[gentoo-commits] proj/hardened-patchset:master commit in: 4.8.15/

[Anthony G. Basile]

commit:     1b413d517df92fadb5758bba4463c8bd6f73fb25
Author:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Sun Jan  1 19:54:26 2017 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Sun Jan  1 19:54:26 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-patchset.git/commit/?id=1b413d51

grsecurity-3.1-4.8.15-201612301949

 4.8.15/0000_README                                 |   18 +-
 4.8.15/1012_linux-4.8.13.patch                     | 1063 ------------
 4.8.15/1013_linux-4.8.14.patch                     | 1725 --------------------
 4.8.15/1014_linux-4.8.15.patch                     | 1042 ------------
 ... 4420_grsecurity-3.1-4.8.15-201612301949.patch} |   14 +-
 4.8.15/4426_default_XATTR_PAX_FLAGS.patch          |   36 +
 6 files changed, 50 insertions(+), 3848 deletions(-)

diff --git a/4.8.15/0000_README b/4.8.15/0000_README
index cd91d08..97a03a1 100644
--- a/4.8.15/0000_README
+++ b/4.8.15/0000_README
@@ -2,19 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1012_linux-4.8.13.patch
-From:	http://www.kernel.org
-Desc:	Linux 4.8.13
-
-Patch:	1013_linux-4.8.14.patch
-From:	http://www.kernel.org
-Desc:	Linux 4.8.14
-
-Patch:	1014_linux-4.8.15.patch
-From:	http://www.kernel.org
-Desc:	Linux 4.8.15
-
-Patch:	4420_grsecurity-3.1-4.8.15-201612151923.patch
+Patch:	4420_grsecurity-3.1-4.8.15-201612301949.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
@@ -22,6 +10,10 @@ Patch:	4425_grsec_remove_EI_PAX.patch
 From:	Anthony G. Basile <blueness@g.o>
 Desc:	Remove EI_PAX option and force off
 
+Patch:	4426_default_XATTR_PAX_FLAGS.patch
+From:	Anthony G. Basile <blueness@g.o>
+Desc:	Defalut PT_PAX_FLAGS off and XATTR_PAX_FLAGS on
+
 Patch:	4427_force_XATTR_PAX_tmpfs.patch
 From:	Anthony G. Basile <blueness@g.o>
 Desc:	Force XATTR_PAX on tmpfs

diff --git a/4.8.15/1012_linux-4.8.13.patch b/4.8.15/1012_linux-4.8.13.patch
deleted file mode 100644
index c742393..0000000
--- a/4.8.15/1012_linux-4.8.13.patch
+++ /dev/null
@@ -1,1063 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 7b0c92f..b38abe9 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 8
--SUBLEVEL = 12
-+SUBLEVEL = 13
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
- 
-diff --git a/arch/arc/include/asm/delay.h b/arch/arc/include/asm/delay.h
-index 08e7e2a..a36e860 100644
---- a/arch/arc/include/asm/delay.h
-+++ b/arch/arc/include/asm/delay.h
-@@ -22,10 +22,11 @@
- static inline void __delay(unsigned long loops)
- {
- 	__asm__ __volatile__(
--	"	lp  1f	\n"
--	"	nop	\n"
--	"1:		\n"
--	: "+l"(loops));
-+	"	mov lp_count, %0	\n"
-+	"	lp  1f			\n"
-+	"	nop			\n"
-+	"1:				\n"
-+	: : "r"(loops));
- }
- 
- extern void __bad_udelay(void);
-diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
-index 89eeb37..e94ca72 100644
---- a/arch/arc/include/asm/pgtable.h
-+++ b/arch/arc/include/asm/pgtable.h
-@@ -280,7 +280,7 @@ static inline void pmd_set(pmd_t *pmdp, pte_t *ptep)
- 
- #define pte_page(pte)		pfn_to_page(pte_pfn(pte))
- #define mk_pte(page, prot)	pfn_pte(page_to_pfn(page), prot)
--#define pfn_pte(pfn, prot)	__pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot))
-+#define pfn_pte(pfn, prot)	__pte(__pfn_to_phys(pfn) | pgprot_val(prot))
- 
- /* Don't use virt_to_pfn for macros below: could cause truncations for PAE40*/
- #define pte_pfn(pte)		(pte_val(pte) >> PAGE_SHIFT)
-diff --git a/arch/arm64/boot/dts/arm/juno-r1.dts b/arch/arm64/boot/dts/arm/juno-r1.dts
-index 123a58b..f0b857d 100644
---- a/arch/arm64/boot/dts/arm/juno-r1.dts
-+++ b/arch/arm64/boot/dts/arm/juno-r1.dts
-@@ -76,7 +76,7 @@
- 				compatible = "arm,idle-state";
- 				arm,psci-suspend-param = <0x1010000>;
- 				local-timer-stop;
--				entry-latency-us = <300>;
-+				entry-latency-us = <400>;
- 				exit-latency-us = <1200>;
- 				min-residency-us = <2500>;
- 			};
-diff --git a/arch/arm64/boot/dts/arm/juno-r2.dts b/arch/arm64/boot/dts/arm/juno-r2.dts
-index 007be82..26aaa6a 100644
---- a/arch/arm64/boot/dts/arm/juno-r2.dts
-+++ b/arch/arm64/boot/dts/arm/juno-r2.dts
-@@ -76,7 +76,7 @@
- 				compatible = "arm,idle-state";
- 				arm,psci-suspend-param = <0x1010000>;
- 				local-timer-stop;
--				entry-latency-us = <300>;
-+				entry-latency-us = <400>;
- 				exit-latency-us = <1200>;
- 				min-residency-us = <2500>;
- 			};
-diff --git a/arch/arm64/boot/dts/arm/juno.dts b/arch/arm64/boot/dts/arm/juno.dts
-index a7270ef..6e154d9 100644
---- a/arch/arm64/boot/dts/arm/juno.dts
-+++ b/arch/arm64/boot/dts/arm/juno.dts
-@@ -76,7 +76,7 @@
- 				compatible = "arm,idle-state";
- 				arm,psci-suspend-param = <0x1010000>;
- 				local-timer-stop;
--				entry-latency-us = <300>;
-+				entry-latency-us = <400>;
- 				exit-latency-us = <1200>;
- 				min-residency-us = <2500>;
- 			};
-diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
-index 7099f26..b96346b 100644
---- a/arch/arm64/include/asm/cpufeature.h
-+++ b/arch/arm64/include/asm/cpufeature.h
-@@ -90,7 +90,7 @@ struct arm64_cpu_capabilities {
- 	u16 capability;
- 	int def_scope;			/* default scope */
- 	bool (*matches)(const struct arm64_cpu_capabilities *caps, int scope);
--	void (*enable)(void *);		/* Called on all active CPUs */
-+	int (*enable)(void *);		/* Called on all active CPUs */
- 	union {
- 		struct {	/* To be used for erratum handling only */
- 			u32 midr_model;
-diff --git a/arch/arm64/include/asm/exec.h b/arch/arm64/include/asm/exec.h
-index db0563c..f7865dd 100644
---- a/arch/arm64/include/asm/exec.h
-+++ b/arch/arm64/include/asm/exec.h
-@@ -18,6 +18,9 @@
- #ifndef __ASM_EXEC_H
- #define __ASM_EXEC_H
- 
-+#include <linux/sched.h>
-+
- extern unsigned long arch_align_stack(unsigned long sp);
-+void uao_thread_switch(struct task_struct *next);
- 
- #endif	/* __ASM_EXEC_H */
-diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
-index ace0a96..3be0ab0 100644
---- a/arch/arm64/include/asm/processor.h
-+++ b/arch/arm64/include/asm/processor.h
-@@ -190,8 +190,8 @@ static inline void spin_lock_prefetch(const void *ptr)
- 
- #endif
- 
--void cpu_enable_pan(void *__unused);
--void cpu_enable_uao(void *__unused);
--void cpu_enable_cache_maint_trap(void *__unused);
-+int cpu_enable_pan(void *__unused);
-+int cpu_enable_uao(void *__unused);
-+int cpu_enable_cache_maint_trap(void *__unused);
- 
- #endif /* __ASM_PROCESSOR_H */
-diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
-index 62272ea..94a0330 100644
---- a/arch/arm64/kernel/cpufeature.c
-+++ b/arch/arm64/kernel/cpufeature.c
-@@ -19,7 +19,9 @@
- #define pr_fmt(fmt) "CPU features: " fmt
- 
- #include <linux/bsearch.h>
-+#include <linux/cpumask.h>
- #include <linux/sort.h>
-+#include <linux/stop_machine.h>
- #include <linux/types.h>
- #include <asm/cpu.h>
- #include <asm/cpufeature.h>
-@@ -936,7 +938,13 @@ void __init enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps)
- {
- 	for (; caps->matches; caps++)
- 		if (caps->enable && cpus_have_cap(caps->capability))
--			on_each_cpu(caps->enable, NULL, true);
-+			/*
-+			 * Use stop_machine() as it schedules the work allowing
-+			 * us to modify PSTATE, instead of on_each_cpu() which
-+			 * uses an IPI, giving us a PSTATE that disappears when
-+			 * we return.
-+			 */
-+			stop_machine(caps->enable, NULL, cpu_online_mask);
- }
- 
- /*
-diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
-index 6cd2612..9cc8667 100644
---- a/arch/arm64/kernel/process.c
-+++ b/arch/arm64/kernel/process.c
-@@ -49,6 +49,7 @@
- #include <asm/alternative.h>
- #include <asm/compat.h>
- #include <asm/cacheflush.h>
-+#include <asm/exec.h>
- #include <asm/fpsimd.h>
- #include <asm/mmu_context.h>
- #include <asm/processor.h>
-@@ -303,7 +304,7 @@ static void tls_thread_switch(struct task_struct *next)
- }
- 
- /* Restore the UAO state depending on next's addr_limit */
--static void uao_thread_switch(struct task_struct *next)
-+void uao_thread_switch(struct task_struct *next)
- {
- 	if (IS_ENABLED(CONFIG_ARM64_UAO)) {
- 		if (task_thread_info(next)->addr_limit == KERNEL_DS)
-diff --git a/arch/arm64/kernel/suspend.c b/arch/arm64/kernel/suspend.c
-index b616e365..23ddf55 100644
---- a/arch/arm64/kernel/suspend.c
-+++ b/arch/arm64/kernel/suspend.c
-@@ -1,8 +1,11 @@
- #include <linux/ftrace.h>
- #include <linux/percpu.h>
- #include <linux/slab.h>
-+#include <asm/alternative.h>
- #include <asm/cacheflush.h>
-+#include <asm/cpufeature.h>
- #include <asm/debug-monitors.h>
-+#include <asm/exec.h>
- #include <asm/pgtable.h>
- #include <asm/memory.h>
- #include <asm/mmu_context.h>
-@@ -48,6 +51,14 @@ void notrace __cpu_suspend_exit(void)
- 	set_my_cpu_offset(per_cpu_offset(smp_processor_id()));
- 
- 	/*
-+	 * PSTATE was not saved over suspend/resume, re-enable any detected
-+	 * features that might not have been set correctly.
-+	 */
-+	asm(ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN,
-+			CONFIG_ARM64_PAN));
-+	uao_thread_switch(current);
-+
-+	/*
- 	 * Restore HW breakpoint registers to sane values
- 	 * before debug exceptions are possibly reenabled
- 	 * through local_dbg_restore.
-diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
-index 771a01a7f..9595d3d 100644
---- a/arch/arm64/kernel/traps.c
-+++ b/arch/arm64/kernel/traps.c
-@@ -428,9 +428,10 @@ asmlinkage void __exception do_undefinstr(struct pt_regs *regs)
- 	force_signal_inject(SIGILL, ILL_ILLOPC, regs, 0);
- }
- 
--void cpu_enable_cache_maint_trap(void *__unused)
-+int cpu_enable_cache_maint_trap(void *__unused)
- {
- 	config_sctlr_el1(SCTLR_EL1_UCI, 0);
-+	return 0;
- }
- 
- #define __user_cache_maint(insn, address, res)			\
-diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
-index 05d2bd7..67506c3 100644
---- a/arch/arm64/mm/fault.c
-+++ b/arch/arm64/mm/fault.c
-@@ -29,7 +29,9 @@
- #include <linux/sched.h>
- #include <linux/highmem.h>
- #include <linux/perf_event.h>
-+#include <linux/preempt.h>
- 
-+#include <asm/bug.h>
- #include <asm/cpufeature.h>
- #include <asm/exception.h>
- #include <asm/debug-monitors.h>
-@@ -671,9 +673,17 @@ asmlinkage int __exception do_debug_exception(unsigned long addr,
- NOKPROBE_SYMBOL(do_debug_exception);
- 
- #ifdef CONFIG_ARM64_PAN
--void cpu_enable_pan(void *__unused)
-+int cpu_enable_pan(void *__unused)
- {
-+	/*
-+	 * We modify PSTATE. This won't work from irq context as the PSTATE
-+	 * is discarded once we return from the exception.
-+	 */
-+	WARN_ON_ONCE(in_interrupt());
-+
- 	config_sctlr_el1(SCTLR_EL1_SPAN, 0);
-+	asm(SET_PSTATE_PAN(1));
-+	return 0;
- }
- #endif /* CONFIG_ARM64_PAN */
- 
-@@ -684,8 +694,9 @@ void cpu_enable_pan(void *__unused)
-  * We need to enable the feature at runtime (instead of adding it to
-  * PSR_MODE_EL1h) as the feature may not be implemented by the cpu.
-  */
--void cpu_enable_uao(void *__unused)
-+int cpu_enable_uao(void *__unused)
- {
- 	asm(SET_PSTATE_UAO(1));
-+	return 0;
- }
- #endif /* CONFIG_ARM64_UAO */
-diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
-index d0efb5c..a4e070a 100644
---- a/arch/x86/events/core.c
-+++ b/arch/x86/events/core.c
-@@ -2344,7 +2344,7 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry_ctx *ent
- 		frame.next_frame     = 0;
- 		frame.return_address = 0;
- 
--		if (!access_ok(VERIFY_READ, fp, 8))
-+		if (!valid_user_frame(fp, sizeof(frame)))
- 			break;
- 
- 		bytes = __copy_from_user_nmi(&frame.next_frame, fp, 4);
-@@ -2354,9 +2354,6 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry_ctx *ent
- 		if (bytes != 0)
- 			break;
- 
--		if (!valid_user_frame(fp, sizeof(frame)))
--			break;
--
- 		perf_callchain_store(entry, cs_base + frame.return_address);
- 		fp = compat_ptr(ss_base + frame.next_frame);
- 	}
-@@ -2405,7 +2402,7 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs
- 		frame.next_frame	     = NULL;
- 		frame.return_address = 0;
- 
--		if (!access_ok(VERIFY_READ, fp, sizeof(*fp) * 2))
-+		if (!valid_user_frame(fp, sizeof(frame)))
- 			break;
- 
- 		bytes = __copy_from_user_nmi(&frame.next_frame, fp, sizeof(*fp));
-@@ -2415,9 +2412,6 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs
- 		if (bytes != 0)
- 			break;
- 
--		if (!valid_user_frame(fp, sizeof(frame)))
--			break;
--
- 		perf_callchain_store(entry, frame.return_address);
- 		fp = (void __user *)frame.next_frame;
- 	}
-diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
-index e207b33..1e007a9 100644
---- a/drivers/ata/libata-scsi.c
-+++ b/drivers/ata/libata-scsi.c
-@@ -1088,7 +1088,7 @@ static void ata_gen_passthru_sense(struct ata_queued_cmd *qc)
- 		desc[1] = tf->command; /* status */
- 		desc[2] = tf->device;
- 		desc[3] = tf->nsect;
--		desc[0] = 0;
-+		desc[7] = 0;
- 		if (tf->flags & ATA_TFLAG_LBA48)  {
- 			desc[8] |= 0x80;
- 			if (tf->hob_nsect)
-diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
-index 04365b1..5163c8f 100644
---- a/drivers/block/zram/zram_drv.c
-+++ b/drivers/block/zram/zram_drv.c
-@@ -1403,7 +1403,8 @@ static ssize_t hot_remove_store(struct class *class,
- 	zram = idr_find(&zram_index_idr, dev_id);
- 	if (zram) {
- 		ret = zram_remove(zram);
--		idr_remove(&zram_index_idr, dev_id);
-+		if (!ret)
-+			idr_remove(&zram_index_idr, dev_id);
- 	} else {
- 		ret = -ENODEV;
- 	}
-diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c
-index 838b22a..f2c9274 100644
---- a/drivers/clk/sunxi/clk-sunxi.c
-+++ b/drivers/clk/sunxi/clk-sunxi.c
-@@ -373,7 +373,7 @@ static void sun4i_get_apb1_factors(struct factors_request *req)
- 	else
- 		calcp = 3;
- 
--	calcm = (req->parent_rate >> calcp) - 1;
-+	calcm = (div >> calcp) - 1;
- 
- 	req->rate = (req->parent_rate >> calcp) / (calcm + 1);
- 	req->m = calcm;
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
-index 10b5ddf..1ed085f 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
-@@ -33,6 +33,7 @@ struct amdgpu_atpx {
- 
- static struct amdgpu_atpx_priv {
- 	bool atpx_detected;
-+	bool bridge_pm_usable;
- 	/* handle for device - and atpx */
- 	acpi_handle dhandle;
- 	acpi_handle other_handle;
-@@ -200,7 +201,11 @@ static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx)
- 	atpx->is_hybrid = false;
- 	if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) {
- 		printk("ATPX Hybrid Graphics\n");
--		atpx->functions.power_cntl = false;
-+		/*
-+		 * Disable legacy PM methods only when pcie port PM is usable,
-+		 * otherwise the device might fail to power off or power on.
-+		 */
-+		atpx->functions.power_cntl = !amdgpu_atpx_priv.bridge_pm_usable;
- 		atpx->is_hybrid = true;
- 	}
- 
-@@ -546,17 +551,25 @@ static bool amdgpu_atpx_detect(void)
- 	struct pci_dev *pdev = NULL;
- 	bool has_atpx = false;
- 	int vga_count = 0;
-+	bool d3_supported = false;
-+	struct pci_dev *parent_pdev;
- 
- 	while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) {
- 		vga_count++;
- 
- 		has_atpx |= (amdgpu_atpx_pci_probe_handle(pdev) == true);
-+
-+		parent_pdev = pci_upstream_bridge(pdev);
-+		d3_supported |= parent_pdev && parent_pdev->bridge_d3;
- 	}
- 
- 	while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) {
- 		vga_count++;
- 
- 		has_atpx |= (amdgpu_atpx_pci_probe_handle(pdev) == true);
-+
-+		parent_pdev = pci_upstream_bridge(pdev);
-+		d3_supported |= parent_pdev && parent_pdev->bridge_d3;
- 	}
- 
- 	if (has_atpx && vga_count == 2) {
-@@ -564,6 +577,7 @@ static bool amdgpu_atpx_detect(void)
- 		printk(KERN_INFO "vga_switcheroo: detected switching method %s handle\n",
- 		       acpi_method_name);
- 		amdgpu_atpx_priv.atpx_detected = true;
-+		amdgpu_atpx_priv.bridge_pm_usable = d3_supported;
- 		amdgpu_atpx_init();
- 		return true;
- 	}
-diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
-index a77ce99..b8e3854 100644
---- a/drivers/gpu/drm/i915/i915_gem.c
-+++ b/drivers/gpu/drm/i915/i915_gem.c
-@@ -2540,7 +2540,7 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
- 			page = shmem_read_mapping_page(mapping, i);
- 			if (IS_ERR(page)) {
- 				ret = PTR_ERR(page);
--				goto err_pages;
-+				goto err_sg;
- 			}
- 		}
- #ifdef CONFIG_SWIOTLB
-@@ -2583,8 +2583,9 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
- 
- 	return 0;
- 
--err_pages:
-+err_sg:
- 	sg_mark_end(sg);
-+err_pages:
- 	for_each_sgt_page(page, sgt_iter, st)
- 		put_page(page);
- 	sg_free_table(st);
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index e26f889..35d385d 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -11791,7 +11791,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
- 	intel_crtc->reset_counter = i915_reset_counter(&dev_priv->gpu_error);
- 	if (__i915_reset_in_progress_or_wedged(intel_crtc->reset_counter)) {
- 		ret = -EIO;
--		goto cleanup;
-+		goto unlock;
- 	}
- 
- 	atomic_inc(&intel_crtc->unpin_work_count);
-@@ -11877,6 +11877,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
- 	if (!IS_ERR_OR_NULL(request))
- 		i915_add_request_no_flush(request);
- 	atomic_dec(&intel_crtc->unpin_work_count);
-+unlock:
- 	mutex_unlock(&dev->struct_mutex);
- cleanup:
- 	crtc->primary->fb = old_fb;
-diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
-index 8f62671f..54acfcc 100644
---- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
-+++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
-@@ -249,13 +249,6 @@ static int mtk_disp_ovl_probe(struct platform_device *pdev)
- 	if (irq < 0)
- 		return irq;
- 
--	ret = devm_request_irq(dev, irq, mtk_disp_ovl_irq_handler,
--			       IRQF_TRIGGER_NONE, dev_name(dev), priv);
--	if (ret < 0) {
--		dev_err(dev, "Failed to request irq %d: %d\n", irq, ret);
--		return ret;
--	}
--
- 	comp_id = mtk_ddp_comp_get_id(dev->of_node, MTK_DISP_OVL);
- 	if (comp_id < 0) {
- 		dev_err(dev, "Failed to identify by alias: %d\n", comp_id);
-@@ -271,6 +264,13 @@ static int mtk_disp_ovl_probe(struct platform_device *pdev)
- 
- 	platform_set_drvdata(pdev, priv);
- 
-+	ret = devm_request_irq(dev, irq, mtk_disp_ovl_irq_handler,
-+			       IRQF_TRIGGER_NONE, dev_name(dev), priv);
-+	if (ret < 0) {
-+		dev_err(dev, "Failed to request irq %d: %d\n", irq, ret);
-+		return ret;
-+	}
-+
- 	ret = component_add(dev, &mtk_disp_ovl_component_ops);
- 	if (ret)
- 		dev_err(dev, "Failed to add component: %d\n", ret);
-diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
-index ddef0d4..34b4ace 100644
---- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
-+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
-@@ -33,6 +33,7 @@ struct radeon_atpx {
- 
- static struct radeon_atpx_priv {
- 	bool atpx_detected;
-+	bool bridge_pm_usable;
- 	/* handle for device - and atpx */
- 	acpi_handle dhandle;
- 	struct radeon_atpx atpx;
-@@ -198,7 +199,11 @@ static int radeon_atpx_validate(struct radeon_atpx *atpx)
- 	atpx->is_hybrid = false;
- 	if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) {
- 		printk("ATPX Hybrid Graphics\n");
--		atpx->functions.power_cntl = false;
-+		/*
-+		 * Disable legacy PM methods only when pcie port PM is usable,
-+		 * otherwise the device might fail to power off or power on.
-+		 */
-+		atpx->functions.power_cntl = !radeon_atpx_priv.bridge_pm_usable;
- 		atpx->is_hybrid = true;
- 	}
- 
-@@ -543,11 +548,16 @@ static bool radeon_atpx_detect(void)
- 	struct pci_dev *pdev = NULL;
- 	bool has_atpx = false;
- 	int vga_count = 0;
-+	bool d3_supported = false;
-+	struct pci_dev *parent_pdev;
- 
- 	while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) {
- 		vga_count++;
- 
- 		has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
-+
-+		parent_pdev = pci_upstream_bridge(pdev);
-+		d3_supported |= parent_pdev && parent_pdev->bridge_d3;
- 	}
- 
- 	/* some newer PX laptops mark the dGPU as a non-VGA display device */
-@@ -555,6 +565,9 @@ static bool radeon_atpx_detect(void)
- 		vga_count++;
- 
- 		has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true);
-+
-+		parent_pdev = pci_upstream_bridge(pdev);
-+		d3_supported |= parent_pdev && parent_pdev->bridge_d3;
- 	}
- 
- 	if (has_atpx && vga_count == 2) {
-@@ -562,6 +575,7 @@ static bool radeon_atpx_detect(void)
- 		printk(KERN_INFO "vga_switcheroo: detected switching method %s handle\n",
- 		       acpi_method_name);
- 		radeon_atpx_priv.atpx_detected = true;
-+		radeon_atpx_priv.bridge_pm_usable = d3_supported;
- 		radeon_atpx_init();
- 		return true;
- 	}
-diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
-index 5784e20..9f6203c 100644
---- a/drivers/input/mouse/psmouse-base.c
-+++ b/drivers/input/mouse/psmouse-base.c
-@@ -1115,10 +1115,6 @@ static int psmouse_extensions(struct psmouse *psmouse,
- 		if (psmouse_try_protocol(psmouse, PSMOUSE_TOUCHKIT_PS2,
- 					 &max_proto, set_properties, true))
- 			return PSMOUSE_TOUCHKIT_PS2;
--
--		if (psmouse_try_protocol(psmouse, PSMOUSE_BYD,
--					 &max_proto, set_properties, true))
--			return PSMOUSE_BYD;
- 	}
- 
- 	/*
-diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
-index a8ff969..cbc7dfa 100644
---- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
-+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
-@@ -2203,8 +2203,9 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len,
- 			is_scanning_required = 1;
- 		} else {
- 			mwifiex_dbg(priv->adapter, MSG,
--				    "info: trying to associate to '%s' bssid %pM\n",
--				    (char *)req_ssid.ssid, bss->bssid);
-+				    "info: trying to associate to '%.*s' bssid %pM\n",
-+				    req_ssid.ssid_len, (char *)req_ssid.ssid,
-+				    bss->bssid);
- 			memcpy(&priv->cfg_bssid, bss->bssid, ETH_ALEN);
- 			break;
- 		}
-@@ -2264,8 +2265,8 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
- 	}
- 
- 	mwifiex_dbg(adapter, INFO,
--		    "info: Trying to associate to %s and bssid %pM\n",
--		    (char *)sme->ssid, sme->bssid);
-+		    "info: Trying to associate to %.*s and bssid %pM\n",
-+		    (int)sme->ssid_len, (char *)sme->ssid, sme->bssid);
- 
- 	if (!mwifiex_stop_bg_scan(priv))
- 		cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy);
-@@ -2398,8 +2399,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
- 	}
- 
- 	mwifiex_dbg(priv->adapter, MSG,
--		    "info: trying to join to %s and bssid %pM\n",
--		    (char *)params->ssid, params->bssid);
-+		    "info: trying to join to %.*s and bssid %pM\n",
-+		    params->ssid_len, (char *)params->ssid, params->bssid);
- 
- 	mwifiex_set_ibss_params(priv, params);
- 
-diff --git a/drivers/pci/pcie/aer/aer_inject.c b/drivers/pci/pcie/aer/aer_inject.c
-index db553dc..2b6a592 100644
---- a/drivers/pci/pcie/aer/aer_inject.c
-+++ b/drivers/pci/pcie/aer/aer_inject.c
-@@ -307,20 +307,6 @@ static int pci_bus_set_aer_ops(struct pci_bus *bus)
- 	return 0;
- }
- 
--static struct pci_dev *pcie_find_root_port(struct pci_dev *dev)
--{
--	while (1) {
--		if (!pci_is_pcie(dev))
--			break;
--		if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT)
--			return dev;
--		if (!dev->bus->self)
--			break;
--		dev = dev->bus->self;
--	}
--	return NULL;
--}
--
- static int find_aer_device_iter(struct device *device, void *data)
- {
- 	struct pcie_device **result = data;
-diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
-index 93f280d..f6eff4a 100644
---- a/drivers/pci/probe.c
-+++ b/drivers/pci/probe.c
-@@ -1439,6 +1439,21 @@ static void program_hpp_type1(struct pci_dev *dev, struct hpp_type1 *hpp)
- 		dev_warn(&dev->dev, "PCI-X settings not supported\n");
- }
- 
-+static bool pcie_root_rcb_set(struct pci_dev *dev)
-+{
-+	struct pci_dev *rp = pcie_find_root_port(dev);
-+	u16 lnkctl;
-+
-+	if (!rp)
-+		return false;
-+
-+	pcie_capability_read_word(rp, PCI_EXP_LNKCTL, &lnkctl);
-+	if (lnkctl & PCI_EXP_LNKCTL_RCB)
-+		return true;
-+
-+	return false;
-+}
-+
- static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp)
- {
- 	int pos;
-@@ -1468,9 +1483,20 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp)
- 			~hpp->pci_exp_devctl_and, hpp->pci_exp_devctl_or);
- 
- 	/* Initialize Link Control Register */
--	if (pcie_cap_has_lnkctl(dev))
-+	if (pcie_cap_has_lnkctl(dev)) {
-+
-+		/*
-+		 * If the Root Port supports Read Completion Boundary of
-+		 * 128, set RCB to 128.  Otherwise, clear it.
-+		 */
-+		hpp->pci_exp_lnkctl_and |= PCI_EXP_LNKCTL_RCB;
-+		hpp->pci_exp_lnkctl_or &= ~PCI_EXP_LNKCTL_RCB;
-+		if (pcie_root_rcb_set(dev))
-+			hpp->pci_exp_lnkctl_or |= PCI_EXP_LNKCTL_RCB;
-+
- 		pcie_capability_clear_and_set_word(dev, PCI_EXP_LNKCTL,
- 			~hpp->pci_exp_lnkctl_and, hpp->pci_exp_lnkctl_or);
-+	}
- 
- 	/* Find Advanced Error Reporting Enhanced Capability */
- 	pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
-diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
-index 0296d81..a813239 100644
---- a/drivers/pwm/sysfs.c
-+++ b/drivers/pwm/sysfs.c
-@@ -425,6 +425,8 @@ void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
- 		if (test_bit(PWMF_EXPORTED, &pwm->flags))
- 			pwm_unexport_child(parent, pwm);
- 	}
-+
-+	put_device(parent);
- }
- 
- static int __init pwm_sysfs_init(void)
-diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
-index 030d002..5138a84 100644
---- a/drivers/scsi/hpsa.c
-+++ b/drivers/scsi/hpsa.c
-@@ -2007,7 +2007,7 @@ static struct hpsa_scsi_dev_t *lookup_hpsa_scsi_dev(struct ctlr_info *h,
- 
- static int hpsa_slave_alloc(struct scsi_device *sdev)
- {
--	struct hpsa_scsi_dev_t *sd;
-+	struct hpsa_scsi_dev_t *sd = NULL;
- 	unsigned long flags;
- 	struct ctlr_info *h;
- 
-@@ -2024,7 +2024,8 @@ static int hpsa_slave_alloc(struct scsi_device *sdev)
- 			sd->target = sdev_id(sdev);
- 			sd->lun = sdev->lun;
- 		}
--	} else
-+	}
-+	if (!sd)
- 		sd = lookup_hpsa_scsi_dev(h, sdev_channel(sdev),
- 					sdev_id(sdev), sdev->lun);
- 
-@@ -3805,6 +3806,7 @@ static int hpsa_update_device_info(struct ctlr_info *h,
- 		sizeof(this_device->vendor));
- 	memcpy(this_device->model, &inq_buff[16],
- 		sizeof(this_device->model));
-+	this_device->rev = inq_buff[2];
- 	memset(this_device->device_id, 0,
- 		sizeof(this_device->device_id));
- 	hpsa_get_device_id(h, scsi3addr, this_device->device_id, 8,
-@@ -3887,10 +3889,14 @@ static void figure_bus_target_lun(struct ctlr_info *h,
- 
- 	if (!is_logical_dev_addr_mode(lunaddrbytes)) {
- 		/* physical device, target and lun filled in later */
--		if (is_hba_lunid(lunaddrbytes))
-+		if (is_hba_lunid(lunaddrbytes)) {
-+			int bus = HPSA_HBA_BUS;
-+
-+			if (!device->rev)
-+				bus = HPSA_LEGACY_HBA_BUS;
- 			hpsa_set_bus_target_lun(device,
--					HPSA_HBA_BUS, 0, lunid & 0x3fff);
--		else
-+					bus, 0, lunid & 0x3fff);
-+		} else
- 			/* defer target, lun assignment for physical devices */
- 			hpsa_set_bus_target_lun(device,
- 					HPSA_PHYSICAL_DEVICE_BUS, -1, -1);
-diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
-index a1487e6..9d45dde 100644
---- a/drivers/scsi/hpsa.h
-+++ b/drivers/scsi/hpsa.h
-@@ -69,6 +69,7 @@ struct hpsa_scsi_dev_t {
- 	u64 sas_address;
- 	unsigned char vendor[8];        /* bytes 8-15 of inquiry data */
- 	unsigned char model[16];        /* bytes 16-31 of inquiry data */
-+	unsigned char rev;		/* byte 2 of inquiry data */
- 	unsigned char raid_level;	/* from inquiry page 0xC1 */
- 	unsigned char volume_offline;	/* discovered via TUR or VPD */
- 	u16 queue_depth;		/* max queue_depth for this device */
-@@ -403,6 +404,7 @@ struct offline_device_entry {
- #define HPSA_RAID_VOLUME_BUS		1
- #define HPSA_EXTERNAL_RAID_VOLUME_BUS	2
- #define HPSA_HBA_BUS			0
-+#define HPSA_LEGACY_HBA_BUS		3
- 
- /*
- 	Send the command to the hardware
-diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
-index 04ce7cf..50c7167 100644
---- a/drivers/scsi/libfc/fc_lport.c
-+++ b/drivers/scsi/libfc/fc_lport.c
-@@ -308,7 +308,7 @@ struct fc_host_statistics *fc_get_host_stats(struct Scsi_Host *shost)
- 	fc_stats = &lport->host_stats;
- 	memset(fc_stats, 0, sizeof(struct fc_host_statistics));
- 
--	fc_stats->seconds_since_last_reset = (lport->boot_time - jiffies) / HZ;
-+	fc_stats->seconds_since_last_reset = (jiffies - lport->boot_time) / HZ;
- 
- 	for_each_possible_cpu(cpu) {
- 		struct fc_stats *stats;
-diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
-index a78415d..78be4ae 100644
---- a/fs/overlayfs/super.c
-+++ b/fs/overlayfs/super.c
-@@ -329,11 +329,11 @@ static struct dentry *ovl_d_real(struct dentry *dentry,
- 	if (!real)
- 		goto bug;
- 
-+	/* Handle recursion */
-+	real = d_real(real, inode, open_flags);
-+
- 	if (!inode || inode == d_inode(real))
- 		return real;
--
--	/* Handle recursion */
--	return d_real(real, inode, open_flags);
- bug:
- 	WARN(1, "ovl_d_real(%pd4, %s:%lu): real dentry not found\n", dentry,
- 	     inode ? inode->i_sb->s_id : "NULL", inode ? inode->i_ino : 0);
-diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
-index 573c5a1..0a0b2d5 100644
---- a/include/linux/compiler-gcc.h
-+++ b/include/linux/compiler-gcc.h
-@@ -256,7 +256,9 @@
- #endif
- #endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP && !__CHECKER__ */
- 
--#if GCC_VERSION >= 50000
-+#if GCC_VERSION >= 70000
-+#define KASAN_ABI_VERSION 5
-+#elif GCC_VERSION >= 50000
- #define KASAN_ABI_VERSION 4
- #elif GCC_VERSION >= 40902
- #define KASAN_ABI_VERSION 3
-diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
-index 01e8443..d47cc4a 100644
---- a/include/linux/pagemap.h
-+++ b/include/linux/pagemap.h
-@@ -364,16 +364,13 @@ static inline struct page *read_mapping_page(struct address_space *mapping,
- }
- 
- /*
-- * Get the offset in PAGE_SIZE.
-- * (TODO: hugepage should have ->index in PAGE_SIZE)
-+ * Get index of the page with in radix-tree
-+ * (TODO: remove once hugetlb pages will have ->index in PAGE_SIZE)
-  */
--static inline pgoff_t page_to_pgoff(struct page *page)
-+static inline pgoff_t page_to_index(struct page *page)
- {
- 	pgoff_t pgoff;
- 
--	if (unlikely(PageHeadHuge(page)))
--		return page->index << compound_order(page);
--
- 	if (likely(!PageTransTail(page)))
- 		return page->index;
- 
-@@ -387,6 +384,18 @@ static inline pgoff_t page_to_pgoff(struct page *page)
- }
- 
- /*
-+ * Get the offset in PAGE_SIZE.
-+ * (TODO: hugepage should have ->index in PAGE_SIZE)
-+ */
-+static inline pgoff_t page_to_pgoff(struct page *page)
-+{
-+	if (unlikely(PageHeadHuge(page)))
-+		return page->index << compound_order(page);
-+
-+	return page_to_index(page);
-+}
-+
-+/*
-  * Return byte-offset into filesystem object for page.
-  */
- static inline loff_t page_offset(struct page *page)
-diff --git a/include/linux/pci.h b/include/linux/pci.h
-index 0ab8359..03f3df0 100644
---- a/include/linux/pci.h
-+++ b/include/linux/pci.h
-@@ -1896,6 +1896,20 @@ static inline int pci_pcie_type(const struct pci_dev *dev)
- 	return (pcie_caps_reg(dev) & PCI_EXP_FLAGS_TYPE) >> 4;
- }
- 
-+static inline struct pci_dev *pcie_find_root_port(struct pci_dev *dev)
-+{
-+	while (1) {
-+		if (!pci_is_pcie(dev))
-+			break;
-+		if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT)
-+			return dev;
-+		if (!dev->bus->self)
-+			break;
-+		dev = dev->bus->self;
-+	}
-+	return NULL;
-+}
-+
- void pci_request_acs(void);
- bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags);
- bool pci_acs_path_enabled(struct pci_dev *start,
-diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
-index d6d071f..3af60ee 100644
---- a/include/uapi/linux/input-event-codes.h
-+++ b/include/uapi/linux/input-event-codes.h
-@@ -640,7 +640,7 @@
-  * Control a data application associated with the currently viewed channel,
-  * e.g. teletext or data broadcast application (MHEG, MHP, HbbTV, etc.)
-  */
--#define KEY_DATA			0x275
-+#define KEY_DATA			0x277
- 
- #define BTN_TRIGGER_HAPPY		0x2c0
- #define BTN_TRIGGER_HAPPY1		0x2c0
-diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
-index 0082fce..85c5a88 100644
---- a/kernel/rcu/tree_plugin.h
-+++ b/kernel/rcu/tree_plugin.h
-@@ -2173,6 +2173,7 @@ static int rcu_nocb_kthread(void *arg)
- 				cl++;
- 			c++;
- 			local_bh_enable();
-+			cond_resched_rcu_qs();
- 			list = next;
- 		}
- 		trace_rcu_batch_end(rdp->rsp->name, c, !!list, 0, 0, 1);
-diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
-index e5c2181f..03f4545 100644
---- a/mm/kasan/kasan.h
-+++ b/mm/kasan/kasan.h
-@@ -53,6 +53,9 @@ struct kasan_global {
- #if KASAN_ABI_VERSION >= 4
- 	struct kasan_source_location *location;
- #endif
-+#if KASAN_ABI_VERSION >= 5
-+	char *odr_indicator;
-+#endif
- };
- 
- /**
-diff --git a/mm/khugepaged.c b/mm/khugepaged.c
-index 728d779..87e1a7ca 100644
---- a/mm/khugepaged.c
-+++ b/mm/khugepaged.c
-@@ -103,6 +103,7 @@ static struct khugepaged_scan khugepaged_scan = {
- 	.mm_head = LIST_HEAD_INIT(khugepaged_scan.mm_head),
- };
- 
-+#ifdef CONFIG_SYSFS
- static ssize_t scan_sleep_millisecs_show(struct kobject *kobj,
- 					 struct kobj_attribute *attr,
- 					 char *buf)
-@@ -295,6 +296,7 @@ struct attribute_group khugepaged_attr_group = {
- 	.attrs = khugepaged_attr,
- 	.name = "khugepaged",
- };
-+#endif /* CONFIG_SYSFS */
- 
- #define VM_NO_KHUGEPAGED (VM_SPECIAL | VM_HUGETLB)
- 
-diff --git a/mm/mlock.c b/mm/mlock.c
-index 14645be..9c91acc 100644
---- a/mm/mlock.c
-+++ b/mm/mlock.c
-@@ -190,10 +190,13 @@ unsigned int munlock_vma_page(struct page *page)
- 	 */
- 	spin_lock_irq(zone_lru_lock(zone));
- 
--	nr_pages = hpage_nr_pages(page);
--	if (!TestClearPageMlocked(page))
-+	if (!TestClearPageMlocked(page)) {
-+		/* Potentially, PTE-mapped THP: do not skip the rest PTEs */
-+		nr_pages = 1;
- 		goto unlock_out;
-+	}
- 
-+	nr_pages = hpage_nr_pages(page);
- 	__mod_zone_page_state(zone, NR_MLOCK, -nr_pages);
- 
- 	if (__munlock_isolate_lru_page(page, true)) {
-diff --git a/mm/truncate.c b/mm/truncate.c
-index a01cce4..8d8c62d 100644
---- a/mm/truncate.c
-+++ b/mm/truncate.c
-@@ -283,7 +283,7 @@ void truncate_inode_pages_range(struct address_space *mapping,
- 
- 			if (!trylock_page(page))
- 				continue;
--			WARN_ON(page_to_pgoff(page) != index);
-+			WARN_ON(page_to_index(page) != index);
- 			if (PageWriteback(page)) {
- 				unlock_page(page);
- 				continue;
-@@ -371,7 +371,7 @@ void truncate_inode_pages_range(struct address_space *mapping,
- 			}
- 
- 			lock_page(page);
--			WARN_ON(page_to_pgoff(page) != index);
-+			WARN_ON(page_to_index(page) != index);
- 			wait_on_page_writeback(page);
- 			truncate_inode_page(mapping, page);
- 			unlock_page(page);
-@@ -492,7 +492,7 @@ unsigned long invalidate_mapping_pages(struct address_space *mapping,
- 			if (!trylock_page(page))
- 				continue;
- 
--			WARN_ON(page_to_pgoff(page) != index);
-+			WARN_ON(page_to_index(page) != index);
- 
- 			/* Middle of THP: skip */
- 			if (PageTransTail(page)) {
-@@ -612,7 +612,7 @@ int invalidate_inode_pages2_range(struct address_space *mapping,
- 			}
- 
- 			lock_page(page);
--			WARN_ON(page_to_pgoff(page) != index);
-+			WARN_ON(page_to_index(page) != index);
- 			if (page->mapping != mapping) {
- 				unlock_page(page);
- 				continue;
-diff --git a/mm/workingset.c b/mm/workingset.c
-index 617475f..fb1f918 100644
---- a/mm/workingset.c
-+++ b/mm/workingset.c
-@@ -348,7 +348,7 @@ static unsigned long count_shadow_nodes(struct shrinker *shrinker,
- 	shadow_nodes = list_lru_shrink_count(&workingset_shadow_nodes, sc);
- 	local_irq_enable();
- 
--	if (memcg_kmem_enabled()) {
-+	if (sc->memcg) {
- 		pages = mem_cgroup_node_nr_lru_pages(sc->memcg, sc->nid,
- 						     LRU_ALL_FILE);
- 	} else {
-diff --git a/net/batman-adv/tp_meter.c b/net/batman-adv/tp_meter.c
-index 2333777..8af1611 100644
---- a/net/batman-adv/tp_meter.c
-+++ b/net/batman-adv/tp_meter.c
-@@ -837,6 +837,7 @@ static int batadv_tp_send(void *arg)
- 	primary_if = batadv_primary_if_get_selected(bat_priv);
- 	if (unlikely(!primary_if)) {
- 		err = BATADV_TP_REASON_DST_UNREACHABLE;
-+		tp_vars->reason = err;
- 		goto out;
- 	}
- 
-diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
-index 0bf6709..6fb4314 100644
---- a/virt/kvm/arm/vgic/vgic-v2.c
-+++ b/virt/kvm/arm/vgic/vgic-v2.c
-@@ -50,8 +50,10 @@ void vgic_v2_process_maintenance(struct kvm_vcpu *vcpu)
- 
- 			WARN_ON(cpuif->vgic_lr[lr] & GICH_LR_STATE);
- 
--			kvm_notify_acked_irq(vcpu->kvm, 0,
--					     intid - VGIC_NR_PRIVATE_IRQS);
-+			/* Only SPIs require notification */
-+			if (vgic_valid_spi(vcpu->kvm, intid))
-+				kvm_notify_acked_irq(vcpu->kvm, 0,
-+						     intid - VGIC_NR_PRIVATE_IRQS);
- 		}
- 	}
- 
-diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
-index 9f0dae3..5c9f974 100644
---- a/virt/kvm/arm/vgic/vgic-v3.c
-+++ b/virt/kvm/arm/vgic/vgic-v3.c
-@@ -41,8 +41,10 @@ void vgic_v3_process_maintenance(struct kvm_vcpu *vcpu)
- 
- 			WARN_ON(cpuif->vgic_lr[lr] & ICH_LR_STATE);
- 
--			kvm_notify_acked_irq(vcpu->kvm, 0,
--					     intid - VGIC_NR_PRIVATE_IRQS);
-+			/* Only SPIs require notification */
-+			if (vgic_valid_spi(vcpu->kvm, intid))
-+				kvm_notify_acked_irq(vcpu->kvm, 0,
-+						     intid - VGIC_NR_PRIVATE_IRQS);
- 		}
- 
- 		/*
-diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 1950782..690d15e 100644
---- a/virt/kvm/kvm_main.c
-+++ b/virt/kvm/kvm_main.c
-@@ -2852,10 +2852,10 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
- 
- 	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
- 	if (ret < 0) {
--		ops->destroy(dev);
- 		mutex_lock(&kvm->lock);
- 		list_del(&dev->vm_node);
- 		mutex_unlock(&kvm->lock);
-+		ops->destroy(dev);
- 		return ret;
- 	}
- 

diff --git a/4.8.15/1013_linux-4.8.14.patch b/4.8.15/1013_linux-4.8.14.patch
deleted file mode 100644
index 63d837b..0000000
--- a/4.8.15/1013_linux-4.8.14.patch
+++ /dev/null
@@ -1,1725 +0,0 @@
-diff --git a/Makefile b/Makefile
-index b38abe9..6a74924 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 8
--SUBLEVEL = 13
-+SUBLEVEL = 14
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
- 
-diff --git a/arch/sparc/kernel/signal_32.c b/arch/sparc/kernel/signal_32.c
-index c3c12ef..9c0c8fd 100644
---- a/arch/sparc/kernel/signal_32.c
-+++ b/arch/sparc/kernel/signal_32.c
-@@ -89,7 +89,7 @@ asmlinkage void do_sigreturn(struct pt_regs *regs)
- 	sf = (struct signal_frame __user *) regs->u_regs[UREG_FP];
- 
- 	/* 1. Make sure we are not getting garbage from the user */
--	if (!invalid_frame_pointer(sf, sizeof(*sf)))
-+	if (invalid_frame_pointer(sf, sizeof(*sf)))
- 		goto segv_and_exit;
- 
- 	if (get_user(ufp, &sf->info.si_regs.u_regs[UREG_FP]))
-@@ -150,7 +150,7 @@ asmlinkage void do_rt_sigreturn(struct pt_regs *regs)
- 
- 	synchronize_user_stack();
- 	sf = (struct rt_signal_frame __user *) regs->u_regs[UREG_FP];
--	if (!invalid_frame_pointer(sf, sizeof(*sf)))
-+	if (invalid_frame_pointer(sf, sizeof(*sf)))
- 		goto segv;
- 
- 	if (get_user(ufp, &sf->regs.u_regs[UREG_FP]))
-diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
-index 7ac6b62..05c7708 100644
---- a/arch/sparc/mm/init_64.c
-+++ b/arch/sparc/mm/init_64.c
-@@ -802,8 +802,10 @@ struct mdesc_mblock {
- };
- static struct mdesc_mblock *mblocks;
- static int num_mblocks;
-+static int find_numa_node_for_addr(unsigned long pa,
-+				   struct node_mem_mask *pnode_mask);
- 
--static unsigned long ra_to_pa(unsigned long addr)
-+static unsigned long __init ra_to_pa(unsigned long addr)
- {
- 	int i;
- 
-@@ -819,8 +821,11 @@ static unsigned long ra_to_pa(unsigned long addr)
- 	return addr;
- }
- 
--static int find_node(unsigned long addr)
-+static int __init find_node(unsigned long addr)
- {
-+	static bool search_mdesc = true;
-+	static struct node_mem_mask last_mem_mask = { ~0UL, ~0UL };
-+	static int last_index;
- 	int i;
- 
- 	addr = ra_to_pa(addr);
-@@ -830,13 +835,30 @@ static int find_node(unsigned long addr)
- 		if ((addr & p->mask) == p->val)
- 			return i;
- 	}
--	/* The following condition has been observed on LDOM guests.*/
--	WARN_ONCE(1, "find_node: A physical address doesn't match a NUMA node"
--		" rule. Some physical memory will be owned by node 0.");
--	return 0;
-+	/* The following condition has been observed on LDOM guests because
-+	 * node_masks only contains the best latency mask and value.
-+	 * LDOM guest's mdesc can contain a single latency group to
-+	 * cover multiple address range. Print warning message only if the
-+	 * address cannot be found in node_masks nor mdesc.
-+	 */
-+	if ((search_mdesc) &&
-+	    ((addr & last_mem_mask.mask) != last_mem_mask.val)) {
-+		/* find the available node in the mdesc */
-+		last_index = find_numa_node_for_addr(addr, &last_mem_mask);
-+		numadbg("find_node: latency group for address 0x%lx is %d\n",
-+			addr, last_index);
-+		if ((last_index < 0) || (last_index >= num_node_masks)) {
-+			/* WARN_ONCE() and use default group 0 */
-+			WARN_ONCE(1, "find_node: A physical address doesn't match a NUMA node rule. Some physical memory will be owned by node 0.");
-+			search_mdesc = false;
-+			last_index = 0;
-+		}
-+	}
-+
-+	return last_index;
- }
- 
--static u64 memblock_nid_range(u64 start, u64 end, int *nid)
-+static u64 __init memblock_nid_range(u64 start, u64 end, int *nid)
- {
- 	*nid = find_node(start);
- 	start += PAGE_SIZE;
-@@ -1160,6 +1182,41 @@ int __node_distance(int from, int to)
- 	return numa_latency[from][to];
- }
- 
-+static int find_numa_node_for_addr(unsigned long pa,
-+				   struct node_mem_mask *pnode_mask)
-+{
-+	struct mdesc_handle *md = mdesc_grab();
-+	u64 node, arc;
-+	int i = 0;
-+
-+	node = mdesc_node_by_name(md, MDESC_NODE_NULL, "latency-groups");
-+	if (node == MDESC_NODE_NULL)
-+		goto out;
-+
-+	mdesc_for_each_node_by_name(md, node, "group") {
-+		mdesc_for_each_arc(arc, md, node, MDESC_ARC_TYPE_FWD) {
-+			u64 target = mdesc_arc_target(md, arc);
-+			struct mdesc_mlgroup *m = find_mlgroup(target);
-+
-+			if (!m)
-+				continue;
-+			if ((pa & m->mask) == m->match) {
-+				if (pnode_mask) {
-+					pnode_mask->mask = m->mask;
-+					pnode_mask->val = m->match;
-+				}
-+				mdesc_release(md);
-+				return i;
-+			}
-+		}
-+		i++;
-+	}
-+
-+out:
-+	mdesc_release(md);
-+	return -1;
-+}
-+
- static int __init find_best_numa_node_for_mlgroup(struct mdesc_mlgroup *grp)
- {
- 	int i;
-diff --git a/block/blk-map.c b/block/blk-map.c
-index b8657fa..27fd8d92 100644
---- a/block/blk-map.c
-+++ b/block/blk-map.c
-@@ -118,6 +118,9 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
- 	struct iov_iter i;
- 	int ret;
- 
-+	if (!iter_is_iovec(iter))
-+		goto fail;
-+
- 	if (map_data)
- 		copy = true;
- 	else if (iov_iter_alignment(iter) & align)
-@@ -140,6 +143,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
- 
- unmap_rq:
- 	__blk_rq_unmap_user(bio);
-+fail:
- 	rq->bio = NULL;
- 	return -EINVAL;
- }
-diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
-index bda37d3..b081929 100644
---- a/drivers/net/dsa/b53/b53_common.c
-+++ b/drivers/net/dsa/b53/b53_common.c
-@@ -904,9 +904,10 @@ static void b53_vlan_add(struct dsa_switch *ds, int port,
- 
- 		vl->members |= BIT(port) | BIT(cpu_port);
- 		if (untagged)
--			vl->untag |= BIT(port) | BIT(cpu_port);
-+			vl->untag |= BIT(port);
- 		else
--			vl->untag &= ~(BIT(port) | BIT(cpu_port));
-+			vl->untag &= ~BIT(port);
-+		vl->untag &= ~BIT(cpu_port);
- 
- 		b53_set_vlan_entry(dev, vid, vl);
- 		b53_fast_age_vlan(dev, vid);
-@@ -915,8 +916,6 @@ static void b53_vlan_add(struct dsa_switch *ds, int port,
- 	if (pvid) {
- 		b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port),
- 			    vlan->vid_end);
--		b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(cpu_port),
--			    vlan->vid_end);
- 		b53_fast_age_vlan(dev, vid);
- 	}
- }
-@@ -926,7 +925,6 @@ static int b53_vlan_del(struct dsa_switch *ds, int port,
- {
- 	struct b53_device *dev = ds_to_priv(ds);
- 	bool untagged = vlan->flags & BRIDGE_VLAN_INFO_UNTAGGED;
--	unsigned int cpu_port = dev->cpu_port;
- 	struct b53_vlan *vl;
- 	u16 vid;
- 	u16 pvid;
-@@ -939,8 +937,6 @@ static int b53_vlan_del(struct dsa_switch *ds, int port,
- 		b53_get_vlan_entry(dev, vid, vl);
- 
- 		vl->members &= ~BIT(port);
--		if ((vl->members & BIT(cpu_port)) == BIT(cpu_port))
--			vl->members = 0;
- 
- 		if (pvid == vid) {
- 			if (is5325(dev) || is5365(dev))
-@@ -949,18 +945,14 @@ static int b53_vlan_del(struct dsa_switch *ds, int port,
- 				pvid = 0;
- 		}
- 
--		if (untagged) {
-+		if (untagged)
- 			vl->untag &= ~(BIT(port));
--			if ((vl->untag & BIT(cpu_port)) == BIT(cpu_port))
--				vl->untag = 0;
--		}
- 
- 		b53_set_vlan_entry(dev, vid, vl);
- 		b53_fast_age_vlan(dev, vid);
- 	}
- 
- 	b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port), pvid);
--	b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(cpu_port), pvid);
- 	b53_fast_age_vlan(dev, pvid);
- 
- 	return 0;
-diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
-index b2b8387..4036865 100644
---- a/drivers/net/dsa/bcm_sf2.c
-+++ b/drivers/net/dsa/bcm_sf2.c
-@@ -1167,6 +1167,7 @@ static void bcm_sf2_sw_adjust_link(struct dsa_switch *ds, int port,
- 				   struct phy_device *phydev)
- {
- 	struct bcm_sf2_priv *priv = ds_to_priv(ds);
-+	struct ethtool_eee *p = &priv->port_sts[port].eee;
- 	u32 id_mode_dis = 0, port_mode;
- 	const char *str = NULL;
- 	u32 reg;
-@@ -1241,6 +1242,9 @@ static void bcm_sf2_sw_adjust_link(struct dsa_switch *ds, int port,
- 		reg |= DUPLX_MODE;
- 
- 	core_writel(priv, reg, CORE_STS_OVERRIDE_GMIIP_PORT(port));
-+
-+	if (!phydev->is_pseudo_fixed_link)
-+		p->eee_enabled = bcm_sf2_eee_init(ds, port, phydev);
- }
- 
- static void bcm_sf2_sw_fixed_link_update(struct dsa_switch *ds, int port,
-diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
-index 5414563..842d8b9 100644
---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
-+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
-@@ -1172,6 +1172,7 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
- 					  struct bcmgenet_tx_ring *ring)
- {
- 	struct bcmgenet_priv *priv = netdev_priv(dev);
-+	struct device *kdev = &priv->pdev->dev;
- 	struct enet_cb *tx_cb_ptr;
- 	struct netdev_queue *txq;
- 	unsigned int pkts_compl = 0;
-@@ -1199,13 +1200,13 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
- 		if (tx_cb_ptr->skb) {
- 			pkts_compl++;
- 			bytes_compl += GENET_CB(tx_cb_ptr->skb)->bytes_sent;
--			dma_unmap_single(&dev->dev,
-+			dma_unmap_single(kdev,
- 					 dma_unmap_addr(tx_cb_ptr, dma_addr),
- 					 dma_unmap_len(tx_cb_ptr, dma_len),
- 					 DMA_TO_DEVICE);
- 			bcmgenet_free_cb(tx_cb_ptr);
- 		} else if (dma_unmap_addr(tx_cb_ptr, dma_addr)) {
--			dma_unmap_page(&dev->dev,
-+			dma_unmap_page(kdev,
- 				       dma_unmap_addr(tx_cb_ptr, dma_addr),
- 				       dma_unmap_len(tx_cb_ptr, dma_len),
- 				       DMA_TO_DEVICE);
-@@ -1775,6 +1776,7 @@ static int bcmgenet_alloc_rx_buffers(struct bcmgenet_priv *priv,
- 
- static void bcmgenet_free_rx_buffers(struct bcmgenet_priv *priv)
- {
-+	struct device *kdev = &priv->pdev->dev;
- 	struct enet_cb *cb;
- 	int i;
- 
-@@ -1782,7 +1784,7 @@ static void bcmgenet_free_rx_buffers(struct bcmgenet_priv *priv)
- 		cb = &priv->rx_cbs[i];
- 
- 		if (dma_unmap_addr(cb, dma_addr)) {
--			dma_unmap_single(&priv->dev->dev,
-+			dma_unmap_single(kdev,
- 					 dma_unmap_addr(cb, dma_addr),
- 					 priv->rx_buf_len, DMA_FROM_DEVICE);
- 			dma_unmap_addr_set(cb, dma_addr, 0);
-diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
-index d954a97..ef0dbcf 100644
---- a/drivers/net/ethernet/cadence/macb.c
-+++ b/drivers/net/ethernet/cadence/macb.c
-@@ -959,6 +959,7 @@ static inline void macb_init_rx_ring(struct macb *bp)
- 		addr += bp->rx_buffer_size;
- 	}
- 	bp->rx_ring[RX_RING_SIZE - 1].addr |= MACB_BIT(RX_WRAP);
-+	bp->rx_tail = 0;
- }
- 
- static int macb_rx(struct macb *bp, int budget)
-@@ -1597,8 +1598,6 @@ static void macb_init_rings(struct macb *bp)
- 	bp->queues[0].tx_head = 0;
- 	bp->queues[0].tx_tail = 0;
- 	bp->queues[0].tx_ring[TX_RING_SIZE - 1].ctrl |= MACB_BIT(TX_WRAP);
--
--	bp->rx_tail = 0;
- }
- 
- static void macb_reset_hw(struct macb *bp)
-diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
-index 467138b..d747e17 100644
---- a/drivers/net/ethernet/marvell/sky2.c
-+++ b/drivers/net/ethernet/marvell/sky2.c
-@@ -5220,6 +5220,19 @@ static SIMPLE_DEV_PM_OPS(sky2_pm_ops, sky2_suspend, sky2_resume);
- 
- static void sky2_shutdown(struct pci_dev *pdev)
- {
-+	struct sky2_hw *hw = pci_get_drvdata(pdev);
-+	int port;
-+
-+	for (port = 0; port < hw->ports; port++) {
-+		struct net_device *ndev = hw->dev[port];
-+
-+		rtnl_lock();
-+		if (netif_running(ndev)) {
-+			dev_close(ndev);
-+			netif_device_detach(ndev);
-+		}
-+		rtnl_unlock();
-+	}
- 	sky2_suspend(&pdev->dev);
- 	pci_wake_from_d3(pdev, device_may_wakeup(&pdev->dev));
- 	pci_set_power_state(pdev, PCI_D3hot);
-diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
-index 054e795..92c9a95 100644
---- a/drivers/net/ethernet/renesas/sh_eth.c
-+++ b/drivers/net/ethernet/renesas/sh_eth.c
-@@ -518,7 +518,7 @@ static struct sh_eth_cpu_data r7s72100_data = {
- 
- 	.ecsr_value	= ECSR_ICD,
- 	.ecsipr_value	= ECSIPR_ICDIP,
--	.eesipr_value	= 0xff7f009f,
-+	.eesipr_value	= 0xe77f009f,
- 
- 	.tx_check	= EESR_TC1 | EESR_FTC,
- 	.eesr_err_check	= EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT |
-diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
-index 16af1ce..5ad706b 100644
---- a/drivers/net/geneve.c
-+++ b/drivers/net/geneve.c
-@@ -844,7 +844,6 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
- 	struct geneve_dev *geneve = netdev_priv(dev);
- 	struct geneve_sock *gs4 = geneve->sock4;
- 	struct rtable *rt = NULL;
--	const struct iphdr *iip; /* interior IP header */
- 	int err = -EINVAL;
- 	struct flowi4 fl4;
- 	__u8 tos, ttl;
-@@ -871,8 +870,6 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
- 	sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
- 	skb_reset_mac_header(skb);
- 
--	iip = ip_hdr(skb);
--
- 	if (info) {
- 		const struct ip_tunnel_key *key = &info->key;
- 		u8 *opts = NULL;
-@@ -892,7 +889,7 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
- 		if (unlikely(err))
- 			goto tx_error;
- 
--		tos = ip_tunnel_ecn_encap(key->tos, iip, skb);
-+		tos = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
- 		ttl = key->ttl;
- 		df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0;
- 	} else {
-@@ -901,7 +898,7 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
- 		if (unlikely(err))
- 			goto tx_error;
- 
--		tos = ip_tunnel_ecn_encap(fl4.flowi4_tos, iip, skb);
-+		tos = ip_tunnel_ecn_encap(fl4.flowi4_tos, ip_hdr(skb), skb);
- 		ttl = geneve->ttl;
- 		if (!ttl && IN_MULTICAST(ntohl(fl4.daddr)))
- 			ttl = 1;
-@@ -934,7 +931,6 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
- 	struct geneve_dev *geneve = netdev_priv(dev);
- 	struct geneve_sock *gs6 = geneve->sock6;
- 	struct dst_entry *dst = NULL;
--	const struct iphdr *iip; /* interior IP header */
- 	int err = -EINVAL;
- 	struct flowi6 fl6;
- 	__u8 prio, ttl;
-@@ -959,8 +955,6 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
- 	sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
- 	skb_reset_mac_header(skb);
- 
--	iip = ip_hdr(skb);
--
- 	if (info) {
- 		const struct ip_tunnel_key *key = &info->key;
- 		u8 *opts = NULL;
-@@ -981,7 +975,7 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
- 		if (unlikely(err))
- 			goto tx_error;
- 
--		prio = ip_tunnel_ecn_encap(key->tos, iip, skb);
-+		prio = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
- 		ttl = key->ttl;
- 		label = info->key.label;
- 	} else {
-@@ -991,7 +985,7 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
- 			goto tx_error;
- 
- 		prio = ip_tunnel_ecn_encap(ip6_tclass(fl6.flowlabel),
--					   iip, skb);
-+					   ip_hdr(skb), skb);
- 		ttl = geneve->ttl;
- 		if (!ttl && ipv6_addr_is_multicast(&fl6.daddr))
- 			ttl = 1;
-diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
-index c47ec0a..dd623f6 100644
---- a/drivers/net/usb/cdc_ether.c
-+++ b/drivers/net/usb/cdc_ether.c
-@@ -388,12 +388,6 @@ void usbnet_cdc_status(struct usbnet *dev, struct urb *urb)
- 	case USB_CDC_NOTIFY_NETWORK_CONNECTION:
- 		netif_dbg(dev, timer, dev->net, "CDC: carrier %s\n",
- 			  event->wValue ? "on" : "off");
--
--		/* Work-around for devices with broken off-notifications */
--		if (event->wValue &&
--		    !test_bit(__LINK_STATE_NOCARRIER, &dev->net->state))
--			usbnet_link_change(dev, 0, 0);
--
- 		usbnet_link_change(dev, !!event->wValue, 0);
- 		break;
- 	case USB_CDC_NOTIFY_SPEED_CHANGE:	/* tx/rx rates */
-@@ -466,6 +460,36 @@ static int usbnet_cdc_zte_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
- 	return 1;
- }
- 
-+/* Ensure correct link state
-+ *
-+ * Some devices (ZTE MF823/831/910) export two carrier on notifications when
-+ * connected. This causes the link state to be incorrect. Work around this by
-+ * always setting the state to off, then on.
-+ */
-+void usbnet_cdc_zte_status(struct usbnet *dev, struct urb *urb)
-+{
-+	struct usb_cdc_notification *event;
-+
-+	if (urb->actual_length < sizeof(*event))
-+		return;
-+
-+	event = urb->transfer_buffer;
-+
-+	if (event->bNotificationType != USB_CDC_NOTIFY_NETWORK_CONNECTION) {
-+		usbnet_cdc_status(dev, urb);
-+		return;
-+	}
-+
-+	netif_dbg(dev, timer, dev->net, "CDC: carrier %s\n",
-+		  event->wValue ? "on" : "off");
-+
-+	if (event->wValue &&
-+	    netif_carrier_ok(dev->net))
-+		netif_carrier_off(dev->net);
-+
-+	usbnet_link_change(dev, !!event->wValue, 0);
-+}
-+
- static const struct driver_info	cdc_info = {
- 	.description =	"CDC Ethernet Device",
- 	.flags =	FLAG_ETHER | FLAG_POINTTOPOINT,
-@@ -481,7 +505,7 @@ static const struct driver_info	zte_cdc_info = {
- 	.flags =	FLAG_ETHER | FLAG_POINTTOPOINT,
- 	.bind =		usbnet_cdc_zte_bind,
- 	.unbind =	usbnet_cdc_unbind,
--	.status =	usbnet_cdc_status,
-+	.status =	usbnet_cdc_zte_status,
- 	.set_rx_mode =	usbnet_cdc_update_filter,
- 	.manage_power =	usbnet_manage_power,
- 	.rx_fixup = usbnet_cdc_zte_rx_fixup,
-diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
-index bf3fd34..d807209 100644
---- a/drivers/net/virtio_net.c
-+++ b/drivers/net/virtio_net.c
-@@ -1468,6 +1468,11 @@ static void virtnet_free_queues(struct virtnet_info *vi)
- 		netif_napi_del(&vi->rq[i].napi);
- 	}
- 
-+	/* We called napi_hash_del() before netif_napi_del(),
-+	 * we need to respect an RCU grace period before freeing vi->rq
-+	 */
-+	synchronize_net();
-+
- 	kfree(vi->rq);
- 	kfree(vi->sq);
- }
-diff --git a/include/linux/uio.h b/include/linux/uio.h
-index 75b4aaf..944e7ba 100644
---- a/include/linux/uio.h
-+++ b/include/linux/uio.h
-@@ -102,12 +102,12 @@ int iov_iter_npages(const struct iov_iter *i, int maxpages);
- 
- const void *dup_iter(struct iov_iter *new, struct iov_iter *old, gfp_t flags);
- 
--static inline size_t iov_iter_count(struct iov_iter *i)
-+static inline size_t iov_iter_count(const struct iov_iter *i)
- {
- 	return i->count;
- }
- 
--static inline bool iter_is_iovec(struct iov_iter *i)
-+static inline bool iter_is_iovec(const struct iov_iter *i)
- {
- 	return !(i->type & (ITER_BVEC | ITER_KVEC));
- }
-diff --git a/include/net/gro_cells.h b/include/net/gro_cells.h
-index d15214d..2a1abbf 100644
---- a/include/net/gro_cells.h
-+++ b/include/net/gro_cells.h
-@@ -68,6 +68,9 @@ static inline int gro_cells_init(struct gro_cells *gcells, struct net_device *de
- 		struct gro_cell *cell = per_cpu_ptr(gcells->cells, i);
- 
- 		__skb_queue_head_init(&cell->napi_skbs);
-+
-+		set_bit(NAPI_STATE_NO_BUSY_POLL, &cell->napi.state);
-+
- 		netif_napi_add(dev, &cell->napi, gro_cell_poll, 64);
- 		napi_enable(&cell->napi);
- 	}
-diff --git a/net/core/flow.c b/net/core/flow.c
-index 3937b1b..18e8893 100644
---- a/net/core/flow.c
-+++ b/net/core/flow.c
-@@ -95,7 +95,6 @@ static void flow_cache_gc_task(struct work_struct *work)
- 	list_for_each_entry_safe(fce, n, &gc_list, u.gc_list) {
- 		flow_entry_kill(fce, xfrm);
- 		atomic_dec(&xfrm->flow_cache_gc_count);
--		WARN_ON(atomic_read(&xfrm->flow_cache_gc_count) < 0);
- 	}
- }
- 
-@@ -236,9 +235,8 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
- 		if (fcp->hash_count > fc->high_watermark)
- 			flow_cache_shrink(fc, fcp);
- 
--		if (fcp->hash_count > 2 * fc->high_watermark ||
--		    atomic_read(&net->xfrm.flow_cache_gc_count) > fc->high_watermark) {
--			atomic_inc(&net->xfrm.flow_cache_genid);
-+		if (atomic_read(&net->xfrm.flow_cache_gc_count) >
-+		    2 * num_online_cpus() * fc->high_watermark) {
- 			flo = ERR_PTR(-ENOBUFS);
- 			goto ret_object;
- 		}
-diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
-index 2c2eb1b..2e9a1c2 100644
---- a/net/core/net_namespace.c
-+++ b/net/core/net_namespace.c
-@@ -217,6 +217,8 @@ int peernet2id_alloc(struct net *net, struct net *peer)
- 	bool alloc;
- 	int id;
- 
-+	if (atomic_read(&net->count) == 0)
-+		return NETNSA_NSID_NOT_ASSIGNED;
- 	spin_lock_irqsave(&net->nsid_lock, flags);
- 	alloc = atomic_read(&peer->count) == 0 ? false : true;
- 	id = __peernet2id_alloc(net, peer, &alloc);
-diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index 189cc78..08c3702 100644
---- a/net/core/rtnetlink.c
-+++ b/net/core/rtnetlink.c
-@@ -1578,7 +1578,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
- 		head = &net->dev_index_head[h];
- 		hlist_for_each_entry(dev, head, index_hlist) {
- 			if (link_dump_filtered(dev, master_idx, kind_ops))
--				continue;
-+				goto cont;
- 			if (idx < s_idx)
- 				goto cont;
- 			err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
-@@ -2791,7 +2791,10 @@ static int nlmsg_populate_fdb_fill(struct sk_buff *skb,
- 
- static inline size_t rtnl_fdb_nlmsg_size(void)
- {
--	return NLMSG_ALIGN(sizeof(struct ndmsg)) + nla_total_size(ETH_ALEN);
-+	return NLMSG_ALIGN(sizeof(struct ndmsg)) +
-+	       nla_total_size(ETH_ALEN) +	/* NDA_LLADDR */
-+	       nla_total_size(sizeof(u16)) +	/* NDA_VLAN */
-+	       0;
- }
- 
- static void rtnl_fdb_notify(struct net_device *dev, u8 *addr, u16 vid, int type,
-diff --git a/net/core/sock.c b/net/core/sock.c
-index 10acacc..ba27920 100644
---- a/net/core/sock.c
-+++ b/net/core/sock.c
-@@ -715,7 +715,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
- 		val = min_t(u32, val, sysctl_wmem_max);
- set_sndbuf:
- 		sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
--		sk->sk_sndbuf = max_t(u32, val * 2, SOCK_MIN_SNDBUF);
-+		sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF);
- 		/* Wake up sending tasks if we upped the value. */
- 		sk->sk_write_space(sk);
- 		break;
-@@ -751,7 +751,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
- 		 * returning the value we actually used in getsockopt
- 		 * is the most desirable behavior.
- 		 */
--		sk->sk_rcvbuf = max_t(u32, val * 2, SOCK_MIN_RCVBUF);
-+		sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF);
- 		break;
- 
- 	case SO_RCVBUFFORCE:
-diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
-index b567c87..edbe59d 100644
---- a/net/dccp/ipv4.c
-+++ b/net/dccp/ipv4.c
-@@ -700,6 +700,7 @@ int dccp_invalid_packet(struct sk_buff *skb)
- {
- 	const struct dccp_hdr *dh;
- 	unsigned int cscov;
-+	u8 dccph_doff;
- 
- 	if (skb->pkt_type != PACKET_HOST)
- 		return 1;
-@@ -721,18 +722,19 @@ int dccp_invalid_packet(struct sk_buff *skb)
- 	/*
- 	 * If P.Data Offset is too small for packet type, drop packet and return
- 	 */
--	if (dh->dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {
--		DCCP_WARN("P.Data Offset(%u) too small\n", dh->dccph_doff);
-+	dccph_doff = dh->dccph_doff;
-+	if (dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {
-+		DCCP_WARN("P.Data Offset(%u) too small\n", dccph_doff);
- 		return 1;
- 	}
- 	/*
- 	 * If P.Data Offset is too too large for packet, drop packet and return
- 	 */
--	if (!pskb_may_pull(skb, dh->dccph_doff * sizeof(u32))) {
--		DCCP_WARN("P.Data Offset(%u) too large\n", dh->dccph_doff);
-+	if (!pskb_may_pull(skb, dccph_doff * sizeof(u32))) {
-+		DCCP_WARN("P.Data Offset(%u) too large\n", dccph_doff);
- 		return 1;
- 	}
--
-+	dh = dccp_hdr(skb);
- 	/*
- 	 * If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet
- 	 * has short sequence numbers), drop packet and return
-diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
-index f30bad9..3bdecd2 100644
---- a/net/dsa/dsa2.c
-+++ b/net/dsa/dsa2.c
-@@ -28,8 +28,10 @@ static struct dsa_switch_tree *dsa_get_dst(u32 tree)
- 	struct dsa_switch_tree *dst;
- 
- 	list_for_each_entry(dst, &dsa_switch_trees, list)
--		if (dst->tree == tree)
-+		if (dst->tree == tree) {
-+			kref_get(&dst->refcount);
- 			return dst;
-+		}
- 	return NULL;
- }
- 
-diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
-index eebbc0f..ed22af6 100644
---- a/net/ipv4/af_inet.c
-+++ b/net/ipv4/af_inet.c
-@@ -1237,7 +1237,7 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb,
- 		fixedid = !!(skb_shinfo(skb)->gso_type & SKB_GSO_TCP_FIXEDID);
- 
- 		/* fixed ID is invalid if DF bit is not set */
--		if (fixedid && !(iph->frag_off & htons(IP_DF)))
-+		if (fixedid && !(ip_hdr(skb)->frag_off & htons(IP_DF)))
- 			goto out;
- 	}
- 
-diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
-index d95631d..20fb25e 100644
---- a/net/ipv4/esp4.c
-+++ b/net/ipv4/esp4.c
-@@ -476,7 +476,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
- 		esph = (void *)skb_push(skb, 4);
- 		*seqhi = esph->spi;
- 		esph->spi = esph->seq_no;
--		esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.input.hi);
-+		esph->seq_no = XFRM_SKB_CB(skb)->seq.input.hi;
- 		aead_request_set_callback(req, 0, esp_input_done_esn, skb);
- 	}
- 
-diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
-index 1b25daf..9301308 100644
---- a/net/ipv4/fib_frontend.c
-+++ b/net/ipv4/fib_frontend.c
-@@ -157,7 +157,7 @@ static void fib_replace_table(struct net *net, struct fib_table *old,
- 
- int fib_unmerge(struct net *net)
- {
--	struct fib_table *old, *new;
-+	struct fib_table *old, *new, *main_table;
- 
- 	/* attempt to fetch local table if it has been allocated */
- 	old = fib_get_table(net, RT_TABLE_LOCAL);
-@@ -168,11 +168,21 @@ int fib_unmerge(struct net *net)
- 	if (!new)
- 		return -ENOMEM;
- 
-+	/* table is already unmerged */
-+	if (new == old)
-+		return 0;
-+
- 	/* replace merged table with clean table */
--	if (new != old) {
--		fib_replace_table(net, old, new);
--		fib_free_table(old);
--	}
-+	fib_replace_table(net, old, new);
-+	fib_free_table(old);
-+
-+	/* attempt to fetch main table if it has been allocated */
-+	main_table = fib_get_table(net, RT_TABLE_MAIN);
-+	if (!main_table)
-+		return 0;
-+
-+	/* flush local entries from main table */
-+	fib_table_flush_external(main_table);
- 
- 	return 0;
- }
-diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
-index 7ef7031..84fd7272 100644
---- a/net/ipv4/fib_trie.c
-+++ b/net/ipv4/fib_trie.c
-@@ -681,6 +681,13 @@ static unsigned char update_suffix(struct key_vector *tn)
- {
- 	unsigned char slen = tn->pos;
- 	unsigned long stride, i;
-+	unsigned char slen_max;
-+
-+	/* only vector 0 can have a suffix length greater than or equal to
-+	 * tn->pos + tn->bits, the second highest node will have a suffix
-+	 * length at most of tn->pos + tn->bits - 1
-+	 */
-+	slen_max = min_t(unsigned char, tn->pos + tn->bits - 1, tn->slen);
- 
- 	/* search though the list of children looking for nodes that might
- 	 * have a suffix greater than the one we currently have.  This is
-@@ -698,12 +705,8 @@ static unsigned char update_suffix(struct key_vector *tn)
- 		slen = n->slen;
- 		i &= ~(stride - 1);
- 
--		/* if slen covers all but the last bit we can stop here
--		 * there will be nothing longer than that since only node
--		 * 0 and 1 << (bits - 1) could have that as their suffix
--		 * length.
--		 */
--		if ((slen + 1) >= (tn->pos + tn->bits))
-+		/* stop searching if we have hit the maximum possible value */
-+		if (slen >= slen_max)
- 			break;
- 	}
- 
-@@ -875,39 +878,27 @@ static struct key_vector *resize(struct trie *t, struct key_vector *tn)
- 		return collapse(t, tn);
- 
- 	/* update parent in case halve failed */
--	tp = node_parent(tn);
--
--	/* Return if at least one deflate was run */
--	if (max_work != MAX_WORK)
--		return tp;
--
--	/* push the suffix length to the parent node */
--	if (tn->slen > tn->pos) {
--		unsigned char slen = update_suffix(tn);
--
--		if (slen > tp->slen)
--			tp->slen = slen;
--	}
--
--	return tp;
-+	return node_parent(tn);
- }
- 
--static void leaf_pull_suffix(struct key_vector *tp, struct key_vector *l)
-+static void node_pull_suffix(struct key_vector *tn, unsigned char slen)
- {
--	while ((tp->slen > tp->pos) && (tp->slen > l->slen)) {
--		if (update_suffix(tp) > l->slen)
-+	unsigned char node_slen = tn->slen;
-+
-+	while ((node_slen > tn->pos) && (node_slen > slen)) {
-+		slen = update_suffix(tn);
-+		if (node_slen == slen)
- 			break;
--		tp = node_parent(tp);
-+
-+		tn = node_parent(tn);
-+		node_slen = tn->slen;
- 	}
- }
- 
--static void leaf_push_suffix(struct key_vector *tn, struct key_vector *l)
-+static void node_push_suffix(struct key_vector *tn, unsigned char slen)
- {
--	/* if this is a new leaf then tn will be NULL and we can sort
--	 * out parent suffix lengths as a part of trie_rebalance
--	 */
--	while (tn->slen < l->slen) {
--		tn->slen = l->slen;
-+	while (tn->slen < slen) {
-+		tn->slen = slen;
- 		tn = node_parent(tn);
- 	}
- }
-@@ -1028,6 +1019,7 @@ static int fib_insert_node(struct trie *t, struct key_vector *tp,
- 	}
- 
- 	/* Case 3: n is NULL, and will just insert a new leaf */
-+	node_push_suffix(tp, new->fa_slen);
- 	NODE_INIT_PARENT(l, tp);
- 	put_child_root(tp, key, l);
- 	trie_rebalance(t, tp);
-@@ -1069,7 +1061,7 @@ static int fib_insert_alias(struct trie *t, struct key_vector *tp,
- 	/* if we added to the tail node then we need to update slen */
- 	if (l->slen < new->fa_slen) {
- 		l->slen = new->fa_slen;
--		leaf_push_suffix(tp, l);
-+		node_push_suffix(tp, new->fa_slen);
- 	}
- 
- 	return 0;
-@@ -1470,6 +1462,8 @@ static void fib_remove_alias(struct trie *t, struct key_vector *tp,
- 	 * out parent suffix lengths as a part of trie_rebalance
- 	 */
- 	if (hlist_empty(&l->leaf)) {
-+		if (tp->slen == l->slen)
-+			node_pull_suffix(tp, tp->pos);
- 		put_child_root(tp, l->key, NULL);
- 		node_free(l);
- 		trie_rebalance(t, tp);
-@@ -1482,7 +1476,7 @@ static void fib_remove_alias(struct trie *t, struct key_vector *tp,
- 
- 	/* update the trie with the latest suffix length */
- 	l->slen = fa->fa_slen;
--	leaf_pull_suffix(tp, l);
-+	node_pull_suffix(tp, fa->fa_slen);
- }
- 
- /* Caller must hold RTNL. */
-@@ -1713,8 +1707,10 @@ struct fib_table *fib_trie_unmerge(struct fib_table *oldtb)
- 				local_l = fib_find_node(lt, &local_tp, l->key);
- 
- 			if (fib_insert_alias(lt, local_tp, local_l, new_fa,
--					     NULL, l->key))
-+					     NULL, l->key)) {
-+				kmem_cache_free(fn_alias_kmem, new_fa);
- 				goto out;
-+			}
- 		}
- 
- 		/* stop loop if key wrapped back to 0 */
-@@ -1751,6 +1747,10 @@ void fib_table_flush_external(struct fib_table *tb)
- 			if (IS_TRIE(pn))
- 				break;
- 
-+			/* update the suffix to address pulled leaves */
-+			if (pn->slen > pn->pos)
-+				update_suffix(pn);
-+
- 			/* resize completed node */
- 			pn = resize(t, pn);
- 			cindex = get_index(pkey, pn);
-@@ -1826,6 +1826,10 @@ int fib_table_flush(struct fib_table *tb)
- 			if (IS_TRIE(pn))
- 				break;
- 
-+			/* update the suffix to address pulled leaves */
-+			if (pn->slen > pn->pos)
-+				update_suffix(pn);
-+
- 			/* resize completed node */
- 			pn = resize(t, pn);
- 			cindex = get_index(pkey, pn);
-diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
-index 307daed..f4790c3 100644
---- a/net/ipv4/ip_output.c
-+++ b/net/ipv4/ip_output.c
-@@ -98,6 +98,9 @@ int __ip_local_out(struct net *net, struct sock *sk, struct sk_buff *skb)
- 
- 	iph->tot_len = htons(skb->len);
- 	ip_send_check(iph);
-+
-+	skb->protocol = htons(ETH_P_IP);
-+
- 	return nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT,
- 		       net, sk, skb, NULL, skb_dst(skb)->dev,
- 		       dst_output);
-diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
-index 66ddcb6..dcdd5ae 100644
---- a/net/ipv4/ping.c
-+++ b/net/ipv4/ping.c
-@@ -662,6 +662,10 @@ int ping_common_sendmsg(int family, struct msghdr *msg, size_t len,
- 	if (len > 0xFFFF)
- 		return -EMSGSIZE;
- 
-+	/* Must have at least a full ICMP header. */
-+	if (len < icmph_len)
-+		return -EINVAL;
-+
- 	/*
- 	 *	Check the flags.
- 	 */
-diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index c0d71e7..a2d54f5 100644
---- a/net/ipv4/udp.c
-+++ b/net/ipv4/udp.c
-@@ -1451,7 +1451,7 @@ static void udp_v4_rehash(struct sock *sk)
- 	udp_lib_rehash(sk, new_hash);
- }
- 
--static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
-+int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
- {
- 	int rc;
- 
-diff --git a/net/ipv4/udp_impl.h b/net/ipv4/udp_impl.h
-index 7e0fe4b..feb50a1 100644
---- a/net/ipv4/udp_impl.h
-+++ b/net/ipv4/udp_impl.h
-@@ -25,7 +25,7 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
- 		int flags, int *addr_len);
- int udp_sendpage(struct sock *sk, struct page *page, int offset, size_t size,
- 		 int flags);
--int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
-+int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
- void udp_destroy_sock(struct sock *sk);
- 
- #ifdef CONFIG_PROC_FS
-diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
-index 2eea073..705d9fb 100644
---- a/net/ipv4/udplite.c
-+++ b/net/ipv4/udplite.c
-@@ -50,7 +50,7 @@ struct proto 	udplite_prot = {
- 	.sendmsg	   = udp_sendmsg,
- 	.recvmsg	   = udp_recvmsg,
- 	.sendpage	   = udp_sendpage,
--	.backlog_rcv	   = udp_queue_rcv_skb,
-+	.backlog_rcv	   = __udp_queue_rcv_skb,
- 	.hash		   = udp_lib_hash,
- 	.unhash		   = udp_lib_unhash,
- 	.get_port	   = udp_v4_get_port,
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index f5432d6..8f2e36f 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -163,7 +163,7 @@ static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
- 
- static void addrconf_dad_start(struct inet6_ifaddr *ifp);
- static void addrconf_dad_work(struct work_struct *w);
--static void addrconf_dad_completed(struct inet6_ifaddr *ifp);
-+static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id);
- static void addrconf_dad_run(struct inet6_dev *idev);
- static void addrconf_rs_timer(unsigned long data);
- static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
-@@ -2893,6 +2893,7 @@ static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
- 		spin_lock_bh(&ifp->lock);
- 		ifp->flags &= ~IFA_F_TENTATIVE;
- 		spin_unlock_bh(&ifp->lock);
-+		rt_genid_bump_ipv6(dev_net(idev->dev));
- 		ipv6_ifa_notify(RTM_NEWADDR, ifp);
- 		in6_ifa_put(ifp);
- 	}
-@@ -3736,7 +3737,7 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
- {
- 	struct inet6_dev *idev = ifp->idev;
- 	struct net_device *dev = idev->dev;
--	bool notify = false;
-+	bool bump_id, notify = false;
- 
- 	addrconf_join_solict(dev, &ifp->addr);
- 
-@@ -3751,11 +3752,12 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
- 	    idev->cnf.accept_dad < 1 ||
- 	    !(ifp->flags&IFA_F_TENTATIVE) ||
- 	    ifp->flags & IFA_F_NODAD) {
-+		bump_id = ifp->flags & IFA_F_TENTATIVE;
- 		ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
- 		spin_unlock(&ifp->lock);
- 		read_unlock_bh(&idev->lock);
- 
--		addrconf_dad_completed(ifp);
-+		addrconf_dad_completed(ifp, bump_id);
- 		return;
- 	}
- 
-@@ -3815,8 +3817,8 @@ static void addrconf_dad_work(struct work_struct *w)
- 						struct inet6_ifaddr,
- 						dad_work);
- 	struct inet6_dev *idev = ifp->idev;
-+	bool bump_id, disable_ipv6 = false;
- 	struct in6_addr mcaddr;
--	bool disable_ipv6 = false;
- 
- 	enum {
- 		DAD_PROCESS,
-@@ -3886,11 +3888,12 @@ static void addrconf_dad_work(struct work_struct *w)
- 		 * DAD was successful
- 		 */
- 
-+		bump_id = ifp->flags & IFA_F_TENTATIVE;
- 		ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
- 		spin_unlock(&ifp->lock);
- 		write_unlock_bh(&idev->lock);
- 
--		addrconf_dad_completed(ifp);
-+		addrconf_dad_completed(ifp, bump_id);
- 
- 		goto out;
- 	}
-@@ -3927,7 +3930,7 @@ static bool ipv6_lonely_lladdr(struct inet6_ifaddr *ifp)
- 	return true;
- }
- 
--static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
-+static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id)
- {
- 	struct net_device *dev = ifp->idev->dev;
- 	struct in6_addr lladdr;
-@@ -3978,6 +3981,9 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
- 		spin_unlock(&ifp->lock);
- 		write_unlock_bh(&ifp->idev->lock);
- 	}
-+
-+	if (bump_id)
-+		rt_genid_bump_ipv6(dev_net(dev));
- }
- 
- static void addrconf_dad_run(struct inet6_dev *idev)
-diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
-index 060a60b..111ba55 100644
---- a/net/ipv6/esp6.c
-+++ b/net/ipv6/esp6.c
-@@ -418,7 +418,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
- 		esph = (void *)skb_push(skb, 4);
- 		*seqhi = esph->spi;
- 		esph->spi = esph->seq_no;
--		esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.input.hi);
-+		esph->seq_no = XFRM_SKB_CB(skb)->seq.input.hi;
- 		aead_request_set_callback(req, 0, esp_input_done_esn, skb);
- 	}
- 
-diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
-index a09418b..93294cf 100644
---- a/net/ipv6/ip6_offload.c
-+++ b/net/ipv6/ip6_offload.c
-@@ -98,7 +98,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
- 		segs = ops->callbacks.gso_segment(skb, features);
- 	}
- 
--	if (IS_ERR(segs))
-+	if (IS_ERR_OR_NULL(segs))
- 		goto out;
- 
- 	for (skb = segs; skb; skb = skb->next) {
-diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
-index 41489f3..da4e7b3 100644
---- a/net/ipv6/ip6_tunnel.c
-+++ b/net/ipv6/ip6_tunnel.c
-@@ -1014,6 +1014,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
- 	int mtu;
- 	unsigned int psh_hlen = sizeof(struct ipv6hdr) + t->encap_hlen;
- 	unsigned int max_headroom = psh_hlen;
-+	bool use_cache = false;
- 	int err = -1;
- 
- 	/* NBMA tunnel */
-@@ -1038,7 +1039,15 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
- 
- 		memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
- 		neigh_release(neigh);
--	} else if (!fl6->flowi6_mark)
-+	} else if (!(t->parms.flags &
-+		     (IP6_TNL_F_USE_ORIG_TCLASS | IP6_TNL_F_USE_ORIG_FWMARK))) {
-+		/* enable the cache only only if the routing decision does
-+		 * not depend on the current inner header value
-+		 */
-+		use_cache = true;
-+	}
-+
-+	if (use_cache)
- 		dst = dst_cache_get(&t->dst_cache);
- 
- 	if (!ip6_tnl_xmit_ctl(t, &fl6->saddr, &fl6->daddr))
-@@ -1113,7 +1122,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
- 		skb = new_skb;
- 	}
- 
--	if (!fl6->flowi6_mark && ndst)
-+	if (use_cache && ndst)
- 		dst_cache_set_ip6(&t->dst_cache, ndst, &fl6->saddr);
- 	skb_dst_set(skb, dst);
- 
-@@ -1134,7 +1143,6 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
- 	if (err)
- 		return err;
- 
--	skb->protocol = htons(ETH_P_IPV6);
- 	skb_push(skb, sizeof(struct ipv6hdr));
- 	skb_reset_network_header(skb);
- 	ipv6h = ipv6_hdr(skb);
-diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
-index 462f2a76b..1d18432 100644
---- a/net/ipv6/output_core.c
-+++ b/net/ipv6/output_core.c
-@@ -148,6 +148,8 @@ int __ip6_local_out(struct net *net, struct sock *sk, struct sk_buff *skb)
- 	ipv6_hdr(skb)->payload_len = htons(len);
- 	IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
- 
-+	skb->protocol = htons(ETH_P_IPV6);
-+
- 	return nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
- 		       net, sk, skb, NULL, skb_dst(skb)->dev,
- 		       dst_output);
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index c2a8656..fa39ab8 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -514,7 +514,7 @@ void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
- 	return;
- }
- 
--static int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
-+int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
- {
- 	int rc;
- 
-diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
-index 0682c03..3c1dbc9 100644
---- a/net/ipv6/udp_impl.h
-+++ b/net/ipv6/udp_impl.h
-@@ -26,7 +26,7 @@ int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
- int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len);
- int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
- 		  int flags, int *addr_len);
--int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
-+int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
- void udpv6_destroy_sock(struct sock *sk);
- 
- void udp_v6_clear_sk(struct sock *sk, int size);
-diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
-index fd6ef41..af2895c 100644
---- a/net/ipv6/udplite.c
-+++ b/net/ipv6/udplite.c
-@@ -45,7 +45,7 @@ struct proto udplitev6_prot = {
- 	.getsockopt	   = udpv6_getsockopt,
- 	.sendmsg	   = udpv6_sendmsg,
- 	.recvmsg	   = udpv6_recvmsg,
--	.backlog_rcv	   = udpv6_queue_rcv_skb,
-+	.backlog_rcv	   = __udpv6_queue_rcv_skb,
- 	.hash		   = udp_lib_hash,
- 	.unhash		   = udp_lib_unhash,
- 	.get_port	   = udp_v6_get_port,
-diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
-index 42de4cc..d0e906d 100644
---- a/net/l2tp/l2tp_ip.c
-+++ b/net/l2tp/l2tp_ip.c
-@@ -251,8 +251,6 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
- 	int ret;
- 	int chk_addr_ret;
- 
--	if (!sock_flag(sk, SOCK_ZAPPED))
--		return -EINVAL;
- 	if (addr_len < sizeof(struct sockaddr_l2tpip))
- 		return -EINVAL;
- 	if (addr->l2tp_family != AF_INET)
-@@ -267,6 +265,9 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
- 	read_unlock_bh(&l2tp_ip_lock);
- 
- 	lock_sock(sk);
-+	if (!sock_flag(sk, SOCK_ZAPPED))
-+		goto out;
-+
- 	if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_l2tpip))
- 		goto out;
- 
-diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
-index ea2ae66..b9c6a41 100644
---- a/net/l2tp/l2tp_ip6.c
-+++ b/net/l2tp/l2tp_ip6.c
-@@ -269,8 +269,6 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
- 	int addr_type;
- 	int err;
- 
--	if (!sock_flag(sk, SOCK_ZAPPED))
--		return -EINVAL;
- 	if (addr->l2tp_family != AF_INET6)
- 		return -EINVAL;
- 	if (addr_len < sizeof(*addr))
-@@ -296,6 +294,9 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
- 	lock_sock(sk);
- 
- 	err = -EINVAL;
-+	if (!sock_flag(sk, SOCK_ZAPPED))
-+		goto out_unlock;
-+
- 	if (sk->sk_state != TCP_CLOSE)
- 		goto out_unlock;
- 
-diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
-index 62bea45..246f29d 100644
---- a/net/netlink/af_netlink.c
-+++ b/net/netlink/af_netlink.c
-@@ -329,7 +329,6 @@ static void netlink_sock_destruct(struct sock *sk)
- 	if (nlk->cb_running) {
- 		if (nlk->cb.done)
- 			nlk->cb.done(&nlk->cb);
--
- 		module_put(nlk->cb.module);
- 		kfree_skb(nlk->cb.skb);
- 	}
-@@ -346,6 +345,14 @@ static void netlink_sock_destruct(struct sock *sk)
- 	WARN_ON(nlk_sk(sk)->groups);
- }
- 
-+static void netlink_sock_destruct_work(struct work_struct *work)
-+{
-+	struct netlink_sock *nlk = container_of(work, struct netlink_sock,
-+						work);
-+
-+	sk_free(&nlk->sk);
-+}
-+
- /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
-  * SMP. Look, when several writers sleep and reader wakes them up, all but one
-  * immediately hit write lock and grab all the cpus. Exclusive sleep solves
-@@ -648,8 +655,18 @@ static int netlink_create(struct net *net, struct socket *sock, int protocol,
- static void deferred_put_nlk_sk(struct rcu_head *head)
- {
- 	struct netlink_sock *nlk = container_of(head, struct netlink_sock, rcu);
-+	struct sock *sk = &nlk->sk;
-+
-+	if (!atomic_dec_and_test(&sk->sk_refcnt))
-+		return;
-+
-+	if (nlk->cb_running && nlk->cb.done) {
-+		INIT_WORK(&nlk->work, netlink_sock_destruct_work);
-+		schedule_work(&nlk->work);
-+		return;
-+	}
- 
--	sock_put(&nlk->sk);
-+	sk_free(sk);
- }
- 
- static int netlink_release(struct socket *sock)
-diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h
-index 3cfd6cc..4fdb383 100644
---- a/net/netlink/af_netlink.h
-+++ b/net/netlink/af_netlink.h
-@@ -3,6 +3,7 @@
- 
- #include <linux/rhashtable.h>
- #include <linux/atomic.h>
-+#include <linux/workqueue.h>
- #include <net/sock.h>
- 
- #define NLGRPSZ(x)	(ALIGN(x, sizeof(unsigned long) * 8) / 8)
-@@ -33,6 +34,7 @@ struct netlink_sock {
- 
- 	struct rhash_head	node;
- 	struct rcu_head		rcu;
-+	struct work_struct	work;
- };
- 
- static inline struct netlink_sock *nlk_sk(struct sock *sk)
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index d2238b2..dd23323 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -3648,19 +3648,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
- 
- 		if (optlen != sizeof(val))
- 			return -EINVAL;
--		if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
--			return -EBUSY;
- 		if (copy_from_user(&val, optval, sizeof(val)))
- 			return -EFAULT;
- 		switch (val) {
- 		case TPACKET_V1:
- 		case TPACKET_V2:
- 		case TPACKET_V3:
--			po->tp_version = val;
--			return 0;
-+			break;
- 		default:
- 			return -EINVAL;
- 		}
-+		lock_sock(sk);
-+		if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
-+			ret = -EBUSY;
-+		} else {
-+			po->tp_version = val;
-+			ret = 0;
-+		}
-+		release_sock(sk);
-+		return ret;
- 	}
- 	case PACKET_RESERVE:
- 	{
-@@ -4164,6 +4170,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
- 	/* Added to avoid minimal code churn */
- 	struct tpacket_req *req = &req_u->req;
- 
-+	lock_sock(sk);
- 	/* Opening a Tx-ring is NOT supported in TPACKET_V3 */
- 	if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) {
- 		net_warn_ratelimited("Tx-ring is not supported.\n");
-@@ -4245,7 +4252,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
- 			goto out;
- 	}
- 
--	lock_sock(sk);
- 
- 	/* Detach socket from network */
- 	spin_lock(&po->bind_lock);
-@@ -4294,11 +4300,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
- 		if (!tx_ring)
- 			prb_shutdown_retire_blk_timer(po, rb_queue);
- 	}
--	release_sock(sk);
- 
- 	if (pg_vec)
- 		free_pg_vec(pg_vec, order, req->tp_block_nr);
- out:
-+	release_sock(sk);
- 	return err;
- }
- 
-diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
-index b54d56d..cf9b2fe 100644
---- a/net/sched/act_pedit.c
-+++ b/net/sched/act_pedit.c
-@@ -108,6 +108,17 @@ static void tcf_pedit_cleanup(struct tc_action *a, int bind)
- 	kfree(keys);
- }
- 
-+static bool offset_valid(struct sk_buff *skb, int offset)
-+{
-+	if (offset > 0 && offset > skb->len)
-+		return false;
-+
-+	if  (offset < 0 && -offset > skb_headroom(skb))
-+		return false;
-+
-+	return true;
-+}
-+
- static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
- 		     struct tcf_result *res)
- {
-@@ -134,6 +145,11 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
- 			if (tkey->offmask) {
- 				char *d, _d;
- 
-+				if (!offset_valid(skb, off + tkey->at)) {
-+					pr_info("tc filter pedit 'at' offset %d out of bounds\n",
-+						off + tkey->at);
-+					goto bad;
-+				}
- 				d = skb_header_pointer(skb, off + tkey->at, 1,
- 						       &_d);
- 				if (!d)
-@@ -146,10 +162,10 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
- 					" offset must be on 32 bit boundaries\n");
- 				goto bad;
- 			}
--			if (offset > 0 && offset > skb->len) {
--				pr_info("tc filter pedit"
--					" offset %d can't exceed pkt length %d\n",
--				       offset, skb->len);
-+
-+			if (!offset_valid(skb, off + offset)) {
-+				pr_info("tc filter pedit offset %d out of bounds\n",
-+					offset);
- 				goto bad;
- 			}
- 
-diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
-index 0b8c3ac..1bf1f451 100644
---- a/net/sched/cls_basic.c
-+++ b/net/sched/cls_basic.c
-@@ -62,9 +62,6 @@ static unsigned long basic_get(struct tcf_proto *tp, u32 handle)
- 	struct basic_head *head = rtnl_dereference(tp->root);
- 	struct basic_filter *f;
- 
--	if (head == NULL)
--		return 0UL;
--
- 	list_for_each_entry(f, &head->flist, link) {
- 		if (f->handle == handle) {
- 			l = (unsigned long) f;
-@@ -109,7 +106,6 @@ static bool basic_destroy(struct tcf_proto *tp, bool force)
- 		tcf_unbind_filter(tp, &f->res);
- 		call_rcu(&f->rcu, basic_delete_filter);
- 	}
--	RCU_INIT_POINTER(tp->root, NULL);
- 	kfree_rcu(head, rcu);
- 	return true;
- }
-diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
-index c3002c2..dbec458 100644
---- a/net/sched/cls_bpf.c
-+++ b/net/sched/cls_bpf.c
-@@ -200,7 +200,6 @@ static bool cls_bpf_destroy(struct tcf_proto *tp, bool force)
- 		call_rcu(&prog->rcu, __cls_bpf_delete_prog);
- 	}
- 
--	RCU_INIT_POINTER(tp->root, NULL);
- 	kfree_rcu(head, rcu);
- 	return true;
- }
-@@ -211,9 +210,6 @@ static unsigned long cls_bpf_get(struct tcf_proto *tp, u32 handle)
- 	struct cls_bpf_prog *prog;
- 	unsigned long ret = 0UL;
- 
--	if (head == NULL)
--		return 0UL;
--
- 	list_for_each_entry(prog, &head->plist, link) {
- 		if (prog->handle == handle) {
- 			ret = (unsigned long) prog;
-diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
-index 4c85bd3..c104c20 100644
---- a/net/sched/cls_cgroup.c
-+++ b/net/sched/cls_cgroup.c
-@@ -130,11 +130,10 @@ static bool cls_cgroup_destroy(struct tcf_proto *tp, bool force)
- 
- 	if (!force)
- 		return false;
--
--	if (head) {
--		RCU_INIT_POINTER(tp->root, NULL);
-+	/* Head can still be NULL due to cls_cgroup_init(). */
-+	if (head)
- 		call_rcu(&head->rcu, cls_cgroup_destroy_rcu);
--	}
-+
- 	return true;
- }
- 
-diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
-index fbfec6a..d7ba2b4 100644
---- a/net/sched/cls_flow.c
-+++ b/net/sched/cls_flow.c
-@@ -583,7 +583,6 @@ static bool flow_destroy(struct tcf_proto *tp, bool force)
- 		list_del_rcu(&f->list);
- 		call_rcu(&f->rcu, flow_destroy_filter);
- 	}
--	RCU_INIT_POINTER(tp->root, NULL);
- 	kfree_rcu(head, rcu);
- 	return true;
- }
-diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
-index 5060801..a411571 100644
---- a/net/sched/cls_flower.c
-+++ b/net/sched/cls_flower.c
-@@ -13,6 +13,7 @@
- #include <linux/init.h>
- #include <linux/module.h>
- #include <linux/rhashtable.h>
-+#include <linux/workqueue.h>
- 
- #include <linux/if_ether.h>
- #include <linux/in6.h>
-@@ -55,7 +56,10 @@ struct cls_fl_head {
- 	bool mask_assigned;
- 	struct list_head filters;
- 	struct rhashtable_params ht_params;
--	struct rcu_head rcu;
-+	union {
-+		struct work_struct work;
-+		struct rcu_head	rcu;
-+	};
- };
- 
- struct cls_fl_filter {
-@@ -239,6 +243,24 @@ static void fl_hw_update_stats(struct tcf_proto *tp, struct cls_fl_filter *f)
- 	dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle, tp->protocol, &tc);
- }
- 
-+static void fl_destroy_sleepable(struct work_struct *work)
-+{
-+	struct cls_fl_head *head = container_of(work, struct cls_fl_head,
-+						work);
-+	if (head->mask_assigned)
-+		rhashtable_destroy(&head->ht);
-+	kfree(head);
-+	module_put(THIS_MODULE);
-+}
-+
-+static void fl_destroy_rcu(struct rcu_head *rcu)
-+{
-+	struct cls_fl_head *head = container_of(rcu, struct cls_fl_head, rcu);
-+
-+	INIT_WORK(&head->work, fl_destroy_sleepable);
-+	schedule_work(&head->work);
-+}
-+
- static bool fl_destroy(struct tcf_proto *tp, bool force)
- {
- 	struct cls_fl_head *head = rtnl_dereference(tp->root);
-@@ -252,10 +274,9 @@ static bool fl_destroy(struct tcf_proto *tp, bool force)
- 		list_del_rcu(&f->list);
- 		call_rcu(&f->rcu, fl_destroy_filter);
- 	}
--	RCU_INIT_POINTER(tp->root, NULL);
--	if (head->mask_assigned)
--		rhashtable_destroy(&head->ht);
--	kfree_rcu(head, rcu);
-+
-+	__module_get(THIS_MODULE);
-+	call_rcu(&head->rcu, fl_destroy_rcu);
- 	return true;
- }
- 
-diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
-index 25927b6..f935429 100644
---- a/net/sched/cls_matchall.c
-+++ b/net/sched/cls_matchall.c
-@@ -114,7 +114,6 @@ static bool mall_destroy(struct tcf_proto *tp, bool force)
- 
- 		call_rcu(&f->rcu, mall_destroy_filter);
- 	}
--	RCU_INIT_POINTER(tp->root, NULL);
- 	kfree_rcu(head, rcu);
- 	return true;
- }
-diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
-index f9c9fc0..9992dfa 100644
---- a/net/sched/cls_rsvp.h
-+++ b/net/sched/cls_rsvp.h
-@@ -152,7 +152,8 @@ static int rsvp_classify(struct sk_buff *skb, const struct tcf_proto *tp,
- 		return -1;
- 	nhptr = ip_hdr(skb);
- #endif
--
-+	if (unlikely(!head))
-+		return -1;
- restart:
- 
- #if RSVP_DST_LEN == 4
-diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
-index 944c8ff..403746b 100644
---- a/net/sched/cls_tcindex.c
-+++ b/net/sched/cls_tcindex.c
-@@ -503,7 +503,6 @@ static bool tcindex_destroy(struct tcf_proto *tp, bool force)
- 	walker.fn = tcindex_destroy_element;
- 	tcindex_walk(tp, &walker);
- 
--	RCU_INIT_POINTER(tp->root, NULL);
- 	call_rcu(&p->rcu, __tcindex_destroy);
- 	return true;
- }
-diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
-index 65b1bbf..6167699 100644
---- a/net/tipc/bearer.c
-+++ b/net/tipc/bearer.c
-@@ -402,6 +402,10 @@ int tipc_enable_l2_media(struct net *net, struct tipc_bearer *b,
- 	dev = dev_get_by_name(net, driver_name);
- 	if (!dev)
- 		return -ENODEV;
-+	if (tipc_mtu_bad(dev, 0)) {
-+		dev_put(dev);
-+		return -EINVAL;
-+	}
- 
- 	/* Associate TIPC bearer with L2 bearer */
- 	rcu_assign_pointer(b->media_ptr, dev);
-@@ -606,8 +610,6 @@ static int tipc_l2_device_event(struct notifier_block *nb, unsigned long evt,
- 	if (!b)
- 		return NOTIFY_DONE;
- 
--	b->mtu = dev->mtu;
--
- 	switch (evt) {
- 	case NETDEV_CHANGE:
- 		if (netif_carrier_ok(dev))
-@@ -621,6 +623,11 @@ static int tipc_l2_device_event(struct notifier_block *nb, unsigned long evt,
- 		tipc_reset_bearer(net, b);
- 		break;
- 	case NETDEV_CHANGEMTU:
-+		if (tipc_mtu_bad(dev, 0)) {
-+			bearer_disable(net, b);
-+			break;
-+		}
-+		b->mtu = dev->mtu;
- 		tipc_reset_bearer(net, b);
- 		break;
- 	case NETDEV_CHANGEADDR:
-diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
-index 43757f1..d93f1f1 100644
---- a/net/tipc/bearer.h
-+++ b/net/tipc/bearer.h
-@@ -39,6 +39,7 @@
- 
- #include "netlink.h"
- #include "core.h"
-+#include "msg.h"
- #include <net/genetlink.h>
- 
- #define MAX_MEDIA	3
-@@ -59,6 +60,9 @@
- #define TIPC_MEDIA_TYPE_IB	2
- #define TIPC_MEDIA_TYPE_UDP	3
- 
-+/* minimum bearer MTU */
-+#define TIPC_MIN_BEARER_MTU	(MAX_H_SIZE + INT_H_SIZE)
-+
- /**
-  * struct tipc_media_addr - destination address used by TIPC bearers
-  * @value: address info (format defined by media)
-@@ -213,4 +217,13 @@ void tipc_bearer_xmit(struct net *net, u32 bearer_id,
- void tipc_bearer_bc_xmit(struct net *net, u32 bearer_id,
- 			 struct sk_buff_head *xmitq);
- 
-+/* check if device MTU is too low for tipc headers */
-+static inline bool tipc_mtu_bad(struct net_device *dev, unsigned int reserve)
-+{
-+	if (dev->mtu >= TIPC_MIN_BEARER_MTU + reserve)
-+		return false;
-+	netdev_warn(dev, "MTU too low for tipc bearer\n");
-+	return true;
-+}
-+
- #endif	/* _TIPC_BEARER_H */
-diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
-index ae7e14c..f60f346 100644
---- a/net/tipc/udp_media.c
-+++ b/net/tipc/udp_media.c
-@@ -372,6 +372,11 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,
- 		udp_conf.local_ip.s_addr = htonl(INADDR_ANY);
- 		udp_conf.use_udp_checksums = false;
- 		ub->ifindex = dev->ifindex;
-+		if (tipc_mtu_bad(dev, sizeof(struct iphdr) +
-+				      sizeof(struct udphdr))) {
-+			err = -EINVAL;
-+			goto err;
-+		}
- 		b->mtu = dev->mtu - sizeof(struct iphdr)
- 			- sizeof(struct udphdr);
- #if IS_ENABLED(CONFIG_IPV6)
-diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 8309687..568f307 100644
---- a/net/unix/af_unix.c
-+++ b/net/unix/af_unix.c
-@@ -2199,7 +2199,8 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
-  *	Sleep until more data has arrived. But check for races..
-  */
- static long unix_stream_data_wait(struct sock *sk, long timeo,
--				  struct sk_buff *last, unsigned int last_len)
-+				  struct sk_buff *last, unsigned int last_len,
-+				  bool freezable)
- {
- 	struct sk_buff *tail;
- 	DEFINE_WAIT(wait);
-@@ -2220,7 +2221,10 @@ static long unix_stream_data_wait(struct sock *sk, long timeo,
- 
- 		sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
- 		unix_state_unlock(sk);
--		timeo = freezable_schedule_timeout(timeo);
-+		if (freezable)
-+			timeo = freezable_schedule_timeout(timeo);
-+		else
-+			timeo = schedule_timeout(timeo);
- 		unix_state_lock(sk);
- 
- 		if (sock_flag(sk, SOCK_DEAD))
-@@ -2250,7 +2254,8 @@ struct unix_stream_read_state {
- 	unsigned int splice_flags;
- };
- 
--static int unix_stream_read_generic(struct unix_stream_read_state *state)
-+static int unix_stream_read_generic(struct unix_stream_read_state *state,
-+				    bool freezable)
- {
- 	struct scm_cookie scm;
- 	struct socket *sock = state->socket;
-@@ -2330,7 +2335,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state)
- 			mutex_unlock(&u->iolock);
- 
- 			timeo = unix_stream_data_wait(sk, timeo, last,
--						      last_len);
-+						      last_len, freezable);
- 
- 			if (signal_pending(current)) {
- 				err = sock_intr_errno(timeo);
-@@ -2472,7 +2477,7 @@ static int unix_stream_recvmsg(struct socket *sock, struct msghdr *msg,
- 		.flags = flags
- 	};
- 
--	return unix_stream_read_generic(&state);
-+	return unix_stream_read_generic(&state, true);
- }
- 
- static ssize_t skb_unix_socket_splice(struct sock *sk,
-@@ -2518,7 +2523,7 @@ static ssize_t unix_stream_splice_read(struct socket *sock,  loff_t *ppos,
- 	    flags & SPLICE_F_NONBLOCK)
- 		state.flags = MSG_DONTWAIT;
- 
--	return unix_stream_read_generic(&state);
-+	return unix_stream_read_generic(&state, false);
- }
- 
- static int unix_shutdown(struct socket *sock, int mode)

diff --git a/4.8.15/1014_linux-4.8.15.patch b/4.8.15/1014_linux-4.8.15.patch
deleted file mode 100644
index 9b7b2f4..0000000
--- a/4.8.15/1014_linux-4.8.15.patch
+++ /dev/null
@@ -1,1042 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 6a74924..c7f0e79 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 8
--SUBLEVEL = 14
-+SUBLEVEL = 15
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
- 
-diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
-index 1e90bdb..fb307de 100644
---- a/arch/arm/boot/dts/imx7s.dtsi
-+++ b/arch/arm/boot/dts/imx7s.dtsi
-@@ -640,9 +640,8 @@
- 				reg = <0x30730000 0x10000>;
- 				interrupts = <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>;
- 				clocks = <&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>,
--					<&clks IMX7D_CLK_DUMMY>,
--					<&clks IMX7D_CLK_DUMMY>;
--				clock-names = "pix", "axi", "disp_axi";
-+					<&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>;
-+				clock-names = "pix", "axi";
- 				status = "disabled";
- 			};
- 		};
-diff --git a/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts b/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts
-index 1cf644b..51dc734 100644
---- a/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts
-+++ b/arch/arm/boot/dts/orion5x-linkstation-lsgl.dts
-@@ -82,6 +82,10 @@
- 	gpios = <&gpio0 9 GPIO_ACTIVE_HIGH>;
- };
- 
-+&sata {
-+	nr-ports = <2>;
-+};
-+
- &ehci1 {
- 	status = "okay";
- };
-diff --git a/arch/m68k/include/asm/delay.h b/arch/m68k/include/asm/delay.h
-index d28fa8f..c598d84 100644
---- a/arch/m68k/include/asm/delay.h
-+++ b/arch/m68k/include/asm/delay.h
-@@ -114,6 +114,6 @@ static inline void __udelay(unsigned long usecs)
-  */
- #define	HZSCALE		(268435456 / (1000000 / HZ))
- 
--#define ndelay(n) __delay(DIV_ROUND_UP((n) * ((((HZSCALE) >> 11) * (loops_per_jiffy >> 11)) >> 6), 1000));
-+#define ndelay(n) __delay(DIV_ROUND_UP((n) * ((((HZSCALE) >> 11) * (loops_per_jiffy >> 11)) >> 6), 1000))
- 
- #endif /* defined(_M68K_DELAY_H) */
-diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
-index c2c43f7..3a4ed9f 100644
---- a/arch/parisc/include/asm/pgtable.h
-+++ b/arch/parisc/include/asm/pgtable.h
-@@ -65,9 +65,9 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
- 		unsigned long flags;				\
- 		spin_lock_irqsave(&pa_tlb_lock, flags);		\
- 		old_pte = *ptep;				\
--		set_pte(ptep, pteval);				\
- 		if (pte_inserted(old_pte))			\
- 			purge_tlb_entries(mm, addr);		\
-+		set_pte(ptep, pteval);				\
- 		spin_unlock_irqrestore(&pa_tlb_lock, flags);	\
- 	} while (0)
- 
-@@ -478,8 +478,8 @@ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned
- 		spin_unlock_irqrestore(&pa_tlb_lock, flags);
- 		return 0;
- 	}
--	set_pte(ptep, pte_mkold(pte));
- 	purge_tlb_entries(vma->vm_mm, addr);
-+	set_pte(ptep, pte_mkold(pte));
- 	spin_unlock_irqrestore(&pa_tlb_lock, flags);
- 	return 1;
- }
-@@ -492,9 +492,9 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
- 
- 	spin_lock_irqsave(&pa_tlb_lock, flags);
- 	old_pte = *ptep;
--	set_pte(ptep, __pte(0));
- 	if (pte_inserted(old_pte))
- 		purge_tlb_entries(mm, addr);
-+	set_pte(ptep, __pte(0));
- 	spin_unlock_irqrestore(&pa_tlb_lock, flags);
- 
- 	return old_pte;
-@@ -504,8 +504,8 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr,
- {
- 	unsigned long flags;
- 	spin_lock_irqsave(&pa_tlb_lock, flags);
--	set_pte(ptep, pte_wrprotect(*ptep));
- 	purge_tlb_entries(mm, addr);
-+	set_pte(ptep, pte_wrprotect(*ptep));
- 	spin_unlock_irqrestore(&pa_tlb_lock, flags);
- }
- 
-diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
-index c2259d4..bbb314eb 100644
---- a/arch/parisc/kernel/cache.c
-+++ b/arch/parisc/kernel/cache.c
-@@ -393,6 +393,15 @@ void __init parisc_setup_cache_timing(void)
- 
- 	/* calculate TLB flush threshold */
- 
-+	/* On SMP machines, skip the TLB measure of kernel text which
-+	 * has been mapped as huge pages. */
-+	if (num_online_cpus() > 1 && !parisc_requires_coherency()) {
-+		threshold = max(cache_info.it_size, cache_info.dt_size);
-+		threshold *= PAGE_SIZE;
-+		threshold /= num_online_cpus();
-+		goto set_tlb_threshold;
-+	}
-+
- 	alltime = mfctl(16);
- 	flush_tlb_all();
- 	alltime = mfctl(16) - alltime;
-@@ -411,6 +420,8 @@ void __init parisc_setup_cache_timing(void)
- 		alltime, size, rangetime);
- 
- 	threshold = PAGE_ALIGN(num_online_cpus() * size * alltime / rangetime);
-+
-+set_tlb_threshold:
- 	if (threshold)
- 		parisc_tlb_flush_threshold = threshold;
- 	printk(KERN_INFO "TLB flush threshold set to %lu KiB\n",
-diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S
-index 6755219..a4761b7 100644
---- a/arch/parisc/kernel/pacache.S
-+++ b/arch/parisc/kernel/pacache.S
-@@ -886,19 +886,10 @@ ENTRY(flush_dcache_page_asm)
- 	fdc,m		r31(%r28)
- 	fdc,m		r31(%r28)
- 	fdc,m		r31(%r28)
--	cmpb,COND(<<)		%r28, %r25,1b
-+	cmpb,COND(<<)	%r28, %r25,1b
- 	fdc,m		r31(%r28)
- 
- 	sync
--
--#ifdef CONFIG_PA20
--	pdtlb,l		%r0(%r25)
--#else
--	tlb_lock	%r20,%r21,%r22
--	pdtlb		%r0(%r25)
--	tlb_unlock	%r20,%r21,%r22
--#endif
--
- 	bv		%r0(%r2)
- 	nop
- 	.exit
-@@ -973,17 +964,6 @@ ENTRY(flush_icache_page_asm)
- 	fic,m		%r31(%sr4,%r28)
- 
- 	sync
--
--#ifdef CONFIG_PA20
--	pdtlb,l		%r0(%r28)
--	pitlb,l         %r0(%sr4,%r25)
--#else
--	tlb_lock        %r20,%r21,%r22
--	pdtlb		%r0(%r28)
--	pitlb           %r0(%sr4,%r25)
--	tlb_unlock      %r20,%r21,%r22
--#endif
--
- 	bv		%r0(%r2)
- 	nop
- 	.exit
-diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
-index 1a2a6e8..1894beb 100644
---- a/arch/powerpc/boot/Makefile
-+++ b/arch/powerpc/boot/Makefile
-@@ -78,7 +78,8 @@ src-wlib-y := string.S crt0.S crtsavres.S stdio.c main.c \
- 		ns16550.c serial.c simple_alloc.c div64.S util.S \
- 		gunzip_util.c elf_util.c $(zlib) devtree.c stdlib.c \
- 		oflib.c ofconsole.c cuboot.c mpsc.c cpm-serial.c \
--		uartlite.c mpc52xx-psc.c opal.c opal-calls.S
-+		uartlite.c mpc52xx-psc.c opal.c
-+src-wlib-$(CONFIG_PPC64_BOOT_WRAPPER) +=  opal-calls.S
- src-wlib-$(CONFIG_40x) += 4xx.c planetcore.c
- src-wlib-$(CONFIG_44x) += 4xx.c ebony.c bamboo.c
- src-wlib-$(CONFIG_8xx) += mpc8xx.c planetcore.c fsl-soc.c
-diff --git a/arch/powerpc/boot/opal.c b/arch/powerpc/boot/opal.c
-index d7b4fd4..0272570 100644
---- a/arch/powerpc/boot/opal.c
-+++ b/arch/powerpc/boot/opal.c
-@@ -13,7 +13,7 @@
- #include <libfdt.h>
- #include "../include/asm/opal-api.h"
- 
--#ifdef __powerpc64__
-+#ifdef CONFIG_PPC64_BOOT_WRAPPER
- 
- /* Global OPAL struct used by opal-call.S */
- struct opal {
-diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
-index 29aa8d1..248f28b 100644
---- a/arch/powerpc/kernel/eeh_driver.c
-+++ b/arch/powerpc/kernel/eeh_driver.c
-@@ -671,8 +671,10 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus,
- 
- 	/* Clear frozen state */
- 	rc = eeh_clear_pe_frozen_state(pe, false);
--	if (rc)
-+	if (rc) {
-+		pci_unlock_rescan_remove();
- 		return rc;
-+	}
- 
- 	/* Give the system 5 seconds to finish running the user-space
- 	 * hotplug shutdown scripts, e.g. ifdown for ethernet.  Yes,
-diff --git a/arch/powerpc/mm/hash64_4k.c b/arch/powerpc/mm/hash64_4k.c
-index 42c702b..6fa450c 100644
---- a/arch/powerpc/mm/hash64_4k.c
-+++ b/arch/powerpc/mm/hash64_4k.c
-@@ -55,7 +55,7 @@ int __hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid,
- 	 */
- 	rflags = htab_convert_pte_flags(new_pte);
- 
--	if (!cpu_has_feature(CPU_FTR_NOEXECUTE) &&
-+	if (cpu_has_feature(CPU_FTR_NOEXECUTE) &&
- 	    !cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
- 		rflags = hash_page_do_lazy_icache(rflags, __pte(old_pte), trap);
- 
-diff --git a/arch/powerpc/mm/hash64_64k.c b/arch/powerpc/mm/hash64_64k.c
-index 3bbbea0..1a68cb1 100644
---- a/arch/powerpc/mm/hash64_64k.c
-+++ b/arch/powerpc/mm/hash64_64k.c
-@@ -87,7 +87,7 @@ int __hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid,
- 	subpg_pte = new_pte & ~subpg_prot;
- 	rflags = htab_convert_pte_flags(subpg_pte);
- 
--	if (!cpu_has_feature(CPU_FTR_NOEXECUTE) &&
-+	if (cpu_has_feature(CPU_FTR_NOEXECUTE) &&
- 	    !cpu_has_feature(CPU_FTR_COHERENT_ICACHE)) {
- 
- 		/*
-@@ -258,7 +258,7 @@ int __hash_page_64K(unsigned long ea, unsigned long access,
- 
- 	rflags = htab_convert_pte_flags(new_pte);
- 
--	if (!cpu_has_feature(CPU_FTR_NOEXECUTE) &&
-+	if (cpu_has_feature(CPU_FTR_NOEXECUTE) &&
- 	    !cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
- 		rflags = hash_page_do_lazy_icache(rflags, __pte(old_pte), trap);
- 
-diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
-index a4e070a..8c925ec 100644
---- a/arch/x86/events/core.c
-+++ b/arch/x86/events/core.c
-@@ -68,7 +68,7 @@ u64 x86_perf_event_update(struct perf_event *event)
- 	int shift = 64 - x86_pmu.cntval_bits;
- 	u64 prev_raw_count, new_raw_count;
- 	int idx = hwc->idx;
--	s64 delta;
-+	u64 delta;
- 
- 	if (idx == INTEL_PMC_IDX_FIXED_BTS)
- 		return 0;
-diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
-index 4c9a79b..3ef34c6 100644
---- a/arch/x86/events/intel/core.c
-+++ b/arch/x86/events/intel/core.c
-@@ -4024,7 +4024,7 @@ __init int intel_pmu_init(void)
- 
- 	/* Support full width counters using alternative MSR range */
- 	if (x86_pmu.intel_cap.full_width_write) {
--		x86_pmu.max_period = x86_pmu.cntval_mask;
-+		x86_pmu.max_period = x86_pmu.cntval_mask >> 1;
- 		x86_pmu.perfctr = MSR_IA32_PMC0;
- 		pr_cont("full-width counters, ");
- 	}
-diff --git a/crypto/Makefile b/crypto/Makefile
-index 99cc64ac..bd6a029 100644
---- a/crypto/Makefile
-+++ b/crypto/Makefile
-@@ -40,6 +40,7 @@ obj-$(CONFIG_CRYPTO_ECDH) += ecdh_generic.o
- 
- $(obj)/rsapubkey-asn1.o: $(obj)/rsapubkey-asn1.c $(obj)/rsapubkey-asn1.h
- $(obj)/rsaprivkey-asn1.o: $(obj)/rsaprivkey-asn1.c $(obj)/rsaprivkey-asn1.h
-+$(obj)/rsa_helper.o: $(obj)/rsapubkey-asn1.h $(obj)/rsaprivkey-asn1.h
- clean-files += rsapubkey-asn1.c rsapubkey-asn1.h
- clean-files += rsaprivkey-asn1.c rsaprivkey-asn1.h
- 
-diff --git a/crypto/mcryptd.c b/crypto/mcryptd.c
-index 86fb59b..c6e9920 100644
---- a/crypto/mcryptd.c
-+++ b/crypto/mcryptd.c
-@@ -254,18 +254,22 @@ static void *mcryptd_alloc_instance(struct crypto_alg *alg, unsigned int head,
- 	goto out;
- }
- 
--static inline void mcryptd_check_internal(struct rtattr **tb, u32 *type,
-+static inline bool mcryptd_check_internal(struct rtattr **tb, u32 *type,
- 					  u32 *mask)
- {
- 	struct crypto_attr_type *algt;
- 
- 	algt = crypto_get_attr_type(tb);
- 	if (IS_ERR(algt))
--		return;
--	if ((algt->type & CRYPTO_ALG_INTERNAL))
--		*type |= CRYPTO_ALG_INTERNAL;
--	if ((algt->mask & CRYPTO_ALG_INTERNAL))
--		*mask |= CRYPTO_ALG_INTERNAL;
-+		return false;
-+
-+	*type |= algt->type & CRYPTO_ALG_INTERNAL;
-+	*mask |= algt->mask & CRYPTO_ALG_INTERNAL;
-+
-+	if (*type & *mask & CRYPTO_ALG_INTERNAL)
-+		return true;
-+	else
-+		return false;
- }
- 
- static int mcryptd_hash_init_tfm(struct crypto_tfm *tfm)
-@@ -492,7 +496,8 @@ static int mcryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb,
- 	u32 mask = 0;
- 	int err;
- 
--	mcryptd_check_internal(tb, &type, &mask);
-+	if (!mcryptd_check_internal(tb, &type, &mask))
-+		return -EINVAL;
- 
- 	halg = ahash_attr_alg(tb[1], type, mask);
- 	if (IS_ERR(halg))
-diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
-index 2accf78..93e0d83 100644
---- a/drivers/acpi/nfit/core.c
-+++ b/drivers/acpi/nfit/core.c
-@@ -94,7 +94,7 @@ static struct acpi_device *to_acpi_dev(struct acpi_nfit_desc *acpi_desc)
- 	return to_acpi_device(acpi_desc->dev);
- }
- 
--static int xlat_status(void *buf, unsigned int cmd, u32 status)
-+static int xlat_bus_status(void *buf, unsigned int cmd, u32 status)
- {
- 	struct nd_cmd_clear_error *clear_err;
- 	struct nd_cmd_ars_status *ars_status;
-@@ -113,7 +113,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
- 		flags = ND_ARS_PERSISTENT | ND_ARS_VOLATILE;
- 		if ((status >> 16 & flags) == 0)
- 			return -ENOTTY;
--		break;
-+		return 0;
- 	case ND_CMD_ARS_START:
- 		/* ARS is in progress */
- 		if ((status & 0xffff) == NFIT_ARS_START_BUSY)
-@@ -122,7 +122,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
- 		/* Command failed */
- 		if (status & 0xffff)
- 			return -EIO;
--		break;
-+		return 0;
- 	case ND_CMD_ARS_STATUS:
- 		ars_status = buf;
- 		/* Command failed */
-@@ -146,7 +146,8 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
- 		 * then just continue with the returned results.
- 		 */
- 		if (status == NFIT_ARS_STATUS_INTR) {
--			if (ars_status->flags & NFIT_ARS_F_OVERFLOW)
-+			if (ars_status->out_length >= 40 && (ars_status->flags
-+						& NFIT_ARS_F_OVERFLOW))
- 				return -ENOSPC;
- 			return 0;
- 		}
-@@ -154,7 +155,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
- 		/* Unknown status */
- 		if (status >> 16)
- 			return -EIO;
--		break;
-+		return 0;
- 	case ND_CMD_CLEAR_ERROR:
- 		clear_err = buf;
- 		if (status & 0xffff)
-@@ -163,7 +164,7 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
- 			return -EIO;
- 		if (clear_err->length > clear_err->cleared)
- 			return clear_err->cleared;
--		break;
-+		return 0;
- 	default:
- 		break;
- 	}
-@@ -174,6 +175,16 @@ static int xlat_status(void *buf, unsigned int cmd, u32 status)
- 	return 0;
- }
- 
-+static int xlat_status(struct nvdimm *nvdimm, void *buf, unsigned int cmd,
-+		u32 status)
-+{
-+	if (!nvdimm)
-+		return xlat_bus_status(buf, cmd, status);
-+	if (status)
-+		return -EIO;
-+	return 0;
-+}
-+
- static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
- 		struct nvdimm *nvdimm, unsigned int cmd, void *buf,
- 		unsigned int buf_len, int *cmd_rc)
-@@ -298,7 +309,8 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
- 
- 	for (i = 0, offset = 0; i < desc->out_num; i++) {
- 		u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i, buf,
--				(u32 *) out_obj->buffer.pointer);
-+				(u32 *) out_obj->buffer.pointer,
-+				out_obj->buffer.length - offset);
- 
- 		if (offset + out_size > out_obj->buffer.length) {
- 			dev_dbg(dev, "%s:%s output object underflow cmd: %s field: %d\n",
-@@ -333,7 +345,8 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
- 			 */
- 			rc = buf_len - offset - in_buf.buffer.length;
- 			if (cmd_rc)
--				*cmd_rc = xlat_status(buf, cmd, fw_status);
-+				*cmd_rc = xlat_status(nvdimm, buf, cmd,
-+						fw_status);
- 		} else {
- 			dev_err(dev, "%s:%s underrun cmd: %s buf_len: %d out_len: %d\n",
- 					__func__, dimm_name, cmd_name, buf_len,
-@@ -343,7 +356,7 @@ static int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc,
- 	} else {
- 		rc = 0;
- 		if (cmd_rc)
--			*cmd_rc = xlat_status(buf, cmd, fw_status);
-+			*cmd_rc = xlat_status(nvdimm, buf, cmd, fw_status);
- 	}
- 
-  out:
-@@ -1857,19 +1870,32 @@ static int ars_get_status(struct acpi_nfit_desc *acpi_desc)
- 	return cmd_rc;
- }
- 
--static int ars_status_process_records(struct nvdimm_bus *nvdimm_bus,
-+static int ars_status_process_records(struct acpi_nfit_desc *acpi_desc,
- 		struct nd_cmd_ars_status *ars_status)
- {
-+	struct nvdimm_bus *nvdimm_bus = acpi_desc->nvdimm_bus;
- 	int rc;
- 	u32 i;
- 
-+	/*
-+	 * First record starts at 44 byte offset from the start of the
-+	 * payload.
-+	 */
-+	if (ars_status->out_length < 44)
-+		return 0;
- 	for (i = 0; i < ars_status->num_records; i++) {
-+		/* only process full records */
-+		if (ars_status->out_length
-+				< 44 + sizeof(struct nd_ars_record) * (i + 1))
-+			break;
- 		rc = nvdimm_bus_add_poison(nvdimm_bus,
- 				ars_status->records[i].err_address,
- 				ars_status->records[i].length);
- 		if (rc)
- 			return rc;
- 	}
-+	if (i < ars_status->num_records)
-+		dev_warn(acpi_desc->dev, "detected truncated ars results\n");
- 
- 	return 0;
- }
-@@ -2122,8 +2148,7 @@ static int acpi_nfit_query_poison(struct acpi_nfit_desc *acpi_desc,
- 	if (rc < 0 && rc != -ENOSPC)
- 		return rc;
- 
--	if (ars_status_process_records(acpi_desc->nvdimm_bus,
--				acpi_desc->ars_status))
-+	if (ars_status_process_records(acpi_desc, acpi_desc->ars_status))
- 		return -ENOMEM;
- 
- 	return 0;
-diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
-index 2b38c1b..7a2e4d4 100644
---- a/drivers/acpi/sleep.c
-+++ b/drivers/acpi/sleep.c
-@@ -47,32 +47,15 @@ static void acpi_sleep_tts_switch(u32 acpi_state)
- 	}
- }
- 
--static void acpi_sleep_pts_switch(u32 acpi_state)
--{
--	acpi_status status;
--
--	status = acpi_execute_simple_method(NULL, "\\_PTS", acpi_state);
--	if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) {
--		/*
--		 * OS can't evaluate the _PTS object correctly. Some warning
--		 * message will be printed. But it won't break anything.
--		 */
--		printk(KERN_NOTICE "Failure in evaluating _PTS object\n");
--	}
--}
--
--static int sleep_notify_reboot(struct notifier_block *this,
-+static int tts_notify_reboot(struct notifier_block *this,
- 			unsigned long code, void *x)
- {
- 	acpi_sleep_tts_switch(ACPI_STATE_S5);
--
--	acpi_sleep_pts_switch(ACPI_STATE_S5);
--
- 	return NOTIFY_DONE;
- }
- 
--static struct notifier_block sleep_notifier = {
--	.notifier_call	= sleep_notify_reboot,
-+static struct notifier_block tts_notifier = {
-+	.notifier_call	= tts_notify_reboot,
- 	.next		= NULL,
- 	.priority	= 0,
- };
-@@ -916,9 +899,9 @@ int __init acpi_sleep_init(void)
- 	pr_info(PREFIX "(supports%s)\n", supported);
- 
- 	/*
--	 * Register the sleep_notifier to reboot notifier list so that the _TTS
--	 * and _PTS object can also be evaluated when the system enters S5.
-+	 * Register the tts_notifier to reboot notifier list so that the _TTS
-+	 * object can also be evaluated when the system enters S5.
- 	 */
--	register_reboot_notifier(&sleep_notifier);
-+	register_reboot_notifier(&tts_notifier);
- 	return 0;
- }
-diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
-index 5163c8f..5497f7f 100644
---- a/drivers/block/zram/zram_drv.c
-+++ b/drivers/block/zram/zram_drv.c
-@@ -1413,8 +1413,14 @@ static ssize_t hot_remove_store(struct class *class,
- 	return ret ? ret : count;
- }
- 
-+/*
-+ * NOTE: hot_add attribute is not the usual read-only sysfs attribute. In a
-+ * sense that reading from this file does alter the state of your system -- it
-+ * creates a new un-initialized zram device and returns back this device's
-+ * device_id (or an error code if it fails to create a new device).
-+ */
- static struct class_attribute zram_control_class_attrs[] = {
--	__ATTR_RO(hot_add),
-+	__ATTR(hot_add, 0400, hot_add_show, NULL),
- 	__ATTR_WO(hot_remove),
- 	__ATTR_NULL,
- };
-diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
-index 0ec112e..2341f37 100644
---- a/drivers/crypto/caam/ctrl.c
-+++ b/drivers/crypto/caam/ctrl.c
-@@ -557,8 +557,9 @@ static int caam_probe(struct platform_device *pdev)
- 	 * Enable DECO watchdogs and, if this is a PHYS_ADDR_T_64BIT kernel,
- 	 * long pointers in master configuration register
- 	 */
--	clrsetbits_32(&ctrl->mcr, MCFGR_AWCACHE_MASK, MCFGR_AWCACHE_CACH |
--		      MCFGR_AWCACHE_BUFF | MCFGR_WDENABLE | MCFGR_LARGE_BURST |
-+	clrsetbits_32(&ctrl->mcr, MCFGR_AWCACHE_MASK | MCFGR_LONG_PTR,
-+		      MCFGR_AWCACHE_CACH | MCFGR_AWCACHE_BUFF |
-+		      MCFGR_WDENABLE | MCFGR_LARGE_BURST |
- 		      (sizeof(dma_addr_t) == sizeof(u64) ? MCFGR_LONG_PTR : 0));
- 
- 	/*
-diff --git a/drivers/crypto/marvell/hash.c b/drivers/crypto/marvell/hash.c
-index b111e14..13e89af 100644
---- a/drivers/crypto/marvell/hash.c
-+++ b/drivers/crypto/marvell/hash.c
-@@ -168,12 +168,11 @@ static void mv_cesa_ahash_std_step(struct ahash_request *req)
- 	mv_cesa_adjust_op(engine, &creq->op_tmpl);
- 	memcpy_toio(engine->sram, &creq->op_tmpl, sizeof(creq->op_tmpl));
- 
--	digsize = crypto_ahash_digestsize(crypto_ahash_reqtfm(req));
--	for (i = 0; i < digsize / 4; i++)
--		writel_relaxed(creq->state[i], engine->regs + CESA_IVDIG(i));
--
--	mv_cesa_adjust_op(engine, &creq->op_tmpl);
--	memcpy_toio(engine->sram, &creq->op_tmpl, sizeof(creq->op_tmpl));
-+	if (!sreq->offset) {
-+		digsize = crypto_ahash_digestsize(crypto_ahash_reqtfm(req));
-+		for (i = 0; i < digsize / 4; i++)
-+			writel_relaxed(creq->state[i], engine->regs + CESA_IVDIG(i));
-+	}
- 
- 	if (creq->cache_ptr)
- 		memcpy_toio(engine->sram + CESA_SA_DATA_SRAM_OFFSET,
-diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c
-index ff64313..4894199 100644
---- a/drivers/dax/dax.c
-+++ b/drivers/dax/dax.c
-@@ -324,7 +324,7 @@ static int check_vma(struct dax_dev *dax_dev, struct vm_area_struct *vma,
- 		return -ENXIO;
- 
- 	/* prevent private mappings from being established */
--	if ((vma->vm_flags & VM_SHARED) != VM_SHARED) {
-+	if ((vma->vm_flags & VM_MAYSHARE) != VM_MAYSHARE) {
- 		dev_info(dev, "%s: %s: fail, attempted private mapping\n",
- 				current->comm, func);
- 		return -EINVAL;
-diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
-index bfb91d8..1006af4 100644
---- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
-+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
-@@ -872,23 +872,25 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter,
- static void peak_usb_disconnect(struct usb_interface *intf)
- {
- 	struct peak_usb_device *dev;
-+	struct peak_usb_device *dev_prev_siblings;
- 
- 	/* unregister as many netdev devices as siblings */
--	for (dev = usb_get_intfdata(intf); dev; dev = dev->prev_siblings) {
-+	for (dev = usb_get_intfdata(intf); dev; dev = dev_prev_siblings) {
- 		struct net_device *netdev = dev->netdev;
- 		char name[IFNAMSIZ];
- 
-+		dev_prev_siblings = dev->prev_siblings;
- 		dev->state &= ~PCAN_USB_STATE_CONNECTED;
- 		strncpy(name, netdev->name, IFNAMSIZ);
- 
- 		unregister_netdev(netdev);
--		free_candev(netdev);
- 
- 		kfree(dev->cmd_buf);
- 		dev->next_siblings = NULL;
- 		if (dev->adapter->dev_free)
- 			dev->adapter->dev_free(dev);
- 
-+		free_candev(netdev);
- 		dev_info(&intf->dev, "%s removed\n", name);
- 	}
- 
-diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
-index a8b6949..23d4a17 100644
---- a/drivers/nvdimm/bus.c
-+++ b/drivers/nvdimm/bus.c
-@@ -715,7 +715,7 @@ EXPORT_SYMBOL_GPL(nd_cmd_in_size);
- 
- u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd,
- 		const struct nd_cmd_desc *desc, int idx, const u32 *in_field,
--		const u32 *out_field)
-+		const u32 *out_field, unsigned long remainder)
- {
- 	if (idx >= desc->out_num)
- 		return UINT_MAX;
-@@ -727,9 +727,24 @@ u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd,
- 		return in_field[1];
- 	else if (nvdimm && cmd == ND_CMD_VENDOR && idx == 2)
- 		return out_field[1];
--	else if (!nvdimm && cmd == ND_CMD_ARS_STATUS && idx == 2)
--		return out_field[1] - 8;
--	else if (cmd == ND_CMD_CALL) {
-+	else if (!nvdimm && cmd == ND_CMD_ARS_STATUS && idx == 2) {
-+		/*
-+		 * Per table 9-276 ARS Data in ACPI 6.1, out_field[1] is
-+		 * "Size of Output Buffer in bytes, including this
-+		 * field."
-+		 */
-+		if (out_field[1] < 4)
-+			return 0;
-+		/*
-+		 * ACPI 6.1 is ambiguous if 'status' is included in the
-+		 * output size. If we encounter an output size that
-+		 * overshoots the remainder by 4 bytes, assume it was
-+		 * including 'status'.
-+		 */
-+		if (out_field[1] - 8 == remainder)
-+			return remainder;
-+		return out_field[1] - 4;
-+	} else if (cmd == ND_CMD_CALL) {
- 		struct nd_cmd_pkg *pkg = (struct nd_cmd_pkg *) in_field;
- 
- 		return pkg->nd_size_out;
-@@ -876,7 +891,7 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
- 	/* process an output envelope */
- 	for (i = 0; i < desc->out_num; i++) {
- 		u32 out_size = nd_cmd_out_size(nvdimm, cmd, desc, i,
--				(u32 *) in_env, (u32 *) out_env);
-+				(u32 *) in_env, (u32 *) out_env, 0);
- 		u32 copy;
- 
- 		if (out_size == UINT_MAX) {
-diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
-index 7080ce2..8214eba 100644
---- a/drivers/scsi/lpfc/lpfc_sli.c
-+++ b/drivers/scsi/lpfc/lpfc_sli.c
-@@ -1323,18 +1323,20 @@ lpfc_sli_ringtxcmpl_put(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
- {
- 	lockdep_assert_held(&phba->hbalock);
- 
--	BUG_ON(!piocb || !piocb->vport);
-+	BUG_ON(!piocb);
- 
- 	list_add_tail(&piocb->list, &pring->txcmplq);
- 	piocb->iocb_flag |= LPFC_IO_ON_TXCMPLQ;
- 
- 	if ((unlikely(pring->ringno == LPFC_ELS_RING)) &&
- 	   (piocb->iocb.ulpCommand != CMD_ABORT_XRI_CN) &&
--	   (piocb->iocb.ulpCommand != CMD_CLOSE_XRI_CN) &&
--	    (!(piocb->vport->load_flag & FC_UNLOADING)))
--		mod_timer(&piocb->vport->els_tmofunc,
--			  jiffies +
--			  msecs_to_jiffies(1000 * (phba->fc_ratov << 1)));
-+	   (piocb->iocb.ulpCommand != CMD_CLOSE_XRI_CN)) {
-+		BUG_ON(!piocb->vport);
-+		if (!(piocb->vport->load_flag & FC_UNLOADING))
-+			mod_timer(&piocb->vport->els_tmofunc,
-+				  jiffies +
-+				  msecs_to_jiffies(1000 * (phba->fc_ratov << 1)));
-+	}
- 
- 	return 0;
- }
-diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
-index e3b30ea..a504e2e0 100644
---- a/drivers/vhost/vsock.c
-+++ b/drivers/vhost/vsock.c
-@@ -506,7 +506,7 @@ static void vhost_vsock_reset_orphans(struct sock *sk)
- 	 * executing.
- 	 */
- 
--	if (!vhost_vsock_get(vsk->local_addr.svm_cid)) {
-+	if (!vhost_vsock_get(vsk->remote_addr.svm_cid)) {
- 		sock_set_flag(sk, SOCK_DONE);
- 		vsk->peer_shutdown = SHUTDOWN_MASK;
- 		sk->sk_state = SS_UNCONNECTED;
-diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
-index df4b3e6..93142bf 100644
---- a/fs/ceph/dir.c
-+++ b/fs/ceph/dir.c
-@@ -1257,26 +1257,30 @@ static int ceph_d_revalidate(struct dentry *dentry, unsigned int flags)
- 			return -ECHILD;
- 
- 		op = ceph_snap(dir) == CEPH_SNAPDIR ?
--			CEPH_MDS_OP_LOOKUPSNAP : CEPH_MDS_OP_LOOKUP;
-+			CEPH_MDS_OP_LOOKUPSNAP : CEPH_MDS_OP_GETATTR;
- 		req = ceph_mdsc_create_request(mdsc, op, USE_ANY_MDS);
- 		if (!IS_ERR(req)) {
- 			req->r_dentry = dget(dentry);
--			req->r_num_caps = 2;
-+			req->r_num_caps = op == CEPH_MDS_OP_GETATTR ? 1 : 2;
- 
- 			mask = CEPH_STAT_CAP_INODE | CEPH_CAP_AUTH_SHARED;
- 			if (ceph_security_xattr_wanted(dir))
- 				mask |= CEPH_CAP_XATTR_SHARED;
- 			req->r_args.getattr.mask = mask;
- 
--			req->r_locked_dir = dir;
- 			err = ceph_mdsc_do_request(mdsc, NULL, req);
--			if (err == 0 || err == -ENOENT) {
--				if (dentry == req->r_dentry) {
--					valid = !d_unhashed(dentry);
--				} else {
--					d_invalidate(req->r_dentry);
--					err = -EAGAIN;
--				}
-+			switch (err) {
-+			case 0:
-+				if (d_really_is_positive(dentry) &&
-+				    d_inode(dentry) == req->r_target_inode)
-+					valid = 1;
-+				break;
-+			case -ENOENT:
-+				if (d_really_is_negative(dentry))
-+					valid = 1;
-+				/* Fallthrough */
-+			default:
-+				break;
- 			}
- 			ceph_mdsc_put_request(req);
- 			dout("d_revalidate %p lookup result=%d\n",
-diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
-index 4ff9251..eb5373a 100644
---- a/fs/fuse/dir.c
-+++ b/fs/fuse/dir.c
-@@ -1709,8 +1709,6 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr)
- 		return -EACCES;
- 
- 	if (attr->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID)) {
--		int kill;
--
- 		attr->ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID |
- 				    ATTR_MODE);
- 		/*
-@@ -1722,12 +1720,11 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr)
- 			return ret;
- 
- 		attr->ia_mode = inode->i_mode;
--		kill = should_remove_suid(entry);
--		if (kill & ATTR_KILL_SUID) {
-+		if (inode->i_mode & S_ISUID) {
- 			attr->ia_valid |= ATTR_MODE;
- 			attr->ia_mode &= ~S_ISUID;
- 		}
--		if (kill & ATTR_KILL_SGID) {
-+		if ((inode->i_mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
- 			attr->ia_valid |= ATTR_MODE;
- 			attr->ia_mode &= ~S_ISGID;
- 		}
-diff --git a/include/linux/cpu.h b/include/linux/cpu.h
-index 797d9c8..c8938eb 100644
---- a/include/linux/cpu.h
-+++ b/include/linux/cpu.h
-@@ -105,22 +105,16 @@ extern bool cpuhp_tasks_frozen;
- 		{ .notifier_call = fn, .priority = pri };	\
- 	__register_cpu_notifier(&fn##_nb);			\
- }
--#else /* #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE) */
--#define cpu_notifier(fn, pri)	do { (void)(fn); } while (0)
--#define __cpu_notifier(fn, pri)	do { (void)(fn); } while (0)
--#endif /* #else #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE) */
- 
--#ifdef CONFIG_HOTPLUG_CPU
- extern int register_cpu_notifier(struct notifier_block *nb);
- extern int __register_cpu_notifier(struct notifier_block *nb);
- extern void unregister_cpu_notifier(struct notifier_block *nb);
- extern void __unregister_cpu_notifier(struct notifier_block *nb);
--#else
- 
--#ifndef MODULE
--extern int register_cpu_notifier(struct notifier_block *nb);
--extern int __register_cpu_notifier(struct notifier_block *nb);
--#else
-+#else /* #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE) */
-+#define cpu_notifier(fn, pri)	do { (void)(fn); } while (0)
-+#define __cpu_notifier(fn, pri)	do { (void)(fn); } while (0)
-+
- static inline int register_cpu_notifier(struct notifier_block *nb)
- {
- 	return 0;
-@@ -130,7 +124,6 @@ static inline int __register_cpu_notifier(struct notifier_block *nb)
- {
- 	return 0;
- }
--#endif
- 
- static inline void unregister_cpu_notifier(struct notifier_block *nb)
- {
-diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h
-index bbfce62..d02d65d 100644
---- a/include/linux/libnvdimm.h
-+++ b/include/linux/libnvdimm.h
-@@ -153,7 +153,7 @@ u32 nd_cmd_in_size(struct nvdimm *nvdimm, int cmd,
- 		const struct nd_cmd_desc *desc, int idx, void *buf);
- u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd,
- 		const struct nd_cmd_desc *desc, int idx, const u32 *in_field,
--		const u32 *out_field);
-+		const u32 *out_field, unsigned long remainder);
- int nvdimm_bus_check_dimm_count(struct nvdimm_bus *nvdimm_bus, int dimm_count);
- struct nd_region *nvdimm_pmem_region_create(struct nvdimm_bus *nvdimm_bus,
- 		struct nd_region_desc *ndr_desc);
-diff --git a/include/uapi/linux/can.h b/include/uapi/linux/can.h
-index 9692cda..c48d93a 100644
---- a/include/uapi/linux/can.h
-+++ b/include/uapi/linux/can.h
-@@ -196,5 +196,6 @@ struct can_filter {
- };
- 
- #define CAN_INV_FILTER 0x20000000U /* to be set in can_filter.can_id */
-+#define CAN_RAW_FILTER_MAX 512 /* maximum number of can_filter set via setsockopt() */
- 
- #endif /* !_UAPI_CAN_H */
-diff --git a/kernel/cpu.c b/kernel/cpu.c
-index 341bf80..73fb59f 100644
---- a/kernel/cpu.c
-+++ b/kernel/cpu.c
-@@ -578,7 +578,6 @@ void __init cpuhp_threads_init(void)
- 	kthread_unpark(this_cpu_read(cpuhp_state.thread));
- }
- 
--#ifdef CONFIG_HOTPLUG_CPU
- EXPORT_SYMBOL(register_cpu_notifier);
- EXPORT_SYMBOL(__register_cpu_notifier);
- void unregister_cpu_notifier(struct notifier_block *nb)
-@@ -595,6 +594,7 @@ void __unregister_cpu_notifier(struct notifier_block *nb)
- }
- EXPORT_SYMBOL(__unregister_cpu_notifier);
- 
-+#ifdef CONFIG_HOTPLUG_CPU
- /**
-  * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU
-  * @cpu: a CPU id
-diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
-index 1ec0f48..2c49d76 100644
---- a/kernel/locking/rtmutex.c
-+++ b/kernel/locking/rtmutex.c
-@@ -65,8 +65,72 @@ static inline void clear_rt_mutex_waiters(struct rt_mutex *lock)
- 
- static void fixup_rt_mutex_waiters(struct rt_mutex *lock)
- {
--	if (!rt_mutex_has_waiters(lock))
--		clear_rt_mutex_waiters(lock);
-+	unsigned long owner, *p = (unsigned long *) &lock->owner;
-+
-+	if (rt_mutex_has_waiters(lock))
-+		return;
-+
-+	/*
-+	 * The rbtree has no waiters enqueued, now make sure that the
-+	 * lock->owner still has the waiters bit set, otherwise the
-+	 * following can happen:
-+	 *
-+	 * CPU 0	CPU 1		CPU2
-+	 * l->owner=T1
-+	 *		rt_mutex_lock(l)
-+	 *		lock(l->lock)
-+	 *		l->owner = T1 | HAS_WAITERS;
-+	 *		enqueue(T2)
-+	 *		boost()
-+	 *		  unlock(l->lock)
-+	 *		block()
-+	 *
-+	 *				rt_mutex_lock(l)
-+	 *				lock(l->lock)
-+	 *				l->owner = T1 | HAS_WAITERS;
-+	 *				enqueue(T3)
-+	 *				boost()
-+	 *				  unlock(l->lock)
-+	 *				block()
-+	 *		signal(->T2)	signal(->T3)
-+	 *		lock(l->lock)
-+	 *		dequeue(T2)
-+	 *		deboost()
-+	 *		  unlock(l->lock)
-+	 *				lock(l->lock)
-+	 *				dequeue(T3)
-+	 *				 ==> wait list is empty
-+	 *				deboost()
-+	 *				 unlock(l->lock)
-+	 *		lock(l->lock)
-+	 *		fixup_rt_mutex_waiters()
-+	 *		  if (wait_list_empty(l) {
-+	 *		    l->owner = owner
-+	 *		    owner = l->owner & ~HAS_WAITERS;
-+	 *		      ==> l->owner = T1
-+	 *		  }
-+	 *				lock(l->lock)
-+	 * rt_mutex_unlock(l)		fixup_rt_mutex_waiters()
-+	 *				  if (wait_list_empty(l) {
-+	 *				    owner = l->owner & ~HAS_WAITERS;
-+	 * cmpxchg(l->owner, T1, NULL)
-+	 *  ===> Success (l->owner = NULL)
-+	 *
-+	 *				    l->owner = owner
-+	 *				      ==> l->owner = T1
-+	 *				  }
-+	 *
-+	 * With the check for the waiter bit in place T3 on CPU2 will not
-+	 * overwrite. All tasks fiddling with the waiters bit are
-+	 * serialized by l->lock, so nothing else can modify the waiters
-+	 * bit. If the bit is set then nothing can change l->owner either
-+	 * so the simple RMW is safe. The cmpxchg() will simply fail if it
-+	 * happens in the middle of the RMW because the waiters bit is
-+	 * still set.
-+	 */
-+	owner = READ_ONCE(*p);
-+	if (owner & RT_MUTEX_HAS_WAITERS)
-+		WRITE_ONCE(*p, owner & ~RT_MUTEX_HAS_WAITERS);
- }
- 
- /*
-diff --git a/kernel/locking/rtmutex_common.h b/kernel/locking/rtmutex_common.h
-index 4f5f83c..e317e1c 100644
---- a/kernel/locking/rtmutex_common.h
-+++ b/kernel/locking/rtmutex_common.h
-@@ -75,8 +75,9 @@ task_top_pi_waiter(struct task_struct *p)
- 
- static inline struct task_struct *rt_mutex_owner(struct rt_mutex *lock)
- {
--	return (struct task_struct *)
--		((unsigned long)lock->owner & ~RT_MUTEX_OWNER_MASKALL);
-+	unsigned long owner = (unsigned long) READ_ONCE(lock->owner);
-+
-+	return (struct task_struct *) (owner & ~RT_MUTEX_OWNER_MASKALL);
- }
- 
- /*
-diff --git a/kernel/sched/auto_group.c b/kernel/sched/auto_group.c
-index a5d966c..418d9b6 100644
---- a/kernel/sched/auto_group.c
-+++ b/kernel/sched/auto_group.c
-@@ -192,6 +192,7 @@ int proc_sched_autogroup_set_nice(struct task_struct *p, int nice)
- {
- 	static unsigned long next = INITIAL_JIFFIES;
- 	struct autogroup *ag;
-+	unsigned long shares;
- 	int err;
- 
- 	if (nice < MIN_NICE || nice > MAX_NICE)
-@@ -210,9 +211,10 @@ int proc_sched_autogroup_set_nice(struct task_struct *p, int nice)
- 
- 	next = HZ / 10 + jiffies;
- 	ag = autogroup_task_get(p);
-+	shares = scale_load(sched_prio_to_weight[nice + 20]);
- 
- 	down_write(&ag->lock);
--	err = sched_group_set_shares(ag->tg, sched_prio_to_weight[nice + 20]);
-+	err = sched_group_set_shares(ag->tg, shares);
- 	if (!err)
- 		ag->nice = nice;
- 	up_write(&ag->lock);
-diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
-index 7e6df7a..67f8fa9 100644
---- a/net/batman-adv/translation-table.c
-+++ b/net/batman-adv/translation-table.c
-@@ -2849,7 +2849,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv,
- 							     &tvlv_tt_data,
- 							     &tt_change,
- 							     &tt_len);
--		if (!tt_len)
-+		if (!tt_len || !tvlv_len)
- 			goto unlock;
- 
- 		/* Copy the last orig_node's OGM buffer */
-@@ -2867,7 +2867,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv,
- 							     &tvlv_tt_data,
- 							     &tt_change,
- 							     &tt_len);
--		if (!tt_len)
-+		if (!tt_len || !tvlv_len)
- 			goto out;
- 
- 		/* fill the rest of the tvlv with the real TT entries */
-diff --git a/net/can/raw.c b/net/can/raw.c
-index 972c187..b075f02 100644
---- a/net/can/raw.c
-+++ b/net/can/raw.c
-@@ -499,6 +499,9 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
- 		if (optlen % sizeof(struct can_filter) != 0)
- 			return -EINVAL;
- 
-+		if (optlen > CAN_RAW_FILTER_MAX * sizeof(struct can_filter))
-+			return -EINVAL;
-+
- 		count = optlen / sizeof(struct can_filter);
- 
- 		if (count > 1) {

diff --git a/4.8.15/4420_grsecurity-3.1-4.8.15-201612151923.patch b/4.8.15/4420_grsecurity-3.1-4.8.15-201612301949.patch
similarity index 99%
rename from 4.8.15/4420_grsecurity-3.1-4.8.15-201612151923.patch
rename to 4.8.15/4420_grsecurity-3.1-4.8.15-201612301949.patch
index f7b8b72..b16a42d 100644
--- a/4.8.15/4420_grsecurity-3.1-4.8.15-201612151923.patch
+++ b/4.8.15/4420_grsecurity-3.1-4.8.15-201612301949.patch
@@ -22150,24 +22150,28 @@ index 6ca9fd6..4c0aa55 100644
   * Vectors 0x30-0x3f are used for ISA interrupts.
   *   round up to the next 16-vector boundary
 diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
-index b77f5ed..3862b91 100644
+index b77f5ed..cbf5ec6 100644
 --- a/arch/x86/include/asm/irqflags.h
 +++ b/arch/x86/include/asm/irqflags.h
-@@ -23,11 +23,13 @@ static inline unsigned long native_save_fl(void)
+@@ -23,11 +23,17 @@ static inline unsigned long native_save_fl(void)
  		     : /* no input */
  		     : "memory");
  
++#if !defined(CONFIG_GRKERNSEC_CONFIG_VIRT_HOST) || !defined(CONFIG_GRKERNSEC_CONFIG_VIRT_VIRTUALBOX)
 +	BUG_ON(flags & X86_EFLAGS_AC);
++#endif
  	return flags;
  }
  
  static inline void native_restore_fl(unsigned long flags)
  {
++#if !defined(CONFIG_GRKERNSEC_CONFIG_VIRT_HOST) || !defined(CONFIG_GRKERNSEC_CONFIG_VIRT_VIRTUALBOX)
 +	BUG_ON(flags & X86_EFLAGS_AC);
++#endif
  	asm volatile("push %0 ; popf"
  		     : /* no output */
  		     :"g" (flags)
-@@ -137,6 +139,11 @@ static inline notrace unsigned long arch_local_irq_save(void)
+@@ -137,6 +143,11 @@ static inline notrace unsigned long arch_local_irq_save(void)
  	swapgs;					\
  	sysretl
  
@@ -120398,7 +120402,7 @@ index fd6be45..6be6542 100644
  
 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
 new file mode 100644
-index 0000000..307ca55
+index 0000000..f1c1ee2
 --- /dev/null
 +++ b/grsecurity/Kconfig
 @@ -0,0 +1,1206 @@
@@ -120600,7 +120604,7 @@ index 0000000..307ca55
 +config GRKERNSEC_HIDESYM
 +	bool "Hide kernel symbols"
 +	default y if GRKERNSEC_CONFIG_AUTO
-+	select PAX_USERCOPY_SLABS
++	select PAX_USERCOPY
 +	help
 +	  If you say Y here, getting information on loaded modules, and
 +	  displaying all kernel symbols through a syscall will be restricted

diff --git a/4.8.15/4426_default_XATTR_PAX_FLAGS.patch b/4.8.15/4426_default_XATTR_PAX_FLAGS.patch
new file mode 100644
index 0000000..f7e97b5
--- /dev/null
+++ b/4.8.15/4426_default_XATTR_PAX_FLAGS.patch
@@ -0,0 +1,36 @@
+diff -Naur linux-4.8.15-hardened-r1.orig/security/Kconfig linux-4.8.15-hardened-r1/security/Kconfig
+--- linux-4.8.15-hardened-r1.orig/security/Kconfig	2017-01-01 12:10:19.638828792 -0500
++++ linux-4.8.15-hardened-r1/security/Kconfig	2017-01-01 12:14:05.434836657 -0500
+@@ -293,7 +293,7 @@
+ 
+ config PAX_PT_PAX_FLAGS
+ 	bool 'Use ELF program header marking'
+-	default y if GRKERNSEC_CONFIG_AUTO
++	default n
+ 	help
+ 	  Enabling this option will allow you to control PaX features on
+ 	  a per executable basis via the 'paxctl' utility available at
+@@ -312,9 +312,12 @@
+ 	  If you enable none of the marking options then all applications
+ 	  will run with PaX enabled on them by default.
+ 
++	  Note for Gentoo: PT_PAX_FLAGS has been deprecated in Gentoo.  Enable
++	  this only for legacy systems.
++
+ config PAX_XATTR_PAX_FLAGS
+ 	bool 'Use filesystem extended attributes marking'
+-	default y if GRKERNSEC_CONFIG_AUTO
++	default y
+ 	select CIFS_XATTR if CIFS
+ 	select EXT2_FS_XATTR if EXT2_FS
+ 	select EXT3_FS_XATTR if EXT3_FS
+@@ -343,6 +346,9 @@
+ 	  If you enable none of the marking options then all applications
+ 	  will run with PaX enabled on them by default.
+ 
++	  Note for Gentoo: XATTR_PAX_FLAGS is now the default in Gentoo.  Do
++	  not disable this unless you know what you're doing.
++
+ choice
+ 	prompt 'MAC system integration'
+ 	default PAX_HAVE_ACL_FLAGS