main/linux-grsec: upgrade to grsecurity-2.9.1-3.6.5-201211042157

2 files changed, 498 insertions, 117 deletions

diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 31b5fa664c..85f40da36c 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -2,9 +2,9 @@
 
 _flavor=grsec
 pkgname=linux-${_flavor}
-pkgver=3.6.4
+pkgver=3.6.5
 _kernver=3.6
-pkgrel=1
+pkgrel=0
 pkgdesc="Linux kernel with grsecurity"
 url=http://grsecurity.net
 depends="mkinitfs linux-firmware"
@@ -14,7 +14,7 @@ _config=${config:-kernelconfig.${CARCH}}
 install=
 source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz
 	http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz
-	grsecurity-2.9.1-3.6.4-201210291446.patch
+	grsecurity-2.9.1-3.6.5-201211042157.patch
 	
 	0004-arp-flush-arp-cache-on-device-change.patch
 
@@ -139,8 +139,8 @@ dev() {
 }
 
 md5sums="1a1760420eac802c541a20ab51a093d1  linux-3.6.tar.xz
-d7efab4da2682c44662b684026b059f7  patch-3.6.4.xz
-4235328c981070bca82bc61b7f7bc7c1  grsecurity-2.9.1-3.6.4-201210291446.patch
+6ad8ceebb9b5c1bf69a0c07ef7cc81f2  patch-3.6.5.xz
+0affb0d4559c04d76251be6755338ae1  grsecurity-2.9.1-3.6.5-201211042157.patch
 776adeeb5272093574f8836c5037dd7d  0004-arp-flush-arp-cache-on-device-change.patch
 0fe70e3640b55adb6800e6eebe74ea4d  kernelconfig.x86
 b7707e701f190d97c3552b7ec292b897  kernelconfig.x86_64"
diff --git a/main/linux-grsec/grsecurity-2.9.1-3.6.4-201210291446.patch b/main/linux-grsec/grsecurity-2.9.1-3.6.5-201211042157.patch
index 08c581d833..18206e5084 100644
--- a/main/linux-grsec/grsecurity-2.9.1-3.6.4-201210291446.patch
+++ b/main/linux-grsec/grsecurity-2.9.1-3.6.5-201211042157.patch
@@ -251,7 +251,7 @@ index ad7e2e5..199f49e 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index dcf132a..db194e3 100644
+index 6e4a00d..4c7aa4f 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -19013,7 +19013,7 @@ index 7a6f3b3..bed145d7 100644
  
  1:
 diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
-index 198e774..e880f29 100644
+index 5cee802..bc22bc3 100644
 --- a/arch/x86/kernel/setup.c
 +++ b/arch/x86/kernel/setup.c
 @@ -440,7 +440,7 @@ static void __init parse_setup_data(void)
@@ -24577,7 +24577,7 @@ index b91e485..d00e7c9 100644
  	}
  	if (mm->get_unmapped_area == arch_get_unmapped_area)
 diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index ab1f6a9..23030ba 100644
+index d7aea41..f753ad2 100644
 --- a/arch/x86/mm/init.c
 +++ b/arch/x86/mm/init.c
 @@ -16,6 +16,8 @@
@@ -24589,16 +24589,16 @@ index ab1f6a9..23030ba 100644
  
  unsigned long __initdata pgt_buf_start;
  unsigned long __meminitdata pgt_buf_end;
-@@ -38,7 +40,7 @@ struct map_range {
- static void __init find_early_table_space(struct map_range *mr, unsigned long end,
- 					  int use_pse, int use_gbpages)
+@@ -44,7 +46,7 @@ static void __init find_early_table_space(struct map_range *mr, int nr_range)
  {
--	unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
-+	unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end;
+ 	int i;
+ 	unsigned long puds = 0, pmds = 0, ptes = 0, tables;
+-	unsigned long start = 0, good_end;
++	unsigned long start = 0x100000, good_end;
  	phys_addr_t base;
  
- 	puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
-@@ -317,10 +319,37 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
+ 	for (i = 0; i < nr_range; i++) {
+@@ -321,10 +323,37 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
   * Access has to be given to non-kernel-ram areas as well, these contain the PCI
   * mmio resources as well as potential bios/acpi data regions.
   */
@@ -24637,7 +24637,7 @@ index ab1f6a9..23030ba 100644
  	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
  		return 0;
  	if (!page_is_ram(pagenr))
-@@ -377,8 +406,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
+@@ -381,8 +410,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
  #endif
  }
  
@@ -25034,7 +25034,7 @@ index 575d86f..4987469 100644
  	printk(KERN_INFO "Write protecting the kernel text: %luk\n",
  		size >> 10);
 diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
-index 2b6b4a3..c17210d 100644
+index 3baff25..8b37564 100644
 --- a/arch/x86/mm/init_64.c
 +++ b/arch/x86/mm/init_64.c
 @@ -74,7 +74,7 @@ early_param("gbpages", parse_direct_gbpages_on);
@@ -25151,7 +25151,7 @@ index 2b6b4a3..c17210d 100644
  	adr = (void *)(((unsigned long)adr) | left);
  
  	return adr;
-@@ -548,7 +562,7 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
+@@ -553,7 +567,7 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
  		unmap_low_page(pmd);
  
  		spin_lock(&init_mm.page_table_lock);
@@ -25160,7 +25160,7 @@ index 2b6b4a3..c17210d 100644
  		spin_unlock(&init_mm.page_table_lock);
  	}
  	__flush_tlb_all();
-@@ -594,7 +608,7 @@ kernel_physical_mapping_init(unsigned long start,
+@@ -599,7 +613,7 @@ kernel_physical_mapping_init(unsigned long start,
  		unmap_low_page(pud);
  
  		spin_lock(&init_mm.page_table_lock);
@@ -25169,7 +25169,7 @@ index 2b6b4a3..c17210d 100644
  		spin_unlock(&init_mm.page_table_lock);
  		pgd_changed = true;
  	}
-@@ -686,6 +700,12 @@ void __init mem_init(void)
+@@ -691,6 +705,12 @@ void __init mem_init(void)
  
  	pci_iommu_alloc();
  
@@ -25182,7 +25182,7 @@ index 2b6b4a3..c17210d 100644
  	/* clear_bss() already clear the empty_zero_page */
  
  	reservedpages = 0;
-@@ -846,8 +866,8 @@ int kern_addr_valid(unsigned long addr)
+@@ -851,8 +871,8 @@ int kern_addr_valid(unsigned long addr)
  static struct vm_area_struct gate_vma = {
  	.vm_start	= VSYSCALL_START,
  	.vm_end		= VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
@@ -25193,7 +25193,7 @@ index 2b6b4a3..c17210d 100644
  };
  
  struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
-@@ -881,7 +901,7 @@ int in_gate_area_no_mm(unsigned long addr)
+@@ -886,7 +906,7 @@ int in_gate_area_no_mm(unsigned long addr)
  
  const char *arch_vma_name(struct vm_area_struct *vma)
  {
@@ -30813,7 +30813,7 @@ index 73fa3e1..ab2e9b9 100644
  	iir = I915_READ(IIR);
  
 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index b634f6f..84bb8ba 100644
+index b634f6f..43c62f5 100644
 --- a/drivers/gpu/drm/i915/intel_display.c
 +++ b/drivers/gpu/drm/i915/intel_display.c
 @@ -2182,7 +2182,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb)
@@ -30825,16 +30825,17 @@ index b634f6f..84bb8ba 100644
  
  	/* Big Hammer, we also need to ensure that any pending
  	 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
-@@ -6168,7 +6168,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
+@@ -6168,8 +6168,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
  
  	obj = work->old_fb_obj;
  
 -	atomic_clear_mask(1 << intel_crtc->plane,
-+	atomic_clear_mask_unchecked(1 << intel_crtc->plane,
- 			  &obj->pending_flip.counter);
+-			  &obj->pending_flip.counter);
++	atomic_clear_mask_unchecked(1 << intel_crtc->plane, &obj->pending_flip);
  
  	wake_up(&dev_priv->pending_flip_queue);
-@@ -6515,7 +6515,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
+ 	schedule_work(&work->work);
+@@ -6515,7 +6514,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
  	/* Block clients from rendering to the new back buffer until
  	 * the flip occurs and the object is no longer visible.
  	 */
@@ -30843,7 +30844,7 @@ index b634f6f..84bb8ba 100644
  
  	ret = dev_priv->display.queue_flip(dev, crtc, fb, obj);
  	if (ret)
-@@ -6530,7 +6530,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
+@@ -6530,7 +6529,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
  	return 0;
  
  cleanup_pending:
@@ -31504,10 +31505,10 @@ index 14599e2..711c965 100644
  
  		for (i = 0; i < hid->maxcollection; i++)
 diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
-index 4065374..10ed7dc 100644
+index f4c3d28..82f45a9 100644
 --- a/drivers/hv/channel.c
 +++ b/drivers/hv/channel.c
-@@ -400,8 +400,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
+@@ -402,8 +402,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
  	int ret = 0;
  	int t;
  
@@ -34782,6 +34783,28 @@ index 51b9d6a..52af9a7 100644
  #include <linux/mtd/mtd.h>
  #include <linux/mtd/nand.h>
  #include <linux/mtd/nftl.h>
+diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
+index dc15d24..ef8d2a0 100644
+--- a/drivers/net/bonding/bond_sysfs.c
++++ b/drivers/net/bonding/bond_sysfs.c
+@@ -1060,7 +1060,7 @@ static ssize_t bonding_store_primary(struct device *d,
+ 		goto out;
+ 	}
+ 
+-	sscanf(buf, "%16s", ifname); /* IFNAMSIZ */
++	sscanf(buf, "%15s", ifname); /* IFNAMSIZ */
+ 
+ 	/* check to see if we are clearing primary */
+ 	if (!strlen(ifname) || buf[0] == '\n') {
+@@ -1237,7 +1237,7 @@ static ssize_t bonding_store_active_slave(struct device *d,
+ 		goto out;
+ 	}
+ 
+-	sscanf(buf, "%16s", ifname); /* IFNAMSIZ */
++	sscanf(buf, "%15s", ifname); /* IFNAMSIZ */
+ 
+ 	/* check to see if we are clearing active */
+ 	if (!strlen(ifname) || buf[0] == '\n') {
 diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c
 index 57d64b8..623dd86 100644
 --- a/drivers/net/ethernet/atheros/atlx/atl2.c
@@ -34795,6 +34818,22 @@ index 57d64b8..623dd86 100644
      MODULE_PARM(X, "1-" __MODULE_STRING(ATL2_MAX_NIC) "i"); \
      MODULE_PARM_DESC(X, desc);
  #else
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 0875ecf..794cdf3 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -3051,9 +3051,8 @@ static void bnx2x_drv_info_ether_stat(struct bnx2x *bp)
+ 	struct eth_stats_info *ether_stat =
+ 		&bp->slowpath->drv_info_to_mcp.ether_stat;
+ 
+-	/* leave last char as NULL */
+-	memcpy(ether_stat->version, DRV_MODULE_VERSION,
+-	       ETH_STAT_INFO_VERSION_LEN - 1);
++	strlcpy(ether_stat->version, DRV_MODULE_VERSION,
++		ETH_STAT_INFO_VERSION_LEN);
+ 
+ 	bp->sp_objs[0].mac_obj.get_n_elements(bp, &bp->sp_objs[0].mac_obj,
+ 					DRV_INFO_ETH_STAT_NUM_MACS_REQUIRED,
 diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
 index f83e033..8b4f43a 100644
 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
@@ -35258,6 +35297,18 @@ index 4a518a3..936b334 100644
  
  #define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath)				\
  		((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next)
+diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
+index 53743f7..af8b414 100644
+--- a/drivers/net/ethernet/nxp/lpc_eth.c
++++ b/drivers/net/ethernet/nxp/lpc_eth.c
+@@ -1524,6 +1524,7 @@ static int lpc_eth_drv_remove(struct platform_device *pdev)
+ 				  pldat->dma_buff_base_p);
+ 	free_irq(ndev->irq, ndev);
+ 	iounmap(pldat->net_base);
++	mdiobus_unregister(pldat->mii_bus);
+ 	mdiobus_free(pldat->mii_bus);
+ 	clk_disable(pldat->clk);
+ 	clk_put(pldat->clk);
 diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
 index b47d5b3..273a516 100644
 --- a/drivers/net/ethernet/realtek/r8169.c
@@ -35352,6 +35403,18 @@ index 1e88a10..1b01736 100644
  
  	/* Ignore return since this msg is optional. */
  	rndis_filter_send_request(dev, request);
+diff --git a/drivers/net/phy/mdio-bitbang.c b/drivers/net/phy/mdio-bitbang.c
+index daec9b0..6428fcb 100644
+--- a/drivers/net/phy/mdio-bitbang.c
++++ b/drivers/net/phy/mdio-bitbang.c
+@@ -234,6 +234,7 @@ void free_mdio_bitbang(struct mii_bus *bus)
+ 	struct mdiobb_ctrl *ctrl = bus->priv;
+ 
+ 	module_put(ctrl->ops->owner);
++	mdiobus_unregister(bus);
+ 	mdiobus_free(bus);
+ }
+ EXPORT_SYMBOL(free_mdio_bitbang);
 diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
 index 5c05572..389610b 100644
 --- a/drivers/net/ppp/ppp_generic.c
@@ -35500,6 +35563,27 @@ index 6169fbd..40e8422 100644
  
  struct ath_common;
  struct ath_bus_ops;
+diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
+index 2aab20e..b761ef8 100644
+--- a/drivers/net/wireless/ath/ath5k/base.c
++++ b/drivers/net/wireless/ath/ath5k/base.c
+@@ -1803,7 +1803,7 @@ ath5k_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+ {
+ 	int ret;
+ 	struct ath5k_hw *ah = hw->priv;
+-	struct ath5k_vif *avf = (void *)vif->drv_priv;
++	struct ath5k_vif *avf;
+ 	struct sk_buff *skb;
+ 
+ 	if (WARN_ON(!vif)) {
+@@ -1818,6 +1818,7 @@ ath5k_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+ 		goto out;
+ 	}
+ 
++	avf = (void *)vif->drv_priv;
+ 	ath5k_txbuf_free_skb(ah, avf->bbuf);
+ 	avf->bbuf->skb = skb;
+ 	ret = ath5k_beacon_setup(ah, avf->bbuf);
 diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
 index 8d78253..bebbb68 100644
 --- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
@@ -37819,6 +37903,40 @@ index 0d4aa82..f7832d4 100644
  extern void tmem_register_hostops(struct tmem_hostops *m);
  
  /* core tmem accessor functions */
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index 9fc9a60..68d4c10 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -850,20 +850,20 @@ int se_dev_check_shutdown(struct se_device *dev)
+ 
+ static u32 se_dev_align_max_sectors(u32 max_sectors, u32 block_size)
+ {
+-	u32 tmp, aligned_max_sectors;
++	u32 aligned_max_sectors;
++	u32 alignment;
+ 	/*
+ 	 * Limit max_sectors to a PAGE_SIZE aligned value for modern
+ 	 * transport_allocate_data_tasks() operation.
+ 	 */
+-	tmp = rounddown((max_sectors * block_size), PAGE_SIZE);
+-	aligned_max_sectors = (tmp / block_size);
+-	if (max_sectors != aligned_max_sectors) {
+-		printk(KERN_INFO "Rounding down aligned max_sectors from %u"
+-				" to %u\n", max_sectors, aligned_max_sectors);
+-		return aligned_max_sectors;
+-	}
++	alignment = max(1ul, PAGE_SIZE / block_size);
++	aligned_max_sectors = rounddown(max_sectors, alignment);
+ 
+-	return max_sectors;
++	if (max_sectors != aligned_max_sectors)
++		pr_info("Rounding down aligned max_sectors from %u to %u\n",
++			max_sectors, aligned_max_sectors);
++
++	return aligned_max_sectors;
+ }
+ 
+ void se_dev_set_default_attribs(
 diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
 index 269f544..32def0d 100644
 --- a/drivers/target/target_core_transport.c
@@ -42586,6 +42704,19 @@ index e56c934..fc22f4b 100644
  	} u;
  	struct list_head list;
  };
+diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
+index 89f7625..ac72702 100644
+--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
+@@ -458,7 +458,7 @@ static ssize_t xenbus_file_write(struct file *filp,
+ 		goto out;
+ 
+ 	/* Can't write a xenbus message larger we can buffer */
+-	if ((len + u->len) > sizeof(u->u.buffer)) {
++	if (len > sizeof(u->u.buffer) - u->len) {
+ 		/* On error, dump existing buffer */
+ 		u->len = 0;
+ 		rc = -EINVAL;
 diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
 index cbf9dbb..35c3af7 100644
 --- a/fs/9p/vfs_inode.c
@@ -44019,6 +44150,19 @@ index e5b7731..b9c59fb 100644
  	int err;
  	u32 ftype;
  	struct ceph_mds_reply_info_parsed *rinfo;
+diff --git a/fs/ceph/export.c b/fs/ceph/export.c
+index 02ce909..9349bb3 100644
+--- a/fs/ceph/export.c
++++ b/fs/ceph/export.c
+@@ -90,6 +90,8 @@ static int ceph_encode_fh(struct inode *inode, u32 *rawfh, int *max_len,
+ 		*max_len = handle_length;
+ 		type = 255;
+ 	}
++	if (dentry)
++		dput(dentry);
+ 	return type;
+ }
+ 
 diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
 index d9ea6ed..1e6c8ac 100644
 --- a/fs/cifs/cifs_debug.c
@@ -44624,19 +44768,10 @@ index 112e45a..b59845b 100644
  
  /*
 diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
-index debdfe0..75d31d4 100644
+index 5d2069f..75d31d4 100644
 --- a/fs/compat_ioctl.c
 +++ b/fs/compat_ioctl.c
-@@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd,
- 
- 	err  = get_user(palp, &up->palette);
- 	err |= get_user(length, &up->length);
-+	if (err)
-+		return -EFAULT;
- 
- 	up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
- 	err  = put_user(compat_ptr(palp), &up_native->palette);
-@@ -621,7 +623,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd,
+@@ -623,7 +623,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd,
  			return -EFAULT;
                  if (__get_user(udata, &ss32->iomem_base))
  			return -EFAULT;
@@ -44645,7 +44780,7 @@ index debdfe0..75d31d4 100644
                  if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
  		    __get_user(ss.port_high, &ss32->port_high))
  			return -EFAULT;
-@@ -796,7 +798,7 @@ static int compat_ioctl_preallocate(struct file *file,
+@@ -798,7 +798,7 @@ static int compat_ioctl_preallocate(struct file *file,
  	    copy_in_user(&p->l_len,	&p32->l_len,	sizeof(s64)) ||
  	    copy_in_user(&p->l_sysid,	&p32->l_sysid,	sizeof(s32)) ||
  	    copy_in_user(&p->l_pid,	&p32->l_pid,	sizeof(u32)) ||
@@ -44654,7 +44789,7 @@ index debdfe0..75d31d4 100644
  		return -EFAULT;
  
  	return ioctl_preallocate(file, p);
-@@ -1610,8 +1612,8 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd,
+@@ -1612,8 +1612,8 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd,
  static int __init init_sys32_ioctl_cmp(const void *p, const void *q)
  {
  	unsigned int a, b;
@@ -44780,7 +44915,7 @@ index b2a34a1..162fa69 100644
  	return rc;
  }
 diff --git a/fs/exec.c b/fs/exec.c
-index 574cf4d..dfe774a 100644
+index fab2c6d..4fa20c0 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
 @@ -55,6 +55,15 @@
@@ -45050,7 +45185,7 @@ index 574cf4d..dfe774a 100644
  	set_fs(old_fs);
  	return result;
  }
-@@ -1257,7 +1296,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
+@@ -1258,7 +1297,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
  	}
  	rcu_read_unlock();
  
@@ -45059,7 +45194,7 @@ index 574cf4d..dfe774a 100644
  		bprm->unsafe |= LSM_UNSAFE_SHARE;
  	} else {
  		res = -EAGAIN;
-@@ -1460,6 +1499,28 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+@@ -1461,6 +1500,28 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
  
  EXPORT_SYMBOL(search_binary_handler);
  
@@ -45088,7 +45223,7 @@ index 574cf4d..dfe774a 100644
  /*
   * sys_execve() executes a new program.
   */
-@@ -1468,6 +1529,11 @@ static int do_execve_common(const char *filename,
+@@ -1469,6 +1530,11 @@ static int do_execve_common(const char *filename,
  				struct user_arg_ptr envp,
  				struct pt_regs *regs)
  {
@@ -45100,7 +45235,7 @@ index 574cf4d..dfe774a 100644
  	struct linux_binprm *bprm;
  	struct file *file;
  	struct files_struct *displaced;
-@@ -1475,6 +1541,8 @@ static int do_execve_common(const char *filename,
+@@ -1476,6 +1542,8 @@ static int do_execve_common(const char *filename,
  	int retval;
  	const struct cred *cred = current_cred();
  
@@ -45109,7 +45244,7 @@ index 574cf4d..dfe774a 100644
  	/*
  	 * We move the actual failure in case of RLIMIT_NPROC excess from
  	 * set*uid() to execve() because too many poorly written programs
-@@ -1515,12 +1583,27 @@ static int do_execve_common(const char *filename,
+@@ -1516,12 +1584,27 @@ static int do_execve_common(const char *filename,
  	if (IS_ERR(file))
  		goto out_unmark;
  
@@ -45137,7 +45272,7 @@ index 574cf4d..dfe774a 100644
  	retval = bprm_mm_init(bprm);
  	if (retval)
  		goto out_file;
-@@ -1537,24 +1620,65 @@ static int do_execve_common(const char *filename,
+@@ -1538,24 +1621,65 @@ static int do_execve_common(const char *filename,
  	if (retval < 0)
  		goto out;
  
@@ -45207,7 +45342,7 @@ index 574cf4d..dfe774a 100644
  	current->fs->in_exec = 0;
  	current->in_execve = 0;
  	acct_update_integrals(current);
-@@ -1563,6 +1687,14 @@ static int do_execve_common(const char *filename,
+@@ -1564,6 +1688,14 @@ static int do_execve_common(const char *filename,
  		put_files_struct(displaced);
  	return retval;
  
@@ -45222,7 +45357,7 @@ index 574cf4d..dfe774a 100644
  out:
  	if (bprm->mm) {
  		acct_arg_size(bprm, 0);
-@@ -1636,7 +1768,7 @@ static int expand_corename(struct core_name *cn)
+@@ -1637,7 +1769,7 @@ static int expand_corename(struct core_name *cn)
  {
  	char *old_corename = cn->corename;
  
@@ -45231,7 +45366,7 @@ index 574cf4d..dfe774a 100644
  	cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
  
  	if (!cn->corename) {
-@@ -1733,7 +1865,7 @@ static int format_corename(struct core_name *cn, long signr)
+@@ -1734,7 +1866,7 @@ static int format_corename(struct core_name *cn, long signr)
  	int pid_in_pattern = 0;
  	int err = 0;
  
@@ -45240,7 +45375,7 @@ index 574cf4d..dfe774a 100644
  	cn->corename = kmalloc(cn->size, GFP_KERNEL);
  	cn->used = 0;
  
-@@ -1830,6 +1962,250 @@ out:
+@@ -1831,6 +1963,250 @@ out:
  	return ispipe;
  }
  
@@ -45491,7 +45626,7 @@ index 574cf4d..dfe774a 100644
  static int zap_process(struct task_struct *start, int exit_code)
  {
  	struct task_struct *t;
-@@ -2040,17 +2416,17 @@ static void wait_for_dump_helpers(struct file *file)
+@@ -2041,17 +2417,17 @@ static void wait_for_dump_helpers(struct file *file)
  	pipe = file->f_path.dentry->d_inode->i_pipe;
  
  	pipe_lock(pipe);
@@ -45514,7 +45649,7 @@ index 574cf4d..dfe774a 100644
  	pipe_unlock(pipe);
  
  }
-@@ -2105,7 +2481,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2106,7 +2482,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  	int flag = 0;
  	int ispipe;
  	bool need_nonrelative = false;
@@ -45523,7 +45658,7 @@ index 574cf4d..dfe774a 100644
  	struct coredump_params cprm = {
  		.signr = signr,
  		.regs = regs,
-@@ -2120,6 +2496,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2121,6 +2497,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  
  	audit_core_dumps(signr);
  
@@ -45533,7 +45668,7 @@ index 574cf4d..dfe774a 100644
  	binfmt = mm->binfmt;
  	if (!binfmt || !binfmt->core_dump)
  		goto fail;
-@@ -2190,7 +2569,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2191,7 +2570,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  		}
  		cprm.limit = RLIM_INFINITY;
  
@@ -45542,7 +45677,7 @@ index 574cf4d..dfe774a 100644
  		if (core_pipe_limit && (core_pipe_limit < dump_count)) {
  			printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
  			       task_tgid_vnr(current), current->comm);
-@@ -2217,6 +2596,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2218,6 +2597,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  	} else {
  		struct inode *inode;
  
@@ -45551,7 +45686,7 @@ index 574cf4d..dfe774a 100644
  		if (cprm.limit < binfmt->min_coredump)
  			goto fail_unlock;
  
-@@ -2268,7 +2649,7 @@ close_fail:
+@@ -2269,7 +2650,7 @@ close_fail:
  		filp_close(cprm.file, NULL);
  fail_dropcount:
  	if (ispipe)
@@ -45560,7 +45695,7 @@ index 574cf4d..dfe774a 100644
  fail_unlock:
  	kfree(cn.corename);
  fail_corename:
-@@ -2287,7 +2668,7 @@ fail:
+@@ -2288,7 +2669,7 @@ fail:
   */
  int dump_write(struct file *file, const void *addr, int nr)
  {
@@ -45652,6 +45787,57 @@ index 5c69f2b..05dec7f 100644
  	atomic_t s_lock_busy;
  
  	/* locality groups */
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 8ce0076..cc2d77c 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -716,6 +716,10 @@ repeat_in_this_group:
+ 				   "inode=%lu", ino + 1);
+ 			continue;
+ 		}
++		BUFFER_TRACE(inode_bitmap_bh, "get_write_access");
++		err = ext4_journal_get_write_access(handle, inode_bitmap_bh);
++		if (err)
++			goto fail;
+ 		ext4_lock_group(sb, group);
+ 		ret2 = ext4_test_and_set_bit(ino, inode_bitmap_bh->b_data);
+ 		ext4_unlock_group(sb, group);
+@@ -729,6 +733,11 @@ repeat_in_this_group:
+ 	goto out;
+ 
+ got:
++	BUFFER_TRACE(inode_bitmap_bh, "call ext4_handle_dirty_metadata");
++	err = ext4_handle_dirty_metadata(handle, NULL, inode_bitmap_bh);
++	if (err)
++		goto fail;
++
+ 	/* We may have to initialize the block bitmap if it isn't already */
+ 	if (ext4_has_group_desc_csum(sb) &&
+ 	    gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
+@@ -762,11 +771,6 @@ got:
+ 			goto fail;
+ 	}
+ 
+-	BUFFER_TRACE(inode_bitmap_bh, "get_write_access");
+-	err = ext4_journal_get_write_access(handle, inode_bitmap_bh);
+-	if (err)
+-		goto fail;
+-
+ 	BUFFER_TRACE(group_desc_bh, "get_write_access");
+ 	err = ext4_journal_get_write_access(handle, group_desc_bh);
+ 	if (err)
+@@ -814,11 +818,6 @@ got:
+ 	}
+ 	ext4_unlock_group(sb, group);
+ 
+-	BUFFER_TRACE(inode_bitmap_bh, "call ext4_handle_dirty_metadata");
+-	err = ext4_handle_dirty_metadata(handle, NULL, inode_bitmap_bh);
+-	if (err)
+-		goto fail;
+-
+ 	BUFFER_TRACE(group_desc_bh, "call ext4_handle_dirty_metadata");
+ 	err = ext4_handle_dirty_metadata(handle, NULL, group_desc_bh);
+ 	if (err)
 diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
 index b26410c..7383d90 100644
 --- a/fs/ext4/mballoc.c
@@ -47551,7 +47737,7 @@ index 7e81bfc..c3649aa 100644
  
  	lock_flocks();
 diff --git a/fs/namei.c b/fs/namei.c
-index 81bd546..80149d9 100644
+index 091c4b7..c6d7e26 100644
 --- a/fs/namei.c
 +++ b/fs/namei.c
 @@ -265,16 +265,32 @@ int generic_permission(struct inode *inode, int mask)
@@ -50292,7 +50478,7 @@ index 41514dd..6564a93 100644
  
  	pipe_unlock(ipipe);
 diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
-index 6b0bb00..75db2fe 100644
+index 2fbdff6..5530a61 100644
 --- a/fs/sysfs/dir.c
 +++ b/fs/sysfs/dir.c
 @@ -685,6 +685,18 @@ static int create_dir(struct kobject *kobj, struct sysfs_dirent *parent_sd,
@@ -61439,10 +61625,10 @@ index 9c02a45..89fdd73 100644
  	unsigned int offset, size_t len);
  
 diff --git a/include/linux/efi.h b/include/linux/efi.h
-index ec45ccd..9923c32 100644
+index 5782114..e9b1ba1 100644
 --- a/include/linux/efi.h
 +++ b/include/linux/efi.h
-@@ -635,7 +635,7 @@ struct efivar_operations {
+@@ -640,7 +640,7 @@ struct efivar_operations {
  	efi_get_variable_t *get_variable;
  	efi_get_next_variable_t *get_next_variable;
  	efi_set_variable_t *set_variable;
@@ -65051,6 +65237,26 @@ index 9e5425b..8136ffc 100644
  	struct list_head list;
  	/* Protects from simultaneous access to first_req list */
  	spinlock_t info_list_lock;
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index f10553c..fb5204b 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -2633,6 +2633,15 @@ unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb);
+ unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc);
+ 
+ /**
++ * ieee80211_get_mesh_hdrlen - get mesh extension header length
++ * @meshhdr: the mesh extension header, only the flags field
++ *	(first byte) will be accessed
++ * Returns the length of the extension header, which is always at
++ * least 6 bytes and at most 18 if address 5 and 6 are present.
++ */
++unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr);
++
++/**
+  * DOC: Data path helpers
+  *
+  * In addition to generic utilities, cfg80211 also offers
 diff --git a/include/net/flow.h b/include/net/flow.h
 index 628e11b..4c475df 100644
 --- a/include/net/flow.h
@@ -66039,7 +66245,7 @@ index 84c6bf1..8899338 100644
  	next_state = Reset;
  	return 0;
 diff --git a/init/main.c b/init/main.c
-index b286730..9ff6135 100644
+index d61ec54..bd3144f 100644
 --- a/init/main.c
 +++ b/init/main.c
 @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) { }
@@ -66113,7 +66319,7 @@ index b286730..9ff6135 100644
  static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
  const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
  static const char *panic_later, *panic_param;
-@@ -675,6 +732,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -678,6 +735,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
  {
  	int count = preempt_count();
  	int ret;
@@ -66121,7 +66327,7 @@ index b286730..9ff6135 100644
  
  	if (initcall_debug)
  		ret = do_one_initcall_debug(fn);
-@@ -687,15 +745,15 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -690,15 +748,15 @@ int __init_or_module do_one_initcall(initcall_t fn)
  		sprintf(msgbuf, "error code %d ", ret);
  
  	if (preempt_count() != count) {
@@ -66141,7 +66347,7 @@ index b286730..9ff6135 100644
  	}
  
  	return ret;
-@@ -749,8 +807,14 @@ static void __init do_initcall_level(int level)
+@@ -752,8 +810,14 @@ static void __init do_initcall_level(int level)
  		   level, level,
  		   &repair_env_string);
  
@@ -66157,7 +66363,7 @@ index b286730..9ff6135 100644
  }
  
  static void __init do_initcalls(void)
-@@ -784,8 +848,14 @@ static void __init do_pre_smp_initcalls(void)
+@@ -787,8 +851,14 @@ static void __init do_pre_smp_initcalls(void)
  {
  	initcall_t *fn;
  
@@ -66173,7 +66379,7 @@ index b286730..9ff6135 100644
  }
  
  static void run_init_process(const char *init_filename)
-@@ -867,7 +937,7 @@ static int __init kernel_init(void * unused)
+@@ -870,7 +940,7 @@ static int __init kernel_init(void * unused)
  	do_basic_setup();
  
  	/* Open the /dev/console on the rootfs, this should never fail */
@@ -66182,7 +66388,7 @@ index b286730..9ff6135 100644
  		printk(KERN_WARNING "Warning: unable to open an initial console.\n");
  
  	(void) sys_dup(0);
-@@ -880,11 +950,13 @@ static int __init kernel_init(void * unused)
+@@ -883,11 +953,13 @@ static int __init kernel_init(void * unused)
  	if (!ramdisk_execute_command)
  		ramdisk_execute_command = "/init";
  
@@ -72430,7 +72636,7 @@ index 5736170..8e04800 100644
  	return 0;
  }
 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index 3d64b36..dbab433 100644
+index 3d64b36..c6ab69c 100644
 --- a/mm/mempolicy.c
 +++ b/mm/mempolicy.c
 @@ -655,6 +655,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
@@ -72444,7 +72650,7 @@ index 3d64b36..dbab433 100644
  	vma = find_vma(mm, start);
  	if (!vma || vma->vm_start > start)
  		return -EFAULT;
-@@ -691,9 +695,18 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
+@@ -691,9 +695,20 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
  			if (err)
  				goto out;
  		}
@@ -72455,15 +72661,17 @@ index 3d64b36..dbab433 100644
 +
 +#ifdef CONFIG_PAX_SEGMEXEC
 +		vma_m = pax_find_mirror_vma(vma);
-+		err = vma_replace_policy(vma_m, new_pol);
-+		if (err)
-+			goto out;
++		if (vma_m) {
++			err = vma_replace_policy(vma_m, new_pol);
++			if (err)
++				goto out;
++		}
 +#endif
 +
  	}
  
   out:
-@@ -1147,6 +1160,17 @@ static long do_mbind(unsigned long start, unsigned long len,
+@@ -1147,6 +1162,17 @@ static long do_mbind(unsigned long start, unsigned long len,
  
  	if (end < start)
  		return -EINVAL;
@@ -72481,7 +72689,7 @@ index 3d64b36..dbab433 100644
  	if (end == start)
  		return 0;
  
-@@ -1370,8 +1394,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
+@@ -1370,8 +1396,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
  	 */
  	tcred = __task_cred(task);
  	if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) &&
@@ -72491,7 +72699,7 @@ index 3d64b36..dbab433 100644
  		rcu_read_unlock();
  		err = -EPERM;
  		goto out_put;
-@@ -1402,6 +1425,15 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
+@@ -1402,6 +1427,15 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
  		goto out;
  	}
  
@@ -74365,10 +74573,10 @@ index 926b466..b23df53 100644
  	if (!mm || IS_ERR(mm)) {
  		rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
 diff --git a/mm/rmap.c b/mm/rmap.c
-index 0f3b7cd..c5652b6 100644
+index aa95e59..b681a63 100644
 --- a/mm/rmap.c
 +++ b/mm/rmap.c
-@@ -167,6 +167,10 @@ int anon_vma_prepare(struct vm_area_struct *vma)
+@@ -168,6 +168,10 @@ int anon_vma_prepare(struct vm_area_struct *vma)
  	struct anon_vma *anon_vma = vma->anon_vma;
  	struct anon_vma_chain *avc;
  
@@ -74379,7 +74587,7 @@ index 0f3b7cd..c5652b6 100644
  	might_sleep();
  	if (unlikely(!anon_vma)) {
  		struct mm_struct *mm = vma->vm_mm;
-@@ -176,6 +180,12 @@ int anon_vma_prepare(struct vm_area_struct *vma)
+@@ -177,6 +181,12 @@ int anon_vma_prepare(struct vm_area_struct *vma)
  		if (!avc)
  			goto out_enomem;
  
@@ -74392,7 +74600,7 @@ index 0f3b7cd..c5652b6 100644
  		anon_vma = find_mergeable_anon_vma(vma);
  		allocated = NULL;
  		if (!anon_vma) {
-@@ -189,6 +199,18 @@ int anon_vma_prepare(struct vm_area_struct *vma)
+@@ -190,6 +200,18 @@ int anon_vma_prepare(struct vm_area_struct *vma)
  		/* page_table_lock to protect against threads */
  		spin_lock(&mm->page_table_lock);
  		if (likely(!vma->anon_vma)) {
@@ -74411,7 +74619,7 @@ index 0f3b7cd..c5652b6 100644
  			vma->anon_vma = anon_vma;
  			anon_vma_chain_link(vma, avc, anon_vma);
  			allocated = NULL;
-@@ -199,12 +221,24 @@ int anon_vma_prepare(struct vm_area_struct *vma)
+@@ -200,12 +222,24 @@ int anon_vma_prepare(struct vm_area_struct *vma)
  
  		if (unlikely(allocated))
  			put_anon_vma(allocated);
@@ -74436,7 +74644,7 @@ index 0f3b7cd..c5652b6 100644
  	anon_vma_chain_free(avc);
   out_enomem:
  	return -ENOMEM;
-@@ -240,7 +274,7 @@ static inline void unlock_anon_vma_root(struct anon_vma *root)
+@@ -241,7 +275,7 @@ static inline void unlock_anon_vma_root(struct anon_vma *root)
   * Attach the anon_vmas from src to dst.
   * Returns 0 on success, -ENOMEM on failure.
   */
@@ -74445,7 +74653,7 @@ index 0f3b7cd..c5652b6 100644
  {
  	struct anon_vma_chain *avc, *pavc;
  	struct anon_vma *root = NULL;
-@@ -318,7 +352,7 @@ void anon_vma_moveto_tail(struct vm_area_struct *dst)
+@@ -319,7 +353,7 @@ void anon_vma_moveto_tail(struct vm_area_struct *dst)
   * the corresponding VMA in the parent process is attached to.
   * Returns 0 on success, non-zero on failure.
   */
@@ -77077,11 +77285,42 @@ index 2a1383c..ff99572 100644
  	get_random_bytes(&net->ipv4.dev_addr_genid,
  			 sizeof(net->ipv4.dev_addr_genid));
  	return 0;
+diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
+index 813b43a..834857f 100644
+--- a/net/ipv4/tcp_illinois.c
++++ b/net/ipv4/tcp_illinois.c
+@@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext,
+ 			.tcpv_rttcnt = ca->cnt_rtt,
+ 			.tcpv_minrtt = ca->base_rtt,
+ 		};
+-		u64 t = ca->sum_rtt;
+ 
+-		do_div(t, ca->cnt_rtt);
+-		info.tcpv_rtt = t;
++		if (info.tcpv_rttcnt > 0) {
++			u64 t = ca->sum_rtt;
+ 
++			do_div(t, info.tcpv_rttcnt);
++			info.tcpv_rtt = t;
++		}
+ 		nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info);
+ 	}
+ }
 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index d377f48..c2211ed 100644
+index d377f48..f19e3ec 100644
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
-@@ -4728,7 +4728,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
+@@ -4556,6 +4556,9 @@ int tcp_send_rcvq(struct sock *sk, struct msghdr *msg, size_t size)
+ 	struct tcphdr *th;
+ 	bool fragstolen;
+ 
++	if (size == 0)
++		return 0;
++
+ 	skb = alloc_skb(size + sizeof(*th), sk->sk_allocation);
+ 	if (!skb)
+ 		goto err;
+@@ -4728,7 +4731,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
   * simplifies code)
   */
  static void
@@ -77879,6 +78118,31 @@ index 34e4185..8823368 100644
  	} while (!res);
  	return res;
  }
+diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
+index 3bfb34a..69bf48d 100644
+--- a/net/l2tp/l2tp_eth.c
++++ b/net/l2tp/l2tp_eth.c
+@@ -290,6 +290,7 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p
+ 
+ out_del_dev:
+ 	free_netdev(dev);
++	spriv->dev = NULL;
+ out_del_session:
+ 	l2tp_session_delete(session);
+ out:
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index 5746d62..327aa07 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -1074,7 +1074,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
+ 	sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
+ 	sdata->u.ibss.ibss_join_req = jiffies;
+ 
+-	memcpy(sdata->u.ibss.ssid, params->ssid, IEEE80211_MAX_SSID_LEN);
++	memcpy(sdata->u.ibss.ssid, params->ssid, params->ssid_len);
+ 	sdata->u.ibss.ssid_len = params->ssid_len;
+ 
+ 	mutex_unlock(&sdata->u.ibss.mtx);
 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
 index bb61f77..3788d63 100644
 --- a/net/mac80211/ieee80211_i.h
@@ -77901,7 +78165,7 @@ index bb61f77..3788d63 100644
  	/* number of interfaces with corresponding FIF_ flags */
  	int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index bfb57dc..77c4b81 100644
+index c93d395..a305570 100644
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
 @@ -454,7 +454,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
@@ -78037,8 +78301,108 @@ index c97a065..ff61928 100644
  		return -EFAULT;
  
  	return p;
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 0cb4ede..884155d 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -491,6 +491,11 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
+ 
+ 		if (ieee80211_is_action(hdr->frame_control)) {
+ 			u8 category;
++
++			/* make sure category field is present */
++			if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
++				return RX_DROP_MONITOR;
++
+ 			mgmt = (struct ieee80211_mgmt *)hdr;
+ 			category = mgmt->u.action.category;
+ 			if (category != WLAN_CATEGORY_MESH_ACTION &&
+@@ -1426,7 +1431,6 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+ 	frag = sc & IEEE80211_SCTL_FRAG;
+ 
+ 	if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
+-		   (rx->skb)->len < 24 ||
+ 		   is_multicast_ether_addr(hdr->addr1))) {
+ 		/* not fragmented */
+ 		goto out;
+@@ -1849,6 +1853,20 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ 
+ 	hdr = (struct ieee80211_hdr *) skb->data;
+ 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
++
++	/* make sure fixed part of mesh header is there, also checks skb len */
++	if (!pskb_may_pull(rx->skb, hdrlen + 6))
++		return RX_DROP_MONITOR;
++
++	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
++
++	/* make sure full mesh header is there, also checks skb len */
++	if (!pskb_may_pull(rx->skb,
++			   hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
++		return RX_DROP_MONITOR;
++
++	/* reload pointers */
++	hdr = (struct ieee80211_hdr *) skb->data;
+ 	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+ 
+ 	/* frame is in RMC, don't forward */
+@@ -1871,9 +1889,12 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ 		if (is_multicast_ether_addr(hdr->addr1)) {
+ 			mpp_addr = hdr->addr3;
+ 			proxied_addr = mesh_hdr->eaddr1;
+-		} else {
++		} else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
++			/* has_a4 already checked in ieee80211_rx_mesh_check */
+ 			mpp_addr = hdr->addr4;
+ 			proxied_addr = mesh_hdr->eaddr2;
++		} else {
++			return RX_DROP_MONITOR;
+ 		}
+ 
+ 		rcu_read_lock();
+@@ -2313,6 +2334,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
+ 		}
+ 		break;
+ 	case WLAN_CATEGORY_SELF_PROTECTED:
++		if (len < (IEEE80211_MIN_ACTION_SIZE +
++			   sizeof(mgmt->u.action.u.self_prot.action_code)))
++			break;
++
+ 		switch (mgmt->u.action.u.self_prot.action_code) {
+ 		case WLAN_SP_MESH_PEERING_OPEN:
+ 		case WLAN_SP_MESH_PEERING_CLOSE:
+@@ -2331,6 +2356,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
+ 		}
+ 		break;
+ 	case WLAN_CATEGORY_MESH_ACTION:
++		if (len < (IEEE80211_MIN_ACTION_SIZE +
++			   sizeof(mgmt->u.action.u.mesh_action.action_code)))
++			break;
++
+ 		if (!ieee80211_vif_is_mesh(&sdata->vif))
+ 			break;
+ 		if (mesh_action_is_path_sel(mgmt) &&
+@@ -2865,10 +2894,15 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
+ 	if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
+ 		local->dot11ReceivedFragmentCount++;
+ 
+-	if (ieee80211_is_mgmt(fc))
+-		err = skb_linearize(skb);
+-	else
++	if (ieee80211_is_mgmt(fc)) {
++		/* drop frame if too short for header */
++		if (skb->len < ieee80211_hdrlen(fc))
++			err = -ENOBUFS;
++		else
++			err = skb_linearize(skb);
++	} else {
+ 		err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
++	}
+ 
+ 	if (err) {
+ 		dev_kfree_skb(skb);
 diff --git a/net/mac80211/util.c b/net/mac80211/util.c
-index 39b82fe..5469ef4 100644
+index c9b52f7..4da1014 100644
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
 @@ -1251,7 +1251,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
@@ -78420,6 +78784,28 @@ index 7261eb8..44e8ac6 100644
  		sax->fsa_ax25.sax25_call   = nr->source_addr;
  		*uaddr_len = sizeof(struct sockaddr_ax25);
  	}
+diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
+index ddeb9aa..e18fffd 100644
+--- a/net/nfc/llcp/sock.c
++++ b/net/nfc/llcp/sock.c
+@@ -443,15 +443,11 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
+ 	pr_debug("sock %p sk %p flags 0x%x\n", sock, sk, flags);
+ 
+ 	if (!addr || len < sizeof(struct sockaddr_nfc) ||
+-	    addr->sa_family != AF_NFC) {
+-		pr_err("Invalid socket\n");
++	    addr->sa_family != AF_NFC)
+ 		return -EINVAL;
+-	}
+ 
+-	if (addr->service_name_len == 0 && addr->dsap == 0) {
+-		pr_err("Missing service name or dsap\n");
++	if (addr->service_name_len == 0 && addr->dsap == 0)
+ 		return -EINVAL;
+-	}
+ 
+ 	pr_debug("addr dev_idx=%u target_idx=%u protocol=%u\n", addr->dev_idx,
+ 		 addr->target_idx, addr->nfc_protocol);
 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
 index c5c9e2a..4814ab1 100644
 --- a/net/packet/af_packet.c
@@ -79607,6 +79993,27 @@ index bc7430b..35349de 100644
  	struct rfkill *rfkill;
  	struct work_struct rfkill_sync;
  
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 994e2f0..f67aeb1 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -309,7 +309,7 @@ unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb)
+ }
+ EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
+ 
+-static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
++unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
+ {
+ 	int ae = meshhdr->flags & MESH_FLAGS_AE;
+ 	/* 7.1.3.5a.2 */
+@@ -326,6 +326,7 @@ static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
+ 		return 6;
+ 	}
+ }
++EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
+ 
+ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
+ 			   enum nl80211_iftype iftype)
 diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
 index b0eb7aa..7d73e82 100644
 --- a/net/wireless/wext-core.c
@@ -89442,32 +89849,6 @@ index 6789d78..4afd019e 100644
 +	.endm
 +
  #endif
-diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c
-index af0f22f..9a7d479 100644
---- a/usr/gen_init_cpio.c
-+++ b/usr/gen_init_cpio.c
-@@ -303,7 +303,7 @@ static int cpio_mkfile(const char *name, const char *location,
- 	int retval;
- 	int rc = -1;
- 	int namesize;
--	int i;
-+	unsigned int i;
- 
- 	mode |= S_IFREG;
- 
-@@ -392,9 +392,10 @@ static char *cpio_replace_env(char *new_location)
-                        *env_var = *expanded = '\0';
-                        strncat(env_var, start + 2, end - start - 2);
-                        strncat(expanded, new_location, start - new_location);
--                       strncat(expanded, getenv(env_var), PATH_MAX);
--                       strncat(expanded, end + 1, PATH_MAX);
-+                       strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
-+                       strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
-                        strncpy(new_location, expanded, PATH_MAX);
-+                       new_location[PATH_MAX] = 0;
-                } else
-                        break;
-        }
 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
 index d617f69..6b445d2 100644
 --- a/virt/kvm/kvm_main.c