[gentoo-commits] proj/hardened-patchset:master commit in: 3.2.69/, 3.14.44/, 4.0.5/, 3.14.45/, 4.0.6/

[Anthony G. Basile]

commit:     f48ab9b7eb98c814a6a82fb5203ee7660f67a5dd
Author:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Thu Jun 25 14:49:00 2015 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Thu Jun 25 14:49:00 2015 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-patchset.git/commit/?id=f48ab9b7

Grsec/PaX: 3.1-{3.2.69,3.14.45,4.0.6}-201506232104

 {3.14.44 => 3.14.45}/0000_README                   |   2 +-
 .../4420_grsecurity-3.1-3.14.45-201506232103.patch | 364 ++++++++++-----
 {4.0.5 => 3.14.45}/4425_grsec_remove_EI_PAX.patch  |   0
 .../4427_force_XATTR_PAX_tmpfs.patch               |   0
 .../4430_grsec-remove-localversion-grsec.patch     |   0
 .../4435_grsec-mute-warnings.patch                 |   0
 .../4440_grsec-remove-protected-paths.patch        |   0
 .../4450_grsec-kconfig-default-gids.patch          |   0
 .../4465_selinux-avc_audit-log-curr_ip.patch       |   0
 .../4470_disable-compat_vdso.patch                 |   0
 {4.0.5 => 3.14.45}/4475_emutramp_default_on.patch  |   0
 3.2.69/0000_README                                 |   2 +-
 ... 4420_grsecurity-3.1-3.2.69-201506232100.patch} |  56 ++-
 {4.0.5 => 4.0.6}/0000_README                       |   2 +-
 .../4420_grsecurity-3.1-4.0.6-201506232104.patch   | 491 ++++++++++++++-------
 {3.14.44 => 4.0.6}/4425_grsec_remove_EI_PAX.patch  |   0
 {4.0.5 => 4.0.6}/4427_force_XATTR_PAX_tmpfs.patch  |   0
 .../4430_grsec-remove-localversion-grsec.patch     |   0
 {4.0.5 => 4.0.6}/4435_grsec-mute-warnings.patch    |   0
 .../4440_grsec-remove-protected-paths.patch        |   0
 .../4450_grsec-kconfig-default-gids.patch          |   0
 .../4465_selinux-avc_audit-log-curr_ip.patch       |   0
 {4.0.5 => 4.0.6}/4470_disable-compat_vdso.patch    |   0
 {3.14.44 => 4.0.6}/4475_emutramp_default_on.patch  |   0
 24 files changed, 639 insertions(+), 278 deletions(-)

diff --git a/3.14.44/0000_README b/3.14.45/0000_README
similarity index 96%
rename from 3.14.44/0000_README
rename to 3.14.45/0000_README
index 2105f07..53a1411 100644
--- a/3.14.44/0000_README
+++ b/3.14.45/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.1-3.14.44-201506082249.patch
+Patch:	4420_grsecurity-3.1-3.14.45-201506232103.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/3.14.44/4420_grsecurity-3.1-3.14.44-201506082249.patch b/3.14.45/4420_grsecurity-3.1-3.14.45-201506232103.patch
similarity index 99%
rename from 3.14.44/4420_grsecurity-3.1-3.14.44-201506082249.patch
rename to 3.14.45/4420_grsecurity-3.1-3.14.45-201506232103.patch
index 3556faf..fe15fa1 100644
--- a/3.14.44/4420_grsecurity-3.1-3.14.44-201506082249.patch
+++ b/3.14.45/4420_grsecurity-3.1-3.14.45-201506232103.patch
@@ -295,7 +295,7 @@ index 5d91ba1..ef1d374 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 9f2471c..0adedd5 100644
+index c92186c..a387fb0 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -6940,7 +6940,7 @@ index 44a1f79..2bd6aa3 100644
  
  void __init gt641xx_irq_init(void)
 diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
-index d1fea7a..2e591b0 100644
+index 7479d8d..5c37e62 100644
 --- a/arch/mips/kernel/irq.c
 +++ b/arch/mips/kernel/irq.c
 @@ -77,17 +77,17 @@ void ack_bad_irq(unsigned int irq)
@@ -6964,18 +6964,16 @@ index d1fea7a..2e591b0 100644
  }
  
  void __init init_IRQ(void)
-@@ -110,7 +110,10 @@ void __init init_IRQ(void)
- #endif
+@@ -111,6 +111,8 @@ void __init init_IRQ(void)
  }
  
+ #ifdef CONFIG_DEBUG_STACKOVERFLOW
 +
- #ifdef DEBUG_STACKOVERFLOW
 +extern void gr_handle_kernel_exploit(void);
-+
  static inline void check_stack_overflow(void)
  {
  	unsigned long sp;
-@@ -126,6 +129,7 @@ static inline void check_stack_overflow(void)
+@@ -126,6 +128,7 @@ static inline void check_stack_overflow(void)
  		printk("do_IRQ: stack overflow: %ld\n",
  		       sp - sizeof(struct thread_info));
  		dump_stack();
@@ -18901,7 +18899,7 @@ index cad82c9..2e5c5c1 100644
  
  #endif /* __KERNEL__ */
 diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
-index 6f1c3a8..7744f19 100644
+index bcc9a2f..2d6e37b 100644
 --- a/arch/x86/include/asm/segment.h
 +++ b/arch/x86/include/asm/segment.h
 @@ -64,10 +64,15 @@
@@ -18987,7 +18985,7 @@ index 6f1c3a8..7744f19 100644
  #define __USER_DS	(GDT_ENTRY_DEFAULT_USER_DS*8+3)
  #define __USER_CS	(GDT_ENTRY_DEFAULT_USER_CS*8+3)
  #ifndef CONFIG_PARAVIRT
-@@ -268,7 +287,7 @@ static inline unsigned long get_limit(unsigned long segment)
+@@ -279,7 +298,7 @@ static inline unsigned long get_limit(unsigned long segment)
  {
  	unsigned long __limit;
  	asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
@@ -24558,7 +24556,7 @@ index 1ffc32d..e52c745 100644
  }
  
 diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
-index 85126cc..1bbce17 100644
+index 5fc4ac7..90be4e1 100644
 --- a/arch/x86/kernel/head64.c
 +++ b/arch/x86/kernel/head64.c
 @@ -67,12 +67,12 @@ again:
@@ -24611,7 +24609,7 @@ index 85126cc..1bbce17 100644
  	init_level4_pgt[511] = early_level4_pgt[511];
  
 diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
-index f36bd42..0ab4474 100644
+index 30a2aa3..d62e1dd 100644
 --- a/arch/x86/kernel/head_32.S
 +++ b/arch/x86/kernel/head_32.S
 @@ -26,6 +26,12 @@
@@ -24821,7 +24819,7 @@ index f36bd42..0ab4474 100644
  	movl %eax,%gs
  
  	xorl %eax,%eax			# Clear LDT
-@@ -512,8 +594,11 @@ setup_once:
+@@ -513,8 +595,11 @@ setup_once:
  	 * relocation.  Manually set base address in stack canary
  	 * segment descriptor.
  	 */
@@ -24834,7 +24832,7 @@ index f36bd42..0ab4474 100644
  	movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
  	shrl $16, %ecx
  	movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
-@@ -548,7 +633,7 @@ ENTRY(early_idt_handler)
+@@ -551,7 +636,7 @@ early_idt_handler_common:
  	cmpl $2,(%esp)		# X86_TRAP_NMI
  	je is_nmi		# Ignore NMI
  
@@ -24843,7 +24841,7 @@ index f36bd42..0ab4474 100644
  	je hlt_loop
  	incl %ss:early_recursion_flag
  
-@@ -586,8 +671,8 @@ ENTRY(early_idt_handler)
+@@ -589,8 +674,8 @@ early_idt_handler_common:
  	pushl (20+6*4)(%esp)	/* trapno */
  	pushl $fault_msg
  	call printk
@@ -24853,7 +24851,7 @@ index f36bd42..0ab4474 100644
  hlt_loop:
  	hlt
  	jmp hlt_loop
-@@ -607,8 +692,11 @@ ENDPROC(early_idt_handler)
+@@ -610,8 +695,11 @@ ENDPROC(early_idt_handler_common)
  /* This is the default interrupt "handler" :-) */
  	ALIGN
  ignore_int:
@@ -24866,7 +24864,7 @@ index f36bd42..0ab4474 100644
  	pushl %eax
  	pushl %ecx
  	pushl %edx
-@@ -617,9 +705,6 @@ ignore_int:
+@@ -620,9 +708,6 @@ ignore_int:
  	movl $(__KERNEL_DS),%eax
  	movl %eax,%ds
  	movl %eax,%es
@@ -24876,7 +24874,7 @@ index f36bd42..0ab4474 100644
  	pushl 16(%esp)
  	pushl 24(%esp)
  	pushl 32(%esp)
-@@ -653,29 +738,34 @@ ENTRY(setup_once_ref)
+@@ -656,29 +741,34 @@ ENTRY(setup_once_ref)
  /*
   * BSS section
   */
@@ -24916,7 +24914,7 @@ index f36bd42..0ab4474 100644
  ENTRY(initial_page_table)
  	.long	pa(initial_pg_pmd+PGD_IDENT_ATTR),0	/* low identity map */
  # if KPMDS == 3
-@@ -694,12 +784,20 @@ ENTRY(initial_page_table)
+@@ -697,12 +787,20 @@ ENTRY(initial_page_table)
  #  error "Kernel PMDs should be 1, 2 or 3"
  # endif
  	.align PAGE_SIZE		/* needs to be page-sized too */
@@ -24938,7 +24936,7 @@ index f36bd42..0ab4474 100644
  
  __INITRODATA
  int_msg:
-@@ -727,7 +825,7 @@ fault_msg:
+@@ -730,7 +828,7 @@ fault_msg:
   * segment size, and 32-bit linear address value:
   */
  
@@ -24947,7 +24945,7 @@ index f36bd42..0ab4474 100644
  .globl boot_gdt_descr
  .globl idt_descr
  
-@@ -736,7 +834,7 @@ fault_msg:
+@@ -739,7 +837,7 @@ fault_msg:
  	.word 0				# 32 bit align gdt_desc.address
  boot_gdt_descr:
  	.word __BOOT_DS+7
@@ -24956,7 +24954,7 @@ index f36bd42..0ab4474 100644
  
  	.word 0				# 32-bit align idt_desc.address
  idt_descr:
-@@ -747,7 +845,7 @@ idt_descr:
+@@ -750,7 +848,7 @@ idt_descr:
  	.word 0				# 32 bit align gdt_desc.address
  ENTRY(early_gdt_descr)
  	.word GDT_ENTRIES*8-1
@@ -24965,7 +24963,7 @@ index f36bd42..0ab4474 100644
  
  /*
   * The boot_gdt must mirror the equivalent in setup.S and is
-@@ -756,5 +854,65 @@ ENTRY(early_gdt_descr)
+@@ -759,5 +857,65 @@ ENTRY(early_gdt_descr)
  	.align L1_CACHE_BYTES
  ENTRY(boot_gdt)
  	.fill GDT_ENTRY_BOOT_CS,8,0
@@ -25034,7 +25032,7 @@ index f36bd42..0ab4474 100644
 +	.fill PAGE_SIZE_asm - GDT_SIZE,1,0
 +	.endr
 diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
-index a468c0a..05f3865 100644
+index a2dc0ad..f3f397d 100644
 --- a/arch/x86/kernel/head_64.S
 +++ b/arch/x86/kernel/head_64.S
 @@ -20,6 +20,8 @@
@@ -25143,7 +25141,7 @@ index a468c0a..05f3865 100644
  	.word  0
  	__FINITDATA
  
-@@ -391,7 +427,7 @@ ENTRY(early_idt_handler)
+@@ -393,7 +429,7 @@ early_idt_handler_common:
  	call dump_stack
  #ifdef CONFIG_KALLSYMS	
  	leaq early_idt_ripmsg(%rip),%rdi
@@ -25152,7 +25150,7 @@ index a468c0a..05f3865 100644
  	call __print_symbol
  #endif
  #endif /* EARLY_PRINTK */
-@@ -420,6 +456,7 @@ ENDPROC(early_idt_handler)
+@@ -422,6 +458,7 @@ ENDPROC(early_idt_handler_common)
  early_recursion_flag:
  	.long 0
  
@@ -25160,7 +25158,7 @@ index a468c0a..05f3865 100644
  #ifdef CONFIG_EARLY_PRINTK
  early_idt_msg:
  	.asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
-@@ -447,29 +484,52 @@ NEXT_PAGE(early_level4_pgt)
+@@ -449,29 +486,52 @@ NEXT_PAGE(early_level4_pgt)
  NEXT_PAGE(early_dynamic_pgts)
  	.fill	512*EARLY_DYNAMIC_PAGE_TABLES,8,0
  
@@ -25222,7 +25220,7 @@ index a468c0a..05f3865 100644
  
  NEXT_PAGE(level3_kernel_pgt)
  	.fill	L3_START_KERNEL,8,0
-@@ -477,6 +537,9 @@ NEXT_PAGE(level3_kernel_pgt)
+@@ -479,6 +539,9 @@ NEXT_PAGE(level3_kernel_pgt)
  	.quad	level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
  	.quad	level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
  
@@ -25232,7 +25230,7 @@ index a468c0a..05f3865 100644
  NEXT_PAGE(level2_kernel_pgt)
  	/*
  	 * 512 MB kernel mapping. We spend a full page on this pagetable
-@@ -492,30 +555,68 @@ NEXT_PAGE(level2_kernel_pgt)
+@@ -494,30 +557,68 @@ NEXT_PAGE(level2_kernel_pgt)
  		KERNEL_IMAGE_SIZE/PMD_SIZE)
  
  NEXT_PAGE(level2_fixmap_pgt)
@@ -28855,6 +28853,19 @@ index 453e5fb..214168f 100644
  
  #define APIC_LVT_NUM			6
  /* 14 is the version for Xeon and Pentium 8.4.8*/
+diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h
+index 6a11845..7205173 100644
+--- a/arch/x86/kvm/lapic.h
++++ b/arch/x86/kvm/lapic.h
+@@ -165,7 +165,7 @@ static inline u16 apic_logical_id(struct kvm_apic_map *map, u32 ldr)
+ 
+ static inline bool kvm_apic_has_events(struct kvm_vcpu *vcpu)
+ {
+-	return vcpu->arch.apic->pending_events;
++	return kvm_vcpu_has_lapic(vcpu) && vcpu->arch.apic->pending_events;
+ }
+ 
+ bool kvm_apic_pending_eoi(struct kvm_vcpu *vcpu, int vector);
 diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
 index cba218a..1cc1bed 100644
 --- a/arch/x86/kvm/paging_tmpl.h
@@ -34427,7 +34438,7 @@ index 0149575..f746de8 100644
 +	pax_force_retaddr
  	ret
 diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
-index af2d431..c405730 100644
+index 1fed139..842a14e 100644
 --- a/arch/x86/net/bpf_jit_comp.c
 +++ b/arch/x86/net/bpf_jit_comp.c
 @@ -50,13 +50,102 @@ static inline u8 *emit_code(u8 *ptr, u32 bytes, unsigned int len)
@@ -34661,7 +34672,7 @@ index af2d431..c405730 100644
  		addrs[i] = proglen;
  	}
  	cleanup_addr = proglen; /* epilogue address */
-@@ -285,6 +394,10 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -290,6 +399,10 @@ void bpf_jit_compile(struct sk_filter *fp)
  		for (i = 0; i < flen; i++) {
  			unsigned int K = filter[i].k;
  
@@ -34672,7 +34683,7 @@ index af2d431..c405730 100644
  			switch (filter[i].code) {
  			case BPF_S_ALU_ADD_X: /* A += X; */
  				seen |= SEEN_XREG;
-@@ -317,10 +430,8 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -322,10 +435,8 @@ void bpf_jit_compile(struct sk_filter *fp)
  			case BPF_S_ALU_MUL_K: /* A *= K */
  				if (is_imm8(K))
  					EMIT3(0x6b, 0xc0, K); /* imul imm8,%eax,%eax */
@@ -34685,7 +34696,7 @@ index af2d431..c405730 100644
  				break;
  			case BPF_S_ALU_DIV_X: /* A /= X; */
  				seen |= SEEN_XREG;
-@@ -333,7 +444,7 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -338,7 +449,7 @@ void bpf_jit_compile(struct sk_filter *fp)
  					EMIT_COND_JMP(X86_JE, addrs[pc_ret0 - 1] -
  								(addrs[i] - 4));
  				} else {
@@ -34694,7 +34705,7 @@ index af2d431..c405730 100644
  					CLEAR_A();
  					EMIT1_off32(0xe9, cleanup_addr - (addrs[i] - 4)); /* jmp .+off32 */
  				}
-@@ -364,7 +475,11 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -369,7 +480,11 @@ void bpf_jit_compile(struct sk_filter *fp)
  					break;
  				}
  				EMIT2(0x31, 0xd2);	/* xor %edx,%edx */
@@ -34706,7 +34717,7 @@ index af2d431..c405730 100644
  				EMIT2(0xf7, 0xf1);	/* div %ecx */
  				EMIT2(0x89, 0xd0);	/* mov %edx,%eax */
  				break;
-@@ -372,7 +487,11 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -377,7 +492,11 @@ void bpf_jit_compile(struct sk_filter *fp)
  				if (K == 1)
  					break;
  				EMIT2(0x31, 0xd2);	/* xor %edx,%edx */
@@ -34718,7 +34729,7 @@ index af2d431..c405730 100644
  				EMIT2(0xf7, 0xf1);	/* div %ecx */
  				break;
  			case BPF_S_ALU_AND_X:
-@@ -643,8 +762,7 @@ common_load_ind:		seen |= SEEN_DATAREF | SEEN_XREG;
+@@ -648,8 +767,7 @@ common_load_ind:		seen |= SEEN_DATAREF | SEEN_XREG;
  					if (is_imm8(K)) {
  						EMIT3(0x8d, 0x73, K); /* lea imm8(%rbx), %esi */
  					} else {
@@ -34728,7 +34739,7 @@ index af2d431..c405730 100644
  					}
  				} else {
  					EMIT2(0x89,0xde); /* mov %ebx,%esi */
-@@ -717,7 +835,7 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -722,7 +840,7 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
  				}
  				if (filter[i].jt != 0) {
  					if (filter[i].jf && f_offset)
@@ -34737,7 +34748,7 @@ index af2d431..c405730 100644
  					EMIT_COND_JMP(t_op, t_offset);
  					if (filter[i].jf)
  						EMIT_JMP(f_offset);
-@@ -734,10 +852,12 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -739,10 +857,12 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
  				if (unlikely(proglen + ilen > oldproglen)) {
  					pr_err("bpb_jit_compile fatal error\n");
  					kfree(addrs);
@@ -34751,7 +34762,7 @@ index af2d431..c405730 100644
  			}
  			proglen += ilen;
  			addrs[i] = proglen;
-@@ -770,7 +890,6 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -775,7 +895,6 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
  
  	if (image) {
  		bpf_flush_icache(header, image + proglen);
@@ -34759,7 +34770,7 @@ index af2d431..c405730 100644
  		fp->bpf_func = (void *)image;
  	}
  out:
-@@ -782,10 +901,8 @@ static void bpf_jit_free_deferred(struct work_struct *work)
+@@ -787,10 +906,8 @@ static void bpf_jit_free_deferred(struct work_struct *work)
  {
  	struct sk_filter *fp = container_of(work, struct sk_filter, work);
  	unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
@@ -36762,7 +36773,7 @@ index a0926a6..b2b14b2 100644
  			err = -EFAULT;
  			goto out;
 diff --git a/block/genhd.c b/block/genhd.c
-index a8d586a..d9910b1 100644
+index 9316f5f..16b4af2 100644
 --- a/block/genhd.c
 +++ b/block/genhd.c
 @@ -469,21 +469,24 @@ static char *bdevt_str(dev_t devt, char *buf)
@@ -40615,6 +40626,33 @@ index dcaae4c..80cd4dd 100644
  	.attrs = cpuidle_default_attrs,
  	.name = "cpuidle",
  };
+diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
+index d97a03d..acf64bb 100644
+--- a/drivers/crypto/caam/caamhash.c
++++ b/drivers/crypto/caam/caamhash.c
+@@ -1469,6 +1469,9 @@ static int ahash_init(struct ahash_request *req)
+ 	state->final = ahash_final_no_ctx;
+ 
+ 	state->current_buf = 0;
++	state->buf_dma = 0;
++	state->buflen_0 = 0;
++	state->buflen_1 = 0;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
+index 28486b1..ae6dae8 100644
+--- a/drivers/crypto/caam/caamrng.c
++++ b/drivers/crypto/caam/caamrng.c
+@@ -56,7 +56,7 @@
+ 
+ /* Buffer, its dma address and lock */
+ struct buf_data {
+-	u8 buf[RN_BUF_SIZE];
++	u8 buf[RN_BUF_SIZE] ____cacheline_aligned;
+ 	dma_addr_t addr;
+ 	struct completion filled;
+ 	u32 hw_desc[DESC_JOB_O_LEN];
 diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
 index 12fea3e2..1e28f47 100644
 --- a/drivers/crypto/hifn_795x.c
@@ -42285,7 +42323,7 @@ index 4a85bb6..aaea819 100644
  	if (regcomp
  	    (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
 diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
-index e39026c..b32e98e 100644
+index 129915e..af52907 100644
 --- a/drivers/gpu/drm/radeon/radeon_device.c
 +++ b/drivers/gpu/drm/radeon/radeon_device.c
 @@ -1128,7 +1128,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev)
@@ -53865,7 +53903,7 @@ index 5bfd807..337352af 100644
  
  	dlci->modem_rx = 0;
 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
-index 8ab46ad..b8db1e2 100644
+index 8195190..46537ed 100644
 --- a/drivers/tty/n_tty.c
 +++ b/drivers/tty/n_tty.c
 @@ -115,7 +115,7 @@ struct n_tty_data {
@@ -53877,7 +53915,7 @@ index 8ab46ad..b8db1e2 100644
  	size_t line_start;
  
  	/* protected by output lock */
-@@ -2578,6 +2578,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
+@@ -2589,6 +2589,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
  {
  	*ops = tty_ldisc_N_TTY;
  	ops->owner = NULL;
@@ -66883,7 +66921,7 @@ index f70119f..ab5894d 100644
  	spin_lock_init(&delayed_root->lock);
  	init_waitqueue_head(&delayed_root->wait);
 diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
-index d04db81..96e54f1 100644
+index 92cbfbf..0ca1d83 100644
 --- a/fs/btrfs/super.c
 +++ b/fs/btrfs/super.c
 @@ -268,7 +268,7 @@ void __btrfs_abort_transaction(struct btrfs_trans_handle *trans,
@@ -103186,6 +103224,40 @@ index c6646a5..574b47c 100644
  static void __add_event_to_tracers(struct ftrace_event_call *call);
  
  /* Add an additional event_call dynamically */
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index 8a86319..32ef21b 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1399,19 +1399,27 @@ static int check_preds(struct filter_parse_state *ps)
+ {
+ 	int n_normal_preds = 0, n_logical_preds = 0;
+ 	struct postfix_elt *elt;
++	int cnt = 0;
+ 
+ 	list_for_each_entry(elt, &ps->postfix, list) {
+-		if (elt->op == OP_NONE)
++		if (elt->op == OP_NONE) {
++			cnt++;
+ 			continue;
++		}
+ 
+ 		if (elt->op == OP_AND || elt->op == OP_OR) {
+ 			n_logical_preds++;
++			cnt--;
+ 			continue;
+ 		}
++		// OP_NOT is not supported in this kernel, will get
++		// a reject here when it's backported
++		cnt--;
+ 		n_normal_preds++;
++		WARN_ON_ONCE(cnt < 0);
+ 	}
+ 
+-	if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
++	if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
+ 		parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
+ 		return -EINVAL;
+ 	}
 diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
 index 0b99120..881174f 100644
 --- a/kernel/trace/trace_functions_graph.c
@@ -104074,6 +104146,28 @@ index f07a40d..0a445a7 100644
  		retval = 1;
  	}
  	spin_unlock(&lockref->lock);
+diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h
+index aac5114..a89d041 100644
+--- a/lib/mpi/longlong.h
++++ b/lib/mpi/longlong.h
+@@ -639,7 +639,7 @@ do { \
+ 	**************  MIPS  *****************
+ 	***************************************/
+ #if defined(__mips__) && W_TYPE_SIZE == 32
+-#if __GNUC__ >= 4 && __GNUC_MINOR__ >= 4
++#if (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
+ #define umul_ppmm(w1, w0, u, v)			\
+ do {						\
+ 	UDItype __ll = (UDItype)(u) * (v);	\
+@@ -671,7 +671,7 @@ do {						\
+ 	**************  MIPS/64  **************
+ 	***************************************/
+ #if (defined(__mips) && __mips >= 3) && W_TYPE_SIZE == 64
+-#if __GNUC__ >= 4 && __GNUC_MINOR__ >= 4
++#if (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
+ #define umul_ppmm(w1, w0, u, v) \
+ do {									\
+ 	typedef unsigned int __ll_UTItype __attribute__((mode(TI)));	\
 diff --git a/lib/nlattr.c b/lib/nlattr.c
 index 10ad042d..25b47b5 100644
 --- a/lib/nlattr.c
@@ -110398,7 +110492,7 @@ index a16ed7b..eb44d17 100644
  
  	return err;
 diff --git a/net/core/dev.c b/net/core/dev.c
-index 73abbd7..1bae4ad 100644
+index 1b9e700..047273c 100644
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
 @@ -1695,14 +1695,14 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
@@ -110649,10 +110743,51 @@ index 26dc006..89e838e 100644
  
  	m->msg_iov = iov;
 diff --git a/net/core/neighbour.c b/net/core/neighbour.c
-index 7d95f69..a6065de 100644
+index 7d95f69..1d316b1 100644
 --- a/net/core/neighbour.c
 +++ b/net/core/neighbour.c
-@@ -2824,7 +2824,7 @@ static int proc_unres_qlen(struct ctl_table *ctl, int write,
+@@ -976,6 +976,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
+ 	rc = 0;
+ 	if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
+ 		goto out_unlock_bh;
++	if (neigh->dead)
++		goto out_dead;
+ 
+ 	if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
+ 		if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
+@@ -1032,6 +1034,13 @@ out_unlock_bh:
+ 		write_unlock(&neigh->lock);
+ 	local_bh_enable();
+ 	return rc;
++
++out_dead:
++	if (neigh->nud_state & NUD_STALE)
++		goto out_unlock_bh;
++	write_unlock_bh(&neigh->lock);
++	kfree_skb(skb);
++	return 1;
+ }
+ EXPORT_SYMBOL(__neigh_event_send);
+ 
+@@ -1095,6 +1104,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
+ 	if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
+ 	    (old & (NUD_NOARP | NUD_PERMANENT)))
+ 		goto out;
++	if (neigh->dead)
++		goto out;
+ 
+ 	if (!(new & NUD_VALID)) {
+ 		neigh_del_timer(neigh);
+@@ -1244,6 +1255,8 @@ EXPORT_SYMBOL(neigh_update);
+  */
+ void __neigh_set_probe_once(struct neighbour *neigh)
+ {
++	if (neigh->dead)
++		return;
+ 	neigh->updated = jiffies;
+ 	if (!(neigh->nud_state & NUD_FAILED))
+ 		return;
+@@ -2824,7 +2837,7 @@ static int proc_unres_qlen(struct ctl_table *ctl, int write,
  			   void __user *buffer, size_t *lenp, loff_t *ppos)
  {
  	int size, ret;
@@ -110661,7 +110796,7 @@ index 7d95f69..a6065de 100644
  
  	tmp.extra1 = &zero;
  	tmp.extra2 = &unres_qlen_max;
-@@ -2886,7 +2886,7 @@ static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
+@@ -2886,7 +2899,7 @@ static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
  					   void __user *buffer,
  					   size_t *lenp, loff_t *ppos)
  {
@@ -110670,7 +110805,7 @@ index 7d95f69..a6065de 100644
  	int ret;
  
  	tmp.extra1 = &zero;
-@@ -3058,11 +3058,12 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
+@@ -3058,11 +3071,12 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
  		memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
  		       sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
  	} else {
@@ -112042,7 +112177,7 @@ index 11c8d81..d67116b 100644
  
  static int raw_seq_show(struct seq_file *seq, void *v)
 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index b64330f..31268ca 100644
+index 625615c..b88eefd 100644
 --- a/net/ipv4/route.c
 +++ b/net/ipv4/route.c
 @@ -234,7 +234,7 @@ static const struct seq_operations rt_cache_seq_ops = {
@@ -112095,7 +112230,7 @@ index b64330f..31268ca 100644
  }
  EXPORT_SYMBOL(ip_idents_reserve);
  
-@@ -2632,34 +2632,34 @@ static struct ctl_table ipv4_route_flush_table[] = {
+@@ -2636,34 +2636,34 @@ static struct ctl_table ipv4_route_flush_table[] = {
  		.maxlen		= sizeof(int),
  		.mode		= 0200,
  		.proc_handler	= ipv4_sysctl_rtcache_flush,
@@ -112138,7 +112273,7 @@ index b64330f..31268ca 100644
  err_dup:
  	return -ENOMEM;
  }
-@@ -2682,8 +2682,8 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
+@@ -2686,8 +2686,8 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
  
  static __net_init int rt_genid_init(struct net *net)
  {
@@ -112149,7 +112284,7 @@ index b64330f..31268ca 100644
  	get_random_bytes(&net->ipv4.dev_addr_genid,
  			 sizeof(net->ipv4.dev_addr_genid));
  	return 0;
-@@ -2726,11 +2726,7 @@ int __init ip_rt_init(void)
+@@ -2730,11 +2730,7 @@ int __init ip_rt_init(void)
  {
  	int rc = 0;
  
@@ -112390,7 +112525,7 @@ index e2f8bd0..6c664ad 100644
  	}
  
 diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
-index 7a436c5..84279ef 100644
+index 9128d0a..5ea9226 100644
 --- a/net/ipv4/tcp_minisocks.c
 +++ b/net/ipv4/tcp_minisocks.c
 @@ -27,6 +27,10 @@
@@ -112407,7 +112542,7 @@ index 7a436c5..84279ef 100644
 @@ -298,7 +302,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
  			tw->tw_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
  			tw->tw_tclass = np->tclass;
- 			tw->tw_flowlabel = np->flow_label >> 12;
+ 			tw->tw_flowlabel = be32_to_cpu(np->flow_label & IPV6_FLOWLABEL_MASK);
 -			tw->tw_ipv6only = np->ipv6only;
 +			tw->tw_ipv6only = sk->sk_ipv6only;
  		}
@@ -112468,7 +112603,7 @@ index 64f0354..a81b39d 100644
  				  syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
  		/* Has it gone just too far? */
 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index b25e852..f578c52 100644
+index 21a3a9e..4a9ef62 100644
 --- a/net/ipv4/udp.c
 +++ b/net/ipv4/udp.c
 @@ -87,6 +87,7 @@
@@ -112479,7 +112614,7 @@ index b25e852..f578c52 100644
  #include <linux/socket.h>
  #include <linux/sockios.h>
  #include <linux/igmp.h>
-@@ -113,6 +114,10 @@
+@@ -114,6 +115,10 @@
  #include <net/busy_poll.h>
  #include "udp_impl.h"
  
@@ -112490,7 +112625,7 @@ index b25e852..f578c52 100644
  struct udp_table udp_table __read_mostly;
  EXPORT_SYMBOL(udp_table);
  
-@@ -615,6 +620,9 @@ found:
+@@ -616,6 +621,9 @@ found:
  	return s;
  }
  
@@ -112500,7 +112635,7 @@ index b25e852..f578c52 100644
  /*
   * This routine is called by the ICMP module when it gets some
   * sort of error condition.  If err < 0 then the socket should
-@@ -914,9 +922,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+@@ -915,9 +923,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
  		dport = usin->sin_port;
  		if (dport == 0)
  			return -EINVAL;
@@ -112519,7 +112654,7 @@ index b25e852..f578c52 100644
  		daddr = inet->inet_daddr;
  		dport = inet->inet_dport;
  		/* Open fast path for connected socket.
-@@ -1163,7 +1180,7 @@ static unsigned int first_packet_length(struct sock *sk)
+@@ -1164,7 +1181,7 @@ static unsigned int first_packet_length(struct sock *sk)
  				 IS_UDPLITE(sk));
  		UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
  				 IS_UDPLITE(sk));
@@ -112528,7 +112663,7 @@ index b25e852..f578c52 100644
  		__skb_unlink(skb, rcvq);
  		__skb_queue_tail(&list_kill, skb);
  	}
-@@ -1243,6 +1260,10 @@ try_again:
+@@ -1244,6 +1261,10 @@ try_again:
  	if (!skb)
  		goto out;
  
@@ -112539,7 +112674,7 @@ index b25e852..f578c52 100644
  	ulen = skb->len - sizeof(struct udphdr);
  	copied = len;
  	if (copied > ulen)
-@@ -1276,7 +1297,7 @@ try_again:
+@@ -1277,7 +1298,7 @@ try_again:
  	if (unlikely(err)) {
  		trace_kfree_skb(skb, udp_recvmsg);
  		if (!peeked) {
@@ -112548,20 +112683,7 @@ index b25e852..f578c52 100644
  			UDP_INC_STATS_USER(sock_net(sk),
  					   UDP_MIB_INERRORS, is_udplite);
  		}
-@@ -1317,10 +1338,8 @@ csum_copy_err:
- 	}
- 	unlock_sock_fast(sk, slow);
- 
--	if (noblock)
--		return -EAGAIN;
--
--	/* starting over for a new packet */
-+	/* starting over for a new packet, but check if we need to yield */
-+	cond_resched();
- 	msg->msg_flags &= ~MSG_TRUNC;
- 	goto try_again;
- }
-@@ -1566,7 +1585,7 @@ csum_error:
+@@ -1565,7 +1586,7 @@ csum_error:
  	UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_CSUMERRORS, is_udplite);
  drop:
  	UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
@@ -112570,7 +112692,7 @@ index b25e852..f578c52 100644
  	kfree_skb(skb);
  	return -1;
  }
-@@ -1585,7 +1604,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
+@@ -1584,7 +1605,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
  			skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
  
  		if (!skb1) {
@@ -112579,7 +112701,7 @@ index b25e852..f578c52 100644
  			UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
  					 IS_UDPLITE(sk));
  			UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
-@@ -1786,6 +1805,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -1785,6 +1806,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
  		goto csum_error;
  
  	UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
@@ -112589,7 +112711,7 @@ index b25e852..f578c52 100644
  	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
  
  	/*
-@@ -2354,7 +2376,7 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
+@@ -2364,7 +2388,7 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
  		from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
  		0, sock_i_ino(sp),
  		atomic_read(&sp->sk_refcnt), sp,
@@ -113386,7 +113508,7 @@ index 7f405a1..eabef92 100644
  	struct ctl_table *ipv6_icmp_table;
  	int err;
 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 9d4332d..4292595 100644
+index b50ae29..568a06f 100644
 --- a/net/ipv6/tcp_ipv6.c
 +++ b/net/ipv6/tcp_ipv6.c
 @@ -104,6 +104,10 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
@@ -113445,7 +113567,7 @@ index 9d4332d..4292595 100644
  	}
  
 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index 20b63d2..9f371ac 100644
+index 38625a9..9f371ac 100644
 --- a/net/ipv6/udp.c
 +++ b/net/ipv6/udp.c
 @@ -76,10 +76,13 @@ static unsigned int udp6_ehashfn(struct net *net,
@@ -113481,20 +113603,7 @@ index 20b63d2..9f371ac 100644
  			if (is_udp4)
  				UDP_INC_STATS_USER(sock_net(sk),
  						   UDP_MIB_INERRORS,
-@@ -515,10 +518,8 @@ csum_copy_err:
- 	}
- 	unlock_sock_fast(sk, slow);
- 
--	if (noblock)
--		return -EAGAIN;
--
--	/* starting over for a new packet */
-+	/* starting over for a new packet, but check if we need to yield */
-+	cond_resched();
- 	msg->msg_flags &= ~MSG_TRUNC;
- 	goto try_again;
- }
-@@ -690,7 +691,7 @@ csum_error:
+@@ -688,7 +691,7 @@ csum_error:
  	UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_CSUMERRORS, is_udplite);
  drop:
  	UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
@@ -113503,7 +113612,7 @@ index 20b63d2..9f371ac 100644
  	kfree_skb(skb);
  	return -1;
  }
-@@ -747,7 +748,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
+@@ -745,7 +748,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
  		if (likely(skb1 == NULL))
  			skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
  		if (!skb1) {
@@ -113512,7 +113621,7 @@ index 20b63d2..9f371ac 100644
  			UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
  					  IS_UDPLITE(sk));
  			UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
-@@ -886,6 +887,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -884,6 +887,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
  		goto csum_error;
  
  	UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
@@ -114778,10 +114887,43 @@ index 270b77d..0a9d0981 100644
  	/* Queue all of the segments. */
  	skb = segs;
 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 48b1817..d2c096b 100644
+index 48b1817..3b2192f 100644
 --- a/net/packet/af_packet.c
 +++ b/net/packet/af_packet.c
-@@ -1846,7 +1846,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1264,16 +1264,6 @@ static void packet_sock_destruct(struct sock *sk)
+ 	sk_refcnt_debug_dec(sk);
+ }
+ 
+-static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
+-{
+-	int x = atomic_read(&f->rr_cur) + 1;
+-
+-	if (x >= num)
+-		x = 0;
+-
+-	return x;
+-}
+-
+ static unsigned int fanout_demux_hash(struct packet_fanout *f,
+ 				      struct sk_buff *skb,
+ 				      unsigned int num)
+@@ -1285,13 +1275,9 @@ static unsigned int fanout_demux_lb(struct packet_fanout *f,
+ 				    struct sk_buff *skb,
+ 				    unsigned int num)
+ {
+-	int cur, old;
++	unsigned int val = atomic_inc_return(&f->rr_cur);
+ 
+-	cur = atomic_read(&f->rr_cur);
+-	while ((old = atomic_cmpxchg(&f->rr_cur, cur,
+-				     fanout_rr_next(f, num))) != cur)
+-		cur = old;
+-	return cur;
++	return val % num;
+ }
+ 
+ static unsigned int fanout_demux_cpu(struct packet_fanout *f,
+@@ -1846,7 +1832,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
  
  	spin_lock(&sk->sk_receive_queue.lock);
  	po->stats.stats1.tp_packets++;
@@ -114790,7 +114932,7 @@ index 48b1817..d2c096b 100644
  	__skb_queue_tail(&sk->sk_receive_queue, skb);
  	spin_unlock(&sk->sk_receive_queue.lock);
  	sk->sk_data_ready(sk, skb->len);
-@@ -1855,7 +1855,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1855,7 +1841,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
  drop_n_acct:
  	spin_lock(&sk->sk_receive_queue.lock);
  	po->stats.stats1.tp_drops++;
@@ -114799,7 +114941,7 @@ index 48b1817..d2c096b 100644
  	spin_unlock(&sk->sk_receive_queue.lock);
  
  drop_n_restore:
-@@ -3462,7 +3462,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3462,7 +3448,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
  	case PACKET_HDRLEN:
  		if (len > sizeof(int))
  			len = sizeof(int);
@@ -114808,7 +114950,7 @@ index 48b1817..d2c096b 100644
  			return -EFAULT;
  		switch (val) {
  		case TPACKET_V1:
-@@ -3508,7 +3508,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3508,7 +3494,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
  		len = lv;
  	if (put_user(len, optlen))
  		return -EFAULT;
@@ -116416,7 +116558,7 @@ index 6424372..afd36e9 100644
  	sub->evt.event = htohl(event, sub->swap);
  	sub->evt.found_lower = htohl(found_lower, sub->swap);
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 94404f1..ac544a1 100644
+index 4757f1c..11b32ee 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
 @@ -791,6 +791,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -116465,7 +116607,7 @@ index 94404f1..ac544a1 100644
  	done_path_create(&path, dentry);
  	return err;
  }
-@@ -2243,11 +2262,14 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
+@@ -2251,11 +2270,14 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
  	writable = unix_writable(sk);
  	other = unix_peer_get(sk);
  	if (other) {
@@ -116482,7 +116624,7 @@ index 94404f1..ac544a1 100644
  		sock_put(other);
  	}
  
-@@ -2344,9 +2366,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2352,9 +2374,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  		seq_puts(seq, "Num       RefCount Protocol Flags    Type St "
  			 "Inode Path\n");
  	else {
@@ -116497,7 +116639,7 @@ index 94404f1..ac544a1 100644
  
  		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
  			s,
-@@ -2371,10 +2397,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2379,10 +2405,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  				seq_putc(seq, '@');
  				i++;
  			}
@@ -128115,10 +128257,10 @@ index 0000000..4378111
 +}
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
 new file mode 100644
-index 0000000..038e79d
+index 0000000..51560ee
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,6059 @@
+@@ -0,0 +1,6061 @@
 +intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL
 +ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
 +storvsc_connect_to_vsp_22 storvsc_connect_to_vsp 2 22 NULL
@@ -131510,7 +131652,8 @@ index 0000000..038e79d
 +vxge_config_vpaths_36636 vxge_config_vpaths 0 36636 NULL
 +convert_extent_item_v0_36645 convert_extent_item_v0 4 36645 NULL
 +ced_ioctl_36647 ced_ioctl 2 36647 NULL
-+lpfc_idiag_extacc_alloc_get_36648 lpfc_idiag_extacc_alloc_get 0-3 36648 NULL
++lpfc_idiag_extacc_alloc_get_36648 lpfc_idiag_extacc_alloc_get 0-3 36648 NULL nohasharray
++tty_copy_to_user_36648 tty_copy_to_user 4 36648 &lpfc_idiag_extacc_alloc_get_36648
 +osd_req_list_collection_objects_36664 osd_req_list_collection_objects 5 36664 NULL
 +iscsi_host_alloc_36671 iscsi_host_alloc 2 36671 NULL
 +xillybus_read_36678 xillybus_read 3 36678 NULL
@@ -131577,7 +131720,8 @@ index 0000000..038e79d
 +xfs_iomap_write_allocate_37336 xfs_iomap_write_allocate 0 37336 NULL
 +security_inode_getsecurity_37354 security_inode_getsecurity 0 37354 NULL
 +hci_sock_sendmsg_37420 hci_sock_sendmsg 4 37420 NULL
-+acpi_os_allocate_zeroed_37422 acpi_os_allocate_zeroed 1 37422 NULL
++acpi_os_allocate_zeroed_37422 acpi_os_allocate_zeroed 1 37422 NULL nohasharray
++find_next_bit_37422 find_next_bit 0 37422 &acpi_os_allocate_zeroed_37422
 +tty_insert_flip_string_fixed_flag_37428 tty_insert_flip_string_fixed_flag 4-0 37428 NULL
 +iwl_print_last_event_logs_37433 iwl_print_last_event_logs 0-7-9 37433 NULL
 +fru_alloc_37442 fru_alloc 1 37442 NULL

diff --git a/4.0.5/4425_grsec_remove_EI_PAX.patch b/3.14.45/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 4.0.5/4425_grsec_remove_EI_PAX.patch
rename to 3.14.45/4425_grsec_remove_EI_PAX.patch

diff --git a/3.14.44/4427_force_XATTR_PAX_tmpfs.patch b/3.14.45/4427_force_XATTR_PAX_tmpfs.patch
similarity index 100%
rename from 3.14.44/4427_force_XATTR_PAX_tmpfs.patch
rename to 3.14.45/4427_force_XATTR_PAX_tmpfs.patch

diff --git a/4.0.5/4430_grsec-remove-localversion-grsec.patch b/3.14.45/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 4.0.5/4430_grsec-remove-localversion-grsec.patch
rename to 3.14.45/4430_grsec-remove-localversion-grsec.patch

diff --git a/3.14.44/4435_grsec-mute-warnings.patch b/3.14.45/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 3.14.44/4435_grsec-mute-warnings.patch
rename to 3.14.45/4435_grsec-mute-warnings.patch

diff --git a/4.0.5/4440_grsec-remove-protected-paths.patch b/3.14.45/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 4.0.5/4440_grsec-remove-protected-paths.patch
rename to 3.14.45/4440_grsec-remove-protected-paths.patch

diff --git a/3.14.44/4450_grsec-kconfig-default-gids.patch b/3.14.45/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 3.14.44/4450_grsec-kconfig-default-gids.patch
rename to 3.14.45/4450_grsec-kconfig-default-gids.patch

diff --git a/3.14.44/4465_selinux-avc_audit-log-curr_ip.patch b/3.14.45/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 3.14.44/4465_selinux-avc_audit-log-curr_ip.patch
rename to 3.14.45/4465_selinux-avc_audit-log-curr_ip.patch

diff --git a/3.14.44/4470_disable-compat_vdso.patch b/3.14.45/4470_disable-compat_vdso.patch
similarity index 100%
rename from 3.14.44/4470_disable-compat_vdso.patch
rename to 3.14.45/4470_disable-compat_vdso.patch

diff --git a/4.0.5/4475_emutramp_default_on.patch b/3.14.45/4475_emutramp_default_on.patch
similarity index 100%
rename from 4.0.5/4475_emutramp_default_on.patch
rename to 3.14.45/4475_emutramp_default_on.patch

diff --git a/3.2.69/0000_README b/3.2.69/0000_README
index c5e335b..1521b73 100644
--- a/3.2.69/0000_README
+++ b/3.2.69/0000_README
@@ -194,7 +194,7 @@ Patch:	1068_linux-3.2.69.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.69
 
-Patch:	4420_grsecurity-3.1-3.2.69-201506082246.patch
+Patch:	4420_grsecurity-3.1-3.2.69-201506232100.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/3.2.69/4420_grsecurity-3.1-3.2.69-201506082246.patch b/3.2.69/4420_grsecurity-3.1-3.2.69-201506232100.patch
similarity index 99%
rename from 3.2.69/4420_grsecurity-3.1-3.2.69-201506082246.patch
rename to 3.2.69/4420_grsecurity-3.1-3.2.69-201506232100.patch
index 35a63ac..873b401 100644
--- a/3.2.69/4420_grsecurity-3.1-3.2.69-201506082246.patch
+++ b/3.2.69/4420_grsecurity-3.1-3.2.69-201506232100.patch
@@ -37854,7 +37854,7 @@ index e47e73b..348e0bd 100644
  	 PCI_VEND_DEV(AMD, FE_GATE_700C), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
  	 AMD762},
 diff --git a/drivers/edac/e752x_edac.c b/drivers/edac/e752x_edac.c
-index 1af531a..3a8ff27 100644
+index 1af531a1..3a8ff27 100644
 --- a/drivers/edac/e752x_edac.c
 +++ b/drivers/edac/e752x_edac.c
 @@ -1380,7 +1380,7 @@ static void __devexit e752x_remove_one(struct pci_dev *pdev)
@@ -96019,6 +96019,40 @@ index 875fed4..7a76cbb 100644
  	}
  }
  
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index b0996c1..7e5c12f 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1343,19 +1343,27 @@ static int check_preds(struct filter_parse_state *ps)
+ {
+ 	int n_normal_preds = 0, n_logical_preds = 0;
+ 	struct postfix_elt *elt;
++	int cnt = 0;
+ 
+ 	list_for_each_entry(elt, &ps->postfix, list) {
+-		if (elt->op == OP_NONE)
++		if (elt->op == OP_NONE) {
++			cnt++;
+ 			continue;
++		}
+ 
+ 		if (elt->op == OP_AND || elt->op == OP_OR) {
+ 			n_logical_preds++;
++			cnt--;
+ 			continue;
+ 		}
++		// OP_NOT is not supported in this kernel, will get
++		// a reject here when it's backported
++		cnt--;
+ 		n_normal_preds++;
++		WARN_ON_ONCE(cnt < 0);
+ 	}
+ 
+-	if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
++	if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
+ 		parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
+ 		return -EINVAL;
+ 	}
 diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
 index a7d2a4c..b034c76 100644
 --- a/kernel/trace/trace_functions_graph.c
@@ -104143,7 +104177,7 @@ index 68bbf9f..5ef0d12 100644
  
  	return err;
 diff --git a/net/core/dev.c b/net/core/dev.c
-index 1c0d862..6117f53 100644
+index 1c0d862..d4946e6 100644
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
 @@ -1142,10 +1142,14 @@ void dev_load(struct net *net, const char *name)
@@ -104179,6 +104213,24 @@ index 1c0d862..6117f53 100644
  		kfree_skb(skb);
  		return NET_RX_DROP;
  	}
+@@ -1961,13 +1965,13 @@ struct sk_buff *skb_gso_segment(struct sk_buff *skb, u32 features)
+ 
+ 	if (unlikely(skb->ip_summed != CHECKSUM_PARTIAL)) {
+ 		struct net_device *dev = skb->dev;
+-		struct ethtool_drvinfo info = {};
++		const char *driver = "";
+ 
+-		if (dev && dev->ethtool_ops && dev->ethtool_ops->get_drvinfo)
+-			dev->ethtool_ops->get_drvinfo(dev, &info);
++		if (dev && dev->dev.parent)
++			driver = dev_driver_string(dev->dev.parent);
+ 
+ 		WARN(1, "%s: caps=(0x%lx, 0x%lx) len=%d data_len=%d ip_summed=%d\n",
+-		     info.driver, dev ? dev->features : 0L,
++		     driver, dev ? dev->features : 0L,
+ 		     skb->sk ? skb->sk->sk_route_caps : 0L,
+ 		     skb->len, skb->data_len, skb->ip_summed);
+ 
 @@ -2048,7 +2052,7 @@ static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
  
  struct dev_gso_cb {

diff --git a/4.0.5/0000_README b/4.0.6/0000_README
similarity index 96%
rename from 4.0.5/0000_README
rename to 4.0.6/0000_README
index 0e406e4..62fb720 100644
--- a/4.0.5/0000_README
+++ b/4.0.6/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.1-4.0.5-201506171322.patch
+Patch:	4420_grsecurity-3.1-4.0.6-201506232104.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/4.0.5/4420_grsecurity-3.1-4.0.5-201506171322.patch b/4.0.6/4420_grsecurity-3.1-4.0.6-201506232104.patch
similarity index 99%
rename from 4.0.5/4420_grsecurity-3.1-4.0.5-201506171322.patch
rename to 4.0.6/4420_grsecurity-3.1-4.0.6-201506232104.patch
index 97c48de..91512cb 100644
--- a/4.0.5/4420_grsecurity-3.1-4.0.5-201506171322.patch
+++ b/4.0.6/4420_grsecurity-3.1-4.0.6-201506232104.patch
@@ -373,7 +373,7 @@ index 4d68ec8..9546b75 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 1880cf7..a141b1e 100644
+index af6da04..22820aa 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -298,7 +298,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -6660,7 +6660,7 @@ index 44a1f79..2bd6aa3 100644
  
  void __init gt641xx_irq_init(void)
 diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
-index d2bfbc2..a8eacd2 100644
+index be15e52..a089cc4 100644
 --- a/arch/mips/kernel/irq.c
 +++ b/arch/mips/kernel/irq.c
 @@ -76,17 +76,17 @@ void ack_bad_irq(unsigned int irq)
@@ -6684,18 +6684,16 @@ index d2bfbc2..a8eacd2 100644
  }
  
  void __init init_IRQ(void)
-@@ -109,7 +109,10 @@ void __init init_IRQ(void)
- #endif
+@@ -110,6 +110,8 @@ void __init init_IRQ(void)
  }
  
+ #ifdef CONFIG_DEBUG_STACKOVERFLOW
 +
- #ifdef DEBUG_STACKOVERFLOW
 +extern void gr_handle_kernel_exploit(void);
-+
  static inline void check_stack_overflow(void)
  {
  	unsigned long sp;
-@@ -125,6 +128,7 @@ static inline void check_stack_overflow(void)
+@@ -125,6 +127,7 @@ static inline void check_stack_overflow(void)
  		printk("do_IRQ: stack overflow: %ld\n",
  		       sp - sizeof(struct thread_info));
  		dump_stack();
@@ -7186,7 +7184,7 @@ index 4ce7a01..449202a 100644
  
  #endif /* __ASM_OPENRISC_CACHE_H */
 diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
-index 226f8ca..9d9b87d 100644
+index 226f8ca9..9d9b87d 100644
 --- a/arch/parisc/include/asm/atomic.h
 +++ b/arch/parisc/include/asm/atomic.h
 @@ -273,6 +273,16 @@ static inline long atomic64_dec_if_positive(atomic64_t *v)
@@ -18987,7 +18985,7 @@ index cad82c9..2e5c5c1 100644
  
  #endif /* __KERNEL__ */
 diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
-index db257a5..b91bc77 100644
+index e657b7b..81fefb444 100644
 --- a/arch/x86/include/asm/segment.h
 +++ b/arch/x86/include/asm/segment.h
 @@ -73,10 +73,15 @@
@@ -19073,7 +19071,7 @@ index db257a5..b91bc77 100644
  #define __USER_DS	(GDT_ENTRY_DEFAULT_USER_DS*8+3)
  #define __USER_CS	(GDT_ENTRY_DEFAULT_USER_CS*8+3)
  #ifndef CONFIG_PARAVIRT
-@@ -256,7 +275,7 @@ static inline unsigned long get_limit(unsigned long segment)
+@@ -267,7 +286,7 @@ static inline unsigned long get_limit(unsigned long segment)
  {
  	unsigned long __limit;
  	asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
@@ -24301,7 +24299,7 @@ index 8b7b0a5..2395f29 100644
  
  	/* Make sure it is what we expect it to be */
 diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
-index c4f8d46..2d63ae2 100644
+index b111ab5..3d419ea 100644
 --- a/arch/x86/kernel/head64.c
 +++ b/arch/x86/kernel/head64.c
 @@ -68,12 +68,12 @@ again:
@@ -24354,7 +24352,7 @@ index c4f8d46..2d63ae2 100644
  	init_level4_pgt[511] = early_level4_pgt[511];
  
 diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
-index f36bd42..0ab4474 100644
+index 30a2aa3..d62e1dd 100644
 --- a/arch/x86/kernel/head_32.S
 +++ b/arch/x86/kernel/head_32.S
 @@ -26,6 +26,12 @@
@@ -24564,7 +24562,7 @@ index f36bd42..0ab4474 100644
  	movl %eax,%gs
  
  	xorl %eax,%eax			# Clear LDT
-@@ -512,8 +594,11 @@ setup_once:
+@@ -513,8 +595,11 @@ setup_once:
  	 * relocation.  Manually set base address in stack canary
  	 * segment descriptor.
  	 */
@@ -24577,7 +24575,7 @@ index f36bd42..0ab4474 100644
  	movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
  	shrl $16, %ecx
  	movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
-@@ -548,7 +633,7 @@ ENTRY(early_idt_handler)
+@@ -551,7 +636,7 @@ early_idt_handler_common:
  	cmpl $2,(%esp)		# X86_TRAP_NMI
  	je is_nmi		# Ignore NMI
  
@@ -24586,7 +24584,7 @@ index f36bd42..0ab4474 100644
  	je hlt_loop
  	incl %ss:early_recursion_flag
  
-@@ -586,8 +671,8 @@ ENTRY(early_idt_handler)
+@@ -589,8 +674,8 @@ early_idt_handler_common:
  	pushl (20+6*4)(%esp)	/* trapno */
  	pushl $fault_msg
  	call printk
@@ -24596,7 +24594,7 @@ index f36bd42..0ab4474 100644
  hlt_loop:
  	hlt
  	jmp hlt_loop
-@@ -607,8 +692,11 @@ ENDPROC(early_idt_handler)
+@@ -610,8 +695,11 @@ ENDPROC(early_idt_handler_common)
  /* This is the default interrupt "handler" :-) */
  	ALIGN
  ignore_int:
@@ -24609,7 +24607,7 @@ index f36bd42..0ab4474 100644
  	pushl %eax
  	pushl %ecx
  	pushl %edx
-@@ -617,9 +705,6 @@ ignore_int:
+@@ -620,9 +708,6 @@ ignore_int:
  	movl $(__KERNEL_DS),%eax
  	movl %eax,%ds
  	movl %eax,%es
@@ -24619,7 +24617,7 @@ index f36bd42..0ab4474 100644
  	pushl 16(%esp)
  	pushl 24(%esp)
  	pushl 32(%esp)
-@@ -653,29 +738,34 @@ ENTRY(setup_once_ref)
+@@ -656,29 +741,34 @@ ENTRY(setup_once_ref)
  /*
   * BSS section
   */
@@ -24659,7 +24657,7 @@ index f36bd42..0ab4474 100644
  ENTRY(initial_page_table)
  	.long	pa(initial_pg_pmd+PGD_IDENT_ATTR),0	/* low identity map */
  # if KPMDS == 3
-@@ -694,12 +784,20 @@ ENTRY(initial_page_table)
+@@ -697,12 +787,20 @@ ENTRY(initial_page_table)
  #  error "Kernel PMDs should be 1, 2 or 3"
  # endif
  	.align PAGE_SIZE		/* needs to be page-sized too */
@@ -24681,7 +24679,7 @@ index f36bd42..0ab4474 100644
  
  __INITRODATA
  int_msg:
-@@ -727,7 +825,7 @@ fault_msg:
+@@ -730,7 +828,7 @@ fault_msg:
   * segment size, and 32-bit linear address value:
   */
  
@@ -24690,7 +24688,7 @@ index f36bd42..0ab4474 100644
  .globl boot_gdt_descr
  .globl idt_descr
  
-@@ -736,7 +834,7 @@ fault_msg:
+@@ -739,7 +837,7 @@ fault_msg:
  	.word 0				# 32 bit align gdt_desc.address
  boot_gdt_descr:
  	.word __BOOT_DS+7
@@ -24699,7 +24697,7 @@ index f36bd42..0ab4474 100644
  
  	.word 0				# 32-bit align idt_desc.address
  idt_descr:
-@@ -747,7 +845,7 @@ idt_descr:
+@@ -750,7 +848,7 @@ idt_descr:
  	.word 0				# 32 bit align gdt_desc.address
  ENTRY(early_gdt_descr)
  	.word GDT_ENTRIES*8-1
@@ -24708,7 +24706,7 @@ index f36bd42..0ab4474 100644
  
  /*
   * The boot_gdt must mirror the equivalent in setup.S and is
-@@ -756,5 +854,65 @@ ENTRY(early_gdt_descr)
+@@ -759,5 +857,65 @@ ENTRY(early_gdt_descr)
  	.align L1_CACHE_BYTES
  ENTRY(boot_gdt)
  	.fill GDT_ENTRY_BOOT_CS,8,0
@@ -24777,7 +24775,7 @@ index f36bd42..0ab4474 100644
 +	.fill PAGE_SIZE_asm - GDT_SIZE,1,0
 +	.endr
 diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
-index 6fd514d9..320367e 100644
+index f8a8406..ad6d014 100644
 --- a/arch/x86/kernel/head_64.S
 +++ b/arch/x86/kernel/head_64.S
 @@ -20,6 +20,8 @@
@@ -24886,7 +24884,7 @@ index 6fd514d9..320367e 100644
  	.word  0
  	__FINITDATA
  
-@@ -391,7 +427,7 @@ ENTRY(early_idt_handler)
+@@ -393,7 +429,7 @@ early_idt_handler_common:
  	call dump_stack
  #ifdef CONFIG_KALLSYMS	
  	leaq early_idt_ripmsg(%rip),%rdi
@@ -24895,7 +24893,7 @@ index 6fd514d9..320367e 100644
  	call __print_symbol
  #endif
  #endif /* EARLY_PRINTK */
-@@ -420,6 +456,7 @@ ENDPROC(early_idt_handler)
+@@ -422,6 +458,7 @@ ENDPROC(early_idt_handler_common)
  early_recursion_flag:
  	.long 0
  
@@ -24903,7 +24901,7 @@ index 6fd514d9..320367e 100644
  #ifdef CONFIG_EARLY_PRINTK
  early_idt_msg:
  	.asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
-@@ -447,29 +484,52 @@ NEXT_PAGE(early_level4_pgt)
+@@ -449,29 +486,52 @@ NEXT_PAGE(early_level4_pgt)
  NEXT_PAGE(early_dynamic_pgts)
  	.fill	512*EARLY_DYNAMIC_PAGE_TABLES,8,0
  
@@ -24965,7 +24963,7 @@ index 6fd514d9..320367e 100644
  
  NEXT_PAGE(level3_kernel_pgt)
  	.fill	L3_START_KERNEL,8,0
-@@ -477,6 +537,9 @@ NEXT_PAGE(level3_kernel_pgt)
+@@ -479,6 +539,9 @@ NEXT_PAGE(level3_kernel_pgt)
  	.quad	level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
  	.quad	level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
  
@@ -24975,7 +24973,7 @@ index 6fd514d9..320367e 100644
  NEXT_PAGE(level2_kernel_pgt)
  	/*
  	 * 512 MB kernel mapping. We spend a full page on this pagetable
-@@ -492,23 +555,61 @@ NEXT_PAGE(level2_kernel_pgt)
+@@ -494,23 +557,61 @@ NEXT_PAGE(level2_kernel_pgt)
  		KERNEL_IMAGE_SIZE/PMD_SIZE)
  
  NEXT_PAGE(level2_fixmap_pgt)
@@ -25043,7 +25041,7 @@ index 6fd514d9..320367e 100644
  
  ENTRY(phys_base)
  	/* This must match the first entry in level2_kernel_pgt */
-@@ -532,8 +633,8 @@ NEXT_PAGE(kasan_zero_pud)
+@@ -534,8 +635,8 @@ NEXT_PAGE(kasan_zero_pud)
  
  
  #include "../../x86/xen/xen-head.S"
@@ -28723,7 +28721,7 @@ index 106c015..2db7161 100644
  		0, 0, 0, /* CR3 checked later */
  		CR4_RESERVED_BITS,
 diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
-index 4ee827d..a14eff9 100644
+index 4ee827d..83c8e31 100644
 --- a/arch/x86/kvm/lapic.c
 +++ b/arch/x86/kvm/lapic.c
 @@ -56,7 +56,7 @@
@@ -28735,6 +28733,85 @@ index 4ee827d..a14eff9 100644
  
  #define APIC_LVT_NUM			6
  /* 14 is the version for Xeon and Pentium 8.4.8*/
+@@ -1064,6 +1064,17 @@ static void update_divide_count(struct kvm_lapic *apic)
+ 				   apic->divide_count);
+ }
+ 
++static void apic_update_lvtt(struct kvm_lapic *apic)
++{
++	u32 timer_mode = kvm_apic_get_reg(apic, APIC_LVTT) &
++			apic->lapic_timer.timer_mode_mask;
++
++	if (apic->lapic_timer.timer_mode != timer_mode) {
++		apic->lapic_timer.timer_mode = timer_mode;
++		hrtimer_cancel(&apic->lapic_timer.timer);
++	}
++}
++
+ static void apic_timer_expired(struct kvm_lapic *apic)
+ {
+ 	struct kvm_vcpu *vcpu = apic->vcpu;
+@@ -1272,6 +1283,7 @@ static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
+ 				apic_set_reg(apic, APIC_LVTT + 0x10 * i,
+ 					     lvt_val | APIC_LVT_MASKED);
+ 			}
++			apic_update_lvtt(apic);
+ 			atomic_set(&apic->lapic_timer.pending, 0);
+ 
+ 		}
+@@ -1304,20 +1316,13 @@ static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
+ 
+ 		break;
+ 
+-	case APIC_LVTT: {
+-		u32 timer_mode = val & apic->lapic_timer.timer_mode_mask;
+-
+-		if (apic->lapic_timer.timer_mode != timer_mode) {
+-			apic->lapic_timer.timer_mode = timer_mode;
+-			hrtimer_cancel(&apic->lapic_timer.timer);
+-		}
+-
++	case APIC_LVTT:
+ 		if (!kvm_apic_sw_enabled(apic))
+ 			val |= APIC_LVT_MASKED;
+ 		val &= (apic_lvt_mask[0] | apic->lapic_timer.timer_mode_mask);
+ 		apic_set_reg(apic, APIC_LVTT, val);
++		apic_update_lvtt(apic);
+ 		break;
+-	}
+ 
+ 	case APIC_TMICT:
+ 		if (apic_lvtt_tscdeadline(apic))
+@@ -1552,7 +1557,7 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu)
+ 
+ 	for (i = 0; i < APIC_LVT_NUM; i++)
+ 		apic_set_reg(apic, APIC_LVTT + 0x10 * i, APIC_LVT_MASKED);
+-	apic->lapic_timer.timer_mode = 0;
++	apic_update_lvtt(apic);
+ 	apic_set_reg(apic, APIC_LVT0,
+ 		     SET_APIC_DELIVERY_MODE(0, APIC_MODE_EXTINT));
+ 
+@@ -1778,6 +1783,7 @@ void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu,
+ 
+ 	apic_update_ppr(apic);
+ 	hrtimer_cancel(&apic->lapic_timer.timer);
++	apic_update_lvtt(apic);
+ 	update_divide_count(apic);
+ 	start_apic_timer(apic);
+ 	apic->irr_pending = true;
+diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h
+index 0bc6c65..ca4f92d 100644
+--- a/arch/x86/kvm/lapic.h
++++ b/arch/x86/kvm/lapic.h
+@@ -165,7 +165,7 @@ static inline u16 apic_logical_id(struct kvm_apic_map *map, u32 ldr)
+ 
+ static inline bool kvm_apic_has_events(struct kvm_vcpu *vcpu)
+ {
+-	return vcpu->arch.apic->pending_events;
++	return kvm_vcpu_has_lapic(vcpu) && vcpu->arch.apic->pending_events;
+ }
+ 
+ bool kvm_apic_pending_eoi(struct kvm_vcpu *vcpu, int vector);
 diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
 index 6e6d115..43fecbf 100644
 --- a/arch/x86/kvm/paging_tmpl.h
@@ -34270,7 +34347,7 @@ index 6440221..f84b5c7 100644
 +	pax_force_retaddr
  	ret
 diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
-index 9875143..36776ae 100644
+index ddeff48..877ead6 100644
 --- a/arch/x86/net/bpf_jit_comp.c
 +++ b/arch/x86/net/bpf_jit_comp.c
 @@ -13,7 +13,11 @@
@@ -34295,49 +34372,7 @@ index 9875143..36776ae 100644
  }
  
  struct jit_context {
-@@ -559,6 +565,13 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
- 				if (is_ereg(dst_reg))
- 					EMIT1(0x41);
- 				EMIT3(0xC1, add_1reg(0xC8, dst_reg), 8);
-+
-+				/* emit 'movzwl eax, ax' */
-+				if (is_ereg(dst_reg))
-+					EMIT3(0x45, 0x0F, 0xB7);
-+				else
-+					EMIT2(0x0F, 0xB7);
-+				EMIT1(add_2reg(0xC0, dst_reg, dst_reg));
- 				break;
- 			case 32:
- 				/* emit 'bswap eax' to swap lower 4 bytes */
-@@ -577,6 +590,27 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
- 			break;
- 
- 		case BPF_ALU | BPF_END | BPF_FROM_LE:
-+			switch (imm32) {
-+			case 16:
-+				/* emit 'movzwl eax, ax' to zero extend 16-bit
-+				 * into 64 bit
-+				 */
-+				if (is_ereg(dst_reg))
-+					EMIT3(0x45, 0x0F, 0xB7);
-+				else
-+					EMIT2(0x0F, 0xB7);
-+				EMIT1(add_2reg(0xC0, dst_reg, dst_reg));
-+				break;
-+			case 32:
-+				/* emit 'mov eax, eax' to clear upper 32-bits */
-+				if (is_ereg(dst_reg))
-+					EMIT1(0x45);
-+				EMIT2(0x89, add_2reg(0xC0, dst_reg, dst_reg));
-+				break;
-+			case 64:
-+				/* nop */
-+				break;
-+			}
- 			break;
- 
- 			/* ST: *(u8*)(dst_reg + off) = imm */
-@@ -896,7 +930,9 @@ common_load:
+@@ -924,7 +930,9 @@ common_load:
  				pr_err("bpf_jit_compile fatal error\n");
  				return -EFAULT;
  			}
@@ -34347,7 +34382,7 @@ index 9875143..36776ae 100644
  		}
  		proglen += ilen;
  		addrs[i] = proglen;
-@@ -968,7 +1004,6 @@ void bpf_int_jit_compile(struct bpf_prog *prog)
+@@ -1001,7 +1009,6 @@ void bpf_int_jit_compile(struct bpf_prog *prog)
  
  	if (image) {
  		bpf_flush_icache(header, image + proglen);
@@ -34355,7 +34390,7 @@ index 9875143..36776ae 100644
  		prog->bpf_func = (void *)image;
  		prog->jited = true;
  	}
-@@ -981,12 +1016,8 @@ void bpf_jit_free(struct bpf_prog *fp)
+@@ -1014,12 +1021,8 @@ void bpf_jit_free(struct bpf_prog *fp)
  	unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
  	struct bpf_binary_header *header = (void *)addr;
  
@@ -35633,7 +35668,7 @@ index 80ffa5b..a33bd15 100644
  
  	return 0;
 diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
-index 7b9be98..39bb57f 100644
+index 8533c96..ff98c52 100644
 --- a/arch/x86/vdso/Makefile
 +++ b/arch/x86/vdso/Makefile
 @@ -175,7 +175,7 @@ quiet_cmd_vdso = VDSO    $@
@@ -36263,7 +36298,7 @@ index f678c73..f35aa18 100644
  			err = -EFAULT;
  			goto out;
 diff --git a/block/genhd.c b/block/genhd.c
-index 0a536dc..b8f7aca 100644
+index ea982ea..86e0f9e 100644
 --- a/block/genhd.c
 +++ b/block/genhd.c
 @@ -469,21 +469,24 @@ static char *bdevt_str(dev_t devt, char *buf)
@@ -40163,6 +40198,32 @@ index 832a2c3..1794080 100644
  	.attrs = cpuidle_default_attrs,
  	.name = "cpuidle",
  };
+diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
+index f347ab7..08b0da2 100644
+--- a/drivers/crypto/caam/caamhash.c
++++ b/drivers/crypto/caam/caamhash.c
+@@ -1543,6 +1543,8 @@ static int ahash_init(struct ahash_request *req)
+ 
+ 	state->current_buf = 0;
+ 	state->buf_dma = 0;
++	state->buflen_0 = 0;
++	state->buflen_1 = 0;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
+index ae31e55..a48dc25 100644
+--- a/drivers/crypto/caam/caamrng.c
++++ b/drivers/crypto/caam/caamrng.c
+@@ -56,7 +56,7 @@
+ 
+ /* Buffer, its dma address and lock */
+ struct buf_data {
+-	u8 buf[RN_BUF_SIZE];
++	u8 buf[RN_BUF_SIZE] ____cacheline_aligned;
+ 	dma_addr_t addr;
+ 	struct completion filled;
+ 	u32 hw_desc[DESC_JOB_O_LEN];
 diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
 index 8d2a772..33826c9 100644
 --- a/drivers/crypto/hifn_795x.c
@@ -41973,7 +42034,7 @@ index b928c17..e5d9400 100644
  	if (regcomp
  	    (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
 diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
-index bd7519f..e1c2cd95 100644
+index aa232fd..7e5f6e1 100644
 --- a/drivers/gpu/drm/radeon/radeon_device.c
 +++ b/drivers/gpu/drm/radeon/radeon_device.c
 @@ -1247,7 +1247,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev)
@@ -45671,7 +45732,7 @@ index 9b4e30a..83c927d 100644
  
  void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
 diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 907534b..8b3554e 100644
+index b7bf8ee..ee17152 100644
 --- a/drivers/md/md.c
 +++ b/drivers/md/md.c
 @@ -191,10 +191,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev);
@@ -45743,7 +45804,7 @@ index 907534b..8b3554e 100644
  
  	INIT_LIST_HEAD(&rdev->same_set);
  	init_waitqueue_head(&rdev->blocked_wait);
-@@ -7085,7 +7085,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
+@@ -7086,7 +7086,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
  
  		spin_unlock(&pers_lock);
  		seq_printf(seq, "\n");
@@ -45752,7 +45813,7 @@ index 907534b..8b3554e 100644
  		return 0;
  	}
  	if (v == (void*)2) {
-@@ -7188,7 +7188,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
+@@ -7189,7 +7189,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
  		return error;
  
  	seq = file->private_data;
@@ -45761,7 +45822,7 @@ index 907534b..8b3554e 100644
  	return error;
  }
  
-@@ -7205,7 +7205,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
+@@ -7206,7 +7206,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
  	/* always allow read */
  	mask = POLLIN | POLLRDNORM;
  
@@ -45770,7 +45831,7 @@ index 907534b..8b3554e 100644
  		mask |= POLLERR | POLLPRI;
  	return mask;
  }
-@@ -7252,7 +7252,7 @@ static int is_mddev_idle(struct mddev *mddev, int init)
+@@ -7253,7 +7253,7 @@ static int is_mddev_idle(struct mddev *mddev, int init)
  		struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
  		curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
  			      (int)part_stat_read(&disk->part0, sectors[1]) -
@@ -49007,7 +49068,7 @@ index badff18..e15c4ec 100644
  	break;
      }
 diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
-index e6b790f..051ba2d 100644
+index 893753f..3b5d790 100644
 --- a/drivers/net/ethernet/emulex/benet/be_main.c
 +++ b/drivers/net/ethernet/emulex/benet/be_main.c
 @@ -536,7 +536,7 @@ static void accumulate_16bit_val(u32 *acc, u16 val)
@@ -54305,7 +54366,7 @@ index bce16e4..1120a85 100644
  
  	dlci->modem_rx = 0;
 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
-index cc57a3a..b39622b 100644
+index eee40b5..796fb03 100644
 --- a/drivers/tty/n_tty.c
 +++ b/drivers/tty/n_tty.c
 @@ -116,7 +116,7 @@ struct n_tty_data {
@@ -54317,7 +54378,7 @@ index cc57a3a..b39622b 100644
  	size_t line_start;
  
  	/* protected by output lock */
-@@ -2561,6 +2561,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
+@@ -2572,6 +2572,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
  {
  	*ops = tty_ldisc_N_TTY;
  	ops->owner = NULL;
@@ -66081,10 +66142,10 @@ index 8a1d38e..300a14e 100644
  			     &data);
  	if (!inode) {
 diff --git a/fs/aio.c b/fs/aio.c
-index a793f70..46f45af 100644
+index a1736e9..c80a8ac 100644
 --- a/fs/aio.c
 +++ b/fs/aio.c
-@@ -404,7 +404,7 @@ static int aio_setup_ring(struct kioctx *ctx)
+@@ -409,7 +409,7 @@ static int aio_setup_ring(struct kioctx *ctx)
  	size += sizeof(struct io_event) * nr_events;
  
  	nr_pages = PFN_UP(size);
@@ -67264,7 +67325,7 @@ index f70119f..ab5894d 100644
  	spin_lock_init(&delayed_root->lock);
  	init_waitqueue_head(&delayed_root->wait);
 diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
-index 05fef19..f3774b8 100644
+index e477ed6..480c0db 100644
 --- a/fs/btrfs/super.c
 +++ b/fs/btrfs/super.c
 @@ -271,7 +271,7 @@ void __btrfs_abort_transaction(struct btrfs_trans_handle *trans,
@@ -94712,7 +94773,7 @@ index 0f712c0..cd762c4 100644
  		return;
  	}
 diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
-index 5976bde..3a81660 100644
+index 9fe865c..43735aa 100644
 --- a/include/net/inet_connection_sock.h
 +++ b/include/net/inet_connection_sock.h
 @@ -63,7 +63,7 @@ struct inet_connection_sock_af_ops {
@@ -101387,7 +101448,7 @@ index f4da2cb..e44587b 100644
  #else
  static void register_sched_domain_sysctl(void)
 diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
-index 241213b..6a64c91 100644
+index 486d00c..62f3f6e 100644
 --- a/kernel/sched/fair.c
 +++ b/kernel/sched/fair.c
 @@ -2092,7 +2092,7 @@ void task_numa_fault(int last_cpupid, int mem_node, int pages, int flags)
@@ -102956,6 +103017,39 @@ index a9c10a3..1864f6b 100644
  static void __add_event_to_tracers(struct ftrace_event_call *call);
  
  /* Add an additional event_call dynamically */
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index ced69da..7f2e97c 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1369,19 +1369,26 @@ static int check_preds(struct filter_parse_state *ps)
+ {
+ 	int n_normal_preds = 0, n_logical_preds = 0;
+ 	struct postfix_elt *elt;
++	int cnt = 0;
+ 
+ 	list_for_each_entry(elt, &ps->postfix, list) {
+-		if (elt->op == OP_NONE)
++		if (elt->op == OP_NONE) {
++			cnt++;
+ 			continue;
++		}
+ 
+ 		if (elt->op == OP_AND || elt->op == OP_OR) {
+ 			n_logical_preds++;
++			cnt--;
+ 			continue;
+ 		}
++		if (elt->op != OP_NOT)
++			cnt--;
+ 		n_normal_preds++;
++		WARN_ON_ONCE(cnt < 0);
+ 	}
+ 
+-	if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
++	if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
+ 		parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
+ 		return -EINVAL;
+ 	}
 diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
 index b6fce36..d9f11a3 100644
 --- a/kernel/trace/trace_functions_graph.c
@@ -103826,6 +103920,28 @@ index ecb9a66..a044fc5 100644
  		retval = 1;
  	}
  	spin_unlock(&lockref->lock);
+diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h
+index aac5114..a89d041 100644
+--- a/lib/mpi/longlong.h
++++ b/lib/mpi/longlong.h
+@@ -639,7 +639,7 @@ do { \
+ 	**************  MIPS  *****************
+ 	***************************************/
+ #if defined(__mips__) && W_TYPE_SIZE == 32
+-#if __GNUC__ >= 4 && __GNUC_MINOR__ >= 4
++#if (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
+ #define umul_ppmm(w1, w0, u, v)			\
+ do {						\
+ 	UDItype __ll = (UDItype)(u) * (v);	\
+@@ -671,7 +671,7 @@ do {						\
+ 	**************  MIPS/64  **************
+ 	***************************************/
+ #if (defined(__mips) && __mips >= 3) && W_TYPE_SIZE == 64
+-#if __GNUC__ >= 4 && __GNUC_MINOR__ >= 4
++#if (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
+ #define umul_ppmm(w1, w0, u, v) \
+ do {									\
+ 	typedef unsigned int __ll_UTItype __attribute__((mode(TI)));	\
 diff --git a/lib/nlattr.c b/lib/nlattr.c
 index f5907d2..36072be 100644
 --- a/lib/nlattr.c
@@ -104173,7 +104289,7 @@ index 957d3da..1d34e20 100644
  	depends on !KMEMCHECK
  	select PAGE_EXTENSION
 diff --git a/mm/backing-dev.c b/mm/backing-dev.c
-index 6dc4580..e031ec1 100644
+index 000e7b3..aad2605 100644
 --- a/mm/backing-dev.c
 +++ b/mm/backing-dev.c
 @@ -12,7 +12,7 @@
@@ -104185,7 +104301,7 @@ index 6dc4580..e031ec1 100644
  
  struct backing_dev_info noop_backing_dev_info = {
  	.name		= "noop",
-@@ -474,7 +474,7 @@ int bdi_setup_and_register(struct backing_dev_info *bdi, char *name)
+@@ -458,7 +458,7 @@ int bdi_setup_and_register(struct backing_dev_info *bdi, char *name)
  		return err;
  
  	err = bdi_register(bdi, NULL, "%.28s-%ld", name,
@@ -107141,7 +107257,7 @@ index 2dc44b1..caa1819 100644
  out:
  	if (ret & ~PAGE_MASK)
 diff --git a/mm/nommu.c b/mm/nommu.c
-index 3fba2dc..fdad748 100644
+index 3fba2dc9..fdad748 100644
 --- a/mm/nommu.c
 +++ b/mm/nommu.c
 @@ -72,7 +72,6 @@ int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
@@ -110160,7 +110276,7 @@ index df493d6..1145766 100644
  
  	return err;
 diff --git a/net/core/dev.c b/net/core/dev.c
-index 22a53ac..1d19af7 100644
+index e977e15..74b19b0 100644
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
 @@ -1681,14 +1681,14 @@ int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
@@ -110322,10 +110438,51 @@ index 1033725..340f65d 100644
  			fle->object = flo;
  		else
 diff --git a/net/core/neighbour.c b/net/core/neighbour.c
-index 70fe9e1..926784c 100644
+index 70fe9e1..c55e69d 100644
 --- a/net/core/neighbour.c
 +++ b/net/core/neighbour.c
-@@ -2806,7 +2806,7 @@ static int proc_unres_qlen(struct ctl_table *ctl, int write,
+@@ -971,6 +971,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
+ 	rc = 0;
+ 	if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
+ 		goto out_unlock_bh;
++	if (neigh->dead)
++		goto out_dead;
+ 
+ 	if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
+ 		if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
+@@ -1027,6 +1029,13 @@ out_unlock_bh:
+ 		write_unlock(&neigh->lock);
+ 	local_bh_enable();
+ 	return rc;
++
++out_dead:
++	if (neigh->nud_state & NUD_STALE)
++		goto out_unlock_bh;
++	write_unlock_bh(&neigh->lock);
++	kfree_skb(skb);
++	return 1;
+ }
+ EXPORT_SYMBOL(__neigh_event_send);
+ 
+@@ -1090,6 +1099,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
+ 	if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
+ 	    (old & (NUD_NOARP | NUD_PERMANENT)))
+ 		goto out;
++	if (neigh->dead)
++		goto out;
+ 
+ 	if (!(new & NUD_VALID)) {
+ 		neigh_del_timer(neigh);
+@@ -1239,6 +1250,8 @@ EXPORT_SYMBOL(neigh_update);
+  */
+ void __neigh_set_probe_once(struct neighbour *neigh)
+ {
++	if (neigh->dead)
++		return;
+ 	neigh->updated = jiffies;
+ 	if (!(neigh->nud_state & NUD_FAILED))
+ 		return;
+@@ -2806,7 +2819,7 @@ static int proc_unres_qlen(struct ctl_table *ctl, int write,
  			   void __user *buffer, size_t *lenp, loff_t *ppos)
  {
  	int size, ret;
@@ -110334,7 +110491,7 @@ index 70fe9e1..926784c 100644
  
  	tmp.extra1 = &zero;
  	tmp.extra2 = &unres_qlen_max;
-@@ -2868,7 +2868,7 @@ static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
+@@ -2868,7 +2881,7 @@ static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
  					   void __user *buffer,
  					   size_t *lenp, loff_t *ppos)
  {
@@ -110483,7 +110640,7 @@ index 508155b..fad080f 100644
  		pr_warn("cannot create /proc/net/%s\n", PG_PROC_DIR);
  		return -ENODEV;
 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index 7ebed55..378bf34 100644
+index a2b90e1..7882f75 100644
 --- a/net/core/rtnetlink.c
 +++ b/net/core/rtnetlink.c
 @@ -61,7 +61,7 @@ struct rtnl_link {
@@ -111639,7 +111796,7 @@ index f027a70..2e64edc 100644
  
  static int raw_seq_show(struct seq_file *seq, void *v)
 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index 20fc020..3ba426f 100644
+index e262a08..d1fc3be 100644
 --- a/net/ipv4/route.c
 +++ b/net/ipv4/route.c
 @@ -228,7 +228,7 @@ static const struct seq_operations rt_cache_seq_ops = {
@@ -111692,7 +111849,7 @@ index 20fc020..3ba426f 100644
  }
  EXPORT_SYMBOL(ip_idents_reserve);
  
-@@ -2639,34 +2639,34 @@ static struct ctl_table ipv4_route_flush_table[] = {
+@@ -2643,34 +2643,34 @@ static struct ctl_table ipv4_route_flush_table[] = {
  		.maxlen		= sizeof(int),
  		.mode		= 0200,
  		.proc_handler	= ipv4_sysctl_rtcache_flush,
@@ -111735,7 +111892,7 @@ index 20fc020..3ba426f 100644
  err_dup:
  	return -ENOMEM;
  }
-@@ -2689,8 +2689,8 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
+@@ -2693,8 +2693,8 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
  
  static __net_init int rt_genid_init(struct net *net)
  {
@@ -111746,7 +111903,7 @@ index 20fc020..3ba426f 100644
  	get_random_bytes(&net->ipv4.dev_addr_genid,
  			 sizeof(net->ipv4.dev_addr_genid));
  	return 0;
-@@ -2734,11 +2734,7 @@ int __init ip_rt_init(void)
+@@ -2738,11 +2738,7 @@ int __init ip_rt_init(void)
  	int rc = 0;
  	int cpu;
  
@@ -111977,7 +112134,7 @@ index f1756ee..8908cb0 100644
  	}
  
 diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
-index dd11ac7..c0872da 100644
+index 50277af..defe393 100644
 --- a/net/ipv4/tcp_minisocks.c
 +++ b/net/ipv4/tcp_minisocks.c
 @@ -27,6 +27,10 @@
@@ -111991,7 +112148,7 @@ index dd11ac7..c0872da 100644
  int sysctl_tcp_syncookies __read_mostly = 1;
  EXPORT_SYMBOL(sysctl_tcp_syncookies);
  
-@@ -785,7 +789,10 @@ embryonic_reset:
+@@ -788,7 +792,10 @@ embryonic_reset:
  		 * avoid becoming vulnerable to outside attack aiming at
  		 * resetting legit local connections.
  		 */
@@ -112046,7 +112203,7 @@ index 0732b78..a82bdc6 100644
  				  syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
  		/* Has it gone just too far? */
 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 97ef1f8b..abeb965 100644
+index 51f1745..4bc0427 100644
 --- a/net/ipv4/udp.c
 +++ b/net/ipv4/udp.c
 @@ -87,6 +87,7 @@
@@ -112057,7 +112214,7 @@ index 97ef1f8b..abeb965 100644
  #include <linux/socket.h>
  #include <linux/sockios.h>
  #include <linux/igmp.h>
-@@ -114,6 +115,10 @@
+@@ -115,6 +116,10 @@
  #include <net/busy_poll.h>
  #include "udp_impl.h"
  
@@ -112068,7 +112225,7 @@ index 97ef1f8b..abeb965 100644
  struct udp_table udp_table __read_mostly;
  EXPORT_SYMBOL(udp_table);
  
-@@ -608,6 +613,9 @@ static inline bool __udp_is_mcast_sock(struct net *net, struct sock *sk,
+@@ -609,6 +614,9 @@ static inline bool __udp_is_mcast_sock(struct net *net, struct sock *sk,
  	return true;
  }
  
@@ -112078,7 +112235,7 @@ index 97ef1f8b..abeb965 100644
  /*
   * This routine is called by the ICMP module when it gets some
   * sort of error condition.  If err < 0 then the socket should
-@@ -945,9 +953,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+@@ -946,9 +954,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
  		dport = usin->sin_port;
  		if (dport == 0)
  			return -EINVAL;
@@ -112097,7 +112254,7 @@ index 97ef1f8b..abeb965 100644
  		daddr = inet->inet_daddr;
  		dport = inet->inet_dport;
  		/* Open fast path for connected socket.
-@@ -1195,7 +1212,7 @@ static unsigned int first_packet_length(struct sock *sk)
+@@ -1196,7 +1213,7 @@ static unsigned int first_packet_length(struct sock *sk)
  				 IS_UDPLITE(sk));
  		UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
  				 IS_UDPLITE(sk));
@@ -112106,7 +112263,7 @@ index 97ef1f8b..abeb965 100644
  		__skb_unlink(skb, rcvq);
  		__skb_queue_tail(&list_kill, skb);
  	}
-@@ -1275,6 +1292,10 @@ try_again:
+@@ -1276,6 +1293,10 @@ try_again:
  	if (!skb)
  		goto out;
  
@@ -112117,7 +112274,7 @@ index 97ef1f8b..abeb965 100644
  	ulen = skb->len - sizeof(struct udphdr);
  	copied = len;
  	if (copied > ulen)
-@@ -1307,7 +1328,7 @@ try_again:
+@@ -1308,7 +1329,7 @@ try_again:
  	if (unlikely(err)) {
  		trace_kfree_skb(skb, udp_recvmsg);
  		if (!peeked) {
@@ -112126,20 +112283,7 @@ index 97ef1f8b..abeb965 100644
  			UDP_INC_STATS_USER(sock_net(sk),
  					   UDP_MIB_INERRORS, is_udplite);
  		}
-@@ -1348,10 +1369,8 @@ csum_copy_err:
- 	}
- 	unlock_sock_fast(sk, slow);
- 
--	if (noblock)
--		return -EAGAIN;
--
--	/* starting over for a new packet */
-+	/* starting over for a new packet, but check if we need to yield */
-+	cond_resched();
- 	msg->msg_flags &= ~MSG_TRUNC;
- 	goto try_again;
- }
-@@ -1605,7 +1624,7 @@ csum_error:
+@@ -1604,7 +1625,7 @@ csum_error:
  	UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_CSUMERRORS, is_udplite);
  drop:
  	UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
@@ -112148,7 +112292,7 @@ index 97ef1f8b..abeb965 100644
  	kfree_skb(skb);
  	return -1;
  }
-@@ -1624,7 +1643,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
+@@ -1623,7 +1644,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
  			skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
  
  		if (!skb1) {
@@ -112157,7 +112301,7 @@ index 97ef1f8b..abeb965 100644
  			UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
  					 IS_UDPLITE(sk));
  			UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
-@@ -1830,6 +1849,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -1829,6 +1850,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
  		goto csum_error;
  
  	UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
@@ -112167,7 +112311,7 @@ index 97ef1f8b..abeb965 100644
  	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
  
  	/*
-@@ -2416,7 +2438,7 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
+@@ -2426,7 +2450,7 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
  		from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
  		0, sock_i_ino(sp),
  		atomic_read(&sp->sk_refcnt), sp,
@@ -112849,7 +112993,7 @@ index c5c10fa..2577d51 100644
  	struct ctl_table *ipv6_icmp_table;
  	int err;
 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 1f5e622..8387d90 100644
+index 5ca3bc8..8c53c81 100644
 --- a/net/ipv6/tcp_ipv6.c
 +++ b/net/ipv6/tcp_ipv6.c
 @@ -104,6 +104,10 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
@@ -112908,7 +113052,7 @@ index 1f5e622..8387d90 100644
  	}
  
 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index d048d46..cacb4d2 100644
+index 1c9512a..786b8d6 100644
 --- a/net/ipv6/udp.c
 +++ b/net/ipv6/udp.c
 @@ -76,6 +76,10 @@ static unsigned int udp6_ehashfn(struct net *net,
@@ -112931,20 +113075,7 @@ index d048d46..cacb4d2 100644
  			if (is_udp4)
  				UDP_INC_STATS_USER(sock_net(sk),
  						   UDP_MIB_INERRORS,
-@@ -528,10 +532,8 @@ csum_copy_err:
- 	}
- 	unlock_sock_fast(sk, slow);
- 
--	if (noblock)
--		return -EAGAIN;
--
--	/* starting over for a new packet */
-+	/* starting over for a new packet, but check if we need to yield */
-+	cond_resched();
- 	msg->msg_flags &= ~MSG_TRUNC;
- 	goto try_again;
- }
-@@ -714,7 +716,7 @@ csum_error:
+@@ -712,7 +716,7 @@ csum_error:
  	UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_CSUMERRORS, is_udplite);
  drop:
  	UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
@@ -112953,7 +113084,7 @@ index d048d46..cacb4d2 100644
  	kfree_skb(skb);
  	return -1;
  }
-@@ -753,7 +755,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
+@@ -753,7 +757,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
  		if (likely(skb1 == NULL))
  			skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
  		if (!skb1) {
@@ -112962,7 +113093,7 @@ index d048d46..cacb4d2 100644
  			UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
  					  IS_UDPLITE(sk));
  			UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
-@@ -937,6 +939,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -937,6 +941,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
  		goto csum_error;
  
  	UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
@@ -114083,7 +114214,7 @@ index 11de55e..f25e448 100644
  	return 0;
  }
 diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
-index d1d7a81..b45b03d 100644
+index 0e9c28d..d99773f 100644
 --- a/net/netlink/af_netlink.c
 +++ b/net/netlink/af_netlink.c
 @@ -260,7 +260,7 @@ static void netlink_overrun(struct sock *sk)
@@ -114095,7 +114226,7 @@ index d1d7a81..b45b03d 100644
  }
  
  static void netlink_rcv_wake(struct sock *sk)
-@@ -3002,7 +3002,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
+@@ -3005,7 +3005,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
  			   sk_wmem_alloc_get(s),
  			   nlk->cb_running,
  			   atomic_read(&s->sk_refcnt),
@@ -114180,7 +114311,7 @@ index bc85331..0d3dce0 100644
  /**
   * struct vport_portids - array of netlink portids of a vport.
 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index f8db706..2b4631e 100644
+index f8db706..0e29f8f 100644
 --- a/net/packet/af_packet.c
 +++ b/net/packet/af_packet.c
 @@ -269,7 +269,7 @@ static int packet_direct_xmit(struct sk_buff *skb)
@@ -114192,7 +114323,40 @@ index f8db706..2b4631e 100644
  	kfree_skb(skb);
  	return NET_XMIT_DROP;
  }
-@@ -1847,7 +1847,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1266,16 +1266,6 @@ static void packet_sock_destruct(struct sock *sk)
+ 	sk_refcnt_debug_dec(sk);
+ }
+ 
+-static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
+-{
+-	int x = atomic_read(&f->rr_cur) + 1;
+-
+-	if (x >= num)
+-		x = 0;
+-
+-	return x;
+-}
+-
+ static unsigned int fanout_demux_hash(struct packet_fanout *f,
+ 				      struct sk_buff *skb,
+ 				      unsigned int num)
+@@ -1287,13 +1277,9 @@ static unsigned int fanout_demux_lb(struct packet_fanout *f,
+ 				    struct sk_buff *skb,
+ 				    unsigned int num)
+ {
+-	int cur, old;
++	unsigned int val = atomic_inc_return(&f->rr_cur);
+ 
+-	cur = atomic_read(&f->rr_cur);
+-	while ((old = atomic_cmpxchg(&f->rr_cur, cur,
+-				     fanout_rr_next(f, num))) != cur)
+-		cur = old;
+-	return cur;
++	return val % num;
+ }
+ 
+ static unsigned int fanout_demux_cpu(struct packet_fanout *f,
+@@ -1847,7 +1833,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
  
  	spin_lock(&sk->sk_receive_queue.lock);
  	po->stats.stats1.tp_packets++;
@@ -114201,7 +114365,7 @@ index f8db706..2b4631e 100644
  	__skb_queue_tail(&sk->sk_receive_queue, skb);
  	spin_unlock(&sk->sk_receive_queue.lock);
  	sk->sk_data_ready(sk);
-@@ -1856,7 +1856,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1856,7 +1842,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
  drop_n_acct:
  	spin_lock(&sk->sk_receive_queue.lock);
  	po->stats.stats1.tp_drops++;
@@ -114210,7 +114374,7 @@ index f8db706..2b4631e 100644
  	spin_unlock(&sk->sk_receive_queue.lock);
  
  drop_n_restore:
-@@ -3499,7 +3499,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3499,7 +3485,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
  	case PACKET_HDRLEN:
  		if (len > sizeof(int))
  			len = sizeof(int);
@@ -114219,7 +114383,7 @@ index f8db706..2b4631e 100644
  			return -EFAULT;
  		switch (val) {
  		case TPACKET_V1:
-@@ -3545,7 +3545,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3545,7 +3531,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
  		len = lv;
  	if (put_user(len, optlen))
  		return -EFAULT;
@@ -115710,7 +115874,7 @@ index 72c339e..a93593a 100644
  	sub->evt.event = htohl(event, sub->swap);
  	sub->evt.found_lower = htohl(found_lower, sub->swap);
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 526b6ed..ec20275 100644
+index 146881f..9441ed2 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
 @@ -791,6 +791,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -115759,7 +115923,7 @@ index 526b6ed..ec20275 100644
  	done_path_create(&path, dentry);
  	return err;
  }
-@@ -2233,11 +2252,14 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
+@@ -2241,11 +2260,14 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
  	writable = unix_writable(sk);
  	other = unix_peer_get(sk);
  	if (other) {
@@ -115776,7 +115940,7 @@ index 526b6ed..ec20275 100644
  		sock_put(other);
  	}
  
-@@ -2334,9 +2356,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2342,9 +2364,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  		seq_puts(seq, "Num       RefCount Protocol Flags    Type St "
  			 "Inode Path\n");
  	else {
@@ -115791,7 +115955,7 @@ index 526b6ed..ec20275 100644
  
  		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
  			s,
-@@ -2361,10 +2387,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2369,10 +2395,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  				seq_putc(seq, '@');
  				i++;
  			}
@@ -126174,10 +126338,10 @@ index 0000000..b8e7188
 +}
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
 new file mode 100644
-index 0000000..19e2901
+index 0000000..89e8e68
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,27981 @@
+@@ -0,0 +1,27982 @@
 +intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL nohasharray
 +iwl_set_tx_power_1 iwl_set_tx_power 0 1 &intel_fake_agp_alloc_by_type_1
 +ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
@@ -141936,7 +142100,8 @@ index 0000000..19e2901
 +cyapa_gen5_bl_exit_36644 cyapa_gen5_bl_exit 0 36644 &ov2640_write_array_36644
 +m66592_udc_start_36646 m66592_udc_start 0 36646 NULL
 +mem_cgroup_do_precharge_36647 mem_cgroup_do_precharge 0 36647 NULL
-+lpfc_idiag_extacc_alloc_get_36648 lpfc_idiag_extacc_alloc_get 0-3 36648 NULL
++lpfc_idiag_extacc_alloc_get_36648 lpfc_idiag_extacc_alloc_get 0-3 36648 NULL nohasharray
++tty_copy_to_user_36648 tty_copy_to_user 4 36648 &lpfc_idiag_extacc_alloc_get_36648
 +add_dev_support_show_36650 add_dev_support_show 0 36650 NULL
 +hfsplus_osx_listxattr_36654 hfsplus_osx_listxattr 0-5 36654 NULL nohasharray
 +interface_show_36654 interface_show 0 36654 &hfsplus_osx_listxattr_36654

diff --git a/3.14.44/4425_grsec_remove_EI_PAX.patch b/4.0.6/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 3.14.44/4425_grsec_remove_EI_PAX.patch
rename to 4.0.6/4425_grsec_remove_EI_PAX.patch

diff --git a/4.0.5/4427_force_XATTR_PAX_tmpfs.patch b/4.0.6/4427_force_XATTR_PAX_tmpfs.patch
similarity index 100%
rename from 4.0.5/4427_force_XATTR_PAX_tmpfs.patch
rename to 4.0.6/4427_force_XATTR_PAX_tmpfs.patch

diff --git a/3.14.44/4430_grsec-remove-localversion-grsec.patch b/4.0.6/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 3.14.44/4430_grsec-remove-localversion-grsec.patch
rename to 4.0.6/4430_grsec-remove-localversion-grsec.patch

diff --git a/4.0.5/4435_grsec-mute-warnings.patch b/4.0.6/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 4.0.5/4435_grsec-mute-warnings.patch
rename to 4.0.6/4435_grsec-mute-warnings.patch

diff --git a/3.14.44/4440_grsec-remove-protected-paths.patch b/4.0.6/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 3.14.44/4440_grsec-remove-protected-paths.patch
rename to 4.0.6/4440_grsec-remove-protected-paths.patch

diff --git a/4.0.5/4450_grsec-kconfig-default-gids.patch b/4.0.6/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 4.0.5/4450_grsec-kconfig-default-gids.patch
rename to 4.0.6/4450_grsec-kconfig-default-gids.patch

diff --git a/4.0.5/4465_selinux-avc_audit-log-curr_ip.patch b/4.0.6/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 4.0.5/4465_selinux-avc_audit-log-curr_ip.patch
rename to 4.0.6/4465_selinux-avc_audit-log-curr_ip.patch

diff --git a/4.0.5/4470_disable-compat_vdso.patch b/4.0.6/4470_disable-compat_vdso.patch
similarity index 100%
rename from 4.0.5/4470_disable-compat_vdso.patch
rename to 4.0.6/4470_disable-compat_vdso.patch

diff --git a/3.14.44/4475_emutramp_default_on.patch b/4.0.6/4475_emutramp_default_on.patch
similarity index 100%
rename from 3.14.44/4475_emutramp_default_on.patch
rename to 4.0.6/4475_emutramp_default_on.patch