main/linux-grsec: upgrade to 3.14.35 kernel

2 files changed, 449 insertions, 147 deletions

diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 1f11872838..736f0bce33 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -2,7 +2,7 @@
 
 _flavor=grsec
 pkgname=linux-${_flavor}
-pkgver=3.14.34
+pkgver=3.14.35
 case $pkgver in
 *.*.*)	_kernver=${pkgver%.*};;
 *.*)	_kernver=${pkgver};;
@@ -17,7 +17,7 @@ _config=${config:-kernelconfig.${CARCH}}
 install=
 source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz
 	http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz
-	grsecurity-3.1-3.14.34-201502271838.patch
+	grsecurity-3.1-3.14.35-201503071140.patch
 
 	fix-memory-map-for-PIE-applications.patch
 	imx6q-no-unclocked-sleep.patch
@@ -165,24 +165,24 @@ dev() {
 }
 
 md5sums="b621207b3f6ecbb67db18b13258f8ea8  linux-3.14.tar.xz
-757fae0b451af69f63a185c72d889de8  patch-3.14.34.xz
-c1cb512c9b8ea2ce485369b9e2be6e0b  grsecurity-3.1-3.14.34-201502271838.patch
+7db70508b7cb888650f8bc14bca04a03  patch-3.14.35.xz
+d81a6ebd98c282c66cfede4e6a7db170  grsecurity-3.1-3.14.35-201503071140.patch
 c6a4ae7e8ca6159e1631545515805216  fix-memory-map-for-PIE-applications.patch
 1a307fc1d63231bf01d22493a4f14378  imx6q-no-unclocked-sleep.patch
 4ceaeb8adf2cf3353a8327f927aeea1c  kernelconfig.x86
 450ca5bae3629c50c0b0485f3a334508  kernelconfig.x86_64
 e18158a62b940c4b12bafbacd1e00639  kernelconfig.armhf"
 sha256sums="61558aa490855f42b6340d1a1596be47454909629327c49a5e4e10268065dffa  linux-3.14.tar.xz
-efa49c5fcce135b5bf098f628f9b83c2a03ce62c95dfbea047977aa7a9ebd0ca  patch-3.14.34.xz
-f374517c65772d103f63561008dfc09c7ba54d30b5fce04e933742dde2039107  grsecurity-3.1-3.14.34-201502271838.patch
+372a13e28ec4dc16c38e9bf2a01919960844d5c1fec66e7fe49918484c624094  patch-3.14.35.xz
+a520dbd1dbaa4fe36edb1c599783686d3aba5ed39e3105bb400fbd9afdafd31c  grsecurity-3.1-3.14.35-201503071140.patch
 500f3577310be52e87b9fecdc2e9c4ca43210fd97d69089f9005d484563f74c7  fix-memory-map-for-PIE-applications.patch
 21179fbb22a5b74af0a609350ae1a170e232908572b201d02e791d2ce0a685d3  imx6q-no-unclocked-sleep.patch
 1c6eca9c7fef842280bbf4705c01c4535d8fde92e00887e52d2a62a0aefe5f94  kernelconfig.x86
 30cdfc33bf00d1d9a79ea2bc46dfc6a69c2317e05a84ec16b79a4c8015f70ead  kernelconfig.x86_64
 655e230d216896c769ec184cb7ec4f95aea3a13326251ffdf35c17426687d1b9  kernelconfig.armhf"
 sha512sums="5730d83a7a81134c1e77c0bf89e42dee4f8251ad56c1ac2be20c59e26fdfaa7bea55f277e7af156b637f22e1584914a46089af85039177cb43485089c74ac26e  linux-3.14.tar.xz
-60d8be620dc46b1bc53889621eb67d2442ac1437019ae49db875711e304303e78938686c405a127b0657a9017038fada7531f3b4a55a11f379b2f79c74b78c51  patch-3.14.34.xz
-09e63cf3f5ebaf8f38114d7185eb2d2918ef2e0b38559adf2f9d1afb7fed081040cbcae0bb2566b14b7594abe3e32829ef680dc44dd556576ab5eee1152416e5  grsecurity-3.1-3.14.34-201502271838.patch
+f698636b1c06e2694a1e991c2563f43991f75fc3a4c0933b7a2b1e1e0d847df6868c7e7aa4661ed1242b9120d3fa5214e06920feeadec098652a9b8bf7b97be8  patch-3.14.35.xz
+50047e28cd4074369ec82d8895786015952fdc5354e4082eba083fa5a990a017022bd29bbfbce059f2d84d5ffcc70fb0cb8a0e4511fb884fd25fc1b3ae727164  grsecurity-3.1-3.14.35-201503071140.patch
 4665c56ae1bbac311f9205d64918e84ee8b01d47d6e2396ff6b8adfb10aada7f7254531ce62e31edbb65c2a54a830f09ad05d314dfcd75d6272f4068945ad7c7  fix-memory-map-for-PIE-applications.patch
 87d1ad59732f265a5b0db54490dc1762c14ea4b868e7eb1aedc3ce57b48046de7bbc08cf5cfcf6f1380fa84063b0edb16ba3d5e3c5670be9bbb229275c88b221  imx6q-no-unclocked-sleep.patch
 8479492c9c3f9bb08e7f04379bb69574fcf59b63db24392797fa6c73c992aa9d8415b97e96151f20bf5d117d5abc430da08bae4e5fb99ad6d4635bc0fadab85c  kernelconfig.x86
diff --git a/main/linux-grsec/grsecurity-3.1-3.14.34-201502271838.patch b/main/linux-grsec/grsecurity-3.1-3.14.35-201503071140.patch
index 40b130273c..4cf94959ae 100644
--- a/main/linux-grsec/grsecurity-3.1-3.14.34-201502271838.patch
+++ b/main/linux-grsec/grsecurity-3.1-3.14.35-201503071140.patch
@@ -292,7 +292,7 @@ index 5d91ba1..935a4e7 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 5443481..47e9927 100644
+index 9720e86..98643f8 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -1637,7 +1637,7 @@ index df2fbba..63fe3e1 100644
  #include <asm-generic/cmpxchg-local.h>
  
 diff --git a/arch/arm/include/asm/domain.h b/arch/arm/include/asm/domain.h
-index 6ddbe44..b5e38b1 100644
+index 6ddbe44..b5e38b1a 100644
 --- a/arch/arm/include/asm/domain.h
 +++ b/arch/arm/include/asm/domain.h
 @@ -48,18 +48,37 @@
@@ -5565,7 +5565,7 @@ index 25c3502..560dae7 100644
  		down_write(&current->mm->mmap_sem);
  		if (insert_vm_struct(current->mm, vma)) {
 diff --git a/arch/m32r/include/asm/cache.h b/arch/m32r/include/asm/cache.h
-index 40b3ee9..8c2c112 100644
+index 40b3ee98..8c2c112 100644
 --- a/arch/m32r/include/asm/cache.h
 +++ b/arch/m32r/include/asm/cache.h
 @@ -1,8 +1,10 @@
@@ -7197,10 +7197,10 @@ index 81e6ae0..6ab6e79 100644
  	info.si_code = FPE_INTOVF;
  	info.si_signo = SIGFPE;
 diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c
-index 3e0ff8d..9eafbf0b 100644
+index 897c605..c421760 100644
 --- a/arch/mips/kvm/kvm_mips.c
 +++ b/arch/mips/kvm/kvm_mips.c
-@@ -832,7 +832,7 @@ long kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg)
+@@ -835,7 +835,7 @@ long kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg)
  	return r;
  }
  
@@ -8571,10 +8571,22 @@ index 9485b43..3bd3c16 100644
  
  static inline unsigned long clear_user(void __user *addr, unsigned long size)
 diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
-index fcc9a89..07be2bb 100644
+index fcc9a89..10f8e7e 100644
 --- a/arch/powerpc/kernel/Makefile
 +++ b/arch/powerpc/kernel/Makefile
-@@ -26,6 +26,8 @@ CFLAGS_REMOVE_ftrace.o = -pg -mno-sched-epilog
+@@ -14,6 +14,11 @@ CFLAGS_prom_init.o      += -fPIC
+ CFLAGS_btext.o		+= -fPIC
+ endif
+ 
++CFLAGS_REMOVE_cputable.o = $(LATENT_ENTROPY_PLUGIN_CFLAGS)
++CFLAGS_REMOVE_prom_init.o = $(LATENT_ENTROPY_PLUGIN_CFLAGS)
++CFLAGS_REMOVE_btext.o = $(LATENT_ENTROPY_PLUGIN_CFLAGS)
++CFLAGS_REMOVE_prom.o = $(LATENT_ENTROPY_PLUGIN_CFLAGS)
++
+ ifdef CONFIG_FUNCTION_TRACER
+ # Do not trace early boot code
+ CFLAGS_REMOVE_cputable.o = -pg -mno-sched-epilog
+@@ -26,6 +31,8 @@ CFLAGS_REMOVE_ftrace.o = -pg -mno-sched-epilog
  CFLAGS_REMOVE_time.o = -pg -mno-sched-epilog
  endif
  
@@ -23076,7 +23088,7 @@ index c5a9cb9..b6a5426 100644
  
  /*
 diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
-index 02553d6..81f4dc7 100644
+index 02553d6..ff1450f4 100644
 --- a/arch/x86/kernel/entry_64.S
 +++ b/arch/x86/kernel/entry_64.S
 @@ -60,6 +60,8 @@
@@ -23746,7 +23758,7 @@ index 02553d6..81f4dc7 100644
  	.popsection
  
  /*
-@@ -539,7 +1008,7 @@ ENTRY(ret_from_fork)
+@@ -539,25 +1008,26 @@ ENTRY(ret_from_fork)
  
  	RESTORE_REST
  
@@ -23754,9 +23766,19 @@ index 02553d6..81f4dc7 100644
 +	testb $3, CS-ARGOFFSET(%rsp)		# from kernel_thread?
  	jz   1f
  
- 	testl $_TIF_IA32, TI_flags(%rcx)	# 32-bit compat task needs IRET
-@@ -549,15 +1018,13 @@ ENTRY(ret_from_fork)
- 	jmp ret_from_sys_call			# go to the SYSRET fastpath
+-	testl $_TIF_IA32, TI_flags(%rcx)	# 32-bit compat task needs IRET
+-	jnz  int_ret_from_sys_call
+-
+-	RESTORE_TOP_OF_STACK %rdi, -ARGOFFSET
+-	jmp ret_from_sys_call			# go to the SYSRET fastpath
++	/*
++	 * By the time we get here, we have no idea whether our pt_regs,
++	 * ti flags, and ti status came from the 64-bit SYSCALL fast path,
++	 * the slow path, or one of the ia32entry paths.
++	 * Use int_ret_from_sys_call to return, since it can safely handle
++	 * all of the above.
++	 */
++	jmp  int_ret_from_sys_call
  
  1:
 -	subq $REST_SKIP, %rsp	# leave space for volatiles
@@ -23772,7 +23794,7 @@ index 02553d6..81f4dc7 100644
  
  /*
   * System call entry. Up to 6 arguments in registers are supported.
-@@ -594,7 +1061,7 @@ END(ret_from_fork)
+@@ -594,7 +1064,7 @@ END(ret_from_fork)
  ENTRY(system_call)
  	CFI_STARTPROC	simple
  	CFI_SIGNAL_FRAME
@@ -23781,7 +23803,7 @@ index 02553d6..81f4dc7 100644
  	CFI_REGISTER	rip,rcx
  	/*CFI_REGISTER	rflags,r11*/
  	SWAPGS_UNSAFE_STACK
-@@ -607,16 +1074,23 @@ GLOBAL(system_call_after_swapgs)
+@@ -607,16 +1077,23 @@ GLOBAL(system_call_after_swapgs)
  
  	movq	%rsp,PER_CPU_VAR(old_rsp)
  	movq	PER_CPU_VAR(kernel_stack),%rsp
@@ -23807,7 +23829,7 @@ index 02553d6..81f4dc7 100644
  	jnz tracesys
  system_call_fastpath:
  #if __SYSCALL_MASK == ~0
-@@ -640,10 +1114,13 @@ sysret_check:
+@@ -640,10 +1117,13 @@ sysret_check:
  	LOCKDEP_SYS_EXIT
  	DISABLE_INTERRUPTS(CLBR_NONE)
  	TRACE_IRQS_OFF
@@ -23822,7 +23844,7 @@ index 02553d6..81f4dc7 100644
  	/*
  	 * sysretq will re-enable interrupts:
  	 */
-@@ -702,6 +1179,9 @@ auditsys:
+@@ -702,6 +1182,9 @@ auditsys:
  	movq %rax,%rsi			/* 2nd arg: syscall number */
  	movl $AUDIT_ARCH_X86_64,%edi	/* 1st arg: audit arch */
  	call __audit_syscall_entry
@@ -23832,7 +23854,7 @@ index 02553d6..81f4dc7 100644
  	LOAD_ARGS 0		/* reload call-clobbered registers */
  	jmp system_call_fastpath
  
-@@ -723,7 +1203,7 @@ sysret_audit:
+@@ -723,7 +1206,7 @@ sysret_audit:
  	/* Do syscall tracing */
  tracesys:
  #ifdef CONFIG_AUDITSYSCALL
@@ -23841,7 +23863,7 @@ index 02553d6..81f4dc7 100644
  	jz auditsys
  #endif
  	SAVE_REST
-@@ -731,12 +1211,15 @@ tracesys:
+@@ -731,12 +1214,15 @@ tracesys:
  	FIXUP_TOP_OF_STACK %rdi
  	movq %rsp,%rdi
  	call syscall_trace_enter
@@ -23858,7 +23880,7 @@ index 02553d6..81f4dc7 100644
  	RESTORE_REST
  #if __SYSCALL_MASK == ~0
  	cmpq $__NR_syscall_max,%rax
-@@ -766,7 +1249,9 @@ GLOBAL(int_with_check)
+@@ -766,7 +1252,9 @@ GLOBAL(int_with_check)
  	andl %edi,%edx
  	jnz   int_careful
  	andl    $~TS_COMPAT,TI_status(%rcx)
@@ -23869,7 +23891,7 @@ index 02553d6..81f4dc7 100644
  
  	/* Either reschedule or signal or syscall exit tracking needed. */
  	/* First do a reschedule test. */
-@@ -812,7 +1297,7 @@ int_restore_rest:
+@@ -812,7 +1300,7 @@ int_restore_rest:
  	TRACE_IRQS_OFF
  	jmp int_with_check
  	CFI_ENDPROC
@@ -23878,7 +23900,7 @@ index 02553d6..81f4dc7 100644
  
  	.macro FORK_LIKE func
  ENTRY(stub_\func)
-@@ -825,9 +1310,10 @@ ENTRY(stub_\func)
+@@ -825,9 +1313,10 @@ ENTRY(stub_\func)
  	DEFAULT_FRAME 0 8		/* offset 8: return address */
  	call sys_\func
  	RESTORE_TOP_OF_STACK %r11, 8
@@ -23891,7 +23913,7 @@ index 02553d6..81f4dc7 100644
  	.endm
  
  	.macro FIXED_FRAME label,func
-@@ -837,9 +1323,10 @@ ENTRY(\label)
+@@ -837,9 +1326,10 @@ ENTRY(\label)
  	FIXUP_TOP_OF_STACK %r11, 8-ARGOFFSET
  	call \func
  	RESTORE_TOP_OF_STACK %r11, 8-ARGOFFSET
@@ -23903,7 +23925,7 @@ index 02553d6..81f4dc7 100644
  	.endm
  
  	FORK_LIKE  clone
-@@ -847,19 +1334,6 @@ END(\label)
+@@ -847,19 +1337,6 @@ END(\label)
  	FORK_LIKE  vfork
  	FIXED_FRAME stub_iopl, sys_iopl
  
@@ -23923,7 +23945,7 @@ index 02553d6..81f4dc7 100644
  ENTRY(stub_execve)
  	CFI_STARTPROC
  	addq $8, %rsp
-@@ -871,7 +1345,7 @@ ENTRY(stub_execve)
+@@ -871,7 +1348,7 @@ ENTRY(stub_execve)
  	RESTORE_REST
  	jmp int_ret_from_sys_call
  	CFI_ENDPROC
@@ -23932,7 +23954,7 @@ index 02553d6..81f4dc7 100644
  
  /*
   * sigreturn is special because it needs to restore all registers on return.
-@@ -888,7 +1362,7 @@ ENTRY(stub_rt_sigreturn)
+@@ -888,7 +1365,7 @@ ENTRY(stub_rt_sigreturn)
  	RESTORE_REST
  	jmp int_ret_from_sys_call
  	CFI_ENDPROC
@@ -23941,7 +23963,7 @@ index 02553d6..81f4dc7 100644
  
  #ifdef CONFIG_X86_X32_ABI
  ENTRY(stub_x32_rt_sigreturn)
-@@ -902,7 +1376,7 @@ ENTRY(stub_x32_rt_sigreturn)
+@@ -902,7 +1379,7 @@ ENTRY(stub_x32_rt_sigreturn)
  	RESTORE_REST
  	jmp int_ret_from_sys_call
  	CFI_ENDPROC
@@ -23950,7 +23972,7 @@ index 02553d6..81f4dc7 100644
  
  ENTRY(stub_x32_execve)
  	CFI_STARTPROC
-@@ -916,7 +1390,7 @@ ENTRY(stub_x32_execve)
+@@ -916,7 +1393,7 @@ ENTRY(stub_x32_execve)
  	RESTORE_REST
  	jmp int_ret_from_sys_call
  	CFI_ENDPROC
@@ -23959,7 +23981,7 @@ index 02553d6..81f4dc7 100644
  
  #endif
  
-@@ -953,7 +1427,7 @@ vector=vector+1
+@@ -953,7 +1430,7 @@ vector=vector+1
  2:	jmp common_interrupt
  .endr
  	CFI_ENDPROC
@@ -23968,7 +23990,7 @@ index 02553d6..81f4dc7 100644
  
  .previous
  END(interrupt)
-@@ -970,8 +1444,8 @@ END(interrupt)
+@@ -970,8 +1447,8 @@ END(interrupt)
  /* 0(%rsp): ~(interrupt number) */
  	.macro interrupt func
  	/* reserve pt_regs for scratch regs and rbp */
@@ -23979,7 +24001,7 @@ index 02553d6..81f4dc7 100644
  	SAVE_ARGS_IRQ
  	call \func
  	.endm
-@@ -998,14 +1472,14 @@ ret_from_intr:
+@@ -998,14 +1475,14 @@ ret_from_intr:
  
  	/* Restore saved previous stack */
  	popq %rsi
@@ -23998,7 +24020,7 @@ index 02553d6..81f4dc7 100644
  	je retint_kernel
  
  	/* Interrupt came from user space */
-@@ -1027,12 +1501,35 @@ retint_swapgs:		/* return to user-space */
+@@ -1027,12 +1504,35 @@ retint_swapgs:		/* return to user-space */
  	 * The iretq could re-enable interrupts:
  	 */
  	DISABLE_INTERRUPTS(CLBR_ANY)
@@ -24034,7 +24056,7 @@ index 02553d6..81f4dc7 100644
  	/*
  	 * The iretq could re-enable interrupts:
  	 */
-@@ -1070,15 +1567,15 @@ native_irq_return_ldt:
+@@ -1070,15 +1570,15 @@ native_irq_return_ldt:
  	SWAPGS
  	movq PER_CPU_VAR(espfix_waddr),%rdi
  	movq %rax,(0*8)(%rdi)	/* RAX */
@@ -24055,7 +24077,7 @@ index 02553d6..81f4dc7 100644
  	movq %rax,(4*8)(%rdi)
  	andl $0xffff0000,%eax
  	popq_cfi %rdi
-@@ -1132,7 +1629,7 @@ ENTRY(retint_kernel)
+@@ -1132,7 +1632,7 @@ ENTRY(retint_kernel)
  	jmp exit_intr
  #endif
  	CFI_ENDPROC
@@ -24064,7 +24086,7 @@ index 02553d6..81f4dc7 100644
  
  /*
   * End of kprobes section
-@@ -1151,7 +1648,7 @@ ENTRY(\sym)
+@@ -1151,7 +1651,7 @@ ENTRY(\sym)
  	interrupt \do_sym
  	jmp ret_from_intr
  	CFI_ENDPROC
@@ -24073,7 +24095,7 @@ index 02553d6..81f4dc7 100644
  .endm
  
  #ifdef CONFIG_TRACING
-@@ -1239,7 +1736,7 @@ ENTRY(\sym)
+@@ -1239,7 +1739,7 @@ ENTRY(\sym)
  	call \do_sym
  	jmp error_exit		/* %ebx: no swapgs flag */
  	CFI_ENDPROC
@@ -24082,7 +24104,7 @@ index 02553d6..81f4dc7 100644
  .endm
  
  .macro paranoidzeroentry sym do_sym
-@@ -1257,10 +1754,10 @@ ENTRY(\sym)
+@@ -1257,10 +1757,10 @@ ENTRY(\sym)
  	call \do_sym
  	jmp paranoid_exit	/* %ebx: no swapgs flag */
  	CFI_ENDPROC
@@ -24095,7 +24117,7 @@ index 02553d6..81f4dc7 100644
  .macro paranoidzeroentry_ist sym do_sym ist
  ENTRY(\sym)
  	INTR_FRAME
-@@ -1273,12 +1770,18 @@ ENTRY(\sym)
+@@ -1273,12 +1773,18 @@ ENTRY(\sym)
  	TRACE_IRQS_OFF_DEBUG
  	movq %rsp,%rdi		/* pt_regs pointer */
  	xorl %esi,%esi		/* no error code */
@@ -24115,7 +24137,7 @@ index 02553d6..81f4dc7 100644
  .endm
  
  .macro errorentry sym do_sym
-@@ -1296,7 +1799,7 @@ ENTRY(\sym)
+@@ -1296,7 +1802,7 @@ ENTRY(\sym)
  	call \do_sym
  	jmp error_exit			/* %ebx: no swapgs flag */
  	CFI_ENDPROC
@@ -24124,7 +24146,7 @@ index 02553d6..81f4dc7 100644
  .endm
  
  #ifdef CONFIG_TRACING
-@@ -1327,7 +1830,7 @@ ENTRY(\sym)
+@@ -1327,7 +1833,7 @@ ENTRY(\sym)
  	call \do_sym
  	jmp paranoid_exit		/* %ebx: no swapgs flag */
  	CFI_ENDPROC
@@ -24133,7 +24155,7 @@ index 02553d6..81f4dc7 100644
  .endm
  
  zeroentry divide_error do_divide_error
-@@ -1357,9 +1860,10 @@ gs_change:
+@@ -1357,9 +1863,10 @@ gs_change:
  2:	mfence		/* workaround */
  	SWAPGS
  	popfq_cfi
@@ -24145,7 +24167,7 @@ index 02553d6..81f4dc7 100644
  
  	_ASM_EXTABLE(gs_change,bad_gs)
  	.section .fixup,"ax"
-@@ -1387,9 +1891,10 @@ ENTRY(do_softirq_own_stack)
+@@ -1387,9 +1894,10 @@ ENTRY(do_softirq_own_stack)
  	CFI_DEF_CFA_REGISTER	rsp
  	CFI_ADJUST_CFA_OFFSET   -8
  	decl PER_CPU_VAR(irq_count)
@@ -24157,7 +24179,7 @@ index 02553d6..81f4dc7 100644
  
  #ifdef CONFIG_XEN
  zeroentry xen_hypervisor_callback xen_do_hypervisor_callback
-@@ -1427,7 +1932,7 @@ ENTRY(xen_do_hypervisor_callback)   # do_hypervisor_callback(struct *pt_regs)
+@@ -1427,7 +1935,7 @@ ENTRY(xen_do_hypervisor_callback)   # do_hypervisor_callback(struct *pt_regs)
  	decl PER_CPU_VAR(irq_count)
  	jmp  error_exit
  	CFI_ENDPROC
@@ -24166,7 +24188,7 @@ index 02553d6..81f4dc7 100644
  
  /*
   * Hypervisor uses this for application faults while it executes.
-@@ -1486,7 +1991,7 @@ ENTRY(xen_failsafe_callback)
+@@ -1486,7 +1994,7 @@ ENTRY(xen_failsafe_callback)
  	SAVE_ALL
  	jmp error_exit
  	CFI_ENDPROC
@@ -24175,7 +24197,7 @@ index 02553d6..81f4dc7 100644
  
  apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
  	xen_hvm_callback_vector xen_evtchn_do_upcall
-@@ -1538,18 +2043,33 @@ ENTRY(paranoid_exit)
+@@ -1538,18 +2046,33 @@ ENTRY(paranoid_exit)
  	DEFAULT_FRAME
  	DISABLE_INTERRUPTS(CLBR_NONE)
  	TRACE_IRQS_OFF_DEBUG
@@ -24211,7 +24233,7 @@ index 02553d6..81f4dc7 100644
  	jmp irq_return
  paranoid_userspace:
  	GET_THREAD_INFO(%rcx)
-@@ -1578,7 +2098,7 @@ paranoid_schedule:
+@@ -1578,7 +2101,7 @@ paranoid_schedule:
  	TRACE_IRQS_OFF
  	jmp paranoid_userspace
  	CFI_ENDPROC
@@ -24220,7 +24242,7 @@ index 02553d6..81f4dc7 100644
  
  /*
   * Exception entry point. This expects an error code/orig_rax on the stack.
-@@ -1605,12 +2125,23 @@ ENTRY(error_entry)
+@@ -1605,12 +2128,23 @@ ENTRY(error_entry)
  	movq_cfi r14, R14+8
  	movq_cfi r15, R15+8
  	xorl %ebx,%ebx
@@ -24245,7 +24267,7 @@ index 02553d6..81f4dc7 100644
  	ret
  
  /*
-@@ -1644,7 +2175,7 @@ error_bad_iret:
+@@ -1644,7 +2178,7 @@ error_bad_iret:
  	decl %ebx	/* Return to usergs */
  	jmp error_sti
  	CFI_ENDPROC
@@ -24254,7 +24276,7 @@ index 02553d6..81f4dc7 100644
  
  
  /* ebx:	no swapgs flag (1: don't need swapgs, 0: need it) */
-@@ -1655,7 +2186,7 @@ ENTRY(error_exit)
+@@ -1655,7 +2189,7 @@ ENTRY(error_exit)
  	DISABLE_INTERRUPTS(CLBR_NONE)
  	TRACE_IRQS_OFF
  	GET_THREAD_INFO(%rcx)
@@ -24263,7 +24285,7 @@ index 02553d6..81f4dc7 100644
  	jne retint_kernel
  	LOCKDEP_SYS_EXIT_IRQ
  	movl TI_flags(%rcx),%edx
-@@ -1664,7 +2195,7 @@ ENTRY(error_exit)
+@@ -1664,7 +2198,7 @@ ENTRY(error_exit)
  	jnz retint_careful
  	jmp retint_swapgs
  	CFI_ENDPROC
@@ -24272,7 +24294,7 @@ index 02553d6..81f4dc7 100644
  
  /*
   * Test if a given stack is an NMI stack or not.
-@@ -1722,9 +2253,11 @@ ENTRY(nmi)
+@@ -1722,9 +2256,11 @@ ENTRY(nmi)
  	 * If %cs was not the kernel segment, then the NMI triggered in user
  	 * space, which means it is definitely not nested.
  	 */
@@ -24285,7 +24307,7 @@ index 02553d6..81f4dc7 100644
  	/*
  	 * Check the special variable on the stack to see if NMIs are
  	 * executing.
-@@ -1758,8 +2291,7 @@ nested_nmi:
+@@ -1758,8 +2294,7 @@ nested_nmi:
  
  1:
  	/* Set up the interrupted NMIs stack to jump to repeat_nmi */
@@ -24295,7 +24317,7 @@ index 02553d6..81f4dc7 100644
  	CFI_ADJUST_CFA_OFFSET 1*8
  	leaq -10*8(%rsp), %rdx
  	pushq_cfi $__KERNEL_DS
-@@ -1777,6 +2309,7 @@ nested_nmi_out:
+@@ -1777,6 +2312,7 @@ nested_nmi_out:
  	CFI_RESTORE rdx
  
  	/* No need to check faults here */
@@ -24303,7 +24325,7 @@ index 02553d6..81f4dc7 100644
  	INTERRUPT_RETURN
  
  	CFI_RESTORE_STATE
-@@ -1873,13 +2406,13 @@ end_repeat_nmi:
+@@ -1873,13 +2409,13 @@ end_repeat_nmi:
  	subq $ORIG_RAX-R15, %rsp
  	CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
  	/*
@@ -24319,7 +24341,7 @@ index 02553d6..81f4dc7 100644
  	DEFAULT_FRAME 0
  
  	/*
-@@ -1889,9 +2422,9 @@ end_repeat_nmi:
+@@ -1889,9 +2425,9 @@ end_repeat_nmi:
  	 * NMI itself takes a page fault, the page fault that was preempted
  	 * will read the information from the NMI page fault and not the
  	 * origin fault. Save it off and restore it if it changes.
@@ -24331,7 +24353,7 @@ index 02553d6..81f4dc7 100644
  
  	/* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
  	movq %rsp,%rdi
-@@ -1900,31 +2433,36 @@ end_repeat_nmi:
+@@ -1900,31 +2436,36 @@ end_repeat_nmi:
  
  	/* Did the NMI take a page fault? Restore cr2 if it did */
  	movq %cr2, %rcx
@@ -28990,7 +29012,7 @@ index 80c22a3..ec2028e 100644
  
  	vcpu->arch.regs_avail = ~((1 << VCPU_REGS_RIP) | (1 << VCPU_REGS_RSP)
 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index fab97ad..bb69607 100644
+index 1777f89..3f70a2c 100644
 --- a/arch/x86/kvm/x86.c
 +++ b/arch/x86/kvm/x86.c
 @@ -688,6 +688,8 @@ EXPORT_SYMBOL_GPL(kvm_set_cr4);
@@ -29002,7 +29024,7 @@ index fab97ad..bb69607 100644
  	if (cr3 == kvm_read_cr3(vcpu) && !pdptrs_changed(vcpu)) {
  		kvm_mmu_sync_roots(vcpu);
  		kvm_mmu_flush_tlb(vcpu);
-@@ -1806,8 +1808,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
+@@ -1807,8 +1809,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
  {
  	struct kvm *kvm = vcpu->kvm;
  	int lm = is_long_mode(vcpu);
@@ -29013,7 +29035,7 @@ index fab97ad..bb69607 100644
  	u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
  		: kvm->arch.xen_hvm_config.blob_size_32;
  	u32 page_num = data & ~PAGE_MASK;
-@@ -2718,6 +2720,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
+@@ -2719,6 +2721,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
  		if (n < msr_list.nmsrs)
  			goto out;
  		r = -EFAULT;
@@ -29022,7 +29044,7 @@ index fab97ad..bb69607 100644
  		if (copy_to_user(user_msr_list->indices, &msrs_to_save,
  				 num_msrs_to_save * sizeof(u32)))
  			goto out;
-@@ -5532,7 +5536,7 @@ static struct notifier_block pvclock_gtod_notifier = {
+@@ -5533,7 +5537,7 @@ static struct notifier_block pvclock_gtod_notifier = {
  };
  #endif
  
@@ -32640,7 +32662,7 @@ index a10c8c7..35a5abb 100644
 +	return ret ? -EFAULT : 0;
 +}
 diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
-index 207d9aef..69030980 100644
+index 448ee89..88fe381 100644
 --- a/arch/x86/mm/gup.c
 +++ b/arch/x86/mm/gup.c
 @@ -268,7 +268,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
@@ -32680,10 +32702,10 @@ index 4500142..53a363c 100644
  
  	return (void *)vaddr;
 diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
-index 8b977eb..4732c33 100644
+index 006cc91..bf05a83 100644
 --- a/arch/x86/mm/hugetlbpage.c
 +++ b/arch/x86/mm/hugetlbpage.c
-@@ -80,23 +80,24 @@ int pud_huge(pud_t pud)
+@@ -86,23 +86,24 @@ int pud_huge(pud_t pud)
  #ifdef CONFIG_HUGETLB_PAGE
  static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
  		unsigned long addr, unsigned long len,
@@ -32711,7 +32733,7 @@ index 8b977eb..4732c33 100644
  {
  	struct hstate *h = hstate_file(file);
  	struct vm_unmapped_area_info info;
-@@ -108,6 +109,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
+@@ -114,6 +115,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
  	info.high_limit = current->mm->mmap_base;
  	info.align_mask = PAGE_MASK & ~huge_page_mask(h);
  	info.align_offset = 0;
@@ -32719,7 +32741,7 @@ index 8b977eb..4732c33 100644
  	addr = vm_unmapped_area(&info);
  
  	/*
-@@ -120,6 +122,12 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
+@@ -126,6 +128,12 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
  		VM_BUG_ON(addr != -ENOMEM);
  		info.flags = 0;
  		info.low_limit = TASK_UNMAPPED_BASE;
@@ -32732,7 +32754,7 @@ index 8b977eb..4732c33 100644
  		info.high_limit = TASK_SIZE;
  		addr = vm_unmapped_area(&info);
  	}
-@@ -134,10 +142,20 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+@@ -140,10 +148,20 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
  	struct hstate *h = hstate_file(file);
  	struct mm_struct *mm = current->mm;
  	struct vm_area_struct *vma;
@@ -32754,7 +32776,7 @@ index 8b977eb..4732c33 100644
  		return -ENOMEM;
  
  	if (flags & MAP_FIXED) {
-@@ -146,19 +164,22 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+@@ -152,19 +170,22 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
  		return addr;
  	}
  
@@ -33487,10 +33509,10 @@ index d87dd6d..bf3fa66 100644
  
  	pte = kmemcheck_pte_lookup(address);
 diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
-index 25e7e13..1964579 100644
+index 3601ff2..b5ba6f7 100644
 --- a/arch/x86/mm/mmap.c
 +++ b/arch/x86/mm/mmap.c
-@@ -52,7 +52,7 @@ static unsigned int stack_maxrandom_size(void)
+@@ -52,7 +52,7 @@ static unsigned long stack_maxrandom_size(void)
   * Leave an at least ~128 MB hole with possible stack randomization.
   */
  #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
@@ -39955,7 +39977,7 @@ index 18448a7..d5fad43 100644
  
  		/* Force all MSRs to the same value */
 diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
-index 4854f81..d9178cb 100644
+index ef3b8ad..728edfa 100644
 --- a/drivers/cpufreq/cpufreq.c
 +++ b/drivers/cpufreq/cpufreq.c
 @@ -1985,7 +1985,7 @@ void cpufreq_unregister_governor(struct cpufreq_governor *governor)
@@ -45417,10 +45439,10 @@ index 3e6d115..ffecdeb 100644
  /*----------------------------------------------------------------*/
  
 diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index 55de4f6..b1c57fe 100644
+index b96ee9d..1d38b21 100644
 --- a/drivers/md/raid1.c
 +++ b/drivers/md/raid1.c
-@@ -1936,7 +1936,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
+@@ -1937,7 +1937,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
  			if (r1_sync_page_io(rdev, sect, s,
  					    bio->bi_io_vec[idx].bv_page,
  					    READ) != 0)
@@ -45429,7 +45451,7 @@ index 55de4f6..b1c57fe 100644
  		}
  		sectors -= s;
  		sect += s;
-@@ -2170,7 +2170,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk,
+@@ -2171,7 +2171,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk,
  			    !test_bit(Faulty, &rdev->flags)) {
  				if (r1_sync_page_io(rdev, sect, s,
  						    conf->tmppage, READ)) {
@@ -45502,7 +45524,7 @@ index a46124e..caf0bd55 100644
  
  			rdev_dec_pending(rdev, mddev);
 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index 175584a..1561092 100644
+index 3545faf..2977207 100644
 --- a/drivers/md/raid5.c
 +++ b/drivers/md/raid5.c
 @@ -1711,6 +1711,10 @@ static int grow_one_stripe(struct r5conf *conf, int hash)
@@ -48363,7 +48385,7 @@ index fbf7dcd..ad71499 100644
  };
  
 diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
-index 07c942b..bce8b8a 100644
+index 07c942b..747b848 100644
 --- a/drivers/net/macvtap.c
 +++ b/drivers/net/macvtap.c
 @@ -422,7 +422,7 @@ static void macvtap_setup(struct net_device *dev)
@@ -48375,7 +48397,33 @@ index 07c942b..bce8b8a 100644
  	.kind		= "macvtap",
  	.setup		= macvtap_setup,
  	.newlink	= macvtap_newlink,
-@@ -1023,7 +1023,7 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
+@@ -637,12 +637,15 @@ static void macvtap_skb_to_vnet_hdr(const struct sk_buff *skb,
+ 	} /* else everything is zero */
+ }
+ 
++/* Neighbour code has some assumptions on HH_DATA_MOD alignment */
++#define MACVTAP_RESERVE HH_DATA_OFF(ETH_HLEN)
++
+ /* Get packet from user space buffer */
+ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+ 				const struct iovec *iv, unsigned long total_len,
+ 				size_t count, int noblock)
+ {
+-	int good_linear = SKB_MAX_HEAD(NET_IP_ALIGN);
++	int good_linear = SKB_MAX_HEAD(MACVTAP_RESERVE);
+ 	struct sk_buff *skb;
+ 	struct macvlan_dev *vlan;
+ 	unsigned long len = total_len;
+@@ -701,7 +704,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+ 			linear = vnet_hdr.hdr_len;
+ 	}
+ 
+-	skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, copylen,
++	skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen,
+ 				linear, noblock, &err);
+ 	if (!skb)
+ 		goto err;
+@@ -1023,7 +1026,7 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
  		}
  
  		ret = 0;
@@ -48384,7 +48432,7 @@ index 07c942b..bce8b8a 100644
  		    put_user(q->flags, &ifr->ifr_flags))
  			ret = -EFAULT;
  		macvtap_put_vlan(vlan);
-@@ -1193,7 +1193,7 @@ static int macvtap_device_event(struct notifier_block *unused,
+@@ -1193,7 +1196,7 @@ static int macvtap_device_event(struct notifier_block *unused,
  	return NOTIFY_DONE;
  }
  
@@ -53158,10 +53206,10 @@ index 850e232..59a0ccd 100644
  }
  EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
 diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
-index 25c9bc7..24077b7 100644
+index e49616e..d23c58d 100644
 --- a/drivers/tty/pty.c
 +++ b/drivers/tty/pty.c
-@@ -790,8 +790,10 @@ static void __init unix98_pty_init(void)
+@@ -793,8 +793,10 @@ static void __init unix98_pty_init(void)
  		panic("Couldn't register Unix98 pts driver");
  
  	/* Now create the /dev/ptmx special device */
@@ -54276,7 +54324,7 @@ index 9ca7716..a2ccc2e 100644
  				    dev->rawdescriptors[i] + (*ppos - pos),
  				    min(len, alloclen))) {
 diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
-index ef6ec13b..5c6e68e 100644
+index ee6c556..001eb9e 100644
 --- a/drivers/usb/core/hcd.c
 +++ b/drivers/usb/core/hcd.c
 @@ -1550,7 +1550,7 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags)
@@ -54365,7 +54413,7 @@ index 1236c60..d47a51c 100644
  static DEVICE_ATTR_RO(urbnum);
  
 diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
-index 4d11449..f4ccabf 100644
+index a922730..4ae8e1c 100644
 --- a/drivers/usb/core/usb.c
 +++ b/drivers/usb/core/usb.c
 @@ -433,7 +433,7 @@ struct usb_device *usb_alloc_dev(struct usb_device *parent,
@@ -58501,7 +58549,7 @@ index ca0ba15..0fa3257 100644
  				fd_offset + ex.a_text);
  		if (error != N_DATADDR(ex)) {
 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index 67be295..83e2f86 100644
+index f4d7b2f..97fd3fc 100644
 --- a/fs/binfmt_elf.c
 +++ b/fs/binfmt_elf.c
 @@ -34,6 +34,7 @@
@@ -59018,7 +59066,7 @@ index 67be295..83e2f86 100644
   * libraries.  There is no binary dependent code anywhere else.
 @@ -551,6 +912,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
  {
- 	unsigned int random_variable = 0;
+ 	unsigned long random_variable = 0;
  
 +#ifdef CONFIG_PAX_RANDUSTACK
 +	if (current->mm->pax_flags & MF_PAX_RANDMMAP)
@@ -59027,8 +59075,8 @@ index 67be295..83e2f86 100644
 +
  	if ((current->flags & PF_RANDOMIZE) &&
  		!(current->personality & ADDR_NO_RANDOMIZE)) {
- 		random_variable = get_random_int() & STACK_RND_MASK;
-@@ -569,7 +935,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ 		random_variable = (unsigned long) get_random_int();
+@@ -570,7 +936,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
   	unsigned long load_addr = 0, load_bias = 0;
  	int load_addr_set = 0;
  	char * elf_interpreter = NULL;
@@ -59037,7 +59085,7 @@ index 67be295..83e2f86 100644
  	struct elf_phdr *elf_ppnt, *elf_phdata;
  	unsigned long elf_bss, elf_brk;
  	int retval, i;
-@@ -579,12 +945,12 @@ static int load_elf_binary(struct linux_binprm *bprm)
+@@ -580,12 +946,12 @@ static int load_elf_binary(struct linux_binprm *bprm)
  	unsigned long start_code, end_code, start_data, end_data;
  	unsigned long reloc_func_desc __maybe_unused = 0;
  	int executable_stack = EXSTACK_DEFAULT;
@@ -59051,7 +59099,7 @@ index 67be295..83e2f86 100644
  
  	loc = kmalloc(sizeof(*loc), GFP_KERNEL);
  	if (!loc) {
-@@ -720,11 +1086,82 @@ static int load_elf_binary(struct linux_binprm *bprm)
+@@ -721,11 +1087,82 @@ static int load_elf_binary(struct linux_binprm *bprm)
  		goto out_free_dentry;
  
  	/* OK, This is the point of no return */
@@ -59135,7 +59183,7 @@ index 67be295..83e2f86 100644
  	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
  		current->personality |= READ_IMPLIES_EXEC;
  
-@@ -814,6 +1251,20 @@ static int load_elf_binary(struct linux_binprm *bprm)
+@@ -815,6 +1252,20 @@ static int load_elf_binary(struct linux_binprm *bprm)
  #else
  			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
  #endif
@@ -59156,7 +59204,7 @@ index 67be295..83e2f86 100644
  		}
  
  		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
-@@ -846,9 +1297,9 @@ static int load_elf_binary(struct linux_binprm *bprm)
+@@ -847,9 +1298,9 @@ static int load_elf_binary(struct linux_binprm *bprm)
  		 * allowed task size. Note that p_filesz must always be
  		 * <= p_memsz so it is only necessary to check p_memsz.
  		 */
@@ -59169,7 +59217,7 @@ index 67be295..83e2f86 100644
  			/* set_brk can never work. Avoid overflows. */
  			send_sig(SIGKILL, current, 0);
  			retval = -EINVAL;
-@@ -887,17 +1338,45 @@ static int load_elf_binary(struct linux_binprm *bprm)
+@@ -888,17 +1339,45 @@ static int load_elf_binary(struct linux_binprm *bprm)
  		goto out_free_dentry;
  	}
  	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
@@ -59221,7 +59269,7 @@ index 67be295..83e2f86 100644
  					    load_bias);
  		if (!IS_ERR((void *)elf_entry)) {
  			/*
-@@ -1119,7 +1598,7 @@ static bool always_dump_vma(struct vm_area_struct *vma)
+@@ -1120,7 +1599,7 @@ static bool always_dump_vma(struct vm_area_struct *vma)
   * Decide what to dump of a segment, part, all or none.
   */
  static unsigned long vma_dump_size(struct vm_area_struct *vma,
@@ -59230,7 +59278,7 @@ index 67be295..83e2f86 100644
  {
  #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
  
-@@ -1157,7 +1636,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+@@ -1158,7 +1637,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
  	if (vma->vm_file == NULL)
  		return 0;
  
@@ -59239,7 +59287,7 @@ index 67be295..83e2f86 100644
  		goto whole;
  
  	/*
-@@ -1364,9 +1843,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
+@@ -1365,9 +1844,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
  {
  	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
  	int i = 0;
@@ -59251,7 +59299,7 @@ index 67be295..83e2f86 100644
  	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
  }
  
-@@ -1375,7 +1854,7 @@ static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
+@@ -1376,7 +1855,7 @@ static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
  {
  	mm_segment_t old_fs = get_fs();
  	set_fs(KERNEL_DS);
@@ -59260,7 +59308,7 @@ index 67be295..83e2f86 100644
  	set_fs(old_fs);
  	fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata);
  }
-@@ -1999,14 +2478,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
+@@ -2000,14 +2479,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
  }
  
  static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
@@ -59277,7 +59325,7 @@ index 67be295..83e2f86 100644
  	return size;
  }
  
-@@ -2097,7 +2576,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2098,7 +2577,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  
  	dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
  
@@ -59286,7 +59334,7 @@ index 67be295..83e2f86 100644
  	offset += elf_core_extra_data_size();
  	e_shoff = offset;
  
-@@ -2125,7 +2604,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2126,7 +2605,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		phdr.p_offset = offset;
  		phdr.p_vaddr = vma->vm_start;
  		phdr.p_paddr = 0;
@@ -59295,7 +59343,7 @@ index 67be295..83e2f86 100644
  		phdr.p_memsz = vma->vm_end - vma->vm_start;
  		offset += phdr.p_filesz;
  		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -2158,7 +2637,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2159,7 +2638,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		unsigned long addr;
  		unsigned long end;
  
@@ -59304,7 +59352,7 @@ index 67be295..83e2f86 100644
  
  		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
  			struct page *page;
-@@ -2199,6 +2678,167 @@ out:
+@@ -2200,6 +2679,167 @@ out:
  
  #endif		/* CONFIG_ELF_CORE */
  
@@ -59517,7 +59565,7 @@ index 1e86823..8e34695 100644
  	else if (whole->bd_holder != NULL)
  		return false;	 /* is a partition of a held device */
 diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
-index cbd3a7d6f..c6a2881 100644
+index 93de3ba..0e1cf23 100644
 --- a/fs/btrfs/ctree.c
 +++ b/fs/btrfs/ctree.c
 @@ -1216,9 +1216,12 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
@@ -65018,7 +65066,7 @@ index 039f380..4239636 100644
  
  	get_mnt_ns(mnt_ns);
 diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
-index f4ccfe6..a5cf064 100644
+index 02f8d09..a5c25d1 100644
 --- a/fs/nfs/callback_xdr.c
 +++ b/fs/nfs/callback_xdr.c
 @@ -51,7 +51,7 @@ struct callback_op {
@@ -82305,10 +82353,10 @@ index 115bb81..e7b812b 100644
  /*
   * fscache cached network filesystem type
 diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
-index 1c804b0..1432c2b 100644
+index 7ee1774..72505b8 100644
 --- a/include/linux/fsnotify.h
 +++ b/include/linux/fsnotify.h
-@@ -195,6 +195,9 @@ static inline void fsnotify_access(struct file *file)
+@@ -197,6 +197,9 @@ static inline void fsnotify_access(struct file *file)
  	struct inode *inode = file_inode(file);
  	__u32 mask = FS_ACCESS;
  
@@ -82318,7 +82366,7 @@ index 1c804b0..1432c2b 100644
  	if (S_ISDIR(inode->i_mode))
  		mask |= FS_ISDIR;
  
-@@ -213,6 +216,9 @@ static inline void fsnotify_modify(struct file *file)
+@@ -215,6 +218,9 @@ static inline void fsnotify_modify(struct file *file)
  	struct inode *inode = file_inode(file);
  	__u32 mask = FS_MODIFY;
  
@@ -82328,7 +82376,7 @@ index 1c804b0..1432c2b 100644
  	if (S_ISDIR(inode->i_mode))
  		mask |= FS_ISDIR;
  
-@@ -315,7 +321,7 @@ static inline void fsnotify_change(struct dentry *dentry, unsigned int ia_valid)
+@@ -317,7 +323,7 @@ static inline void fsnotify_change(struct dentry *dentry, unsigned int ia_valid)
   */
  static inline const unsigned char *fsnotify_oldname_init(const unsigned char *name)
  {
@@ -83974,6 +84022,41 @@ index 35e7eca..6afb7ad 100644
  
  extern struct ipc_namespace init_ipc_ns;
  extern atomic_t nr_ipc_ns;
+diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
+index 2faef33..33dc081 100644
+--- a/include/linux/ipv6.h
++++ b/include/linux/ipv6.h
+@@ -193,7 +193,7 @@ struct ipv6_pinfo {
+ 	                        sndflow:1,
+ 				repflow:1,
+ 				pmtudisc:3,
+-				ipv6only:1,
++				padding:1,	/* 1 bit hole */
+ 				srcprefs:3,	/* 001: prefer temporary address
+ 						 * 010: prefer public address
+ 						 * 100: prefer care-of address
+@@ -282,8 +282,8 @@ static inline void inet_sk_copy_descendant(struct sock *sk_to,
+ 	__inet_sk_copy_descendant(sk_to, sk_from, ancestor_size);
+ }
+ 
+-#define __ipv6_only_sock(sk)	(inet6_sk(sk)->ipv6only)
+-#define ipv6_only_sock(sk)	((sk)->sk_family == PF_INET6 && __ipv6_only_sock(sk))
++#define __ipv6_only_sock(sk)	(sk->sk_ipv6only)
++#define ipv6_only_sock(sk)	(__ipv6_only_sock(sk))
+ #define ipv6_sk_rxinfo(sk)	((sk)->sk_family == PF_INET6 && \
+ 				 inet6_sk(sk)->rxopt.bits.rxinfo)
+ 
+@@ -296,8 +296,8 @@ static inline const struct in6_addr *inet6_rcv_saddr(const struct sock *sk)
+ 
+ static inline int inet_v6_ipv6only(const struct sock *sk)
+ {
+-	return likely(sk->sk_state != TCP_TIME_WAIT) ?
+-		ipv6_only_sock(sk) : inet_twsk(sk)->tw_ipv6only;
++	/* ipv6only field is at same position for timewait and other sockets */
++	return ipv6_only_sock(sk);
+ }
+ #else
+ #define __ipv6_only_sock(sk)	0
 diff --git a/include/linux/irq.h b/include/linux/irq.h
 index ef1ac9f..e1db06c 100644
 --- a/include/linux/irq.h
@@ -87393,6 +87476,27 @@ index cf92728..9236ee6 100644
  
  /** inet_connection_sock - INET connection oriented sock
   *
+diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
+index 61474ea..6c56603 100644
+--- a/include/net/inet_timewait_sock.h
++++ b/include/net/inet_timewait_sock.h
+@@ -108,6 +108,7 @@ struct inet_timewait_sock {
+ #define tw_family		__tw_common.skc_family
+ #define tw_state		__tw_common.skc_state
+ #define tw_reuse		__tw_common.skc_reuse
++#define tw_ipv6only		__tw_common.skc_ipv6only
+ #define tw_bound_dev_if		__tw_common.skc_bound_dev_if
+ #define tw_node			__tw_common.skc_nulls_node
+ #define tw_bind_node		__tw_common.skc_bind_node
+@@ -131,7 +132,7 @@ struct inet_timewait_sock {
+ 	__be16			tw_sport;
+ 	kmemcheck_bitfield_begin(flags);
+ 	/* And these are ours. */
+-	unsigned int		tw_ipv6only     : 1,
++	unsigned int		tw_pad0		: 1,	/* 1 bit hole */
+ 				tw_transparent  : 1,
+ 				tw_flowlabel	: 20,
+ 				tw_pad		: 2,	/* 2 bits hole */
 diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
 index 823ec7b..44c938c 100644
 --- a/include/net/inetpeer.h
@@ -87878,10 +87982,28 @@ index 0dfcc92..7967849 100644
  
  /* Structure to track chunk fragments that have been acked, but peer
 diff --git a/include/net/sock.h b/include/net/sock.h
-index f66b2b1..5233aa0 100644
+index f66b2b1..b05a13e 100644
 --- a/include/net/sock.h
 +++ b/include/net/sock.h
-@@ -348,7 +348,7 @@ struct sock {
+@@ -181,7 +181,8 @@ struct sock_common {
+ 	unsigned short		skc_family;
+ 	volatile unsigned char	skc_state;
+ 	unsigned char		skc_reuse:4;
+-	unsigned char		skc_reuseport:4;
++	unsigned char		skc_reuseport:1;
++	unsigned char		skc_ipv6only:1;
+ 	int			skc_bound_dev_if;
+ 	union {
+ 		struct hlist_node	skc_bind_node;
+@@ -316,6 +317,7 @@ struct sock {
+ #define sk_state		__sk_common.skc_state
+ #define sk_reuse		__sk_common.skc_reuse
+ #define sk_reuseport		__sk_common.skc_reuseport
++#define sk_ipv6only		__sk_common.skc_ipv6only
+ #define sk_bound_dev_if		__sk_common.skc_bound_dev_if
+ #define sk_bind_node		__sk_common.skc_bind_node
+ #define sk_prot			__sk_common.skc_prot
+@@ -348,7 +350,7 @@ struct sock {
  	unsigned int		sk_napi_id;
  	unsigned int		sk_ll_usec;
  #endif
@@ -87890,7 +88012,7 @@ index f66b2b1..5233aa0 100644
  	int			sk_rcvbuf;
  
  	struct sk_filter __rcu	*sk_filter;
-@@ -1035,7 +1035,7 @@ struct proto {
+@@ -1035,7 +1037,7 @@ struct proto {
  	void			(*destroy_cgroup)(struct mem_cgroup *memcg);
  	struct cg_proto		*(*proto_cgroup)(struct mem_cgroup *memcg);
  #endif
@@ -87899,7 +88021,7 @@ index f66b2b1..5233aa0 100644
  
  /*
   * Bits in struct cg_proto.flags
-@@ -1222,7 +1222,7 @@ static inline u64 memcg_memory_allocated_read(struct cg_proto *prot)
+@@ -1222,7 +1224,7 @@ static inline u64 memcg_memory_allocated_read(struct cg_proto *prot)
  	return ret >> PAGE_SHIFT;
  }
  
@@ -87908,7 +88030,7 @@ index f66b2b1..5233aa0 100644
  sk_memory_allocated(const struct sock *sk)
  {
  	struct proto *prot = sk->sk_prot;
-@@ -1367,7 +1367,7 @@ struct sock_iocb {
+@@ -1367,7 +1369,7 @@ struct sock_iocb {
  	struct scm_cookie	*scm;
  	struct msghdr		*msg, async_msg;
  	struct kiocb		*kiocb;
@@ -87917,7 +88039,7 @@ index f66b2b1..5233aa0 100644
  
  static inline struct sock_iocb *kiocb_to_siocb(struct kiocb *iocb)
  {
-@@ -1829,7 +1829,7 @@ static inline void sk_nocaps_add(struct sock *sk, netdev_features_t flags)
+@@ -1829,7 +1831,7 @@ static inline void sk_nocaps_add(struct sock *sk, netdev_features_t flags)
  }
  
  static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
@@ -87926,7 +88048,7 @@ index f66b2b1..5233aa0 100644
  					   int copy, int offset)
  {
  	if (skb->ip_summed == CHECKSUM_NONE) {
-@@ -2091,7 +2091,7 @@ static inline void sk_stream_moderate_sndbuf(struct sock *sk)
+@@ -2091,7 +2093,7 @@ static inline void sk_stream_moderate_sndbuf(struct sock *sk)
  	}
  }
  
@@ -89951,7 +90073,7 @@ index 8865cae..3530a18 100644
  }
  EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
 diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
-index 0b097c8..11dd5c5 100644
+index 449518e..2658dd6 100644
 --- a/kernel/debug/kdb/kdb_main.c
 +++ b/kernel/debug/kdb/kdb_main.c
 @@ -1977,7 +1977,7 @@ static int kdb_lsmod(int argc, const char **argv)
@@ -90221,10 +90343,17 @@ index 81b3d67..ef189a4 100644
  {
  	struct signal_struct *sig = current->signal;
 diff --git a/kernel/fork.c b/kernel/fork.c
-index e2c6853..9a6397e 100644
+index e2c6853..d5a5c13 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
-@@ -182,6 +182,48 @@ void thread_info_cache_init(void)
+@@ -176,12 +176,54 @@ static void free_thread_info(struct thread_info *ti)
+ void thread_info_cache_init(void)
+ {
+ 	thread_info_cache = kmem_cache_create("thread_info", THREAD_SIZE,
+-					      THREAD_SIZE, 0, NULL);
++					      THREAD_SIZE, SLAB_USERCOPY, NULL);
+ 	BUG_ON(thread_info_cache == NULL);
+ }
  # endif
  #endif
  
@@ -95253,7 +95382,7 @@ index 774a080..7fa60b1 100644
  		*data_page = bpage;
  
 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index 7113672..e8a9c80 100644
+index 813b021..cdd1400 100644
 --- a/kernel/trace/trace.c
 +++ b/kernel/trace/trace.c
 @@ -3412,7 +3412,7 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
@@ -96595,7 +96724,7 @@ index b32b70c..e512eb0 100644
  	set_page_address(page, (void *)vaddr);
  
 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 67d0c17..b22c193 100644
+index 472259b..7a58e99 100644
 --- a/mm/hugetlb.c
 +++ b/mm/hugetlb.c
 @@ -2070,6 +2070,7 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
@@ -102157,6 +102286,19 @@ index f9c0980a..fcbbfeb 100644
  
  	tty_port_close(&dev->port, tty, filp);
  }
+diff --git a/net/bridge/br.c b/net/bridge/br.c
+index 19311aa..339d794 100644
+--- a/net/bridge/br.c
++++ b/net/bridge/br.c
+@@ -49,6 +49,8 @@ static int __init br_init(void)
+ {
+ 	int err;
+ 
++	BUILD_BUG_ON(sizeof(struct br_input_skb_cb) > FIELD_SIZEOF(struct sk_buff, cb));
++
+ 	err = stp_proto_register(&br_stp_proto);
+ 	if (err < 0) {
+ 		pr_err("bridge: can't register sap for STP\n");
 diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
 index e8844d9..df3afa0 100644
 --- a/net/bridge/br_netlink.c
@@ -102919,7 +103061,7 @@ index fdac61c..e5e5b46 100644
  		pr_warn("cannot create /proc/net/%s\n", PG_PROC_DIR);
  		return -ENODEV;
 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index a6613ff..b258926 100644
+index a6613ff..810aa44 100644
 --- a/net/core/rtnetlink.c
 +++ b/net/core/rtnetlink.c
 @@ -58,7 +58,7 @@ struct rtnl_link {
@@ -102957,7 +103099,18 @@ index a6613ff..b258926 100644
  }
  EXPORT_SYMBOL_GPL(__rtnl_link_unregister);
  
-@@ -2689,6 +2692,9 @@ static int rtnl_bridge_setlink(struct sk_buff *skb, struct nlmsghdr *nlh)
+@@ -2010,6 +2013,10 @@ replay:
+ 		if (IS_ERR(dest_net))
+ 			return PTR_ERR(dest_net);
+ 
++		err = -EPERM;
++		if (!netlink_ns_capable(skb, dest_net->user_ns, CAP_NET_ADMIN))
++			goto out;
++
+ 		dev = rtnl_create_link(dest_net, ifname, ops, tb);
+ 		if (IS_ERR(dev)) {
+ 			err = PTR_ERR(dev);
+@@ -2689,6 +2696,9 @@ static int rtnl_bridge_setlink(struct sk_buff *skb, struct nlmsghdr *nlh)
  	if (br_spec) {
  		nla_for_each_nested(attr, br_spec, rem) {
  			if (nla_type(attr) == IFLA_BRIDGE_FLAGS) {
@@ -102967,7 +103120,7 @@ index a6613ff..b258926 100644
  				have_flags = true;
  				flags = nla_get_u16(attr);
  				break;
-@@ -2759,6 +2765,9 @@ static int rtnl_bridge_dellink(struct sk_buff *skb, struct nlmsghdr *nlh)
+@@ -2759,6 +2769,9 @@ static int rtnl_bridge_dellink(struct sk_buff *skb, struct nlmsghdr *nlh)
  	if (br_spec) {
  		nla_for_each_nested(attr, br_spec, rem) {
  			if (nla_type(attr) == IFLA_BRIDGE_FLAGS) {
@@ -103340,6 +103493,23 @@ index cf9cd13..8b56af3 100644
  	.init = sysctl_core_net_init,
  	.exit = sysctl_core_net_exit,
  };
+diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
+index 9e2f78b..c18aad6 100644
+--- a/net/dccp/minisocks.c
++++ b/net/dccp/minisocks.c
+@@ -55,11 +55,9 @@ void dccp_time_wait(struct sock *sk, int state, int timeo)
+ 		const int rto = (icsk->icsk_rto << 2) - (icsk->icsk_rto >> 1);
+ #if IS_ENABLED(CONFIG_IPV6)
+ 		if (tw->tw_family == PF_INET6) {
+-			const struct ipv6_pinfo *np = inet6_sk(sk);
+-
+ 			tw->tw_v6_daddr = sk->sk_v6_daddr;
+ 			tw->tw_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
+-			tw->tw_ipv6only = np->ipv6only;
++			tw->tw_ipv6only = sk->sk_ipv6only;
+ 		}
+ #endif
+ 		/* Linkage updates. */
 diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
 index 4c04848..f575934 100644
 --- a/net/decnet/af_decnet.c
@@ -103967,7 +104137,7 @@ index 2510c02..cfb34fa 100644
  		pr_err("Unable to proc dir entry\n");
  		return -ENOMEM;
 diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
-index 04ce671..d0a62e6 100644
+index 04ce671..f13b8c2 100644
 --- a/net/ipv4/ping.c
 +++ b/net/ipv4/ping.c
 @@ -59,7 +59,7 @@ struct ping_table {
@@ -103979,7 +104149,38 @@ index 04ce671..d0a62e6 100644
  EXPORT_SYMBOL_GPL(pingv6_ops);
  
  static u16 ping_port_rover;
-@@ -350,7 +350,7 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
+@@ -259,6 +259,9 @@ int ping_init_sock(struct sock *sk)
+ 	kgid_t low, high;
+ 	int ret = 0;
+ 
++	if (sk->sk_family == AF_INET6)
++		sk->sk_ipv6only = 1;
++
+ 	inet_get_ping_group_range_net(net, &low, &high);
+ 	if (gid_lte(low, group) && gid_lte(group, high))
+ 		return 0;
+@@ -305,6 +308,11 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
+ 		if (addr_len < sizeof(*addr))
+ 			return -EINVAL;
+ 
++		if (addr->sin_family != AF_INET &&
++		    !(addr->sin_family == AF_UNSPEC &&
++		      addr->sin_addr.s_addr == htonl(INADDR_ANY)))
++			return -EAFNOSUPPORT;
++
+ 		pr_debug("ping_check_bind_addr(sk=%p,addr=%pI4,port=%d)\n",
+ 			 sk, &addr->sin_addr.s_addr, ntohs(addr->sin_port));
+ 
+@@ -330,7 +338,7 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
+ 			return -EINVAL;
+ 
+ 		if (addr->sin6_family != AF_INET6)
+-			return -EINVAL;
++			return -EAFNOSUPPORT;
+ 
+ 		pr_debug("ping_check_bind_addr(sk=%p,addr=%pI6c,port=%d)\n",
+ 			 sk, addr->sin6_addr.s6_addr, ntohs(addr->sin6_port));
+@@ -350,7 +358,7 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
  				return -ENODEV;
  			}
  		}
@@ -103988,7 +104189,7 @@ index 04ce671..d0a62e6 100644
  						    scoped);
  		rcu_read_unlock();
  
-@@ -558,7 +558,7 @@ void ping_err(struct sk_buff *skb, int offset, u32 info)
+@@ -558,7 +566,7 @@ void ping_err(struct sk_buff *skb, int offset, u32 info)
  		}
  #if IS_ENABLED(CONFIG_IPV6)
  	} else if (skb->protocol == htons(ETH_P_IPV6)) {
@@ -103997,7 +104198,7 @@ index 04ce671..d0a62e6 100644
  #endif
  	}
  
-@@ -576,7 +576,7 @@ void ping_err(struct sk_buff *skb, int offset, u32 info)
+@@ -576,7 +584,7 @@ void ping_err(struct sk_buff *skb, int offset, u32 info)
  				      info, (u8 *)icmph);
  #if IS_ENABLED(CONFIG_IPV6)
  		} else if (family == AF_INET6) {
@@ -104006,7 +104207,16 @@ index 04ce671..d0a62e6 100644
  						   info, (u8 *)icmph);
  #endif
  		}
-@@ -860,7 +860,7 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+@@ -716,7 +724,7 @@ static int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
+ 		if (msg->msg_namelen < sizeof(*usin))
+ 			return -EINVAL;
+ 		if (usin->sin_family != AF_INET)
+-			return -EINVAL;
++			return -EAFNOSUPPORT;
+ 		daddr = usin->sin_addr.s_addr;
+ 		/* no remote port */
+ 	} else {
+@@ -860,7 +868,7 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
  			return ip_recv_error(sk, msg, len, addr_len);
  #if IS_ENABLED(CONFIG_IPV6)
  		} else if (family == AF_INET6) {
@@ -104015,7 +104225,7 @@ index 04ce671..d0a62e6 100644
  							  addr_len);
  #endif
  		}
-@@ -918,10 +918,10 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+@@ -918,10 +926,10 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
  		}
  
  		if (inet6_sk(sk)->rxopt.all)
@@ -104028,7 +104238,7 @@ index 04ce671..d0a62e6 100644
  		else if (skb->protocol == htons(ETH_P_IP) && isk->cmsg_flags)
  			ip_cmsg_recv(msg, skb);
  #endif
-@@ -1116,7 +1116,7 @@ static void ping_v4_format_sock(struct sock *sp, struct seq_file *f,
+@@ -1116,7 +1124,7 @@ static void ping_v4_format_sock(struct sock *sp, struct seq_file *f,
  		from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
  		0, sock_i_ino(sp),
  		atomic_read(&sp->sk_refcnt), sp,
@@ -104441,7 +104651,7 @@ index b7effad..70ddfe0 100644
  	}
  
 diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
-index 7a436c5..1b05c59 100644
+index 7a436c5..84279ef 100644
 --- a/net/ipv4/tcp_minisocks.c
 +++ b/net/ipv4/tcp_minisocks.c
 @@ -27,6 +27,10 @@
@@ -104455,6 +104665,15 @@ index 7a436c5..1b05c59 100644
  int sysctl_tcp_syncookies __read_mostly = 1;
  EXPORT_SYMBOL(sysctl_tcp_syncookies);
  
+@@ -298,7 +302,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
+ 			tw->tw_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
+ 			tw->tw_tclass = np->tclass;
+ 			tw->tw_flowlabel = np->flow_label >> 12;
+-			tw->tw_ipv6only = np->ipv6only;
++			tw->tw_ipv6only = sk->sk_ipv6only;
+ 		}
+ #endif
+ 
 @@ -709,7 +713,10 @@ embryonic_reset:
  		 * avoid becoming vulnerable to outside attack aiming at
  		 * resetting legit local connections.
@@ -104826,9 +105045,36 @@ index 3f0ec06..230c2c5 100644
  };
  
 diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
-index d935889..2f64330 100644
+index d935889..d0f3a63 100644
 --- a/net/ipv6/af_inet6.c
 +++ b/net/ipv6/af_inet6.c
+@@ -200,7 +200,7 @@ lookup_protocol:
+ 	np->mcast_hops	= IPV6_DEFAULT_MCASTHOPS;
+ 	np->mc_loop	= 1;
+ 	np->pmtudisc	= IPV6_PMTUDISC_WANT;
+-	np->ipv6only	= net->ipv6.sysctl.bindv6only;
++	sk->sk_ipv6only	= net->ipv6.sysctl.bindv6only;
+ 
+ 	/* Init the ipv4 part of the socket since we can have sockets
+ 	 * using v6 API for ipv4.
+@@ -297,7 +297,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ 		/* Binding to v4-mapped address on a v6-only socket
+ 		 * makes no sense
+ 		 */
+-		if (np->ipv6only) {
++		if (sk->sk_ipv6only) {
+ 			err = -EINVAL;
+ 			goto out;
+ 		}
+@@ -374,7 +374,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ 	if (addr_type != IPV6_ADDR_ANY) {
+ 		sk->sk_userlocks |= SOCK_BINDADDR_LOCK;
+ 		if (addr_type != IPV6_ADDR_MAPPED)
+-			np->ipv6only = 1;
++			sk->sk_ipv6only = 1;
+ 	}
+ 	if (snum)
+ 		sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
 @@ -776,7 +776,7 @@ static int __net_init inet6_net_init(struct net *net)
  	net->ipv6.sysctl.bindv6only = 0;
  	net->ipv6.sysctl.icmpv6_time = 1*HZ;
@@ -104977,9 +105223,18 @@ index 28456c9..13a4115 100644
  	.maxtype	= IFLA_VTI_MAX,
  	.policy		= vti6_policy,
 diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
-index 0a00f44..bec42b2 100644
+index 0a00f44..123e322 100644
 --- a/net/ipv6/ipv6_sockglue.c
 +++ b/net/ipv6/ipv6_sockglue.c
+@@ -235,7 +235,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ 		if (optlen < sizeof(int) ||
+ 		    inet_sk(sk)->inet_num)
+ 			goto e_inval;
+-		np->ipv6only = valbool;
++		sk->sk_ipv6only = valbool;
+ 		retv = 0;
+ 		break;
+ 
 @@ -991,7 +991,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
  		if (sk->sk_type != SOCK_STREAM)
  			return -ENOPROTOOPT;
@@ -104989,6 +105244,15 @@ index 0a00f44..bec42b2 100644
  		msg.msg_controllen = len;
  		msg.msg_flags = flags;
  
+@@ -1058,7 +1058,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
+ 	}
+ 
+ 	case IPV6_V6ONLY:
+-		val = np->ipv6only;
++		val = sk->sk_ipv6only;
+ 		break;
+ 
+ 	case IPV6_RECVPKTINFO:
 diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
 index e080fbb..412b3cf 100644
 --- a/net/ipv6/netfilter/ip6_tables.c
@@ -105081,10 +105345,23 @@ index 767ab8d..c5ec70a 100644
  	return -ENOMEM;
  }
 diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
-index bda7429..469b26b 100644
+index bda7429..5b5bbe3 100644
 --- a/net/ipv6/ping.c
 +++ b/net/ipv6/ping.c
-@@ -246,6 +246,24 @@ static struct pernet_operations ping_v6_net_ops = {
+@@ -103,9 +103,10 @@ int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+ 
+ 	if (msg->msg_name) {
+ 		DECLARE_SOCKADDR(struct sockaddr_in6 *, u, msg->msg_name);
+-		if (msg->msg_namelen < sizeof(struct sockaddr_in6) ||
+-		    u->sin6_family != AF_INET6) {
++		if (msg->msg_namelen < sizeof(*u))
+ 			return -EINVAL;
++		if (u->sin6_family != AF_INET6) {
++			return -EAFNOSUPPORT;
+ 		}
+ 		if (sk->sk_bound_dev_if &&
+ 		    sk->sk_bound_dev_if != u->sin6_scope_id) {
+@@ -246,6 +247,24 @@ static struct pernet_operations ping_v6_net_ops = {
  };
  #endif
  
@@ -105109,7 +105386,7 @@ index bda7429..469b26b 100644
  int __init pingv6_init(void)
  {
  #ifdef CONFIG_PROC_FS
-@@ -253,13 +271,7 @@ int __init pingv6_init(void)
+@@ -253,13 +272,7 @@ int __init pingv6_init(void)
  	if (ret)
  		return ret;
  #endif
@@ -105124,7 +105401,7 @@ index bda7429..469b26b 100644
  	return inet6_register_protosw(&pingv6_protosw);
  }
  
-@@ -268,14 +280,9 @@ int __init pingv6_init(void)
+@@ -268,14 +281,9 @@ int __init pingv6_init(void)
   */
  void pingv6_exit(void)
  {
@@ -105401,10 +105678,10 @@ index a4f890d..5db3708 100644
  	}
  
 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index 20b63d2..31a777d 100644
+index 20b63d2..babfcb8 100644
 --- a/net/ipv6/udp.c
 +++ b/net/ipv6/udp.c
-@@ -76,6 +76,10 @@ static unsigned int udp6_ehashfn(struct net *net,
+@@ -76,10 +76,13 @@ static unsigned int udp6_ehashfn(struct net *net,
  			       udp_ipv6_hash_secret + net_hash_mix(net));
  }
  
@@ -105415,7 +105692,20 @@ index 20b63d2..31a777d 100644
  int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
  {
  	const struct in6_addr *sk2_rcv_saddr6 = inet6_rcv_saddr(sk2);
-@@ -435,7 +439,7 @@ try_again:
+-	int sk_ipv6only = ipv6_only_sock(sk);
+ 	int sk2_ipv6only = inet_v6_ipv6only(sk2);
+ 	int addr_type = ipv6_addr_type(&sk->sk_v6_rcv_saddr);
+ 	int addr_type2 = sk2_rcv_saddr6 ? ipv6_addr_type(sk2_rcv_saddr6) : IPV6_ADDR_MAPPED;
+@@ -95,7 +98,7 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
+ 		return 1;
+ 
+ 	if (addr_type == IPV6_ADDR_ANY &&
+-	    !(sk_ipv6only && addr_type2 == IPV6_ADDR_MAPPED))
++	    !(ipv6_only_sock(sk) && addr_type2 == IPV6_ADDR_MAPPED))
+ 		return 1;
+ 
+ 	if (sk2_rcv_saddr6 &&
+@@ -435,7 +438,7 @@ try_again:
  	if (unlikely(err)) {
  		trace_kfree_skb(skb, udpv6_recvmsg);
  		if (!peeked) {
@@ -105424,7 +105714,7 @@ index 20b63d2..31a777d 100644
  			if (is_udp4)
  				UDP_INC_STATS_USER(sock_net(sk),
  						   UDP_MIB_INERRORS,
-@@ -690,7 +694,7 @@ csum_error:
+@@ -690,7 +693,7 @@ csum_error:
  	UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_CSUMERRORS, is_udplite);
  drop:
  	UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
@@ -105433,7 +105723,7 @@ index 20b63d2..31a777d 100644
  	kfree_skb(skb);
  	return -1;
  }
-@@ -747,7 +751,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
+@@ -747,7 +750,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
  		if (likely(skb1 == NULL))
  			skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
  		if (!skb1) {
@@ -105442,7 +105732,7 @@ index 20b63d2..31a777d 100644
  			UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
  					  IS_UDPLITE(sk));
  			UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
-@@ -886,6 +890,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -886,6 +889,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
  		goto csum_error;
  
  	UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
@@ -105959,6 +106249,18 @@ index 6ff1346..936ca9a 100644
  		return -EFAULT;
  
  	return p;
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index e5a7ac2..dca076f 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -562,6 +562,7 @@ ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
+ 		if (tx->sdata->control_port_no_encrypt)
+ 			info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+ 		info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
++		info->flags |= IEEE80211_TX_CTL_USE_MINRATE;
+ 	}
+ 
+ 	return TX_CONTINUE;
 diff --git a/net/mac80211/util.c b/net/mac80211/util.c
 index 6427625..afa5a5a 100644
 --- a/net/mac80211/util.c