[gentoo-commits] proj/hardened-patchset:master commit in: 4.9.11/, 4.9.12/

[Anthony G. Basile]

commit:     b29d22f84076b2b7b21dd32836b57ca262dcd8db
Author:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Sat Feb 25 11:57:22 2017 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Sat Feb 25 11:57:22 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-patchset.git/commit/?id=b29d22f8

grsecurity-3.1-4.9.12-201702231830

 4.9.11/1009_linux-4.9.10.patch                     | 2157 --------------------
 4.9.11/1010_linux-4.9.11.patch                     | 1893 -----------------
 {4.9.11 => 4.9.12}/0000_README                     |   10 +-
 .../4420_grsecurity-3.1-4.9.12-201702231830.patch  |  299 +--
 {4.9.11 => 4.9.12}/4425_grsec_remove_EI_PAX.patch  |    0
 .../4426_default_XATTR_PAX_FLAGS.patch             |    0
 .../4427_force_XATTR_PAX_tmpfs.patch               |    0
 .../4430_grsec-remove-localversion-grsec.patch     |    0
 {4.9.11 => 4.9.12}/4435_grsec-mute-warnings.patch  |    0
 .../4440_grsec-remove-protected-paths.patch        |    0
 .../4450_grsec-kconfig-default-gids.patch          |    0
 .../4465_selinux-avc_audit-log-curr_ip.patch       |    0
 {4.9.11 => 4.9.12}/4470_disable-compat_vdso.patch  |    0
 {4.9.11 => 4.9.12}/4475_emutramp_default_on.patch  |    0
 14 files changed, 161 insertions(+), 4198 deletions(-)

diff --git a/4.9.11/1009_linux-4.9.10.patch b/4.9.11/1009_linux-4.9.10.patch
deleted file mode 100644
index 1767b59..0000000
--- a/4.9.11/1009_linux-4.9.10.patch
+++ /dev/null
@@ -1,2157 +0,0 @@
-diff --git a/Makefile b/Makefile
-index c0c41c9..d2fe757 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 9
--SUBLEVEL = 9
-+SUBLEVEL = 10
- EXTRAVERSION =
- NAME = Roaring Lionus
- 
-diff --git a/arch/arc/kernel/unaligned.c b/arch/arc/kernel/unaligned.c
-index 91ebe38..5f69c3b 100644
---- a/arch/arc/kernel/unaligned.c
-+++ b/arch/arc/kernel/unaligned.c
-@@ -243,7 +243,7 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs,
- 
- 	/* clear any remanants of delay slot */
- 	if (delay_mode(regs)) {
--		regs->ret = regs->bta ~1U;
-+		regs->ret = regs->bta & ~1U;
- 		regs->status32 &= ~STATUS_DE_MASK;
- 	} else {
- 		regs->ret += state.instr_len;
-diff --git a/arch/arm/boot/dts/imx6dl.dtsi b/arch/arm/boot/dts/imx6dl.dtsi
-index 1ade195..7aa120f 100644
---- a/arch/arm/boot/dts/imx6dl.dtsi
-+++ b/arch/arm/boot/dts/imx6dl.dtsi
-@@ -137,7 +137,7 @@
- &gpio4 {
- 	gpio-ranges = <&iomuxc  5 136 1>, <&iomuxc  6 145 1>, <&iomuxc  7 150 1>,
- 		      <&iomuxc  8 146 1>, <&iomuxc  9 151 1>, <&iomuxc 10 147 1>,
--		      <&iomuxc 11 151 1>, <&iomuxc 12 148 1>, <&iomuxc 13 153 1>,
-+		      <&iomuxc 11 152 1>, <&iomuxc 12 148 1>, <&iomuxc 13 153 1>,
- 		      <&iomuxc 14 149 1>, <&iomuxc 15 154 1>, <&iomuxc 16  39 7>,
- 		      <&iomuxc 23  56 1>, <&iomuxc 24  61 7>, <&iomuxc 31  46 1>;
- };
-diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
-index ce131ed..ae738a6 100644
---- a/arch/arm/kernel/ptrace.c
-+++ b/arch/arm/kernel/ptrace.c
-@@ -600,7 +600,7 @@ static int gpr_set(struct task_struct *target,
- 		   const void *kbuf, const void __user *ubuf)
- {
- 	int ret;
--	struct pt_regs newregs;
-+	struct pt_regs newregs = *task_pt_regs(target);
- 
- 	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
- 				 &newregs,
-diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
-index 3a2e678..0122ad1 100644
---- a/arch/arm/mm/fault.c
-+++ b/arch/arm/mm/fault.c
-@@ -610,9 +610,9 @@ static int __init early_abort_handler(unsigned long addr, unsigned int fsr,
- 
- void __init early_abt_enable(void)
- {
--	fsr_info[22].fn = early_abort_handler;
-+	fsr_info[FSR_FS_AEA].fn = early_abort_handler;
- 	local_abt_enable();
--	fsr_info[22].fn = do_bad;
-+	fsr_info[FSR_FS_AEA].fn = do_bad;
- }
- 
- #ifndef CONFIG_ARM_LPAE
-diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h
-index 67532f2..afc1f84 100644
---- a/arch/arm/mm/fault.h
-+++ b/arch/arm/mm/fault.h
-@@ -11,11 +11,15 @@
- #define FSR_FS5_0		(0x3f)
- 
- #ifdef CONFIG_ARM_LPAE
-+#define FSR_FS_AEA		17
-+
- static inline int fsr_fs(unsigned int fsr)
- {
- 	return fsr & FSR_FS5_0;
- }
- #else
-+#define FSR_FS_AEA		22
-+
- static inline int fsr_fs(unsigned int fsr)
- {
- 	return (fsr & FSR_FS3_0) | (fsr & FSR_FS4) >> 6;
-diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
-index 9e1499f..13f5fad 100644
---- a/arch/powerpc/include/asm/reg.h
-+++ b/arch/powerpc/include/asm/reg.h
-@@ -641,9 +641,10 @@
- #define   SRR1_ISI_N_OR_G	0x10000000 /* ISI: Access is no-exec or G */
- #define   SRR1_ISI_PROT		0x08000000 /* ISI: Other protection fault */
- #define   SRR1_WAKEMASK		0x00380000 /* reason for wakeup */
--#define   SRR1_WAKEMASK_P8	0x003c0000 /* reason for wakeup on POWER8 */
-+#define   SRR1_WAKEMASK_P8	0x003c0000 /* reason for wakeup on POWER8 and 9 */
- #define   SRR1_WAKESYSERR	0x00300000 /* System error */
- #define   SRR1_WAKEEE		0x00200000 /* External interrupt */
-+#define   SRR1_WAKEHVI		0x00240000 /* Hypervisor Virtualization Interrupt (P9) */
- #define   SRR1_WAKEMT		0x00280000 /* mtctrl */
- #define	  SRR1_WAKEHMI		0x00280000 /* Hypervisor maintenance */
- #define   SRR1_WAKEDEC		0x00180000 /* Decrementer interrupt */
-diff --git a/arch/powerpc/include/asm/xics.h b/arch/powerpc/include/asm/xics.h
-index f0b2385..e0b9e57 100644
---- a/arch/powerpc/include/asm/xics.h
-+++ b/arch/powerpc/include/asm/xics.h
-@@ -44,6 +44,7 @@ static inline int icp_hv_init(void) { return -ENODEV; }
- 
- #ifdef CONFIG_PPC_POWERNV
- extern int icp_opal_init(void);
-+extern void icp_opal_flush_interrupt(void);
- #else
- static inline int icp_opal_init(void) { return -ENODEV; }
- #endif
-diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
-index 3493cf4..71697ff 100644
---- a/arch/powerpc/mm/tlb-radix.c
-+++ b/arch/powerpc/mm/tlb-radix.c
-@@ -50,9 +50,7 @@ static inline void _tlbiel_pid(unsigned long pid, unsigned long ric)
- 	for (set = 0; set < POWER9_TLB_SETS_RADIX ; set++) {
- 		__tlbiel_pid(pid, set, ric);
- 	}
--	if (cpu_has_feature(CPU_FTR_POWER9_DD1))
--		asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
--	return;
-+	asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
- }
- 
- static inline void _tlbie_pid(unsigned long pid, unsigned long ric)
-@@ -85,8 +83,6 @@ static inline void _tlbiel_va(unsigned long va, unsigned long pid,
- 	asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1)
- 		     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
- 	asm volatile("ptesync": : :"memory");
--	if (cpu_has_feature(CPU_FTR_POWER9_DD1))
--		asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
- }
- 
- static inline void _tlbie_va(unsigned long va, unsigned long pid,
-diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
-index c789258..eec0e8d 100644
---- a/arch/powerpc/platforms/powernv/smp.c
-+++ b/arch/powerpc/platforms/powernv/smp.c
-@@ -155,8 +155,10 @@ static void pnv_smp_cpu_kill_self(void)
- 		wmask = SRR1_WAKEMASK_P8;
- 
- 	idle_states = pnv_get_supported_cpuidle_states();
-+
- 	/* We don't want to take decrementer interrupts while we are offline,
--	 * so clear LPCR:PECE1. We keep PECE2 enabled.
-+	 * so clear LPCR:PECE1. We keep PECE2 (and LPCR_PECE_HVEE on P9)
-+	 * enabled as to let IPIs in.
- 	 */
- 	mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1);
- 
-@@ -206,8 +208,12 @@ static void pnv_smp_cpu_kill_self(void)
- 		 * contains 0.
- 		 */
- 		if (((srr1 & wmask) == SRR1_WAKEEE) ||
-+		    ((srr1 & wmask) == SRR1_WAKEHVI) ||
- 		    (local_paca->irq_happened & PACA_IRQ_EE)) {
--			icp_native_flush_interrupt();
-+			if (cpu_has_feature(CPU_FTR_ARCH_300))
-+				icp_opal_flush_interrupt();
-+			else
-+				icp_native_flush_interrupt();
- 		} else if ((srr1 & wmask) == SRR1_WAKEHDBELL) {
- 			unsigned long msg = PPC_DBELL_TYPE(PPC_DBELL_SERVER);
- 			asm volatile(PPC_MSGCLR(%0) : : "r" (msg));
-@@ -221,6 +227,8 @@ static void pnv_smp_cpu_kill_self(void)
- 		if (srr1 && !generic_check_cpu_restart(cpu))
- 			DBG("CPU%d Unexpected exit while offline !\n", cpu);
- 	}
-+
-+	/* Re-enable decrementer interrupts */
- 	mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) | LPCR_PECE1);
- 	DBG("CPU%d coming online...\n", cpu);
- }
-diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c
-index 60c5765..c96c0cb 100644
---- a/arch/powerpc/sysdev/xics/icp-opal.c
-+++ b/arch/powerpc/sysdev/xics/icp-opal.c
-@@ -132,6 +132,35 @@ static irqreturn_t icp_opal_ipi_action(int irq, void *dev_id)
- 	return smp_ipi_demux();
- }
- 
-+/*
-+ * Called when an interrupt is received on an off-line CPU to
-+ * clear the interrupt, so that the CPU can go back to nap mode.
-+ */
-+void icp_opal_flush_interrupt(void)
-+{
-+	unsigned int xirr;
-+	unsigned int vec;
-+
-+	do {
-+		xirr = icp_opal_get_xirr();
-+		vec = xirr & 0x00ffffff;
-+		if (vec == XICS_IRQ_SPURIOUS)
-+			break;
-+		if (vec == XICS_IPI) {
-+			/* Clear pending IPI */
-+			int cpu = smp_processor_id();
-+			kvmppc_set_host_ipi(cpu, 0);
-+			opal_int_set_mfrr(get_hard_smp_processor_id(cpu), 0xff);
-+		} else {
-+			pr_err("XICS: hw interrupt 0x%x to offline cpu, "
-+			       "disabling\n", vec);
-+			xics_mask_unknown_vec(vec);
-+		}
-+
-+		/* EOI the interrupt */
-+	} while (opal_int_eoi(xirr) > 0);
-+}
-+
- #endif /* CONFIG_SMP */
- 
- static const struct icp_ops icp_opal_ops = {
-diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
-index 984a7bf..83db0ea 100644
---- a/arch/x86/include/asm/processor.h
-+++ b/arch/x86/include/asm/processor.h
-@@ -104,6 +104,7 @@ struct cpuinfo_x86 {
- 	__u8			x86_phys_bits;
- 	/* CPUID returned core id bits: */
- 	__u8			x86_coreid_bits;
-+	__u8			cu_id;
- 	/* Max extended CPUID function supported: */
- 	__u32			extended_cpuid_level;
- 	/* Maximum supported CPUID level, -1=no CPUID: */
-diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
-index 7249f15..d1e2556 100644
---- a/arch/x86/kernel/apic/io_apic.c
-+++ b/arch/x86/kernel/apic/io_apic.c
-@@ -1876,7 +1876,6 @@ static struct irq_chip ioapic_chip __read_mostly = {
- 	.irq_ack		= irq_chip_ack_parent,
- 	.irq_eoi		= ioapic_ack_level,
- 	.irq_set_affinity	= ioapic_set_affinity,
--	.irq_retrigger		= irq_chip_retrigger_hierarchy,
- 	.flags			= IRQCHIP_SKIP_SET_WAKE,
- };
- 
-@@ -1888,7 +1887,6 @@ static struct irq_chip ioapic_ir_chip __read_mostly = {
- 	.irq_ack		= irq_chip_ack_parent,
- 	.irq_eoi		= ioapic_ir_ack_level,
- 	.irq_set_affinity	= ioapic_set_affinity,
--	.irq_retrigger		= irq_chip_retrigger_hierarchy,
- 	.flags			= IRQCHIP_SKIP_SET_WAKE,
- };
- 
-diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
-index 1d31672..2b4cf04 100644
---- a/arch/x86/kernel/cpu/amd.c
-+++ b/arch/x86/kernel/cpu/amd.c
-@@ -309,8 +309,22 @@ static void amd_get_topology(struct cpuinfo_x86 *c)
- 
- 	/* get information required for multi-node processors */
- 	if (boot_cpu_has(X86_FEATURE_TOPOEXT)) {
-+		u32 eax, ebx, ecx, edx;
- 
--		node_id = cpuid_ecx(0x8000001e) & 7;
-+		cpuid(0x8000001e, &eax, &ebx, &ecx, &edx);
-+
-+		node_id  = ecx & 0xff;
-+		smp_num_siblings = ((ebx >> 8) & 0xff) + 1;
-+
-+		if (c->x86 == 0x15)
-+			c->cu_id = ebx & 0xff;
-+
-+		if (c->x86 >= 0x17) {
-+			c->cpu_core_id = ebx & 0xff;
-+
-+			if (smp_num_siblings > 1)
-+				c->x86_max_cores /= smp_num_siblings;
-+		}
- 
- 		/*
- 		 * We may have multiple LLCs if L3 caches exist, so check if we
-diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
-index 023c7bf..4eece91 100644
---- a/arch/x86/kernel/cpu/common.c
-+++ b/arch/x86/kernel/cpu/common.c
-@@ -1015,6 +1015,7 @@ static void identify_cpu(struct cpuinfo_x86 *c)
- 	c->x86_model_id[0] = '\0';  /* Unset */
- 	c->x86_max_cores = 1;
- 	c->x86_coreid_bits = 0;
-+	c->cu_id = 0xff;
- #ifdef CONFIG_X86_64
- 	c->x86_clflush_size = 64;
- 	c->x86_phys_bits = 36;
-diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index e9bbe02..36171bc 100644
---- a/arch/x86/kernel/smpboot.c
-+++ b/arch/x86/kernel/smpboot.c
-@@ -423,9 +423,15 @@ static bool match_smt(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
- 		int cpu1 = c->cpu_index, cpu2 = o->cpu_index;
- 
- 		if (c->phys_proc_id == o->phys_proc_id &&
--		    per_cpu(cpu_llc_id, cpu1) == per_cpu(cpu_llc_id, cpu2) &&
--		    c->cpu_core_id == o->cpu_core_id)
--			return topology_sane(c, o, "smt");
-+		    per_cpu(cpu_llc_id, cpu1) == per_cpu(cpu_llc_id, cpu2)) {
-+			if (c->cpu_core_id == o->cpu_core_id)
-+				return topology_sane(c, o, "smt");
-+
-+			if ((c->cu_id != 0xff) &&
-+			    (o->cu_id != 0xff) &&
-+			    (c->cu_id == o->cu_id))
-+				return topology_sane(c, o, "smt");
-+		}
- 
- 	} else if (c->phys_proc_id == o->phys_proc_id &&
- 		   c->cpu_core_id == o->cpu_core_id) {
-diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
-index ea9c49a..8aa6bea 100644
---- a/arch/x86/mm/dump_pagetables.c
-+++ b/arch/x86/mm/dump_pagetables.c
-@@ -15,6 +15,7 @@
- #include <linux/debugfs.h>
- #include <linux/mm.h>
- #include <linux/init.h>
-+#include <linux/sched.h>
- #include <linux/seq_file.h>
- 
- #include <asm/pgtable.h>
-@@ -406,6 +407,7 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
- 		} else
- 			note_page(m, &st, __pgprot(0), 1);
- 
-+		cond_resched();
- 		start++;
- 	}
- 
-diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
-index e9c0993..e8817e2 100644
---- a/crypto/algif_aead.c
-+++ b/crypto/algif_aead.c
-@@ -671,9 +671,9 @@ static int aead_recvmsg_sync(struct socket *sock, struct msghdr *msg, int flags)
- unlock:
- 	list_for_each_entry_safe(rsgl, tmp, &ctx->list, list) {
- 		af_alg_free_sg(&rsgl->sgl);
-+		list_del(&rsgl->list);
- 		if (rsgl != &ctx->first_rsgl)
- 			sock_kfree_s(sk, rsgl, sizeof(*rsgl));
--		list_del(&rsgl->list);
- 	}
- 	INIT_LIST_HEAD(&ctx->list);
- 	aead_wmem_wakeup(sk);
-diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
-index 312c4b4..6eb6733 100644
---- a/drivers/acpi/nfit/core.c
-+++ b/drivers/acpi/nfit/core.c
-@@ -2704,6 +2704,7 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
- 	struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
- 	struct device *dev = acpi_desc->dev;
- 	struct acpi_nfit_flush_work flush;
-+	int rc;
- 
- 	/* bounce the device lock to flush acpi_nfit_add / acpi_nfit_notify */
- 	device_lock(dev);
-@@ -2716,7 +2717,10 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
- 	INIT_WORK_ONSTACK(&flush.work, flush_probe);
- 	COMPLETION_INITIALIZER_ONSTACK(flush.cmp);
- 	queue_work(nfit_wq, &flush.work);
--	return wait_for_completion_interruptible(&flush.cmp);
-+
-+	rc = wait_for_completion_interruptible(&flush.cmp);
-+	cancel_work_sync(&flush.work);
-+	return rc;
- }
- 
- static int acpi_nfit_clear_to_send(struct nvdimm_bus_descriptor *nd_desc,
-diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index 4737520..80fa656 100644
---- a/drivers/cpufreq/intel_pstate.c
-+++ b/drivers/cpufreq/intel_pstate.c
-@@ -820,6 +820,25 @@ static void intel_pstate_hwp_enable(struct cpudata *cpudata)
- 	wrmsrl_on_cpu(cpudata->cpu, MSR_PM_ENABLE, 0x1);
- }
- 
-+#define MSR_IA32_POWER_CTL_BIT_EE	19
-+
-+/* Disable energy efficiency optimization */
-+static void intel_pstate_disable_ee(int cpu)
-+{
-+	u64 power_ctl;
-+	int ret;
-+
-+	ret = rdmsrl_on_cpu(cpu, MSR_IA32_POWER_CTL, &power_ctl);
-+	if (ret)
-+		return;
-+
-+	if (!(power_ctl & BIT(MSR_IA32_POWER_CTL_BIT_EE))) {
-+		pr_info("Disabling energy efficiency optimization\n");
-+		power_ctl |= BIT(MSR_IA32_POWER_CTL_BIT_EE);
-+		wrmsrl_on_cpu(cpu, MSR_IA32_POWER_CTL, power_ctl);
-+	}
-+}
-+
- static int atom_get_min_pstate(void)
- {
- 	u64 value;
-@@ -1420,6 +1439,11 @@ static const struct x86_cpu_id intel_pstate_cpu_oob_ids[] __initconst = {
- 	{}
- };
- 
-+static const struct x86_cpu_id intel_pstate_cpu_ee_disable_ids[] = {
-+	ICPU(INTEL_FAM6_KABYLAKE_DESKTOP, core_params),
-+	{}
-+};
-+
- static int intel_pstate_init_cpu(unsigned int cpunum)
- {
- 	struct cpudata *cpu;
-@@ -1435,6 +1459,12 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
- 	cpu->cpu = cpunum;
- 
- 	if (hwp_active) {
-+		const struct x86_cpu_id *id;
-+
-+		id = x86_match_cpu(intel_pstate_cpu_ee_disable_ids);
-+		if (id)
-+			intel_pstate_disable_ee(cpunum);
-+
- 		intel_pstate_hwp_enable(cpu);
- 		pid_params.sample_rate_ms = 50;
- 		pid_params.sample_rate_ns = 50 * NSEC_PER_MSEC;
-diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
-index faf3cb3..a388bf2 100644
---- a/drivers/crypto/ccp/ccp-dev-v5.c
-+++ b/drivers/crypto/ccp/ccp-dev-v5.c
-@@ -955,7 +955,7 @@ static irqreturn_t ccp5_irq_handler(int irq, void *data)
- static void ccp5_config(struct ccp_device *ccp)
- {
- 	/* Public side */
--	iowrite32(0x00001249, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET);
-+	iowrite32(0x0, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET);
- }
- 
- static void ccp5other_config(struct ccp_device *ccp)
-diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
-index da5f4a6..340aef1 100644
---- a/drivers/crypto/ccp/ccp-dev.h
-+++ b/drivers/crypto/ccp/ccp-dev.h
-@@ -238,6 +238,7 @@ struct ccp_dma_chan {
- 	struct ccp_device *ccp;
- 
- 	spinlock_t lock;
-+	struct list_head created;
- 	struct list_head pending;
- 	struct list_head active;
- 	struct list_head complete;
-diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
-index 6553912..e5d9278 100644
---- a/drivers/crypto/ccp/ccp-dmaengine.c
-+++ b/drivers/crypto/ccp/ccp-dmaengine.c
-@@ -63,6 +63,7 @@ static void ccp_free_chan_resources(struct dma_chan *dma_chan)
- 	ccp_free_desc_resources(chan->ccp, &chan->complete);
- 	ccp_free_desc_resources(chan->ccp, &chan->active);
- 	ccp_free_desc_resources(chan->ccp, &chan->pending);
-+	ccp_free_desc_resources(chan->ccp, &chan->created);
- 
- 	spin_unlock_irqrestore(&chan->lock, flags);
- }
-@@ -273,6 +274,7 @@ static dma_cookie_t ccp_tx_submit(struct dma_async_tx_descriptor *tx_desc)
- 	spin_lock_irqsave(&chan->lock, flags);
- 
- 	cookie = dma_cookie_assign(tx_desc);
-+	list_del(&desc->entry);
- 	list_add_tail(&desc->entry, &chan->pending);
- 
- 	spin_unlock_irqrestore(&chan->lock, flags);
-@@ -426,7 +428,7 @@ static struct ccp_dma_desc *ccp_create_desc(struct dma_chan *dma_chan,
- 
- 	spin_lock_irqsave(&chan->lock, sflags);
- 
--	list_add_tail(&desc->entry, &chan->pending);
-+	list_add_tail(&desc->entry, &chan->created);
- 
- 	spin_unlock_irqrestore(&chan->lock, sflags);
- 
-@@ -610,6 +612,7 @@ static int ccp_terminate_all(struct dma_chan *dma_chan)
- 	/*TODO: Purge the complete list? */
- 	ccp_free_desc_resources(chan->ccp, &chan->active);
- 	ccp_free_desc_resources(chan->ccp, &chan->pending);
-+	ccp_free_desc_resources(chan->ccp, &chan->created);
- 
- 	spin_unlock_irqrestore(&chan->lock, flags);
- 
-@@ -679,6 +682,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp)
- 		chan->ccp = ccp;
- 
- 		spin_lock_init(&chan->lock);
-+		INIT_LIST_HEAD(&chan->created);
- 		INIT_LIST_HEAD(&chan->pending);
- 		INIT_LIST_HEAD(&chan->active);
- 		INIT_LIST_HEAD(&chan->complete);
-diff --git a/drivers/crypto/chelsio/chcr_core.c b/drivers/crypto/chelsio/chcr_core.c
-index fb5f9bb..6aece3f 100644
---- a/drivers/crypto/chelsio/chcr_core.c
-+++ b/drivers/crypto/chelsio/chcr_core.c
-@@ -51,6 +51,7 @@ static struct cxgb4_uld_info chcr_uld_info = {
- int assign_chcr_device(struct chcr_dev **dev)
- {
- 	struct uld_ctx *u_ctx;
-+	int ret = -ENXIO;
- 
- 	/*
- 	 * Which device to use if multiple devices are available TODO
-@@ -58,15 +59,14 @@ int assign_chcr_device(struct chcr_dev **dev)
- 	 * must go to the same device to maintain the ordering.
- 	 */
- 	mutex_lock(&dev_mutex); /* TODO ? */
--	u_ctx = list_first_entry(&uld_ctx_list, struct uld_ctx, entry);
--	if (!u_ctx) {
--		mutex_unlock(&dev_mutex);
--		return -ENXIO;
-+	list_for_each_entry(u_ctx, &uld_ctx_list, entry)
-+		if (u_ctx && u_ctx->dev) {
-+			*dev = u_ctx->dev;
-+			ret = 0;
-+			break;
- 	}
--
--	*dev = u_ctx->dev;
- 	mutex_unlock(&dev_mutex);
--	return 0;
-+	return ret;
- }
- 
- static int chcr_dev_add(struct uld_ctx *u_ctx)
-@@ -203,10 +203,8 @@ static int chcr_uld_state_change(void *handle, enum cxgb4_state state)
- 
- static int __init chcr_crypto_init(void)
- {
--	if (cxgb4_register_uld(CXGB4_ULD_CRYPTO, &chcr_uld_info)) {
-+	if (cxgb4_register_uld(CXGB4_ULD_CRYPTO, &chcr_uld_info))
- 		pr_err("ULD register fail: No chcr crypto support in cxgb4");
--		return -1;
--	}
- 
- 	return 0;
- }
-diff --git a/drivers/crypto/qat/qat_c62x/adf_drv.c b/drivers/crypto/qat/qat_c62x/adf_drv.c
-index bc5cbc1..5b2d78a 100644
---- a/drivers/crypto/qat/qat_c62x/adf_drv.c
-+++ b/drivers/crypto/qat/qat_c62x/adf_drv.c
-@@ -233,7 +233,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
- 			      &hw_data->accel_capabilities_mask);
- 
- 	/* Find and map all the device's BARS */
--	i = 0;
-+	i = (hw_data->fuses & ADF_DEVICE_FUSECTL_MASK) ? 1 : 0;
- 	bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
- 	for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
- 			 ADF_PCI_MAX_BARS * 2) {
-diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h
-index e882253..33f0a62 100644
---- a/drivers/crypto/qat/qat_common/adf_accel_devices.h
-+++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h
-@@ -69,6 +69,7 @@
- #define ADF_ERRSOU5 (0x3A000 + 0xD8)
- #define ADF_DEVICE_FUSECTL_OFFSET 0x40
- #define ADF_DEVICE_LEGFUSE_OFFSET 0x4C
-+#define ADF_DEVICE_FUSECTL_MASK 0x80000000
- #define ADF_PCI_MAX_BARS 3
- #define ADF_DEVICE_NAME_LENGTH 32
- #define ADF_ETR_MAX_RINGS_PER_BANK 16
-diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c
-index 1e480f1..8c4fd25 100644
---- a/drivers/crypto/qat/qat_common/qat_hal.c
-+++ b/drivers/crypto/qat/qat_common/qat_hal.c
-@@ -456,7 +456,7 @@ static int qat_hal_init_esram(struct icp_qat_fw_loader_handle *handle)
- 	unsigned int csr_val;
- 	int times = 30;
- 
--	if (handle->pci_dev->device == ADF_C3XXX_PCI_DEVICE_ID)
-+	if (handle->pci_dev->device != ADF_DH895XCC_PCI_DEVICE_ID)
- 		return 0;
- 
- 	csr_val = ADF_CSR_RD(csr_addr, 0);
-@@ -716,7 +716,7 @@ int qat_hal_init(struct adf_accel_dev *accel_dev)
- 		(void __iomem *)((uintptr_t)handle->hal_cap_ae_xfer_csr_addr_v +
- 				 LOCAL_TO_XFER_REG_OFFSET);
- 	handle->pci_dev = pci_info->pci_dev;
--	if (handle->pci_dev->device != ADF_C3XXX_PCI_DEVICE_ID) {
-+	if (handle->pci_dev->device == ADF_DH895XCC_PCI_DEVICE_ID) {
- 		sram_bar =
- 			&pci_info->pci_bars[hw_data->get_sram_bar_id(hw_data)];
- 		handle->hal_sram_addr_v = sram_bar->virt_addr;
-diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
-index e6862a7..4e19bde 100644
---- a/drivers/gpu/drm/drm_atomic.c
-+++ b/drivers/gpu/drm/drm_atomic.c
-@@ -1759,16 +1759,16 @@ int drm_mode_atomic_ioctl(struct drm_device *dev,
- 
- 	if (ret && arg->flags & DRM_MODE_PAGE_FLIP_EVENT) {
- 		/*
--		 * TEST_ONLY and PAGE_FLIP_EVENT are mutually exclusive,
--		 * if they weren't, this code should be called on success
--		 * for TEST_ONLY too.
-+		 * Free the allocated event. drm_atomic_helper_setup_commit
-+		 * can allocate an event too, so only free it if it's ours
-+		 * to prevent a double free in drm_atomic_state_clear.
- 		 */
--
- 		for_each_crtc_in_state(state, crtc, crtc_state, i) {
--			if (!crtc_state->event)
--				continue;
--
--			drm_event_cancel_free(dev, &crtc_state->event->base);
-+			struct drm_pending_vblank_event *event = crtc_state->event;
-+			if (event && (event->base.fence || event->base.file_priv)) {
-+				drm_event_cancel_free(dev, &event->base);
-+				crtc_state->event = NULL;
-+			}
- 		}
- 	}
- 
-diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-index a218c2e..0c400f8 100644
---- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-@@ -1215,14 +1215,14 @@ validate_exec_list(struct drm_device *dev,
- 			if (exec[i].offset !=
- 			    gen8_canonical_addr(exec[i].offset & PAGE_MASK))
- 				return -EINVAL;
--
--			/* From drm_mm perspective address space is continuous,
--			 * so from this point we're always using non-canonical
--			 * form internally.
--			 */
--			exec[i].offset = gen8_noncanonical_addr(exec[i].offset);
- 		}
- 
-+		/* From drm_mm perspective address space is continuous,
-+		 * so from this point we're always using non-canonical
-+		 * form internally.
-+		 */
-+		exec[i].offset = gen8_noncanonical_addr(exec[i].offset);
-+
- 		if (exec[i].alignment && !is_power_of_2(exec[i].alignment))
- 			return -EINVAL;
- 
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 8079e5b..b9be8a6 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -4280,10 +4280,10 @@ static void page_flip_completed(struct intel_crtc *intel_crtc)
- 	drm_crtc_vblank_put(&intel_crtc->base);
- 
- 	wake_up_all(&dev_priv->pending_flip_queue);
--	queue_work(dev_priv->wq, &work->unpin_work);
--
- 	trace_i915_flip_complete(intel_crtc->plane,
- 				 work->pending_flip_obj);
-+
-+	queue_work(dev_priv->wq, &work->unpin_work);
- }
- 
- static int intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc)
-diff --git a/drivers/gpu/drm/i915/intel_dpll_mgr.c b/drivers/gpu/drm/i915/intel_dpll_mgr.c
-index 1c59ca5..cae27c5 100644
---- a/drivers/gpu/drm/i915/intel_dpll_mgr.c
-+++ b/drivers/gpu/drm/i915/intel_dpll_mgr.c
-@@ -1723,7 +1723,8 @@ bxt_get_dpll(struct intel_crtc *crtc,
- 		return NULL;
- 
- 	if ((encoder->type == INTEL_OUTPUT_DP ||
--	     encoder->type == INTEL_OUTPUT_EDP) &&
-+	     encoder->type == INTEL_OUTPUT_EDP ||
-+	     encoder->type == INTEL_OUTPUT_DP_MST) &&
- 	    !bxt_ddi_dp_set_dpll_hw_state(clock, &dpll_hw_state))
- 		return NULL;
- 
-diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
-index 16f91c8..5fb4c6d 100644
---- a/drivers/hv/channel.c
-+++ b/drivers/hv/channel.c
-@@ -39,7 +39,7 @@
-  * vmbus_setevent- Trigger an event notification on the specified
-  * channel.
-  */
--static void vmbus_setevent(struct vmbus_channel *channel)
-+void vmbus_setevent(struct vmbus_channel *channel)
- {
- 	struct hv_monitor_page *monitorpage;
- 
-@@ -65,6 +65,7 @@ static void vmbus_setevent(struct vmbus_channel *channel)
- 		vmbus_set_event(channel);
- 	}
- }
-+EXPORT_SYMBOL_GPL(vmbus_setevent);
- 
- /*
-  * vmbus_open - Open the specified channel.
-@@ -635,8 +636,6 @@ int vmbus_sendpacket_ctl(struct vmbus_channel *channel, void *buffer,
- 	u32 packetlen_aligned = ALIGN(packetlen, sizeof(u64));
- 	struct kvec bufferlist[3];
- 	u64 aligned_data = 0;
--	int ret;
--	bool signal = false;
- 	bool lock = channel->acquire_ring_lock;
- 	int num_vecs = ((bufferlen != 0) ? 3 : 1);
- 
-@@ -656,33 +655,9 @@ int vmbus_sendpacket_ctl(struct vmbus_channel *channel, void *buffer,
- 	bufferlist[2].iov_base = &aligned_data;
- 	bufferlist[2].iov_len = (packetlen_aligned - packetlen);
- 
--	ret = hv_ringbuffer_write(&channel->outbound, bufferlist, num_vecs,
--				  &signal, lock, channel->signal_policy);
--
--	/*
--	 * Signalling the host is conditional on many factors:
--	 * 1. The ring state changed from being empty to non-empty.
--	 *    This is tracked by the variable "signal".
--	 * 2. The variable kick_q tracks if more data will be placed
--	 *    on the ring. We will not signal if more data is
--	 *    to be placed.
--	 *
--	 * Based on the channel signal state, we will decide
--	 * which signaling policy will be applied.
--	 *
--	 * If we cannot write to the ring-buffer; signal the host
--	 * even if we may not have written anything. This is a rare
--	 * enough condition that it should not matter.
--	 * NOTE: in this case, the hvsock channel is an exception, because
--	 * it looks the host side's hvsock implementation has a throttling
--	 * mechanism which can hurt the performance otherwise.
--	 */
--
--	if (((ret == 0) && kick_q && signal) ||
--	    (ret && !is_hvsock_channel(channel)))
--		vmbus_setevent(channel);
-+	return hv_ringbuffer_write(channel, bufferlist, num_vecs,
-+				   lock, kick_q);
- 
--	return ret;
- }
- EXPORT_SYMBOL(vmbus_sendpacket_ctl);
- 
-@@ -723,7 +698,6 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
- 				     u32 flags,
- 				     bool kick_q)
- {
--	int ret;
- 	int i;
- 	struct vmbus_channel_packet_page_buffer desc;
- 	u32 descsize;
-@@ -731,7 +705,6 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
- 	u32 packetlen_aligned;
- 	struct kvec bufferlist[3];
- 	u64 aligned_data = 0;
--	bool signal = false;
- 	bool lock = channel->acquire_ring_lock;
- 
- 	if (pagecount > MAX_PAGE_BUFFER_COUNT)
-@@ -769,29 +742,8 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
- 	bufferlist[2].iov_base = &aligned_data;
- 	bufferlist[2].iov_len = (packetlen_aligned - packetlen);
- 
--	ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3,
--				  &signal, lock, channel->signal_policy);
--
--	/*
--	 * Signalling the host is conditional on many factors:
--	 * 1. The ring state changed from being empty to non-empty.
--	 *    This is tracked by the variable "signal".
--	 * 2. The variable kick_q tracks if more data will be placed
--	 *    on the ring. We will not signal if more data is
--	 *    to be placed.
--	 *
--	 * Based on the channel signal state, we will decide
--	 * which signaling policy will be applied.
--	 *
--	 * If we cannot write to the ring-buffer; signal the host
--	 * even if we may not have written anything. This is a rare
--	 * enough condition that it should not matter.
--	 */
--
--	if (((ret == 0) && kick_q && signal) || (ret))
--		vmbus_setevent(channel);
--
--	return ret;
-+	return hv_ringbuffer_write(channel, bufferlist, 3,
-+				   lock, kick_q);
- }
- EXPORT_SYMBOL_GPL(vmbus_sendpacket_pagebuffer_ctl);
- 
-@@ -822,12 +774,10 @@ int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel,
- 			      u32 desc_size,
- 			      void *buffer, u32 bufferlen, u64 requestid)
- {
--	int ret;
- 	u32 packetlen;
- 	u32 packetlen_aligned;
- 	struct kvec bufferlist[3];
- 	u64 aligned_data = 0;
--	bool signal = false;
- 	bool lock = channel->acquire_ring_lock;
- 
- 	packetlen = desc_size + bufferlen;
-@@ -848,13 +798,8 @@ int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel,
- 	bufferlist[2].iov_base = &aligned_data;
- 	bufferlist[2].iov_len = (packetlen_aligned - packetlen);
- 
--	ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3,
--				  &signal, lock, channel->signal_policy);
--
--	if (ret == 0 && signal)
--		vmbus_setevent(channel);
--
--	return ret;
-+	return hv_ringbuffer_write(channel, bufferlist, 3,
-+				   lock, true);
- }
- EXPORT_SYMBOL_GPL(vmbus_sendpacket_mpb_desc);
- 
-@@ -866,14 +811,12 @@ int vmbus_sendpacket_multipagebuffer(struct vmbus_channel *channel,
- 				struct hv_multipage_buffer *multi_pagebuffer,
- 				void *buffer, u32 bufferlen, u64 requestid)
- {
--	int ret;
- 	struct vmbus_channel_packet_multipage_buffer desc;
- 	u32 descsize;
- 	u32 packetlen;
- 	u32 packetlen_aligned;
- 	struct kvec bufferlist[3];
- 	u64 aligned_data = 0;
--	bool signal = false;
- 	bool lock = channel->acquire_ring_lock;
- 	u32 pfncount = NUM_PAGES_SPANNED(multi_pagebuffer->offset,
- 					 multi_pagebuffer->len);
-@@ -913,13 +856,8 @@ int vmbus_sendpacket_multipagebuffer(struct vmbus_channel *channel,
- 	bufferlist[2].iov_base = &aligned_data;
- 	bufferlist[2].iov_len = (packetlen_aligned - packetlen);
- 
--	ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3,
--				  &signal, lock, channel->signal_policy);
--
--	if (ret == 0 && signal)
--		vmbus_setevent(channel);
--
--	return ret;
-+	return hv_ringbuffer_write(channel, bufferlist, 3,
-+				   lock, true);
- }
- EXPORT_SYMBOL_GPL(vmbus_sendpacket_multipagebuffer);
- 
-@@ -941,16 +879,9 @@ __vmbus_recvpacket(struct vmbus_channel *channel, void *buffer,
- 		   u32 bufferlen, u32 *buffer_actual_len, u64 *requestid,
- 		   bool raw)
- {
--	int ret;
--	bool signal = false;
-+	return hv_ringbuffer_read(channel, buffer, bufferlen,
-+				  buffer_actual_len, requestid, raw);
- 
--	ret = hv_ringbuffer_read(&channel->inbound, buffer, bufferlen,
--				 buffer_actual_len, requestid, &signal, raw);
--
--	if (signal)
--		vmbus_setevent(channel);
--
--	return ret;
- }
- 
- int vmbus_recvpacket(struct vmbus_channel *channel, void *buffer,
-diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
-index 1bc1d479..caf3418 100644
---- a/drivers/hv/channel_mgmt.c
-+++ b/drivers/hv/channel_mgmt.c
-@@ -449,8 +449,6 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
- 	}
- 
- 	dev_type = hv_get_dev_type(newchannel);
--	if (dev_type == HV_NIC)
--		set_channel_signal_state(newchannel, HV_SIGNAL_POLICY_EXPLICIT);
- 
- 	init_vp_index(newchannel, dev_type);
- 
-diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
-index a5b4442..2b13f2a 100644
---- a/drivers/hv/hyperv_vmbus.h
-+++ b/drivers/hv/hyperv_vmbus.h
-@@ -527,14 +527,14 @@ int hv_ringbuffer_init(struct hv_ring_buffer_info *ring_info,
- 
- void hv_ringbuffer_cleanup(struct hv_ring_buffer_info *ring_info);
- 
--int hv_ringbuffer_write(struct hv_ring_buffer_info *ring_info,
-+int hv_ringbuffer_write(struct vmbus_channel *channel,
- 		    struct kvec *kv_list,
--		    u32 kv_count, bool *signal, bool lock,
--		    enum hv_signal_policy policy);
-+		    u32 kv_count, bool lock,
-+		    bool kick_q);
- 
--int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
-+int hv_ringbuffer_read(struct vmbus_channel *channel,
- 		       void *buffer, u32 buflen, u32 *buffer_actual_len,
--		       u64 *requestid, bool *signal, bool raw);
-+		       u64 *requestid, bool raw);
- 
- void hv_ringbuffer_get_debuginfo(struct hv_ring_buffer_info *ring_info,
- 			    struct hv_ring_buffer_debug_info *debug_info);
-diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
-index 08043da..308dbda 100644
---- a/drivers/hv/ring_buffer.c
-+++ b/drivers/hv/ring_buffer.c
-@@ -66,21 +66,25 @@ u32 hv_end_read(struct hv_ring_buffer_info *rbi)
-  *	   once the ring buffer is empty, it will clear the
-  *	   interrupt_mask and re-check to see if new data has
-  *	   arrived.
-+ *
-+ * KYS: Oct. 30, 2016:
-+ * It looks like Windows hosts have logic to deal with DOS attacks that
-+ * can be triggered if it receives interrupts when it is not expecting
-+ * the interrupt. The host expects interrupts only when the ring
-+ * transitions from empty to non-empty (or full to non full on the guest
-+ * to host ring).
-+ * So, base the signaling decision solely on the ring state until the
-+ * host logic is fixed.
-  */
- 
--static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi,
--			      enum hv_signal_policy policy)
-+static void hv_signal_on_write(u32 old_write, struct vmbus_channel *channel,
-+			       bool kick_q)
- {
-+	struct hv_ring_buffer_info *rbi = &channel->outbound;
-+
- 	virt_mb();
- 	if (READ_ONCE(rbi->ring_buffer->interrupt_mask))
--		return false;
--
--	/*
--	 * When the client wants to control signaling,
--	 * we only honour the host interrupt mask.
--	 */
--	if (policy == HV_SIGNAL_POLICY_EXPLICIT)
--		return true;
-+		return;
- 
- 	/* check interrupt_mask before read_index */
- 	virt_rmb();
-@@ -89,9 +93,9 @@ static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi,
- 	 * ring transitions from being empty to non-empty.
- 	 */
- 	if (old_write == READ_ONCE(rbi->ring_buffer->read_index))
--		return true;
-+		vmbus_setevent(channel);
- 
--	return false;
-+	return;
- }
- 
- /* Get the next write location for the specified ring buffer. */
-@@ -280,9 +284,9 @@ void hv_ringbuffer_cleanup(struct hv_ring_buffer_info *ring_info)
- }
- 
- /* Write to the ring buffer. */
--int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
--		    struct kvec *kv_list, u32 kv_count, bool *signal, bool lock,
--		    enum hv_signal_policy policy)
-+int hv_ringbuffer_write(struct vmbus_channel *channel,
-+		    struct kvec *kv_list, u32 kv_count, bool lock,
-+		    bool kick_q)
- {
- 	int i = 0;
- 	u32 bytes_avail_towrite;
-@@ -292,6 +296,7 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
- 	u32 old_write;
- 	u64 prev_indices = 0;
- 	unsigned long flags = 0;
-+	struct hv_ring_buffer_info *outring_info = &channel->outbound;
- 
- 	for (i = 0; i < kv_count; i++)
- 		totalbytes_towrite += kv_list[i].iov_len;
-@@ -344,13 +349,13 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
- 	if (lock)
- 		spin_unlock_irqrestore(&outring_info->ring_lock, flags);
- 
--	*signal = hv_need_to_signal(old_write, outring_info, policy);
-+	hv_signal_on_write(old_write, channel, kick_q);
- 	return 0;
- }
- 
--int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
-+int hv_ringbuffer_read(struct vmbus_channel *channel,
- 		       void *buffer, u32 buflen, u32 *buffer_actual_len,
--		       u64 *requestid, bool *signal, bool raw)
-+		       u64 *requestid, bool raw)
- {
- 	u32 bytes_avail_toread;
- 	u32 next_read_location = 0;
-@@ -359,6 +364,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
- 	u32 offset;
- 	u32 packetlen;
- 	int ret = 0;
-+	struct hv_ring_buffer_info *inring_info = &channel->inbound;
- 
- 	if (buflen <= 0)
- 		return -EINVAL;
-@@ -377,6 +383,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
- 		return ret;
- 	}
- 
-+	init_cached_read_index(channel);
- 	next_read_location = hv_get_next_read_location(inring_info);
- 	next_read_location = hv_copyfrom_ringbuffer(inring_info, &desc,
- 						    sizeof(desc),
-@@ -416,7 +423,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
- 	/* Update the read index */
- 	hv_set_next_read_location(inring_info, next_read_location);
- 
--	*signal = hv_need_to_signal_on_read(inring_info);
-+	hv_signal_on_read(channel);
- 
- 	return ret;
- }
-diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
-index 1869152..9b732c5 100644
---- a/drivers/infiniband/sw/rxe/rxe_mr.c
-+++ b/drivers/infiniband/sw/rxe/rxe_mr.c
-@@ -59,9 +59,11 @@ int mem_check_range(struct rxe_mem *mem, u64 iova, size_t length)
- 
- 	case RXE_MEM_TYPE_MR:
- 	case RXE_MEM_TYPE_FMR:
--		return ((iova < mem->iova) ||
--			((iova + length) > (mem->iova + mem->length))) ?
--			-EFAULT : 0;
-+		if (iova < mem->iova ||
-+		    length > mem->length ||
-+		    iova > mem->iova + mem->length - length)
-+			return -EFAULT;
-+		return 0;
- 
- 	default:
- 		return -EFAULT;
-diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
-index dd3d88a..ccf6247 100644
---- a/drivers/infiniband/sw/rxe/rxe_resp.c
-+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
-@@ -472,7 +472,7 @@ static enum resp_states check_rkey(struct rxe_qp *qp,
- 				goto err2;
- 			}
- 
--			resid = mtu;
-+			qp->resp.resid = mtu;
- 		} else {
- 			if (pktlen != resid) {
- 				state = RESPST_ERR_LENGTH;
-diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
-index 92595b9..022be0e 100644
---- a/drivers/input/misc/uinput.c
-+++ b/drivers/input/misc/uinput.c
-@@ -263,13 +263,21 @@ static int uinput_create_device(struct uinput_device *udev)
- 		return -EINVAL;
- 	}
- 
--	if (test_bit(ABS_MT_SLOT, dev->absbit)) {
--		nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
--		error = input_mt_init_slots(dev, nslot, 0);
--		if (error)
-+	if (test_bit(EV_ABS, dev->evbit)) {
-+		input_alloc_absinfo(dev);
-+		if (!dev->absinfo) {
-+			error = -EINVAL;
- 			goto fail1;
--	} else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
--		input_set_events_per_packet(dev, 60);
-+		}
-+
-+		if (test_bit(ABS_MT_SLOT, dev->absbit)) {
-+			nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
-+			error = input_mt_init_slots(dev, nslot, 0);
-+			if (error)
-+				goto fail1;
-+		} else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
-+			input_set_events_per_packet(dev, 60);
-+		}
- 	}
- 
- 	if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) {
-diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
-index 31a89c8..2c96542 100644
---- a/drivers/md/dm-rq.c
-+++ b/drivers/md/dm-rq.c
-@@ -804,6 +804,10 @@ static void dm_old_request_fn(struct request_queue *q)
- 		int srcu_idx;
- 		struct dm_table *map = dm_get_live_table(md, &srcu_idx);
- 
-+		if (unlikely(!map)) {
-+			dm_put_live_table(md, srcu_idx);
-+			return;
-+		}
- 		ti = dm_table_find_target(map, pos);
- 		dm_put_live_table(md, srcu_idx);
- 	}
-diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
-index 878950a..2cf8b1d 100644
---- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
-+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
-@@ -1007,9 +1007,7 @@
- 
- static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
- {
--	u8 __iomem *reg_addr = ACCESS_ONCE(base);
--
--	writel(value, reg_addr + reg);
-+	writel(value, base + reg);
- }
- 
- #define dsaf_write_dev(a, reg, value) \
-@@ -1017,9 +1015,7 @@ static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
- 
- static inline u32 dsaf_read_reg(u8 __iomem *base, u32 reg)
- {
--	u8 __iomem *reg_addr = ACCESS_ONCE(base);
--
--	return readl(reg_addr + reg);
-+	return readl(base + reg);
- }
- 
- static inline void dsaf_write_syscon(struct regmap *base, u32 reg, u32 value)
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
-index 27ff401..51c6a57 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
-@@ -991,6 +991,7 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
- {
- 	struct mlx5e_priv *priv = netdev_priv(dev);
- 	int inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
-+	bool hash_changed = false;
- 	void *in;
- 
- 	if ((hfunc != ETH_RSS_HASH_NO_CHANGE) &&
-@@ -1012,14 +1013,21 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
- 		mlx5e_redirect_rqt(priv, rqtn, MLX5E_INDIR_RQT_SIZE, 0);
- 	}
- 
--	if (key)
-+	if (hfunc != ETH_RSS_HASH_NO_CHANGE &&
-+	    hfunc != priv->params.rss_hfunc) {
-+		priv->params.rss_hfunc = hfunc;
-+		hash_changed = true;
-+	}
-+
-+	if (key) {
- 		memcpy(priv->params.toeplitz_hash_key, key,
- 		       sizeof(priv->params.toeplitz_hash_key));
-+		hash_changed = hash_changed ||
-+			       priv->params.rss_hfunc == ETH_RSS_HASH_TOP;
-+	}
- 
--	if (hfunc != ETH_RSS_HASH_NO_CHANGE)
--		priv->params.rss_hfunc = hfunc;
--
--	mlx5e_modify_tirs_hash(priv, in, inlen);
-+	if (hash_changed)
-+		mlx5e_modify_tirs_hash(priv, in, inlen);
- 
- 	mutex_unlock(&priv->state_lock);
- 
-diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
-index 720b5fa..c2ac39a 100644
---- a/drivers/net/hyperv/netvsc.c
-+++ b/drivers/net/hyperv/netvsc.c
-@@ -1288,6 +1288,9 @@ void netvsc_channel_cb(void *context)
- 	ndev = hv_get_drvdata(device);
- 	buffer = get_per_channel_state(channel);
- 
-+	/* commit_rd_index() -> hv_signal_on_read() needs this. */
-+	init_cached_read_index(channel);
-+
- 	do {
- 		desc = get_next_pkt_raw(channel);
- 		if (desc != NULL) {
-@@ -1340,6 +1343,9 @@ void netvsc_channel_cb(void *context)
- 
- 			bufferlen = bytes_recvd;
- 		}
-+
-+		init_cached_read_index(channel);
-+
- 	} while (1);
- 
- 	if (bufferlen > NETVSC_PACKET_SIZE)
-diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
-index 8b6e37c..20bfb37 100644
---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
-+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
-@@ -96,7 +96,7 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
- 	struct rtl_priv *rtlpriv = rtl_priv(hw);
- 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
- 	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
--	char *fw_name = "rtlwifi/rtl8192cfwU.bin";
-+	char *fw_name;
- 
- 	rtl8192ce_bt_reg_init(hw);
- 
-@@ -168,8 +168,13 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
- 	}
- 
- 	/* request fw */
--	if (IS_81XXC_VENDOR_UMC_B_CUT(rtlhal->version))
-+	if (IS_VENDOR_UMC_A_CUT(rtlhal->version) &&
-+	    !IS_92C_SERIAL(rtlhal->version))
-+		fw_name = "rtlwifi/rtl8192cfwU.bin";
-+	else if (IS_81XXC_VENDOR_UMC_B_CUT(rtlhal->version))
- 		fw_name = "rtlwifi/rtl8192cfwU_B.bin";
-+	else
-+		fw_name = "rtlwifi/rtl8192cfw.bin";
- 
- 	rtlpriv->max_fw_size = 0x4000;
- 	pr_info("Using firmware %s\n", fw_name);
-diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
-index bf2744e..0cdcb21 100644
---- a/drivers/net/xen-netfront.c
-+++ b/drivers/net/xen-netfront.c
-@@ -1397,6 +1397,8 @@ static void xennet_disconnect_backend(struct netfront_info *info)
- 	for (i = 0; i < num_queues && info->queues; ++i) {
- 		struct netfront_queue *queue = &info->queues[i];
- 
-+		del_timer_sync(&queue->rx_refill_timer);
-+
- 		if (queue->tx_irq && (queue->tx_irq == queue->rx_irq))
- 			unbind_from_irqhandler(queue->tx_irq, queue);
- 		if (queue->tx_irq && (queue->tx_irq != queue->rx_irq)) {
-@@ -1751,7 +1753,6 @@ static void xennet_destroy_queues(struct netfront_info *info)
- 
- 		if (netif_running(info->netdev))
- 			napi_disable(&queue->napi);
--		del_timer_sync(&queue->rx_refill_timer);
- 		netif_napi_del(&queue->napi);
- 	}
- 
-diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
-index 1480734..aefca64 100644
---- a/drivers/nvdimm/namespace_devs.c
-+++ b/drivers/nvdimm/namespace_devs.c
-@@ -962,8 +962,8 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
- 	struct nvdimm_drvdata *ndd;
- 	struct nd_label_id label_id;
- 	u32 flags = 0, remainder;
-+	int rc, i, id = -1;
- 	u8 *uuid = NULL;
--	int rc, i;
- 
- 	if (dev->driver || ndns->claim)
- 		return -EBUSY;
-@@ -972,11 +972,13 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
- 		struct nd_namespace_pmem *nspm = to_nd_namespace_pmem(dev);
- 
- 		uuid = nspm->uuid;
-+		id = nspm->id;
- 	} else if (is_namespace_blk(dev)) {
- 		struct nd_namespace_blk *nsblk = to_nd_namespace_blk(dev);
- 
- 		uuid = nsblk->uuid;
- 		flags = NSLABEL_FLAG_LOCAL;
-+		id = nsblk->id;
- 	}
- 
- 	/*
-@@ -1039,10 +1041,11 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
- 
- 	/*
- 	 * Try to delete the namespace if we deleted all of its
--	 * allocation, this is not the seed device for the region, and
--	 * it is not actively claimed by a btt instance.
-+	 * allocation, this is not the seed or 0th device for the
-+	 * region, and it is not actively claimed by a btt, pfn, or dax
-+	 * instance.
- 	 */
--	if (val == 0 && nd_region->ns_seed != dev && !ndns->claim)
-+	if (val == 0 && id != 0 && nd_region->ns_seed != dev && !ndns->claim)
- 		nd_device_unregister(dev, ND_ASYNC);
- 
- 	return rc;
-diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
-index a2ac9e6..6c033c9 100644
---- a/drivers/nvdimm/pfn_devs.c
-+++ b/drivers/nvdimm/pfn_devs.c
-@@ -627,15 +627,12 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
- 	size = resource_size(&nsio->res);
- 	npfns = (size - start_pad - end_trunc - SZ_8K) / SZ_4K;
- 	if (nd_pfn->mode == PFN_MODE_PMEM) {
--		unsigned long memmap_size;
--
- 		/*
- 		 * vmemmap_populate_hugepages() allocates the memmap array in
- 		 * HPAGE_SIZE chunks.
- 		 */
--		memmap_size = ALIGN(64 * npfns, HPAGE_SIZE);
--		offset = ALIGN(start + SZ_8K + memmap_size + dax_label_reserve,
--				nd_pfn->align) - start;
-+		offset = ALIGN(start + SZ_8K + 64 * npfns + dax_label_reserve,
-+				max(nd_pfn->align, HPAGE_SIZE)) - start;
- 	} else if (nd_pfn->mode == PFN_MODE_RAM)
- 		offset = ALIGN(start + SZ_8K + dax_label_reserve,
- 				nd_pfn->align) - start;
-diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
-index 75f820ca..27ff38f 100644
---- a/drivers/s390/scsi/zfcp_fsf.c
-+++ b/drivers/s390/scsi/zfcp_fsf.c
-@@ -1583,7 +1583,7 @@ static void zfcp_fsf_open_wka_port_handler(struct zfcp_fsf_req *req)
- int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
- {
- 	struct zfcp_qdio *qdio = wka_port->adapter->qdio;
--	struct zfcp_fsf_req *req = NULL;
-+	struct zfcp_fsf_req *req;
- 	int retval = -EIO;
- 
- 	spin_lock_irq(&qdio->req_q_lock);
-@@ -1612,7 +1612,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
- 		zfcp_fsf_req_free(req);
- out:
- 	spin_unlock_irq(&qdio->req_q_lock);
--	if (req && !IS_ERR(req))
-+	if (!retval)
- 		zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id);
- 	return retval;
- }
-@@ -1638,7 +1638,7 @@ static void zfcp_fsf_close_wka_port_handler(struct zfcp_fsf_req *req)
- int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
- {
- 	struct zfcp_qdio *qdio = wka_port->adapter->qdio;
--	struct zfcp_fsf_req *req = NULL;
-+	struct zfcp_fsf_req *req;
- 	int retval = -EIO;
- 
- 	spin_lock_irq(&qdio->req_q_lock);
-@@ -1667,7 +1667,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
- 		zfcp_fsf_req_free(req);
- out:
- 	spin_unlock_irq(&qdio->req_q_lock);
--	if (req && !IS_ERR(req))
-+	if (!retval)
- 		zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req->req_id);
- 	return retval;
- }
-diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
-index 341ea32..792d3e7 100644
---- a/drivers/scsi/aacraid/comminit.c
-+++ b/drivers/scsi/aacraid/comminit.c
-@@ -50,9 +50,13 @@ struct aac_common aac_config = {
- 
- static inline int aac_is_msix_mode(struct aac_dev *dev)
- {
--	u32 status;
-+	u32 status = 0;
- 
--	status = src_readl(dev, MUnit.OMR);
-+	if (dev->pdev->device == PMC_DEVICE_S6 ||
-+		dev->pdev->device == PMC_DEVICE_S7 ||
-+		dev->pdev->device == PMC_DEVICE_S8) {
-+		status = src_readl(dev, MUnit.OMR);
-+	}
- 	return (status & AAC_INT_MODE_MSIX);
- }
- 
-diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
-index e3b911c..91dfd58 100644
---- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
-+++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
-@@ -3929,6 +3929,7 @@ static struct configfs_attribute *ibmvscsis_tpg_attrs[] = {
- static const struct target_core_fabric_ops ibmvscsis_ops = {
- 	.module				= THIS_MODULE,
- 	.name				= "ibmvscsis",
-+	.max_data_sg_nents		= MAX_TXU / PAGE_SIZE,
- 	.get_fabric_name		= ibmvscsis_get_fabric_name,
- 	.tpg_get_wwn			= ibmvscsis_get_fabric_wwn,
- 	.tpg_get_tag			= ibmvscsis_get_tag,
-diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
-index f84a608..8a7941b 100644
---- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
-+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
-@@ -51,6 +51,7 @@
- #include <linux/workqueue.h>
- #include <linux/delay.h>
- #include <linux/pci.h>
-+#include <linux/pci-aspm.h>
- #include <linux/interrupt.h>
- #include <linux/aer.h>
- #include <linux/raid_class.h>
-@@ -8706,6 +8707,8 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
- 
- 	switch (hba_mpi_version) {
- 	case MPI2_VERSION:
-+		pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S |
-+			PCIE_LINK_STATE_L1 | PCIE_LINK_STATE_CLKPM);
- 		/* Use mpt2sas driver host template for SAS 2.0 HBA's */
- 		shost = scsi_host_alloc(&mpt2sas_driver_template,
- 		  sizeof(struct MPT3SAS_ADAPTER));
-diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
-index 078d797..bea819e 100644
---- a/drivers/scsi/qla2xxx/qla_os.c
-+++ b/drivers/scsi/qla2xxx/qla_os.c
-@@ -1459,7 +1459,7 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
- 				/* Don't abort commands in adapter during EEH
- 				 * recovery as it's not accessible/responding.
- 				 */
--				if (!ha->flags.eeh_busy) {
-+				if (GET_CMD_SP(sp) && !ha->flags.eeh_busy) {
- 					/* Get a reference to the sp and drop the lock.
- 					 * The reference ensures this sp->done() call
- 					 * - and not the call in qla2xxx_eh_abort() -
-diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
-index 6b42348..ea9617c 100644
---- a/drivers/target/target_core_device.c
-+++ b/drivers/target/target_core_device.c
-@@ -351,7 +351,15 @@ int core_enable_device_list_for_node(
- 			kfree(new);
- 			return -EINVAL;
- 		}
--		BUG_ON(orig->se_lun_acl != NULL);
-+		if (orig->se_lun_acl != NULL) {
-+			pr_warn_ratelimited("Detected existing explicit"
-+				" se_lun_acl->se_lun_group reference for %s"
-+				" mapped_lun: %llu, failing\n",
-+				 nacl->initiatorname, mapped_lun);
-+			mutex_unlock(&nacl->lun_entry_mutex);
-+			kfree(new);
-+			return -EINVAL;
-+		}
- 
- 		rcu_assign_pointer(new->se_lun, lun);
- 		rcu_assign_pointer(new->se_lun_acl, lun_acl);
-diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
-index 04f616b..aabd660 100644
---- a/drivers/target/target_core_sbc.c
-+++ b/drivers/target/target_core_sbc.c
-@@ -450,6 +450,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
- 					     int *post_ret)
- {
- 	struct se_device *dev = cmd->se_dev;
-+	sense_reason_t ret = TCM_NO_SENSE;
- 
- 	/*
- 	 * Only set SCF_COMPARE_AND_WRITE_POST to force a response fall-through
-@@ -457,9 +458,12 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
- 	 * sent to the backend driver.
- 	 */
- 	spin_lock_irq(&cmd->t_state_lock);
--	if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) {
-+	if (cmd->transport_state & CMD_T_SENT) {
- 		cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
- 		*post_ret = 1;
-+
-+		if (cmd->scsi_status == SAM_STAT_CHECK_CONDITION)
-+			ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
- 	}
- 	spin_unlock_irq(&cmd->t_state_lock);
- 
-@@ -469,7 +473,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
- 	 */
- 	up(&dev->caw_sem);
- 
--	return TCM_NO_SENSE;
-+	return ret;
- }
- 
- static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success,
-diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index 7dfefd6..767d1eb6 100644
---- a/drivers/target/target_core_transport.c
-+++ b/drivers/target/target_core_transport.c
-@@ -457,8 +457,20 @@ static void target_complete_nacl(struct kref *kref)
- {
- 	struct se_node_acl *nacl = container_of(kref,
- 				struct se_node_acl, acl_kref);
-+	struct se_portal_group *se_tpg = nacl->se_tpg;
- 
--	complete(&nacl->acl_free_comp);
-+	if (!nacl->dynamic_stop) {
-+		complete(&nacl->acl_free_comp);
-+		return;
-+	}
-+
-+	mutex_lock(&se_tpg->acl_node_mutex);
-+	list_del(&nacl->acl_list);
-+	mutex_unlock(&se_tpg->acl_node_mutex);
-+
-+	core_tpg_wait_for_nacl_pr_ref(nacl);
-+	core_free_device_list_for_node(nacl, se_tpg);
-+	kfree(nacl);
- }
- 
- void target_put_nacl(struct se_node_acl *nacl)
-@@ -499,12 +511,39 @@ EXPORT_SYMBOL(transport_deregister_session_configfs);
- void transport_free_session(struct se_session *se_sess)
- {
- 	struct se_node_acl *se_nacl = se_sess->se_node_acl;
-+
- 	/*
- 	 * Drop the se_node_acl->nacl_kref obtained from within
- 	 * core_tpg_get_initiator_node_acl().
- 	 */
- 	if (se_nacl) {
-+		struct se_portal_group *se_tpg = se_nacl->se_tpg;
-+		const struct target_core_fabric_ops *se_tfo = se_tpg->se_tpg_tfo;
-+		unsigned long flags;
-+
- 		se_sess->se_node_acl = NULL;
-+
-+		/*
-+		 * Also determine if we need to drop the extra ->cmd_kref if
-+		 * it had been previously dynamically generated, and
-+		 * the endpoint is not caching dynamic ACLs.
-+		 */
-+		mutex_lock(&se_tpg->acl_node_mutex);
-+		if (se_nacl->dynamic_node_acl &&
-+		    !se_tfo->tpg_check_demo_mode_cache(se_tpg)) {
-+			spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags);
-+			if (list_empty(&se_nacl->acl_sess_list))
-+				se_nacl->dynamic_stop = true;
-+			spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags);
-+
-+			if (se_nacl->dynamic_stop)
-+				list_del(&se_nacl->acl_list);
-+		}
-+		mutex_unlock(&se_tpg->acl_node_mutex);
-+
-+		if (se_nacl->dynamic_stop)
-+			target_put_nacl(se_nacl);
-+
- 		target_put_nacl(se_nacl);
- 	}
- 	if (se_sess->sess_cmd_map) {
-@@ -518,16 +557,12 @@ EXPORT_SYMBOL(transport_free_session);
- void transport_deregister_session(struct se_session *se_sess)
- {
- 	struct se_portal_group *se_tpg = se_sess->se_tpg;
--	const struct target_core_fabric_ops *se_tfo;
--	struct se_node_acl *se_nacl;
- 	unsigned long flags;
--	bool drop_nacl = false;
- 
- 	if (!se_tpg) {
- 		transport_free_session(se_sess);
- 		return;
- 	}
--	se_tfo = se_tpg->se_tpg_tfo;
- 
- 	spin_lock_irqsave(&se_tpg->session_lock, flags);
- 	list_del(&se_sess->sess_list);
-@@ -535,33 +570,15 @@ void transport_deregister_session(struct se_session *se_sess)
- 	se_sess->fabric_sess_ptr = NULL;
- 	spin_unlock_irqrestore(&se_tpg->session_lock, flags);
- 
--	/*
--	 * Determine if we need to do extra work for this initiator node's
--	 * struct se_node_acl if it had been previously dynamically generated.
--	 */
--	se_nacl = se_sess->se_node_acl;
--
--	mutex_lock(&se_tpg->acl_node_mutex);
--	if (se_nacl && se_nacl->dynamic_node_acl) {
--		if (!se_tfo->tpg_check_demo_mode_cache(se_tpg)) {
--			list_del(&se_nacl->acl_list);
--			drop_nacl = true;
--		}
--	}
--	mutex_unlock(&se_tpg->acl_node_mutex);
--
--	if (drop_nacl) {
--		core_tpg_wait_for_nacl_pr_ref(se_nacl);
--		core_free_device_list_for_node(se_nacl, se_tpg);
--		se_sess->se_node_acl = NULL;
--		kfree(se_nacl);
--	}
- 	pr_debug("TARGET_CORE[%s]: Deregistered fabric_sess\n",
- 		se_tpg->se_tpg_tfo->get_fabric_name());
- 	/*
- 	 * If last kref is dropping now for an explicit NodeACL, awake sleeping
- 	 * ->acl_free_comp caller to wakeup configfs se_node_acl->acl_group
- 	 * removal context from within transport_free_session() code.
-+	 *
-+	 * For dynamic ACL, target_put_nacl() uses target_complete_nacl()
-+	 * to release all remaining generate_node_acl=1 created ACL resources.
- 	 */
- 
- 	transport_free_session(se_sess);
-@@ -3086,7 +3103,6 @@ static void target_tmr_work(struct work_struct *work)
- 		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
- 		goto check_stop;
- 	}
--	cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
- 	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
- 
- 	cmd->se_tfo->queue_tm_rsp(cmd);
-@@ -3099,11 +3115,25 @@ int transport_generic_handle_tmr(
- 	struct se_cmd *cmd)
- {
- 	unsigned long flags;
-+	bool aborted = false;
- 
- 	spin_lock_irqsave(&cmd->t_state_lock, flags);
--	cmd->transport_state |= CMD_T_ACTIVE;
-+	if (cmd->transport_state & CMD_T_ABORTED) {
-+		aborted = true;
-+	} else {
-+		cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
-+		cmd->transport_state |= CMD_T_ACTIVE;
-+	}
- 	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
- 
-+	if (aborted) {
-+		pr_warn_ratelimited("handle_tmr caught CMD_T_ABORTED TMR %d"
-+			"ref_tag: %llu tag: %llu\n", cmd->se_tmr_req->function,
-+			cmd->se_tmr_req->ref_task_tag, cmd->tag);
-+		transport_cmd_check_stop_to_fabric(cmd);
-+		return 0;
-+	}
-+
- 	INIT_WORK(&cmd->work, target_tmr_work);
- 	queue_work(cmd->se_dev->tmr_wq, &cmd->work);
- 	return 0;
-diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
-index 094a144..18848ba 100644
---- a/drivers/target/target_core_xcopy.c
-+++ b/drivers/target/target_core_xcopy.c
-@@ -836,7 +836,7 @@ static void target_xcopy_do_work(struct work_struct *work)
- 			" CHECK_CONDITION -> sending response\n", rc);
- 		ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
- 	}
--	target_complete_cmd(ec_cmd, SAM_STAT_CHECK_CONDITION);
-+	target_complete_cmd(ec_cmd, ec_cmd->scsi_status);
- }
- 
- sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
-diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index 7acbd2c..1782804 100644
---- a/fs/btrfs/ioctl.c
-+++ b/fs/btrfs/ioctl.c
-@@ -5648,6 +5648,10 @@ long btrfs_ioctl(struct file *file, unsigned int
- #ifdef CONFIG_COMPAT
- long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
- {
-+	/*
-+	 * These all access 32-bit values anyway so no further
-+	 * handling is necessary.
-+	 */
- 	switch (cmd) {
- 	case FS_IOC32_GETFLAGS:
- 		cmd = FS_IOC_GETFLAGS;
-@@ -5658,8 +5662,6 @@ long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
- 	case FS_IOC32_GETVERSION:
- 		cmd = FS_IOC_GETVERSION;
- 		break;
--	default:
--		return -ENOIOCTLCMD;
- 	}
- 
- 	return btrfs_ioctl(file, cmd, (unsigned long) compat_ptr(arg));
-diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
-index da7fbf1..fa3b155 100644
---- a/include/linux/cpumask.h
-+++ b/include/linux/cpumask.h
-@@ -560,7 +560,7 @@ static inline void cpumask_copy(struct cpumask *dstp,
- static inline int cpumask_parse_user(const char __user *buf, int len,
- 				     struct cpumask *dstp)
- {
--	return bitmap_parse_user(buf, len, cpumask_bits(dstp), nr_cpu_ids);
-+	return bitmap_parse_user(buf, len, cpumask_bits(dstp), nr_cpumask_bits);
- }
- 
- /**
-@@ -575,7 +575,7 @@ static inline int cpumask_parselist_user(const char __user *buf, int len,
- 				     struct cpumask *dstp)
- {
- 	return bitmap_parselist_user(buf, len, cpumask_bits(dstp),
--				     nr_cpu_ids);
-+				     nr_cpumask_bits);
- }
- 
- /**
-@@ -590,7 +590,7 @@ static inline int cpumask_parse(const char *buf, struct cpumask *dstp)
- 	char *nl = strchr(buf, '\n');
- 	unsigned int len = nl ? (unsigned int)(nl - buf) : strlen(buf);
- 
--	return bitmap_parse(buf, len, cpumask_bits(dstp), nr_cpu_ids);
-+	return bitmap_parse(buf, len, cpumask_bits(dstp), nr_cpumask_bits);
- }
- 
- /**
-@@ -602,7 +602,7 @@ static inline int cpumask_parse(const char *buf, struct cpumask *dstp)
-  */
- static inline int cpulist_parse(const char *buf, struct cpumask *dstp)
- {
--	return bitmap_parselist(buf, cpumask_bits(dstp), nr_cpu_ids);
-+	return bitmap_parselist(buf, cpumask_bits(dstp), nr_cpumask_bits);
- }
- 
- /**
-diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
-index cd184bd..c92a083 100644
---- a/include/linux/hyperv.h
-+++ b/include/linux/hyperv.h
-@@ -128,6 +128,7 @@ struct hv_ring_buffer_info {
- 	u32 ring_data_startoffset;
- 	u32 priv_write_index;
- 	u32 priv_read_index;
-+	u32 cached_read_index;
- };
- 
- /*
-@@ -180,6 +181,19 @@ static inline u32 hv_get_bytes_to_write(struct hv_ring_buffer_info *rbi)
- 	return write;
- }
- 
-+static inline u32 hv_get_cached_bytes_to_write(
-+	const struct hv_ring_buffer_info *rbi)
-+{
-+	u32 read_loc, write_loc, dsize, write;
-+
-+	dsize = rbi->ring_datasize;
-+	read_loc = rbi->cached_read_index;
-+	write_loc = rbi->ring_buffer->write_index;
-+
-+	write = write_loc >= read_loc ? dsize - (write_loc - read_loc) :
-+		read_loc - write_loc;
-+	return write;
-+}
- /*
-  * VMBUS version is 32 bit entity broken up into
-  * two 16 bit quantities: major_number. minor_number.
-@@ -1447,6 +1461,7 @@ void hv_event_tasklet_enable(struct vmbus_channel *channel);
- 
- void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid);
- 
-+void vmbus_setevent(struct vmbus_channel *channel);
- /*
-  * Negotiated version with the Host.
-  */
-@@ -1479,10 +1494,11 @@ hv_get_ring_buffer(struct hv_ring_buffer_info *ring_info)
-  *    there is room for the producer to send the pending packet.
-  */
- 
--static inline  bool hv_need_to_signal_on_read(struct hv_ring_buffer_info *rbi)
-+static inline  void hv_signal_on_read(struct vmbus_channel *channel)
- {
--	u32 cur_write_sz;
-+	u32 cur_write_sz, cached_write_sz;
- 	u32 pending_sz;
-+	struct hv_ring_buffer_info *rbi = &channel->inbound;
- 
- 	/*
- 	 * Issue a full memory barrier before making the signaling decision.
-@@ -1500,14 +1516,26 @@ static inline  bool hv_need_to_signal_on_read(struct hv_ring_buffer_info *rbi)
- 	pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);
- 	/* If the other end is not blocked on write don't bother. */
- 	if (pending_sz == 0)
--		return false;
-+		return;
- 
- 	cur_write_sz = hv_get_bytes_to_write(rbi);
- 
--	if (cur_write_sz >= pending_sz)
--		return true;
-+	if (cur_write_sz < pending_sz)
-+		return;
-+
-+	cached_write_sz = hv_get_cached_bytes_to_write(rbi);
-+	if (cached_write_sz < pending_sz)
-+		vmbus_setevent(channel);
-+
-+	return;
-+}
-+
-+static inline void
-+init_cached_read_index(struct vmbus_channel *channel)
-+{
-+	struct hv_ring_buffer_info *rbi = &channel->inbound;
- 
--	return false;
-+	rbi->cached_read_index = rbi->ring_buffer->read_index;
- }
- 
- /*
-@@ -1571,6 +1599,8 @@ static inline void put_pkt_raw(struct vmbus_channel *channel,
-  * This call commits the read index and potentially signals the host.
-  * Here is the pattern for using the "in-place" consumption APIs:
-  *
-+ * init_cached_read_index();
-+ *
-  * while (get_next_pkt_raw() {
-  *	process the packet "in-place";
-  *	put_pkt_raw();
-@@ -1589,8 +1619,7 @@ static inline void commit_rd_index(struct vmbus_channel *channel)
- 	virt_rmb();
- 	ring_info->ring_buffer->read_index = ring_info->priv_read_index;
- 
--	if (hv_need_to_signal_on_read(ring_info))
--		vmbus_set_event(channel);
-+	hv_signal_on_read(channel);
- }
- 
- 
-diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
-index c211900..48bc1ac 100644
---- a/include/target/target_core_base.h
-+++ b/include/target/target_core_base.h
-@@ -538,6 +538,7 @@ struct se_node_acl {
- 	char			initiatorname[TRANSPORT_IQN_LEN];
- 	/* Used to signal demo mode created ACL, disabled by default */
- 	bool			dynamic_node_acl;
-+	bool			dynamic_stop;
- 	u32			queue_depth;
- 	u32			acl_index;
- 	enum target_prot_type	saved_prot_type;
-diff --git a/kernel/events/core.c b/kernel/events/core.c
-index b1cfd74..4b33231 100644
---- a/kernel/events/core.c
-+++ b/kernel/events/core.c
-@@ -3461,14 +3461,15 @@ struct perf_read_data {
- 	int ret;
- };
- 
--static int find_cpu_to_read(struct perf_event *event, int local_cpu)
-+static int __perf_event_read_cpu(struct perf_event *event, int event_cpu)
- {
--	int event_cpu = event->oncpu;
- 	u16 local_pkg, event_pkg;
- 
- 	if (event->group_caps & PERF_EV_CAP_READ_ACTIVE_PKG) {
--		event_pkg =  topology_physical_package_id(event_cpu);
--		local_pkg =  topology_physical_package_id(local_cpu);
-+		int local_cpu = smp_processor_id();
-+
-+		event_pkg = topology_physical_package_id(event_cpu);
-+		local_pkg = topology_physical_package_id(local_cpu);
- 
- 		if (event_pkg == local_pkg)
- 			return local_cpu;
-@@ -3598,7 +3599,7 @@ u64 perf_event_read_local(struct perf_event *event)
- 
- static int perf_event_read(struct perf_event *event, bool group)
- {
--	int ret = 0, cpu_to_read, local_cpu;
-+	int event_cpu, ret = 0;
- 
- 	/*
- 	 * If event is enabled and currently active on a CPU, update the
-@@ -3611,21 +3612,25 @@ static int perf_event_read(struct perf_event *event, bool group)
- 			.ret = 0,
- 		};
- 
--		local_cpu = get_cpu();
--		cpu_to_read = find_cpu_to_read(event, local_cpu);
--		put_cpu();
-+		event_cpu = READ_ONCE(event->oncpu);
-+		if ((unsigned)event_cpu >= nr_cpu_ids)
-+			return 0;
-+
-+		preempt_disable();
-+		event_cpu = __perf_event_read_cpu(event, event_cpu);
- 
- 		/*
- 		 * Purposely ignore the smp_call_function_single() return
- 		 * value.
- 		 *
--		 * If event->oncpu isn't a valid CPU it means the event got
-+		 * If event_cpu isn't a valid CPU it means the event got
- 		 * scheduled out and that will have updated the event count.
- 		 *
- 		 * Therefore, either way, we'll have an up-to-date event count
- 		 * after this.
- 		 */
--		(void)smp_call_function_single(cpu_to_read, __perf_event_read, &data, 1);
-+		(void)smp_call_function_single(event_cpu, __perf_event_read, &data, 1);
-+		preempt_enable();
- 		ret = data.ret;
- 	} else if (event->state == PERF_EVENT_STATE_INACTIVE) {
- 		struct perf_event_context *ctx = event->ctx;
-diff --git a/kernel/stacktrace.c b/kernel/stacktrace.c
-index b6e4c16..9c15a91 100644
---- a/kernel/stacktrace.c
-+++ b/kernel/stacktrace.c
-@@ -18,10 +18,8 @@ void print_stack_trace(struct stack_trace *trace, int spaces)
- 	if (WARN_ON(!trace->entries))
- 		return;
- 
--	for (i = 0; i < trace->nr_entries; i++) {
--		printk("%*c", 1 + spaces, ' ');
--		print_ip_sym(trace->entries[i]);
--	}
-+	for (i = 0; i < trace->nr_entries; i++)
-+		printk("%*c%pS\n", 1 + spaces, ' ', (void *)trace->entries[i]);
- }
- EXPORT_SYMBOL_GPL(print_stack_trace);
- 
-@@ -29,7 +27,6 @@ int snprint_stack_trace(char *buf, size_t size,
- 			struct stack_trace *trace, int spaces)
- {
- 	int i;
--	unsigned long ip;
- 	int generated;
- 	int total = 0;
- 
-@@ -37,9 +34,8 @@ int snprint_stack_trace(char *buf, size_t size,
- 		return 0;
- 
- 	for (i = 0; i < trace->nr_entries; i++) {
--		ip = trace->entries[i];
--		generated = snprintf(buf, size, "%*c[<%p>] %pS\n",
--				1 + spaces, ' ', (void *) ip, (void *) ip);
-+		generated = snprintf(buf, size, "%*c%pS\n", 1 + spaces, ' ',
-+				     (void *)trace->entries[i]);
- 
- 		total += generated;
- 
-diff --git a/mm/slub.c b/mm/slub.c
-index 2b3e740..7aa0e97 100644
---- a/mm/slub.c
-+++ b/mm/slub.c
-@@ -1419,6 +1419,10 @@ static int init_cache_random_seq(struct kmem_cache *s)
- 	int err;
- 	unsigned long i, count = oo_objects(s->oo);
- 
-+	/* Bailout if already initialised */
-+	if (s->random_seq)
-+		return 0;
-+
- 	err = cache_random_seq_create(s, count, GFP_KERNEL);
- 	if (err) {
- 		pr_err("SLUB: Unable to initialize free list for %s\n",
-diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
-index 42120d9..50e1b7f 100644
---- a/net/mac80211/mesh.c
-+++ b/net/mac80211/mesh.c
-@@ -339,7 +339,7 @@ int mesh_add_vendor_ies(struct ieee80211_sub_if_data *sdata,
- 	/* fast-forward to vendor IEs */
- 	offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0);
- 
--	if (offset) {
-+	if (offset < ifmsh->ie_len) {
- 		len = ifmsh->ie_len - offset;
- 		data = ifmsh->ie + offset;
- 		if (skb_tailroom(skb) < len)
-diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
-index 1b3c18c..cd7a419 100644
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -5874,6 +5874,7 @@ do {									    \
- 			break;
- 		}
- 		cfg->ht_opmode = ht_opmode;
-+		mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
- 	}
- 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
- 				  1, 65535, mask,
-diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
-index 09fd610..c2da45a 100644
---- a/security/selinux/hooks.c
-+++ b/security/selinux/hooks.c
-@@ -5858,7 +5858,7 @@ static int selinux_setprocattr(struct task_struct *p,
- 		return error;
- 
- 	/* Obtain a SID for the context, if one was specified. */
--	if (size && str[1] && str[1] != '\n') {
-+	if (size && str[0] && str[0] != '\n') {
- 		if (str[size-1] == '\n') {
- 			str[size-1] = 0;
- 			size--;
-diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
-index c850345..dfa5156 100644
---- a/sound/core/seq/seq_memory.c
-+++ b/sound/core/seq/seq_memory.c
-@@ -419,7 +419,6 @@ int snd_seq_pool_done(struct snd_seq_pool *pool)
- {
- 	unsigned long flags;
- 	struct snd_seq_event_cell *ptr;
--	int max_count = 5 * HZ;
- 
- 	if (snd_BUG_ON(!pool))
- 		return -EINVAL;
-@@ -432,14 +431,8 @@ int snd_seq_pool_done(struct snd_seq_pool *pool)
- 	if (waitqueue_active(&pool->output_sleep))
- 		wake_up(&pool->output_sleep);
- 
--	while (atomic_read(&pool->counter) > 0) {
--		if (max_count == 0) {
--			pr_warn("ALSA: snd_seq_pool_done timeout: %d cells remain\n", atomic_read(&pool->counter));
--			break;
--		}
-+	while (atomic_read(&pool->counter) > 0)
- 		schedule_timeout_uninterruptible(1);
--		max_count--;
--	}
- 	
- 	/* release all resources */
- 	spin_lock_irqsave(&pool->lock, flags);
-diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
-index 0bec02e..450c518 100644
---- a/sound/core/seq/seq_queue.c
-+++ b/sound/core/seq/seq_queue.c
-@@ -181,6 +181,8 @@ void __exit snd_seq_queues_delete(void)
- 	}
- }
- 
-+static void queue_use(struct snd_seq_queue *queue, int client, int use);
-+
- /* allocate a new queue -
-  * return queue index value or negative value for error
-  */
-@@ -192,11 +194,11 @@ int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)
- 	if (q == NULL)
- 		return -ENOMEM;
- 	q->info_flags = info_flags;
-+	queue_use(q, client, 1);
- 	if (queue_list_add(q) < 0) {
- 		queue_delete(q);
- 		return -ENOMEM;
- 	}
--	snd_seq_queue_use(q->queue, client, 1); /* use this queue */
- 	return q->queue;
- }
- 
-@@ -502,19 +504,9 @@ int snd_seq_queue_timer_set_tempo(int queueid, int client,
- 	return result;
- }
- 
--
--/* use or unuse this queue -
-- * if it is the first client, starts the timer.
-- * if it is not longer used by any clients, stop the timer.
-- */
--int snd_seq_queue_use(int queueid, int client, int use)
-+/* use or unuse this queue */
-+static void queue_use(struct snd_seq_queue *queue, int client, int use)
- {
--	struct snd_seq_queue *queue;
--
--	queue = queueptr(queueid);
--	if (queue == NULL)
--		return -EINVAL;
--	mutex_lock(&queue->timer_mutex);
- 	if (use) {
- 		if (!test_and_set_bit(client, queue->clients_bitmap))
- 			queue->clients++;
-@@ -529,6 +521,21 @@ int snd_seq_queue_use(int queueid, int client, int use)
- 	} else {
- 		snd_seq_timer_close(queue);
- 	}
-+}
-+
-+/* use or unuse this queue -
-+ * if it is the first client, starts the timer.
-+ * if it is not longer used by any clients, stop the timer.
-+ */
-+int snd_seq_queue_use(int queueid, int client, int use)
-+{
-+	struct snd_seq_queue *queue;
-+
-+	queue = queueptr(queueid);
-+	if (queue == NULL)
-+		return -EINVAL;
-+	mutex_lock(&queue->timer_mutex);
-+	queue_use(queue, client, use);
- 	mutex_unlock(&queue->timer_mutex);
- 	queuefree(queue);
- 	return 0;
-diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
-index 56e5204..4bf4833 100644
---- a/sound/pci/hda/patch_hdmi.c
-+++ b/sound/pci/hda/patch_hdmi.c
-@@ -3638,6 +3638,7 @@ HDA_CODEC_ENTRY(0x10de0070, "GPU 70 HDMI/DP",	patch_nvhdmi),
- HDA_CODEC_ENTRY(0x10de0071, "GPU 71 HDMI/DP",	patch_nvhdmi),
- HDA_CODEC_ENTRY(0x10de0072, "GPU 72 HDMI/DP",	patch_nvhdmi),
- HDA_CODEC_ENTRY(0x10de007d, "GPU 7d HDMI/DP",	patch_nvhdmi),
-+HDA_CODEC_ENTRY(0x10de0080, "GPU 80 HDMI/DP",	patch_nvhdmi),
- HDA_CODEC_ENTRY(0x10de0082, "GPU 82 HDMI/DP",	patch_nvhdmi),
- HDA_CODEC_ENTRY(0x10de0083, "GPU 83 HDMI/DP",	patch_nvhdmi),
- HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI",	patch_nvhdmi_2ch),
-diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
-index 90009c0..ab3c280 100644
---- a/sound/usb/line6/driver.c
-+++ b/sound/usb/line6/driver.c
-@@ -754,8 +754,9 @@ int line6_probe(struct usb_interface *interface,
- 		goto error;
- 	}
- 
-+	line6_get_interval(line6);
-+
- 	if (properties->capabilities & LINE6_CAP_CONTROL) {
--		line6_get_interval(line6);
- 		ret = line6_init_cap_control(line6);
- 		if (ret < 0)
- 			goto error;
-diff --git a/tools/perf/builtin-diff.c b/tools/perf/builtin-diff.c
-index 9ff0db4..933aeec 100644
---- a/tools/perf/builtin-diff.c
-+++ b/tools/perf/builtin-diff.c
-@@ -1199,7 +1199,7 @@ static int ui_init(void)
- 		BUG_ON(1);
- 	}
- 
--	perf_hpp__register_sort_field(fmt);
-+	perf_hpp__prepend_sort_field(fmt);
- 	return 0;
- }
- 
-diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
-index 3738839..18cfcdc9 100644
---- a/tools/perf/ui/hist.c
-+++ b/tools/perf/ui/hist.c
-@@ -521,6 +521,12 @@ void perf_hpp_list__register_sort_field(struct perf_hpp_list *list,
- 	list_add_tail(&format->sort_list, &list->sorts);
- }
- 
-+void perf_hpp_list__prepend_sort_field(struct perf_hpp_list *list,
-+				       struct perf_hpp_fmt *format)
-+{
-+	list_add(&format->sort_list, &list->sorts);
-+}
-+
- void perf_hpp__column_unregister(struct perf_hpp_fmt *format)
- {
- 	list_del(&format->list);
-@@ -560,6 +566,10 @@ void perf_hpp__setup_output_field(struct perf_hpp_list *list)
- 	perf_hpp_list__for_each_sort_list(list, fmt) {
- 		struct perf_hpp_fmt *pos;
- 
-+		/* skip sort-only fields ("sort_compute" in perf diff) */
-+		if (!fmt->entry && !fmt->color)
-+			continue;
-+
- 		perf_hpp_list__for_each_format(list, pos) {
- 			if (fmt_equal(fmt, pos))
- 				goto next;
-diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
-index 9928fed..a440a04 100644
---- a/tools/perf/util/hist.h
-+++ b/tools/perf/util/hist.h
-@@ -282,6 +282,8 @@ void perf_hpp_list__column_register(struct perf_hpp_list *list,
- 				    struct perf_hpp_fmt *format);
- void perf_hpp_list__register_sort_field(struct perf_hpp_list *list,
- 					struct perf_hpp_fmt *format);
-+void perf_hpp_list__prepend_sort_field(struct perf_hpp_list *list,
-+				       struct perf_hpp_fmt *format);
- 
- static inline void perf_hpp__column_register(struct perf_hpp_fmt *format)
- {
-@@ -293,6 +295,11 @@ static inline void perf_hpp__register_sort_field(struct perf_hpp_fmt *format)
- 	perf_hpp_list__register_sort_field(&perf_hpp_list, format);
- }
- 
-+static inline void perf_hpp__prepend_sort_field(struct perf_hpp_fmt *format)
-+{
-+	perf_hpp_list__prepend_sort_field(&perf_hpp_list, format);
-+}
-+
- #define perf_hpp_list__for_each_format(_list, format) \
- 	list_for_each_entry(format, &(_list)->fields, list)
- 

diff --git a/4.9.11/1010_linux-4.9.11.patch b/4.9.11/1010_linux-4.9.11.patch
deleted file mode 100644
index 59eb5c7..0000000
--- a/4.9.11/1010_linux-4.9.11.patch
+++ /dev/null
@@ -1,1893 +0,0 @@
-diff --git a/Makefile b/Makefile
-index d2fe757..18b0c5a 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 9
--SUBLEVEL = 10
-+SUBLEVEL = 11
- EXTRAVERSION =
- NAME = Roaring Lionus
- 
-diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
-index ebb4e95..96d80df 100644
---- a/arch/x86/kernel/fpu/core.c
-+++ b/arch/x86/kernel/fpu/core.c
-@@ -236,7 +236,8 @@ void fpstate_init(union fpregs_state *state)
- 	 * it will #GP. Make sure it is replaced after the memset().
- 	 */
- 	if (static_cpu_has(X86_FEATURE_XSAVES))
--		state->xsave.header.xcomp_bv = XCOMP_BV_COMPACTED_FORMAT;
-+		state->xsave.header.xcomp_bv = XCOMP_BV_COMPACTED_FORMAT |
-+					       xfeatures_mask;
- 
- 	if (static_cpu_has(X86_FEATURE_FXSR))
- 		fpstate_init_fxstate(&state->fxsave);
-diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
-index f2e8bed..4d3ddc2 100644
---- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
-+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
-@@ -507,8 +507,11 @@ void mlx4_en_recover_from_oom(struct mlx4_en_priv *priv)
- 		return;
- 
- 	for (ring = 0; ring < priv->rx_ring_num; ring++) {
--		if (mlx4_en_is_ring_empty(priv->rx_ring[ring]))
-+		if (mlx4_en_is_ring_empty(priv->rx_ring[ring])) {
-+			local_bh_disable();
- 			napi_reschedule(&priv->rx_cq[ring]->napi);
-+			local_bh_enable();
-+		}
- 	}
- }
- 
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
-index 71382df..81d8e3b 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
-@@ -765,7 +765,8 @@ void mlx5e_disable_vlan_filter(struct mlx5e_priv *priv);
- int mlx5e_modify_rqs_vsd(struct mlx5e_priv *priv, bool vsd);
- 
- int mlx5e_redirect_rqt(struct mlx5e_priv *priv, u32 rqtn, int sz, int ix);
--void mlx5e_build_tir_ctx_hash(void *tirc, struct mlx5e_priv *priv);
-+void mlx5e_build_indir_tir_ctx_hash(struct mlx5e_priv *priv, void *tirc,
-+				    enum mlx5e_traffic_types tt);
- 
- int mlx5e_open_locked(struct net_device *netdev);
- int mlx5e_close_locked(struct net_device *netdev);
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
-index 51c6a57..126cfeb 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
-@@ -975,15 +975,18 @@ static int mlx5e_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key,
- 
- static void mlx5e_modify_tirs_hash(struct mlx5e_priv *priv, void *in, int inlen)
- {
--	struct mlx5_core_dev *mdev = priv->mdev;
- 	void *tirc = MLX5_ADDR_OF(modify_tir_in, in, ctx);
--	int i;
-+	struct mlx5_core_dev *mdev = priv->mdev;
-+	int ctxlen = MLX5_ST_SZ_BYTES(tirc);
-+	int tt;
- 
- 	MLX5_SET(modify_tir_in, in, bitmask.hash, 1);
--	mlx5e_build_tir_ctx_hash(tirc, priv);
- 
--	for (i = 0; i < MLX5E_NUM_INDIR_TIRS; i++)
--		mlx5_core_modify_tir(mdev, priv->indir_tir[i].tirn, in, inlen);
-+	for (tt = 0; tt < MLX5E_NUM_INDIR_TIRS; tt++) {
-+		memset(tirc, 0, ctxlen);
-+		mlx5e_build_indir_tir_ctx_hash(priv, tirc, tt);
-+		mlx5_core_modify_tir(mdev, priv->indir_tir[tt].tirn, in, inlen);
-+	}
- }
- 
- static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
-index 5dc3e24..b3067137 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
-@@ -1978,8 +1978,23 @@ static void mlx5e_build_tir_ctx_lro(void *tirc, struct mlx5e_priv *priv)
- 	MLX5_SET(tirc, tirc, lro_timeout_period_usecs, priv->params.lro_timeout);
- }
- 
--void mlx5e_build_tir_ctx_hash(void *tirc, struct mlx5e_priv *priv)
-+void mlx5e_build_indir_tir_ctx_hash(struct mlx5e_priv *priv, void *tirc,
-+				    enum mlx5e_traffic_types tt)
- {
-+	void *hfso = MLX5_ADDR_OF(tirc, tirc, rx_hash_field_selector_outer);
-+
-+#define MLX5_HASH_IP            (MLX5_HASH_FIELD_SEL_SRC_IP   |\
-+				 MLX5_HASH_FIELD_SEL_DST_IP)
-+
-+#define MLX5_HASH_IP_L4PORTS    (MLX5_HASH_FIELD_SEL_SRC_IP   |\
-+				 MLX5_HASH_FIELD_SEL_DST_IP   |\
-+				 MLX5_HASH_FIELD_SEL_L4_SPORT |\
-+				 MLX5_HASH_FIELD_SEL_L4_DPORT)
-+
-+#define MLX5_HASH_IP_IPSEC_SPI  (MLX5_HASH_FIELD_SEL_SRC_IP   |\
-+				 MLX5_HASH_FIELD_SEL_DST_IP   |\
-+				 MLX5_HASH_FIELD_SEL_IPSEC_SPI)
-+
- 	MLX5_SET(tirc, tirc, rx_hash_fn,
- 		 mlx5e_rx_hash_fn(priv->params.rss_hfunc));
- 	if (priv->params.rss_hfunc == ETH_RSS_HASH_TOP) {
-@@ -1991,6 +2006,88 @@ void mlx5e_build_tir_ctx_hash(void *tirc, struct mlx5e_priv *priv)
- 		MLX5_SET(tirc, tirc, rx_hash_symmetric, 1);
- 		memcpy(rss_key, priv->params.toeplitz_hash_key, len);
- 	}
-+
-+	switch (tt) {
-+	case MLX5E_TT_IPV4_TCP:
-+		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-+			 MLX5_L3_PROT_TYPE_IPV4);
-+		MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
-+			 MLX5_L4_PROT_TYPE_TCP);
-+		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-+			 MLX5_HASH_IP_L4PORTS);
-+		break;
-+
-+	case MLX5E_TT_IPV6_TCP:
-+		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-+			 MLX5_L3_PROT_TYPE_IPV6);
-+		MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
-+			 MLX5_L4_PROT_TYPE_TCP);
-+		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-+			 MLX5_HASH_IP_L4PORTS);
-+		break;
-+
-+	case MLX5E_TT_IPV4_UDP:
-+		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-+			 MLX5_L3_PROT_TYPE_IPV4);
-+		MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
-+			 MLX5_L4_PROT_TYPE_UDP);
-+		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-+			 MLX5_HASH_IP_L4PORTS);
-+		break;
-+
-+	case MLX5E_TT_IPV6_UDP:
-+		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-+			 MLX5_L3_PROT_TYPE_IPV6);
-+		MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
-+			 MLX5_L4_PROT_TYPE_UDP);
-+		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-+			 MLX5_HASH_IP_L4PORTS);
-+		break;
-+
-+	case MLX5E_TT_IPV4_IPSEC_AH:
-+		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-+			 MLX5_L3_PROT_TYPE_IPV4);
-+		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-+			 MLX5_HASH_IP_IPSEC_SPI);
-+		break;
-+
-+	case MLX5E_TT_IPV6_IPSEC_AH:
-+		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-+			 MLX5_L3_PROT_TYPE_IPV6);
-+		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-+			 MLX5_HASH_IP_IPSEC_SPI);
-+		break;
-+
-+	case MLX5E_TT_IPV4_IPSEC_ESP:
-+		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-+			 MLX5_L3_PROT_TYPE_IPV4);
-+		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-+			 MLX5_HASH_IP_IPSEC_SPI);
-+		break;
-+
-+	case MLX5E_TT_IPV6_IPSEC_ESP:
-+		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-+			 MLX5_L3_PROT_TYPE_IPV6);
-+		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-+			 MLX5_HASH_IP_IPSEC_SPI);
-+		break;
-+
-+	case MLX5E_TT_IPV4:
-+		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-+			 MLX5_L3_PROT_TYPE_IPV4);
-+		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-+			 MLX5_HASH_IP);
-+		break;
-+
-+	case MLX5E_TT_IPV6:
-+		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
-+			 MLX5_L3_PROT_TYPE_IPV6);
-+		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
-+			 MLX5_HASH_IP);
-+		break;
-+	default:
-+		WARN_ONCE(true, "%s: bad traffic type!\n", __func__);
-+	}
- }
- 
- static int mlx5e_modify_tirs_lro(struct mlx5e_priv *priv)
-@@ -2360,110 +2457,13 @@ void mlx5e_cleanup_nic_tx(struct mlx5e_priv *priv)
- static void mlx5e_build_indir_tir_ctx(struct mlx5e_priv *priv, u32 *tirc,
- 				      enum mlx5e_traffic_types tt)
- {
--	void *hfso = MLX5_ADDR_OF(tirc, tirc, rx_hash_field_selector_outer);
--
- 	MLX5_SET(tirc, tirc, transport_domain, priv->mdev->mlx5e_res.td.tdn);
- 
--#define MLX5_HASH_IP            (MLX5_HASH_FIELD_SEL_SRC_IP   |\
--				 MLX5_HASH_FIELD_SEL_DST_IP)
--
--#define MLX5_HASH_IP_L4PORTS    (MLX5_HASH_FIELD_SEL_SRC_IP   |\
--				 MLX5_HASH_FIELD_SEL_DST_IP   |\
--				 MLX5_HASH_FIELD_SEL_L4_SPORT |\
--				 MLX5_HASH_FIELD_SEL_L4_DPORT)
--
--#define MLX5_HASH_IP_IPSEC_SPI  (MLX5_HASH_FIELD_SEL_SRC_IP   |\
--				 MLX5_HASH_FIELD_SEL_DST_IP   |\
--				 MLX5_HASH_FIELD_SEL_IPSEC_SPI)
--
- 	mlx5e_build_tir_ctx_lro(tirc, priv);
- 
- 	MLX5_SET(tirc, tirc, disp_type, MLX5_TIRC_DISP_TYPE_INDIRECT);
- 	MLX5_SET(tirc, tirc, indirect_table, priv->indir_rqt.rqtn);
--	mlx5e_build_tir_ctx_hash(tirc, priv);
--
--	switch (tt) {
--	case MLX5E_TT_IPV4_TCP:
--		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
--			 MLX5_L3_PROT_TYPE_IPV4);
--		MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
--			 MLX5_L4_PROT_TYPE_TCP);
--		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
--			 MLX5_HASH_IP_L4PORTS);
--		break;
--
--	case MLX5E_TT_IPV6_TCP:
--		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
--			 MLX5_L3_PROT_TYPE_IPV6);
--		MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
--			 MLX5_L4_PROT_TYPE_TCP);
--		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
--			 MLX5_HASH_IP_L4PORTS);
--		break;
--
--	case MLX5E_TT_IPV4_UDP:
--		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
--			 MLX5_L3_PROT_TYPE_IPV4);
--		MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
--			 MLX5_L4_PROT_TYPE_UDP);
--		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
--			 MLX5_HASH_IP_L4PORTS);
--		break;
--
--	case MLX5E_TT_IPV6_UDP:
--		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
--			 MLX5_L3_PROT_TYPE_IPV6);
--		MLX5_SET(rx_hash_field_select, hfso, l4_prot_type,
--			 MLX5_L4_PROT_TYPE_UDP);
--		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
--			 MLX5_HASH_IP_L4PORTS);
--		break;
--
--	case MLX5E_TT_IPV4_IPSEC_AH:
--		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
--			 MLX5_L3_PROT_TYPE_IPV4);
--		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
--			 MLX5_HASH_IP_IPSEC_SPI);
--		break;
--
--	case MLX5E_TT_IPV6_IPSEC_AH:
--		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
--			 MLX5_L3_PROT_TYPE_IPV6);
--		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
--			 MLX5_HASH_IP_IPSEC_SPI);
--		break;
--
--	case MLX5E_TT_IPV4_IPSEC_ESP:
--		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
--			 MLX5_L3_PROT_TYPE_IPV4);
--		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
--			 MLX5_HASH_IP_IPSEC_SPI);
--		break;
--
--	case MLX5E_TT_IPV6_IPSEC_ESP:
--		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
--			 MLX5_L3_PROT_TYPE_IPV6);
--		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
--			 MLX5_HASH_IP_IPSEC_SPI);
--		break;
--
--	case MLX5E_TT_IPV4:
--		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
--			 MLX5_L3_PROT_TYPE_IPV4);
--		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
--			 MLX5_HASH_IP);
--		break;
--
--	case MLX5E_TT_IPV6:
--		MLX5_SET(rx_hash_field_select, hfso, l3_prot_type,
--			 MLX5_L3_PROT_TYPE_IPV6);
--		MLX5_SET(rx_hash_field_select, hfso, selected_fields,
--			 MLX5_HASH_IP);
--		break;
--	default:
--		WARN_ONCE(true,
--			  "mlx5e_build_indir_tir_ctx: bad traffic type!\n");
--	}
-+	mlx5e_build_indir_tir_ctx_hash(priv, tirc, tt);
- }
- 
- static void mlx5e_build_direct_tir_ctx(struct mlx5e_priv *priv, u32 *tirc,
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
-index 914e546..7e20e4b 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
-@@ -1110,9 +1110,8 @@ static struct mlx5_flow_rule *add_rule_fg(struct mlx5_flow_group *fg,
- 				return rule;
- 			}
- 			rule = add_rule_fte(fte, fg, dest);
--			unlock_ref_node(&fte->node);
- 			if (IS_ERR(rule))
--				goto unlock_fg;
-+				goto unlock_fte;
- 			else
- 				goto add_rule;
- 		}
-@@ -1130,6 +1129,7 @@ static struct mlx5_flow_rule *add_rule_fg(struct mlx5_flow_group *fg,
- 		goto unlock_fg;
- 	}
- 	tree_init_node(&fte->node, 0, del_fte);
-+	nested_lock_ref_node(&fte->node, FS_MUTEX_CHILD);
- 	rule = add_rule_fte(fte, fg, dest);
- 	if (IS_ERR(rule)) {
- 		kfree(fte);
-@@ -1142,6 +1142,8 @@ static struct mlx5_flow_rule *add_rule_fg(struct mlx5_flow_group *fg,
- 	list_add(&fte->node.list, prev);
- add_rule:
- 	tree_add_node(&rule->node, &fte->node);
-+unlock_fte:
-+	unlock_ref_node(&fte->node);
- unlock_fg:
- 	unlock_ref_node(&fg->node);
- 	return rule;
-diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
-index 7df4ff1..7d19029 100644
---- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
-+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
-@@ -305,8 +305,12 @@ static int dwmac1000_irq_status(struct mac_device_info *hw,
- {
- 	void __iomem *ioaddr = hw->pcsr;
- 	u32 intr_status = readl(ioaddr + GMAC_INT_STATUS);
-+	u32 intr_mask = readl(ioaddr + GMAC_INT_MASK);
- 	int ret = 0;
- 
-+	/* Discard masked bits */
-+	intr_status &= ~intr_mask;
-+
- 	/* Not used events (e.g. MMC interrupts) are not handled. */
- 	if ((intr_status & GMAC_INT_STATUS_MMCTIS))
- 		x->mmc_tx_irq_n++;
-diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
-index 6255973..1b65f0f 100644
---- a/drivers/net/loopback.c
-+++ b/drivers/net/loopback.c
-@@ -164,6 +164,7 @@ static void loopback_setup(struct net_device *dev)
- {
- 	dev->mtu		= 64 * 1024;
- 	dev->hard_header_len	= ETH_HLEN;	/* 14	*/
-+	dev->min_header_len	= ETH_HLEN;	/* 14	*/
- 	dev->addr_len		= ETH_ALEN;	/* 6	*/
- 	dev->type		= ARPHRD_LOOPBACK;	/* 0x0001*/
- 	dev->flags		= IFF_LOOPBACK;
-diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
-index 6f38daf..adea6f5 100644
---- a/drivers/net/macvtap.c
-+++ b/drivers/net/macvtap.c
-@@ -682,7 +682,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
- 	ssize_t n;
- 
- 	if (q->flags & IFF_VNET_HDR) {
--		vnet_hdr_len = q->vnet_hdr_sz;
-+		vnet_hdr_len = READ_ONCE(q->vnet_hdr_sz);
- 
- 		err = -EINVAL;
- 		if (len < vnet_hdr_len)
-@@ -822,7 +822,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
- 
- 	if (q->flags & IFF_VNET_HDR) {
- 		struct virtio_net_hdr vnet_hdr;
--		vnet_hdr_len = q->vnet_hdr_sz;
-+		vnet_hdr_len = READ_ONCE(q->vnet_hdr_sz);
- 		if (iov_iter_count(iter) < vnet_hdr_len)
- 			return -EINVAL;
- 
-diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index 18402d7..b31aca8 100644
---- a/drivers/net/tun.c
-+++ b/drivers/net/tun.c
-@@ -1187,9 +1187,11 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
- 	}
- 
- 	if (tun->flags & IFF_VNET_HDR) {
--		if (len < tun->vnet_hdr_sz)
-+		int vnet_hdr_sz = READ_ONCE(tun->vnet_hdr_sz);
-+
-+		if (len < vnet_hdr_sz)
- 			return -EINVAL;
--		len -= tun->vnet_hdr_sz;
-+		len -= vnet_hdr_sz;
- 
- 		n = copy_from_iter(&gso, sizeof(gso), from);
- 		if (n != sizeof(gso))
-@@ -1201,7 +1203,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
- 
- 		if (tun16_to_cpu(tun, gso.hdr_len) > len)
- 			return -EINVAL;
--		iov_iter_advance(from, tun->vnet_hdr_sz - sizeof(gso));
-+		iov_iter_advance(from, vnet_hdr_sz - sizeof(gso));
- 	}
- 
- 	if ((tun->flags & TUN_TYPE_MASK) == IFF_TAP) {
-@@ -1348,7 +1350,7 @@ static ssize_t tun_put_user(struct tun_struct *tun,
- 		vlan_hlen = VLAN_HLEN;
- 
- 	if (tun->flags & IFF_VNET_HDR)
--		vnet_hdr_sz = tun->vnet_hdr_sz;
-+		vnet_hdr_sz = READ_ONCE(tun->vnet_hdr_sz);
- 
- 	total = skb->len + vlan_hlen + vnet_hdr_sz;
- 
-diff --git a/drivers/net/usb/catc.c b/drivers/net/usb/catc.c
-index d9ca05d..4086415 100644
---- a/drivers/net/usb/catc.c
-+++ b/drivers/net/usb/catc.c
-@@ -777,7 +777,7 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
- 	struct net_device *netdev;
- 	struct catc *catc;
- 	u8 broadcast[ETH_ALEN];
--	int i, pktsz;
-+	int pktsz, ret;
- 
- 	if (usb_set_interface(usbdev,
- 			intf->altsetting->desc.bInterfaceNumber, 1)) {
-@@ -812,12 +812,8 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
- 	if ((!catc->ctrl_urb) || (!catc->tx_urb) || 
- 	    (!catc->rx_urb) || (!catc->irq_urb)) {
- 		dev_err(&intf->dev, "No free urbs available.\n");
--		usb_free_urb(catc->ctrl_urb);
--		usb_free_urb(catc->tx_urb);
--		usb_free_urb(catc->rx_urb);
--		usb_free_urb(catc->irq_urb);
--		free_netdev(netdev);
--		return -ENOMEM;
-+		ret = -ENOMEM;
-+		goto fail_free;
- 	}
- 
- 	/* The F5U011 has the same vendor/product as the netmate but a device version of 0x130 */
-@@ -845,15 +841,24 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
-                 catc->irq_buf, 2, catc_irq_done, catc, 1);
- 
- 	if (!catc->is_f5u011) {
-+		u32 *buf;
-+		int i;
-+
- 		dev_dbg(dev, "Checking memory size\n");
- 
--		i = 0x12345678;
--		catc_write_mem(catc, 0x7a80, &i, 4);
--		i = 0x87654321;	
--		catc_write_mem(catc, 0xfa80, &i, 4);
--		catc_read_mem(catc, 0x7a80, &i, 4);
-+		buf = kmalloc(4, GFP_KERNEL);
-+		if (!buf) {
-+			ret = -ENOMEM;
-+			goto fail_free;
-+		}
-+
-+		*buf = 0x12345678;
-+		catc_write_mem(catc, 0x7a80, buf, 4);
-+		*buf = 0x87654321;
-+		catc_write_mem(catc, 0xfa80, buf, 4);
-+		catc_read_mem(catc, 0x7a80, buf, 4);
- 	  
--		switch (i) {
-+		switch (*buf) {
- 		case 0x12345678:
- 			catc_set_reg(catc, TxBufCount, 8);
- 			catc_set_reg(catc, RxBufCount, 32);
-@@ -868,6 +873,8 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
- 			dev_dbg(dev, "32k Memory\n");
- 			break;
- 		}
-+
-+		kfree(buf);
- 	  
- 		dev_dbg(dev, "Getting MAC from SEEROM.\n");
- 	  
-@@ -914,16 +921,21 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id
- 	usb_set_intfdata(intf, catc);
- 
- 	SET_NETDEV_DEV(netdev, &intf->dev);
--	if (register_netdev(netdev) != 0) {
--		usb_set_intfdata(intf, NULL);
--		usb_free_urb(catc->ctrl_urb);
--		usb_free_urb(catc->tx_urb);
--		usb_free_urb(catc->rx_urb);
--		usb_free_urb(catc->irq_urb);
--		free_netdev(netdev);
--		return -EIO;
--	}
-+	ret = register_netdev(netdev);
-+	if (ret)
-+		goto fail_clear_intfdata;
-+
- 	return 0;
-+
-+fail_clear_intfdata:
-+	usb_set_intfdata(intf, NULL);
-+fail_free:
-+	usb_free_urb(catc->ctrl_urb);
-+	usb_free_urb(catc->tx_urb);
-+	usb_free_urb(catc->rx_urb);
-+	usb_free_urb(catc->irq_urb);
-+	free_netdev(netdev);
-+	return ret;
- }
- 
- static void catc_disconnect(struct usb_interface *intf)
-diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
-index 1434e5d..ee40ac2 100644
---- a/drivers/net/usb/pegasus.c
-+++ b/drivers/net/usb/pegasus.c
-@@ -126,40 +126,61 @@ static void async_ctrl_callback(struct urb *urb)
- 
- static int get_registers(pegasus_t *pegasus, __u16 indx, __u16 size, void *data)
- {
-+	u8 *buf;
- 	int ret;
- 
-+	buf = kmalloc(size, GFP_NOIO);
-+	if (!buf)
-+		return -ENOMEM;
-+
- 	ret = usb_control_msg(pegasus->usb, usb_rcvctrlpipe(pegasus->usb, 0),
- 			      PEGASUS_REQ_GET_REGS, PEGASUS_REQT_READ, 0,
--			      indx, data, size, 1000);
-+			      indx, buf, size, 1000);
- 	if (ret < 0)
- 		netif_dbg(pegasus, drv, pegasus->net,
- 			  "%s returned %d\n", __func__, ret);
-+	else if (ret <= size)
-+		memcpy(data, buf, ret);
-+	kfree(buf);
- 	return ret;
- }
- 
--static int set_registers(pegasus_t *pegasus, __u16 indx, __u16 size, void *data)
-+static int set_registers(pegasus_t *pegasus, __u16 indx, __u16 size,
-+			 const void *data)
- {
-+	u8 *buf;
- 	int ret;
- 
-+	buf = kmemdup(data, size, GFP_NOIO);
-+	if (!buf)
-+		return -ENOMEM;
-+
- 	ret = usb_control_msg(pegasus->usb, usb_sndctrlpipe(pegasus->usb, 0),
- 			      PEGASUS_REQ_SET_REGS, PEGASUS_REQT_WRITE, 0,
--			      indx, data, size, 100);
-+			      indx, buf, size, 100);
- 	if (ret < 0)
- 		netif_dbg(pegasus, drv, pegasus->net,
- 			  "%s returned %d\n", __func__, ret);
-+	kfree(buf);
- 	return ret;
- }
- 
- static int set_register(pegasus_t *pegasus, __u16 indx, __u8 data)
- {
-+	u8 *buf;
- 	int ret;
- 
-+	buf = kmemdup(&data, 1, GFP_NOIO);
-+	if (!buf)
-+		return -ENOMEM;
-+
- 	ret = usb_control_msg(pegasus->usb, usb_sndctrlpipe(pegasus->usb, 0),
- 			      PEGASUS_REQ_SET_REG, PEGASUS_REQT_WRITE, data,
--			      indx, &data, 1, 1000);
-+			      indx, buf, 1, 1000);
- 	if (ret < 0)
- 		netif_dbg(pegasus, drv, pegasus->net,
- 			  "%s returned %d\n", __func__, ret);
-+	kfree(buf);
- 	return ret;
- }
- 
-diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
-index 7c72bfa..dc4f7ea 100644
---- a/drivers/net/usb/rtl8150.c
-+++ b/drivers/net/usb/rtl8150.c
-@@ -155,16 +155,36 @@ static const char driver_name [] = "rtl8150";
- */
- static int get_registers(rtl8150_t * dev, u16 indx, u16 size, void *data)
- {
--	return usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
--			       RTL8150_REQ_GET_REGS, RTL8150_REQT_READ,
--			       indx, 0, data, size, 500);
-+	void *buf;
-+	int ret;
-+
-+	buf = kmalloc(size, GFP_NOIO);
-+	if (!buf)
-+		return -ENOMEM;
-+
-+	ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
-+			      RTL8150_REQ_GET_REGS, RTL8150_REQT_READ,
-+			      indx, 0, buf, size, 500);
-+	if (ret > 0 && ret <= size)
-+		memcpy(data, buf, ret);
-+	kfree(buf);
-+	return ret;
- }
- 
--static int set_registers(rtl8150_t * dev, u16 indx, u16 size, void *data)
-+static int set_registers(rtl8150_t * dev, u16 indx, u16 size, const void *data)
- {
--	return usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
--			       RTL8150_REQ_SET_REGS, RTL8150_REQT_WRITE,
--			       indx, 0, data, size, 500);
-+	void *buf;
-+	int ret;
-+
-+	buf = kmemdup(data, size, GFP_NOIO);
-+	if (!buf)
-+		return -ENOMEM;
-+
-+	ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
-+			      RTL8150_REQ_SET_REGS, RTL8150_REQT_WRITE,
-+			      indx, 0, buf, size, 500);
-+	kfree(buf);
-+	return ret;
- }
- 
- static void async_set_reg_cb(struct urb *urb)
-diff --git a/include/linux/can/core.h b/include/linux/can/core.h
-index a087500..df08a41 100644
---- a/include/linux/can/core.h
-+++ b/include/linux/can/core.h
-@@ -45,10 +45,9 @@ struct can_proto {
- extern int  can_proto_register(const struct can_proto *cp);
- extern void can_proto_unregister(const struct can_proto *cp);
- 
--extern int  can_rx_register(struct net_device *dev, canid_t can_id,
--			    canid_t mask,
--			    void (*func)(struct sk_buff *, void *),
--			    void *data, char *ident);
-+int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
-+		    void (*func)(struct sk_buff *, void *),
-+		    void *data, char *ident, struct sock *sk);
- 
- extern void can_rx_unregister(struct net_device *dev, canid_t can_id,
- 			      canid_t mask,
-diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
-index d83590e..bb9b102 100644
---- a/include/linux/netdevice.h
-+++ b/include/linux/netdevice.h
-@@ -1508,6 +1508,7 @@ enum netdev_priv_flags {
-  *	@mtu:		Interface MTU value
-  *	@type:		Interface hardware type
-  *	@hard_header_len: Maximum hardware header length.
-+ *	@min_header_len:  Minimum hardware header length
-  *
-  *	@needed_headroom: Extra headroom the hardware may need, but not in all
-  *			  cases can this be guaranteed
-@@ -1728,6 +1729,7 @@ struct net_device {
- 	unsigned int		mtu;
- 	unsigned short		type;
- 	unsigned short		hard_header_len;
-+	unsigned short		min_header_len;
- 
- 	unsigned short		needed_headroom;
- 	unsigned short		needed_tailroom;
-@@ -2783,6 +2785,8 @@ static inline bool dev_validate_header(const struct net_device *dev,
- {
- 	if (likely(len >= dev->hard_header_len))
- 		return true;
-+	if (len < dev->min_header_len)
-+		return false;
- 
- 	if (capable(CAP_SYS_RAWIO)) {
- 		memset(ll_header + len, 0, dev->hard_header_len - len);
-diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
-index 3ebb168..a34b141 100644
---- a/include/net/cipso_ipv4.h
-+++ b/include/net/cipso_ipv4.h
-@@ -309,6 +309,10 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
- 	}
- 
- 	for (opt_iter = 6; opt_iter < opt_len;) {
-+		if (opt_iter + 1 == opt_len) {
-+			err_offset = opt_iter;
-+			goto out;
-+		}
- 		tag_len = opt[opt_iter + 1];
- 		if ((tag_len == 0) || (tag_len > (opt_len - opt_iter))) {
- 			err_offset = opt_iter + 1;
-diff --git a/include/net/ipv6.h b/include/net/ipv6.h
-index f11ca83..7f15f95 100644
---- a/include/net/ipv6.h
-+++ b/include/net/ipv6.h
-@@ -871,7 +871,7 @@ int ip6_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb);
-  *	upper-layer output functions
-  */
- int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
--	     struct ipv6_txoptions *opt, int tclass);
-+	     __u32 mark, struct ipv6_txoptions *opt, int tclass);
- 
- int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr);
- 
-diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h
-index fc7c0db..3f40132 100644
---- a/include/net/lwtunnel.h
-+++ b/include/net/lwtunnel.h
-@@ -176,7 +176,10 @@ static inline int lwtunnel_valid_encap_type(u16 encap_type)
- }
- static inline int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int len)
- {
--	return -EOPNOTSUPP;
-+	/* return 0 since we are not walking attr looking for
-+	 * RTA_ENCAP_TYPE attribute on nexthops.
-+	 */
-+	return 0;
- }
- 
- static inline int lwtunnel_build_state(struct net_device *dev, u16 encap_type,
-diff --git a/net/can/af_can.c b/net/can/af_can.c
-index 1108079..5488e4a 100644
---- a/net/can/af_can.c
-+++ b/net/can/af_can.c
-@@ -445,6 +445,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
-  * @func: callback function on filter match
-  * @data: returned parameter for callback function
-  * @ident: string for calling module identification
-+ * @sk: socket pointer (might be NULL)
-  *
-  * Description:
-  *  Invokes the callback function with the received sk_buff and the given
-@@ -468,7 +469,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
-  */
- int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
- 		    void (*func)(struct sk_buff *, void *), void *data,
--		    char *ident)
-+		    char *ident, struct sock *sk)
- {
- 	struct receiver *r;
- 	struct hlist_head *rl;
-@@ -496,6 +497,7 @@ int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
- 		r->func    = func;
- 		r->data    = data;
- 		r->ident   = ident;
-+		r->sk      = sk;
- 
- 		hlist_add_head_rcu(&r->list, rl);
- 		d->entries++;
-@@ -520,8 +522,11 @@ EXPORT_SYMBOL(can_rx_register);
- static void can_rx_delete_receiver(struct rcu_head *rp)
- {
- 	struct receiver *r = container_of(rp, struct receiver, rcu);
-+	struct sock *sk = r->sk;
- 
- 	kmem_cache_free(rcv_cache, r);
-+	if (sk)
-+		sock_put(sk);
- }
- 
- /**
-@@ -596,8 +601,11 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
- 	spin_unlock(&can_rcvlists_lock);
- 
- 	/* schedule the receiver item for deletion */
--	if (r)
-+	if (r) {
-+		if (r->sk)
-+			sock_hold(r->sk);
- 		call_rcu(&r->rcu, can_rx_delete_receiver);
-+	}
- }
- EXPORT_SYMBOL(can_rx_unregister);
- 
-diff --git a/net/can/af_can.h b/net/can/af_can.h
-index fca0fe9..b86f512 100644
---- a/net/can/af_can.h
-+++ b/net/can/af_can.h
-@@ -50,13 +50,14 @@
- 
- struct receiver {
- 	struct hlist_node list;
--	struct rcu_head rcu;
- 	canid_t can_id;
- 	canid_t mask;
- 	unsigned long matches;
- 	void (*func)(struct sk_buff *, void *);
- 	void *data;
- 	char *ident;
-+	struct sock *sk;
-+	struct rcu_head rcu;
- };
- 
- #define CAN_SFF_RCV_ARRAY_SZ (1 << CAN_SFF_ID_BITS)
-diff --git a/net/can/bcm.c b/net/can/bcm.c
-index 5e9ed5e..e4f694d 100644
---- a/net/can/bcm.c
-+++ b/net/can/bcm.c
-@@ -1225,7 +1225,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
- 				err = can_rx_register(dev, op->can_id,
- 						      REGMASK(op->can_id),
- 						      bcm_rx_handler, op,
--						      "bcm");
-+						      "bcm", sk);
- 
- 				op->rx_reg_dev = dev;
- 				dev_put(dev);
-@@ -1234,7 +1234,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
- 		} else
- 			err = can_rx_register(NULL, op->can_id,
- 					      REGMASK(op->can_id),
--					      bcm_rx_handler, op, "bcm");
-+					      bcm_rx_handler, op, "bcm", sk);
- 		if (err) {
- 			/* this bcm rx op is broken -> remove it */
- 			list_del(&op->list);
-diff --git a/net/can/gw.c b/net/can/gw.c
-index 4551687..77c8af4 100644
---- a/net/can/gw.c
-+++ b/net/can/gw.c
-@@ -442,7 +442,7 @@ static inline int cgw_register_filter(struct cgw_job *gwj)
- {
- 	return can_rx_register(gwj->src.dev, gwj->ccgw.filter.can_id,
- 			       gwj->ccgw.filter.can_mask, can_can_gw_rcv,
--			       gwj, "gw");
-+			       gwj, "gw", NULL);
- }
- 
- static inline void cgw_unregister_filter(struct cgw_job *gwj)
-diff --git a/net/can/raw.c b/net/can/raw.c
-index b075f02..6dc546a 100644
---- a/net/can/raw.c
-+++ b/net/can/raw.c
-@@ -190,7 +190,7 @@ static int raw_enable_filters(struct net_device *dev, struct sock *sk,
- 	for (i = 0; i < count; i++) {
- 		err = can_rx_register(dev, filter[i].can_id,
- 				      filter[i].can_mask,
--				      raw_rcv, sk, "raw");
-+				      raw_rcv, sk, "raw", sk);
- 		if (err) {
- 			/* clean up successfully registered filters */
- 			while (--i >= 0)
-@@ -211,7 +211,7 @@ static int raw_enable_errfilter(struct net_device *dev, struct sock *sk,
- 
- 	if (err_mask)
- 		err = can_rx_register(dev, 0, err_mask | CAN_ERR_FLAG,
--				      raw_rcv, sk, "raw");
-+				      raw_rcv, sk, "raw", sk);
- 
- 	return err;
- }
-diff --git a/net/core/dev.c b/net/core/dev.c
-index df51c50..60b0a604 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -1696,24 +1696,19 @@ EXPORT_SYMBOL_GPL(net_dec_egress_queue);
- 
- static struct static_key netstamp_needed __read_mostly;
- #ifdef HAVE_JUMP_LABEL
--/* We are not allowed to call static_key_slow_dec() from irq context
-- * If net_disable_timestamp() is called from irq context, defer the
-- * static_key_slow_dec() calls.
-- */
- static atomic_t netstamp_needed_deferred;
--#endif
--
--void net_enable_timestamp(void)
-+static void netstamp_clear(struct work_struct *work)
- {
--#ifdef HAVE_JUMP_LABEL
- 	int deferred = atomic_xchg(&netstamp_needed_deferred, 0);
- 
--	if (deferred) {
--		while (--deferred)
--			static_key_slow_dec(&netstamp_needed);
--		return;
--	}
-+	while (deferred--)
-+		static_key_slow_dec(&netstamp_needed);
-+}
-+static DECLARE_WORK(netstamp_work, netstamp_clear);
- #endif
-+
-+void net_enable_timestamp(void)
-+{
- 	static_key_slow_inc(&netstamp_needed);
- }
- EXPORT_SYMBOL(net_enable_timestamp);
-@@ -1721,12 +1716,12 @@ EXPORT_SYMBOL(net_enable_timestamp);
- void net_disable_timestamp(void)
- {
- #ifdef HAVE_JUMP_LABEL
--	if (in_interrupt()) {
--		atomic_inc(&netstamp_needed_deferred);
--		return;
--	}
--#endif
-+	/* net_disable_timestamp() can be called from non process context */
-+	atomic_inc(&netstamp_needed_deferred);
-+	schedule_work(&netstamp_work);
-+#else
- 	static_key_slow_dec(&netstamp_needed);
-+#endif
- }
- EXPORT_SYMBOL(net_disable_timestamp);
- 
-diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
-index 715e5d1..7506c03 100644
---- a/net/dccp/ipv6.c
-+++ b/net/dccp/ipv6.c
-@@ -227,7 +227,7 @@ static int dccp_v6_send_response(const struct sock *sk, struct request_sock *req
- 		opt = ireq->ipv6_opt;
- 		if (!opt)
- 			opt = rcu_dereference(np->opt);
--		err = ip6_xmit(sk, skb, &fl6, opt, np->tclass);
-+		err = ip6_xmit(sk, skb, &fl6, sk->sk_mark, opt, np->tclass);
- 		rcu_read_unlock();
- 		err = net_xmit_eval(err);
- 	}
-@@ -281,7 +281,7 @@ static void dccp_v6_ctl_send_reset(const struct sock *sk, struct sk_buff *rxskb)
- 	dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
- 	if (!IS_ERR(dst)) {
- 		skb_dst_set(skb, dst);
--		ip6_xmit(ctl_sk, skb, &fl6, NULL, 0);
-+		ip6_xmit(ctl_sk, skb, &fl6, 0, NULL, 0);
- 		DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
- 		DCCP_INC_STATS(DCCP_MIB_OUTRSTS);
- 		return;
-diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
-index da38621..0f99297 100644
---- a/net/dsa/dsa2.c
-+++ b/net/dsa/dsa2.c
-@@ -273,6 +273,7 @@ static int dsa_user_port_apply(struct device_node *port, u32 index,
- 	if (err) {
- 		dev_warn(ds->dev, "Failed to create slave %d: %d\n",
- 			 index, err);
-+		ds->ports[index].netdev = NULL;
- 		return err;
- 	}
- 
-diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
-index 02acfff..24d7aff 100644
---- a/net/ethernet/eth.c
-+++ b/net/ethernet/eth.c
-@@ -356,6 +356,7 @@ void ether_setup(struct net_device *dev)
- 	dev->header_ops		= &eth_header_ops;
- 	dev->type		= ARPHRD_ETHER;
- 	dev->hard_header_len 	= ETH_HLEN;
-+	dev->min_header_len	= ETH_HLEN;
- 	dev->mtu		= ETH_DATA_LEN;
- 	dev->addr_len		= ETH_ALEN;
- 	dev->tx_queue_len	= 1000;	/* Ethernet wants good queues */
-diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
-index 72d6f05..ae20616 100644
---- a/net/ipv4/cipso_ipv4.c
-+++ b/net/ipv4/cipso_ipv4.c
-@@ -1587,6 +1587,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
- 				goto validate_return_locked;
- 			}
- 
-+		if (opt_iter + 1 == opt_len) {
-+			err_offset = opt_iter;
-+			goto validate_return_locked;
-+		}
- 		tag_len = tag[1];
- 		if (tag_len > (opt_len - opt_iter)) {
- 			err_offset = opt_iter + 1;
-diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
-index 32a08bc..1bc623d 100644
---- a/net/ipv4/igmp.c
-+++ b/net/ipv4/igmp.c
-@@ -1172,6 +1172,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im)
- 				psf->sf_crcount = im->crcount;
- 		}
- 		in_dev_put(pmc->interface);
-+		kfree(pmc);
- 	}
- 	spin_unlock_bh(&im->lock);
- }
-diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
-index 877bdb0..e5c1dbe 100644
---- a/net/ipv4/ip_output.c
-+++ b/net/ipv4/ip_output.c
-@@ -1606,6 +1606,7 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
- 	sk->sk_protocol = ip_hdr(skb)->protocol;
- 	sk->sk_bound_dev_if = arg->bound_dev_if;
- 	sk->sk_sndbuf = sysctl_wmem_default;
-+	sk->sk_mark = fl4.flowi4_mark;
- 	err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base,
- 			     len, 0, &ipc, &rt, MSG_DONTWAIT);
- 	if (unlikely(err)) {
-diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
-index f226f408..65336f3 100644
---- a/net/ipv4/ip_sockglue.c
-+++ b/net/ipv4/ip_sockglue.c
-@@ -1215,7 +1215,14 @@ void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb)
- 		pktinfo->ipi_ifindex = 0;
- 		pktinfo->ipi_spec_dst.s_addr = 0;
- 	}
--	skb_dst_drop(skb);
-+	/* We need to keep the dst for __ip_options_echo()
-+	 * We could restrict the test to opt.ts_needtime || opt.srr,
-+	 * but the following is good enough as IP options are not often used.
-+	 */
-+	if (unlikely(IPCB(skb)->opt.optlen))
-+		skb_dst_force(skb);
-+	else
-+		skb_dst_drop(skb);
- }
- 
- int ip_setsockopt(struct sock *sk, int level,
-diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
-index 96b8e2b..105c074 100644
---- a/net/ipv4/ping.c
-+++ b/net/ipv4/ping.c
-@@ -642,6 +642,8 @@ static int ping_v4_push_pending_frames(struct sock *sk, struct pingfakehdr *pfh,
- {
- 	struct sk_buff *skb = skb_peek(&sk->sk_write_queue);
- 
-+	if (!skb)
-+		return 0;
- 	pfh->wcheck = csum_partial((char *)&pfh->icmph,
- 		sizeof(struct icmphdr), pfh->wcheck);
- 	pfh->icmph.checksum = csum_fold(pfh->wcheck);
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index 814af89..6a90a0e 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -772,6 +772,12 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
- 				ret = -EAGAIN;
- 				break;
- 			}
-+			/* if __tcp_splice_read() got nothing while we have
-+			 * an skb in receive queue, we do not want to loop.
-+			 * This might happen with URG data.
-+			 */
-+			if (!skb_queue_empty(&sk->sk_receive_queue))
-+				break;
- 			sk_wait_data(sk, &timeo, NULL);
- 			if (signal_pending(current)) {
- 				ret = sock_intr_errno(timeo);
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index 896e9df..65d6189 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -2436,9 +2436,11 @@ u32 __tcp_select_window(struct sock *sk)
- 	int full_space = min_t(int, tp->window_clamp, allowed_space);
- 	int window;
- 
--	if (mss > full_space)
-+	if (unlikely(mss > full_space)) {
- 		mss = full_space;
--
-+		if (mss <= 0)
-+			return 0;
-+	}
- 	if (free_space < (full_space >> 1)) {
- 		icsk->icsk_ack.quick = 0;
- 
-diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
-index 532c3ef..798a095 100644
---- a/net/ipv6/inet6_connection_sock.c
-+++ b/net/ipv6/inet6_connection_sock.c
-@@ -173,7 +173,7 @@ int inet6_csk_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl_unused
- 	/* Restore final destination back after routing done */
- 	fl6.daddr = sk->sk_v6_daddr;
- 
--	res = ip6_xmit(sk, skb, &fl6, rcu_dereference(np->opt),
-+	res = ip6_xmit(sk, skb, &fl6, sk->sk_mark, rcu_dereference(np->opt),
- 		       np->tclass);
- 	rcu_read_unlock();
- 	return res;
-diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
-index d7d6d3a..0a59220 100644
---- a/net/ipv6/ip6_gre.c
-+++ b/net/ipv6/ip6_gre.c
-@@ -367,35 +367,37 @@ static void ip6gre_tunnel_uninit(struct net_device *dev)
- 
- 
- static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
--		u8 type, u8 code, int offset, __be32 info)
-+		       u8 type, u8 code, int offset, __be32 info)
- {
--	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb->data;
--	__be16 *p = (__be16 *)(skb->data + offset);
--	int grehlen = offset + 4;
-+	const struct gre_base_hdr *greh;
-+	const struct ipv6hdr *ipv6h;
-+	int grehlen = sizeof(*greh);
- 	struct ip6_tnl *t;
-+	int key_off = 0;
- 	__be16 flags;
-+	__be32 key;
- 
--	flags = p[0];
--	if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) {
--		if (flags&(GRE_VERSION|GRE_ROUTING))
--			return;
--		if (flags&GRE_KEY) {
--			grehlen += 4;
--			if (flags&GRE_CSUM)
--				grehlen += 4;
--		}
-+	if (!pskb_may_pull(skb, offset + grehlen))
-+		return;
-+	greh = (const struct gre_base_hdr *)(skb->data + offset);
-+	flags = greh->flags;
-+	if (flags & (GRE_VERSION | GRE_ROUTING))
-+		return;
-+	if (flags & GRE_CSUM)
-+		grehlen += 4;
-+	if (flags & GRE_KEY) {
-+		key_off = grehlen + offset;
-+		grehlen += 4;
- 	}
- 
--	/* If only 8 bytes returned, keyed message will be dropped here */
--	if (!pskb_may_pull(skb, grehlen))
-+	if (!pskb_may_pull(skb, offset + grehlen))
- 		return;
- 	ipv6h = (const struct ipv6hdr *)skb->data;
--	p = (__be16 *)(skb->data + offset);
-+	greh = (const struct gre_base_hdr *)(skb->data + offset);
-+	key = key_off ? *(__be32 *)(skb->data + key_off) : 0;
- 
- 	t = ip6gre_tunnel_lookup(skb->dev, &ipv6h->daddr, &ipv6h->saddr,
--				flags & GRE_KEY ?
--				*(((__be32 *)p) + (grehlen / 4) - 1) : 0,
--				p[1]);
-+				 key, greh->protocol);
- 	if (!t)
- 		return;
- 
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index 59eb4ed..9a87bfb 100644
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -163,7 +163,7 @@ int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
-  * which are using proper atomic operations or spinlocks.
-  */
- int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
--	     struct ipv6_txoptions *opt, int tclass)
-+	     __u32 mark, struct ipv6_txoptions *opt, int tclass)
- {
- 	struct net *net = sock_net(sk);
- 	const struct ipv6_pinfo *np = inet6_sk(sk);
-@@ -230,7 +230,7 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
- 
- 	skb->protocol = htons(ETH_P_IPV6);
- 	skb->priority = sk->sk_priority;
--	skb->mark = sk->sk_mark;
-+	skb->mark = mark;
- 
- 	mtu = dst_mtu(dst);
- 	if ((skb->len <= mtu) || skb->ignore_df || skb_is_gso(skb)) {
-diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
-index f95437f..f6ba452 100644
---- a/net/ipv6/ip6_tunnel.c
-+++ b/net/ipv6/ip6_tunnel.c
-@@ -400,18 +400,19 @@ ip6_tnl_dev_uninit(struct net_device *dev)
- 
- __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
- {
--	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) raw;
--	__u8 nexthdr = ipv6h->nexthdr;
--	__u16 off = sizeof(*ipv6h);
-+	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw;
-+	unsigned int nhoff = raw - skb->data;
-+	unsigned int off = nhoff + sizeof(*ipv6h);
-+	u8 next, nexthdr = ipv6h->nexthdr;
- 
- 	while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
--		__u16 optlen = 0;
- 		struct ipv6_opt_hdr *hdr;
--		if (raw + off + sizeof(*hdr) > skb->data &&
--		    !pskb_may_pull(skb, raw - skb->data + off + sizeof (*hdr)))
-+		u16 optlen;
-+
-+		if (!pskb_may_pull(skb, off + sizeof(*hdr)))
- 			break;
- 
--		hdr = (struct ipv6_opt_hdr *) (raw + off);
-+		hdr = (struct ipv6_opt_hdr *)(skb->data + off);
- 		if (nexthdr == NEXTHDR_FRAGMENT) {
- 			struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;
- 			if (frag_hdr->frag_off)
-@@ -422,20 +423,29 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
- 		} else {
- 			optlen = ipv6_optlen(hdr);
- 		}
-+		/* cache hdr->nexthdr, since pskb_may_pull() might
-+		 * invalidate hdr
-+		 */
-+		next = hdr->nexthdr;
- 		if (nexthdr == NEXTHDR_DEST) {
--			__u16 i = off + 2;
-+			u16 i = 2;
-+
-+			/* Remember : hdr is no longer valid at this point. */
-+			if (!pskb_may_pull(skb, off + optlen))
-+				break;
-+
- 			while (1) {
- 				struct ipv6_tlv_tnl_enc_lim *tel;
- 
- 				/* No more room for encapsulation limit */
--				if (i + sizeof (*tel) > off + optlen)
-+				if (i + sizeof(*tel) > optlen)
- 					break;
- 
--				tel = (struct ipv6_tlv_tnl_enc_lim *) &raw[i];
-+				tel = (struct ipv6_tlv_tnl_enc_lim *)(skb->data + off + i);
- 				/* return index of option if found and valid */
- 				if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
- 				    tel->length == 1)
--					return i;
-+					return i + off - nhoff;
- 				/* else jump to next option */
- 				if (tel->type)
- 					i += tel->length + 2;
-@@ -443,7 +453,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
- 					i++;
- 			}
- 		}
--		nexthdr = hdr->nexthdr;
-+		nexthdr = next;
- 		off += optlen;
- 	}
- 	return 0;
-diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
-index 14a3903..1bdc703 100644
---- a/net/ipv6/mcast.c
-+++ b/net/ipv6/mcast.c
-@@ -81,7 +81,7 @@ static void mld_gq_timer_expire(unsigned long data);
- static void mld_ifc_timer_expire(unsigned long data);
- static void mld_ifc_event(struct inet6_dev *idev);
- static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *pmc);
--static void mld_del_delrec(struct inet6_dev *idev, const struct in6_addr *addr);
-+static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *pmc);
- static void mld_clear_delrec(struct inet6_dev *idev);
- static bool mld_in_v1_mode(const struct inet6_dev *idev);
- static int sf_setstate(struct ifmcaddr6 *pmc);
-@@ -692,9 +692,9 @@ static void igmp6_group_dropped(struct ifmcaddr6 *mc)
- 			dev_mc_del(dev, buf);
- 	}
- 
--	if (mc->mca_flags & MAF_NOREPORT)
--		goto done;
- 	spin_unlock_bh(&mc->mca_lock);
-+	if (mc->mca_flags & MAF_NOREPORT)
-+		return;
- 
- 	if (!mc->idev->dead)
- 		igmp6_leave_group(mc);
-@@ -702,8 +702,6 @@ static void igmp6_group_dropped(struct ifmcaddr6 *mc)
- 	spin_lock_bh(&mc->mca_lock);
- 	if (del_timer(&mc->mca_timer))
- 		atomic_dec(&mc->mca_refcnt);
--done:
--	ip6_mc_clear_src(mc);
- 	spin_unlock_bh(&mc->mca_lock);
- }
- 
-@@ -748,10 +746,11 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
- 	spin_unlock_bh(&idev->mc_lock);
- }
- 
--static void mld_del_delrec(struct inet6_dev *idev, const struct in6_addr *pmca)
-+static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
- {
- 	struct ifmcaddr6 *pmc, *pmc_prev;
--	struct ip6_sf_list *psf, *psf_next;
-+	struct ip6_sf_list *psf;
-+	struct in6_addr *pmca = &im->mca_addr;
- 
- 	spin_lock_bh(&idev->mc_lock);
- 	pmc_prev = NULL;
-@@ -768,14 +767,21 @@ static void mld_del_delrec(struct inet6_dev *idev, const struct in6_addr *pmca)
- 	}
- 	spin_unlock_bh(&idev->mc_lock);
- 
-+	spin_lock_bh(&im->mca_lock);
- 	if (pmc) {
--		for (psf = pmc->mca_tomb; psf; psf = psf_next) {
--			psf_next = psf->sf_next;
--			kfree(psf);
-+		im->idev = pmc->idev;
-+		im->mca_crcount = idev->mc_qrv;
-+		im->mca_sfmode = pmc->mca_sfmode;
-+		if (pmc->mca_sfmode == MCAST_INCLUDE) {
-+			im->mca_tomb = pmc->mca_tomb;
-+			im->mca_sources = pmc->mca_sources;
-+			for (psf = im->mca_sources; psf; psf = psf->sf_next)
-+				psf->sf_crcount = im->mca_crcount;
- 		}
- 		in6_dev_put(pmc->idev);
- 		kfree(pmc);
- 	}
-+	spin_unlock_bh(&im->mca_lock);
- }
- 
- static void mld_clear_delrec(struct inet6_dev *idev)
-@@ -904,7 +910,7 @@ int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
- 	mca_get(mc);
- 	write_unlock_bh(&idev->lock);
- 
--	mld_del_delrec(idev, &mc->mca_addr);
-+	mld_del_delrec(idev, mc);
- 	igmp6_group_added(mc);
- 	ma_put(mc);
- 	return 0;
-@@ -927,6 +933,7 @@ int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr)
- 				write_unlock_bh(&idev->lock);
- 
- 				igmp6_group_dropped(ma);
-+				ip6_mc_clear_src(ma);
- 
- 				ma_put(ma);
- 				return 0;
-@@ -2501,15 +2508,17 @@ void ipv6_mc_down(struct inet6_dev *idev)
- 	/* Withdraw multicast list */
- 
- 	read_lock_bh(&idev->lock);
--	mld_ifc_stop_timer(idev);
--	mld_gq_stop_timer(idev);
--	mld_dad_stop_timer(idev);
- 
- 	for (i = idev->mc_list; i; i = i->next)
- 		igmp6_group_dropped(i);
--	read_unlock_bh(&idev->lock);
- 
--	mld_clear_delrec(idev);
-+	/* Should stop timer after group drop. or we will
-+	 * start timer again in mld_ifc_event()
-+	 */
-+	mld_ifc_stop_timer(idev);
-+	mld_gq_stop_timer(idev);
-+	mld_dad_stop_timer(idev);
-+	read_unlock_bh(&idev->lock);
- }
- 
- static void ipv6_mc_reset(struct inet6_dev *idev)
-@@ -2531,8 +2540,10 @@ void ipv6_mc_up(struct inet6_dev *idev)
- 
- 	read_lock_bh(&idev->lock);
- 	ipv6_mc_reset(idev);
--	for (i = idev->mc_list; i; i = i->next)
-+	for (i = idev->mc_list; i; i = i->next) {
-+		mld_del_delrec(idev, i);
- 		igmp6_group_added(i);
-+	}
- 	read_unlock_bh(&idev->lock);
- }
- 
-@@ -2565,6 +2576,7 @@ void ipv6_mc_destroy_dev(struct inet6_dev *idev)
- 
- 	/* Deactivate timers */
- 	ipv6_mc_down(idev);
-+	mld_clear_delrec(idev);
- 
- 	/* Delete all-nodes address. */
- 	/* We cannot call ipv6_dev_mc_dec() directly, our caller in
-@@ -2579,11 +2591,9 @@ void ipv6_mc_destroy_dev(struct inet6_dev *idev)
- 	write_lock_bh(&idev->lock);
- 	while ((i = idev->mc_list) != NULL) {
- 		idev->mc_list = i->next;
--		write_unlock_bh(&idev->lock);
- 
--		igmp6_group_dropped(i);
-+		write_unlock_bh(&idev->lock);
- 		ma_put(i);
--
- 		write_lock_bh(&idev->lock);
- 	}
- 	write_unlock_bh(&idev->lock);
-diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
-index b1cdf80..40d7405 100644
---- a/net/ipv6/sit.c
-+++ b/net/ipv6/sit.c
-@@ -1390,6 +1390,7 @@ static int ipip6_tunnel_init(struct net_device *dev)
- 	err = dst_cache_init(&tunnel->dst_cache, GFP_KERNEL);
- 	if (err) {
- 		free_percpu(dev->tstats);
-+		dev->tstats = NULL;
- 		return err;
- 	}
- 
-diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index b9f1fee..6673965 100644
---- a/net/ipv6/tcp_ipv6.c
-+++ b/net/ipv6/tcp_ipv6.c
-@@ -467,7 +467,7 @@ static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
- 		opt = ireq->ipv6_opt;
- 		if (!opt)
- 			opt = rcu_dereference(np->opt);
--		err = ip6_xmit(sk, skb, fl6, opt, np->tclass);
-+		err = ip6_xmit(sk, skb, fl6, sk->sk_mark, opt, np->tclass);
- 		rcu_read_unlock();
- 		err = net_xmit_eval(err);
- 	}
-@@ -837,7 +837,7 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32
- 	dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
- 	if (!IS_ERR(dst)) {
- 		skb_dst_set(buff, dst);
--		ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
-+		ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL, tclass);
- 		TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
- 		if (rst)
- 			TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
-@@ -987,6 +987,16 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
- 	return 0; /* don't send reset */
- }
- 
-+static void tcp_v6_restore_cb(struct sk_buff *skb)
-+{
-+	/* We need to move header back to the beginning if xfrm6_policy_check()
-+	 * and tcp_v6_fill_cb() are going to be called again.
-+	 * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
-+	 */
-+	memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
-+		sizeof(struct inet6_skb_parm));
-+}
-+
- static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
- 					 struct request_sock *req,
- 					 struct dst_entry *dst,
-@@ -1178,8 +1188,10 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
- 						      sk_gfp_mask(sk, GFP_ATOMIC));
- 			consume_skb(ireq->pktopts);
- 			ireq->pktopts = NULL;
--			if (newnp->pktoptions)
-+			if (newnp->pktoptions) {
-+				tcp_v6_restore_cb(newnp->pktoptions);
- 				skb_set_owner_r(newnp->pktoptions, newsk);
-+			}
- 		}
- 	}
- 
-@@ -1194,16 +1206,6 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
- 	return NULL;
- }
- 
--static void tcp_v6_restore_cb(struct sk_buff *skb)
--{
--	/* We need to move header back to the beginning if xfrm6_policy_check()
--	 * and tcp_v6_fill_cb() are going to be called again.
--	 * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
--	 */
--	memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
--		sizeof(struct inet6_skb_parm));
--}
--
- /* The socket must have it's spinlock held when we get
-  * here, unless it is a TCP_LISTEN socket.
-  *
-diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
-index 2599af6..181e755c 100644
---- a/net/l2tp/l2tp_core.h
-+++ b/net/l2tp/l2tp_core.h
-@@ -273,6 +273,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb,
- int l2tp_nl_register_ops(enum l2tp_pwtype pw_type,
- 			 const struct l2tp_nl_cmd_ops *ops);
- void l2tp_nl_unregister_ops(enum l2tp_pwtype pw_type);
-+int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg);
- 
- /* Session reference counts. Incremented when code obtains a reference
-  * to a session.
-diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
-index 8938b6b..c0f0750 100644
---- a/net/l2tp/l2tp_ip.c
-+++ b/net/l2tp/l2tp_ip.c
-@@ -11,6 +11,7 @@
- 
- #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
- 
-+#include <asm/ioctls.h>
- #include <linux/icmp.h>
- #include <linux/module.h>
- #include <linux/skbuff.h>
-@@ -560,6 +561,30 @@ static int l2tp_ip_recvmsg(struct sock *sk, struct msghdr *msg,
- 	return err ? err : copied;
- }
- 
-+int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg)
-+{
-+	struct sk_buff *skb;
-+	int amount;
-+
-+	switch (cmd) {
-+	case SIOCOUTQ:
-+		amount = sk_wmem_alloc_get(sk);
-+		break;
-+	case SIOCINQ:
-+		spin_lock_bh(&sk->sk_receive_queue.lock);
-+		skb = skb_peek(&sk->sk_receive_queue);
-+		amount = skb ? skb->len : 0;
-+		spin_unlock_bh(&sk->sk_receive_queue.lock);
-+		break;
-+
-+	default:
-+		return -ENOIOCTLCMD;
-+	}
-+
-+	return put_user(amount, (int __user *)arg);
-+}
-+EXPORT_SYMBOL(l2tp_ioctl);
-+
- static struct proto l2tp_ip_prot = {
- 	.name		   = "L2TP/IP",
- 	.owner		   = THIS_MODULE,
-@@ -568,7 +593,7 @@ static struct proto l2tp_ip_prot = {
- 	.bind		   = l2tp_ip_bind,
- 	.connect	   = l2tp_ip_connect,
- 	.disconnect	   = l2tp_ip_disconnect,
--	.ioctl		   = udp_ioctl,
-+	.ioctl		   = l2tp_ioctl,
- 	.destroy	   = l2tp_ip_destroy_sock,
- 	.setsockopt	   = ip_setsockopt,
- 	.getsockopt	   = ip_getsockopt,
-diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
-index aa821cb..1a65c9a 100644
---- a/net/l2tp/l2tp_ip6.c
-+++ b/net/l2tp/l2tp_ip6.c
-@@ -729,7 +729,7 @@ static struct proto l2tp_ip6_prot = {
- 	.bind		   = l2tp_ip6_bind,
- 	.connect	   = l2tp_ip6_connect,
- 	.disconnect	   = l2tp_ip6_disconnect,
--	.ioctl		   = udp_ioctl,
-+	.ioctl		   = l2tp_ioctl,
- 	.destroy	   = l2tp_ip6_destroy_sock,
- 	.setsockopt	   = ipv6_setsockopt,
- 	.getsockopt	   = ipv6_getsockopt,
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 94e4a59..458722b 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -2813,7 +2813,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
- 	struct virtio_net_hdr vnet_hdr = { 0 };
- 	int offset = 0;
- 	struct packet_sock *po = pkt_sk(sk);
--	int hlen, tlen;
-+	int hlen, tlen, linear;
- 	int extra_len = 0;
- 
- 	/*
-@@ -2874,8 +2874,9 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
- 	err = -ENOBUFS;
- 	hlen = LL_RESERVED_SPACE(dev);
- 	tlen = dev->needed_tailroom;
--	skb = packet_alloc_skb(sk, hlen + tlen, hlen, len,
--			       __virtio16_to_cpu(vio_le(), vnet_hdr.hdr_len),
-+	linear = __virtio16_to_cpu(vio_le(), vnet_hdr.hdr_len);
-+	linear = max(linear, min_t(int, len, dev->hard_header_len));
-+	skb = packet_alloc_skb(sk, hlen + tlen, hlen, len, linear,
- 			       msg->msg_flags & MSG_DONTWAIT, &err);
- 	if (skb == NULL)
- 		goto out_unlock;
-diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
-index f935429..b12bc2a 100644
---- a/net/sched/cls_matchall.c
-+++ b/net/sched/cls_matchall.c
-@@ -16,16 +16,11 @@
- #include <net/sch_generic.h>
- #include <net/pkt_cls.h>
- 
--struct cls_mall_filter {
-+struct cls_mall_head {
- 	struct tcf_exts exts;
- 	struct tcf_result res;
- 	u32 handle;
--	struct rcu_head	rcu;
- 	u32 flags;
--};
--
--struct cls_mall_head {
--	struct cls_mall_filter *filter;
- 	struct rcu_head	rcu;
- };
- 
-@@ -33,38 +28,29 @@ static int mall_classify(struct sk_buff *skb, const struct tcf_proto *tp,
- 			 struct tcf_result *res)
- {
- 	struct cls_mall_head *head = rcu_dereference_bh(tp->root);
--	struct cls_mall_filter *f = head->filter;
- 
--	if (tc_skip_sw(f->flags))
-+	if (tc_skip_sw(head->flags))
- 		return -1;
- 
--	return tcf_exts_exec(skb, &f->exts, res);
-+	return tcf_exts_exec(skb, &head->exts, res);
- }
- 
- static int mall_init(struct tcf_proto *tp)
- {
--	struct cls_mall_head *head;
--
--	head = kzalloc(sizeof(*head), GFP_KERNEL);
--	if (!head)
--		return -ENOBUFS;
--
--	rcu_assign_pointer(tp->root, head);
--
- 	return 0;
- }
- 
--static void mall_destroy_filter(struct rcu_head *head)
-+static void mall_destroy_rcu(struct rcu_head *rcu)
- {
--	struct cls_mall_filter *f = container_of(head, struct cls_mall_filter, rcu);
-+	struct cls_mall_head *head = container_of(rcu, struct cls_mall_head,
-+						  rcu);
- 
--	tcf_exts_destroy(&f->exts);
--
--	kfree(f);
-+	tcf_exts_destroy(&head->exts);
-+	kfree(head);
- }
- 
- static int mall_replace_hw_filter(struct tcf_proto *tp,
--				  struct cls_mall_filter *f,
-+				  struct cls_mall_head *head,
- 				  unsigned long cookie)
- {
- 	struct net_device *dev = tp->q->dev_queue->dev;
-@@ -74,7 +60,7 @@ static int mall_replace_hw_filter(struct tcf_proto *tp,
- 	offload.type = TC_SETUP_MATCHALL;
- 	offload.cls_mall = &mall_offload;
- 	offload.cls_mall->command = TC_CLSMATCHALL_REPLACE;
--	offload.cls_mall->exts = &f->exts;
-+	offload.cls_mall->exts = &head->exts;
- 	offload.cls_mall->cookie = cookie;
- 
- 	return dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle, tp->protocol,
-@@ -82,7 +68,7 @@ static int mall_replace_hw_filter(struct tcf_proto *tp,
- }
- 
- static void mall_destroy_hw_filter(struct tcf_proto *tp,
--				   struct cls_mall_filter *f,
-+				   struct cls_mall_head *head,
- 				   unsigned long cookie)
- {
- 	struct net_device *dev = tp->q->dev_queue->dev;
-@@ -103,29 +89,20 @@ static bool mall_destroy(struct tcf_proto *tp, bool force)
- {
- 	struct cls_mall_head *head = rtnl_dereference(tp->root);
- 	struct net_device *dev = tp->q->dev_queue->dev;
--	struct cls_mall_filter *f = head->filter;
- 
--	if (!force && f)
--		return false;
-+	if (!head)
-+		return true;
- 
--	if (f) {
--		if (tc_should_offload(dev, tp, f->flags))
--			mall_destroy_hw_filter(tp, f, (unsigned long) f);
-+	if (tc_should_offload(dev, tp, head->flags))
-+		mall_destroy_hw_filter(tp, head, (unsigned long) head);
- 
--		call_rcu(&f->rcu, mall_destroy_filter);
--	}
--	kfree_rcu(head, rcu);
-+	call_rcu(&head->rcu, mall_destroy_rcu);
- 	return true;
- }
- 
- static unsigned long mall_get(struct tcf_proto *tp, u32 handle)
- {
--	struct cls_mall_head *head = rtnl_dereference(tp->root);
--	struct cls_mall_filter *f = head->filter;
--
--	if (f && f->handle == handle)
--		return (unsigned long) f;
--	return 0;
-+	return 0UL;
- }
- 
- static const struct nla_policy mall_policy[TCA_MATCHALL_MAX + 1] = {
-@@ -134,7 +111,7 @@ static const struct nla_policy mall_policy[TCA_MATCHALL_MAX + 1] = {
- };
- 
- static int mall_set_parms(struct net *net, struct tcf_proto *tp,
--			  struct cls_mall_filter *f,
-+			  struct cls_mall_head *head,
- 			  unsigned long base, struct nlattr **tb,
- 			  struct nlattr *est, bool ovr)
- {
-@@ -147,11 +124,11 @@ static int mall_set_parms(struct net *net, struct tcf_proto *tp,
- 		return err;
- 
- 	if (tb[TCA_MATCHALL_CLASSID]) {
--		f->res.classid = nla_get_u32(tb[TCA_MATCHALL_CLASSID]);
--		tcf_bind_filter(tp, &f->res, base);
-+		head->res.classid = nla_get_u32(tb[TCA_MATCHALL_CLASSID]);
-+		tcf_bind_filter(tp, &head->res, base);
- 	}
- 
--	tcf_exts_change(tp, &f->exts, &e);
-+	tcf_exts_change(tp, &head->exts, &e);
- 
- 	return 0;
- }
-@@ -162,21 +139,17 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
- 		       unsigned long *arg, bool ovr)
- {
- 	struct cls_mall_head *head = rtnl_dereference(tp->root);
--	struct cls_mall_filter *fold = (struct cls_mall_filter *) *arg;
- 	struct net_device *dev = tp->q->dev_queue->dev;
--	struct cls_mall_filter *f;
- 	struct nlattr *tb[TCA_MATCHALL_MAX + 1];
-+	struct cls_mall_head *new;
- 	u32 flags = 0;
- 	int err;
- 
- 	if (!tca[TCA_OPTIONS])
- 		return -EINVAL;
- 
--	if (head->filter)
--		return -EBUSY;
--
--	if (fold)
--		return -EINVAL;
-+	if (head)
-+		return -EEXIST;
- 
- 	err = nla_parse_nested(tb, TCA_MATCHALL_MAX,
- 			       tca[TCA_OPTIONS], mall_policy);
-@@ -189,23 +162,23 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
- 			return -EINVAL;
- 	}
- 
--	f = kzalloc(sizeof(*f), GFP_KERNEL);
--	if (!f)
-+	new = kzalloc(sizeof(*new), GFP_KERNEL);
-+	if (!new)
- 		return -ENOBUFS;
- 
--	tcf_exts_init(&f->exts, TCA_MATCHALL_ACT, 0);
-+	tcf_exts_init(&new->exts, TCA_MATCHALL_ACT, 0);
- 
- 	if (!handle)
- 		handle = 1;
--	f->handle = handle;
--	f->flags = flags;
-+	new->handle = handle;
-+	new->flags = flags;
- 
--	err = mall_set_parms(net, tp, f, base, tb, tca[TCA_RATE], ovr);
-+	err = mall_set_parms(net, tp, new, base, tb, tca[TCA_RATE], ovr);
- 	if (err)
- 		goto errout;
- 
- 	if (tc_should_offload(dev, tp, flags)) {
--		err = mall_replace_hw_filter(tp, f, (unsigned long) f);
-+		err = mall_replace_hw_filter(tp, new, (unsigned long) new);
- 		if (err) {
- 			if (tc_skip_sw(flags))
- 				goto errout;
-@@ -214,39 +187,29 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
- 		}
- 	}
- 
--	*arg = (unsigned long) f;
--	rcu_assign_pointer(head->filter, f);
--
-+	*arg = (unsigned long) head;
-+	rcu_assign_pointer(tp->root, new);
-+	if (head)
-+		call_rcu(&head->rcu, mall_destroy_rcu);
- 	return 0;
- 
- errout:
--	kfree(f);
-+	kfree(new);
- 	return err;
- }
- 
- static int mall_delete(struct tcf_proto *tp, unsigned long arg)
- {
--	struct cls_mall_head *head = rtnl_dereference(tp->root);
--	struct cls_mall_filter *f = (struct cls_mall_filter *) arg;
--	struct net_device *dev = tp->q->dev_queue->dev;
--
--	if (tc_should_offload(dev, tp, f->flags))
--		mall_destroy_hw_filter(tp, f, (unsigned long) f);
--
--	RCU_INIT_POINTER(head->filter, NULL);
--	tcf_unbind_filter(tp, &f->res);
--	call_rcu(&f->rcu, mall_destroy_filter);
--	return 0;
-+	return -EOPNOTSUPP;
- }
- 
- static void mall_walk(struct tcf_proto *tp, struct tcf_walker *arg)
- {
- 	struct cls_mall_head *head = rtnl_dereference(tp->root);
--	struct cls_mall_filter *f = head->filter;
- 
- 	if (arg->count < arg->skip)
- 		goto skip;
--	if (arg->fn(tp, (unsigned long) f, arg) < 0)
-+	if (arg->fn(tp, (unsigned long) head, arg) < 0)
- 		arg->stop = 1;
- skip:
- 	arg->count++;
-@@ -255,28 +218,28 @@ static void mall_walk(struct tcf_proto *tp, struct tcf_walker *arg)
- static int mall_dump(struct net *net, struct tcf_proto *tp, unsigned long fh,
- 		     struct sk_buff *skb, struct tcmsg *t)
- {
--	struct cls_mall_filter *f = (struct cls_mall_filter *) fh;
-+	struct cls_mall_head *head = (struct cls_mall_head *) fh;
- 	struct nlattr *nest;
- 
--	if (!f)
-+	if (!head)
- 		return skb->len;
- 
--	t->tcm_handle = f->handle;
-+	t->tcm_handle = head->handle;
- 
- 	nest = nla_nest_start(skb, TCA_OPTIONS);
- 	if (!nest)
- 		goto nla_put_failure;
- 
--	if (f->res.classid &&
--	    nla_put_u32(skb, TCA_MATCHALL_CLASSID, f->res.classid))
-+	if (head->res.classid &&
-+	    nla_put_u32(skb, TCA_MATCHALL_CLASSID, head->res.classid))
- 		goto nla_put_failure;
- 
--	if (tcf_exts_dump(skb, &f->exts))
-+	if (tcf_exts_dump(skb, &head->exts))
- 		goto nla_put_failure;
- 
- 	nla_nest_end(skb, nest);
- 
--	if (tcf_exts_dump_stats(skb, &f->exts) < 0)
-+	if (tcf_exts_dump_stats(skb, &head->exts) < 0)
- 		goto nla_put_failure;
- 
- 	return skb->len;
-diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
-index 176af30..6a2532d 100644
---- a/net/sctp/ipv6.c
-+++ b/net/sctp/ipv6.c
-@@ -222,7 +222,8 @@ static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
- 	SCTP_INC_STATS(sock_net(sk), SCTP_MIB_OUTSCTPPACKS);
- 
- 	rcu_read_lock();
--	res = ip6_xmit(sk, skb, fl6, rcu_dereference(np->opt), np->tclass);
-+	res = ip6_xmit(sk, skb, fl6, sk->sk_mark, rcu_dereference(np->opt),
-+		       np->tclass);
- 	rcu_read_unlock();
- 	return res;
- }
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index ca12aa3..6cbe5bd 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -7427,7 +7427,8 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
- 		 */
- 		release_sock(sk);
- 		current_timeo = schedule_timeout(current_timeo);
--		BUG_ON(sk != asoc->base.sk);
-+		if (sk != asoc->base.sk)
-+			goto do_error;
- 		lock_sock(sk);
- 
- 		*timeo_p = current_timeo;

diff --git a/4.9.11/0000_README b/4.9.12/0000_README
similarity index 89%
rename from 4.9.11/0000_README
rename to 4.9.12/0000_README
index 27a4c3e..fde5541 100644
--- a/4.9.11/0000_README
+++ b/4.9.12/0000_README
@@ -2,15 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1009_linux-4.9.10.patch
-From:	http://www.kernel.org
-Desc:	Linux 4.9.10
-
-Patch:	1010_linux-4.9.11.patch
-From:	http://www.kernel.org
-Desc:	Linux 4.9.11
-
-Patch:	4420_grsecurity-3.1-4.9.11-201702181444.patch
+Patch:	4420_grsecurity-3.1-4.9.12-201702231830.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/4.9.11/4420_grsecurity-3.1-4.9.11-201702181444.patch b/4.9.12/4420_grsecurity-3.1-4.9.12-201702231830.patch
similarity index 99%
rename from 4.9.11/4420_grsecurity-3.1-4.9.11-201702181444.patch
rename to 4.9.12/4420_grsecurity-3.1-4.9.12-201702231830.patch
index 91575ee..ce908bf 100644
--- a/4.9.11/4420_grsecurity-3.1-4.9.11-201702181444.patch
+++ b/4.9.12/4420_grsecurity-3.1-4.9.12-201702231830.patch
@@ -419,7 +419,7 @@ index 3d0ae15..84e5412 100644
        cmd_syscalls = $(CONFIG_SHELL) $< $(CC) $(c_flags) $(missing_syscalls_flags)
  
 diff --git a/Makefile b/Makefile
-index 18b0c5a..54a9fea 100644
+index 3cd6f6f..43e4233 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -26426,7 +26426,7 @@ index 17f2186..f394307 100644
  
  /*
 diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
-index 83db0ea..137bc2c 100644
+index 83db0ea..0ad5d22 100644
 --- a/arch/x86/include/asm/processor.h
 +++ b/arch/x86/include/asm/processor.h
 @@ -136,7 +136,7 @@ struct cpuinfo_x86 {
@@ -26447,18 +26447,10 @@ index 83db0ea..137bc2c 100644
  #define cpu_data(cpu)		per_cpu(cpu_info, cpu)
  #else
  #define cpu_info		boot_cpu_data
-@@ -206,9 +206,21 @@ static inline void native_cpuid(unsigned int *eax, unsigned int *ebx,
+@@ -206,9 +206,13 @@ static inline void native_cpuid(unsigned int *eax, unsigned int *ebx,
  	    : "memory");
  }
  
-+/* invpcid (%rdx),%rax */
-+#define __ASM_INVPCID ".byte 0x66,0x0f,0x38,0x82,0x02"
-+
-+#define INVPCID_SINGLE_ADDRESS	0UL
-+#define INVPCID_SINGLE_CONTEXT	1UL
-+#define INVPCID_ALL_GLOBAL	2UL
-+#define INVPCID_ALL_NONGLOBAL	3UL
-+
 +#define PCID_KERNEL		0UL
 +#define PCID_USER		1UL
 +#define PCID_NOFLUSH		(1UL << 63)
@@ -26470,7 +26462,7 @@ index 83db0ea..137bc2c 100644
  }
  
  #ifdef CONFIG_X86_32
-@@ -308,11 +320,9 @@ struct tss_struct {
+@@ -308,11 +312,9 @@ struct tss_struct {
  
  } ____cacheline_aligned;
  
@@ -26483,7 +26475,7 @@ index 83db0ea..137bc2c 100644
  
  /*
   * Save the original ist values for checking stack pointers during debugging
-@@ -341,6 +351,7 @@ DECLARE_PER_CPU_FIRST(union irq_stack_union, irq_stack_union) __visible;
+@@ -341,6 +343,7 @@ DECLARE_PER_CPU_FIRST(union irq_stack_union, irq_stack_union) __visible;
  DECLARE_INIT_PER_CPU(irq_stack_union);
  
  DECLARE_PER_CPU(char *, irq_stack_ptr);
@@ -26491,7 +26483,7 @@ index 83db0ea..137bc2c 100644
  DECLARE_PER_CPU(unsigned int, irq_count);
  extern asmlinkage void ignore_sysret(void);
  #else	/* X86_64 */
-@@ -389,6 +400,7 @@ struct thread_struct {
+@@ -389,6 +392,7 @@ struct thread_struct {
  	unsigned short		ds;
  	unsigned short		fsindex;
  	unsigned short		gsindex;
@@ -26499,7 +26491,7 @@ index 83db0ea..137bc2c 100644
  #endif
  
  	u32			status;		/* thread synchronous flags */
-@@ -405,6 +417,9 @@ struct thread_struct {
+@@ -405,6 +409,9 @@ struct thread_struct {
  	unsigned long gs;
  #endif
  
@@ -26509,7 +26501,7 @@ index 83db0ea..137bc2c 100644
  	/* Save middle states of ptrace breakpoints */
  	struct perf_event	*ptrace_bps[HBP_NUM];
  	/* Debug status used for traps, single steps, etc... */
-@@ -426,17 +441,11 @@ struct thread_struct {
+@@ -426,17 +433,11 @@ struct thread_struct {
  	unsigned		io_bitmap_max;
  
  	mm_segment_t		addr_limit;
@@ -26529,7 +26521,7 @@ index 83db0ea..137bc2c 100644
  
  /*
   * Thread-synchronous status.
-@@ -488,12 +497,8 @@ static inline void native_swapgs(void)
+@@ -488,12 +489,8 @@ static inline void native_swapgs(void)
  
  static inline unsigned long current_top_of_stack(void)
  {
@@ -26542,7 +26534,7 @@ index 83db0ea..137bc2c 100644
  }
  
  #ifdef CONFIG_PARAVIRT
-@@ -718,20 +723,30 @@ static inline void spin_lock_prefetch(const void *x)
+@@ -718,20 +715,30 @@ static inline void spin_lock_prefetch(const void *x)
  #define TOP_OF_INIT_STACK ((unsigned long)&init_stack + sizeof(init_stack) - \
  			   TOP_OF_KERNEL_STACK_PADDING)
  
@@ -26574,7 +26566,7 @@ index 83db0ea..137bc2c 100644
  }
  
  /*
-@@ -744,12 +759,7 @@ static inline void spin_lock_prefetch(const void *x)
+@@ -744,12 +751,7 @@ static inline void spin_lock_prefetch(const void *x)
   * "struct pt_regs" is possible, but they may contain the
   * completely wrong values.
   */
@@ -26588,7 +26580,7 @@ index 83db0ea..137bc2c 100644
  
  #define KSTK_ESP(task)		(task_pt_regs(task)->sp)
  
-@@ -763,13 +773,13 @@ static inline void spin_lock_prefetch(const void *x)
+@@ -763,13 +765,13 @@ static inline void spin_lock_prefetch(const void *x)
   * particular problem by preventing anything from being mapped
   * at the maximum canonical address.
   */
@@ -26604,7 +26596,7 @@ index 83db0ea..137bc2c 100644
  
  #define TASK_SIZE		(test_thread_flag(TIF_ADDR32) ? \
  					IA32_PAGE_OFFSET : TASK_SIZE_MAX)
-@@ -782,6 +792,7 @@ static inline void spin_lock_prefetch(const void *x)
+@@ -782,6 +784,7 @@ static inline void spin_lock_prefetch(const void *x)
  #define INIT_THREAD  {						\
  	.sp0			= TOP_OF_INIT_STACK,		\
  	.addr_limit		= KERNEL_DS,			\
@@ -26612,7 +26604,7 @@ index 83db0ea..137bc2c 100644
  }
  
  #define task_pt_regs(tsk)	((struct pt_regs *)(tsk)->thread.sp0 - 1)
-@@ -800,6 +811,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
+@@ -800,6 +803,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
   */
  #define TASK_UNMAPPED_BASE	(PAGE_ALIGN(TASK_SIZE / 3))
  
@@ -26623,7 +26615,7 @@ index 83db0ea..137bc2c 100644
  #define KSTK_EIP(task)		(task_pt_regs(task)->ip)
  
  /* Get/set a process' ability to use the timestamp counter instruction */
-@@ -845,7 +860,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves)
+@@ -845,7 +852,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves)
  	return 0;
  }
  
@@ -26632,7 +26624,7 @@ index 83db0ea..137bc2c 100644
  extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
  
  void default_idle(void);
-@@ -855,6 +870,6 @@ bool xen_set_default_idle(void);
+@@ -855,6 +862,6 @@ bool xen_set_default_idle(void);
  #define xen_set_default_idle 0
  #endif
  
@@ -27484,7 +27476,7 @@ index ad6f5eb0..1b4909d 100644
  
  #ifdef CONFIG_COMPAT
 diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
-index 6fa8594..30950f3 100644
+index 6fa8594..c5b8ce1 100644
 --- a/arch/x86/include/asm/tlbflush.h
 +++ b/arch/x86/include/asm/tlbflush.h
 @@ -89,7 +89,9 @@ static inline void cr4_set_bits(unsigned long mask)
@@ -27515,15 +27507,12 @@ index 6fa8594..30950f3 100644
  	return this_cpu_read(cpu_tlbstate.cr4);
  }
  
-@@ -135,6 +140,25 @@ static inline void cr4_set_bits_and_update_boot(unsigned long mask)
+@@ -135,6 +140,22 @@ static inline void cr4_set_bits_and_update_boot(unsigned long mask)
  
  static inline void __native_flush_tlb(void)
  {
 +	if (static_cpu_has(X86_FEATURE_INVPCID)) {
-+		u64 descriptor[2];
-+
-+		descriptor[0] = PCID_KERNEL;
-+		asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_ALL_NONGLOBAL) : "memory");
++		invpcid_flush_all_nonglobals();
 +		return;
 +	}
 +
@@ -27541,58 +27530,35 @@ index 6fa8594..30950f3 100644
  	/*
  	 * If current->mm == NULL then we borrow a mm which may change during a
  	 * task switch and therefore we must not be preempted while we write CR3
-@@ -147,13 +171,21 @@ static inline void __native_flush_tlb(void)
- 
- static inline void __native_flush_tlb_global_irq_disabled(void)
- {
--	unsigned long cr4;
-+	if (static_cpu_has(X86_FEATURE_INVPCID)) {
-+		u64 descriptor[2];
- 
--	cr4 = this_cpu_read(cpu_tlbstate.cr4);
--	/* clear PGE */
--	native_write_cr4(cr4 & ~X86_CR4_PGE);
--	/* write old PGE again and flush TLBs */
--	native_write_cr4(cr4);
-+		descriptor[0] = PCID_KERNEL;
-+		asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_ALL_GLOBAL) : "memory");
-+	} else {
-+		unsigned long cr4;
-+
-+		cr4 = this_cpu_read(cpu_tlbstate.cr4);
-+		BUG_ON(cr4 != __read_cr4());
-+		/* clear PGE */
-+		native_write_cr4(cr4 & ~X86_CR4_PGE);
-+		/* write old PGE again and flush TLBs */
-+		native_write_cr4(cr4);
-+	}
- }
+@@ -150,6 +171,7 @@ static inline void __native_flush_tlb_global_irq_disabled(void)
+ 	unsigned long cr4;
  
- static inline void __native_flush_tlb_global(void)
-@@ -183,6 +215,43 @@ static inline void __native_flush_tlb_global(void)
+ 	cr4 = this_cpu_read(cpu_tlbstate.cr4);
++	BUG_ON(cr4 != __read_cr4());
+ 	/* clear PGE */
+ 	native_write_cr4(cr4 & ~X86_CR4_PGE);
+ 	/* write old PGE again and flush TLBs */
+@@ -183,6 +205,40 @@ static inline void __native_flush_tlb_global(void)
  
  static inline void __native_flush_tlb_single(unsigned long addr)
  {
 +	if (static_cpu_has(X86_FEATURE_INVPCID)) {
-+		u64 descriptor[2];
-+
-+		descriptor[0] = PCID_KERNEL;
-+		descriptor[1] = addr;
++		unsigned long pcid = PCID_KERNEL;
 +
 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
 +		if (static_cpu_has(X86_FEATURE_PCIDUDEREF)) {
 +			if (!static_cpu_has(X86_FEATURE_STRONGUDEREF) || addr >= TASK_SIZE_MAX) {
 +				if (addr < TASK_SIZE_MAX)
-+					descriptor[1] += pax_user_shadow_base;
-+				asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_ADDRESS) : "memory");
++					invpcid_flush_one(pcid, addr + pax_user_shadow_base);
++				else
++					invpcid_flush_one(pcid, addr);
 +			}
 +
-+			descriptor[0] = PCID_USER;
-+			descriptor[1] = addr;
++			pcid = PCID_USER;
 +		}
 +#endif
 +
-+		asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_ADDRESS) : "memory");
++		invpcid_flush_one(pcid, addr);
 +		return;
 +	}
 +
@@ -28723,7 +28689,7 @@ index 4858733..3353d988 100644
  #endif
  	initial_code = (unsigned long)wakeup_long64;
 diff --git a/arch/x86/kernel/acpi/wakeup_32.S b/arch/x86/kernel/acpi/wakeup_32.S
-index 0c26b1b..dcc0a4f 100644
+index 0c26b1b..dfa105a 100644
 --- a/arch/x86/kernel/acpi/wakeup_32.S
 +++ b/arch/x86/kernel/acpi/wakeup_32.S
 @@ -2,6 +2,7 @@
@@ -28734,7 +28700,16 @@ index 0c26b1b..dcc0a4f 100644
  
  # Copyright 2003, 2008 Pavel Machek <pavel@××××.cz>, distribute under GPLv2
  
-@@ -31,13 +32,11 @@ wakeup_pmode_return:
+@@ -14,8 +15,6 @@ wakeup_pmode_return:
+ 	movw	%ax, %ss
+ 	movw	%ax, %fs
+ 	movw	%ax, %gs
+-
+-	movw	$__USER_DS, %ax
+ 	movw	%ax, %ds
+ 	movw	%ax, %es
+ 
+@@ -31,13 +30,11 @@ wakeup_pmode_return:
  	# and restore the stack ... but you need gdt for this to work
  	movl	saved_context_esp, %esp
  
@@ -28750,7 +28725,7 @@ index 0c26b1b..dcc0a4f 100644
  
  bogus_magic:
  	jmp	bogus_magic
-@@ -59,7 +58,7 @@ save_registers:
+@@ -59,7 +56,7 @@ save_registers:
  	popl	saved_context_eflags
  
  	movl	$ret_point, saved_eip
@@ -28759,7 +28734,7 @@ index 0c26b1b..dcc0a4f 100644
  
  
  restore_registers:
-@@ -69,13 +68,14 @@ restore_registers:
+@@ -69,13 +66,14 @@ restore_registers:
  	movl	saved_context_edi, %edi
  	pushl	saved_context_eflags
  	popfl
@@ -28778,7 +28753,7 @@ index 0c26b1b..dcc0a4f 100644
  	addl	$4, %esp
  
  #	In case of S3 failure, we'll emerge here.  Jump
-@@ -83,9 +83,9 @@ ENTRY(do_suspend_lowlevel)
+@@ -83,9 +81,9 @@ ENTRY(do_suspend_lowlevel)
  	jmp	ret_point
  	.p2align 4,,7
  ret_point:
@@ -42699,7 +42674,7 @@ index f65a33f..f408a99 100644
  }
  
 diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
-index a7655f6..895549a 100644
+index a7655f6..0cab8dd 100644
 --- a/arch/x86/mm/tlb.c
 +++ b/arch/x86/mm/tlb.c
 @@ -47,7 +47,11 @@ void leave_mm(int cpu)
@@ -42714,7 +42689,7 @@ index a7655f6..895549a 100644
  		/*
  		 * This gets called in the idle path where RCU
  		 * functions differently.  Tracing normally
-@@ -61,6 +65,51 @@ EXPORT_SYMBOL_GPL(leave_mm);
+@@ -61,6 +65,47 @@ EXPORT_SYMBOL_GPL(leave_mm);
  
  #endif /* CONFIG_SMP */
  
@@ -42741,13 +42716,9 @@ index a7655f6..895549a 100644
 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
 +	if (static_cpu_has(X86_FEATURE_PCIDUDEREF)) {
 +		if (static_cpu_has(X86_FEATURE_INVPCID)) {
-+			u64 descriptor[2];
-+			descriptor[0] = PCID_USER;
-+			asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_CONTEXT) : "memory");
-+			if (!static_cpu_has(X86_FEATURE_STRONGUDEREF)) {
-+				descriptor[0] = PCID_KERNEL;
-+				asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_CONTEXT) : "memory");
-+			}
++			invpcid_flush_single_context(PCID_USER);
++			if (!static_cpu_has(X86_FEATURE_STRONGUDEREF))
++				invpcid_flush_single_context(PCID_KERNEL);
 +		} else {
 +			write_cr3(__pa(get_cpu_pgd(cpu, user)) | PCID_USER);
 +			if (static_cpu_has(X86_FEATURE_STRONGUDEREF))
@@ -42766,7 +42737,7 @@ index a7655f6..895549a 100644
  void switch_mm(struct mm_struct *prev, struct mm_struct *next,
  	       struct task_struct *tsk)
  {
-@@ -75,6 +124,9 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
+@@ -75,6 +120,9 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
  			struct task_struct *tsk)
  {
  	unsigned cpu = smp_processor_id();
@@ -42776,7 +42747,7 @@ index a7655f6..895549a 100644
  
  	if (likely(prev != next)) {
  		if (IS_ENABLED(CONFIG_VMAP_STACK)) {
-@@ -89,9 +141,14 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
+@@ -89,9 +137,14 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
  
  			if (unlikely(pgd_none(*pgd)))
  				set_pgd(pgd, init_mm.pgd[stack_pgd_index]);
@@ -42791,7 +42762,7 @@ index a7655f6..895549a 100644
  		this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
  		this_cpu_write(cpu_tlbstate.active_mm, next);
  #endif
-@@ -111,7 +168,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
+@@ -111,7 +164,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
  		 * We need to prevent an outcome in which CPU 1 observes
  		 * the new PTE value and CPU 0 observes bit 1 clear in
  		 * mm_cpumask.  (If that occurs, then the IPI will never
@@ -42800,7 +42771,7 @@ index a7655f6..895549a 100644
  		 *
  		 * The bad outcome can occur if either CPU's load is
  		 * reordered before that CPU's store, so both CPUs must
-@@ -126,7 +183,11 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
+@@ -126,7 +179,11 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
  		 * ordering guarantee we need.
  		 *
  		 */
@@ -42812,7 +42783,7 @@ index a7655f6..895549a 100644
  
  		trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL);
  
-@@ -152,9 +213,31 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
+@@ -152,9 +209,31 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
  		if (unlikely(prev->context.ldt != next->context.ldt))
  			load_mm_ldt(next);
  #endif
@@ -42845,7 +42816,7 @@ index a7655f6..895549a 100644
  		this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
  		BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next);
  
-@@ -175,13 +258,30 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
+@@ -175,13 +254,30 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
  			 * As above, load_cr3() is serializing and orders TLB
  			 * fills with respect to the mm_cpumask write.
  			 */
@@ -45142,10 +45113,18 @@ index eff224d..ab792d2 100644
 +	pax_ret check_events
  ENDPROC(check_events)
 diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
-index feb6d40..c8fd8e7 100644
+index feb6d40..4292c19 100644
 --- a/arch/x86/xen/xen-asm_32.S
 +++ b/arch/x86/xen/xen-asm_32.S
-@@ -28,7 +28,7 @@ check_events:
+@@ -15,6 +15,7 @@
+ #include <asm/processor-flags.h>
+ #include <asm/segment.h>
+ #include <asm/asm.h>
++#include <asm/alternative-asm.h>
+ 
+ #include <xen/interface/xen.h>
+ 
+@@ -28,7 +29,7 @@ check_events:
  	push %eax
  	push %ecx
  	push %edx
@@ -45154,7 +45133,7 @@ index feb6d40..c8fd8e7 100644
  	pop %edx
  	pop %ecx
  	pop %eax
-@@ -85,7 +85,7 @@ ENTRY(xen_iret)
+@@ -85,7 +86,7 @@ ENTRY(xen_iret)
  	pushw %fs
  	movl $(__KERNEL_PERCPU), %eax
  	movl %eax, %fs
@@ -45204,7 +45183,7 @@ index 7f8d8ab..3032b77 100644
  #endif /* CONFIG_XEN_PVH */
  
 diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
-index 3cbce3b..f1221bc 100644
+index 3cbce3b..c58120b 100644
 --- a/arch/x86/xen/xen-ops.h
 +++ b/arch/x86/xen/xen-ops.h
 @@ -16,8 +16,6 @@ void xen_syscall_target(void);
@@ -45216,6 +45195,19 @@ index 3cbce3b..f1221bc 100644
  struct trap_info;
  void xen_copy_trap_info(struct trap_info *traps);
  
+@@ -133,9 +131,9 @@ static inline void __init xen_efi_init(void)
+ 	extern char name##_end[] __visible;	\
+ 	extern char name##_reloc[] __visible
+ 
+-DECL_ASM(void, xen_irq_enable_direct, void);
+-DECL_ASM(void, xen_irq_disable_direct, void);
+-DECL_ASM(unsigned long, xen_save_fl_direct, void);
++DECL_ASM(asmlinkage void, xen_irq_enable_direct, void);
++DECL_ASM(asmlinkage void, xen_irq_disable_direct, void);
++DECL_ASM(asmlinkage unsigned long, xen_save_fl_direct, void);
+ DECL_ASM(void, xen_restore_fl_direct, unsigned long);
+ 
+ /* These are not functions, and cannot be called normally */
 diff --git a/arch/xtensa/variants/dc232b/include/variant/core.h b/arch/xtensa/variants/dc232b/include/variant/core.h
 index 525bd3d..ef888b1 100644
 --- a/arch/xtensa/variants/dc232b/include/variant/core.h
@@ -60577,7 +60569,7 @@ index ca4abe1..0b029ef 100644
  	}
  
 diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
-index 6b420a5..d5acb8f 100644
+index c3ea03c..7412315 100644
 --- a/drivers/md/bcache/bcache.h
 +++ b/drivers/md/bcache/bcache.h
 @@ -433,12 +433,12 @@ struct cache {
@@ -60599,7 +60591,7 @@ index 6b420a5..d5acb8f 100644
  
  struct gc_stat {
 diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
-index 81d3db4..46e8b68 100644
+index 2efdce0..e30d873 100644
 --- a/drivers/md/bcache/btree.c
 +++ b/drivers/md/bcache/btree.c
 @@ -336,15 +336,17 @@ static void btree_complete_write(struct btree *b, struct btree_write *w)
@@ -60863,7 +60855,7 @@ index 5c4bdde..99659fe 100644
  	struct bio *bio = &io->bio.bio;
  
 diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
-index 40ffe5e..6757bd6 100644
+index a37c177..a4dfbfc 100644
 --- a/drivers/md/bcache/request.c
 +++ b/drivers/md/bcache/request.c
 @@ -24,7 +24,7 @@
@@ -60917,7 +60909,7 @@ index 40ffe5e..6757bd6 100644
  	struct data_insert_op *op = container_of(cl, struct data_insert_op, cl);
  	struct bio *bio = op->bio, *n;
  
-@@ -313,8 +316,9 @@ static void bch_data_insert_start(struct closure *cl)
+@@ -311,8 +314,9 @@ static void bch_data_insert_start(struct closure *cl)
   * If s->bypass is true, instead of inserting the data it invalidates the
   * region of the cache represented by s->cache_bio and op->inode.
   */
@@ -60928,7 +60920,7 @@ index 40ffe5e..6757bd6 100644
  	struct data_insert_op *op = container_of(cl, struct data_insert_op, cl);
  
  	trace_bcache_write(op->c, op->inode, op->bio,
-@@ -322,7 +326,7 @@ void bch_data_insert(struct closure *cl)
+@@ -320,7 +324,7 @@ void bch_data_insert(struct closure *cl)
  
  	bch_keylist_init(&op->insert_keys);
  	bio_get(op->bio);
@@ -60937,7 +60929,7 @@ index 40ffe5e..6757bd6 100644
  }
  
  /* Congested? */
-@@ -570,8 +574,9 @@ static int cache_lookup_fn(struct btree_op *op, struct btree *b, struct bkey *k)
+@@ -568,8 +572,9 @@ static int cache_lookup_fn(struct btree_op *op, struct btree *b, struct bkey *k)
  	return n == bio ? MAP_DONE : MAP_CONTINUE;
  }
  
@@ -60948,7 +60940,7 @@ index 40ffe5e..6757bd6 100644
  	struct search *s = container_of(cl, struct search, iop.cl);
  	struct bio *bio = &s->bio.bio;
  	int ret;
-@@ -631,8 +636,9 @@ static void do_bio_hook(struct search *s, struct bio *orig_bio)
+@@ -629,8 +634,9 @@ static void do_bio_hook(struct search *s, struct bio *orig_bio)
  	bio_cnt_set(bio, 3);
  }
  
@@ -60959,7 +60951,7 @@ index 40ffe5e..6757bd6 100644
  	struct search *s = container_of(cl, struct search, cl);
  	bio_complete(s);
  
-@@ -676,19 +682,21 @@ static inline struct search *search_alloc(struct bio *bio,
+@@ -674,19 +680,21 @@ static inline struct search *search_alloc(struct bio *bio,
  
  /* Cached devices */
  
@@ -60984,7 +60976,7 @@ index 40ffe5e..6757bd6 100644
  	struct search *s = container_of(cl, struct search, cl);
  
  	if (s->iop.replace_collision)
-@@ -697,11 +705,12 @@ static void cached_dev_cache_miss_done(struct closure *cl)
+@@ -695,11 +703,12 @@ static void cached_dev_cache_miss_done(struct closure *cl)
  	if (s->iop.bio)
  		bio_free_pages(s->iop.bio);
  
@@ -60999,7 +60991,7 @@ index 40ffe5e..6757bd6 100644
  	struct search *s = container_of(cl, struct search, cl);
  	struct bio *bio = &s->bio.bio;
  
-@@ -720,8 +729,9 @@ static void cached_dev_read_error(struct closure *cl)
+@@ -718,8 +727,9 @@ static void cached_dev_read_error(struct closure *cl)
  	continue_at(cl, cached_dev_cache_miss_done, NULL);
  }
  
@@ -61010,7 +61002,7 @@ index 40ffe5e..6757bd6 100644
  	struct search *s = container_of(cl, struct search, cl);
  	struct cached_dev *dc = container_of(s->d, struct cached_dev, disk);
  
-@@ -760,8 +770,9 @@ static void cached_dev_read_done(struct closure *cl)
+@@ -758,8 +768,9 @@ static void cached_dev_read_done(struct closure *cl)
  	continue_at(cl, cached_dev_cache_miss_done, NULL);
  }
  
@@ -61021,7 +61013,7 @@ index 40ffe5e..6757bd6 100644
  	struct search *s = container_of(cl, struct search, cl);
  	struct cached_dev *dc = container_of(s->d, struct cached_dev, disk);
  
-@@ -859,13 +870,14 @@ static void cached_dev_read(struct cached_dev *dc, struct search *s)
+@@ -857,13 +868,14 @@ static void cached_dev_read(struct cached_dev *dc, struct search *s)
  
  /* Process writes */
  
@@ -61038,7 +61030,7 @@ index 40ffe5e..6757bd6 100644
  }
  
  static void cached_dev_write(struct cached_dev *dc, struct search *s)
-@@ -937,8 +949,9 @@ static void cached_dev_write(struct cached_dev *dc, struct search *s)
+@@ -935,8 +947,9 @@ static void cached_dev_write(struct cached_dev *dc, struct search *s)
  	continue_at(cl, cached_dev_write_complete, NULL);
  }
  
@@ -61049,7 +61041,7 @@ index 40ffe5e..6757bd6 100644
  	struct search *s = container_of(cl, struct search, cl);
  	struct bio *bio = &s->bio.bio;
  
-@@ -1058,8 +1071,9 @@ static int flash_dev_cache_miss(struct btree *b, struct search *s,
+@@ -1056,8 +1069,9 @@ static int flash_dev_cache_miss(struct btree *b, struct search *s,
  	return MAP_CONTINUE;
  }
  
@@ -61187,7 +61179,7 @@ index adbff14..018c2d2 100644
  	struct cache_stat_collector collector;
  
 diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
-index 849ad44..a9e695e 100644
+index 66669c8..3296d7e 100644
 --- a/drivers/md/bcache/super.c
 +++ b/drivers/md/bcache/super.c
 @@ -240,8 +240,9 @@ static void __write_super(struct cache_sb *sb, struct bio *bio)
@@ -79806,10 +79798,10 @@ index cf04a36..54dd630 100644
  		     !(SDEBUG_OPT_NO_CDB_NOISE & sdebug_opts))) {
  		char b[120];
 diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
-index 2cca9cf..cbe4c6d 100644
+index e64eae4..465011a 100644
 --- a/drivers/scsi/scsi_lib.c
 +++ b/drivers/scsi/scsi_lib.c
-@@ -1513,7 +1513,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
+@@ -1514,7 +1514,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
  	shost = sdev->host;
  	scsi_init_cmd_errh(cmd);
  	cmd->result = DID_NO_CONNECT << 16;
@@ -79818,7 +79810,7 @@ index 2cca9cf..cbe4c6d 100644
  
  	/*
  	 * SCSI request completion path will do scsi_device_unbusy(),
-@@ -1536,9 +1536,9 @@ static void scsi_softirq_done(struct request *rq)
+@@ -1537,9 +1537,9 @@ static void scsi_softirq_done(struct request *rq)
  
  	INIT_LIST_HEAD(&cmd->eh_entry);
  
@@ -79830,7 +79822,7 @@ index 2cca9cf..cbe4c6d 100644
  
  	disposition = scsi_decide_disposition(cmd);
  	if (disposition != SUCCESS &&
-@@ -1579,7 +1579,7 @@ static int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
+@@ -1580,7 +1580,7 @@ static int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
  	struct Scsi_Host *host = cmd->device->host;
  	int rtn = 0;
  
@@ -80008,7 +80000,7 @@ index 51e5629..caef5f7 100644
  	if (!sdp->request_queue->rq_timeout) {
  		if (sdp->type != TYPE_MOD)
 diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
-index dbe5b4b..1242bc3 100644
+index 121de0a..f2ba1bb 100644
 --- a/drivers/scsi/sg.c
 +++ b/drivers/scsi/sg.c
 @@ -1083,7 +1083,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
@@ -123707,7 +123699,7 @@ index 368bfb9..5b43f37 100644
  {
  	const struct seq_operations *op = ((struct seq_file *)file->private_data)->op;
 diff --git a/fs/splice.c b/fs/splice.c
-index 63b8f54..8292069 100644
+index 8dd79ec..0a56b1a 100644
 --- a/fs/splice.c
 +++ b/fs/splice.c
 @@ -188,7 +188,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
@@ -123719,7 +123711,7 @@ index 63b8f54..8292069 100644
  		send_sig(SIGPIPE, current, 0);
  		ret = -EPIPE;
  		goto out;
-@@ -227,7 +227,7 @@ ssize_t add_to_pipe(struct pipe_inode_info *pipe, struct pipe_buffer *buf)
+@@ -228,7 +228,7 @@ ssize_t add_to_pipe(struct pipe_inode_info *pipe, struct pipe_buffer *buf)
  {
  	int ret;
  
@@ -123728,7 +123720,7 @@ index 63b8f54..8292069 100644
  		send_sig(SIGPIPE, current, 0);
  		ret = -EPIPE;
  	} else if (pipe->nrbufs == pipe->buffers) {
-@@ -359,7 +359,7 @@ static ssize_t kernel_readv(struct file *file, const struct kvec *vec,
+@@ -360,7 +360,7 @@ static ssize_t kernel_readv(struct file *file, const struct kvec *vec,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -123737,7 +123729,7 @@ index 63b8f54..8292069 100644
  	set_fs(old_fs);
  
  	return res;
-@@ -374,7 +374,7 @@ ssize_t kernel_write(struct file *file, const char *buf, size_t count,
+@@ -375,7 +375,7 @@ ssize_t kernel_write(struct file *file, const char *buf, size_t count,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -123746,7 +123738,7 @@ index 63b8f54..8292069 100644
  	set_fs(old_fs);
  
  	return res;
-@@ -533,7 +533,7 @@ static int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_des
+@@ -534,7 +534,7 @@ static int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_des
  			pipe_buf_release(pipe, buf);
  			pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
  			pipe->nrbufs--;
@@ -123755,7 +123747,7 @@ index 63b8f54..8292069 100644
  				sd->need_wakeup = true;
  		}
  
-@@ -564,10 +564,10 @@ static int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_des
+@@ -565,10 +565,10 @@ static int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_des
  		return -ERESTARTSYS;
  
  	while (!pipe->nrbufs) {
@@ -123768,7 +123760,7 @@ index 63b8f54..8292069 100644
  			return 0;
  
  		if (sd->flags & SPLICE_F_NONBLOCK)
-@@ -781,7 +781,7 @@ iter_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
+@@ -782,7 +782,7 @@ iter_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
  				pipe_buf_release(pipe, buf);
  				pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
  				pipe->nrbufs--;
@@ -123777,7 +123769,7 @@ index 63b8f54..8292069 100644
  					sd.need_wakeup = true;
  			} else {
  				buf->offset += ret;
-@@ -944,7 +944,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+@@ -945,7 +945,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
  		 * out of the pipe right after the splice_to_pipe(). So set
  		 * PIPE_READERS appropriately.
  		 */
@@ -123786,7 +123778,7 @@ index 63b8f54..8292069 100644
  
  		current->splice_pipe = pipe;
  	}
-@@ -1087,7 +1087,7 @@ EXPORT_SYMBOL(do_splice_direct);
+@@ -1088,7 +1088,7 @@ EXPORT_SYMBOL(do_splice_direct);
  static int wait_for_space(struct pipe_inode_info *pipe, unsigned flags)
  {
  	for (;;) {
@@ -123795,7 +123787,7 @@ index 63b8f54..8292069 100644
  			send_sig(SIGPIPE, current, 0);
  			return -EPIPE;
  		}
-@@ -1097,9 +1097,9 @@ static int wait_for_space(struct pipe_inode_info *pipe, unsigned flags)
+@@ -1098,9 +1098,9 @@ static int wait_for_space(struct pipe_inode_info *pipe, unsigned flags)
  			return -EAGAIN;
  		if (signal_pending(current))
  			return -ERESTARTSYS;
@@ -123807,7 +123799,7 @@ index 63b8f54..8292069 100644
  	}
  }
  
-@@ -1446,9 +1446,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1447,9 +1447,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  			ret = -ERESTARTSYS;
  			break;
  		}
@@ -123819,7 +123811,7 @@ index 63b8f54..8292069 100644
  			if (flags & SPLICE_F_NONBLOCK) {
  				ret = -EAGAIN;
  				break;
-@@ -1480,7 +1480,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1481,7 +1481,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  	pipe_lock(pipe);
  
  	while (pipe->nrbufs >= pipe->buffers) {
@@ -123828,7 +123820,7 @@ index 63b8f54..8292069 100644
  			send_sig(SIGPIPE, current, 0);
  			ret = -EPIPE;
  			break;
-@@ -1493,9 +1493,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1494,9 +1494,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  			ret = -ERESTARTSYS;
  			break;
  		}
@@ -123840,7 +123832,7 @@ index 63b8f54..8292069 100644
  	}
  
  	pipe_unlock(pipe);
-@@ -1531,14 +1531,14 @@ static int splice_pipe_to_pipe(struct pipe_inode_info *ipipe,
+@@ -1532,14 +1532,14 @@ static int splice_pipe_to_pipe(struct pipe_inode_info *ipipe,
  	pipe_double_lock(ipipe, opipe);
  
  	do {
@@ -123857,7 +123849,7 @@ index 63b8f54..8292069 100644
  			break;
  
  		/*
-@@ -1635,7 +1635,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+@@ -1636,7 +1636,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
  	pipe_double_lock(ipipe, opipe);
  
  	do {
@@ -123866,7 +123858,7 @@ index 63b8f54..8292069 100644
  			send_sig(SIGPIPE, current, 0);
  			if (!ret)
  				ret = -EPIPE;
-@@ -1680,7 +1680,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+@@ -1681,7 +1681,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
  	 * return EAGAIN if we have the potential of some data in the
  	 * future, otherwise just return 0
  	 */
@@ -140150,7 +140142,7 @@ index 063962f..d34f2da 100644
  static inline struct hugetlb_cgroup *hugetlb_cgroup_from_page(struct page *page)
  {
 diff --git a/include/linux/hwmon-sysfs.h b/include/linux/hwmon-sysfs.h
-index 1c7b89a..7dda400 100644
+index 1c7b89a..7dda4003 100644
 --- a/include/linux/hwmon-sysfs.h
 +++ b/include/linux/hwmon-sysfs.h
 @@ -25,7 +25,8 @@
@@ -149727,7 +149719,7 @@ index ba8a015..37d2e1d 100644
  	int threads = max_threads;
  	int min = MIN_THREADS;
 diff --git a/kernel/futex.c b/kernel/futex.c
-index 2c4be46..46c5c89 100644
+index 38b68c2..1940ab9 100644
 --- a/kernel/futex.c
 +++ b/kernel/futex.c
 @@ -210,7 +210,7 @@ struct futex_pi_state {
@@ -151741,7 +151733,7 @@ index 4f0f060..d6c1a7d 100644
  
  /**
 diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
-index f7a55e9..85fe3ba 100644
+index 9c5b231..aaa4a5c 100644
 --- a/kernel/printk/printk.c
 +++ b/kernel/printk/printk.c
 @@ -588,7 +588,7 @@ static int log_store(int facility, int level,
@@ -164833,6 +164825,20 @@ index 0df2aa6..7db59f7 100644
  	.init = sysctl_core_net_init,
  	.exit = sysctl_core_net_exit,
  };
+diff --git a/net/dccp/input.c b/net/dccp/input.c
+index ba34718..8fedc2d 100644
+--- a/net/dccp/input.c
++++ b/net/dccp/input.c
+@@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+ 			if (inet_csk(sk)->icsk_af_ops->conn_request(sk,
+ 								    skb) < 0)
+ 				return 1;
+-			goto discard;
++			consume_skb(skb);
++			return 0;
+ 		}
+ 		if (dh->dccph_type == DCCP_PKT_RESET)
+ 			goto discard;
 diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
 index 13d6b1a..eaa0cee 100644
 --- a/net/decnet/af_decnet.c
@@ -209399,10 +209405,10 @@ index 0000000..1181e93
 +size_mei_msg_data_65529_fields size mei_msg_data 0 65529 NULL
 diff --git a/scripts/gcc-plugins/size_overflow_plugin/e_fns.data b/scripts/gcc-plugins/size_overflow_plugin/e_fns.data
 new file mode 100644
-index 0000000..75e575c
+index 0000000..103f4c7
 --- /dev/null
 +++ b/scripts/gcc-plugins/size_overflow_plugin/e_fns.data
-@@ -0,0 +1,5032 @@
+@@ -0,0 +1,5033 @@
 +logi_dj_recv_query_paired_devices_fndecl_13_fns logi_dj_recv_query_paired_devices fndecl 0 13 NULL
 +response_length_ib_uverbs_ex_destroy_wq_resp_15_fns response_length ib_uverbs_ex_destroy_wq_resp 0 15 NULL
 +kfd_wait_on_events_fndecl_19_fns kfd_wait_on_events fndecl 2 19 NULL
@@ -213550,6 +213556,7 @@ index 0000000..75e575c
 +__hwahc_op_set_ptk_fndecl_54157_fns __hwahc_op_set_ptk fndecl 5 54157 NULL
 +b43_nphy_load_samples_fndecl_54162_fns b43_nphy_load_samples fndecl 3 54162 NULL
 +cpu_type_read_fndecl_54191_fns cpu_type_read fndecl 3 54191 NULL
++smsusb_sendrequest_fndecl_54196_fns smsusb_sendrequest fndecl 3 54196 NULL
 +p_filesz_elf32_phdr_54204_fns p_filesz elf32_phdr 0 54204 NULL
 +numeraseregions_mtd_info_54223_fns numeraseregions mtd_info 0 54223 NULL
 +__kfifo_to_user_fndecl_54232_fns __kfifo_to_user fndecl 3 54232 NULL
@@ -225693,7 +225700,7 @@ index 0a578fe..b81f62d 100644
  })
  
 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 7f9ee29..71d4ab0 100644
+index 7f9ee29..39268bd 100644
 --- a/virt/kvm/kvm_main.c
 +++ b/virt/kvm/kvm_main.c
 @@ -93,12 +93,17 @@ LIST_HEAD(vm_list);
@@ -225763,7 +225770,21 @@ index 7f9ee29..71d4ab0 100644
  	.release        = kvm_vm_release,
  	.unlocked_ioctl = kvm_vm_ioctl,
  #ifdef CONFIG_KVM_COMPAT
-@@ -3231,7 +3244,7 @@ static long kvm_dev_ioctl(struct file *filp,
+@@ -3181,11 +3194,13 @@ static int kvm_dev_ioctl_create_vm(unsigned long type)
+ 		return PTR_ERR(file);
+ 	}
+ 
++#ifndef CONFIG_GRKERNSEC_SYSFS_RESTRICT
+ 	if (kvm_create_vm_debugfs(kvm, r) < 0) {
+ 		put_unused_fd(r);
+ 		fput(file);
+ 		return -ENOMEM;
+ 	}
++#endif
+ 
+ 	fd_install(r, file);
+ 	return r;
+@@ -3231,7 +3246,7 @@ static long kvm_dev_ioctl(struct file *filp,
  	return r;
  }
  
@@ -225772,7 +225793,7 @@ index 7f9ee29..71d4ab0 100644
  	.unlocked_ioctl = kvm_dev_ioctl,
  	.compat_ioctl   = kvm_dev_ioctl,
  	.llseek		= noop_llseek,
-@@ -3257,7 +3270,7 @@ static void hardware_enable_nolock(void *junk)
+@@ -3257,7 +3272,7 @@ static void hardware_enable_nolock(void *junk)
  
  	if (r) {
  		cpumask_clear_cpu(cpu, cpus_hardware_enabled);
@@ -225781,7 +225802,7 @@ index 7f9ee29..71d4ab0 100644
  		pr_info("kvm: enabling virtualization on CPU%d failed\n", cpu);
  	}
  }
-@@ -3314,10 +3327,10 @@ static int hardware_enable_all(void)
+@@ -3314,10 +3329,10 @@ static int hardware_enable_all(void)
  
  	kvm_usage_count++;
  	if (kvm_usage_count == 1) {
@@ -225794,7 +225815,7 @@ index 7f9ee29..71d4ab0 100644
  			hardware_disable_all_nolock();
  			r = -EBUSY;
  		}
-@@ -3877,8 +3890,9 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -3877,8 +3892,9 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
  	/* A kmem cache lets us meet the alignment requirements of fx_save. */
  	if (!vcpu_align)
  		vcpu_align = __alignof__(struct kvm_vcpu);
@@ -225806,7 +225827,7 @@ index 7f9ee29..71d4ab0 100644
  	if (!kvm_vcpu_cache) {
  		r = -ENOMEM;
  		goto out_free_3;
-@@ -3888,9 +3902,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -3888,9 +3904,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
  	if (r)
  		goto out_free;
  
@@ -225818,7 +225839,7 @@ index 7f9ee29..71d4ab0 100644
  
  	r = misc_register(&kvm_dev);
  	if (r) {
-@@ -3900,9 +3916,6 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -3900,9 +3918,6 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
  
  	register_syscore_ops(&kvm_syscore_ops);
  

diff --git a/4.9.11/4425_grsec_remove_EI_PAX.patch b/4.9.12/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 4.9.11/4425_grsec_remove_EI_PAX.patch
rename to 4.9.12/4425_grsec_remove_EI_PAX.patch

diff --git a/4.9.11/4426_default_XATTR_PAX_FLAGS.patch b/4.9.12/4426_default_XATTR_PAX_FLAGS.patch
similarity index 100%
rename from 4.9.11/4426_default_XATTR_PAX_FLAGS.patch
rename to 4.9.12/4426_default_XATTR_PAX_FLAGS.patch

diff --git a/4.9.11/4427_force_XATTR_PAX_tmpfs.patch b/4.9.12/4427_force_XATTR_PAX_tmpfs.patch
similarity index 100%
rename from 4.9.11/4427_force_XATTR_PAX_tmpfs.patch
rename to 4.9.12/4427_force_XATTR_PAX_tmpfs.patch

diff --git a/4.9.11/4430_grsec-remove-localversion-grsec.patch b/4.9.12/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 4.9.11/4430_grsec-remove-localversion-grsec.patch
rename to 4.9.12/4430_grsec-remove-localversion-grsec.patch

diff --git a/4.9.11/4435_grsec-mute-warnings.patch b/4.9.12/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 4.9.11/4435_grsec-mute-warnings.patch
rename to 4.9.12/4435_grsec-mute-warnings.patch

diff --git a/4.9.11/4440_grsec-remove-protected-paths.patch b/4.9.12/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 4.9.11/4440_grsec-remove-protected-paths.patch
rename to 4.9.12/4440_grsec-remove-protected-paths.patch

diff --git a/4.9.11/4450_grsec-kconfig-default-gids.patch b/4.9.12/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 4.9.11/4450_grsec-kconfig-default-gids.patch
rename to 4.9.12/4450_grsec-kconfig-default-gids.patch

diff --git a/4.9.11/4465_selinux-avc_audit-log-curr_ip.patch b/4.9.12/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 4.9.11/4465_selinux-avc_audit-log-curr_ip.patch
rename to 4.9.12/4465_selinux-avc_audit-log-curr_ip.patch

diff --git a/4.9.11/4470_disable-compat_vdso.patch b/4.9.12/4470_disable-compat_vdso.patch
similarity index 100%
rename from 4.9.11/4470_disable-compat_vdso.patch
rename to 4.9.12/4470_disable-compat_vdso.patch

diff --git a/4.9.11/4475_emutramp_default_on.patch b/4.9.12/4475_emutramp_default_on.patch
similarity index 100%
rename from 4.9.11/4475_emutramp_default_on.patch
rename to 4.9.12/4475_emutramp_default_on.patch