main/linux-grsec: upgrade to grsecurity-3.0-3.14.27-201501011217

(cherry picked from commit 895538e88106051055b34fb9fdf6b304581d7a68)

2 files changed, 809 insertions, 30 deletions

diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 0f4e25fbfa..e82bdd4484 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -7,7 +7,7 @@ case $pkgver in
 *.*.*)	_kernver=${pkgver%.*};;
 *.*)	_kernver=${pkgver};;
 esac
-pkgrel=0
+pkgrel=1
 pkgdesc="Linux kernel with grsecurity"
 url=http://grsecurity.net
 depends="mkinitfs linux-firmware"
@@ -17,7 +17,7 @@ _config=${config:-kernelconfig.${CARCH}}
 install=
 source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz
 	http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz
-	grsecurity-3.0-3.14.27-201412211908.patch
+	grsecurity-3.0-3.14.27-201501011217.patch
 
 	fix-memory-map-for-PIE-applications.patch
 	imx6q-no-unclocked-sleep.patch
@@ -167,7 +167,7 @@ dev() {
 
 md5sums="b621207b3f6ecbb67db18b13258f8ea8  linux-3.14.tar.xz
 d79fd9ea62b9c9dd3c17ed7651a9e408  patch-3.14.27.xz
-0ccf786b0da3ba2968c17bcb0e08bdf9  grsecurity-3.0-3.14.27-201412211908.patch
+760c7d4f8a06507eddae37e3061c13f2  grsecurity-3.0-3.14.27-201501011217.patch
 c6a4ae7e8ca6159e1631545515805216  fix-memory-map-for-PIE-applications.patch
 1a307fc1d63231bf01d22493a4f14378  imx6q-no-unclocked-sleep.patch
 59a78a67677e25540028414bb5eb6330  gre-fix-the-inner-mac-header-in-nbma-gre-tunnels-xmit-path.patch
@@ -176,7 +176,7 @@ c6a4ae7e8ca6159e1631545515805216  fix-memory-map-for-PIE-applications.patch
 6709c83fbbd38d40f31d39f0022d4ce9  kernelconfig.armhf"
 sha256sums="61558aa490855f42b6340d1a1596be47454909629327c49a5e4e10268065dffa  linux-3.14.tar.xz
 5f84a4ff394444486d1715d5283383a8461ff089ed9b9fdc5dde2ed65531d21e  patch-3.14.27.xz
-6a54cf72bf2d0231f6c1e13eda0585919178e66312270522d91a9c34c32643f7  grsecurity-3.0-3.14.27-201412211908.patch
+9136a07098a7bc9fe9da7a4ce1137097e095f8068072ac2b158a40b1d4f13b0e  grsecurity-3.0-3.14.27-201501011217.patch
 500f3577310be52e87b9fecdc2e9c4ca43210fd97d69089f9005d484563f74c7  fix-memory-map-for-PIE-applications.patch
 21179fbb22a5b74af0a609350ae1a170e232908572b201d02e791d2ce0a685d3  imx6q-no-unclocked-sleep.patch
 f04d0f6610398f3657ddb2e6926113c43ec331ae256704bca4de11f432881ec5  gre-fix-the-inner-mac-header-in-nbma-gre-tunnels-xmit-path.patch
@@ -185,7 +185,7 @@ d555a01f2b464e20cfa71c67ea6d571f80c707c5a3fea33879de09b085e2d7b6  kernelconfig.x
 01a6c90cf0643f8727d120aede2267ca7303c4ebe548c5d19222d4387ceb98cc  kernelconfig.armhf"
 sha512sums="5730d83a7a81134c1e77c0bf89e42dee4f8251ad56c1ac2be20c59e26fdfaa7bea55f277e7af156b637f22e1584914a46089af85039177cb43485089c74ac26e  linux-3.14.tar.xz
 1191ef739905b2e5057c5273e5cf026baea1ea4855dca8375dbe4ecaa7e6d2d38b8103e2781554f2d9ecf9026fdad1086c6b9d8f0b41fcb8e39aca0612e208e7  patch-3.14.27.xz
-c136f386b848daefce89e758cd0cb737406e858cbc1b11b241a669a48e44b4ffd6ef0fc731538becdcdf38d4f887ecf4c020983e3e41068caa6f3f83646adf9b  grsecurity-3.0-3.14.27-201412211908.patch
+7101a9c507dbd701f6371a1237616f052f6573a99e51afcbec4599e9b57cf8d460412df1e71b8da52f1d4bd9db5457d61852cc1b9736cbdc734df93b7f237f7a  grsecurity-3.0-3.14.27-201501011217.patch
 4665c56ae1bbac311f9205d64918e84ee8b01d47d6e2396ff6b8adfb10aada7f7254531ce62e31edbb65c2a54a830f09ad05d314dfcd75d6272f4068945ad7c7  fix-memory-map-for-PIE-applications.patch
 87d1ad59732f265a5b0db54490dc1762c14ea4b868e7eb1aedc3ce57b48046de7bbc08cf5cfcf6f1380fa84063b0edb16ba3d5e3c5670be9bbb229275c88b221  imx6q-no-unclocked-sleep.patch
 ddc32533bd519db5298895eb2da5eb95390999bd3f6d27b5eee38551387df4a43f537235d6a9be859ee1f433420f3afbf01e2c1e7ca0175b27460598c5c385f9  gre-fix-the-inner-mac-header-in-nbma-gre-tunnels-xmit-path.patch
diff --git a/main/linux-grsec/grsecurity-3.0-3.14.27-201412211908.patch b/main/linux-grsec/grsecurity-3.0-3.14.27-201501011217.patch
index 9c6d79742d..176a326ac8 100644
--- a/main/linux-grsec/grsecurity-3.0-3.14.27-201412211908.patch
+++ b/main/linux-grsec/grsecurity-3.0-3.14.27-201501011217.patch
@@ -23058,7 +23058,7 @@ index c5a9cb9..228d280 100644
  
  /*
 diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
-index 02553d6..54e9bd5 100644
+index 02553d6..d1fcecb 100644
 --- a/arch/x86/kernel/entry_64.S
 +++ b/arch/x86/kernel/entry_64.S
 @@ -60,6 +60,8 @@
@@ -24015,6 +24015,27 @@ index 02553d6..54e9bd5 100644
  	/*
  	 * The iretq could re-enable interrupts:
  	 */
+@@ -1070,15 +1566,15 @@ native_irq_return_ldt:
+ 	SWAPGS
+ 	movq PER_CPU_VAR(espfix_waddr),%rdi
+ 	movq %rax,(0*8)(%rdi)	/* RAX */
+-	movq (2*8)(%rsp),%rax	/* RIP */
++	movq (2*8 + RIP-RIP)(%rsp),%rax	/* RIP */
+ 	movq %rax,(1*8)(%rdi)
+-	movq (3*8)(%rsp),%rax	/* CS */
++	movq (2*8 + CS-RIP)(%rsp),%rax	/* CS */
+ 	movq %rax,(2*8)(%rdi)
+-	movq (4*8)(%rsp),%rax	/* RFLAGS */
++	movq (2*8 + EFLAGS-RIP)(%rsp),%rax	/* RFLAGS */
+ 	movq %rax,(3*8)(%rdi)
+-	movq (6*8)(%rsp),%rax	/* SS */
++	movq (2*8 + SS-RIP)(%rsp),%rax	/* SS */
+ 	movq %rax,(5*8)(%rdi)
+-	movq (5*8)(%rsp),%rax	/* RSP */
++	movq (2*8 + RSP-RIP)(%rsp),%rax	/* RSP */
+ 	movq %rax,(4*8)(%rdi)
+ 	andl $0xffff0000,%eax
+ 	popq_cfi %rdi
 @@ -1132,7 +1628,7 @@ ENTRY(retint_kernel)
  	jmp exit_intr
  #endif
@@ -26400,26 +26421,30 @@ index 1b10af8..45bfbec 100644
  
  EXPORT_SYMBOL_GPL(pv_time_ops);
 diff --git a/arch/x86/kernel/paravirt_patch_64.c b/arch/x86/kernel/paravirt_patch_64.c
-index a1da673..2c72d5b 100644
+index a1da673..b6f5831 100644
 --- a/arch/x86/kernel/paravirt_patch_64.c
 +++ b/arch/x86/kernel/paravirt_patch_64.c
-@@ -9,7 +9,9 @@ DEF_NATIVE(pv_irq_ops, save_fl, "pushfq; popq %rax");
+@@ -9,7 +9,11 @@ DEF_NATIVE(pv_irq_ops, save_fl, "pushfq; popq %rax");
  DEF_NATIVE(pv_mmu_ops, read_cr2, "movq %cr2, %rax");
  DEF_NATIVE(pv_mmu_ops, read_cr3, "movq %cr3, %rax");
  DEF_NATIVE(pv_mmu_ops, write_cr3, "movq %rdi, %cr3");
++
 +#ifndef CONFIG_PAX_MEMORY_UDEREF
  DEF_NATIVE(pv_mmu_ops, flush_tlb_single, "invlpg (%rdi)");
 +#endif
++
  DEF_NATIVE(pv_cpu_ops, clts, "clts");
  DEF_NATIVE(pv_cpu_ops, wbinvd, "wbinvd");
  
-@@ -57,7 +59,9 @@ unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
+@@ -57,7 +61,11 @@ unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
  		PATCH_SITE(pv_mmu_ops, read_cr3);
  		PATCH_SITE(pv_mmu_ops, write_cr3);
  		PATCH_SITE(pv_cpu_ops, clts);
++
 +#ifndef CONFIG_PAX_MEMORY_UDEREF
  		PATCH_SITE(pv_mmu_ops, flush_tlb_single);
 +#endif
++
  		PATCH_SITE(pv_cpu_ops, wbinvd);
  
  	patch_site:
@@ -28733,9 +28758,18 @@ index c697625..a032162 100644
  
  out:
 diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index 38d3751..e6fcffb 100644
+index 38d3751..1702329 100644
 --- a/arch/x86/kvm/emulate.c
 +++ b/arch/x86/kvm/emulate.c
+@@ -3401,7 +3401,7 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
+ 	int cr = ctxt->modrm_reg;
+ 	u64 efer = 0;
+ 
+-	static u64 cr_reserved_bits[] = {
++	static const u64 cr_reserved_bits[] = {
+ 		0xffffffff00000000ULL,
+ 		0, 0, 0, /* CR3 checked later */
+ 		CR4_RESERVED_BITS,
 @@ -3436,7 +3436,7 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
  
  		ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
@@ -53179,7 +53213,7 @@ index 9cd706d..6ff2de7 100644
  
  	if (cfg->uart_flags & UPF_CONS_FLOW) {
 diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
-index 27b5554..8131d9d 100644
+index 27b5554..3075055 100644
 --- a/drivers/tty/serial/serial_core.c
 +++ b/drivers/tty/serial/serial_core.c
 @@ -1451,7 +1451,7 @@ static void uart_hangup(struct tty_struct *tty)
@@ -53214,7 +53248,7 @@ index 27b5554..8131d9d 100644
  	return retval;
  err_dec_count:
 -	port->count--;
-+	atomic_inc(&port->count);
++	atomic_dec(&port->count);
  	mutex_unlock(&port->mutex);
  	goto end;
  }
@@ -63644,7 +63678,7 @@ index e846a32..bb06bd0 100644
  	return res;
  }
 diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
-index f488bba..bb63254 100644
+index f488bba..735d752 100644
 --- a/fs/isofs/rock.c
 +++ b/fs/isofs/rock.c
 @@ -30,6 +30,7 @@ struct rock_state {
@@ -63674,6 +63708,16 @@ index f488bba..bb63254 100644
  		bh = sb_bread(rs->inode->i_sb, rs->cont_extent);
  		if (bh) {
  			memcpy(rs->buffer, bh->b_data + rs->cont_offset,
+@@ -356,6 +362,9 @@ repeat:
+ 			rs.cont_size = isonum_733(rr->u.CE.size);
+ 			break;
+ 		case SIG('E', 'R'):
++			/* Invalid length of ER tag id? */
++			if (rr->u.ER.len_id + offsetof(struct rock_ridge, u.ER.data) > rr->len)
++				goto out;
+ 			ISOFS_SB(inode->i_sb)->s_rock = 1;
+ 			printk(KERN_DEBUG "ISO 9660 Extensions: ");
+ 			{
 diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
 index 4a6cf28..d3a29d3 100644
 --- a/fs/jffs2/erase.c
@@ -63716,7 +63760,7 @@ index e2b7483..855bca3 100644
  	if (jfs_inode_cachep == NULL)
  		return -ENOMEM;
 diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
-index 39c0143..d54fad4 100644
+index 39c0143..829bfe5 100644
 --- a/fs/kernfs/dir.c
 +++ b/fs/kernfs/dir.c
 @@ -28,7 +28,7 @@ DEFINE_MUTEX(kernfs_mutex);
@@ -63728,6 +63772,25 @@ index 39c0143..d54fad4 100644
  {
  	unsigned long hash = init_name_hash();
  	unsigned int len = strlen(name);
+@@ -729,11 +729,17 @@ static int kernfs_iop_mkdir(struct inode *dir, struct dentry *dentry,
+ {
+ 	struct kernfs_node *parent = dir->i_private;
+ 	struct kernfs_dir_ops *kdops = kernfs_root(parent)->dir_ops;
++	int ret;
+ 
+ 	if (!kdops || !kdops->mkdir)
+ 		return -EPERM;
+ 
+-	return kdops->mkdir(parent, dentry->d_name.name, mode);
++	ret = kdops->mkdir(parent, dentry->d_name.name, mode);
++
++	if (!ret)
++		ret = kernfs_iop_lookup(dir, dentry, 0);
++
++	return ret;
+ }
+ 
+ static int kernfs_iop_rmdir(struct inode *dir, struct dentry *dentry)
 diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
 index d29640b..32d2b6b 100644
 --- a/fs/kernfs/file.c
@@ -67904,8 +67967,22 @@ index e18b988..f1d4ad0f 100644
  {
  	int err;
  
+diff --git a/fs/udf/dir.c b/fs/udf/dir.c
+index a012c51..a7690b4 100644
+--- a/fs/udf/dir.c
++++ b/fs/udf/dir.c
+@@ -167,7 +167,8 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
+ 			continue;
+ 		}
+ 
+-		flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
++		flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
++					UDF_NAME_LEN);
+ 		if (!flen)
+ 			continue;
+ 
 diff --git a/fs/udf/inode.c b/fs/udf/inode.c
-index 287cd5f..c693331 100644
+index 287cd5f..5252259 100644
 --- a/fs/udf/inode.c
 +++ b/fs/udf/inode.c
 @@ -51,7 +51,6 @@ MODULE_LICENSE("GPL");
@@ -67916,7 +67993,12 @@ index 287cd5f..c693331 100644
  static int udf_sync_inode(struct inode *inode);
  static int udf_alloc_i_data(struct inode *inode, size_t size);
  static sector_t inode_getblk(struct inode *, sector_t, int *, int *);
-@@ -1282,8 +1281,11 @@ static void __udf_read_inode(struct inode *inode)
+@@ -1278,15 +1277,27 @@ update_time:
+  */
+ #define UDF_MAX_ICB_NESTING 1024
+ 
+-static void __udf_read_inode(struct inode *inode)
++static int udf_read_inode(struct inode *inode)
  {
  	struct buffer_head *bh = NULL;
  	struct fileEntry *fe;
@@ -67924,11 +68006,43 @@ index 287cd5f..c693331 100644
  	uint16_t ident;
  	struct udf_inode_info *iinfo = UDF_I(inode);
 +	struct udf_sb_info *sbi = UDF_SB(inode->i_sb);
++	struct kernel_lb_addr *iloc = &iinfo->i_location;
 +	unsigned int link_count;
  	unsigned int indirections = 0;
++	int ret = -EIO;
  
  reread:
-@@ -1316,6 +1318,7 @@ reread:
++	if (iloc->logicalBlockNum >=
++	    sbi->s_partmaps[iloc->partitionReferenceNum].s_partition_len) {
++		udf_debug("block=%d, partition=%d out of range\n",
++			  iloc->logicalBlockNum, iloc->partitionReferenceNum);
++		return -EIO;
++	}
++
+ 	/*
+ 	 * Set defaults, but the inode is still incomplete!
+ 	 * Note: get_new_inode() sets the following on a new inode:
+@@ -1299,29 +1310,26 @@ reread:
+ 	 *      i_nlink = 1
+ 	 *      i_op = NULL;
+ 	 */
+-	bh = udf_read_ptagged(inode->i_sb, &iinfo->i_location, 0, &ident);
++	bh = udf_read_ptagged(inode->i_sb, iloc, 0, &ident);
+ 	if (!bh) {
+ 		udf_err(inode->i_sb, "(ino %ld) failed !bh\n", inode->i_ino);
+-		make_bad_inode(inode);
+-		return;
++		return -EIO;
+ 	}
+ 
+ 	if (ident != TAG_IDENT_FE && ident != TAG_IDENT_EFE &&
+ 	    ident != TAG_IDENT_USE) {
+ 		udf_err(inode->i_sb, "(ino %ld) failed ident=%d\n",
+ 			inode->i_ino, ident);
+-		brelse(bh);
+-		make_bad_inode(inode);
+-		return;
++		goto out;
  	}
  
  	fe = (struct fileEntry *)bh->b_data;
@@ -67936,9 +68050,41 @@ index 287cd5f..c693331 100644
  
  	if (fe->icbTag.strategyType == cpu_to_le16(4096)) {
  		struct buffer_head *ibh;
-@@ -1353,22 +1356,6 @@ reread:
- 		make_bad_inode(inode);
- 		return;
+ 
+-		ibh = udf_read_ptagged(inode->i_sb, &iinfo->i_location, 1,
+-					&ident);
++		ibh = udf_read_ptagged(inode->i_sb, iloc, 1, &ident);
+ 		if (ident == TAG_IDENT_IE && ibh) {
+ 			struct kernel_lb_addr loc;
+ 			struct indirectEntry *ie;
+@@ -1330,7 +1338,6 @@ reread:
+ 			loc = lelb_to_cpu(ie->indirectICB.extLocation);
+ 
+ 			if (ie->indirectICB.extLength) {
+-				brelse(bh);
+ 				brelse(ibh);
+ 				memcpy(&iinfo->i_location, &loc,
+ 				       sizeof(struct kernel_lb_addr));
+@@ -1339,9 +1346,9 @@ reread:
+ 						"too many ICBs in ICB hierarchy"
+ 						" (max %d supported)\n",
+ 						UDF_MAX_ICB_NESTING);
+-					make_bad_inode(inode);
+-					return;
++					goto out;
+ 				}
++				brelse(bh);
+ 				goto reread;
+ 			}
+ 		}
+@@ -1349,26 +1356,8 @@ reread:
+ 	} else if (fe->icbTag.strategyType != cpu_to_le16(4)) {
+ 		udf_err(inode->i_sb, "unsupported strategy type: %d\n",
+ 			le16_to_cpu(fe->icbTag.strategyType));
+-		brelse(bh);
+-		make_bad_inode(inode);
+-		return;
++		goto out;
  	}
 -	udf_fill_inode(inode, bh);
 -
@@ -67959,15 +68105,109 @@ index 287cd5f..c693331 100644
  	if (fe->icbTag.strategyType == cpu_to_le16(4))
  		iinfo->i_strat4096 = 0;
  	else /* if (fe->icbTag.strategyType == cpu_to_le16(4096)) */
-@@ -1558,6 +1545,7 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh)
+@@ -1385,11 +1374,10 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh)
+ 	if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_EFE)) {
+ 		iinfo->i_efe = 1;
+ 		iinfo->i_use = 0;
+-		if (udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
+-					sizeof(struct extendedFileEntry))) {
+-			make_bad_inode(inode);
+-			return;
+-		}
++		ret = udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
++					sizeof(struct extendedFileEntry));
++		if (ret)
++			goto out;
+ 		memcpy(iinfo->i_ext.i_data,
+ 		       bh->b_data + sizeof(struct extendedFileEntry),
+ 		       inode->i_sb->s_blocksize -
+@@ -1397,11 +1385,10 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh)
+ 	} else if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_FE)) {
+ 		iinfo->i_efe = 0;
+ 		iinfo->i_use = 0;
+-		if (udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
+-						sizeof(struct fileEntry))) {
+-			make_bad_inode(inode);
+-			return;
+-		}
++		ret = udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
++						sizeof(struct fileEntry));
++		if (ret)
++			goto out;
+ 		memcpy(iinfo->i_ext.i_data,
+ 		       bh->b_data + sizeof(struct fileEntry),
+ 		       inode->i_sb->s_blocksize - sizeof(struct fileEntry));
+@@ -1411,18 +1398,18 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh)
+ 		iinfo->i_lenAlloc = le32_to_cpu(
+ 				((struct unallocSpaceEntry *)bh->b_data)->
+ 				 lengthAllocDescs);
+-		if (udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
+-					sizeof(struct unallocSpaceEntry))) {
+-			make_bad_inode(inode);
+-			return;
+-		}
++		ret = udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
++					sizeof(struct unallocSpaceEntry));
++		if (ret)
++			goto out;
+ 		memcpy(iinfo->i_ext.i_data,
+ 		       bh->b_data + sizeof(struct unallocSpaceEntry),
+ 		       inode->i_sb->s_blocksize -
+ 					sizeof(struct unallocSpaceEntry));
+-		return;
++		return 0;
+ 	}
+ 
++	ret = -EIO;
+ 	read_lock(&sbi->s_cred_lock);
+ 	i_uid_write(inode, le32_to_cpu(fe->uid));
+ 	if (!uid_valid(inode->i_uid) ||
+@@ -1496,6 +1483,20 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh)
+ 		iinfo->i_checkpoint = le32_to_cpu(efe->checkpoint);
+ 	}
+ 
++	/* Sanity checks for files in ICB so that we don't get confused later */
++	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
++		/*
++		 * For file in ICB data is stored in allocation descriptor
++		 * so sizes should match
++		 */
++		if (iinfo->i_lenAlloc != inode->i_size)
++			goto out;
++		/* File in ICB has to fit in there... */
++		if (inode->i_size > inode->i_sb->s_blocksize -
++					udf_file_entry_alloc_offset(inode))
++			goto out;
++	}
++
+ 	switch (fe->icbTag.fileType) {
+ 	case ICBTAG_FILE_TYPE_DIRECTORY:
+ 		inode->i_op = &udf_dir_inode_operations;
+@@ -1544,8 +1545,7 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh)
+ 	default:
+ 		udf_err(inode->i_sb, "(ino %ld) failed unknown file type=%d\n",
+ 			inode->i_ino, fe->icbTag.fileType);
+-		make_bad_inode(inode);
+-		return;
++		goto out;
+ 	}
+ 	if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode)) {
+ 		struct deviceSpec *dsea =
+@@ -1556,8 +1556,12 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh)
+ 				      le32_to_cpu(dsea->minorDeviceIdent)));
+ 			/* Developer ID ??? */
  		} else
- 			make_bad_inode(inode);
+-			make_bad_inode(inode);
++			goto out;
  	}
++	ret = 0;
++out:
 +	brelse(bh);
++	return ret;
  }
  
  static int udf_alloc_i_data(struct inode *inode, size_t size)
-@@ -1671,7 +1659,7 @@ static int udf_update_inode(struct inode *inode, int do_sync)
+@@ -1671,7 +1675,7 @@ static int udf_update_inode(struct inode *inode, int do_sync)
  		     FE_PERM_U_DELETE | FE_PERM_U_CHATTR));
  	fe->permissions = cpu_to_le32(udfperms);
  
@@ -67976,6 +68216,49 @@ index 287cd5f..c693331 100644
  		fe->fileLinkCount = cpu_to_le16(inode->i_nlink - 1);
  	else
  		fe->fileLinkCount = cpu_to_le16(inode->i_nlink);
+@@ -1837,32 +1841,23 @@ struct inode *udf_iget(struct super_block *sb, struct kernel_lb_addr *ino)
+ {
+ 	unsigned long block = udf_get_lb_pblock(sb, ino, 0);
+ 	struct inode *inode = iget_locked(sb, block);
++	int err;
+ 
+ 	if (!inode)
+-		return NULL;
++		return ERR_PTR(-ENOMEM);
+ 
+-	if (inode->i_state & I_NEW) {
+-		memcpy(&UDF_I(inode)->i_location, ino, sizeof(struct kernel_lb_addr));
+-		__udf_read_inode(inode);
+-		unlock_new_inode(inode);
+-	}
+-
+-	if (is_bad_inode(inode))
+-		goto out_iput;
++	if (!(inode->i_state & I_NEW))
++		return inode;
+ 
+-	if (ino->logicalBlockNum >= UDF_SB(sb)->
+-			s_partmaps[ino->partitionReferenceNum].s_partition_len) {
+-		udf_debug("block=%d, partition=%d out of range\n",
+-			  ino->logicalBlockNum, ino->partitionReferenceNum);
+-		make_bad_inode(inode);
+-		goto out_iput;
++	memcpy(&UDF_I(inode)->i_location, ino, sizeof(struct kernel_lb_addr));
++	err = udf_read_inode(inode);
++	if (err < 0) {
++		iget_failed(inode);
++		return ERR_PTR(err);
+ 	}
++	unlock_new_inode(inode);
+ 
+ 	return inode;
+-
+- out_iput:
+-	iput(inode);
+-	return NULL;
+ }
+ 
+ int udf_add_aext(struct inode *inode, struct extent_position *epos,
 diff --git a/fs/udf/misc.c b/fs/udf/misc.c
 index c175b4d..8f36a16 100644
 --- a/fs/udf/misc.c
@@ -67989,6 +68272,486 @@ index c175b4d..8f36a16 100644
  	u8 checksum = 0;
  	int i;
  	for (i = 0; i < sizeof(struct tag); ++i)
+diff --git a/fs/udf/namei.c b/fs/udf/namei.c
+index 9737cba..e5ae1c3 100644
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -233,7 +233,8 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir,
+ 		if (!lfi)
+ 			continue;
+ 
+-		flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
++		flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
++					UDF_NAME_LEN);
+ 		if (flen && udf_match(flen, fname, child->len, child->name))
+ 			goto out_ok;
+ 	}
+@@ -270,9 +271,8 @@ static struct dentry *udf_lookup(struct inode *dir, struct dentry *dentry,
+ 						NULL, 0),
+ 		};
+ 		inode = udf_iget(dir->i_sb, lb);
+-		if (!inode) {
+-			return ERR_PTR(-EACCES);
+-		}
++		if (IS_ERR(inode))
++			return inode;
+ 	} else
+ #endif /* UDF_RECOVERY */
+ 
+@@ -285,9 +285,8 @@ static struct dentry *udf_lookup(struct inode *dir, struct dentry *dentry,
+ 
+ 		loc = lelb_to_cpu(cfi.icb.extLocation);
+ 		inode = udf_iget(dir->i_sb, &loc);
+-		if (!inode) {
+-			return ERR_PTR(-EACCES);
+-		}
++		if (IS_ERR(inode))
++			return ERR_CAST(inode);
+ 	}
+ 
+ 	return d_splice_alias(inode, dentry);
+@@ -1221,7 +1220,7 @@ static struct dentry *udf_get_parent(struct dentry *child)
+ 	struct udf_fileident_bh fibh;
+ 
+ 	if (!udf_find_entry(child->d_inode, &dotdot, &fibh, &cfi))
+-		goto out_unlock;
++		return ERR_PTR(-EACCES);
+ 
+ 	if (fibh.sbh != fibh.ebh)
+ 		brelse(fibh.ebh);
+@@ -1229,12 +1228,10 @@ static struct dentry *udf_get_parent(struct dentry *child)
+ 
+ 	tloc = lelb_to_cpu(cfi.icb.extLocation);
+ 	inode = udf_iget(child->d_inode->i_sb, &tloc);
+-	if (!inode)
+-		goto out_unlock;
++	if (IS_ERR(inode))
++		return ERR_CAST(inode);
+ 
+ 	return d_obtain_alias(inode);
+-out_unlock:
+-	return ERR_PTR(-EACCES);
+ }
+ 
+ 
+@@ -1251,8 +1248,8 @@ static struct dentry *udf_nfs_get_inode(struct super_block *sb, u32 block,
+ 	loc.partitionReferenceNum = partref;
+ 	inode = udf_iget(sb, &loc);
+ 
+-	if (inode == NULL)
+-		return ERR_PTR(-ENOMEM);
++	if (IS_ERR(inode))
++		return ERR_CAST(inode);
+ 
+ 	if (generation && inode->i_generation != generation) {
+ 		iput(inode);
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 3306b9f..a1e0eda 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -956,12 +956,14 @@ struct inode *udf_find_metadata_inode_efe(struct super_block *sb,
+ 
+ 	metadata_fe = udf_iget(sb, &addr);
+ 
+-	if (metadata_fe == NULL)
++	if (IS_ERR(metadata_fe)) {
+ 		udf_warn(sb, "metadata inode efe not found\n");
+-	else if (UDF_I(metadata_fe)->i_alloc_type != ICBTAG_FLAG_AD_SHORT) {
++		return metadata_fe;
++	}
++	if (UDF_I(metadata_fe)->i_alloc_type != ICBTAG_FLAG_AD_SHORT) {
+ 		udf_warn(sb, "metadata inode efe does not have short allocation descriptors!\n");
+ 		iput(metadata_fe);
+-		metadata_fe = NULL;
++		return ERR_PTR(-EIO);
+ 	}
+ 
+ 	return metadata_fe;
+@@ -973,6 +975,7 @@ static int udf_load_metadata_files(struct super_block *sb, int partition)
+ 	struct udf_part_map *map;
+ 	struct udf_meta_data *mdata;
+ 	struct kernel_lb_addr addr;
++	struct inode *fe;
+ 
+ 	map = &sbi->s_partmaps[partition];
+ 	mdata = &map->s_type_specific.s_metadata;
+@@ -981,22 +984,24 @@ static int udf_load_metadata_files(struct super_block *sb, int partition)
+ 	udf_debug("Metadata file location: block = %d part = %d\n",
+ 		  mdata->s_meta_file_loc, map->s_partition_num);
+ 
+-	mdata->s_metadata_fe = udf_find_metadata_inode_efe(sb,
+-		mdata->s_meta_file_loc, map->s_partition_num);
+-
+-	if (mdata->s_metadata_fe == NULL) {
++	fe = udf_find_metadata_inode_efe(sb, mdata->s_meta_file_loc,
++					 map->s_partition_num);
++	if (IS_ERR(fe)) {
+ 		/* mirror file entry */
+ 		udf_debug("Mirror metadata file location: block = %d part = %d\n",
+ 			  mdata->s_mirror_file_loc, map->s_partition_num);
+ 
+-		mdata->s_mirror_fe = udf_find_metadata_inode_efe(sb,
+-			mdata->s_mirror_file_loc, map->s_partition_num);
++		fe = udf_find_metadata_inode_efe(sb, mdata->s_mirror_file_loc,
++						 map->s_partition_num);
+ 
+-		if (mdata->s_mirror_fe == NULL) {
++		if (IS_ERR(fe)) {
+ 			udf_err(sb, "Both metadata and mirror metadata inode efe can not found\n");
+-			return -EIO;
++			return PTR_ERR(fe);
+ 		}
+-	}
++		mdata->s_mirror_fe = fe;
++	} else
++		mdata->s_metadata_fe = fe;
++
+ 
+ 	/*
+ 	 * bitmap file entry
+@@ -1010,15 +1015,16 @@ static int udf_load_metadata_files(struct super_block *sb, int partition)
+ 		udf_debug("Bitmap file location: block = %d part = %d\n",
+ 			  addr.logicalBlockNum, addr.partitionReferenceNum);
+ 
+-		mdata->s_bitmap_fe = udf_iget(sb, &addr);
+-		if (mdata->s_bitmap_fe == NULL) {
++		fe = udf_iget(sb, &addr);
++		if (IS_ERR(fe)) {
+ 			if (sb->s_flags & MS_RDONLY)
+ 				udf_warn(sb, "bitmap inode efe not found but it's ok since the disc is mounted read-only\n");
+ 			else {
+ 				udf_err(sb, "bitmap inode efe not found and attempted read-write mount\n");
+-				return -EIO;
++				return PTR_ERR(fe);
+ 			}
+-		}
++		} else
++			mdata->s_bitmap_fe = fe;
+ 	}
+ 
+ 	udf_debug("udf_load_metadata_files Ok\n");
+@@ -1106,13 +1112,15 @@ static int udf_fill_partdesc_info(struct super_block *sb,
+ 				phd->unallocSpaceTable.extPosition),
+ 			.partitionReferenceNum = p_index,
+ 		};
++		struct inode *inode;
+ 
+-		map->s_uspace.s_table = udf_iget(sb, &loc);
+-		if (!map->s_uspace.s_table) {
++		inode = udf_iget(sb, &loc);
++		if (IS_ERR(inode)) {
+ 			udf_debug("cannot load unallocSpaceTable (part %d)\n",
+ 				  p_index);
+-			return -EIO;
++			return PTR_ERR(inode);
+ 		}
++		map->s_uspace.s_table = inode;
+ 		map->s_partition_flags |= UDF_PART_FLAG_UNALLOC_TABLE;
+ 		udf_debug("unallocSpaceTable (part %d) @ %ld\n",
+ 			  p_index, map->s_uspace.s_table->i_ino);
+@@ -1139,14 +1147,15 @@ static int udf_fill_partdesc_info(struct super_block *sb,
+ 				phd->freedSpaceTable.extPosition),
+ 			.partitionReferenceNum = p_index,
+ 		};
++		struct inode *inode;
+ 
+-		map->s_fspace.s_table = udf_iget(sb, &loc);
+-		if (!map->s_fspace.s_table) {
++		inode = udf_iget(sb, &loc);
++		if (IS_ERR(inode)) {
+ 			udf_debug("cannot load freedSpaceTable (part %d)\n",
+ 				  p_index);
+-			return -EIO;
++			return PTR_ERR(inode);
+ 		}
+-
++		map->s_fspace.s_table = inode;
+ 		map->s_partition_flags |= UDF_PART_FLAG_FREED_TABLE;
+ 		udf_debug("freedSpaceTable (part %d) @ %ld\n",
+ 			  p_index, map->s_fspace.s_table->i_ino);
+@@ -1173,6 +1182,7 @@ static void udf_find_vat_block(struct super_block *sb, int p_index,
+ 	struct udf_part_map *map = &sbi->s_partmaps[p_index];
+ 	sector_t vat_block;
+ 	struct kernel_lb_addr ino;
++	struct inode *inode;
+ 
+ 	/*
+ 	 * VAT file entry is in the last recorded block. Some broken disks have
+@@ -1181,10 +1191,13 @@ static void udf_find_vat_block(struct super_block *sb, int p_index,
+ 	ino.partitionReferenceNum = type1_index;
+ 	for (vat_block = start_block;
+ 	     vat_block >= map->s_partition_root &&
+-	     vat_block >= start_block - 3 &&
+-	     !sbi->s_vat_inode; vat_block--) {
++	     vat_block >= start_block - 3; vat_block--) {
+ 		ino.logicalBlockNum = vat_block - map->s_partition_root;
+-		sbi->s_vat_inode = udf_iget(sb, &ino);
++		inode = udf_iget(sb, &ino);
++		if (!IS_ERR(inode)) {
++			sbi->s_vat_inode = inode;
++			break;
++		}
+ 	}
+ }
+ 
+@@ -2200,10 +2213,10 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)
+ 	/* assign inodes by physical block number */
+ 	/* perhaps it's not extensible enough, but for now ... */
+ 	inode = udf_iget(sb, &rootdir);
+-	if (!inode) {
++	if (IS_ERR(inode)) {
+ 		udf_err(sb, "Error in udf_iget, block=%d, partition=%d\n",
+ 		       rootdir.logicalBlockNum, rootdir.partitionReferenceNum);
+-		ret = -EIO;
++		ret = PTR_ERR(inode);
+ 		goto error_out;
+ 	}
+ 
+diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c
+index d7c6dbe..0422b7b 100644
+--- a/fs/udf/symlink.c
++++ b/fs/udf/symlink.c
+@@ -30,49 +30,73 @@
+ #include <linux/buffer_head.h>
+ #include "udf_i.h"
+ 
+-static void udf_pc_to_char(struct super_block *sb, unsigned char *from,
+-			   int fromlen, unsigned char *to)
++static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
++			  int fromlen, unsigned char *to, int tolen)
+ {
+ 	struct pathComponent *pc;
+ 	int elen = 0;
++	int comp_len;
+ 	unsigned char *p = to;
+ 
++	/* Reserve one byte for terminating \0 */
++	tolen--;
+ 	while (elen < fromlen) {
+ 		pc = (struct pathComponent *)(from + elen);
++		elen += sizeof(struct pathComponent);
+ 		switch (pc->componentType) {
+ 		case 1:
+ 			/*
+ 			 * Symlink points to some place which should be agreed
+  			 * upon between originator and receiver of the media. Ignore.
+ 			 */
+-			if (pc->lengthComponentIdent > 0)
++			if (pc->lengthComponentIdent > 0) {
++				elen += pc->lengthComponentIdent;
+ 				break;
++			}
+ 			/* Fall through */
+ 		case 2:
++			if (tolen == 0)
++				return -ENAMETOOLONG;
+ 			p = to;
+ 			*p++ = '/';
++			tolen--;
+ 			break;
+ 		case 3:
++			if (tolen < 3)
++				return -ENAMETOOLONG;
+ 			memcpy(p, "../", 3);
+ 			p += 3;
++			tolen -= 3;
+ 			break;
+ 		case 4:
++			if (tolen < 2)
++				return -ENAMETOOLONG;
+ 			memcpy(p, "./", 2);
+ 			p += 2;
++			tolen -= 2;
+ 			/* that would be . - just ignore */
+ 			break;
+ 		case 5:
+-			p += udf_get_filename(sb, pc->componentIdent, p,
+-					      pc->lengthComponentIdent);
++			elen += pc->lengthComponentIdent;
++			if (elen > fromlen)
++				return -EIO;
++			comp_len = udf_get_filename(sb, pc->componentIdent,
++						    pc->lengthComponentIdent,
++						    p, tolen);
++			p += comp_len;
++			tolen -= comp_len;
++			if (tolen == 0)
++				return -ENAMETOOLONG;
+ 			*p++ = '/';
++			tolen--;
+ 			break;
+ 		}
+-		elen += sizeof(struct pathComponent) + pc->lengthComponentIdent;
+ 	}
+ 	if (p > to + 1)
+ 		p[-1] = '\0';
+ 	else
+ 		p[0] = '\0';
++	return 0;
+ }
+ 
+ static int udf_symlink_filler(struct file *file, struct page *page)
+@@ -80,11 +104,17 @@ static int udf_symlink_filler(struct file *file, struct page *page)
+ 	struct inode *inode = page->mapping->host;
+ 	struct buffer_head *bh = NULL;
+ 	unsigned char *symlink;
+-	int err = -EIO;
++	int err;
+ 	unsigned char *p = kmap(page);
+ 	struct udf_inode_info *iinfo;
+ 	uint32_t pos;
+ 
++	/* We don't support symlinks longer than one block */
++	if (inode->i_size > inode->i_sb->s_blocksize) {
++		err = -ENAMETOOLONG;
++		goto out_unmap;
++	}
++
+ 	iinfo = UDF_I(inode);
+ 	pos = udf_block_map(inode, 0);
+ 
+@@ -94,14 +124,18 @@ static int udf_symlink_filler(struct file *file, struct page *page)
+ 	} else {
+ 		bh = sb_bread(inode->i_sb, pos);
+ 
+-		if (!bh)
+-			goto out;
++		if (!bh) {
++			err = -EIO;
++			goto out_unlock_inode;
++		}
+ 
+ 		symlink = bh->b_data;
+ 	}
+ 
+-	udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p);
++	err = udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p, PAGE_SIZE);
+ 	brelse(bh);
++	if (err)
++		goto out_unlock_inode;
+ 
+ 	up_read(&iinfo->i_data_sem);
+ 	SetPageUptodate(page);
+@@ -109,9 +143,10 @@ static int udf_symlink_filler(struct file *file, struct page *page)
+ 	unlock_page(page);
+ 	return 0;
+ 
+-out:
++out_unlock_inode:
+ 	up_read(&iinfo->i_data_sem);
+ 	SetPageError(page);
++out_unmap:
+ 	kunmap(page);
+ 	unlock_page(page);
+ 	return err;
+diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
+index be7dabb..6b10c98 100644
+--- a/fs/udf/udfdecl.h
++++ b/fs/udf/udfdecl.h
+@@ -143,7 +143,6 @@ extern int udf_expand_file_adinicb(struct inode *);
+ extern struct buffer_head *udf_expand_dir_adinicb(struct inode *, int *, int *);
+ extern struct buffer_head *udf_bread(struct inode *, int, int, int *);
+ extern int udf_setsize(struct inode *, loff_t);
+-extern void udf_read_inode(struct inode *);
+ extern void udf_evict_inode(struct inode *);
+ extern int udf_write_inode(struct inode *, struct writeback_control *wbc);
+ extern long udf_block_map(struct inode *, sector_t);
+@@ -201,7 +200,8 @@ udf_get_lb_pblock(struct super_block *sb, struct kernel_lb_addr *loc,
+ }
+ 
+ /* unicode.c */
+-extern int udf_get_filename(struct super_block *, uint8_t *, uint8_t *, int);
++extern int udf_get_filename(struct super_block *, uint8_t *, int, uint8_t *,
++			    int);
+ extern int udf_put_filename(struct super_block *, const uint8_t *, uint8_t *,
+ 			    int);
+ extern int udf_build_ustr(struct ustr *, dstring *, int);
+diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
+index 44b815e..d29c06f 100644
+--- a/fs/udf/unicode.c
++++ b/fs/udf/unicode.c
+@@ -28,7 +28,8 @@
+ 
+ #include "udf_sb.h"
+ 
+-static int udf_translate_to_linux(uint8_t *, uint8_t *, int, uint8_t *, int);
++static int udf_translate_to_linux(uint8_t *, int, uint8_t *, int, uint8_t *,
++				  int);
+ 
+ static int udf_char_to_ustr(struct ustr *dest, const uint8_t *src, int strlen)
+ {
+@@ -333,8 +334,8 @@ try_again:
+ 	return u_len + 1;
+ }
+ 
+-int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
+-		     int flen)
++int udf_get_filename(struct super_block *sb, uint8_t *sname, int slen,
++		     uint8_t *dname, int dlen)
+ {
+ 	struct ustr *filename, *unifilename;
+ 	int len = 0;
+@@ -347,7 +348,7 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
+ 	if (!unifilename)
+ 		goto out1;
+ 
+-	if (udf_build_ustr_exact(unifilename, sname, flen))
++	if (udf_build_ustr_exact(unifilename, sname, slen))
+ 		goto out2;
+ 
+ 	if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8)) {
+@@ -366,7 +367,8 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
+ 	} else
+ 		goto out2;
+ 
+-	len = udf_translate_to_linux(dname, filename->u_name, filename->u_len,
++	len = udf_translate_to_linux(dname, dlen,
++				     filename->u_name, filename->u_len,
+ 				     unifilename->u_name, unifilename->u_len);
+ out2:
+ 	kfree(unifilename);
+@@ -403,10 +405,12 @@ int udf_put_filename(struct super_block *sb, const uint8_t *sname,
+ #define EXT_MARK		'.'
+ #define CRC_MARK		'#'
+ #define EXT_SIZE 		5
++/* Number of chars we need to store generated CRC to make filename unique */
++#define CRC_LEN			5
+ 
+-static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
+-				  int udfLen, uint8_t *fidName,
+-				  int fidNameLen)
++static int udf_translate_to_linux(uint8_t *newName, int newLen,
++				  uint8_t *udfName, int udfLen,
++				  uint8_t *fidName, int fidNameLen)
+ {
+ 	int index, newIndex = 0, needsCRC = 0;
+ 	int extIndex = 0, newExtIndex = 0, hasExt = 0;
+@@ -440,7 +444,7 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
+ 					newExtIndex = newIndex;
+ 				}
+ 			}
+-			if (newIndex < 256)
++			if (newIndex < newLen)
+ 				newName[newIndex++] = curr;
+ 			else
+ 				needsCRC = 1;
+@@ -468,13 +472,13 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
+ 				}
+ 				ext[localExtIndex++] = curr;
+ 			}
+-			maxFilenameLen = 250 - localExtIndex;
++			maxFilenameLen = newLen - CRC_LEN - localExtIndex;
+ 			if (newIndex > maxFilenameLen)
+ 				newIndex = maxFilenameLen;
+ 			else
+ 				newIndex = newExtIndex;
+-		} else if (newIndex > 250)
+-			newIndex = 250;
++		} else if (newIndex > newLen - CRC_LEN)
++			newIndex = newLen - CRC_LEN;
+ 		newName[newIndex++] = CRC_MARK;
+ 		valueCRC = crc_itu_t(0, fidName, fidNameLen);
+ 		newName[newIndex++] = hexChar[(valueCRC & 0xf000) >> 12];
 diff --git a/fs/ufs/swab.h b/fs/ufs/swab.h
 index 8d974c4..b82f6ec 100644
 --- a/fs/ufs/swab.h
@@ -100570,9 +101333,18 @@ index d074d06..ad3cfcf 100644
  	if (ogm_packet->flags & BATADV_DIRECTLINK)
  		has_directlink_flag = true;
 diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
-index c46387a..6ad5ef9 100644
+index c46387a..3b6c10e 100644
 --- a/net/batman-adv/fragmentation.c
 +++ b/net/batman-adv/fragmentation.c
+@@ -251,7 +251,7 @@ batadv_frag_merge_packets(struct hlist_head *chain, struct sk_buff *skb)
+ 	kfree(entry);
+ 
+ 	/* Make room for the rest of the fragments. */
+-	if (pskb_expand_head(skb_out, 0, size - skb->len, GFP_ATOMIC) < 0) {
++	if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
+ 		kfree_skb(skb_out);
+ 		skb_out = NULL;
+ 		goto free;
 @@ -450,7 +450,7 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
  	frag_header.packet_type = BATADV_UNICAST_FRAG;
  	frag_header.version = BATADV_COMPAT_VERSION;
@@ -107500,10 +108272,10 @@ index 152d4d2..791684c 100644
  mkdir -p "$destdir"
  (cd $srctree; tar -c -f - -T "$objtree/debian/hdrsrcfiles") | (cd $destdir; tar -xf -)
 diff --git a/scripts/package/mkspec b/scripts/package/mkspec
-index 1395760..6ceef68 100755
+index 1395760..bca2734 100755
 --- a/scripts/package/mkspec
 +++ b/scripts/package/mkspec
-@@ -121,14 +121,27 @@ echo 'rm -f $RPM_BUILD_ROOT'"/lib/modules/$KERNELRELEASE/{build,source}"
+@@ -121,29 +121,40 @@ echo 'rm -f $RPM_BUILD_ROOT'"/lib/modules/$KERNELRELEASE/{build,source}"
  echo "mkdir -p "'$RPM_BUILD_ROOT'"/usr/src/kernels/$KERNELRELEASE"
  echo "EXCLUDES=\"$RCS_TAR_IGNORE --exclude .tmp_versions --exclude=*vmlinux* --exclude=*.o --exclude=*.ko --exclude=*.cmd --exclude=Documentation --exclude=firmware --exclude .config.old --exclude .missing-syscalls.d\""
  echo "tar "'$EXCLUDES'" -cf- . | (cd "'$RPM_BUILD_ROOT'"/usr/src/kernels/$KERNELRELEASE;tar xvf -)"
@@ -107532,9 +108304,16 @@ index 1395760..6ceef68 100755
 +echo "ln -sf /usr/src/kernels/$KERNELRELEASE /lib/modules/$KERNELRELEASE/source"
 +echo ""
  echo "%post"
- echo "if [ -x /sbin/installkernel -a -r /boot/vmlinuz-$KERNELRELEASE -a -r /boot/System.map-$KERNELRELEASE ]; then"
- echo "cp /boot/vmlinuz-$KERNELRELEASE /boot/vmlinuz-$KERNELRELEASE-rpm"
-@@ -139,11 +152,11 @@ echo "rm -f /boot/vmlinuz-$KERNELRELEASE-rpm /boot/System.map-$KERNELRELEASE-rpm
+-echo "if [ -x /sbin/installkernel -a -r /boot/vmlinuz-$KERNELRELEASE -a -r /boot/System.map-$KERNELRELEASE ]; then"
+-echo "cp /boot/vmlinuz-$KERNELRELEASE /boot/vmlinuz-$KERNELRELEASE-rpm"
+-echo "cp /boot/System.map-$KERNELRELEASE /boot/System.map-$KERNELRELEASE-rpm"
+-echo "rm -f /boot/vmlinuz-$KERNELRELEASE /boot/System.map-$KERNELRELEASE"
+-echo "/sbin/installkernel $KERNELRELEASE /boot/vmlinuz-$KERNELRELEASE-rpm /boot/System.map-$KERNELRELEASE-rpm"
+-echo "rm -f /boot/vmlinuz-$KERNELRELEASE-rpm /boot/System.map-$KERNELRELEASE-rpm"
++echo "if [ -x /sbin/dracut ]; then"
++echo '/sbin/new-kernel-pkg --dracut --mkinitrd --depmod --install --make-default '"$KERNELRELEASE"' || exit $?'
++echo "else"
++echo '/sbin/new-kernel-pkg --mkinitrd --depmod --install --make-default '"$KERNELRELEASE"' || exit $?'
  echo "fi"
  echo ""
  echo "%files"
@@ -107548,7 +108327,7 @@ index 1395760..6ceef68 100755
  echo "/lib/firmware/$KERNELRELEASE"
  echo "/boot/*"
  echo ""
-@@ -152,8 +165,7 @@ echo '%defattr (-, root, root)'
+@@ -152,8 +163,7 @@ echo '%defattr (-, root, root)'
  echo "/usr/include"
  echo ""
  echo "%files devel"