main/linux-grsec: upgrade to grsecurity-2.9.1-3.8.8-201304241907

2 files changed, 720 insertions, 44 deletions

diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 0dba0bc2b8..c247d4940a 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -4,7 +4,7 @@ _flavor=grsec
 pkgname=linux-${_flavor}
 pkgver=3.8.8
 _kernver=3.8
-pkgrel=0
+pkgrel=1
 pkgdesc="Linux kernel with grsecurity"
 url=http://grsecurity.net
 depends="mkinitfs linux-firmware"
@@ -14,7 +14,7 @@ _config=${config:-kernelconfig.${CARCH}}
 install=
 source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz
 	http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz
-	grsecurity-2.9.1-3.8.8-201304172116.patch
+	grsecurity-2.9.1-3.8.8-201304241907.patch
 
 	0004-arp-flush-arp-cache-on-device-change.patch
 
@@ -142,19 +142,19 @@ dev() {
 
 md5sums="1c738edfc54e7c65faeb90c436104e2f  linux-3.8.tar.xz
 08cdcef928c2ca402adf1c444a3c43ac  patch-3.8.8.xz
-51c922d1e46251ab693f87fa673380d6  grsecurity-2.9.1-3.8.8-201304172116.patch
+fc7eefbae7601ee1ea9c6da643172293  grsecurity-2.9.1-3.8.8-201304241907.patch
 776adeeb5272093574f8836c5037dd7d  0004-arp-flush-arp-cache-on-device-change.patch
 0914bcf698bb5e1a39d2888ad2c5c442  kernelconfig.x86
 477f1a2a20dd6634dfa42f4732235370  kernelconfig.x86_64"
 sha256sums="e070d1bdfbded5676a4f374721c63565f1c969466c5a3e214004a136b583184b  linux-3.8.tar.xz
 759313a1012f17c83af15f237f3ad8b50a45f1bb34c62409e558a4d65bf014c3  patch-3.8.8.xz
-1ab35660c7a1a33a83e331b1ec23f52f3773ff94e7fd119acd83a58fc1dd3331  grsecurity-2.9.1-3.8.8-201304172116.patch
+5c48d0ba120c1858e8b4dc5d4bd579bf0ea6100f1eb7c9469a104c0375639e3c  grsecurity-2.9.1-3.8.8-201304241907.patch
 e2d2d1503f53572c6a2e21da729a13a430dd01f510405ffb3a33b29208860bde  0004-arp-flush-arp-cache-on-device-change.patch
 fea4df55c6db0a058eb24ede61473bf401a52ceb1945d5d552421847cc947160  kernelconfig.x86
 6b4c04220aaecd9854ac6e889e7518c931f1c3f5f2e7c32c2c084ccfc3be911f  kernelconfig.x86_64"
 sha512sums="10a7983391af907d8aec72bdb096d1cabd4911985715e9ea13d35ff09095c035db15d4ab08b92eda7c10026cc27348cb9728c212335f7fcdcda7c610856ec30f  linux-3.8.tar.xz
 dedc73b00d159a944ebc8efe961afafa64db140eca7fa1609dfea52517c60707384e633a5d05c70bb31603f6b668a8ceef1ce28eac62f8ce0fa67395265e8338  patch-3.8.8.xz
-be813a5108a42f9b1795d8b4646a492c4ccfcf6e82f984fdce2d7a4be0c1dfd8966c0f8522dd26930e23d48c46bc106e6e4c5fa35f6c008b1dca56367b5b59cd  grsecurity-2.9.1-3.8.8-201304172116.patch
+29fc165eb57e02c2903f6f67d3b8e51ccce4f68905bb1e5bc22decd95f8ffcb0d6fb70a19d590a6a87d70668a37a9769b545125d0450c9a2eb670bb40caf1500  grsecurity-2.9.1-3.8.8-201304241907.patch
 b6fdf376009f0f0f3fa194cb11be97343e4d394cf5d3547de6cfca8ad619c5bd3f60719331fd8cfadc47f09d22be8376ba5f871b46b24887ea73fe47e233a54e  0004-arp-flush-arp-cache-on-device-change.patch
 ffb12d33f55dbc50e97156feaf65e29f6b332750e43c33ed90b2def5029d039b0b87d559483cf3a80f330dadac68f921fa276dc6cc9fbc4e60050985d823501e  kernelconfig.x86
 3bdc68b0b8d36b051ac543f13eba1151902e1e43e76abef8d8dcbaa6927db6365f1b091505569af8146c89e486e24647e8e96fb6b96f30a0071f59e5923950cb  kernelconfig.x86_64"
diff --git a/main/linux-grsec/grsecurity-2.9.1-3.8.8-201304172116.patch b/main/linux-grsec/grsecurity-2.9.1-3.8.8-201304241907.patch
index b90155e117..749175d279 100644
--- a/main/linux-grsec/grsecurity-2.9.1-3.8.8-201304172116.patch
+++ b/main/linux-grsec/grsecurity-2.9.1-3.8.8-201304241907.patch
@@ -3306,7 +3306,7 @@ index b0179b8..829510e 100644
 +
  }
 diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
-index 11c1785..c67d54c 100644
+index 11c1785..1b209f4 100644
 --- a/arch/arm/kernel/vmlinux.lds.S
 +++ b/arch/arm/kernel/vmlinux.lds.S
 @@ -8,7 +8,11 @@
@@ -3334,17 +3334,26 @@ index 11c1785..c67d54c 100644
  	.text : {			/* Real text segment		*/
  		_stext = .;		/* Text and read-only data	*/
  			__exception_text_start = .;
-@@ -144,6 +153,10 @@ SECTIONS
+@@ -112,6 +121,8 @@ SECTIONS
+ 			ARM_CPU_KEEP(PROC_INFO)
+ 	}
+ 
++	_etext = .;			/* End of text section */
++
+ 	RO_DATA(PAGE_SIZE)
  
- 	_etext = .;			/* End of text and rodata section */
+ 	. = ALIGN(4);
+@@ -142,7 +153,9 @@ SECTIONS
  
+ 	NOTES
+ 
+-	_etext = .;			/* End of text and rodata section */
 +#ifdef CONFIG_PAX_KERNEXEC
 +	. = ALIGN(1<<SECTION_SHIFT);
 +#endif
-+
+ 
  #ifndef CONFIG_XIP_KERNEL
  	. = ALIGN(PAGE_SIZE);
- 	__init_begin = .;
 @@ -203,6 +216,11 @@ SECTIONS
  	. = PAGE_OFFSET + TEXT_OFFSET;
  #else
@@ -8237,6 +8246,18 @@ index 6fc1348..390c50a 100644
  #define __S100	PAGE_READONLY
  #define __S101	PAGE_READONLY
  #define __S110	PAGE_SHARED
+diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
+index 08fcce9..7619f2f 100644
+--- a/arch/sparc/include/asm/pgtable_64.h
++++ b/arch/sparc/include/asm/pgtable_64.h
+@@ -915,6 +915,7 @@ static inline int io_remap_pfn_range(struct vm_area_struct *vma,
+ 	return remap_pfn_range(vma, from, phys_base >> PAGE_SHIFT, size, prot);
+ }
+ 
++#include <asm/tlbflush.h>
+ #include <asm-generic/pgtable.h>
+ 
+ /* We provide our own get_unmapped_area to cope with VA holes and
 diff --git a/arch/sparc/include/asm/pgtsrmmu.h b/arch/sparc/include/asm/pgtsrmmu.h
 index 79da178..c2eede8 100644
 --- a/arch/sparc/include/asm/pgtsrmmu.h
@@ -8354,6 +8375,20 @@ index 9689176..63c18ea 100644
  {
  	unsigned long mask, tmp1, tmp2, result;
  
+diff --git a/arch/sparc/include/asm/switch_to_64.h b/arch/sparc/include/asm/switch_to_64.h
+index cad36f5..c7de332 100644
+--- a/arch/sparc/include/asm/switch_to_64.h
++++ b/arch/sparc/include/asm/switch_to_64.h
+@@ -18,8 +18,7 @@ do {						\
+ 	 * and 2 stores in this critical code path.  -DaveM
+ 	 */
+ #define switch_to(prev, next, last)					\
+-do {	flush_tlb_pending();						\
+-	save_and_clear_fpu();						\
++do {	save_and_clear_fpu();						\
+ 	/* If you are tempted to conditionalize the following */	\
+ 	/* so that ASI is only written if it changes, think again. */	\
+ 	__asm__ __volatile__("wr %%g0, %0, %%asi"			\
 diff --git a/arch/sparc/include/asm/thread_info_32.h b/arch/sparc/include/asm/thread_info_32.h
 index 25849ae..924c54b 100644
 --- a/arch/sparc/include/asm/thread_info_32.h
@@ -8412,6 +8447,82 @@ index 269bd92..e46a9b8 100644
  /*
   * Thread-synchronous status.
   *
+diff --git a/arch/sparc/include/asm/tlbflush_64.h b/arch/sparc/include/asm/tlbflush_64.h
+index 2ef4634..f0d6a97 100644
+--- a/arch/sparc/include/asm/tlbflush_64.h
++++ b/arch/sparc/include/asm/tlbflush_64.h
+@@ -11,24 +11,40 @@
+ struct tlb_batch {
+ 	struct mm_struct *mm;
+ 	unsigned long tlb_nr;
++	unsigned long active;
+ 	unsigned long vaddrs[TLB_BATCH_NR];
+ };
+ 
+ extern void flush_tsb_kernel_range(unsigned long start, unsigned long end);
+ extern void flush_tsb_user(struct tlb_batch *tb);
++extern void flush_tsb_user_page(struct mm_struct *mm, unsigned long vaddr);
+ 
+ /* TLB flush operations. */
+ 
++static inline void flush_tlb_mm(struct mm_struct *mm)
++{
++}
++
++static inline void flush_tlb_page(struct vm_area_struct *vma,
++				  unsigned long vmaddr)
++{
++}
++
++static inline void flush_tlb_range(struct vm_area_struct *vma,
++				   unsigned long start, unsigned long end)
++{
++}
++
++#define __HAVE_ARCH_ENTER_LAZY_MMU_MODE
++
+ extern void flush_tlb_pending(void);
+-
+-#define flush_tlb_range(vma,start,end)	\
+-	do { (void)(start); flush_tlb_pending(); } while (0)
+-#define flush_tlb_page(vma,addr)	flush_tlb_pending()
+-#define flush_tlb_mm(mm)		flush_tlb_pending()
++extern void arch_enter_lazy_mmu_mode(void);
++extern void arch_leave_lazy_mmu_mode(void);
++#define arch_flush_lazy_mmu_mode()      do {} while (0)
+ 
+ /* Local cpu only.  */
+ extern void __flush_tlb_all(void);
+-
++extern void __flush_tlb_page(unsigned long context, unsigned long vaddr);
+ extern void __flush_tlb_kernel_range(unsigned long start, unsigned long end);
+ 
+ #ifndef CONFIG_SMP
+@@ -38,15 +54,24 @@ do {	flush_tsb_kernel_range(start,end); \
+ 	__flush_tlb_kernel_range(start,end); \
+ } while (0)
+ 
++static inline void global_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr)
++{
++	__flush_tlb_page(CTX_HWBITS(mm->context), vaddr);
++}
++
+ #else /* CONFIG_SMP */
+ 
+ extern void smp_flush_tlb_kernel_range(unsigned long start, unsigned long end);
++extern void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr);
+ 
+ #define flush_tlb_kernel_range(start, end) \
+ do {	flush_tsb_kernel_range(start,end); \
+ 	smp_flush_tlb_kernel_range(start, end); \
+ } while (0)
+ 
++#define global_flush_tlb_page(mm, vaddr) \
++	smp_flush_tlb_page(mm, vaddr)
++
+ #endif /* ! CONFIG_SMP */
+ 
+ #endif /* _SPARC64_TLBFLUSH_H */
 diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
 index 0167d26..767bb0c 100644
 --- a/arch/sparc/include/asm/uaccess.h
@@ -8658,6 +8769,79 @@ index 7ff45e4..a58f271 100644
  	audit_syscall_exit(regs);
  
  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
+diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
+index 537eb66..ca64d2a 100644
+--- a/arch/sparc/kernel/smp_64.c
++++ b/arch/sparc/kernel/smp_64.c
+@@ -849,7 +849,7 @@ void smp_tsb_sync(struct mm_struct *mm)
+ }
+ 
+ extern unsigned long xcall_flush_tlb_mm;
+-extern unsigned long xcall_flush_tlb_pending;
++extern unsigned long xcall_flush_tlb_page;
+ extern unsigned long xcall_flush_tlb_kernel_range;
+ extern unsigned long xcall_fetch_glob_regs;
+ extern unsigned long xcall_fetch_glob_pmu;
+@@ -1074,23 +1074,56 @@ local_flush_and_out:
+ 	put_cpu();
+ }
+ 
++struct tlb_pending_info {
++	unsigned long ctx;
++	unsigned long nr;
++	unsigned long *vaddrs;
++};
++
++static void tlb_pending_func(void *info)
++{
++	struct tlb_pending_info *t = info;
++
++	__flush_tlb_pending(t->ctx, t->nr, t->vaddrs);
++}
++
+ void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned long *vaddrs)
+ {
+ 	u32 ctx = CTX_HWBITS(mm->context);
++	struct tlb_pending_info info;
+ 	int cpu = get_cpu();
+ 
++	info.ctx = ctx;
++	info.nr = nr;
++	info.vaddrs = vaddrs;
++
+ 	if (mm == current->mm && atomic_read(&mm->mm_users) == 1)
+ 		cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
+ 	else
+-		smp_cross_call_masked(&xcall_flush_tlb_pending,
+-				      ctx, nr, (unsigned long) vaddrs,
+-				      mm_cpumask(mm));
++		smp_call_function_many(mm_cpumask(mm), tlb_pending_func,
++				       &info, 1);
+ 
+ 	__flush_tlb_pending(ctx, nr, vaddrs);
+ 
+ 	put_cpu();
+ }
+ 
++void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr)
++{
++	unsigned long context = CTX_HWBITS(mm->context);
++	int cpu = get_cpu();
++
++	if (mm == current->mm && atomic_read(&mm->mm_users) == 1)
++		cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
++	else
++		smp_cross_call_masked(&xcall_flush_tlb_page,
++				      context, vaddr, 0,
++				      mm_cpumask(mm));
++	__flush_tlb_page(context, vaddr);
++
++	put_cpu();
++}
++
+ void smp_flush_tlb_kernel_range(unsigned long start, unsigned long end)
+ {
+ 	start &= PAGE_MASK;
 diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c
 index 2da0bdc..79128d2 100644
 --- a/arch/sparc/kernel/sys_sparc_32.c
@@ -10333,6 +10517,369 @@ index d2b5944..bd813f2 100644
  			return addr;
  	}
  	if (mm->get_unmapped_area == arch_get_unmapped_area)
+diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
+index ba6ae7f..272aa4f 100644
+--- a/arch/sparc/mm/tlb.c
++++ b/arch/sparc/mm/tlb.c
+@@ -24,11 +24,17 @@ static DEFINE_PER_CPU(struct tlb_batch, tlb_batch);
+ void flush_tlb_pending(void)
+ {
+ 	struct tlb_batch *tb = &get_cpu_var(tlb_batch);
++	struct mm_struct *mm = tb->mm;
+ 
+-	if (tb->tlb_nr) {
+-		flush_tsb_user(tb);
++	if (!tb->tlb_nr)
++		goto out;
+ 
+-		if (CTX_VALID(tb->mm->context)) {
++	flush_tsb_user(tb);
++
++	if (CTX_VALID(mm->context)) {
++		if (tb->tlb_nr == 1) {
++			global_flush_tlb_page(mm, tb->vaddrs[0]);
++		} else {
+ #ifdef CONFIG_SMP
+ 			smp_flush_tlb_pending(tb->mm, tb->tlb_nr,
+ 					      &tb->vaddrs[0]);
+@@ -37,12 +43,30 @@ void flush_tlb_pending(void)
+ 					    tb->tlb_nr, &tb->vaddrs[0]);
+ #endif
+ 		}
+-		tb->tlb_nr = 0;
+ 	}
+ 
++	tb->tlb_nr = 0;
++
++out:
+ 	put_cpu_var(tlb_batch);
+ }
+ 
++void arch_enter_lazy_mmu_mode(void)
++{
++	struct tlb_batch *tb = &__get_cpu_var(tlb_batch);
++
++	tb->active = 1;
++}
++
++void arch_leave_lazy_mmu_mode(void)
++{
++	struct tlb_batch *tb = &__get_cpu_var(tlb_batch);
++
++	if (tb->tlb_nr)
++		flush_tlb_pending();
++	tb->active = 0;
++}
++
+ static void tlb_batch_add_one(struct mm_struct *mm, unsigned long vaddr,
+ 			      bool exec)
+ {
+@@ -60,6 +84,12 @@ static void tlb_batch_add_one(struct mm_struct *mm, unsigned long vaddr,
+ 		nr = 0;
+ 	}
+ 
++	if (!tb->active) {
++		global_flush_tlb_page(mm, vaddr);
++		flush_tsb_user_page(mm, vaddr);
++		return;
++	}
++
+ 	if (nr == 0)
+ 		tb->mm = mm;
+ 
+diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
+index 428982b..2cc3bce 100644
+--- a/arch/sparc/mm/tsb.c
++++ b/arch/sparc/mm/tsb.c
+@@ -7,11 +7,10 @@
+ #include <linux/preempt.h>
+ #include <linux/slab.h>
+ #include <asm/page.h>
+-#include <asm/tlbflush.h>
+-#include <asm/tlb.h>
+-#include <asm/mmu_context.h>
+ #include <asm/pgtable.h>
++#include <asm/mmu_context.h>
+ #include <asm/tsb.h>
++#include <asm/tlb.h>
+ #include <asm/oplib.h>
+ 
+ extern struct tsb swapper_tsb[KERNEL_TSB_NENTRIES];
+@@ -46,23 +45,27 @@ void flush_tsb_kernel_range(unsigned long start, unsigned long end)
+ 	}
+ }
+ 
++static void __flush_tsb_one_entry(unsigned long tsb, unsigned long v,
++				  unsigned long hash_shift,
++				  unsigned long nentries)
++{
++	unsigned long tag, ent, hash;
++
++	v &= ~0x1UL;
++	hash = tsb_hash(v, hash_shift, nentries);
++	ent = tsb + (hash * sizeof(struct tsb));
++	tag = (v >> 22UL);
++
++	tsb_flush(ent, tag);
++}
++
+ static void __flush_tsb_one(struct tlb_batch *tb, unsigned long hash_shift,
+ 			    unsigned long tsb, unsigned long nentries)
+ {
+ 	unsigned long i;
+ 
+-	for (i = 0; i < tb->tlb_nr; i++) {
+-		unsigned long v = tb->vaddrs[i];
+-		unsigned long tag, ent, hash;
+-
+-		v &= ~0x1UL;
+-
+-		hash = tsb_hash(v, hash_shift, nentries);
+-		ent = tsb + (hash * sizeof(struct tsb));
+-		tag = (v >> 22UL);
+-
+-		tsb_flush(ent, tag);
+-	}
++	for (i = 0; i < tb->tlb_nr; i++)
++		__flush_tsb_one_entry(tsb, tb->vaddrs[i], hash_shift, nentries);
+ }
+ 
+ void flush_tsb_user(struct tlb_batch *tb)
+@@ -90,6 +93,30 @@ void flush_tsb_user(struct tlb_batch *tb)
+ 	spin_unlock_irqrestore(&mm->context.lock, flags);
+ }
+ 
++void flush_tsb_user_page(struct mm_struct *mm, unsigned long vaddr)
++{
++	unsigned long nentries, base, flags;
++
++	spin_lock_irqsave(&mm->context.lock, flags);
++
++	base = (unsigned long) mm->context.tsb_block[MM_TSB_BASE].tsb;
++	nentries = mm->context.tsb_block[MM_TSB_BASE].tsb_nentries;
++	if (tlb_type == cheetah_plus || tlb_type == hypervisor)
++		base = __pa(base);
++	__flush_tsb_one_entry(base, vaddr, PAGE_SHIFT, nentries);
++
++#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)
++	if (mm->context.tsb_block[MM_TSB_HUGE].tsb) {
++		base = (unsigned long) mm->context.tsb_block[MM_TSB_HUGE].tsb;
++		nentries = mm->context.tsb_block[MM_TSB_HUGE].tsb_nentries;
++		if (tlb_type == cheetah_plus || tlb_type == hypervisor)
++			base = __pa(base);
++		__flush_tsb_one_entry(base, vaddr, HPAGE_SHIFT, nentries);
++	}
++#endif
++	spin_unlock_irqrestore(&mm->context.lock, flags);
++}
++
+ #define HV_PGSZ_IDX_BASE	HV_PGSZ_IDX_8K
+ #define HV_PGSZ_MASK_BASE	HV_PGSZ_MASK_8K
+ 
+diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
+index f8e13d4..432aa0c 100644
+--- a/arch/sparc/mm/ultra.S
++++ b/arch/sparc/mm/ultra.S
+@@ -53,6 +53,33 @@ __flush_tlb_mm:		/* 18 insns */
+ 	nop
+ 
+ 	.align		32
++	.globl		__flush_tlb_page
++__flush_tlb_page:	/* 22 insns */
++	/* %o0 = context, %o1 = vaddr */
++	rdpr		%pstate, %g7
++	andn		%g7, PSTATE_IE, %g2
++	wrpr		%g2, %pstate
++	mov		SECONDARY_CONTEXT, %o4
++	ldxa		[%o4] ASI_DMMU, %g2
++	stxa		%o0, [%o4] ASI_DMMU
++	andcc		%o1, 1, %g0
++	andn		%o1, 1, %o3
++	be,pn		%icc, 1f
++	 or		%o3, 0x10, %o3
++	stxa		%g0, [%o3] ASI_IMMU_DEMAP
++1:	stxa		%g0, [%o3] ASI_DMMU_DEMAP
++	membar		#Sync
++	stxa		%g2, [%o4] ASI_DMMU
++	sethi		%hi(KERNBASE), %o4
++	flush		%o4
++	retl
++	 wrpr		%g7, 0x0, %pstate
++	nop
++	nop
++	nop
++	nop
++
++	.align		32
+ 	.globl		__flush_tlb_pending
+ __flush_tlb_pending:	/* 26 insns */
+ 	/* %o0 = context, %o1 = nr, %o2 = vaddrs[] */
+@@ -203,6 +230,31 @@ __cheetah_flush_tlb_mm: /* 19 insns */
+ 	retl
+ 	 wrpr		%g7, 0x0, %pstate
+ 
++__cheetah_flush_tlb_page:	/* 22 insns */
++	/* %o0 = context, %o1 = vaddr */
++	rdpr		%pstate, %g7
++	andn		%g7, PSTATE_IE, %g2
++	wrpr		%g2, 0x0, %pstate
++	wrpr		%g0, 1, %tl
++	mov		PRIMARY_CONTEXT, %o4
++	ldxa		[%o4] ASI_DMMU, %g2
++	srlx		%g2, CTX_PGSZ1_NUC_SHIFT, %o3
++	sllx		%o3, CTX_PGSZ1_NUC_SHIFT, %o3
++	or		%o0, %o3, %o0	/* Preserve nucleus page size fields */
++	stxa		%o0, [%o4] ASI_DMMU
++	andcc		%o1, 1, %g0
++	be,pn		%icc, 1f
++	 andn		%o1, 1, %o3
++	stxa		%g0, [%o3] ASI_IMMU_DEMAP
++1:	stxa		%g0, [%o3] ASI_DMMU_DEMAP	
++	membar		#Sync
++	stxa		%g2, [%o4] ASI_DMMU
++	sethi		%hi(KERNBASE), %o4
++	flush		%o4
++	wrpr		%g0, 0, %tl
++	retl
++	 wrpr		%g7, 0x0, %pstate
++
+ __cheetah_flush_tlb_pending:	/* 27 insns */
+ 	/* %o0 = context, %o1 = nr, %o2 = vaddrs[] */
+ 	rdpr		%pstate, %g7
+@@ -269,6 +321,20 @@ __hypervisor_flush_tlb_mm: /* 10 insns */
+ 	retl
+ 	 nop
+ 
++__hypervisor_flush_tlb_page: /* 11 insns */
++	/* %o0 = context, %o1 = vaddr */
++	mov		%o0, %g2
++	mov		%o1, %o0              /* ARG0: vaddr + IMMU-bit */
++	mov		%g2, %o1	      /* ARG1: mmu context */
++	mov		HV_MMU_ALL, %o2	      /* ARG2: flags */
++	srlx		%o0, PAGE_SHIFT, %o0
++	sllx		%o0, PAGE_SHIFT, %o0
++	ta		HV_MMU_UNMAP_ADDR_TRAP
++	brnz,pn		%o0, __hypervisor_tlb_tl0_error
++	 mov		HV_MMU_UNMAP_ADDR_TRAP, %o1
++	retl
++	 nop
++
+ __hypervisor_flush_tlb_pending: /* 16 insns */
+ 	/* %o0 = context, %o1 = nr, %o2 = vaddrs[] */
+ 	sllx		%o1, 3, %g1
+@@ -339,6 +405,13 @@ cheetah_patch_cachetlbops:
+ 	call		tlb_patch_one
+ 	 mov		19, %o2
+ 
++	sethi		%hi(__flush_tlb_page), %o0
++	or		%o0, %lo(__flush_tlb_page), %o0
++	sethi		%hi(__cheetah_flush_tlb_page), %o1
++	or		%o1, %lo(__cheetah_flush_tlb_page), %o1
++	call		tlb_patch_one
++	 mov		22, %o2
++
+ 	sethi		%hi(__flush_tlb_pending), %o0
+ 	or		%o0, %lo(__flush_tlb_pending), %o0
+ 	sethi		%hi(__cheetah_flush_tlb_pending), %o1
+@@ -397,10 +470,9 @@ xcall_flush_tlb_mm:	/* 21 insns */
+ 	nop
+ 	nop
+ 
+-	.globl		xcall_flush_tlb_pending
+-xcall_flush_tlb_pending:	/* 21 insns */
+-	/* %g5=context, %g1=nr, %g7=vaddrs[] */
+-	sllx		%g1, 3, %g1
++	.globl		xcall_flush_tlb_page
++xcall_flush_tlb_page:	/* 17 insns */
++	/* %g5=context, %g1=vaddr */
+ 	mov		PRIMARY_CONTEXT, %g4
+ 	ldxa		[%g4] ASI_DMMU, %g2
+ 	srlx		%g2, CTX_PGSZ1_NUC_SHIFT, %g4
+@@ -408,20 +480,16 @@ xcall_flush_tlb_pending:	/* 21 insns */
+ 	or		%g5, %g4, %g5
+ 	mov		PRIMARY_CONTEXT, %g4
+ 	stxa		%g5, [%g4] ASI_DMMU
+-1:	sub		%g1, (1 << 3), %g1
+-	ldx		[%g7 + %g1], %g5
+-	andcc		%g5, 0x1, %g0
++	andcc		%g1, 0x1, %g0
+ 	be,pn		%icc, 2f
+-
+-	 andn		%g5, 0x1, %g5
++	 andn		%g1, 0x1, %g5
+ 	stxa		%g0, [%g5] ASI_IMMU_DEMAP
+ 2:	stxa		%g0, [%g5] ASI_DMMU_DEMAP
+ 	membar		#Sync
+-	brnz,pt		%g1, 1b
+-	 nop
+ 	stxa		%g2, [%g4] ASI_DMMU
+ 	retry
+ 	nop
++	nop
+ 
+ 	.globl		xcall_flush_tlb_kernel_range
+ xcall_flush_tlb_kernel_range:	/* 25 insns */
+@@ -656,15 +724,13 @@ __hypervisor_xcall_flush_tlb_mm: /* 21 insns */
+ 	membar		#Sync
+ 	retry
+ 
+-	.globl		__hypervisor_xcall_flush_tlb_pending
+-__hypervisor_xcall_flush_tlb_pending: /* 21 insns */
+-	/* %g5=ctx, %g1=nr, %g7=vaddrs[], %g2,%g3,%g4,g6=scratch */
+-	sllx		%g1, 3, %g1
++	.globl		__hypervisor_xcall_flush_tlb_page
++__hypervisor_xcall_flush_tlb_page: /* 17 insns */
++	/* %g5=ctx, %g1=vaddr */
+ 	mov		%o0, %g2
+ 	mov		%o1, %g3
+ 	mov		%o2, %g4
+-1:	sub		%g1, (1 << 3), %g1
+-	ldx		[%g7 + %g1], %o0	/* ARG0: virtual address */
++	mov		%g1, %o0	        /* ARG0: virtual address */
+ 	mov		%g5, %o1		/* ARG1: mmu context */
+ 	mov		HV_MMU_ALL, %o2		/* ARG2: flags */
+ 	srlx		%o0, PAGE_SHIFT, %o0
+@@ -673,8 +739,6 @@ __hypervisor_xcall_flush_tlb_pending: /* 21 insns */
+ 	mov		HV_MMU_UNMAP_ADDR_TRAP, %g6
+ 	brnz,a,pn	%o0, __hypervisor_tlb_xcall_error
+ 	 mov		%o0, %g5
+-	brnz,pt		%g1, 1b
+-	 nop
+ 	mov		%g2, %o0
+ 	mov		%g3, %o1
+ 	mov		%g4, %o2
+@@ -757,6 +821,13 @@ hypervisor_patch_cachetlbops:
+ 	call		tlb_patch_one
+ 	 mov		10, %o2
+ 
++	sethi		%hi(__flush_tlb_page), %o0
++	or		%o0, %lo(__flush_tlb_page), %o0
++	sethi		%hi(__hypervisor_flush_tlb_page), %o1
++	or		%o1, %lo(__hypervisor_flush_tlb_page), %o1
++	call		tlb_patch_one
++	 mov		11, %o2
++
+ 	sethi		%hi(__flush_tlb_pending), %o0
+ 	or		%o0, %lo(__flush_tlb_pending), %o0
+ 	sethi		%hi(__hypervisor_flush_tlb_pending), %o1
+@@ -788,12 +859,12 @@ hypervisor_patch_cachetlbops:
+ 	call		tlb_patch_one
+ 	 mov		21, %o2
+ 
+-	sethi		%hi(xcall_flush_tlb_pending), %o0
+-	or		%o0, %lo(xcall_flush_tlb_pending), %o0
+-	sethi		%hi(__hypervisor_xcall_flush_tlb_pending), %o1
+-	or		%o1, %lo(__hypervisor_xcall_flush_tlb_pending), %o1
++	sethi		%hi(xcall_flush_tlb_page), %o0
++	or		%o0, %lo(xcall_flush_tlb_page), %o0
++	sethi		%hi(__hypervisor_xcall_flush_tlb_page), %o1
++	or		%o1, %lo(__hypervisor_xcall_flush_tlb_page), %o1
+ 	call		tlb_patch_one
+-	 mov		21, %o2
++	 mov		17, %o2
+ 
+ 	sethi		%hi(xcall_flush_tlb_kernel_range), %o0
+ 	or		%o0, %lo(xcall_flush_tlb_kernel_range), %o0
 diff --git a/arch/tile/include/asm/atomic_64.h b/arch/tile/include/asm/atomic_64.h
 index f4500c6..889656c 100644
 --- a/arch/tile/include/asm/atomic_64.h
@@ -39892,7 +40439,7 @@ index 4c83003..2a2a5b9 100644
  	break;
      }
 diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
-index 4d6f3c5..6169e60 100644
+index 4d6f3c5..449bc5c 100644
 --- a/drivers/net/ethernet/emulex/benet/be_main.c
 +++ b/drivers/net/ethernet/emulex/benet/be_main.c
 @@ -455,7 +455,7 @@ static void accumulate_16bit_val(u32 *acc, u16 val)
@@ -39904,6 +40451,18 @@ index 4d6f3c5..6169e60 100644
  }
  
  void be_parse_stats(struct be_adapter *adapter)
+@@ -759,8 +759,9 @@ static struct sk_buff *be_insert_vlan_in_pkt(struct be_adapter *adapter,
+ 
+ 	if (vlan_tx_tag_present(skb)) {
+ 		vlan_tag = be_get_tx_vlan_tag(adapter, skb);
+-		__vlan_put_tag(skb, vlan_tag);
+-		skb->vlan_tci = 0;
++		skb = __vlan_put_tag(skb, vlan_tag);
++		if (skb)
++			skb->vlan_tci = 0;
+ 	}
+ 
+ 	return skb;
 diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
 index 74d749e..eefb1bd 100644
 --- a/drivers/net/ethernet/faraday/ftgmac100.c
@@ -40321,9 +40880,18 @@ index 8efe47a..a8075c5 100644
  };
  
 diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index cb95fe5..a5bdab5 100644
+index cb95fe5..16909e2 100644
 --- a/drivers/net/tun.c
 +++ b/drivers/net/tun.c
+@@ -1594,7 +1594,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
+ 
+ 		if (tun->flags & TUN_TAP_MQ &&
+ 		    (tun->numqueues + tun->numdisabled > 1))
+-			return err;
++			return -EBUSY;
+ 	}
+ 	else {
+ 		char *name;
 @@ -1838,7 +1838,7 @@ unlock:
  }
  
@@ -40343,6 +40911,19 @@ index cb95fe5..a5bdab5 100644
  	if (cmd == TUNSETIFF || cmd == TUNSETQUEUE || _IOC_TYPE(cmd) == 0x89) {
  		if (copy_from_user(&ifr, argp, ifreq_len))
  			return -EFAULT;
+diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
+index 16c8429..6bd9167 100644
+--- a/drivers/net/usb/cdc_mbim.c
++++ b/drivers/net/usb/cdc_mbim.c
+@@ -134,7 +134,7 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb
+ 		goto error;
+ 
+ 	if (skb) {
+-		if (skb->len <= sizeof(ETH_HLEN))
++		if (skb->len <= ETH_HLEN)
+ 			goto error;
+ 
+ 		/* mapping VLANs to MBIM sessions:
 diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
 index cd8ccb2..cff5144 100644
 --- a/drivers/net/usb/hso.c
@@ -50762,10 +51343,10 @@ index b2a34a1..162fa69 100644
  	return rc;
  }
 diff --git a/fs/exec.c b/fs/exec.c
-index 20df02c..c9a5bc9 100644
+index 20df02c..9a87617 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
-@@ -55,6 +55,17 @@
+@@ -55,8 +55,20 @@
  #include <linux/pipe_fs_i.h>
  #include <linux/oom.h>
  #include <linux/compat.h>
@@ -50782,8 +51363,11 @@ index 20df02c..c9a5bc9 100644
 +#include <trace/events/fs.h>
  
  #include <asm/uaccess.h>
++#include <asm/sections.h>
  #include <asm/mmu_context.h>
-@@ -66,6 +77,18 @@
+ #include <asm/tlb.h>
+ 
+@@ -66,6 +78,18 @@
  
  #include <trace/events/sched.h>
  
@@ -50802,7 +51386,7 @@ index 20df02c..c9a5bc9 100644
  int suid_dumpable = 0;
  
  static LIST_HEAD(formats);
-@@ -75,8 +98,8 @@ void __register_binfmt(struct linux_binfmt * fmt, int insert)
+@@ -75,8 +99,8 @@ void __register_binfmt(struct linux_binfmt * fmt, int insert)
  {
  	BUG_ON(!fmt);
  	write_lock(&binfmt_lock);
@@ -50813,7 +51397,7 @@ index 20df02c..c9a5bc9 100644
  	write_unlock(&binfmt_lock);
  }
  
-@@ -85,7 +108,7 @@ EXPORT_SYMBOL(__register_binfmt);
+@@ -85,7 +109,7 @@ EXPORT_SYMBOL(__register_binfmt);
  void unregister_binfmt(struct linux_binfmt * fmt)
  {
  	write_lock(&binfmt_lock);
@@ -50822,7 +51406,7 @@ index 20df02c..c9a5bc9 100644
  	write_unlock(&binfmt_lock);
  }
  
-@@ -180,18 +203,10 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+@@ -180,18 +204,10 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
  		int write)
  {
  	struct page *page;
@@ -50844,7 +51428,7 @@ index 20df02c..c9a5bc9 100644
  		return NULL;
  
  	if (write) {
-@@ -207,6 +222,17 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+@@ -207,6 +223,17 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
  		if (size <= ARG_MAX)
  			return page;
  
@@ -50862,7 +51446,7 @@ index 20df02c..c9a5bc9 100644
  		/*
  		 * Limit to 1/4-th the stack size for the argv+env strings.
  		 * This ensures that:
-@@ -266,6 +292,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
+@@ -266,6 +293,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
  	vma->vm_end = STACK_TOP_MAX;
  	vma->vm_start = vma->vm_end - PAGE_SIZE;
  	vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
@@ -50874,7 +51458,7 @@ index 20df02c..c9a5bc9 100644
  	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
  	INIT_LIST_HEAD(&vma->anon_vma_chain);
  
-@@ -276,6 +307,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
+@@ -276,6 +308,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
  	mm->stack_vm = mm->total_vm = 1;
  	up_write(&mm->mmap_sem);
  	bprm->p = vma->vm_end - sizeof(void *);
@@ -50887,7 +51471,7 @@ index 20df02c..c9a5bc9 100644
  	return 0;
  err:
  	up_write(&mm->mmap_sem);
-@@ -396,7 +433,7 @@ struct user_arg_ptr {
+@@ -396,7 +434,7 @@ struct user_arg_ptr {
  	} ptr;
  };
  
@@ -50896,7 +51480,7 @@ index 20df02c..c9a5bc9 100644
  {
  	const char __user *native;
  
-@@ -405,14 +442,14 @@ static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
+@@ -405,14 +443,14 @@ static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
  		compat_uptr_t compat;
  
  		if (get_user(compat, argv.ptr.compat + nr))
@@ -50913,7 +51497,7 @@ index 20df02c..c9a5bc9 100644
  
  	return native;
  }
-@@ -431,7 +468,7 @@ static int count(struct user_arg_ptr argv, int max)
+@@ -431,7 +469,7 @@ static int count(struct user_arg_ptr argv, int max)
  			if (!p)
  				break;
  
@@ -50922,7 +51506,7 @@ index 20df02c..c9a5bc9 100644
  				return -EFAULT;
  
  			if (i >= max)
-@@ -466,7 +503,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
+@@ -466,7 +504,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
  
  		ret = -EFAULT;
  		str = get_user_arg_ptr(argv, argc);
@@ -50931,7 +51515,7 @@ index 20df02c..c9a5bc9 100644
  			goto out;
  
  		len = strnlen_user(str, MAX_ARG_STRLEN);
-@@ -548,7 +585,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
+@@ -548,7 +586,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
  	int r;
  	mm_segment_t oldfs = get_fs();
  	struct user_arg_ptr argv = {
@@ -50940,7 +51524,7 @@ index 20df02c..c9a5bc9 100644
  	};
  
  	set_fs(KERNEL_DS);
-@@ -583,7 +620,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+@@ -583,7 +621,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
  	unsigned long new_end = old_end - shift;
  	struct mmu_gather tlb;
  
@@ -50950,7 +51534,7 @@ index 20df02c..c9a5bc9 100644
  
  	/*
  	 * ensure there are no vmas between where we want to go
-@@ -592,6 +630,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+@@ -592,6 +631,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
  	if (vma != find_vma(mm, new_start))
  		return -EFAULT;
  
@@ -50961,7 +51545,7 @@ index 20df02c..c9a5bc9 100644
  	/*
  	 * cover the whole range: [new_start, old_end)
  	 */
-@@ -672,10 +714,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -672,10 +715,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
  	stack_top = arch_align_stack(stack_top);
  	stack_top = PAGE_ALIGN(stack_top);
  
@@ -50972,7 +51556,7 @@ index 20df02c..c9a5bc9 100644
  	stack_shift = vma->vm_end - stack_top;
  
  	bprm->p -= stack_shift;
-@@ -687,8 +725,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -687,8 +726,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
  	bprm->exec -= stack_shift;
  
  	down_write(&mm->mmap_sem);
@@ -51001,7 +51585,7 @@ index 20df02c..c9a5bc9 100644
  	/*
  	 * Adjust stack execute permissions; explicitly enable for
  	 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
-@@ -707,13 +765,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -707,13 +766,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
  		goto out_unlock;
  	BUG_ON(prev != vma);
  
@@ -51015,7 +51599,7 @@ index 20df02c..c9a5bc9 100644
  	/* mprotect_fixup is overkill to remove the temporary stack flags */
  	vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
  
-@@ -737,6 +788,27 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -737,6 +789,27 @@ int setup_arg_pages(struct linux_binprm *bprm,
  #endif
  	current->mm->start_stack = bprm->p;
  	ret = expand_stack(vma, stack_base);
@@ -51043,7 +51627,7 @@ index 20df02c..c9a5bc9 100644
  	if (ret)
  		ret = -EFAULT;
  
-@@ -772,6 +844,8 @@ struct file *open_exec(const char *name)
+@@ -772,6 +845,8 @@ struct file *open_exec(const char *name)
  
  	fsnotify_open(file);
  
@@ -51052,7 +51636,7 @@ index 20df02c..c9a5bc9 100644
  	err = deny_write_access(file);
  	if (err)
  		goto exit;
-@@ -795,7 +869,7 @@ int kernel_read(struct file *file, loff_t offset,
+@@ -795,7 +870,7 @@ int kernel_read(struct file *file, loff_t offset,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -51061,7 +51645,7 @@ index 20df02c..c9a5bc9 100644
  	set_fs(old_fs);
  	return result;
  }
-@@ -1247,7 +1321,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
+@@ -1247,7 +1322,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
  	}
  	rcu_read_unlock();
  
@@ -51070,7 +51654,7 @@ index 20df02c..c9a5bc9 100644
  		bprm->unsafe |= LSM_UNSAFE_SHARE;
  	} else {
  		res = -EAGAIN;
-@@ -1447,6 +1521,31 @@ int search_binary_handler(struct linux_binprm *bprm)
+@@ -1447,6 +1522,31 @@ int search_binary_handler(struct linux_binprm *bprm)
  
  EXPORT_SYMBOL(search_binary_handler);
  
@@ -51102,7 +51686,7 @@ index 20df02c..c9a5bc9 100644
  /*
   * sys_execve() executes a new program.
   */
-@@ -1454,6 +1553,11 @@ static int do_execve_common(const char *filename,
+@@ -1454,6 +1554,11 @@ static int do_execve_common(const char *filename,
  				struct user_arg_ptr argv,
  				struct user_arg_ptr envp)
  {
@@ -51114,7 +51698,7 @@ index 20df02c..c9a5bc9 100644
  	struct linux_binprm *bprm;
  	struct file *file;
  	struct files_struct *displaced;
-@@ -1461,6 +1565,8 @@ static int do_execve_common(const char *filename,
+@@ -1461,6 +1566,8 @@ static int do_execve_common(const char *filename,
  	int retval;
  	const struct cred *cred = current_cred();
  
@@ -51123,7 +51707,7 @@ index 20df02c..c9a5bc9 100644
  	/*
  	 * We move the actual failure in case of RLIMIT_NPROC excess from
  	 * set*uid() to execve() because too many poorly written programs
-@@ -1501,12 +1607,27 @@ static int do_execve_common(const char *filename,
+@@ -1501,12 +1608,27 @@ static int do_execve_common(const char *filename,
  	if (IS_ERR(file))
  		goto out_unmark;
  
@@ -51151,7 +51735,7 @@ index 20df02c..c9a5bc9 100644
  	retval = bprm_mm_init(bprm);
  	if (retval)
  		goto out_file;
-@@ -1523,24 +1644,65 @@ static int do_execve_common(const char *filename,
+@@ -1523,24 +1645,65 @@ static int do_execve_common(const char *filename,
  	if (retval < 0)
  		goto out;
  
@@ -51221,7 +51805,7 @@ index 20df02c..c9a5bc9 100644
  	current->fs->in_exec = 0;
  	current->in_execve = 0;
  	acct_update_integrals(current);
-@@ -1549,6 +1711,14 @@ static int do_execve_common(const char *filename,
+@@ -1549,6 +1712,14 @@ static int do_execve_common(const char *filename,
  		put_files_struct(displaced);
  	return retval;
  
@@ -51236,7 +51820,7 @@ index 20df02c..c9a5bc9 100644
  out:
  	if (bprm->mm) {
  		acct_arg_size(bprm, 0);
-@@ -1697,3 +1867,278 @@ asmlinkage long compat_sys_execve(const char __user * filename,
+@@ -1697,3 +1868,278 @@ asmlinkage long compat_sys_execve(const char __user * filename,
  	return error;
  }
  #endif
@@ -53424,6 +54008,19 @@ index 2b6f569..fcb4d1f 100644
  	if (!IS_ERR(s))
  		kfree(s);
  }
+diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
+index eba76eab..fc8ddc1 100644
+--- a/fs/hfsplus/extents.c
++++ b/fs/hfsplus/extents.c
+@@ -533,7 +533,7 @@ void hfsplus_file_truncate(struct inode *inode)
+ 		struct address_space *mapping = inode->i_mapping;
+ 		struct page *page;
+ 		void *fsdata;
+-		u32 size = inode->i_size;
++		loff_t size = inode->i_size;
+ 
+ 		res = pagecache_write_begin(NULL, mapping, size, 0,
+ 						AOP_FLAG_UNINTERRUPTIBLE,
 diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
 index 78bde32..767e906 100644
 --- a/fs/hugetlbfs/inode.c
@@ -73019,6 +73616,21 @@ index 5a15fab..d799ea7 100644
  
  extern int	__rtnl_link_register(struct rtnl_link_ops *ops);
  extern void	__rtnl_link_unregister(struct rtnl_link_ops *ops);
+diff --git a/include/net/scm.h b/include/net/scm.h
+index 975cca0..b117081 100644
+--- a/include/net/scm.h
++++ b/include/net/scm.h
+@@ -56,8 +56,8 @@ static __inline__ void scm_set_cred(struct scm_cookie *scm,
+ 	scm->pid  = get_pid(pid);
+ 	scm->cred = cred ? get_cred(cred) : NULL;
+ 	scm->creds.pid = pid_vnr(pid);
+-	scm->creds.uid = cred ? cred->euid : INVALID_UID;
+-	scm->creds.gid = cred ? cred->egid : INVALID_GID;
++	scm->creds.uid = cred ? cred->uid : INVALID_UID;
++	scm->creds.gid = cred ? cred->gid : INVALID_GID;
+ }
+ 
+ static __inline__ void scm_destroy_cred(struct scm_cookie *scm)
 diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
 index 7fdf298..197e9f7 100644
 --- a/include/net/sctp/sctp.h
@@ -78437,7 +79049,7 @@ index 81fa536..6ccf96a 100644
  	int this_cpu = smp_processor_id();
  	struct rq *this_rq = cpu_rq(this_cpu);
 diff --git a/kernel/signal.c b/kernel/signal.c
-index dec9c30..d1da15b 100644
+index dec9c30..92c8f65 100644
 --- a/kernel/signal.c
 +++ b/kernel/signal.c
 @@ -50,12 +50,12 @@ static struct kmem_cache *sigqueue_cachep;
@@ -78563,6 +79175,15 @@ index dec9c30..d1da15b 100644
  	if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
  		error = check_kill_permission(sig, info, p);
  		/*
+@@ -2880,7 +2911,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
+ 
+ static int do_tkill(pid_t tgid, pid_t pid, int sig)
+ {
+-	struct siginfo info;
++	struct siginfo info = {};
+ 
+ 	info.si_signo = sig;
+ 	info.si_errno = 0;
 @@ -3138,8 +3169,8 @@ COMPAT_SYSCALL_DEFINE2(sigaltstack,
  	}
  	seg = get_fs();
@@ -86701,9 +87322,30 @@ index a8e4f26..25e5f40 100644
  #endif
  	if (dflt != &ipv4_devconf_dflt)
 diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
-index 3b4f0cd..8cb864c 100644
+index 3b4f0cd..a6ba66e 100644
 --- a/net/ipv4/esp4.c
 +++ b/net/ipv4/esp4.c
+@@ -139,8 +139,6 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
+ 
+ 	/* skb is pure payload to encrypt */
+ 
+-	err = -ENOMEM;
+-
+ 	esp = x->data;
+ 	aead = esp->aead;
+ 	alen = crypto_aead_authsize(aead);
+@@ -176,8 +174,10 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	}
+ 
+ 	tmp = esp_alloc_tmp(aead, nfrags + sglists, seqhilen);
+-	if (!tmp)
++	if (!tmp) {
++		err = -ENOMEM;
+ 		goto error;
++	}
+ 
+ 	seqhi = esp_tmp_seqhi(tmp);
+ 	iv = esp_tmp_iv(aead, tmp, seqhilen);
 @@ -503,7 +503,7 @@ static void esp4_err(struct sk_buff *skb, u32 info)
  		return;
  
@@ -87226,6 +87868,21 @@ index a0fcc47..32e2c89 100644
  	get_random_bytes(&net->ipv4.dev_addr_genid,
  			 sizeof(net->ipv4.dev_addr_genid));
  	return 0;
+diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
+index b236ef04..f962f19 100644
+--- a/net/ipv4/syncookies.c
++++ b/net/ipv4/syncookies.c
+@@ -348,8 +348,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
+ 	 * hasn't changed since we received the original syn, but I see
+ 	 * no easy way to do this.
+ 	 */
+-	flowi4_init_output(&fl4, 0, sk->sk_mark, RT_CONN_FLAGS(sk),
+-			   RT_SCOPE_UNIVERSE, IPPROTO_TCP,
++	flowi4_init_output(&fl4, sk->sk_bound_dev_if, sk->sk_mark,
++			   RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, IPPROTO_TCP,
+ 			   inet_sk_flowi_flags(sk),
+ 			   (opt && opt->srr) ? opt->faddr : ireq->rmt_addr,
+ 			   ireq->loc_addr, th->source, th->dest);
 diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
 index d84400b..62e066e 100644
 --- a/net/ipv4/sysctl_net_ipv4.c
@@ -87490,6 +88147,25 @@ index f35f2df..ccb5ca6 100644
  	} else if (fastopen) { /* received a valid RST pkt */
  		reqsk_fastopen_remove(sk, req, true);
  		tcp_reset(sk);
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 17d659e..a9f50ee 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2388,8 +2388,12 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
+ 	 */
+ 	TCP_SKB_CB(skb)->when = tcp_time_stamp;
+ 
+-	/* make sure skb->data is aligned on arches that require it */
+-	if (unlikely(NET_IP_ALIGN && ((unsigned long)skb->data & 3))) {
++	/* make sure skb->data is aligned on arches that require it
++	 * and check if ack-trimming & collapsing extended the headroom
++	 * beyond what csum_start can cover.
++	 */
++	if (unlikely((NET_IP_ALIGN && ((unsigned long)skb->data & 3)) ||
++		     skb_headroom(skb) >= 0xFFFF)) {
+ 		struct sk_buff *nskb = __pskb_copy(skb, MAX_TCP_HEADER,
+ 						   GFP_ATOMIC);
+ 		return nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
 diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
 index 4526fe6..1a34e43 100644
 --- a/net/ipv4/tcp_probe.c