Grsec/PaX: 2.9.1-{2.6.32.59,3.2.23,3.4.4}-201207122200

14 files changed, 2058 insertions, 357 deletions

diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index a0df600..3cd1e97 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -30,7 +30,7 @@ Patch:	1058_linux-2.6.32.59.patch
 From:	http://www.kernel.org
 Desc:	Linux 2.6.32.59
 
-Patch:	4420_grsecurity-2.9.1-2.6.32.59-201207080923.patch
+Patch:	4420_grsecurity-2.9.1-2.6.32.59-201207122159.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201207080923.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201207122159.patch
index 2ebb2bb..614255d 100644
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201207080923.patch
+++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201207122159.patch
@@ -471,7 +471,7 @@ index 3a9a721..b81a4d5 100644
  	$(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1)   \
  	$(build)=$(build-dir) $(@:.ko=.o)
 diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
-index 610dff4..f396854 100644
+index 610dff44..f396854 100644
 --- a/arch/alpha/include/asm/atomic.h
 +++ b/arch/alpha/include/asm/atomic.h
 @@ -251,6 +251,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
@@ -62906,7 +62906,7 @@ index cbad67e8..3cf900e 100644
  	.update_status  = omapbl_update_status,
  };
 diff --git a/drivers/video/backlight/progear_bl.c b/drivers/video/backlight/progear_bl.c
-index 9edaf24..075786e 100644
+index 9edaf24f..075786e 100644
 --- a/drivers/video/backlight/progear_bl.c
 +++ b/drivers/video/backlight/progear_bl.c
 @@ -54,7 +54,7 @@ static int progearbl_get_intensity(struct backlight_device *bd)
@@ -76690,7 +76690,7 @@ index 0000000..1b9afa9
 +endif
 diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
 new file mode 100644
-index 0000000..8c9aeb7
+index 0000000..109cc56
 --- /dev/null
 +++ b/grsecurity/gracl.c
 @@ -0,0 +1,4175 @@
@@ -76716,6 +76716,7 @@ index 0000000..8c9aeb7
 +#include <linux/security.h>
 +#include <linux/grinternal.h>
 +#include <linux/pid_namespace.h>
++#include <linux/stop_machine.h>
 +#include <linux/fdtable.h>
 +#include <linux/percpu.h>
 +
@@ -78957,18 +78958,17 @@ index 0000000..8c9aeb7
 +void
 +gr_copy_label(struct task_struct *tsk)
 +{
-+	/* plain copying of fields is already done by dup_task_struct */
 +	tsk->signal->used_accept = 0;
 +	tsk->acl_sp_role = 0;
-+	//tsk->acl_role_id = current->acl_role_id;
-+	//tsk->acl = current->acl;
-+	//tsk->role = current->role;
++	tsk->acl_role_id = current->acl_role_id;
++	tsk->acl = current->acl;
++	tsk->role = current->role;
 +	tsk->signal->curr_ip = current->signal->curr_ip;
 +	tsk->signal->saved_ip = current->signal->saved_ip;
 +	if (current->exec_file)
 +		get_file(current->exec_file);
-+	//tsk->exec_file = current->exec_file;
-+	//tsk->is_writable = current->is_writable;
++	tsk->exec_file = current->exec_file;
++	tsk->is_writable = current->is_writable;
 +	if (unlikely(current->signal->used_accept)) {
 +		current->signal->curr_ip = 0;
 +		current->signal->saved_ip = 0;
@@ -79777,6 +79777,15 @@ index 0000000..8c9aeb7
 +	return 1;
 +}
 +
++static int gr_rbac_disable(void *unused)
++{
++	pax_open_kernel();
++	gr_status &= ~GR_READY;
++	pax_close_kernel();
++
++	return 0;
++}
++
 +ssize_t
 +write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
 +{
@@ -79861,15 +79870,12 @@ index 0000000..8c9aeb7
 +	case GR_SHUTDOWN:
 +		if ((gr_status & GR_READY)
 +		    && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+			pax_open_kernel();
-+			gr_status &= ~GR_READY;
-+			pax_close_kernel();
-+
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
++			stop_machine(gr_rbac_disable, NULL, NULL);
 +			free_variables();
 +			memset(gr_usermode, 0, sizeof (struct gr_arg));
 +			memset(gr_system_salt, 0, GR_SALT_LEN);
 +			memset(gr_system_sum, 0, GR_SHA_LEN);
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
 +		} else if (gr_status & GR_READY) {
 +			gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
 +			error = -EPERM;
@@ -79894,20 +79900,14 @@ index 0000000..8c9aeb7
 +			gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
 +			error = -EAGAIN;
 +		} else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+			lock_kernel();
-+
-+			pax_open_kernel();
-+			gr_status &= ~GR_READY;
-+			pax_close_kernel();
-+
++			stop_machine(gr_rbac_disable, NULL, NULL);
 +			free_variables();
-+			if (!(error2 = gracl_init(gr_usermode))) {
-+				unlock_kernel();
++			error2 = gracl_init(gr_usermode);
++			if (!error2)
 +				gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
-+			} else {
-+				unlock_kernel();
-+				error = error2;
++			else {
 +				gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
++				error = error2;
 +			}
 +		} else {
 +			gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
@@ -91616,7 +91616,7 @@ index 0993a22..32ba2fe 100644
  	void *pmi_pal;
  	u8 *vbe_state_orig;		/*
 diff --git a/init/Kconfig b/init/Kconfig
-index d72691b..3996e54 100644
+index d72691b..b21f901 100644
 --- a/init/Kconfig
 +++ b/init/Kconfig
 @@ -1004,7 +1004,7 @@ config SLUB_DEBUG
@@ -91628,6 +91628,15 @@ index d72691b..3996e54 100644
  	help
  	  Randomizing heap placement makes heap exploits harder, but it
  	  also breaks ancient binaries (including anything libc5 based).
+@@ -1190,7 +1190,7 @@ config INIT_ALL_POSSIBLE
+ config STOP_MACHINE
+ 	bool
+ 	default y
+-	depends on (SMP && MODULE_UNLOAD) || HOTPLUG_CPU
++	depends on (SMP && MODULE_UNLOAD) || HOTPLUG_CPU || GRKERNSEC
+ 	help
+ 	  Need stop_machine() primitive.
+ 
 diff --git a/init/do_mounts.c b/init/do_mounts.c
 index bb008d0..4fa3933 100644
 --- a/init/do_mounts.c
@@ -93056,7 +93065,7 @@ index 0f8fae3..66af9b1 100644
  		get_task_struct(p);
  		read_unlock(&tasklist_lock);
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 4bde56f..8f14dad 100644
+index 4bde56f..21a5033 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -253,7 +253,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
@@ -93163,16 +93172,17 @@ index 4bde56f..8f14dad 100644
  
  	retval = copy_creds(p, clone_flags);
  	if (retval < 0)
-@@ -1183,6 +1214,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- 			goto bad_fork_free_pid;
- 	}
+@@ -1233,6 +1264,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ 	/* Need tasklist lock for parent etc handling! */
+ 	write_lock_irq(&tasklist_lock);
  
++	/* synchronizes with gr_set_acls() */
 +	gr_copy_label(p);
 +
- 	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
- 	/*
- 	 * Clear TID on mm_release()?
-@@ -1299,7 +1332,8 @@ bad_fork_free_pid:
+ 	/* CLONE_PARENT re-uses the old parent */
+ 	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
+ 		p->real_parent = current->real_parent;
+@@ -1299,7 +1333,8 @@ bad_fork_free_pid:
  	if (pid != &init_struct_pid)
  		free_pid(pid);
  bad_fork_cleanup_io:
@@ -93182,7 +93192,7 @@ index 4bde56f..8f14dad 100644
  bad_fork_cleanup_namespaces:
  	exit_task_namespaces(p);
  bad_fork_cleanup_mm:
-@@ -1333,6 +1367,8 @@ bad_fork_cleanup_count:
+@@ -1333,6 +1368,8 @@ bad_fork_cleanup_count:
  bad_fork_free:
  	free_task(p);
  fork_out:
@@ -93191,7 +93201,7 @@ index 4bde56f..8f14dad 100644
  	return ERR_PTR(retval);
  }
  
-@@ -1426,6 +1462,8 @@ long do_fork(unsigned long clone_flags,
+@@ -1426,6 +1463,8 @@ long do_fork(unsigned long clone_flags,
  		if (clone_flags & CLONE_PARENT_SETTID)
  			put_user(nr, parent_tidptr);
  
@@ -93200,7 +93210,7 @@ index 4bde56f..8f14dad 100644
  		if (clone_flags & CLONE_VFORK) {
  			p->vfork_done = &vfork;
  			init_completion(&vfork);
-@@ -1558,7 +1596,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1558,7 +1597,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
  		return 0;
  
  	/* don't need lock here; in the worst case we'll do useless copy */
@@ -93209,7 +93219,7 @@ index 4bde56f..8f14dad 100644
  		return 0;
  
  	*new_fsp = copy_fs_struct(fs);
-@@ -1681,7 +1719,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -1681,7 +1720,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
  			fs = current->fs;
  			write_lock(&fs->lock);
  			current->fs = new_fs;
@@ -106188,10 +106198,10 @@ index d52f7a0..b66cdd9 100755
  		rm -f tags
  		xtags ctags
 diff --git a/security/Kconfig b/security/Kconfig
-index fb363cd..6ef754f 100644
+index fb363cd..b6ce7c6 100644
 --- a/security/Kconfig
 +++ b/security/Kconfig
-@@ -4,6 +4,854 @@
+@@ -4,6 +4,855 @@
  
  menu "Security options"
  
@@ -106220,6 +106230,7 @@ index fb363cd..6ef754f 100644
 +	bool "Grsecurity"
 +	select CRYPTO
 +	select CRYPTO_SHA256
++	select STOP_MACHINE
 +	help
 +	  If you say Y here, you will be able to configure many features
 +	  that will enhance the security of your system.  It is highly
@@ -107046,7 +107057,7 @@ index fb363cd..6ef754f 100644
  config KEYS
  	bool "Enable access key retention support"
  	help
-@@ -146,7 +994,7 @@ config INTEL_TXT
+@@ -146,7 +995,7 @@ config INTEL_TXT
  config LSM_MMAP_MIN_ADDR
  	int "Low address space for LSM to protect from user allocation"
  	depends on SECURITY && SECURITY_SELINUX
diff --git a/3.2.22/0000_README b/3.2.23/0000_README
index 7a8a57c..79f060b 100644
--- a/3.2.22/0000_README
+++ b/3.2.23/0000_README
@@ -6,7 +6,11 @@ Patch:	1021_linux-3.2.22.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.22
 
-Patch:	4420_grsecurity-2.9.1-3.2.22-201207080924.patch
+Patch:	1022_linux-3.2.23.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.2.23
+
+Patch:	4420_grsecurity-2.9.1-3.2.23-201207122159.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.22/1021_linux-3.2.22.patch b/3.2.23/1021_linux-3.2.22.patch
index e6ad93a..e6ad93a 100644
--- a/3.2.22/1021_linux-3.2.22.patch
+++ b/3.2.23/1021_linux-3.2.22.patch
diff --git a/3.2.23/1022_linux-3.2.23.patch b/3.2.23/1022_linux-3.2.23.patch
new file mode 100644
index 0000000..3d796d0
--- /dev/null
+++ b/3.2.23/1022_linux-3.2.23.patch
@@ -0,0 +1,1862 @@
+diff --git a/Makefile b/Makefile
+index 9a7d921..40d1e3b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 22
++SUBLEVEL = 23
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
+index e10e59a..1d1710e 100644
+--- a/arch/arm/kernel/smp.c
++++ b/arch/arm/kernel/smp.c
+@@ -471,9 +471,7 @@ static DEFINE_PER_CPU(struct clock_event_device, percpu_clockevent);
+ static void ipi_timer(void)
+ {
+ 	struct clock_event_device *evt = &__get_cpu_var(percpu_clockevent);
+-	irq_enter();
+ 	evt->event_handler(evt);
+-	irq_exit();
+ }
+ 
+ #ifdef CONFIG_GENERIC_CLOCKEVENTS_BROADCAST
+@@ -572,7 +570,9 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
+ 
+ 	switch (ipinr) {
+ 	case IPI_TIMER:
++		irq_enter();
+ 		ipi_timer();
++		irq_exit();
+ 		break;
+ 
+ 	case IPI_RESCHEDULE:
+@@ -580,15 +580,21 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
+ 		break;
+ 
+ 	case IPI_CALL_FUNC:
++		irq_enter();
+ 		generic_smp_call_function_interrupt();
++		irq_exit();
+ 		break;
+ 
+ 	case IPI_CALL_FUNC_SINGLE:
++		irq_enter();
+ 		generic_smp_call_function_single_interrupt();
++		irq_exit();
+ 		break;
+ 
+ 	case IPI_CPU_STOP:
++		irq_enter();
+ 		ipi_cpu_stop(cpu);
++		irq_exit();
+ 		break;
+ 
+ 	default:
+diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+index 44d8829..5e8dc08 100644
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -763,7 +763,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_201)
+ 	lwz	r3,VCORE_NAPPING_THREADS(r5)
+ 	lwz	r4,VCPU_PTID(r9)
+ 	li	r0,1
+-	sldi	r0,r0,r4
++	sld	r0,r0,r4
+ 	andc.	r3,r3,r0		/* no sense IPI'ing ourselves */
+ 	beq	43f
+ 	mulli	r4,r4,PACA_SIZE		/* get paca for thread 0 */
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index 03a217a..b7e63d8 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -975,7 +975,7 @@ static int cpu_cmd(void)
+ 		/* print cpus waiting or in xmon */
+ 		printf("cpus stopped:");
+ 		count = 0;
+-		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
++		for_each_possible_cpu(cpu) {
+ 			if (cpumask_test_cpu(cpu, &cpus_in_xmon)) {
+ 				if (count == 0)
+ 					printf(" %x", cpu);
+diff --git a/drivers/block/umem.c b/drivers/block/umem.c
+index aa27120..9a72277 100644
+--- a/drivers/block/umem.c
++++ b/drivers/block/umem.c
+@@ -513,6 +513,44 @@ static void process_page(unsigned long data)
+ 	}
+ }
+ 
++struct mm_plug_cb {
++	struct blk_plug_cb cb;
++	struct cardinfo *card;
++};
++
++static void mm_unplug(struct blk_plug_cb *cb)
++{
++	struct mm_plug_cb *mmcb = container_of(cb, struct mm_plug_cb, cb);
++
++	spin_lock_irq(&mmcb->card->lock);
++	activate(mmcb->card);
++	spin_unlock_irq(&mmcb->card->lock);
++	kfree(mmcb);
++}
++
++static int mm_check_plugged(struct cardinfo *card)
++{
++	struct blk_plug *plug = current->plug;
++	struct mm_plug_cb *mmcb;
++
++	if (!plug)
++		return 0;
++
++	list_for_each_entry(mmcb, &plug->cb_list, cb.list) {
++		if (mmcb->cb.callback == mm_unplug && mmcb->card == card)
++			return 1;
++	}
++	/* Not currently on the callback list */
++	mmcb = kmalloc(sizeof(*mmcb), GFP_ATOMIC);
++	if (!mmcb)
++		return 0;
++
++	mmcb->card = card;
++	mmcb->cb.callback = mm_unplug;
++	list_add(&mmcb->cb.list, &plug->cb_list);
++	return 1;
++}
++
+ static void mm_make_request(struct request_queue *q, struct bio *bio)
+ {
+ 	struct cardinfo *card = q->queuedata;
+@@ -523,6 +561,8 @@ static void mm_make_request(struct request_queue *q, struct bio *bio)
+ 	*card->biotail = bio;
+ 	bio->bi_next = NULL;
+ 	card->biotail = &bio->bi_next;
++	if (bio->bi_rw & REQ_SYNC || !mm_check_plugged(card))
++		activate(card);
+ 	spin_unlock_irq(&card->lock);
+ 
+ 	return;
+diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
+index c4da951..ca67338 100644
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -1890,6 +1890,27 @@ ips_ping_for_i915_load(void)
+ 	}
+ }
+ 
++static void i915_kick_out_firmware_fb(struct drm_i915_private *dev_priv)
++{
++	struct apertures_struct *ap;
++	struct pci_dev *pdev = dev_priv->dev->pdev;
++	bool primary;
++
++	ap = alloc_apertures(1);
++	if (!ap)
++		return;
++
++	ap->ranges[0].base = dev_priv->dev->agp->base;
++	ap->ranges[0].size =
++		dev_priv->mm.gtt->gtt_mappable_entries << PAGE_SHIFT;
++	primary =
++		pdev->resource[PCI_ROM_RESOURCE].flags & IORESOURCE_ROM_SHADOW;
++
++	remove_conflicting_framebuffers(ap, "inteldrmfb", primary);
++
++	kfree(ap);
++}
++
+ /**
+  * i915_driver_load - setup chip and create an initial config
+  * @dev: DRM device
+@@ -1927,6 +1948,15 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
+ 		goto free_priv;
+ 	}
+ 
++	dev_priv->mm.gtt = intel_gtt_get();
++	if (!dev_priv->mm.gtt) {
++		DRM_ERROR("Failed to initialize GTT\n");
++		ret = -ENODEV;
++		goto put_bridge;
++	}
++
++	i915_kick_out_firmware_fb(dev_priv);
++
+ 	/* overlay on gen2 is broken and can't address above 1G */
+ 	if (IS_GEN2(dev))
+ 		dma_set_coherent_mask(&dev->pdev->dev, DMA_BIT_MASK(30));
+@@ -1950,13 +1980,6 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
+ 		goto put_bridge;
+ 	}
+ 
+-	dev_priv->mm.gtt = intel_gtt_get();
+-	if (!dev_priv->mm.gtt) {
+-		DRM_ERROR("Failed to initialize GTT\n");
+-		ret = -ENODEV;
+-		goto out_rmmap;
+-	}
+-
+ 	agp_size = dev_priv->mm.gtt->gtt_mappable_entries << PAGE_SHIFT;
+ 
+ 	dev_priv->mm.gtt_mapping =
+diff --git a/drivers/md/persistent-data/dm-space-map-checker.c b/drivers/md/persistent-data/dm-space-map-checker.c
+index 50ed53b..fc90c11 100644
+--- a/drivers/md/persistent-data/dm-space-map-checker.c
++++ b/drivers/md/persistent-data/dm-space-map-checker.c
+@@ -8,6 +8,7 @@
+ 
+ #include <linux/device-mapper.h>
+ #include <linux/export.h>
++#include <linux/vmalloc.h>
+ 
+ #ifdef CONFIG_DM_DEBUG_SPACE_MAPS
+ 
+@@ -89,13 +90,23 @@ static int ca_create(struct count_array *ca, struct dm_space_map *sm)
+ 
+ 	ca->nr = nr_blocks;
+ 	ca->nr_free = nr_blocks;
+-	ca->counts = kzalloc(sizeof(*ca->counts) * nr_blocks, GFP_KERNEL);
+-	if (!ca->counts)
+-		return -ENOMEM;
++
++	if (!nr_blocks)
++		ca->counts = NULL;
++	else {
++		ca->counts = vzalloc(sizeof(*ca->counts) * nr_blocks);
++		if (!ca->counts)
++			return -ENOMEM;
++	}
+ 
+ 	return 0;
+ }
+ 
++static void ca_destroy(struct count_array *ca)
++{
++	vfree(ca->counts);
++}
++
+ static int ca_load(struct count_array *ca, struct dm_space_map *sm)
+ {
+ 	int r;
+@@ -126,12 +137,14 @@ static int ca_load(struct count_array *ca, struct dm_space_map *sm)
+ static int ca_extend(struct count_array *ca, dm_block_t extra_blocks)
+ {
+ 	dm_block_t nr_blocks = ca->nr + extra_blocks;
+-	uint32_t *counts = kzalloc(sizeof(*counts) * nr_blocks, GFP_KERNEL);
++	uint32_t *counts = vzalloc(sizeof(*counts) * nr_blocks);
+ 	if (!counts)
+ 		return -ENOMEM;
+ 
+-	memcpy(counts, ca->counts, sizeof(*counts) * ca->nr);
+-	kfree(ca->counts);
++	if (ca->counts) {
++		memcpy(counts, ca->counts, sizeof(*counts) * ca->nr);
++		ca_destroy(ca);
++	}
+ 	ca->nr = nr_blocks;
+ 	ca->nr_free += extra_blocks;
+ 	ca->counts = counts;
+@@ -151,11 +164,6 @@ static int ca_commit(struct count_array *old, struct count_array *new)
+ 	return 0;
+ }
+ 
+-static void ca_destroy(struct count_array *ca)
+-{
+-	kfree(ca->counts);
+-}
+-
+ /*----------------------------------------------------------------*/
+ 
+ struct sm_checker {
+@@ -343,25 +351,25 @@ struct dm_space_map *dm_sm_checker_create(struct dm_space_map *sm)
+ 	int r;
+ 	struct sm_checker *smc;
+ 
+-	if (!sm)
+-		return NULL;
++	if (IS_ERR_OR_NULL(sm))
++		return ERR_PTR(-EINVAL);
+ 
+ 	smc = kmalloc(sizeof(*smc), GFP_KERNEL);
+ 	if (!smc)
+-		return NULL;
++		return ERR_PTR(-ENOMEM);
+ 
+ 	memcpy(&smc->sm, &ops_, sizeof(smc->sm));
+ 	r = ca_create(&smc->old_counts, sm);
+ 	if (r) {
+ 		kfree(smc);
+-		return NULL;
++		return ERR_PTR(r);
+ 	}
+ 
+ 	r = ca_create(&smc->counts, sm);
+ 	if (r) {
+ 		ca_destroy(&smc->old_counts);
+ 		kfree(smc);
+-		return NULL;
++		return ERR_PTR(r);
+ 	}
+ 
+ 	smc->real_sm = sm;
+@@ -371,7 +379,7 @@ struct dm_space_map *dm_sm_checker_create(struct dm_space_map *sm)
+ 		ca_destroy(&smc->counts);
+ 		ca_destroy(&smc->old_counts);
+ 		kfree(smc);
+-		return NULL;
++		return ERR_PTR(r);
+ 	}
+ 
+ 	r = ca_commit(&smc->old_counts, &smc->counts);
+@@ -379,7 +387,7 @@ struct dm_space_map *dm_sm_checker_create(struct dm_space_map *sm)
+ 		ca_destroy(&smc->counts);
+ 		ca_destroy(&smc->old_counts);
+ 		kfree(smc);
+-		return NULL;
++		return ERR_PTR(r);
+ 	}
+ 
+ 	return &smc->sm;
+@@ -391,25 +399,25 @@ struct dm_space_map *dm_sm_checker_create_fresh(struct dm_space_map *sm)
+ 	int r;
+ 	struct sm_checker *smc;
+ 
+-	if (!sm)
+-		return NULL;
++	if (IS_ERR_OR_NULL(sm))
++		return ERR_PTR(-EINVAL);
+ 
+ 	smc = kmalloc(sizeof(*smc), GFP_KERNEL);
+ 	if (!smc)
+-		return NULL;
++		return ERR_PTR(-ENOMEM);
+ 
+ 	memcpy(&smc->sm, &ops_, sizeof(smc->sm));
+ 	r = ca_create(&smc->old_counts, sm);
+ 	if (r) {
+ 		kfree(smc);
+-		return NULL;
++		return ERR_PTR(r);
+ 	}
+ 
+ 	r = ca_create(&smc->counts, sm);
+ 	if (r) {
+ 		ca_destroy(&smc->old_counts);
+ 		kfree(smc);
+-		return NULL;
++		return ERR_PTR(r);
+ 	}
+ 
+ 	smc->real_sm = sm;
+diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c
+index fc469ba..3d0ed53 100644
+--- a/drivers/md/persistent-data/dm-space-map-disk.c
++++ b/drivers/md/persistent-data/dm-space-map-disk.c
+@@ -290,7 +290,16 @@ struct dm_space_map *dm_sm_disk_create(struct dm_transaction_manager *tm,
+ 				       dm_block_t nr_blocks)
+ {
+ 	struct dm_space_map *sm = dm_sm_disk_create_real(tm, nr_blocks);
+-	return dm_sm_checker_create_fresh(sm);
++	struct dm_space_map *smc;
++
++	if (IS_ERR_OR_NULL(sm))
++		return sm;
++
++	smc = dm_sm_checker_create_fresh(sm);
++	if (IS_ERR(smc))
++		dm_sm_destroy(sm);
++
++	return smc;
+ }
+ EXPORT_SYMBOL_GPL(dm_sm_disk_create);
+ 
+diff --git a/drivers/md/persistent-data/dm-transaction-manager.c b/drivers/md/persistent-data/dm-transaction-manager.c
+index 6f8d387..ba54aac 100644
+--- a/drivers/md/persistent-data/dm-transaction-manager.c
++++ b/drivers/md/persistent-data/dm-transaction-manager.c
+@@ -138,6 +138,9 @@ EXPORT_SYMBOL_GPL(dm_tm_create_non_blocking_clone);
+ 
+ void dm_tm_destroy(struct dm_transaction_manager *tm)
+ {
++	if (!tm->is_clone)
++		wipe_shadow_table(tm);
++
+ 	kfree(tm);
+ }
+ EXPORT_SYMBOL_GPL(dm_tm_destroy);
+@@ -342,8 +345,10 @@ static int dm_tm_create_internal(struct dm_block_manager *bm,
+ 		}
+ 
+ 		*sm = dm_sm_checker_create(inner);
+-		if (!*sm)
++		if (IS_ERR(*sm)) {
++			r = PTR_ERR(*sm);
+ 			goto bad2;
++		}
+ 
+ 	} else {
+ 		r = dm_bm_write_lock(dm_tm_get_bm(*tm), sb_location,
+@@ -362,8 +367,10 @@ static int dm_tm_create_internal(struct dm_block_manager *bm,
+ 		}
+ 
+ 		*sm = dm_sm_checker_create(inner);
+-		if (!*sm)
++		if (IS_ERR(*sm)) {
++			r = PTR_ERR(*sm);
+ 			goto bad2;
++		}
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index b219449..7a9eef6 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1919,7 +1919,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
+ 			if (r10_sync_page_io(rdev,
+ 					     r10_bio->devs[sl].addr +
+ 					     sect,
+-					     s<<9, conf->tmppage, WRITE)
++					     s, conf->tmppage, WRITE)
+ 			    == 0) {
+ 				/* Well, this device is dead */
+ 				printk(KERN_NOTICE
+@@ -1956,7 +1956,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
+ 			switch (r10_sync_page_io(rdev,
+ 					     r10_bio->devs[sl].addr +
+ 					     sect,
+-					     s<<9, conf->tmppage,
++					     s, conf->tmppage,
+ 						 READ)) {
+ 			case 0:
+ 				/* Well, this device is dead */
+@@ -2119,7 +2119,7 @@ read_more:
+ 	rdev = conf->mirrors[mirror].rdev;
+ 	printk_ratelimited(
+ 		KERN_ERR
+-		"md/raid10:%s: %s: redirecting"
++		"md/raid10:%s: %s: redirecting "
+ 		"sector %llu to another mirror\n",
+ 		mdname(mddev),
+ 		bdevname(rdev->bdev, b),
+@@ -2436,6 +2436,12 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr,
+ 			/* want to reconstruct this device */
+ 			rb2 = r10_bio;
+ 			sect = raid10_find_virt(conf, sector_nr, i);
++			if (sect >= mddev->resync_max_sectors) {
++				/* last stripe is not complete - don't
++				 * try to recover this sector.
++				 */
++				continue;
++			}
+ 			/* Unless we are doing a full sync, we only need
+ 			 * to recover the block if it is set in the bitmap
+ 			 */
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 858fdbb..6ba4954 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -542,6 +542,12 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
+ 					 * a chance*/
+ 					md_check_recovery(conf->mddev);
+ 				}
++				/*
++				 * Because md_wait_for_blocked_rdev
++				 * will dec nr_pending, we must
++				 * increment it first.
++				 */
++				atomic_inc(&rdev->nr_pending);
+ 				md_wait_for_blocked_rdev(rdev, conf->mddev);
+ 			} else {
+ 				/* Acknowledged bad block - skip the write */
+@@ -3621,7 +3627,6 @@ static int chunk_aligned_read(struct mddev *mddev, struct bio * raid_bio)
+ 		raid_bio->bi_next = (void*)rdev;
+ 		align_bi->bi_bdev =  rdev->bdev;
+ 		align_bi->bi_flags &= ~(1 << BIO_SEG_VALID);
+-		align_bi->bi_sector += rdev->data_offset;
+ 
+ 		if (!bio_fits_rdev(align_bi) ||
+ 		    is_badblock(rdev, align_bi->bi_sector, align_bi->bi_size>>9,
+@@ -3632,6 +3637,9 @@ static int chunk_aligned_read(struct mddev *mddev, struct bio * raid_bio)
+ 			return 0;
+ 		}
+ 
++		/* No reshape active, so we can trust rdev->data_offset */
++		align_bi->bi_sector += rdev->data_offset;
++
+ 		spin_lock_irq(&conf->device_lock);
+ 		wait_event_lock_irq(conf->wait_for_stripe,
+ 				    conf->quiesce == 0,
+diff --git a/drivers/mtd/nand/cafe_nand.c b/drivers/mtd/nand/cafe_nand.c
+index 72d3f23..68ecf48 100644
+--- a/drivers/mtd/nand/cafe_nand.c
++++ b/drivers/mtd/nand/cafe_nand.c
+@@ -102,7 +102,7 @@ static const char *part_probes[] = { "cmdlinepart", "RedBoot", NULL };
+ static int cafe_device_ready(struct mtd_info *mtd)
+ {
+ 	struct cafe_priv *cafe = mtd->priv;
+-	int result = !!(cafe_readl(cafe, NAND_STATUS) | 0x40000000);
++	int result = !!(cafe_readl(cafe, NAND_STATUS) & 0x40000000);
+ 	uint32_t irqs = cafe_readl(cafe, NAND_IRQ);
+ 
+ 	cafe_writel(cafe, irqs, NAND_IRQ);
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index f65e0b9..1a88e38 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -77,6 +77,7 @@
+ #include <net/route.h>
+ #include <net/net_namespace.h>
+ #include <net/netns/generic.h>
++#include <net/pkt_sched.h>
+ #include "bonding.h"
+ #include "bond_3ad.h"
+ #include "bond_alb.h"
+@@ -382,8 +383,6 @@ struct vlan_entry *bond_next_vlan(struct bonding *bond, struct vlan_entry *curr)
+ 	return next;
+ }
+ 
+-#define bond_queue_mapping(skb) (*(u16 *)((skb)->cb))
+-
+ /**
+  * bond_dev_queue_xmit - Prepare skb for xmit.
+  *
+@@ -396,7 +395,9 @@ int bond_dev_queue_xmit(struct bonding *bond, struct sk_buff *skb,
+ {
+ 	skb->dev = slave_dev;
+ 
+-	skb->queue_mapping = bond_queue_mapping(skb);
++	BUILD_BUG_ON(sizeof(skb->queue_mapping) !=
++		     sizeof(qdisc_skb_cb(skb)->bond_queue_mapping));
++	skb->queue_mapping = qdisc_skb_cb(skb)->bond_queue_mapping;
+ 
+ 	if (unlikely(netpoll_tx_running(slave_dev)))
+ 		bond_netpoll_send_skb(bond_get_slave_by_dev(bond, slave_dev), skb);
+@@ -4151,7 +4152,7 @@ static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb)
+ 	/*
+ 	 * Save the original txq to restore before passing to the driver
+ 	 */
+-	bond_queue_mapping(skb) = skb->queue_mapping;
++	qdisc_skb_cb(skb)->bond_queue_mapping = skb->queue_mapping;
+ 
+ 	if (unlikely(txq >= dev->real_num_tx_queues)) {
+ 		do {
+diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
+index eeac9ca..68fe73c 100644
+--- a/drivers/net/dummy.c
++++ b/drivers/net/dummy.c
+@@ -37,6 +37,7 @@
+ #include <linux/rtnetlink.h>
+ #include <net/rtnetlink.h>
+ #include <linux/u64_stats_sync.h>
++#include <linux/sched.h>
+ 
+ static int numdummies = 1;
+ 
+@@ -186,8 +187,10 @@ static int __init dummy_init_module(void)
+ 	rtnl_lock();
+ 	err = __rtnl_link_register(&dummy_link_ops);
+ 
+-	for (i = 0; i < numdummies && !err; i++)
++	for (i = 0; i < numdummies && !err; i++) {
+ 		err = dummy_init_one();
++		cond_resched();
++	}
+ 	if (err < 0)
+ 		__rtnl_link_unregister(&dummy_link_ops);
+ 	rtnl_unlock();
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index bf266a0..36c7c4e 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -696,6 +696,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
+ 
+ 	copied = make_tx_wrbs(adapter, txq, skb, wrb_cnt, dummy_wrb);
+ 	if (copied) {
++		int gso_segs = skb_shinfo(skb)->gso_segs;
++
+ 		/* record the sent skb in the sent_skb table */
+ 		BUG_ON(txo->sent_skb_list[start]);
+ 		txo->sent_skb_list[start] = skb;
+@@ -713,8 +715,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
+ 
+ 		be_txq_notify(adapter, txq->id, wrb_cnt);
+ 
+-		be_tx_stats_update(txo, wrb_cnt, copied,
+-				skb_shinfo(skb)->gso_segs, stopped);
++		be_tx_stats_update(txo, wrb_cnt, copied, gso_segs, stopped);
+ 	} else {
+ 		txq->head = start;
+ 		dev_kfree_skb_any(skb);
+diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
+index 65c51ff..11ddd838 100644
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -4361,10 +4361,12 @@ static int sky2_set_features(struct net_device *dev, u32 features)
+ 	struct sky2_port *sky2 = netdev_priv(dev);
+ 	u32 changed = dev->features ^ features;
+ 
+-	if (changed & NETIF_F_RXCSUM) {
+-		u32 on = features & NETIF_F_RXCSUM;
+-		sky2_write32(sky2->hw, Q_ADDR(rxqaddr[sky2->port], Q_CSR),
+-			     on ? BMU_ENA_RX_CHKSUM : BMU_DIS_RX_CHKSUM);
++	if ((changed & NETIF_F_RXCSUM) &&
++	    !(sky2->hw->flags & SKY2_HW_NEW_LE)) {
++		sky2_write32(sky2->hw,
++			     Q_ADDR(rxqaddr[sky2->port], Q_CSR),
++			     (features & NETIF_F_RXCSUM)
++			     ? BMU_ENA_RX_CHKSUM : BMU_DIS_RX_CHKSUM);
+ 	}
+ 
+ 	if (changed & NETIF_F_RXHASH)
+diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
+index 0f9ee46..4cc4a8b 100644
+--- a/drivers/net/wireless/ath/ath.h
++++ b/drivers/net/wireless/ath/ath.h
+@@ -143,6 +143,7 @@ struct ath_common {
+ 	u32 keymax;
+ 	DECLARE_BITMAP(keymap, ATH_KEYMAX);
+ 	DECLARE_BITMAP(tkip_keymap, ATH_KEYMAX);
++	DECLARE_BITMAP(ccmp_keymap, ATH_KEYMAX);
+ 	enum ath_crypt_caps crypt_caps;
+ 
+ 	unsigned int clockrate;
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index 6973620..7f97164 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -557,7 +557,7 @@ static int __ath9k_hw_init(struct ath_hw *ah)
+ 
+ 	if (ah->config.serialize_regmode == SER_REG_MODE_AUTO) {
+ 		if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCI ||
+-		    ((AR_SREV_9160(ah) || AR_SREV_9280(ah)) &&
++		    ((AR_SREV_9160(ah) || AR_SREV_9280(ah) || AR_SREV_9287(ah)) &&
+ 		     !ah->is_pciexpress)) {
+ 			ah->config.serialize_regmode =
+ 				SER_REG_MODE_ON;
+diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
+index 2f3aeac..e6d791c 100644
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -829,7 +829,8 @@ static bool ath9k_rx_accept(struct ath_common *common,
+ 	 * descriptor does contain a valid key index. This has been observed
+ 	 * mostly with CCMP encryption.
+ 	 */
+-	if (rx_stats->rs_keyix == ATH9K_RXKEYIX_INVALID)
++	if (rx_stats->rs_keyix == ATH9K_RXKEYIX_INVALID ||
++	    !test_bit(rx_stats->rs_keyix, common->ccmp_keymap))
+ 		rx_stats->rs_status &= ~ATH9K_RXERR_KEYMISS;
+ 
+ 	if (!rx_stats->rs_datalen)
+diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c
+index 4cf7c5e..1ec3fa5 100644
+--- a/drivers/net/wireless/ath/key.c
++++ b/drivers/net/wireless/ath/key.c
+@@ -556,6 +556,9 @@ int ath_key_config(struct ath_common *common,
+ 		return -EIO;
+ 
+ 	set_bit(idx, common->keymap);
++	if (key->cipher == WLAN_CIPHER_SUITE_CCMP)
++		set_bit(idx, common->ccmp_keymap);
++
+ 	if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
+ 		set_bit(idx + 64, common->keymap);
+ 		set_bit(idx, common->tkip_keymap);
+@@ -582,6 +585,7 @@ void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key)
+ 		return;
+ 
+ 	clear_bit(key->hw_key_idx, common->keymap);
++	clear_bit(key->hw_key_idx, common->ccmp_keymap);
+ 	if (key->cipher != WLAN_CIPHER_SUITE_TKIP)
+ 		return;
+ 
+diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
+index 7aa9aa0..39fd4d5 100644
+--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
++++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
+@@ -267,7 +267,8 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
+ 	else
+ 		last_seq = priv->rx_seq[tid];
+ 
+-	if (last_seq >= new_node->start_win)
++	if (last_seq != MWIFIEX_DEF_11N_RX_SEQ_NUM &&
++	    last_seq >= new_node->start_win)
+ 		new_node->start_win = last_seq + 1;
+ 
+ 	new_node->win_size = win_size;
+@@ -611,5 +612,5 @@ void mwifiex_11n_cleanup_reorder_tbl(struct mwifiex_private *priv)
+ 	spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
+ 
+ 	INIT_LIST_HEAD(&priv->rx_reorder_tbl_ptr);
+-	memset(priv->rx_seq, 0, sizeof(priv->rx_seq));
++	mwifiex_reset_11n_rx_seq_num(priv);
+ }
+diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.h b/drivers/net/wireless/mwifiex/11n_rxreorder.h
+index 033c8ad..7128baa 100644
+--- a/drivers/net/wireless/mwifiex/11n_rxreorder.h
++++ b/drivers/net/wireless/mwifiex/11n_rxreorder.h
+@@ -37,6 +37,13 @@
+ 
+ #define ADDBA_RSP_STATUS_ACCEPT 0
+ 
++#define MWIFIEX_DEF_11N_RX_SEQ_NUM	0xffff
++
++static inline void mwifiex_reset_11n_rx_seq_num(struct mwifiex_private *priv)
++{
++	memset(priv->rx_seq, 0xff, sizeof(priv->rx_seq));
++}
++
+ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *,
+ 			       u16 seqNum,
+ 			       u16 tid, u8 *ta,
+diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
+index 462c710..01dcb1a 100644
+--- a/drivers/net/wireless/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/mwifiex/cfg80211.c
+@@ -1177,11 +1177,11 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
+ 	void *mdev_priv;
+ 
+ 	if (!priv)
+-		return NULL;
++		return ERR_PTR(-EFAULT);
+ 
+ 	adapter = priv->adapter;
+ 	if (!adapter)
+-		return NULL;
++		return ERR_PTR(-EFAULT);
+ 
+ 	switch (type) {
+ 	case NL80211_IFTYPE_UNSPECIFIED:
+@@ -1190,7 +1190,7 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
+ 		if (priv->bss_mode) {
+ 			wiphy_err(wiphy, "cannot create multiple"
+ 					" station/adhoc interfaces\n");
+-			return NULL;
++			return ERR_PTR(-EINVAL);
+ 		}
+ 
+ 		if (type == NL80211_IFTYPE_UNSPECIFIED)
+@@ -1208,14 +1208,15 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
+ 		break;
+ 	default:
+ 		wiphy_err(wiphy, "type not supported\n");
+-		return NULL;
++		return ERR_PTR(-EINVAL);
+ 	}
+ 
+ 	dev = alloc_netdev_mq(sizeof(struct mwifiex_private *), name,
+ 			      ether_setup, 1);
+ 	if (!dev) {
+ 		wiphy_err(wiphy, "no memory available for netdevice\n");
+-		goto error;
++		priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
++		return ERR_PTR(-ENOMEM);
+ 	}
+ 
+ 	dev_net_set(dev, wiphy_net(wiphy));
+@@ -1240,7 +1241,9 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
+ 	/* Register network device */
+ 	if (register_netdevice(dev)) {
+ 		wiphy_err(wiphy, "cannot register virtual network device\n");
+-		goto error;
++		free_netdev(dev);
++		priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
++		return ERR_PTR(-EFAULT);
+ 	}
+ 
+ 	sema_init(&priv->async_sem, 1);
+@@ -1252,12 +1255,6 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
+ 	mwifiex_dev_debugfs_init(priv);
+ #endif
+ 	return dev;
+-error:
+-	if (dev && (dev->reg_state == NETREG_UNREGISTERED))
+-		free_netdev(dev);
+-	priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
+-
+-	return NULL;
+ }
+ EXPORT_SYMBOL_GPL(mwifiex_add_virtual_intf);
+ 
+diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
+index 6c239c3..06fcf1e 100644
+--- a/drivers/net/wireless/mwifiex/wmm.c
++++ b/drivers/net/wireless/mwifiex/wmm.c
+@@ -406,6 +406,8 @@ mwifiex_wmm_init(struct mwifiex_adapter *adapter)
+ 		priv->add_ba_param.tx_win_size = MWIFIEX_AMPDU_DEF_TXWINSIZE;
+ 		priv->add_ba_param.rx_win_size = MWIFIEX_AMPDU_DEF_RXWINSIZE;
+ 
++		mwifiex_reset_11n_rx_seq_num(priv);
++
+ 		atomic_set(&priv->wmm.tx_pkts_queued, 0);
+ 		atomic_set(&priv->wmm.highest_queued_prio, HIGH_PRIO_TID);
+ 	}
+@@ -1209,10 +1211,12 @@ mwifiex_dequeue_tx_packet(struct mwifiex_adapter *adapter)
+ 		return 0;
+ 	}
+ 
+-	if (!ptr->is_11n_enabled || mwifiex_is_ba_stream_setup(priv, ptr, tid)
+-	    || ((priv->sec_info.wpa_enabled
+-		  || priv->sec_info.wpa2_enabled) && !priv->wpa_is_gtk_set)
+-		) {
++	if (!ptr->is_11n_enabled ||
++	    mwifiex_is_ba_stream_setup(priv, ptr, tid) ||
++	    priv->wps.session_enable ||
++	    ((priv->sec_info.wpa_enabled ||
++	      priv->sec_info.wpa2_enabled) &&
++	     !priv->wpa_is_gtk_set)) {
+ 		mwifiex_send_single_packet(priv, ptr, ptr_index, flags);
+ 		/* ra_list_spinlock has been freed in
+ 		   mwifiex_send_single_packet() */
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index 94a3e17..0302148 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -311,9 +311,11 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ 	{RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/
+ 	{RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
+ 	{RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/
++	{RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
+ 	{RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ 	{RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ 	{RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
++	{RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
+ 	/* HP - Lite-On ,8188CUS Slim Combo */
+ 	{RTL_USB_DEVICE(0x103c, 0x1629, rtl92cu_hal_cfg)},
+ 	{RTL_USB_DEVICE(0x13d3, 0x3357, rtl92cu_hal_cfg)}, /* AzureWave */
+@@ -355,6 +357,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ 	{RTL_USB_DEVICE(0x07b8, 0x8178, rtl92cu_hal_cfg)}, /*Funai -Abocom*/
+ 	{RTL_USB_DEVICE(0x0846, 0x9021, rtl92cu_hal_cfg)}, /*Netgear-Sercomm*/
+ 	{RTL_USB_DEVICE(0x0b05, 0x17ab, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/
++	{RTL_USB_DEVICE(0x0bda, 0x8186, rtl92cu_hal_cfg)}, /*Realtek 92CE-VAU*/
+ 	{RTL_USB_DEVICE(0x0df6, 0x0061, rtl92cu_hal_cfg)}, /*Sitecom-Edimax*/
+ 	{RTL_USB_DEVICE(0x0e66, 0x0019, rtl92cu_hal_cfg)}, /*Hawking-Edimax*/
+ 	{RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
+diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c
+index 3269213..64ddb63 100644
+--- a/drivers/target/tcm_fc/tfc_sess.c
++++ b/drivers/target/tcm_fc/tfc_sess.c
+@@ -61,7 +61,8 @@ static struct ft_tport *ft_tport_create(struct fc_lport *lport)
+ 	struct ft_tport *tport;
+ 	int i;
+ 
+-	tport = rcu_dereference(lport->prov[FC_TYPE_FCP]);
++	tport = rcu_dereference_protected(lport->prov[FC_TYPE_FCP],
++					  lockdep_is_held(&ft_lport_lock));
+ 	if (tport && tport->tpg)
+ 		return tport;
+ 
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 3568374..19b127c 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -692,6 +692,8 @@ static noinline int drop_one_dir_item(struct btrfs_trans_handle *trans,
+ 	kfree(name);
+ 
+ 	iput(inode);
++
++	btrfs_run_delayed_items(trans, root);
+ 	return ret;
+ }
+ 
+@@ -897,6 +899,7 @@ again:
+ 				ret = btrfs_unlink_inode(trans, root, dir,
+ 							 inode, victim_name,
+ 							 victim_name_len);
++				btrfs_run_delayed_items(trans, root);
+ 			}
+ 			kfree(victim_name);
+ 			ptr = (unsigned long)(victim_ref + 1) + victim_name_len;
+@@ -1477,6 +1480,9 @@ again:
+ 			ret = btrfs_unlink_inode(trans, root, dir, inode,
+ 						 name, name_len);
+ 			BUG_ON(ret);
++
++			btrfs_run_delayed_items(trans, root);
++
+ 			kfree(name);
+ 			iput(inode);
+ 
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 9e0675a..b21670c 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2975,18 +2975,15 @@ cifs_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
+ 	 * MS-CIFS indicates that servers are only limited by the client's
+ 	 * bufsize for reads, testing against win98se shows that it throws
+ 	 * INVALID_PARAMETER errors if you try to request too large a read.
++	 * OS/2 just sends back short reads.
+ 	 *
+-	 * If the server advertises a MaxBufferSize of less than one page,
+-	 * assume that it also can't satisfy reads larger than that either.
+-	 *
+-	 * FIXME: Is there a better heuristic for this?
++	 * If the server doesn't advertise CAP_LARGE_READ_X, then assume that
++	 * it can't handle a read request larger than its MaxBufferSize either.
+ 	 */
+ 	if (tcon->unix_ext && (unix_cap & CIFS_UNIX_LARGE_READ_CAP))
+ 		defsize = CIFS_DEFAULT_IOSIZE;
+ 	else if (server->capabilities & CAP_LARGE_READ_X)
+ 		defsize = CIFS_DEFAULT_NON_POSIX_RSIZE;
+-	else if (server->maxBuf >= PAGE_CACHE_SIZE)
+-		defsize = CIFSMaxBufSize;
+ 	else
+ 		defsize = server->maxBuf - sizeof(READ_RSP);
+ 
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index 6e39668..07ee5b4 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -2422,8 +2422,10 @@ out_dio:
+ 		unaligned_dio = 0;
+ 	}
+ 
+-	if (unaligned_dio)
++	if (unaligned_dio) {
++		ocfs2_iocb_clear_unaligned_aio(iocb);
+ 		atomic_dec(&OCFS2_I(inode)->ip_unaligned_aio);
++	}
+ 
+ out:
+ 	if (rw_level != -1)
+diff --git a/fs/open.c b/fs/open.c
+index 22c41b5..e2b5d51 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -396,10 +396,10 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
+ {
+ 	struct file *file;
+ 	struct inode *inode;
+-	int error;
++	int error, fput_needed;
+ 
+ 	error = -EBADF;
+-	file = fget(fd);
++	file = fget_raw_light(fd, &fput_needed);
+ 	if (!file)
+ 		goto out;
+ 
+@@ -413,7 +413,7 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
+ 	if (!error)
+ 		set_fs_pwd(current->fs, &file->f_path);
+ out_putf:
+-	fput(file);
++	fput_light(file, fput_needed);
+ out:
+ 	return error;
+ }
+diff --git a/fs/splice.c b/fs/splice.c
+index 6d0dfb8..014fcb4 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -274,13 +274,16 @@ void spd_release_page(struct splice_pipe_desc *spd, unsigned int i)
+  * Check if we need to grow the arrays holding pages and partial page
+  * descriptions.
+  */
+-int splice_grow_spd(struct pipe_inode_info *pipe, struct splice_pipe_desc *spd)
++int splice_grow_spd(const struct pipe_inode_info *pipe, struct splice_pipe_desc *spd)
+ {
+-	if (pipe->buffers <= PIPE_DEF_BUFFERS)
++	unsigned int buffers = ACCESS_ONCE(pipe->buffers);
++
++	spd->nr_pages_max = buffers;
++	if (buffers <= PIPE_DEF_BUFFERS)
+ 		return 0;
+ 
+-	spd->pages = kmalloc(pipe->buffers * sizeof(struct page *), GFP_KERNEL);
+-	spd->partial = kmalloc(pipe->buffers * sizeof(struct partial_page), GFP_KERNEL);
++	spd->pages = kmalloc(buffers * sizeof(struct page *), GFP_KERNEL);
++	spd->partial = kmalloc(buffers * sizeof(struct partial_page), GFP_KERNEL);
+ 
+ 	if (spd->pages && spd->partial)
+ 		return 0;
+@@ -290,10 +293,9 @@ int splice_grow_spd(struct pipe_inode_info *pipe, struct splice_pipe_desc *spd)
+ 	return -ENOMEM;
+ }
+ 
+-void splice_shrink_spd(struct pipe_inode_info *pipe,
+-		       struct splice_pipe_desc *spd)
++void splice_shrink_spd(struct splice_pipe_desc *spd)
+ {
+-	if (pipe->buffers <= PIPE_DEF_BUFFERS)
++	if (spd->nr_pages_max <= PIPE_DEF_BUFFERS)
+ 		return;
+ 
+ 	kfree(spd->pages);
+@@ -316,6 +318,7 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
+ 	struct splice_pipe_desc spd = {
+ 		.pages = pages,
+ 		.partial = partial,
++		.nr_pages_max = PIPE_DEF_BUFFERS,
+ 		.flags = flags,
+ 		.ops = &page_cache_pipe_buf_ops,
+ 		.spd_release = spd_release_page,
+@@ -327,7 +330,7 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
+ 	index = *ppos >> PAGE_CACHE_SHIFT;
+ 	loff = *ppos & ~PAGE_CACHE_MASK;
+ 	req_pages = (len + loff + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
+-	nr_pages = min(req_pages, pipe->buffers);
++	nr_pages = min(req_pages, spd.nr_pages_max);
+ 
+ 	/*
+ 	 * Lookup the (hopefully) full range of pages we need.
+@@ -498,7 +501,7 @@ fill_it:
+ 	if (spd.nr_pages)
+ 		error = splice_to_pipe(pipe, &spd);
+ 
+-	splice_shrink_spd(pipe, &spd);
++	splice_shrink_spd(&spd);
+ 	return error;
+ }
+ 
+@@ -599,6 +602,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
+ 	struct splice_pipe_desc spd = {
+ 		.pages = pages,
+ 		.partial = partial,
++		.nr_pages_max = PIPE_DEF_BUFFERS,
+ 		.flags = flags,
+ 		.ops = &default_pipe_buf_ops,
+ 		.spd_release = spd_release_page,
+@@ -609,8 +613,8 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
+ 
+ 	res = -ENOMEM;
+ 	vec = __vec;
+-	if (pipe->buffers > PIPE_DEF_BUFFERS) {
+-		vec = kmalloc(pipe->buffers * sizeof(struct iovec), GFP_KERNEL);
++	if (spd.nr_pages_max > PIPE_DEF_BUFFERS) {
++		vec = kmalloc(spd.nr_pages_max * sizeof(struct iovec), GFP_KERNEL);
+ 		if (!vec)
+ 			goto shrink_ret;
+ 	}
+@@ -618,7 +622,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
+ 	offset = *ppos & ~PAGE_CACHE_MASK;
+ 	nr_pages = (len + offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
+ 
+-	for (i = 0; i < nr_pages && i < pipe->buffers && len; i++) {
++	for (i = 0; i < nr_pages && i < spd.nr_pages_max && len; i++) {
+ 		struct page *page;
+ 
+ 		page = alloc_page(GFP_USER);
+@@ -666,7 +670,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
+ shrink_ret:
+ 	if (vec != __vec)
+ 		kfree(vec);
+-	splice_shrink_spd(pipe, &spd);
++	splice_shrink_spd(&spd);
+ 	return res;
+ 
+ err:
+@@ -1616,6 +1620,7 @@ static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
+ 	struct splice_pipe_desc spd = {
+ 		.pages = pages,
+ 		.partial = partial,
++		.nr_pages_max = PIPE_DEF_BUFFERS,
+ 		.flags = flags,
+ 		.ops = &user_page_pipe_buf_ops,
+ 		.spd_release = spd_release_page,
+@@ -1631,13 +1636,13 @@ static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
+ 
+ 	spd.nr_pages = get_iovec_page_array(iov, nr_segs, spd.pages,
+ 					    spd.partial, flags & SPLICE_F_GIFT,
+-					    pipe->buffers);
++					    spd.nr_pages_max);
+ 	if (spd.nr_pages <= 0)
+ 		ret = spd.nr_pages;
+ 	else
+ 		ret = splice_to_pipe(pipe, &spd);
+ 
+-	splice_shrink_spd(pipe, &spd);
++	splice_shrink_spd(&spd);
+ 	return ret;
+ }
+ 
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 87cb24a..270e135 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -56,6 +56,7 @@
+ #include <linux/seq_file.h>
+ #include <linux/bitmap.h>
+ #include <linux/crc-itu-t.h>
++#include <linux/log2.h>
+ #include <asm/byteorder.h>
+ 
+ #include "udf_sb.h"
+@@ -1217,16 +1218,65 @@ out_bh:
+ 	return ret;
+ }
+ 
++static int udf_load_sparable_map(struct super_block *sb,
++				 struct udf_part_map *map,
++				 struct sparablePartitionMap *spm)
++{
++	uint32_t loc;
++	uint16_t ident;
++	struct sparingTable *st;
++	struct udf_sparing_data *sdata = &map->s_type_specific.s_sparing;
++	int i;
++	struct buffer_head *bh;
++
++	map->s_partition_type = UDF_SPARABLE_MAP15;
++	sdata->s_packet_len = le16_to_cpu(spm->packetLength);
++	if (!is_power_of_2(sdata->s_packet_len)) {
++		udf_err(sb, "error loading logical volume descriptor: "
++			"Invalid packet length %u\n",
++			(unsigned)sdata->s_packet_len);
++		return -EIO;
++	}
++	if (spm->numSparingTables > 4) {
++		udf_err(sb, "error loading logical volume descriptor: "
++			"Too many sparing tables (%d)\n",
++			(int)spm->numSparingTables);
++		return -EIO;
++	}
++
++	for (i = 0; i < spm->numSparingTables; i++) {
++		loc = le32_to_cpu(spm->locSparingTable[i]);
++		bh = udf_read_tagged(sb, loc, loc, &ident);
++		if (!bh)
++			continue;
++
++		st = (struct sparingTable *)bh->b_data;
++		if (ident != 0 ||
++		    strncmp(st->sparingIdent.ident, UDF_ID_SPARING,
++			    strlen(UDF_ID_SPARING)) ||
++		    sizeof(*st) + le16_to_cpu(st->reallocationTableLen) >
++							sb->s_blocksize) {
++			brelse(bh);
++			continue;
++		}
++
++		sdata->s_spar_map[i] = bh;
++	}
++	map->s_partition_func = udf_get_pblock_spar15;
++	return 0;
++}
++
+ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
+ 			       struct kernel_lb_addr *fileset)
+ {
+ 	struct logicalVolDesc *lvd;
+-	int i, j, offset;
++	int i, offset;
+ 	uint8_t type;
+ 	struct udf_sb_info *sbi = UDF_SB(sb);
+ 	struct genericPartitionMap *gpm;
+ 	uint16_t ident;
+ 	struct buffer_head *bh;
++	unsigned int table_len;
+ 	int ret = 0;
+ 
+ 	bh = udf_read_tagged(sb, block, block, &ident);
+@@ -1234,15 +1284,20 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
+ 		return 1;
+ 	BUG_ON(ident != TAG_IDENT_LVD);
+ 	lvd = (struct logicalVolDesc *)bh->b_data;
+-
+-	i = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps));
+-	if (i != 0) {
+-		ret = i;
++	table_len = le32_to_cpu(lvd->mapTableLength);
++	if (sizeof(*lvd) + table_len > sb->s_blocksize) {
++		udf_err(sb, "error loading logical volume descriptor: "
++			"Partition table too long (%u > %lu)\n", table_len,
++			sb->s_blocksize - sizeof(*lvd));
+ 		goto out_bh;
+ 	}
+ 
++	ret = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps));
++	if (ret)
++		goto out_bh;
++
+ 	for (i = 0, offset = 0;
+-	     i < sbi->s_partitions && offset < le32_to_cpu(lvd->mapTableLength);
++	     i < sbi->s_partitions && offset < table_len;
+ 	     i++, offset += gpm->partitionMapLength) {
+ 		struct udf_part_map *map = &sbi->s_partmaps[i];
+ 		gpm = (struct genericPartitionMap *)
+@@ -1277,38 +1332,9 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
+ 			} else if (!strncmp(upm2->partIdent.ident,
+ 						UDF_ID_SPARABLE,
+ 						strlen(UDF_ID_SPARABLE))) {
+-				uint32_t loc;
+-				struct sparingTable *st;
+-				struct sparablePartitionMap *spm =
+-					(struct sparablePartitionMap *)gpm;
+-
+-				map->s_partition_type = UDF_SPARABLE_MAP15;
+-				map->s_type_specific.s_sparing.s_packet_len =
+-						le16_to_cpu(spm->packetLength);
+-				for (j = 0; j < spm->numSparingTables; j++) {
+-					struct buffer_head *bh2;
+-
+-					loc = le32_to_cpu(
+-						spm->locSparingTable[j]);
+-					bh2 = udf_read_tagged(sb, loc, loc,
+-							     &ident);
+-					map->s_type_specific.s_sparing.
+-							s_spar_map[j] = bh2;
+-
+-					if (bh2 == NULL)
+-						continue;
+-
+-					st = (struct sparingTable *)bh2->b_data;
+-					if (ident != 0 || strncmp(
+-						st->sparingIdent.ident,
+-						UDF_ID_SPARING,
+-						strlen(UDF_ID_SPARING))) {
+-						brelse(bh2);
+-						map->s_type_specific.s_sparing.
+-							s_spar_map[j] = NULL;
+-					}
+-				}
+-				map->s_partition_func = udf_get_pblock_spar15;
++				if (udf_load_sparable_map(sb, map,
++				    (struct sparablePartitionMap *)gpm) < 0)
++					goto out_bh;
+ 			} else if (!strncmp(upm2->partIdent.ident,
+ 						UDF_ID_METADATA,
+ 						strlen(UDF_ID_METADATA))) {
+diff --git a/include/linux/aio.h b/include/linux/aio.h
+index 2314ad8..b1a520e 100644
+--- a/include/linux/aio.h
++++ b/include/linux/aio.h
+@@ -140,6 +140,7 @@ struct kiocb {
+ 		(x)->ki_dtor = NULL;			\
+ 		(x)->ki_obj.tsk = tsk;			\
+ 		(x)->ki_user_data = 0;                  \
++		(x)->private = NULL;			\
+ 	} while (0)
+ 
+ #define AIO_RING_MAGIC			0xa10a10a1
+diff --git a/include/linux/splice.h b/include/linux/splice.h
+index 26e5b61..09a545a 100644
+--- a/include/linux/splice.h
++++ b/include/linux/splice.h
+@@ -51,7 +51,8 @@ struct partial_page {
+ struct splice_pipe_desc {
+ 	struct page **pages;		/* page map */
+ 	struct partial_page *partial;	/* pages[] may not be contig */
+-	int nr_pages;			/* number of pages in map */
++	int nr_pages;			/* number of populated pages in map */
++	unsigned int nr_pages_max;	/* pages[] & partial[] arrays size */
+ 	unsigned int flags;		/* splice flags */
+ 	const struct pipe_buf_operations *ops;/* ops associated with output pipe */
+ 	void (*spd_release)(struct splice_pipe_desc *, unsigned int);
+@@ -85,9 +86,8 @@ extern ssize_t splice_direct_to_actor(struct file *, struct splice_desc *,
+ /*
+  * for dynamic pipe sizing
+  */
+-extern int splice_grow_spd(struct pipe_inode_info *, struct splice_pipe_desc *);
+-extern void splice_shrink_spd(struct pipe_inode_info *,
+-				struct splice_pipe_desc *);
++extern int splice_grow_spd(const struct pipe_inode_info *, struct splice_pipe_desc *);
++extern void splice_shrink_spd(struct splice_pipe_desc *);
+ extern void spd_release_page(struct splice_pipe_desc *, unsigned int);
+ 
+ extern const struct pipe_buf_operations page_cache_pipe_buf_ops;
+diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
+index 9808877..a7a683e 100644
+--- a/include/net/cipso_ipv4.h
++++ b/include/net/cipso_ipv4.h
+@@ -42,6 +42,7 @@
+ #include <net/netlabel.h>
+ #include <net/request_sock.h>
+ #include <linux/atomic.h>
++#include <asm/unaligned.h>
+ 
+ /* known doi values */
+ #define CIPSO_V4_DOI_UNKNOWN          0x00000000
+@@ -285,7 +286,33 @@ static inline int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
+ static inline int cipso_v4_validate(const struct sk_buff *skb,
+ 				    unsigned char **option)
+ {
+-	return -ENOSYS;
++	unsigned char *opt = *option;
++	unsigned char err_offset = 0;
++	u8 opt_len = opt[1];
++	u8 opt_iter;
++
++	if (opt_len < 8) {
++		err_offset = 1;
++		goto out;
++	}
++
++	if (get_unaligned_be32(&opt[2]) == 0) {
++		err_offset = 2;
++		goto out;
++	}
++
++	for (opt_iter = 6; opt_iter < opt_len;) {
++		if (opt[opt_iter + 1] > (opt_len - opt_iter)) {
++			err_offset = opt_iter + 1;
++			goto out;
++		}
++		opt_iter += opt[opt_iter + 1];
++	}
++
++out:
++	*option = opt + err_offset;
++	return err_offset;
++
+ }
+ #endif /* CONFIG_NETLABEL */
+ 
+diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
+index 55ce96b..9d7d54a 100644
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -220,13 +220,16 @@ struct tcf_proto {
+ 
+ struct qdisc_skb_cb {
+ 	unsigned int		pkt_len;
+-	unsigned char		data[24];
++	u16			bond_queue_mapping;
++	u16			_pad;
++	unsigned char		data[20];
+ };
+ 
+ static inline void qdisc_cb_private_validate(const struct sk_buff *skb, int sz)
+ {
+ 	struct qdisc_skb_cb *qcb;
+-	BUILD_BUG_ON(sizeof(skb->cb) < sizeof(unsigned int) + sz);
++
++	BUILD_BUG_ON(sizeof(skb->cb) < offsetof(struct qdisc_skb_cb, data) + sz);
+ 	BUILD_BUG_ON(sizeof(qcb->data) < sz);
+ }
+ 
+diff --git a/kernel/relay.c b/kernel/relay.c
+index b6f803a..a535fc9 100644
+--- a/kernel/relay.c
++++ b/kernel/relay.c
+@@ -1235,6 +1235,7 @@ static ssize_t subbuf_splice_actor(struct file *in,
+ 	struct splice_pipe_desc spd = {
+ 		.pages = pages,
+ 		.nr_pages = 0,
++		.nr_pages_max = PIPE_DEF_BUFFERS,
+ 		.partial = partial,
+ 		.flags = flags,
+ 		.ops = &relay_pipe_buf_ops,
+@@ -1302,8 +1303,8 @@ static ssize_t subbuf_splice_actor(struct file *in,
+                 ret += padding;
+ 
+ out:
+-	splice_shrink_spd(pipe, &spd);
+-        return ret;
++	splice_shrink_spd(&spd);
++	return ret;
+ }
+ 
+ static ssize_t relay_file_splice_read(struct file *in,
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 697e49d..5638104 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2541,10 +2541,12 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf,
+ 		if (cpumask_test_cpu(cpu, tracing_cpumask) &&
+ 				!cpumask_test_cpu(cpu, tracing_cpumask_new)) {
+ 			atomic_inc(&global_trace.data[cpu]->disabled);
++			ring_buffer_record_disable_cpu(global_trace.buffer, cpu);
+ 		}
+ 		if (!cpumask_test_cpu(cpu, tracing_cpumask) &&
+ 				cpumask_test_cpu(cpu, tracing_cpumask_new)) {
+ 			atomic_dec(&global_trace.data[cpu]->disabled);
++			ring_buffer_record_enable_cpu(global_trace.buffer, cpu);
+ 		}
+ 	}
+ 	arch_spin_unlock(&ftrace_max_lock);
+@@ -3456,6 +3458,7 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
+ 		.pages		= pages_def,
+ 		.partial	= partial_def,
+ 		.nr_pages	= 0, /* This gets updated below. */
++		.nr_pages_max	= PIPE_DEF_BUFFERS,
+ 		.flags		= flags,
+ 		.ops		= &tracing_pipe_buf_ops,
+ 		.spd_release	= tracing_spd_release_pipe,
+@@ -3527,7 +3530,7 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
+ 
+ 	ret = splice_to_pipe(pipe, &spd);
+ out:
+-	splice_shrink_spd(pipe, &spd);
++	splice_shrink_spd(&spd);
+ 	return ret;
+ 
+ out_err:
+@@ -4017,6 +4020,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
+ 	struct splice_pipe_desc spd = {
+ 		.pages		= pages_def,
+ 		.partial	= partial_def,
++		.nr_pages_max	= PIPE_DEF_BUFFERS,
+ 		.flags		= flags,
+ 		.ops		= &buffer_pipe_buf_ops,
+ 		.spd_release	= buffer_spd_release,
+@@ -4104,7 +4108,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
+ 	}
+ 
+ 	ret = splice_to_pipe(pipe, &spd);
+-	splice_shrink_spd(pipe, &spd);
++	splice_shrink_spd(&spd);
+ out:
+ 	return ret;
+ }
+diff --git a/mm/madvise.c b/mm/madvise.c
+index 74bf193..23d3a6b 100644
+--- a/mm/madvise.c
++++ b/mm/madvise.c
+@@ -13,6 +13,7 @@
+ #include <linux/hugetlb.h>
+ #include <linux/sched.h>
+ #include <linux/ksm.h>
++#include <linux/file.h>
+ 
+ /*
+  * Any behaviour which results in changes to the vma->vm_flags needs to
+@@ -197,14 +198,16 @@ static long madvise_remove(struct vm_area_struct *vma,
+ 	struct address_space *mapping;
+ 	loff_t offset, endoff;
+ 	int error;
++	struct file *f;
+ 
+ 	*prev = NULL;	/* tell sys_madvise we drop mmap_sem */
+ 
+ 	if (vma->vm_flags & (VM_LOCKED|VM_NONLINEAR|VM_HUGETLB))
+ 		return -EINVAL;
+ 
+-	if (!vma->vm_file || !vma->vm_file->f_mapping
+-		|| !vma->vm_file->f_mapping->host) {
++	f = vma->vm_file;
++
++	if (!f || !f->f_mapping || !f->f_mapping->host) {
+ 			return -EINVAL;
+ 	}
+ 
+@@ -218,9 +221,16 @@ static long madvise_remove(struct vm_area_struct *vma,
+ 	endoff = (loff_t)(end - vma->vm_start - 1)
+ 			+ ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
+ 
+-	/* vmtruncate_range needs to take i_mutex */
++	/*
++	 * vmtruncate_range may need to take i_mutex.  We need to
++	 * explicitly grab a reference because the vma (and hence the
++	 * vma's reference to the file) can go away as soon as we drop
++	 * mmap_sem.
++	 */
++	get_file(f);
+ 	up_read(&current->mm->mmap_sem);
+ 	error = vmtruncate_range(mapping->host, offset, endoff);
++	fput(f);
+ 	down_read(&current->mm->mmap_sem);
+ 	return error;
+ }
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 6c253f7..7a82174 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1359,6 +1359,7 @@ static ssize_t shmem_file_splice_read(struct file *in, loff_t *ppos,
+ 	struct splice_pipe_desc spd = {
+ 		.pages = pages,
+ 		.partial = partial,
++		.nr_pages_max = PIPE_DEF_BUFFERS,
+ 		.flags = flags,
+ 		.ops = &page_cache_pipe_buf_ops,
+ 		.spd_release = spd_release_page,
+@@ -1447,7 +1448,7 @@ static ssize_t shmem_file_splice_read(struct file *in, loff_t *ppos,
+ 	if (spd.nr_pages)
+ 		error = splice_to_pipe(pipe, &spd);
+ 
+-	splice_shrink_spd(pipe, &spd);
++	splice_shrink_spd(&spd);
+ 
+ 	if (error > 0) {
+ 		*ppos += error;
+diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
+index f603e5b..f3f75ad 100644
+--- a/net/bridge/br_if.c
++++ b/net/bridge/br_if.c
+@@ -240,6 +240,7 @@ int br_add_bridge(struct net *net, const char *name)
+ 		return -ENOMEM;
+ 
+ 	dev_net_set(dev, net);
++	dev->rtnl_link_ops = &br_link_ops;
+ 
+ 	res = register_netdev(dev);
+ 	if (res)
+diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
+index a1daf82..cbf9ccd 100644
+--- a/net/bridge/br_netlink.c
++++ b/net/bridge/br_netlink.c
+@@ -211,7 +211,7 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
+ 	return 0;
+ }
+ 
+-static struct rtnl_link_ops br_link_ops __read_mostly = {
++struct rtnl_link_ops br_link_ops __read_mostly = {
+ 	.kind		= "bridge",
+ 	.priv_size	= sizeof(struct net_bridge),
+ 	.setup		= br_dev_setup,
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index 93264df..b9bba8f 100644
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -536,6 +536,7 @@ extern int (*br_fdb_test_addr_hook)(struct net_device *dev, unsigned char *addr)
+ #endif
+ 
+ /* br_netlink.c */
++extern struct rtnl_link_ops br_link_ops;
+ extern int br_netlink_init(void);
+ extern void br_netlink_fini(void);
+ extern void br_ifinfo_notify(int event, struct net_bridge_port *port);
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index 2b587ec..2367246 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -1672,6 +1672,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
+ 	case ETHTOOL_GRXCSUM:
+ 	case ETHTOOL_GTXCSUM:
+ 	case ETHTOOL_GSG:
++	case ETHTOOL_GSSET_INFO:
+ 	case ETHTOOL_GSTRINGS:
+ 	case ETHTOOL_GTSO:
+ 	case ETHTOOL_GPERMADDR:
+diff --git a/net/core/netpoll.c b/net/core/netpoll.c
+index ab0633f..db4bb7a 100644
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -351,22 +351,23 @@ EXPORT_SYMBOL(netpoll_send_skb_on_dev);
+ 
+ void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
+ {
+-	int total_len, eth_len, ip_len, udp_len;
++	int total_len, ip_len, udp_len;
+ 	struct sk_buff *skb;
+ 	struct udphdr *udph;
+ 	struct iphdr *iph;
+ 	struct ethhdr *eth;
+ 
+ 	udp_len = len + sizeof(*udph);
+-	ip_len = eth_len = udp_len + sizeof(*iph);
+-	total_len = eth_len + ETH_HLEN + NET_IP_ALIGN;
++	ip_len = udp_len + sizeof(*iph);
++	total_len = ip_len + LL_RESERVED_SPACE(np->dev);
+ 
+-	skb = find_skb(np, total_len, total_len - len);
++	skb = find_skb(np, total_len + np->dev->needed_tailroom,
++		       total_len - len);
+ 	if (!skb)
+ 		return;
+ 
+ 	skb_copy_to_linear_data(skb, msg, len);
+-	skb->len += len;
++	skb_put(skb, len);
+ 
+ 	skb_push(skb, sizeof(*udph));
+ 	skb_reset_transport_header(skb);
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 2ec200de..af9c3c6 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -1663,6 +1663,7 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
+ 	struct splice_pipe_desc spd = {
+ 		.pages = pages,
+ 		.partial = partial,
++		.nr_pages_max = MAX_SKB_FRAGS,
+ 		.flags = flags,
+ 		.ops = &sock_pipe_buf_ops,
+ 		.spd_release = sock_spd_release,
+@@ -1709,7 +1710,7 @@ done:
+ 		lock_sock(sk);
+ 	}
+ 
+-	splice_shrink_spd(pipe, &spd);
++	splice_shrink_spd(&spd);
+ 	return ret;
+ }
+ 
+diff --git a/net/core/sock.c b/net/core/sock.c
+index b23f174..8d095b9 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1497,6 +1497,11 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
+ 	gfp_t gfp_mask;
+ 	long timeo;
+ 	int err;
++	int npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
++
++	err = -EMSGSIZE;
++	if (npages > MAX_SKB_FRAGS)
++		goto failure;
+ 
+ 	gfp_mask = sk->sk_allocation;
+ 	if (gfp_mask & __GFP_WAIT)
+@@ -1515,14 +1520,12 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
+ 		if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
+ 			skb = alloc_skb(header_len, gfp_mask);
+ 			if (skb) {
+-				int npages;
+ 				int i;
+ 
+ 				/* No pages, we're done... */
+ 				if (!data_len)
+ 					break;
+ 
+-				npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
+ 				skb->truesize += data_len;
+ 				skb_shinfo(skb)->nr_frags = npages;
+ 				for (i = 0; i < npages; i++) {
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 059b9d9..2e21751 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2881,10 +2881,6 @@ static int __net_init ip6_route_net_init(struct net *net)
+ 	net->ipv6.sysctl.ip6_rt_mtu_expires = 10*60*HZ;
+ 	net->ipv6.sysctl.ip6_rt_min_advmss = IPV6_MIN_MTU - 20 - 40;
+ 
+-#ifdef CONFIG_PROC_FS
+-	proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
+-	proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
+-#endif
+ 	net->ipv6.ip6_rt_gc_expire = 30*HZ;
+ 
+ 	ret = 0;
+@@ -2905,10 +2901,6 @@ out_ip6_dst_ops:
+ 
+ static void __net_exit ip6_route_net_exit(struct net *net)
+ {
+-#ifdef CONFIG_PROC_FS
+-	proc_net_remove(net, "ipv6_route");
+-	proc_net_remove(net, "rt6_stats");
+-#endif
+ 	kfree(net->ipv6.ip6_null_entry);
+ #ifdef CONFIG_IPV6_MULTIPLE_TABLES
+ 	kfree(net->ipv6.ip6_prohibit_entry);
+@@ -2917,11 +2909,33 @@ static void __net_exit ip6_route_net_exit(struct net *net)
+ 	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
+ }
+ 
++static int __net_init ip6_route_net_init_late(struct net *net)
++{
++#ifdef CONFIG_PROC_FS
++	proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
++	proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
++#endif
++	return 0;
++}
++
++static void __net_exit ip6_route_net_exit_late(struct net *net)
++{
++#ifdef CONFIG_PROC_FS
++	proc_net_remove(net, "ipv6_route");
++	proc_net_remove(net, "rt6_stats");
++#endif
++}
++
+ static struct pernet_operations ip6_route_net_ops = {
+ 	.init = ip6_route_net_init,
+ 	.exit = ip6_route_net_exit,
+ };
+ 
++static struct pernet_operations ip6_route_net_late_ops = {
++	.init = ip6_route_net_init_late,
++	.exit = ip6_route_net_exit_late,
++};
++
+ static struct notifier_block ip6_route_dev_notifier = {
+ 	.notifier_call = ip6_route_dev_notify,
+ 	.priority = 0,
+@@ -2971,19 +2985,25 @@ int __init ip6_route_init(void)
+ 	if (ret)
+ 		goto xfrm6_init;
+ 
++	ret = register_pernet_subsys(&ip6_route_net_late_ops);
++	if (ret)
++		goto fib6_rules_init;
++
+ 	ret = -ENOBUFS;
+ 	if (__rtnl_register(PF_INET6, RTM_NEWROUTE, inet6_rtm_newroute, NULL, NULL) ||
+ 	    __rtnl_register(PF_INET6, RTM_DELROUTE, inet6_rtm_delroute, NULL, NULL) ||
+ 	    __rtnl_register(PF_INET6, RTM_GETROUTE, inet6_rtm_getroute, NULL, NULL))
+-		goto fib6_rules_init;
++		goto out_register_late_subsys;
+ 
+ 	ret = register_netdevice_notifier(&ip6_route_dev_notifier);
+ 	if (ret)
+-		goto fib6_rules_init;
++		goto out_register_late_subsys;
+ 
+ out:
+ 	return ret;
+ 
++out_register_late_subsys:
++	unregister_pernet_subsys(&ip6_route_net_late_ops);
+ fib6_rules_init:
+ 	fib6_rules_cleanup();
+ xfrm6_init:
+@@ -3002,6 +3022,7 @@ out_kmem_cache:
+ void ip6_route_cleanup(void)
+ {
+ 	unregister_netdevice_notifier(&ip6_route_dev_notifier);
++	unregister_pernet_subsys(&ip6_route_net_late_ops);
+ 	fib6_rules_cleanup();
+ 	xfrm6_fini();
+ 	fib6_gc_cleanup();
+diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
+index d2726a7..3c55f63 100644
+--- a/net/l2tp/l2tp_eth.c
++++ b/net/l2tp/l2tp_eth.c
+@@ -167,6 +167,7 @@ static void l2tp_eth_delete(struct l2tp_session *session)
+ 		if (dev) {
+ 			unregister_netdev(dev);
+ 			spriv->dev = NULL;
++			module_put(THIS_MODULE);
+ 		}
+ 	}
+ }
+@@ -254,6 +255,7 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p
+ 	if (rc < 0)
+ 		goto out_del_dev;
+ 
++	__module_get(THIS_MODULE);
+ 	/* Must be done after register_netdev() */
+ 	strlcpy(session->ifname, dev->name, IFNAMSIZ);
+ 
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
+index 2fbbe1f..6c7e609 100644
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -515,10 +515,12 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
+ 					   sk->sk_bound_dev_if);
+ 		if (IS_ERR(rt))
+ 			goto no_route;
+-		if (connected)
++		if (connected) {
+ 			sk_setup_caps(sk, &rt->dst);
+-		else
+-			dst_release(&rt->dst); /* safe since we hold rcu_read_lock */
++		} else {
++			skb_dst_set(skb, &rt->dst);
++			goto xmit;
++		}
+ 	}
+ 
+ 	/* We dont need to clone dst here, it is guaranteed to not disappear.
+@@ -526,6 +528,7 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
+ 	 */
+ 	skb_dst_set_noref(skb, &rt->dst);
+ 
++xmit:
+ 	/* Queue the packet to IP for output */
+ 	rc = ip_queue_xmit(skb, &inet->cork.fl);
+ 	rcu_read_unlock();
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 064d20f..cda4875 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2389,7 +2389,7 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
+ 	 * frames that we didn't handle, including returning unknown
+ 	 * ones. For all other modes we will return them to the sender,
+ 	 * setting the 0x80 bit in the action category, as required by
+-	 * 802.11-2007 7.3.1.11.
++	 * 802.11-2012 9.24.4.
+ 	 * Newer versions of hostapd shall also use the management frame
+ 	 * registration mechanisms, but older ones still use cooked
+ 	 * monitor interfaces so push all frames there.
+@@ -2399,6 +2399,9 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
+ 	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
+ 		return RX_DROP_MONITOR;
+ 
++	if (is_multicast_ether_addr(mgmt->da))
++		return RX_DROP_MONITOR;
++
+ 	/* do not return rejected action frames */
+ 	if (mgmt->u.action.category & 0x80)
+ 		return RX_DROP_UNUSABLE;
+diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c
+index 96633f5..12b6a80 100644
+--- a/net/nfc/nci/ntf.c
++++ b/net/nfc/nci/ntf.c
+@@ -86,7 +86,7 @@ static int nci_rf_activate_nfca_passive_poll(struct nci_dev *ndev,
+ 	nfca_poll->sens_res = __le16_to_cpu(*((__u16 *)data));
+ 	data += 2;
+ 
+-	nfca_poll->nfcid1_len = *data++;
++	nfca_poll->nfcid1_len = min_t(__u8, *data++, sizeof(nfca_poll->nfcid1));
+ 
+ 	nfc_dbg("sens_res 0x%x, nfcid1_len %d",
+ 		nfca_poll->sens_res,
+@@ -111,7 +111,7 @@ static int nci_rf_activate_nfca_passive_poll(struct nci_dev *ndev,
+ 
+ 	switch (ntf->rf_interface_type) {
+ 	case NCI_RF_INTERFACE_ISO_DEP:
+-		nfca_poll_iso_dep->rats_res_len = *data++;
++		nfca_poll_iso_dep->rats_res_len = min_t(__u8, *data++, 20);
+ 		if (nfca_poll_iso_dep->rats_res_len > 0) {
+ 			memcpy(nfca_poll_iso_dep->rats_res,
+ 				data,
+diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
+index ee7b2b3..7a167fc 100644
+--- a/net/nfc/rawsock.c
++++ b/net/nfc/rawsock.c
+@@ -52,7 +52,10 @@ static int rawsock_release(struct socket *sock)
+ {
+ 	struct sock *sk = sock->sk;
+ 
+-	nfc_dbg("sock=%p", sock);
++	nfc_dbg("sock=%p sk=%p", sock, sk);
++
++	if (!sk)
++		return 0;
+ 
+ 	sock_orphan(sk);
+ 	sock_put(sk);
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 7b7a516..2b973f5 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -4457,7 +4457,7 @@ static int stac92xx_init(struct hda_codec *codec)
+ 					 AC_PINCTL_IN_EN);
+ 	for (i = 0; i < spec->num_pwrs; i++)  {
+ 		hda_nid_t nid = spec->pwr_nids[i];
+-		int pinctl, def_conf;
++		unsigned int pinctl, def_conf;
+ 
+ 		/* power on when no jack detection is available */
+ 		/* or when the VREF is used for controlling LED */
+@@ -4484,7 +4484,7 @@ static int stac92xx_init(struct hda_codec *codec)
+ 		def_conf = get_defcfg_connect(def_conf);
+ 		/* skip any ports that don't have jacks since presence
+  		 * detection is useless */
+-		if (def_conf != AC_JACK_PORT_NONE &&
++		if (def_conf != AC_JACK_PORT_COMPLEX ||
+ 		    !is_jack_detectable(codec, nid)) {
+ 			stac_toggle_power_map(codec, nid, 1);
+ 			continue;
+diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
+index 87d5ef1..8b48801 100644
+--- a/sound/soc/codecs/tlv320aic3x.c
++++ b/sound/soc/codecs/tlv320aic3x.c
+@@ -963,9 +963,7 @@ static int aic3x_hw_params(struct snd_pcm_substream *substream,
+ 	}
+ 
+ found:
+-	data = snd_soc_read(codec, AIC3X_PLL_PROGA_REG);
+-	snd_soc_write(codec, AIC3X_PLL_PROGA_REG,
+-		      data | (pll_p << PLLP_SHIFT));
++	snd_soc_update_bits(codec, AIC3X_PLL_PROGA_REG, PLLP_MASK, pll_p);
+ 	snd_soc_write(codec, AIC3X_OVRF_STATUS_AND_PLLR_REG,
+ 		      pll_r << PLLR_SHIFT);
+ 	snd_soc_write(codec, AIC3X_PLL_PROGB_REG, pll_j << PLLJ_SHIFT);
+diff --git a/sound/soc/codecs/tlv320aic3x.h b/sound/soc/codecs/tlv320aic3x.h
+index 06a1978..16d9999 100644
+--- a/sound/soc/codecs/tlv320aic3x.h
++++ b/sound/soc/codecs/tlv320aic3x.h
+@@ -166,6 +166,7 @@
+ 
+ /* PLL registers bitfields */
+ #define PLLP_SHIFT		0
++#define PLLP_MASK		7
+ #define PLLQ_SHIFT		3
+ #define PLLR_SHIFT		0
+ #define PLLJ_SHIFT		2
diff --git a/3.2.22/4420_grsecurity-2.9.1-3.2.22-201207080924.patch b/3.2.23/4420_grsecurity-2.9.1-3.2.23-201207122159.patch
index 166b633..7052c62 100644
--- a/3.2.22/4420_grsecurity-2.9.1-3.2.22-201207080924.patch
+++ b/3.2.23/4420_grsecurity-2.9.1-3.2.23-201207122159.patch
@@ -205,7 +205,7 @@ index 81c287f..d456d02 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 9a7d921..c10f64e 100644
+index 40d1e3b..bf02dfb 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -30753,7 +30753,7 @@ index b2e3c97..58cf079 100644
  	mutex_unlock(&dev->struct_mutex);
  
 diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
-index c4da951..3c59c5c 100644
+index ca67338..0003ba7 100644
 --- a/drivers/gpu/drm/i915/i915_dma.c
 +++ b/drivers/gpu/drm/i915/i915_dma.c
 @@ -1172,7 +1172,7 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev)
@@ -33970,10 +33970,10 @@ index cf742d9..7c7c745 100644
  
  struct md_personality
 diff --git a/drivers/md/persistent-data/dm-space-map-checker.c b/drivers/md/persistent-data/dm-space-map-checker.c
-index 50ed53b..4f29d7d 100644
+index fc90c11..c8cd9a9 100644
 --- a/drivers/md/persistent-data/dm-space-map-checker.c
 +++ b/drivers/md/persistent-data/dm-space-map-checker.c
-@@ -159,7 +159,7 @@ static void ca_destroy(struct count_array *ca)
+@@ -167,7 +167,7 @@ static int ca_commit(struct count_array *old, struct count_array *new)
  /*----------------------------------------------------------------*/
  
  struct sm_checker {
@@ -33983,7 +33983,7 @@ index 50ed53b..4f29d7d 100644
  	struct count_array old_counts;
  	struct count_array counts;
 diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c
-index fc469ba..2d91555 100644
+index 3d0ed53..35dc592 100644
 --- a/drivers/md/persistent-data/dm-space-map-disk.c
 +++ b/drivers/md/persistent-data/dm-space-map-disk.c
 @@ -23,7 +23,7 @@
@@ -34043,7 +34043,7 @@ index 7af60ec..10a4a5d 100644
  					       "md/raid1:%s: read error corrected "
  					       "(%d sectors at %llu on %s)\n",
 diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index b219449..40bfcc2 100644
+index 7a9eef6..707cb03 100644
 --- a/drivers/md/raid10.c
 +++ b/drivers/md/raid10.c
 @@ -1453,7 +1453,7 @@ static void end_sync_read(struct bio *bio, int error)
@@ -34106,10 +34106,10 @@ index b219449..40bfcc2 100644
  
  			rdev_dec_pending(rdev, mddev);
 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index 858fdbb..b2dac95 100644
+index 6ba4954..5ce122a 100644
 --- a/drivers/md/raid5.c
 +++ b/drivers/md/raid5.c
-@@ -1610,19 +1610,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
+@@ -1616,19 +1616,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
  				(unsigned long long)(sh->sector
  						     + rdev->data_offset),
  				bdevname(rdev->bdev, b));
@@ -34133,7 +34133,7 @@ index 858fdbb..b2dac95 100644
  		if (conf->mddev->degraded >= conf->max_degraded)
  			printk_ratelimited(
  				KERN_WARNING
-@@ -1642,7 +1642,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
+@@ -1648,7 +1648,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
  				(unsigned long long)(sh->sector
  						     + rdev->data_offset),
  				bdn);
@@ -35007,19 +35007,6 @@ index a3f7a27..234016e 100644
  		return -EINVAL;
  
  	/* Don't allow a single read to cross a 512-byte block boundary */
-diff --git a/drivers/mtd/nand/cafe_nand.c b/drivers/mtd/nand/cafe_nand.c
-index 72d3f23..68ecf48 100644
---- a/drivers/mtd/nand/cafe_nand.c
-+++ b/drivers/mtd/nand/cafe_nand.c
-@@ -102,7 +102,7 @@ static const char *part_probes[] = { "cmdlinepart", "RedBoot", NULL };
- static int cafe_device_ready(struct mtd_info *mtd)
- {
- 	struct cafe_priv *cafe = mtd->priv;
--	int result = !!(cafe_readl(cafe, NAND_STATUS) | 0x40000000);
-+	int result = !!(cafe_readl(cafe, NAND_STATUS) & 0x40000000);
- 	uint32_t irqs = cafe_readl(cafe, NAND_IRQ);
- 
- 	cafe_writel(cafe, irqs, NAND_IRQ);
 diff --git a/drivers/mtd/nand/denali.c b/drivers/mtd/nand/denali.c
 index 3984d48..28aa897 100644
 --- a/drivers/mtd/nand/denali.c
@@ -35157,7 +35144,7 @@ index dcd7f7a..ecb7fb3 100644
  	{"D-Link DFE-550FX 100Mbps Fiber-optics Adapter"},
  	{"D-Link DFE-580TX 4 port Server Adapter"},
 diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
-index bf266a0..e024af7 100644
+index 36c7c4e..7de1382 100644
 --- a/drivers/net/ethernet/emulex/benet/be_main.c
 +++ b/drivers/net/ethernet/emulex/benet/be_main.c
 @@ -397,7 +397,7 @@ static void accumulate_16bit_val(u32 *acc, u16 val)
@@ -35901,7 +35888,7 @@ index e662cbc..8d4a102 100644
  	}
  
 diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
-index 0f9ee46..e2d6e65 100644
+index 4cc4a8b..a7dc55a 100644
 --- a/drivers/net/wireless/ath/ath.h
 +++ b/drivers/net/wireless/ath/ath.h
 @@ -119,6 +119,7 @@ struct ath_ops {
@@ -48086,7 +48073,7 @@ index 5d22872..523db20 100644
  		kfree(link);
  }
 diff --git a/fs/open.c b/fs/open.c
-index 22c41b5..070cb15 100644
+index e2b5d51..2c5708d 100644
 --- a/fs/open.c
 +++ b/fs/open.c
 @@ -31,6 +31,8 @@
@@ -49750,7 +49737,7 @@ index dba43c3..4b3f701 100644
  
  	if (op) {
 diff --git a/fs/splice.c b/fs/splice.c
-index 6d0dfb8..115bb3a 100644
+index 014fcb4..980206f 100644
 --- a/fs/splice.c
 +++ b/fs/splice.c
 @@ -195,7 +195,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
@@ -49774,7 +49761,7 @@ index 6d0dfb8..115bb3a 100644
  	}
  
  	pipe_unlock(pipe);
-@@ -561,7 +561,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
+@@ -564,7 +564,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -49783,7 +49770,7 @@ index 6d0dfb8..115bb3a 100644
  	set_fs(old_fs);
  
  	return res;
-@@ -576,7 +576,7 @@ static ssize_t kernel_write(struct file *file, const char *buf, size_t count,
+@@ -579,7 +579,7 @@ static ssize_t kernel_write(struct file *file, const char *buf, size_t count,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -49792,7 +49779,7 @@ index 6d0dfb8..115bb3a 100644
  	set_fs(old_fs);
  
  	return res;
-@@ -627,7 +627,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
+@@ -631,7 +631,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
  			goto err;
  
  		this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
@@ -49801,7 +49788,7 @@ index 6d0dfb8..115bb3a 100644
  		vec[i].iov_len = this_len;
  		spd.pages[i] = page;
  		spd.nr_pages++;
-@@ -849,10 +849,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
+@@ -853,10 +853,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
  int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
  {
  	while (!pipe->nrbufs) {
@@ -49814,7 +49801,7 @@ index 6d0dfb8..115bb3a 100644
  			return 0;
  
  		if (sd->flags & SPLICE_F_NONBLOCK)
-@@ -1185,7 +1185,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+@@ -1189,7 +1189,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
  		 * out of the pipe right after the splice_to_pipe(). So set
  		 * PIPE_READERS appropriately.
  		 */
@@ -49823,7 +49810,7 @@ index 6d0dfb8..115bb3a 100644
  
  		current->splice_pipe = pipe;
  	}
-@@ -1737,9 +1737,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1742,9 +1742,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  			ret = -ERESTARTSYS;
  			break;
  		}
@@ -49835,7 +49822,7 @@ index 6d0dfb8..115bb3a 100644
  			if (flags & SPLICE_F_NONBLOCK) {
  				ret = -EAGAIN;
  				break;
-@@ -1771,7 +1771,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1776,7 +1776,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  	pipe_lock(pipe);
  
  	while (pipe->nrbufs >= pipe->buffers) {
@@ -49844,7 +49831,7 @@ index 6d0dfb8..115bb3a 100644
  			send_sig(SIGPIPE, current, 0);
  			ret = -EPIPE;
  			break;
-@@ -1784,9 +1784,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1789,9 +1789,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  			ret = -ERESTARTSYS;
  			break;
  		}
@@ -49856,7 +49843,7 @@ index 6d0dfb8..115bb3a 100644
  	}
  
  	pipe_unlock(pipe);
-@@ -1822,14 +1822,14 @@ retry:
+@@ -1827,14 +1827,14 @@ retry:
  	pipe_double_lock(ipipe, opipe);
  
  	do {
@@ -49873,7 +49860,7 @@ index 6d0dfb8..115bb3a 100644
  			break;
  
  		/*
-@@ -1926,7 +1926,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+@@ -1931,7 +1931,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
  	pipe_double_lock(ipipe, opipe);
  
  	do {
@@ -49882,7 +49869,7 @@ index 6d0dfb8..115bb3a 100644
  			send_sig(SIGPIPE, current, 0);
  			if (!ret)
  				ret = -EPIPE;
-@@ -1971,7 +1971,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+@@ -1976,7 +1976,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
  	 * return EAGAIN if we have the potential of some data in the
  	 * future, otherwise just return 0
  	 */
@@ -49989,150 +49976,6 @@ index c175b4d..8f36a16 100644
  	u8 checksum = 0;
  	int i;
  	for (i = 0; i < sizeof(struct tag); ++i)
-diff --git a/fs/udf/super.c b/fs/udf/super.c
-index 87cb24a..ce8efeb 100644
---- a/fs/udf/super.c
-+++ b/fs/udf/super.c
-@@ -56,6 +56,7 @@
- #include <linux/seq_file.h>
- #include <linux/bitmap.h>
- #include <linux/crc-itu-t.h>
-+#include <linux/log2.h>
- #include <asm/byteorder.h>
- 
- #include "udf_sb.h"
-@@ -1217,16 +1218,65 @@ out_bh:
- 	return ret;
- }
- 
-+static int udf_load_sparable_map(struct super_block *sb,
-+				 struct udf_part_map *map,
-+				 struct sparablePartitionMap *spm)
-+{
-+	uint32_t loc;
-+	uint16_t ident;
-+	struct sparingTable *st;
-+	struct udf_sparing_data *sdata = &map->s_type_specific.s_sparing;
-+	int i;
-+	struct buffer_head *bh;
-+
-+	map->s_partition_type = UDF_SPARABLE_MAP15;
-+	sdata->s_packet_len = le16_to_cpu(spm->packetLength);
-+	if (!is_power_of_2(sdata->s_packet_len)) {
-+		udf_err(sb, "error loading logical volume descriptor: "
-+			"Invalid packet length %u\n",
-+			(unsigned)sdata->s_packet_len);
-+		return -EIO;
-+	}
-+	if (spm->numSparingTables > 4) {
-+		udf_err(sb, "error loading logical volume descriptor: "
-+			"Too many sparing tables (%d)\n",
-+			(int)spm->numSparingTables);
-+		return -EIO;
-+	}
-+
-+	for (i = 0; i < spm->numSparingTables; i++) {
-+		loc = le32_to_cpu(spm->locSparingTable[i]);
-+		bh = udf_read_tagged(sb, loc, loc, &ident);
-+		if (!bh)
-+			continue;
-+
-+		st = (struct sparingTable *)bh->b_data;
-+		if (ident != 0 ||
-+		    strncmp(st->sparingIdent.ident, UDF_ID_SPARING,
-+			    strlen(UDF_ID_SPARING)) ||
-+		    sizeof(*st) + le16_to_cpu(st->reallocationTableLen) >
-+							sb->s_blocksize) {
-+			brelse(bh);
-+			continue;
-+		}
-+
-+		sdata->s_spar_map[i] = bh;
-+	}
-+	map->s_partition_func = udf_get_pblock_spar15;
-+	return 0;
-+}
-+
- static int udf_load_logicalvol(struct super_block *sb, sector_t block,
- 			       struct kernel_lb_addr *fileset)
- {
- 	struct logicalVolDesc *lvd;
--	int i, j, offset;
-+	int i, offset;
- 	uint8_t type;
- 	struct udf_sb_info *sbi = UDF_SB(sb);
- 	struct genericPartitionMap *gpm;
- 	uint16_t ident;
- 	struct buffer_head *bh;
-+	unsigned int table_len;
- 	int ret = 0;
- 
- 	bh = udf_read_tagged(sb, block, block, &ident);
-@@ -1234,6 +1284,13 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
- 		return 1;
- 	BUG_ON(ident != TAG_IDENT_LVD);
- 	lvd = (struct logicalVolDesc *)bh->b_data;
-+	table_len = le32_to_cpu(lvd->mapTableLength);
-+	if (sizeof(*lvd) + table_len > sb->s_blocksize) {
-+		udf_err(sb, "error loading logical volume descriptor: "
-+			"Partition table too long (%u > %lu)\n", table_len,
-+			sb->s_blocksize - sizeof(*lvd));
-+		goto out_bh;
-+	}
- 
- 	i = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps));
- 	if (i != 0) {
-@@ -1242,7 +1299,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
- 	}
- 
- 	for (i = 0, offset = 0;
--	     i < sbi->s_partitions && offset < le32_to_cpu(lvd->mapTableLength);
-+	     i < sbi->s_partitions && offset < table_len;
- 	     i++, offset += gpm->partitionMapLength) {
- 		struct udf_part_map *map = &sbi->s_partmaps[i];
- 		gpm = (struct genericPartitionMap *)
-@@ -1277,38 +1334,9 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
- 			} else if (!strncmp(upm2->partIdent.ident,
- 						UDF_ID_SPARABLE,
- 						strlen(UDF_ID_SPARABLE))) {
--				uint32_t loc;
--				struct sparingTable *st;
--				struct sparablePartitionMap *spm =
--					(struct sparablePartitionMap *)gpm;
--
--				map->s_partition_type = UDF_SPARABLE_MAP15;
--				map->s_type_specific.s_sparing.s_packet_len =
--						le16_to_cpu(spm->packetLength);
--				for (j = 0; j < spm->numSparingTables; j++) {
--					struct buffer_head *bh2;
--
--					loc = le32_to_cpu(
--						spm->locSparingTable[j]);
--					bh2 = udf_read_tagged(sb, loc, loc,
--							     &ident);
--					map->s_type_specific.s_sparing.
--							s_spar_map[j] = bh2;
--
--					if (bh2 == NULL)
--						continue;
--
--					st = (struct sparingTable *)bh2->b_data;
--					if (ident != 0 || strncmp(
--						st->sparingIdent.ident,
--						UDF_ID_SPARING,
--						strlen(UDF_ID_SPARING))) {
--						brelse(bh2);
--						map->s_type_specific.s_sparing.
--							s_spar_map[j] = NULL;
--					}
--				}
--				map->s_partition_func = udf_get_pblock_spar15;
-+				if (udf_load_sparable_map(sb, map,
-+				    (struct sparablePartitionMap *)gpm) < 0)
-+					goto out_bh;
- 			} else if (!strncmp(upm2->partIdent.ident,
- 						UDF_ID_METADATA,
- 						strlen(UDF_ID_METADATA))) {
 diff --git a/fs/utimes.c b/fs/utimes.c
 index ba653f3..06ea4b1 100644
 --- a/fs/utimes.c
@@ -51291,7 +51134,7 @@ index 0000000..1b9afa9
 +endif
 diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
 new file mode 100644
-index 0000000..71152c3
+index 0000000..2b8f968
 --- /dev/null
 +++ b/grsecurity/gracl.c
 @@ -0,0 +1,4190 @@
@@ -51317,6 +51160,7 @@ index 0000000..71152c3
 +#include <linux/security.h>
 +#include <linux/grinternal.h>
 +#include <linux/pid_namespace.h>
++#include <linux/stop_machine.h>
 +#include <linux/fdtable.h>
 +#include <linux/percpu.h>
 +
@@ -53574,18 +53418,17 @@ index 0000000..71152c3
 +void
 +gr_copy_label(struct task_struct *tsk)
 +{
-+	/* plain copying of fields is already done by dup_task_struct */
 +	tsk->signal->used_accept = 0;
 +	tsk->acl_sp_role = 0;
-+	//tsk->acl_role_id = current->acl_role_id;
-+	//tsk->acl = current->acl;
-+	//tsk->role = current->role;
++	tsk->acl_role_id = current->acl_role_id;
++	tsk->acl = current->acl;
++	tsk->role = current->role;
 +	tsk->signal->curr_ip = current->signal->curr_ip;
 +	tsk->signal->saved_ip = current->signal->saved_ip;
 +	if (current->exec_file)
 +		get_file(current->exec_file);
-+	//tsk->exec_file = current->exec_file;
-+	//tsk->is_writable = current->is_writable;
++	tsk->exec_file = current->exec_file;
++	tsk->is_writable = current->is_writable;
 +	if (unlikely(current->signal->used_accept)) {
 +		current->signal->curr_ip = 0;
 +		current->signal->saved_ip = 0;
@@ -54394,6 +54237,15 @@ index 0000000..71152c3
 +	return 1;
 +}
 +
++static int gr_rbac_disable(void *unused)
++{
++	pax_open_kernel();
++	gr_status &= ~GR_READY;
++	pax_close_kernel();
++
++	return 0;
++}
++
 +ssize_t
 +write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
 +{
@@ -54478,15 +54330,12 @@ index 0000000..71152c3
 +	case GR_SHUTDOWN:
 +		if ((gr_status & GR_READY)
 +		    && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+			pax_open_kernel();
-+			gr_status &= ~GR_READY;
-+			pax_close_kernel();
-+
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
++			stop_machine(gr_rbac_disable, NULL, NULL);
 +			free_variables();
 +			memset(gr_usermode, 0, sizeof (struct gr_arg));
 +			memset(gr_system_salt, 0, GR_SALT_LEN);
 +			memset(gr_system_sum, 0, GR_SHA_LEN);
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
 +		} else if (gr_status & GR_READY) {
 +			gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
 +			error = -EPERM;
@@ -54511,20 +54360,14 @@ index 0000000..71152c3
 +			gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
 +			error = -EAGAIN;
 +		} else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+			preempt_disable();
-+
-+			pax_open_kernel();
-+			gr_status &= ~GR_READY;
-+			pax_close_kernel();
-+
++			stop_machine(gr_rbac_disable, NULL, NULL);
 +			free_variables();
-+			if (!(error2 = gracl_init(gr_usermode))) {
-+				preempt_enable();
++			error2 = gracl_init(gr_usermode);
++			if (!error2)
 +				gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
-+			} else {
-+				preempt_enable();
-+				error = error2;
++			else {
 +				gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
++				error = error2;
 +			}
 +		} else {
 +			gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
@@ -65468,7 +65311,7 @@ index 0993a22..32ba2fe 100644
  	void *pmi_pal;
  	u8 *vbe_state_orig;		/*
 diff --git a/init/Kconfig b/init/Kconfig
-index 43298f9..2f56c12 100644
+index 43298f9..7e4816c 100644
 --- a/init/Kconfig
 +++ b/init/Kconfig
 @@ -1214,7 +1214,7 @@ config SLUB_DEBUG
@@ -65480,6 +65323,15 @@ index 43298f9..2f56c12 100644
  	help
  	  Randomizing heap placement makes heap exploits harder, but it
  	  also breaks ancient binaries (including anything libc5 based).
+@@ -1397,7 +1397,7 @@ config INIT_ALL_POSSIBLE
+ config STOP_MACHINE
+ 	bool
+ 	default y
+-	depends on (SMP && MODULE_UNLOAD) || HOTPLUG_CPU
++	depends on (SMP && MODULE_UNLOAD) || HOTPLUG_CPU || GRKERNSEC
+ 	help
+ 	  Need stop_machine() primitive.
+ 
 diff --git a/init/do_mounts.c b/init/do_mounts.c
 index d6c229f..4746631 100644
 --- a/init/do_mounts.c
@@ -66827,7 +66679,7 @@ index 5a8a66e..ded4680 100644
  {
  	struct signal_struct *sig = current->signal;
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 79ee71f..94d79d4 100644
+index 79ee71f..2101311 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -282,7 +282,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
@@ -67099,16 +66951,17 @@ index 79ee71f..94d79d4 100644
  	if (atomic_read(&p->real_cred->user->processes) >=
  			task_rlimit(p, RLIMIT_NPROC)) {
  		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
-@@ -1261,6 +1322,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- 	if (clone_flags & CLONE_THREAD)
- 		p->tgid = current->tgid;
+@@ -1318,6 +1379,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ 	/* Need tasklist lock for parent etc handling! */
+ 	write_lock_irq(&tasklist_lock);
  
++	/* synchronizes with gr_set_acls() */
 +	gr_copy_label(p);
 +
- 	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
- 	/*
- 	 * Clear TID on mm_release()?
-@@ -1425,6 +1488,8 @@ bad_fork_cleanup_count:
+ 	/* CLONE_PARENT re-uses the old parent */
+ 	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
+ 		p->real_parent = current->real_parent;
+@@ -1425,6 +1489,8 @@ bad_fork_cleanup_count:
  bad_fork_free:
  	free_task(p);
  fork_out:
@@ -67117,7 +66970,7 @@ index 79ee71f..94d79d4 100644
  	return ERR_PTR(retval);
  }
  
-@@ -1525,6 +1590,8 @@ long do_fork(unsigned long clone_flags,
+@@ -1525,6 +1591,8 @@ long do_fork(unsigned long clone_flags,
  		if (clone_flags & CLONE_PARENT_SETTID)
  			put_user(nr, parent_tidptr);
  
@@ -67126,7 +66979,7 @@ index 79ee71f..94d79d4 100644
  		if (clone_flags & CLONE_VFORK) {
  			p->vfork_done = &vfork;
  			init_completion(&vfork);
-@@ -1634,7 +1701,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1634,7 +1702,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
  		return 0;
  
  	/* don't need lock here; in the worst case we'll do useless copy */
@@ -67135,7 +66988,7 @@ index 79ee71f..94d79d4 100644
  		return 0;
  
  	*new_fsp = copy_fs_struct(fs);
-@@ -1723,7 +1790,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -1723,7 +1791,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
  			fs = current->fs;
  			spin_lock(&fs->lock);
  			current->fs = new_fs;
@@ -70501,10 +70354,10 @@ index 25b4f4d..6f4772d 100644
  	struct ftrace_func_probe *entry;
  	struct ftrace_page *pg;
 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index 697e49d..7f77a66 100644
+index 5638104..f047453 100644
 --- a/kernel/trace/trace.c
 +++ b/kernel/trace/trace.c
-@@ -4205,10 +4205,9 @@ static const struct file_operations tracing_dyn_info_fops = {
+@@ -4209,10 +4209,9 @@ static const struct file_operations tracing_dyn_info_fops = {
  };
  #endif
  
@@ -70516,7 +70369,7 @@ index 697e49d..7f77a66 100644
  	static int once;
  
  	if (d_tracer)
-@@ -4228,10 +4227,9 @@ struct dentry *tracing_init_dentry(void)
+@@ -4232,10 +4231,9 @@ struct dentry *tracing_init_dentry(void)
  	return d_tracer;
  }
  
@@ -71296,19 +71149,10 @@ index d53adf9..03a24bf 100644
  	set_fs(old_fs);
  
 diff --git a/mm/madvise.c b/mm/madvise.c
-index 74bf193..4041aaa 100644
+index 23d3a6b..7b519b7 100644
 --- a/mm/madvise.c
 +++ b/mm/madvise.c
-@@ -13,6 +13,8 @@
- #include <linux/hugetlb.h>
- #include <linux/sched.h>
- #include <linux/ksm.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
- 
- /*
-  * Any behaviour which results in changes to the vma->vm_flags needs to
-@@ -45,6 +47,10 @@ static long madvise_behavior(struct vm_area_struct * vma,
+@@ -46,6 +46,10 @@ static long madvise_behavior(struct vm_area_struct * vma,
  	pgoff_t pgoff;
  	unsigned long new_flags = vma->vm_flags;
  
@@ -71319,7 +71163,7 @@ index 74bf193..4041aaa 100644
  	switch (behavior) {
  	case MADV_NORMAL:
  		new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
-@@ -110,6 +116,13 @@ success:
+@@ -111,6 +115,13 @@ success:
  	/*
  	 * vm_flags is protected by the mmap_sem held in write mode.
  	 */
@@ -71333,7 +71177,7 @@ index 74bf193..4041aaa 100644
  	vma->vm_flags = new_flags;
  
  out:
-@@ -168,6 +181,11 @@ static long madvise_dontneed(struct vm_area_struct * vma,
+@@ -169,6 +180,11 @@ static long madvise_dontneed(struct vm_area_struct * vma,
  			     struct vm_area_struct ** prev,
  			     unsigned long start, unsigned long end)
  {
@@ -71345,7 +71189,7 @@ index 74bf193..4041aaa 100644
  	*prev = vma;
  	if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
  		return -EINVAL;
-@@ -180,6 +198,21 @@ static long madvise_dontneed(struct vm_area_struct * vma,
+@@ -181,6 +197,21 @@ static long madvise_dontneed(struct vm_area_struct * vma,
  		zap_page_range(vma, start, end - start, &details);
  	} else
  		zap_page_range(vma, start, end - start, NULL);
@@ -71367,47 +71211,15 @@ index 74bf193..4041aaa 100644
  	return 0;
  }
  
-@@ -197,16 +230,17 @@ static long madvise_remove(struct vm_area_struct *vma,
- 	struct address_space *mapping;
- 	loff_t offset, endoff;
- 	int error;
-+	struct file *f;
- 
- 	*prev = NULL;	/* tell sys_madvise we drop mmap_sem */
- 
- 	if (vma->vm_flags & (VM_LOCKED|VM_NONLINEAR|VM_HUGETLB))
- 		return -EINVAL;
- 
--	if (!vma->vm_file || !vma->vm_file->f_mapping
--		|| !vma->vm_file->f_mapping->host) {
--			return -EINVAL;
--	}
-+	f = vma->vm_file;
-+
-+	if (!f || !f->f_mapping || !f->f_mapping->host)
-+		return -EINVAL;
- 
- 	if ((vma->vm_flags & (VM_SHARED|VM_WRITE)) != (VM_SHARED|VM_WRITE))
- 		return -EACCES;
-@@ -218,10 +252,16 @@ static long madvise_remove(struct vm_area_struct *vma,
- 	endoff = (loff_t)(end - vma->vm_start - 1)
- 			+ ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
- 
--	/* vmtruncate_range needs to take i_mutex */
-+	/* vmtruncate_range needs to take i_mutex. We need to
-+	* explicitly grab a reference because the vma (and hence the
-+	* vma's reference to the file) can go away as soon as we drop
-+	* mmap_sem.
-+	*/
-+	get_file(f);
- 	up_read(&current->mm->mmap_sem);
+@@ -232,6 +263,7 @@ static long madvise_remove(struct vm_area_struct *vma,
  	error = vmtruncate_range(mapping->host, offset, endoff);
+ 	fput(f);
  	down_read(&current->mm->mmap_sem);
 +	fput(f);
  	return error;
  }
  
-@@ -376,6 +416,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
+@@ -386,6 +418,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
  	if (end < start)
  		goto out;
  
@@ -74320,7 +74132,7 @@ index a4fd368..e0ffec7 100644
  	struct anon_vma_chain *avc;
  	struct anon_vma *anon_vma;
 diff --git a/mm/shmem.c b/mm/shmem.c
-index 6c253f7..367e20a 100644
+index 7a82174..75d1c8b 100644
 --- a/mm/shmem.c
 +++ b/mm/shmem.c
 @@ -31,7 +31,7 @@
@@ -74341,7 +74153,7 @@ index 6c253f7..367e20a 100644
  
  struct shmem_xattr {
  	struct list_head list;	/* anchored by shmem_inode_info->xattr_list */
-@@ -2180,8 +2180,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
+@@ -2181,8 +2181,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
  	int err = -ENOMEM;
  
  	/* Round up to L1_CACHE_BYTES to resist false sharing */
@@ -76322,7 +76134,7 @@ index ff52ad0..aff1c0f 100644
  	{
  		int new_fd;
 diff --git a/net/core/sock.c b/net/core/sock.c
-index b23f174..b9a0d26 100644
+index 8d095b9..315c541 100644
 --- a/net/core/sock.c
 +++ b/net/core/sock.c
 @@ -289,7 +289,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
@@ -76397,7 +76209,7 @@ index b23f174..b9a0d26 100644
  		return -EFAULT;
  lenout:
  	if (put_user(len, optlen))
-@@ -2020,7 +2020,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+@@ -2023,7 +2023,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
  	 */
  	smp_wmb();
  	atomic_set(&sk->sk_refcnt, 1);
@@ -79759,10 +79571,10 @@ index 38f6617..e70b72b 100755
  
  exuberant()
 diff --git a/security/Kconfig b/security/Kconfig
-index 51bd5a0..5a02ed0 100644
+index 51bd5a0..d660068 100644
 --- a/security/Kconfig
 +++ b/security/Kconfig
-@@ -4,6 +4,860 @@
+@@ -4,6 +4,861 @@
  
  menu "Security options"
  
@@ -79791,6 +79603,7 @@ index 51bd5a0..5a02ed0 100644
 +	bool "Grsecurity"
 +	select CRYPTO
 +	select CRYPTO_SHA256
++	select STOP_MACHINE
 +	help
 +	  If you say Y here, you will be able to configure many features
 +	  that will enhance the security of your system.  It is highly
@@ -80623,7 +80436,7 @@ index 51bd5a0..5a02ed0 100644
  config KEYS
  	bool "Enable access key retention support"
  	help
-@@ -169,7 +1023,7 @@ config INTEL_TXT
+@@ -169,7 +1024,7 @@ config INTEL_TXT
  config LSM_MMAP_MIN_ADDR
  	int "Low address space for LSM to protect from user allocation"
  	depends on SECURITY && SECURITY_SELINUX
diff --git a/3.2.22/4430_grsec-remove-localversion-grsec.patch b/3.2.23/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.2.22/4430_grsec-remove-localversion-grsec.patch
+++ b/3.2.23/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.22/4435_grsec-mute-warnings.patch b/3.2.23/4435_grsec-mute-warnings.patch
index e85abd6..e85abd6 100644
--- a/3.2.22/4435_grsec-mute-warnings.patch
+++ b/3.2.23/4435_grsec-mute-warnings.patch
diff --git a/3.2.22/4440_grsec-remove-protected-paths.patch b/3.2.23/4440_grsec-remove-protected-paths.patch
index 637934a..637934a 100644
--- a/3.2.22/4440_grsec-remove-protected-paths.patch
+++ b/3.2.23/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.22/4450_grsec-kconfig-default-gids.patch b/3.2.23/4450_grsec-kconfig-default-gids.patch
index 545e82e..545e82e 100644
--- a/3.2.22/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.23/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.22/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.23/4465_selinux-avc_audit-log-curr_ip.patch
index 48acad7..48acad7 100644
--- a/3.2.22/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.23/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.22/4470_disable-compat_vdso.patch b/3.2.23/4470_disable-compat_vdso.patch
index 4742d01..4742d01 100644
--- a/3.2.22/4470_disable-compat_vdso.patch
+++ b/3.2.23/4470_disable-compat_vdso.patch
diff --git a/3.4.4/0000_README b/3.4.4/0000_README
index 6e60159..f73a168 100644
--- a/3.4.4/0000_README
+++ b/3.4.4/0000_README
@@ -6,7 +6,7 @@ Patch:	2600_FW_MIPS_FILE_06_regression.patch
 From:	Anthony G. Basile <blueness@gentoo.org>
 Desc:	Fix regressions against bnx2 firmware
 
-Patch:	4420_grsecurity-2.9.1-3.4.4-201207080925.patch
+Patch:	4420_grsecurity-2.9.1-3.4.4-201207122200.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.4.4/4420_grsecurity-2.9.1-3.4.4-201207080925.patch b/3.4.4/4420_grsecurity-2.9.1-3.4.4-201207122200.patch
index 1035f85..826a3d4 100644
--- a/3.4.4/4420_grsecurity-2.9.1-3.4.4-201207080925.patch
+++ b/3.4.4/4420_grsecurity-2.9.1-3.4.4-201207122200.patch
@@ -50133,7 +50133,7 @@ index 0000000..1b9afa9
 +endif
 diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
 new file mode 100644
-index 0000000..dc0417e
+index 0000000..7a5922f
 --- /dev/null
 +++ b/grsecurity/gracl.c
 @@ -0,0 +1,4016 @@
@@ -50159,6 +50159,7 @@ index 0000000..dc0417e
 +#include <linux/security.h>
 +#include <linux/grinternal.h>
 +#include <linux/pid_namespace.h>
++#include <linux/stop_machine.h>
 +#include <linux/fdtable.h>
 +#include <linux/percpu.h>
 +#include "../fs/mount.h"
@@ -52409,18 +52410,17 @@ index 0000000..dc0417e
 +void
 +gr_copy_label(struct task_struct *tsk)
 +{
-+	/* plain copying of fields is already done by dup_task_struct */
 +	tsk->signal->used_accept = 0;
 +	tsk->acl_sp_role = 0;
-+	//tsk->acl_role_id = current->acl_role_id;
-+	//tsk->acl = current->acl;
-+	//tsk->role = current->role;
++	tsk->acl_role_id = current->acl_role_id;
++	tsk->acl = current->acl;
++	tsk->role = current->role;
 +	tsk->signal->curr_ip = current->signal->curr_ip;
 +	tsk->signal->saved_ip = current->signal->saved_ip;
 +	if (current->exec_file)
 +		get_file(current->exec_file);
-+	//tsk->exec_file = current->exec_file;
-+	//tsk->is_writable = current->is_writable;
++	tsk->exec_file = current->exec_file;
++	tsk->is_writable = current->is_writable;
 +	if (unlikely(current->signal->used_accept)) {
 +		current->signal->curr_ip = 0;
 +		current->signal->saved_ip = 0;
@@ -53229,6 +53229,15 @@ index 0000000..dc0417e
 +	return 1;
 +}
 +
++static int gr_rbac_disable(void *unused)
++{
++	pax_open_kernel();
++	gr_status &= ~GR_READY;
++	pax_close_kernel();
++
++	return 0;
++}
++
 +ssize_t
 +write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
 +{
@@ -53313,15 +53322,12 @@ index 0000000..dc0417e
 +	case GR_SHUTDOWN:
 +		if ((gr_status & GR_READY)
 +		    && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+			pax_open_kernel();
-+			gr_status &= ~GR_READY;
-+			pax_close_kernel();
-+
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
++			stop_machine(gr_rbac_disable, NULL, NULL);
 +			free_variables();
 +			memset(gr_usermode, 0, sizeof (struct gr_arg));
 +			memset(gr_system_salt, 0, GR_SALT_LEN);
 +			memset(gr_system_sum, 0, GR_SHA_LEN);
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
 +		} else if (gr_status & GR_READY) {
 +			gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
 +			error = -EPERM;
@@ -53346,20 +53352,14 @@ index 0000000..dc0417e
 +			gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
 +			error = -EAGAIN;
 +		} else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+			preempt_disable();
-+
-+			pax_open_kernel();
-+			gr_status &= ~GR_READY;
-+			pax_close_kernel();
-+
++			stop_machine(gr_rbac_disable, NULL, NULL);
 +			free_variables();
-+			if (!(error2 = gracl_init(gr_usermode))) {
-+				preempt_enable();
++			error2 = gracl_init(gr_usermode);
++			if (!error2)
 +				gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
-+			} else {
-+				preempt_enable();
-+				error = error2;
++			else {
 +				gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
++				error = error2;
 +			}
 +		} else {
 +			gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
@@ -63979,7 +63979,7 @@ index 0993a22..32ba2fe 100644
  	void *pmi_pal;
  	u8 *vbe_state_orig;		/*
 diff --git a/init/Kconfig b/init/Kconfig
-index 6cfd71d..73cb68d 100644
+index 6cfd71d..16006e6 100644
 --- a/init/Kconfig
 +++ b/init/Kconfig
 @@ -790,6 +790,7 @@ endif # CGROUPS
@@ -63999,6 +63999,15 @@ index 6cfd71d..73cb68d 100644
  	help
  	  Randomizing heap placement makes heap exploits harder, but it
  	  also breaks ancient binaries (including anything libc5 based).
+@@ -1423,7 +1424,7 @@ config INIT_ALL_POSSIBLE
+ config STOP_MACHINE
+ 	bool
+ 	default y
+-	depends on (SMP && MODULE_UNLOAD) || HOTPLUG_CPU
++	depends on (SMP && MODULE_UNLOAD) || HOTPLUG_CPU || GRKERNSEC
+ 	help
+ 	  Need stop_machine() primitive.
+ 
 diff --git a/init/do_mounts.c b/init/do_mounts.c
 index 42b0707..c06eef4 100644
 --- a/init/do_mounts.c
@@ -65340,7 +65349,7 @@ index d8bd3b42..26bd8dc 100644
  {
  	struct signal_struct *sig = current->signal;
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 8163333..efb4692 100644
+index 8163333..42d41de 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -286,7 +286,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
@@ -65596,16 +65605,17 @@ index 8163333..efb4692 100644
  	if (atomic_read(&p->real_cred->user->processes) >=
  			task_rlimit(p, RLIMIT_NPROC)) {
  		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
-@@ -1328,6 +1369,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- 	if (clone_flags & CLONE_THREAD)
- 		p->tgid = current->tgid;
+@@ -1392,6 +1433,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ 	/* Need tasklist lock for parent etc handling! */
+ 	write_lock_irq(&tasklist_lock);
  
++	/* synchronizes with gr_set_acls() */
 +	gr_copy_label(p);
 +
- 	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
- 	/*
- 	 * Clear TID on mm_release()?
-@@ -1502,6 +1545,8 @@ bad_fork_cleanup_count:
+ 	/* CLONE_PARENT re-uses the old parent */
+ 	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
+ 		p->real_parent = current->real_parent;
+@@ -1502,6 +1546,8 @@ bad_fork_cleanup_count:
  bad_fork_free:
  	free_task(p);
  fork_out:
@@ -65614,7 +65624,7 @@ index 8163333..efb4692 100644
  	return ERR_PTR(retval);
  }
  
-@@ -1602,6 +1647,8 @@ long do_fork(unsigned long clone_flags,
+@@ -1602,6 +1648,8 @@ long do_fork(unsigned long clone_flags,
  		if (clone_flags & CLONE_PARENT_SETTID)
  			put_user(nr, parent_tidptr);
  
@@ -65623,7 +65633,7 @@ index 8163333..efb4692 100644
  		if (clone_flags & CLONE_VFORK) {
  			p->vfork_done = &vfork;
  			init_completion(&vfork);
-@@ -1700,7 +1747,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1700,7 +1748,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
  		return 0;
  
  	/* don't need lock here; in the worst case we'll do useless copy */
@@ -65632,7 +65642,7 @@ index 8163333..efb4692 100644
  		return 0;
  
  	*new_fsp = copy_fs_struct(fs);
-@@ -1789,7 +1836,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -1789,7 +1837,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
  			fs = current->fs;
  			spin_lock(&fs->lock);
  			current->fs = new_fs;
@@ -77756,10 +77766,10 @@ index 5c11312..72742b5 100644
      write_hex_cnt = 0;
      for (i = 0; i < logo_clutsize; i++) {
 diff --git a/security/Kconfig b/security/Kconfig
-index ccc61f8..bac65f2 100644
+index ccc61f8..7244cf1 100644
 --- a/security/Kconfig
 +++ b/security/Kconfig
-@@ -4,6 +4,860 @@
+@@ -4,6 +4,861 @@
  
  menu "Security options"
  
@@ -77788,6 +77798,7 @@ index ccc61f8..bac65f2 100644
 +	bool "Grsecurity"
 +	select CRYPTO
 +	select CRYPTO_SHA256
++	select STOP_MACHINE
 +	help
 +	  If you say Y here, you will be able to configure many features
 +	  that will enhance the security of your system.  It is highly
@@ -78620,7 +78631,7 @@ index ccc61f8..bac65f2 100644
  config KEYS
  	bool "Enable access key retention support"
  	help
-@@ -169,7 +1023,7 @@ config INTEL_TXT
+@@ -169,7 +1024,7 @@ config INTEL_TXT
  config LSM_MMAP_MIN_ADDR
  	int "Low address space for LSM to protect from user allocation"
  	depends on SECURITY && SECURITY_SELINUX