main/linux-grsec: upgrade to 3.14.31

2 files changed, 228 insertions, 232 deletions

diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index d8b262eb3..10cc5636c 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -2,7 +2,7 @@
 
 _flavor=grsec
 pkgname=linux-${_flavor}
-pkgver=3.14.30
+pkgver=3.14.31
 case $pkgver in
 *.*.*)	_kernver=${pkgver%.*};;
 *.*)	_kernver=${pkgver};;
@@ -17,7 +17,7 @@ _config=${config:-kernelconfig.${CARCH}}
 install=
 source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz
 	http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz
-	grsecurity-3.0-3.14.30-201501272307.patch
+	grsecurity-3.0-3.14.31-201502021853.patch
 
 	fix-memory-map-for-PIE-applications.patch
 	imx6q-no-unclocked-sleep.patch
@@ -165,24 +165,24 @@ dev() {
 }
 
 md5sums="b621207b3f6ecbb67db18b13258f8ea8  linux-3.14.tar.xz
-d4e6b893a18953a9a908e0559d2b32e0  patch-3.14.30.xz
-679bd4b74910bda35e0f5d5bacbd76eb  grsecurity-3.0-3.14.30-201501272307.patch
+be2e0f3f1ebc124940571ca6130dc478  patch-3.14.31.xz
+228c15c924d4a1d9091a41bf9919ce36  grsecurity-3.0-3.14.31-201502021853.patch
 c6a4ae7e8ca6159e1631545515805216  fix-memory-map-for-PIE-applications.patch
 1a307fc1d63231bf01d22493a4f14378  imx6q-no-unclocked-sleep.patch
 870b91f0eb07294ba453ac61b052c0b6  kernelconfig.x86
 38b50cd1a7670f886c5e9fe9f1f91496  kernelconfig.x86_64
 6709c83fbbd38d40f31d39f0022d4ce9  kernelconfig.armhf"
 sha256sums="61558aa490855f42b6340d1a1596be47454909629327c49a5e4e10268065dffa  linux-3.14.tar.xz
-d49803d1d4d99f8b984d8512d4413b7f03cc140be62de29c8cb7b10e40ae0a66  patch-3.14.30.xz
-8da6bbf7eb97012e27875e0b19075bde4c5c23baff1272e7a97b449c53e5475f  grsecurity-3.0-3.14.30-201501272307.patch
+4eb7743905bad80c8502d88913cfb5424c1772dbe44af30da97ed4198b12e4a1  patch-3.14.31.xz
+8584450f656fe28e621eac2946f0f9cf20250a6a5c8a228f3e51989a449bd90a  grsecurity-3.0-3.14.31-201502021853.patch
 500f3577310be52e87b9fecdc2e9c4ca43210fd97d69089f9005d484563f74c7  fix-memory-map-for-PIE-applications.patch
 21179fbb22a5b74af0a609350ae1a170e232908572b201d02e791d2ce0a685d3  imx6q-no-unclocked-sleep.patch
 bf953a65ba047b5316509da5bc7a6dbcee12767e343d26e8360369d27bfdbe78  kernelconfig.x86
 d555a01f2b464e20cfa71c67ea6d571f80c707c5a3fea33879de09b085e2d7b6  kernelconfig.x86_64
 01a6c90cf0643f8727d120aede2267ca7303c4ebe548c5d19222d4387ceb98cc  kernelconfig.armhf"
 sha512sums="5730d83a7a81134c1e77c0bf89e42dee4f8251ad56c1ac2be20c59e26fdfaa7bea55f277e7af156b637f22e1584914a46089af85039177cb43485089c74ac26e  linux-3.14.tar.xz
-3f68a2131bbd8b91f13974c8c70453c0a3cece930e91a942d175d080be97cf917b85ab3552b39bd480aa803feedd3838717e262e698c555507be92c4d9144a9c  patch-3.14.30.xz
-fcb17d4fb3118a406ad9cbb7e412a244e837cb60a3e0b065deef4a39121db7d1b28efba50cd5cd6ed8ea64338e1e69863da10d0077555f4d54094c68e34a9aa5  grsecurity-3.0-3.14.30-201501272307.patch
+93db5af7a604ebc5012efa7864fb2583db8ff0ca985e0f4194d688808ced3c666ff5271a6a19cf1de8102834bd512370d613bd7d33e186c16069220cf54c16ad  patch-3.14.31.xz
+2cdd0a767e01b8ed05cae5409a956aae82cf16fde662552e5c77a13a106ad00b94cbae50a746b7da0d4b20ed4b2d918f4c0cd57f1740393afc45d47ac1f83755  grsecurity-3.0-3.14.31-201502021853.patch
 4665c56ae1bbac311f9205d64918e84ee8b01d47d6e2396ff6b8adfb10aada7f7254531ce62e31edbb65c2a54a830f09ad05d314dfcd75d6272f4068945ad7c7  fix-memory-map-for-PIE-applications.patch
 87d1ad59732f265a5b0db54490dc1762c14ea4b868e7eb1aedc3ce57b48046de7bbc08cf5cfcf6f1380fa84063b0edb16ba3d5e3c5670be9bbb229275c88b221  imx6q-no-unclocked-sleep.patch
 dde402be39f68955f9395f807631f1457e90cda76a80e0e198695c8f946cdba02a00fe12a59a77bf5e8b40f5ecb52efbe364449f3e58d8996f27e07b719ac6a4  kernelconfig.x86
diff --git a/main/linux-grsec/grsecurity-3.0-3.14.30-201501272307.patch b/main/linux-grsec/grsecurity-3.0-3.14.31-201502021853.patch
index fa3669a5f..7d0e977e5 100644
--- a/main/linux-grsec/grsecurity-3.0-3.14.30-201501272307.patch
+++ b/main/linux-grsec/grsecurity-3.0-3.14.31-201502021853.patch
@@ -292,7 +292,7 @@ index 5d91ba1..935a4e7 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 5b94752..8acf114 100644
+index 5abf670..9b24a3b 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -12350,7 +12350,7 @@ index ad8f795..2c7eec6 100644
  /*
   * Memory returned by kmalloc() may be used for DMA, so we must make
 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 98aa930..9cfc3c7 100644
+index 2f645c9..7e2933c 100644
 --- a/arch/x86/Kconfig
 +++ b/arch/x86/Kconfig
 @@ -22,6 +22,7 @@ config X86_64
@@ -12387,7 +12387,7 @@ index 98aa930..9cfc3c7 100644
  	---help---
  	  Say Y here to enable options for running Linux under various hyper-
  	  visors. This option enables basic hypervisor detection and platform
-@@ -973,6 +975,7 @@ config VM86
+@@ -977,6 +979,7 @@ config VM86
  
  config X86_16BIT
  	bool "Enable support for 16-bit segments" if EXPERT
@@ -12395,7 +12395,7 @@ index 98aa930..9cfc3c7 100644
  	default y
  	---help---
  	  This option is required by programs like Wine to run 16-bit
-@@ -1129,7 +1132,7 @@ choice
+@@ -1133,7 +1136,7 @@ choice
  
  config NOHIGHMEM
  	bool "off"
@@ -12404,7 +12404,7 @@ index 98aa930..9cfc3c7 100644
  	---help---
  	  Linux can use up to 64 Gigabytes of physical memory on x86 systems.
  	  However, the address space of 32-bit x86 processors is only 4
-@@ -1166,7 +1169,7 @@ config NOHIGHMEM
+@@ -1170,7 +1173,7 @@ config NOHIGHMEM
  
  config HIGHMEM4G
  	bool "4GB"
@@ -12413,7 +12413,7 @@ index 98aa930..9cfc3c7 100644
  	---help---
  	  Select this if you have a 32-bit processor and between 1 and 4
  	  gigabytes of physical RAM.
-@@ -1219,7 +1222,7 @@ config PAGE_OFFSET
+@@ -1223,7 +1226,7 @@ config PAGE_OFFSET
  	hex
  	default 0xB0000000 if VMSPLIT_3G_OPT
  	default 0x80000000 if VMSPLIT_2G
@@ -12422,7 +12422,7 @@ index 98aa930..9cfc3c7 100644
  	default 0x40000000 if VMSPLIT_1G
  	default 0xC0000000
  	depends on X86_32
-@@ -1624,6 +1627,7 @@ source kernel/Kconfig.hz
+@@ -1628,6 +1631,7 @@ source kernel/Kconfig.hz
  
  config KEXEC
  	bool "kexec system call"
@@ -12430,7 +12430,7 @@ index 98aa930..9cfc3c7 100644
  	---help---
  	  kexec is a system call that implements the ability to shutdown your
  	  current kernel, and to start another kernel.  It is like a reboot
-@@ -1775,7 +1779,9 @@ config X86_NEED_RELOCS
+@@ -1779,7 +1783,9 @@ config X86_NEED_RELOCS
  
  config PHYSICAL_ALIGN
  	hex "Alignment value to which kernel should be aligned"
@@ -12441,7 +12441,7 @@ index 98aa930..9cfc3c7 100644
  	range 0x2000 0x1000000 if X86_32
  	range 0x200000 0x1000000 if X86_64
  	---help---
-@@ -1855,9 +1861,10 @@ config DEBUG_HOTPLUG_CPU0
+@@ -1859,9 +1865,10 @@ config DEBUG_HOTPLUG_CPU0
  	  If unsure, say N.
  
  config COMPAT_VDSO
@@ -12716,7 +12716,7 @@ index 34bbc09..c126b87 100644
  	.quad   0x0000000000000000	/* TS continued */
  gdt_end:
 diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
-index eb25ca1..3de0f7c 100644
+index 8f45c85..fc8346a 100644
 --- a/arch/x86/boot/compressed/misc.c
 +++ b/arch/x86/boot/compressed/misc.c
 @@ -218,7 +218,7 @@ void __putstr(const char *s)
@@ -12764,7 +12764,7 @@ index eb25ca1..3de0f7c 100644
  			break;
  		default: /* Ignore other PT_* */ break;
  		}
-@@ -437,7 +440,7 @@ asmlinkage void *decompress_kernel(void *rmode, memptr heap,
+@@ -439,7 +442,7 @@ asmlinkage void *decompress_kernel(void *rmode, memptr heap,
  		error("Destination address too large");
  #endif
  #ifndef CONFIG_RELOCATABLE
@@ -16387,7 +16387,7 @@ index 1717156..14e260a 100644
  			     "6:\n"
  			     ".previous\n"
 diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
-index 50d033a..59ecefa 100644
+index a94b82e..59ecefa 100644
 --- a/arch/x86/include/asm/desc.h
 +++ b/arch/x86/include/asm/desc.h
 @@ -4,6 +4,7 @@
@@ -16485,7 +16485,7 @@ index 50d033a..59ecefa 100644
  }
  
  static inline void native_load_gdt(const struct desc_ptr *dtr)
-@@ -247,11 +258,14 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
+@@ -247,8 +258,10 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
  	struct desc_struct *gdt = get_cpu_gdt_table(cpu);
  	unsigned int i;
  
@@ -16495,37 +16495,8 @@ index 50d033a..59ecefa 100644
 +	pax_close_kernel();
  }
  
--#define _LDT_empty(info)				\
-+/* This intentionally ignores lm, since 32-bit apps don't have that field. */
-+#define LDT_empty(info)					\
- 	((info)->base_addr		== 0	&&	\
- 	 (info)->limit			== 0	&&	\
- 	 (info)->contents		== 0	&&	\
-@@ -261,11 +275,18 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
- 	 (info)->seg_not_present	== 1	&&	\
- 	 (info)->useable		== 0)
- 
--#ifdef CONFIG_X86_64
--#define LDT_empty(info) (_LDT_empty(info) && ((info)->lm == 0))
--#else
--#define LDT_empty(info) (_LDT_empty(info))
--#endif
-+/* Lots of programs expect an all-zero user_desc to mean "no segment at all". */
-+static inline bool LDT_zero(const struct user_desc *info)
-+{
-+	return (info->base_addr		== 0 &&
-+		info->limit		== 0 &&
-+		info->contents		== 0 &&
-+		info->read_exec_only	== 0 &&
-+		info->seg_32bit		== 0 &&
-+		info->limit_in_pages	== 0 &&
-+		info->seg_not_present	== 0 &&
-+		info->useable		== 0);
-+}
- 
- static inline void clear_LDT(void)
- {
-@@ -287,7 +308,7 @@ static inline void load_LDT(mm_context_t *pc)
+ /* This intentionally ignores lm, since 32-bit apps don't have that field. */
+@@ -295,7 +308,7 @@ static inline void load_LDT(mm_context_t *pc)
  	preempt_enable();
  }
  
@@ -16534,7 +16505,7 @@ index 50d033a..59ecefa 100644
  {
  	return (unsigned)(desc->base0 | ((desc->base1) << 16) | ((desc->base2) << 24));
  }
-@@ -311,7 +332,7 @@ static inline void set_desc_limit(struct desc_struct *desc, unsigned long limit)
+@@ -319,7 +332,7 @@ static inline void set_desc_limit(struct desc_struct *desc, unsigned long limit)
  }
  
  #ifdef CONFIG_X86_64
@@ -16543,7 +16514,7 @@ index 50d033a..59ecefa 100644
  {
  	gate_desc s;
  
-@@ -321,14 +342,14 @@ static inline void set_nmi_gate(int gate, void *addr)
+@@ -329,14 +342,14 @@ static inline void set_nmi_gate(int gate, void *addr)
  #endif
  
  #ifdef CONFIG_TRACING
@@ -16561,7 +16532,7 @@ index 50d033a..59ecefa 100644
  				   unsigned dpl, unsigned ist, unsigned seg)
  {
  	gate_desc s;
-@@ -348,7 +369,7 @@ static inline void write_trace_idt_entry(int entry, const gate_desc *gate)
+@@ -356,7 +369,7 @@ static inline void write_trace_idt_entry(int entry, const gate_desc *gate)
  #define _trace_set_gate(gate, type, addr, dpl, ist, seg)
  #endif
  
@@ -16570,7 +16541,7 @@ index 50d033a..59ecefa 100644
  			     unsigned dpl, unsigned ist, unsigned seg)
  {
  	gate_desc s;
-@@ -371,9 +392,9 @@ static inline void _set_gate(int gate, unsigned type, void *addr,
+@@ -379,9 +392,9 @@ static inline void _set_gate(int gate, unsigned type, void *addr,
  #define set_intr_gate(n, addr)						\
  	do {								\
  		BUG_ON((unsigned)n > 0xFF);				\
@@ -16582,7 +16553,7 @@ index 50d033a..59ecefa 100644
  				0, 0, __KERNEL_CS);			\
  	} while (0)
  
-@@ -401,19 +422,19 @@ static inline void alloc_system_vector(int vector)
+@@ -409,19 +422,19 @@ static inline void alloc_system_vector(int vector)
  /*
   * This routine sets up an interrupt gate at directory privilege level 3.
   */
@@ -16605,7 +16576,7 @@ index 50d033a..59ecefa 100644
  {
  	BUG_ON((unsigned)n > 0xFF);
  	_set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
-@@ -422,16 +443,16 @@ static inline void set_trap_gate(unsigned int n, void *addr)
+@@ -430,16 +443,16 @@ static inline void set_trap_gate(unsigned int n, void *addr)
  static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
  {
  	BUG_ON((unsigned)n > 0xFF);
@@ -16625,7 +16596,7 @@ index 50d033a..59ecefa 100644
  {
  	BUG_ON((unsigned)n > 0xFF);
  	_set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
-@@ -503,4 +524,17 @@ static inline void load_current_idt(void)
+@@ -511,4 +524,17 @@ static inline void load_current_idt(void)
  	else
  		load_idt((const struct desc_ptr *)&idt_descr);
  }
@@ -27866,49 +27837,10 @@ index 24d3c91..d06b473 100644
  	return pc;
  }
 diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
-index 4e942f3..c6e445a 100644
+index 7fc5e84..c6e445a 100644
 --- a/arch/x86/kernel/tls.c
 +++ b/arch/x86/kernel/tls.c
-@@ -29,7 +29,28 @@ static int get_free_idx(void)
- 
- static bool tls_desc_okay(const struct user_desc *info)
- {
--	if (LDT_empty(info))
-+	/*
-+	 * For historical reasons (i.e. no one ever documented how any
-+	 * of the segmentation APIs work), user programs can and do
-+	 * assume that a struct user_desc that's all zeros except for
-+	 * entry_number means "no segment at all".  This never actually
-+	 * worked.  In fact, up to Linux 3.19, a struct user_desc like
-+	 * this would create a 16-bit read-write segment with base and
-+	 * limit both equal to zero.
-+	 *
-+	 * That was close enough to "no segment at all" until we
-+	 * hardened this function to disallow 16-bit TLS segments.  Fix
-+	 * it up by interpreting these zeroed segments the way that they
-+	 * were almost certainly intended to be interpreted.
-+	 *
-+	 * The correct way to ask for "no segment at all" is to specify
-+	 * a user_desc that satisfies LDT_empty.  To keep everything
-+	 * working, we accept both.
-+	 *
-+	 * Note that there's a similar kludge in modify_ldt -- look at
-+	 * the distinction between modes 1 and 0x11.
-+	 */
-+	if (LDT_empty(info) || LDT_zero(info))
- 		return true;
- 
- 	/*
-@@ -71,7 +92,7 @@ static void set_tls_desc(struct task_struct *p, int idx,
- 	cpu = get_cpu();
- 
- 	while (n-- > 0) {
--		if (LDT_empty(info))
-+		if (LDT_empty(info) || LDT_zero(info))
- 			desc->a = desc->b = 0;
- 		else
- 			fill_ldt(desc, info);
-@@ -118,6 +139,11 @@ int do_set_thread_area(struct task_struct *p, int idx,
+@@ -139,6 +139,11 @@ int do_set_thread_area(struct task_struct *p, int idx,
  	if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
  		return -EINVAL;
  
@@ -27920,7 +27852,7 @@ index 4e942f3..c6e445a 100644
  	set_tls_desc(p, idx, &info, 1);
  
  	return 0;
-@@ -235,7 +261,7 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
+@@ -256,7 +261,7 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
  
  	if (kbuf)
  		info = kbuf;
@@ -27948,7 +27880,7 @@ index 1c113db..287b42e 100644
  static int trace_irq_vector_refcount;
  static DEFINE_MUTEX(irq_vector_mutex);
 diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
-index f9d976e..488b635 100644
+index b1d9002..04013df 100644
 --- a/arch/x86/kernel/traps.c
 +++ b/arch/x86/kernel/traps.c
 @@ -66,7 +66,7 @@
@@ -28139,7 +28071,7 @@ index f9d976e..488b635 100644
  		if (!fixup_exception(regs)) {
  			task->thread.error_code = error_code;
 diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
-index de02906..7353850 100644
+index b20bced..17532ba 100644
 --- a/arch/x86/kernel/tsc.c
 +++ b/arch/x86/kernel/tsc.c
 @@ -150,7 +150,7 @@ static void cyc2ns_write_end(int cpu, struct cyc2ns_data *data)
@@ -36184,7 +36116,7 @@ index 01b9026..1e476df 100644
  	  This is the Linux Xen port.  Enabling this will allow the
  	  kernel to boot in a paravirtualized environment under the
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 201d09a..be93768 100644
+index 201d09a..2302db1 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
 @@ -123,8 +123,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -36272,19 +36204,21 @@ index 201d09a..be93768 100644
  {
  	if (pm_power_off)
  		pm_power_off();
-@@ -1455,8 +1451,9 @@ static void __ref xen_setup_gdt(int cpu)
+@@ -1455,8 +1451,11 @@ static void __ref xen_setup_gdt(int cpu)
  	pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry_boot;
  	pv_cpu_ops.load_gdt = xen_load_gdt_boot;
  
 -	setup_stack_canary_segment(0);
 -	switch_to_new_gdt(0);
 +	setup_stack_canary_segment(cpu);
++#ifdef CONFIG_X86_64
 +	load_percpu_segment(cpu);
++#endif
 +	switch_to_new_gdt(cpu);
  
  	pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry;
  	pv_cpu_ops.load_gdt = xen_load_gdt;
-@@ -1564,7 +1561,17 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1564,7 +1563,17 @@ asmlinkage void __init xen_start_kernel(void)
  	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
  
  	/* Work out if we support NX */
@@ -36303,7 +36237,7 @@ index 201d09a..be93768 100644
  
  	/* Get mfn list */
  	xen_build_dynamic_phys_to_machine();
-@@ -1592,13 +1599,6 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1592,13 +1601,6 @@ asmlinkage void __init xen_start_kernel(void)
  
  	machine_ops = xen_machine_ops;
  
@@ -36836,7 +36770,7 @@ index 4044cf7..555ae4e 100644
  		goto error;
  
 diff --git a/crypto/cryptd.c b/crypto/cryptd.c
-index 7bdd61b..afec999 100644
+index 75c415d..0b21cd8 100644
 --- a/crypto/cryptd.c
 +++ b/crypto/cryptd.c
 @@ -63,7 +63,7 @@ struct cryptd_blkcipher_ctx {
@@ -36858,7 +36792,7 @@ index 7bdd61b..afec999 100644
  static void cryptd_queue_worker(struct work_struct *work);
  
 diff --git a/crypto/cts.c b/crypto/cts.c
-index 042223f..133f087 100644
+index 60b9da3..bd94058 100644
 --- a/crypto/cts.c
 +++ b/crypto/cts.c
 @@ -202,7 +202,8 @@ static int cts_cbc_decrypt(struct crypto_cts_ctx *ctx,
@@ -36872,7 +36806,7 @@ index 042223f..133f087 100644
  	sg_set_buf(&sgdst[0], d, bsize);
  	err = crypto_blkcipher_decrypt_iv(&lcldesc, sgdst, sgsrc, bsize);
 diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
-index 309d345..1632720 100644
+index c305d41..a96de79 100644
 --- a/crypto/pcrypt.c
 +++ b/crypto/pcrypt.c
 @@ -440,7 +440,7 @@ static int pcrypt_sysfs_add(struct padata_instance *pinst, const char *name)
@@ -36885,7 +36819,7 @@ index 309d345..1632720 100644
  		kobject_uevent(&pinst->kobj, KOBJ_ADD);
  
 diff --git a/crypto/sha1_generic.c b/crypto/sha1_generic.c
-index 4279480..7bb0474 100644
+index fdf7c00..a3e50c3 100644
 --- a/crypto/sha1_generic.c
 +++ b/crypto/sha1_generic.c
 @@ -64,7 +64,7 @@ int crypto_sha1_update(struct shash_desc *desc, const u8 *data,
@@ -36898,7 +36832,7 @@ index 4279480..7bb0474 100644
  	}
  	memcpy(sctx->buffer + partial, src, len - done);
 diff --git a/crypto/sha256_generic.c b/crypto/sha256_generic.c
-index 5433667..32c5e5e 100644
+index 136381b..cde0361 100644
 --- a/crypto/sha256_generic.c
 +++ b/crypto/sha256_generic.c
 @@ -210,10 +210,9 @@ static void sha256_transform(u32 *state, const u8 *input)
@@ -36923,7 +36857,7 @@ index 5433667..32c5e5e 100644
  	return 0;
  }
 diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
-index 6ed124f..04d295a 100644
+index 6c6d901..d350854 100644
 --- a/crypto/sha512_generic.c
 +++ b/crypto/sha512_generic.c
 @@ -238,7 +238,7 @@ static int sha384_final(struct shash_desc *desc, u8 *hash)
@@ -36936,7 +36870,7 @@ index 6ed124f..04d295a 100644
  	return 0;
  }
 diff --git a/crypto/tgr192.c b/crypto/tgr192.c
-index 8740355..3c7af0d 100644
+index f7ed2fb..321bc6f 100644
 --- a/crypto/tgr192.c
 +++ b/crypto/tgr192.c
 @@ -612,7 +612,7 @@ static int tgr160_final(struct shash_desc *desc, u8 * out)
@@ -36958,7 +36892,7 @@ index 8740355..3c7af0d 100644
  	return 0;
  }
 diff --git a/crypto/vmac.c b/crypto/vmac.c
-index 2eb11a3..d84c24b 100644
+index bf2d3a8..df76a81 100644
 --- a/crypto/vmac.c
 +++ b/crypto/vmac.c
 @@ -613,7 +613,7 @@ static int vmac_final(struct shash_desc *pdesc, u8 *out)
@@ -36971,7 +36905,7 @@ index 2eb11a3..d84c24b 100644
  	ctx->partial_size = 0;
  	return 0;
 diff --git a/crypto/wp512.c b/crypto/wp512.c
-index 180f1d6..ec64e77 100644
+index 253db94..7ee5a04 100644
 --- a/crypto/wp512.c
 +++ b/crypto/wp512.c
 @@ -1102,8 +1102,8 @@ static int wp384_final(struct shash_desc *desc, u8 *out)
@@ -44092,7 +44026,7 @@ index 1946101..09766d2 100644
  #include "qib_common.h"
  #include "qib_verbs.h"
 diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
-index ce953d8..1469995 100644
+index fb787c3..1469995 100644
 --- a/drivers/input/evdev.c
 +++ b/drivers/input/evdev.c
 @@ -422,7 +422,7 @@ static int evdev_open(struct inode *inode, struct file *file)
@@ -44104,43 +44038,6 @@ index ce953d8..1469995 100644
  	return error;
  }
  
-@@ -757,20 +757,23 @@ static int evdev_handle_set_keycode_v2(struct input_dev *dev, void __user *p)
-  */
- static int evdev_handle_get_val(struct evdev_client *client,
- 				struct input_dev *dev, unsigned int type,
--				unsigned long *bits, unsigned int max,
--				unsigned int size, void __user *p, int compat)
-+				unsigned long *bits, unsigned int maxbit,
-+				unsigned int maxlen, void __user *p,
-+				int compat)
- {
- 	int ret;
- 	unsigned long *mem;
-+	size_t len;
- 
--	mem = kmalloc(sizeof(unsigned long) * max, GFP_KERNEL);
-+	len = BITS_TO_LONGS(maxbit) * sizeof(unsigned long);
-+	mem = kmalloc(len, GFP_KERNEL);
- 	if (!mem)
- 		return -ENOMEM;
- 
- 	spin_lock_irq(&dev->event_lock);
- 	spin_lock(&client->buffer_lock);
- 
--	memcpy(mem, bits, sizeof(unsigned long) * max);
-+	memcpy(mem, bits, len);
- 
- 	spin_unlock(&dev->event_lock);
- 
-@@ -778,7 +781,7 @@ static int evdev_handle_get_val(struct evdev_client *client,
- 
- 	spin_unlock_irq(&client->buffer_lock);
- 
--	ret = bits_to_user(mem, max, size, p, compat);
-+	ret = bits_to_user(mem, maxbit, maxlen, p, compat);
- 	if (ret < 0)
- 		evdev_queue_syn_dropped(client);
- 
 diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
 index 24c41ba..102d71f 100644
 --- a/drivers/input/gameport/gameport.c
@@ -45543,7 +45440,7 @@ index a46124e..caf0bd55 100644
  
  			rdev_dec_pending(rdev, mddev);
 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index 4913c06..663bb94 100644
+index 175584a..1561092 100644
 --- a/drivers/md/raid5.c
 +++ b/drivers/md/raid5.c
 @@ -1711,6 +1711,10 @@ static int grow_one_stripe(struct r5conf *conf, int hash)
@@ -47805,10 +47702,10 @@ index 9e7d95d..d447b88 100644
  	  Say Y here if you want to support for Freescale FlexCAN.
  
 diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
-index cc11f7f..bf7de8b 100644
+index 1468c46..1f8e748 100644
 --- a/drivers/net/can/dev.c
 +++ b/drivers/net/can/dev.c
-@@ -756,7 +756,7 @@ static int can_newlink(struct net *src_net, struct net_device *dev,
+@@ -760,7 +760,7 @@ static int can_newlink(struct net *src_net, struct net_device *dev,
  	return -EOPNOTSUPP;
  }
  
@@ -48434,6 +48331,19 @@ index d2bb12b..d6c921e 100644
  	.kind			= "nlmon",
  	.priv_size		= sizeof(struct nlmon),
  	.setup			= nlmon_setup,
+diff --git a/drivers/net/ppp/ppp_deflate.c b/drivers/net/ppp/ppp_deflate.c
+index 602c625..b5edc7f 100644
+--- a/drivers/net/ppp/ppp_deflate.c
++++ b/drivers/net/ppp/ppp_deflate.c
+@@ -246,7 +246,7 @@ static int z_compress(void *arg, unsigned char *rptr, unsigned char *obuf,
+ 	/*
+ 	 * See if we managed to reduce the size of the packet.
+ 	 */
+-	if (olen < isize) {
++	if (olen < isize && olen <= osize) {
+ 		state->stats.comp_bytes += olen;
+ 		state->stats.comp_packets++;
+ 	} else {
 diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
 index 5a1897d..e860630 100644
 --- a/drivers/net/ppp/ppp_generic.c
@@ -53164,7 +53074,7 @@ index 2ebe47b..3205833 100644
  
  	dlci->modem_rx = 0;
 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
-index d46b4cc..c470f00 100644
+index 850e232..59a0ccd 100644
 --- a/drivers/tty/n_tty.c
 +++ b/drivers/tty/n_tty.c
 @@ -115,7 +115,7 @@ struct n_tty_data {
@@ -53176,7 +53086,7 @@ index d46b4cc..c470f00 100644
  	size_t line_start;
  
  	/* protected by output lock */
-@@ -2521,6 +2521,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
+@@ -2526,6 +2526,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
  {
  	*ops = tty_ldisc_N_TTY;
  	ops->owner = NULL;
@@ -59643,10 +59553,10 @@ index ff286f3..8153a14 100644
  			.attrs = attrs,
  		};
 diff --git a/fs/buffer.c b/fs/buffer.c
-index 4d06a57..5977df8 100644
+index eef21c6..10a8304 100644
 --- a/fs/buffer.c
 +++ b/fs/buffer.c
-@@ -3438,7 +3438,7 @@ void __init buffer_init(void)
+@@ -3450,7 +3450,7 @@ void __init buffer_init(void)
  	bh_cachep = kmem_cache_create("buffer_head",
  			sizeof(struct buffer_head), 0,
  				(SLAB_RECLAIM_ACCOUNT|SLAB_PANIC|
@@ -61908,10 +61818,10 @@ index e6574d7..c30cbe2 100644
  		brelse(bh);
  		bh = NULL;
 diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 242226a..f3eb6c1 100644
+index 7620133..212880d 100644
 --- a/fs/ext4/mballoc.c
 +++ b/fs/ext4/mballoc.c
-@@ -1882,7 +1882,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
+@@ -1884,7 +1884,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
  		BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
  
  		if (EXT4_SB(sb)->s_mb_stats)
@@ -61920,7 +61830,7 @@ index 242226a..f3eb6c1 100644
  
  		break;
  	}
-@@ -2191,7 +2191,7 @@ repeat:
+@@ -2193,7 +2193,7 @@ repeat:
  			ac->ac_status = AC_STATUS_CONTINUE;
  			ac->ac_flags |= EXT4_MB_HINT_FIRST;
  			cr = 3;
@@ -61929,7 +61839,7 @@ index 242226a..f3eb6c1 100644
  			goto repeat;
  		}
  	}
-@@ -2699,25 +2699,25 @@ int ext4_mb_release(struct super_block *sb)
+@@ -2701,25 +2701,25 @@ int ext4_mb_release(struct super_block *sb)
  	if (sbi->s_mb_stats) {
  		ext4_msg(sb, KERN_INFO,
  		       "mballoc: %u blocks %u reqs (%u success)",
@@ -61965,7 +61875,7 @@ index 242226a..f3eb6c1 100644
  	}
  
  	free_percpu(sbi->s_locality_groups);
-@@ -3171,16 +3171,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
+@@ -3173,16 +3173,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
  	struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
  
  	if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
@@ -61988,7 +61898,7 @@ index 242226a..f3eb6c1 100644
  	}
  
  	if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
-@@ -3607,7 +3607,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
+@@ -3609,7 +3609,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
  	trace_ext4_mb_new_inode_pa(ac, pa);
  
  	ext4_mb_use_inode_pa(ac, pa);
@@ -61997,7 +61907,7 @@ index 242226a..f3eb6c1 100644
  
  	ei = EXT4_I(ac->ac_inode);
  	grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
-@@ -3667,7 +3667,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
+@@ -3669,7 +3669,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
  	trace_ext4_mb_new_group_pa(ac, pa);
  
  	ext4_mb_use_group_pa(ac, pa);
@@ -62006,7 +61916,7 @@ index 242226a..f3eb6c1 100644
  
  	grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
  	lg = ac->ac_lg;
-@@ -3756,7 +3756,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
+@@ -3758,7 +3758,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
  		 * from the bitmap and continue.
  		 */
  	}
@@ -62015,7 +61925,7 @@ index 242226a..f3eb6c1 100644
  
  	return err;
  }
-@@ -3774,7 +3774,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
+@@ -3776,7 +3776,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
  	ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
  	BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
  	mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
@@ -62167,7 +62077,7 @@ index ef68665..5deacdc 100644
  	return 0;
  }
 diff --git a/fs/fhandle.c b/fs/fhandle.c
-index 999ff5c..ac037c9 100644
+index 999ff5c..2281df9 100644
 --- a/fs/fhandle.c
 +++ b/fs/fhandle.c
 @@ -8,6 +8,7 @@
@@ -62197,6 +62107,18 @@ index 999ff5c..ac037c9 100644
  		retval = -EPERM;
  		goto out_err;
  	}
+@@ -195,8 +195,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
+ 		goto out_err;
+ 	}
+ 	/* copy the full handle */
+-	if (copy_from_user(handle, ufh,
+-			   sizeof(struct file_handle) +
++	*handle = f_handle;
++	if (copy_from_user(&handle->f_handle,
++			   &ufh->f_handle,
+ 			   f_handle.handle_bytes)) {
+ 		retval = -EFAULT;
+ 		goto out_handle;
 diff --git a/fs/file.c b/fs/file.c
 index eb56a13..ccee850 100644
 --- a/fs/file.c
@@ -63763,7 +63685,7 @@ index b96a49b..9bfdc47 100644
  	cuse_class = class_create(THIS_MODULE, "cuse");
  	if (IS_ERR(cuse_class))
 diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
-index 0a648bb..8d463f1 100644
+index 6eb13c6..4389620 100644
 --- a/fs/fuse/dev.c
 +++ b/fs/fuse/dev.c
 @@ -1323,7 +1323,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
@@ -65197,7 +65119,7 @@ index 9e38daf..5727cae 100644
  				"inode 0x%lx or driver bug.", vdir->i_ino);
  		goto err_out;
 diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
-index db9bd8a..8338fb6 100644
+index 86ddab9..cedba51 100644
 --- a/fs/ntfs/file.c
 +++ b/fs/ntfs/file.c
 @@ -1282,7 +1282,7 @@ static inline size_t ntfs_copy_from_user(struct page **pages,
@@ -81592,10 +81514,10 @@ index 6c58dd7..80d1d95 100644
  #define current_cred_xxx(xxx)			\
  ({						\
 diff --git a/include/linux/crypto.h b/include/linux/crypto.h
-index b92eadf..b4ecdc1 100644
+index 2b00d92..ab50c5e 100644
 --- a/include/linux/crypto.h
 +++ b/include/linux/crypto.h
-@@ -373,7 +373,7 @@ struct cipher_tfm {
+@@ -386,7 +386,7 @@ struct cipher_tfm {
  	                  const u8 *key, unsigned int keylen);
  	void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
  	void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
@@ -81604,7 +81526,7 @@ index b92eadf..b4ecdc1 100644
  
  struct hash_tfm {
  	int (*init)(struct hash_desc *desc);
-@@ -394,13 +394,13 @@ struct compress_tfm {
+@@ -407,13 +407,13 @@ struct compress_tfm {
  	int (*cot_decompress)(struct crypto_tfm *tfm,
  	                      const u8 *src, unsigned int slen,
  	                      u8 *dst, unsigned int *dlen);
@@ -82047,7 +81969,7 @@ index c0894dd..2fbf10c 100644
  };
  
 diff --git a/include/linux/gfp.h b/include/linux/gfp.h
-index 39b81dc..819dc51 100644
+index 3824ac6..f3932a3 100644
 --- a/include/linux/gfp.h
 +++ b/include/linux/gfp.h
 @@ -36,6 +36,13 @@ struct vm_area_struct;
@@ -83751,7 +83673,7 @@ index a74c3a8..28d3f21 100644
  extern struct key_type key_type_keyring;
  
 diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h
-index e465bb1..19f605f 100644
+index e465bb1..19f605fd 100644
 --- a/include/linux/kgdb.h
 +++ b/include/linux/kgdb.h
 @@ -52,7 +52,7 @@ extern int kgdb_connected;
@@ -84395,18 +84317,18 @@ index c5d5278..f0b68c8 100644
  }
  
 diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
-index 1884353..626ca6b 100644
+index ac819bf..838afec 100644
 --- a/include/linux/mmzone.h
 +++ b/include/linux/mmzone.h
-@@ -401,7 +401,7 @@ struct zone {
- 	unsigned long		flags;		   /* zone flags, see below */
+@@ -513,7 +513,7 @@ struct zone {
  
+ 	ZONE_PADDING(_pad3_)
  	/* Zone statistics */
 -	atomic_long_t		vm_stat[NR_VM_ZONE_STAT_ITEMS];
-+	atomic_long_unchecked_t		vm_stat[NR_VM_ZONE_STAT_ITEMS];
++	atomic_long_unchecked_t	vm_stat[NR_VM_ZONE_STAT_ITEMS];
+ } ____cacheline_internodealigned_in_smp;
  
- 	/*
- 	 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
+ typedef enum {
 diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
 index 45e9214..4a547ac 100644
 --- a/include/linux/mod_devicetable.h
@@ -87058,10 +86980,28 @@ index 823ec7b..44c938c 100644
  		struct rcu_head         rcu;
  		struct inet_peer	*gc_next;
 diff --git a/include/net/ip.h b/include/net/ip.h
-index 937f196..7251808 100644
+index 937f196..310a44f 100644
 --- a/include/net/ip.h
 +++ b/include/net/ip.h
-@@ -214,7 +214,7 @@ static inline void snmp_mib_free(void __percpu *ptr[SNMP_ARRAY_SZ])
+@@ -38,11 +38,12 @@ struct inet_skb_parm {
+ 	struct ip_options	opt;		/* Compiled IP options		*/
+ 	unsigned char		flags;
+ 
+-#define IPSKB_FORWARDED		1
+-#define IPSKB_XFRM_TUNNEL_SIZE	2
+-#define IPSKB_XFRM_TRANSFORMED	4
+-#define IPSKB_FRAG_COMPLETE	8
+-#define IPSKB_REROUTED		16
++#define IPSKB_FORWARDED		BIT(0)
++#define IPSKB_XFRM_TUNNEL_SIZE	BIT(1)
++#define IPSKB_XFRM_TRANSFORMED	BIT(2)
++#define IPSKB_FRAG_COMPLETE	BIT(3)
++#define IPSKB_REROUTED		BIT(4)
++#define IPSKB_DOREDIRECT	BIT(5)
+ 
+ 	u16			frag_max_size;
+ };
+@@ -214,7 +215,7 @@ static inline void snmp_mib_free(void __percpu *ptr[SNMP_ARRAY_SZ])
  
  void inet_get_local_port_range(struct net *net, int *low, int *high);
  
@@ -87070,7 +87010,7 @@ index 937f196..7251808 100644
  static inline int inet_is_reserved_local_port(int port)
  {
  	return test_bit(port, sysctl_local_reserved_ports);
-@@ -297,7 +297,7 @@ static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb)
+@@ -297,7 +298,7 @@ static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb)
  	}
  }
  
@@ -94299,7 +94239,7 @@ index 13d2f7c..c93d0b0 100644
  		return cmd_attr_register_cpumask(info);
  	else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
 diff --git a/kernel/time.c b/kernel/time.c
-index 3c49ab4..00a3aea 100644
+index 3eb322e..1ba53cf 100644
 --- a/kernel/time.c
 +++ b/kernel/time.c
 @@ -172,6 +172,11 @@ int do_sys_settimeofday(const struct timespec *tv, const struct timezone *tz)
@@ -96119,10 +96059,10 @@ index 09d9591..165bb75 100644
  		bdi_destroy(bdi);
  		return err;
 diff --git a/mm/filemap.c b/mm/filemap.c
-index bdaa215..2949940 100644
+index 217cfd3..6257351 100644
 --- a/mm/filemap.c
 +++ b/mm/filemap.c
-@@ -1998,7 +1998,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
+@@ -1972,7 +1972,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
  	struct address_space *mapping = file->f_mapping;
  
  	if (!mapping->a_ops->readpage)
@@ -96131,7 +96071,7 @@ index bdaa215..2949940 100644
  	file_accessed(file);
  	vma->vm_ops = &generic_file_vm_ops;
  	return 0;
-@@ -2162,7 +2162,7 @@ static size_t __iovec_copy_from_user_inatomic(char *vaddr,
+@@ -2136,7 +2136,7 @@ static size_t __iovec_copy_from_user_inatomic(char *vaddr,
  
  	while (bytes) {
  		char __user *buf = iov->iov_base + base;
@@ -96140,7 +96080,7 @@ index bdaa215..2949940 100644
  
  		base = 0;
  		left = __copy_from_user_inatomic(vaddr, buf, copy);
-@@ -2190,7 +2190,7 @@ size_t iov_iter_copy_from_user_atomic(struct page *page,
+@@ -2164,7 +2164,7 @@ size_t iov_iter_copy_from_user_atomic(struct page *page,
  
  	kaddr = kmap_atomic(page);
  	if (likely(i->nr_segs == 1)) {
@@ -96149,7 +96089,7 @@ index bdaa215..2949940 100644
  		char __user *buf = i->iov->iov_base + i->iov_offset;
  		left = __copy_from_user_inatomic(kaddr + offset, buf, bytes);
  		copied = bytes - left;
-@@ -2218,7 +2218,7 @@ size_t iov_iter_copy_from_user(struct page *page,
+@@ -2192,7 +2192,7 @@ size_t iov_iter_copy_from_user(struct page *page,
  
  	kaddr = kmap(page);
  	if (likely(i->nr_segs == 1)) {
@@ -96158,7 +96098,7 @@ index bdaa215..2949940 100644
  		char __user *buf = i->iov->iov_base + i->iov_offset;
  		left = __copy_from_user(kaddr + offset, buf, bytes);
  		copied = bytes - left;
-@@ -2248,7 +2248,7 @@ void iov_iter_advance(struct iov_iter *i, size_t bytes)
+@@ -2222,7 +2222,7 @@ void iov_iter_advance(struct iov_iter *i, size_t bytes)
  		 * zero-length segments (without overruning the iovec).
  		 */
  		while (bytes || unlikely(i->count && !iov->iov_len)) {
@@ -96167,7 +96107,7 @@ index bdaa215..2949940 100644
  
  			copy = min(bytes, iov->iov_len - base);
  			BUG_ON(!i->count || i->count < copy);
-@@ -2319,6 +2319,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i
+@@ -2293,6 +2293,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i
                          *pos = i_size_read(inode);
  
  		if (limit != RLIM_INFINITY) {
@@ -96632,7 +96572,7 @@ index a98c7fc..393f8f1 100644
  	}
  	unset_migratetype_isolate(page, MIGRATE_MOVABLE);
 diff --git a/mm/memory.c b/mm/memory.c
-index 924429e..732f880 100644
+index 7f30bea..67cb92b 100644
 --- a/mm/memory.c
 +++ b/mm/memory.c
 @@ -403,6 +403,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
@@ -99190,7 +99130,7 @@ index 9f45f87..749bfd8 100644
  					unsigned long bg_thresh,
  					unsigned long dirty,
 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 4b25829..382c9bd 100644
+index ea41913..d1a474f 100644
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
 @@ -61,6 +61,7 @@
@@ -99210,7 +99150,7 @@ index 4b25829..382c9bd 100644
  {
  	__free_pages_ok(page, compound_order(page));
  }
-@@ -729,6 +730,10 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
+@@ -749,6 +750,10 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
  	int i;
  	int bad = 0;
  
@@ -99221,7 +99161,7 @@ index 4b25829..382c9bd 100644
  	trace_mm_page_free(page, order);
  	kmemcheck_free_shadow(page, order);
  
-@@ -745,6 +750,12 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
+@@ -765,6 +770,12 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
  		debug_check_no_obj_freed(page_address(page),
  					   PAGE_SIZE << order);
  	}
@@ -99234,7 +99174,7 @@ index 4b25829..382c9bd 100644
  	arch_free_page(page, order);
  	kernel_map_pages(page, 1 << order, 0);
  
-@@ -767,6 +778,20 @@ static void __free_pages_ok(struct page *page, unsigned int order)
+@@ -788,6 +799,20 @@ static void __free_pages_ok(struct page *page, unsigned int order)
  	local_irq_restore(flags);
  }
  
@@ -99255,7 +99195,7 @@ index 4b25829..382c9bd 100644
  void __init __free_pages_bootmem(struct page *page, unsigned int order)
  {
  	unsigned int nr_pages = 1 << order;
-@@ -782,6 +807,19 @@ void __init __free_pages_bootmem(struct page *page, unsigned int order)
+@@ -803,6 +828,19 @@ void __init __free_pages_bootmem(struct page *page, unsigned int order)
  	__ClearPageReserved(p);
  	set_page_count(p, 0);
  
@@ -99275,7 +99215,7 @@ index 4b25829..382c9bd 100644
  	page_zone(page)->managed_pages += nr_pages;
  	set_page_refcounted(page);
  	__free_pages(page, order);
-@@ -910,8 +948,10 @@ static int prep_new_page(struct page *page, int order, gfp_t gfp_flags)
+@@ -931,8 +969,10 @@ static int prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags)
  	arch_alloc_page(page, order);
  	kernel_map_pages(page, 1 << order, 1);
  
@@ -99286,25 +99226,16 @@ index 4b25829..382c9bd 100644
  
  	if (order && (gfp_flags & __GFP_COMP))
  		prep_compound_page(page, order);
-@@ -1960,7 +2000,7 @@ zonelist_scan:
- 		if (alloc_flags & ALLOC_FAIR) {
- 			if (!zone_local(preferred_zone, zone))
- 				continue;
--			if (atomic_long_read(&zone->vm_stat[NR_ALLOC_BATCH]) <= 0)
-+			if (atomic_long_read_unchecked(&zone->vm_stat[NR_ALLOC_BATCH]) <= 0)
- 				continue;
- 		}
- 		/*
-@@ -2424,7 +2464,7 @@ static void reset_alloc_batches(struct zonelist *zonelist,
- 			continue;
+@@ -1948,7 +1988,7 @@ static void reset_alloc_batches(struct zone *preferred_zone)
+ 	do {
  		mod_zone_page_state(zone, NR_ALLOC_BATCH,
  			high_wmark_pages(zone) - low_wmark_pages(zone) -
 -			atomic_long_read(&zone->vm_stat[NR_ALLOC_BATCH]));
 +			atomic_long_read_unchecked(&zone->vm_stat[NR_ALLOC_BATCH]));
- 	}
+ 		zone_clear_flag(zone, ZONE_FAIR_DEPLETED);
+ 	} while (zone++ != preferred_zone);
  }
- 
-@@ -5669,7 +5709,7 @@ static void __setup_per_zone_wmarks(void)
+@@ -5711,7 +5751,7 @@ static void __setup_per_zone_wmarks(void)
  
  		__mod_zone_page_state(zone, NR_ALLOC_BATCH,
  			high_wmark_pages(zone) - low_wmark_pages(zone) -
@@ -99313,7 +99244,7 @@ index 4b25829..382c9bd 100644
  
  		setup_zone_migrate_reserve(zone);
  		spin_unlock_irqrestore(&zone->lock, flags);
-@@ -6611,4 +6651,4 @@ void dump_page(struct page *page, char *reason)
+@@ -6652,4 +6692,4 @@ void dump_page(struct page *page, char *reason)
  {
  	dump_page_badflags(page, reason, 0);
  }
@@ -99513,7 +99444,7 @@ index cab9820..cb05259 100644
  
  /*
 diff --git a/mm/shmem.c b/mm/shmem.c
-index 0f14475..c469130d 100644
+index 85d8a1a..da4e20f 100644
 --- a/mm/shmem.c
 +++ b/mm/shmem.c
 @@ -33,7 +33,7 @@
@@ -99534,7 +99465,7 @@ index 0f14475..c469130d 100644
  
  /*
   * shmem_fallocate communicates with shmem_fault or shmem_writepage via
-@@ -2240,6 +2240,11 @@ static const struct xattr_handler *shmem_xattr_handlers[] = {
+@@ -2249,6 +2249,11 @@ static const struct xattr_handler *shmem_xattr_handlers[] = {
  static int shmem_xattr_validate(const char *name)
  {
  	struct { const char *prefix; size_t len; } arr[] = {
@@ -99546,7 +99477,7 @@ index 0f14475..c469130d 100644
  		{ XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN },
  		{ XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN }
  	};
-@@ -2295,6 +2300,15 @@ static int shmem_setxattr(struct dentry *dentry, const char *name,
+@@ -2304,6 +2309,15 @@ static int shmem_setxattr(struct dentry *dentry, const char *name,
  	if (err)
  		return err;
  
@@ -99562,7 +99493,7 @@ index 0f14475..c469130d 100644
  	return simple_xattr_set(&info->xattrs, name, value, size, flags);
  }
  
-@@ -2607,8 +2621,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
+@@ -2616,8 +2630,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
  	int err = -ENOMEM;
  
  	/* Round up to L1_CACHE_BYTES to resist false sharing */
@@ -100672,7 +100603,7 @@ index 63c3ea5..95c0858 100644
  		}
  	}
 diff --git a/mm/swap.c b/mm/swap.c
-index c8048d7..099d1a3 100644
+index d2ceddf..d585efa 100644
 --- a/mm/swap.c
 +++ b/mm/swap.c
 @@ -31,6 +31,7 @@
@@ -100785,7 +100716,7 @@ index c1010cb..210c536 100644
  {
  	struct address_space *mapping = page->mapping;
 diff --git a/mm/vmalloc.c b/mm/vmalloc.c
-index 0fdf968..991ff6a 100644
+index aa3891e..97555dd 100644
 --- a/mm/vmalloc.c
 +++ b/mm/vmalloc.c
 @@ -38,6 +38,21 @@ struct vfree_deferred {
@@ -101068,7 +100999,7 @@ index 0fdf968..991ff6a 100644
  	if (v->nr_pages)
  		seq_printf(m, " pages=%d", v->nr_pages);
 diff --git a/mm/vmstat.c b/mm/vmstat.c
-index def5dd2..4ce55cec 100644
+index eded190..e4203d1 100644
 --- a/mm/vmstat.c
 +++ b/mm/vmstat.c
 @@ -20,6 +20,7 @@
@@ -101126,7 +101057,7 @@ index def5dd2..4ce55cec 100644
  		}
  }
  #endif
-@@ -1150,10 +1151,22 @@ static void *vmstat_start(struct seq_file *m, loff_t *pos)
+@@ -1151,10 +1152,22 @@ static void *vmstat_start(struct seq_file *m, loff_t *pos)
  	stat_items_size += sizeof(struct vm_event_state);
  #endif
  
@@ -101150,7 +101081,7 @@ index def5dd2..4ce55cec 100644
  	for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
  		v[i] = global_page_state(i);
  	v += NR_VM_ZONE_STAT_ITEMS;
-@@ -1302,10 +1315,16 @@ static int __init setup_vmstat(void)
+@@ -1303,10 +1316,16 @@ static int __init setup_vmstat(void)
  	put_online_cpus();
  #endif
  #ifdef CONFIG_PROC_FS
@@ -103221,6 +103152,20 @@ index bf2cb4a..d83ba8a 100644
  		p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
  		p->rate_tokens = 0;
  		/* 60*HZ is arbitrary, but chosen enough high so that the first
+diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
+index 1c6bd43..ecb34b5 100644
+--- a/net/ipv4/ip_forward.c
++++ b/net/ipv4/ip_forward.c
+@@ -178,7 +178,8 @@ int ip_forward(struct sk_buff *skb)
+ 	 *	We now generate an ICMP HOST REDIRECT giving the route
+ 	 *	we calculated.
+ 	 */
+-	if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb_sec_path(skb))
++	if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr &&
++	    !skb_sec_path(skb))
+ 		ip_rt_send_redirect(skb);
+ 
+ 	skb->priority = rt_tos2priority(iph->tos);
 diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
 index c10a3ce..dd71f84 100644
 --- a/net/ipv4/ip_fragment.c
@@ -103328,6 +103273,18 @@ index 3d4da2c..40f9c29 100644
  					icmp_send(skb, ICMP_DEST_UNREACH,
  						  ICMP_PROT_UNREACH, 0);
  				}
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 844323b..7c1b9ac 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1471,6 +1471,7 @@ static DEFINE_PER_CPU(struct inet_sock, unicast_sock) = {
+ 		.sk_wmem_alloc	= ATOMIC_INIT(1),
+ 		.sk_allocation	= GFP_ATOMIC,
+ 		.sk_flags	= (1UL << SOCK_USE_WRITE_QUEUE),
++		.sk_pacing_rate = ~0U,
+ 	},
+ 	.pmtudisc	= IP_PMTUDISC_WANT,
+ 	.uc_ttl		= -1,
 diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
 index 580dd96..41e9720 100644
 --- a/net/ipv4/ip_sockglue.c
@@ -103696,7 +103653,7 @@ index 11c8d81..d67116b 100644
  
  static int raw_seq_show(struct seq_file *seq, void *v)
 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index 487bb62..bc101aa 100644
+index 487bb62..31268ca 100644
 --- a/net/ipv4/route.c
 +++ b/net/ipv4/route.c
 @@ -234,7 +234,7 @@ static const struct seq_operations rt_cache_seq_ops = {
@@ -103749,7 +103706,31 @@ index 487bb62..bc101aa 100644
  }
  EXPORT_SYMBOL(ip_idents_reserve);
  
-@@ -2631,34 +2631,34 @@ static struct ctl_table ipv4_route_flush_table[] = {
+@@ -1554,11 +1554,10 @@ static int __mkroute_input(struct sk_buff *skb,
+ 
+ 	do_cache = res->fi && !itag;
+ 	if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
++	    skb->protocol == htons(ETH_P_IP) &&
+ 	    (IN_DEV_SHARED_MEDIA(out_dev) ||
+-	     inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) {
+-		flags |= RTCF_DOREDIRECT;
+-		do_cache = false;
+-	}
++	     inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
++		IPCB(skb)->flags |= IPSKB_DOREDIRECT;
+ 
+ 	if (skb->protocol != htons(ETH_P_IP)) {
+ 		/* Not IP (i.e. ARP). Do not create route, if it is
+@@ -2305,6 +2304,8 @@ static int rt_fill_info(struct net *net,  __be32 dst, __be32 src,
+ 	r->rtm_flags	= (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
+ 	if (rt->rt_flags & RTCF_NOTIFY)
+ 		r->rtm_flags |= RTM_F_NOTIFY;
++	if (IPCB(skb)->flags & IPSKB_DOREDIRECT)
++		r->rtm_flags |= RTCF_DOREDIRECT;
+ 
+ 	if (nla_put_be32(skb, RTA_DST, dst))
+ 		goto nla_put_failure;
+@@ -2631,34 +2632,34 @@ static struct ctl_table ipv4_route_flush_table[] = {
  		.maxlen		= sizeof(int),
  		.mode		= 0200,
  		.proc_handler	= ipv4_sysctl_rtcache_flush,
@@ -103792,7 +103773,7 @@ index 487bb62..bc101aa 100644
  err_dup:
  	return -ENOMEM;
  }
-@@ -2681,8 +2681,8 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
+@@ -2681,8 +2682,8 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
  
  static __net_init int rt_genid_init(struct net *net)
  {
@@ -103803,7 +103784,7 @@ index 487bb62..bc101aa 100644
  	get_random_bytes(&net->ipv4.dev_addr_genid,
  			 sizeof(net->ipv4.dev_addr_genid));
  	return 0;
-@@ -2725,11 +2725,7 @@ int __init ip_rt_init(void)
+@@ -2725,11 +2726,7 @@ int __init ip_rt_init(void)
  {
  	int rc = 0;
  
@@ -108106,6 +108087,19 @@ index 05a6e3d..6716ec9 100644
  
  	__xfrm_sysctl_init(net);
  
+diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
+index 547e15d..e550fa6 100644
+--- a/scripts/Kbuild.include
++++ b/scripts/Kbuild.include
+@@ -143,7 +143,7 @@ cc-ifversion = $(shell [ $(call cc-version, $(CC)) $(1) $(2) ] && echo $(3))
+ # cc-ldoption
+ # Usage: ldflags += $(call cc-ldoption, -Wl$(comma)--hash-style=both)
+ cc-ldoption = $(call try-run,\
+-	$(CC) $(1) -nostdlib -x c /dev/null -o "$$TMP",$(1),$(2))
++	$(CC) $(1) -Wl,-r -nostdlib -x c /dev/null -o "$$TMP",$(1),$(2))
+ 
+ # ld-option
+ # Usage: LDFLAGS += $(call ld-option, -X)
 diff --git a/scripts/Makefile b/scripts/Makefile
 index 01e7adb..6176d5d 100644
 --- a/scripts/Makefile
@@ -118842,10 +118836,10 @@ index 0000000..4378111
 +}
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
 new file mode 100644
-index 0000000..7ab73a3
+index 0000000..3d3508d
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,6040 @@
+@@ -0,0 +1,6042 @@
 +intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL
 +ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
 +storvsc_connect_to_vsp_22 storvsc_connect_to_vsp 2 22 NULL
@@ -120927,6 +120921,7 @@ index 0000000..7ab73a3
 +l2tp_ip_recvmsg_22681 l2tp_ip_recvmsg 4 22681 NULL
 +bch_dump_read_22685 bch_dump_read 3 22685 NULL
 +reg_umr_22686 reg_umr 5 22686 NULL
++nr_cpusets_22705 nr_cpusets 0 22705 NULL
 +alloc_libipw_22708 alloc_libipw 1 22708 NULL
 +cx18_copy_buf_to_user_22735 cx18_copy_buf_to_user 4-0 22735 NULL
 +ceph_decode_32_22738 ceph_decode_32 0 22738 NULL nohasharray
@@ -121580,6 +121575,7 @@ index 0000000..7ab73a3
 +read_cis_cache_29735 read_cis_cache 4 29735 NULL
 +xfs_new_eof_29737 xfs_new_eof 2 29737 NULL
 +std_nic_write_29752 std_nic_write 3 29752 NULL
++static_key_count_29771 static_key_count 0 29771 NULL
 +dbAlloc_29794 dbAlloc 0 29794 NULL
 +tcp_sendpage_29829 tcp_sendpage 4 29829 NULL
 +__probe_kernel_write_29842 __probe_kernel_write 3 29842 NULL