grsecurity-3.1-4.7.4-20160915223420160915

15 files changed, 2953 insertions, 464 deletions

diff --git a/4.7.3/0000_README b/4.7.4/0000_README
index af5ddba..6374649 100644
--- a/4.7.3/0000_README
+++ b/4.7.4/0000_README
@@ -14,7 +14,11 @@ Patch:	1002_linux-4.7.3.patch
 From:	http://www.kernel.org
 Desc:	Linux 4.7.3
 
-Patch:	4420_grsecurity-3.1-4.7.3-201609072139.patch
+Patch:	1003_linux-4.7.4.patch
+From:	http://www.kernel.org
+Desc:	Linux 4.7.4
+
+Patch:	4420_grsecurity-3.1-4.7.4-201609152234.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/4.7.3/1000_linux-4.7.1.patch b/4.7.4/1000_linux-4.7.1.patch
index 79c652a..79c652a 100644
--- a/4.7.3/1000_linux-4.7.1.patch
+++ b/4.7.4/1000_linux-4.7.1.patch
diff --git a/4.7.3/1001_linux-4.7.2.patch b/4.7.4/1001_linux-4.7.2.patch
index d0ef798..d0ef798 100644
--- a/4.7.3/1001_linux-4.7.2.patch
+++ b/4.7.4/1001_linux-4.7.2.patch
diff --git a/4.7.3/1002_linux-4.7.3.patch b/4.7.4/1002_linux-4.7.3.patch
index caac684..caac684 100644
--- a/4.7.3/1002_linux-4.7.3.patch
+++ b/4.7.4/1002_linux-4.7.3.patch
diff --git a/4.7.4/1003_linux-4.7.4.patch b/4.7.4/1003_linux-4.7.4.patch
new file mode 100644
index 0000000..af6c1d4
--- /dev/null
+++ b/4.7.4/1003_linux-4.7.4.patch
@@ -0,0 +1,2424 @@
+diff --git a/Makefile b/Makefile
+index 4afff18..ec3bd11 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 7
+-SUBLEVEL = 3
++SUBLEVEL = 4
+ EXTRAVERSION =
+ NAME = Psychotic Stoned Sheep
+ 
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 60078a6..b15e1c1 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1597,6 +1597,9 @@ void __init enable_IR_x2apic(void)
+ 	unsigned long flags;
+ 	int ret, ir_stat;
+ 
++	if (skip_ioapic_setup)
++		return;
++
+ 	ir_stat = irq_remapping_prepare();
+ 	if (ir_stat < 0 && !x2apic_supported())
+ 		return;
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 2475b1c7..b993f88 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -515,7 +515,9 @@ EXPORT_SYMBOL_GPL(blk_queue_bypass_end);
+ 
+ void blk_set_queue_dying(struct request_queue *q)
+ {
+-	queue_flag_set_unlocked(QUEUE_FLAG_DYING, q);
++	spin_lock_irq(q->queue_lock);
++	queue_flag_set(QUEUE_FLAG_DYING, q);
++	spin_unlock_irq(q->queue_lock);
+ 
+ 	if (q->mq_ops)
+ 		blk_mq_wake_waiters(q);
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 2613531..bea9344 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -94,9 +94,31 @@ static struct bio *blk_bio_segment_split(struct request_queue *q,
+ 	bool do_split = true;
+ 	struct bio *new = NULL;
+ 	const unsigned max_sectors = get_max_io_size(q, bio);
++	unsigned bvecs = 0;
+ 
+ 	bio_for_each_segment(bv, bio, iter) {
+ 		/*
++		 * With arbitrary bio size, the incoming bio may be very
++		 * big. We have to split the bio into small bios so that
++		 * each holds at most BIO_MAX_PAGES bvecs because
++		 * bio_clone() can fail to allocate big bvecs.
++		 *
++		 * It should have been better to apply the limit per
++		 * request queue in which bio_clone() is involved,
++		 * instead of globally. The biggest blocker is the
++		 * bio_clone() in bio bounce.
++		 *
++		 * If bio is splitted by this reason, we should have
++		 * allowed to continue bios merging, but don't do
++		 * that now for making the change simple.
++		 *
++		 * TODO: deal with bio bounce's bio_clone() gracefully
++		 * and convert the global limit into per-queue limit.
++		 */
++		if (bvecs++ >= BIO_MAX_PAGES)
++			goto split;
++
++		/*
+ 		 * If the queue doesn't support SG gaps and adding this
+ 		 * offset would create a gap, disallow it.
+ 		 */
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index 84708a5..b206115 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -3663,11 +3663,6 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
+ 
+ 	opened_bdev[drive] = bdev;
+ 
+-	if (!(mode & (FMODE_READ|FMODE_WRITE))) {
+-		res = -EINVAL;
+-		goto out;
+-	}
+-
+ 	res = -ENXIO;
+ 
+ 	if (!floppy_track_buffer) {
+@@ -3711,20 +3706,21 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
+ 	if (UFDCS->rawcmd == 1)
+ 		UFDCS->rawcmd = 2;
+ 
+-	UDRS->last_checked = 0;
+-	clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
+-	check_disk_change(bdev);
+-	if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
+-		goto out;
+-	if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
+-		goto out;
+-
+-	res = -EROFS;
+-
+-	if ((mode & FMODE_WRITE) &&
+-			!test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
+-		goto out;
+-
++	if (!(mode & FMODE_NDELAY)) {
++		if (mode & (FMODE_READ|FMODE_WRITE)) {
++			UDRS->last_checked = 0;
++			clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
++			check_disk_change(bdev);
++			if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
++				goto out;
++			if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
++				goto out;
++		}
++		res = -EROFS;
++		if ((mode & FMODE_WRITE) &&
++		    !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
++			goto out;
++	}
+ 	mutex_unlock(&open_lock);
+ 	mutex_unlock(&floppy_mutex);
+ 	return 0;
+diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
+index 0bb44d5..2ee40fd 100644
+--- a/drivers/cpufreq/cpufreq-dt-platdev.c
++++ b/drivers/cpufreq/cpufreq-dt-platdev.c
+@@ -74,6 +74,8 @@ static const struct of_device_id machines[] __initconst = {
+ 	{ .compatible = "ti,omap5", },
+ 
+ 	{ .compatible = "xlnx,zynq-7000", },
++
++	{ }
+ };
+ 
+ static int __init cpufreq_dt_platdev_init(void)
+diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
+index 6dc5971..b304421 100644
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -556,7 +556,10 @@ skip_enc:
+ 
+ 	/* Read and write assoclen bytes */
+ 	append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ);
+-	append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
++	if (alg->caam.geniv)
++		append_math_add_imm_u32(desc, VARSEQOUTLEN, REG3, IMM, ivsize);
++	else
++		append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
+ 
+ 	/* Skip assoc data */
+ 	append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF);
+@@ -565,6 +568,14 @@ skip_enc:
+ 	append_seq_fifo_load(desc, 0, FIFOLD_CLASS_CLASS2 | FIFOLD_TYPE_MSG |
+ 			     KEY_VLF);
+ 
++	if (alg->caam.geniv) {
++		append_seq_load(desc, ivsize, LDST_CLASS_1_CCB |
++				LDST_SRCDST_BYTE_CONTEXT |
++				(ctx1_iv_off << LDST_OFFSET_SHIFT));
++		append_move(desc, MOVE_SRC_CLASS1CTX | MOVE_DEST_CLASS2INFIFO |
++			    (ctx1_iv_off << MOVE_OFFSET_SHIFT) | ivsize);
++	}
++
+ 	/* Load Counter into CONTEXT1 reg */
+ 	if (is_rfc3686)
+ 		append_load_imm_u32(desc, be32_to_cpu(1), LDST_IMM |
+@@ -2150,7 +2161,7 @@ static void init_authenc_job(struct aead_request *req,
+ 
+ 	init_aead_job(req, edesc, all_contig, encrypt);
+ 
+-	if (ivsize && (is_rfc3686 || !(alg->caam.geniv && encrypt)))
++	if (ivsize && ((is_rfc3686 && encrypt) || !alg->caam.geniv))
+ 		append_load_as_imm(desc, req->iv, ivsize,
+ 				   LDST_CLASS_1_CCB |
+ 				   LDST_SRCDST_BYTE_CONTEXT |
+@@ -2537,20 +2548,6 @@ static int aead_decrypt(struct aead_request *req)
+ 	return ret;
+ }
+ 
+-static int aead_givdecrypt(struct aead_request *req)
+-{
+-	struct crypto_aead *aead = crypto_aead_reqtfm(req);
+-	unsigned int ivsize = crypto_aead_ivsize(aead);
+-
+-	if (req->cryptlen < ivsize)
+-		return -EINVAL;
+-
+-	req->cryptlen -= ivsize;
+-	req->assoclen += ivsize;
+-
+-	return aead_decrypt(req);
+-}
+-
+ /*
+  * allocate and map the ablkcipher extended descriptor for ablkcipher
+  */
+@@ -3210,7 +3207,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = AES_BLOCK_SIZE,
+ 			.maxauthsize = MD5_DIGEST_SIZE,
+ 		},
+@@ -3256,7 +3253,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = AES_BLOCK_SIZE,
+ 			.maxauthsize = SHA1_DIGEST_SIZE,
+ 		},
+@@ -3302,7 +3299,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = AES_BLOCK_SIZE,
+ 			.maxauthsize = SHA224_DIGEST_SIZE,
+ 		},
+@@ -3348,7 +3345,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = AES_BLOCK_SIZE,
+ 			.maxauthsize = SHA256_DIGEST_SIZE,
+ 		},
+@@ -3394,7 +3391,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = AES_BLOCK_SIZE,
+ 			.maxauthsize = SHA384_DIGEST_SIZE,
+ 		},
+@@ -3440,7 +3437,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = AES_BLOCK_SIZE,
+ 			.maxauthsize = SHA512_DIGEST_SIZE,
+ 		},
+@@ -3486,7 +3483,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = DES3_EDE_BLOCK_SIZE,
+ 			.maxauthsize = MD5_DIGEST_SIZE,
+ 		},
+@@ -3534,7 +3531,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = DES3_EDE_BLOCK_SIZE,
+ 			.maxauthsize = SHA1_DIGEST_SIZE,
+ 		},
+@@ -3582,7 +3579,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = DES3_EDE_BLOCK_SIZE,
+ 			.maxauthsize = SHA224_DIGEST_SIZE,
+ 		},
+@@ -3630,7 +3627,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = DES3_EDE_BLOCK_SIZE,
+ 			.maxauthsize = SHA256_DIGEST_SIZE,
+ 		},
+@@ -3678,7 +3675,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = DES3_EDE_BLOCK_SIZE,
+ 			.maxauthsize = SHA384_DIGEST_SIZE,
+ 		},
+@@ -3726,7 +3723,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = DES3_EDE_BLOCK_SIZE,
+ 			.maxauthsize = SHA512_DIGEST_SIZE,
+ 		},
+@@ -3772,7 +3769,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = DES_BLOCK_SIZE,
+ 			.maxauthsize = MD5_DIGEST_SIZE,
+ 		},
+@@ -3818,7 +3815,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = DES_BLOCK_SIZE,
+ 			.maxauthsize = SHA1_DIGEST_SIZE,
+ 		},
+@@ -3864,7 +3861,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = DES_BLOCK_SIZE,
+ 			.maxauthsize = SHA224_DIGEST_SIZE,
+ 		},
+@@ -3910,7 +3907,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = DES_BLOCK_SIZE,
+ 			.maxauthsize = SHA256_DIGEST_SIZE,
+ 		},
+@@ -3956,7 +3953,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = DES_BLOCK_SIZE,
+ 			.maxauthsize = SHA384_DIGEST_SIZE,
+ 		},
+@@ -4002,7 +3999,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = DES_BLOCK_SIZE,
+ 			.maxauthsize = SHA512_DIGEST_SIZE,
+ 		},
+@@ -4051,7 +4048,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = CTR_RFC3686_IV_SIZE,
+ 			.maxauthsize = MD5_DIGEST_SIZE,
+ 		},
+@@ -4102,7 +4099,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = CTR_RFC3686_IV_SIZE,
+ 			.maxauthsize = SHA1_DIGEST_SIZE,
+ 		},
+@@ -4153,7 +4150,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = CTR_RFC3686_IV_SIZE,
+ 			.maxauthsize = SHA224_DIGEST_SIZE,
+ 		},
+@@ -4204,7 +4201,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = CTR_RFC3686_IV_SIZE,
+ 			.maxauthsize = SHA256_DIGEST_SIZE,
+ 		},
+@@ -4255,7 +4252,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = CTR_RFC3686_IV_SIZE,
+ 			.maxauthsize = SHA384_DIGEST_SIZE,
+ 		},
+@@ -4306,7 +4303,7 @@ static struct caam_aead_alg driver_aeads[] = {
+ 			.setkey = aead_setkey,
+ 			.setauthsize = aead_setauthsize,
+ 			.encrypt = aead_encrypt,
+-			.decrypt = aead_givdecrypt,
++			.decrypt = aead_decrypt,
+ 			.ivsize = CTR_RFC3686_IV_SIZE,
+ 			.maxauthsize = SHA512_DIGEST_SIZE,
+ 		},
+diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
+index 9bb99e2..79a05a3 100644
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -465,7 +465,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
+ 					val,
+ 					-1,
+ 					&replaced);
+-		state->color_mgmt_changed = replaced;
++		state->color_mgmt_changed |= replaced;
+ 		return ret;
+ 	} else if (property == config->ctm_property) {
+ 		ret = drm_atomic_replace_property_blob_from_id(crtc,
+@@ -473,7 +473,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
+ 					val,
+ 					sizeof(struct drm_color_ctm),
+ 					&replaced);
+-		state->color_mgmt_changed = replaced;
++		state->color_mgmt_changed |= replaced;
+ 		return ret;
+ 	} else if (property == config->gamma_lut_property) {
+ 		ret = drm_atomic_replace_property_blob_from_id(crtc,
+@@ -481,7 +481,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
+ 					val,
+ 					-1,
+ 					&replaced);
+-		state->color_mgmt_changed = replaced;
++		state->color_mgmt_changed |= replaced;
+ 		return ret;
+ 	} else if (crtc->funcs->atomic_set_property)
+ 		return crtc->funcs->atomic_set_property(crtc, state, property, val);
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index 0e3cc66..a5cae1b 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -5312,6 +5312,9 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
+ 	struct drm_pending_vblank_event *e = NULL;
+ 	int ret = -EINVAL;
+ 
++	if (!drm_core_check_feature(dev, DRIVER_MODESET))
++		return -EINVAL;
++
+ 	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
+ 	    page_flip->reserved != 0)
+ 		return -EINVAL;
+diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
+index eb4bb8b..eb515f0 100644
+--- a/drivers/gpu/drm/msm/msm_gem_submit.c
++++ b/drivers/gpu/drm/msm/msm_gem_submit.c
+@@ -62,6 +62,14 @@ void msm_gem_submit_free(struct msm_gem_submit *submit)
+ 	kfree(submit);
+ }
+ 
++static inline unsigned long __must_check
++copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
++{
++	if (access_ok(VERIFY_READ, from, n))
++		return __copy_from_user_inatomic(to, from, n);
++	return -EFAULT;
++}
++
+ static int submit_lookup_objects(struct msm_gem_submit *submit,
+ 		struct drm_msm_gem_submit *args, struct drm_file *file)
+ {
+@@ -69,6 +77,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
+ 	int ret = 0;
+ 
+ 	spin_lock(&file->table_lock);
++	pagefault_disable();
+ 
+ 	for (i = 0; i < args->nr_bos; i++) {
+ 		struct drm_msm_gem_submit_bo submit_bo;
+@@ -82,10 +91,15 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
+ 		 */
+ 		submit->bos[i].flags = 0;
+ 
+-		ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
+-		if (ret) {
+-			ret = -EFAULT;
+-			goto out_unlock;
++		ret = copy_from_user_inatomic(&submit_bo, userptr, sizeof(submit_bo));
++		if (unlikely(ret)) {
++			pagefault_enable();
++			spin_unlock(&file->table_lock);
++			ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
++			if (ret)
++				goto out;
++			spin_lock(&file->table_lock);
++			pagefault_disable();
+ 		}
+ 
+ 		if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
+@@ -125,9 +139,12 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
+ 	}
+ 
+ out_unlock:
+-	submit->nr_bos = i;
++	pagefault_enable();
+ 	spin_unlock(&file->table_lock);
+ 
++out:
++	submit->nr_bos = i;
++
+ 	return ret;
+ }
+ 
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 259cd6e..17e3454 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -627,7 +627,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ 			if (radeon_crtc->ss.refdiv) {
+ 				radeon_crtc->pll_flags |= RADEON_PLL_USE_REF_DIV;
+ 				radeon_crtc->pll_reference_div = radeon_crtc->ss.refdiv;
+-				if (rdev->family >= CHIP_RV770)
++				if (ASIC_IS_AVIVO(rdev) &&
++				    rdev->family != CHIP_RS780 &&
++				    rdev->family != CHIP_RS880)
+ 					radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
+ 			}
+ 		}
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index 590b037..0ab76dd 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -263,8 +263,8 @@ static int radeon_move_blit(struct ttm_buffer_object *bo,
+ 
+ 	rdev = radeon_get_rdev(bo->bdev);
+ 	ridx = radeon_copy_ring_index(rdev);
+-	old_start = old_mem->start << PAGE_SHIFT;
+-	new_start = new_mem->start << PAGE_SHIFT;
++	old_start = (u64)old_mem->start << PAGE_SHIFT;
++	new_start = (u64)new_mem->start << PAGE_SHIFT;
+ 
+ 	switch (old_mem->mem_type) {
+ 	case TTM_PL_VRAM:
+diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
+index 37cac59..2e24616 100644
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -321,6 +321,15 @@ vc4_first_render_job(struct vc4_dev *vc4)
+ 				struct vc4_exec_info, head);
+ }
+ 
++static inline struct vc4_exec_info *
++vc4_last_render_job(struct vc4_dev *vc4)
++{
++	if (list_empty(&vc4->render_job_list))
++		return NULL;
++	return list_last_entry(&vc4->render_job_list,
++			       struct vc4_exec_info, head);
++}
++
+ /**
+  * struct vc4_texture_sample_info - saves the offsets into the UBO for texture
+  * setup parameters.
+diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
+index 46899d6..78ab08e 100644
+--- a/drivers/gpu/drm/vc4/vc4_gem.c
++++ b/drivers/gpu/drm/vc4/vc4_gem.c
+@@ -574,8 +574,8 @@ vc4_cl_lookup_bos(struct drm_device *dev,
+ 	spin_unlock(&file_priv->table_lock);
+ 
+ fail:
+-	kfree(handles);
+-	return 0;
++	drm_free_large(handles);
++	return ret;
+ }
+ 
+ static int
+diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c
+index b0104a34..094bc6a 100644
+--- a/drivers/gpu/drm/vc4/vc4_irq.c
++++ b/drivers/gpu/drm/vc4/vc4_irq.c
+@@ -83,8 +83,10 @@ vc4_overflow_mem_work(struct work_struct *work)
+ 
+ 		spin_lock_irqsave(&vc4->job_lock, irqflags);
+ 		current_exec = vc4_first_bin_job(vc4);
++		if (!current_exec)
++			current_exec = vc4_last_render_job(vc4);
+ 		if (current_exec) {
+-			vc4->overflow_mem->seqno = vc4->finished_seqno + 1;
++			vc4->overflow_mem->seqno = current_exec->seqno;
+ 			list_add_tail(&vc4->overflow_mem->unref_head,
+ 				      &current_exec->unref_list);
+ 			vc4->overflow_mem = NULL;
+diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
+index 70ed1d0..d3ef0fc 100644
+--- a/drivers/irqchip/irq-mips-gic.c
++++ b/drivers/irqchip/irq-mips-gic.c
+@@ -713,9 +713,6 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
+ 	unsigned long flags;
+ 	int i;
+ 
+-	irq_set_chip_and_handler(virq, &gic_level_irq_controller,
+-				 handle_level_irq);
+-
+ 	spin_lock_irqsave(&gic_lock, flags);
+ 	gic_map_to_pin(intr, gic_cpu_pin);
+ 	gic_map_to_vpe(intr, mips_cm_vp_id(vpe));
+@@ -732,6 +729,10 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq,
+ {
+ 	if (GIC_HWIRQ_TO_LOCAL(hw) < GIC_NUM_LOCAL_INTRS)
+ 		return gic_local_irq_domain_map(d, virq, hw);
++
++	irq_set_chip_and_handler(virq, &gic_level_irq_controller,
++				 handle_level_irq);
++
+ 	return gic_shared_irq_domain_map(d, virq, hw, 0);
+ }
+ 
+@@ -771,11 +772,13 @@ static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq,
+ 			hwirq = GIC_SHARED_TO_HWIRQ(base_hwirq + i);
+ 
+ 			ret = irq_domain_set_hwirq_and_chip(d, virq + i, hwirq,
+-							    &gic_edge_irq_controller,
++							    &gic_level_irq_controller,
+ 							    NULL);
+ 			if (ret)
+ 				goto error;
+ 
++			irq_set_handler(virq + i, handle_level_irq);
++
+ 			ret = gic_shared_irq_domain_map(d, virq + i, hwirq, cpu);
+ 			if (ret)
+ 				goto error;
+@@ -890,10 +893,17 @@ void gic_dev_domain_free(struct irq_domain *d, unsigned int virq,
+ 	return;
+ }
+ 
++static void gic_dev_domain_activate(struct irq_domain *domain,
++				    struct irq_data *d)
++{
++	gic_shared_irq_domain_map(domain, d->irq, d->hwirq, 0);
++}
++
+ static struct irq_domain_ops gic_dev_domain_ops = {
+ 	.xlate = gic_dev_domain_xlate,
+ 	.alloc = gic_dev_domain_alloc,
+ 	.free = gic_dev_domain_free,
++	.activate = gic_dev_domain_activate,
+ };
+ 
+ static int gic_ipi_domain_xlate(struct irq_domain *d, struct device_node *ctrlr,
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index f5dbb4e..5d3b231 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1818,7 +1818,7 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca)
+ 	free = roundup_pow_of_two(ca->sb.nbuckets) >> 10;
+ 
+ 	if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) ||
+-	    !init_fifo(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
++	    !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
+ 	    !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) ||
+ 	    !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) ||
+ 	    !init_fifo(&ca->free_inc,	free << 2, GFP_KERNEL) ||
+diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
+index e2fb44c..dc3a854 100644
+--- a/drivers/misc/mei/hw-me.c
++++ b/drivers/misc/mei/hw-me.c
+@@ -1263,8 +1263,14 @@ static bool mei_me_fw_type_nm(struct pci_dev *pdev)
+ static bool mei_me_fw_type_sps(struct pci_dev *pdev)
+ {
+ 	u32 reg;
+-	/* Read ME FW Status check for SPS Firmware */
+-	pci_read_config_dword(pdev, PCI_CFG_HFS_1, &reg);
++	unsigned int devfn;
++
++	/*
++	 * Read ME FW Status register to check for SPS Firmware
++	 * The SPS FW is only signaled in pci function 0
++	 */
++	devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0);
++	pci_bus_read_config_dword(pdev->bus, devfn, PCI_CFG_HFS_1, &reg);
+ 	trace_mei_pci_cfg_read(&pdev->dev, "PCI_CFG_HFS_1", PCI_CFG_HFS_1, reg);
+ 	/* if bits [19:16] = 15, running SPS Firmware */
+ 	return (reg & 0xf0000) == 0xf0000;
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index 64e64da..71cea9b 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -85,8 +85,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+ 
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT, mei_me_pch8_cfg)},
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)},
+-	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_cfg)},
+-	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_cfg)},
++	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)},
++	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)},
+ 
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)},
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)},
+diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c
+index 83458f7..6dc96c8 100644
+--- a/drivers/scsi/constants.c
++++ b/drivers/scsi/constants.c
+@@ -361,8 +361,9 @@ static const char * const snstext[] = {
+ 
+ /* Get sense key string or NULL if not available */
+ const char *
+-scsi_sense_key_string(unsigned char key) {
+-	if (key <= 0xE)
++scsi_sense_key_string(unsigned char key)
++{
++	if (key < ARRAY_SIZE(snstext))
+ 		return snstext[key];
+ 	return NULL;
+ }
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 0a4d54a..591e520 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1196,6 +1196,8 @@ static int acm_probe(struct usb_interface *intf,
+ 	}
+ 
+ 	if (!buflen) {
++		if (!intf->cur_altsetting || !intf->cur_altsetting->endpoint)
++			return -EINVAL;
+ 		if (intf->cur_altsetting->endpoint &&
+ 				intf->cur_altsetting->endpoint->extralen &&
+ 				intf->cur_altsetting->endpoint->extra) {
+@@ -1276,6 +1278,8 @@ next_desc:
+ 				data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = call_interface_num));
+ 			control_interface = intf;
+ 		} else {
++			if (!intf->cur_altsetting)
++				return -ENODEV;
+ 			if (intf->cur_altsetting->desc.bNumEndpoints != 3) {
+ 				dev_dbg(&intf->dev,"No union descriptor, giving up\n");
+ 				return -ENODEV;
+@@ -1305,15 +1309,22 @@ next_desc:
+ 		combined_interfaces = 1;
+ 		/* a popular other OS doesn't use it */
+ 		quirks |= NO_CAP_LINE;
++		if (!data_interface->cur_altsetting)
++			return -EINVAL;
+ 		if (data_interface->cur_altsetting->desc.bNumEndpoints != 3) {
+ 			dev_err(&intf->dev, "This needs exactly 3 endpoints\n");
+ 			return -EINVAL;
+ 		}
+ look_for_collapsed_interface:
++		if (!data_interface->cur_altsetting)
++			return -EINVAL;
+ 		for (i = 0; i < 3; i++) {
+ 			struct usb_endpoint_descriptor *ep;
+ 			ep = &data_interface->cur_altsetting->endpoint[i].desc;
+ 
++			if (!ep)
++				return -ENODEV;
++
+ 			if (usb_endpoint_is_int_in(ep))
+ 				epctrl = ep;
+ 			else if (usb_endpoint_is_bulk_out(ep))
+@@ -1332,8 +1343,12 @@ look_for_collapsed_interface:
+ skip_normal_probe:
+ 
+ 	/*workaround for switched interfaces */
++	if (!data_interface->cur_altsetting)
++		return -EINVAL;
+ 	if (data_interface->cur_altsetting->desc.bInterfaceClass
+ 						!= CDC_DATA_INTERFACE_TYPE) {
++		if (!control_interface->cur_altsetting)
++			return -EINVAL;
+ 		if (control_interface->cur_altsetting->desc.bInterfaceClass
+ 						== CDC_DATA_INTERFACE_TYPE) {
+ 			dev_dbg(&intf->dev,
+@@ -1356,6 +1371,7 @@ skip_normal_probe:
+ 
+ 
+ 	if (data_interface->cur_altsetting->desc.bNumEndpoints < 2 ||
++	    !control_interface->cur_altsetting ||
+ 	    control_interface->cur_altsetting->desc.bNumEndpoints == 0)
+ 		return -EINVAL;
+ 
+@@ -1363,6 +1379,8 @@ skip_normal_probe:
+ 	epread = &data_interface->cur_altsetting->endpoint[0].desc;
+ 	epwrite = &data_interface->cur_altsetting->endpoint[1].desc;
+ 
++	if (!epctrl || !epread || !epwrite)
++		return -ENODEV;
+ 
+ 	/* workaround for switched endpoints */
+ 	if (!usb_endpoint_dir_in(epread)) {
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index 9d6320e..6e29d05 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -88,7 +88,7 @@ struct vhost_scsi_cmd {
+ 	struct scatterlist *tvc_prot_sgl;
+ 	struct page **tvc_upages;
+ 	/* Pointer to response header iovec */
+-	struct iovec *tvc_resp_iov;
++	struct iovec tvc_resp_iov;
+ 	/* Pointer to vhost_scsi for our device */
+ 	struct vhost_scsi *tvc_vhost;
+ 	/* Pointer to vhost_virtqueue for the cmd */
+@@ -547,7 +547,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
+ 		memcpy(v_rsp.sense, cmd->tvc_sense_buf,
+ 		       se_cmd->scsi_sense_length);
+ 
+-		iov_iter_init(&iov_iter, READ, cmd->tvc_resp_iov,
++		iov_iter_init(&iov_iter, READ, &cmd->tvc_resp_iov,
+ 			      cmd->tvc_in_iovs, sizeof(v_rsp));
+ 		ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter);
+ 		if (likely(ret == sizeof(v_rsp))) {
+@@ -1044,7 +1044,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
+ 		}
+ 		cmd->tvc_vhost = vs;
+ 		cmd->tvc_vq = vq;
+-		cmd->tvc_resp_iov = &vq->iov[out];
++		cmd->tvc_resp_iov = vq->iov[out];
+ 		cmd->tvc_in_iovs = in;
+ 
+ 		pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n",
+diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
+index 7487971..c1010f01 100644
+--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
+@@ -316,7 +316,7 @@ static int xenbus_write_transaction(unsigned msg_type,
+ 			rc = -ENOMEM;
+ 			goto out;
+ 		}
+-	} else {
++	} else if (msg_type == XS_TRANSACTION_END) {
+ 		list_for_each_entry(trans, &u->transactions, list)
+ 			if (trans->handle.id == u->u.msg.tx_id)
+ 				break;
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 71ccab1..b1495fa 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -659,7 +659,7 @@ static struct dentry *bd_mount(struct file_system_type *fs_type,
+ {
+ 	struct dentry *dent;
+ 	dent = mount_pseudo(fs_type, "bdev:", &bdev_sops, NULL, BDEVFS_MAGIC);
+-	if (dent)
++	if (!IS_ERR(dent))
+ 		dent->d_sb->s_iflags |= SB_I_CGROUPWB;
+ 	return dent;
+ }
+diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
+index 0f9961e..f96547f 100644
+--- a/fs/crypto/policy.c
++++ b/fs/crypto/policy.c
+@@ -95,10 +95,15 @@ static int create_encryption_context_from_policy(struct inode *inode,
+ int fscrypt_process_policy(struct inode *inode,
+ 				const struct fscrypt_policy *policy)
+ {
++	if (!inode_owner_or_capable(inode))
++		return -EACCES;
++
+ 	if (policy->version != 0)
+ 		return -EINVAL;
+ 
+ 	if (!inode_has_encryption_context(inode)) {
++		if (!S_ISDIR(inode->i_mode))
++			return -EINVAL;
+ 		if (!inode->i_sb->s_cop->empty_dir)
+ 			return -EOPNOTSUPP;
+ 		if (!inode->i_sb->s_cop->empty_dir(inode))
+diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c
+index ad05069..8a9feb3 100644
+--- a/fs/ext4/crypto_policy.c
++++ b/fs/ext4/crypto_policy.c
+@@ -102,6 +102,9 @@ static int ext4_create_encryption_context_from_policy(
+ int ext4_process_policy(const struct ext4_encryption_policy *policy,
+ 			struct inode *inode)
+ {
++	if (!inode_owner_or_capable(inode))
++		return -EACCES;
++
+ 	if (policy->version != 0)
+ 		return -EINVAL;
+ 
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index b747ec0..ea628af 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -51,25 +51,31 @@ static __u32 ext4_inode_csum(struct inode *inode, struct ext4_inode *raw,
+ 			      struct ext4_inode_info *ei)
+ {
+ 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+-	__u16 csum_lo;
+-	__u16 csum_hi = 0;
+ 	__u32 csum;
++	__u16 dummy_csum = 0;
++	int offset = offsetof(struct ext4_inode, i_checksum_lo);
++	unsigned int csum_size = sizeof(dummy_csum);
+ 
+-	csum_lo = le16_to_cpu(raw->i_checksum_lo);
+-	raw->i_checksum_lo = 0;
+-	if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE &&
+-	    EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) {
+-		csum_hi = le16_to_cpu(raw->i_checksum_hi);
+-		raw->i_checksum_hi = 0;
+-	}
++	csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw, offset);
++	csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, csum_size);
++	offset += csum_size;
++	csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset,
++			   EXT4_GOOD_OLD_INODE_SIZE - offset);
+ 
+-	csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw,
+-			   EXT4_INODE_SIZE(inode->i_sb));
+-
+-	raw->i_checksum_lo = cpu_to_le16(csum_lo);
+-	if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE &&
+-	    EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi))
+-		raw->i_checksum_hi = cpu_to_le16(csum_hi);
++	if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
++		offset = offsetof(struct ext4_inode, i_checksum_hi);
++		csum = ext4_chksum(sbi, csum, (__u8 *)raw +
++				   EXT4_GOOD_OLD_INODE_SIZE,
++				   offset - EXT4_GOOD_OLD_INODE_SIZE);
++		if (EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) {
++			csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum,
++					   csum_size);
++			offset += csum_size;
++			csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset,
++					   EXT4_INODE_SIZE(inode->i_sb) -
++					   offset);
++		}
++	}
+ 
+ 	return csum;
+ }
+@@ -5460,8 +5466,6 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
+ 						      sbi->s_want_extra_isize,
+ 						      iloc, handle);
+ 			if (ret) {
+-				ext4_set_inode_state(inode,
+-						     EXT4_STATE_NO_EXPAND);
+ 				if (mnt_count !=
+ 					le16_to_cpu(sbi->s_es->s_mnt_count)) {
+ 					ext4_warning(inode->i_sb,
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index ec4c399..5bb46b6 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -420,15 +420,14 @@ static __le32 ext4_dx_csum(struct inode *inode, struct ext4_dir_entry *dirent,
+ 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+ 	struct ext4_inode_info *ei = EXT4_I(inode);
+ 	__u32 csum;
+-	__le32 save_csum;
+ 	int size;
++	__u32 dummy_csum = 0;
++	int offset = offsetof(struct dx_tail, dt_checksum);
+ 
+ 	size = count_offset + (count * sizeof(struct dx_entry));
+-	save_csum = t->dt_checksum;
+-	t->dt_checksum = 0;
+ 	csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)dirent, size);
+-	csum = ext4_chksum(sbi, csum, (__u8 *)t, sizeof(struct dx_tail));
+-	t->dt_checksum = save_csum;
++	csum = ext4_chksum(sbi, csum, (__u8 *)t, offset);
++	csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, sizeof(dummy_csum));
+ 
+ 	return cpu_to_le32(csum);
+ }
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 639bd756..d4505f8 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2068,23 +2068,25 @@ failed:
+ static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group,
+ 				   struct ext4_group_desc *gdp)
+ {
+-	int offset;
++	int offset = offsetof(struct ext4_group_desc, bg_checksum);
+ 	__u16 crc = 0;
+ 	__le32 le_group = cpu_to_le32(block_group);
+ 	struct ext4_sb_info *sbi = EXT4_SB(sb);
+ 
+ 	if (ext4_has_metadata_csum(sbi->s_sb)) {
+ 		/* Use new metadata_csum algorithm */
+-		__le16 save_csum;
+ 		__u32 csum32;
++		__u16 dummy_csum = 0;
+ 
+-		save_csum = gdp->bg_checksum;
+-		gdp->bg_checksum = 0;
+ 		csum32 = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&le_group,
+ 				     sizeof(le_group));
+-		csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp,
+-				     sbi->s_desc_size);
+-		gdp->bg_checksum = save_csum;
++		csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp, offset);
++		csum32 = ext4_chksum(sbi, csum32, (__u8 *)&dummy_csum,
++				     sizeof(dummy_csum));
++		offset += sizeof(dummy_csum);
++		if (offset < sbi->s_desc_size)
++			csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp + offset,
++					     sbi->s_desc_size - offset);
+ 
+ 		crc = csum32 & 0xFFFF;
+ 		goto out;
+@@ -2094,8 +2096,6 @@ static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group,
+ 	if (!ext4_has_feature_gdt_csum(sb))
+ 		return 0;
+ 
+-	offset = offsetof(struct ext4_group_desc, bg_checksum);
+-
+ 	crc = crc16(~0, sbi->s_es->s_uuid, sizeof(sbi->s_es->s_uuid));
+ 	crc = crc16(crc, (__u8 *)&le_group, sizeof(le_group));
+ 	crc = crc16(crc, (__u8 *)gdp, offset);
+@@ -2131,6 +2131,7 @@ void ext4_group_desc_csum_set(struct super_block *sb, __u32 block_group,
+ 
+ /* Called at mount-time, super-block is locked */
+ static int ext4_check_descriptors(struct super_block *sb,
++				  ext4_fsblk_t sb_block,
+ 				  ext4_group_t *first_not_zeroed)
+ {
+ 	struct ext4_sb_info *sbi = EXT4_SB(sb);
+@@ -2161,6 +2162,11 @@ static int ext4_check_descriptors(struct super_block *sb,
+ 			grp = i;
+ 
+ 		block_bitmap = ext4_block_bitmap(sb, gdp);
++		if (block_bitmap == sb_block) {
++			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
++				 "Block bitmap for group %u overlaps "
++				 "superblock", i);
++		}
+ 		if (block_bitmap < first_block || block_bitmap > last_block) {
+ 			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+ 			       "Block bitmap for group %u not in group "
+@@ -2168,6 +2174,11 @@ static int ext4_check_descriptors(struct super_block *sb,
+ 			return 0;
+ 		}
+ 		inode_bitmap = ext4_inode_bitmap(sb, gdp);
++		if (inode_bitmap == sb_block) {
++			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
++				 "Inode bitmap for group %u overlaps "
++				 "superblock", i);
++		}
+ 		if (inode_bitmap < first_block || inode_bitmap > last_block) {
+ 			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+ 			       "Inode bitmap for group %u not in group "
+@@ -2175,6 +2186,11 @@ static int ext4_check_descriptors(struct super_block *sb,
+ 			return 0;
+ 		}
+ 		inode_table = ext4_inode_table(sb, gdp);
++		if (inode_table == sb_block) {
++			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
++				 "Inode table for group %u overlaps "
++				 "superblock", i);
++		}
+ 		if (inode_table < first_block ||
+ 		    inode_table + sbi->s_itb_per_group - 1 > last_block) {
+ 			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+@@ -3677,7 +3693,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ 			goto failed_mount2;
+ 		}
+ 	}
+-	if (!ext4_check_descriptors(sb, &first_not_zeroed)) {
++	if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
+ 		ext4_msg(sb, KERN_ERR, "group descriptors corrupted!");
+ 		ret = -EFSCORRUPTED;
+ 		goto failed_mount2;
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index e79bd32..2eb935c 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -121,17 +121,18 @@ static __le32 ext4_xattr_block_csum(struct inode *inode,
+ {
+ 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+ 	__u32 csum;
+-	__le32 save_csum;
+ 	__le64 dsk_block_nr = cpu_to_le64(block_nr);
++	__u32 dummy_csum = 0;
++	int offset = offsetof(struct ext4_xattr_header, h_checksum);
+ 
+-	save_csum = hdr->h_checksum;
+-	hdr->h_checksum = 0;
+ 	csum = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&dsk_block_nr,
+ 			   sizeof(dsk_block_nr));
+-	csum = ext4_chksum(sbi, csum, (__u8 *)hdr,
+-			   EXT4_BLOCK_SIZE(inode->i_sb));
++	csum = ext4_chksum(sbi, csum, (__u8 *)hdr, offset);
++	csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, sizeof(dummy_csum));
++	offset += sizeof(dummy_csum);
++	csum = ext4_chksum(sbi, csum, (__u8 *)hdr + offset,
++			   EXT4_BLOCK_SIZE(inode->i_sb) - offset);
+ 
+-	hdr->h_checksum = save_csum;
+ 	return cpu_to_le32(csum);
+ }
+ 
+@@ -1352,15 +1353,19 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
+ 	size_t min_offs, free;
+ 	int total_ino;
+ 	void *base, *start, *end;
+-	int extra_isize = 0, error = 0, tried_min_extra_isize = 0;
++	int error = 0, tried_min_extra_isize = 0;
+ 	int s_min_extra_isize = le16_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_min_extra_isize);
++	int isize_diff;	/* How much do we need to grow i_extra_isize */
+ 
+ 	down_write(&EXT4_I(inode)->xattr_sem);
++	/*
++	 * Set EXT4_STATE_NO_EXPAND to avoid recursion when marking inode dirty
++	 */
++	ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND);
+ retry:
+-	if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) {
+-		up_write(&EXT4_I(inode)->xattr_sem);
+-		return 0;
+-	}
++	isize_diff = new_extra_isize - EXT4_I(inode)->i_extra_isize;
++	if (EXT4_I(inode)->i_extra_isize >= new_extra_isize)
++		goto out;
+ 
+ 	header = IHDR(inode, raw_inode);
+ 	entry = IFIRST(header);
+@@ -1381,7 +1386,7 @@ retry:
+ 		goto cleanup;
+ 
+ 	free = ext4_xattr_free_space(last, &min_offs, base, &total_ino);
+-	if (free >= new_extra_isize) {
++	if (free >= isize_diff) {
+ 		entry = IFIRST(header);
+ 		ext4_xattr_shift_entries(entry,	EXT4_I(inode)->i_extra_isize
+ 				- new_extra_isize, (void *)raw_inode +
+@@ -1389,8 +1394,7 @@ retry:
+ 				(void *)header, total_ino,
+ 				inode->i_sb->s_blocksize);
+ 		EXT4_I(inode)->i_extra_isize = new_extra_isize;
+-		error = 0;
+-		goto cleanup;
++		goto out;
+ 	}
+ 
+ 	/*
+@@ -1413,7 +1417,7 @@ retry:
+ 		end = bh->b_data + bh->b_size;
+ 		min_offs = end - base;
+ 		free = ext4_xattr_free_space(first, &min_offs, base, NULL);
+-		if (free < new_extra_isize) {
++		if (free < isize_diff) {
+ 			if (!tried_min_extra_isize && s_min_extra_isize) {
+ 				tried_min_extra_isize++;
+ 				new_extra_isize = s_min_extra_isize;
+@@ -1427,7 +1431,7 @@ retry:
+ 		free = inode->i_sb->s_blocksize;
+ 	}
+ 
+-	while (new_extra_isize > 0) {
++	while (isize_diff > 0) {
+ 		size_t offs, size, entry_size;
+ 		struct ext4_xattr_entry *small_entry = NULL;
+ 		struct ext4_xattr_info i = {
+@@ -1458,7 +1462,7 @@ retry:
+ 			EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) +
+ 					EXT4_XATTR_LEN(last->e_name_len);
+ 			if (total_size <= free && total_size < min_total_size) {
+-				if (total_size < new_extra_isize) {
++				if (total_size < isize_diff) {
+ 					small_entry = last;
+ 				} else {
+ 					entry = last;
+@@ -1513,22 +1517,22 @@ retry:
+ 		error = ext4_xattr_ibody_set(handle, inode, &i, is);
+ 		if (error)
+ 			goto cleanup;
++		total_ino -= entry_size;
+ 
+ 		entry = IFIRST(header);
+-		if (entry_size + EXT4_XATTR_SIZE(size) >= new_extra_isize)
+-			shift_bytes = new_extra_isize;
++		if (entry_size + EXT4_XATTR_SIZE(size) >= isize_diff)
++			shift_bytes = isize_diff;
+ 		else
+-			shift_bytes = entry_size + size;
++			shift_bytes = entry_size + EXT4_XATTR_SIZE(size);
+ 		/* Adjust the offsets and shift the remaining entries ahead */
+-		ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize -
+-			shift_bytes, (void *)raw_inode +
+-			EXT4_GOOD_OLD_INODE_SIZE + extra_isize + shift_bytes,
+-			(void *)header, total_ino - entry_size,
+-			inode->i_sb->s_blocksize);
++		ext4_xattr_shift_entries(entry, -shift_bytes,
++			(void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE +
++			EXT4_I(inode)->i_extra_isize + shift_bytes,
++			(void *)header, total_ino, inode->i_sb->s_blocksize);
+ 
+-		extra_isize += shift_bytes;
+-		new_extra_isize -= shift_bytes;
+-		EXT4_I(inode)->i_extra_isize = extra_isize;
++		isize_diff -= shift_bytes;
++		EXT4_I(inode)->i_extra_isize += shift_bytes;
++		header = IHDR(inode, raw_inode);
+ 
+ 		i.name = b_entry_name;
+ 		i.value = buffer;
+@@ -1550,6 +1554,8 @@ retry:
+ 		kfree(bs);
+ 	}
+ 	brelse(bh);
++out:
++	ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
+ 	up_write(&EXT4_I(inode)->xattr_sem);
+ 	return 0;
+ 
+@@ -1561,6 +1567,10 @@ cleanup:
+ 	kfree(is);
+ 	kfree(bs);
+ 	brelse(bh);
++	/*
++	 * We deliberately leave EXT4_STATE_NO_EXPAND set here since inode
++	 * size expansion failed.
++	 */
+ 	up_write(&EXT4_I(inode)->xattr_sem);
+ 	return error;
+ }
+diff --git a/fs/namei.c b/fs/namei.c
+index 70580ab..9281b2b 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -901,6 +901,7 @@ static inline int may_follow_link(struct nameidata *nd)
+ {
+ 	const struct inode *inode;
+ 	const struct inode *parent;
++	kuid_t puid;
+ 
+ 	if (!sysctl_protected_symlinks)
+ 		return 0;
+@@ -916,7 +917,8 @@ static inline int may_follow_link(struct nameidata *nd)
+ 		return 0;
+ 
+ 	/* Allowed if parent directory and link owner match. */
+-	if (uid_eq(parent->i_uid, inode->i_uid))
++	puid = parent->i_uid;
++	if (uid_valid(puid) && uid_eq(puid, inode->i_uid))
+ 		return 0;
+ 
+ 	if (nd->flags & LOOKUP_RCU)
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 80aa6f1..4133aa7 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -80,6 +80,8 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
+ 	}
+ 
+ 	for (name = buf; name < (buf + list_size); name += strlen(name) + 1) {
++		if (ovl_is_private_xattr(name))
++			continue;
+ retry:
+ 		size = vfs_getxattr(old, name, value, value_size);
+ 		if (size == -ERANGE)
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index d1cdc60..ac98a71 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -231,7 +231,7 @@ static int ovl_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
+ }
+ 
+ 
+-static bool ovl_is_private_xattr(const char *name)
++bool ovl_is_private_xattr(const char *name)
+ {
+ 	return strncmp(name, OVL_XATTR_PRE_NAME, OVL_XATTR_PRE_LEN) == 0;
+ }
+@@ -279,24 +279,27 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
+ {
+ 	struct dentry *realdentry = ovl_dentry_real(dentry);
+ 	ssize_t res;
+-	int off;
++	size_t len;
++	char *s;
+ 
+ 	res = vfs_listxattr(realdentry, list, size);
+ 	if (res <= 0 || size == 0)
+ 		return res;
+ 
+ 	/* filter out private xattrs */
+-	for (off = 0; off < res;) {
+-		char *s = list + off;
+-		size_t slen = strlen(s) + 1;
++	for (s = list, len = res; len;) {
++		size_t slen = strnlen(s, len) + 1;
+ 
+-		BUG_ON(off + slen > res);
++		/* underlying fs providing us with an broken xattr list? */
++		if (WARN_ON(slen > len))
++			return -EIO;
+ 
++		len -= slen;
+ 		if (ovl_is_private_xattr(s)) {
+ 			res -= slen;
+-			memmove(s, s + slen, res - off);
++			memmove(s, s + slen, len);
+ 		} else {
+-			off += slen;
++			s += slen;
+ 		}
+ 	}
+ 
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index cfbca53..d8ddc31 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -168,6 +168,8 @@ int ovl_check_empty_dir(struct dentry *dentry, struct list_head *list);
+ void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list);
+ void ovl_cache_free(struct list_head *list);
+ int ovl_check_d_type_supported(struct path *realpath);
++void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt,
++			 struct dentry *dentry, int level);
+ 
+ /* inode.c */
+ int ovl_setattr(struct dentry *dentry, struct iattr *attr);
+@@ -180,6 +182,7 @@ ssize_t ovl_getxattr(struct dentry *dentry, struct inode *inode,
+ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
+ int ovl_removexattr(struct dentry *dentry, const char *name);
+ struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags);
++bool ovl_is_private_xattr(const char *name);
+ 
+ struct inode *ovl_new_inode(struct super_block *sb, umode_t mode,
+ 			    struct ovl_entry *oe);
+diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
+index cf37fc7..f241b4e 100644
+--- a/fs/overlayfs/readdir.c
++++ b/fs/overlayfs/readdir.c
+@@ -248,7 +248,7 @@ static inline int ovl_dir_read(struct path *realpath,
+ 			err = rdd->err;
+ 	} while (!err && rdd->count);
+ 
+-	if (!err && rdd->first_maybe_whiteout)
++	if (!err && rdd->first_maybe_whiteout && rdd->dentry)
+ 		err = ovl_check_whiteouts(realpath->dentry, rdd);
+ 
+ 	fput(realfile);
+@@ -606,3 +606,64 @@ int ovl_check_d_type_supported(struct path *realpath)
+ 
+ 	return rdd.d_type_supported;
+ }
++
++static void ovl_workdir_cleanup_recurse(struct path *path, int level)
++{
++	int err;
++	struct inode *dir = path->dentry->d_inode;
++	LIST_HEAD(list);
++	struct ovl_cache_entry *p;
++	struct ovl_readdir_data rdd = {
++		.ctx.actor = ovl_fill_merge,
++		.dentry = NULL,
++		.list = &list,
++		.root = RB_ROOT,
++		.is_lowest = false,
++	};
++
++	err = ovl_dir_read(path, &rdd);
++	if (err)
++		goto out;
++
++	inode_lock_nested(dir, I_MUTEX_PARENT);
++	list_for_each_entry(p, &list, l_node) {
++		struct dentry *dentry;
++
++		if (p->name[0] == '.') {
++			if (p->len == 1)
++				continue;
++			if (p->len == 2 && p->name[1] == '.')
++				continue;
++		}
++		dentry = lookup_one_len(p->name, path->dentry, p->len);
++		if (IS_ERR(dentry))
++			continue;
++		if (dentry->d_inode)
++			ovl_workdir_cleanup(dir, path->mnt, dentry, level);
++		dput(dentry);
++	}
++	inode_unlock(dir);
++out:
++	ovl_cache_free(&list);
++}
++
++void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt,
++			 struct dentry *dentry, int level)
++{
++	int err;
++
++	if (!d_is_dir(dentry) || level > 1) {
++		ovl_cleanup(dir, dentry);
++		return;
++	}
++
++	err = ovl_do_rmdir(dir, dentry);
++	if (err) {
++		struct path path = { .mnt = mnt, .dentry = dentry };
++
++		inode_unlock(dir);
++		ovl_workdir_cleanup_recurse(&path, level + 1);
++		inode_lock_nested(dir, I_MUTEX_PARENT);
++		ovl_cleanup(dir, dentry);
++	}
++}
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 6db75cb..86f2025 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -798,6 +798,10 @@ retry:
+ 		struct kstat stat = {
+ 			.mode = S_IFDIR | 0,
+ 		};
++		struct iattr attr = {
++			.ia_valid = ATTR_MODE,
++			.ia_mode = stat.mode,
++		};
+ 
+ 		if (work->d_inode) {
+ 			err = -EEXIST;
+@@ -805,7 +809,7 @@ retry:
+ 				goto out_dput;
+ 
+ 			retried = true;
+-			ovl_cleanup(dir, work);
++			ovl_workdir_cleanup(dir, mnt, work, 0);
+ 			dput(work);
+ 			goto retry;
+ 		}
+@@ -813,6 +817,21 @@ retry:
+ 		err = ovl_create_real(dir, work, &stat, NULL, NULL, true);
+ 		if (err)
+ 			goto out_dput;
++
++		err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT);
++		if (err && err != -ENODATA && err != -EOPNOTSUPP)
++			goto out_dput;
++
++		err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS);
++		if (err && err != -ENODATA && err != -EOPNOTSUPP)
++			goto out_dput;
++
++		/* Clear any inherited mode bits */
++		inode_lock(work->d_inode);
++		err = notify_change(work, &attr, NULL);
++		inode_unlock(work->d_inode);
++		if (err)
++			goto out_dput;
+ 	}
+ out_unlock:
+ 	inode_unlock(dir);
+diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
+index b45345d..51157da 100644
+--- a/fs/ubifs/tnc_commit.c
++++ b/fs/ubifs/tnc_commit.c
+@@ -370,7 +370,7 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
+ 
+ 	p = c->gap_lebs;
+ 	do {
+-		ubifs_assert(p < c->gap_lebs + sizeof(int) * c->lst.idx_lebs);
++		ubifs_assert(p < c->gap_lebs + c->lst.idx_lebs);
+ 		written = layout_leb_in_gaps(c, p);
+ 		if (written < 0) {
+ 			err = written;
+diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
+index b5fc279..c63710f 100644
+--- a/fs/ubifs/xattr.c
++++ b/fs/ubifs/xattr.c
+@@ -575,7 +575,8 @@ static int ubifs_xattr_get(const struct xattr_handler *handler,
+ 	dbg_gen("xattr '%s', ino %lu ('%pd'), buf size %zd", name,
+ 		inode->i_ino, dentry, size);
+ 
+-	return  __ubifs_getxattr(inode, name, buffer, size);
++	name = xattr_full_name(handler, name);
++	return __ubifs_getxattr(inode, name, buffer, size);
+ }
+ 
+ static int ubifs_xattr_set(const struct xattr_handler *handler,
+@@ -586,6 +587,8 @@ static int ubifs_xattr_set(const struct xattr_handler *handler,
+ 	dbg_gen("xattr '%s', host ino %lu ('%pd'), size %zd",
+ 		name, inode->i_ino, dentry, size);
+ 
++	name = xattr_full_name(handler, name);
++
+ 	if (value)
+ 		return __ubifs_setxattr(inode, name, value, size, flags);
+ 	else
+diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
+index 12ca867..85bdf3d 100644
+--- a/fs/xfs/libxfs/xfs_sb.c
++++ b/fs/xfs/libxfs/xfs_sb.c
+@@ -581,7 +581,8 @@ xfs_sb_verify(
+ 	 * Only check the in progress field for the primary superblock as
+ 	 * mkfs.xfs doesn't clear it from secondary superblocks.
+ 	 */
+-	return xfs_mount_validate_sb(mp, &sb, bp->b_bn == XFS_SB_DADDR,
++	return xfs_mount_validate_sb(mp, &sb,
++				     bp->b_maps[0].bm_bn == XFS_SB_DADDR,
+ 				     check_version);
+ }
+ 
+diff --git a/include/linux/capability.h b/include/linux/capability.h
+index 00690ff..5f3c63d 100644
+--- a/include/linux/capability.h
++++ b/include/linux/capability.h
+@@ -206,6 +206,7 @@ extern bool has_ns_capability_noaudit(struct task_struct *t,
+ 				      struct user_namespace *ns, int cap);
+ extern bool capable(int cap);
+ extern bool ns_capable(struct user_namespace *ns, int cap);
++extern bool ns_capable_noaudit(struct user_namespace *ns, int cap);
+ #else
+ static inline bool has_capability(struct task_struct *t, int cap)
+ {
+@@ -233,6 +234,10 @@ static inline bool ns_capable(struct user_namespace *ns, int cap)
+ {
+ 	return true;
+ }
++static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap)
++{
++	return true;
++}
+ #endif /* CONFIG_MULTIUSER */
+ extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap);
+ extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
+diff --git a/kernel/capability.c b/kernel/capability.c
+index 45432b5..00411c8 100644
+--- a/kernel/capability.c
++++ b/kernel/capability.c
+@@ -361,6 +361,24 @@ bool has_capability_noaudit(struct task_struct *t, int cap)
+ 	return has_ns_capability_noaudit(t, &init_user_ns, cap);
+ }
+ 
++static bool ns_capable_common(struct user_namespace *ns, int cap, bool audit)
++{
++	int capable;
++
++	if (unlikely(!cap_valid(cap))) {
++		pr_crit("capable() called with invalid cap=%u\n", cap);
++		BUG();
++	}
++
++	capable = audit ? security_capable(current_cred(), ns, cap) :
++			  security_capable_noaudit(current_cred(), ns, cap);
++	if (capable == 0) {
++		current->flags |= PF_SUPERPRIV;
++		return true;
++	}
++	return false;
++}
++
+ /**
+  * ns_capable - Determine if the current task has a superior capability in effect
+  * @ns:  The usernamespace we want the capability in
+@@ -374,19 +392,27 @@ bool has_capability_noaudit(struct task_struct *t, int cap)
+  */
+ bool ns_capable(struct user_namespace *ns, int cap)
+ {
+-	if (unlikely(!cap_valid(cap))) {
+-		pr_crit("capable() called with invalid cap=%u\n", cap);
+-		BUG();
+-	}
+-
+-	if (security_capable(current_cred(), ns, cap) == 0) {
+-		current->flags |= PF_SUPERPRIV;
+-		return true;
+-	}
+-	return false;
++	return ns_capable_common(ns, cap, true);
+ }
+ EXPORT_SYMBOL(ns_capable);
+ 
++/**
++ * ns_capable_noaudit - Determine if the current task has a superior capability
++ * (unaudited) in effect
++ * @ns:  The usernamespace we want the capability in
++ * @cap: The capability to be tested for
++ *
++ * Return true if the current task has the given superior capability currently
++ * available for use, false if not.
++ *
++ * This sets PF_SUPERPRIV on the task if the capability is available on the
++ * assumption that it's about to be used.
++ */
++bool ns_capable_noaudit(struct user_namespace *ns, int cap)
++{
++	return ns_capable_common(ns, cap, false);
++}
++EXPORT_SYMBOL(ns_capable_noaudit);
+ 
+ /**
+  * capable - Determine if the current task has a superior capability in effect
+diff --git a/kernel/cred.c b/kernel/cred.c
+index 0c0cd8a..5f264fb 100644
+--- a/kernel/cred.c
++++ b/kernel/cred.c
+@@ -689,6 +689,8 @@ EXPORT_SYMBOL(set_security_override_from_ctx);
+  */
+ int set_create_files_as(struct cred *new, struct inode *inode)
+ {
++	if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid))
++		return -EINVAL;
+ 	new->fsuid = inode->i_uid;
+ 	new->fsgid = inode->i_gid;
+ 	return security_kernel_create_files_as(new, inode);
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 4a7ec0c..aea4f4d 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1406,7 +1406,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ 	p->real_start_time = ktime_get_boot_ns();
+ 	p->io_context = NULL;
+ 	p->audit_context = NULL;
+-	threadgroup_change_begin(current);
+ 	cgroup_fork(p);
+ #ifdef CONFIG_NUMA
+ 	p->mempolicy = mpol_dup(p->mempolicy);
+@@ -1558,6 +1557,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ 	INIT_LIST_HEAD(&p->thread_group);
+ 	p->task_works = NULL;
+ 
++	threadgroup_change_begin(current);
+ 	/*
+ 	 * Ensure that the cgroup subsystem policies allow the new process to be
+ 	 * forked. It should be noted the the new process's css_set can be changed
+@@ -1658,6 +1658,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ bad_fork_cancel_cgroup:
+ 	cgroup_cancel_fork(p);
+ bad_fork_free_pid:
++	threadgroup_change_end(current);
+ 	if (pid != &init_struct_pid)
+ 		free_pid(pid);
+ bad_fork_cleanup_thread:
+@@ -1690,7 +1691,6 @@ bad_fork_cleanup_policy:
+ 	mpol_put(p->mempolicy);
+ bad_fork_cleanup_threadgroup_lock:
+ #endif
+-	threadgroup_change_end(current);
+ 	delayacct_tsk_free(p);
+ bad_fork_cleanup_count:
+ 	atomic_dec(&p->cred->user->processes);
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 479d25c..b6c3945 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -401,7 +401,10 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf)
+ 	do {
+ 		seq = raw_read_seqcount_latch(&tkf->seq);
+ 		tkr = tkf->base + (seq & 0x01);
+-		now = ktime_to_ns(tkr->base) + timekeeping_get_ns(tkr);
++		now = ktime_to_ns(tkr->base);
++
++		now += clocksource_delta(tkr->read(tkr->clock),
++					 tkr->cycle_last, tkr->mask);
+ 	} while (read_seqcount_retry(&tkf->seq, seq));
+ 
+ 	return now;
+diff --git a/kernel/time/timekeeping_debug.c b/kernel/time/timekeeping_debug.c
+index f6bd652..107310a 100644
+--- a/kernel/time/timekeeping_debug.c
++++ b/kernel/time/timekeeping_debug.c
+@@ -23,7 +23,9 @@
+ 
+ #include "timekeeping_internal.h"
+ 
+-static unsigned int sleep_time_bin[32] = {0};
++#define NUM_BINS 32
++
++static unsigned int sleep_time_bin[NUM_BINS] = {0};
+ 
+ static int tk_debug_show_sleep_time(struct seq_file *s, void *data)
+ {
+@@ -69,6 +71,9 @@ late_initcall(tk_debug_sleep_time_init);
+ 
+ void tk_debug_account_sleep_time(struct timespec64 *t)
+ {
+-	sleep_time_bin[fls(t->tv_sec)]++;
++	/* Cap bin index so we don't overflow the array */
++	int bin = min(fls(t->tv_sec), NUM_BINS-1);
++
++	sleep_time_bin[bin]++;
+ }
+ 
+diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c
+index c094754..f02ab80 100644
+--- a/net/sunrpc/xprtrdma/frwr_ops.c
++++ b/net/sunrpc/xprtrdma/frwr_ops.c
+@@ -125,17 +125,16 @@ __frwr_reset_mr(struct rpcrdma_ia *ia, struct rpcrdma_mw *r)
+ }
+ 
+ static void
+-__frwr_reset_and_unmap(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mw *mw)
++__frwr_reset_and_unmap(struct rpcrdma_mw *mw)
+ {
++	struct rpcrdma_xprt *r_xprt = mw->mw_xprt;
+ 	struct rpcrdma_ia *ia = &r_xprt->rx_ia;
+-	struct rpcrdma_frmr *f = &mw->frmr;
+ 	int rc;
+ 
+ 	rc = __frwr_reset_mr(ia, mw);
+-	ib_dma_unmap_sg(ia->ri_device, f->fr_sg, f->fr_nents, f->fr_dir);
++	ib_dma_unmap_sg(ia->ri_device, mw->mw_sg, mw->mw_nents, mw->mw_dir);
+ 	if (rc)
+ 		return;
+-
+ 	rpcrdma_put_mw(r_xprt, mw);
+ }
+ 
+@@ -152,8 +151,7 @@ __frwr_recovery_worker(struct work_struct *work)
+ 	struct rpcrdma_mw *r = container_of(work, struct rpcrdma_mw,
+ 					    mw_work);
+ 
+-	__frwr_reset_and_unmap(r->mw_xprt, r);
+-	return;
++	__frwr_reset_and_unmap(r);
+ }
+ 
+ /* A broken MR was discovered in a context that can't sleep.
+@@ -167,8 +165,7 @@ __frwr_queue_recovery(struct rpcrdma_mw *r)
+ }
+ 
+ static int
+-__frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, struct ib_device *device,
+-	    unsigned int depth)
++__frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, unsigned int depth)
+ {
+ 	struct rpcrdma_frmr *f = &r->frmr;
+ 	int rc;
+@@ -177,11 +174,11 @@ __frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, struct ib_device *device,
+ 	if (IS_ERR(f->fr_mr))
+ 		goto out_mr_err;
+ 
+-	f->fr_sg = kcalloc(depth, sizeof(*f->fr_sg), GFP_KERNEL);
+-	if (!f->fr_sg)
++	r->mw_sg = kcalloc(depth, sizeof(*r->mw_sg), GFP_KERNEL);
++	if (!r->mw_sg)
+ 		goto out_list_err;
+ 
+-	sg_init_table(f->fr_sg, depth);
++	sg_init_table(r->mw_sg, depth);
+ 
+ 	init_completion(&f->fr_linv_done);
+ 
+@@ -210,7 +207,7 @@ __frwr_release(struct rpcrdma_mw *r)
+ 	if (rc)
+ 		dprintk("RPC:       %s: ib_dereg_mr status %i\n",
+ 			__func__, rc);
+-	kfree(r->frmr.fr_sg);
++	kfree(r->mw_sg);
+ }
+ 
+ static int
+@@ -350,7 +347,6 @@ static int
+ frwr_op_init(struct rpcrdma_xprt *r_xprt)
+ {
+ 	struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
+-	struct ib_device *device = r_xprt->rx_ia.ri_device;
+ 	unsigned int depth = r_xprt->rx_ia.ri_max_frmr_depth;
+ 	struct ib_pd *pd = r_xprt->rx_ia.ri_pd;
+ 	int i;
+@@ -372,7 +368,7 @@ frwr_op_init(struct rpcrdma_xprt *r_xprt)
+ 		if (!r)
+ 			return -ENOMEM;
+ 
+-		rc = __frwr_init(r, pd, device, depth);
++		rc = __frwr_init(r, pd, depth);
+ 		if (rc) {
+ 			kfree(r);
+ 			return rc;
+@@ -386,7 +382,7 @@ frwr_op_init(struct rpcrdma_xprt *r_xprt)
+ 	return 0;
+ }
+ 
+-/* Post a FAST_REG Work Request to register a memory region
++/* Post a REG_MR Work Request to register a memory region
+  * for remote access via RDMA READ or RDMA WRITE.
+  */
+ static int
+@@ -394,8 +390,6 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
+ 	    int nsegs, bool writing)
+ {
+ 	struct rpcrdma_ia *ia = &r_xprt->rx_ia;
+-	struct ib_device *device = ia->ri_device;
+-	enum dma_data_direction direction = rpcrdma_data_dir(writing);
+ 	struct rpcrdma_mr_seg *seg1 = seg;
+ 	struct rpcrdma_mw *mw;
+ 	struct rpcrdma_frmr *frmr;
+@@ -421,15 +415,14 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
+ 
+ 	if (nsegs > ia->ri_max_frmr_depth)
+ 		nsegs = ia->ri_max_frmr_depth;
+-
+ 	for (i = 0; i < nsegs;) {
+ 		if (seg->mr_page)
+-			sg_set_page(&frmr->fr_sg[i],
++			sg_set_page(&mw->mw_sg[i],
+ 				    seg->mr_page,
+ 				    seg->mr_len,
+ 				    offset_in_page(seg->mr_offset));
+ 		else
+-			sg_set_buf(&frmr->fr_sg[i], seg->mr_offset,
++			sg_set_buf(&mw->mw_sg[i], seg->mr_offset,
+ 				   seg->mr_len);
+ 
+ 		++seg;
+@@ -440,26 +433,20 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
+ 		    offset_in_page((seg-1)->mr_offset + (seg-1)->mr_len))
+ 			break;
+ 	}
+-	frmr->fr_nents = i;
+-	frmr->fr_dir = direction;
+-
+-	dma_nents = ib_dma_map_sg(device, frmr->fr_sg, frmr->fr_nents, direction);
+-	if (!dma_nents) {
+-		pr_err("RPC:       %s: failed to dma map sg %p sg_nents %u\n",
+-		       __func__, frmr->fr_sg, frmr->fr_nents);
+-		return -ENOMEM;
+-	}
++	mw->mw_nents = i;
++	mw->mw_dir = rpcrdma_data_dir(writing);
+ 
+-	n = ib_map_mr_sg(mr, frmr->fr_sg, frmr->fr_nents, NULL, PAGE_SIZE);
+-	if (unlikely(n != frmr->fr_nents)) {
+-		pr_err("RPC:       %s: failed to map mr %p (%u/%u)\n",
+-		       __func__, frmr->fr_mr, n, frmr->fr_nents);
+-		rc = n < 0 ? n : -EINVAL;
+-		goto out_senderr;
+-	}
++	dma_nents = ib_dma_map_sg(ia->ri_device,
++				  mw->mw_sg, mw->mw_nents, mw->mw_dir);
++	if (!dma_nents)
++		goto out_dmamap_err;
++
++	n = ib_map_mr_sg(mr, mw->mw_sg, mw->mw_nents, NULL, PAGE_SIZE);
++	if (unlikely(n != mw->mw_nents))
++		goto out_mapmr_err;
+ 
+ 	dprintk("RPC:       %s: Using frmr %p to map %u segments (%u bytes)\n",
+-		__func__, mw, frmr->fr_nents, mr->length);
++		__func__, mw, mw->mw_nents, mr->length);
+ 
+ 	key = (u8)(mr->rkey & 0x000000FF);
+ 	ib_update_fast_reg_key(mr, ++key);
+@@ -484,13 +471,25 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
+ 	seg1->rl_mw = mw;
+ 	seg1->mr_rkey = mr->rkey;
+ 	seg1->mr_base = mr->iova;
+-	seg1->mr_nsegs = frmr->fr_nents;
++	seg1->mr_nsegs = mw->mw_nents;
+ 	seg1->mr_len = mr->length;
+ 
+-	return frmr->fr_nents;
++	return mw->mw_nents;
++
++out_dmamap_err:
++	pr_err("rpcrdma: failed to dma map sg %p sg_nents %u\n",
++	       mw->mw_sg, mw->mw_nents);
++	return -ENOMEM;
++
++out_mapmr_err:
++	pr_err("rpcrdma: failed to map mr %p (%u/%u)\n",
++	       frmr->fr_mr, n, mw->mw_nents);
++	rc = n < 0 ? n : -EIO;
++	__frwr_queue_recovery(mw);
++	return rc;
+ 
+ out_senderr:
+-	dprintk("RPC:       %s: ib_post_send status %i\n", __func__, rc);
++	pr_err("rpcrdma: ib_post_send status %i\n", rc);
+ 	__frwr_queue_recovery(mw);
+ 	return rc;
+ }
+@@ -582,8 +581,8 @@ unmap:
+ 		mw = seg->rl_mw;
+ 		seg->rl_mw = NULL;
+ 
+-		ib_dma_unmap_sg(ia->ri_device, f->fr_sg, f->fr_nents,
+-				f->fr_dir);
++		ib_dma_unmap_sg(ia->ri_device,
++				mw->mw_sg, mw->mw_nents, mw->mw_dir);
+ 		rpcrdma_put_mw(r_xprt, mw);
+ 
+ 		i += seg->mr_nsegs;
+@@ -630,7 +629,7 @@ frwr_op_unmap_safe(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req,
+ 		mw = seg->rl_mw;
+ 
+ 		if (sync)
+-			__frwr_reset_and_unmap(r_xprt, mw);
++			__frwr_reset_and_unmap(mw);
+ 		else
+ 			__frwr_queue_recovery(mw);
+ 
+diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
+index 95cdc66..c53abd1 100644
+--- a/net/sunrpc/xprtrdma/xprt_rdma.h
++++ b/net/sunrpc/xprtrdma/xprt_rdma.h
+@@ -221,9 +221,6 @@ enum rpcrdma_frmr_state {
+ };
+ 
+ struct rpcrdma_frmr {
+-	struct scatterlist		*fr_sg;
+-	int				fr_nents;
+-	enum dma_data_direction		fr_dir;
+ 	struct ib_mr			*fr_mr;
+ 	struct ib_cqe			fr_cqe;
+ 	enum rpcrdma_frmr_state		fr_state;
+@@ -240,13 +237,16 @@ struct rpcrdma_fmr {
+ };
+ 
+ struct rpcrdma_mw {
++	struct list_head	mw_list;
++	struct scatterlist	*mw_sg;
++	int			mw_nents;
++	enum dma_data_direction	mw_dir;
+ 	union {
+ 		struct rpcrdma_fmr	fmr;
+ 		struct rpcrdma_frmr	frmr;
+ 	};
+ 	struct work_struct	mw_work;
+ 	struct rpcrdma_xprt	*mw_xprt;
+-	struct list_head	mw_list;
+ 	struct list_head	mw_all;
+ };
+ 
+diff --git a/net/sysctl_net.c b/net/sysctl_net.c
+index ed98c1f..46a71c7 100644
+--- a/net/sysctl_net.c
++++ b/net/sysctl_net.c
+@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ctl_table_header *head,
+ 	kgid_t root_gid = make_kgid(net->user_ns, 0);
+ 
+ 	/* Allow network administrator to have same access as root. */
+-	if (ns_capable(net->user_ns, CAP_NET_ADMIN) ||
++	if (ns_capable_noaudit(net->user_ns, CAP_NET_ADMIN) ||
+ 	    uid_eq(root_uid, current_euid())) {
+ 		int mode = (table->mode >> 6) & 7;
+ 		return (mode << 6) | (mode << 3) | mode;
+diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
+index 705c287..7347fcc 100644
+--- a/security/apparmor/policy.c
++++ b/security/apparmor/policy.c
+@@ -766,7 +766,9 @@ struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name)
+ 	struct aa_profile *profile;
+ 
+ 	rcu_read_lock();
+-	profile = aa_get_profile(__find_child(&parent->base.profiles, name));
++	do {
++		profile = __find_child(&parent->base.profiles, name);
++	} while (profile && !aa_get_profile_not0(profile));
+ 	rcu_read_unlock();
+ 
+ 	/* refcount released by caller */
+diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
+index 795437b..b450a27 100644
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -1633,11 +1633,13 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
+ 		return -EBUSY;
+ 	}
+ 	list_add_tail(&rmidi->list, &snd_rawmidi_devices);
++	mutex_unlock(&register_mutex);
+ 	err = snd_register_device(SNDRV_DEVICE_TYPE_RAWMIDI,
+ 				  rmidi->card, rmidi->device,
+ 				  &snd_rawmidi_f_ops, rmidi, &rmidi->dev);
+ 	if (err < 0) {
+ 		rmidi_err(rmidi, "unable to register\n");
++		mutex_lock(&register_mutex);
+ 		list_del(&rmidi->list);
+ 		mutex_unlock(&register_mutex);
+ 		return err;
+@@ -1645,6 +1647,7 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
+ 	if (rmidi->ops && rmidi->ops->dev_register &&
+ 	    (err = rmidi->ops->dev_register(rmidi)) < 0) {
+ 		snd_unregister_device(&rmidi->dev);
++		mutex_lock(&register_mutex);
+ 		list_del(&rmidi->list);
+ 		mutex_unlock(&register_mutex);
+ 		return err;
+@@ -1677,7 +1680,6 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
+ 		}
+ 	}
+ #endif /* CONFIG_SND_OSSEMUL */
+-	mutex_unlock(&register_mutex);
+ 	sprintf(name, "midi%d", rmidi->device);
+ 	entry = snd_info_create_card_entry(rmidi->card, name, rmidi->card->proc_root);
+ 	if (entry) {
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 9a6157e..fc144f4 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -35,6 +35,9 @@
+ #include <sound/initval.h>
+ #include <linux/kmod.h>
+ 
++/* internal flags */
++#define SNDRV_TIMER_IFLG_PAUSED		0x00010000
++
+ #if IS_ENABLED(CONFIG_SND_HRTIMER)
+ #define DEFAULT_TIMER_LIMIT 4
+ #else
+@@ -294,8 +297,21 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ 		get_device(&timer->card->card_dev);
+ 	timeri->slave_class = tid->dev_sclass;
+ 	timeri->slave_id = slave_id;
+-	if (list_empty(&timer->open_list_head) && timer->hw.open)
+-		timer->hw.open(timer);
++
++	if (list_empty(&timer->open_list_head) && timer->hw.open) {
++		int err = timer->hw.open(timer);
++		if (err) {
++			kfree(timeri->owner);
++			kfree(timeri);
++
++			if (timer->card)
++				put_device(&timer->card->card_dev);
++			module_put(timer->module);
++			mutex_unlock(&register_mutex);
++			return err;
++		}
++	}
++
+ 	list_add_tail(&timeri->open_list, &timer->open_list_head);
+ 	snd_timer_check_master(timeri);
+ 	mutex_unlock(&register_mutex);
+@@ -526,6 +542,10 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop)
+ 		}
+ 	}
+ 	timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START);
++	if (stop)
++		timeri->flags &= ~SNDRV_TIMER_IFLG_PAUSED;
++	else
++		timeri->flags |= SNDRV_TIMER_IFLG_PAUSED;
+ 	snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
+ 			  SNDRV_TIMER_EVENT_CONTINUE);
+  unlock:
+@@ -587,6 +607,10 @@ int snd_timer_stop(struct snd_timer_instance *timeri)
+  */
+ int snd_timer_continue(struct snd_timer_instance *timeri)
+ {
++	/* timer can continue only after pause */
++	if (!(timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
++		return -EINVAL;
++
+ 	if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE)
+ 		return snd_timer_start_slave(timeri, false);
+ 	else
+@@ -813,6 +837,7 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid,
+ 	timer->tmr_subdevice = tid->subdevice;
+ 	if (id)
+ 		strlcpy(timer->id, id, sizeof(timer->id));
++	timer->sticks = 1;
+ 	INIT_LIST_HEAD(&timer->device_list);
+ 	INIT_LIST_HEAD(&timer->open_list_head);
+ 	INIT_LIST_HEAD(&timer->active_list_head);
+@@ -1817,6 +1842,9 @@ static int snd_timer_user_continue(struct file *file)
+ 	tu = file->private_data;
+ 	if (!tu->timeri)
+ 		return -EBADFD;
++	/* start timer instead of continue if it's not used before */
++	if (!(tu->timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
++		return snd_timer_user_start(file);
+ 	tu->timeri->lost = 0;
+ 	return (err = snd_timer_continue(tu->timeri)) < 0 ? err : 0;
+ }
+@@ -1958,6 +1986,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
+ 		tu->qused--;
+ 		spin_unlock_irq(&tu->qlock);
+ 
++		mutex_lock(&tu->ioctl_lock);
+ 		if (tu->tread) {
+ 			if (copy_to_user(buffer, &tu->tqueue[qhead],
+ 					 sizeof(struct snd_timer_tread)))
+@@ -1967,6 +1996,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
+ 					 sizeof(struct snd_timer_read)))
+ 				err = -EFAULT;
+ 		}
++		mutex_unlock(&tu->ioctl_lock);
+ 
+ 		spin_lock_irq(&tu->qlock);
+ 		if (err < 0)
+diff --git a/sound/firewire/fireworks/fireworks.h b/sound/firewire/fireworks/fireworks.h
+index 03ed352..d73c12b 100644
+--- a/sound/firewire/fireworks/fireworks.h
++++ b/sound/firewire/fireworks/fireworks.h
+@@ -108,7 +108,6 @@ struct snd_efw {
+ 	u8 *resp_buf;
+ 	u8 *pull_ptr;
+ 	u8 *push_ptr;
+-	unsigned int resp_queues;
+ };
+ 
+ int snd_efw_transaction_cmd(struct fw_unit *unit,
+diff --git a/sound/firewire/fireworks/fireworks_hwdep.c b/sound/firewire/fireworks/fireworks_hwdep.c
+index 33df865..2e1d9a2 100644
+--- a/sound/firewire/fireworks/fireworks_hwdep.c
++++ b/sound/firewire/fireworks/fireworks_hwdep.c
+@@ -25,6 +25,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
+ {
+ 	unsigned int length, till_end, type;
+ 	struct snd_efw_transaction *t;
++	u8 *pull_ptr;
+ 	long count = 0;
+ 
+ 	if (remained < sizeof(type) + sizeof(struct snd_efw_transaction))
+@@ -38,8 +39,17 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
+ 	buf += sizeof(type);
+ 
+ 	/* write into buffer as many responses as possible */
+-	while (efw->resp_queues > 0) {
+-		t = (struct snd_efw_transaction *)(efw->pull_ptr);
++	spin_lock_irq(&efw->lock);
++
++	/*
++	 * When another task reaches here during this task's access to user
++	 * space, it picks up current position in buffer and can read the same
++	 * series of responses.
++	 */
++	pull_ptr = efw->pull_ptr;
++
++	while (efw->push_ptr != pull_ptr) {
++		t = (struct snd_efw_transaction *)(pull_ptr);
+ 		length = be32_to_cpu(t->length) * sizeof(__be32);
+ 
+ 		/* confirm enough space for this response */
+@@ -49,26 +59,39 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
+ 		/* copy from ring buffer to user buffer */
+ 		while (length > 0) {
+ 			till_end = snd_efw_resp_buf_size -
+-				(unsigned int)(efw->pull_ptr - efw->resp_buf);
++				(unsigned int)(pull_ptr - efw->resp_buf);
+ 			till_end = min_t(unsigned int, length, till_end);
+ 
+-			if (copy_to_user(buf, efw->pull_ptr, till_end))
++			spin_unlock_irq(&efw->lock);
++
++			if (copy_to_user(buf, pull_ptr, till_end))
+ 				return -EFAULT;
+ 
+-			efw->pull_ptr += till_end;
+-			if (efw->pull_ptr >= efw->resp_buf +
+-					     snd_efw_resp_buf_size)
+-				efw->pull_ptr -= snd_efw_resp_buf_size;
++			spin_lock_irq(&efw->lock);
++
++			pull_ptr += till_end;
++			if (pull_ptr >= efw->resp_buf + snd_efw_resp_buf_size)
++				pull_ptr -= snd_efw_resp_buf_size;
+ 
+ 			length -= till_end;
+ 			buf += till_end;
+ 			count += till_end;
+ 			remained -= till_end;
+ 		}
+-
+-		efw->resp_queues--;
+ 	}
+ 
++	/*
++	 * All of tasks can read from the buffer nearly simultaneously, but the
++	 * last position for each task is different depending on the length of
++	 * given buffer. Here, for simplicity, a position of buffer is set by
++	 * the latest task. It's better for a listening application to allow one
++	 * thread to read from the buffer. Unless, each task can read different
++	 * sequence of responses depending on variation of buffer length.
++	 */
++	efw->pull_ptr = pull_ptr;
++
++	spin_unlock_irq(&efw->lock);
++
+ 	return count;
+ }
+ 
+@@ -76,14 +99,17 @@ static long
+ hwdep_read_locked(struct snd_efw *efw, char __user *buf, long count,
+ 		  loff_t *offset)
+ {
+-	union snd_firewire_event event;
++	union snd_firewire_event event = {
++		.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS,
++	};
+ 
+-	memset(&event, 0, sizeof(event));
++	spin_lock_irq(&efw->lock);
+ 
+-	event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
+ 	event.lock_status.status = (efw->dev_lock_count > 0);
+ 	efw->dev_lock_changed = false;
+ 
++	spin_unlock_irq(&efw->lock);
++
+ 	count = min_t(long, count, sizeof(event.lock_status));
+ 
+ 	if (copy_to_user(buf, &event, count))
+@@ -98,10 +124,15 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
+ {
+ 	struct snd_efw *efw = hwdep->private_data;
+ 	DEFINE_WAIT(wait);
++	bool dev_lock_changed;
++	bool queued;
+ 
+ 	spin_lock_irq(&efw->lock);
+ 
+-	while ((!efw->dev_lock_changed) && (efw->resp_queues == 0)) {
++	dev_lock_changed = efw->dev_lock_changed;
++	queued = efw->push_ptr != efw->pull_ptr;
++
++	while (!dev_lock_changed && !queued) {
+ 		prepare_to_wait(&efw->hwdep_wait, &wait, TASK_INTERRUPTIBLE);
+ 		spin_unlock_irq(&efw->lock);
+ 		schedule();
+@@ -109,15 +140,17 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
+ 		if (signal_pending(current))
+ 			return -ERESTARTSYS;
+ 		spin_lock_irq(&efw->lock);
++		dev_lock_changed = efw->dev_lock_changed;
++		queued = efw->push_ptr != efw->pull_ptr;
+ 	}
+ 
+-	if (efw->dev_lock_changed)
++	spin_unlock_irq(&efw->lock);
++
++	if (dev_lock_changed)
+ 		count = hwdep_read_locked(efw, buf, count, offset);
+-	else if (efw->resp_queues > 0)
++	else if (queued)
+ 		count = hwdep_read_resp_buf(efw, buf, count, offset);
+ 
+-	spin_unlock_irq(&efw->lock);
+-
+ 	return count;
+ }
+ 
+@@ -160,7 +193,7 @@ hwdep_poll(struct snd_hwdep *hwdep, struct file *file, poll_table *wait)
+ 	poll_wait(file, &efw->hwdep_wait, wait);
+ 
+ 	spin_lock_irq(&efw->lock);
+-	if (efw->dev_lock_changed || (efw->resp_queues > 0))
++	if (efw->dev_lock_changed || efw->pull_ptr != efw->push_ptr)
+ 		events = POLLIN | POLLRDNORM;
+ 	else
+ 		events = 0;
+diff --git a/sound/firewire/fireworks/fireworks_proc.c b/sound/firewire/fireworks/fireworks_proc.c
+index 0639dcb..beb0a0f 100644
+--- a/sound/firewire/fireworks/fireworks_proc.c
++++ b/sound/firewire/fireworks/fireworks_proc.c
+@@ -188,8 +188,8 @@ proc_read_queues_state(struct snd_info_entry *entry,
+ 	else
+ 		consumed = (unsigned int)(efw->push_ptr - efw->pull_ptr);
+ 
+-	snd_iprintf(buffer, "%d %d/%d\n",
+-		    efw->resp_queues, consumed, snd_efw_resp_buf_size);
++	snd_iprintf(buffer, "%d/%d\n",
++		    consumed, snd_efw_resp_buf_size);
+ }
+ 
+ static void
+diff --git a/sound/firewire/fireworks/fireworks_transaction.c b/sound/firewire/fireworks/fireworks_transaction.c
+index f550808..36a08ba 100644
+--- a/sound/firewire/fireworks/fireworks_transaction.c
++++ b/sound/firewire/fireworks/fireworks_transaction.c
+@@ -121,11 +121,11 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
+ 	size_t capacity, till_end;
+ 	struct snd_efw_transaction *t;
+ 
+-	spin_lock_irq(&efw->lock);
+-
+ 	t = (struct snd_efw_transaction *)data;
+ 	length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length);
+ 
++	spin_lock_irq(&efw->lock);
++
+ 	if (efw->push_ptr < efw->pull_ptr)
+ 		capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr);
+ 	else
+@@ -155,7 +155,6 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
+ 	}
+ 
+ 	/* for hwdep */
+-	efw->resp_queues++;
+ 	wake_up(&efw->hwdep_wait);
+ 
+ 	*rcode = RCODE_COMPLETE;
+diff --git a/sound/firewire/tascam/tascam-hwdep.c b/sound/firewire/tascam/tascam-hwdep.c
+index 131267c..106406c 100644
+--- a/sound/firewire/tascam/tascam-hwdep.c
++++ b/sound/firewire/tascam/tascam-hwdep.c
+@@ -16,31 +16,14 @@
+ 
+ #include "tascam.h"
+ 
+-static long hwdep_read_locked(struct snd_tscm *tscm, char __user *buf,
+-			      long count)
+-{
+-	union snd_firewire_event event;
+-
+-	memset(&event, 0, sizeof(event));
+-
+-	event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
+-	event.lock_status.status = (tscm->dev_lock_count > 0);
+-	tscm->dev_lock_changed = false;
+-
+-	count = min_t(long, count, sizeof(event.lock_status));
+-
+-	if (copy_to_user(buf, &event, count))
+-		return -EFAULT;
+-
+-	return count;
+-}
+-
+ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
+ 		       loff_t *offset)
+ {
+ 	struct snd_tscm *tscm = hwdep->private_data;
+ 	DEFINE_WAIT(wait);
+-	union snd_firewire_event event;
++	union snd_firewire_event event = {
++		.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS,
++	};
+ 
+ 	spin_lock_irq(&tscm->lock);
+ 
+@@ -54,10 +37,16 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
+ 		spin_lock_irq(&tscm->lock);
+ 	}
+ 
+-	memset(&event, 0, sizeof(event));
+-	count = hwdep_read_locked(tscm, buf, count);
++	event.lock_status.status = (tscm->dev_lock_count > 0);
++	tscm->dev_lock_changed = false;
++
+ 	spin_unlock_irq(&tscm->lock);
+ 
++	count = min_t(long, count, sizeof(event.lock_status));
++
++	if (copy_to_user(buf, &event, count))
++		return -EFAULT;
++
+ 	return count;
+ }
+ 
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index f25479b..eaee626 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4840,6 +4840,7 @@ enum {
+ 	ALC221_FIXUP_HP_FRONT_MIC,
+ 	ALC292_FIXUP_TPT460,
+ 	ALC298_FIXUP_SPK_VOLUME,
++	ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER,
+ };
+ 
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -5501,6 +5502,15 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.chained = true,
+ 		.chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 	},
++	[ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{ 0x1b, 0x90170151 },
++			{ }
++		},
++		.chained = true,
++		.chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
++	},
+ };
+ 
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -5545,6 +5555,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
+ 	SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
+ 	SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
++	SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ 	SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
+ 	SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ 	SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+@@ -5879,6 +5890,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ 		{0x12, 0x90a60170},
+ 		{0x14, 0x90170120},
+ 		{0x21, 0x02211030}),
++	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell Inspiron 5468", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++		{0x12, 0x90a60180},
++		{0x14, 0x90170120},
++		{0x21, 0x02211030}),
+ 	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 		ALC256_STANDARD_PINS),
+ 	SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
+diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c
+index 1267e1a..633d54ca 100644
+--- a/sound/soc/atmel/atmel_ssc_dai.c
++++ b/sound/soc/atmel/atmel_ssc_dai.c
+@@ -299,8 +299,9 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream,
+ 	clk_enable(ssc_p->ssc->clk);
+ 	ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk);
+ 
+-	/* Reset the SSC to keep it at a clean status */
+-	ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST));
++	/* Reset the SSC unless initialized to keep it in a clean state */
++	if (!ssc_p->initialized)
++		ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST));
+ 
+ 	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
+ 		dir = 0;
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 6cf1f35..152292e 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1141,6 +1141,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
+ 	case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
+ 	case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
+ 	case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
++	case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
+ 	case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */
+ 	case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
+ 	case USB_ID(0x1de7, 0x0114): /* Phoenix Audio MT202pcs */
diff --git a/4.7.3/4420_grsecurity-3.1-4.7.3-201609072139.patch b/4.7.4/4420_grsecurity-3.1-4.7.4-201609152234.patch
index 34c7fa0..84d74fa 100644
--- a/4.7.3/4420_grsecurity-3.1-4.7.3-201609072139.patch
+++ b/4.7.4/4420_grsecurity-3.1-4.7.4-201609152234.patch
@@ -420,7 +420,7 @@ index a3683ce..5ec8bf4 100644
  
  A toggle value indicating if modules are allowed to be loaded
 diff --git a/Makefile b/Makefile
-index 4afff18..1c6d3b2 100644
+index ec3bd11..35d4d88 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -956,7 +956,7 @@ index d50430c..01cc53b 100644
  # but it is being used too early to link to meaningful stack_chk logic.
  nossp_flags := $(call cc-option, -fno-stack-protector)
 diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
-index 9e10c45..2feb375 100644
+index 9e10c45..688ea8b 100644
 --- a/arch/arm/include/asm/atomic.h
 +++ b/arch/arm/include/asm/atomic.h
 @@ -18,17 +18,41 @@
@@ -1404,15 +1404,14 @@ index 9e10c45..2feb375 100644
  
  static inline long long
  atomic64_cmpxchg_relaxed(atomic64_t *ptr, long long old, long long new)
-@@ -361,6 +555,31 @@ atomic64_cmpxchg_relaxed(atomic64_t *ptr, long long old, long long new)
+@@ -361,6 +555,30 @@ atomic64_cmpxchg_relaxed(atomic64_t *ptr, long long old, long long new)
  	return oldval;
  }
  #define atomic64_cmpxchg_relaxed	atomic64_cmpxchg_relaxed
 +#define atomic64_cmpxchg_unchecked_relaxed	atomic64_cmpxchg_unchecked_relaxed
 +
 +static inline long long
-+atomic64_cmpxchg_unchecked_relaxed(atomic64_unchecked_t *ptr, long long old,
-+					long long new)
++atomic64_cmpxchg_unchecked_relaxed(atomic64_unchecked_t *ptr, long long old, long long new)
 +{
 +	long long oldval;
 +	unsigned long res;
@@ -1436,7 +1435,7 @@ index 9e10c45..2feb375 100644
  
  static inline long long atomic64_xchg_relaxed(atomic64_t *ptr, long long new)
  {
-@@ -380,26 +599,60 @@ static inline long long atomic64_xchg_relaxed(atomic64_t *ptr, long long new)
+@@ -380,26 +598,60 @@ static inline long long atomic64_xchg_relaxed(atomic64_t *ptr, long long new)
  
  	return result;
  }
@@ -1503,7 +1502,7 @@ index 9e10c45..2feb375 100644
  	: "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
  	: "r" (&v->counter)
  	: "cc");
-@@ -423,13 +676,25 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
+@@ -423,13 +675,25 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
  "	teq	%0, %5\n"
  "	teqeq	%H0, %H5\n"
  "	moveq	%1, #0\n"
@@ -1532,7 +1531,7 @@ index 9e10c45..2feb375 100644
  	: "=&r" (val), "+r" (ret), "=&r" (tmp), "+Qo" (v->counter)
  	: "r" (&v->counter), "r" (u), "r" (a)
  	: "cc");
-@@ -442,10 +707,13 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
+@@ -442,10 +706,13 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
  
  #define atomic64_add_negative(a, v)	(atomic64_add_return((a), (v)) < 0)
  #define atomic64_inc(v)			atomic64_add(1LL, (v))
@@ -1601,20 +1600,28 @@ index 524692f..a8871ec 100644
  /*
   * 	Fold a partial checksum without adding pseudo headers
 diff --git a/arch/arm/include/asm/cmpxchg.h b/arch/arm/include/asm/cmpxchg.h
-index 97882f9..0cc6ef1 100644
+index 97882f9..ff9d6ac 100644
 --- a/arch/arm/include/asm/cmpxchg.h
 +++ b/arch/arm/include/asm/cmpxchg.h
 @@ -117,6 +117,10 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, int size
  	(__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr),		\
  				   sizeof(*(ptr)));			\
  })
-+#define xchg_unchecked(ptr, x) ({					\
++#define xchg_unchecked_relaxed(ptr, x) ({				\
 +	(__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr),		\
 +				   sizeof(*(ptr)));			\
 +})
  
  #include <asm-generic/cmpxchg-local.h>
  
+@@ -128,6 +132,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, int size
+ #endif
+ 
+ #define xchg xchg_relaxed
++#define xchg_unchecked xchg_unchecked_relaxed
+ 
+ /*
+  * cmpxchg_local and cmpxchg64_local are atomic wrt current CPU. Always make
 diff --git a/arch/arm/include/asm/cpuidle.h b/arch/arm/include/asm/cpuidle.h
 index baefe1d..29cb35a 100644
 --- a/arch/arm/include/asm/cpuidle.h
@@ -5041,19 +5048,6 @@ index 2a43012..3409956 100644
  }
  
  static const char *esr_class_str[] = {
-diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
-index c566ec8..3e01953 100644
---- a/arch/arm64/mm/dma-mapping.c
-+++ b/arch/arm64/mm/dma-mapping.c
-@@ -132,7 +132,7 @@ static void __dma_free_coherent(struct device *dev, size_t size,
- 					phys_to_page(paddr),
- 					size >> PAGE_SHIFT);
- 	if (!freed)
--		swiotlb_free_coherent(dev, size, vaddr, dma_handle);
-+		swiotlb_free_coherent(dev, size, vaddr, dma_handle, attrs);
- }
- 
- static void *__dma_alloc(struct device *dev, size_t size,
 diff --git a/arch/avr32/include/asm/cache.h b/arch/avr32/include/asm/cache.h
 index c3a58a1..78fbf54 100644
 --- a/arch/avr32/include/asm/cache.h
@@ -5879,19 +5873,6 @@ index ac91939..a1df96d 100644
  	help
  	  kexec is a system call that implements the ability to shutdown your
  	  current kernel, and to start another kernel.  It is like a reboot
-diff --git a/arch/mips/cavium-octeon/dma-octeon.c b/arch/mips/cavium-octeon/dma-octeon.c
-index 2cd45f5..d0f4900 100644
---- a/arch/mips/cavium-octeon/dma-octeon.c
-+++ b/arch/mips/cavium-octeon/dma-octeon.c
-@@ -191,7 +191,7 @@ static void *octeon_dma_alloc_coherent(struct device *dev, size_t size,
- static void octeon_dma_free_coherent(struct device *dev, size_t size,
- 	void *vaddr, dma_addr_t dma_handle, struct dma_attrs *attrs)
- {
--	swiotlb_free_coherent(dev, size, vaddr, dma_handle);
-+	swiotlb_free_coherent(dev, size, vaddr, dma_handle, attrs);
- }
- 
- static dma_addr_t octeon_unity_phys_to_dma(struct device *dev, phys_addr_t paddr)
 diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
 index 835b402..347a797 100644
 --- a/arch/mips/include/asm/atomic.h
@@ -8400,17 +8381,30 @@ index ae0751e..06b108a 100644
  2:"
  	: "=&r" (t)
 diff --git a/arch/powerpc/include/asm/book3s/32/hash.h b/arch/powerpc/include/asm/book3s/32/hash.h
-index 880db13..017716c 100644
+index 880db13..bb4ed4a 100644
 --- a/arch/powerpc/include/asm/book3s/32/hash.h
 +++ b/arch/powerpc/include/asm/book3s/32/hash.h
 @@ -20,6 +20,7 @@
  #define _PAGE_HASHPTE	0x002	/* hash_page has made an HPTE for this pte */
  #define _PAGE_USER	0x004	/* usermode access allowed */
  #define _PAGE_GUARDED	0x008	/* G: prohibit speculative access */
-+#define _PAGE_EXEC	_PAGE_GUARDED
++#define _PAGE_NX	_PAGE_GUARDED
  #define _PAGE_COHERENT	0x010	/* M: enforce memory coherence (SMP systems) */
  #define _PAGE_NO_CACHE	0x020	/* I: cache inhibit */
  #define _PAGE_WRITETHRU	0x040	/* W: cache write-through */
+diff --git a/arch/powerpc/include/asm/book3s/32/pgtable.h b/arch/powerpc/include/asm/book3s/32/pgtable.h
+index 38b33dc..945d1f1 100644
+--- a/arch/powerpc/include/asm/book3s/32/pgtable.h
++++ b/arch/powerpc/include/asm/book3s/32/pgtable.h
+@@ -226,7 +226,7 @@ static inline void huge_ptep_set_wrprotect(struct mm_struct *mm,
+ static inline void __ptep_set_access_flags(pte_t *ptep, pte_t entry)
+ {
+ 	unsigned long set = pte_val(entry) &
+-		(_PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_RW | _PAGE_EXEC);
++		(_PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_RW | _PAGE_EXEC | _PAGE_NX);
+ 	unsigned long clr = ~pte_val(entry) & _PAGE_RO;
+ 
+ 	pte_update(ptep, clr, set);
 diff --git a/arch/powerpc/include/asm/book3s/64/pgalloc.h b/arch/powerpc/include/asm/book3s/64/pgalloc.h
 index cd5e7aa..7709061 100644
 --- a/arch/powerpc/include/asm/book3s/64/pgalloc.h
@@ -8696,6 +8690,73 @@ index ee09e99..7e580ee 100644
  #ifndef __ASSEMBLY__
  #include <linux/mmdebug.h>
  #include <linux/mmzone.h>
+diff --git a/arch/powerpc/include/asm/pte-common.h b/arch/powerpc/include/asm/pte-common.h
+index 2eeaf80..c75d4fb 100644
+--- a/arch/powerpc/include/asm/pte-common.h
++++ b/arch/powerpc/include/asm/pte-common.h
+@@ -16,6 +16,9 @@
+ #ifndef _PAGE_EXEC
+ #define _PAGE_EXEC	0
+ #endif
++#ifndef _PAGE_NX
++#define _PAGE_NX	0
++#endif
+ #ifndef _PAGE_ENDIAN
+ #define _PAGE_ENDIAN	0
+ #endif
+@@ -53,13 +56,13 @@
+ #define PMD_PAGE_SIZE(pmd)	bad_call_to_PMD_PAGE_SIZE()
+ #endif
+ #ifndef _PAGE_KERNEL_RO
+-#define _PAGE_KERNEL_RO		(_PAGE_RO)
++#define _PAGE_KERNEL_RO		(_PAGE_RO | _PAGE_NX)
+ #endif
+ #ifndef _PAGE_KERNEL_ROX
+ #define _PAGE_KERNEL_ROX	(_PAGE_EXEC | _PAGE_RO)
+ #endif
+ #ifndef _PAGE_KERNEL_RW
+-#define _PAGE_KERNEL_RW		(_PAGE_DIRTY | _PAGE_RW | _PAGE_HWWRITE)
++#define _PAGE_KERNEL_RW		(_PAGE_DIRTY | _PAGE_RW | _PAGE_HWWRITE | _PAGE_NX)
+ #endif
+ #ifndef _PAGE_KERNEL_RWX
+ #define _PAGE_KERNEL_RWX	(_PAGE_DIRTY | _PAGE_RW | _PAGE_HWWRITE | _PAGE_EXEC)
+@@ -142,15 +145,12 @@ static inline bool pte_user(pte_t pte)
+  * Note due to the way vm flags are laid out, the bits are XWR
+  */
+ #define PAGE_NONE	__pgprot(_PAGE_BASE)
+-#define PAGE_SHARED	__pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RW)
+-#define PAGE_SHARED_X	__pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RW | \
+-				 _PAGE_EXEC)
+-#define PAGE_COPY	__pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO)
+-#define PAGE_COPY_X	__pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO | \
+-				 _PAGE_EXEC)
+-#define PAGE_READONLY	__pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO)
+-#define PAGE_READONLY_X	__pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO | \
+-				 _PAGE_EXEC)
++#define PAGE_SHARED	__pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RW | _PAGE_NX)
++#define PAGE_SHARED_X	__pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RW | _PAGE_EXEC)
++#define PAGE_COPY	__pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO | _PAGE_NX)
++#define PAGE_COPY_X	__pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO | _PAGE_EXEC)
++#define PAGE_READONLY	__pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO | _PAGE_NX)
++#define PAGE_READONLY_X	__pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO | _PAGE_EXEC)
+ 
+ #define __P000	PAGE_NONE
+ #define __P001	PAGE_READONLY
+@@ -171,11 +171,9 @@ static inline bool pte_user(pte_t pte)
+ #define __S111	PAGE_SHARED_X
+ 
+ /* Permission masks used for kernel mappings */
+-#define PAGE_KERNEL	__pgprot(_PAGE_BASE | _PAGE_KERNEL_RW)
+-#define PAGE_KERNEL_NC	__pgprot(_PAGE_BASE_NC | _PAGE_KERNEL_RW | \
+-				 _PAGE_NO_CACHE)
+-#define PAGE_KERNEL_NCG	__pgprot(_PAGE_BASE_NC | _PAGE_KERNEL_RW | \
+-				 _PAGE_NO_CACHE | _PAGE_GUARDED)
++#define PAGE_KERNEL	__pgprot(_PAGE_BASE | _PAGE_KERNEL_RW | _PAGE_NX)
++#define PAGE_KERNEL_NC	__pgprot(_PAGE_BASE_NC | _PAGE_KERNEL_RW | _PAGE_NO_CACHE)
++#define PAGE_KERNEL_NCG	__pgprot(_PAGE_BASE_NC | _PAGE_KERNEL_RW | _PAGE_NO_CACHE | _PAGE_GUARDED)
+ #define PAGE_KERNEL_X	__pgprot(_PAGE_BASE | _PAGE_KERNEL_RWX)
+ #define PAGE_KERNEL_RO	__pgprot(_PAGE_BASE | _PAGE_KERNEL_RO)
+ #define PAGE_KERNEL_ROX	__pgprot(_PAGE_BASE | _PAGE_KERNEL_ROX)
 diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
 index a0948f4..ddcf6be 100644
 --- a/arch/powerpc/include/asm/reg.h
@@ -14648,6 +14709,72 @@ index 50e6847..bf7c2d8 100644
  
  static void cast6_xts_enc(void *ctx, u128 *dst, const u128 *src, le128 *iv)
  {
+diff --git a/arch/x86/crypto/crc32-pclmul_asm.S b/arch/x86/crypto/crc32-pclmul_asm.S
+index f247304..b500391 100644
+--- a/arch/x86/crypto/crc32-pclmul_asm.S
++++ b/arch/x86/crypto/crc32-pclmul_asm.S
+@@ -102,6 +102,12 @@
+  *	                     size_t len, uint crc32)
+  */
+ 
++#ifndef __x86_64__
++__i686_get_pc_thunk_cx:
++	mov     (%esp),%ecx
++	ret
++#endif
++
+ ENTRY(crc32_pclmul_le_16) /* buffer and buffer size are 16 bytes aligned */
+ 	movdqa  (BUF), %xmm1
+ 	movdqa  0x10(BUF), %xmm2
+@@ -113,9 +119,8 @@ ENTRY(crc32_pclmul_le_16) /* buffer and buffer size are 16 bytes aligned */
+ 	add     $0x40, BUF
+ #ifndef __x86_64__
+ 	/* This is for position independent code(-fPIC) support for 32bit */
+-	call    delta
++	call    __i686_get_pc_thunk_cx
+ delta:
+-	pop     %ecx
+ #endif
+ 	cmp     $0x40, LEN
+ 	jb      less_64
+@@ -123,7 +128,7 @@ delta:
+ #ifdef __x86_64__
+ 	movdqa .Lconstant_R2R1(%rip), CONSTANT
+ #else
+-	movdqa .Lconstant_R2R1 - delta(%ecx), CONSTANT
++	movdqa %cs:.Lconstant_R2R1 - delta (%ecx), CONSTANT
+ #endif
+ 
+ loop_64:/*  64 bytes Full cache line folding */
+@@ -172,7 +177,7 @@ less_64:/*  Folding cache line into 128bit */
+ #ifdef __x86_64__
+ 	movdqa  .Lconstant_R4R3(%rip), CONSTANT
+ #else
+-	movdqa  .Lconstant_R4R3 - delta(%ecx), CONSTANT
++	movdqa  %cs:.Lconstant_R4R3 - delta(%ecx), CONSTANT
+ #endif
+ 	prefetchnta     (BUF)
+ 
+@@ -220,8 +225,8 @@ fold_64:
+ 	movdqa  .Lconstant_R5(%rip), CONSTANT
+ 	movdqa  .Lconstant_mask32(%rip), %xmm3
+ #else
+-	movdqa  .Lconstant_R5 - delta(%ecx), CONSTANT
+-	movdqa  .Lconstant_mask32 - delta(%ecx), %xmm3
++	movdqa  %cs:.Lconstant_R5 - delta(%ecx), CONSTANT
++	movdqa  %cs:.Lconstant_mask32 - delta(%ecx), %xmm3
+ #endif
+ 	psrldq  $0x04, %xmm2
+ 	pand    %xmm3, %xmm1
+@@ -232,7 +237,7 @@ fold_64:
+ #ifdef __x86_64__
+ 	movdqa  .Lconstant_RUpoly(%rip), CONSTANT
+ #else
+-	movdqa  .Lconstant_RUpoly - delta(%ecx), CONSTANT
++	movdqa  %cs:.Lconstant_RUpoly - delta(%ecx), CONSTANT
+ #endif
+ 	movdqa  %xmm1, %xmm2
+ 	pand    %xmm3, %xmm1
 diff --git a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
 index dc05f010..23c8bfd 100644
 --- a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
@@ -23343,6 +23470,27 @@ index 1549caa0..aa9ebe1 100644
  #define __USER32_CS			(GDT_ENTRY_DEFAULT_USER32_CS*8 + 3)
  #define __USER_DS			(GDT_ENTRY_DEFAULT_USER_DS*8 + 3)
  #define __USER32_DS			__USER_DS
+diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h
+index ac1d5da..6c4be50 100644
+--- a/arch/x86/include/asm/setup.h
++++ b/arch/x86/include/asm/setup.h
+@@ -61,6 +61,7 @@ static inline void x86_ce4100_early_setup(void) { }
+ #ifndef _SETUP
+ 
+ #include <asm/espfix.h>
++#include <asm/uaccess.h>
+ #include <linux/kernel.h>
+ 
+ /*
+@@ -76,7 +77,7 @@ static inline bool kaslr_enabled(void)
+ 
+ static inline unsigned long kaslr_offset(void)
+ {
+-	return (unsigned long)&_text - __START_KERNEL;
++	return ktla_ktva((unsigned long)&_text) - __START_KERNEL;
+ }
+ 
+ /*
 diff --git a/arch/x86/include/asm/smap.h b/arch/x86/include/asm/smap.h
 index db33330..e9521fb 100644
 --- a/arch/x86/include/asm/smap.h
@@ -23927,7 +24075,7 @@ index c3496619..3f3a7dc 100644
  asmlinkage void smp_deferred_error_interrupt(void);
  #endif
 diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
-index 2982387..8adcc96 100644
+index 2982387..35d07f4 100644
 --- a/arch/x86/include/asm/uaccess.h
 +++ b/arch/x86/include/asm/uaccess.h
 @@ -8,6 +8,7 @@
@@ -24130,16 +24278,23 @@ index 2982387..8adcc96 100644
  		break;							\
  	case 4:								\
  		__get_user_asm_ex(x, ptr, "l", "k", "=r");		\
-@@ -412,7 +464,7 @@ do {									\
+@@ -412,9 +464,13 @@ do {									\
  } while (0)
  
  #define __get_user_asm_ex(x, addr, itype, rtype, ltype)			\
 -	asm volatile("1:	mov"itype" %1,%"rtype"0\n"		\
 +	asm volatile("1:	"__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
  		     "2:\n"						\
- 		     _ASM_EXTABLE_EX(1b, 2b)				\
+-		     _ASM_EXTABLE_EX(1b, 2b)				\
++		     ".section .fixup,\"ax\"\n"				\
++                     "3:xorl %k0,%k0\n"					\
++		     "  jmp 2b\n"					\
++		     ".previous\n"					\
++		     _ASM_EXTABLE_EX(1b, 3b)				\
  		     : ltype(x) : "m" (__m(addr)))
-@@ -433,13 +485,24 @@ do {									\
+ 
+ #define __put_user_nocheck(x, ptr, size)			\
+@@ -433,13 +489,24 @@ do {									\
  	__uaccess_begin();						\
  	__get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT);	\
  	__uaccess_end();						\
@@ -24166,7 +24321,7 @@ index 2982387..8adcc96 100644
  
  /*
   * Tell gcc we read from memory instead of writing: this is because
-@@ -447,8 +510,10 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -447,8 +514,10 @@ struct __large_struct { unsigned long buf[100]; };
   * aliasing issues.
   */
  #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
@@ -24178,7 +24333,7 @@ index 2982387..8adcc96 100644
  		     "2:\n"						\
  		     ".section .fixup,\"ax\"\n"				\
  		     "3:	mov %3,%0\n"				\
-@@ -456,10 +521,12 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -456,10 +525,12 @@ struct __large_struct { unsigned long buf[100]; };
  		     ".previous\n"					\
  		     _ASM_EXTABLE(1b, 3b)				\
  		     : "=r"(err)					\
@@ -24193,7 +24348,7 @@ index 2982387..8adcc96 100644
  		     "2:\n"						\
  		     _ASM_EXTABLE_EX(1b, 2b)				\
  		     : : ltype(x), "m" (__m(addr)))
-@@ -469,11 +536,13 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -469,11 +540,13 @@ struct __large_struct { unsigned long buf[100]; };
   */
  #define uaccess_try	do {						\
  	current_thread_info()->uaccess_err = 0;				\
@@ -24207,7 +24362,7 @@ index 2982387..8adcc96 100644
  	(err) |= (current_thread_info()->uaccess_err ? -EFAULT : 0);	\
  } while (0)
  
-@@ -499,8 +568,12 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -499,8 +572,12 @@ struct __large_struct { unsigned long buf[100]; };
   * On error, the variable @x is set to zero.
   */
  
@@ -24220,7 +24375,7 @@ index 2982387..8adcc96 100644
  
  /**
   * __put_user: - Write a simple value into user space, with less checking.
-@@ -523,8 +596,12 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -523,8 +600,12 @@ struct __large_struct { unsigned long buf[100]; };
   * Returns zero on success, or -EFAULT on error.
   */
  
@@ -24233,7 +24388,7 @@ index 2982387..8adcc96 100644
  
  #define __get_user_unaligned __get_user
  #define __put_user_unaligned __put_user
-@@ -542,7 +619,7 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -542,7 +623,7 @@ struct __large_struct { unsigned long buf[100]; };
  #define get_user_ex(x, ptr)	do {					\
  	unsigned long __gue_val;					\
  	__get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr))));	\
@@ -24242,7 +24397,7 @@ index 2982387..8adcc96 100644
  } while (0)
  
  #define put_user_try		uaccess_try
-@@ -560,7 +637,7 @@ extern __must_check long strlen_user(const char __user *str);
+@@ -560,7 +641,7 @@ extern __must_check long strlen_user(const char __user *str);
  extern __must_check long strnlen_user(const char __user *str, long n);
  
  unsigned long __must_check clear_user(void __user *mem, unsigned long len);
@@ -24251,7 +24406,7 @@ index 2982387..8adcc96 100644
  
  extern void __cmpxchg_wrong_size(void)
  	__compiletime_error("Bad argument size for cmpxchg");
-@@ -568,22 +645,23 @@ extern void __cmpxchg_wrong_size(void)
+@@ -568,22 +649,23 @@ extern void __cmpxchg_wrong_size(void)
  #define __user_atomic_cmpxchg_inatomic(uval, ptr, old, new, size)	\
  ({									\
  	int __ret = 0;							\
@@ -24280,7 +24435,7 @@ index 2982387..8adcc96 100644
  			: "i" (-EFAULT), "q" (__new), "1" (__old)	\
  			: "memory"					\
  		);							\
-@@ -592,14 +670,14 @@ extern void __cmpxchg_wrong_size(void)
+@@ -592,14 +674,14 @@ extern void __cmpxchg_wrong_size(void)
  	case 2:								\
  	{								\
  		asm volatile("\n"					\
@@ -24297,7 +24452,7 @@ index 2982387..8adcc96 100644
  			: "i" (-EFAULT), "r" (__new), "1" (__old)	\
  			: "memory"					\
  		);							\
-@@ -608,14 +686,14 @@ extern void __cmpxchg_wrong_size(void)
+@@ -608,14 +690,14 @@ extern void __cmpxchg_wrong_size(void)
  	case 4:								\
  	{								\
  		asm volatile("\n"					\
@@ -24314,7 +24469,7 @@ index 2982387..8adcc96 100644
  			: "i" (-EFAULT), "r" (__new), "1" (__old)	\
  			: "memory"					\
  		);							\
-@@ -627,14 +705,14 @@ extern void __cmpxchg_wrong_size(void)
+@@ -627,14 +709,14 @@ extern void __cmpxchg_wrong_size(void)
  			__cmpxchg_wrong_size();				\
  									\
  		asm volatile("\n"					\
@@ -24331,7 +24486,7 @@ index 2982387..8adcc96 100644
  			: "i" (-EFAULT), "r" (__new), "1" (__old)	\
  			: "memory"					\
  		);							\
-@@ -644,6 +722,7 @@ extern void __cmpxchg_wrong_size(void)
+@@ -644,6 +726,7 @@ extern void __cmpxchg_wrong_size(void)
  		__cmpxchg_wrong_size();					\
  	}								\
  	__uaccess_end();						\
@@ -24339,7 +24494,7 @@ index 2982387..8adcc96 100644
  	*__uval = __old;						\
  	__ret;								\
  })
-@@ -667,17 +746,6 @@ extern struct movsl_mask {
+@@ -667,17 +750,6 @@ extern struct movsl_mask {
  
  #define ARCH_HAS_NOCACHE_UACCESS 1
  
@@ -24357,7 +24512,7 @@ index 2982387..8adcc96 100644
  #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
  # define copy_user_diag __compiletime_error
  #else
-@@ -687,7 +755,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from,
+@@ -687,7 +759,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from,
  extern void copy_user_diag("copy_from_user() buffer size is too small")
  copy_from_user_overflow(void);
  extern void copy_user_diag("copy_to_user() buffer size is too small")
@@ -24366,7 +24521,7 @@ index 2982387..8adcc96 100644
  
  #undef copy_user_diag
  
-@@ -700,7 +768,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
+@@ -700,7 +772,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
  
  extern void
  __compiletime_warning("copy_to_user() buffer size is not provably correct")
@@ -24375,7 +24530,7 @@ index 2982387..8adcc96 100644
  #define __copy_to_user_overflow(size, count) __copy_to_user_overflow()
  
  #else
-@@ -715,10 +783,16 @@ __copy_from_user_overflow(int size, unsigned long count)
+@@ -715,10 +787,16 @@ __copy_from_user_overflow(int size, unsigned long count)
  
  #endif
  
@@ -24393,7 +24548,7 @@ index 2982387..8adcc96 100644
  
  	might_fault();
  
-@@ -742,12 +816,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
+@@ -742,12 +820,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
  	 * case, and do only runtime checking for non-constant sizes.
  	 */
  
@@ -24415,7 +24570,7 @@ index 2982387..8adcc96 100644
  
  	return n;
  }
-@@ -755,19 +832,20 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
+@@ -755,19 +836,20 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
  static inline unsigned long __must_check
  copy_to_user(void __user *to, const void *from, unsigned long n)
  {
@@ -25284,7 +25439,7 @@ index 5cb272a..2bcff83 100644
  	bp_int3_handler = handler;
  	bp_int3_addr = (u8 *)addr + sizeof(int3);
 diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
-index 60078a6..b9fb105 100644
+index b15e1c1..42cf1f5 100644
 --- a/arch/x86/kernel/apic/apic.c
 +++ b/arch/x86/kernel/apic/apic.c
 @@ -177,7 +177,7 @@ int first_system_vector = FIRST_SYSTEM_VECTOR;
@@ -25296,7 +25451,7 @@ index 60078a6..b9fb105 100644
  
  int pic_mode;
  
-@@ -1878,7 +1878,7 @@ static void __smp_error_interrupt(struct pt_regs *regs)
+@@ -1881,7 +1881,7 @@ static void __smp_error_interrupt(struct pt_regs *regs)
  		apic_write(APIC_ESR, 0);
  	v = apic_read(APIC_ESR);
  	ack_APIC_irq();
@@ -29000,7 +29155,7 @@ index 61924222..0e4856e 100644
 +ENDPROC(return_to_handler)
  #endif
 diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
-index 477ae80..c8e40a3 100644
+index 477ae80..a280c67 100644
 --- a/arch/x86/kernel/module.c
 +++ b/arch/x86/kernel/module.c
 @@ -76,17 +76,17 @@ static unsigned long int get_module_load_offset(void)
@@ -29050,7 +29205,7 @@ index 477ae80..c8e40a3 100644
 +		return NULL;
 +
 +	area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
-+return area ? area->addr : NULL;
++	return area ? area->addr : NULL;
 +}
 +EXPORT_SYMBOL(module_alloc_exec);
 +
@@ -29659,19 +29814,6 @@ index f712dfd..0172a75 100644
  
  #define DEBUG 1
  
-diff --git a/arch/x86/kernel/pci-swiotlb.c b/arch/x86/kernel/pci-swiotlb.c
-index 7c577a1..3557b10 100644
---- a/arch/x86/kernel/pci-swiotlb.c
-+++ b/arch/x86/kernel/pci-swiotlb.c
-@@ -40,7 +40,7 @@ void x86_swiotlb_free_coherent(struct device *dev, size_t size,
- 				      struct dma_attrs *attrs)
- {
- 	if (is_swiotlb_buffer(dma_to_phys(dev, dma_addr)))
--		swiotlb_free_coherent(dev, size, vaddr, dma_addr);
-+		swiotlb_free_coherent(dev, size, vaddr, dma_addr, attrs);
- 	else
- 		dma_generic_free_coherent(dev, size, vaddr, dma_addr, attrs);
- }
 diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
 index 96becbb..a18444b 100644
 --- a/arch/x86/kernel/process.c
@@ -32118,7 +32260,7 @@ index 8326d68..3cc3895 100644
  	.disabled_by_bios = vmx_disabled_by_bios,
  	.hardware_setup = hardware_setup,
 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index fea2c57..19b3e60 100644
+index fea2c57..5c02643 100644
 --- a/arch/x86/kvm/x86.c
 +++ b/arch/x86/kvm/x86.c
 @@ -1941,8 +1941,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
@@ -32177,6 +32319,15 @@ index fea2c57..19b3e60 100644
  			guest_xsave->region, sizeof(struct fxregs_state));
  	}
  	return 0;
+@@ -5728,7 +5730,7 @@ static unsigned long kvm_get_guest_ip(void)
+ 	unsigned long ip = 0;
+ 
+ 	if (__this_cpu_read(current_vcpu))
+-		ip = kvm_rip_read(__this_cpu_read(current_vcpu));
++		ip = kvm_get_linear_rip(__this_cpu_read(current_vcpu));
+ 
+ 	return ip;
+ }
 @@ -6450,6 +6452,7 @@ void kvm_arch_mmu_notifier_invalidate_page(struct kvm *kvm,
   * exiting to the userspace.  Otherwise, the value will be returned to the
   * userspace.
@@ -35069,46 +35220,10 @@ index 99bfb19..237fb1d 100644
  			} else {
  				walk_pud_level(m, &st, *start,
 diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
-index 4bb53b8..7e79b52 100644
+index 4bb53b8..0828f20 100644
 --- a/arch/x86/mm/extable.c
 +++ b/arch/x86/mm/extable.c
-@@ -1,6 +1,7 @@
- #include <linux/module.h>
- #include <asm/uaccess.h>
- #include <asm/traps.h>
-+#include <asm/boot.h>
- 
- typedef bool (*ex_handler_t)(const struct exception_table_entry *,
- 			    struct pt_regs *, int);
-@@ -8,12 +9,25 @@ typedef bool (*ex_handler_t)(const struct exception_table_entry *,
- static inline unsigned long
- ex_fixup_addr(const struct exception_table_entry *x)
- {
--	return (unsigned long)&x->fixup + x->fixup;
-+	unsigned long reloc = 0;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	reloc = ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
-+#endif
-+
-+	return (unsigned long)&x->fixup + x->fixup + reloc;
- }
-+
- static inline ex_handler_t
- ex_fixup_handler(const struct exception_table_entry *x)
- {
--	return (ex_handler_t)((unsigned long)&x->handler + x->handler);
-+	unsigned long reloc = 0;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	reloc = ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
-+#endif
-+
-+	return (ex_handler_t)((unsigned long)&x->handler + x->handler + reloc);
- }
- 
- bool ex_handler_default(const struct exception_table_entry *fixup,
-@@ -99,7 +113,7 @@ int fixup_exception(struct pt_regs *regs, int trapnr)
+@@ -99,7 +99,7 @@ int fixup_exception(struct pt_regs *regs, int trapnr)
  	ex_handler_t handler;
  
  #ifdef CONFIG_PNPBIOS
@@ -36982,7 +37097,7 @@ index 9c086c5..421e25b 100644
  	unsigned long uninitialized_var(pfn_align);
  	int i, nid;
 diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
-index 7a1f7bb..62a6748 100644
+index 7a1f7bb..5b4b5cc 100644
 --- a/arch/x86/mm/pageattr.c
 +++ b/arch/x86/mm/pageattr.c
 @@ -258,7 +258,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
@@ -37093,6 +37208,16 @@ index 7a1f7bb..62a6748 100644
  			cpa->flags |= CPA_FLUSHTLB;
  		}
  		cpa->numpages = 1;
+@@ -1336,7 +1362,8 @@ static int cpa_process_alias(struct cpa_data *cpa)
+ 
+ static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias)
+ {
+-	int ret, numpages = cpa->numpages;
++	int ret;
++	unsigned long numpages = cpa->numpages;
+ 
+ 	while (numpages) {
+ 		/*
 diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
 index fb0604f..b9e0399 100644
 --- a/arch/x86/mm/pat.c
@@ -39205,7 +39330,7 @@ index c7b15f3..cc09a65 100644
  	  This is the Linux Xen port.  Enabling this will allow the
  	  kernel to boot in a paravirtualized environment under the
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 760789a..dbf5054 100644
+index 760789a..0aef1ec 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
 @@ -131,8 +131,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -39311,11 +39436,21 @@ index 760789a..dbf5054 100644
  
  	pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry;
  	pv_cpu_ops.load_gdt = xen_load_gdt;
-@@ -1583,7 +1582,17 @@ asmlinkage __visible void __init xen_start_kernel(void)
+@@ -1582,9 +1581,6 @@ asmlinkage __visible void __init xen_start_kernel(void)
+ 	 */
  	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
  
- 	/* Work out if we support NX */
+-	/* Work out if we support NX */
 -	x86_configure_nx();
+-
+ 	/* Get mfn list */
+ 	xen_build_dynamic_phys_to_machine();
+ 
+@@ -1594,6 +1590,19 @@ asmlinkage __visible void __init xen_start_kernel(void)
+ 	 */
+ 	xen_setup_gdt(0);
+ 
++	/* Work out if we support NX */
 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
 +	if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
 +	    (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
@@ -39327,9 +39462,10 @@ index 760789a..dbf5054 100644
 +		wrmsr(MSR_EFER, l, h);
 +	}
 +#endif
++
+ 	xen_init_irq_ops();
+ 	xen_init_cpuid_mask();
  
- 	/* Get mfn list */
- 	xen_build_dynamic_phys_to_machine();
 @@ -1611,13 +1620,6 @@ asmlinkage __visible void __init xen_start_kernel(void)
  
  	machine_ops = xen_machine_ops;
@@ -39426,6 +39562,18 @@ index 6743371..26347de 100644
  
  	.alloc_pud = xen_alloc_pmd_init,
  	.release_pud = xen_release_pmd_init,
+diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c
+index 9466354..b33bb13 100644
+--- a/arch/x86/xen/pmu.c
++++ b/arch/x86/xen/pmu.c
+@@ -444,6 +444,7 @@ static unsigned long xen_get_guest_ip(void)
+ 		return 0;
+ 	}
+ 
++	// TODO: adjust with the segment base
+ 	return xenpmu_data->pmu.r.regs.ip;
+ }
+ 
 diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
 index 719cf29..8a13fd8 100644
 --- a/arch/x86/xen/smp.c
@@ -42615,7 +42763,7 @@ index 4d87499..1e2bcce 100644
  	device->rs_last_events =
  		(int)part_stat_read(&disk->part0, sectors[0]) +
 diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
-index 84708a5..95c0e55 100644
+index b206115..dcb469b 100644
 --- a/drivers/block/floppy.c
 +++ b/drivers/block/floppy.c
 @@ -961,6 +961,10 @@ static void empty(void)
@@ -46312,7 +46460,7 @@ index 207a2cb..666b75a 100644
  {
  	struct bochs_device *bochs =
 diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index 0e3cc66..005ade8 100644
+index a5cae1b..2b89b96 100644
 --- a/drivers/gpu/drm/drm_crtc.c
 +++ b/drivers/gpu/drm/drm_crtc.c
 @@ -4285,7 +4285,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
@@ -48325,7 +48473,7 @@ index 414953c..1b26674 100644
 -int radeon_max_kms_ioctl = ARRAY_SIZE(radeon_ioctls_kms);
 +const int radeon_max_kms_ioctl = ARRAY_SIZE(radeon_ioctls_kms);
 diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
-index 590b037..2755d23 100644
+index 0ab76dd..62359ea 100644
 --- a/drivers/gpu/drm/radeon/radeon_ttm.c
 +++ b/drivers/gpu/drm/radeon/radeon_ttm.c
 @@ -970,7 +970,7 @@ void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size)
@@ -55020,7 +55168,7 @@ index adbff14..018c2d2 100644
  	struct cache_stat_collector collector;
  
 diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
-index f5dbb4e..26a4c2e 100644
+index 5d3b231..6a0cbd8 100644
 --- a/drivers/md/bcache/super.c
 +++ b/drivers/md/bcache/super.c
 @@ -241,8 +241,9 @@ static void __write_super(struct cache_sb *sb, struct bio *bio)
@@ -75244,7 +75392,7 @@ index ec21d8c..1c2e09c 100644
  	return _SUCCESS;
  }
 diff --git a/drivers/staging/rtl8188eu/include/Hal8188EPhyCfg.h b/drivers/staging/rtl8188eu/include/Hal8188EPhyCfg.h
-index 8990748..7727f80 100644
+index 8990748..7727f804 100644
 --- a/drivers/staging/rtl8188eu/include/Hal8188EPhyCfg.h
 +++ b/drivers/staging/rtl8188eu/include/Hal8188EPhyCfg.h
 @@ -200,17 +200,9 @@ void PHY_GetTxPowerLevel8188E(struct adapter *adapter, u32 *powerlevel);
@@ -96960,7 +97108,7 @@ index 2035893..f42edf1 100644
  		for (i = 0; i < numnote; i++)
  			sz += notesize(notes + i);
 diff --git a/fs/block_dev.c b/fs/block_dev.c
-index 71ccab1..8e55e4e 100644
+index b1495fa..256330e 100644
 --- a/fs/block_dev.c
 +++ b/fs/block_dev.c
 @@ -852,7 +852,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
@@ -100117,59 +100265,6 @@ index d7ccb7f..1b9329a 100644
  	int ret;
  
  	eh = ext_inode_hdr(inode);
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index b747ec0..ea39d19 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -51,26 +51,32 @@ static __u32 ext4_inode_csum(struct inode *inode, struct ext4_inode *raw,
- 			      struct ext4_inode_info *ei)
- {
- 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
--	__u16 csum_lo;
--	__u16 csum_hi = 0;
- 	__u32 csum;
-+	__u16 dummy_csum = 0;
-+	int offset = offsetof(struct ext4_inode, i_checksum_lo);
-+	unsigned int csum_size = sizeof(dummy_csum);
- 
--	csum_lo = le16_to_cpu(raw->i_checksum_lo);
--	raw->i_checksum_lo = 0;
--	if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE &&
--	    EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) {
--		csum_hi = le16_to_cpu(raw->i_checksum_hi);
--		raw->i_checksum_hi = 0;
-+	csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw, offset);
-+	csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, csum_size);
-+	offset += csum_size;
-+	csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset,
-+			   EXT4_GOOD_OLD_INODE_SIZE - offset);
-+
-+	if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
-+		offset = offsetof(struct ext4_inode, i_checksum_hi);
-+		csum = ext4_chksum(sbi, csum, (__u8 *)raw +
-+				   EXT4_GOOD_OLD_INODE_SIZE,
-+				   offset - EXT4_GOOD_OLD_INODE_SIZE);
-+		if (EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) {
-+			csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum,
-+					   csum_size);
-+			offset += csum_size;
-+			csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset,
-+					   EXT4_INODE_SIZE(inode->i_sb) -
-+					   offset);
-+		}
- 	}
- 
--	csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw,
--			   EXT4_INODE_SIZE(inode->i_sb));
--
--	raw->i_checksum_lo = cpu_to_le16(csum_lo);
--	if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE &&
--	    EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi))
--		raw->i_checksum_hi = cpu_to_le16(csum_hi);
--
- 	return csum;
- }
- 
 diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
 index 7f42eda..0150cd7 100644
 --- a/fs/ext4/mballoc.c
@@ -100287,30 +100382,6 @@ index 7f42eda..0150cd7 100644
  	trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
  
  	return 0;
-diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
-index ec4c399..5bb46b6 100644
---- a/fs/ext4/namei.c
-+++ b/fs/ext4/namei.c
-@@ -420,15 +420,14 @@ static __le32 ext4_dx_csum(struct inode *inode, struct ext4_dir_entry *dirent,
- 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
- 	struct ext4_inode_info *ei = EXT4_I(inode);
- 	__u32 csum;
--	__le32 save_csum;
- 	int size;
-+	__u32 dummy_csum = 0;
-+	int offset = offsetof(struct dx_tail, dt_checksum);
- 
- 	size = count_offset + (count * sizeof(struct dx_entry));
--	save_csum = t->dt_checksum;
--	t->dt_checksum = 0;
- 	csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)dirent, size);
--	csum = ext4_chksum(sbi, csum, (__u8 *)t, sizeof(struct dx_tail));
--	t->dt_checksum = save_csum;
-+	csum = ext4_chksum(sbi, csum, (__u8 *)t, offset);
-+	csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, sizeof(dummy_csum));
- 
- 	return cpu_to_le32(csum);
- }
 diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
 index cf68100..f96c5c0 100644
 --- a/fs/ext4/resize.c
@@ -100354,7 +100425,7 @@ index cf68100..f96c5c0 100644
  		err = ext4_handle_dirty_metadata(handle, NULL, bh);
  		if (unlikely(err))
 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 639bd756..7cbfe75 100644
+index d4505f8..7f73c190 100644
 --- a/fs/ext4/super.c
 +++ b/fs/ext4/super.c
 @@ -1307,7 +1307,7 @@ static ext4_fsblk_t get_sb_block(void **data)
@@ -100366,48 +100437,6 @@ index 639bd756..7cbfe75 100644
  	"Contact linux-ext4@vger.kernel.org if you think we should keep it.\n";
  
  #ifdef CONFIG_QUOTA
-@@ -2068,23 +2068,25 @@ failed:
- static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group,
- 				   struct ext4_group_desc *gdp)
- {
--	int offset;
-+	int offset = offsetof(struct ext4_group_desc, bg_checksum);
- 	__u16 crc = 0;
- 	__le32 le_group = cpu_to_le32(block_group);
- 	struct ext4_sb_info *sbi = EXT4_SB(sb);
- 
- 	if (ext4_has_metadata_csum(sbi->s_sb)) {
- 		/* Use new metadata_csum algorithm */
--		__le16 save_csum;
- 		__u32 csum32;
-+		__u16 dummy_csum = 0;
- 
--		save_csum = gdp->bg_checksum;
--		gdp->bg_checksum = 0;
- 		csum32 = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&le_group,
- 				     sizeof(le_group));
--		csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp,
--				     sbi->s_desc_size);
--		gdp->bg_checksum = save_csum;
-+		csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp, offset);
-+		csum32 = ext4_chksum(sbi, csum32, (__u8 *)&dummy_csum,
-+				     sizeof(dummy_csum));
-+		offset += sizeof(dummy_csum);
-+		if (offset < sbi->s_desc_size)
-+			csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp + offset,
-+					     sbi->s_desc_size - offset);
- 
- 		crc = csum32 & 0xFFFF;
- 		goto out;
-@@ -2094,8 +2096,6 @@ static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group,
- 	if (!ext4_has_feature_gdt_csum(sb))
- 		return 0;
- 
--	offset = offsetof(struct ext4_group_desc, bg_checksum);
--
- 	crc = crc16(~0, sbi->s_es->s_uuid, sizeof(sbi->s_es->s_uuid));
- 	crc = crc16(crc, (__u8 *)&le_group, sizeof(le_group));
- 	crc = crc16(crc, (__u8 *)gdp, offset);
 diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c
 index 1420a3c..e87523c 100644
 --- a/fs/ext4/sysfs.c
@@ -100422,35 +100451,10 @@ index 1420a3c..e87523c 100644
  static ssize_t session_write_kbytes_show(struct ext4_attr *a,
  					 struct ext4_sb_info *sbi, char *buf)
 diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
-index e79bd32..1a4826d 100644
+index 2eb935c..2fda99e 100644
 --- a/fs/ext4/xattr.c
 +++ b/fs/ext4/xattr.c
-@@ -121,17 +121,18 @@ static __le32 ext4_xattr_block_csum(struct inode *inode,
- {
- 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
- 	__u32 csum;
--	__le32 save_csum;
- 	__le64 dsk_block_nr = cpu_to_le64(block_nr);
-+	__u32 dummy_csum = 0;
-+	int offset = offsetof(struct ext4_xattr_header, h_checksum);
- 
--	save_csum = hdr->h_checksum;
--	hdr->h_checksum = 0;
- 	csum = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&dsk_block_nr,
- 			   sizeof(dsk_block_nr));
--	csum = ext4_chksum(sbi, csum, (__u8 *)hdr,
--			   EXT4_BLOCK_SIZE(inode->i_sb));
-+	csum = ext4_chksum(sbi, csum, (__u8 *)hdr, offset);
-+	csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, sizeof(dummy_csum));
-+	offset += sizeof(dummy_csum);
-+	csum = ext4_chksum(sbi, csum, (__u8 *)hdr + offset,
-+			   EXT4_BLOCK_SIZE(inode->i_sb) - offset);
- 
--	hdr->h_checksum = save_csum;
- 	return cpu_to_le32(csum);
- }
- 
-@@ -417,7 +418,7 @@ static int
+@@ -418,7 +418,7 @@ static int
  ext4_xattr_list_entries(struct dentry *dentry, struct ext4_xattr_entry *entry,
  			char *buffer, size_t buffer_size)
  {
@@ -100459,7 +100463,7 @@ index e79bd32..1a4826d 100644
  
  	for (; !IS_LAST_ENTRY(entry); entry = EXT4_XATTR_NEXT(entry)) {
  		const struct xattr_handler *handler =
-@@ -438,9 +439,10 @@ ext4_xattr_list_entries(struct dentry *dentry, struct ext4_xattr_entry *entry,
+@@ -439,9 +439,10 @@ ext4_xattr_list_entries(struct dentry *dentry, struct ext4_xattr_entry *entry,
  				*buffer++ = 0;
  			}
  			rest -= size;
@@ -104199,7 +104203,7 @@ index 14db05d..687f6d8 100644
  #define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */
  
 diff --git a/fs/namei.c b/fs/namei.c
-index 70580ab..cdede72 100644
+index 9281b2b..657fdb3 100644
 --- a/fs/namei.c
 +++ b/fs/namei.c
 @@ -337,17 +337,32 @@ int generic_permission(struct inode *inode, int mask)
@@ -104358,7 +104362,7 @@ index 70580ab..cdede72 100644
  		if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) {
  			path_put(&nd->root);
  			nd->root.mnt = NULL;
-@@ -1015,6 +1082,9 @@ const char *get_link(struct nameidata *nd)
+@@ -1017,6 +1084,9 @@ const char *get_link(struct nameidata *nd)
  	if (unlikely(error))
  		return ERR_PTR(error);
  
@@ -104368,7 +104372,7 @@ index 70580ab..cdede72 100644
  	nd->last_type = LAST_BIND;
  	res = inode->i_link;
  	if (!res) {
-@@ -1701,6 +1771,23 @@ static int pick_link(struct nameidata *nd, struct path *link,
+@@ -1703,6 +1773,23 @@ static int pick_link(struct nameidata *nd, struct path *link,
  		}
  	}
  
@@ -104392,7 +104396,7 @@ index 70580ab..cdede72 100644
  	last = nd->stack + nd->depth++;
  	last->link = *link;
  	clear_delayed_call(&last->done);
-@@ -1938,7 +2025,7 @@ EXPORT_SYMBOL(hashlen_string);
+@@ -1940,7 +2027,7 @@ EXPORT_SYMBOL(hashlen_string);
  static inline u64 hash_name(const char *name)
  {
  	unsigned long a = 0, b, x = 0, y = 0, adata, bdata, mask, len;
@@ -104401,7 +104405,7 @@ index 70580ab..cdede72 100644
  
  	len = -sizeof(unsigned long);
  	do {
-@@ -2120,6 +2207,10 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
+@@ -2122,6 +2209,10 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
  	nd->last_type = LAST_ROOT; /* if there are only slashes... */
  	nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT;
  	nd->depth = 0;
@@ -104412,7 +104416,7 @@ index 70580ab..cdede72 100644
  	if (flags & LOOKUP_ROOT) {
  		struct dentry *root = nd->root.dentry;
  		struct inode *inode = root->d_inode;
-@@ -2251,6 +2342,14 @@ static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path
+@@ -2253,6 +2344,14 @@ static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path
  	if (!err)
  		err = complete_walk(nd);
  
@@ -104427,7 +104431,7 @@ index 70580ab..cdede72 100644
  	if (!err && nd->flags & LOOKUP_DIRECTORY)
  		if (!d_can_lookup(nd->path.dentry))
  			err = -ENOTDIR;
-@@ -2299,6 +2398,14 @@ static int path_parentat(struct nameidata *nd, unsigned flags,
+@@ -2301,6 +2400,14 @@ static int path_parentat(struct nameidata *nd, unsigned flags,
  	err = link_path_walk(s, nd);
  	if (!err)
  		err = complete_walk(nd);
@@ -104442,7 +104446,7 @@ index 70580ab..cdede72 100644
  	if (!err) {
  		*parent = nd->path;
  		nd->path.mnt = NULL;
-@@ -2926,6 +3033,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
+@@ -2928,6 +3035,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
  	if (flag & O_NOATIME && !inode_owner_or_capable(inode))
  		return -EPERM;
  
@@ -104456,7 +104460,7 @@ index 70580ab..cdede72 100644
  	return 0;
  }
  
-@@ -3165,6 +3279,20 @@ no_open:
+@@ -3167,6 +3281,20 @@ no_open:
  
  	/* Negative dentry, just create the file */
  	if (!dentry->d_inode && (open_flag & O_CREAT)) {
@@ -104477,7 +104481,7 @@ index 70580ab..cdede72 100644
  		*opened |= FILE_CREATED;
  		audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
  		if (!dir_inode->i_op->create) {
-@@ -3175,6 +3303,7 @@ no_open:
+@@ -3177,6 +3305,7 @@ no_open:
  						open_flag & O_EXCL);
  		if (error)
  			goto out_dput;
@@ -104485,7 +104489,7 @@ index 70580ab..cdede72 100644
  		fsnotify_create(dir_inode, dentry);
  	}
  	if (unlikely(create_error) && !dentry->d_inode) {
-@@ -3289,6 +3418,11 @@ static int do_last(struct nameidata *nd,
+@@ -3291,6 +3420,11 @@ static int do_last(struct nameidata *nd,
  		goto finish_open_created;
  	}
  
@@ -104497,7 +104501,7 @@ index 70580ab..cdede72 100644
  	/*
  	 * If atomic_open() acquired write access it is dropped now due to
  	 * possible mount and symlink following (this might be optimized away if
-@@ -3308,6 +3442,13 @@ static int do_last(struct nameidata *nd,
+@@ -3310,6 +3444,13 @@ static int do_last(struct nameidata *nd,
  		return -ENOENT;
  	}
  
@@ -104511,7 +104515,7 @@ index 70580ab..cdede72 100644
  	/*
  	 * create/update audit record if it already exists.
  	 */
-@@ -3336,6 +3477,21 @@ finish_open:
+@@ -3338,6 +3479,21 @@ finish_open:
  	error = complete_walk(nd);
  	if (error)
  		return error;
@@ -104533,7 +104537,7 @@ index 70580ab..cdede72 100644
  	audit_inode(nd->name, nd->path.dentry, 0);
  	error = -EISDIR;
  	if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry))
-@@ -3592,9 +3748,11 @@ static struct dentry *filename_create(int dfd, struct filename *name,
+@@ -3594,9 +3750,11 @@ static struct dentry *filename_create(int dfd, struct filename *name,
  		goto unlock;
  
  	error = -EEXIST;
@@ -104547,7 +104551,7 @@ index 70580ab..cdede72 100644
  	/*
  	 * Special case - lookup gave negative, but... we had foo/bar/
  	 * From the vfs_mknod() POV we just have a negative dentry -
-@@ -3648,6 +3806,20 @@ inline struct dentry *user_path_create(int dfd, const char __user *pathname,
+@@ -3650,6 +3808,20 @@ inline struct dentry *user_path_create(int dfd, const char __user *pathname,
  }
  EXPORT_SYMBOL(user_path_create);
  
@@ -104568,7 +104572,7 @@ index 70580ab..cdede72 100644
  int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
  {
  	int error = may_create(dir, dentry);
-@@ -3711,6 +3883,17 @@ retry:
+@@ -3713,6 +3885,17 @@ retry:
  
  	if (!IS_POSIXACL(path.dentry->d_inode))
  		mode &= ~current_umask();
@@ -104586,7 +104590,7 @@ index 70580ab..cdede72 100644
  	error = security_path_mknod(&path, dentry, mode, dev);
  	if (error)
  		goto out;
-@@ -3728,6 +3911,8 @@ retry:
+@@ -3730,6 +3913,8 @@ retry:
  			error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
  			break;
  	}
@@ -104595,7 +104599,7 @@ index 70580ab..cdede72 100644
  out:
  	done_path_create(&path, dentry);
  	if (retry_estale(error, lookup_flags)) {
-@@ -3782,9 +3967,16 @@ retry:
+@@ -3784,9 +3969,16 @@ retry:
  
  	if (!IS_POSIXACL(path.dentry->d_inode))
  		mode &= ~current_umask();
@@ -104612,7 +104616,7 @@ index 70580ab..cdede72 100644
  	done_path_create(&path, dentry);
  	if (retry_estale(error, lookup_flags)) {
  		lookup_flags |= LOOKUP_REVAL;
-@@ -3845,6 +4037,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
+@@ -3847,6 +4039,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
  	struct path path;
  	struct qstr last;
  	int type;
@@ -104621,7 +104625,7 @@ index 70580ab..cdede72 100644
  	unsigned int lookup_flags = 0;
  retry:
  	name = user_path_parent(dfd, pathname,
-@@ -3877,10 +4071,20 @@ retry:
+@@ -3879,10 +4073,20 @@ retry:
  		error = -ENOENT;
  		goto exit3;
  	}
@@ -104642,7 +104646,7 @@ index 70580ab..cdede72 100644
  exit3:
  	dput(dentry);
  exit2:
-@@ -3975,6 +4179,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+@@ -3977,6 +4181,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
  	int type;
  	struct inode *inode = NULL;
  	struct inode *delegated_inode = NULL;
@@ -104651,7 +104655,7 @@ index 70580ab..cdede72 100644
  	unsigned int lookup_flags = 0;
  retry:
  	name = user_path_parent(dfd, pathname,
-@@ -4001,10 +4207,21 @@ retry_deleg:
+@@ -4003,10 +4209,21 @@ retry_deleg:
  		if (d_is_negative(dentry))
  			goto slashes;
  		ihold(inode);
@@ -104673,7 +104677,7 @@ index 70580ab..cdede72 100644
  exit2:
  		dput(dentry);
  	}
-@@ -4093,9 +4310,17 @@ retry:
+@@ -4095,9 +4312,17 @@ retry:
  	if (IS_ERR(dentry))
  		goto out_putname;
  
@@ -104691,7 +104695,7 @@ index 70580ab..cdede72 100644
  	done_path_create(&path, dentry);
  	if (retry_estale(error, lookup_flags)) {
  		lookup_flags |= LOOKUP_REVAL;
-@@ -4199,6 +4424,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -4201,6 +4426,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
  	struct dentry *new_dentry;
  	struct path old_path, new_path;
  	struct inode *delegated_inode = NULL;
@@ -104699,7 +104703,7 @@ index 70580ab..cdede72 100644
  	int how = 0;
  	int error;
  
-@@ -4222,7 +4448,7 @@ retry:
+@@ -4224,7 +4450,7 @@ retry:
  	if (error)
  		return error;
  
@@ -104708,7 +104712,7 @@ index 70580ab..cdede72 100644
  					(how & LOOKUP_REVAL));
  	error = PTR_ERR(new_dentry);
  	if (IS_ERR(new_dentry))
-@@ -4234,11 +4460,26 @@ retry:
+@@ -4236,11 +4462,26 @@ retry:
  	error = may_linkat(&old_path);
  	if (unlikely(error))
  		goto out_dput;
@@ -104735,7 +104739,7 @@ index 70580ab..cdede72 100644
  	done_path_create(&new_path, new_dentry);
  	if (delegated_inode) {
  		error = break_deleg_wait(&delegated_inode);
-@@ -4557,6 +4798,20 @@ retry_deleg:
+@@ -4559,6 +4800,20 @@ retry_deleg:
  	if (new_dentry == trap)
  		goto exit5;
  
@@ -104756,7 +104760,7 @@ index 70580ab..cdede72 100644
  	error = security_path_rename(&old_path, old_dentry,
  				     &new_path, new_dentry, flags);
  	if (error)
-@@ -4564,6 +4819,9 @@ retry_deleg:
+@@ -4566,6 +4821,9 @@ retry_deleg:
  	error = vfs_rename(old_path.dentry->d_inode, old_dentry,
  			   new_path.dentry->d_inode, new_dentry,
  			   &delegated_inode, flags);
@@ -104766,7 +104770,7 @@ index 70580ab..cdede72 100644
  exit5:
  	dput(new_dentry);
  exit4:
-@@ -4620,14 +4878,24 @@ EXPORT_SYMBOL(vfs_whiteout);
+@@ -4622,14 +4880,24 @@ EXPORT_SYMBOL(vfs_whiteout);
  
  int readlink_copy(char __user *buffer, int buflen, const char *link)
  {
@@ -113513,10 +113517,10 @@ index 93ae3cd..6cee098 100644
  	}
  	putname(tmp);
 diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
-index 80aa6f1..bf87501 100644
+index 4133aa7..5468804 100644
 --- a/fs/overlayfs/copy_up.c
 +++ b/fs/overlayfs/copy_up.c
-@@ -185,7 +185,7 @@ static char *ovl_read_symlink(struct dentry *realdentry)
+@@ -187,7 +187,7 @@ static char *ovl_read_symlink(struct dentry *realdentry)
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
  	res = inode->i_op->readlink(realdentry,
@@ -113526,10 +113530,10 @@ index 80aa6f1..bf87501 100644
  	if (res < 0) {
  		free_page((unsigned long) buf);
 diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
-index d1cdc60..38f2608 100644
+index ac98a71..48f2b72 100644
 --- a/fs/overlayfs/inode.c
 +++ b/fs/overlayfs/inode.c
-@@ -360,6 +360,9 @@ struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags)
+@@ -363,6 +363,9 @@ struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags)
  	if (d_is_dir(dentry))
  		return d_backing_inode(dentry);
  
@@ -113540,7 +113544,7 @@ index d1cdc60..38f2608 100644
  	if (ovl_open_need_copy_up(file_flags, type, realpath.dentry)) {
  		err = ovl_want_write(dentry);
 diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
-index 6db75cb..b2fe139 100644
+index 86f2025..8a2a0b8 100644
 --- a/fs/overlayfs/super.c
 +++ b/fs/overlayfs/super.c
 @@ -196,7 +196,7 @@ void ovl_path_lower(struct dentry *dentry, struct path *path)
@@ -113552,7 +113556,7 @@ index 6db75cb..b2fe139 100644
  }
  
  int ovl_want_write(struct dentry *dentry)
-@@ -953,8 +953,8 @@ static unsigned int ovl_split_lowerdirs(char *str)
+@@ -972,8 +972,8 @@ static unsigned int ovl_split_lowerdirs(char *str)
  
  static int ovl_fill_super(struct super_block *sb, void *data, int silent)
  {
@@ -115396,7 +115400,7 @@ index 510413eb..34d9a8c 100644
  	seq_printf(p, "softirq %llu", (unsigned long long)sum_softirq);
  
 diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index 4648c7f..9f5a541 100644
+index 4648c7f..1cd9ac3 100644
 --- a/fs/proc/task_mmu.c
 +++ b/fs/proc/task_mmu.c
 @@ -15,12 +15,19 @@
@@ -115469,12 +115473,25 @@ index 4648c7f..9f5a541 100644
  	if (IS_ERR(priv->mm)) {
  		int err = PTR_ERR(priv->mm);
  
-@@ -281,11 +309,11 @@ static int is_stack(struct proc_maps_private *priv,
- 			stack = vma_is_stack_for_task(vma, task);
- 		rcu_read_unlock();
- 	}
--	return stack;
-+	return stack || (vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP));
+@@ -263,14 +291,15 @@ static int do_maps_open(struct inode *inode, struct file *file,
+  * Indicate if the VMA is a stack for the given task; for
+  * /proc/PID/maps that is the stack of the main task.
+  */
+-static int is_stack(struct proc_maps_private *priv,
++static bool is_stack(struct proc_maps_private *priv,
+ 		    struct vm_area_struct *vma, int is_pid)
+ {
+-	int stack = 0;
++	bool stack = false;
+ 
+ 	if (is_pid) {
+ 		stack = vma->vm_start <= vma->vm_mm->start_stack &&
+ 			vma->vm_end >= vma->vm_mm->start_stack;
++		stack |= vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP);
+ 	} else {
+ 		struct inode *inode = priv->inode;
+ 		struct task_struct *task;
+@@ -285,7 +314,7 @@ static int is_stack(struct proc_maps_private *priv,
  }
  
  static void
@@ -115483,7 +115500,7 @@ index 4648c7f..9f5a541 100644
  {
  	struct mm_struct *mm = vma->vm_mm;
  	struct file *file = vma->vm_file;
-@@ -304,13 +332,8 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
+@@ -304,13 +333,8 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
  		pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
  	}
  
@@ -115499,7 +115516,7 @@ index 4648c7f..9f5a541 100644
  
  	seq_setwidth(m, 25 + sizeof(void *) * 6 - 1);
  	seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ",
-@@ -320,7 +343,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
+@@ -320,7 +344,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
  			flags & VM_WRITE ? 'w' : '-',
  			flags & VM_EXEC ? 'x' : '-',
  			flags & VM_MAYSHARE ? 's' : 'p',
@@ -115508,7 +115525,7 @@ index 4648c7f..9f5a541 100644
  			MAJOR(dev), MINOR(dev), ino);
  
  	/*
-@@ -329,7 +352,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
+@@ -329,7 +353,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
  	 */
  	if (file) {
  		seq_pad(m, ' ');
@@ -115517,7 +115534,7 @@ index 4648c7f..9f5a541 100644
  		goto done;
  	}
  
-@@ -366,7 +389,20 @@ done:
+@@ -366,7 +390,20 @@ done:
  
  static int show_map(struct seq_file *m, void *v, int is_pid)
  {
@@ -115539,7 +115556,7 @@ index 4648c7f..9f5a541 100644
  	m_cache_vma(m, v);
  	return 0;
  }
-@@ -646,6 +682,9 @@ static void show_smap_vma_flags(struct seq_file *m, struct vm_area_struct *vma)
+@@ -646,6 +683,9 @@ static void show_smap_vma_flags(struct seq_file *m, struct vm_area_struct *vma)
  		[ilog2(VM_RAND_READ)]	= "rr",
  		[ilog2(VM_DONTCOPY)]	= "dc",
  		[ilog2(VM_DONTEXPAND)]	= "de",
@@ -115549,7 +115566,7 @@ index 4648c7f..9f5a541 100644
  		[ilog2(VM_ACCOUNT)]	= "ac",
  		[ilog2(VM_NORESERVE)]	= "nr",
  		[ilog2(VM_HUGETLB)]	= "ht",
-@@ -727,7 +766,14 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
+@@ -727,7 +767,14 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
  		.mm = vma->vm_mm,
  		.private = &mss,
  	};
@@ -115564,7 +115581,7 @@ index 4648c7f..9f5a541 100644
  	memset(&mss, 0, sizeof mss);
  
  #ifdef CONFIG_SHMEM
-@@ -754,10 +800,15 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
+@@ -754,10 +801,15 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
  	}
  #endif
  
@@ -115583,7 +115600,7 @@ index 4648c7f..9f5a541 100644
  
  	seq_printf(m,
  		   "Size:           %8lu kB\n"
-@@ -777,7 +828,7 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
+@@ -777,7 +829,7 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
  		   "KernelPageSize: %8lu kB\n"
  		   "MMUPageSize:    %8lu kB\n"
  		   "Locked:         %8lu kB\n",
@@ -115592,7 +115609,7 @@ index 4648c7f..9f5a541 100644
  		   mss.resident >> 10,
  		   (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
  		   mss.shared_clean  >> 10,
-@@ -1433,7 +1484,7 @@ static int pagemap_open(struct inode *inode, struct file *file)
+@@ -1433,7 +1485,7 @@ static int pagemap_open(struct inode *inode, struct file *file)
  {
  	struct mm_struct *mm;
  
@@ -115601,7 +115618,7 @@ index 4648c7f..9f5a541 100644
  	if (IS_ERR(mm))
  		return PTR_ERR(mm);
  	file->private_data = mm;
-@@ -1636,6 +1687,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
+@@ -1636,6 +1688,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
  	char buffer[64];
  	int nid;
  
@@ -115615,7 +115632,7 @@ index 4648c7f..9f5a541 100644
  	if (!mm)
  		return 0;
  
-@@ -1650,11 +1708,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
+@@ -1650,11 +1709,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
  		mpol_to_str(buffer, sizeof(buffer), proc_priv->task_mempolicy);
  	}
  
@@ -126381,7 +126398,7 @@ index 0000000..6822208
 +}
 diff --git a/grsecurity/grsec_ipc.c b/grsecurity/grsec_ipc.c
 new file mode 100644
-index 0000000..1773300
+index 0000000..6a8ed69
 --- /dev/null
 +++ b/grsecurity/grsec_ipc.c
 @@ -0,0 +1,48 @@
@@ -126426,7 +126443,7 @@ index 0000000..1773300
 +			orig_granted_mode = 0;
 +	}
 +	if (!(requested_mode & ~granted_mode & 0007) && (requested_mode & ~orig_granted_mode & 0007) &&
-+	    !ns_capable_nolog(ns->user_ns, CAP_IPC_OWNER)) {
++	    !ns_capable_noaudit(ns->user_ns, CAP_IPC_OWNER)) {
 +		gr_log_str_int(GR_DONT_AUDIT, GR_IPC_DENIED_MSG, write ? "write" : "read", GR_GLOBAL_UID(ipcp->cuid));
 +		return 0;
 +	}
@@ -128339,7 +128356,7 @@ index 5bdab6b..9ae82fe 100644
  #define pud_none(pud)			0
  #define pud_bad(pud)			0
 diff --git a/include/asm-generic/atomic-long.h b/include/asm-generic/atomic-long.h
-index 5e1f345..74a91f8 100644
+index 5e1f345..e3fb6e2 100644
 --- a/include/asm-generic/atomic-long.h
 +++ b/include/asm-generic/atomic-long.h
 @@ -22,6 +22,12 @@
@@ -128548,7 +128565,7 @@ index 5e1f345..74a91f8 100644
  
  #undef ATOMIC_LONG_INC_DEC_OP
  
-@@ -187,4 +229,59 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
+@@ -187,4 +229,60 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
  #define atomic_long_inc_not_zero(l) \
  	ATOMIC_LONG_PFX(_inc_not_zero)((ATOMIC_LONG_PFX(_t) *)(l))
  
@@ -128596,6 +128613,7 @@ index 5e1f345..74a91f8 100644
 +#ifndef atomic_xchg_unchecked
 +#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
 +#endif
++
 +#define atomic_long_read_unchecked(v) atomic_long_read(v)
 +#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
 +#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
@@ -129640,10 +129658,10 @@ index 1be04f8..9c2d3e2 100644
  #define __ro_after_init __attribute__((__section__(".data..ro_after_init")))
  #endif
 diff --git a/include/linux/capability.h b/include/linux/capability.h
-index 00690ff..b9c971b 100644
+index 5f3c63d..b874083 100644
 --- a/include/linux/capability.h
 +++ b/include/linux/capability.h
-@@ -229,15 +229,28 @@ static inline bool capable(int cap)
+@@ -230,6 +230,10 @@ static inline bool capable(int cap)
  {
  	return true;
  }
@@ -129654,17 +129672,13 @@ index 00690ff..b9c971b 100644
  static inline bool ns_capable(struct user_namespace *ns, int cap)
  {
  	return true;
+@@ -240,9 +244,13 @@ static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap)
  }
-+static inline bool ns_capable_nolog(struct user_namespace *ns, int cap)
-+{
-+	return true;
-+}
  #endif /* CONFIG_MULTIUSER */
  extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap);
 +extern bool capable_wrt_inode_uidgid_nolog(const struct inode *inode, int cap);
  extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
 +extern bool capable_nolog(int cap);
-+extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
  
  /* audit system wants to get cap info from files as well */
  extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
@@ -132307,19 +132321,23 @@ index ba7a9b0..33a0237 100644
  extern int register_pppox_proto(int proto_num, const struct pppox_proto *pp);
  extern void unregister_pppox_proto(int proto_num);
 diff --git a/include/linux/init.h b/include/linux/init.h
-index aedb254..71b67e5 100644
+index aedb254..a398315 100644
 --- a/include/linux/init.h
 +++ b/include/linux/init.h
-@@ -39,7 +39,7 @@
+@@ -37,9 +37,11 @@
+  * section.
+  */
  
++#define add_init_latent_entropy __latent_entropy
++
  /* These are for everybody (although not all archs will actually
     discard it in modules) */
 -#define __init		__section(.init.text) __cold notrace
-+#define __init		__section(.init.text) __cold notrace __latent_entropy
++#define __init		__section(.init.text) __cold notrace add_init_latent_entropy
  #define __initdata	__section(.init.data)
  #define __initconst	__constsection(.init.rodata)
  #define __exitdata	__section(.exit.data)
-@@ -92,7 +92,7 @@
+@@ -92,7 +94,7 @@
  #define __exit          __section(.exit.text) __exitused __cold notrace
  
  /* Used for MEMORY_HOTPLUG */
@@ -132328,7 +132346,7 @@ index aedb254..71b67e5 100644
  #define __meminitdata    __section(.meminit.data)
  #define __meminitconst   __constsection(.meminit.rodata)
  #define __memexit        __section(.memexit.text) __exitused __cold notrace
-@@ -117,6 +117,12 @@
+@@ -117,6 +119,12 @@
  #define __REFDATA        .section       ".ref.data", "aw"
  #define __REFCONST       .section       ".ref.rodata", "a"
  
@@ -132902,6 +132920,33 @@ index 5356f4d..c99970b 100644
  /**
   * list_move - delete from one list and add as another's head
   * @list: the entry to move
+diff --git a/include/linux/llist.h b/include/linux/llist.h
+index fd4ca0b..d77d4a8 100644
+--- a/include/linux/llist.h
++++ b/include/linux/llist.h
+@@ -168,6 +168,10 @@ static inline struct llist_node *llist_next(struct llist_node *node)
+ extern bool llist_add_batch(struct llist_node *new_first,
+ 			    struct llist_node *new_last,
+ 			    struct llist_head *head);
++
++extern bool pax_llist_add_batch(struct llist_node *new_first,
++				struct llist_node *new_last,
++				struct llist_head *head);
+ /**
+  * llist_add - add a new entry
+  * @new:	new entry to be added
+@@ -180,6 +184,11 @@ static inline bool llist_add(struct llist_node *new, struct llist_head *head)
+ 	return llist_add_batch(new, new, head);
+ }
+ 
++static inline bool pax_llist_add(struct llist_node *new, struct llist_head *head)
++{
++	return pax_llist_add_batch(new, new, head);
++}
++
+ /**
+  * llist_del_all - delete all entries from lock-less list
+  * @head:	the head of lock-less list to delete all entries
 diff --git a/include/linux/lockd/xdr.h b/include/linux/lockd/xdr.h
 index d39ed1c..8b5d98f 100644
 --- a/include/linux/lockd/xdr.h
@@ -133162,7 +133207,7 @@ index 4429d25..ae5ab54 100644
  static inline int
  vma_dup_policy(struct vm_area_struct *src, struct vm_area_struct *dst)
 diff --git a/include/linux/mm.h b/include/linux/mm.h
-index ece042d..d7834bf 100644
+index ece042d..8115afb 100644
 --- a/include/linux/mm.h
 +++ b/include/linux/mm.h
 @@ -107,6 +107,7 @@ extern int mmap_rnd_compat_bits __read_mostly;
@@ -133228,7 +133273,7 @@ index ece042d..d7834bf 100644
  
  long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
  		      unsigned long start, unsigned long nr_pages,
-@@ -1331,39 +1338,11 @@ int clear_page_dirty_for_io(struct page *page);
+@@ -1331,40 +1338,12 @@ int clear_page_dirty_for_io(struct page *page);
  
  int get_cmdline(struct task_struct *task, char *buffer, int buflen);
  
@@ -133265,9 +133310,11 @@ index ece042d..d7834bf 100644
 -		!vma_growsup(vma->vm_next, addr);
 -}
 -
- int vma_is_stack_for_task(struct vm_area_struct *vma, struct task_struct *t);
+-int vma_is_stack_for_task(struct vm_area_struct *vma, struct task_struct *t);
++bool vma_is_stack_for_task(struct vm_area_struct *vma, struct task_struct *t);
  
  extern unsigned long move_page_tables(struct vm_area_struct *vma,
+ 		unsigned long old_addr, struct vm_area_struct *new_vma,
 @@ -1508,8 +1487,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd,
  {
  	return 0;
@@ -136120,20 +136167,6 @@ index 5c3a5f3..84a8bef 100644
  }
  #else
  
-diff --git a/include/linux/swiotlb.h b/include/linux/swiotlb.h
-index 017fced..d4a9fc9 100644
---- a/include/linux/swiotlb.h
-+++ b/include/linux/swiotlb.h
-@@ -63,7 +63,8 @@ extern void
- 
- extern void
- swiotlb_free_coherent(struct device *hwdev, size_t size,
--		      void *vaddr, dma_addr_t dma_handle);
-+		      void *vaddr, dma_addr_t dma_handle,
-+		      struct dma_attrs *attrs);
- 
- extern dma_addr_t swiotlb_map_page(struct device *dev, struct page *page,
- 				   unsigned long offset, size_t size,
 diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
 index d022390..80f9811 100644
 --- a/include/linux/syscalls.h
@@ -139633,7 +139666,7 @@ index 46ecce4..46c1a1a 100644
  	if (!access_ok(VERIFY_READ, uattr, 1))
  		return -EFAULT;
 diff --git a/kernel/capability.c b/kernel/capability.c
-index 45432b5..7d860f7 100644
+index 00411c8..aaad585 100644
 --- a/kernel/capability.c
 +++ b/kernel/capability.c
 @@ -193,6 +193,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
@@ -139673,51 +139706,34 @@ index 45432b5..7d860f7 100644
  }
  
  /**
-@@ -379,7 +383,7 @@ bool ns_capable(struct user_namespace *ns, int cap)
+@@ -370,9 +374,9 @@ static bool ns_capable_common(struct user_namespace *ns, int cap, bool audit)
  		BUG();
  	}
  
--	if (security_capable(current_cred(), ns, cap) == 0) {
-+	if (security_capable(current_cred(), ns, cap) == 0 && gr_is_capable(cap)) {
+-	capable = audit ? security_capable(current_cred(), ns, cap) :
+-			  security_capable_noaudit(current_cred(), ns, cap);
+-	if (capable == 0) {
++	capable = audit ? (security_capable(current_cred(), ns, cap) == 0 && gr_is_capable(cap)) :
++			  (security_capable_noaudit(current_cred(), ns, cap) == 0 && gr_is_capable_nolog(cap)) ;
++	if (capable) {
  		current->flags |= PF_SUPERPRIV;
  		return true;
  	}
-@@ -387,6 +391,20 @@ bool ns_capable(struct user_namespace *ns, int cap)
- }
- EXPORT_SYMBOL(ns_capable);
- 
-+bool ns_capable_nolog(struct user_namespace *ns, int cap)
-+{
-+	if (unlikely(!cap_valid(cap))) {
-+		pr_crit("capable_nolog() called with invalid cap=%u\n", cap);
-+		BUG();
-+	}
-+
-+	if (security_capable_noaudit(current_cred(), ns, cap) == 0 && gr_is_capable_nolog(cap)) {
-+		current->flags |= PF_SUPERPRIV;
-+		return true;
-+	}
-+	return false;
-+}
-+EXPORT_SYMBOL(ns_capable_nolog);
- 
- /**
-  * capable - Determine if the current task has a superior capability in effect
-@@ -403,6 +421,13 @@ bool capable(int cap)
+@@ -429,6 +433,13 @@ bool capable(int cap)
  	return ns_capable(&init_user_ns, cap);
  }
  EXPORT_SYMBOL(capable);
 +
 +bool capable_nolog(int cap)
 +{
-+	return ns_capable_nolog(&init_user_ns, cap);
++	return ns_capable_noaudit(&init_user_ns, cap);
 +}
 +EXPORT_SYMBOL(capable_nolog);
 +
  #endif /* CONFIG_MULTIUSER */
  
  /**
-@@ -447,3 +472,12 @@ bool capable_wrt_inode_uidgid(const struct inode *inode, int cap)
+@@ -473,3 +484,12 @@ bool capable_wrt_inode_uidgid(const struct inode *inode, int cap)
  		kgid_has_mapping(ns, inode->i_gid);
  }
  EXPORT_SYMBOL(capable_wrt_inode_uidgid);
@@ -139726,7 +139742,7 @@ index 45432b5..7d860f7 100644
 +{
 +	struct user_namespace *ns = current_user_ns();
 +
-+	return ns_capable_nolog(ns, cap) && kuid_has_mapping(ns, inode->i_uid) &&
++	return ns_capable_noaudit(ns, cap) && kuid_has_mapping(ns, inode->i_uid) &&
 +		kgid_has_mapping(ns, inode->i_gid);
 +}
 +EXPORT_SYMBOL(capable_wrt_inode_uidgid_nolog);
@@ -140015,7 +140031,7 @@ index c18b1f1..b9a0132 100644
  		return -ENOMEM;
  
 diff --git a/kernel/cred.c b/kernel/cred.c
-index 0c0cd8a..faf7245 100644
+index 5f264fb..8fc856b 100644
 --- a/kernel/cred.c
 +++ b/kernel/cred.c
 @@ -172,6 +172,15 @@ void exit_creds(struct task_struct *tsk)
@@ -140644,8 +140660,45 @@ index 9e6e135..4af378d 100644
  
  		if (wo->wo_flags & __WNOTHREAD)
  			break;
+diff --git a/kernel/extable.c b/kernel/extable.c
+index e820cce..72195de 100644
+--- a/kernel/extable.c
++++ b/kernel/extable.c
+@@ -23,6 +23,7 @@
+ 
+ #include <asm/sections.h>
+ #include <asm/uaccess.h>
++#include <asm/setup.h>
+ 
+ /*
+  * mutex protecting text section modification (dynamic code patching).
+@@ -41,10 +42,22 @@ u32 __initdata __visible main_extable_sort_needed = 1;
+ /* Sort the kernel's built-in exception table */
+ void __init sort_main_extable(void)
+ {
+-	if (main_extable_sort_needed && __stop___ex_table > __start___ex_table) {
++	struct exception_table_entry *start = __start___ex_table;
++
++	if (main_extable_sort_needed && __stop___ex_table > start) {
+ 		pr_notice("Sorting __ex_table...\n");
+-		sort_extable(__start___ex_table, __stop___ex_table);
++		sort_extable(start, __stop___ex_table);
+ 	}
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++	while (start < __stop___ex_table) {
++		start->insn -= kaslr_offset();
++		start->fixup -= kaslr_offset();
++		start->handler -= kaslr_offset();
++		start++;
++	}
++#endif
++
+ }
+ 
+ /* Given an address, look for it in the exception tables. */
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 4a7ec0c..c49705c 100644
+index aea4f4d..59d599e 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -197,12 +197,55 @@ static void free_thread_stack(unsigned long *stack)
@@ -141806,7 +141859,7 @@ index a0f61ef..b6aef3c 100644
  		seq_printf(m, "%40s %14lu %29s %pS\n",
  			   name, stats->contending_point[i],
 diff --git a/kernel/module.c b/kernel/module.c
-index 6458a2f..ebdeb641 100644
+index 6458a2f..3edf977 100644
 --- a/kernel/module.c
 +++ b/kernel/module.c
 @@ -60,6 +60,7 @@
@@ -142747,17 +142800,24 @@ index 6458a2f..ebdeb641 100644
  	return 0;
  }
  module_init(proc_modules_init);
-@@ -4118,7 +4328,8 @@ struct module *__module_address(unsigned long addr)
+@@ -4118,7 +4328,15 @@ struct module *__module_address(unsigned long addr)
  {
  	struct module *mod;
  
 -	if (addr < module_addr_min || addr > module_addr_max)
++#ifdef CONFIG_X86_32
++	unsigned long vaddr = ktla_ktva(addr);
++
++	if (module_addr_min_rx <= vaddr && vaddr <= module_addr_max_rx)
++		addr = vaddr;
++#endif
++
 +	if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
 +	    (addr < module_addr_min_rw || addr > module_addr_max_rw))
  		return NULL;
  
  	module_assert_mutex_or_preempt();
-@@ -4161,11 +4372,21 @@ bool is_module_text_address(unsigned long addr)
+@@ -4161,11 +4379,21 @@ bool is_module_text_address(unsigned long addr)
   */
  struct module *__module_text_address(unsigned long addr)
  {
@@ -142782,6 +142842,15 @@ index 6458a2f..ebdeb641 100644
  			mod = NULL;
  	}
  	return mod;
+@@ -4195,7 +4423,7 @@ void print_modules(void)
+ #ifdef CONFIG_MODVERSIONS
+ /* Generate the signature for all relevant module structures here.
+  * If these change, we don't want to try to parse the module. */
+-void module_layout(struct module *mod,
++__visible void module_layout(struct module *mod,
+ 		   struct modversion_info *ver,
+ 		   struct kernel_param *kp,
+ 		   struct kernel_symbol *ks,
 diff --git a/kernel/notifier.c b/kernel/notifier.c
 index fd2c9ac..6263e05 100644
 --- a/kernel/notifier.c
@@ -143155,7 +143224,7 @@ index c2199e9..ce5d89c 100644
  }
  
 diff --git a/kernel/ptrace.c b/kernel/ptrace.c
-index d49bfa1..5eb9a32 100644
+index d49bfa1..10a4c38 100644
 --- a/kernel/ptrace.c
 +++ b/kernel/ptrace.c
 @@ -206,12 +206,32 @@ static int ptrace_check_attach(struct task_struct *child, bool ignore_state)
@@ -143217,7 +143286,7 @@ index d49bfa1..5eb9a32 100644
  		flags |= PT_SEIZED;
  	rcu_read_lock();
 -	if (ns_capable(__task_cred(task)->user_ns, CAP_SYS_PTRACE))
-+	if (ns_capable_nolog(__task_cred(task)->user_ns, CAP_SYS_PTRACE))
++	if (ns_capable_noaudit(__task_cred(task)->user_ns, CAP_SYS_PTRACE))
  		flags |= PT_PTRACE_CAP;
  	rcu_read_unlock();
  	task->ptrace = flags;
@@ -145399,7 +145468,7 @@ index 667b933..1668952 100644
  		update_vsyscall_tz();
  		if (firsttime) {
 diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index 479d25c..7c25647 100644
+index b6c3945..373f21e 100644
 --- a/kernel/time/timekeeping.c
 +++ b/kernel/time/timekeeping.c
 @@ -15,6 +15,7 @@
@@ -145410,7 +145479,7 @@ index 479d25c..7c25647 100644
  #include <linux/syscore_ops.h>
  #include <linux/clocksource.h>
  #include <linux/jiffies.h>
-@@ -1164,6 +1165,8 @@ int do_settimeofday64(const struct timespec64 *ts)
+@@ -1167,6 +1168,8 @@ int do_settimeofday64(const struct timespec64 *ts)
  	if (!timespec64_valid_strict(ts))
  		return -EINVAL;
  
@@ -146859,34 +146928,6 @@ index 51a76af..7caf15b 100644
  		err_printk(dev, NULL, "DMA-API: device driver maps memory from "
  				"stack [addr=%p]\n", addr);
  }
-diff --git a/lib/extable.c b/lib/extable.c
-index 0be02ad5..c2ad286 100644
---- a/lib/extable.c
-+++ b/lib/extable.c
-@@ -13,13 +13,22 @@
- #include <linux/init.h>
- #include <linux/sort.h>
- #include <asm/uaccess.h>
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#include <asm/boot.h>
-+#endif
- 
- #ifndef ARCH_HAS_RELATIVE_EXTABLE
- #define ex_to_insn(x)	((x)->insn)
- #else
- static inline unsigned long ex_to_insn(const struct exception_table_entry *x)
- {
--	return (unsigned long)&x->insn + x->insn;
-+	unsigned long reloc = 0;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	reloc = ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
-+#endif
-+
-+	return (unsigned long)&x->insn + x->insn + reloc;
- }
- #endif
- 
 diff --git a/lib/inflate.c b/lib/inflate.c
 index 013a761..c28f3fc 100644
 --- a/lib/inflate.c
@@ -147186,6 +147227,41 @@ index 3859bf6..818741d6 100644
 +	pax_close_kernel();
 +}
 +EXPORT_SYMBOL(pax_list_del_rcu);
+diff --git a/lib/llist.c b/lib/llist.c
+index ae5872b..63a9698 100644
+--- a/lib/llist.c
++++ b/lib/llist.c
+@@ -25,6 +25,7 @@
+ #include <linux/kernel.h>
+ #include <linux/export.h>
+ #include <linux/llist.h>
++#include <linux/mm.h>
+ 
+ 
+ /**
+@@ -48,6 +49,22 @@ bool llist_add_batch(struct llist_node *new_first, struct llist_node *new_last,
+ }
+ EXPORT_SYMBOL_GPL(llist_add_batch);
+ 
++bool pax_llist_add_batch(struct llist_node *new_first, struct llist_node *new_last,
++			 struct llist_head *head)
++{
++	struct llist_node *first;
++
++	do {
++		first = ACCESS_ONCE(head->first);
++		pax_open_kernel();
++		new_last->next = first;
++		pax_close_kernel();
++	} while (cmpxchg(&head->first, first, new_first) != first);
++
++	return !first;
++}
++EXPORT_SYMBOL_GPL(pax_llist_add_batch);
++
+ /**
+  * llist_del_first - delete the first entry of lock-less list
+  * @head:	the head for your lock-less list
 diff --git a/lib/lockref.c b/lib/lockref.c
 index 5a92189..d77978d 100644
 --- a/lib/lockref.c
@@ -147469,19 +147545,6 @@ index 2625943..1541382 100644
  	long align, res = 0;
  	unsigned long c;
  
-diff --git a/lib/swiotlb.c b/lib/swiotlb.c
-index 76f29ec..1a5316f 100644
---- a/lib/swiotlb.c
-+++ b/lib/swiotlb.c
-@@ -690,7 +690,7 @@ EXPORT_SYMBOL(swiotlb_alloc_coherent);
- 
- void
- swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr,
--		      dma_addr_t dev_addr)
-+		      dma_addr_t dev_addr, struct dma_attrs *attrs)
- {
- 	phys_addr_t paddr = dma_to_phys(hwdev, dev_addr);
- 
 diff --git a/lib/usercopy.c b/lib/usercopy.c
 index 4f5b1dd..7cab418 100644
 --- a/lib/usercopy.c
@@ -152776,9 +152839,18 @@ index 031713ab..f2c0e55 100644
  
  	if (S_ISREG(inode->i_mode))
 diff --git a/mm/util.c b/mm/util.c
-index 917e0e3..6873e84 100644
+index 917e0e3..1c9f20c 100644
 --- a/mm/util.c
 +++ b/mm/util.c
+@@ -230,7 +230,7 @@ void __vma_link_list(struct mm_struct *mm, struct vm_area_struct *vma,
+ }
+ 
+ /* Check if the vma is being used as a stack by this task */
+-int vma_is_stack_for_task(struct vm_area_struct *vma, struct task_struct *t)
++bool vma_is_stack_for_task(struct vm_area_struct *vma, struct task_struct *t)
+ {
+ 	return (vma->vm_start <= KSTK_ESP(t) && vma->vm_end >= KSTK_ESP(t));
+ }
 @@ -239,6 +239,12 @@ int vma_is_stack_for_task(struct vm_area_struct *vma, struct task_struct *t)
  void arch_pick_mmap_layout(struct mm_struct *mm)
  {
@@ -152811,7 +152883,7 @@ index 917e0e3..6873e84 100644
  	arg_start = mm->arg_start;
  	arg_end = mm->arg_end;
 diff --git a/mm/vmalloc.c b/mm/vmalloc.c
-index e11475c..3650eb9 100644
+index e11475c..eef1387 100644
 --- a/mm/vmalloc.c
 +++ b/mm/vmalloc.c
 @@ -43,20 +43,65 @@ struct vfree_deferred {
@@ -153065,7 +153137,7 @@ index e11475c..3650eb9 100644
 +		return;
 +	if (unlikely(in_interrupt())) {
 +		struct vfree_deferred *p = this_cpu_ptr(&vunmap_deferred);
-+		if (llist_add((struct llist_node *)addr, &p->list))
++		if (pax_llist_add((struct llist_node *)addr, &p->list))
 +			schedule_work(&p->wq);
 +	} else {
 +		might_sleep();
@@ -162233,19 +162305,6 @@ index dd94401..9540398 100644
  
  			/* Wait until SQ WR available if SQ still full */
  			wait_event(xprt->sc_send_wait,
-diff --git a/net/sysctl_net.c b/net/sysctl_net.c
-index ed98c1f..f74b659 100644
---- a/net/sysctl_net.c
-+++ b/net/sysctl_net.c
-@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ctl_table_header *head,
- 	kgid_t root_gid = make_kgid(net->user_ns, 0);
- 
- 	/* Allow network administrator to have same access as root. */
--	if (ns_capable(net->user_ns, CAP_NET_ADMIN) ||
-+	if (ns_capable_nolog(net->user_ns, CAP_NET_ADMIN) ||
- 	    uid_eq(root_uid, current_euid())) {
- 		int mode = (table->mode >> 6) & 7;
- 		return (mode << 6) | (mode << 3) | mode;
 diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
 index 1fd4647..ebf12ff 100644
 --- a/net/tipc/netlink_compat.c
@@ -166879,10 +166938,10 @@ index 0000000..7514850
 +fi
 diff --git a/scripts/gcc-plugins/initify_plugin.c b/scripts/gcc-plugins/initify_plugin.c
 new file mode 100644
-index 0000000..5a01d10
+index 0000000..fd7b918
 --- /dev/null
 +++ b/scripts/gcc-plugins/initify_plugin.c
-@@ -0,0 +1,537 @@
+@@ -0,0 +1,538 @@
 +/*
 + * Copyright 2015-2016 by Emese Revfy <re.emese@gmail.com>
 + * Licensed under the GPL v2, or (at your option) v3
@@ -167063,6 +167122,7 @@ index 0000000..5a01d10
 +	int fntype_arg_len;
 +	const_tree fndecl = gimple_call_fndecl(stmt);
 +
++//	gcc_assert(DECL_ABSTRACT_ORIGIN(fndecl) == NULL_TREE);
 +	if (DECL_ABSTRACT_ORIGIN(fndecl) != NULL_TREE)
 +		return false;
 +
@@ -185662,10 +185722,10 @@ index 0000000..00c7430
 +}
 diff --git a/scripts/gcc-plugins/size_overflow_plugin/size_overflow_hash.data b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_hash.data
 new file mode 100644
-index 0000000..9d7e744
+index 0000000..d9ac611
 --- /dev/null
 +++ b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,22256 @@
+@@ -0,0 +1,22257 @@
 +enable_so_recv_ctrl_pipe_us_data_0 recv_ctrl_pipe us_data 0 0 NULL
 +enable_so___earlyonly_bootmem_alloc_fndecl_3 __earlyonly_bootmem_alloc fndecl 2-3-4 3 NULL
 +enable_so_v9fs_xattr_get_acl_fndecl_4 v9fs_xattr_get_acl fndecl 5 4 NULL
@@ -195481,6 +195541,7 @@ index 0000000..9d7e744
 +enable_so_cur_offset_drm_dp_sideband_msg_tx_28655 cur_offset drm_dp_sideband_msg_tx 0 28655 &enable_so_alt_port_num_ib_qp_attr_28655
 +enable_so_alloc_size_chunk_28657 alloc_size chunk 0 28657 NULL
 +enable_so_bfad_iocmd_lunmask_fndecl_28667 bfad_iocmd_lunmask fndecl 0 28667 NULL
++enable_so___frwr_init_fndecl_28674 __frwr_init fndecl 3 28674 NULL
 +enable_so_x25_create_facilities_fndecl_28684 x25_create_facilities fndecl 0 28684 NULL
 +enable_so_fill_isoc_urb_fndecl_28690 fill_isoc_urb fndecl 6-5-3 28690 NULL
 +enable_so_stolen_size_psb_gtt_28693 stolen_size psb_gtt 0 28693 NULL
@@ -214381,7 +214442,7 @@ index 7798e16..1079224 100644
  	int i;
  	if (!capable(CAP_MAC_ADMIN))
 diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
-index 705c287..81257f1 100644
+index 7347fcc..b7f3f22 100644
 --- a/security/apparmor/policy.c
 +++ b/security/apparmor/policy.c
 @@ -298,7 +298,7 @@ static struct aa_namespace *alloc_namespace(const char *prefix,
@@ -215021,7 +215082,7 @@ index c61fd50f7..3081340 100644
  	default:
  		result = -EINVAL;
 diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
-index 795437b..3650746 100644
+index b450a27..28c8238 100644
 --- a/sound/core/rawmidi.c
 +++ b/sound/core/rawmidi.c
 @@ -871,9 +871,10 @@ static int snd_rawmidi_control_ioctl(struct snd_card *card,
diff --git a/4.7.3/4425_grsec_remove_EI_PAX.patch b/4.7.4/4425_grsec_remove_EI_PAX.patch
index ba92792..ba92792 100644
--- a/4.7.3/4425_grsec_remove_EI_PAX.patch
+++ b/4.7.4/4425_grsec_remove_EI_PAX.patch
diff --git a/4.7.3/4427_force_XATTR_PAX_tmpfs.patch b/4.7.4/4427_force_XATTR_PAX_tmpfs.patch
index b4714fc..b4714fc 100644
--- a/4.7.3/4427_force_XATTR_PAX_tmpfs.patch
+++ b/4.7.4/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/4.7.3/4430_grsec-remove-localversion-grsec.patch b/4.7.4/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/4.7.3/4430_grsec-remove-localversion-grsec.patch
+++ b/4.7.4/4430_grsec-remove-localversion-grsec.patch
diff --git a/4.7.3/4435_grsec-mute-warnings.patch b/4.7.4/4435_grsec-mute-warnings.patch
index 8929222..8929222 100644
--- a/4.7.3/4435_grsec-mute-warnings.patch
+++ b/4.7.4/4435_grsec-mute-warnings.patch
diff --git a/4.7.3/4440_grsec-remove-protected-paths.patch b/4.7.4/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/4.7.3/4440_grsec-remove-protected-paths.patch
+++ b/4.7.4/4440_grsec-remove-protected-paths.patch
diff --git a/4.7.3/4450_grsec-kconfig-default-gids.patch b/4.7.4/4450_grsec-kconfig-default-gids.patch
index e892c8a..e892c8a 100644
--- a/4.7.3/4450_grsec-kconfig-default-gids.patch
+++ b/4.7.4/4450_grsec-kconfig-default-gids.patch
diff --git a/4.7.3/4465_selinux-avc_audit-log-curr_ip.patch b/4.7.4/4465_selinux-avc_audit-log-curr_ip.patch
index 7248385..7248385 100644
--- a/4.7.3/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/4.7.4/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/4.7.3/4470_disable-compat_vdso.patch b/4.7.4/4470_disable-compat_vdso.patch
index 0f82d7e..0f82d7e 100644
--- a/4.7.3/4470_disable-compat_vdso.patch
+++ b/4.7.4/4470_disable-compat_vdso.patch
diff --git a/4.7.3/4475_emutramp_default_on.patch b/4.7.4/4475_emutramp_default_on.patch
index 2db58ab..2db58ab 100644
--- a/4.7.3/4475_emutramp_default_on.patch
+++ b/4.7.4/4475_emutramp_default_on.patch