grsecurity-3.1-4.3.3-20160116175720160116

2 files changed, 1466 insertions, 103 deletions

diff --git a/4.3.3/0000_README b/4.3.3/0000_README
index ac59d19..8ff755f 100644
--- a/4.3.3/0000_README
+++ b/4.3.3/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.1-4.3.3-201601051958.patch
+Patch:	4420_grsecurity-3.1-4.3.3-201601161757.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/4.3.3/4420_grsecurity-3.1-4.3.3-201601051958.patch b/4.3.3/4420_grsecurity-3.1-4.3.3-201601161757.patch
index 0bcf4a7..15482a1 100644
--- a/4.3.3/4420_grsecurity-3.1-4.3.3-201601051958.patch
+++ b/4.3.3/4420_grsecurity-3.1-4.3.3-201601161757.patch
@@ -4702,7 +4702,7 @@ index 7cd1514..0307305 100644
  }
  
 diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
-index b8efb8c..88fa837 100644
+index b8efb8c..0b8f924 100644
 --- a/arch/arm/net/bpf_jit_32.c
 +++ b/arch/arm/net/bpf_jit_32.c
 @@ -20,6 +20,7 @@
@@ -4778,7 +4778,24 @@ index b8efb8c..88fa837 100644
  
  	return (u64)err << 32 | ntohl(ret);
  }
-@@ -199,8 +184,10 @@ static void jit_fill_hole(void *area, unsigned int size)
+@@ -182,31 +167,19 @@ static inline int mem_words_used(struct jit_ctx *ctx)
+ 	return fls(ctx->seen & SEEN_MEM);
+ }
+ 
+-static inline bool is_load_to_a(u16 inst)
+-{
+-	switch (inst) {
+-	case BPF_LD | BPF_W | BPF_LEN:
+-	case BPF_LD | BPF_W | BPF_ABS:
+-	case BPF_LD | BPF_H | BPF_ABS:
+-	case BPF_LD | BPF_B | BPF_ABS:
+-		return true;
+-	default:
+-		return false;
+-	}
+-}
+-
+ static void jit_fill_hole(void *area, unsigned int size)
  {
  	u32 *ptr;
  	/* We are guaranteed to have aligned memory. */
@@ -4789,7 +4806,22 @@ index b8efb8c..88fa837 100644
  }
  
  static void build_prologue(struct jit_ctx *ctx)
-@@ -556,6 +543,9 @@ static int build_body(struct jit_ctx *ctx)
+ {
+ 	u16 reg_set = saved_regs(ctx);
+-	u16 first_inst = ctx->skf->insns[0].code;
+ 	u16 off;
+ 
+ #ifdef CONFIG_FRAME_POINTER
+@@ -236,7 +209,7 @@ static void build_prologue(struct jit_ctx *ctx)
+ 		emit(ARM_MOV_I(r_X, 0), ctx);
+ 
+ 	/* do not leak kernel data to userspace */
+-	if ((first_inst != (BPF_RET | BPF_K)) && !(is_load_to_a(first_inst)))
++	if (bpf_needs_clear_a(&ctx->skf->insns[0]))
+ 		emit(ARM_MOV_I(r_A, 0), ctx);
+ 
+ 	/* stack space for the BPF_MEM words */
+@@ -556,6 +529,9 @@ static int build_body(struct jit_ctx *ctx)
  		case BPF_LD | BPF_B | BPF_ABS:
  			load_order = 0;
  load:
@@ -4799,7 +4831,7 @@ index b8efb8c..88fa837 100644
  			emit_mov_i(r_off, k, ctx);
  load_common:
  			ctx->seen |= SEEN_DATA | SEEN_CALL;
-@@ -570,18 +560,6 @@ load_common:
+@@ -570,18 +546,6 @@ load_common:
  				condt = ARM_COND_HI;
  			}
  
@@ -4818,6 +4850,16 @@ index b8efb8c..88fa837 100644
  			_emit(condt, ARM_ADD_R(r_scratch, r_off, r_skb_data),
  			      ctx);
  
+@@ -744,7 +708,8 @@ load_ind:
+ 		case BPF_ALU | BPF_RSH | BPF_K:
+ 			if (unlikely(k > 31))
+ 				return -1;
+-			emit(ARM_LSR_I(r_A, r_A, k), ctx);
++			if (k)
++				emit(ARM_LSR_I(r_A, r_A, k), ctx);
+ 			break;
+ 		case BPF_ALU | BPF_RSH | BPF_X:
+ 			update_on_xread(ctx);
 diff --git a/arch/arm/plat-iop/setup.c b/arch/arm/plat-iop/setup.c
 index 5b217f4..c23f40e 100644
 --- a/arch/arm/plat-iop/setup.c
@@ -7046,6 +7088,47 @@ index 5c81fdd..db158d3 100644
  int __virt_addr_valid(const volatile void *kaddr)
  {
  	return pfn_valid(PFN_DOWN(virt_to_phys(kaddr)));
+diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c
+index 0c4a133..26e947d 100644
+--- a/arch/mips/net/bpf_jit.c
++++ b/arch/mips/net/bpf_jit.c
+@@ -521,19 +521,6 @@ static inline u16 align_sp(unsigned int num)
+ 	return num;
+ }
+ 
+-static bool is_load_to_a(u16 inst)
+-{
+-	switch (inst) {
+-	case BPF_LD | BPF_W | BPF_LEN:
+-	case BPF_LD | BPF_W | BPF_ABS:
+-	case BPF_LD | BPF_H | BPF_ABS:
+-	case BPF_LD | BPF_B | BPF_ABS:
+-		return true;
+-	default:
+-		return false;
+-	}
+-}
+-
+ static void save_bpf_jit_regs(struct jit_ctx *ctx, unsigned offset)
+ {
+ 	int i = 0, real_off = 0;
+@@ -614,7 +601,6 @@ static unsigned int get_stack_depth(struct jit_ctx *ctx)
+ 
+ static void build_prologue(struct jit_ctx *ctx)
+ {
+-	u16 first_inst = ctx->skf->insns[0].code;
+ 	int sp_off;
+ 
+ 	/* Calculate the total offset for the stack pointer */
+@@ -641,7 +627,7 @@ static void build_prologue(struct jit_ctx *ctx)
+ 		emit_jit_reg_move(r_X, r_zero, ctx);
+ 
+ 	/* Do not leak kernel data to userspace */
+-	if ((first_inst != (BPF_RET | BPF_K)) && !(is_load_to_a(first_inst)))
++	if (bpf_needs_clear_a(&ctx->skf->insns[0]))
+ 		emit_jit_reg_move(r_A, r_zero, ctx);
+ }
+ 
 diff --git a/arch/mips/sgi-ip27/ip27-nmi.c b/arch/mips/sgi-ip27/ip27-nmi.c
 index a2358b4..7cead4f 100644
 --- a/arch/mips/sgi-ip27/ip27-nmi.c
@@ -9339,6 +9422,31 @@ index 0f432a7..abfe841 100644
  	/* If hint, make sure it matches our alignment restrictions */
  	if (!fixed && addr) {
  		addr = _ALIGN_UP(addr, 1ul << pshift);
+diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
+index 17cea18..264c473 100644
+--- a/arch/powerpc/net/bpf_jit_comp.c
++++ b/arch/powerpc/net/bpf_jit_comp.c
+@@ -78,18 +78,9 @@ static void bpf_jit_build_prologue(struct bpf_prog *fp, u32 *image,
+ 		PPC_LI(r_X, 0);
+ 	}
+ 
+-	switch (filter[0].code) {
+-	case BPF_RET | BPF_K:
+-	case BPF_LD | BPF_W | BPF_LEN:
+-	case BPF_LD | BPF_W | BPF_ABS:
+-	case BPF_LD | BPF_H | BPF_ABS:
+-	case BPF_LD | BPF_B | BPF_ABS:
+-		/* first instruction sets A register (or is RET 'constant') */
+-		break;
+-	default:
+-		/* make sure we dont leak kernel information to user */
++	/* make sure we dont leak kernel information to user */
++	if (bpf_needs_clear_a(&filter[0]))
+ 		PPC_LI(r_A, 0);
+-	}
+ }
+ 
+ static void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
 diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c
 index 5038fd5..87a2033 100644
 --- a/arch/powerpc/platforms/cell/spufs/file.c
@@ -12192,6 +12300,35 @@ index 4ac88b7..bac6cb2 100644
  #endif /* CONFIG_SMP */
  #endif /* CONFIG_DEBUG_DCFLUSH */
  }
+diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
+index f8b9f71..17e71d2 100644
+--- a/arch/sparc/net/bpf_jit_comp.c
++++ b/arch/sparc/net/bpf_jit_comp.c
+@@ -420,22 +420,9 @@ void bpf_jit_compile(struct bpf_prog *fp)
+ 		}
+ 		emit_reg_move(O7, r_saved_O7);
+ 
+-		switch (filter[0].code) {
+-		case BPF_RET | BPF_K:
+-		case BPF_LD | BPF_W | BPF_LEN:
+-		case BPF_LD | BPF_W | BPF_ABS:
+-		case BPF_LD | BPF_H | BPF_ABS:
+-		case BPF_LD | BPF_B | BPF_ABS:
+-			/* The first instruction sets the A register (or is
+-			 * a "RET 'constant'")
+-			 */
+-			break;
+-		default:
+-			/* Make sure we dont leak kernel information to the
+-			 * user.
+-			 */
++		/* Make sure we dont leak kernel information to the user. */
++		if (bpf_needs_clear_a(&filter[0]))
+ 			emit_clear(r_A); /* A = 0 */
+-		}
+ 
+ 		for (i = 0; i < flen; i++) {
+ 			unsigned int K = filter[i].k;
 diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
 index 106c21b..185bf0f 100644
 --- a/arch/tile/Kconfig
@@ -24159,6 +24296,19 @@ index 66dd3fe9..c9bfa35 100644
  	}
  }
  
+diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
+index 165be83..031e5d22 100644
+--- a/arch/x86/kernel/cpu/perf_event.h
++++ b/arch/x86/kernel/cpu/perf_event.h
+@@ -790,7 +790,7 @@ static inline void set_linear_ip(struct pt_regs *regs, unsigned long ip)
+ 	regs->cs = kernel_ip(ip) ? __KERNEL_CS : __USER_CS;
+ 	if (regs->flags & X86_VM_MASK)
+ 		regs->flags ^= (PERF_EFLAGS_VM | X86_VM_MASK);
+-	regs->ip = ip;
++	regs->ip = kernel_ip(ip) ? ktva_ktla(ip) : ip;
+ }
+ 
+ ssize_t x86_event_sysfs_show(char *page, u64 config, u64 event);
 diff --git a/arch/x86/kernel/cpu/perf_event_amd_iommu.c b/arch/x86/kernel/cpu/perf_event_amd_iommu.c
 index 97242a9..cf9c30e 100644
 --- a/arch/x86/kernel/cpu/perf_event_amd_iommu.c
@@ -24321,6 +24471,67 @@ index 377e8f8..2982f48 100644
  
  	ret = intel_cqm_setup_rmid_cache();
  	if (ret)
+diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
+index 84f236a..6251ea8 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
+@@ -561,7 +561,7 @@ int intel_pmu_drain_bts_buffer(void)
+ 
+ static inline void intel_pmu_drain_pebs_buffer(void)
+ {
+-	struct pt_regs regs;
++	struct pt_regs regs = {};
+ 
+ 	x86_pmu.drain_pebs(&regs);
+ }
+@@ -832,7 +832,7 @@ static int intel_pmu_pebs_fixup_ip(struct pt_regs *regs)
+ 	struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
+ 	unsigned long from = cpuc->lbr_entries[0].from;
+ 	unsigned long old_to, to = cpuc->lbr_entries[0].to;
+-	unsigned long ip = regs->ip;
++	unsigned long ip = ktva_ktla(regs->ip);
+ 	int is_64bit = 0;
+ 	void *kaddr;
+ 	int size;
+@@ -884,6 +884,7 @@ static int intel_pmu_pebs_fixup_ip(struct pt_regs *regs)
+ 	} else {
+ 		kaddr = (void *)to;
+ 	}
++	kaddr = (void *)ktva_ktla((unsigned long)kaddr);
+ 
+ 	do {
+ 		struct insn insn;
+@@ -1032,7 +1033,7 @@ static void setup_pebs_sample_data(struct perf_event *event,
+ 	}
+ 
+ 	if (event->attr.precise_ip > 1 && x86_pmu.intel_cap.pebs_format >= 2) {
+-		regs->ip = pebs->real_ip;
++		set_linear_ip(regs, pebs->real_ip);
+ 		regs->flags |= PERF_EFLAGS_EXACT;
+ 	} else if (event->attr.precise_ip > 1 && intel_pmu_pebs_fixup_ip(regs))
+ 		regs->flags |= PERF_EFLAGS_EXACT;
+diff --git a/arch/x86/kernel/cpu/perf_event_intel_lbr.c b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
+index b2c9475..7288a46 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel_lbr.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
+@@ -682,7 +682,7 @@ static int branch_type(unsigned long from, unsigned long to, int abort)
+ 		 * Ensure we don't blindy read any address by validating it is
+ 		 * a known text address.
+ 		 */
+-		if (kernel_text_address(from)) {
++		if (kernel_text_address(ktva_ktla(from))) {
+ 			addr = (void *)from;
+ 			/*
+ 			 * Assume we can get the maximum possible size
+@@ -704,7 +704,7 @@ static int branch_type(unsigned long from, unsigned long to, int abort)
+ #ifdef CONFIG_X86_64
+ 	is64 = kernel_ip((unsigned long)addr) || !test_thread_flag(TIF_IA32);
+ #endif
+-	insn_init(&insn, addr, bytes_read, is64);
++	insn_init(&insn, (void *)ktva_ktla((unsigned long)addr), bytes_read, is64);
+ 	insn_get_opcode(&insn);
+ 	if (!insn.opcode.got)
+ 		return X86_BR_ABORT;
 diff --git a/arch/x86/kernel/cpu/perf_event_intel_pt.c b/arch/x86/kernel/cpu/perf_event_intel_pt.c
 index 4216928..cdae603 100644
 --- a/arch/x86/kernel/cpu/perf_event_intel_pt.c
@@ -29230,9 +29441,18 @@ index c3f7602..f6033e1 100644
  
  /*
 diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
-index bf4db6e..d491400 100644
+index bf4db6e..624137c 100644
 --- a/arch/x86/kernel/uprobes.c
 +++ b/arch/x86/kernel/uprobes.c
+@@ -287,7 +287,7 @@ static int uprobe_init_insn(struct arch_uprobe *auprobe, struct insn *insn, bool
+ {
+ 	u32 volatile *good_insns;
+ 
+-	insn_init(insn, auprobe->insn, sizeof(auprobe->insn), x86_64);
++	insn_init(insn, (void *)ktva_ktla((unsigned long)auprobe->insn), sizeof(auprobe->insn), x86_64);
+ 	/* has the side-effect of processing the entire instruction */
+ 	insn_get_length(insn);
+ 	if (WARN_ON_ONCE(!insn_complete(insn)))
 @@ -978,7 +978,7 @@ arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs
  
  	if (nleft != rasize) {
@@ -34681,9 +34901,18 @@ index 0057a7acc..95c7edd 100644
  	might_sleep();
  	if (is_enabled()) /* recheck and proper locking in *_core() */
 diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
-index 71fc79a..7388ad7 100644
+index 71fc79a..3dd1f49 100644
 --- a/arch/x86/mm/mpx.c
 +++ b/arch/x86/mm/mpx.c
+@@ -193,7 +193,7 @@ static int mpx_insn_decode(struct insn *insn,
+ 	 */
+ 	if (!nr_copied)
+ 		return -EFAULT;
+-	insn_init(insn, buf, nr_copied, x86_64);
++	insn_init(insn, (void *)ktva_ktla((unsigned long)buf), nr_copied, x86_64);
+ 	insn_get_length(insn);
+ 	/*
+ 	 * copy_from_user() tries to get as many bytes as we could see in
 @@ -292,11 +292,11 @@ siginfo_t *mpx_generate_siginfo(struct pt_regs *regs)
  	 * We were not able to extract an address from the instruction,
  	 * probably because there was something invalid in it.
@@ -42077,6 +42306,19 @@ index 5db3445..21414d5 100644
  	}
  
  	/*
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+index 0d13e63..3f67919 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -2338,7 +2338,7 @@ static inline void amdgpu_unregister_atpx_handler(void) {}
+  * KMS
+  */
+ extern const struct drm_ioctl_desc amdgpu_ioctls_kms[];
+-extern int amdgpu_max_kms_ioctl;
++extern const int amdgpu_max_kms_ioctl;
+ 
+ int amdgpu_driver_load_kms(struct drm_device *dev, unsigned long flags);
+ int amdgpu_driver_unload_kms(struct drm_device *dev);
 diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
 index 8e99514..3d68786 100644
 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
@@ -42174,6 +42416,35 @@ index 6068d82..7ecd87c 100644
  }
  
  static const struct vga_switcheroo_client_ops amdgpu_switcheroo_ops = {
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index b190c2a..d1b18c2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -544,8 +544,12 @@ static int __init amdgpu_init(void)
+ 	DRM_INFO("amdgpu kernel modesetting enabled.\n");
+ 	driver = &kms_driver;
+ 	pdriver = &amdgpu_kms_pci_driver;
+-	driver->driver_features |= DRIVER_MODESET;
+-	driver->num_ioctls = amdgpu_max_kms_ioctl;
++
++	pax_open_kernel();
++	*(u32 *)&driver->driver_features |= DRIVER_MODESET;
++	*(int *)&driver->num_ioctls = amdgpu_max_kms_ioctl;
++	pax_close_kernel();
++
+ 	amdgpu_register_atpx_handler();
+ 
+ 	amdgpu_amdkfd_init();
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index 5d11e79..04cc53e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -703,4 +703,4 @@ const struct drm_ioctl_desc amdgpu_ioctls_kms[] = {
+ 	DRM_IOCTL_DEF_DRV(AMDGPU_GEM_OP, amdgpu_gem_op_ioctl, DRM_AUTH|DRM_UNLOCKED|DRM_RENDER_ALLOW),
+ 	DRM_IOCTL_DEF_DRV(AMDGPU_GEM_USERPTR, amdgpu_gem_userptr_ioctl, DRM_AUTH|DRM_UNLOCKED|DRM_RENDER_ALLOW),
+ };
+-int amdgpu_max_kms_ioctl = ARRAY_SIZE(amdgpu_ioctls_kms);
++const int amdgpu_max_kms_ioctl = ARRAY_SIZE(amdgpu_ioctls_kms);
 diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
 index c6a1b4c..32873f8 100644
 --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -42631,6 +42902,27 @@ index 7b69070..d7bd78b 100644
  							pqn->q);
  	if (retval != 0)
  		return retval;
+diff --git a/drivers/gpu/drm/armada/armada_drv.c b/drivers/gpu/drm/armada/armada_drv.c
+index 225034b..4bb9696 100644
+--- a/drivers/gpu/drm/armada/armada_drv.c
++++ b/drivers/gpu/drm/armada/armada_drv.c
+@@ -324,6 +324,7 @@ static struct drm_driver armada_drm_driver = {
+ 	.driver_features	= DRIVER_GEM | DRIVER_MODESET |
+ 				  DRIVER_HAVE_IRQ | DRIVER_PRIME,
+ 	.ioctls			= armada_ioctls,
++	.num_ioctls		= ARRAY_SIZE(armada_ioctls),
+ 	.fops			= &armada_drm_fops,
+ };
+ 
+@@ -484,8 +485,6 @@ static int __init armada_drm_init(void)
+ {
+ 	int ret;
+ 
+-	armada_drm_driver.num_ioctls = ARRAY_SIZE(armada_ioctls);
+-
+ 	ret = platform_driver_register(&armada_lcd_platform_driver);
+ 	if (ret)
+ 		return ret;
 diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
 index 8328e70..fbd9db2 100644
 --- a/drivers/gpu/drm/drm_crtc.c
@@ -42867,6 +43159,49 @@ index d93e737..edb8a4a 100644
  	unsigned int nr = DRM_IOCTL_NR(cmd);
  	int retcode = -EINVAL;
  	char stack_kdata[128];
+diff --git a/drivers/gpu/drm/drm_pci.c b/drivers/gpu/drm/drm_pci.c
+index 1b1bd42..0e49027 100644
+--- a/drivers/gpu/drm/drm_pci.c
++++ b/drivers/gpu/drm/drm_pci.c
+@@ -305,7 +305,7 @@ int drm_get_pci_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
+ 	/* No locking needed since shadow-attach is single-threaded since it may
+ 	 * only be called from the per-driver module init hook. */
+ 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
+-		list_add_tail(&dev->legacy_dev_list, &driver->legacy_dev_list);
++		pax_list_add_tail(&dev->legacy_dev_list, (struct list_head *)&driver->legacy_dev_list);
+ 
+ 	return 0;
+ 
+@@ -340,7 +340,7 @@ int drm_pci_init(struct drm_driver *driver, struct pci_driver *pdriver)
+ 		return pci_register_driver(pdriver);
+ 
+ 	/* If not using KMS, fall back to stealth mode manual scanning. */
+-	INIT_LIST_HEAD(&driver->legacy_dev_list);
++	INIT_LIST_HEAD((struct list_head *)&driver->legacy_dev_list);
+ 	for (i = 0; pdriver->id_table[i].vendor != 0; i++) {
+ 		pid = &pdriver->id_table[i];
+ 
+@@ -446,7 +446,7 @@ void drm_pci_exit(struct drm_driver *driver, struct pci_driver *pdriver)
+ 	} else {
+ 		list_for_each_entry_safe(dev, tmp, &driver->legacy_dev_list,
+ 					 legacy_dev_list) {
+-			list_del(&dev->legacy_dev_list);
++			pax_list_del(&dev->legacy_dev_list);
+ 			drm_put_dev(dev);
+ 		}
+ 	}
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
+index ae9e6b2..80b2703 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
+@@ -614,7 +614,6 @@ static int exynos_drm_platform_probe(struct platform_device *pdev)
+ 	struct component_match *match;
+ 
+ 	pdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
+-	exynos_drm_driver.num_ioctls = ARRAY_SIZE(exynos_ioctls);
+ 
+ 	match = exynos_drm_match_add(&pdev->dev);
+ 	if (IS_ERR(match))
 diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c b/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c
 index d4813e0..6c1ab4d 100644
 --- a/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c
@@ -42890,8 +43225,54 @@ index d4813e0..6c1ab4d 100644
  	if (pipe) {
  		pipeconf_reg = PIPECCONF;
  		dspcntr_reg = DSPCCNTR;
+diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
+index 92e7e57..f59f5d3 100644
+--- a/drivers/gpu/drm/gma500/psb_drv.c
++++ b/drivers/gpu/drm/gma500/psb_drv.c
+@@ -376,7 +376,10 @@ static int psb_driver_load(struct drm_device *dev, unsigned long flags)
+ 
+ 	dev->vblank_disable_allowed = true;
+ 	dev->max_vblank_count = 0xffffff; /* only 24 bits of frame count */
+-	dev->driver->get_vblank_counter = psb_get_vblank_counter;
++
++	pax_open_kernel();
++	*(void **)&dev->driver->get_vblank_counter = psb_get_vblank_counter;
++	pax_close_kernel();
+ 
+ 	psb_modeset_init(dev);
+ 	psb_fbdev_init(dev);
+diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
+index d918567..6cfd904 100644
+--- a/drivers/gpu/drm/i810/i810_dma.c
++++ b/drivers/gpu/drm/i810/i810_dma.c
+@@ -1250,7 +1250,7 @@ const struct drm_ioctl_desc i810_ioctls[] = {
+ 	DRM_IOCTL_DEF_DRV(I810_FLIP, i810_flip_bufs, DRM_AUTH|DRM_UNLOCKED),
+ };
+ 
+-int i810_max_ioctl = ARRAY_SIZE(i810_ioctls);
++const int i810_max_ioctl = ARRAY_SIZE(i810_ioctls);
+ 
+ /**
+  * Determine if the device really is AGP or not.
+diff --git a/drivers/gpu/drm/i810/i810_drv.c b/drivers/gpu/drm/i810/i810_drv.c
+index 44f4a13..0063c1b 100644
+--- a/drivers/gpu/drm/i810/i810_drv.c
++++ b/drivers/gpu/drm/i810/i810_drv.c
+@@ -87,7 +87,11 @@ static int __init i810_init(void)
+ 		pr_err("drm/i810 does not support SMP\n");
+ 		return -EINVAL;
+ 	}
+-	driver.num_ioctls = i810_max_ioctl;
++
++	pax_open_kernel();
++	*(int *)&driver.num_ioctls = i810_max_ioctl;
++	pax_close_kernel();
++
+ 	return drm_pci_init(&driver, &i810_pci_driver);
+ }
+ 
 diff --git a/drivers/gpu/drm/i810/i810_drv.h b/drivers/gpu/drm/i810/i810_drv.h
-index 93ec5dc..82acbaf 100644
+index 93ec5dc..204ec92 100644
 --- a/drivers/gpu/drm/i810/i810_drv.h
 +++ b/drivers/gpu/drm/i810/i810_drv.h
 @@ -110,8 +110,8 @@ typedef struct drm_i810_private {
@@ -42905,8 +43286,17 @@ index 93ec5dc..82acbaf 100644
  
  	int front_offset;
  } drm_i810_private_t;
+@@ -128,7 +128,7 @@ extern int i810_driver_device_is_agp(struct drm_device *dev);
+ 
+ extern long i810_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
+ extern const struct drm_ioctl_desc i810_ioctls[];
+-extern int i810_max_ioctl;
++extern const int i810_max_ioctl;
+ 
+ #define I810_BASE(reg)		((unsigned long) \
+ 				dev_priv->mmio_map->handle)
 diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
-index ab37d11..df030da 100644
+index ab37d11..5cbacc7 100644
 --- a/drivers/gpu/drm/i915/i915_dma.c
 +++ b/drivers/gpu/drm/i915/i915_dma.c
 @@ -383,7 +383,7 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev)
@@ -42918,6 +43308,72 @@ index ab37d11..df030da 100644
  }
  
  static const struct vga_switcheroo_client_ops i915_switcheroo_ops = {
+@@ -1273,4 +1273,4 @@ const struct drm_ioctl_desc i915_ioctls[] = {
+ 	DRM_IOCTL_DEF_DRV(I915_GEM_CONTEXT_SETPARAM, i915_gem_context_setparam_ioctl, DRM_UNLOCKED|DRM_RENDER_ALLOW),
+ };
+ 
+-int i915_max_ioctl = ARRAY_SIZE(i915_ioctls);
++const int i915_max_ioctl = ARRAY_SIZE(i915_ioctls);
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index ab64d68..e6be8e5 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -1697,25 +1697,27 @@ static struct pci_driver i915_pci_driver = {
+ 
+ static int __init i915_init(void)
+ {
+-	driver.num_ioctls = i915_max_ioctl;
++	pax_open_kernel();
++	*(int *)&driver.num_ioctls = i915_max_ioctl;
+ 
+ 	/*
+ 	 * Enable KMS by default, unless explicitly overriden by
+ 	 * either the i915.modeset prarameter or by the
+ 	 * vga_text_mode_force boot option.
+ 	 */
+-	driver.driver_features |= DRIVER_MODESET;
++	*(u32 *)&driver.driver_features |= DRIVER_MODESET;
+ 
+ 	if (i915.modeset == 0)
+-		driver.driver_features &= ~DRIVER_MODESET;
++		*(u32 *)&driver.driver_features &= ~DRIVER_MODESET;
+ 
+ #ifdef CONFIG_VGA_CONSOLE
+ 	if (vgacon_text_force() && i915.modeset == -1)
+-		driver.driver_features &= ~DRIVER_MODESET;
++		*(u32 *)&driver.driver_features &= ~DRIVER_MODESET;
+ #endif
+ 
+ 	if (!(driver.driver_features & DRIVER_MODESET)) {
+-		driver.get_vblank_timestamp = NULL;
++		*(void **)&driver.get_vblank_timestamp = NULL;
++		pax_close_kernel();
+ 		/* Silently fail loading to not upset userspace. */
+ 		DRM_DEBUG_DRIVER("KMS and UMS disabled.\n");
+ 		return 0;
+@@ -1727,7 +1729,8 @@ static int __init i915_init(void)
+ 	 * a single CRTC will actually work.
+ 	 */
+ 	if (driver.driver_features & DRIVER_MODESET)
+-		driver.driver_features |= DRIVER_ATOMIC;
++		*(u32 *)&driver.driver_features |= DRIVER_ATOMIC;
++	pax_close_kernel();
+ 
+ 	return drm_pci_init(&driver, &i915_pci_driver);
+ }
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index e1db8de..3abe8a4 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -2601,7 +2601,7 @@ struct drm_i915_cmd_table {
+ #include "i915_trace.h"
+ 
+ extern const struct drm_ioctl_desc i915_ioctls[];
+-extern int i915_max_ioctl;
++extern const int i915_max_ioctl;
+ 
+ extern int i915_suspend_legacy(struct drm_device *dev, pm_message_t state);
+ extern int i915_resume_legacy(struct drm_device *dev);
 diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
 index a953d49..bf179e7 100644
 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -43044,6 +43500,137 @@ index 97f3a56..32c712e 100644
  	else
  		ret = drm_ioctl(filp, cmd, arg);
  
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index 39d73db..b5187a1 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -4143,14 +4143,15 @@ void intel_irq_init(struct drm_i915_private *dev_priv)
+ 
+ 	pm_qos_add_request(&dev_priv->pm_qos, PM_QOS_CPU_DMA_LATENCY, PM_QOS_DEFAULT_VALUE);
+ 
++	pax_open_kernel();
+ 	if (IS_GEN2(dev_priv)) {
+ 		dev->max_vblank_count = 0;
+-		dev->driver->get_vblank_counter = i8xx_get_vblank_counter;
++		*(void **)&dev->driver->get_vblank_counter = i8xx_get_vblank_counter;
+ 	} else if (IS_G4X(dev_priv) || INTEL_INFO(dev_priv)->gen >= 5) {
+ 		dev->max_vblank_count = 0xffffffff; /* full 32 bit counter */
+-		dev->driver->get_vblank_counter = gm45_get_vblank_counter;
++		*(void **)&dev->driver->get_vblank_counter = gm45_get_vblank_counter;
+ 	} else {
+-		dev->driver->get_vblank_counter = i915_get_vblank_counter;
++		*(void **)&dev->driver->get_vblank_counter = i915_get_vblank_counter;
+ 		dev->max_vblank_count = 0xffffff; /* only 24 bits of frame count */
+ 	}
+ 
+@@ -4162,66 +4163,67 @@ void intel_irq_init(struct drm_i915_private *dev_priv)
+ 	if (!IS_GEN2(dev_priv))
+ 		dev->vblank_disable_immediate = true;
+ 
+-	dev->driver->get_vblank_timestamp = i915_get_vblank_timestamp;
+-	dev->driver->get_scanout_position = i915_get_crtc_scanoutpos;
++	*(void **)&dev->driver->get_vblank_timestamp = i915_get_vblank_timestamp;
++	*(void **)&dev->driver->get_scanout_position = i915_get_crtc_scanoutpos;
+ 
+ 	if (IS_CHERRYVIEW(dev_priv)) {
+-		dev->driver->irq_handler = cherryview_irq_handler;
+-		dev->driver->irq_preinstall = cherryview_irq_preinstall;
+-		dev->driver->irq_postinstall = cherryview_irq_postinstall;
+-		dev->driver->irq_uninstall = cherryview_irq_uninstall;
+-		dev->driver->enable_vblank = valleyview_enable_vblank;
+-		dev->driver->disable_vblank = valleyview_disable_vblank;
++		*(void **)&dev->driver->irq_handler = cherryview_irq_handler;
++		*(void **)&dev->driver->irq_preinstall = cherryview_irq_preinstall;
++		*(void **)&dev->driver->irq_postinstall = cherryview_irq_postinstall;
++		*(void **)&dev->driver->irq_uninstall = cherryview_irq_uninstall;
++		*(void **)&dev->driver->enable_vblank = valleyview_enable_vblank;
++		*(void **)&dev->driver->disable_vblank = valleyview_disable_vblank;
+ 		dev_priv->display.hpd_irq_setup = i915_hpd_irq_setup;
+ 	} else if (IS_VALLEYVIEW(dev_priv)) {
+-		dev->driver->irq_handler = valleyview_irq_handler;
+-		dev->driver->irq_preinstall = valleyview_irq_preinstall;
+-		dev->driver->irq_postinstall = valleyview_irq_postinstall;
+-		dev->driver->irq_uninstall = valleyview_irq_uninstall;
+-		dev->driver->enable_vblank = valleyview_enable_vblank;
+-		dev->driver->disable_vblank = valleyview_disable_vblank;
++		*(void **)&dev->driver->irq_handler = valleyview_irq_handler;
++		*(void **)&dev->driver->irq_preinstall = valleyview_irq_preinstall;
++		*(void **)&dev->driver->irq_postinstall = valleyview_irq_postinstall;
++		*(void **)&dev->driver->irq_uninstall = valleyview_irq_uninstall;
++		*(void **)&dev->driver->enable_vblank = valleyview_enable_vblank;
++		*(void **)&dev->driver->disable_vblank = valleyview_disable_vblank;
+ 		dev_priv->display.hpd_irq_setup = i915_hpd_irq_setup;
+ 	} else if (INTEL_INFO(dev_priv)->gen >= 8) {
+-		dev->driver->irq_handler = gen8_irq_handler;
+-		dev->driver->irq_preinstall = gen8_irq_reset;
+-		dev->driver->irq_postinstall = gen8_irq_postinstall;
+-		dev->driver->irq_uninstall = gen8_irq_uninstall;
+-		dev->driver->enable_vblank = gen8_enable_vblank;
+-		dev->driver->disable_vblank = gen8_disable_vblank;
++		*(void **)&dev->driver->irq_handler = gen8_irq_handler;
++		*(void **)&dev->driver->irq_preinstall = gen8_irq_reset;
++		*(void **)&dev->driver->irq_postinstall = gen8_irq_postinstall;
++		*(void **)&dev->driver->irq_uninstall = gen8_irq_uninstall;
++		*(void **)&dev->driver->enable_vblank = gen8_enable_vblank;
++		*(void **)&dev->driver->disable_vblank = gen8_disable_vblank;
+ 		if (HAS_PCH_SPLIT(dev))
+ 			dev_priv->display.hpd_irq_setup = ibx_hpd_irq_setup;
+ 		else
+ 			dev_priv->display.hpd_irq_setup = bxt_hpd_irq_setup;
+ 	} else if (HAS_PCH_SPLIT(dev)) {
+-		dev->driver->irq_handler = ironlake_irq_handler;
+-		dev->driver->irq_preinstall = ironlake_irq_reset;
+-		dev->driver->irq_postinstall = ironlake_irq_postinstall;
+-		dev->driver->irq_uninstall = ironlake_irq_uninstall;
+-		dev->driver->enable_vblank = ironlake_enable_vblank;
+-		dev->driver->disable_vblank = ironlake_disable_vblank;
++		*(void **)&dev->driver->irq_handler = ironlake_irq_handler;
++		*(void **)&dev->driver->irq_preinstall = ironlake_irq_reset;
++		*(void **)&dev->driver->irq_postinstall = ironlake_irq_postinstall;
++		*(void **)&dev->driver->irq_uninstall = ironlake_irq_uninstall;
++		*(void **)&dev->driver->enable_vblank = ironlake_enable_vblank;
++		*(void **)&dev->driver->disable_vblank = ironlake_disable_vblank;
+ 		dev_priv->display.hpd_irq_setup = ibx_hpd_irq_setup;
+ 	} else {
+ 		if (INTEL_INFO(dev_priv)->gen == 2) {
+-			dev->driver->irq_preinstall = i8xx_irq_preinstall;
+-			dev->driver->irq_postinstall = i8xx_irq_postinstall;
+-			dev->driver->irq_handler = i8xx_irq_handler;
+-			dev->driver->irq_uninstall = i8xx_irq_uninstall;
++			*(void **)&dev->driver->irq_preinstall = i8xx_irq_preinstall;
++			*(void **)&dev->driver->irq_postinstall = i8xx_irq_postinstall;
++			*(void **)&dev->driver->irq_handler = i8xx_irq_handler;
++			*(void **)&dev->driver->irq_uninstall = i8xx_irq_uninstall;
+ 		} else if (INTEL_INFO(dev_priv)->gen == 3) {
+-			dev->driver->irq_preinstall = i915_irq_preinstall;
+-			dev->driver->irq_postinstall = i915_irq_postinstall;
+-			dev->driver->irq_uninstall = i915_irq_uninstall;
+-			dev->driver->irq_handler = i915_irq_handler;
++			*(void **)&dev->driver->irq_preinstall = i915_irq_preinstall;
++			*(void **)&dev->driver->irq_postinstall = i915_irq_postinstall;
++			*(void **)&dev->driver->irq_uninstall = i915_irq_uninstall;
++			*(void **)&dev->driver->irq_handler = i915_irq_handler;
+ 		} else {
+-			dev->driver->irq_preinstall = i965_irq_preinstall;
+-			dev->driver->irq_postinstall = i965_irq_postinstall;
+-			dev->driver->irq_uninstall = i965_irq_uninstall;
+-			dev->driver->irq_handler = i965_irq_handler;
++			*(void **)&dev->driver->irq_preinstall = i965_irq_preinstall;
++			*(void **)&dev->driver->irq_postinstall = i965_irq_postinstall;
++			*(void **)&dev->driver->irq_uninstall = i965_irq_uninstall;
++			*(void **)&dev->driver->irq_handler = i965_irq_handler;
+ 		}
+ 		if (I915_HAS_HOTPLUG(dev_priv))
+ 			dev_priv->display.hpd_irq_setup = i915_hpd_irq_setup;
+-		dev->driver->enable_vblank = i915_enable_vblank;
+-		dev->driver->disable_vblank = i915_disable_vblank;
++		*(void **)&dev->driver->enable_vblank = i915_enable_vblank;
++		*(void **)&dev->driver->disable_vblank = i915_disable_vblank;
+ 	}
++	pax_close_kernel();
+ }
+ 
+ /**
 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
 index b2270d5..e5c48fe 100644
 --- a/drivers/gpu/drm/i915/intel_display.c
@@ -43108,8 +43695,24 @@ index 74f505b..21f6914 100644
  		return -EBUSY;
  
  	imx_drm_crtc = kzalloc(sizeof(*imx_drm_crtc), GFP_KERNEL);
+diff --git a/drivers/gpu/drm/mga/mga_drv.c b/drivers/gpu/drm/mga/mga_drv.c
+index 5e2f131..d227dbc 100644
+--- a/drivers/gpu/drm/mga/mga_drv.c
++++ b/drivers/gpu/drm/mga/mga_drv.c
+@@ -92,7 +92,10 @@ static struct pci_driver mga_pci_driver = {
+ 
+ static int __init mga_init(void)
+ {
+-	driver.num_ioctls = mga_max_ioctl;
++	pax_open_kernel();
++	*(int *)&driver.num_ioctls = mga_max_ioctl;
++	pax_close_kernel();
++
+ 	return drm_pci_init(&driver, &mga_pci_driver);
+ }
+ 
 diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
-index b4a20149..219ab78 100644
+index b4a20149..caa87d9 100644
 --- a/drivers/gpu/drm/mga/mga_drv.h
 +++ b/drivers/gpu/drm/mga/mga_drv.h
 @@ -122,9 +122,9 @@ typedef struct drm_mga_private {
@@ -43124,6 +43727,15 @@ index b4a20149..219ab78 100644
  	u32 next_fence_to_post;
  
  	unsigned int fb_cpp;
+@@ -152,7 +152,7 @@ typedef struct drm_mga_private {
+ } drm_mga_private_t;
+ 
+ extern const struct drm_ioctl_desc mga_ioctls[];
+-extern int mga_max_ioctl;
++extern const int mga_max_ioctl;
+ 
+ 				/* mga_dma.c */
+ extern int mga_dma_bootstrap(struct drm_device *dev, void *data,
 diff --git a/drivers/gpu/drm/mga/mga_ioc32.c b/drivers/gpu/drm/mga/mga_ioc32.c
 index 729bfd5..14bae78 100644
 --- a/drivers/gpu/drm/mga/mga_ioc32.c
@@ -43197,6 +43809,16 @@ index 1b071b8..de8601a 100644
  		      - *sequence) <= (1 << 23)));
  
  	*sequence = cur_fence;
+diff --git a/drivers/gpu/drm/mga/mga_state.c b/drivers/gpu/drm/mga/mga_state.c
+index 792f924..aeb1334 100644
+--- a/drivers/gpu/drm/mga/mga_state.c
++++ b/drivers/gpu/drm/mga/mga_state.c
+@@ -1099,4 +1099,4 @@ const struct drm_ioctl_desc mga_ioctls[] = {
+ 	DRM_IOCTL_DEF_DRV(MGA_DMA_BOOTSTRAP, mga_dma_bootstrap, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
+ };
+ 
+-int mga_max_ioctl = ARRAY_SIZE(mga_ioctls);
++const int mga_max_ioctl = ARRAY_SIZE(mga_ioctls);
 diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
 index 4dca65a..3486961 100644
 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -43210,6 +43832,51 @@ index 4dca65a..3486961 100644
  
  #define BIT_TABLE(id, funcid) ((struct bit_table){ id, parse_bit_##funcid##_tbl_entry })
  
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
+index ccefb64..a19593d 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -76,7 +76,6 @@ MODULE_PARM_DESC(runpm, "disable (0), force enable (1), optimus only default (-1
+ int nouveau_runtime_pm = -1;
+ module_param_named(runpm, nouveau_runtime_pm, int, 0400);
+ 
+-static struct drm_driver driver_stub;
+ static struct drm_driver driver_pci;
+ static struct drm_driver driver_platform;
+ 
+@@ -917,7 +916,7 @@ nouveau_driver_fops = {
+ };
+ 
+ static struct drm_driver
+-driver_stub = {
++driver_pci = {
+ 	.driver_features =
+ 		DRIVER_GEM | DRIVER_MODESET | DRIVER_PRIME | DRIVER_RENDER |
+ 		DRIVER_KMS_LEGACY_CONTEXT,
+@@ -929,6 +928,8 @@ driver_stub = {
+ 	.postclose = nouveau_drm_postclose,
+ 	.lastclose = nouveau_vga_lastclose,
+ 
++	.set_busid = drm_pci_set_busid,
++
+ #if defined(CONFIG_DEBUG_FS)
+ 	.debugfs_init = nouveau_debugfs_init,
+ 	.debugfs_cleanup = nouveau_debugfs_takedown,
+@@ -1065,10 +1066,10 @@ err_free:
+ static int __init
+ nouveau_drm_init(void)
+ {
+-	driver_pci = driver_stub;
+-	driver_pci.set_busid = drm_pci_set_busid;
+-	driver_platform = driver_stub;
+-	driver_platform.set_busid = drm_platform_set_busid;
++	pax_open_kernel();
++	memcpy((void *)&driver_platform, &driver_pci, sizeof driver_pci);
++	*(void **)&driver_platform.set_busid = drm_platform_set_busid;
++	pax_close_kernel();
+ 
+ 	nouveau_display_options();
+ 
 diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.h b/drivers/gpu/drm/nouveau/nouveau_drm.h
 index 3c902c2..1b2d658 100644
 --- a/drivers/gpu/drm/nouveau/nouveau_drm.h
@@ -43371,6 +44038,32 @@ index 6911b8c..89d6867 100644
  	seq_printf(m, "%d\n", qdev->irq_received_error);
  	return 0;
  }
+diff --git a/drivers/gpu/drm/qxl/qxl_drv.c b/drivers/gpu/drm/qxl/qxl_drv.c
+index 83f6f0b..0d36693 100644
+--- a/drivers/gpu/drm/qxl/qxl_drv.c
++++ b/drivers/gpu/drm/qxl/qxl_drv.c
+@@ -37,7 +37,7 @@
+ #include "qxl_drv.h"
+ #include "qxl_object.h"
+ 
+-extern int qxl_max_ioctls;
++extern const int qxl_max_ioctls;
+ static const struct pci_device_id pciidlist[] = {
+ 	{ 0x1b36, 0x100, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8,
+ 	  0xffff00, 0 },
+@@ -278,7 +278,11 @@ static int __init qxl_init(void)
+ 
+ 	if (qxl_modeset == 0)
+ 		return -EINVAL;
+-	qxl_driver.num_ioctls = qxl_max_ioctls;
++
++	pax_open_kernel();
++	*(int *)&qxl_driver.num_ioctls = qxl_max_ioctls;
++	pax_close_kernel();
++
+ 	return drm_pci_init(&qxl_driver, &qxl_pci_driver);
+ }
+ 
 diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
 index 01a8694..584fb48 100644
 --- a/drivers/gpu/drm/qxl/qxl_drv.h
@@ -43391,7 +44084,7 @@ index 01a8694..584fb48 100644
  	wait_queue_head_t display_event;
  	wait_queue_head_t cursor_event;
 diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
-index bda5c5f..140ac46 100644
+index bda5c5f..aa09e3e 100644
 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c
 +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
 @@ -183,7 +183,7 @@ static int qxl_process_single_command(struct qxl_device *qdev,
@@ -43426,6 +44119,12 @@ index bda5c5f..140ac46 100644
  				       sizeof(user_cmd)))
  			return -EFAULT;
  
+@@ -439,4 +439,4 @@ const struct drm_ioctl_desc qxl_ioctls[] = {
+ 			  DRM_AUTH|DRM_UNLOCKED),
+ };
+ 
+-int qxl_max_ioctls = ARRAY_SIZE(qxl_ioctls);
++const int qxl_max_ioctls = ARRAY_SIZE(qxl_ioctls);
 diff --git a/drivers/gpu/drm/qxl/qxl_irq.c b/drivers/gpu/drm/qxl/qxl_irq.c
 index 0bf1e20..42a7310 100644
 --- a/drivers/gpu/drm/qxl/qxl_irq.c
@@ -43547,8 +44246,23 @@ index 2c45ac9..5d740f8 100644
  
  	/* We don't support anything other than bus-mastering ring mode,
  	 * but the ring can be in either AGP or PCI space for the ring
+diff --git a/drivers/gpu/drm/r128/r128_drv.c b/drivers/gpu/drm/r128/r128_drv.c
+index c57b4de..2614d79 100644
+--- a/drivers/gpu/drm/r128/r128_drv.c
++++ b/drivers/gpu/drm/r128/r128_drv.c
+@@ -94,7 +94,9 @@ static struct pci_driver r128_pci_driver = {
+ 
+ static int __init r128_init(void)
+ {
+-	driver.num_ioctls = r128_max_ioctl;
++	pax_open_kernel();
++	*(int *)&driver.num_ioctls = r128_max_ioctl;
++	pax_close_kernel();
+ 
+ 	return drm_pci_init(&driver, &r128_pci_driver);
+ }
 diff --git a/drivers/gpu/drm/r128/r128_drv.h b/drivers/gpu/drm/r128/r128_drv.h
-index 723e5d6..102dbaf 100644
+index 723e5d6..6efb284 100644
 --- a/drivers/gpu/drm/r128/r128_drv.h
 +++ b/drivers/gpu/drm/r128/r128_drv.h
 @@ -93,14 +93,14 @@ typedef struct drm_r128_private {
@@ -43568,6 +44282,15 @@ index 723e5d6..102dbaf 100644
  
  	u32 color_fmt;
  	unsigned int front_offset;
+@@ -135,7 +135,7 @@ typedef struct drm_r128_buf_priv {
+ } drm_r128_buf_priv_t;
+ 
+ extern const struct drm_ioctl_desc r128_ioctls[];
+-extern int r128_max_ioctl;
++extern const int r128_max_ioctl;
+ 
+ 				/* r128_cce.c */
+ extern int r128_cce_init(struct drm_device *dev, void *data, struct drm_file *file_priv);
 diff --git a/drivers/gpu/drm/r128/r128_ioc32.c b/drivers/gpu/drm/r128/r128_ioc32.c
 index 663f38c..ec159a1 100644
 --- a/drivers/gpu/drm/r128/r128_ioc32.c
@@ -43624,7 +44347,7 @@ index c2ae496..30b5993 100644
  		return IRQ_HANDLED;
  	}
 diff --git a/drivers/gpu/drm/r128/r128_state.c b/drivers/gpu/drm/r128/r128_state.c
-index 8fd2d9f..18c9660 100644
+index 8fd2d9f..4e99166 100644
 --- a/drivers/gpu/drm/r128/r128_state.c
 +++ b/drivers/gpu/drm/r128/r128_state.c
 @@ -320,10 +320,10 @@ static void r128_clear_box(drm_r128_private_t *dev_priv,
@@ -43640,6 +44363,12 @@ index 8fd2d9f..18c9660 100644
  }
  
  #endif
+@@ -1641,4 +1641,4 @@ const struct drm_ioctl_desc r128_ioctls[] = {
+ 	DRM_IOCTL_DEF_DRV(R128_GETPARAM, r128_getparam, DRM_AUTH),
+ };
+ 
+-int r128_max_ioctl = ARRAY_SIZE(r128_ioctls);
++const int r128_max_ioctl = ARRAY_SIZE(r128_ioctls);
 diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c
 index b928c17..e5d9400 100644
 --- a/drivers/gpu/drm/radeon/mkregtable.c
@@ -43674,8 +44403,50 @@ index f3f562f..0c099bb 100644
  }
  
  static const struct vga_switcheroo_client_ops radeon_switcheroo_ops = {
+diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
+index 5751446..f39a861 100644
+--- a/drivers/gpu/drm/radeon/radeon_drv.c
++++ b/drivers/gpu/drm/radeon/radeon_drv.c
+@@ -130,7 +130,7 @@ extern int radeon_get_crtc_scanoutpos(struct drm_device *dev, int crtc,
+ 				      ktime_t *etime);
+ extern bool radeon_is_px(struct drm_device *dev);
+ extern const struct drm_ioctl_desc radeon_ioctls_kms[];
+-extern int radeon_max_kms_ioctl;
++extern const int radeon_max_kms_ioctl;
+ int radeon_mmap(struct file *filp, struct vm_area_struct *vma);
+ int radeon_mode_dumb_mmap(struct drm_file *filp,
+ 			  struct drm_device *dev,
+@@ -650,8 +650,12 @@ static int __init radeon_init(void)
+ 		DRM_INFO("radeon kernel modesetting enabled.\n");
+ 		driver = &kms_driver;
+ 		pdriver = &radeon_kms_pci_driver;
+-		driver->driver_features |= DRIVER_MODESET;
+-		driver->num_ioctls = radeon_max_kms_ioctl;
++
++		pax_open_kernel();
++		*(u32 *)&driver->driver_features |= DRIVER_MODESET;
++		*(int *)&driver->num_ioctls = radeon_max_kms_ioctl;
++		pax_close_kernel();
++
+ 		radeon_register_atpx_handler();
+ 
+ 	} else {
+@@ -659,8 +663,11 @@ static int __init radeon_init(void)
+ 		DRM_INFO("radeon userspace modesetting enabled.\n");
+ 		driver = &driver_old;
+ 		pdriver = &radeon_pci_driver;
+-		driver->driver_features &= ~DRIVER_MODESET;
+-		driver->num_ioctls = radeon_max_ioctl;
++
++		pax_open_kernel();
++		*(u32 *)&driver->driver_features &= ~DRIVER_MODESET;
++		*(int *)&driver->num_ioctls = radeon_max_ioctl;
++		pax_close_kernel();
+ #else
+ 		DRM_ERROR("No UMS support in radeon module!\n");
+ 		return -EINVAL;
 diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
-index 46bd393..6ae4719 100644
+index 46bd393..8f077b5 100644
 --- a/drivers/gpu/drm/radeon/radeon_drv.h
 +++ b/drivers/gpu/drm/radeon/radeon_drv.h
 @@ -264,7 +264,7 @@ typedef struct drm_radeon_private {
@@ -43687,6 +44458,15 @@ index 46bd393..6ae4719 100644
  	int vblank_crtc;
  	uint32_t irq_enable_reg;
  	uint32_t r500_disp_irq_reg;
+@@ -336,7 +336,7 @@ typedef struct drm_radeon_kcmd_buffer {
+ 
+ extern int radeon_no_wb;
+ extern struct drm_ioctl_desc radeon_ioctls[];
+-extern int radeon_max_ioctl;
++extern const int radeon_max_ioctl;
+ 
+ extern u32 radeon_get_ring_head(drm_radeon_private_t *dev_priv);
+ extern void radeon_set_ring_head(drm_radeon_private_t *dev_priv, u32 val);
 diff --git a/drivers/gpu/drm/radeon/radeon_ioc32.c b/drivers/gpu/drm/radeon/radeon_ioc32.c
 index 0b98ea1..a3c770f 100644
 --- a/drivers/gpu/drm/radeon/radeon_ioc32.c
@@ -43753,8 +44533,18 @@ index 244b19b..c19226d 100644
  	init_waitqueue_head(&dev_priv->swi_queue);
  
  	dev->max_vblank_count = 0x001fffff;
+diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
+index 0e932bf..3de01a7 100644
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -932,4 +932,4 @@ const struct drm_ioctl_desc radeon_ioctls_kms[] = {
+ 	DRM_IOCTL_DEF_DRV(RADEON_GEM_OP, radeon_gem_op_ioctl, DRM_AUTH|DRM_UNLOCKED|DRM_RENDER_ALLOW),
+ 	DRM_IOCTL_DEF_DRV(RADEON_GEM_USERPTR, radeon_gem_userptr_ioctl, DRM_AUTH|DRM_UNLOCKED|DRM_RENDER_ALLOW),
+ };
+-int radeon_max_kms_ioctl = ARRAY_SIZE(radeon_ioctls_kms);
++const int radeon_max_kms_ioctl = ARRAY_SIZE(radeon_ioctls_kms);
 diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
-index 15aee72..cda326e 100644
+index 15aee72..c6df119 100644
 --- a/drivers/gpu/drm/radeon/radeon_state.c
 +++ b/drivers/gpu/drm/radeon/radeon_state.c
 @@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_device *dev, void *data, struct drm_file *
@@ -43775,6 +44565,12 @@ index 15aee72..cda326e 100644
  
  	DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
  
+@@ -3258,4 +3258,4 @@ struct drm_ioctl_desc radeon_ioctls[] = {
+ 	DRM_IOCTL_DEF_DRV(RADEON_CS, r600_cs_legacy_ioctl, DRM_AUTH)
+ };
+ 
+-int radeon_max_ioctl = ARRAY_SIZE(radeon_ioctls);
++const int radeon_max_ioctl = ARRAY_SIZE(radeon_ioctls);
 diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
 index 06ac59fe..57e0681 100644
 --- a/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -43799,6 +44595,83 @@ index 06ac59fe..57e0681 100644
  	}
  	vma->vm_ops = &radeon_ttm_vm_ops;
  	return 0;
+diff --git a/drivers/gpu/drm/savage/savage_bci.c b/drivers/gpu/drm/savage/savage_bci.c
+index d47dff9..0752202 100644
+--- a/drivers/gpu/drm/savage/savage_bci.c
++++ b/drivers/gpu/drm/savage/savage_bci.c
+@@ -1080,4 +1080,4 @@ const struct drm_ioctl_desc savage_ioctls[] = {
+ 	DRM_IOCTL_DEF_DRV(SAVAGE_BCI_EVENT_WAIT, savage_bci_event_wait, DRM_AUTH),
+ };
+ 
+-int savage_max_ioctl = ARRAY_SIZE(savage_ioctls);
++const int savage_max_ioctl = ARRAY_SIZE(savage_ioctls);
+diff --git a/drivers/gpu/drm/savage/savage_drv.c b/drivers/gpu/drm/savage/savage_drv.c
+index 21aed1f..5db7419 100644
+--- a/drivers/gpu/drm/savage/savage_drv.c
++++ b/drivers/gpu/drm/savage/savage_drv.c
+@@ -76,7 +76,10 @@ static struct pci_driver savage_pci_driver = {
+ 
+ static int __init savage_init(void)
+ {
+-	driver.num_ioctls = savage_max_ioctl;
++	pax_open_kernel();
++	*(int *)&driver.num_ioctls = savage_max_ioctl;
++	pax_close_kernel();
++
+ 	return drm_pci_init(&driver, &savage_pci_driver);
+ }
+ 
+diff --git a/drivers/gpu/drm/savage/savage_drv.h b/drivers/gpu/drm/savage/savage_drv.h
+index 37b6995..9b31aaf 100644
+--- a/drivers/gpu/drm/savage/savage_drv.h
++++ b/drivers/gpu/drm/savage/savage_drv.h
+@@ -107,7 +107,7 @@ enum savage_family {
+ };
+ 
+ extern const struct drm_ioctl_desc savage_ioctls[];
+-extern int savage_max_ioctl;
++extern const int savage_max_ioctl;
+ 
+ #define S3_SAVAGE3D_SERIES(chip)  ((chip>=S3_SAVAGE3D) && (chip<=S3_SAVAGE_MX))
+ 
+diff --git a/drivers/gpu/drm/sis/sis_drv.c b/drivers/gpu/drm/sis/sis_drv.c
+index 79bce76..4fd9a20 100644
+--- a/drivers/gpu/drm/sis/sis_drv.c
++++ b/drivers/gpu/drm/sis/sis_drv.c
+@@ -128,7 +128,10 @@ static struct pci_driver sis_pci_driver = {
+ 
+ static int __init sis_init(void)
+ {
+-	driver.num_ioctls = sis_max_ioctl;
++	pax_open_kernel();
++	*(int *)&driver.num_ioctls = sis_max_ioctl;
++	pax_close_kernel();
++
+ 	return drm_pci_init(&driver, &sis_pci_driver);
+ }
+ 
+diff --git a/drivers/gpu/drm/sis/sis_drv.h b/drivers/gpu/drm/sis/sis_drv.h
+index 16f972b..4f46125 100644
+--- a/drivers/gpu/drm/sis/sis_drv.h
++++ b/drivers/gpu/drm/sis/sis_drv.h
+@@ -73,6 +73,6 @@ extern void sis_reclaim_buffers_locked(struct drm_device *dev,
+ extern void sis_lastclose(struct drm_device *dev);
+ 
+ extern const struct drm_ioctl_desc sis_ioctls[];
+-extern int sis_max_ioctl;
++extern const int sis_max_ioctl;
+ 
+ #endif
+diff --git a/drivers/gpu/drm/sis/sis_mm.c b/drivers/gpu/drm/sis/sis_mm.c
+index 93ad8a5..48f0a57 100644
+--- a/drivers/gpu/drm/sis/sis_mm.c
++++ b/drivers/gpu/drm/sis/sis_mm.c
+@@ -359,4 +359,4 @@ const struct drm_ioctl_desc sis_ioctls[] = {
+ 	DRM_IOCTL_DEF_DRV(SIS_FB_INIT, sis_fb_init, DRM_AUTH | DRM_MASTER | DRM_ROOT_ONLY),
+ };
+ 
+-int sis_max_ioctl = ARRAY_SIZE(sis_ioctls);
++const int sis_max_ioctl = ARRAY_SIZE(sis_ioctls);
 diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
 index ddefb85..9011500 100644
 --- a/drivers/gpu/drm/tegra/dc.c
@@ -44080,8 +44953,34 @@ index 62c7b1d..2018818 100644
  	}
  
  	pr_warn("released /dev/fb%d user=%d count=%d\n",
+diff --git a/drivers/gpu/drm/via/via_dma.c b/drivers/gpu/drm/via/via_dma.c
+index d17d8f2..67e8e48b 100644
+--- a/drivers/gpu/drm/via/via_dma.c
++++ b/drivers/gpu/drm/via/via_dma.c
+@@ -737,4 +737,4 @@ const struct drm_ioctl_desc via_ioctls[] = {
+ 	DRM_IOCTL_DEF_DRV(VIA_BLIT_SYNC, via_dma_blit_sync, DRM_AUTH)
+ };
+ 
+-int via_max_ioctl = ARRAY_SIZE(via_ioctls);
++const int via_max_ioctl = ARRAY_SIZE(via_ioctls);
+diff --git a/drivers/gpu/drm/via/via_drv.c b/drivers/gpu/drm/via/via_drv.c
+index ed8aa8f..16c84fc 100644
+--- a/drivers/gpu/drm/via/via_drv.c
++++ b/drivers/gpu/drm/via/via_drv.c
+@@ -107,7 +107,10 @@ static struct pci_driver via_pci_driver = {
+ 
+ static int __init via_init(void)
+ {
+-	driver.num_ioctls = via_max_ioctl;
++	pax_open_kernel();
++	*(int *)&driver.num_ioctls = via_max_ioctl;
++	pax_close_kernel();
++
+ 	via_init_command_verifier();
+ 	return drm_pci_init(&driver, &via_pci_driver);
+ }
 diff --git a/drivers/gpu/drm/via/via_drv.h b/drivers/gpu/drm/via/via_drv.h
-index ef8c500..01030c8 100644
+index ef8c500..e0053ce 100644
 --- a/drivers/gpu/drm/via/via_drv.h
 +++ b/drivers/gpu/drm/via/via_drv.h
 @@ -53,7 +53,7 @@ typedef struct drm_via_ring_buffer {
@@ -44102,6 +45001,15 @@ index ef8c500..01030c8 100644
  	drm_via_state_t hc_state;
  	char pci_buf[VIA_PCI_BUF_SIZE];
  	const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
+@@ -117,7 +117,7 @@ enum via_family {
+ #define VIA_WRITE8(reg, val)	DRM_WRITE8(VIA_BASE, reg, val)
+ 
+ extern const struct drm_ioctl_desc via_ioctls[];
+-extern int via_max_ioctl;
++extern const int via_max_ioctl;
+ 
+ extern int via_fb_init(struct drm_device *dev, void *data, struct drm_file *file_priv);
+ extern int via_mem_alloc(struct drm_device *dev, void *data, struct drm_file *file_priv);
 diff --git a/drivers/gpu/drm/via/via_irq.c b/drivers/gpu/drm/via/via_irq.c
 index 1319433..a993b0c 100644
 --- a/drivers/gpu/drm/via/via_irq.c
@@ -51351,6 +52259,60 @@ index 445071c..6be9e60 100644
  	.kind		= "geneve",
  	.maxtype	= IFLA_GENEVE_MAX,
  	.policy		= geneve_policy,
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index 7c4a415..5a1e985 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -683,14 +683,20 @@ static void sixpack_close(struct tty_struct *tty)
+ 	if (!atomic_dec_and_test(&sp->refcnt))
+ 		down(&sp->dead_sem);
+ 
+-	unregister_netdev(sp->dev);
++	/* We must stop the queue to avoid potentially scribbling
++	 * on the free buffers. The sp->dead_sem is not sufficient
++	 * to protect us from sp->xbuff access.
++	 */
++	netif_stop_queue(sp->dev);
+ 
+-	del_timer(&sp->tx_t);
+-	del_timer(&sp->resync_t);
++	del_timer_sync(&sp->tx_t);
++	del_timer_sync(&sp->resync_t);
+ 
+ 	/* Free all 6pack frame buffers. */
+ 	kfree(sp->rbuff);
+ 	kfree(sp->xbuff);
++
++	unregister_netdev(sp->dev);
+ }
+ 
+ /* Perform I/O control on an active 6pack channel. */
+diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
+index 216bfd3..85828f1 100644
+--- a/drivers/net/hamradio/mkiss.c
++++ b/drivers/net/hamradio/mkiss.c
+@@ -797,14 +797,19 @@ static void mkiss_close(struct tty_struct *tty)
+ 	 */
+ 	if (!atomic_dec_and_test(&ax->refcnt))
+ 		down(&ax->dead_sem);
+-
+-	unregister_netdev(ax->dev);
++	/*
++	 * Halt the transmit queue so that a new transmit cannot scribble
++	 * on our buffers
++	 */
++	netif_stop_queue(ax->dev);
+ 
+ 	/* Free all AX25 frame buffers. */
+ 	kfree(ax->rbuff);
+ 	kfree(ax->xbuff);
+ 
+ 	ax->tty = NULL;
++
++	unregister_netdev(ax->dev);
+ }
+ 
+ /* Perform I/O control on an active ax25 channel. */
 diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
 index 5fa98f5..322f0f8 100644
 --- a/drivers/net/hyperv/hyperv_net.h
@@ -80831,7 +81793,7 @@ index 14db05d..687f6d8 100644
  #define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */
  
 diff --git a/fs/namei.c b/fs/namei.c
-index 33e9495..0c1096b 100644
+index 33e9495..4b9d9fb 100644
 --- a/fs/namei.c
 +++ b/fs/namei.c
 @@ -336,17 +336,32 @@ int generic_permission(struct inode *inode, int mask)
@@ -81111,17 +82073,7 @@ index 33e9495..0c1096b 100644
  	}
  out_no_open:
  	path->dentry = dentry;
-@@ -3066,6 +3187,9 @@ static int do_last(struct nameidata *nd,
- 		if (error)
- 			return error;
- 
-+		if (!gr_acl_handle_hidden_file(dir, nd->path.mnt))
-+			return -ENOENT;
-+
- 		audit_inode(nd->name, dir, LOOKUP_PARENT);
- 		/* trailing slashes? */
- 		if (unlikely(nd->last.name[nd->last.len]))
-@@ -3108,11 +3232,24 @@ retry_lookup:
+@@ -3108,11 +3229,24 @@ retry_lookup:
  		goto finish_open_created;
  	}
  
@@ -81147,7 +82099,7 @@ index 33e9495..0c1096b 100644
  
  	/*
  	 * If atomic_open() acquired write access it is dropped now due to
-@@ -3148,6 +3285,11 @@ finish_lookup:
+@@ -3148,6 +3282,11 @@ finish_lookup:
  	if (unlikely(error))
  		return error;
  
@@ -81159,7 +82111,7 @@ index 33e9495..0c1096b 100644
  	if (unlikely(d_is_symlink(path.dentry)) && !(open_flag & O_PATH)) {
  		path_to_nameidata(&path, nd);
  		return -ELOOP;
-@@ -3170,6 +3312,12 @@ finish_open:
+@@ -3170,6 +3309,12 @@ finish_open:
  		path_put(&save_parent);
  		return error;
  	}
@@ -81172,7 +82124,7 @@ index 33e9495..0c1096b 100644
  	audit_inode(nd->name, nd->path.dentry, 0);
  	error = -EISDIR;
  	if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry))
-@@ -3436,9 +3584,11 @@ static struct dentry *filename_create(int dfd, struct filename *name,
+@@ -3436,9 +3581,11 @@ static struct dentry *filename_create(int dfd, struct filename *name,
  		goto unlock;
  
  	error = -EEXIST;
@@ -81186,7 +82138,7 @@ index 33e9495..0c1096b 100644
  	/*
  	 * Special case - lookup gave negative, but... we had foo/bar/
  	 * From the vfs_mknod() POV we just have a negative dentry -
-@@ -3492,6 +3642,20 @@ inline struct dentry *user_path_create(int dfd, const char __user *pathname,
+@@ -3492,6 +3639,20 @@ inline struct dentry *user_path_create(int dfd, const char __user *pathname,
  }
  EXPORT_SYMBOL(user_path_create);
  
@@ -81207,7 +82159,7 @@ index 33e9495..0c1096b 100644
  int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
  {
  	int error = may_create(dir, dentry);
-@@ -3555,6 +3719,17 @@ retry:
+@@ -3555,6 +3716,17 @@ retry:
  
  	if (!IS_POSIXACL(path.dentry->d_inode))
  		mode &= ~current_umask();
@@ -81225,7 +82177,7 @@ index 33e9495..0c1096b 100644
  	error = security_path_mknod(&path, dentry, mode, dev);
  	if (error)
  		goto out;
-@@ -3570,6 +3745,8 @@ retry:
+@@ -3570,6 +3742,8 @@ retry:
  			error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
  			break;
  	}
@@ -81234,7 +82186,7 @@ index 33e9495..0c1096b 100644
  out:
  	done_path_create(&path, dentry);
  	if (retry_estale(error, lookup_flags)) {
-@@ -3624,9 +3801,16 @@ retry:
+@@ -3624,9 +3798,16 @@ retry:
  
  	if (!IS_POSIXACL(path.dentry->d_inode))
  		mode &= ~current_umask();
@@ -81251,7 +82203,7 @@ index 33e9495..0c1096b 100644
  	done_path_create(&path, dentry);
  	if (retry_estale(error, lookup_flags)) {
  		lookup_flags |= LOOKUP_REVAL;
-@@ -3659,7 +3843,7 @@ void dentry_unhash(struct dentry *dentry)
+@@ -3659,7 +3840,7 @@ void dentry_unhash(struct dentry *dentry)
  {
  	shrink_dcache_parent(dentry);
  	spin_lock(&dentry->d_lock);
@@ -81260,7 +82212,7 @@ index 33e9495..0c1096b 100644
  		__d_drop(dentry);
  	spin_unlock(&dentry->d_lock);
  }
-@@ -3712,6 +3896,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
+@@ -3712,6 +3893,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
  	struct path path;
  	struct qstr last;
  	int type;
@@ -81269,7 +82221,7 @@ index 33e9495..0c1096b 100644
  	unsigned int lookup_flags = 0;
  retry:
  	name = user_path_parent(dfd, pathname,
-@@ -3744,10 +3930,20 @@ retry:
+@@ -3744,10 +3927,20 @@ retry:
  		error = -ENOENT;
  		goto exit3;
  	}
@@ -81290,7 +82242,7 @@ index 33e9495..0c1096b 100644
  exit3:
  	dput(dentry);
  exit2:
-@@ -3842,6 +4038,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+@@ -3842,6 +4035,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
  	int type;
  	struct inode *inode = NULL;
  	struct inode *delegated_inode = NULL;
@@ -81299,7 +82251,7 @@ index 33e9495..0c1096b 100644
  	unsigned int lookup_flags = 0;
  retry:
  	name = user_path_parent(dfd, pathname,
-@@ -3868,10 +4066,21 @@ retry_deleg:
+@@ -3868,10 +4063,21 @@ retry_deleg:
  		if (d_is_negative(dentry))
  			goto slashes;
  		ihold(inode);
@@ -81321,7 +82273,7 @@ index 33e9495..0c1096b 100644
  exit2:
  		dput(dentry);
  	}
-@@ -3960,9 +4169,17 @@ retry:
+@@ -3960,9 +4166,17 @@ retry:
  	if (IS_ERR(dentry))
  		goto out_putname;
  
@@ -81339,7 +82291,7 @@ index 33e9495..0c1096b 100644
  	done_path_create(&path, dentry);
  	if (retry_estale(error, lookup_flags)) {
  		lookup_flags |= LOOKUP_REVAL;
-@@ -4066,6 +4283,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -4066,6 +4280,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
  	struct dentry *new_dentry;
  	struct path old_path, new_path;
  	struct inode *delegated_inode = NULL;
@@ -81347,7 +82299,7 @@ index 33e9495..0c1096b 100644
  	int how = 0;
  	int error;
  
-@@ -4089,7 +4307,7 @@ retry:
+@@ -4089,7 +4304,7 @@ retry:
  	if (error)
  		return error;
  
@@ -81356,7 +82308,7 @@ index 33e9495..0c1096b 100644
  					(how & LOOKUP_REVAL));
  	error = PTR_ERR(new_dentry);
  	if (IS_ERR(new_dentry))
-@@ -4101,11 +4319,26 @@ retry:
+@@ -4101,11 +4316,26 @@ retry:
  	error = may_linkat(&old_path);
  	if (unlikely(error))
  		goto out_dput;
@@ -81383,7 +82335,7 @@ index 33e9495..0c1096b 100644
  	done_path_create(&new_path, new_dentry);
  	if (delegated_inode) {
  		error = break_deleg_wait(&delegated_inode);
-@@ -4420,6 +4653,20 @@ retry_deleg:
+@@ -4420,6 +4650,20 @@ retry_deleg:
  	if (new_dentry == trap)
  		goto exit5;
  
@@ -81404,7 +82356,7 @@ index 33e9495..0c1096b 100644
  	error = security_path_rename(&old_path, old_dentry,
  				     &new_path, new_dentry, flags);
  	if (error)
-@@ -4427,6 +4674,9 @@ retry_deleg:
+@@ -4427,6 +4671,9 @@ retry_deleg:
  	error = vfs_rename(old_path.dentry->d_inode, old_dentry,
  			   new_path.dentry->d_inode, new_dentry,
  			   &delegated_inode, flags);
@@ -81414,7 +82366,7 @@ index 33e9495..0c1096b 100644
  exit5:
  	dput(new_dentry);
  exit4:
-@@ -4483,14 +4733,24 @@ EXPORT_SYMBOL(vfs_whiteout);
+@@ -4483,14 +4730,24 @@ EXPORT_SYMBOL(vfs_whiteout);
  
  int readlink_copy(char __user *buffer, int buflen, const char *link)
  {
@@ -83243,7 +84195,7 @@ index 50493ed..248166b 100644
  }
  fs_initcall(proc_devices_init);
 diff --git a/fs/proc/fd.c b/fs/proc/fd.c
-index 6e5fcd0..06ea074 100644
+index 6e5fcd0..3841f4e 100644
 --- a/fs/proc/fd.c
 +++ b/fs/proc/fd.c
 @@ -27,7 +27,8 @@ static int seq_show(struct seq_file *m, void *v)
@@ -83256,7 +84208,15 @@ index 6e5fcd0..06ea074 100644
  	put_task_struct(task);
  
  	if (files) {
-@@ -291,11 +292,21 @@ static struct dentry *proc_lookupfd(struct inode *dir, struct dentry *dentry,
+@@ -258,6 +259,7 @@ static int proc_readfd_common(struct file *file, struct dir_context *ctx,
+ 				     name, len, instantiate, p,
+ 				     (void *)(unsigned long)fd))
+ 			goto out_fd_loop;
++		cond_resched();
+ 		rcu_read_lock();
+ 	}
+ 	rcu_read_unlock();
+@@ -291,11 +293,21 @@ static struct dentry *proc_lookupfd(struct inode *dir, struct dentry *dentry,
   */
  int proc_fd_permission(struct inode *inode, int mask)
  {
@@ -95423,10 +96383,10 @@ index 0000000..304c518
 +}
 diff --git a/grsecurity/grsec_sig.c b/grsecurity/grsec_sig.c
 new file mode 100644
-index 0000000..3860c7e
+index 0000000..1e6f893
 --- /dev/null
 +++ b/grsecurity/grsec_sig.c
-@@ -0,0 +1,236 @@
+@@ -0,0 +1,243 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/fs.h>
@@ -95581,6 +96541,7 @@ index 0000000..3860c7e
 +void gr_handle_kernel_exploit(void)
 +{
 +#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
++	static unsigned int num_banned_users __read_only;
 +	const struct cred *cred;
 +	struct task_struct *tsk, *tsk2;
 +	struct user_struct *user;
@@ -95594,6 +96555,12 @@ index 0000000..3860c7e
 +	if (gr_is_global_root(uid))
 +		panic("grsec: halting the system due to suspicious kernel crash caused by root");
 +	else {
++		pax_open_kernel();
++		num_banned_users++;
++		pax_close_kernel();
++		if (num_banned_users > 8)
++			panic("grsec: halting the system due to suspicious kernel crash caused by a large number of different users");
++
 +		/* kill all the processes of this user, hold a reference
 +		   to their creds struct, and prevent them from creating
 +		   another process until system reset
@@ -97263,7 +98230,7 @@ index c9fe145..9fb2337 100644
  struct crypto_instance {
  	struct crypto_alg alg;
 diff --git a/include/drm/drmP.h b/include/drm/drmP.h
-index 8b5ce7c..984979b 100644
+index 8b5ce7c..a0ee191 100644
 --- a/include/drm/drmP.h
 +++ b/include/drm/drmP.h
 @@ -59,6 +59,7 @@
@@ -97301,6 +98268,15 @@ index 8b5ce7c..984979b 100644
  
  /**
   * Creates a driver or general drm_ioctl_desc array entry for the given
+@@ -630,7 +633,7 @@ struct drm_driver {
+ 
+ 	/* List of devices hanging off this driver with stealth attach. */
+ 	struct list_head legacy_dev_list;
+-};
++} __do_const;
+ 
+ enum drm_minor_type {
+ 	DRM_MINOR_LEGACY,
 @@ -648,7 +651,8 @@ struct drm_info_list {
  	int (*show)(struct seq_file*, void*); /** show callback */
  	u32 driver_features; /**< Required driver features for this entry */
@@ -98459,6 +99435,36 @@ index 674e3e2..f68af19 100644
  void do_close_on_exec(struct files_struct *);
  int iterate_fd(struct files_struct *, unsigned,
  		int (*)(const void *, struct file *, unsigned),
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index fa2cab9..d42a5b8 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -459,6 +459,25 @@ static inline void bpf_jit_free(struct bpf_prog *fp)
+ 
+ #define BPF_ANC		BIT(15)
+ 
++static inline bool bpf_needs_clear_a(const struct sock_filter *first)
++{
++	switch (first->code) {
++	case BPF_RET | BPF_K:
++	case BPF_LD | BPF_W | BPF_LEN:
++		return false;
++
++	case BPF_LD | BPF_W | BPF_ABS:
++	case BPF_LD | BPF_H | BPF_ABS:
++	case BPF_LD | BPF_B | BPF_ABS:
++		if (first->k == SKF_AD_OFF + SKF_AD_ALU_XOR_X)
++			return true;
++		return false;
++
++	default:
++		return true;
++	}
++}
++
+ static inline u16 bpf_anc_helper(const struct sock_filter *ftest)
+ {
+ 	BUG_ON(ftest->code & BPF_ANC);
 diff --git a/include/linux/fs.h b/include/linux/fs.h
 index 72d8a84..4027250 100644
 --- a/include/linux/fs.h
@@ -98630,6 +99636,18 @@ index 7ee1774..72505b8 100644
  }
  
  /*
+diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
+index 6cd8c0e..47420d4 100644
+--- a/include/linux/ftrace.h
++++ b/include/linux/ftrace.h
+@@ -575,6 +575,7 @@ extern int ftrace_arch_read_dyn_info(char *buf, int size);
+ 
+ extern int skip_trace(unsigned long ip);
+ extern void ftrace_module_init(struct module *mod);
++extern void ftrace_release_mod(struct module *mod);
+ 
+ extern void ftrace_disable_daemon(void);
+ extern void ftrace_enable_daemon(void);
 diff --git a/include/linux/genhd.h b/include/linux/genhd.h
 index 2adbfa6..abfd2e6 100644
 --- a/include/linux/genhd.h
@@ -102292,7 +103310,7 @@ index 556ec1e..38c19c9 100644
  
  /*
 diff --git a/include/linux/sched.h b/include/linux/sched.h
-index b7b9501..dc6b96f 100644
+index b7b9501..46d7e52 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
 @@ -7,7 +7,7 @@
@@ -102359,7 +103377,14 @@ index b7b9501..dc6b96f 100644
  
  /*
   * Bits in flags field of signal_struct.
-@@ -836,6 +861,14 @@ struct user_struct {
+@@ -830,12 +855,21 @@ struct user_struct {
+ 	unsigned long mq_bytes;	/* How many bytes can be allocated to mqueue? */
+ #endif
+ 	unsigned long locked_shm; /* How many pages of mlocked shm ? */
++	unsigned long unix_inflight;	/* How many files in flight in unix sockets */
+ 
+ #ifdef CONFIG_KEYS
+ 	struct key *uid_keyring;	/* UID specific keyring */
  	struct key *session_keyring;	/* UID's default session keyring */
  #endif
  
@@ -102374,7 +103399,7 @@ index b7b9501..dc6b96f 100644
  	/* Hash table maintenance information */
  	struct hlist_node uidhash_node;
  	kuid_t uid;
-@@ -843,7 +876,7 @@ struct user_struct {
+@@ -843,7 +877,7 @@ struct user_struct {
  #ifdef CONFIG_PERF_EVENTS
  	atomic_long_t locked_vm;
  #endif
@@ -102383,7 +103408,7 @@ index b7b9501..dc6b96f 100644
  
  extern int uids_sysfs_init(void);
  
-@@ -1378,6 +1411,9 @@ struct tlbflush_unmap_batch {
+@@ -1378,6 +1412,9 @@ struct tlbflush_unmap_batch {
  struct task_struct {
  	volatile long state;	/* -1 unrunnable, 0 runnable, >0 stopped */
  	void *stack;
@@ -102393,7 +103418,7 @@ index b7b9501..dc6b96f 100644
  	atomic_t usage;
  	unsigned int flags;	/* per process flags, defined below */
  	unsigned int ptrace;
-@@ -1510,8 +1546,8 @@ struct task_struct {
+@@ -1510,8 +1547,8 @@ struct task_struct {
  	struct list_head thread_node;
  
  	struct completion *vfork_done;		/* for vfork() */
@@ -102404,7 +103429,7 @@ index b7b9501..dc6b96f 100644
  
  	cputime_t utime, stime, utimescaled, stimescaled;
  	cputime_t gtime;
-@@ -1534,11 +1570,6 @@ struct task_struct {
+@@ -1534,11 +1571,6 @@ struct task_struct {
  	struct task_cputime cputime_expires;
  	struct list_head cpu_timers[3];
  
@@ -102416,7 +103441,7 @@ index b7b9501..dc6b96f 100644
  	char comm[TASK_COMM_LEN]; /* executable name excluding path
  				     - access with [gs]et_task_comm (which lock
  				       it with task_lock())
-@@ -1554,6 +1585,8 @@ struct task_struct {
+@@ -1554,6 +1586,8 @@ struct task_struct {
  /* hung task detection */
  	unsigned long last_switch_count;
  #endif
@@ -102425,7 +103450,7 @@ index b7b9501..dc6b96f 100644
  /* filesystem information */
  	struct fs_struct *fs;
  /* open file information */
-@@ -1630,6 +1663,10 @@ struct task_struct {
+@@ -1630,6 +1664,10 @@ struct task_struct {
  	gfp_t lockdep_reclaim_gfp;
  #endif
  
@@ -102436,7 +103461,7 @@ index b7b9501..dc6b96f 100644
  /* journalling filesystem info */
  	void *journal_info;
  
-@@ -1668,6 +1705,10 @@ struct task_struct {
+@@ -1668,6 +1706,10 @@ struct task_struct {
  	/* cg_list protected by css_set_lock and tsk->alloc_lock */
  	struct list_head cg_list;
  #endif
@@ -102447,7 +103472,7 @@ index b7b9501..dc6b96f 100644
  #ifdef CONFIG_FUTEX
  	struct robust_list_head __user *robust_list;
  #ifdef CONFIG_COMPAT
-@@ -1783,7 +1824,7 @@ struct task_struct {
+@@ -1783,7 +1825,7 @@ struct task_struct {
  	 * Number of functions that haven't been traced
  	 * because of depth overrun.
  	 */
@@ -102456,7 +103481,7 @@ index b7b9501..dc6b96f 100644
  	/* Pause for the tracing */
  	atomic_t tracing_graph_pause;
  #endif
-@@ -1812,22 +1853,89 @@ struct task_struct {
+@@ -1812,22 +1854,89 @@ struct task_struct {
  	unsigned long	task_state_change;
  #endif
  	int pagefault_disabled;
@@ -102556,7 +103581,7 @@ index b7b9501..dc6b96f 100644
  /* Future-safe accessor for struct task_struct's cpus_allowed. */
  #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
  
-@@ -1909,7 +2017,7 @@ struct pid_namespace;
+@@ -1909,7 +2018,7 @@ struct pid_namespace;
  pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
  			struct pid_namespace *ns);
  
@@ -102565,7 +103590,7 @@ index b7b9501..dc6b96f 100644
  {
  	return tsk->pid;
  }
-@@ -2270,6 +2378,25 @@ extern u64 sched_clock_cpu(int cpu);
+@@ -2270,6 +2379,25 @@ extern u64 sched_clock_cpu(int cpu);
  
  extern void sched_clock_init(void);
  
@@ -102591,7 +103616,7 @@ index b7b9501..dc6b96f 100644
  #ifndef CONFIG_HAVE_UNSTABLE_SCHED_CLOCK
  static inline void sched_clock_tick(void)
  {
-@@ -2398,7 +2525,9 @@ extern void set_curr_task(int cpu, struct task_struct *p);
+@@ -2398,7 +2526,9 @@ extern void set_curr_task(int cpu, struct task_struct *p);
  void yield(void);
  
  union thread_union {
@@ -102601,7 +103626,7 @@ index b7b9501..dc6b96f 100644
  	unsigned long stack[THREAD_SIZE/sizeof(long)];
  };
  
-@@ -2431,6 +2560,7 @@ extern struct pid_namespace init_pid_ns;
+@@ -2431,6 +2561,7 @@ extern struct pid_namespace init_pid_ns;
   */
  
  extern struct task_struct *find_task_by_vpid(pid_t nr);
@@ -102609,7 +103634,7 @@ index b7b9501..dc6b96f 100644
  extern struct task_struct *find_task_by_pid_ns(pid_t nr,
  		struct pid_namespace *ns);
  
-@@ -2462,7 +2592,7 @@ extern void proc_caches_init(void);
+@@ -2462,7 +2593,7 @@ extern void proc_caches_init(void);
  extern void flush_signals(struct task_struct *);
  extern void ignore_signals(struct task_struct *);
  extern void flush_signal_handlers(struct task_struct *, int force_default);
@@ -102618,7 +103643,7 @@ index b7b9501..dc6b96f 100644
  
  static inline int dequeue_signal_lock(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
  {
-@@ -2608,7 +2738,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
+@@ -2608,7 +2739,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
  extern void exit_itimers(struct signal_struct *);
  extern void flush_itimer_signals(void);
  
@@ -102627,7 +103652,7 @@ index b7b9501..dc6b96f 100644
  
  extern int do_execve(struct filename *,
  		     const char __user * const __user *,
-@@ -2723,11 +2853,13 @@ static inline int thread_group_empty(struct task_struct *p)
+@@ -2723,11 +2854,13 @@ static inline int thread_group_empty(struct task_struct *p)
   * It must not be nested with write_lock_irq(&tasklist_lock),
   * neither inside nor outside.
   */
@@ -102641,7 +103666,7 @@ index b7b9501..dc6b96f 100644
  static inline void task_unlock(struct task_struct *p)
  {
  	spin_unlock(&p->alloc_lock);
-@@ -2813,9 +2945,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
+@@ -2813,9 +2946,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
  #define task_stack_end_corrupted(task) \
  		(*(end_of_stack(task)) != STACK_END_MAGIC)
  
@@ -106457,6 +107482,27 @@ index 35bac8e..8de1d69 100644
  
  	if (!access_ok(VERIFY_READ, uattr, 1))
  		return -EFAULT;
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index b074b23..36c6efe 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -1058,6 +1058,16 @@ static int check_alu_op(struct reg_state *regs, struct bpf_insn *insn)
+ 			return -EINVAL;
+ 		}
+ 
++		if ((opcode == BPF_LSH || opcode == BPF_RSH ||
++		     opcode == BPF_ARSH) && BPF_SRC(insn->code) == BPF_K) {
++			int size = BPF_CLASS(insn->code) == BPF_ALU64 ? 64 : 32;
++
++			if (insn->imm < 0 || insn->imm >= size) {
++				verbose("invalid shift %d\n", insn->imm);
++				return -EINVAL;
++			}
++		}
++
+ 		/* pattern match 'bpf_add Rx, imm' instruction */
+ 		if (opcode == BPF_ADD && BPF_CLASS(insn->code) == BPF_ALU64 &&
+ 		    regs[insn->dst_reg].type == FRAME_PTR &&
 diff --git a/kernel/capability.c b/kernel/capability.c
 index 45432b5..988f1e4 100644
 --- a/kernel/capability.c
@@ -108612,7 +109658,7 @@ index 4cccea6..4382db9 100644
  	debug_mutex_free_waiter(&waiter);
  	mutex_release(&lock->dep_map, 1, ip);
 diff --git a/kernel/module.c b/kernel/module.c
-index 8f051a1..07da01a 100644
+index 8f051a1..e1be102 100644
 --- a/kernel/module.c
 +++ b/kernel/module.c
 @@ -59,6 +59,7 @@
@@ -109532,9 +110578,16 @@ index 8f051a1..07da01a 100644
   free_unload:
  	module_unload_free(mod);
   unlink_mod:
-@@ -3572,7 +3757,8 @@ static int load_module(struct load_info *info, const char __user *uargs,
+@@ -3571,8 +3756,15 @@ static int load_module(struct load_info *info, const char __user *uargs,
+ 	synchronize_sched();
  	mutex_unlock(&module_mutex);
   free_module:
++	/*
++	 * Ftrace needs to clean up what it initialized.
++	 * This does nothing if ftrace_module_init() wasn't called,
++	 * but it must be called outside of module_mutex.
++	 */
++	ftrace_release_mod(mod);
  	/* Free lock-classes; relies on the preceding sync_rcu() */
 -	lockdep_free_key_range(mod->module_core, mod->core_size);
 +	lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
@@ -109542,7 +110595,7 @@ index 8f051a1..07da01a 100644
  
  	module_deallocate(mod, info);
   free_copy:
-@@ -3649,10 +3835,16 @@ static const char *get_ksymbol(struct module *mod,
+@@ -3649,10 +3841,16 @@ static const char *get_ksymbol(struct module *mod,
  	unsigned long nextval;
  
  	/* At worse, next value is at end of module */
@@ -109562,7 +110615,7 @@ index 8f051a1..07da01a 100644
  
  	/* Scan for closest preceding symbol, and next symbol. (ELF
  	   starts real symbols at 1). */
-@@ -3899,7 +4091,7 @@ static int m_show(struct seq_file *m, void *p)
+@@ -3899,7 +4097,7 @@ static int m_show(struct seq_file *m, void *p)
  		return 0;
  
  	seq_printf(m, "%s %u",
@@ -109571,7 +110624,7 @@ index 8f051a1..07da01a 100644
  	print_unload_info(m, mod);
  
  	/* Informative for users. */
-@@ -3908,7 +4100,7 @@ static int m_show(struct seq_file *m, void *p)
+@@ -3908,7 +4106,7 @@ static int m_show(struct seq_file *m, void *p)
  		   mod->state == MODULE_STATE_COMING ? "Loading" :
  		   "Live");
  	/* Used by oprofile and other similar tools. */
@@ -109580,7 +110633,7 @@ index 8f051a1..07da01a 100644
  
  	/* Taints info */
  	if (mod->taints)
-@@ -3944,7 +4136,17 @@ static const struct file_operations proc_modules_operations = {
+@@ -3944,7 +4142,17 @@ static const struct file_operations proc_modules_operations = {
  
  static int __init proc_modules_init(void)
  {
@@ -109598,7 +110651,7 @@ index 8f051a1..07da01a 100644
  	return 0;
  }
  module_init(proc_modules_init);
-@@ -4005,7 +4207,8 @@ struct module *__module_address(unsigned long addr)
+@@ -4005,7 +4213,8 @@ struct module *__module_address(unsigned long addr)
  {
  	struct module *mod;
  
@@ -109608,7 +110661,7 @@ index 8f051a1..07da01a 100644
  		return NULL;
  
  	module_assert_mutex_or_preempt();
-@@ -4048,11 +4251,20 @@ bool is_module_text_address(unsigned long addr)
+@@ -4048,11 +4257,20 @@ bool is_module_text_address(unsigned long addr)
   */
  struct module *__module_text_address(unsigned long addr)
  {
@@ -117431,7 +118484,7 @@ index 48ce829..4c30cd3 100644
  		return -ENOMEM;
  
 diff --git a/mm/slab.c b/mm/slab.c
-index 4fcc5dd..09e0eee 100644
+index 4fcc5dd..8fb1a86 100644
 --- a/mm/slab.c
 +++ b/mm/slab.c
 @@ -116,6 +116,7 @@
@@ -117486,6 +118539,15 @@ index 4fcc5dd..09e0eee 100644
  	slab_state = PARTIAL_NODE;
  	setup_kmalloc_cache_index_table();
  
+@@ -1691,7 +1696,7 @@ static void store_stackinfo(struct kmem_cache *cachep, unsigned long *addr,
+ 
+ 		while (!kstack_end(sptr)) {
+ 			svalue = *sptr++;
+-			if (kernel_text_address(svalue)) {
++			if (kernel_text_address(ktva_ktla(svalue))) {
+ 				*addr++ = svalue;
+ 				size -= sizeof(unsigned long);
+ 				if (size <= sizeof(unsigned long))
 @@ -2074,7 +2079,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
  
  	cachep = find_mergeable(size, align, flags, name, ctor);
@@ -120234,8 +121296,27 @@ index b94b1d2..da3ed7c 100644
  }
  EXPORT_SYMBOL(dev_load);
  
+diff --git a/net/core/dst.c b/net/core/dst.c
+index d6a5a0b..8852021 100644
+--- a/net/core/dst.c
++++ b/net/core/dst.c
+@@ -301,12 +301,13 @@ void dst_release(struct dst_entry *dst)
+ {
+ 	if (dst) {
+ 		int newrefcnt;
++		unsigned short nocache = dst->flags & DST_NOCACHE;
+ 
+ 		newrefcnt = atomic_dec_return(&dst->__refcnt);
+ 		if (unlikely(newrefcnt < 0))
+ 			net_warn_ratelimited("%s: dst:%p refcnt:%d\n",
+ 					     __func__, dst, newrefcnt);
+-		if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE))
++		if (!newrefcnt && unlikely(nocache))
+ 			call_rcu(&dst->rcu_head, dst_destroy_rcu);
+ 	}
+ }
 diff --git a/net/core/filter.c b/net/core/filter.c
-index bb18c36..90998d5 100644
+index bb18c36..a0c92a7 100644
 --- a/net/core/filter.c
 +++ b/net/core/filter.c
 @@ -584,7 +584,11 @@ do_pass:
@@ -120260,7 +121341,19 @@ index bb18c36..90998d5 100644
  
  	masks = kmalloc_array(flen, sizeof(*masks), GFP_KERNEL);
  	if (!masks)
-@@ -1057,7 +1061,7 @@ int bpf_prog_create(struct bpf_prog **pfp, struct sock_fprog_kern *fprog)
+@@ -781,6 +785,11 @@ static int bpf_check_classic(const struct sock_filter *filter,
+ 			if (ftest->k == 0)
+ 				return -EINVAL;
+ 			break;
++		case BPF_ALU | BPF_LSH | BPF_K:
++		case BPF_ALU | BPF_RSH | BPF_K:
++			if (ftest->k >= 32)
++				return -EINVAL;
++			break;
+ 		case BPF_LD | BPF_MEM:
+ 		case BPF_LDX | BPF_MEM:
+ 		case BPF_ST:
+@@ -1057,7 +1066,7 @@ int bpf_prog_create(struct bpf_prog **pfp, struct sock_fprog_kern *fprog)
  	if (!fp)
  		return -ENOMEM;
  
@@ -124776,7 +125869,7 @@ index 7ec667d..b5c2cf2 100644
  
  	sch->handle = handle;
 diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
-index e82a1ad..7def03d 100644
+index e82a1ad..a7df216b 100644
 --- a/net/sched/sch_generic.c
 +++ b/net/sched/sch_generic.c
 @@ -349,7 +349,7 @@ void netif_carrier_on(struct net_device *dev)
@@ -124797,6 +125890,18 @@ index e82a1ad..7def03d 100644
  		linkwatch_fire_event(dev);
  	}
  }
+@@ -658,8 +658,10 @@ static void qdisc_rcu_free(struct rcu_head *head)
+ {
+ 	struct Qdisc *qdisc = container_of(head, struct Qdisc, rcu_head);
+ 
+-	if (qdisc_is_percpu_stats(qdisc))
++	if (qdisc_is_percpu_stats(qdisc)) {
+ 		free_percpu(qdisc->cpu_bstats);
++		free_percpu(qdisc->cpu_qstats);
++	}
+ 
+ 	kfree((char *) qdisc - qdisc->padded);
+ }
 diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
 index e917d27..13e2a4c 100644
 --- a/net/sctp/ipv6.c
@@ -124872,9 +125977,18 @@ index 3d9ea9a..d3aee1a 100644
  
  static int sctp_v4_protosw_init(void)
 diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
-index 6098d4c..9d87fbd 100644
+index 6098d4c..9920c54 100644
 --- a/net/sctp/sm_sideeffect.c
 +++ b/net/sctp/sm_sideeffect.c
+@@ -63,7 +63,7 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
+ static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
+ 			     sctp_state_t state,
+ 			     struct sctp_endpoint *ep,
+-			     struct sctp_association *asoc,
++			     struct sctp_association **asoc,
+ 			     void *event_arg,
+ 			     sctp_disposition_t status,
+ 			     sctp_cmd_seq_t *commands,
 @@ -443,7 +443,7 @@ static void sctp_generate_sack_event(unsigned long data)
  	sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_SACK);
  }
@@ -124884,6 +125998,128 @@ index 6098d4c..9d87fbd 100644
  	NULL,
  	sctp_generate_t1_cookie_event,
  	sctp_generate_t1_init_event,
+@@ -1123,7 +1123,7 @@ int sctp_do_sm(struct net *net, sctp_event_t event_type, sctp_subtype_t subtype,
+ 	debug_post_sfn();
+ 
+ 	error = sctp_side_effects(event_type, subtype, state,
+-				  ep, asoc, event_arg, status,
++				  ep, &asoc, event_arg, status,
+ 				  &commands, gfp);
+ 	debug_post_sfx();
+ 
+@@ -1136,7 +1136,7 @@ int sctp_do_sm(struct net *net, sctp_event_t event_type, sctp_subtype_t subtype,
+ static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
+ 			     sctp_state_t state,
+ 			     struct sctp_endpoint *ep,
+-			     struct sctp_association *asoc,
++			     struct sctp_association **asoc,
+ 			     void *event_arg,
+ 			     sctp_disposition_t status,
+ 			     sctp_cmd_seq_t *commands,
+@@ -1151,7 +1151,7 @@ static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
+ 	 * disposition SCTP_DISPOSITION_CONSUME.
+ 	 */
+ 	if (0 != (error = sctp_cmd_interpreter(event_type, subtype, state,
+-					       ep, asoc,
++					       ep, *asoc,
+ 					       event_arg, status,
+ 					       commands, gfp)))
+ 		goto bail;
+@@ -1174,11 +1174,12 @@ static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
+ 		break;
+ 
+ 	case SCTP_DISPOSITION_DELETE_TCB:
++	case SCTP_DISPOSITION_ABORT:
+ 		/* This should now be a command. */
++		*asoc = NULL;
+ 		break;
+ 
+ 	case SCTP_DISPOSITION_CONSUME:
+-	case SCTP_DISPOSITION_ABORT:
+ 		/*
+ 		 * We should no longer have much work to do here as the
+ 		 * real work has been done as explicit commands above.
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index d7eaa73..9042a5d 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -2976,7 +2976,7 @@ sctp_disposition_t sctp_sf_eat_data_6_2(struct net *net,
+ 		SCTP_INC_STATS(net, SCTP_MIB_IN_DATA_CHUNK_DISCARDS);
+ 		goto discard_force;
+ 	case SCTP_IERROR_NO_DATA:
+-		goto consume;
++		return SCTP_DISPOSITION_ABORT;
+ 	case SCTP_IERROR_PROTO_VIOLATION:
+ 		return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
+ 			(u8 *)chunk->subh.data_hdr, sizeof(sctp_datahdr_t));
+@@ -3043,9 +3043,6 @@ discard_noforce:
+ 		sctp_add_cmd_sf(commands, SCTP_CMD_GEN_SACK, force);
+ 
+ 	return SCTP_DISPOSITION_DISCARD;
+-consume:
+-	return SCTP_DISPOSITION_CONSUME;
+-
+ }
+ 
+ /*
+@@ -3093,7 +3090,7 @@ sctp_disposition_t sctp_sf_eat_data_fast_4_4(struct net *net,
+ 	case SCTP_IERROR_BAD_STREAM:
+ 		break;
+ 	case SCTP_IERROR_NO_DATA:
+-		goto consume;
++		return SCTP_DISPOSITION_ABORT;
+ 	case SCTP_IERROR_PROTO_VIOLATION:
+ 		return sctp_sf_abort_violation(net, ep, asoc, chunk, commands,
+ 			(u8 *)chunk->subh.data_hdr, sizeof(sctp_datahdr_t));
+@@ -3119,7 +3116,6 @@ sctp_disposition_t sctp_sf_eat_data_fast_4_4(struct net *net,
+ 				SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
+ 	}
+ 
+-consume:
+ 	return SCTP_DISPOSITION_CONSUME;
+ }
+ 
+@@ -4825,9 +4821,6 @@ sctp_disposition_t sctp_sf_do_9_1_prm_abort(
+ 	 * if necessary to fill gaps.
+ 	 */
+ 	struct sctp_chunk *abort = arg;
+-	sctp_disposition_t retval;
+-
+-	retval = SCTP_DISPOSITION_CONSUME;
+ 
+ 	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
+ 
+@@ -4844,7 +4837,7 @@ sctp_disposition_t sctp_sf_do_9_1_prm_abort(
+ 	SCTP_INC_STATS(net, SCTP_MIB_ABORTEDS);
+ 	SCTP_DEC_STATS(net, SCTP_MIB_CURRESTAB);
+ 
+-	return retval;
++	return SCTP_DISPOSITION_ABORT;
+ }
+ 
+ /* We tried an illegal operation on an association which is closed.  */
+@@ -4959,12 +4952,10 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
+ 	sctp_cmd_seq_t *commands)
+ {
+ 	struct sctp_chunk *abort = arg;
+-	sctp_disposition_t retval;
+ 
+ 	/* Stop T1-init timer */
+ 	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
+ 			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
+-	retval = SCTP_DISPOSITION_CONSUME;
+ 
+ 	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
+ 
+@@ -4983,7 +4974,7 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(
+ 	sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
+ 			SCTP_PERR(SCTP_ERROR_USER_ABORT));
+ 
+-	return retval;
++	return SCTP_DISPOSITION_ABORT;
+ }
+ 
+ /*
 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
 index 3ec88be..a8d9d222 100644
 --- a/net/sctp/socket.c
@@ -125016,10 +126252,10 @@ index 3ec88be..a8d9d222 100644
  		return -ENOMEM;
  
 diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
-index 26d50c5..dfae665 100644
+index 26d50c5..289fe22 100644
 --- a/net/sctp/sysctl.c
 +++ b/net/sctp/sysctl.c
-@@ -317,7 +317,7 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
+@@ -317,10 +317,10 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
  				loff_t *ppos)
  {
  	struct net *net = current->nsproxy->net_ns;
@@ -125027,7 +126263,11 @@ index 26d50c5..dfae665 100644
 +	ctl_table_no_const tbl;
  	bool changed = false;
  	char *none = "none";
- 	char tmp[8];
+-	char tmp[8];
++	char tmp[8] = {0};
+ 	int ret;
+ 
+ 	memset(&tbl, 0, sizeof(struct ctl_table));
 @@ -365,7 +365,7 @@ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
  	struct net *net = current->nsproxy->net_ns;
  	unsigned int min = *(unsigned int *) ctl->extra1;
@@ -125468,7 +126708,7 @@ index 621ca7b..78bf76b 100644
  static int unix_gid_parse(struct cache_detail *cd,
  			char *mesg, int mlen)
 diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
-index 2cd252f..eefac51 100644
+index 2cd252f..94dc8cb 100644
 --- a/net/sunrpc/xprtrdma/svc_rdma.c
 +++ b/net/sunrpc/xprtrdma/svc_rdma.c
 @@ -61,15 +61,15 @@ unsigned int svcrdma_max_req_size = RPCRDMA_MAX_REQ_SIZE;
@@ -125496,6 +126736,27 @@ index 2cd252f..eefac51 100644
  
  /* Temporary NFS request map and context caches */
  struct kmem_cache *svc_rdma_map_cachep;
+@@ -87,17 +87,17 @@ static int read_reset_stat(struct ctl_table *table, int write,
+ 			   void __user *buffer, size_t *lenp,
+ 			   loff_t *ppos)
+ {
+-	atomic_t *stat = (atomic_t *)table->data;
++	atomic_unchecked_t *stat = (atomic_unchecked_t *)table->data;
+ 
+ 	if (!stat)
+ 		return -EINVAL;
+ 
+ 	if (write)
+-		atomic_set(stat, 0);
++		atomic_set_unchecked(stat, 0);
+ 	else {
+ 		char str_buf[32];
+ 		char *data;
+-		int len = snprintf(str_buf, 32, "%d\n", atomic_read(stat));
++		int len = snprintf(str_buf, 32, "%d\n", atomic_read_unchecked(stat));
+ 		if (len >= 32)
+ 			return -EFAULT;
+ 		len = strlen(str_buf);
 @@ -109,7 +109,7 @@ static int read_reset_stat(struct ctl_table *table, int write,
  		len -= *ppos;
  		if (len > *lenp)
@@ -125749,7 +127010,7 @@ index 350cca3..a108fc5 100644
  	sub->evt.event = htohl(event, sub->swap);
  	sub->evt.found_lower = htohl(found_lower, sub->swap);
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 128b098..38013fc 100644
+index 128b098..b66988b 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
 @@ -918,6 +918,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -125913,7 +127174,52 @@ index 128b098..38013fc 100644
  out:
  	return err;
  }
-@@ -2772,9 +2805,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -1498,6 +1531,21 @@ static void unix_destruct_scm(struct sk_buff *skb)
+ 	sock_wfree(skb);
+ }
+ 
++/*
++ * The "user->unix_inflight" variable is protected by the garbage
++ * collection lock, and we just read it locklessly here. If you go
++ * over the limit, there might be a tiny race in actually noticing
++ * it across threads. Tough.
++ */
++static inline bool too_many_unix_fds(struct task_struct *p)
++{
++	struct user_struct *user = current_user();
++
++	if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
++		return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
++	return false;
++}
++
+ #define MAX_RECURSION_LEVEL 4
+ 
+ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+@@ -1506,6 +1554,9 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+ 	unsigned char max_level = 0;
+ 	int unix_sock_count = 0;
+ 
++	if (too_many_unix_fds(current))
++		return -ETOOMANYREFS;
++
+ 	for (i = scm->fp->count - 1; i >= 0; i--) {
+ 		struct sock *sk = unix_get_socket(scm->fp->fp[i]);
+ 
+@@ -1527,10 +1578,8 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+ 	if (!UNIXCB(skb).fp)
+ 		return -ENOMEM;
+ 
+-	if (unix_sock_count) {
+-		for (i = scm->fp->count - 1; i >= 0; i--)
+-			unix_inflight(scm->fp->fp[i]);
+-	}
++	for (i = scm->fp->count - 1; i >= 0; i--)
++		unix_inflight(scm->fp->fp[i]);
+ 	return max_level;
+ }
+ 
+@@ -2772,9 +2821,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  		seq_puts(seq, "Num       RefCount Protocol Flags    Type St "
  			 "Inode Path\n");
  	else {
@@ -125928,7 +127234,7 @@ index 128b098..38013fc 100644
  
  		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
  			s,
-@@ -2799,10 +2836,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2799,10 +2852,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  				seq_putc(seq, '@');
  				i++;
  			}
@@ -125962,6 +127268,56 @@ index 128b098..38013fc 100644
  		seq_putc(seq, '\n');
  	}
  
+diff --git a/net/unix/garbage.c b/net/unix/garbage.c
+index a73a226..8fcdc22 100644
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -120,11 +120,11 @@ void unix_inflight(struct file *fp)
+ {
+ 	struct sock *s = unix_get_socket(fp);
+ 
++	spin_lock(&unix_gc_lock);
++
+ 	if (s) {
+ 		struct unix_sock *u = unix_sk(s);
+ 
+-		spin_lock(&unix_gc_lock);
+-
+ 		if (atomic_long_inc_return(&u->inflight) == 1) {
+ 			BUG_ON(!list_empty(&u->link));
+ 			list_add_tail(&u->link, &gc_inflight_list);
+@@ -132,25 +132,28 @@ void unix_inflight(struct file *fp)
+ 			BUG_ON(list_empty(&u->link));
+ 		}
+ 		unix_tot_inflight++;
+-		spin_unlock(&unix_gc_lock);
+ 	}
++	fp->f_cred->user->unix_inflight++;
++	spin_unlock(&unix_gc_lock);
+ }
+ 
+ void unix_notinflight(struct file *fp)
+ {
+ 	struct sock *s = unix_get_socket(fp);
+ 
++	spin_lock(&unix_gc_lock);
++
+ 	if (s) {
+ 		struct unix_sock *u = unix_sk(s);
+ 
+-		spin_lock(&unix_gc_lock);
+ 		BUG_ON(list_empty(&u->link));
+ 
+ 		if (atomic_long_dec_and_test(&u->inflight))
+ 			list_del_init(&u->link);
+ 		unix_tot_inflight--;
+-		spin_unlock(&unix_gc_lock);
+ 	}
++	fp->f_cred->user->unix_inflight--;
++	spin_unlock(&unix_gc_lock);
+ }
+ 
+ static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
 diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c
 index b3d5150..ff3a837 100644
 --- a/net/unix/sysctl_net_unix.c
@@ -131812,12 +133168,12 @@ index 0000000..7514850
 +fi
 diff --git a/tools/gcc/initify_plugin.c b/tools/gcc/initify_plugin.c
 new file mode 100644
-index 0000000..a518073
+index 0000000..9431b53
 --- /dev/null
 +++ b/tools/gcc/initify_plugin.c
-@@ -0,0 +1,581 @@
+@@ -0,0 +1,588 @@
 +/*
-+ * Copyright 2011-2016 by Emese Revfy <re.emese@gmail.com>
++ * Copyright 2015-2016 by Emese Revfy <re.emese@gmail.com>
 + * Licensed under the GPL v2, or (at your option) v3
 + *
 + * Homepage:
@@ -131836,7 +133192,7 @@ index 0000000..a518073
 +int plugin_is_GPL_compatible;
 +
 +static struct plugin_info initify_plugin_info = {
-+	.version	= "20160104",
++	.version	= "20160113",
 +	.help		= "initify_plugin\n",
 +};
 +
@@ -132022,11 +133378,18 @@ index 0000000..a518073
 +
 +static bool is_same_vardecl(const_tree op, const_tree vardecl)
 +{
++	const_tree decl;
++
 +	if (op == vardecl)
 +		return true;
-+	if (!DECL_P(op))
++	if (TREE_CODE(op) == SSA_NAME)
++		decl = SSA_NAME_VAR(op);
++	else
++		decl = op;
++	if (decl == NULL_TREE || !DECL_P(decl))
 +		return false;
-+	return DECL_NAME(op) && !strcmp(DECL_NAME_POINTER(op), DECL_NAME_POINTER(vardecl));
++
++	return DECL_NAME(decl) && !strcmp(DECL_NAME_POINTER(decl), DECL_NAME_POINTER(vardecl));
 +}
 +
 +static bool search_same_vardecl(const_tree value, const_tree vardecl)
@@ -134607,10 +135970,10 @@ index 0000000..f74d85a
 +targets += size_overflow_hash.h size_overflow_hash_aux.h disable_size_overflow_hash.h
 diff --git a/tools/gcc/size_overflow_plugin/disable_size_overflow_hash.data b/tools/gcc/size_overflow_plugin/disable_size_overflow_hash.data
 new file mode 100644
-index 0000000..5276d6e
+index 0000000..e141179
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/disable_size_overflow_hash.data
-@@ -0,0 +1,12433 @@
+@@ -0,0 +1,12434 @@
 +disable_so_interrupt_pnode_gru_message_queue_desc_4 interrupt_pnode gru_message_queue_desc 0 4 NULL
 +disable_so_bch_btree_insert_fndecl_12 bch_btree_insert fndecl 0 12 NULL
 +disable_so_macvlan_sync_address_fndecl_22 macvlan_sync_address fndecl 0 22 NULL nohasharray
@@ -147044,6 +148407,7 @@ index 0000000..5276d6e
 +enable_so_deh_location_reiserfs_de_head_7682 deh_location reiserfs_de_head 0 7682 NULL
 +enable_so_deh_offset_reiserfs_de_head_42314 deh_offset reiserfs_de_head 0 42314 NULL
 +enable_so_dsack_tcp_options_received_27706 dsack tcp_options_received 0 27706 NULL
++enable_so_inbufBits_bunzip_data_13788 inbufBits bunzip_data 0 13788 NULL
 diff --git a/tools/gcc/size_overflow_plugin/generate_size_overflow_hash.sh b/tools/gcc/size_overflow_plugin/generate_size_overflow_hash.sh
 new file mode 100644
 index 0000000..be9724d
@@ -149287,10 +150651,10 @@ index 0000000..fc58e16
 +}
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
 new file mode 100644
-index 0000000..3fc86c1
+index 0000000..0a36c4a
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,21744 @@
+@@ -0,0 +1,21743 @@
 +enable_so_recv_ctrl_pipe_us_data_0 recv_ctrl_pipe us_data 0 0 NULL
 +enable_so___earlyonly_bootmem_alloc_fndecl_3 __earlyonly_bootmem_alloc fndecl 2-3-4 3 NULL
 +enable_so_size_ttm_mem_reg_8 size ttm_mem_reg 0 8 NULL
@@ -153871,8 +155235,7 @@ index 0000000..3fc86c1
 +enable_so_usbhs_dma_calc_received_size_fndecl_13783 usbhs_dma_calc_received_size fndecl 0-3 13783 NULL
 +enable_so_build_data_key_fndecl_13784 build_data_key fndecl 2 13784 NULL
 +enable_so_iwl_trans_read_mem32_fndecl_13786 iwl_trans_read_mem32 fndecl 0 13786 NULL
-+enable_so_ept_get_level1_sp_gpa_fndecl_13788 ept_get_level1_sp_gpa fndecl 0 13788 NULL nohasharray
-+enable_so_inbufBits_bunzip_data_13788 inbufBits bunzip_data 0 13788 &enable_so_ept_get_level1_sp_gpa_fndecl_13788
++enable_so_ept_get_level1_sp_gpa_fndecl_13788 ept_get_level1_sp_gpa fndecl 0 13788 NULL
 +enable_so_smk_write_load_fndecl_13790 smk_write_load fndecl 3 13790 NULL
 +enable_so_num_channels_xilly_endpoint_13791 num_channels xilly_endpoint 0 13791 NULL
 +enable_so_tipc_conn_sendmsg_fndecl_13792 tipc_conn_sendmsg fndecl 5 13792 NULL