grsecurity-3.1-4.7.6-20160930191820160930

12 files changed, 2619 insertions, 103 deletions

diff --git a/4.7.5/0000_README b/4.7.6/0000_README
index 9104194..65ecad7 100644
--- a/4.7.5/0000_README
+++ b/4.7.6/0000_README
@@ -2,7 +2,11 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.1-4.7.5-201609261522.patch
+Patch:	1005_linux-4.7.6.patch 
+From:	http://www.kernel.org
+Desc:	Linux 4.7.6
+
+Patch:	4420_grsecurity-3.1-4.7.6-201609301918.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/4.7.6/1005_linux-4.7.6.patch b/4.7.6/1005_linux-4.7.6.patch
new file mode 100644
index 0000000..5699974
--- /dev/null
+++ b/4.7.6/1005_linux-4.7.6.patch
@@ -0,0 +1,2572 @@
+diff --git a/Makefile b/Makefile
+index dd755d1..48b0120 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 7
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+ NAME = Psychotic Stoned Sheep
+ 
+@@ -370,7 +370,7 @@ LDFLAGS_MODULE  =
+ CFLAGS_KERNEL	=
+ AFLAGS_KERNEL	=
+ LDFLAGS_vmlinux =
+-CFLAGS_GCOV	= -fprofile-arcs -ftest-coverage -fno-tree-loop-im -Wno-maybe-uninitialized
++CFLAGS_GCOV	= -fprofile-arcs -ftest-coverage -fno-tree-loop-im
+ CFLAGS_KCOV	= -fsanitize-coverage=trace-pc
+ 
+ 
+@@ -619,12 +619,13 @@ ARCH_CFLAGS :=
+ include arch/$(SRCARCH)/Makefile
+ 
+ KBUILD_CFLAGS	+= $(call cc-option,-fno-delete-null-pointer-checks,)
++KBUILD_CFLAGS	+= $(call cc-disable-warning,maybe-uninitialized,)
+ 
+ ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
+-KBUILD_CFLAGS	+= -Os $(call cc-disable-warning,maybe-uninitialized,)
++KBUILD_CFLAGS	+= -Os
+ else
+ ifdef CONFIG_PROFILE_ALL_BRANCHES
+-KBUILD_CFLAGS	+= -O2 $(call cc-disable-warning,maybe-uninitialized,)
++KBUILD_CFLAGS	+= -O2
+ else
+ KBUILD_CFLAGS   += -O2
+ endif
+diff --git a/arch/arc/Makefile b/arch/arc/Makefile
+index 85814e7..601ed17 100644
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -74,9 +74,7 @@ endif
+ ifndef CONFIG_CC_OPTIMIZE_FOR_SIZE
+ # Generic build system uses -O2, we want -O3
+ # Note: No need to add to cflags-y as that happens anyways
+-#
+-# Disable the false maybe-uninitialized warings gcc spits out at -O3
+-ARCH_CFLAGS += -O3 $(call cc-disable-warning,maybe-uninitialized,)
++ARCH_CFLAGS += -O3
+ endif
+ 
+ # small data is default for elf32 tool-chain. If not usable, disable it
+diff --git a/arch/arm/crypto/aes-ce-glue.c b/arch/arm/crypto/aes-ce-glue.c
+index da3c042..aef022a 100644
+--- a/arch/arm/crypto/aes-ce-glue.c
++++ b/arch/arm/crypto/aes-ce-glue.c
+@@ -284,7 +284,7 @@ static int ctr_encrypt(struct blkcipher_desc *desc, struct scatterlist *dst,
+ 		err = blkcipher_walk_done(desc, &walk,
+ 					  walk.nbytes % AES_BLOCK_SIZE);
+ 	}
+-	if (nbytes) {
++	if (walk.nbytes % AES_BLOCK_SIZE) {
+ 		u8 *tdst = walk.dst.virt.addr + blocks * AES_BLOCK_SIZE;
+ 		u8 *tsrc = walk.src.virt.addr + blocks * AES_BLOCK_SIZE;
+ 		u8 __aligned(8) tail[AES_BLOCK_SIZE];
+diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c
+index 5c88804..6b2aa0f 100644
+--- a/arch/arm64/crypto/aes-glue.c
++++ b/arch/arm64/crypto/aes-glue.c
+@@ -216,7 +216,7 @@ static int ctr_encrypt(struct blkcipher_desc *desc, struct scatterlist *dst,
+ 		err = blkcipher_walk_done(desc, &walk,
+ 					  walk.nbytes % AES_BLOCK_SIZE);
+ 	}
+-	if (nbytes) {
++	if (walk.nbytes % AES_BLOCK_SIZE) {
+ 		u8 *tdst = walk.dst.virt.addr + blocks * AES_BLOCK_SIZE;
+ 		u8 *tsrc = walk.src.virt.addr + blocks * AES_BLOCK_SIZE;
+ 		u8 __aligned(8) tail[AES_BLOCK_SIZE];
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index 490db85..95e32d9 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -201,12 +201,6 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ 	return ret;
+ }
+ 
+-static void smp_store_cpu_info(unsigned int cpuid)
+-{
+-	store_cpu_topology(cpuid);
+-	numa_store_cpu_info(cpuid);
+-}
+-
+ /*
+  * This is the secondary CPU boot entry.  We're using this CPUs
+  * idle thread stack, but a set of temporary page tables.
+@@ -254,7 +248,7 @@ asmlinkage void secondary_start_kernel(void)
+ 	 */
+ 	notify_cpu_starting(cpu);
+ 
+-	smp_store_cpu_info(cpu);
++	store_cpu_topology(cpu);
+ 
+ 	/*
+ 	 * OK, now it's safe to let the boot CPU continue.  Wait for
+@@ -687,10 +681,13 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
+ {
+ 	int err;
+ 	unsigned int cpu;
++	unsigned int this_cpu;
+ 
+ 	init_cpu_topology();
+ 
+-	smp_store_cpu_info(smp_processor_id());
++	this_cpu = smp_processor_id();
++	store_cpu_topology(this_cpu);
++	numa_store_cpu_info(this_cpu);
+ 
+ 	/*
+ 	 * If UP is mandated by "nosmp" (which implies "maxcpus=0"), don't set
+@@ -717,6 +714,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
+ 			continue;
+ 
+ 		set_cpu_present(cpu, true);
++		numa_store_cpu_info(cpu);
+ 	}
+ }
+ 
+diff --git a/arch/mips/Kconfig.debug b/arch/mips/Kconfig.debug
+index f0e314c..7f975b2 100644
+--- a/arch/mips/Kconfig.debug
++++ b/arch/mips/Kconfig.debug
+@@ -113,42 +113,6 @@ config SPINLOCK_TEST
+ 	help
+ 	  Add several files to the debugfs to test spinlock speed.
+ 
+-if CPU_MIPSR6
+-
+-choice
+-	prompt "Compact branch policy"
+-	default MIPS_COMPACT_BRANCHES_OPTIMAL
+-
+-config MIPS_COMPACT_BRANCHES_NEVER
+-	bool "Never (force delay slot branches)"
+-	help
+-	  Pass the -mcompact-branches=never flag to the compiler in order to
+-	  force it to always emit branches with delay slots, and make no use
+-	  of the compact branch instructions introduced by MIPSr6. This is
+-	  useful if you suspect there may be an issue with compact branches in
+-	  either the compiler or the CPU.
+-
+-config MIPS_COMPACT_BRANCHES_OPTIMAL
+-	bool "Optimal (use where beneficial)"
+-	help
+-	  Pass the -mcompact-branches=optimal flag to the compiler in order for
+-	  it to make use of compact branch instructions where it deems them
+-	  beneficial, and use branches with delay slots elsewhere. This is the
+-	  default compiler behaviour, and should be used unless you have a
+-	  reason to choose otherwise.
+-
+-config MIPS_COMPACT_BRANCHES_ALWAYS
+-	bool "Always (force compact branches)"
+-	help
+-	  Pass the -mcompact-branches=always flag to the compiler in order to
+-	  force it to always emit compact branches, making no use of branch
+-	  instructions with delay slots. This can result in more compact code
+-	  which may be beneficial in some scenarios.
+-
+-endchoice
+-
+-endif # CPU_MIPSR6
+-
+ config SCACHE_DEBUGFS
+ 	bool "L2 cache debugfs entries"
+ 	depends on DEBUG_FS
+diff --git a/arch/mips/Makefile b/arch/mips/Makefile
+index efd7a9d..598ab29 100644
+--- a/arch/mips/Makefile
++++ b/arch/mips/Makefile
+@@ -203,10 +203,6 @@ endif
+ toolchain-virt				:= $(call cc-option-yn,$(mips-cflags) -mvirt)
+ cflags-$(toolchain-virt)		+= -DTOOLCHAIN_SUPPORTS_VIRT
+ 
+-cflags-$(CONFIG_MIPS_COMPACT_BRANCHES_NEVER)	+= -mcompact-branches=never
+-cflags-$(CONFIG_MIPS_COMPACT_BRANCHES_OPTIMAL)	+= -mcompact-branches=optimal
+-cflags-$(CONFIG_MIPS_COMPACT_BRANCHES_ALWAYS)	+= -mcompact-branches=always
+-
+ #
+ # Firmware support
+ #
+diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h
+index 56584a6..83054f7 100644
+--- a/arch/mips/include/asm/asmmacro.h
++++ b/arch/mips/include/asm/asmmacro.h
+@@ -157,6 +157,7 @@
+ 	ldc1	$f28, THREAD_FPR28(\thread)
+ 	ldc1	$f30, THREAD_FPR30(\thread)
+ 	ctc1	\tmp, fcr31
++	.set	pop
+ 	.endm
+ 
+ 	.macro	fpu_restore_16odd thread
+diff --git a/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h b/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h
+index 2f82bfa..c9f5769 100644
+--- a/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h
++++ b/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h
+@@ -11,11 +11,13 @@
+ #define CP0_EBASE $15, 1
+ 
+ 	.macro  kernel_entry_setup
++#ifdef CONFIG_SMP
+ 	mfc0	t0, CP0_EBASE
+ 	andi	t0, t0, 0x3ff		# CPUNum
+ 	beqz	t0, 1f
+ 	# CPUs other than zero goto smp_bootstrap
+ 	j	smp_bootstrap
++#endif /* CONFIG_SMP */
+ 
+ 1:
+ 	.endm
+diff --git a/arch/mips/kernel/mips-r2-to-r6-emul.c b/arch/mips/kernel/mips-r2-to-r6-emul.c
+index 7ff2a55..ae77575 100644
+--- a/arch/mips/kernel/mips-r2-to-r6-emul.c
++++ b/arch/mips/kernel/mips-r2-to-r6-emul.c
+@@ -1164,7 +1164,9 @@ fpu_emul:
+ 		regs->regs[31] = r31;
+ 		regs->cp0_epc = epc;
+ 		if (!used_math()) {     /* First time FPU user.  */
++			preempt_disable();
+ 			err = init_fpu();
++			preempt_enable();
+ 			set_used_math();
+ 		}
+ 		lose_fpu(1);    /* Save FPU state for the emulator. */
+diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
+index 813ed78..45cff9f 100644
+--- a/arch/mips/kernel/process.c
++++ b/arch/mips/kernel/process.c
+@@ -591,14 +591,14 @@ int mips_set_process_fp_mode(struct task_struct *task, unsigned int value)
+ 		return -EOPNOTSUPP;
+ 
+ 	/* Avoid inadvertently triggering emulation */
+-	if ((value & PR_FP_MODE_FR) && cpu_has_fpu &&
+-	    !(current_cpu_data.fpu_id & MIPS_FPIR_F64))
++	if ((value & PR_FP_MODE_FR) && raw_cpu_has_fpu &&
++	    !(raw_current_cpu_data.fpu_id & MIPS_FPIR_F64))
+ 		return -EOPNOTSUPP;
+-	if ((value & PR_FP_MODE_FRE) && cpu_has_fpu && !cpu_has_fre)
++	if ((value & PR_FP_MODE_FRE) && raw_cpu_has_fpu && !cpu_has_fre)
+ 		return -EOPNOTSUPP;
+ 
+ 	/* FR = 0 not supported in MIPS R6 */
+-	if (!(value & PR_FP_MODE_FR) && cpu_has_fpu && cpu_has_mips_r6)
++	if (!(value & PR_FP_MODE_FR) && raw_cpu_has_fpu && cpu_has_mips_r6)
+ 		return -EOPNOTSUPP;
+ 
+ 	/* Proceed with the mode switch */
+diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
+index f9d01e9..dcf4a23 100644
+--- a/arch/mips/kernel/smp.c
++++ b/arch/mips/kernel/smp.c
+@@ -320,6 +320,9 @@ asmlinkage void start_secondary(void)
+ 	cpumask_set_cpu(cpu, &cpu_coherent_mask);
+ 	notify_cpu_starting(cpu);
+ 
++	cpumask_set_cpu(cpu, &cpu_callin_map);
++	synchronise_count_slave(cpu);
++
+ 	set_cpu_online(cpu, true);
+ 
+ 	set_cpu_sibling_map(cpu);
+@@ -327,10 +330,6 @@ asmlinkage void start_secondary(void)
+ 
+ 	calculate_cpu_foreign_map();
+ 
+-	cpumask_set_cpu(cpu, &cpu_callin_map);
+-
+-	synchronise_count_slave(cpu);
+-
+ 	/*
+ 	 * irq will be enabled in ->smp_finish(), enabling it too early
+ 	 * is dangerous.
+diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c
+index 54e1663..0b30c02 100644
+--- a/arch/mips/kernel/vdso.c
++++ b/arch/mips/kernel/vdso.c
+@@ -39,16 +39,16 @@ static struct vm_special_mapping vdso_vvar_mapping = {
+ static void __init init_vdso_image(struct mips_vdso_image *image)
+ {
+ 	unsigned long num_pages, i;
++	unsigned long data_pfn;
+ 
+ 	BUG_ON(!PAGE_ALIGNED(image->data));
+ 	BUG_ON(!PAGE_ALIGNED(image->size));
+ 
+ 	num_pages = image->size / PAGE_SIZE;
+ 
+-	for (i = 0; i < num_pages; i++) {
+-		image->mapping.pages[i] =
+-			virt_to_page(image->data + (i * PAGE_SIZE));
+-	}
++	data_pfn = __phys_to_pfn(__pa_symbol(image->data));
++	for (i = 0; i < num_pages; i++)
++		image->mapping.pages[i] = pfn_to_page(data_pfn + i);
+ }
+ 
+ static int __init init_vdso(void)
+diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
+index 7a1f7bb..b2659b9 100644
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -932,11 +932,11 @@ static void populate_pte(struct cpa_data *cpa,
+ 	}
+ }
+ 
+-static int populate_pmd(struct cpa_data *cpa,
+-			unsigned long start, unsigned long end,
+-			unsigned num_pages, pud_t *pud, pgprot_t pgprot)
++static long populate_pmd(struct cpa_data *cpa,
++			 unsigned long start, unsigned long end,
++			 unsigned num_pages, pud_t *pud, pgprot_t pgprot)
+ {
+-	unsigned int cur_pages = 0;
++	long cur_pages = 0;
+ 	pmd_t *pmd;
+ 	pgprot_t pmd_pgprot;
+ 
+@@ -1006,12 +1006,12 @@ static int populate_pmd(struct cpa_data *cpa,
+ 	return num_pages;
+ }
+ 
+-static int populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd,
+-			pgprot_t pgprot)
++static long populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd,
++			 pgprot_t pgprot)
+ {
+ 	pud_t *pud;
+ 	unsigned long end;
+-	int cur_pages = 0;
++	long cur_pages = 0;
+ 	pgprot_t pud_pgprot;
+ 
+ 	end = start + (cpa->numpages << PAGE_SHIFT);
+@@ -1067,7 +1067,7 @@ static int populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd,
+ 
+ 	/* Map trailing leftover */
+ 	if (start < end) {
+-		int tmp;
++		long tmp;
+ 
+ 		pud = pud_offset(pgd, start);
+ 		if (pud_none(*pud))
+@@ -1093,7 +1093,7 @@ static int populate_pgd(struct cpa_data *cpa, unsigned long addr)
+ 	pgprot_t pgprot = __pgprot(_KERNPG_TABLE);
+ 	pud_t *pud = NULL;	/* shut up gcc */
+ 	pgd_t *pgd_entry;
+-	int ret;
++	long ret;
+ 
+ 	pgd_entry = cpa->pgd + pgd_index(addr);
+ 
+@@ -1336,7 +1336,8 @@ static int cpa_process_alias(struct cpa_data *cpa)
+ 
+ static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias)
+ {
+-	int ret, numpages = cpa->numpages;
++	unsigned long numpages = cpa->numpages;
++	int ret;
+ 
+ 	while (numpages) {
+ 		/*
+diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
+index b226b3f..964c702 100644
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -244,7 +244,7 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
+ 	 * text and allocate a new stack because we can't rely on the
+ 	 * stack pointer being < 4GB.
+ 	 */
+-	if (!IS_ENABLED(CONFIG_EFI_MIXED))
++	if (!IS_ENABLED(CONFIG_EFI_MIXED) || efi_is_native())
+ 		return 0;
+ 
+ 	/*
+diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
+index 8cc1622..dca7bc8 100644
+--- a/crypto/blkcipher.c
++++ b/crypto/blkcipher.c
+@@ -234,6 +234,8 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc,
+ 		return blkcipher_walk_done(desc, walk, -EINVAL);
+ 	}
+ 
++	bsize = min(walk->walk_blocksize, n);
++
+ 	walk->flags &= ~(BLKCIPHER_WALK_SLOW | BLKCIPHER_WALK_COPY |
+ 			 BLKCIPHER_WALK_DIFF);
+ 	if (!scatterwalk_aligned(&walk->in, walk->alignmask) ||
+@@ -246,7 +248,6 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc,
+ 		}
+ 	}
+ 
+-	bsize = min(walk->walk_blocksize, n);
+ 	n = scatterwalk_clamp(&walk->in, n);
+ 	n = scatterwalk_clamp(&walk->out, n);
+ 
+diff --git a/crypto/echainiv.c b/crypto/echainiv.c
+index b96a8456..343a74e 100644
+--- a/crypto/echainiv.c
++++ b/crypto/echainiv.c
+@@ -1,8 +1,8 @@
+ /*
+  * echainiv: Encrypted Chain IV Generator
+  *
+- * This generator generates an IV based on a sequence number by xoring it
+- * with a salt and then encrypting it with the same key as used to encrypt
++ * This generator generates an IV based on a sequence number by multiplying
++ * it with a salt and then encrypting it with the same key as used to encrypt
+  * the plain text.  This algorithm requires that the block size be equal
+  * to the IV size.  It is mainly useful for CBC.
+  *
+@@ -23,81 +23,17 @@
+ #include <linux/err.h>
+ #include <linux/init.h>
+ #include <linux/kernel.h>
+-#include <linux/mm.h>
+ #include <linux/module.h>
+-#include <linux/percpu.h>
+-#include <linux/spinlock.h>
++#include <linux/slab.h>
+ #include <linux/string.h>
+ 
+-#define MAX_IV_SIZE 16
+-
+-static DEFINE_PER_CPU(u32 [MAX_IV_SIZE / sizeof(u32)], echainiv_iv);
+-
+-/* We don't care if we get preempted and read/write IVs from the next CPU. */
+-static void echainiv_read_iv(u8 *dst, unsigned size)
+-{
+-	u32 *a = (u32 *)dst;
+-	u32 __percpu *b = echainiv_iv;
+-
+-	for (; size >= 4; size -= 4) {
+-		*a++ = this_cpu_read(*b);
+-		b++;
+-	}
+-}
+-
+-static void echainiv_write_iv(const u8 *src, unsigned size)
+-{
+-	const u32 *a = (const u32 *)src;
+-	u32 __percpu *b = echainiv_iv;
+-
+-	for (; size >= 4; size -= 4) {
+-		this_cpu_write(*b, *a);
+-		a++;
+-		b++;
+-	}
+-}
+-
+-static void echainiv_encrypt_complete2(struct aead_request *req, int err)
+-{
+-	struct aead_request *subreq = aead_request_ctx(req);
+-	struct crypto_aead *geniv;
+-	unsigned int ivsize;
+-
+-	if (err == -EINPROGRESS)
+-		return;
+-
+-	if (err)
+-		goto out;
+-
+-	geniv = crypto_aead_reqtfm(req);
+-	ivsize = crypto_aead_ivsize(geniv);
+-
+-	echainiv_write_iv(subreq->iv, ivsize);
+-
+-	if (req->iv != subreq->iv)
+-		memcpy(req->iv, subreq->iv, ivsize);
+-
+-out:
+-	if (req->iv != subreq->iv)
+-		kzfree(subreq->iv);
+-}
+-
+-static void echainiv_encrypt_complete(struct crypto_async_request *base,
+-					 int err)
+-{
+-	struct aead_request *req = base->data;
+-
+-	echainiv_encrypt_complete2(req, err);
+-	aead_request_complete(req, err);
+-}
+-
+ static int echainiv_encrypt(struct aead_request *req)
+ {
+ 	struct crypto_aead *geniv = crypto_aead_reqtfm(req);
+ 	struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
+ 	struct aead_request *subreq = aead_request_ctx(req);
+-	crypto_completion_t compl;
+-	void *data;
++	__be64 nseqno;
++	u64 seqno;
+ 	u8 *info;
+ 	unsigned int ivsize = crypto_aead_ivsize(geniv);
+ 	int err;
+@@ -107,8 +43,6 @@ static int echainiv_encrypt(struct aead_request *req)
+ 
+ 	aead_request_set_tfm(subreq, ctx->child);
+ 
+-	compl = echainiv_encrypt_complete;
+-	data = req;
+ 	info = req->iv;
+ 
+ 	if (req->src != req->dst) {
+@@ -123,29 +57,30 @@ static int echainiv_encrypt(struct aead_request *req)
+ 			return err;
+ 	}
+ 
+-	if (unlikely(!IS_ALIGNED((unsigned long)info,
+-				 crypto_aead_alignmask(geniv) + 1))) {
+-		info = kmalloc(ivsize, req->base.flags &
+-				       CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL:
+-								  GFP_ATOMIC);
+-		if (!info)
+-			return -ENOMEM;
+-
+-		memcpy(info, req->iv, ivsize);
+-	}
+-
+-	aead_request_set_callback(subreq, req->base.flags, compl, data);
++	aead_request_set_callback(subreq, req->base.flags,
++				  req->base.complete, req->base.data);
+ 	aead_request_set_crypt(subreq, req->dst, req->dst,
+ 			       req->cryptlen, info);
+ 	aead_request_set_ad(subreq, req->assoclen);
+ 
+-	crypto_xor(info, ctx->salt, ivsize);
++	memcpy(&nseqno, info + ivsize - 8, 8);
++	seqno = be64_to_cpu(nseqno);
++	memset(info, 0, ivsize);
++
+ 	scatterwalk_map_and_copy(info, req->dst, req->assoclen, ivsize, 1);
+-	echainiv_read_iv(info, ivsize);
+ 
+-	err = crypto_aead_encrypt(subreq);
+-	echainiv_encrypt_complete2(req, err);
+-	return err;
++	do {
++		u64 a;
++
++		memcpy(&a, ctx->salt + ivsize - 8, 8);
++
++		a |= 1;
++		a *= seqno;
++
++		memcpy(info + ivsize - 8, &a, 8);
++	} while ((ivsize -= 8));
++
++	return crypto_aead_encrypt(subreq);
+ }
+ 
+ static int echainiv_decrypt(struct aead_request *req)
+@@ -192,8 +127,7 @@ static int echainiv_aead_create(struct crypto_template *tmpl,
+ 	alg = crypto_spawn_aead_alg(spawn);
+ 
+ 	err = -EINVAL;
+-	if (inst->alg.ivsize & (sizeof(u32) - 1) ||
+-	    inst->alg.ivsize > MAX_IV_SIZE)
++	if (inst->alg.ivsize & (sizeof(u64) - 1) || !inst->alg.ivsize)
+ 		goto free_inst;
+ 
+ 	inst->alg.encrypt = echainiv_encrypt;
+@@ -202,7 +136,6 @@ static int echainiv_aead_create(struct crypto_template *tmpl,
+ 	inst->alg.init = aead_init_geniv;
+ 	inst->alg.exit = aead_exit_geniv;
+ 
+-	inst->alg.base.cra_alignmask |= __alignof__(u32) - 1;
+ 	inst->alg.base.cra_ctxsize = sizeof(struct aead_geniv_ctx);
+ 	inst->alg.base.cra_ctxsize += inst->alg.ivsize;
+ 
+diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c
+index 56e1d63..6e6c760 100644
+--- a/drivers/gpu/drm/qxl/qxl_draw.c
++++ b/drivers/gpu/drm/qxl/qxl_draw.c
+@@ -136,6 +136,8 @@ static int qxl_palette_create_1bit(struct qxl_bo *palette_bo,
+ 				 * correctly globaly, since that would require
+ 				 * tracking all of our palettes. */
+ 	ret = qxl_bo_kmap(palette_bo, (void **)&pal);
++	if (ret)
++		return ret;
+ 	pal->num_ents = 2;
+ 	pal->unique = unique++;
+ 	if (visual == FB_VISUAL_TRUECOLOR || visual == FB_VISUAL_DIRECTCOLOR) {
+diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
+index 137125b..5ce71ce 100644
+--- a/drivers/i2c/busses/i2c-eg20t.c
++++ b/drivers/i2c/busses/i2c-eg20t.c
+@@ -773,13 +773,6 @@ static int pch_i2c_probe(struct pci_dev *pdev,
+ 	/* Set the number of I2C channel instance */
+ 	adap_info->ch_num = id->driver_data;
+ 
+-	ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
+-		  KBUILD_MODNAME, adap_info);
+-	if (ret) {
+-		pch_pci_err(pdev, "request_irq FAILED\n");
+-		goto err_request_irq;
+-	}
+-
+ 	for (i = 0; i < adap_info->ch_num; i++) {
+ 		pch_adap = &adap_info->pch_data[i].pch_adapter;
+ 		adap_info->pch_i2c_suspended = false;
+@@ -797,6 +790,17 @@ static int pch_i2c_probe(struct pci_dev *pdev,
+ 
+ 		pch_adap->dev.of_node = pdev->dev.of_node;
+ 		pch_adap->dev.parent = &pdev->dev;
++	}
++
++	ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
++		  KBUILD_MODNAME, adap_info);
++	if (ret) {
++		pch_pci_err(pdev, "request_irq FAILED\n");
++		goto err_request_irq;
++	}
++
++	for (i = 0; i < adap_info->ch_num; i++) {
++		pch_adap = &adap_info->pch_data[i].pch_adapter;
+ 
+ 		pch_i2c_init(&adap_info->pch_data[i]);
+ 
+diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c
+index 041050e..57256bb 100644
+--- a/drivers/i2c/busses/i2c-qup.c
++++ b/drivers/i2c/busses/i2c-qup.c
+@@ -1610,7 +1610,8 @@ static int qup_i2c_pm_resume_runtime(struct device *device)
+ #ifdef CONFIG_PM_SLEEP
+ static int qup_i2c_suspend(struct device *device)
+ {
+-	qup_i2c_pm_suspend_runtime(device);
++	if (!pm_runtime_suspended(device))
++		return qup_i2c_pm_suspend_runtime(device);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/i2c/muxes/i2c-mux-pca954x.c b/drivers/i2c/muxes/i2c-mux-pca954x.c
+index 528e755..3278ebf 100644
+--- a/drivers/i2c/muxes/i2c-mux-pca954x.c
++++ b/drivers/i2c/muxes/i2c-mux-pca954x.c
+@@ -164,7 +164,7 @@ static int pca954x_select_chan(struct i2c_mux_core *muxc, u32 chan)
+ 	/* Only select the channel if its different from the last channel */
+ 	if (data->last_chan != regval) {
+ 		ret = pca954x_reg_write(muxc->parent, client, regval);
+-		data->last_chan = regval;
++		data->last_chan = ret ? 0 : regval;
+ 	}
+ 
+ 	return ret;
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index a3a6721..be00c4b 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -3011,9 +3011,9 @@ static int fw4_ack(struct c4iw_dev *dev, struct sk_buff *skb)
+ 		PDBG("%s last streaming msg ack ep %p tid %u state %u "
+ 		     "initiator %u freeing skb\n", __func__, ep, ep->hwtid,
+ 		     state_read(&ep->com), ep->mpa_attr.initiator ? 1 : 0);
++		mutex_lock(&ep->com.mutex);
+ 		kfree_skb(ep->mpa_skb);
+ 		ep->mpa_skb = NULL;
+-		mutex_lock(&ep->com.mutex);
+ 		if (test_bit(STOP_MPA_TIMER, &ep->com.flags))
+ 			stop_ep_timer(ep);
+ 		mutex_unlock(&ep->com.mutex);
+@@ -3582,6 +3582,16 @@ int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp)
+ 			ep->com.state = ABORTING;
+ 		else {
+ 			ep->com.state = CLOSING;
++
++			/*
++			 * if we close before we see the fw4_ack() then we fix
++			 * up the timer state since we're reusing it.
++			 */
++			if (ep->mpa_skb &&
++			    test_bit(STOP_MPA_TIMER, &ep->com.flags)) {
++				clear_bit(STOP_MPA_TIMER, &ep->com.flags);
++				stop_ep_timer(ep);
++			}
+ 			start_ep_timer(ep);
+ 		}
+ 		set_bit(CLOSE_SENT, &ep->com.flags);
+diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
+index d3ef0fc..6acf69e 100644
+--- a/drivers/irqchip/irq-mips-gic.c
++++ b/drivers/irqchip/irq-mips-gic.c
+@@ -638,27 +638,6 @@ static int gic_local_irq_domain_map(struct irq_domain *d, unsigned int virq,
+ 	if (!gic_local_irq_is_routable(intr))
+ 		return -EPERM;
+ 
+-	/*
+-	 * HACK: These are all really percpu interrupts, but the rest
+-	 * of the MIPS kernel code does not use the percpu IRQ API for
+-	 * the CP0 timer and performance counter interrupts.
+-	 */
+-	switch (intr) {
+-	case GIC_LOCAL_INT_TIMER:
+-	case GIC_LOCAL_INT_PERFCTR:
+-	case GIC_LOCAL_INT_FDC:
+-		irq_set_chip_and_handler(virq,
+-					 &gic_all_vpes_local_irq_controller,
+-					 handle_percpu_irq);
+-		break;
+-	default:
+-		irq_set_chip_and_handler(virq,
+-					 &gic_local_irq_controller,
+-					 handle_percpu_devid_irq);
+-		irq_set_percpu_devid(virq);
+-		break;
+-	}
+-
+ 	spin_lock_irqsave(&gic_lock, flags);
+ 	for (i = 0; i < gic_vpes; i++) {
+ 		u32 val = GIC_MAP_TO_PIN_MSK | gic_cpu_pin;
+@@ -724,16 +703,42 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
+ 	return 0;
+ }
+ 
+-static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq,
+-			      irq_hw_number_t hw)
++static int gic_setup_dev_chip(struct irq_domain *d, unsigned int virq,
++			      unsigned int hwirq)
+ {
+-	if (GIC_HWIRQ_TO_LOCAL(hw) < GIC_NUM_LOCAL_INTRS)
+-		return gic_local_irq_domain_map(d, virq, hw);
++	struct irq_chip *chip;
++	int err;
++
++	if (hwirq >= GIC_SHARED_HWIRQ_BASE) {
++		err = irq_domain_set_hwirq_and_chip(d, virq, hwirq,
++						    &gic_level_irq_controller,
++						    NULL);
++	} else {
++		switch (GIC_HWIRQ_TO_LOCAL(hwirq)) {
++		case GIC_LOCAL_INT_TIMER:
++		case GIC_LOCAL_INT_PERFCTR:
++		case GIC_LOCAL_INT_FDC:
++			/*
++			 * HACK: These are all really percpu interrupts, but
++			 * the rest of the MIPS kernel code does not use the
++			 * percpu IRQ API for them.
++			 */
++			chip = &gic_all_vpes_local_irq_controller;
++			irq_set_handler(virq, handle_percpu_irq);
++			break;
++
++		default:
++			chip = &gic_local_irq_controller;
++			irq_set_handler(virq, handle_percpu_devid_irq);
++			irq_set_percpu_devid(virq);
++			break;
++		}
+ 
+-	irq_set_chip_and_handler(virq, &gic_level_irq_controller,
+-				 handle_level_irq);
++		err = irq_domain_set_hwirq_and_chip(d, virq, hwirq,
++						    chip, NULL);
++	}
+ 
+-	return gic_shared_irq_domain_map(d, virq, hw, 0);
++	return err;
+ }
+ 
+ static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq,
+@@ -744,15 +749,12 @@ static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq,
+ 	int cpu, ret, i;
+ 
+ 	if (spec->type == GIC_DEVICE) {
+-		/* verify that it doesn't conflict with an IPI irq */
+-		if (test_bit(spec->hwirq, ipi_resrv))
++		/* verify that shared irqs don't conflict with an IPI irq */
++		if ((spec->hwirq >= GIC_SHARED_HWIRQ_BASE) &&
++		    test_bit(GIC_HWIRQ_TO_SHARED(spec->hwirq), ipi_resrv))
+ 			return -EBUSY;
+ 
+-		hwirq = GIC_SHARED_TO_HWIRQ(spec->hwirq);
+-
+-		return irq_domain_set_hwirq_and_chip(d, virq, hwirq,
+-						     &gic_level_irq_controller,
+-						     NULL);
++		return gic_setup_dev_chip(d, virq, spec->hwirq);
+ 	} else {
+ 		base_hwirq = find_first_bit(ipi_resrv, gic_shared_intrs);
+ 		if (base_hwirq == gic_shared_intrs) {
+@@ -821,7 +823,6 @@ int gic_irq_domain_match(struct irq_domain *d, struct device_node *node,
+ }
+ 
+ static const struct irq_domain_ops gic_irq_domain_ops = {
+-	.map = gic_irq_domain_map,
+ 	.alloc = gic_irq_domain_alloc,
+ 	.free = gic_irq_domain_free,
+ 	.match = gic_irq_domain_match,
+@@ -852,29 +853,20 @@ static int gic_dev_domain_alloc(struct irq_domain *d, unsigned int virq,
+ 	struct irq_fwspec *fwspec = arg;
+ 	struct gic_irq_spec spec = {
+ 		.type = GIC_DEVICE,
+-		.hwirq = fwspec->param[1],
+ 	};
+ 	int i, ret;
+-	bool is_shared = fwspec->param[0] == GIC_SHARED;
+ 
+-	if (is_shared) {
+-		ret = irq_domain_alloc_irqs_parent(d, virq, nr_irqs, &spec);
+-		if (ret)
+-			return ret;
+-	}
+-
+-	for (i = 0; i < nr_irqs; i++) {
+-		irq_hw_number_t hwirq;
++	if (fwspec->param[0] == GIC_SHARED)
++		spec.hwirq = GIC_SHARED_TO_HWIRQ(fwspec->param[1]);
++	else
++		spec.hwirq = GIC_LOCAL_TO_HWIRQ(fwspec->param[1]);
+ 
+-		if (is_shared)
+-			hwirq = GIC_SHARED_TO_HWIRQ(spec.hwirq + i);
+-		else
+-			hwirq = GIC_LOCAL_TO_HWIRQ(spec.hwirq + i);
++	ret = irq_domain_alloc_irqs_parent(d, virq, nr_irqs, &spec);
++	if (ret)
++		return ret;
+ 
+-		ret = irq_domain_set_hwirq_and_chip(d, virq + i,
+-						    hwirq,
+-						    &gic_level_irq_controller,
+-						    NULL);
++	for (i = 0; i < nr_irqs; i++) {
++		ret = gic_setup_dev_chip(d, virq + i, spec.hwirq + i);
+ 		if (ret)
+ 			goto error;
+ 	}
+@@ -896,7 +888,10 @@ void gic_dev_domain_free(struct irq_domain *d, unsigned int virq,
+ static void gic_dev_domain_activate(struct irq_domain *domain,
+ 				    struct irq_data *d)
+ {
+-	gic_shared_irq_domain_map(domain, d->irq, d->hwirq, 0);
++	if (GIC_HWIRQ_TO_LOCAL(d->hwirq) < GIC_NUM_LOCAL_INTRS)
++		gic_local_irq_domain_map(domain, d->irq, d->hwirq);
++	else
++		gic_shared_irq_domain_map(domain, d->irq, d->hwirq, 0);
+ }
+ 
+ static struct irq_domain_ops gic_dev_domain_ops = {
+diff --git a/drivers/mtd/maps/pmcmsp-flash.c b/drivers/mtd/maps/pmcmsp-flash.c
+index 744ca5c..f9fa3fa 100644
+--- a/drivers/mtd/maps/pmcmsp-flash.c
++++ b/drivers/mtd/maps/pmcmsp-flash.c
+@@ -75,15 +75,15 @@ static int __init init_msp_flash(void)
+ 
+ 	printk(KERN_NOTICE "Found %d PMC flash devices\n", fcnt);
+ 
+-	msp_flash = kmalloc(fcnt * sizeof(struct map_info *), GFP_KERNEL);
++	msp_flash = kcalloc(fcnt, sizeof(*msp_flash), GFP_KERNEL);
+ 	if (!msp_flash)
+ 		return -ENOMEM;
+ 
+-	msp_parts = kmalloc(fcnt * sizeof(struct mtd_partition *), GFP_KERNEL);
++	msp_parts = kcalloc(fcnt, sizeof(*msp_parts), GFP_KERNEL);
+ 	if (!msp_parts)
+ 		goto free_msp_flash;
+ 
+-	msp_maps = kcalloc(fcnt, sizeof(struct mtd_info), GFP_KERNEL);
++	msp_maps = kcalloc(fcnt, sizeof(*msp_maps), GFP_KERNEL);
+ 	if (!msp_maps)
+ 		goto free_msp_parts;
+ 
+diff --git a/drivers/mtd/maps/sa1100-flash.c b/drivers/mtd/maps/sa1100-flash.c
+index 142fc3d..784c6e1 100644
+--- a/drivers/mtd/maps/sa1100-flash.c
++++ b/drivers/mtd/maps/sa1100-flash.c
+@@ -230,8 +230,10 @@ static struct sa_info *sa1100_setup_mtd(struct platform_device *pdev,
+ 
+ 		info->mtd = mtd_concat_create(cdev, info->num_subdev,
+ 					      plat->name);
+-		if (info->mtd == NULL)
++		if (info->mtd == NULL) {
+ 			ret = -ENXIO;
++			goto err;
++		}
+ 	}
+ 	info->mtd->dev.parent = &pdev->dev;
+ 
+diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
+index 5173fad..57cbe2b 100644
+--- a/drivers/mtd/nand/mxc_nand.c
++++ b/drivers/mtd/nand/mxc_nand.c
+@@ -943,7 +943,7 @@ static int mxc_v2_ooblayout_free(struct mtd_info *mtd, int section,
+ 	struct nand_chip *nand_chip = mtd_to_nand(mtd);
+ 	int stepsize = nand_chip->ecc.bytes == 9 ? 16 : 26;
+ 
+-	if (section > nand_chip->ecc.steps)
++	if (section >= nand_chip->ecc.steps)
+ 		return -ERANGE;
+ 
+ 	if (!section) {
+diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
+index c52e455..a6adb27 100644
+--- a/drivers/mtd/spi-nor/spi-nor.c
++++ b/drivers/mtd/spi-nor/spi-nor.c
+@@ -661,7 +661,7 @@ static int stm_unlock(struct spi_nor *nor, loff_t ofs, uint64_t len)
+ 	status_new = (status_old & ~mask & ~SR_TB) | val;
+ 
+ 	/* Don't protect status register if we're fully unlocked */
+-	if (lock_len == mtd->size)
++	if (lock_len == 0)
+ 		status_new &= ~SR_SRWD;
+ 
+ 	if (!use_top)
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 41c0fc9..16f7cad 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -1268,11 +1268,10 @@ static int __maybe_unused flexcan_suspend(struct device *device)
+ 	struct flexcan_priv *priv = netdev_priv(dev);
+ 	int err;
+ 
+-	err = flexcan_chip_disable(priv);
+-	if (err)
+-		return err;
+-
+ 	if (netif_running(dev)) {
++		err = flexcan_chip_disable(priv);
++		if (err)
++			return err;
+ 		netif_stop_queue(dev);
+ 		netif_device_detach(dev);
+ 	}
+@@ -1285,13 +1284,17 @@ static int __maybe_unused flexcan_resume(struct device *device)
+ {
+ 	struct net_device *dev = dev_get_drvdata(device);
+ 	struct flexcan_priv *priv = netdev_priv(dev);
++	int err;
+ 
+ 	priv->can.state = CAN_STATE_ERROR_ACTIVE;
+ 	if (netif_running(dev)) {
+ 		netif_device_attach(dev);
+ 		netif_start_queue(dev);
++		err = flexcan_chip_enable(priv);
++		if (err)
++			return err;
+ 	}
+-	return flexcan_chip_enable(priv);
++	return 0;
+ }
+ 
+ static SIMPLE_DEV_PM_OPS(flexcan_pm_ops, flexcan_suspend, flexcan_resume);
+diff --git a/drivers/net/can/ifi_canfd/ifi_canfd.c b/drivers/net/can/ifi_canfd/ifi_canfd.c
+index 2d1d22e..368bb07 100644
+--- a/drivers/net/can/ifi_canfd/ifi_canfd.c
++++ b/drivers/net/can/ifi_canfd/ifi_canfd.c
+@@ -81,6 +81,10 @@
+ #define IFI_CANFD_TIME_SET_TIMEA_4_12_6_6	BIT(15)
+ 
+ #define IFI_CANFD_TDELAY			0x1c
++#define IFI_CANFD_TDELAY_DEFAULT		0xb
++#define IFI_CANFD_TDELAY_MASK			0x3fff
++#define IFI_CANFD_TDELAY_ABS			BIT(14)
++#define IFI_CANFD_TDELAY_EN			BIT(15)
+ 
+ #define IFI_CANFD_ERROR				0x20
+ #define IFI_CANFD_ERROR_TX_OFFSET		0
+@@ -641,7 +645,7 @@ static void ifi_canfd_set_bittiming(struct net_device *ndev)
+ 	struct ifi_canfd_priv *priv = netdev_priv(ndev);
+ 	const struct can_bittiming *bt = &priv->can.bittiming;
+ 	const struct can_bittiming *dbt = &priv->can.data_bittiming;
+-	u16 brp, sjw, tseg1, tseg2;
++	u16 brp, sjw, tseg1, tseg2, tdc;
+ 
+ 	/* Configure bit timing */
+ 	brp = bt->brp - 2;
+@@ -664,6 +668,11 @@ static void ifi_canfd_set_bittiming(struct net_device *ndev)
+ 	       (brp << IFI_CANFD_TIME_PRESCALE_OFF) |
+ 	       (sjw << IFI_CANFD_TIME_SJW_OFF_7_9_8_8),
+ 	       priv->base + IFI_CANFD_FTIME);
++
++	/* Configure transmitter delay */
++	tdc = (dbt->brp * (dbt->phase_seg1 + 1)) & IFI_CANFD_TDELAY_MASK;
++	writel(IFI_CANFD_TDELAY_EN | IFI_CANFD_TDELAY_ABS | tdc,
++	       priv->base + IFI_CANFD_TDELAY);
+ }
+ 
+ static void ifi_canfd_set_filter(struct net_device *ndev, const u32 id,
+diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
+index f097c5a..3c7bcdf 100644
+--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
++++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
+@@ -743,7 +743,8 @@ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter)
+ 		}
+ 	}
+ 
+-	shhwtstamps.hwtstamp = ktime_sub_ns(shhwtstamps.hwtstamp, adjust);
++	shhwtstamps.hwtstamp =
++		ktime_add_ns(shhwtstamps.hwtstamp, adjust);
+ 
+ 	skb_tstamp_tx(adapter->ptp_tx_skb, &shhwtstamps);
+ 	dev_kfree_skb_any(adapter->ptp_tx_skb);
+@@ -766,13 +767,32 @@ void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector,
+ 			 struct sk_buff *skb)
+ {
+ 	__le64 *regval = (__le64 *)va;
++	struct igb_adapter *adapter = q_vector->adapter;
++	int adjust = 0;
+ 
+ 	/* The timestamp is recorded in little endian format.
+ 	 * DWORD: 0        1        2        3
+ 	 * Field: Reserved Reserved SYSTIML  SYSTIMH
+ 	 */
+-	igb_ptp_systim_to_hwtstamp(q_vector->adapter, skb_hwtstamps(skb),
++	igb_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb),
+ 				   le64_to_cpu(regval[1]));
++
++	/* adjust timestamp for the RX latency based on link speed */
++	if (adapter->hw.mac.type == e1000_i210) {
++		switch (adapter->link_speed) {
++		case SPEED_10:
++			adjust = IGB_I210_RX_LATENCY_10;
++			break;
++		case SPEED_100:
++			adjust = IGB_I210_RX_LATENCY_100;
++			break;
++		case SPEED_1000:
++			adjust = IGB_I210_RX_LATENCY_1000;
++			break;
++		}
++	}
++	skb_hwtstamps(skb)->hwtstamp =
++		ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust);
+ }
+ 
+ /**
+@@ -824,7 +844,7 @@ void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector,
+ 		}
+ 	}
+ 	skb_hwtstamps(skb)->hwtstamp =
+-		ktime_add_ns(skb_hwtstamps(skb)->hwtstamp, adjust);
++		ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust);
+ 
+ 	/* Update the last_rx_timestamp timer in order to enable watchdog check
+ 	 * for error case of latched timestamp on a dropped packet.
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 8bebd86..58153e8 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -4100,6 +4100,8 @@ static void ixgbe_vlan_promisc_enable(struct ixgbe_adapter *adapter)
+ 	struct ixgbe_hw *hw = &adapter->hw;
+ 	u32 vlnctrl, i;
+ 
++	vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
++
+ 	switch (hw->mac.type) {
+ 	case ixgbe_mac_82599EB:
+ 	case ixgbe_mac_X540:
+@@ -4112,8 +4114,7 @@ static void ixgbe_vlan_promisc_enable(struct ixgbe_adapter *adapter)
+ 		/* fall through */
+ 	case ixgbe_mac_82598EB:
+ 		/* legacy case, we can just disable VLAN filtering */
+-		vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+-		vlnctrl &= ~(IXGBE_VLNCTRL_VFE | IXGBE_VLNCTRL_CFIEN);
++		vlnctrl &= ~IXGBE_VLNCTRL_VFE;
+ 		IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
+ 		return;
+ 	}
+@@ -4125,6 +4126,10 @@ static void ixgbe_vlan_promisc_enable(struct ixgbe_adapter *adapter)
+ 	/* Set flag so we don't redo unnecessary work */
+ 	adapter->flags2 |= IXGBE_FLAG2_VLAN_PROMISC;
+ 
++	/* For VMDq and SR-IOV we must leave VLAN filtering enabled */
++	vlnctrl |= IXGBE_VLNCTRL_VFE;
++	IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
++
+ 	/* Add PF to all active pools */
+ 	for (i = IXGBE_VLVF_ENTRIES; --i;) {
+ 		u32 reg_offset = IXGBE_VLVFB(i * 2 + VMDQ_P(0) / 32);
+@@ -4191,6 +4196,11 @@ static void ixgbe_vlan_promisc_disable(struct ixgbe_adapter *adapter)
+ 	struct ixgbe_hw *hw = &adapter->hw;
+ 	u32 vlnctrl, i;
+ 
++	/* Set VLAN filtering to enabled */
++	vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
++	vlnctrl |= IXGBE_VLNCTRL_VFE;
++	IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
++
+ 	switch (hw->mac.type) {
+ 	case ixgbe_mac_82599EB:
+ 	case ixgbe_mac_X540:
+@@ -4202,10 +4212,6 @@ static void ixgbe_vlan_promisc_disable(struct ixgbe_adapter *adapter)
+ 			break;
+ 		/* fall through */
+ 	case ixgbe_mac_82598EB:
+-		vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+-		vlnctrl &= ~IXGBE_VLNCTRL_CFIEN;
+-		vlnctrl |= IXGBE_VLNCTRL_VFE;
+-		IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
+ 		return;
+ 	}
+ 
+@@ -9496,6 +9502,7 @@ skip_sriov:
+ 
+ 	/* copy netdev features into list of user selectable features */
+ 	netdev->hw_features |= netdev->features |
++			       NETIF_F_HW_VLAN_CTAG_FILTER |
+ 			       NETIF_F_HW_VLAN_CTAG_RX |
+ 			       NETIF_F_HW_VLAN_CTAG_TX |
+ 			       NETIF_F_RXALL |
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index 779bafc..b92b75f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -501,6 +501,15 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
+ 	int hdrlen = ieee80211_hdrlen(hdr->frame_control);
+ 	int queue;
+ 
++	/* IWL_MVM_OFFCHANNEL_QUEUE is used for ROC packets that can be used
++	 * in 2 different types of vifs, P2P & STATION. P2P uses the offchannel
++	 * queue. STATION (HS2.0) uses the auxiliary context of the FW,
++	 * and hence needs to be sent on the aux queue
++	 */
++	if (IEEE80211_SKB_CB(skb)->hw_queue == IWL_MVM_OFFCHANNEL_QUEUE &&
++	    skb_info->control.vif->type == NL80211_IFTYPE_STATION)
++		IEEE80211_SKB_CB(skb)->hw_queue = mvm->aux_queue;
++
+ 	memcpy(&info, skb->cb, sizeof(info));
+ 
+ 	if (WARN_ON_ONCE(info.flags & IEEE80211_TX_CTL_AMPDU))
+@@ -514,16 +523,6 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
+ 	/* This holds the amsdu headers length */
+ 	skb_info->driver_data[0] = (void *)(uintptr_t)0;
+ 
+-	/*
+-	 * IWL_MVM_OFFCHANNEL_QUEUE is used for ROC packets that can be used
+-	 * in 2 different types of vifs, P2P & STATION. P2P uses the offchannel
+-	 * queue. STATION (HS2.0) uses the auxiliary context of the FW,
+-	 * and hence needs to be sent on the aux queue
+-	 */
+-	if (IEEE80211_SKB_CB(skb)->hw_queue == IWL_MVM_OFFCHANNEL_QUEUE &&
+-	    info.control.vif->type == NL80211_IFTYPE_STATION)
+-		IEEE80211_SKB_CB(skb)->hw_queue = mvm->aux_queue;
+-
+ 	queue = info.hw_queue;
+ 
+ 	/*
+diff --git a/drivers/power/max17042_battery.c b/drivers/power/max17042_battery.c
+index 9c65f13..da7a75f 100644
+--- a/drivers/power/max17042_battery.c
++++ b/drivers/power/max17042_battery.c
+@@ -457,13 +457,16 @@ static inline void max17042_write_model_data(struct max17042_chip *chip,
+ }
+ 
+ static inline void max17042_read_model_data(struct max17042_chip *chip,
+-					u8 addr, u32 *data, int size)
++					u8 addr, u16 *data, int size)
+ {
+ 	struct regmap *map = chip->regmap;
+ 	int i;
++	u32 tmp;
+ 
+-	for (i = 0; i < size; i++)
+-		regmap_read(map, addr + i, &data[i]);
++	for (i = 0; i < size; i++) {
++		regmap_read(map, addr + i, &tmp);
++		data[i] = (u16)tmp;
++	}
+ }
+ 
+ static inline int max17042_model_data_compare(struct max17042_chip *chip,
+@@ -486,7 +489,7 @@ static int max17042_init_model(struct max17042_chip *chip)
+ {
+ 	int ret;
+ 	int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
+-	u32 *temp_data;
++	u16 *temp_data;
+ 
+ 	temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
+ 	if (!temp_data)
+@@ -501,7 +504,7 @@ static int max17042_init_model(struct max17042_chip *chip)
+ 	ret = max17042_model_data_compare(
+ 		chip,
+ 		chip->pdata->config_data->cell_char_tbl,
+-		(u16 *)temp_data,
++		temp_data,
+ 		table_size);
+ 
+ 	max10742_lock_model(chip);
+@@ -514,7 +517,7 @@ static int max17042_verify_model_lock(struct max17042_chip *chip)
+ {
+ 	int i;
+ 	int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
+-	u32 *temp_data;
++	u16 *temp_data;
+ 	int ret = 0;
+ 
+ 	temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
+diff --git a/drivers/power/reset/hisi-reboot.c b/drivers/power/reset/hisi-reboot.c
+index 9ab7f56..f69387e 100644
+--- a/drivers/power/reset/hisi-reboot.c
++++ b/drivers/power/reset/hisi-reboot.c
+@@ -53,13 +53,16 @@ static int hisi_reboot_probe(struct platform_device *pdev)
+ 
+ 	if (of_property_read_u32(np, "reboot-offset", &reboot_offset) < 0) {
+ 		pr_err("failed to find reboot-offset property\n");
++		iounmap(base);
+ 		return -EINVAL;
+ 	}
+ 
+ 	err = register_restart_handler(&hisi_restart_nb);
+-	if (err)
++	if (err) {
+ 		dev_err(&pdev->dev, "cannot register restart handler (err=%d)\n",
+ 			err);
++		iounmap(base);
++	}
+ 
+ 	return err;
+ }
+diff --git a/drivers/power/tps65217_charger.c b/drivers/power/tps65217_charger.c
+index 73dfae4..4c56e54 100644
+--- a/drivers/power/tps65217_charger.c
++++ b/drivers/power/tps65217_charger.c
+@@ -206,6 +206,7 @@ static int tps65217_charger_probe(struct platform_device *pdev)
+ 	if (!charger)
+ 		return -ENOMEM;
+ 
++	platform_set_drvdata(pdev, charger);
+ 	charger->tps = tps;
+ 	charger->dev = &pdev->dev;
+ 
+diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
+index 821d9c0..f25f7dc 100644
+--- a/drivers/rtc/rtc-ds1307.c
++++ b/drivers/rtc/rtc-ds1307.c
+@@ -602,6 +602,8 @@ static const struct rtc_class_ops ds13xx_rtc_ops = {
+  * Alarm support for mcp794xx devices.
+  */
+ 
++#define MCP794XX_REG_WEEKDAY		0x3
++#define MCP794XX_REG_WEEKDAY_WDAY_MASK	0x7
+ #define MCP794XX_REG_CONTROL		0x07
+ #	define MCP794XX_BIT_ALM0_EN	0x10
+ #	define MCP794XX_BIT_ALM1_EN	0x20
+@@ -1231,13 +1233,16 @@ static int ds1307_probe(struct i2c_client *client,
+ {
+ 	struct ds1307		*ds1307;
+ 	int			err = -ENODEV;
+-	int			tmp;
++	int			tmp, wday;
+ 	struct chip_desc	*chip = &chips[id->driver_data];
+ 	struct i2c_adapter	*adapter = to_i2c_adapter(client->dev.parent);
+ 	bool			want_irq = false;
+ 	bool			ds1307_can_wakeup_device = false;
+ 	unsigned char		*buf;
+ 	struct ds1307_platform_data *pdata = dev_get_platdata(&client->dev);
++	struct rtc_time		tm;
++	unsigned long		timestamp;
++
+ 	irq_handler_t	irq_handler = ds1307_irq;
+ 
+ 	static const int	bbsqi_bitpos[] = {
+@@ -1526,6 +1531,27 @@ read_rtc:
+ 				bin2bcd(tmp));
+ 	}
+ 
++	/*
++	 * Some IPs have weekday reset value = 0x1 which might not correct
++	 * hence compute the wday using the current date/month/year values
++	 */
++	ds1307_get_time(&client->dev, &tm);
++	wday = tm.tm_wday;
++	timestamp = rtc_tm_to_time64(&tm);
++	rtc_time64_to_tm(timestamp, &tm);
++
++	/*
++	 * Check if reset wday is different from the computed wday
++	 * If different then set the wday which we computed using
++	 * timestamp
++	 */
++	if (wday != tm.tm_wday) {
++		wday = i2c_smbus_read_byte_data(client, MCP794XX_REG_WEEKDAY);
++		wday = wday & ~MCP794XX_REG_WEEKDAY_WDAY_MASK;
++		wday = wday | (tm.tm_wday + 1);
++		i2c_smbus_write_byte_data(client, MCP794XX_REG_WEEKDAY, wday);
++	}
++
+ 	if (want_irq) {
+ 		device_set_wakeup_capable(&client->dev, true);
+ 		set_bit(HAS_ALARM, &ds1307->flags);
+diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
+index bb17345..5031c89 100644
+--- a/drivers/soc/tegra/pmc.c
++++ b/drivers/soc/tegra/pmc.c
+@@ -1205,6 +1205,14 @@ static int tegra_pmc_probe(struct platform_device *pdev)
+ 	struct resource *res;
+ 	int err;
+ 
++	/*
++	 * Early initialisation should have configured an initial
++	 * register mapping and setup the soc data pointer. If these
++	 * are not valid then something went badly wrong!
++	 */
++	if (WARN_ON(!pmc->base || !pmc->soc))
++		return -ENODEV;
++
+ 	err = tegra_pmc_parse_dt(pmc, pdev->dev.of_node);
+ 	if (err < 0)
+ 		return err;
+diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
+index b493909..d8e6d42 100644
+--- a/fs/autofs4/expire.c
++++ b/fs/autofs4/expire.c
+@@ -417,6 +417,7 @@ static struct dentry *should_expire(struct dentry *dentry,
+ 	}
+ 	return NULL;
+ }
++
+ /*
+  * Find an eligible tree to time-out
+  * A tree is eligible if :-
+@@ -432,6 +433,7 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
+ 	struct dentry *root = sb->s_root;
+ 	struct dentry *dentry;
+ 	struct dentry *expired;
++	struct dentry *found;
+ 	struct autofs_info *ino;
+ 
+ 	if (!root)
+@@ -442,31 +444,46 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
+ 
+ 	dentry = NULL;
+ 	while ((dentry = get_next_positive_subdir(dentry, root))) {
++		int flags = how;
++
+ 		spin_lock(&sbi->fs_lock);
+ 		ino = autofs4_dentry_ino(dentry);
+-		if (ino->flags & AUTOFS_INF_WANT_EXPIRE)
+-			expired = NULL;
+-		else
+-			expired = should_expire(dentry, mnt, timeout, how);
+-		if (!expired) {
++		if (ino->flags & AUTOFS_INF_WANT_EXPIRE) {
+ 			spin_unlock(&sbi->fs_lock);
+ 			continue;
+ 		}
++		spin_unlock(&sbi->fs_lock);
++
++		expired = should_expire(dentry, mnt, timeout, flags);
++		if (!expired)
++			continue;
++
++		spin_lock(&sbi->fs_lock);
+ 		ino = autofs4_dentry_ino(expired);
+ 		ino->flags |= AUTOFS_INF_WANT_EXPIRE;
+ 		spin_unlock(&sbi->fs_lock);
+ 		synchronize_rcu();
+-		spin_lock(&sbi->fs_lock);
+-		if (should_expire(expired, mnt, timeout, how)) {
+-			if (expired != dentry)
+-				dput(dentry);
+-			goto found;
+-		}
+ 
++		/* Make sure a reference is not taken on found if
++		 * things have changed.
++		 */
++		flags &= ~AUTOFS_EXP_LEAVES;
++		found = should_expire(expired, mnt, timeout, how);
++		if (!found || found != expired)
++			/* Something has changed, continue */
++			goto next;
++
++		if (expired != dentry)
++			dput(dentry);
++
++		spin_lock(&sbi->fs_lock);
++		goto found;
++next:
++		spin_lock(&sbi->fs_lock);
+ 		ino->flags &= ~AUTOFS_INF_WANT_EXPIRE;
++		spin_unlock(&sbi->fs_lock);
+ 		if (expired != dentry)
+ 			dput(expired);
+-		spin_unlock(&sbi->fs_lock);
+ 	}
+ 	return NULL;
+ 
+@@ -483,6 +500,7 @@ int autofs4_expire_wait(struct dentry *dentry, int rcu_walk)
+ 	struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
+ 	struct autofs_info *ino = autofs4_dentry_ino(dentry);
+ 	int status;
++	int state;
+ 
+ 	/* Block on any pending expire */
+ 	if (!(ino->flags & AUTOFS_INF_WANT_EXPIRE))
+@@ -490,8 +508,19 @@ int autofs4_expire_wait(struct dentry *dentry, int rcu_walk)
+ 	if (rcu_walk)
+ 		return -ECHILD;
+ 
++retry:
+ 	spin_lock(&sbi->fs_lock);
+-	if (ino->flags & AUTOFS_INF_EXPIRING) {
++	state = ino->flags & (AUTOFS_INF_WANT_EXPIRE | AUTOFS_INF_EXPIRING);
++	if (state == AUTOFS_INF_WANT_EXPIRE) {
++		spin_unlock(&sbi->fs_lock);
++		/*
++		 * Possibly being selected for expire, wait until
++		 * it's selected or not.
++		 */
++		schedule_timeout_uninterruptible(HZ/10);
++		goto retry;
++	}
++	if (state & AUTOFS_INF_EXPIRING) {
+ 		spin_unlock(&sbi->fs_lock);
+ 
+ 		pr_debug("waiting for expire %p name=%pd\n", dentry, dentry);
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 3722a1f..4ffcf0c 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -1634,6 +1634,9 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
+ 	int namelen;
+ 	int ret = 0;
+ 
++	if (!S_ISDIR(file_inode(file)->i_mode))
++		return -ENOTDIR;
++
+ 	ret = mnt_want_write_file(file);
+ 	if (ret)
+ 		goto out;
+@@ -1691,6 +1694,9 @@ static noinline int btrfs_ioctl_snap_create(struct file *file,
+ 	struct btrfs_ioctl_vol_args *vol_args;
+ 	int ret;
+ 
++	if (!S_ISDIR(file_inode(file)->i_mode))
++		return -ENOTDIR;
++
+ 	vol_args = memdup_user(arg, sizeof(*vol_args));
+ 	if (IS_ERR(vol_args))
+ 		return PTR_ERR(vol_args);
+@@ -1714,6 +1720,9 @@ static noinline int btrfs_ioctl_snap_create_v2(struct file *file,
+ 	bool readonly = false;
+ 	struct btrfs_qgroup_inherit *inherit = NULL;
+ 
++	if (!S_ISDIR(file_inode(file)->i_mode))
++		return -ENOTDIR;
++
+ 	vol_args = memdup_user(arg, sizeof(*vol_args));
+ 	if (IS_ERR(vol_args))
+ 		return PTR_ERR(vol_args);
+@@ -2358,6 +2367,9 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file,
+ 	int ret;
+ 	int err = 0;
+ 
++	if (!S_ISDIR(dir->i_mode))
++		return -ENOTDIR;
++
+ 	vol_args = memdup_user(arg, sizeof(*vol_args));
+ 	if (IS_ERR(vol_args))
+ 		return PTR_ERR(vol_args);
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index 0daaf7c..b1b9b48 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -1448,16 +1448,14 @@ static loff_t ceph_llseek(struct file *file, loff_t offset, int whence)
+ {
+ 	struct inode *inode = file->f_mapping->host;
+ 	loff_t i_size;
+-	int ret;
++	loff_t ret;
+ 
+ 	inode_lock(inode);
+ 
+ 	if (whence == SEEK_END || whence == SEEK_DATA || whence == SEEK_HOLE) {
+ 		ret = ceph_do_getattr(inode, CEPH_STAT_CAP_SIZE, false);
+-		if (ret < 0) {
+-			offset = ret;
++		if (ret < 0)
+ 			goto out;
+-		}
+ 	}
+ 
+ 	i_size = i_size_read(inode);
+@@ -1473,7 +1471,7 @@ static loff_t ceph_llseek(struct file *file, loff_t offset, int whence)
+ 		 * write() or lseek() might have altered it
+ 		 */
+ 		if (offset == 0) {
+-			offset = file->f_pos;
++			ret = file->f_pos;
+ 			goto out;
+ 		}
+ 		offset += file->f_pos;
+@@ -1493,11 +1491,11 @@ static loff_t ceph_llseek(struct file *file, loff_t offset, int whence)
+ 		break;
+ 	}
+ 
+-	offset = vfs_setpos(file, offset, inode->i_sb->s_maxbytes);
++	ret = vfs_setpos(file, offset, inode->i_sb->s_maxbytes);
+ 
+ out:
+ 	inode_unlock(inode);
+-	return offset;
++	return ret;
+ }
+ 
+ static inline void ceph_zero_partial_page(
+diff --git a/fs/ceph/ioctl.c b/fs/ceph/ioctl.c
+index be6b165..0946f2d 100644
+--- a/fs/ceph/ioctl.c
++++ b/fs/ceph/ioctl.c
+@@ -183,7 +183,7 @@ static long ceph_ioctl_get_dataloc(struct file *file, void __user *arg)
+ 	struct ceph_osd_client *osdc =
+ 		&ceph_sb_to_client(inode->i_sb)->client->osdc;
+ 	struct ceph_object_locator oloc;
+-	struct ceph_object_id oid;
++	CEPH_DEFINE_OID_ONSTACK(oid);
+ 	u64 len = 1, olen;
+ 	u64 tmp;
+ 	struct ceph_pg pgid;
+diff --git a/fs/configfs/file.c b/fs/configfs/file.c
+index bbc1252..2ddfa05 100644
+--- a/fs/configfs/file.c
++++ b/fs/configfs/file.c
+@@ -333,6 +333,7 @@ configfs_write_bin_file(struct file *file, const char __user *buf,
+ 		if (bin_attr->cb_max_size &&
+ 			*ppos + count > bin_attr->cb_max_size) {
+ 			len = -EFBIG;
++			goto out;
+ 		}
+ 
+ 		tbuf = vmalloc(*ppos + count);
+diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
+index 5c57654..90e46cd 100644
+--- a/fs/hostfs/hostfs_kern.c
++++ b/fs/hostfs/hostfs_kern.c
+@@ -959,10 +959,11 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)
+ 
+ 	if (S_ISLNK(root_inode->i_mode)) {
+ 		char *name = follow_link(host_root_path);
+-		if (IS_ERR(name))
++		if (IS_ERR(name)) {
+ 			err = PTR_ERR(name);
+-		else
+-			err = read_name(root_inode, name);
++			goto out_put;
++		}
++		err = read_name(root_inode, name);
+ 		kfree(name);
+ 		if (err)
+ 			goto out_put;
+diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
+index d2f97ec..e0e5f7c 100644
+--- a/fs/notify/fanotify/fanotify.c
++++ b/fs/notify/fanotify/fanotify.c
+@@ -67,18 +67,7 @@ static int fanotify_get_response(struct fsnotify_group *group,
+ 
+ 	pr_debug("%s: group=%p event=%p\n", __func__, group, event);
+ 
+-	wait_event(group->fanotify_data.access_waitq, event->response ||
+-				atomic_read(&group->fanotify_data.bypass_perm));
+-
+-	if (!event->response) {	/* bypass_perm set */
+-		/*
+-		 * Event was canceled because group is being destroyed. Remove
+-		 * it from group's event list because we are responsible for
+-		 * freeing the permission event.
+-		 */
+-		fsnotify_remove_event(group, &event->fae.fse);
+-		return 0;
+-	}
++	wait_event(group->fanotify_data.access_waitq, event->response);
+ 
+ 	/* userspace responded, convert to something usable */
+ 	switch (event->response) {
+diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
+index 8e8e6bc..a643138 100644
+--- a/fs/notify/fanotify/fanotify_user.c
++++ b/fs/notify/fanotify/fanotify_user.c
+@@ -358,16 +358,20 @@ static int fanotify_release(struct inode *ignored, struct file *file)
+ 
+ #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
+ 	struct fanotify_perm_event_info *event, *next;
++	struct fsnotify_event *fsn_event;
+ 
+ 	/*
+-	 * There may be still new events arriving in the notification queue
+-	 * but since userspace cannot use fanotify fd anymore, no event can
+-	 * enter or leave access_list by now.
++	 * Stop new events from arriving in the notification queue. since
++	 * userspace cannot use fanotify fd anymore, no event can enter or
++	 * leave access_list by now either.
+ 	 */
+-	spin_lock(&group->fanotify_data.access_lock);
+-
+-	atomic_inc(&group->fanotify_data.bypass_perm);
++	fsnotify_group_stop_queueing(group);
+ 
++	/*
++	 * Process all permission events on access_list and notification queue
++	 * and simulate reply from userspace.
++	 */
++	spin_lock(&group->fanotify_data.access_lock);
+ 	list_for_each_entry_safe(event, next, &group->fanotify_data.access_list,
+ 				 fae.fse.list) {
+ 		pr_debug("%s: found group=%p event=%p\n", __func__, group,
+@@ -379,12 +383,21 @@ static int fanotify_release(struct inode *ignored, struct file *file)
+ 	spin_unlock(&group->fanotify_data.access_lock);
+ 
+ 	/*
+-	 * Since bypass_perm is set, newly queued events will not wait for
+-	 * access response. Wake up the already sleeping ones now.
+-	 * synchronize_srcu() in fsnotify_destroy_group() will wait for all
+-	 * processes sleeping in fanotify_handle_event() waiting for access
+-	 * response and thus also for all permission events to be freed.
++	 * Destroy all non-permission events. For permission events just
++	 * dequeue them and set the response. They will be freed once the
++	 * response is consumed and fanotify_get_response() returns.
+ 	 */
++	mutex_lock(&group->notification_mutex);
++	while (!fsnotify_notify_queue_is_empty(group)) {
++		fsn_event = fsnotify_remove_first_event(group);
++		if (!(fsn_event->mask & FAN_ALL_PERM_EVENTS))
++			fsnotify_destroy_event(group, fsn_event);
++		else
++			FANOTIFY_PE(fsn_event)->response = FAN_ALLOW;
++	}
++	mutex_unlock(&group->notification_mutex);
++
++	/* Response for all permission events it set, wakeup waiters */
+ 	wake_up(&group->fanotify_data.access_waitq);
+ #endif
+ 
+@@ -755,7 +768,6 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
+ 	spin_lock_init(&group->fanotify_data.access_lock);
+ 	init_waitqueue_head(&group->fanotify_data.access_waitq);
+ 	INIT_LIST_HEAD(&group->fanotify_data.access_list);
+-	atomic_set(&group->fanotify_data.bypass_perm, 0);
+ #endif
+ 	switch (flags & FAN_ALL_CLASS_BITS) {
+ 	case FAN_CLASS_NOTIF:
+diff --git a/fs/notify/group.c b/fs/notify/group.c
+index 3e2dd85..b47f7cf 100644
+--- a/fs/notify/group.c
++++ b/fs/notify/group.c
+@@ -40,6 +40,17 @@ static void fsnotify_final_destroy_group(struct fsnotify_group *group)
+ }
+ 
+ /*
++ * Stop queueing new events for this group. Once this function returns
++ * fsnotify_add_event() will not add any new events to the group's queue.
++ */
++void fsnotify_group_stop_queueing(struct fsnotify_group *group)
++{
++	mutex_lock(&group->notification_mutex);
++	group->shutdown = true;
++	mutex_unlock(&group->notification_mutex);
++}
++
++/*
+  * Trying to get rid of a group. Remove all marks, flush all events and release
+  * the group reference.
+  * Note that another thread calling fsnotify_clear_marks_by_group() may still
+@@ -47,6 +58,14 @@ static void fsnotify_final_destroy_group(struct fsnotify_group *group)
+  */
+ void fsnotify_destroy_group(struct fsnotify_group *group)
+ {
++	/*
++	 * Stop queueing new events. The code below is careful enough to not
++	 * require this but fanotify needs to stop queuing events even before
++	 * fsnotify_destroy_group() is called and this makes the other callers
++	 * of fsnotify_destroy_group() to see the same behavior.
++	 */
++	fsnotify_group_stop_queueing(group);
++
+ 	/* clear all inode marks for this group, attach them to destroy_list */
+ 	fsnotify_detach_group_marks(group);
+ 
+diff --git a/fs/notify/notification.c b/fs/notify/notification.c
+index a95d8e0..e455e83 100644
+--- a/fs/notify/notification.c
++++ b/fs/notify/notification.c
+@@ -82,7 +82,8 @@ void fsnotify_destroy_event(struct fsnotify_group *group,
+  * Add an event to the group notification queue.  The group can later pull this
+  * event off the queue to deal with.  The function returns 0 if the event was
+  * added to the queue, 1 if the event was merged with some other queued event,
+- * 2 if the queue of events has overflown.
++ * 2 if the event was not queued - either the queue of events has overflown
++ * or the group is shutting down.
+  */
+ int fsnotify_add_event(struct fsnotify_group *group,
+ 		       struct fsnotify_event *event,
+@@ -96,6 +97,11 @@ int fsnotify_add_event(struct fsnotify_group *group,
+ 
+ 	mutex_lock(&group->notification_mutex);
+ 
++	if (group->shutdown) {
++		mutex_unlock(&group->notification_mutex);
++		return 2;
++	}
++
+ 	if (group->q_len >= group->max_events) {
+ 		ret = 2;
+ 		/* Queue overflow event only if it isn't already queued */
+@@ -126,21 +132,6 @@ queue:
+ }
+ 
+ /*
+- * Remove @event from group's notification queue. It is the responsibility of
+- * the caller to destroy the event.
+- */
+-void fsnotify_remove_event(struct fsnotify_group *group,
+-			   struct fsnotify_event *event)
+-{
+-	mutex_lock(&group->notification_mutex);
+-	if (!list_empty(&event->list)) {
+-		list_del_init(&event->list);
+-		group->q_len--;
+-	}
+-	mutex_unlock(&group->notification_mutex);
+-}
+-
+-/*
+  * Remove and return the first event from the notification list.  It is the
+  * responsibility of the caller to destroy the obtained event
+  */
+diff --git a/fs/ocfs2/cluster/tcp_internal.h b/fs/ocfs2/cluster/tcp_internal.h
+index 94b1836..b95e7df 100644
+--- a/fs/ocfs2/cluster/tcp_internal.h
++++ b/fs/ocfs2/cluster/tcp_internal.h
+@@ -44,9 +44,6 @@
+  * version here in tcp_internal.h should not need to be bumped for
+  * filesystem locking changes.
+  *
+- * New in version 12
+- *	- Negotiate hb timeout when storage is down.
+- *
+  * New in version 11
+  * 	- Negotiation of filesystem locking in the dlm join.
+  *
+@@ -78,7 +75,7 @@
+  * 	- full 64 bit i_size in the metadata lock lvbs
+  * 	- introduction of "rw" lock and pushing meta/data locking down
+  */
+-#define O2NET_PROTOCOL_VERSION 12ULL
++#define O2NET_PROTOCOL_VERSION 11ULL
+ struct o2net_handshake {
+ 	__be64	protocol_version;
+ 	__be64	connector_id;
+diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
+index cdeafb4..0bb1286 100644
+--- a/fs/ocfs2/dlm/dlmconvert.c
++++ b/fs/ocfs2/dlm/dlmconvert.c
+@@ -268,7 +268,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
+ 				  struct dlm_lock *lock, int flags, int type)
+ {
+ 	enum dlm_status status;
+-	u8 old_owner = res->owner;
+ 
+ 	mlog(0, "type=%d, convert_type=%d, busy=%d\n", lock->ml.type,
+ 	     lock->ml.convert_type, res->state & DLM_LOCK_RES_IN_PROGRESS);
+@@ -335,7 +334,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
+ 
+ 	spin_lock(&res->spinlock);
+ 	res->state &= ~DLM_LOCK_RES_IN_PROGRESS;
+-	lock->convert_pending = 0;
+ 	/* if it failed, move it back to granted queue.
+ 	 * if master returns DLM_NORMAL and then down before sending ast,
+ 	 * it may have already been moved to granted queue, reset to
+@@ -344,12 +342,14 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
+ 		if (status != DLM_NOTQUEUED)
+ 			dlm_error(status);
+ 		dlm_revert_pending_convert(res, lock);
+-	} else if ((res->state & DLM_LOCK_RES_RECOVERING) ||
+-			(old_owner != res->owner)) {
+-		mlog(0, "res %.*s is in recovering or has been recovered.\n",
+-				res->lockname.len, res->lockname.name);
++	} else if (!lock->convert_pending) {
++		mlog(0, "%s: res %.*s, owner died and lock has been moved back "
++				"to granted list, retry convert.\n",
++				dlm->name, res->lockname.len, res->lockname.name);
+ 		status = DLM_RECOVERING;
+ 	}
++
++	lock->convert_pending = 0;
+ bail:
+ 	spin_unlock(&res->spinlock);
+ 
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index 4e7b0dc..0b055bf 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -1506,7 +1506,8 @@ static int ocfs2_zero_partial_clusters(struct inode *inode,
+ 				       u64 start, u64 len)
+ {
+ 	int ret = 0;
+-	u64 tmpend, end = start + len;
++	u64 tmpend = 0;
++	u64 end = start + len;
+ 	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
+ 	unsigned int csize = osb->s_clustersize;
+ 	handle_t *handle;
+@@ -1538,18 +1539,31 @@ static int ocfs2_zero_partial_clusters(struct inode *inode,
+ 	}
+ 
+ 	/*
+-	 * We want to get the byte offset of the end of the 1st cluster.
++	 * If start is on a cluster boundary and end is somewhere in another
++	 * cluster, we have not COWed the cluster starting at start, unless
++	 * end is also within the same cluster. So, in this case, we skip this
++	 * first call to ocfs2_zero_range_for_truncate() truncate and move on
++	 * to the next one.
+ 	 */
+-	tmpend = (u64)osb->s_clustersize + (start & ~(osb->s_clustersize - 1));
+-	if (tmpend > end)
+-		tmpend = end;
++	if ((start & (csize - 1)) != 0) {
++		/*
++		 * We want to get the byte offset of the end of the 1st
++		 * cluster.
++		 */
++		tmpend = (u64)osb->s_clustersize +
++			(start & ~(osb->s_clustersize - 1));
++		if (tmpend > end)
++			tmpend = end;
+ 
+-	trace_ocfs2_zero_partial_clusters_range1((unsigned long long)start,
+-						 (unsigned long long)tmpend);
++		trace_ocfs2_zero_partial_clusters_range1(
++			(unsigned long long)start,
++			(unsigned long long)tmpend);
+ 
+-	ret = ocfs2_zero_range_for_truncate(inode, handle, start, tmpend);
+-	if (ret)
+-		mlog_errno(ret);
++		ret = ocfs2_zero_range_for_truncate(inode, handle, start,
++						    tmpend);
++		if (ret)
++			mlog_errno(ret);
++	}
+ 
+ 	if (tmpend < end) {
+ 		/*
+diff --git a/fs/reiserfs/ibalance.c b/fs/reiserfs/ibalance.c
+index b751eea..5db6f45 100644
+--- a/fs/reiserfs/ibalance.c
++++ b/fs/reiserfs/ibalance.c
+@@ -1153,8 +1153,9 @@ int balance_internal(struct tree_balance *tb,
+ 				       insert_ptr);
+ 	}
+ 
+-	memcpy(new_insert_key_addr, &new_insert_key, KEY_SIZE);
+ 	insert_ptr[0] = new_insert_ptr;
++	if (new_insert_ptr)
++		memcpy(new_insert_key_addr, &new_insert_key, KEY_SIZE);
+ 
+ 	return order;
+ }
+diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
+index e71cfbd..41c20b6 100644
+--- a/fs/xfs/xfs_buf.c
++++ b/fs/xfs/xfs_buf.c
+@@ -1531,7 +1531,7 @@ xfs_wait_buftarg(
+ 	 * ensure here that all reference counts have been dropped before we
+ 	 * start walking the LRU list.
+ 	 */
+-	drain_workqueue(btp->bt_mount->m_buf_workqueue);
++	flush_workqueue(btp->bt_mount->m_buf_workqueue);
+ 
+ 	/* loop until there is nothing left on the lru list. */
+ 	while (list_lru_count(&btp->bt_lru)) {
+diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h
+index 690985d..6b79a6b 100644
+--- a/include/linux/ceph/libceph.h
++++ b/include/linux/ceph/libceph.h
+@@ -214,8 +214,9 @@ static void erase_##name(struct rb_root *root, type *t)			\
+ }
+ 
+ #define DEFINE_RB_LOOKUP_FUNC(name, type, keyfld, nodefld)		\
++extern type __lookup_##name##_key;					\
+ static type *lookup_##name(struct rb_root *root,			\
+-			   typeof(((type *)0)->keyfld) key)		\
++			   typeof(__lookup_##name##_key.keyfld) key)	\
+ {									\
+ 	struct rb_node *n = root->rb_node;				\
+ 									\
+diff --git a/include/linux/ceph/osdmap.h b/include/linux/ceph/osdmap.h
+index 9ccf4db..21d7f04 100644
+--- a/include/linux/ceph/osdmap.h
++++ b/include/linux/ceph/osdmap.h
+@@ -115,6 +115,11 @@ static inline void ceph_oid_init(struct ceph_object_id *oid)
+ 	oid->name_len = 0;
+ }
+ 
++#define CEPH_OID_INIT_ONSTACK(oid)					\
++    ({ ceph_oid_init(&oid); oid; })
++#define CEPH_DEFINE_OID_ONSTACK(oid)					\
++	struct ceph_object_id oid = CEPH_OID_INIT_ONSTACK(oid)
++
+ static inline bool ceph_oid_empty(const struct ceph_object_id *oid)
+ {
+ 	return oid->name == oid->inline_name && !oid->name_len;
+diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
+index 29f9175..16af670 100644
+--- a/include/linux/fsnotify_backend.h
++++ b/include/linux/fsnotify_backend.h
+@@ -148,6 +148,7 @@ struct fsnotify_group {
+ 	#define FS_PRIO_1	1 /* fanotify content based access control */
+ 	#define FS_PRIO_2	2 /* fanotify pre-content access */
+ 	unsigned int priority;
++	bool shutdown;		/* group is being shut down, don't queue more events */
+ 
+ 	/* stores all fastpath marks assoc with this group so they can be cleaned on unregister */
+ 	struct mutex mark_mutex;	/* protect marks_list */
+@@ -179,7 +180,6 @@ struct fsnotify_group {
+ 			spinlock_t access_lock;
+ 			struct list_head access_list;
+ 			wait_queue_head_t access_waitq;
+-			atomic_t bypass_perm;
+ #endif /* CONFIG_FANOTIFY_ACCESS_PERMISSIONS */
+ 			int f_flags;
+ 			unsigned int max_marks;
+@@ -303,6 +303,8 @@ extern struct fsnotify_group *fsnotify_alloc_group(const struct fsnotify_ops *op
+ extern void fsnotify_get_group(struct fsnotify_group *group);
+ /* drop reference on a group from fsnotify_alloc_group */
+ extern void fsnotify_put_group(struct fsnotify_group *group);
++/* group destruction begins, stop queuing new events */
++extern void fsnotify_group_stop_queueing(struct fsnotify_group *group);
+ /* destroy group */
+ extern void fsnotify_destroy_group(struct fsnotify_group *group);
+ /* fasync handler function */
+@@ -315,8 +317,6 @@ extern int fsnotify_add_event(struct fsnotify_group *group,
+ 			      struct fsnotify_event *event,
+ 			      int (*merge)(struct list_head *,
+ 					   struct fsnotify_event *));
+-/* Remove passed event from groups notification queue */
+-extern void fsnotify_remove_event(struct fsnotify_group *group, struct fsnotify_event *event);
+ /* true if the group notification queue is empty */
+ extern bool fsnotify_notify_queue_is_empty(struct fsnotify_group *group);
+ /* return, but do not dequeue the first event on the notification queue */
+diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
+index 9735410..1f94053 100644
+--- a/include/linux/pagemap.h
++++ b/include/linux/pagemap.h
+@@ -571,56 +571,56 @@ static inline int fault_in_pages_readable(const char __user *uaddr, int size)
+  */
+ static inline int fault_in_multipages_writeable(char __user *uaddr, int size)
+ {
+-	int ret = 0;
+ 	char __user *end = uaddr + size - 1;
+ 
+ 	if (unlikely(size == 0))
+-		return ret;
++		return 0;
+ 
++	if (unlikely(uaddr > end))
++		return -EFAULT;
+ 	/*
+ 	 * Writing zeroes into userspace here is OK, because we know that if
+ 	 * the zero gets there, we'll be overwriting it.
+ 	 */
+-	while (uaddr <= end) {
+-		ret = __put_user(0, uaddr);
+-		if (ret != 0)
+-			return ret;
++	do {
++		if (unlikely(__put_user(0, uaddr) != 0))
++			return -EFAULT;
+ 		uaddr += PAGE_SIZE;
+-	}
++	} while (uaddr <= end);
+ 
+ 	/* Check whether the range spilled into the next page. */
+ 	if (((unsigned long)uaddr & PAGE_MASK) ==
+ 			((unsigned long)end & PAGE_MASK))
+-		ret = __put_user(0, end);
++		return __put_user(0, end);
+ 
+-	return ret;
++	return 0;
+ }
+ 
+ static inline int fault_in_multipages_readable(const char __user *uaddr,
+ 					       int size)
+ {
+ 	volatile char c;
+-	int ret = 0;
+ 	const char __user *end = uaddr + size - 1;
+ 
+ 	if (unlikely(size == 0))
+-		return ret;
++		return 0;
+ 
+-	while (uaddr <= end) {
+-		ret = __get_user(c, uaddr);
+-		if (ret != 0)
+-			return ret;
++	if (unlikely(uaddr > end))
++		return -EFAULT;
++
++	do {
++		if (unlikely(__get_user(c, uaddr) != 0))
++			return -EFAULT;
+ 		uaddr += PAGE_SIZE;
+-	}
++	} while (uaddr <= end);
+ 
+ 	/* Check whether the range spilled into the next page. */
+ 	if (((unsigned long)uaddr & PAGE_MASK) ==
+ 			((unsigned long)end & PAGE_MASK)) {
+-		ret = __get_user(c, end);
+-		(void)c;
++		return __get_user(c, end);
+ 	}
+ 
+-	return ret;
++	return 0;
+ }
+ 
+ int add_to_page_cache_locked(struct page *page, struct address_space *mapping,
+diff --git a/include/linux/reset.h b/include/linux/reset.h
+index 45a4abe..5daff15 100644
+--- a/include/linux/reset.h
++++ b/include/linux/reset.h
+@@ -71,14 +71,14 @@ static inline struct reset_control *__of_reset_control_get(
+ 					struct device_node *node,
+ 					const char *id, int index, int shared)
+ {
+-	return ERR_PTR(-EINVAL);
++	return ERR_PTR(-ENOTSUPP);
+ }
+ 
+ static inline struct reset_control *__devm_reset_control_get(
+ 					struct device *dev,
+ 					const char *id, int index, int shared)
+ {
+-	return ERR_PTR(-EINVAL);
++	return ERR_PTR(-ENOTSUPP);
+ }
+ 
+ #endif /* CONFIG_RESET_CONTROLLER */
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index e0be49f..129a7ca 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -6240,6 +6240,12 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd)
+ 	if (cgroup_sk_alloc_disabled)
+ 		return;
+ 
++	/* Socket clone path */
++	if (skcd->val) {
++		cgroup_get(sock_cgroup_ptr(skcd));
++		return;
++	}
++
+ 	rcu_read_lock();
+ 
+ 	while (true) {
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index fca9254..2fc1177 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -299,12 +299,12 @@ static int create_image(int platform_mode)
+ 	save_processor_state();
+ 	trace_suspend_resume(TPS("machine_suspend"), PM_EVENT_HIBERNATE, true);
+ 	error = swsusp_arch_suspend();
++	/* Restore control flow magically appears here */
++	restore_processor_state();
+ 	trace_suspend_resume(TPS("machine_suspend"), PM_EVENT_HIBERNATE, false);
+ 	if (error)
+ 		printk(KERN_ERR "PM: Error %d creating hibernation image\n",
+ 			error);
+-	/* Restore control flow magically appears here */
+-	restore_processor_state();
+ 	if (!in_suspend)
+ 		events_check_enabled = false;
+ 
+diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
+index 3a97060..f155c62 100644
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -765,9 +765,9 @@ static bool memory_bm_pfn_present(struct memory_bitmap *bm, unsigned long pfn)
+  */
+ static bool rtree_next_node(struct memory_bitmap *bm)
+ {
+-	bm->cur.node = list_entry(bm->cur.node->list.next,
+-				  struct rtree_node, list);
+-	if (&bm->cur.node->list != &bm->cur.zone->leaves) {
++	if (!list_is_last(&bm->cur.node->list, &bm->cur.zone->leaves)) {
++		bm->cur.node = list_entry(bm->cur.node->list.next,
++					  struct rtree_node, list);
+ 		bm->cur.node_pfn += BM_BITS_PER_BLOCK;
+ 		bm->cur.node_bit  = 0;
+ 		touch_softlockup_watchdog();
+@@ -775,9 +775,9 @@ static bool rtree_next_node(struct memory_bitmap *bm)
+ 	}
+ 
+ 	/* No more nodes, goto next zone */
+-	bm->cur.zone = list_entry(bm->cur.zone->list.next,
++	if (!list_is_last(&bm->cur.zone->list, &bm->zones)) {
++		bm->cur.zone = list_entry(bm->cur.zone->list.next,
+ 				  struct mem_zone_bm_rtree, list);
+-	if (&bm->cur.zone->list != &bm->zones) {
+ 		bm->cur.node = list_entry(bm->cur.zone->leaves.next,
+ 					  struct rtree_node, list);
+ 		bm->cur.node_pfn = 0;
+diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile
+index 979e7bf..d0a1617 100644
+--- a/kernel/trace/Makefile
++++ b/kernel/trace/Makefile
+@@ -1,4 +1,8 @@
+ 
++# We are fully aware of the dangers of __builtin_return_address()
++FRAME_CFLAGS := $(call cc-disable-warning,frame-address)
++KBUILD_CFLAGS += $(FRAME_CFLAGS)
++
+ # Do not instrument the tracer itself:
+ 
+ ifdef CONFIG_FUNCTION_TRACER
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 8a4bd6b..77eeab2 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -4890,19 +4890,20 @@ tracing_read_pipe(struct file *filp, char __user *ubuf,
+ 	struct trace_iterator *iter = filp->private_data;
+ 	ssize_t sret;
+ 
+-	/* return any leftover data */
+-	sret = trace_seq_to_user(&iter->seq, ubuf, cnt);
+-	if (sret != -EBUSY)
+-		return sret;
+-
+-	trace_seq_init(&iter->seq);
+-
+ 	/*
+ 	 * Avoid more than one consumer on a single file descriptor
+ 	 * This is just a matter of traces coherency, the ring buffer itself
+ 	 * is protected.
+ 	 */
+ 	mutex_lock(&iter->mutex);
++
++	/* return any leftover data */
++	sret = trace_seq_to_user(&iter->seq, ubuf, cnt);
++	if (sret != -EBUSY)
++		goto out;
++
++	trace_seq_init(&iter->seq);
++
+ 	if (iter->trace->read) {
+ 		sret = iter->trace->read(iter, filp, ubuf, cnt, ppos);
+ 		if (sret)
+@@ -5929,9 +5930,6 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
+ 		return -EBUSY;
+ #endif
+ 
+-	if (splice_grow_spd(pipe, &spd))
+-		return -ENOMEM;
+-
+ 	if (*ppos & (PAGE_SIZE - 1))
+ 		return -EINVAL;
+ 
+@@ -5941,6 +5939,9 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
+ 		len &= PAGE_MASK;
+ 	}
+ 
++	if (splice_grow_spd(pipe, &spd))
++		return -ENOMEM;
++
+  again:
+ 	trace_access_lock(iter->cpu_file);
+ 	entries = ring_buffer_entries_cpu(iter->trace_buffer->buffer, iter->cpu_file);
+@@ -5998,19 +5999,21 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
+ 	/* did we read anything? */
+ 	if (!spd.nr_pages) {
+ 		if (ret)
+-			return ret;
++			goto out;
+ 
++		ret = -EAGAIN;
+ 		if ((file->f_flags & O_NONBLOCK) || (flags & SPLICE_F_NONBLOCK))
+-			return -EAGAIN;
++			goto out;
+ 
+ 		ret = wait_on_pipe(iter, true);
+ 		if (ret)
+-			return ret;
++			goto out;
+ 
+ 		goto again;
+ 	}
+ 
+ 	ret = splice_to_pipe(pipe, &spd);
++out:
+ 	splice_shrink_spd(&spd);
+ 
+ 	return ret;
+diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
+index 6845f92..50e92c5 100644
+--- a/mm/kasan/kasan.c
++++ b/mm/kasan/kasan.c
+@@ -562,7 +562,7 @@ void kasan_kmalloc(struct kmem_cache *cache, const void *object, size_t size,
+ 	unsigned long redzone_start;
+ 	unsigned long redzone_end;
+ 
+-	if (flags & __GFP_RECLAIM)
++	if (gfpflags_allow_blocking(flags))
+ 		quarantine_reduce();
+ 
+ 	if (unlikely(object == NULL))
+@@ -595,7 +595,7 @@ void kasan_kmalloc_large(const void *ptr, size_t size, gfp_t flags)
+ 	unsigned long redzone_start;
+ 	unsigned long redzone_end;
+ 
+-	if (flags & __GFP_RECLAIM)
++	if (gfpflags_allow_blocking(flags))
+ 		quarantine_reduce();
+ 
+ 	if (unlikely(ptr == NULL))
+diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c
+index 65793f1..a04887c 100644
+--- a/mm/kasan/quarantine.c
++++ b/mm/kasan/quarantine.c
+@@ -196,7 +196,7 @@ void quarantine_put(struct kasan_free_meta *info, struct kmem_cache *cache)
+ 
+ void quarantine_reduce(void)
+ {
+-	size_t new_quarantine_size;
++	size_t new_quarantine_size, percpu_quarantines;
+ 	unsigned long flags;
+ 	struct qlist_head to_free = QLIST_INIT;
+ 	size_t size_to_free = 0;
+@@ -214,7 +214,12 @@ void quarantine_reduce(void)
+ 	 */
+ 	new_quarantine_size = (READ_ONCE(totalram_pages) << PAGE_SHIFT) /
+ 		QUARANTINE_FRACTION;
+-	new_quarantine_size -= QUARANTINE_PERCPU_SIZE * num_online_cpus();
++	percpu_quarantines = QUARANTINE_PERCPU_SIZE * num_online_cpus();
++	if (WARN_ONCE(new_quarantine_size < percpu_quarantines,
++		"Too little memory, disabling global KASAN quarantine.\n"))
++		new_quarantine_size = 0;
++	else
++		new_quarantine_size -= percpu_quarantines;
+ 	WRITE_ONCE(quarantine_size, new_quarantine_size);
+ 
+ 	last = global_quarantine.head;
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index ca847d9..fcb5b8c 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1797,17 +1797,22 @@ static DEFINE_MUTEX(percpu_charge_mutex);
+ static bool consume_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
+ {
+ 	struct memcg_stock_pcp *stock;
++	unsigned long flags;
+ 	bool ret = false;
+ 
+ 	if (nr_pages > CHARGE_BATCH)
+ 		return ret;
+ 
+-	stock = &get_cpu_var(memcg_stock);
++	local_irq_save(flags);
++
++	stock = this_cpu_ptr(&memcg_stock);
+ 	if (memcg == stock->cached && stock->nr_pages >= nr_pages) {
+ 		stock->nr_pages -= nr_pages;
+ 		ret = true;
+ 	}
+-	put_cpu_var(memcg_stock);
++
++	local_irq_restore(flags);
++
+ 	return ret;
+ }
+ 
+@@ -1828,15 +1833,18 @@ static void drain_stock(struct memcg_stock_pcp *stock)
+ 	stock->cached = NULL;
+ }
+ 
+-/*
+- * This must be called under preempt disabled or must be called by
+- * a thread which is pinned to local cpu.
+- */
+ static void drain_local_stock(struct work_struct *dummy)
+ {
+-	struct memcg_stock_pcp *stock = this_cpu_ptr(&memcg_stock);
++	struct memcg_stock_pcp *stock;
++	unsigned long flags;
++
++	local_irq_save(flags);
++
++	stock = this_cpu_ptr(&memcg_stock);
+ 	drain_stock(stock);
+ 	clear_bit(FLUSHING_CACHED_CHARGE, &stock->flags);
++
++	local_irq_restore(flags);
+ }
+ 
+ /*
+@@ -1845,14 +1853,19 @@ static void drain_local_stock(struct work_struct *dummy)
+  */
+ static void refill_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
+ {
+-	struct memcg_stock_pcp *stock = &get_cpu_var(memcg_stock);
++	struct memcg_stock_pcp *stock;
++	unsigned long flags;
++
++	local_irq_save(flags);
+ 
++	stock = this_cpu_ptr(&memcg_stock);
+ 	if (stock->cached != memcg) { /* reset if necessary */
+ 		drain_stock(stock);
+ 		stock->cached = memcg;
+ 	}
+ 	stock->nr_pages += nr_pages;
+-	put_cpu_var(memcg_stock);
++
++	local_irq_restore(flags);
+ }
+ 
+ /*
+diff --git a/mm/page_io.c b/mm/page_io.c
+index 242dba0..dc1af1e 100644
+--- a/mm/page_io.c
++++ b/mm/page_io.c
+@@ -262,6 +262,7 @@ int __swap_writepage(struct page *page, struct writeback_control *wbc,
+ 	int ret, rw = WRITE;
+ 	struct swap_info_struct *sis = page_swap_info(page);
+ 
++	BUG_ON(!PageSwapCache(page));
+ 	if (sis->flags & SWP_FILE) {
+ 		struct kiocb kiocb;
+ 		struct file *swap_file = sis->swap_file;
+@@ -333,6 +334,7 @@ int swap_readpage(struct page *page)
+ 	int ret = 0;
+ 	struct swap_info_struct *sis = page_swap_info(page);
+ 
++	BUG_ON(!PageSwapCache(page));
+ 	VM_BUG_ON_PAGE(!PageLocked(page), page);
+ 	VM_BUG_ON_PAGE(PageUptodate(page), page);
+ 	if (frontswap_load(page) == 0) {
+@@ -381,6 +383,7 @@ int swap_set_page_dirty(struct page *page)
+ 
+ 	if (sis->flags & SWP_FILE) {
+ 		struct address_space *mapping = sis->swap_file->f_mapping;
++		BUG_ON(!PageSwapCache(page));
+ 		return mapping->a_ops->set_page_dirty(page);
+ 	} else {
+ 		return __set_page_dirty_no_writeback(page);
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index 031713ab..46502f5 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -2724,7 +2724,6 @@ int swapcache_prepare(swp_entry_t entry)
+ struct swap_info_struct *page_swap_info(struct page *page)
+ {
+ 	swp_entry_t swap = { .val = page_private(page) };
+-	BUG_ON(!PageSwapCache(page));
+ 	return swap_info[swp_type(swap)];
+ }
+ 
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index c4a2f45..38a2691 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2150,23 +2150,6 @@ out:
+ 	}
+ }
+ 
+-#ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
+-static void init_tlb_ubc(void)
+-{
+-	/*
+-	 * This deliberately does not clear the cpumask as it's expensive
+-	 * and unnecessary. If there happens to be data in there then the
+-	 * first SWAP_CLUSTER_MAX pages will send an unnecessary IPI and
+-	 * then will be cleared.
+-	 */
+-	current->tlb_ubc.flush_required = false;
+-}
+-#else
+-static inline void init_tlb_ubc(void)
+-{
+-}
+-#endif /* CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH */
+-
+ /*
+  * This is a basic per-zone page freer.  Used by both kswapd and direct reclaim.
+  */
+@@ -2202,8 +2185,6 @@ static void shrink_zone_memcg(struct zone *zone, struct mem_cgroup *memcg,
+ 	scan_adjusted = (global_reclaim(sc) && !current_is_kswapd() &&
+ 			 sc->priority == DEF_PRIORITY);
+ 
+-	init_tlb_ubc();
+-
+ 	blk_start_plug(&plug);
+ 	while (nr[LRU_INACTIVE_ANON] || nr[LRU_ACTIVE_FILE] ||
+ 					nr[LRU_INACTIVE_FILE]) {
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index 8946959..aee117f 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -4187,7 +4187,7 @@ static struct ceph_msg *alloc_msg_with_page_vector(struct ceph_msg_header *hdr)
+ 
+ 		pages = ceph_alloc_page_vector(calc_pages_for(0, data_len),
+ 					       GFP_NOIO);
+-		if (!pages) {
++		if (IS_ERR(pages)) {
+ 			ceph_msg_put(m);
+ 			return NULL;
+ 		}
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 25dab8b..fd7b41e 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1362,7 +1362,6 @@ static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
+ 		if (!try_module_get(prot->owner))
+ 			goto out_free_sec;
+ 		sk_tx_queue_clear(sk);
+-		cgroup_sk_alloc(&sk->sk_cgrp_data);
+ 	}
+ 
+ 	return sk;
+@@ -1422,6 +1421,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
+ 		sock_net_set(sk, net);
+ 		atomic_set(&sk->sk_wmem_alloc, 1);
+ 
++		cgroup_sk_alloc(&sk->sk_cgrp_data);
+ 		sock_update_classid(&sk->sk_cgrp_data);
+ 		sock_update_netprioidx(&sk->sk_cgrp_data);
+ 	}
+@@ -1566,6 +1566,9 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
+ 		newsk->sk_priority = 0;
+ 		newsk->sk_incoming_cpu = raw_smp_processor_id();
+ 		atomic64_set(&newsk->sk_cookie, 0);
++
++		cgroup_sk_alloc(&newsk->sk_cgrp_data);
++
+ 		/*
+ 		 * Before updating sk_refcnt, we must commit prior changes to memory
+ 		 * (Documentation/RCU/rculist_nulls.txt for details)
+diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
+index 3a8f881..0a7305a 100644
+--- a/net/mac80211/agg-rx.c
++++ b/net/mac80211/agg-rx.c
+@@ -261,10 +261,16 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
+ 		.timeout = timeout,
+ 		.ssn = start_seq_num,
+ 	};
+-
+ 	int i, ret = -EOPNOTSUPP;
+ 	u16 status = WLAN_STATUS_REQUEST_DECLINED;
+ 
++	if (tid >= IEEE80211_FIRST_TSPEC_TSID) {
++		ht_dbg(sta->sdata,
++		       "STA %pM requests BA session on unsupported tid %d\n",
++		       sta->sta.addr, tid);
++		goto end_no_lock;
++	}
++
+ 	if (!sta->sta.ht_cap.ht_supported) {
+ 		ht_dbg(sta->sdata,
+ 		       "STA %pM erroneously requests BA session on tid %d w/o QoS\n",
+diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
+index 42fa810..744ad1c 100644
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -580,6 +580,9 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
+ 	    ieee80211_hw_check(&local->hw, TX_AMPDU_SETUP_IN_HW))
+ 		return -EINVAL;
+ 
++	if (WARN_ON(tid >= IEEE80211_FIRST_TSPEC_TSID))
++		return -EINVAL;
++
+ 	ht_dbg(sdata, "Open BA session requested for %pM tid %u\n",
+ 	       pubsta->addr, tid);
+ 
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 7d72283..7d38dd6 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -6811,7 +6811,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
+ 
+ 		params.n_counter_offsets_presp = len / sizeof(u16);
+ 		if (rdev->wiphy.max_num_csa_counters &&
+-		    (params.n_counter_offsets_beacon >
++		    (params.n_counter_offsets_presp >
+ 		     rdev->wiphy.max_num_csa_counters))
+ 			return -EINVAL;
+ 
+diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan
+index 77ce538..8ab6867 100644
+--- a/scripts/Makefile.ubsan
++++ b/scripts/Makefile.ubsan
+@@ -14,8 +14,4 @@ ifdef CONFIG_UBSAN
+ ifdef CONFIG_UBSAN_ALIGNMENT
+       CFLAGS_UBSAN += $(call cc-option, -fsanitize=alignment)
+ endif
+-
+-      # -fsanitize=* options makes GCC less smart than usual and
+-      # increase number of 'maybe-uninitialized false-positives
+-      CFLAGS_UBSAN += $(call cc-option, -Wno-maybe-uninitialized)
+ endif
+diff --git a/scripts/package/builddeb b/scripts/package/builddeb
+index 86e56fe..202d6e7 100755
+--- a/scripts/package/builddeb
++++ b/scripts/package/builddeb
+@@ -322,12 +322,12 @@ fi
+ 
+ # Build kernel header package
+ (cd $srctree; find . -name Makefile\* -o -name Kconfig\* -o -name \*.pl) > "$objtree/debian/hdrsrcfiles"
+-if grep -q '^CONFIG_STACK_VALIDATION=y' $KCONFIG_CONFIG ; then
+-	(cd $srctree; find tools/objtool -type f -executable) >> "$objtree/debian/hdrsrcfiles"
+-fi
+ (cd $srctree; find arch/*/include include scripts -type f) >> "$objtree/debian/hdrsrcfiles"
+ (cd $srctree; find arch/$SRCARCH -name module.lds -o -name Kbuild.platforms -o -name Platform) >> "$objtree/debian/hdrsrcfiles"
+ (cd $srctree; find $(find arch/$SRCARCH -name include -o -name scripts -type d) -type f) >> "$objtree/debian/hdrsrcfiles"
++if grep -q '^CONFIG_STACK_VALIDATION=y' $KCONFIG_CONFIG ; then
++	(cd $objtree; find tools/objtool -type f -executable) >> "$objtree/debian/hdrobjfiles"
++fi
+ (cd $objtree; find arch/$SRCARCH/include Module.symvers include scripts -type f) >> "$objtree/debian/hdrobjfiles"
+ destdir=$kernel_headers_dir/usr/src/linux-headers-$version
+ mkdir -p "$destdir"
+diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
+index 5adbfc3..17a0610 100644
+--- a/security/keys/encrypted-keys/encrypted.c
++++ b/security/keys/encrypted-keys/encrypted.c
+@@ -29,6 +29,7 @@
+ #include <linux/rcupdate.h>
+ #include <linux/scatterlist.h>
+ #include <linux/ctype.h>
++#include <crypto/aes.h>
+ #include <crypto/hash.h>
+ #include <crypto/sha.h>
+ #include <crypto/skcipher.h>
+@@ -478,6 +479,7 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
+ 	struct crypto_skcipher *tfm;
+ 	struct skcipher_request *req;
+ 	unsigned int encrypted_datalen;
++	u8 iv[AES_BLOCK_SIZE];
+ 	unsigned int padlen;
+ 	char pad[16];
+ 	int ret;
+@@ -500,8 +502,8 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
+ 	sg_init_table(sg_out, 1);
+ 	sg_set_buf(sg_out, epayload->encrypted_data, encrypted_datalen);
+ 
+-	skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen,
+-				   epayload->iv);
++	memcpy(iv, epayload->iv, sizeof(iv));
++	skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
+ 	ret = crypto_skcipher_encrypt(req);
+ 	tfm = crypto_skcipher_reqtfm(req);
+ 	skcipher_request_free(req);
+@@ -581,6 +583,7 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
+ 	struct crypto_skcipher *tfm;
+ 	struct skcipher_request *req;
+ 	unsigned int encrypted_datalen;
++	u8 iv[AES_BLOCK_SIZE];
+ 	char pad[16];
+ 	int ret;
+ 
+@@ -599,8 +602,8 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
+ 		   epayload->decrypted_datalen);
+ 	sg_set_buf(&sg_out[1], pad, sizeof pad);
+ 
+-	skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen,
+-				   epayload->iv);
++	memcpy(iv, epayload->iv, sizeof(iv));
++	skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
+ 	ret = crypto_skcipher_decrypt(req);
+ 	tfm = crypto_skcipher_reqtfm(req);
+ 	skcipher_request_free(req);
diff --git a/4.7.5/4420_grsecurity-3.1-4.7.5-201609261522.patch b/4.7.6/4420_grsecurity-3.1-4.7.6-201609301918.patch
index 9169f89..c2732fa 100644
--- a/4.7.5/4420_grsecurity-3.1-4.7.5-201609261522.patch
+++ b/4.7.6/4420_grsecurity-3.1-4.7.6-201609301918.patch
@@ -420,7 +420,7 @@ index a3683ce..5ec8bf4 100644
  
  A toggle value indicating if modules are allowed to be loaded
 diff --git a/Makefile b/Makefile
-index dd755d19..b480d63 100644
+index 48b0120..b7cbcd2 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -443,7 +443,7 @@ index dd755d19..b480d63 100644
  	$(Q)$(MAKE) $(build)=$(@)
  
  # Objects we will link into vmlinux / subdirs we need to visit
-@@ -633,6 +635,8 @@ endif
+@@ -634,6 +636,8 @@ endif
  # Tell gcc to never replace conditional load with a non-conditional one
  KBUILD_CFLAGS	+= $(call cc-option,--param=allow-store-data-races=0)
  
@@ -452,7 +452,7 @@ index dd755d19..b480d63 100644
  ifdef CONFIG_READABLE_ASM
  # Disable optimizations that make assembler listings hard to read.
  # reorder blocks reorders the control in the function
-@@ -734,7 +738,7 @@ KBUILD_CFLAGS   += $(call cc-option, -gsplit-dwarf, -g)
+@@ -735,7 +739,7 @@ KBUILD_CFLAGS   += $(call cc-option, -gsplit-dwarf, -g)
  else
  KBUILD_CFLAGS	+= -g
  endif
@@ -461,7 +461,7 @@ index dd755d19..b480d63 100644
  endif
  ifdef CONFIG_DEBUG_INFO_DWARF4
  KBUILD_CFLAGS	+= $(call cc-option, -gdwarf-4,)
-@@ -909,7 +913,7 @@ export mod_sign_cmd
+@@ -910,7 +914,7 @@ export mod_sign_cmd
  
  
  ifeq ($(KBUILD_EXTMOD),)
@@ -470,7 +470,7 @@ index dd755d19..b480d63 100644
  
  vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
  		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-@@ -1028,7 +1032,7 @@ prepare1: prepare2 $(version_h) include/generated/utsrelease.h \
+@@ -1029,7 +1033,7 @@ prepare1: prepare2 $(version_h) include/generated/utsrelease.h \
  
  archprepare: archheaders archscripts prepare1 scripts_basic
  
@@ -479,7 +479,7 @@ index dd755d19..b480d63 100644
  	$(Q)$(MAKE) $(build)=.
  
  # All the preparing..
-@@ -1247,7 +1251,11 @@ MRPROPER_FILES += .config .config.old .version .old_version \
+@@ -1248,7 +1252,11 @@ MRPROPER_FILES += .config .config.old .version .old_version \
  		  Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS \
  		  signing_key.pem signing_key.priv signing_key.x509	\
  		  x509.genkey extra_certificates signing_key.x509.keyid	\
@@ -492,7 +492,7 @@ index dd755d19..b480d63 100644
  
  # clean - Delete most, but leave enough to build external modules
  #
-@@ -1286,7 +1294,7 @@ distclean: mrproper
+@@ -1287,7 +1295,7 @@ distclean: mrproper
  	@find $(srctree) $(RCS_FIND_IGNORE) \
  		\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
  		-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
@@ -501,7 +501,7 @@ index dd755d19..b480d63 100644
  		-type f -print | xargs rm -f
  
  
-@@ -1509,6 +1517,7 @@ clean: $(clean-dirs)
+@@ -1510,6 +1518,7 @@ clean: $(clean-dirs)
  		-o -name '.*.d' -o -name '.*.tmp' -o -name '*.mod.c' \
  		-o -name '*.symtypes' -o -name 'modules.order' \
  		-o -name modules.builtin -o -name '.tmp_*.o.*' \
@@ -1532,7 +1532,7 @@ index 75fe66b..2255c86 100644
  /*
   * Memory returned by kmalloc() may be used for DMA, so we must make
 diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
-index 9156fc3..9791d17 100644
+index 9156fc3..0521e3e 100644
 --- a/arch/arm/include/asm/cacheflush.h
 +++ b/arch/arm/include/asm/cacheflush.h
 @@ -116,7 +116,7 @@ struct cpu_cache_fns {
@@ -1540,7 +1540,7 @@ index 9156fc3..9791d17 100644
  
  	void (*dma_flush_range)(const void *, const void *);
 -};
-+} __no_const;
++} __no_const __no_randomize_layout;
  
  /*
   * Select the calling method
@@ -6839,7 +6839,7 @@ index adda3ff..ac067e2 100644
  
  	/* Run the generated entry code */
 diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
-index 813ed78..0acf903 100644
+index 45cff9f..f3eae55 100644
 --- a/arch/mips/kernel/process.c
 +++ b/arch/mips/kernel/process.c
 @@ -531,18 +531,6 @@ out:
@@ -37343,7 +37343,7 @@ index 9c086c5..421e25b 100644
  	unsigned long uninitialized_var(pfn_align);
  	int i, nid;
 diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
-index 7a1f7bb..5b4b5cc 100644
+index b2659b9..5715042 100644
 --- a/arch/x86/mm/pageattr.c
 +++ b/arch/x86/mm/pageattr.c
 @@ -258,7 +258,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
@@ -37454,16 +37454,6 @@ index 7a1f7bb..5b4b5cc 100644
  			cpa->flags |= CPA_FLUSHTLB;
  		}
  		cpa->numpages = 1;
-@@ -1336,7 +1362,8 @@ static int cpa_process_alias(struct cpa_data *cpa)
- 
- static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias)
- {
--	int ret, numpages = cpa->numpages;
-+	int ret;
-+	unsigned long numpages = cpa->numpages;
- 
- 	while (numpages) {
- 		/*
 diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
 index 5431a32..137f092 100644
 --- a/arch/x86/mm/pat.c
@@ -38826,7 +38816,7 @@ index 338402b9..29ea50ab 100644
  	gdt_descr.size = GDT_SIZE - 1;
  	load_gdt(&gdt_descr);
 diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
-index b226b3f..c9a3540 100644
+index 964c702..142ffdb 100644
 --- a/arch/x86/platform/efi/efi_64.c
 +++ b/arch/x86/platform/efi/efi_64.c
 @@ -91,6 +91,11 @@ pgd_t * __init efi_call_phys_prolog(void)
@@ -60062,7 +60052,7 @@ index ad535a8..b7e3ad7 100644
  	.maxtype	= IFLA_CAN_MAX,
  	.policy		= can_policy,
 diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
-index 41c0fc9..517f7e3 100644
+index 16f7cad..e643cf4 100644
 --- a/drivers/net/can/flexcan.c
 +++ b/drivers/net/can/flexcan.c
 @@ -465,7 +465,7 @@ static int flexcan_get_berr_counter(const struct net_device *dev,
@@ -62922,10 +62912,10 @@ index b0778ba..ed4357a 100644
  	struct net_device *netdev = pci_get_drvdata(pdev);
  	struct igbvf_adapter *adapter = netdev_priv(netdev);
 diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
-index 8bebd86..61406f4 100644
+index 58153e8..a159edd 100644
 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
 +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
-@@ -9818,7 +9818,7 @@ static void ixgbe_remove(struct pci_dev *pdev)
+@@ -9825,7 +9825,7 @@ static void ixgbe_remove(struct pci_dev *pdev)
   * this device has been detected.
   */
  static pci_ers_result_t ixgbe_io_error_detected(struct pci_dev *pdev,
@@ -66671,7 +66661,7 @@ index 4fdc3da..4f63dd9 100644
  				     ((u64)seq.tkip.iv32 << 16));
  			break;
 diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
-index 779bafc..6ec6ea1 100644
+index b92b75f..04a4e09 100644
 --- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
 +++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
 @@ -405,7 +405,7 @@ static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm,
@@ -70872,7 +70862,7 @@ index a6d9434..dc26b71 100644
  
  	case RTC_PIE_ON:
 diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
-index 821d9c0..d71c3b5 100644
+index f25f7dc..e89a400 100644
 --- a/drivers/rtc/rtc-ds1307.c
 +++ b/drivers/rtc/rtc-ds1307.c
 @@ -111,7 +111,7 @@ struct ds1307 {
@@ -113224,7 +113214,7 @@ index a80a741..f28c9c9 100644
  	}
  
 diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
-index 8e8e6bc..211eeca 100644
+index a643138..4b88993 100644
 --- a/fs/notify/fanotify/fanotify_user.c
 +++ b/fs/notify/fanotify/fanotify_user.c
 @@ -216,8 +216,8 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
@@ -113239,7 +113229,7 @@ index 8e8e6bc..211eeca 100644
  
  #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
 diff --git a/fs/notify/notification.c b/fs/notify/notification.c
-index a95d8e0..a91a5fd 100644
+index e455e83..6e2b732 100644
 --- a/fs/notify/notification.c
 +++ b/fs/notify/notification.c
 @@ -48,7 +48,7 @@
@@ -134397,7 +134387,7 @@ index 113ee62..70198a7 100644
  	spinlock_t                      lock ____cacheline_aligned;
  	unsigned int			processed;
 diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
-index 9735410..701e42e 100644
+index 1f94053..b668cf9 100644
 --- a/include/linux/pagemap.h
 +++ b/include/linux/pagemap.h
 @@ -215,7 +215,7 @@ static inline struct page *page_cache_alloc_readahead(struct address_space *x)
@@ -140039,7 +140029,7 @@ index 00411c8..aaad585 100644
 +}
 +EXPORT_SYMBOL(capable_wrt_inode_uidgid_nolog);
 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index e0be49f..d599a0e 100644
+index 129a7ca..4fa9405 100644
 --- a/kernel/cgroup.c
 +++ b/kernel/cgroup.c
 @@ -3632,7 +3632,7 @@ static int cgroup_add_file(struct cgroup_subsys_state *css, struct cgroup *cgrp,
@@ -140134,7 +140124,7 @@ index e0be49f..d599a0e 100644
  	spin_lock_irq(&css_set_lock);
  	path = cgroup_path_ns_locked(cgrp, pathbuf, PATH_MAX, &init_cgroup_ns);
  	spin_unlock_irq(&css_set_lock);
-@@ -6465,7 +6477,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
+@@ -6471,7 +6483,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
  		struct task_struct *task;
  		int count = 0;
  
@@ -143386,13 +143376,13 @@ index 68d3ebc..554935d 100644
  	select LZO_COMPRESS
  	select LZO_DECOMPRESS
 diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
-index fca9254..a40591f 100644
+index 2fc1177..6abfde0a 100644
 --- a/kernel/power/hibernate.c
 +++ b/kernel/power/hibernate.c
 @@ -305,8 +305,10 @@ static int create_image(int platform_mode)
+ 	if (error)
+ 		printk(KERN_ERR "PM: Error %d creating hibernation image\n",
  			error);
- 	/* Restore control flow magically appears here */
- 	restore_processor_state();
 -	if (!in_suspend)
 +	if (!in_suspend) {
  		events_check_enabled = false;
@@ -143458,7 +143448,7 @@ index 0c2ee97..63229a6 100644
  
  		if (pm_wakeup_pending()) {
 diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
-index 3a97060..12c1d4e 100644
+index f155c62..facb59e 100644
 --- a/kernel/power/snapshot.c
 +++ b/kernel/power/snapshot.c
 @@ -1032,6 +1032,26 @@ void free_basic_memory_bitmaps(void)
@@ -146500,7 +146490,7 @@ index 9c14373..5ddd763 100644
  		*data_page = bpage;
  
 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index 8a4bd6b..3b741d7 100644
+index 77eeab2..f8ac159 100644
 --- a/kernel/trace/trace.c
 +++ b/kernel/trace/trace.c
 @@ -3649,7 +3649,7 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
@@ -148749,7 +148739,7 @@ index 93fb63e..0aa6448 100644
  	if (end == start)
  		return error;
 diff --git a/mm/memcontrol.c b/mm/memcontrol.c
-index ca847d9..3582387 100644
+index fcb5b8c..5551323 100644
 --- a/mm/memcontrol.c
 +++ b/mm/memcontrol.c
 @@ -723,7 +723,7 @@ static void memcg_check_events(struct mem_cgroup *memcg, struct page *page)
@@ -153133,7 +153123,7 @@ index 90530ff..9735082 100644
  }
  
 diff --git a/mm/swapfile.c b/mm/swapfile.c
-index 031713ab..f2c0e55 100644
+index 46502f5..59af784 100644
 --- a/mm/swapfile.c
 +++ b/mm/swapfile.c
 @@ -90,7 +90,7 @@ static DEFINE_MUTEX(swapon_mutex);
@@ -155512,7 +155502,7 @@ index eb12d21..3551c47 100644
  }
  
 diff --git a/net/core/sock.c b/net/core/sock.c
-index 25dab8b..51aa624 100644
+index fd7b41e..71dae11 100644
 --- a/net/core/sock.c
 +++ b/net/core/sock.c
 @@ -411,13 +411,13 @@ int __sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
@@ -155653,10 +155643,10 @@ index 25dab8b..51aa624 100644
  		newsk->sk_incoming_cpu = raw_smp_processor_id();
 -		atomic64_set(&newsk->sk_cookie, 0);
 +		atomic64_set_unchecked(&newsk->sk_cookie, 0);
- 		/*
- 		 * Before updating sk_refcnt, we must commit prior changes to memory
- 		 * (Documentation/RCU/rculist_nulls.txt for details)
-@@ -2494,7 +2497,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+ 
+ 		cgroup_sk_alloc(&newsk->sk_cgrp_data);
+ 
+@@ -2497,7 +2500,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
  	 */
  	smp_wmb();
  	atomic_set(&sk->sk_refcnt, 1);
@@ -155665,7 +155655,7 @@ index 25dab8b..51aa624 100644
  }
  EXPORT_SYMBOL(sock_init_data);
  
-@@ -2618,6 +2621,7 @@ void sock_enable_timestamp(struct sock *sk, int flag)
+@@ -2621,6 +2624,7 @@ void sock_enable_timestamp(struct sock *sk, int flag)
  int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
  		       int level, int type)
  {
@@ -155673,7 +155663,7 @@ index 25dab8b..51aa624 100644
  	struct sock_exterr_skb *serr;
  	struct sk_buff *skb;
  	int copied, err;
-@@ -2639,7 +2643,8 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+@@ -2642,7 +2646,8 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
  	sock_recv_timestamp(msg, sk, skb);
  
  	serr = SKB_EXT_ERR(skb);
@@ -155683,7 +155673,7 @@ index 25dab8b..51aa624 100644
  
  	msg->msg_flags |= MSG_ERRQUEUE;
  	err = copied;
-@@ -3091,7 +3096,7 @@ static __net_exit void proto_exit_net(struct net *net)
+@@ -3094,7 +3099,7 @@ static __net_exit void proto_exit_net(struct net *net)
  }
  
  
@@ -213489,12 +213479,12 @@ index 71b4a8a..dcb89c5 100644
  rm -f $(2) $(objtree)/.scmversion
  
 diff --git a/scripts/package/builddeb b/scripts/package/builddeb
-index 86e56fe..4d4418a 100755
+index 202d6e7..4184398 100755
 --- a/scripts/package/builddeb
 +++ b/scripts/package/builddeb
-@@ -329,6 +329,7 @@ fi
- (cd $srctree; find arch/$SRCARCH -name module.lds -o -name Kbuild.platforms -o -name Platform) >> "$objtree/debian/hdrsrcfiles"
- (cd $srctree; find $(find arch/$SRCARCH -name include -o -name scripts -type d) -type f) >> "$objtree/debian/hdrsrcfiles"
+@@ -329,6 +329,7 @@ if grep -q '^CONFIG_STACK_VALIDATION=y' $KCONFIG_CONFIG ; then
+ 	(cd $objtree; find tools/objtool -type f -executable) >> "$objtree/debian/hdrobjfiles"
+ fi
  (cd $objtree; find arch/$SRCARCH/include Module.symvers include scripts -type f) >> "$objtree/debian/hdrobjfiles"
 +(cd $objtree; find scripts/gcc-plugins -name \*.so -o -name gcc-common.h) >> "$objtree/debian/hdrobjfiles"
  destdir=$kernel_headers_dir/usr/src/linux-headers-$version
@@ -214904,56 +214894,6 @@ index 552705d..9920f4fb 100644
  	key = ima_hash_key(entry->digest);
  	hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
  	return 0;
-diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
-index 5adbfc3..17a0610 100644
---- a/security/keys/encrypted-keys/encrypted.c
-+++ b/security/keys/encrypted-keys/encrypted.c
-@@ -29,6 +29,7 @@
- #include <linux/rcupdate.h>
- #include <linux/scatterlist.h>
- #include <linux/ctype.h>
-+#include <crypto/aes.h>
- #include <crypto/hash.h>
- #include <crypto/sha.h>
- #include <crypto/skcipher.h>
-@@ -478,6 +479,7 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
- 	struct crypto_skcipher *tfm;
- 	struct skcipher_request *req;
- 	unsigned int encrypted_datalen;
-+	u8 iv[AES_BLOCK_SIZE];
- 	unsigned int padlen;
- 	char pad[16];
- 	int ret;
-@@ -500,8 +502,8 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
- 	sg_init_table(sg_out, 1);
- 	sg_set_buf(sg_out, epayload->encrypted_data, encrypted_datalen);
- 
--	skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen,
--				   epayload->iv);
-+	memcpy(iv, epayload->iv, sizeof(iv));
-+	skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
- 	ret = crypto_skcipher_encrypt(req);
- 	tfm = crypto_skcipher_reqtfm(req);
- 	skcipher_request_free(req);
-@@ -581,6 +583,7 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
- 	struct crypto_skcipher *tfm;
- 	struct skcipher_request *req;
- 	unsigned int encrypted_datalen;
-+	u8 iv[AES_BLOCK_SIZE];
- 	char pad[16];
- 	int ret;
- 
-@@ -599,8 +602,8 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
- 		   epayload->decrypted_datalen);
- 	sg_set_buf(&sg_out[1], pad, sizeof pad);
- 
--	skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen,
--				   epayload->iv);
-+	memcpy(iv, epayload->iv, sizeof(iv));
-+	skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
- 	ret = crypto_skcipher_decrypt(req);
- 	tfm = crypto_skcipher_reqtfm(req);
- 	skcipher_request_free(req);
 diff --git a/security/keys/internal.h b/security/keys/internal.h
 index a705a7d..898c675 100644
 --- a/security/keys/internal.h
diff --git a/4.7.5/4425_grsec_remove_EI_PAX.patch b/4.7.6/4425_grsec_remove_EI_PAX.patch
index ba92792..ba92792 100644
--- a/4.7.5/4425_grsec_remove_EI_PAX.patch
+++ b/4.7.6/4425_grsec_remove_EI_PAX.patch
diff --git a/4.7.5/4427_force_XATTR_PAX_tmpfs.patch b/4.7.6/4427_force_XATTR_PAX_tmpfs.patch
index b4714fc..b4714fc 100644
--- a/4.7.5/4427_force_XATTR_PAX_tmpfs.patch
+++ b/4.7.6/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/4.7.5/4430_grsec-remove-localversion-grsec.patch b/4.7.6/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/4.7.5/4430_grsec-remove-localversion-grsec.patch
+++ b/4.7.6/4430_grsec-remove-localversion-grsec.patch
diff --git a/4.7.5/4435_grsec-mute-warnings.patch b/4.7.6/4435_grsec-mute-warnings.patch
index 8929222..8929222 100644
--- a/4.7.5/4435_grsec-mute-warnings.patch
+++ b/4.7.6/4435_grsec-mute-warnings.patch
diff --git a/4.7.5/4440_grsec-remove-protected-paths.patch b/4.7.6/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/4.7.5/4440_grsec-remove-protected-paths.patch
+++ b/4.7.6/4440_grsec-remove-protected-paths.patch
diff --git a/4.7.5/4450_grsec-kconfig-default-gids.patch b/4.7.6/4450_grsec-kconfig-default-gids.patch
index e892c8a..e892c8a 100644
--- a/4.7.5/4450_grsec-kconfig-default-gids.patch
+++ b/4.7.6/4450_grsec-kconfig-default-gids.patch
diff --git a/4.7.5/4465_selinux-avc_audit-log-curr_ip.patch b/4.7.6/4465_selinux-avc_audit-log-curr_ip.patch
index 7248385..7248385 100644
--- a/4.7.5/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/4.7.6/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/4.7.5/4470_disable-compat_vdso.patch b/4.7.6/4470_disable-compat_vdso.patch
index 0f82d7e..0f82d7e 100644
--- a/4.7.5/4470_disable-compat_vdso.patch
+++ b/4.7.6/4470_disable-compat_vdso.patch
diff --git a/4.7.5/4475_emutramp_default_on.patch b/4.7.6/4475_emutramp_default_on.patch
index 2db58ab..2db58ab 100644
--- a/4.7.5/4475_emutramp_default_on.patch
+++ b/4.7.6/4475_emutramp_default_on.patch