main/linux-virtgrsec: upgrade to 3.18.8

2 files changed, 245 insertions, 266 deletions

diff --git a/main/linux-virtgrsec/APKBUILD b/main/linux-virtgrsec/APKBUILD
index b44d672d4c..a743bec008 100644
--- a/main/linux-virtgrsec/APKBUILD
+++ b/main/linux-virtgrsec/APKBUILD
@@ -3,7 +3,7 @@
 
 _flavor=virtgrsec
 pkgname=linux-${_flavor}
-pkgver=3.18.7
+pkgver=3.18.8
 case $pkgver in
 *.*.*)	_kernver=${pkgver%.*};;
 *.*)	_kernver=${pkgver};;
@@ -18,7 +18,7 @@ _config=${config:-kernelconfig.${CARCH}}
 install=
 source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz
 	http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz
-	grsecurity-3.1-3.18.7-201502222138.patch
+	grsecurity-3.1-3.18.8-201502271843.patch
 	fix-memory-map-for-PIE-applications.patch
 	imx6q-no-unclocked-sleep.patch
 
@@ -146,22 +146,22 @@ dev() {
 }
 
 md5sums="9e854df51ca3fef8bfe566dbd7b89241  linux-3.18.tar.xz
-9db3178b87ddf7c05e6191bf57645610  patch-3.18.7.xz
-7e76bc2553a45e1d97d37c33dcf3411b  grsecurity-3.1-3.18.7-201502222138.patch
+b7bd36ce9f4bff165ee776e2b9263257  patch-3.18.8.xz
+f78dc7e1f77db3049de30f4d498fb2bc  grsecurity-3.1-3.18.8-201502271843.patch
 c6a4ae7e8ca6159e1631545515805216  fix-memory-map-for-PIE-applications.patch
 1a307fc1d63231bf01d22493a4f14378  imx6q-no-unclocked-sleep.patch
 4938a7329976fd579206cb814ee75ef6  kernelconfig.x86
 54daab617c2eab14d08afed2c8321620  kernelconfig.x86_64"
 sha256sums="becc413cc9e6d7f5cc52a3ce66d65c3725bc1d1cc1001f4ce6c32b69eb188cbd  linux-3.18.tar.xz
-2267eee27227c85c6c7aee1ed6a14e1d7f11d70c3048c96bcb1e848fc5ab31ca  patch-3.18.7.xz
-2bfe1b3e6b3eeb10eeca68735e796f98e4856a2014feb2447510239dfce4d636  grsecurity-3.1-3.18.7-201502222138.patch
+c392e435661b8afebffb4c2badf6a82c3c559dee07d13f76450c952ea8ebb3e3  patch-3.18.8.xz
+904daa25b3ac3d23e06c65164d1456a629499dc989f1c62c255250da6a2c404e  grsecurity-3.1-3.18.8-201502271843.patch
 500f3577310be52e87b9fecdc2e9c4ca43210fd97d69089f9005d484563f74c7  fix-memory-map-for-PIE-applications.patch
 21179fbb22a5b74af0a609350ae1a170e232908572b201d02e791d2ce0a685d3  imx6q-no-unclocked-sleep.patch
 baa8e42965fb7e4ab66f99eca6d5959c13919cdc67d31d949da4831b9a4addfa  kernelconfig.x86
 9bfda1dcffa2401e515d57991f105632bd20d316acc4807388f3a04e4879688e  kernelconfig.x86_64"
 sha512sums="2f0b72466e9bc538a675738aa416573d41bbbd7e3e2ffd5b5b127afde609ebc278cec5a3c37e73479607e957c13f1b4ed9782a3795e0dcc2cf8e550228594009  linux-3.18.tar.xz
-a63f56818a3d16f7e39b9967ed751fd6f49837668d533e32ae5bbad7f834e0f3641d9829c27acaf7e65b10581dd1e7d15a05127550627edcd7f9ec7fb5780600  patch-3.18.7.xz
-06cf7a7a77eb7f3601d96fefad98ae993680612cc945d53c2c70ae523af5fe30585818a6246309c65b47ec90a825a45e20b6e78413c725c7bac072add3f92ddf  grsecurity-3.1-3.18.7-201502222138.patch
+11a075e08f03a33af57a2225b29e0db3d422467dcb23439faa1510e89770ba74af08bc01d9a43caf58c130d5261c13f9b3f018020e40cbfe8ef4411d545331a2  patch-3.18.8.xz
+8b487ce70a308d8c27b7b6ed85e6cdee373ff1e7a79711b9c5b3b814b7a54ae8c8ff8cb36ac487c6663d5afb5248ea157e608a463ea35067bec5280c61811ed6  grsecurity-3.1-3.18.8-201502271843.patch
 4665c56ae1bbac311f9205d64918e84ee8b01d47d6e2396ff6b8adfb10aada7f7254531ce62e31edbb65c2a54a830f09ad05d314dfcd75d6272f4068945ad7c7  fix-memory-map-for-PIE-applications.patch
 87d1ad59732f265a5b0db54490dc1762c14ea4b868e7eb1aedc3ce57b48046de7bbc08cf5cfcf6f1380fa84063b0edb16ba3d5e3c5670be9bbb229275c88b221  imx6q-no-unclocked-sleep.patch
 b0f57415a3b29a6e8d414fd2701cabd789d33e1a8ce9278d8e6653acbcf8fe199bf75c3bfb61330f1c1c50d2480d24b74615b65f4bc1300bfcf0a517fa05989f  kernelconfig.x86
diff --git a/main/linux-virtgrsec/grsecurity-3.1-3.18.7-201502222138.patch b/main/linux-virtgrsec/grsecurity-3.1-3.18.8-201502271843.patch
index 1db1bc35e1..70b99d6c00 100644
--- a/main/linux-virtgrsec/grsecurity-3.1-3.18.7-201502222138.patch
+++ b/main/linux-virtgrsec/grsecurity-3.1-3.18.8-201502271843.patch
@@ -370,7 +370,7 @@ index f4c71d4..66811b1 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 0efae22..380e711 100644
+index 0b3f8a1..2b1f2b6 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -298,7 +298,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -21646,10 +21646,22 @@ index 36a8361..e7058c2 100644
  };
  
 diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
-index c6826d1..ad18e14a 100644
+index c6826d1..8dc677e 100644
 --- a/arch/x86/kernel/cpu/microcode/intel.c
 +++ b/arch/x86/kernel/cpu/microcode/intel.c
-@@ -293,13 +293,13 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device,
+@@ -196,6 +196,11 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size,
+ 		struct microcode_header_intel mc_header;
+ 		unsigned int mc_size;
+ 
++		if (leftover < sizeof(mc_header)) {
++			pr_err("error! Truncated header in microcode data file\n");
++			break;
++		}
++
+ 		if (get_ucode_data(&mc_header, ucode_ptr, sizeof(mc_header)))
+ 			break;
+ 
+@@ -293,13 +298,13 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device,
  
  static int get_ucode_user(void *to, const void *from, size_t n)
  {
@@ -21665,6 +21677,23 @@ index c6826d1..ad18e14a 100644
  }
  
  static void microcode_fini_cpu(int cpu)
+diff --git a/arch/x86/kernel/cpu/microcode/intel_early.c b/arch/x86/kernel/cpu/microcode/intel_early.c
+index ec9df6f..420eb93 100644
+--- a/arch/x86/kernel/cpu/microcode/intel_early.c
++++ b/arch/x86/kernel/cpu/microcode/intel_early.c
+@@ -321,7 +321,11 @@ get_matching_model_microcode(int cpu, unsigned long start,
+ 	unsigned int mc_saved_count = mc_saved_data->mc_saved_count;
+ 	int i;
+ 
+-	while (leftover) {
++	while (leftover && mc_saved_count < ARRAY_SIZE(mc_saved_tmp)) {
++
++		if (leftover < sizeof(mc_header))
++			break;
++
+ 		mc_header = (struct microcode_header_intel *)ucode_ptr;
+ 
+ 		mc_size = get_totalsize(mc_header);
 diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
 index ea5f363..cb0e905 100644
 --- a/arch/x86/kernel/cpu/mtrr/main.c
@@ -48414,42 +48443,6 @@ index 2f48f79..8ae1a1a 100644
  
  	spinlock_t request_lock;
  	struct list_head req_list;
-diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
-index 7d76c95..63d7a64 100644
---- a/drivers/net/hyperv/netvsc.c
-+++ b/drivers/net/hyperv/netvsc.c
-@@ -716,7 +716,7 @@ int netvsc_send(struct hv_device *device,
- 	u64 req_id;
- 	unsigned int section_index = NETVSC_INVALID_INDEX;
- 	u32 msg_size = 0;
--	struct sk_buff *skb;
-+	struct sk_buff *skb = NULL;
- 	u16 q_idx = packet->q_idx;
- 
- 
-@@ -743,8 +743,6 @@ int netvsc_send(struct hv_device *device,
- 							   packet);
- 			skb = (struct sk_buff *)
- 			      (unsigned long)packet->send_completion_tid;
--			if (skb)
--				dev_kfree_skb_any(skb);
- 			packet->page_buf_cnt = 0;
- 		}
- 	}
-@@ -807,6 +805,13 @@ int netvsc_send(struct hv_device *device,
- 			   packet, ret);
- 	}
- 
-+	if (ret != 0) {
-+		if (section_index != NETVSC_INVALID_INDEX)
-+			netvsc_free_send_slot(net_device, section_index);
-+	} else if (skb) {
-+		dev_kfree_skb_any(skb);
-+	}
-+
- 	return ret;
- }
- 
 diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
 index 2b86f0b..ecc996f 100644
 --- a/drivers/net/hyperv/rndis_filter.c
@@ -48587,19 +48580,6 @@ index 34924df..a747360 100644
  	.kind			= "nlmon",
  	.priv_size		= sizeof(struct nlmon),
  	.setup			= nlmon_setup,
-diff --git a/drivers/net/ppp/ppp_deflate.c b/drivers/net/ppp/ppp_deflate.c
-index 602c625..b5edc7f 100644
---- a/drivers/net/ppp/ppp_deflate.c
-+++ b/drivers/net/ppp/ppp_deflate.c
-@@ -246,7 +246,7 @@ static int z_compress(void *arg, unsigned char *rptr, unsigned char *obuf,
- 	/*
- 	 * See if we managed to reduce the size of the packet.
- 	 */
--	if (olen < isize) {
-+	if (olen < isize && olen <= osize) {
- 		state->stats.comp_bytes += olen;
- 		state->stats.comp_packets++;
- 	} else {
 diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
 index 794a473..9fd437b 100644
 --- a/drivers/net/ppp/ppp_generic.c
@@ -58395,6 +58375,32 @@ index 6530ced..4a827e2 100644
  		if (limit != RLIM_INFINITY && offset > limit)
  			goto out_sig;
  		if (offset > inode->i_sb->s_maxbytes)
+diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
+index aaf96cb..ac7d921 100644
+--- a/fs/autofs4/dev-ioctl.c
++++ b/fs/autofs4/dev-ioctl.c
+@@ -95,7 +95,7 @@ static int check_dev_ioctl_version(int cmd, struct autofs_dev_ioctl *param)
+  */
+ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in)
+ {
+-	struct autofs_dev_ioctl tmp;
++	struct autofs_dev_ioctl tmp, *res;
+ 
+ 	if (copy_from_user(&tmp, in, sizeof(tmp)))
+ 		return ERR_PTR(-EFAULT);
+@@ -106,7 +106,11 @@ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *i
+ 	if (tmp.size > (PATH_MAX + sizeof(tmp)))
+ 		return ERR_PTR(-ENAMETOOLONG);
+ 
+-	return memdup_user(in, tmp.size);
++	res = memdup_user(in, tmp.size);
++	if (!IS_ERR(res))
++		res->size = tmp.size;
++
++	return res;
+ }
+ 
+ static inline void free_dev_ioctl(struct autofs_dev_ioctl *param)
 diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
 index 116fd38..c04182da 100644
 --- a/fs/autofs4/waitq.c
@@ -60908,10 +60914,30 @@ index 03dca3c..15f326d 100644
  	dcache_init();
  	inode_init();
 diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
-index 05f2960..b012481 100644
+index 05f2960..780f4f8 100644
 --- a/fs/debugfs/inode.c
 +++ b/fs/debugfs/inode.c
-@@ -416,7 +416,11 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
+@@ -246,10 +246,19 @@ static int debugfs_show_options(struct seq_file *m, struct dentry *root)
+ 	return 0;
+ }
+ 
++static void debugfs_evict_inode(struct inode *inode)
++{
++	truncate_inode_pages_final(&inode->i_data);
++	clear_inode(inode);
++	if (S_ISLNK(inode->i_mode))
++		kfree(inode->i_private);
++}
++
+ static const struct super_operations debugfs_super_operations = {
+ 	.statfs		= simple_statfs,
+ 	.remount_fs	= debugfs_remount,
+ 	.show_options	= debugfs_show_options,
++	.evict_inode	= debugfs_evict_inode,
+ };
+ 
+ static int debug_fill_super(struct super_block *sb, void *data, int silent)
+@@ -416,7 +425,11 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
   */
  struct dentry *debugfs_create_dir(const char *name, struct dentry *parent)
  {
@@ -60923,6 +60949,38 @@ index 05f2960..b012481 100644
  				   parent, NULL, NULL);
  }
  EXPORT_SYMBOL_GPL(debugfs_create_dir);
+@@ -466,23 +479,14 @@ static int __debugfs_remove(struct dentry *dentry, struct dentry *parent)
+ 	int ret = 0;
+ 
+ 	if (debugfs_positive(dentry)) {
+-		if (dentry->d_inode) {
+-			dget(dentry);
+-			switch (dentry->d_inode->i_mode & S_IFMT) {
+-			case S_IFDIR:
+-				ret = simple_rmdir(parent->d_inode, dentry);
+-				break;
+-			case S_IFLNK:
+-				kfree(dentry->d_inode->i_private);
+-				/* fall through */
+-			default:
+-				simple_unlink(parent->d_inode, dentry);
+-				break;
+-			}
+-			if (!ret)
+-				d_delete(dentry);
+-			dput(dentry);
+-		}
++		dget(dentry);
++		if (S_ISDIR(dentry->d_inode->i_mode))
++			ret = simple_rmdir(parent->d_inode, dentry);
++		else
++			simple_unlink(parent->d_inode, dentry);
++		if (!ret)
++			d_delete(dentry);
++		dput(dentry);
+ 	}
+ 	return ret;
+ }
 diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
 index 1686dc2..9611c50 100644
 --- a/fs/ecryptfs/inode.c
@@ -60950,7 +61008,7 @@ index e4141f2..d8263e8 100644
  		i += packet_length_size;
  		if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
 diff --git a/fs/exec.c b/fs/exec.c
-index 7302b75..b917171 100644
+index 7302b75..44eb2f8 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
 @@ -56,8 +56,20 @@
@@ -61695,7 +61753,7 @@ index 7302b75..b917171 100644
 +	const char *type;
 +#endif
 +
-+#ifndef CONFIG_STACK_GROWSUP
++#if !defined(CONFIG_STACK_GROWSUP) && !defined(CONFIG_X86_64)
 +	unsigned long stackstart = (unsigned long)task_stack_page(current);
 +	unsigned long currentsp = (unsigned long)&stackstart;
 +	if (unlikely((currentsp < stackstart + 512 ||
@@ -62072,7 +62130,7 @@ index 8313ca3..8a37d08 100644
  		       "MMP failure info: last update time: %llu, last update "
  		       "node: %s, last update device: %s\n",
 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 2c9e686..6a40edc 100644
+index fc7391e..1927b04 100644
 --- a/fs/ext4/super.c
 +++ b/fs/ext4/super.c
 @@ -1254,7 +1254,7 @@ static ext4_fsblk_t get_sb_block(void **data)
@@ -83000,6 +83058,19 @@ index 13eed92..3261c86 100644
  
  void gic_init_bases(unsigned int, int, void __iomem *, void __iomem *,
  		    u32 offset, struct device_node *);
+diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
+index faf433a..7dcb186 100644
+--- a/include/linux/irqdesc.h
++++ b/include/linux/irqdesc.h
+@@ -61,7 +61,7 @@ struct irq_desc {
+ 	unsigned int		irq_count;	/* For detecting broken IRQs */
+ 	unsigned long		last_unhandled;	/* Aging timer for unhandled count */
+ 	unsigned int		irqs_unhandled;
+-	atomic_t		threads_handled;
++	atomic_unchecked_t	threads_handled;
+ 	int			threads_handled_last;
+ 	raw_spinlock_t		lock;
+ 	struct cpumask		*percpu_enabled;
 diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
 index c367cbd..c9b79e6 100644
 --- a/include/linux/jiffies.h
@@ -86445,28 +86516,10 @@ index 80479ab..0c3f647 100644
  		struct rcu_head         rcu;
  		struct inet_peer	*gc_next;
 diff --git a/include/net/ip.h b/include/net/ip.h
-index 0bb6207..1f38247 100644
+index 09cf5ae..ab62fcf 100644
 --- a/include/net/ip.h
 +++ b/include/net/ip.h
-@@ -39,11 +39,12 @@ struct inet_skb_parm {
- 	struct ip_options	opt;		/* Compiled IP options		*/
- 	unsigned char		flags;
- 
--#define IPSKB_FORWARDED		1
--#define IPSKB_XFRM_TUNNEL_SIZE	2
--#define IPSKB_XFRM_TRANSFORMED	4
--#define IPSKB_FRAG_COMPLETE	8
--#define IPSKB_REROUTED		16
-+#define IPSKB_FORWARDED		BIT(0)
-+#define IPSKB_XFRM_TUNNEL_SIZE	BIT(1)
-+#define IPSKB_XFRM_TRANSFORMED	BIT(2)
-+#define IPSKB_FRAG_COMPLETE	BIT(3)
-+#define IPSKB_REROUTED		BIT(4)
-+#define IPSKB_DOREDIRECT	BIT(5)
- 
- 	u16			frag_max_size;
- };
-@@ -316,7 +317,7 @@ static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb)
+@@ -317,7 +317,7 @@ static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb)
  	}
  }
  
@@ -86779,10 +86832,10 @@ index 29d6a94..235d3d84 100644
  };
  
 diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
-index 24945ce..f19e42f 100644
+index 0ffef1a..2ce1ceb 100644
 --- a/include/net/netns/ipv4.h
 +++ b/include/net/netns/ipv4.h
-@@ -83,7 +83,7 @@ struct netns_ipv4 {
+@@ -84,7 +84,7 @@ struct netns_ipv4 {
  
  	struct ping_group_range ping_group_range;
  
@@ -86791,7 +86844,7 @@ index 24945ce..f19e42f 100644
  
  #ifdef CONFIG_SYSCTL
  	unsigned long *sysctl_local_reserved_ports;
-@@ -97,6 +97,6 @@ struct netns_ipv4 {
+@@ -98,6 +98,6 @@ struct netns_ipv4 {
  	struct fib_rules_ops	*mr_rules_ops;
  #endif
  #endif
@@ -89732,6 +89785,32 @@ index b358a80..fc25240 100644
  			gcov_info_unlink(prev, info);
  			if (gcov_events_enabled)
  				gcov_event(GCOV_REMOVE, info);
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 0a9104b..fc260e4 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -869,7 +869,7 @@ static int irq_thread(void *data)
+ 
+ 		action_ret = handler_fn(desc, action);
+ 		if (action_ret == IRQ_HANDLED)
+-			atomic_inc(&desc->threads_handled);
++			atomic_inc_unchecked(&desc->threads_handled);
+ 
+ 		wake_threads_waitq(desc);
+ 	}
+diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c
+index e2514b0..de3dfe0 100644
+--- a/kernel/irq/spurious.c
++++ b/kernel/irq/spurious.c
+@@ -337,7 +337,7 @@ void note_interrupt(unsigned int irq, struct irq_desc *desc,
+ 			 * count. We just care about the count being
+ 			 * different than the one we saw before.
+ 			 */
+-			handled = atomic_read(&desc->threads_handled);
++			handled = atomic_read_unchecked(&desc->threads_handled);
+ 			handled |= SPURIOUS_DEFERRED;
+ 			if (handled != desc->threads_handled_last) {
+ 				action_ret = IRQ_HANDLED;
 diff --git a/kernel/jump_label.c b/kernel/jump_label.c
 index 9019f15..9a3c42e 100644
 --- a/kernel/jump_label.c
@@ -101597,7 +101676,7 @@ index fdbc9a8..cd6972c 100644
  
  	return err;
 diff --git a/net/core/dev.c b/net/core/dev.c
-index 8440968..e14d2b7 100644
+index 9704a5c..1f363d0d 100644
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
 @@ -1683,14 +1683,14 @@ int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
@@ -101978,7 +102057,7 @@ index 443256b..bbff424 100644
  		pr_warn("cannot create /proc/net/%s\n", PG_PROC_DIR);
  		return -ENODEV;
 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index 76321ea..3129bd6 100644
+index ca82629..66264f7 100644
 --- a/net/core/rtnetlink.c
 +++ b/net/core/rtnetlink.c
 @@ -58,7 +58,7 @@ struct rtnl_link {
@@ -102655,20 +102734,6 @@ index 241afd7..31b95d5 100644
  		p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
  		p->rate_tokens = 0;
  		/* 60*HZ is arbitrary, but chosen enough high so that the first
-diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
-index 3a83ce5..787b3c2 100644
---- a/net/ipv4/ip_forward.c
-+++ b/net/ipv4/ip_forward.c
-@@ -129,7 +129,8 @@ int ip_forward(struct sk_buff *skb)
- 	 *	We now generate an ICMP HOST REDIRECT giving the route
- 	 *	we calculated.
- 	 */
--	if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb_sec_path(skb))
-+	if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr &&
-+	    !skb_sec_path(skb))
- 		ip_rt_send_redirect(skb);
- 
- 	skb->priority = rt_tos2priority(iph->tos);
 diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
 index 2811cc1..ad5a534 100644
 --- a/net/ipv4/ip_fragment.c
@@ -102776,42 +102841,11 @@ index 3d4da2c..40f9c29 100644
  					icmp_send(skb, ICMP_DEST_UNREACH,
  						  ICMP_PROT_UNREACH, 0);
  				}
-diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
-index bc6471d..c5e8a0c 100644
---- a/net/ipv4/ip_output.c
-+++ b/net/ipv4/ip_output.c
-@@ -1517,6 +1517,7 @@ static DEFINE_PER_CPU(struct inet_sock, unicast_sock) = {
- 		.sk_wmem_alloc	= ATOMIC_INIT(1),
- 		.sk_allocation	= GFP_ATOMIC,
- 		.sk_flags	= (1UL << SOCK_USE_WRITE_QUEUE),
-+		.sk_pacing_rate = ~0U,
- 	},
- 	.pmtudisc	= IP_PMTUDISC_WANT,
- 	.uc_ttl		= -1,
 diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
-index 9daf217..373d454 100644
+index 046fce0..4b28126 100644
 --- a/net/ipv4/ip_sockglue.c
 +++ b/net/ipv4/ip_sockglue.c
-@@ -443,15 +443,12 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
- 
- 	memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
- 	sin = &errhdr.offender;
--	sin->sin_family = AF_UNSPEC;
-+	memset(sin, 0, sizeof(*sin));
-+
- 	if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP) {
--		struct inet_sock *inet = inet_sk(sk);
--
- 		sin->sin_family = AF_INET;
- 		sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
--		sin->sin_port = 0;
--		memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
--		if (inet->cmsg_flags)
-+		if (inet_sk(sk)->cmsg_flags)
- 			ip_cmsg_recv(msg, skb);
- 	}
- 
-@@ -1177,7 +1174,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+@@ -1173,7 +1173,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
  		len = min_t(unsigned int, len, opt->optlen);
  		if (put_user(len, optlen))
  			return -EFAULT;
@@ -102821,7 +102855,7 @@ index 9daf217..373d454 100644
  			return -EFAULT;
  		return 0;
  	}
-@@ -1308,7 +1306,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+@@ -1304,7 +1305,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
  		if (sk->sk_type != SOCK_STREAM)
  			return -ENOPROTOOPT;
  
@@ -103017,7 +103051,7 @@ index e90f83a..3e6acca 100644
  		pr_err("Unable to proc dir entry\n");
  		return -ENOMEM;
 diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
-index 5d740cc..22c8e65 100644
+index 5638b17..22c8e65 100644
 --- a/net/ipv4/ping.c
 +++ b/net/ipv4/ping.c
 @@ -59,7 +59,7 @@ struct ping_table {
@@ -103069,20 +103103,7 @@ index 5d740cc..22c8e65 100644
  		else if (skb->protocol == htons(ETH_P_IP) && isk->cmsg_flags)
  			ip_cmsg_recv(msg, skb);
  #endif
-@@ -965,8 +965,11 @@ void ping_rcv(struct sk_buff *skb)
- 
- 	sk = ping_lookup(net, skb, ntohs(icmph->un.echo.id));
- 	if (sk != NULL) {
-+		struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
-+
- 		pr_debug("rcv on socket %p\n", sk);
--		ping_queue_rcv_skb(sk, skb_get(skb));
-+		if (skb2)
-+			ping_queue_rcv_skb(sk, skb2);
- 		sock_put(sk);
- 		return;
- 	}
-@@ -1105,7 +1108,7 @@ static void ping_v4_format_sock(struct sock *sp, struct seq_file *f,
+@@ -1108,7 +1108,7 @@ static void ping_v4_format_sock(struct sock *sp, struct seq_file *f,
  		from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
  		0, sock_i_ino(sp),
  		atomic_read(&sp->sk_refcnt), sp,
@@ -103147,7 +103168,7 @@ index 739db31..74f0210 100644
  
  static int raw_seq_show(struct seq_file *seq, void *v)
 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index 6a2155b..47de388 100644
+index d58dd0e..47de388 100644
 --- a/net/ipv4/route.c
 +++ b/net/ipv4/route.c
 @@ -228,7 +228,7 @@ static const struct seq_operations rt_cache_seq_ops = {
@@ -103200,31 +103221,7 @@ index 6a2155b..47de388 100644
  }
  EXPORT_SYMBOL(ip_idents_reserve);
  
-@@ -1554,11 +1554,10 @@ static int __mkroute_input(struct sk_buff *skb,
- 
- 	do_cache = res->fi && !itag;
- 	if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
-+	    skb->protocol == htons(ETH_P_IP) &&
- 	    (IN_DEV_SHARED_MEDIA(out_dev) ||
--	     inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) {
--		flags |= RTCF_DOREDIRECT;
--		do_cache = false;
--	}
-+	     inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
-+		IPCB(skb)->flags |= IPSKB_DOREDIRECT;
- 
- 	if (skb->protocol != htons(ETH_P_IP)) {
- 		/* Not IP (i.e. ARP). Do not create route, if it is
-@@ -2303,6 +2302,8 @@ static int rt_fill_info(struct net *net,  __be32 dst, __be32 src,
- 	r->rtm_flags	= (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
- 	if (rt->rt_flags & RTCF_NOTIFY)
- 		r->rtm_flags |= RTM_F_NOTIFY;
-+	if (IPCB(skb)->flags & IPSKB_DOREDIRECT)
-+		r->rtm_flags |= RTCF_DOREDIRECT;
- 
- 	if (nla_put_be32(skb, RTA_DST, dst))
- 		goto nla_put_failure;
-@@ -2624,34 +2625,34 @@ static struct ctl_table ipv4_route_flush_table[] = {
+@@ -2625,34 +2625,34 @@ static struct ctl_table ipv4_route_flush_table[] = {
  		.maxlen		= sizeof(int),
  		.mode		= 0200,
  		.proc_handler	= ipv4_sysctl_rtcache_flush,
@@ -103267,7 +103264,7 @@ index 6a2155b..47de388 100644
  err_dup:
  	return -ENOMEM;
  }
-@@ -2674,8 +2675,8 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
+@@ -2675,8 +2675,8 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
  
  static __net_init int rt_genid_init(struct net *net)
  {
@@ -103278,7 +103275,7 @@ index 6a2155b..47de388 100644
  	get_random_bytes(&net->ipv4.dev_addr_genid,
  			 sizeof(net->ipv4.dev_addr_genid));
  	return 0;
-@@ -2718,11 +2719,7 @@ int __init ip_rt_init(void)
+@@ -2719,11 +2719,7 @@ int __init ip_rt_init(void)
  {
  	int rc = 0;
  
@@ -103425,7 +103422,7 @@ index d107ee2..bcebf11 100644
  			if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
  				return 1;
 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index ef7089c..a3e65fb 100644
+index 944ce5e..5b83585 100644
 --- a/net/ipv4/tcp_ipv4.c
 +++ b/net/ipv4/tcp_ipv4.c
 @@ -89,6 +89,10 @@ int sysctl_tcp_tw_reuse __read_mostly;
@@ -103439,7 +103436,7 @@ index ef7089c..a3e65fb 100644
  #ifdef CONFIG_TCP_MD5SIG
  static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
  			       __be32 daddr, __be32 saddr, const struct tcphdr *th);
-@@ -1469,6 +1473,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1471,6 +1475,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
  	return 0;
  
  reset:
@@ -103449,7 +103446,7 @@ index ef7089c..a3e65fb 100644
  	tcp_v4_send_reset(rsk, skb);
  discard:
  	kfree_skb(skb);
-@@ -1633,12 +1640,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
+@@ -1635,12 +1642,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
  	TCP_SKB_CB(skb)->sacked	 = 0;
  
  	sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
@@ -103472,7 +103469,7 @@ index ef7089c..a3e65fb 100644
  
  	if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
  		NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
-@@ -1694,6 +1708,10 @@ csum_error:
+@@ -1696,6 +1710,10 @@ csum_error:
  bad_packet:
  		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
  	} else {
@@ -103869,38 +103866,10 @@ index e8c4400..a4cd5da 100644
  	err = ipv6_init_mibs(net);
  	if (err)
 diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
-index 2cdc383..4f1b785 100644
+index 11e3945..4f1b785 100644
 --- a/net/ipv6/datagram.c
 +++ b/net/ipv6/datagram.c
-@@ -383,11 +383,10 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
- 
- 	memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
- 	sin = &errhdr.offender;
--	sin->sin6_family = AF_UNSPEC;
-+	memset(sin, 0, sizeof(*sin));
-+
- 	if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) {
- 		sin->sin6_family = AF_INET6;
--		sin->sin6_flowinfo = 0;
--		sin->sin6_port = 0;
- 		if (np->rxopt.all)
- 			ip6_datagram_recv_common_ctl(sk, msg, skb);
- 		if (skb->protocol == htons(ETH_P_IPV6)) {
-@@ -398,12 +397,9 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
- 				ipv6_iface_scope_id(&sin->sin6_addr,
- 						    IP6CB(skb)->iif);
- 		} else {
--			struct inet_sock *inet = inet_sk(sk);
--
- 			ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
- 					       &sin->sin6_addr);
--			sin->sin6_scope_id = 0;
--			if (inet->cmsg_flags)
-+			if (inet_sk(sk)->cmsg_flags)
- 				ip_cmsg_recv(msg, skb);
- 		}
- 	}
-@@ -928,5 +924,5 @@ void ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp,
+@@ -924,5 +924,5 @@ void ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp,
  		   0,
  		   sock_i_ino(sp),
  		   atomic_read(&sp->sk_refcnt), sp,
@@ -103921,7 +103890,7 @@ index 97ae700..18dcae0 100644
  	table = kmemdup(ipv6_icmp_table_template,
  			sizeof(ipv6_icmp_table_template),
 diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
-index b2d1838..0194c04 100644
+index f1c6d5e..faabef6 100644
 --- a/net/ipv6/ip6_fib.c
 +++ b/net/ipv6/ip6_fib.c
 @@ -99,9 +99,9 @@ static int fib6_new_sernum(struct net *net)
@@ -104335,25 +104304,10 @@ index 1a157ca..9fc05f4 100644
  	return -ENOMEM;
  }
 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
-index a318dd89..42a612c 100644
+index d02ee01..42a612c 100644
 --- a/net/ipv6/route.c
 +++ b/net/ipv6/route.c
-@@ -1150,12 +1150,9 @@ static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
- 		struct net *net = dev_net(dst->dev);
- 
- 		rt6->rt6i_flags |= RTF_MODIFIED;
--		if (mtu < IPV6_MIN_MTU) {
--			u32 features = dst_metric(dst, RTAX_FEATURES);
-+		if (mtu < IPV6_MIN_MTU)
- 			mtu = IPV6_MIN_MTU;
--			features |= RTAX_FEATURE_ALLFRAG;
--			dst_metric_set(dst, RTAX_FEATURES, features);
--		}
-+
- 		dst_metric_set(dst, RTAX_MTU, mtu);
- 		rt6_update_expires(rt6, net->ipv6.sysctl.ip6_rt_mtu_expires);
- 	}
-@@ -2965,7 +2962,7 @@ struct ctl_table ipv6_route_table_template[] = {
+@@ -2962,7 +2962,7 @@ struct ctl_table ipv6_route_table_template[] = {
  
  struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
  {
@@ -104845,6 +104799,43 @@ index 1a3c7e0..80f8b0c 100644
  	if (!llc_proc_dir)
  		goto out;
  
+diff --git a/net/llc/sysctl_net_llc.c b/net/llc/sysctl_net_llc.c
+index 612a5dd..799bafc 100644
+--- a/net/llc/sysctl_net_llc.c
++++ b/net/llc/sysctl_net_llc.c
+@@ -18,28 +18,28 @@ static struct ctl_table llc2_timeout_table[] = {
+ 	{
+ 		.procname	= "ack",
+ 		.data		= &sysctl_llc2_ack_timeout,
+-		.maxlen		= sizeof(long),
++		.maxlen		= sizeof(sysctl_llc2_ack_timeout),
+ 		.mode		= 0644,
+ 		.proc_handler   = proc_dointvec_jiffies,
+ 	},
+ 	{
+ 		.procname	= "busy",
+ 		.data		= &sysctl_llc2_busy_timeout,
+-		.maxlen		= sizeof(long),
++		.maxlen		= sizeof(sysctl_llc2_busy_timeout),
+ 		.mode		= 0644,
+ 		.proc_handler   = proc_dointvec_jiffies,
+ 	},
+ 	{
+ 		.procname	= "p",
+ 		.data		= &sysctl_llc2_p_timeout,
+-		.maxlen		= sizeof(long),
++		.maxlen		= sizeof(sysctl_llc2_p_timeout),
+ 		.mode		= 0644,
+ 		.proc_handler   = proc_dointvec_jiffies,
+ 	},
+ 	{
+ 		.procname	= "rej",
+ 		.data		= &sysctl_llc2_rej_timeout,
+-		.maxlen		= sizeof(long),
++		.maxlen		= sizeof(sysctl_llc2_rej_timeout),
+ 		.mode		= 0644,
+ 		.proc_handler   = proc_dointvec_jiffies,
+ 	},
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
 index 343da1e..509873f 100644
 --- a/net/mac80211/cfg.c
@@ -106361,18 +106352,6 @@ index 6efca30..1259f82 100644
  		linkwatch_fire_event(dev);
  	}
  }
-diff --git a/net/sctp/associola.c b/net/sctp/associola.c
-index f791edd..26d06db 100644
---- a/net/sctp/associola.c
-+++ b/net/sctp/associola.c
-@@ -1182,7 +1182,6 @@ void sctp_assoc_update(struct sctp_association *asoc,
- 	asoc->peer.peer_hmacs = new->peer.peer_hmacs;
- 	new->peer.peer_hmacs = NULL;
- 
--	sctp_auth_key_put(asoc->asoc_shared_key);
- 	sctp_auth_asoc_init_active_key(asoc, GFP_ATOMIC);
- }
- 
 diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
 index 0e4198e..f94193e 100644
 --- a/net/sctp/ipv6.c
@@ -106621,7 +106600,7 @@ index 2e9ada1..40f425d 100644
  
  	table = kmemdup(sctp_net_table, sizeof(sctp_net_table), GFP_KERNEL);
 diff --git a/net/socket.c b/net/socket.c
-index fe20c31..83a0ed6 100644
+index cf9ebf1..9522714 100644
 --- a/net/socket.c
 +++ b/net/socket.c
 @@ -89,6 +89,7 @@
@@ -106659,7 +106638,7 @@ index fe20c31..83a0ed6 100644
  
  static struct file_system_type sock_fs_type = {
  	.name =		"sockfs",
-@@ -1263,6 +1266,8 @@ int __sock_create(struct net *net, int family, int type, int protocol,
+@@ -1260,6 +1263,8 @@ int __sock_create(struct net *net, int family, int type, int protocol,
  		return -EAFNOSUPPORT;
  	if (type < 0 || type >= SOCK_MAX)
  		return -EINVAL;
@@ -106668,7 +106647,7 @@ index fe20c31..83a0ed6 100644
  
  	/* Compatibility.
  
-@@ -1283,6 +1288,20 @@ int __sock_create(struct net *net, int family, int type, int protocol,
+@@ -1280,6 +1285,20 @@ int __sock_create(struct net *net, int family, int type, int protocol,
  	if (err)
  		return err;
  
@@ -106689,7 +106668,7 @@ index fe20c31..83a0ed6 100644
  	/*
  	 *	Allocate the socket and allow the family to set things up. if
  	 *	the protocol is 0, the family is instructed to select an appropriate
-@@ -1534,6 +1553,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
+@@ -1531,6 +1550,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
  	if (sock) {
  		err = move_addr_to_kernel(umyaddr, addrlen, &address);
  		if (err >= 0) {
@@ -106704,7 +106683,7 @@ index fe20c31..83a0ed6 100644
  			err = security_socket_bind(sock,
  						   (struct sockaddr *)&address,
  						   addrlen);
-@@ -1542,6 +1569,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
+@@ -1539,6 +1566,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
  						      (struct sockaddr *)
  						      &address, addrlen);
  		}
@@ -106712,7 +106691,7 @@ index fe20c31..83a0ed6 100644
  		fput_light(sock->file, fput_needed);
  	}
  	return err;
-@@ -1565,10 +1593,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, backlog)
+@@ -1562,10 +1590,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, backlog)
  		if ((unsigned int)backlog > somaxconn)
  			backlog = somaxconn;
  
@@ -106733,7 +106712,7 @@ index fe20c31..83a0ed6 100644
  		fput_light(sock->file, fput_needed);
  	}
  	return err;
-@@ -1612,6 +1650,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
+@@ -1609,6 +1647,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
  	newsock->type = sock->type;
  	newsock->ops = sock->ops;
  
@@ -106752,7 +106731,7 @@ index fe20c31..83a0ed6 100644
  	/*
  	 * We don't need try_module_get here, as the listening socket (sock)
  	 * has the protocol module (sock->ops->owner) held.
-@@ -1657,6 +1707,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
+@@ -1654,6 +1704,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
  	fd_install(newfd, newfile);
  	err = newfd;
  
@@ -106761,7 +106740,7 @@ index fe20c31..83a0ed6 100644
  out_put:
  	fput_light(sock->file, fput_needed);
  out:
-@@ -1689,6 +1741,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
+@@ -1686,6 +1738,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
  		int, addrlen)
  {
  	struct socket *sock;
@@ -106769,7 +106748,7 @@ index fe20c31..83a0ed6 100644
  	struct sockaddr_storage address;
  	int err, fput_needed;
  
-@@ -1699,6 +1752,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
+@@ -1696,6 +1749,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
  	if (err < 0)
  		goto out_put;
  
@@ -106787,7 +106766,7 @@ index fe20c31..83a0ed6 100644
  	err =
  	    security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
  	if (err)
-@@ -1780,6 +1844,8 @@ SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
+@@ -1777,6 +1841,8 @@ SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
   *	the protocol.
   */
  
@@ -106796,7 +106775,7 @@ index fe20c31..83a0ed6 100644
  SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
  		unsigned int, flags, struct sockaddr __user *, addr,
  		int, addr_len)
-@@ -1846,7 +1912,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
+@@ -1843,7 +1909,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
  	struct socket *sock;
  	struct iovec iov;
  	struct msghdr msg;
@@ -106805,7 +106784,7 @@ index fe20c31..83a0ed6 100644
  	int err, err2;
  	int fput_needed;
  
-@@ -2075,7 +2141,7 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -2072,7 +2138,7 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
  		 * checking falls down on this.
  		 */
  		if (copy_from_user(ctl_buf,
@@ -106814,7 +106793,7 @@ index fe20c31..83a0ed6 100644
  				   ctl_len))
  			goto out_freectl;
  		msg_sys->msg_control = ctl_buf;
-@@ -2226,7 +2292,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -2223,7 +2289,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
  	int err, total_len, len;
  
  	/* kernel mode address */
@@ -106823,7 +106802,7 @@ index fe20c31..83a0ed6 100644
  
  	/* user mode address pointers */
  	struct sockaddr __user *uaddr;
-@@ -2255,7 +2321,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -2252,7 +2318,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
  	/* Save the user-mode address (verify_iovec will change the
  	 * kernel msghdr to use the kernel address space)
  	 */
@@ -106832,7 +106811,7 @@ index fe20c31..83a0ed6 100644
  	uaddr_len = COMPAT_NAMELEN(msg);
  	if (MSG_CMSG_COMPAT & flags)
  		err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
-@@ -2896,7 +2962,7 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2893,7 +2959,7 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
  	ifr = compat_alloc_user_space(buf_size);
  	rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
  
@@ -106841,7 +106820,7 @@ index fe20c31..83a0ed6 100644
  		return -EFAULT;
  
  	if (put_user(convert_in ? rxnfc : compat_ptr(data),
-@@ -3007,7 +3073,7 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
+@@ -3004,7 +3070,7 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
  		old_fs = get_fs();
  		set_fs(KERNEL_DS);
  		err = dev_ioctl(net, cmd,
@@ -106850,7 +106829,7 @@ index fe20c31..83a0ed6 100644
  		set_fs(old_fs);
  
  		return err;
-@@ -3100,7 +3166,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
+@@ -3097,7 +3163,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
  
  	old_fs = get_fs();
  	set_fs(KERNEL_DS);
@@ -106859,7 +106838,7 @@ index fe20c31..83a0ed6 100644
  	set_fs(old_fs);
  
  	if (cmd == SIOCGIFMAP && !err) {
-@@ -3184,7 +3250,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
+@@ -3181,7 +3247,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
  		ret |= get_user(rtdev, &(ur4->rt_dev));
  		if (rtdev) {
  			ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
@@ -106868,7 +106847,7 @@ index fe20c31..83a0ed6 100644
  			devname[15] = 0;
  		} else
  			r4.rt_dev = NULL;
-@@ -3411,8 +3477,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
+@@ -3408,8 +3474,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
  	int __user *uoptlen;
  	int err;
  
@@ -106879,7 +106858,7 @@ index fe20c31..83a0ed6 100644
  
  	set_fs(KERNEL_DS);
  	if (level == SOL_SOCKET)
-@@ -3432,7 +3498,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
+@@ -3429,7 +3495,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
  	char __user *uoptval;
  	int err;