ab5..6823be2 100644
  extern pid_t
  vm_is_stack(struct task_struct *task, struct vm_area_struct *vma, int in_group);
  
-@@ -1322,6 +1302,15 @@ static inline void sync_mm_rss(struct mm_struct *mm)
+@@ -1324,6 +1304,15 @@ static inline void sync_mm_rss(struct mm_struct *mm)
  }
  #endif
  
@@ -84869,7 +84816,7 @@ index 46b8ab5..6823be2 100644
  int vma_wants_writenotify(struct vm_area_struct *vma);
  
  extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
-@@ -1340,8 +1329,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd,
+@@ -1342,8 +1331,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd,
  {
  	return 0;
  }
@@ -84885,7 +84832,7 @@ index 46b8ab5..6823be2 100644
  #endif
  
  #ifdef __PAGETABLE_PMD_FOLDED
-@@ -1350,8 +1346,15 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud,
+@@ -1352,8 +1348,15 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud,
  {
  	return 0;
  }
@@ -84901,7 +84848,7 @@ index 46b8ab5..6823be2 100644
  #endif
  
  int __pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
-@@ -1369,11 +1372,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a
+@@ -1371,11 +1374,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a
  		NULL: pud_offset(pgd, address);
  }
  
@@ -84925,7 +84872,7 @@ index 46b8ab5..6823be2 100644
  #endif /* CONFIG_MMU && !__ARCH_HAS_4LEVEL_HACK */
  
  #if USE_SPLIT_PTE_PTLOCKS
-@@ -1763,7 +1778,7 @@ extern int install_special_mapping(struct mm_struct *mm,
+@@ -1765,7 +1780,7 @@ extern int install_special_mapping(struct mm_struct *mm,
  				   unsigned long addr, unsigned long len,
  				   unsigned long flags, struct page **pages);
  
@@ -84934,7 +84881,7 @@ index 46b8ab5..6823be2 100644
  
  extern unsigned long mmap_region(struct file *file, unsigned long addr,
  	unsigned long len, vm_flags_t vm_flags, unsigned long pgoff);
-@@ -1771,6 +1786,7 @@ extern unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1773,6 +1788,7 @@ extern unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
  	unsigned long len, unsigned long prot, unsigned long flags,
  	unsigned long pgoff, unsigned long *populate);
  extern int do_munmap(struct mm_struct *, unsigned long, size_t);
@@ -84942,7 +84889,7 @@ index 46b8ab5..6823be2 100644
  
  #ifdef CONFIG_MMU
  extern int __mm_populate(unsigned long addr, unsigned long len,
-@@ -1799,10 +1815,11 @@ struct vm_unmapped_area_info {
+@@ -1801,10 +1817,11 @@ struct vm_unmapped_area_info {
  	unsigned long high_limit;
  	unsigned long align_mask;
  	unsigned long align_offset;
@@ -84956,7 +84903,7 @@ index 46b8ab5..6823be2 100644
  
  /*
   * Search for an unmapped address range.
-@@ -1814,7 +1831,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info);
+@@ -1816,7 +1833,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info);
   * - satisfies (begin_addr & align_mask) == (align_offset & align_mask)
   */
  static inline unsigned long
@@ -84965,7 +84912,7 @@ index 46b8ab5..6823be2 100644
  {
  	if (!(info->flags & VM_UNMAPPED_AREA_TOPDOWN))
  		return unmapped_area(info);
-@@ -1874,6 +1891,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
+@@ -1876,6 +1893,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
  extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
  					     struct vm_area_struct **pprev);
  
@@ -84976,7 +84923,7 @@ index 46b8ab5..6823be2 100644
  /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
     NULL if none.  Assume start_addr < end_addr. */
  static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
-@@ -1902,15 +1923,6 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
+@@ -1904,15 +1925,6 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
  	return vma;
  }
  
@@ -84992,7 +84939,7 @@ index 46b8ab5..6823be2 100644
  #ifdef CONFIG_NUMA_BALANCING
  unsigned long change_prot_numa(struct vm_area_struct *vma,
  			unsigned long start, unsigned long end);
-@@ -1962,6 +1974,11 @@ void vm_stat_account(struct mm_struct *, unsigned long, struct file *, long);
+@@ -1964,6 +1976,11 @@ void vm_stat_account(struct mm_struct *, unsigned long, struct file *, long);
  static inline void vm_stat_account(struct mm_struct *mm,
  			unsigned long flags, struct file *file, long pages)
  {
@@ -85004,7 +84951,7 @@ index 46b8ab5..6823be2 100644
  	mm->total_vm += pages;
  }
  #endif /* CONFIG_PROC_FS */
-@@ -2043,7 +2060,7 @@ extern int unpoison_memory(unsigned long pfn);
+@@ -2045,7 +2062,7 @@ extern int unpoison_memory(unsigned long pfn);
  extern int sysctl_memory_failure_early_kill;
  extern int sysctl_memory_failure_recovery;
  extern void shake_page(struct page *p, int access);
@@ -85013,7 +84960,7 @@ index 46b8ab5..6823be2 100644
  extern int soft_offline_page(struct page *page, int flags);
  
  #if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_HUGETLBFS)
-@@ -2078,5 +2095,11 @@ void __init setup_nr_node_ids(void);
+@@ -2080,5 +2097,11 @@ void __init setup_nr_node_ids(void);
  static inline void setup_nr_node_ids(void) {}
  #endif
  
@@ -85391,7 +85338,7 @@ index 17d8339..81656c0 100644
  struct iovec;
  struct kvec;
 diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
-index 911718f..f673407 100644
+index bf46cc8..2af7ba8 100644
 --- a/include/linux/netdevice.h
 +++ b/include/linux/netdevice.h
 @@ -1147,6 +1147,7 @@ struct net_device_ops {
@@ -86197,7 +86144,7 @@ index a964f72..b475afb 100644
  }
  
 diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 218b058..30088db 100644
+index 91fe6a3..30088db 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
 @@ -133,6 +133,7 @@ struct fs_struct;
@@ -86452,15 +86399,6 @@ index 218b058..30088db 100644
  {
  	return tsk->pid;
  }
-@@ -1695,7 +1809,7 @@ static inline pid_t task_tgid_vnr(struct task_struct *tsk)
- }
- 
- 
--static int pid_alive(const struct task_struct *p);
-+static inline int pid_alive(const struct task_struct *p);
- static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns)
- {
- 	pid_t pid = 0;
 @@ -2015,6 +2129,25 @@ extern u64 sched_clock_cpu(int cpu);
  
  extern void sched_clock_init(void);
@@ -87796,7 +87734,7 @@ index 823ec7b..44c938c 100644
  		struct rcu_head         rcu;
  		struct inet_peer	*gc_next;
 diff --git a/include/net/ip.h b/include/net/ip.h
-index 3446cdd..e3d86f4 100644
+index 5128fa7..8814c81 100644
 --- a/include/net/ip.h
 +++ b/include/net/ip.h
 @@ -215,7 +215,7 @@ static inline void snmp_mib_free(void __percpu *ptr[SNMP_ARRAY_SZ])
@@ -88267,7 +88205,7 @@ index 0dfcc92..7967849 100644
  
  /* Structure to track chunk fragments that have been acked, but peer
 diff --git a/include/net/sock.h b/include/net/sock.h
-index f66b2b1..b05a13e 100644
+index 0c79a74..862699f 100644
 --- a/include/net/sock.h
 +++ b/include/net/sock.h
 @@ -181,7 +181,8 @@ struct sock_common {
@@ -88324,7 +88262,7 @@ index f66b2b1..b05a13e 100644
  
  static inline struct sock_iocb *kiocb_to_siocb(struct kiocb *iocb)
  {
-@@ -1829,7 +1831,7 @@ static inline void sk_nocaps_add(struct sock *sk, netdev_features_t flags)
+@@ -1831,7 +1833,7 @@ static inline void sk_nocaps_add(struct sock *sk, netdev_features_t flags)
  }
  
  static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
@@ -88333,7 +88271,7 @@ index f66b2b1..b05a13e 100644
  					   int copy, int offset)
  {
  	if (skb->ip_summed == CHECKSUM_NONE) {
-@@ -2091,7 +2093,7 @@ static inline void sk_stream_moderate_sndbuf(struct sock *sk)
+@@ -2093,7 +2095,7 @@ static inline void sk_stream_moderate_sndbuf(struct sock *sk)
  	}
  }
  
@@ -89966,7 +89904,7 @@ index 00adb21..d5954a8 100644
 +}
 +EXPORT_SYMBOL(capable_wrt_inode_uidgid_nolog);
 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 550e205..b0a7f7d 100644
+index 18711f3..a8e4c7b 100644
 --- a/kernel/cgroup.c
 +++ b/kernel/cgroup.c
 @@ -5189,6 +5189,14 @@ static void cgroup_release_agent(struct work_struct *work)
@@ -95763,7 +95701,7 @@ index 774a080..d09b170 100644
  		*data_page = bpage;
  
 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index 813b021..cdd1400 100644
+index a2d62b3..1997260 100644
 --- a/kernel/trace/trace.c
 +++ b/kernel/trace/trace.c
 @@ -3412,7 +3412,7 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
@@ -95809,7 +95747,7 @@ index 57b67b1..66082a9 100644
 +	return atomic64_inc_return_unchecked(&trace_counter);
  }
 diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
-index e4c4efc..ef4e975 100644
+index c6646a5..574b47c 100644
 --- a/kernel/trace/trace_events.c
 +++ b/kernel/trace/trace_events.c
 @@ -1682,7 +1682,6 @@ __trace_early_add_new_event(struct ftrace_event_call *call,
@@ -97415,7 +97353,7 @@ index a402f8f..f5e5daa 100644
  	if (end == start)
  		return error;
 diff --git a/mm/memory-failure.c b/mm/memory-failure.c
-index a98c7fc..393f8f1 100644
+index ffc7bf0..b9105bd 100644
 --- a/mm/memory-failure.c
 +++ b/mm/memory-failure.c
 @@ -61,7 +61,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0;
@@ -97521,7 +97459,7 @@ index a98c7fc..393f8f1 100644
  		return 0;
  	}
  
-@@ -1652,7 +1652,7 @@ static int __soft_offline_page(struct page *page, int flags)
+@@ -1650,7 +1650,7 @@ static int __soft_offline_page(struct page *page, int flags)
  			if (!is_free_buddy_page(page))
  				pr_info("soft offline: %#lx: page leaked\n",
  					pfn);
@@ -97530,7 +97468,7 @@ index a98c7fc..393f8f1 100644
  		}
  	} else {
  		pr_info("soft offline: %#lx: isolation failed: %d, page count %d, type %lx\n",
-@@ -1726,11 +1726,11 @@ int soft_offline_page(struct page *page, int flags)
+@@ -1724,11 +1724,11 @@ int soft_offline_page(struct page *page, int flags)
  		if (PageHuge(page)) {
  			set_page_hwpoison_huge_page(hpage);
  			dequeue_hwpoisoned_huge_page(hpage);
@@ -97545,7 +97483,7 @@ index a98c7fc..393f8f1 100644
  	}
  	unset_migratetype_isolate(page, MIGRATE_MOVABLE);
 diff --git a/mm/memory.c b/mm/memory.c
-index 102af09..4118c57 100644
+index 749e1c6..f7fbc29 100644
 --- a/mm/memory.c
 +++ b/mm/memory.c
 @@ -403,6 +403,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
@@ -97654,7 +97592,7 @@ index 102af09..4118c57 100644
  				if (foll_flags & FOLL_WRITE)
  					fault_flags |= FAULT_FLAG_WRITE;
  				if (nonblocking)
-@@ -1893,7 +1890,7 @@ next_page:
+@@ -1894,7 +1891,7 @@ next_page:
  			start += page_increm * PAGE_SIZE;
  			nr_pages -= page_increm;
  		} while (nr_pages && start < vma->vm_end);
@@ -97663,7 +97601,7 @@ index 102af09..4118c57 100644
  	return i;
  }
  EXPORT_SYMBOL(__get_user_pages);
-@@ -2105,6 +2102,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
+@@ -2106,6 +2103,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
  	page_add_file_rmap(page);
  	set_pte_at(mm, addr, pte, mk_pte(page, prot));
  
@@ -97674,7 +97612,7 @@ index 102af09..4118c57 100644
  	retval = 0;
  	pte_unmap_unlock(pte, ptl);
  	return retval;
-@@ -2149,9 +2150,21 @@ int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
+@@ -2150,9 +2151,21 @@ int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
  	if (!page_count(page))
  		return -EINVAL;
  	if (!(vma->vm_flags & VM_MIXEDMAP)) {
@@ -97696,7 +97634,7 @@ index 102af09..4118c57 100644
  	}
  	return insert_page(vma, addr, page, vma->vm_page_prot);
  }
-@@ -2234,6 +2247,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
+@@ -2235,6 +2248,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
  			unsigned long pfn)
  {
  	BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
@@ -97704,7 +97642,7 @@ index 102af09..4118c57 100644
  
  	if (addr < vma->vm_start || addr >= vma->vm_end)
  		return -EFAULT;
-@@ -2481,7 +2495,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
+@@ -2482,7 +2496,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
  
  	BUG_ON(pud_huge(*pud));
  
@@ -97715,7 +97653,7 @@ index 102af09..4118c57 100644
  	if (!pmd)
  		return -ENOMEM;
  	do {
-@@ -2501,7 +2517,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
+@@ -2502,7 +2518,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
  	unsigned long next;
  	int err;
  
@@ -97726,7 +97664,7 @@ index 102af09..4118c57 100644
  	if (!pud)
  		return -ENOMEM;
  	do {
-@@ -2591,6 +2609,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
+@@ -2592,6 +2610,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
  		copy_user_highpage(dst, src, va, vma);
  }
  
@@ -97913,7 +97851,7 @@ index 102af09..4118c57 100644
  /*
   * This routine handles present pages, when users try to write
   * to a shared page. It is done by copying the page to a new address
-@@ -2815,6 +3013,12 @@ gotten:
+@@ -2816,6 +3014,12 @@ gotten:
  	 */
  	page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
  	if (likely(pte_same(*page_table, orig_pte))) {
@@ -97926,7 +97864,7 @@ index 102af09..4118c57 100644
  		if (old_page) {
  			if (!PageAnon(old_page)) {
  				dec_mm_counter_fast(mm, MM_FILEPAGES);
-@@ -2866,6 +3070,10 @@ gotten:
+@@ -2867,6 +3071,10 @@ gotten:
  			page_remove_rmap(old_page);
  		}
  
@@ -97937,7 +97875,7 @@ index 102af09..4118c57 100644
  		/* Free the old page.. */
  		new_page = old_page;
  		ret |= VM_FAULT_WRITE;
-@@ -3143,6 +3351,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3144,6 +3352,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
  	swap_free(entry);
  	if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
  		try_to_free_swap(page);
@@ -97949,7 +97887,7 @@ index 102af09..4118c57 100644
  	unlock_page(page);
  	if (page != swapcache) {
  		/*
-@@ -3166,6 +3379,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3167,6 +3380,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
  
  	/* No need to invalidate - it was non-present before */
  	update_mmu_cache(vma, address, page_table);
@@ -97961,7 +97899,7 @@ index 102af09..4118c57 100644
  unlock:
  	pte_unmap_unlock(page_table, ptl);
  out:
-@@ -3185,40 +3403,6 @@ out_release:
+@@ -3186,40 +3404,6 @@ out_release:
  }
  
  /*
@@ -98002,7 +97940,7 @@ index 102af09..4118c57 100644
   * We enter with non-exclusive mmap_sem (to exclude vma changes,
   * but allow concurrent faults), and pte mapped but not yet locked.
   * We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -3227,27 +3411,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3228,27 +3412,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  		unsigned long address, pte_t *page_table, pmd_t *pmd,
  		unsigned int flags)
  {
@@ -98015,7 +97953,7 @@ index 102af09..4118c57 100644
 -
 -	/* Check if we need to add a guard page to the stack */
 -	if (check_stack_guard_page(vma, address) < 0)
--		return VM_FAULT_SIGBUS;
+-		return VM_FAULT_SIGSEGV;
 -
 -	/* Use the zero-page for reads */
  	if (!(flags & FAULT_FLAG_WRITE)) {
@@ -98035,7 +97973,7 @@ index 102af09..4118c57 100644
  	if (unlikely(anon_vma_prepare(vma)))
  		goto oom;
  	page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -3271,6 +3451,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3272,6 +3452,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  	if (!pte_none(*page_table))
  		goto release;
  
@@ -98047,7 +97985,7 @@ index 102af09..4118c57 100644
  	inc_mm_counter_fast(mm, MM_ANONPAGES);
  	page_add_new_anon_rmap(page, vma, address);
  setpte:
-@@ -3278,6 +3463,12 @@ setpte:
+@@ -3279,6 +3464,12 @@ setpte:
  
  	/* No need to invalidate - it was non-present before */
  	update_mmu_cache(vma, address, page_table);
@@ -98060,7 +97998,7 @@ index 102af09..4118c57 100644
  unlock:
  	pte_unmap_unlock(page_table, ptl);
  	return 0;
-@@ -3422,6 +3613,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3423,6 +3614,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	 */
  	/* Only go through if we didn't race with anybody else... */
  	if (likely(pte_same(*page_table, orig_pte))) {
@@ -98073,7 +98011,7 @@ index 102af09..4118c57 100644
  		flush_icache_page(vma, page);
  		entry = mk_pte(page, vma->vm_page_prot);
  		if (flags & FAULT_FLAG_WRITE)
-@@ -3443,6 +3640,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3444,6 +3641,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  
  		/* no need to invalidate: a not-present page won't be cached */
  		update_mmu_cache(vma, address, page_table);
@@ -98088,7 +98026,7 @@ index 102af09..4118c57 100644
  	} else {
  		if (cow_page)
  			mem_cgroup_uncharge_page(cow_page);
-@@ -3690,6 +3895,12 @@ static int handle_pte_fault(struct mm_struct *mm,
+@@ -3691,6 +3896,12 @@ static int handle_pte_fault(struct mm_struct *mm,
  		if (flags & FAULT_FLAG_WRITE)
  			flush_tlb_fix_spurious_fault(vma, address);
  	}
@@ -98101,7 +98039,7 @@ index 102af09..4118c57 100644
  unlock:
  	pte_unmap_unlock(pte, ptl);
  	return 0;
-@@ -3706,9 +3917,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3707,9 +3918,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	pmd_t *pmd;
  	pte_t *pte;
  
@@ -98143,7 +98081,7 @@ index 102af09..4118c57 100644
  	pgd = pgd_offset(mm, address);
  	pud = pud_alloc(mm, pgd, address);
  	if (!pud)
-@@ -3836,6 +4079,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+@@ -3837,6 +4080,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -98167,7 +98105,7 @@ index 102af09..4118c57 100644
  #endif /* __PAGETABLE_PUD_FOLDED */
  
  #ifndef __PAGETABLE_PMD_FOLDED
-@@ -3866,6 +4126,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+@@ -3867,6 +4127,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -98198,7 +98136,7 @@ index 102af09..4118c57 100644
  #endif /* __PAGETABLE_PMD_FOLDED */
  
  #if !defined(__HAVE_ARCH_GATE_AREA)
-@@ -3879,7 +4163,7 @@ static int __init gate_vma_init(void)
+@@ -3880,7 +4164,7 @@ static int __init gate_vma_init(void)
  	gate_vma.vm_start = FIXADDR_USER_START;
  	gate_vma.vm_end = FIXADDR_USER_END;
  	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
@@ -98207,7 +98145,7 @@ index 102af09..4118c57 100644
  
  	return 0;
  }
-@@ -4013,8 +4297,8 @@ out:
+@@ -4014,8 +4298,8 @@ out:
  	return ret;
  }
  
@@ -98218,7 +98156,7 @@ index 102af09..4118c57 100644
  {
  	resource_size_t phys_addr;
  	unsigned long prot = 0;
-@@ -4040,8 +4324,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
+@@ -4041,8 +4325,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
   * Access another process' address space as given in mm.  If non-NULL, use the
   * given task for page fault accounting.
   */
@@ -98229,7 +98167,7 @@ index 102af09..4118c57 100644
  {
  	struct vm_area_struct *vma;
  	void *old_buf = buf;
-@@ -4049,7 +4333,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -4050,7 +4334,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
  	down_read(&mm->mmap_sem);
  	/* ignore errors, just check how much was successfully transferred */
  	while (len) {
@@ -98238,7 +98176,7 @@ index 102af09..4118c57 100644
  		void *maddr;
  		struct page *page = NULL;
  
-@@ -4108,8 +4392,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -4109,8 +4393,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
   *
   * The caller must hold a reference on @mm.
   */
@@ -98249,7 +98187,7 @@ index 102af09..4118c57 100644
  {
  	return __access_remote_vm(NULL, mm, addr, buf, len, write);
  }
-@@ -4119,11 +4403,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+@@ -4120,11 +4404,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
   * Source/target buffer must be kernel space,
   * Do not walk the page table directly, use get_user_pages
   */
@@ -103018,7 +102956,7 @@ index a16ed7b..eb44d17 100644
  
  	return err;
 diff --git a/net/core/dev.c b/net/core/dev.c
-index f6d8d7f..846845c 100644
+index 73abbd7..1bae4ad 100644
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
 @@ -1695,14 +1695,14 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
@@ -103047,7 +102985,7 @@ index f6d8d7f..846845c 100644
  
  #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
  
-@@ -3238,7 +3238,7 @@ enqueue:
+@@ -3240,7 +3240,7 @@ enqueue:
  
  	local_irq_restore(flags);
  
@@ -103056,7 +102994,7 @@ index f6d8d7f..846845c 100644
  	kfree_skb(skb);
  	return NET_RX_DROP;
  }
-@@ -3319,7 +3319,7 @@ int netif_rx_ni(struct sk_buff *skb)
+@@ -3321,7 +3321,7 @@ int netif_rx_ni(struct sk_buff *skb)
  }
  EXPORT_SYMBOL(netif_rx_ni);
  
@@ -103065,7 +103003,7 @@ index f6d8d7f..846845c 100644
  {
  	struct softnet_data *sd = &__get_cpu_var(softnet_data);
  
-@@ -3656,7 +3656,7 @@ ncls:
+@@ -3658,7 +3658,7 @@ ncls:
  			ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
  	} else {
  drop:
@@ -103074,7 +103012,7 @@ index f6d8d7f..846845c 100644
  		kfree_skb(skb);
  		/* Jamal, now you will not able to escape explaining
  		 * me how you were going to use this. :-)
-@@ -4346,7 +4346,7 @@ void netif_napi_del(struct napi_struct *napi)
+@@ -4348,7 +4348,7 @@ void netif_napi_del(struct napi_struct *napi)
  }
  EXPORT_SYMBOL(netif_napi_del);
  
@@ -103083,7 +103021,7 @@ index f6d8d7f..846845c 100644
  {
  	struct softnet_data *sd = &__get_cpu_var(softnet_data);
  	unsigned long time_limit = jiffies + 2;
-@@ -5066,7 +5066,7 @@ void netdev_upper_dev_unlink(struct net_device *dev,
+@@ -5068,7 +5068,7 @@ void netdev_upper_dev_unlink(struct net_device *dev,
  }
  EXPORT_SYMBOL(netdev_upper_dev_unlink);
  
@@ -103092,7 +103030,7 @@ index f6d8d7f..846845c 100644
  {
  	struct netdev_adjacent *iter;
  
-@@ -5091,7 +5091,7 @@ void netdev_adjacent_add_links(struct net_device *dev)
+@@ -5093,7 +5093,7 @@ void netdev_adjacent_add_links(struct net_device *dev)
  	}
  }
  
@@ -103101,7 +103039,7 @@ index f6d8d7f..846845c 100644
  {
  	struct netdev_adjacent *iter;
  
-@@ -6376,7 +6376,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
+@@ -6378,7 +6378,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
  	} else {
  		netdev_stats_to_stats64(storage, &dev->stats);
  	}
@@ -103110,7 +103048,7 @@ index f6d8d7f..846845c 100644
  	return storage;
  }
  EXPORT_SYMBOL(dev_get_stats);
-@@ -6392,7 +6392,7 @@ struct netdev_queue *dev_ingress_queue_create(struct net_device *dev)
+@@ -6394,7 +6394,7 @@ struct netdev_queue *dev_ingress_queue_create(struct net_device *dev)
  	if (!queue)
  		return NULL;
  	netdev_init_one_queue(dev, queue, NULL);
@@ -103612,7 +103550,7 @@ index e2b1bba..71bd8fe 100644
  }
  
 diff --git a/net/core/sock.c b/net/core/sock.c
-index c806956..b63d825 100644
+index 650dd58..25162a5 100644
 --- a/net/core/sock.c
 +++ b/net/core/sock.c
 @@ -442,7 +442,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
@@ -103660,7 +103598,7 @@ index c806956..b63d825 100644
  		goto discard_and_relse;
  	}
  
-@@ -998,12 +998,12 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+@@ -1017,12 +1017,12 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
  		struct timeval tm;
  	} v;
  
@@ -103676,7 +103614,7 @@ index c806956..b63d825 100644
  		return -EINVAL;
  
  	memset(&v, 0, sizeof(v));
-@@ -1155,11 +1155,11 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+@@ -1174,11 +1174,11 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
  
  	case SO_PEERNAME:
  	{
@@ -103690,7 +103628,7 @@ index c806956..b63d825 100644
  			return -EINVAL;
  		if (copy_to_user(optval, address, len))
  			return -EFAULT;
-@@ -1240,7 +1240,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+@@ -1259,7 +1259,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
  
  	if (len > lv)
  		len = lv;
@@ -103699,7 +103637,7 @@ index c806956..b63d825 100644
  		return -EFAULT;
  lenout:
  	if (put_user(len, optlen))
-@@ -1731,6 +1731,8 @@ EXPORT_SYMBOL(sock_kmalloc);
+@@ -1750,6 +1750,8 @@ EXPORT_SYMBOL(sock_kmalloc);
   */
  void sock_kfree_s(struct sock *sk, void *mem, int size)
  {
@@ -103708,7 +103646,7 @@ index c806956..b63d825 100644
  	kfree(mem);
  	atomic_sub(size, &sk->sk_omem_alloc);
  }
-@@ -2375,7 +2377,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+@@ -2394,7 +2396,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
  	 */
  	smp_wmb();
  	atomic_set(&sk->sk_refcnt, 1);
@@ -103717,7 +103655,7 @@ index c806956..b63d825 100644
  }
  EXPORT_SYMBOL(sock_init_data);
  
-@@ -2503,6 +2505,7 @@ void sock_enable_timestamp(struct sock *sk, int flag)
+@@ -2522,6 +2524,7 @@ void sock_enable_timestamp(struct sock *sk, int flag)
  int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
  		       int level, int type)
  {
@@ -103725,7 +103663,7 @@ index c806956..b63d825 100644
  	struct sock_exterr_skb *serr;
  	struct sk_buff *skb, *skb2;
  	int copied, err;
-@@ -2524,7 +2527,8 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+@@ -2543,7 +2546,8 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
  	sock_recv_timestamp(msg, sk, skb);
  
  	serr = SKB_EXT_ERR(skb);
@@ -104904,7 +104842,7 @@ index 44eba05..b36864b 100644
  	hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table);
  	if (hdr == NULL)
 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index 2291791..7b62d2b 100644
+index 9fbd69e..285e21e 100644
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
 @@ -761,7 +761,7 @@ static void tcp_update_pacing_rate(struct sock *sk)
@@ -104916,7 +104854,7 @@ index 2291791..7b62d2b 100644
  						sk->sk_max_pacing_rate);
  }
  
-@@ -4482,7 +4482,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
+@@ -4483,7 +4483,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
   * simplifies code)
   */
  static void
@@ -104925,7 +104863,7 @@ index 2291791..7b62d2b 100644
  	     struct sk_buff *head, struct sk_buff *tail,
  	     u32 start, u32 end)
  {
-@@ -5559,6 +5559,7 @@ discard:
+@@ -5560,6 +5560,7 @@ discard:
  	    tcp_paws_reject(&tp->rx_opt, 0))
  		goto discard_and_undo;
  
@@ -104933,7 +104871,7 @@ index 2291791..7b62d2b 100644
  	if (th->syn) {
  		/* We see SYN without ACK. It is attempt of
  		 * simultaneous connect with crossed SYNs.
-@@ -5609,6 +5610,7 @@ discard:
+@@ -5610,6 +5611,7 @@ discard:
  		goto discard;
  #endif
  	}
@@ -104941,7 +104879,7 @@ index 2291791..7b62d2b 100644
  	/* "fifth, if neither of the SYN or RST bits is set then
  	 * drop the segment and return."
  	 */
-@@ -5655,7 +5657,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -5656,7 +5658,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  			goto discard;
  
  		if (th->syn) {
@@ -104951,7 +104889,7 @@ index 2291791..7b62d2b 100644
  			if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
  				return 1;
 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index b7effad..70ddfe0 100644
+index e2f8bd0..6c664ad 100644
 --- a/net/ipv4/tcp_ipv4.c
 +++ b/net/ipv4/tcp_ipv4.c
 @@ -91,6 +91,10 @@ int sysctl_tcp_low_latency __read_mostly;
@@ -105965,7 +105903,7 @@ index 7f405a1..eabef92 100644
  	struct ctl_table *ipv6_icmp_table;
  	int err;
 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index a4f890d..5db3708 100644
+index 9d4332d..4292595 100644
 --- a/net/ipv6/tcp_ipv6.c
 +++ b/net/ipv6/tcp_ipv6.c
 @@ -104,6 +104,10 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)

diff --git a/3.19.5/4425_grsec_remove_EI_PAX.patch b/3.14.40/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 3.19.5/4425_grsec_remove_EI_PAX.patch
rename to 3.14.40/4425_grsec_remove_EI_PAX.patch

diff --git a/3.14.39/4427_force_XATTR_PAX_tmpfs.patch b/3.14.40/4427_force_XATTR_PAX_tmpfs.patch
similarity index 100%
rename from 3.14.39/4427_force_XATTR_PAX_tmpfs.patch
rename to 3.14.40/4427_force_XATTR_PAX_tmpfs.patch

diff --git a/3.19.5/4430_grsec-remove-localversion-grsec.patch b/3.14.40/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 3.19.5/4430_grsec-remove-localversion-grsec.patch
rename to 3.14.40/4430_grsec-remove-localversion-grsec.patch

diff --git a/3.14.39/4435_grsec-mute-warnings.patch b/3.14.40/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 3.14.39/4435_grsec-mute-warnings.patch
rename to 3.14.40/4435_grsec-mute-warnings.patch

diff --git a/3.19.5/4440_grsec-remove-protected-paths.patch b/3.14.40/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 3.19.5/4440_grsec-remove-protected-paths.patch
rename to 3.14.40/4440_grsec-remove-protected-paths.patch

diff --git a/3.14.39/4450_grsec-kconfig-default-gids.patch b/3.14.40/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 3.14.39/4450_grsec-kconfig-default-gids.patch
rename to 3.14.40/4450_grsec-kconfig-default-gids.patch

diff --git a/3.14.39/4465_selinux-avc_audit-log-curr_ip.patch b/3.14.40/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 3.14.39/4465_selinux-avc_audit-log-curr_ip.patch
rename to 3.14.40/4465_selinux-avc_audit-log-curr_ip.patch

diff --git a/3.14.39/4470_disable-compat_vdso.patch b/3.14.40/4470_disable-compat_vdso.patch
similarity index 100%
rename from 3.14.39/4470_disable-compat_vdso.patch
rename to 3.14.40/4470_disable-compat_vdso.patch

diff --git a/3.19.5/4475_emutramp_default_on.patch b/3.14.40/4475_emutramp_default_on.patch
similarity index 100%
rename from 3.19.5/4475_emutramp_default_on.patch
rename to 3.14.40/4475_emutramp_default_on.patch

diff --git a/3.19.5/0000_README b/3.19.6/0000_README
similarity index 92%
rename from 3.19.5/0000_README
rename to 3.19.6/0000_README
index 4fd49ef..725e5d4 100644
--- a/3.19.5/0000_README
+++ b/3.19.6/0000_README
@@ -2,7 +2,11 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.1-3.19.5-201504270827.patch
+Patch:	1005_linux-3.19.6.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.19.6
+
+Patch:	4420_grsecurity-3.1-3.19.6-201504290821.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/3.19.6/1005_linux-3.19.6.patch b/3.19.6/1005_linux-3.19.6.patch
new file mode 100644
index 0000000..f55bc7e
--- /dev/null
+++ b/3.19.6/1005_linux-3.19.6.patch
@@ -0,0 +1,1674 @@
+diff --git a/Makefile b/Makefile
+index 633b5f0..65c7c87 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 19
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+ NAME = Diseased Newt
+ 
+diff --git a/arch/arm/mm/hugetlbpage.c b/arch/arm/mm/hugetlbpage.c
+index 66781bf..c724124 100644
+--- a/arch/arm/mm/hugetlbpage.c
++++ b/arch/arm/mm/hugetlbpage.c
+@@ -36,12 +36,6 @@
+  * of type casting from pmd_t * to pte_t *.
+  */
+ 
+-struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
+-			      int write)
+-{
+-	return ERR_PTR(-EINVAL);
+-}
+-
+ int pud_huge(pud_t pud)
+ {
+ 	return 0;
+diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
+index 023747b..2de9d2e 100644
+--- a/arch/arm64/mm/hugetlbpage.c
++++ b/arch/arm64/mm/hugetlbpage.c
+@@ -38,12 +38,6 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
+ }
+ #endif
+ 
+-struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
+-			      int write)
+-{
+-	return ERR_PTR(-EINVAL);
+-}
+-
+ int pmd_huge(pmd_t pmd)
+ {
+ 	return !(pmd_val(pmd) & PMD_TABLE_BIT);
+diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
+index 76069c1..52b7604 100644
+--- a/arch/ia64/mm/hugetlbpage.c
++++ b/arch/ia64/mm/hugetlbpage.c
+@@ -114,12 +114,6 @@ int pud_huge(pud_t pud)
+ 	return 0;
+ }
+ 
+-struct page *
+-follow_huge_pmd(struct mm_struct *mm, unsigned long address, pmd_t *pmd, int write)
+-{
+-	return NULL;
+-}
+-
+ void hugetlb_free_pgd_range(struct mmu_gather *tlb,
+ 			unsigned long addr, unsigned long end,
+ 			unsigned long floor, unsigned long ceiling)
+diff --git a/arch/metag/mm/hugetlbpage.c b/arch/metag/mm/hugetlbpage.c
+index 3c32075..7ca80ac 100644
+--- a/arch/metag/mm/hugetlbpage.c
++++ b/arch/metag/mm/hugetlbpage.c
+@@ -94,12 +94,6 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
+ 	return 0;
+ }
+ 
+-struct page *follow_huge_addr(struct mm_struct *mm,
+-			      unsigned long address, int write)
+-{
+-	return ERR_PTR(-EINVAL);
+-}
+-
+ int pmd_huge(pmd_t pmd)
+ {
+ 	return pmd_page_shift(pmd) > PAGE_SHIFT;
+diff --git a/arch/mips/mm/hugetlbpage.c b/arch/mips/mm/hugetlbpage.c
+index 4ec8ee1..06e0f42 100644
+--- a/arch/mips/mm/hugetlbpage.c
++++ b/arch/mips/mm/hugetlbpage.c
+@@ -68,12 +68,6 @@ int is_aligned_hugepage_range(unsigned long addr, unsigned long len)
+ 	return 0;
+ }
+ 
+-struct page *
+-follow_huge_addr(struct mm_struct *mm, unsigned long address, int write)
+-{
+-	return ERR_PTR(-EINVAL);
+-}
+-
+ int pmd_huge(pmd_t pmd)
+ {
+ 	return (pmd_val(pmd) & _PAGE_HUGE) != 0;
+@@ -83,15 +77,3 @@ int pud_huge(pud_t pud)
+ {
+ 	return (pud_val(pud) & _PAGE_HUGE) != 0;
+ }
+-
+-struct page *
+-follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+-		pmd_t *pmd, int write)
+-{
+-	struct page *page;
+-
+-	page = pte_page(*(pte_t *)pmd);
+-	if (page)
+-		page += ((address & ~HPAGE_MASK) >> PAGE_SHIFT);
+-	return page;
+-}
+diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
+index 620d0ec..7e408bf 100644
+--- a/arch/powerpc/mm/hugetlbpage.c
++++ b/arch/powerpc/mm/hugetlbpage.c
+@@ -714,6 +714,14 @@ follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+ 	return NULL;
+ }
+ 
++struct page *
++follow_huge_pud(struct mm_struct *mm, unsigned long address,
++		pud_t *pud, int write)
++{
++	BUG();
++	return NULL;
++}
++
+ static unsigned long hugepte_addr_end(unsigned long addr, unsigned long end,
+ 				      unsigned long sz)
+ {
+diff --git a/arch/s390/mm/hugetlbpage.c b/arch/s390/mm/hugetlbpage.c
+index 3c80d2e..210ffed 100644
+--- a/arch/s390/mm/hugetlbpage.c
++++ b/arch/s390/mm/hugetlbpage.c
+@@ -192,12 +192,6 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
+ 	return 0;
+ }
+ 
+-struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
+-			      int write)
+-{
+-	return ERR_PTR(-EINVAL);
+-}
+-
+ int pmd_huge(pmd_t pmd)
+ {
+ 	if (!MACHINE_HAS_HPAGE)
+@@ -210,17 +204,3 @@ int pud_huge(pud_t pud)
+ {
+ 	return 0;
+ }
+-
+-struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+-			     pmd_t *pmdp, int write)
+-{
+-	struct page *page;
+-
+-	if (!MACHINE_HAS_HPAGE)
+-		return NULL;
+-
+-	page = pmd_page(*pmdp);
+-	if (page)
+-		page += ((address & ~HPAGE_MASK) >> PAGE_SHIFT);
+-	return page;
+-}
+diff --git a/arch/sh/mm/hugetlbpage.c b/arch/sh/mm/hugetlbpage.c
+index d776234..534bc97 100644
+--- a/arch/sh/mm/hugetlbpage.c
++++ b/arch/sh/mm/hugetlbpage.c
+@@ -67,12 +67,6 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
+ 	return 0;
+ }
+ 
+-struct page *follow_huge_addr(struct mm_struct *mm,
+-			      unsigned long address, int write)
+-{
+-	return ERR_PTR(-EINVAL);
+-}
+-
+ int pmd_huge(pmd_t pmd)
+ {
+ 	return 0;
+@@ -82,9 +76,3 @@ int pud_huge(pud_t pud)
+ {
+ 	return 0;
+ }
+-
+-struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+-			     pmd_t *pmd, int write)
+-{
+-	return NULL;
+-}
+diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
+index d329537..4242eab 100644
+--- a/arch/sparc/mm/hugetlbpage.c
++++ b/arch/sparc/mm/hugetlbpage.c
+@@ -215,12 +215,6 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
+ 	return entry;
+ }
+ 
+-struct page *follow_huge_addr(struct mm_struct *mm,
+-			      unsigned long address, int write)
+-{
+-	return ERR_PTR(-EINVAL);
+-}
+-
+ int pmd_huge(pmd_t pmd)
+ {
+ 	return 0;
+@@ -230,9 +224,3 @@ int pud_huge(pud_t pud)
+ {
+ 	return 0;
+ }
+-
+-struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+-			     pmd_t *pmd, int write)
+-{
+-	return NULL;
+-}
+diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c
+index 3270e00..8416240 100644
+--- a/arch/tile/mm/hugetlbpage.c
++++ b/arch/tile/mm/hugetlbpage.c
+@@ -150,12 +150,6 @@ pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
+ 	return NULL;
+ }
+ 
+-struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
+-			      int write)
+-{
+-	return ERR_PTR(-EINVAL);
+-}
+-
+ int pmd_huge(pmd_t pmd)
+ {
+ 	return !!(pmd_val(pmd) & _PAGE_HUGE_PAGE);
+@@ -166,28 +160,6 @@ int pud_huge(pud_t pud)
+ 	return !!(pud_val(pud) & _PAGE_HUGE_PAGE);
+ }
+ 
+-struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+-			     pmd_t *pmd, int write)
+-{
+-	struct page *page;
+-
+-	page = pte_page(*(pte_t *)pmd);
+-	if (page)
+-		page += ((address & ~PMD_MASK) >> PAGE_SHIFT);
+-	return page;
+-}
+-
+-struct page *follow_huge_pud(struct mm_struct *mm, unsigned long address,
+-			     pud_t *pud, int write)
+-{
+-	struct page *page;
+-
+-	page = pte_page(*(pte_t *)pud);
+-	if (page)
+-		page += ((address & ~PUD_MASK) >> PAGE_SHIFT);
+-	return page;
+-}
+-
+ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
+ {
+ 	return 0;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index d4c58d8..3124464 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2404,8 +2404,7 @@ static __init void nested_vmx_setup_ctls_msrs(void)
+ 
+ 	if (enable_ept) {
+ 		/* nested EPT: emulate EPT also to L1 */
+-		nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT |
+-			SECONDARY_EXEC_UNRESTRICTED_GUEST;
++		nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT;
+ 		nested_vmx_ept_caps = VMX_EPT_PAGE_WALK_4_BIT |
+ 			 VMX_EPTP_WB_BIT | VMX_EPT_2MB_PAGE_BIT |
+ 			 VMX_EPT_INVEPT_BIT;
+@@ -2419,6 +2418,10 @@ static __init void nested_vmx_setup_ctls_msrs(void)
+ 	} else
+ 		nested_vmx_ept_caps = 0;
+ 
++	if (enable_unrestricted_guest)
++		nested_vmx_secondary_ctls_high |=
++			SECONDARY_EXEC_UNRESTRICTED_GUEST;
++
+ 	/* miscellaneous data */
+ 	rdmsr(MSR_IA32_VMX_MISC, nested_vmx_misc_low, nested_vmx_misc_high);
+ 	nested_vmx_misc_low &= VMX_MISC_SAVE_EFER_LMA;
+diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
+index 006cc91..9161f76 100644
+--- a/arch/x86/mm/hugetlbpage.c
++++ b/arch/x86/mm/hugetlbpage.c
+@@ -52,20 +52,8 @@ int pud_huge(pud_t pud)
+ 	return 0;
+ }
+ 
+-struct page *
+-follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+-		pmd_t *pmd, int write)
+-{
+-	return NULL;
+-}
+ #else
+ 
+-struct page *
+-follow_huge_addr(struct mm_struct *mm, unsigned long address, int write)
+-{
+-	return ERR_PTR(-EINVAL);
+-}
+-
+ /*
+  * pmd_huge() returns 1 if @pmd is hugetlb related entry, that is normal
+  * hugetlb entry or non-present (migration or hwpoisoned) hugetlb entry.
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 0dceba1..68ad39a 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3797,7 +3797,8 @@ static inline int bond_slave_override(struct bonding *bond,
+ 	/* Find out if any slaves have the same mapping as this skb. */
+ 	bond_for_each_slave_rcu(bond, slave, iter) {
+ 		if (slave->queue_id == skb->queue_mapping) {
+-			if (bond_slave_can_tx(slave)) {
++			if (bond_slave_is_up(slave) &&
++			    slave->link == BOND_LINK_UP) {
+ 				bond_dev_queue_xmit(bond, skb, slave->dev);
+ 				return 0;
+ 			}
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+index c3a6072..2559206 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+@@ -531,20 +531,8 @@ struct bnx2x_fastpath {
+ 	struct napi_struct	napi;
+ 
+ #ifdef CONFIG_NET_RX_BUSY_POLL
+-	unsigned int state;
+-#define BNX2X_FP_STATE_IDLE		      0
+-#define BNX2X_FP_STATE_NAPI		(1 << 0)    /* NAPI owns this FP */
+-#define BNX2X_FP_STATE_POLL		(1 << 1)    /* poll owns this FP */
+-#define BNX2X_FP_STATE_DISABLED		(1 << 2)
+-#define BNX2X_FP_STATE_NAPI_YIELD	(1 << 3)    /* NAPI yielded this FP */
+-#define BNX2X_FP_STATE_POLL_YIELD	(1 << 4)    /* poll yielded this FP */
+-#define BNX2X_FP_OWNED	(BNX2X_FP_STATE_NAPI | BNX2X_FP_STATE_POLL)
+-#define BNX2X_FP_YIELD	(BNX2X_FP_STATE_NAPI_YIELD | BNX2X_FP_STATE_POLL_YIELD)
+-#define BNX2X_FP_LOCKED	(BNX2X_FP_OWNED | BNX2X_FP_STATE_DISABLED)
+-#define BNX2X_FP_USER_PEND (BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_POLL_YIELD)
+-	/* protect state */
+-	spinlock_t lock;
+-#endif /* CONFIG_NET_RX_BUSY_POLL */
++	unsigned long		busy_poll_state;
++#endif
+ 
+ 	union host_hc_status_block	status_blk;
+ 	/* chip independent shortcuts into sb structure */
+@@ -619,104 +607,83 @@ struct bnx2x_fastpath {
+ #define bnx2x_fp_qstats(bp, fp)	(&((bp)->fp_stats[(fp)->index].eth_q_stats))
+ 
+ #ifdef CONFIG_NET_RX_BUSY_POLL
+-static inline void bnx2x_fp_init_lock(struct bnx2x_fastpath *fp)
++
++enum bnx2x_fp_state {
++	BNX2X_STATE_FP_NAPI	= BIT(0), /* NAPI handler owns the queue */
++
++	BNX2X_STATE_FP_NAPI_REQ_BIT = 1, /* NAPI would like to own the queue */
++	BNX2X_STATE_FP_NAPI_REQ = BIT(1),
++
++	BNX2X_STATE_FP_POLL_BIT = 2,
++	BNX2X_STATE_FP_POLL     = BIT(2), /* busy_poll owns the queue */
++
++	BNX2X_STATE_FP_DISABLE_BIT = 3, /* queue is dismantled */
++};
++
++static inline void bnx2x_fp_busy_poll_init(struct bnx2x_fastpath *fp)
+ {
+-	spin_lock_init(&fp->lock);
+-	fp->state = BNX2X_FP_STATE_IDLE;
++	WRITE_ONCE(fp->busy_poll_state, 0);
+ }
+ 
+ /* called from the device poll routine to get ownership of a FP */
+ static inline bool bnx2x_fp_lock_napi(struct bnx2x_fastpath *fp)
+ {
+-	bool rc = true;
+-
+-	spin_lock_bh(&fp->lock);
+-	if (fp->state & BNX2X_FP_LOCKED) {
+-		WARN_ON(fp->state & BNX2X_FP_STATE_NAPI);
+-		fp->state |= BNX2X_FP_STATE_NAPI_YIELD;
+-		rc = false;
+-	} else {
+-		/* we don't care if someone yielded */
+-		fp->state = BNX2X_FP_STATE_NAPI;
++	unsigned long prev, old = READ_ONCE(fp->busy_poll_state);
++
++	while (1) {
++		switch (old) {
++		case BNX2X_STATE_FP_POLL:
++			/* make sure bnx2x_fp_lock_poll() wont starve us */
++			set_bit(BNX2X_STATE_FP_NAPI_REQ_BIT,
++				&fp->busy_poll_state);
++			/* fallthrough */
++		case BNX2X_STATE_FP_POLL | BNX2X_STATE_FP_NAPI_REQ:
++			return false;
++		default:
++			break;
++		}
++		prev = cmpxchg(&fp->busy_poll_state, old, BNX2X_STATE_FP_NAPI);
++		if (unlikely(prev != old)) {
++			old = prev;
++			continue;
++		}
++		return true;
+ 	}
+-	spin_unlock_bh(&fp->lock);
+-	return rc;
+ }
+ 
+-/* returns true is someone tried to get the FP while napi had it */
+-static inline bool bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
++static inline void bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
+ {
+-	bool rc = false;
+-
+-	spin_lock_bh(&fp->lock);
+-	WARN_ON(fp->state &
+-		(BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_NAPI_YIELD));
+-
+-	if (fp->state & BNX2X_FP_STATE_POLL_YIELD)
+-		rc = true;
+-
+-	/* state ==> idle, unless currently disabled */
+-	fp->state &= BNX2X_FP_STATE_DISABLED;
+-	spin_unlock_bh(&fp->lock);
+-	return rc;
++	smp_wmb();
++	fp->busy_poll_state = 0;
+ }
+ 
+ /* called from bnx2x_low_latency_poll() */
+ static inline bool bnx2x_fp_lock_poll(struct bnx2x_fastpath *fp)
+ {
+-	bool rc = true;
+-
+-	spin_lock_bh(&fp->lock);
+-	if ((fp->state & BNX2X_FP_LOCKED)) {
+-		fp->state |= BNX2X_FP_STATE_POLL_YIELD;
+-		rc = false;
+-	} else {
+-		/* preserve yield marks */
+-		fp->state |= BNX2X_FP_STATE_POLL;
+-	}
+-	spin_unlock_bh(&fp->lock);
+-	return rc;
++	return cmpxchg(&fp->busy_poll_state, 0, BNX2X_STATE_FP_POLL) == 0;
+ }
+ 
+-/* returns true if someone tried to get the FP while it was locked */
+-static inline bool bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
++static inline void bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
+ {
+-	bool rc = false;
+-
+-	spin_lock_bh(&fp->lock);
+-	WARN_ON(fp->state & BNX2X_FP_STATE_NAPI);
+-
+-	if (fp->state & BNX2X_FP_STATE_POLL_YIELD)
+-		rc = true;
+-
+-	/* state ==> idle, unless currently disabled */
+-	fp->state &= BNX2X_FP_STATE_DISABLED;
+-	spin_unlock_bh(&fp->lock);
+-	return rc;
++	smp_mb__before_atomic();
++	clear_bit(BNX2X_STATE_FP_POLL_BIT, &fp->busy_poll_state);
+ }
+ 
+-/* true if a socket is polling, even if it did not get the lock */
++/* true if a socket is polling */
+ static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
+ {
+-	WARN_ON(!(fp->state & BNX2X_FP_OWNED));
+-	return fp->state & BNX2X_FP_USER_PEND;
++	return READ_ONCE(fp->busy_poll_state) & BNX2X_STATE_FP_POLL;
+ }
+ 
+ /* false if fp is currently owned */
+ static inline bool bnx2x_fp_ll_disable(struct bnx2x_fastpath *fp)
+ {
+-	int rc = true;
+-
+-	spin_lock_bh(&fp->lock);
+-	if (fp->state & BNX2X_FP_OWNED)
+-		rc = false;
+-	fp->state |= BNX2X_FP_STATE_DISABLED;
+-	spin_unlock_bh(&fp->lock);
++	set_bit(BNX2X_STATE_FP_DISABLE_BIT, &fp->busy_poll_state);
++	return !bnx2x_fp_ll_polling(fp);
+ 
+-	return rc;
+ }
+ #else
+-static inline void bnx2x_fp_init_lock(struct bnx2x_fastpath *fp)
++static inline void bnx2x_fp_busy_poll_init(struct bnx2x_fastpath *fp)
+ {
+ }
+ 
+@@ -725,9 +692,8 @@ static inline bool bnx2x_fp_lock_napi(struct bnx2x_fastpath *fp)
+ 	return true;
+ }
+ 
+-static inline bool bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
++static inline void bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
+ {
+-	return false;
+ }
+ 
+ static inline bool bnx2x_fp_lock_poll(struct bnx2x_fastpath *fp)
+@@ -735,9 +701,8 @@ static inline bool bnx2x_fp_lock_poll(struct bnx2x_fastpath *fp)
+ 	return false;
+ }
+ 
+-static inline bool bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
++static inline void bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
+ {
+-	return false;
+ }
+ 
+ static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index e468ed3..2b8e8b2 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -1849,7 +1849,7 @@ static void bnx2x_napi_enable_cnic(struct bnx2x *bp)
+ 	int i;
+ 
+ 	for_each_rx_queue_cnic(bp, i) {
+-		bnx2x_fp_init_lock(&bp->fp[i]);
++		bnx2x_fp_busy_poll_init(&bp->fp[i]);
+ 		napi_enable(&bnx2x_fp(bp, i, napi));
+ 	}
+ }
+@@ -1859,7 +1859,7 @@ static void bnx2x_napi_enable(struct bnx2x *bp)
+ 	int i;
+ 
+ 	for_each_eth_queue(bp, i) {
+-		bnx2x_fp_init_lock(&bp->fp[i]);
++		bnx2x_fp_busy_poll_init(&bp->fp[i]);
+ 		napi_enable(&bnx2x_fp(bp, i, napi));
+ 	}
+ }
+@@ -3191,9 +3191,10 @@ static int bnx2x_poll(struct napi_struct *napi, int budget)
+ 			}
+ 		}
+ 
++		bnx2x_fp_unlock_napi(fp);
++
+ 		/* Fall out from the NAPI loop if needed */
+-		if (!bnx2x_fp_unlock_napi(fp) &&
+-		    !(bnx2x_has_rx_work(fp) || bnx2x_has_tx_work(fp))) {
++		if (!(bnx2x_has_rx_work(fp) || bnx2x_has_tx_work(fp))) {
+ 
+ 			/* No need to update SB for FCoE L2 ring as long as
+ 			 * it's connected to the default SB and the SB
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 96bf01b..05ae126 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -17868,8 +17868,10 @@ static int tg3_init_one(struct pci_dev *pdev,
+ 	 */
+ 	if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
+ 	    (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
++		tg3_full_lock(tp, 0);
+ 		tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
+ 		tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
++		tg3_full_unlock(tp);
+ 	}
+ 
+ 	err = tg3_test_dma(tp);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+index 5c93d14..9842bf9 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+@@ -585,7 +585,8 @@ static int mlx4_cmd_wait(struct mlx4_dev *dev, u64 in_param, u64 *out_param,
+ 		 * on the host, we deprecate the error message for this
+ 		 * specific command/input_mod/opcode_mod/fw-status to be debug.
+ 		 */
+-		if (op == MLX4_CMD_SET_PORT && in_modifier == 1 &&
++		if (op == MLX4_CMD_SET_PORT &&
++		    (in_modifier == 1 || in_modifier == 2) &&
+ 		    op_modifier == 0 && context->fw_status == CMD_STAT_BAD_SIZE)
+ 			mlx4_dbg(dev, "command 0x%x failed: fw status = 0x%x\n",
+ 				 op, context->fw_status);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index ac6a8f1..2617c9d 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -2627,13 +2627,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
+ 	netif_carrier_off(dev);
+ 	mlx4_en_set_default_moderation(priv);
+ 
+-	err = register_netdev(dev);
+-	if (err) {
+-		en_err(priv, "Netdev registration failed for port %d\n", port);
+-		goto out;
+-	}
+-	priv->registered = 1;
+-
+ 	en_warn(priv, "Using %d TX rings\n", prof->tx_ring_num);
+ 	en_warn(priv, "Using %d RX rings\n", prof->rx_ring_num);
+ 
+@@ -2673,6 +2666,14 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
+ 		queue_delayed_work(mdev->workqueue, &priv->service_task,
+ 				   SERVICE_TASK_DELAY);
+ 
++	err = register_netdev(dev);
++	if (err) {
++		en_err(priv, "Netdev registration failed for port %d\n", port);
++		goto out;
++	}
++
++	priv->registered = 1;
++
+ 	return 0;
+ 
+ out:
+diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c
+index 2f398fa..24c0284 100644
+--- a/drivers/net/ethernet/rocker/rocker.c
++++ b/drivers/net/ethernet/rocker/rocker.c
+@@ -4305,10 +4305,16 @@ static int rocker_port_master_changed(struct net_device *dev)
+ 	struct net_device *master = netdev_master_upper_dev_get(dev);
+ 	int err = 0;
+ 
++	/* There are currently three cases handled here:
++	 * 1. Joining a bridge
++	 * 2. Leaving a previously joined bridge
++	 * 3. Other, e.g. being added to or removed from a bond or openvswitch,
++	 *    in which case nothing is done
++	 */
+ 	if (master && master->rtnl_link_ops &&
+ 	    !strcmp(master->rtnl_link_ops->kind, "bridge"))
+ 		err = rocker_port_bridge_join(rocker_port, master);
+-	else
++	else if (rocker_port_is_bridged(rocker_port))
+ 		err = rocker_port_bridge_leave(rocker_port);
+ 
+ 	return err;
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 10f9e40..9a409a8 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1368,7 +1368,7 @@ static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile,
+ 	skb = __skb_recv_datagram(tfile->socket.sk, noblock ? MSG_DONTWAIT : 0,
+ 				  &peeked, &off, &err);
+ 	if (!skb)
+-		return 0;
++		return err;
+ 
+ 	ret = tun_put_user(tun, tfile, skb, to);
+ 	if (unlikely(ret < 0))
+diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
+index 5c55f11..75d6f26 100644
+--- a/drivers/net/usb/asix_common.c
++++ b/drivers/net/usb/asix_common.c
+@@ -188,6 +188,8 @@ struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+ 		memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
+ 		skb_put(skb, sizeof(padbytes));
+ 	}
++
++	usbnet_set_skb_tx_stats(skb, 1, 0);
+ 	return skb;
+ }
+ 
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index 80a844e..c3e4da9 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -1172,17 +1172,17 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+ 
+ 	/* return skb */
+ 	ctx->tx_curr_skb = NULL;
+-	dev->net->stats.tx_packets += ctx->tx_curr_frame_num;
+ 
+ 	/* keep private stats: framing overhead and number of NTBs */
+ 	ctx->tx_overhead += skb_out->len - ctx->tx_curr_frame_payload;
+ 	ctx->tx_ntbs++;
+ 
+-	/* usbnet has already counted all the framing overhead.
++	/* usbnet will count all the framing overhead by default.
+ 	 * Adjust the stats so that the tx_bytes counter show real
+ 	 * payload data instead.
+ 	 */
+-	dev->net->stats.tx_bytes -= skb_out->len - ctx->tx_curr_frame_payload;
++	usbnet_set_skb_tx_stats(skb_out, n,
++				ctx->tx_curr_frame_payload - skb_out->len);
+ 
+ 	return skb_out;
+ 
+diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c
+index b94a0fb..953de13 100644
+--- a/drivers/net/usb/sr9800.c
++++ b/drivers/net/usb/sr9800.c
+@@ -144,6 +144,7 @@ static struct sk_buff *sr_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+ 		skb_put(skb, sizeof(padbytes));
+ 	}
+ 
++	usbnet_set_skb_tx_stats(skb, 1, 0);
+ 	return skb;
+ }
+ 
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 3a6770a..e7ed251 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -1189,8 +1189,7 @@ static void tx_complete (struct urb *urb)
+ 	struct usbnet		*dev = entry->dev;
+ 
+ 	if (urb->status == 0) {
+-		if (!(dev->driver_info->flags & FLAG_MULTI_PACKET))
+-			dev->net->stats.tx_packets++;
++		dev->net->stats.tx_packets += entry->packets;
+ 		dev->net->stats.tx_bytes += entry->length;
+ 	} else {
+ 		dev->net->stats.tx_errors++;
+@@ -1348,7 +1347,19 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
+ 		} else
+ 			urb->transfer_flags |= URB_ZERO_PACKET;
+ 	}
+-	entry->length = urb->transfer_buffer_length = length;
++	urb->transfer_buffer_length = length;
++
++	if (info->flags & FLAG_MULTI_PACKET) {
++		/* Driver has set number of packets and a length delta.
++		 * Calculate the complete length and ensure that it's
++		 * positive.
++		 */
++		entry->length += length;
++		if (WARN_ON_ONCE(entry->length <= 0))
++			entry->length = length;
++	} else {
++		usbnet_set_skb_tx_stats(skb, 1, length);
++	}
+ 
+ 	spin_lock_irqsave(&dev->txq.lock, flags);
+ 	retval = usb_autopm_get_interface_async(dev->intf);
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index a8c755d..6c83846 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -1578,12 +1578,6 @@ static int vxlan6_xmit_skb(struct vxlan_sock *vs,
+ 	int err;
+ 	bool udp_sum = !udp_get_no_check6_tx(vs->sock->sk);
+ 
+-	skb = udp_tunnel_handle_offloads(skb, udp_sum);
+-	if (IS_ERR(skb)) {
+-		err = -EINVAL;
+-		goto err;
+-	}
+-
+ 	skb_scrub_packet(skb, xnet);
+ 
+ 	min_headroom = LL_RESERVED_SPACE(dst->dev) + dst->header_len
+@@ -1603,6 +1597,12 @@ static int vxlan6_xmit_skb(struct vxlan_sock *vs,
+ 		goto err;
+ 	}
+ 
++	skb = udp_tunnel_handle_offloads(skb, udp_sum);
++	if (IS_ERR(skb)) {
++		err = -EINVAL;
++		goto err;
++	}
++
+ 	vxh = (struct vxlanhdr *) __skb_push(skb, sizeof(*vxh));
+ 	vxh->vx_flags = htonl(VXLAN_FLAGS);
+ 	vxh->vx_vni = vni;
+@@ -1628,10 +1628,6 @@ int vxlan_xmit_skb(struct vxlan_sock *vs,
+ 	int err;
+ 	bool udp_sum = !vs->sock->sk->sk_no_check_tx;
+ 
+-	skb = udp_tunnel_handle_offloads(skb, udp_sum);
+-	if (IS_ERR(skb))
+-		return PTR_ERR(skb);
+-
+ 	min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len
+ 			+ VXLAN_HLEN + sizeof(struct iphdr)
+ 			+ (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
+@@ -1647,6 +1643,10 @@ int vxlan_xmit_skb(struct vxlan_sock *vs,
+ 	if (WARN_ON(!skb))
+ 		return -ENOMEM;
+ 
++	skb = udp_tunnel_handle_offloads(skb, udp_sum);
++	if (IS_ERR(skb))
++		return PTR_ERR(skb);
++
+ 	vxh = (struct vxlanhdr *) __skb_push(skb, sizeof(*vxh));
+ 	vxh->vx_flags = htonl(VXLAN_FLAGS);
+ 	vxh->vx_vni = vni;
+diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
+index a5186bb..8c45cf4 100644
+--- a/drivers/net/wireless/rtlwifi/pci.c
++++ b/drivers/net/wireless/rtlwifi/pci.c
+@@ -578,6 +578,13 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
+ 		else
+ 			entry = (u8 *)(&ring->desc[ring->idx]);
+ 
++		if (rtlpriv->cfg->ops->get_available_desc &&
++		    rtlpriv->cfg->ops->get_available_desc(hw, prio) <= 1) {
++			RT_TRACE(rtlpriv, (COMP_INTR | COMP_SEND), DBG_DMESG,
++				 "no available desc!\n");
++			return;
++		}
++
+ 		if (!rtlpriv->cfg->ops->is_tx_desc_closed(hw, prio, ring->idx))
+ 			return;
+ 		ring->idx = (ring->idx + 1) % ring->entries;
+@@ -641,10 +648,9 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
+ 
+ 		ieee80211_tx_status_irqsafe(hw, skb);
+ 
+-		if ((ring->entries - skb_queue_len(&ring->queue))
+-				== 2) {
++		if ((ring->entries - skb_queue_len(&ring->queue)) <= 4) {
+ 
+-			RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
++			RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
+ 				 "more desc left, wake skb_queue@%d, ring->idx = %d, skb_queue_len = 0x%x\n",
+ 				 prio, ring->idx,
+ 				 skb_queue_len(&ring->queue));
+@@ -793,7 +799,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ 			rx_remained_cnt =
+ 				rtlpriv->cfg->ops->rx_desc_buff_remained_cnt(hw,
+ 								      hw_queue);
+-			if (rx_remained_cnt < 1)
++			if (rx_remained_cnt == 0)
+ 				return;
+ 
+ 		} else {	/* rx descriptor */
+@@ -845,18 +851,18 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ 			else
+ 				skb_reserve(skb, stats.rx_drvinfo_size +
+ 					    stats.rx_bufshift);
+-
+ 		} else {
+ 			RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+ 				 "skb->end - skb->tail = %d, len is %d\n",
+ 				 skb->end - skb->tail, len);
+-			break;
++			dev_kfree_skb_any(skb);
++			goto new_trx_end;
+ 		}
+ 		/* handle command packet here */
+ 		if (rtlpriv->cfg->ops->rx_command_packet &&
+ 		    rtlpriv->cfg->ops->rx_command_packet(hw, stats, skb)) {
+ 				dev_kfree_skb_any(skb);
+-				goto end;
++				goto new_trx_end;
+ 		}
+ 
+ 		/*
+@@ -906,6 +912,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ 		} else {
+ 			dev_kfree_skb_any(skb);
+ 		}
++new_trx_end:
+ 		if (rtlpriv->use_new_trx_flow) {
+ 			rtlpci->rx_ring[hw_queue].next_rx_rp += 1;
+ 			rtlpci->rx_ring[hw_queue].next_rx_rp %=
+@@ -921,7 +928,6 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ 			rtlpriv->enter_ps = false;
+ 			schedule_work(&rtlpriv->works.lps_change_work);
+ 		}
+-end:
+ 		skb = new_skb;
+ no_new:
+ 		if (rtlpriv->use_new_trx_flow) {
+@@ -1695,6 +1701,15 @@ static int rtl_pci_tx(struct ieee80211_hw *hw,
+ 		}
+ 	}
+ 
++	if (rtlpriv->cfg->ops->get_available_desc &&
++	    rtlpriv->cfg->ops->get_available_desc(hw, hw_queue) == 0) {
++			RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
++				 "get_available_desc fail\n");
++			spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock,
++					       flags);
++			return skb->len;
++	}
++
+ 	if (ieee80211_is_data_qos(fc)) {
+ 		tid = rtl_get_tid(skb);
+ 		if (sta) {
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c
+index 9b5a7d5..c31c6bf 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c
+@@ -113,8 +113,6 @@ int rtl92ee_init_sw_vars(struct ieee80211_hw *hw)
+ 				  RCR_HTC_LOC_CTRL		|
+ 				  RCR_AMF			|
+ 				  RCR_ACF			|
+-				  RCR_ADF			|
+-				  RCR_AICV			|
+ 				  RCR_ACRC32			|
+ 				  RCR_AB			|
+ 				  RCR_AM			|
+@@ -241,6 +239,7 @@ static struct rtl_hal_ops rtl8192ee_hal_ops = {
+ 	.set_desc = rtl92ee_set_desc,
+ 	.get_desc = rtl92ee_get_desc,
+ 	.is_tx_desc_closed = rtl92ee_is_tx_desc_closed,
++	.get_available_desc = rtl92ee_get_available_desc,
+ 	.tx_polling = rtl92ee_tx_polling,
+ 	.enable_hw_sec = rtl92ee_enable_hw_security_config,
+ 	.set_key = rtl92ee_set_key,
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
+index 0069004..1f6d160 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
+@@ -707,7 +707,7 @@ static u16 get_desc_addr_fr_q_idx(u16 queue_index)
+ 	return desc_address;
+ }
+ 
+-void rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 q_idx)
++u16 rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 q_idx)
+ {
+ 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+@@ -721,11 +721,12 @@ void rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 q_idx)
+ 	current_tx_write_point = (u16)((tmp_4byte) & 0x0fff);
+ 
+ 	point_diff = ((current_tx_read_point > current_tx_write_point) ?
+-		      (current_tx_read_point - current_tx_write_point) :
+-		      (TX_DESC_NUM_92E - current_tx_write_point +
++		      (current_tx_read_point - current_tx_write_point - 1) :
++		      (TX_DESC_NUM_92E - 1 - current_tx_write_point +
+ 		       current_tx_read_point));
+ 
+ 	rtlpci->tx_ring[q_idx].avl_desc = point_diff;
++	return point_diff;
+ }
+ 
+ void rtl92ee_pre_fill_tx_bd_desc(struct ieee80211_hw *hw,
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
+index 8effef9..b489dd9 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
+@@ -831,7 +831,7 @@ void rtl92ee_rx_check_dma_ok(struct ieee80211_hw *hw, u8 *header_desc,
+ 			     u8 queue_index);
+ u16	rtl92ee_rx_desc_buff_remained_cnt(struct ieee80211_hw *hw,
+ 					  u8 queue_index);
+-void rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 queue_index);
++u16 rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 queue_index);
+ void rtl92ee_pre_fill_tx_bd_desc(struct ieee80211_hw *hw,
+ 				 u8 *tx_bd_desc, u8 *desc, u8 queue_index,
+ 				 struct sk_buff *skb, dma_addr_t addr);
+diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
+index 6866dcf..27822fe 100644
+--- a/drivers/net/wireless/rtlwifi/wifi.h
++++ b/drivers/net/wireless/rtlwifi/wifi.h
+@@ -2161,6 +2161,7 @@ struct rtl_hal_ops {
+ 	void (*add_wowlan_pattern)(struct ieee80211_hw *hw,
+ 				   struct rtl_wow_pattern *rtl_pattern,
+ 				   u8 index);
++	u16 (*get_available_desc)(struct ieee80211_hw *hw, u8 q_idx);
+ };
+ 
+ struct rtl_intf_ops {
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index d8c1076..76ce69c 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1062,8 +1062,7 @@ err:
+ 
+ static int xennet_change_mtu(struct net_device *dev, int mtu)
+ {
+-	int max = xennet_can_sg(dev) ?
+-		XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER : ETH_DATA_LEN;
++	int max = xennet_can_sg(dev) ? XEN_NETIF_MAX_TX_SIZE : ETH_DATA_LEN;
+ 
+ 	if (mtu > max)
+ 		return -EINVAL;
+@@ -1333,8 +1332,6 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
+ 	netdev->ethtool_ops = &xennet_ethtool_ops;
+ 	SET_NETDEV_DEV(netdev, &dev->dev);
+ 
+-	netif_set_gso_max_size(netdev, XEN_NETIF_MAX_TX_SIZE - MAX_TCP_HEADER);
+-
+ 	np->netdev = netdev;
+ 
+ 	netif_carrier_off(netdev);
+diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c
+index d02df7d..57b7bc2 100644
+--- a/drivers/staging/comedi/drivers/adv_pci1710.c
++++ b/drivers/staging/comedi/drivers/adv_pci1710.c
+@@ -455,7 +455,6 @@ static int pci171x_insn_read_ai(struct comedi_device *dev,
+ 				struct comedi_insn *insn, unsigned int *data)
+ {
+ 	struct pci1710_private *devpriv = dev->private;
+-	unsigned int chan = CR_CHAN(insn->chanspec);
+ 	int ret = 0;
+ 	int i;
+ 
+@@ -477,7 +476,7 @@ static int pci171x_insn_read_ai(struct comedi_device *dev,
+ 			break;
+ 
+ 		val = inw(dev->iobase + PCI171x_AD_DATA);
+-		ret = pci171x_ai_dropout(dev, s, chan, val);
++		ret = pci171x_ai_dropout(dev, s, 0, val);
+ 		if (ret)
+ 			break;
+ 
+diff --git a/fs/exec.c b/fs/exec.c
+index ad8798e..4617a4e 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1259,6 +1259,53 @@ static void check_unsafe_exec(struct linux_binprm *bprm)
+ 	spin_unlock(&p->fs->lock);
+ }
+ 
++static void bprm_fill_uid(struct linux_binprm *bprm)
++{
++	struct inode *inode;
++	unsigned int mode;
++	kuid_t uid;
++	kgid_t gid;
++
++	/* clear any previous set[ug]id data from a previous binary */
++	bprm->cred->euid = current_euid();
++	bprm->cred->egid = current_egid();
++
++	if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
++		return;
++
++	if (task_no_new_privs(current))
++		return;
++
++	inode = file_inode(bprm->file);
++	mode = READ_ONCE(inode->i_mode);
++	if (!(mode & (S_ISUID|S_ISGID)))
++		return;
++
++	/* Be careful if suid/sgid is set */
++	mutex_lock(&inode->i_mutex);
++
++	/* reload atomically mode/uid/gid now that lock held */
++	mode = inode->i_mode;
++	uid = inode->i_uid;
++	gid = inode->i_gid;
++	mutex_unlock(&inode->i_mutex);
++
++	/* We ignore suid/sgid if there are no mappings for them in the ns */
++	if (!kuid_has_mapping(bprm->cred->user_ns, uid) ||
++		 !kgid_has_mapping(bprm->cred->user_ns, gid))
++		return;
++
++	if (mode & S_ISUID) {
++		bprm->per_clear |= PER_CLEAR_ON_SETID;
++		bprm->cred->euid = uid;
++	}
++
++	if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
++		bprm->per_clear |= PER_CLEAR_ON_SETID;
++		bprm->cred->egid = gid;
++	}
++}
++
+ /*
+  * Fill the binprm structure from the inode.
+  * Check permissions, then read the first 128 (BINPRM_BUF_SIZE) bytes
+@@ -1267,36 +1314,9 @@ static void check_unsafe_exec(struct linux_binprm *bprm)
+  */
+ int prepare_binprm(struct linux_binprm *bprm)
+ {
+-	struct inode *inode = file_inode(bprm->file);
+-	umode_t mode = inode->i_mode;
+ 	int retval;
+ 
+-
+-	/* clear any previous set[ug]id data from a previous binary */
+-	bprm->cred->euid = current_euid();
+-	bprm->cred->egid = current_egid();
+-
+-	if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) &&
+-	    !task_no_new_privs(current) &&
+-	    kuid_has_mapping(bprm->cred->user_ns, inode->i_uid) &&
+-	    kgid_has_mapping(bprm->cred->user_ns, inode->i_gid)) {
+-		/* Set-uid? */
+-		if (mode & S_ISUID) {
+-			bprm->per_clear |= PER_CLEAR_ON_SETID;
+-			bprm->cred->euid = inode->i_uid;
+-		}
+-
+-		/* Set-gid? */
+-		/*
+-		 * If setgid is set but no group execute bit then this
+-		 * is a candidate for mandatory locking, not a setgid
+-		 * executable.
+-		 */
+-		if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
+-			bprm->per_clear |= PER_CLEAR_ON_SETID;
+-			bprm->cred->egid = inode->i_gid;
+-		}
+-	}
++	bprm_fill_uid(bprm);
+ 
+ 	/* fill in binprm security blob */
+ 	retval = security_bprm_set_creds(bprm);
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index 431b7fc..e235ec5 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -99,9 +99,9 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep);
+ struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
+ 			      int write);
+ struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+-				pmd_t *pmd, int write);
++				pmd_t *pmd, int flags);
+ struct page *follow_huge_pud(struct mm_struct *mm, unsigned long address,
+-				pud_t *pud, int write);
++				pud_t *pud, int flags);
+ int pmd_huge(pmd_t pmd);
+ int pud_huge(pud_t pmd);
+ unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
+@@ -133,8 +133,8 @@ static inline void hugetlb_report_meminfo(struct seq_file *m)
+ static inline void hugetlb_show_meminfo(void)
+ {
+ }
+-#define follow_huge_pmd(mm, addr, pmd, write)	NULL
+-#define follow_huge_pud(mm, addr, pud, write)	NULL
++#define follow_huge_pmd(mm, addr, pmd, flags)	NULL
++#define follow_huge_pud(mm, addr, pud, flags)	NULL
+ #define prepare_hugepage_range(file, addr, len)	(-EINVAL)
+ #define pmd_huge(x)	0
+ #define pud_huge(x)	0
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 52fd8e8..840fb7f 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2159,6 +2159,12 @@ void netdev_freemem(struct net_device *dev);
+ void synchronize_net(void);
+ int init_dummy_netdev(struct net_device *dev);
+ 
++DECLARE_PER_CPU(int, xmit_recursion);
++static inline int dev_recursion_level(void)
++{
++	return this_cpu_read(xmit_recursion);
++}
++
+ struct net_device *dev_get_by_index(struct net *net, int ifindex);
+ struct net_device *__dev_get_by_index(struct net *net, int ifindex);
+ struct net_device *dev_get_by_index_rcu(struct net *net, int ifindex);
+diff --git a/include/linux/swapops.h b/include/linux/swapops.h
+index 6adfb7b..e288d5c 100644
+--- a/include/linux/swapops.h
++++ b/include/linux/swapops.h
+@@ -137,6 +137,8 @@ static inline void make_migration_entry_read(swp_entry_t *entry)
+ 	*entry = swp_entry(SWP_MIGRATION_READ, swp_offset(*entry));
+ }
+ 
++extern void __migration_entry_wait(struct mm_struct *mm, pte_t *ptep,
++					spinlock_t *ptl);
+ extern void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,
+ 					unsigned long address);
+ extern void migration_entry_wait_huge(struct vm_area_struct *vma,
+@@ -150,6 +152,8 @@ static inline int is_migration_entry(swp_entry_t swp)
+ }
+ #define migration_entry_to_page(swp) NULL
+ static inline void make_migration_entry_read(swp_entry_t *entryp) { }
++static inline void __migration_entry_wait(struct mm_struct *mm, pte_t *ptep,
++					spinlock_t *ptl) { }
+ static inline void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,
+ 					 unsigned long address) { }
+ static inline void migration_entry_wait_huge(struct vm_area_struct *vma,
+diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
+index d9a4905..6e0ce8c 100644
+--- a/include/linux/usb/usbnet.h
++++ b/include/linux/usb/usbnet.h
+@@ -227,9 +227,23 @@ struct skb_data {	/* skb->cb is one of these */
+ 	struct urb		*urb;
+ 	struct usbnet		*dev;
+ 	enum skb_state		state;
+-	size_t			length;
++	long			length;
++	unsigned long		packets;
+ };
+ 
++/* Drivers that set FLAG_MULTI_PACKET must call this in their
++ * tx_fixup method before returning an skb.
++ */
++static inline void
++usbnet_set_skb_tx_stats(struct sk_buff *skb,
++			unsigned long packets, long bytes_delta)
++{
++	struct skb_data *entry = (struct skb_data *) skb->cb;
++
++	entry->packets = packets;
++	entry->length = bytes_delta;
++}
++
+ extern int usbnet_open(struct net_device *net);
+ extern int usbnet_stop(struct net_device *net);
+ extern netdev_tx_t usbnet_start_xmit(struct sk_buff *skb,
+diff --git a/include/net/ip.h b/include/net/ip.h
+index 09cf5ae..c0c26c3 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -453,22 +453,6 @@ static __inline__ void inet_reset_saddr(struct sock *sk)
+ 
+ #endif
+ 
+-static inline int sk_mc_loop(struct sock *sk)
+-{
+-	if (!sk)
+-		return 1;
+-	switch (sk->sk_family) {
+-	case AF_INET:
+-		return inet_sk(sk)->mc_loop;
+-#if IS_ENABLED(CONFIG_IPV6)
+-	case AF_INET6:
+-		return inet6_sk(sk)->mc_loop;
+-#endif
+-	}
+-	WARN_ON(1);
+-	return 1;
+-}
+-
+ bool ip_call_ra_chain(struct sk_buff *skb);
+ 
+ /*
+diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
+index 1d09b46..eda131d 100644
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -174,7 +174,8 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
+ 
+ static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
+ {
+-	struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
++	struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
++				inet6_sk(skb->sk) : NULL;
+ 
+ 	return (np && np->pmtudisc >= IPV6_PMTUDISC_PROBE) ?
+ 	       skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 2210fec..45b54d3 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1812,6 +1812,8 @@ struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie);
+ 
+ struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie);
+ 
++bool sk_mc_loop(struct sock *sk);
++
+ static inline bool sk_can_gso(const struct sock *sk)
+ {
+ 	return net_gso_ok(sk->sk_route_caps, sk->sk_gso_type);
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index a28e09c..36508e6 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -1380,7 +1380,8 @@ peek_stack:
+ 			/* tell verifier to check for equivalent states
+ 			 * after every call and jump
+ 			 */
+-			env->explored_states[t + 1] = STATE_LIST_MARK;
++			if (t + 1 < insn_cnt)
++				env->explored_states[t + 1] = STATE_LIST_MARK;
+ 		} else {
+ 			/* conditional jump with two edges */
+ 			ret = push_insn(t, t + 1, FALLTHROUGH, env);
+diff --git a/mm/gup.c b/mm/gup.c
+index 9b2afbf..e29c374 100644
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -167,10 +167,10 @@ struct page *follow_page_mask(struct vm_area_struct *vma,
+ 	if (pud_none(*pud))
+ 		return no_page_table(vma, flags);
+ 	if (pud_huge(*pud) && vma->vm_flags & VM_HUGETLB) {
+-		if (flags & FOLL_GET)
+-			return NULL;
+-		page = follow_huge_pud(mm, address, pud, flags & FOLL_WRITE);
+-		return page;
++		page = follow_huge_pud(mm, address, pud, flags);
++		if (page)
++			return page;
++		return no_page_table(vma, flags);
+ 	}
+ 	if (unlikely(pud_bad(*pud)))
+ 		return no_page_table(vma, flags);
+@@ -179,19 +179,10 @@ struct page *follow_page_mask(struct vm_area_struct *vma,
+ 	if (pmd_none(*pmd))
+ 		return no_page_table(vma, flags);
+ 	if (pmd_huge(*pmd) && vma->vm_flags & VM_HUGETLB) {
+-		page = follow_huge_pmd(mm, address, pmd, flags & FOLL_WRITE);
+-		if (flags & FOLL_GET) {
+-			/*
+-			 * Refcount on tail pages are not well-defined and
+-			 * shouldn't be taken. The caller should handle a NULL
+-			 * return when trying to follow tail pages.
+-			 */
+-			if (PageHead(page))
+-				get_page(page);
+-			else
+-				page = NULL;
+-		}
+-		return page;
++		page = follow_huge_pmd(mm, address, pmd, flags);
++		if (page)
++			return page;
++		return no_page_table(vma, flags);
+ 	}
+ 	if ((flags & FOLL_NUMA) && pmd_numa(*pmd))
+ 		return no_page_table(vma, flags);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 267e419..a2bfd02 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -3700,44 +3700,64 @@ pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
+ 	return (pte_t *) pmd;
+ }
+ 
+-struct page *
+-follow_huge_pmd(struct mm_struct *mm, unsigned long address,
+-		pmd_t *pmd, int write)
+-{
+-	struct page *page;
++#endif /* CONFIG_ARCH_WANT_GENERAL_HUGETLB */
+ 
+-	if (!pmd_present(*pmd))
+-		return NULL;
+-	page = pte_page(*(pte_t *)pmd);
+-	if (page)
+-		page += ((address & ~PMD_MASK) >> PAGE_SHIFT);
+-	return page;
++/*
++ * These functions are overwritable if your architecture needs its own
++ * behavior.
++ */
++struct page * __weak
++follow_huge_addr(struct mm_struct *mm, unsigned long address,
++			      int write)
++{
++	return ERR_PTR(-EINVAL);
+ }
+ 
+-struct page *
+-follow_huge_pud(struct mm_struct *mm, unsigned long address,
+-		pud_t *pud, int write)
++struct page * __weak
++follow_huge_pmd(struct mm_struct *mm, unsigned long address,
++		pmd_t *pmd, int flags)
+ {
+-	struct page *page;
+-
+-	page = pte_page(*(pte_t *)pud);
+-	if (page)
+-		page += ((address & ~PUD_MASK) >> PAGE_SHIFT);
++	struct page *page = NULL;
++	spinlock_t *ptl;
++retry:
++	ptl = pmd_lockptr(mm, pmd);
++	spin_lock(ptl);
++	/*
++	 * make sure that the address range covered by this pmd is not
++	 * unmapped from other threads.
++	 */
++	if (!pmd_huge(*pmd))
++		goto out;
++	if (pmd_present(*pmd)) {
++		page = pte_page(*(pte_t *)pmd) +
++			((address & ~PMD_MASK) >> PAGE_SHIFT);
++		if (flags & FOLL_GET)
++			get_page(page);
++	} else {
++		if (is_hugetlb_entry_migration(huge_ptep_get((pte_t *)pmd))) {
++			spin_unlock(ptl);
++			__migration_entry_wait(mm, (pte_t *)pmd, ptl);
++			goto retry;
++		}
++		/*
++		 * hwpoisoned entry is treated as no_page_table in
++		 * follow_page_mask().
++		 */
++	}
++out:
++	spin_unlock(ptl);
+ 	return page;
+ }
+ 
+-#else /* !CONFIG_ARCH_WANT_GENERAL_HUGETLB */
+-
+-/* Can be overriden by architectures */
+ struct page * __weak
+ follow_huge_pud(struct mm_struct *mm, unsigned long address,
+-	       pud_t *pud, int write)
++		pud_t *pud, int flags)
+ {
+-	BUG();
+-	return NULL;
+-}
++	if (flags & FOLL_GET)
++		return NULL;
+ 
+-#endif /* CONFIG_ARCH_WANT_GENERAL_HUGETLB */
++	return pte_page(*(pte_t *)pud) + ((address & ~PUD_MASK) >> PAGE_SHIFT);
++}
+ 
+ #ifdef CONFIG_MEMORY_FAILURE
+ 
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 344cdf6..be6d1ed 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -229,7 +229,7 @@ static void remove_migration_ptes(struct page *old, struct page *new)
+  * get to the page and wait until migration is finished.
+  * When we return from this function the fault will be retried.
+  */
+-static void __migration_entry_wait(struct mm_struct *mm, pte_t *ptep,
++void __migration_entry_wait(struct mm_struct *mm, pte_t *ptep,
+ 				spinlock_t *ptl)
+ {
+ 	pte_t pte;
+@@ -1268,7 +1268,8 @@ static int do_move_page_to_node_array(struct mm_struct *mm,
+ 			goto put_and_set;
+ 
+ 		if (PageHuge(page)) {
+-			isolate_huge_page(page, &pagelist);
++			if (PageHead(page))
++				isolate_huge_page(page, &pagelist);
+ 			goto put_and_set;
+ 		}
+ 
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 4ff46f8..5dd905c 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2821,7 +2821,9 @@ static void skb_update_prio(struct sk_buff *skb)
+ #define skb_update_prio(skb)
+ #endif
+ 
+-static DEFINE_PER_CPU(int, xmit_recursion);
++DEFINE_PER_CPU(int, xmit_recursion);
++EXPORT_SYMBOL(xmit_recursion);
++
+ #define RECURSION_LIMIT 10
+ 
+ /**
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 62c67be..39c444c 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4141,18 +4141,20 @@ EXPORT_SYMBOL(skb_try_coalesce);
+  */
+ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
+ {
+-	if (xnet)
+-		skb_orphan(skb);
+ 	skb->tstamp.tv64 = 0;
+ 	skb->pkt_type = PACKET_HOST;
+ 	skb->skb_iif = 0;
+ 	skb->ignore_df = 0;
+ 	skb_dst_drop(skb);
+-	skb->mark = 0;
+-	skb_init_secmark(skb);
+ 	secpath_reset(skb);
+ 	nf_reset(skb);
+ 	nf_reset_trace(skb);
++
++	if (!xnet)
++		return;
++
++	skb_orphan(skb);
++	skb->mark = 0;
+ }
+ EXPORT_SYMBOL_GPL(skb_scrub_packet);
+ 
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 1c7a33d..a91f99f 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -651,6 +651,25 @@ static inline void sock_valbool_flag(struct sock *sk, int bit, int valbool)
+ 		sock_reset_flag(sk, bit);
+ }
+ 
++bool sk_mc_loop(struct sock *sk)
++{
++	if (dev_recursion_level())
++		return false;
++	if (!sk)
++		return true;
++	switch (sk->sk_family) {
++	case AF_INET:
++		return inet_sk(sk)->mc_loop;
++#if IS_ENABLED(CONFIG_IPV6)
++	case AF_INET6:
++		return inet6_sk(sk)->mc_loop;
++#endif
++	}
++	WARN_ON(1);
++	return true;
++}
++EXPORT_SYMBOL(sk_mc_loop);
++
+ /*
+  *	This is meant for all protocols to use and covers goings on
+  *	at the socket level. Everything here is generic.
+diff --git a/net/ipv4/geneve.c b/net/ipv4/geneve.c
+index 394a200..69711d8 100644
+--- a/net/ipv4/geneve.c
++++ b/net/ipv4/geneve.c
+@@ -121,10 +121,6 @@ int geneve_xmit_skb(struct geneve_sock *gs, struct rtable *rt,
+ 	int min_headroom;
+ 	int err;
+ 
+-	skb = udp_tunnel_handle_offloads(skb, !gs->sock->sk->sk_no_check_tx);
+-	if (IS_ERR(skb))
+-		return PTR_ERR(skb);
+-
+ 	min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len
+ 			+ GENEVE_BASE_HLEN + opt_len + sizeof(struct iphdr)
+ 			+ (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
+@@ -139,6 +135,10 @@ int geneve_xmit_skb(struct geneve_sock *gs, struct rtable *rt,
+ 	if (unlikely(!skb))
+ 		return -ENOMEM;
+ 
++	skb = udp_tunnel_handle_offloads(skb, !gs->sock->sk->sk_no_check_tx);
++	if (IS_ERR(skb))
++		return PTR_ERR(skb);
++
+ 	gnvh = (struct genevehdr *)__skb_push(skb, sizeof(*gnvh) + opt_len);
+ 	geneve_build_header(gnvh, tun_flags, vni, opt_len, opt);
+ 
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 075ab4d..08ccca6 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3104,10 +3104,11 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
+ 			if (!first_ackt.v64)
+ 				first_ackt = last_ackt;
+ 
+-			if (!(sacked & TCPCB_SACKED_ACKED))
++			if (!(sacked & TCPCB_SACKED_ACKED)) {
+ 				reord = min(pkts_acked, reord);
+-			if (!after(scb->end_seq, tp->high_seq))
+-				flag |= FLAG_ORIG_SACK_ACKED;
++				if (!after(scb->end_seq, tp->high_seq))
++					flag |= FLAG_ORIG_SACK_ACKED;
++			}
+ 		}
+ 
+ 		if (sacked & TCPCB_SACKED_ACKED)
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index d22f544..982347e 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -1516,7 +1516,7 @@ void tcp_v4_early_demux(struct sk_buff *skb)
+ 		skb->sk = sk;
+ 		skb->destructor = sock_edemux;
+ 		if (sk->sk_state != TCP_TIME_WAIT) {
+-			struct dst_entry *dst = sk->sk_rx_dst;
++			struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
+ 
+ 			if (dst)
+ 				dst = dst_check(dst, 0);
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 9790f39..9f29453 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2931,6 +2931,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
+ 	}
+ #endif
+ 
++	/* Do not fool tcpdump (if any), clean our debris */
++	skb->tstamp.tv64 = 0;
+ 	return skb;
+ }
+ EXPORT_SYMBOL(tcp_make_synack);
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 3f5aa99..0bf56e5 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -541,7 +541,8 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+ {
+ 	struct sk_buff *frag;
+ 	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
+-	struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
++	struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
++				inet6_sk(skb->sk) : NULL;
+ 	struct ipv6hdr *tmp_hdr;
+ 	struct frag_hdr *fh;
+ 	unsigned int mtu, hlen, left, len;
+diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
+index 6828667..d375ce6 100644
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -1216,7 +1216,14 @@ static void ndisc_router_discovery(struct sk_buff *skb)
+ 	if (rt)
+ 		rt6_set_expires(rt, jiffies + (HZ * lifetime));
+ 	if (ra_msg->icmph.icmp6_hop_limit) {
+-		in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
++		/* Only set hop_limit on the interface if it is higher than
++		 * the current hop_limit.
++		 */
++		if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) {
++			in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
++		} else {
++			ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n");
++		}
+ 		if (rt)
+ 			dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
+ 				       ra_msg->icmph.icmp6_hop_limit);
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 9c0b54e..b899793 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1409,6 +1409,15 @@ static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
+ 	TCP_SKB_CB(skb)->sacked = 0;
+ }
+ 
++static void tcp_v6_restore_cb(struct sk_buff *skb)
++{
++	/* We need to move header back to the beginning if xfrm6_policy_check()
++	 * and tcp_v6_fill_cb() are going to be called again.
++	 */
++	memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
++		sizeof(struct inet6_skb_parm));
++}
++
+ static int tcp_v6_rcv(struct sk_buff *skb)
+ {
+ 	const struct tcphdr *th;
+@@ -1541,6 +1550,7 @@ do_time_wait:
+ 			inet_twsk_deschedule(tw, &tcp_death_row);
+ 			inet_twsk_put(tw);
+ 			sk = sk2;
++			tcp_v6_restore_cb(skb);
+ 			goto process;
+ 		}
+ 		/* Fall through to ACK */
+@@ -1549,6 +1559,7 @@ do_time_wait:
+ 		tcp_v6_timewait_ack(sk, skb);
+ 		break;
+ 	case TCP_TW_RST:
++		tcp_v6_restore_cb(skb);
+ 		goto no_tcp_socket;
+ 	case TCP_TW_SUCCESS:
+ 		;
+@@ -1583,7 +1594,7 @@ static void tcp_v6_early_demux(struct sk_buff *skb)
+ 		skb->sk = sk;
+ 		skb->destructor = sock_edemux;
+ 		if (sk->sk_state != TCP_TIME_WAIT) {
+-			struct dst_entry *dst = sk->sk_rx_dst;
++			struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
+ 
+ 			if (dst)
+ 				dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
+diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
+index 2034c6d..296cc24 100644
+--- a/net/openvswitch/vport.c
++++ b/net/openvswitch/vport.c
+@@ -274,10 +274,8 @@ void ovs_vport_del(struct vport *vport)
+ 	ASSERT_OVSL();
+ 
+ 	hlist_del_rcu(&vport->hash_node);
+-
+-	vport->ops->destroy(vport);
+-
+ 	module_put(vport->ops->owner);
++	vport->ops->destroy(vport);
+ }
+ 
+ /**

diff --git a/3.19.5/4420_grsecurity-3.1-3.19.5-201504270827.patch b/3.19.6/4420_grsecurity-3.1-3.19.6-201504290821.patch
similarity index 99%
rename from 3.19.5/4420_grsecurity-3.1-3.19.5-201504270827.patch
rename to 3.19.6/4420_grsecurity-3.1-3.19.6-201504290821.patch
index 2036ebb..68f5d26 100644
--- a/3.19.5/4420_grsecurity-3.1-3.19.5-201504270827.patch
+++ b/3.19.6/4420_grsecurity-3.1-3.19.6-201504290821.patch
@@ -373,7 +373,7 @@ index 176d4fe..6eabd3c 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 633b5f0..10aa54f 100644
+index 65c7c87..abe7f93 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -298,7 +298,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -5569,10 +5569,10 @@ index ba5ba7a..36e9d3a 100644
  	/*
  	 * If for any reason at all we couldn't handle the fault, make
 diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
-index 76069c1..c2aa816 100644
+index 52b7604b..455cb85 100644
 --- a/arch/ia64/mm/hugetlbpage.c
 +++ b/arch/ia64/mm/hugetlbpage.c
-@@ -149,6 +149,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
+@@ -143,6 +143,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
  		unsigned long pgoff, unsigned long flags)
  {
  	struct vm_unmapped_area_info info;
@@ -5580,7 +5580,7 @@ index 76069c1..c2aa816 100644
  
  	if (len > RGN_MAP_LIMIT)
  		return -ENOMEM;
-@@ -172,6 +173,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
+@@ -166,6 +167,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
  	info.high_limit = HPAGE_REGION_BASE + RGN_MAP_LIMIT;
  	info.align_mask = PAGE_MASK & (HPAGE_SIZE - 1);
  	info.align_offset = 0;
@@ -5692,10 +5692,10 @@ index d703d8e..a8e2d70 100644
  
  #define smp_load_acquire(p)						\
 diff --git a/arch/metag/mm/hugetlbpage.c b/arch/metag/mm/hugetlbpage.c
-index 3c32075..ae0ae75 100644
+index 7ca80ac..794ba72 100644
 --- a/arch/metag/mm/hugetlbpage.c
 +++ b/arch/metag/mm/hugetlbpage.c
-@@ -200,6 +200,7 @@ hugetlb_get_unmapped_area_new_pmd(unsigned long len)
+@@ -194,6 +194,7 @@ hugetlb_get_unmapped_area_new_pmd(unsigned long len)
  	info.high_limit = TASK_SIZE;
  	info.align_mask = PAGE_MASK & HUGEPT_MASK;
  	info.align_offset = 0;
@@ -12237,7 +12237,7 @@ index 4798232..f76e3aa 100644
  	 * load/store/atomic was a write or not, it only says that there
  	 * was no match.  So in such a case we (carefully) read the
 diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
-index d329537..2c3746a 100644
+index 4242eab..9ae6360 100644
 --- a/arch/sparc/mm/hugetlbpage.c
 +++ b/arch/sparc/mm/hugetlbpage.c
 @@ -25,8 +25,10 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *filp,
@@ -12448,10 +12448,10 @@ index b6cde32..c0cb736 100644
  	else
  		copy_from_user_overflow();
 diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c
-index 3270e00..a77236e 100644
+index 8416240..a012fb7 100644
 --- a/arch/tile/mm/hugetlbpage.c
 +++ b/arch/tile/mm/hugetlbpage.c
-@@ -207,6 +207,7 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
+@@ -179,6 +179,7 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
  	info.high_limit = TASK_SIZE;
  	info.align_mask = PAGE_MASK & ~huge_page_mask(h);
  	info.align_offset = 0;
@@ -12459,7 +12459,7 @@ index 3270e00..a77236e 100644
  	return vm_unmapped_area(&info);
  }
  
-@@ -224,6 +225,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
+@@ -196,6 +197,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
  	info.high_limit = current->mm->mmap_base;
  	info.align_mask = PAGE_MASK & ~huge_page_mask(h);
  	info.align_offset = 0;
@@ -28842,7 +28842,7 @@ index 41dd038..de331cf 100644
  
  	local_irq_disable();
 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index d4c58d8..eaf2568 100644
+index 3124464..2e42ec3 100644
 --- a/arch/x86/kvm/vmx.c
 +++ b/arch/x86/kvm/vmx.c
 @@ -1380,12 +1380,12 @@ static void vmcs_write64(unsigned long field, u64 value)
@@ -28892,7 +28892,7 @@ index d4c58d8..eaf2568 100644
  {
  	u64 host_tsc, tsc_offset;
  
-@@ -4252,7 +4260,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+@@ -4255,7 +4263,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
  	unsigned long cr4;
  
  	vmcs_writel(HOST_CR0, read_cr0() & ~X86_CR0_TS);  /* 22.2.3 */
@@ -28903,7 +28903,7 @@ index d4c58d8..eaf2568 100644
  
  	/* Save the most likely value for this task's CR4 in the VMCS. */
  	cr4 = read_cr4();
-@@ -4279,7 +4290,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+@@ -4282,7 +4293,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
  	vmcs_writel(HOST_IDTR_BASE, dt.address);   /* 22.2.4 */
  	vmx->host_idt_base = dt.address;
  
@@ -28912,7 +28912,7 @@ index d4c58d8..eaf2568 100644
  
  	rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
  	vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
-@@ -5876,11 +5887,16 @@ static __init int hardware_setup(void)
+@@ -5879,11 +5890,16 @@ static __init int hardware_setup(void)
  		 * page upon invalidation.  No need to do anything if the
  		 * processor does not have the APIC_ACCESS_ADDR VMCS field.
  		 */
@@ -28932,7 +28932,7 @@ index d4c58d8..eaf2568 100644
  
  	if (enable_ept && !cpu_has_vmx_ept_2m_page())
  		kvm_disable_largepages();
-@@ -5891,13 +5907,15 @@ static __init int hardware_setup(void)
+@@ -5894,13 +5910,15 @@ static __init int hardware_setup(void)
  	if (!cpu_has_vmx_apicv())
  		enable_apicv = 0;
  
@@ -28952,7 +28952,7 @@ index d4c58d8..eaf2568 100644
  
  	if (nested)
  		nested_vmx_setup_ctls_msrs();
-@@ -7846,6 +7864,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -7849,6 +7867,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  		"jmp 2f \n\t"
  		"1: " __ex(ASM_VMX_VMRESUME) "\n\t"
  		"2: "
@@ -28965,7 +28965,7 @@ index d4c58d8..eaf2568 100644
  		/* Save guest registers, load host registers, keep flags */
  		"mov %0, %c[wordsize](%%" _ASM_SP ") \n\t"
  		"pop %0 \n\t"
-@@ -7898,6 +7922,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -7901,6 +7925,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  #endif
  		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
  		[wordsize]"i"(sizeof(ulong))
@@ -28977,7 +28977,7 @@ index d4c58d8..eaf2568 100644
  	      : "cc", "memory"
  #ifdef CONFIG_X86_64
  		, "rax", "rbx", "rdi", "rsi"
-@@ -7911,7 +7940,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -7914,7 +7943,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  	if (debugctlmsr)
  		update_debugctlmsr(debugctlmsr);
  
@@ -28986,7 +28986,7 @@ index d4c58d8..eaf2568 100644
  	/*
  	 * The sysexit path does not restore ds/es, so we must set them to
  	 * a reasonable value ourselves.
-@@ -7920,8 +7949,18 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -7923,8 +7952,18 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  	 * may be executed in interrupt context, which saves and restore segments
  	 * around it, nullifying its effect.
  	 */
@@ -32638,10 +32638,10 @@ index 4500142..53a363c 100644
  
  	return (void *)vaddr;
 diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
-index 006cc91..bf05a83 100644
+index 9161f76..cbc5124 100644
 --- a/arch/x86/mm/hugetlbpage.c
 +++ b/arch/x86/mm/hugetlbpage.c
-@@ -86,23 +86,24 @@ int pud_huge(pud_t pud)
+@@ -74,23 +74,24 @@ int pud_huge(pud_t pud)
  #ifdef CONFIG_HUGETLB_PAGE
  static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
  		unsigned long addr, unsigned long len,
@@ -32669,7 +32669,7 @@ index 006cc91..bf05a83 100644
  {
  	struct hstate *h = hstate_file(file);
  	struct vm_unmapped_area_info info;
-@@ -114,6 +115,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
+@@ -102,6 +103,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
  	info.high_limit = current->mm->mmap_base;
  	info.align_mask = PAGE_MASK & ~huge_page_mask(h);
  	info.align_offset = 0;
@@ -32677,7 +32677,7 @@ index 006cc91..bf05a83 100644
  	addr = vm_unmapped_area(&info);
  
  	/*
-@@ -126,6 +128,12 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
+@@ -114,6 +116,12 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
  		VM_BUG_ON(addr != -ENOMEM);
  		info.flags = 0;
  		info.low_limit = TASK_UNMAPPED_BASE;
@@ -32690,7 +32690,7 @@ index 006cc91..bf05a83 100644
  		info.high_limit = TASK_SIZE;
  		addr = vm_unmapped_area(&info);
  	}
-@@ -140,10 +148,20 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+@@ -128,10 +136,20 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
  	struct hstate *h = hstate_file(file);
  	struct mm_struct *mm = current->mm;
  	struct vm_area_struct *vma;
@@ -32712,7 +32712,7 @@ index 006cc91..bf05a83 100644
  		return -ENOMEM;
  
  	if (flags & MAP_FIXED) {
-@@ -152,19 +170,22 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+@@ -140,19 +158,22 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
  		return addr;
  	}
  
@@ -48486,7 +48486,7 @@ index 2c087ef..4859007 100644
  };
  
 diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index 10f9e40..3515e7e 100644
+index 9a409a8..3d44477 100644
 --- a/drivers/net/tun.c
 +++ b/drivers/net/tun.c
 @@ -1425,7 +1425,7 @@ static int tun_validate(struct nlattr *tb[], struct nlattr *data[])
@@ -48657,7 +48657,7 @@ index 0ad6c0c..4013638 100644
  #define VIRTNET_DRIVER_VERSION "1.0.0"
  
 diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
-index a8c755d..a988b71 100644
+index 6c83846..215144b 100644
 --- a/drivers/net/vxlan.c
 +++ b/drivers/net/vxlan.c
 @@ -2702,7 +2702,7 @@ nla_put_failure:
@@ -60692,7 +60692,7 @@ index e4141f2..d8263e8 100644
  		i += packet_length_size;
  		if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
 diff --git a/fs/exec.c b/fs/exec.c
-index ad8798e..e3f50ec 100644
+index 4617a4e..e3f50ec 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
 @@ -56,8 +56,20 @@
@@ -61028,7 +61028,7 @@ index ad8798e..e3f50ec 100644
  			if (likely(leader->exit_state))
  				break;
  			__set_current_state(TASK_KILLABLE);
-@@ -1252,13 +1335,60 @@ static void check_unsafe_exec(struct linux_binprm *bprm)
+@@ -1252,7 +1335,7 @@ static void check_unsafe_exec(struct linux_binprm *bprm)
  	}
  	rcu_read_unlock();
  
@@ -61037,98 +61037,7 @@ index ad8798e..e3f50ec 100644
  		bprm->unsafe |= LSM_UNSAFE_SHARE;
  	else
  		p->fs->in_exec = 1;
- 	spin_unlock(&p->fs->lock);
- }
- 
-+static void bprm_fill_uid(struct linux_binprm *bprm)
-+{
-+	struct inode *inode;
-+	unsigned int mode;
-+	kuid_t uid;
-+	kgid_t gid;
-+
-+	/* clear any previous set[ug]id data from a previous binary */
-+	bprm->cred->euid = current_euid();
-+	bprm->cred->egid = current_egid();
-+
-+	if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
-+		return;
-+
-+	if (task_no_new_privs(current))
-+		return;
-+
-+	inode = file_inode(bprm->file);
-+	mode = READ_ONCE(inode->i_mode);
-+	if (!(mode & (S_ISUID|S_ISGID)))
-+		return;
-+
-+	/* Be careful if suid/sgid is set */
-+	mutex_lock(&inode->i_mutex);
-+
-+	/* reload atomically mode/uid/gid now that lock held */
-+	mode = inode->i_mode;
-+	uid = inode->i_uid;
-+	gid = inode->i_gid;
-+	mutex_unlock(&inode->i_mutex);
-+
-+	/* We ignore suid/sgid if there are no mappings for them in the ns */
-+	if (!kuid_has_mapping(bprm->cred->user_ns, uid) ||
-+		 !kgid_has_mapping(bprm->cred->user_ns, gid))
-+		return;
-+
-+	if (mode & S_ISUID) {
-+		bprm->per_clear |= PER_CLEAR_ON_SETID;
-+		bprm->cred->euid = uid;
-+	}
-+
-+	if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
-+		bprm->per_clear |= PER_CLEAR_ON_SETID;
-+		bprm->cred->egid = gid;
-+	}
-+}
-+
- /*
-  * Fill the binprm structure from the inode.
-  * Check permissions, then read the first 128 (BINPRM_BUF_SIZE) bytes
-@@ -1267,36 +1397,9 @@ static void check_unsafe_exec(struct linux_binprm *bprm)
-  */
- int prepare_binprm(struct linux_binprm *bprm)
- {
--	struct inode *inode = file_inode(bprm->file);
--	umode_t mode = inode->i_mode;
- 	int retval;
- 
--
--	/* clear any previous set[ug]id data from a previous binary */
--	bprm->cred->euid = current_euid();
--	bprm->cred->egid = current_egid();
--
--	if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) &&
--	    !task_no_new_privs(current) &&
--	    kuid_has_mapping(bprm->cred->user_ns, inode->i_uid) &&
--	    kgid_has_mapping(bprm->cred->user_ns, inode->i_gid)) {
--		/* Set-uid? */
--		if (mode & S_ISUID) {
--			bprm->per_clear |= PER_CLEAR_ON_SETID;
--			bprm->cred->euid = inode->i_uid;
--		}
--
--		/* Set-gid? */
--		/*
--		 * If setgid is set but no group execute bit then this
--		 * is a candidate for mandatory locking, not a setgid
--		 * executable.
--		 */
--		if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
--			bprm->per_clear |= PER_CLEAR_ON_SETID;
--			bprm->cred->egid = inode->i_gid;
--		}
--	}
-+	bprm_fill_uid(bprm);
- 
- 	/* fill in binprm security blob */
- 	retval = security_bprm_set_creds(bprm);
-@@ -1433,6 +1536,31 @@ static int exec_binprm(struct linux_binprm *bprm)
+@@ -1453,6 +1536,31 @@ static int exec_binprm(struct linux_binprm *bprm)
  	return ret;
  }
  
@@ -61160,7 +61069,7 @@ index ad8798e..e3f50ec 100644
  /*
   * sys_execve() executes a new program.
   */
-@@ -1441,6 +1569,11 @@ static int do_execveat_common(int fd, struct filename *filename,
+@@ -1461,6 +1569,11 @@ static int do_execveat_common(int fd, struct filename *filename,
  			      struct user_arg_ptr envp,
  			      int flags)
  {
@@ -61172,7 +61081,7 @@ index ad8798e..e3f50ec 100644
  	char *pathbuf = NULL;
  	struct linux_binprm *bprm;
  	struct file *file;
-@@ -1450,6 +1583,8 @@ static int do_execveat_common(int fd, struct filename *filename,
+@@ -1470,6 +1583,8 @@ static int do_execveat_common(int fd, struct filename *filename,
  	if (IS_ERR(filename))
  		return PTR_ERR(filename);
  
@@ -61181,7 +61090,7 @@ index ad8798e..e3f50ec 100644
  	/*
  	 * We move the actual failure in case of RLIMIT_NPROC excess from
  	 * set*uid() to execve() because too many poorly written programs
-@@ -1487,6 +1622,11 @@ static int do_execveat_common(int fd, struct filename *filename,
+@@ -1507,6 +1622,11 @@ static int do_execveat_common(int fd, struct filename *filename,
  	if (IS_ERR(file))
  		goto out_unmark;
  
@@ -61193,7 +61102,7 @@ index ad8798e..e3f50ec 100644
  	sched_exec();
  
  	bprm->file = file;
-@@ -1513,6 +1653,11 @@ static int do_execveat_common(int fd, struct filename *filename,
+@@ -1533,6 +1653,11 @@ static int do_execveat_common(int fd, struct filename *filename,
  	}
  	bprm->interp = bprm->filename;
  
@@ -61205,7 +61114,7 @@ index ad8798e..e3f50ec 100644
  	retval = bprm_mm_init(bprm);
  	if (retval)
  		goto out_unmark;
-@@ -1529,24 +1674,70 @@ static int do_execveat_common(int fd, struct filename *filename,
+@@ -1549,24 +1674,70 @@ static int do_execveat_common(int fd, struct filename *filename,
  	if (retval < 0)
  		goto out;
  
@@ -61280,7 +61189,7 @@ index ad8798e..e3f50ec 100644
  	current->fs->in_exec = 0;
  	current->in_execve = 0;
  	acct_update_integrals(current);
-@@ -1558,6 +1749,14 @@ static int do_execveat_common(int fd, struct filename *filename,
+@@ -1578,6 +1749,14 @@ static int do_execveat_common(int fd, struct filename *filename,
  		put_files_struct(displaced);
  	return retval;
  
@@ -61295,7 +61204,7 @@ index ad8798e..e3f50ec 100644
  out:
  	if (bprm->mm) {
  		acct_arg_size(bprm, 0);
-@@ -1704,3 +1903,312 @@ COMPAT_SYSCALL_DEFINE5(execveat, int, fd,
+@@ -1724,3 +1903,312 @@ COMPAT_SYSCALL_DEFINE5(execveat, int, fd,
  				  argv, envp, flags);
  }
  #endif
@@ -84080,7 +83989,7 @@ index 17d8339..81656c0 100644
  struct iovec;
  struct kvec;
 diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
-index 52fd8e8..19430a1 100644
+index 840fb7f..547ad02 100644
 --- a/include/linux/netdevice.h
 +++ b/include/linux/netdevice.h
 @@ -1191,6 +1191,7 @@ struct net_device_ops {
@@ -86496,7 +86405,7 @@ index 80479ab..0c3f647 100644
  		struct rcu_head         rcu;
  		struct inet_peer	*gc_next;
 diff --git a/include/net/ip.h b/include/net/ip.h
-index 09cf5ae..ab62fcf 100644
+index c0c26c3..29f0420 100644
 --- a/include/net/ip.h
 +++ b/include/net/ip.h
 @@ -317,7 +317,7 @@ static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb)
@@ -86937,7 +86846,7 @@ index 2bb2fcf..d17c291 100644
  
  /* Structure to track chunk fragments that have been acked, but peer
 diff --git a/include/net/sock.h b/include/net/sock.h
-index 2210fec..2249ad0 100644
+index 45b54d3..10efeac 100644
 --- a/include/net/sock.h
 +++ b/include/net/sock.h
 @@ -362,7 +362,7 @@ struct sock {
@@ -86976,7 +86885,7 @@ index 2210fec..2249ad0 100644
  
  static inline struct sock_iocb *kiocb_to_siocb(struct kiocb *iocb)
  {
-@@ -1826,7 +1826,7 @@ static inline void sk_nocaps_add(struct sock *sk, netdev_features_t flags)
+@@ -1828,7 +1828,7 @@ static inline void sk_nocaps_add(struct sock *sk, netdev_features_t flags)
  }
  
  static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
@@ -86985,7 +86894,7 @@ index 2210fec..2249ad0 100644
  					   int copy, int offset)
  {
  	if (skb->ip_summed == CHECKSUM_NONE) {
-@@ -2075,7 +2075,7 @@ static inline void sk_stream_moderate_sndbuf(struct sock *sk)
+@@ -2077,7 +2077,7 @@ static inline void sk_stream_moderate_sndbuf(struct sock *sk)
  	}
  }
  
@@ -88423,20 +88332,6 @@ index 536edc2..d28c85d 100644
  
  	if (!access_ok(VERIFY_READ, uattr, 1))
  		return -EFAULT;
-diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
-index a28e09c..36508e6 100644
---- a/kernel/bpf/verifier.c
-+++ b/kernel/bpf/verifier.c
-@@ -1380,7 +1380,8 @@ peek_stack:
- 			/* tell verifier to check for equivalent states
- 			 * after every call and jump
- 			 */
--			env->explored_states[t + 1] = STATE_LIST_MARK;
-+			if (t + 1 < insn_cnt)
-+				env->explored_states[t + 1] = STATE_LIST_MARK;
- 		} else {
- 			/* conditional jump with two edges */
- 			ret = push_insn(t, t + 1, FALLTHROUGH, env);
 diff --git a/kernel/capability.c b/kernel/capability.c
 index 989f5bf..d317ca0 100644
 --- a/kernel/capability.c
@@ -95794,10 +95689,10 @@ index 2805d71..8b56e7d 100644
  	 * Make sure the vma is shared, that it supports prefaulting,
  	 * and that the remapped range is valid and fully within
 diff --git a/mm/gup.c b/mm/gup.c
-index 9b2afbf..647297c 100644
+index e29c374..66e998f 100644
 --- a/mm/gup.c
 +++ b/mm/gup.c
-@@ -274,11 +274,6 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
+@@ -265,11 +265,6 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
  	unsigned int fault_flags = 0;
  	int ret;
  
@@ -95809,7 +95704,7 @@ index 9b2afbf..647297c 100644
  	if (*flags & FOLL_WRITE)
  		fault_flags |= FAULT_FLAG_WRITE;
  	if (nonblocking)
-@@ -444,14 +439,14 @@ long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+@@ -435,14 +430,14 @@ long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
  	if (!(gup_flags & FOLL_FORCE))
  		gup_flags |= FOLL_NUMA;
  
@@ -95826,7 +95721,7 @@ index 9b2afbf..647297c 100644
  			if (!vma && in_gate_area(mm, start)) {
  				int ret;
  				ret = get_gate_page(mm, start & PAGE_MASK,
-@@ -463,7 +458,7 @@ long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+@@ -454,7 +449,7 @@ long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
  				goto next_page;
  			}
  
@@ -95835,7 +95730,7 @@ index 9b2afbf..647297c 100644
  				return i ? : -EFAULT;
  			if (is_vm_hugetlb_page(vma)) {
  				i = follow_hugetlb_page(mm, vma, pages, vmas,
-@@ -518,7 +513,7 @@ next_page:
+@@ -509,7 +504,7 @@ next_page:
  		i += page_increm;
  		start += page_increm * PAGE_SIZE;
  		nr_pages -= page_increm;
@@ -95873,7 +95768,7 @@ index 123bcd3..0de52ba 100644
  	set_page_address(page, (void *)vaddr);
  
 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 267e419..394bed9 100644
+index a2bfd02..2126298 100644
 --- a/mm/hugetlb.c
 +++ b/mm/hugetlb.c
 @@ -2258,6 +2258,7 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
@@ -97019,10 +96914,10 @@ index 0e0961b..c9143b9 100644
  		capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE);
  
 diff --git a/mm/migrate.c b/mm/migrate.c
-index 344cdf6..07399500 100644
+index be6d1ed..d778cc1 100644
 --- a/mm/migrate.c
 +++ b/mm/migrate.c
-@@ -1503,8 +1503,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
+@@ -1504,8 +1504,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
  	 */
  	tcred = __task_cred(task);
  	if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) &&
@@ -101731,7 +101626,7 @@ index df493d6..1145766 100644
  
  	return err;
 diff --git a/net/core/dev.c b/net/core/dev.c
-index 4ff46f8..e877e78 100644
+index 5dd905c..a95d262 100644
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
 @@ -1680,14 +1680,14 @@ int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
@@ -101751,7 +101646,7 @@ index 4ff46f8..e877e78 100644
  		kfree_skb(skb);
  		return NET_RX_DROP;
  	}
-@@ -2958,7 +2958,7 @@ recursion_alert:
+@@ -2960,7 +2960,7 @@ recursion_alert:
  drop:
  	rcu_read_unlock_bh();
  
@@ -101760,7 +101655,7 @@ index 4ff46f8..e877e78 100644
  	kfree_skb_list(skb);
  	return rc;
  out:
-@@ -3301,7 +3301,7 @@ enqueue:
+@@ -3303,7 +3303,7 @@ enqueue:
  
  	local_irq_restore(flags);
  
@@ -101769,7 +101664,7 @@ index 4ff46f8..e877e78 100644
  	kfree_skb(skb);
  	return NET_RX_DROP;
  }
-@@ -3378,7 +3378,7 @@ int netif_rx_ni(struct sk_buff *skb)
+@@ -3380,7 +3380,7 @@ int netif_rx_ni(struct sk_buff *skb)
  }
  EXPORT_SYMBOL(netif_rx_ni);
  
@@ -101778,7 +101673,7 @@ index 4ff46f8..e877e78 100644
  {
  	struct softnet_data *sd = this_cpu_ptr(&softnet_data);
  
-@@ -3711,7 +3711,7 @@ ncls:
+@@ -3713,7 +3713,7 @@ ncls:
  			ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
  	} else {
  drop:
@@ -101787,7 +101682,7 @@ index 4ff46f8..e877e78 100644
  		kfree_skb(skb);
  		/* Jamal, now you will not able to escape explaining
  		 * me how you were going to use this. :-)
-@@ -4599,7 +4599,7 @@ out_unlock:
+@@ -4601,7 +4601,7 @@ out_unlock:
  	return work;
  }
  
@@ -101796,7 +101691,7 @@ index 4ff46f8..e877e78 100644
  {
  	struct softnet_data *sd = this_cpu_ptr(&softnet_data);
  	unsigned long time_limit = jiffies + 2;
-@@ -6610,8 +6610,8 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
+@@ -6612,8 +6612,8 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
  	} else {
  		netdev_stats_to_stats64(storage, &dev->stats);
  	}
@@ -102153,7 +102048,7 @@ index 3b6899b..cf36238 100644
  	{
  		struct socket *sock;
 diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index 62c67be..361c354 100644
+index 39c444c..361c354 100644
 --- a/net/core/skbuff.c
 +++ b/net/core/skbuff.c
 @@ -2123,7 +2123,7 @@ EXPORT_SYMBOL(__skb_checksum);
@@ -102182,33 +102077,8 @@ index 62c67be..361c354 100644
  						NULL);
  }
  
-@@ -4141,18 +4143,20 @@ EXPORT_SYMBOL(skb_try_coalesce);
-  */
- void skb_scrub_packet(struct sk_buff *skb, bool xnet)
- {
--	if (xnet)
--		skb_orphan(skb);
- 	skb->tstamp.tv64 = 0;
- 	skb->pkt_type = PACKET_HOST;
- 	skb->skb_iif = 0;
- 	skb->ignore_df = 0;
- 	skb_dst_drop(skb);
--	skb->mark = 0;
--	skb_init_secmark(skb);
- 	secpath_reset(skb);
- 	nf_reset(skb);
- 	nf_reset_trace(skb);
-+
-+	if (!xnet)
-+		return;
-+
-+	skb_orphan(skb);
-+	skb->mark = 0;
- }
- EXPORT_SYMBOL_GPL(skb_scrub_packet);
- 
 diff --git a/net/core/sock.c b/net/core/sock.c
-index 1c7a33d..a3817e2 100644
+index a91f99f..603a20c 100644
 --- a/net/core/sock.c
 +++ b/net/core/sock.c
 @@ -441,7 +441,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
@@ -102256,7 +102126,7 @@ index 1c7a33d..a3817e2 100644
  		goto discard_and_relse;
  	}
  
-@@ -888,6 +888,7 @@ set_rcvbuf:
+@@ -907,6 +907,7 @@ set_rcvbuf:
  		}
  		break;
  
@@ -102264,7 +102134,7 @@ index 1c7a33d..a3817e2 100644
  	case SO_ATTACH_BPF:
  		ret = -EINVAL;
  		if (optlen == sizeof(u32)) {
-@@ -900,7 +901,7 @@ set_rcvbuf:
+@@ -919,7 +920,7 @@ set_rcvbuf:
  			ret = sk_attach_bpf(ufd, sk);
  		}
  		break;
@@ -102273,7 +102143,7 @@ index 1c7a33d..a3817e2 100644
  	case SO_DETACH_FILTER:
  		ret = sk_detach_filter(sk);
  		break;
-@@ -1004,12 +1005,12 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+@@ -1023,12 +1024,12 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
  		struct timeval tm;
  	} v;
  
@@ -102289,7 +102159,7 @@ index 1c7a33d..a3817e2 100644
  		return -EINVAL;
  
  	memset(&v, 0, sizeof(v));
-@@ -1147,11 +1148,11 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+@@ -1166,11 +1167,11 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
  
  	case SO_PEERNAME:
  	{
@@ -102303,7 +102173,7 @@ index 1c7a33d..a3817e2 100644
  			return -EINVAL;
  		if (copy_to_user(optval, address, len))
  			return -EFAULT;
-@@ -1236,7 +1237,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+@@ -1255,7 +1256,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
  
  	if (len > lv)
  		len = lv;
@@ -102312,7 +102182,7 @@ index 1c7a33d..a3817e2 100644
  		return -EFAULT;
  lenout:
  	if (put_user(len, optlen))
-@@ -2349,7 +2350,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+@@ -2368,7 +2369,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
  	 */
  	smp_wmb();
  	atomic_set(&sk->sk_refcnt, 1);
@@ -102321,7 +102191,7 @@ index 1c7a33d..a3817e2 100644
  }
  EXPORT_SYMBOL(sock_init_data);
  
-@@ -2477,6 +2478,7 @@ void sock_enable_timestamp(struct sock *sk, int flag)
+@@ -2496,6 +2497,7 @@ void sock_enable_timestamp(struct sock *sk, int flag)
  int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
  		       int level, int type)
  {
@@ -102329,7 +102199,7 @@ index 1c7a33d..a3817e2 100644
  	struct sock_exterr_skb *serr;
  	struct sk_buff *skb;
  	int copied, err;
-@@ -2498,7 +2500,8 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+@@ -2517,7 +2519,8 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
  	sock_recv_timestamp(msg, sk, skb);
  
  	serr = SKB_EXT_ERR(skb);
@@ -103469,7 +103339,7 @@ index 3075723..aa6f6e5 100644
  					mask |= POLLOUT | POLLWRNORM;
  			}
 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index 075ab4d..8d0580a 100644
+index 08ccca6..28e7ce6 100644
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
 @@ -766,7 +766,7 @@ static void tcp_update_pacing_rate(struct sock *sk)
@@ -103481,7 +103351,7 @@ index 075ab4d..8d0580a 100644
  						sk->sk_max_pacing_rate);
  }
  
-@@ -4528,7 +4528,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
+@@ -4529,7 +4529,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
   * simplifies code)
   */
  static void
@@ -103490,7 +103360,7 @@ index 075ab4d..8d0580a 100644
  	     struct sk_buff *head, struct sk_buff *tail,
  	     u32 start, u32 end)
  {
-@@ -4786,6 +4786,8 @@ static void tcp_check_space(struct sock *sk)
+@@ -4787,6 +4787,8 @@ static void tcp_check_space(struct sock *sk)
  {
  	if (sock_flag(sk, SOCK_QUEUE_SHRUNK)) {
  		sock_reset_flag(sk, SOCK_QUEUE_SHRUNK);
@@ -103499,7 +103369,7 @@ index 075ab4d..8d0580a 100644
  		if (sk->sk_socket &&
  		    test_bit(SOCK_NOSPACE, &sk->sk_socket->flags))
  			tcp_new_space(sk);
-@@ -5506,6 +5508,7 @@ discard:
+@@ -5507,6 +5509,7 @@ discard:
  	    tcp_paws_reject(&tp->rx_opt, 0))
  		goto discard_and_undo;
  
@@ -103507,7 +103377,7 @@ index 075ab4d..8d0580a 100644
  	if (th->syn) {
  		/* We see SYN without ACK. It is attempt of
  		 * simultaneous connect with crossed SYNs.
-@@ -5556,6 +5559,7 @@ discard:
+@@ -5557,6 +5560,7 @@ discard:
  		goto discard;
  #endif
  	}
@@ -103515,7 +103385,7 @@ index 075ab4d..8d0580a 100644
  	/* "fifth, if neither of the SYN or RST bits is set then
  	 * drop the segment and return."
  	 */
-@@ -5602,7 +5606,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -5603,7 +5607,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  			goto discard;
  
  		if (th->syn) {
@@ -103525,7 +103395,7 @@ index 075ab4d..8d0580a 100644
  			if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
  				return 1;
 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index d22f544..62f6787 100644
+index 982347e..aba8ca8 100644
 --- a/net/ipv4/tcp_ipv4.c
 +++ b/net/ipv4/tcp_ipv4.c
 @@ -89,6 +89,10 @@ int sysctl_tcp_tw_reuse __read_mostly;
@@ -103610,19 +103480,6 @@ index 63d2680..2db9d6b 100644
  	} else if (fastopen) { /* received a valid RST pkt */
  		reqsk_fastopen_remove(sk, req, true);
  		tcp_reset(sk);
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index 9790f39..9f29453 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -2931,6 +2931,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
- 	}
- #endif
- 
-+	/* Do not fool tcpdump (if any), clean our debris */
-+	skb->tstamp.tv64 = 0;
- 	return skb;
- }
- EXPORT_SYMBOL(tcp_make_synack);
 diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
 index ebf5ff5..4d1ff32 100644
 --- a/net/ipv4/tcp_probe.c
@@ -104419,7 +104276,7 @@ index c5c10fa..2577d51 100644
  	struct ctl_table *ipv6_icmp_table;
  	int err;
 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 9c0b54e..5e7bd8f 100644
+index b899793..b783604 100644
 --- a/net/ipv6/tcp_ipv6.c
 +++ b/net/ipv6/tcp_ipv6.c
 @@ -104,6 +104,10 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
@@ -104443,7 +104300,7 @@ index 9c0b54e..5e7bd8f 100644
  	tcp_v6_send_reset(sk, skb);
  discard:
  	if (opt_skb)
-@@ -1443,12 +1450,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
+@@ -1452,12 +1459,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
  
  	sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
  				inet6_iif(skb));
@@ -104466,7 +104323,7 @@ index 9c0b54e..5e7bd8f 100644
  
  	if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
  		NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
-@@ -1499,6 +1514,10 @@ csum_error:
+@@ -1508,6 +1523,10 @@ csum_error:
  bad_packet:
  		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
  	} else {
@@ -105631,10 +105488,10 @@ index 6a55f71..e88c937 100644
  };
  
 diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
-index 2034c6d..1a24f03 100644
+index 296cc24..0f4115d 100644
 --- a/net/openvswitch/vport.c
 +++ b/net/openvswitch/vport.c
-@@ -305,10 +305,10 @@ void ovs_vport_get_stats(struct vport *vport, struct ovs_vport_stats *stats)
+@@ -303,10 +303,10 @@ void ovs_vport_get_stats(struct vport *vport, struct ovs_vport_stats *stats)
  	 * netdev-stats can be directly read over netlink-ioctl.
  	 */
  
@@ -105649,7 +105506,7 @@ index 2034c6d..1a24f03 100644
  
  	for_each_possible_cpu(i) {
  		const struct pcpu_sw_netstats *percpu_stats;
-@@ -539,19 +539,19 @@ static void ovs_vport_record_error(struct vport *vport,
+@@ -537,19 +537,19 @@ static void ovs_vport_record_error(struct vport *vport,
  {
  	switch (err_type) {
  	case VPORT_E_RX_DROPPED:

diff --git a/3.14.39/4425_grsec_remove_EI_PAX.patch b/3.19.6/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 3.14.39/4425_grsec_remove_EI_PAX.patch
rename to 3.19.6/4425_grsec_remove_EI_PAX.patch

diff --git a/3.19.5/4427_force_XATTR_PAX_tmpfs.patch b/3.19.6/4427_force_XATTR_PAX_tmpfs.patch
similarity index 100%
rename from 3.19.5/4427_force_XATTR_PAX_tmpfs.patch
rename to 3.19.6/4427_force_XATTR_PAX_tmpfs.patch

diff --git a/3.14.39/4430_grsec-remove-localversion-grsec.patch b/3.19.6/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 3.14.39/4430_grsec-remove-localversion-grsec.patch
rename to 3.19.6/4430_grsec-remove-localversion-grsec.patch

diff --git a/3.19.5/4435_grsec-mute-warnings.patch b/3.19.6/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 3.19.5/4435_grsec-mute-warnings.patch
rename to 3.19.6/4435_grsec-mute-warnings.patch

diff --git a/3.14.39/4440_grsec-remove-protected-paths.patch b/3.19.6/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 3.14.39/4440_grsec-remove-protected-paths.patch
rename to 3.19.6/4440_grsec-remove-protected-paths.patch

diff --git a/3.19.5/4450_grsec-kconfig-default-gids.patch b/3.19.6/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 3.19.5/4450_grsec-kconfig-default-gids.patch
rename to 3.19.6/4450_grsec-kconfig-default-gids.patch

diff --git a/3.19.5/4465_selinux-avc_audit-log-curr_ip.patch b/3.19.6/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 3.19.5/4465_selinux-avc_audit-log-curr_ip.patch
rename to 3.19.6/4465_selinux-avc_audit-log-curr_ip.patch

diff --git a/3.19.5/4470_disable-compat_vdso.patch b/3.19.6/4470_disable-compat_vdso.patch
similarity index 100%
rename from 3.19.5/4470_disable-compat_vdso.patch
rename to 3.19.6/4470_disable-compat_vdso.patch

diff --git a/3.14.39/4475_emutramp_default_on.patch b/3.19.6/4475_emutramp_default_on.patch
similarity index 100%
rename from 3.14.39/4475_emutramp_default_on.patch
rename to 3.19.6/4475_emutramp_default_on.patch