Grsec/PaX: 2.9.1-{2.6.32.60,3.2.43,3.8.7}-20130412202720130412

14 files changed, 3253 insertions, 495 deletions

diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index e34859b..6b3d14c 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -34,7 +34,7 @@ Patch:	1059_linux-2.6.32.60.patch
 From:	http://www.kernel.org
 Desc:	Linux 2.6.32.59
 
-Patch:	4420_grsecurity-2.9.1-2.6.32.60-201304111811.patch
+Patch:	4420_grsecurity-2.9.1-2.6.32.60-201304122025.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304111811.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304122025.patch
index 1520bdd..5b9006d 100644
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304111811.patch
+++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304122025.patch
@@ -29993,7 +29993,7 @@ index 21e1aeb..2c0b3c4 100644
 -}
 -__setup("vdso=", vdso_setup);
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index d52f895..5a92cc3 100644
+index d52f895..3bcb11b 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
 @@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -30011,10 +30011,19 @@ index d52f895..5a92cc3 100644
  	unsigned int size = dtr->size + 1;
 -	unsigned pages = (size + PAGE_SIZE - 1) / PAGE_SIZE;
 -	unsigned long frames[pages];
-+	unsigned long frames[65536 / PAGE_SIZE];
++	unsigned long frames[(GDT_SIZE + PAGE_SIZE - 1) / PAGE_SIZE];
  	int f;
  
  	/*
+@@ -345,7 +342,7 @@ static void xen_load_gdt(const struct desc_ptr *dtr)
+ 	 * 8-byte entries, or 16 4k pages..
+ 	 */
+ 
+-	BUG_ON(size > 65536);
++	BUG_ON(size > GDT_SIZE);
+ 	BUG_ON(va & ~PAGE_MASK);
+ 
+ 	for (f = 0; va < dtr->address + size; va += PAGE_SIZE, f++) {
 @@ -385,8 +382,7 @@ static __init void xen_load_gdt_boot(const struct desc_ptr *dtr)
  {
  	unsigned long va = dtr->address;
@@ -30104,22 +30113,20 @@ index d52f895..5a92cc3 100644
  #endif
  
  	xen_setup_features();
-@@ -1130,14 +1137,7 @@ asmlinkage void __init xen_start_kernel(void)
- 		pv_mmu_ops.ptep_modify_prot_commit = xen_ptep_modify_prot_commit;
- 	}
+@@ -1132,13 +1139,6 @@ asmlinkage void __init xen_start_kernel(void)
+ 
+ 	machine_ops = xen_machine_ops;
  
--	machine_ops = xen_machine_ops;
--
 -	/*
 -	 * The only reliable way to retain the initial address of the
 -	 * percpu gdt_page is to remember it here, so we can go and
 -	 * mark it RW later, when the initial percpu area is freed.
 -	 */
 -	xen_initial_gdt = &per_cpu(gdt_page, 0);
-+	memcpy((void *)&machine_ops, &xen_machine_ops, sizeof machine_ops);
- 
+-
  	xen_smp_init();
  
+ 	pgd = (pgd_t *)xen_start_info->pt_base;
 diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
 index 8f4452c..38873e5 100644
 --- a/arch/x86/xen/mmu.c
@@ -119647,7 +119654,7 @@ index d52f7a0..b66cdd9 100755
  		rm -f tags
  		xtags ctags
 diff --git a/security/Kconfig b/security/Kconfig
-index fb363cd..f289b7c 100644
+index fb363cd..55a557a 100644
 --- a/security/Kconfig
 +++ b/security/Kconfig
 @@ -4,6 +4,896 @@
@@ -120402,7 +120409,7 @@ index fb363cd..f289b7c 100644
 +
 +config PAX_MEMORY_STACKLEAK
 +	bool "Sanitize kernel stack"
-+	default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY && !(GRKERNSEC_CONFIG_VIRT_HOST && GRKERNSEC_CONFIG_VIRT_XEN))
++	default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
 +	depends on X86
 +	help
 +	  By saying Y here the kernel will erase the kernel stack before it
diff --git a/3.2.43/0000_README b/3.2.43/0000_README
index c2965ab..72f3f88 100644
--- a/3.2.43/0000_README
+++ b/3.2.43/0000_README
@@ -90,7 +90,7 @@ Patch:	1042_linux-3.2.43.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.43
 
-Patch:	4420_grsecurity-2.9.1-3.2.43-201304111813.patch
+Patch:	4420_grsecurity-2.9.1-3.2.43-201304122026.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.43/4420_grsecurity-2.9.1-3.2.43-201304111813.patch b/3.2.43/4420_grsecurity-2.9.1-3.2.43-201304122026.patch
index 84d2f5a..48edf5c 100644
--- a/3.2.43/4420_grsecurity-2.9.1-3.2.43-201304111813.patch
+++ b/3.2.43/4420_grsecurity-2.9.1-3.2.43-201304122026.patch
@@ -2803,10 +2803,18 @@ index 77597e5..189dd62f 100644
  	.notifier_call = palinfo_cpu_callback,
  	.priority = 0,
 diff --git a/arch/ia64/kernel/perfmon.c b/arch/ia64/kernel/perfmon.c
-index 89accc6..e888968 100644
+index 89accc6..236d389 100644
 --- a/arch/ia64/kernel/perfmon.c
 +++ b/arch/ia64/kernel/perfmon.c
-@@ -2370,7 +2370,6 @@ pfm_smpl_buffer_alloc(struct task_struct *task, struct file *filp, pfm_context_t
+@@ -632,6 +632,7 @@ static struct file_system_type pfm_fs_type = {
+ 	.mount    = pfmfs_mount,
+ 	.kill_sb  = kill_anon_super,
+ };
++MODULE_ALIAS_FS("pfmfs");
+ 
+ DEFINE_PER_CPU(unsigned long, pfm_syst_info);
+ DEFINE_PER_CPU(struct task_struct *, pmu_owner);
+@@ -2370,7 +2371,6 @@ pfm_smpl_buffer_alloc(struct task_struct *task, struct file *filp, pfm_context_t
  	 */
  	insert_vm_struct(mm, vma);
  
@@ -5160,6 +5168,18 @@ index 0cfece4..2f1a0e5 100644
  {
  	struct spu_context *ctx = vma->vm_file->private_data;
  	unsigned long offset = address - vma->vm_start;
+diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
+index e481f6b..6f90539 100644
+--- a/arch/powerpc/platforms/cell/spufs/inode.c
++++ b/arch/powerpc/platforms/cell/spufs/inode.c
+@@ -810,6 +810,7 @@ static struct file_system_type spufs_type = {
+ 	.mount = spufs_mount,
+ 	.kill_sb = kill_litter_super,
+ };
++MODULE_ALIAS_FS("spufs");
+ 
+ static int __init spufs_init(void)
+ {
 diff --git a/arch/powerpc/platforms/powermac/smp.c b/arch/powerpc/platforms/powermac/smp.c
 index 3394254..8c6825c 100644
 --- a/arch/powerpc/platforms/powermac/smp.c
@@ -5186,6 +5206,18 @@ index 24bff4f..0248123 100644
  	.notifier_call = appldata_cpu_notify,
  };
  
+diff --git a/arch/s390/hypfs/inode.c b/arch/s390/hypfs/inode.c
+index 481f4f7..f16ec59 100644
+--- a/arch/s390/hypfs/inode.c
++++ b/arch/s390/hypfs/inode.c
+@@ -454,6 +454,7 @@ static struct file_system_type hypfs_type = {
+ 	.mount		= hypfs_mount,
+ 	.kill_sb	= hypfs_kill_super
+ };
++MODULE_ALIAS_FS("s390_hypfs");
+ 
+ static const struct super_operations hypfs_s_ops = {
+ 	.statfs		= simple_statfs,
 diff --git a/arch/s390/include/asm/atomic.h b/arch/s390/include/asm/atomic.h
 index 8517d2a..d2738d4 100644
 --- a/arch/s390/include/asm/atomic.h
@@ -29251,7 +29283,7 @@ index 153407c..611cba9 100644
 -}
 -__setup("vdso=", vdso_setup);
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 69b9ef6..30a09b1 100644
+index 69b9ef6..aa929bc 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
 @@ -86,8 +86,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -29279,10 +29311,19 @@ index 69b9ef6..30a09b1 100644
  	unsigned int size = dtr->size + 1;
 -	unsigned pages = (size + PAGE_SIZE - 1) / PAGE_SIZE;
 -	unsigned long frames[pages];
-+	unsigned long frames[65536 / PAGE_SIZE];
++	unsigned long frames[(GDT_SIZE + PAGE_SIZE - 1) / PAGE_SIZE];
  	int f;
  
  	/*
+@@ -425,7 +421,7 @@ static void __init xen_load_gdt_boot(const struct desc_ptr *dtr)
+ 	 * 8-byte entries, or 16 4k pages..
+ 	 */
+ 
+-	BUG_ON(size > 65536);
++	BUG_ON(size > GDT_SIZE);
+ 	BUG_ON(va & ~PAGE_MASK);
+ 
+ 	for (f = 0; va < dtr->address + size; va += PAGE_SIZE, f++) {
 @@ -1057,30 +1053,30 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
  #endif
  };
@@ -29340,22 +29381,20 @@ index 69b9ef6..30a09b1 100644
  
  	xen_setup_features();
  
-@@ -1210,14 +1216,7 @@ asmlinkage void __init xen_start_kernel(void)
- 		pv_mmu_ops.ptep_modify_prot_commit = xen_ptep_modify_prot_commit;
- 	}
+@@ -1212,13 +1218,6 @@ asmlinkage void __init xen_start_kernel(void)
+ 
+ 	machine_ops = xen_machine_ops;
  
--	machine_ops = xen_machine_ops;
--
 -	/*
 -	 * The only reliable way to retain the initial address of the
 -	 * percpu gdt_page is to remember it here, so we can go and
 -	 * mark it RW later, when the initial percpu area is freed.
 -	 */
 -	xen_initial_gdt = &per_cpu(gdt_page, 0);
-+	memcpy((void *)&machine_ops, &xen_machine_ops, sizeof machine_ops);
- 
+-
  	xen_smp_init();
  
+ #ifdef CONFIG_ACPI_NUMA
 @@ -1400,7 +1399,7 @@ static int __cpuinit xen_hvm_cpu_notify(struct notifier_block *self,
  	return NOTIFY_OK;
  }
@@ -35856,6 +35895,18 @@ index e571e60..523c505 100644
  	.notifier_call	= comp_pool_callback,
  	.priority	= 0,
  };
+diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
+index 31ae1b1..fe606ac 100644
+--- a/drivers/infiniband/hw/ipath/ipath_fs.c
++++ b/drivers/infiniband/hw/ipath/ipath_fs.c
+@@ -410,6 +410,7 @@ static struct file_system_type ipathfs_fs_type = {
+ 	.mount =	ipathfs_mount,
+ 	.kill_sb =	ipathfs_kill_super,
+ };
++MODULE_ALIAS_FS("ipathfs");
+ 
+ int __init ipath_init_ipathfs(void)
+ {
 diff --git a/drivers/infiniband/hw/ipath/ipath_rc.c b/drivers/infiniband/hw/ipath/ipath_rc.c
 index 79b3dbc..96e5fcc 100644
 --- a/drivers/infiniband/hw/ipath/ipath_rc.c
@@ -36361,6 +36412,18 @@ index b881bdc..c2e360c 100644
  
  #include "qib_common.h"
  #include "qib_verbs.h"
+diff --git a/drivers/infiniband/hw/qib/qib_fs.c b/drivers/infiniband/hw/qib/qib_fs.c
+index df7fa25..f11b448 100644
+--- a/drivers/infiniband/hw/qib/qib_fs.c
++++ b/drivers/infiniband/hw/qib/qib_fs.c
+@@ -603,6 +603,7 @@ static struct file_system_type qibfs_fs_type = {
+ 	.mount =        qibfs_mount,
+ 	.kill_sb =      qibfs_kill_super,
+ };
++MODULE_ALIAS_FS("ipathfs");
+ 
+ int __init qib_init_qibfs(void)
+ {
 diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
 index c351aa4..e6967c2 100644
 --- a/drivers/input/gameport/gameport.c
@@ -38012,6 +38075,18 @@ index 19fc7c1..09a4d26 100644
  	ret = device_create_bin_file(c2dev->dev, &c2port_bin_attrs);
  	if (unlikely(ret))
  		goto error_device_create_bin_file;
+diff --git a/drivers/misc/ibmasm/ibmasmfs.c b/drivers/misc/ibmasm/ibmasmfs.c
+index 8994772..f8453cc 100644
+--- a/drivers/misc/ibmasm/ibmasmfs.c
++++ b/drivers/misc/ibmasm/ibmasmfs.c
+@@ -110,6 +110,7 @@ static struct file_system_type ibmasmfs_type = {
+ 	.mount          = ibmasmfs_mount,
+ 	.kill_sb        = kill_litter_super,
+ };
++MODULE_ALIAS_FS("ibmasmfs");
+ 
+ static int ibmasmfs_fill_super (struct super_block *sb, void *data, int silent)
+ {
 diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
 index 3aa9a96..59cf685 100644
 --- a/drivers/misc/kgdbts.c
@@ -38435,7 +38510,7 @@ index a3f7a27..234016e 100644
  
  	/* Don't allow a single read to cross a 512-byte block boundary */
 diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
-index e7dc732..60bee13 100644
+index e7dc732..58ec627 100644
 --- a/drivers/mtd/mtdchar.c
 +++ b/drivers/mtd/mtdchar.c
 @@ -1141,6 +1141,33 @@ static unsigned long mtd_get_unmapped_area(struct file *file,
@@ -38508,6 +38583,14 @@ index e7dc732..60bee13 100644
  		vma->vm_flags |= VM_IO | VM_RESERVED;
  
  #ifdef pgprot_noncached
+@@ -1211,6 +1247,7 @@ static struct file_system_type mtd_inodefs_type = {
+        .mount = mtd_inodefs_mount,
+        .kill_sb = kill_anon_super,
+ };
++MODULE_ALIAS_FS("mtd_inodefs");
+ 
+ static void mtdchar_notify_add(struct mtd_info *mtd)
+ {
 diff --git a/drivers/mtd/nand/denali.c b/drivers/mtd/nand/denali.c
 index 3984d48..28aa897 100644
 --- a/drivers/mtd/nand/denali.c
@@ -40235,7 +40318,7 @@ index 38b6fc0..b5cbfce 100644
  
  extern struct oprofile_stat_struct oprofile_stats;
 diff --git a/drivers/oprofile/oprofilefs.c b/drivers/oprofile/oprofilefs.c
-index 2f0aa0f..90fab02 100644
+index 2f0aa0f..1ba4404 100644
 --- a/drivers/oprofile/oprofilefs.c
 +++ b/drivers/oprofile/oprofilefs.c
 @@ -193,7 +193,7 @@ static const struct file_operations atomic_ro_fops = {
@@ -40247,6 +40330,14 @@ index 2f0aa0f..90fab02 100644
  {
  	return __oprofilefs_create_file(sb, root, name,
  					&atomic_ro_fops, 0444, val);
+@@ -279,6 +279,7 @@ static struct file_system_type oprofilefs_type = {
+ 	.mount		= oprofilefs_mount,
+ 	.kill_sb	= kill_litter_super,
+ };
++MODULE_ALIAS_FS("oprofilefs");
+ 
+ 
+ int __init oprofilefs_register(void)
 diff --git a/drivers/oprofile/timer_int.c b/drivers/oprofile/timer_int.c
 index 878fba1..2084bcf 100644
 --- a/drivers/oprofile/timer_int.c
@@ -43224,6 +43315,18 @@ index 347bb05..63e1b73 100644
  
  	return 0;
  }
+diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
+index 0e641a1..49e6ac7 100644
+--- a/drivers/usb/gadget/f_fs.c
++++ b/drivers/usb/gadget/f_fs.c
+@@ -1212,6 +1212,7 @@ static struct file_system_type ffs_fs_type = {
+ 	.mount		= ffs_fs_mount,
+ 	.kill_sb	= ffs_fs_kill_sb,
+ };
++MODULE_ALIAS_FS("functionfs");
+ 
+ 
+ /* Driver's main init/cleanup functions *************************************/
 diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
 index db2d607..3a25028 100644
 --- a/drivers/usb/gadget/file_storage.c
@@ -43255,6 +43358,18 @@ index db2d607..3a25028 100644
  
  	/* Find out how many LUNs there should be */
  	i = mod_data.nluns;
+diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
+index 7138540..2370195 100644
+--- a/drivers/usb/gadget/inode.c
++++ b/drivers/usb/gadget/inode.c
+@@ -2121,6 +2121,7 @@ static struct file_system_type gadgetfs_type = {
+ 	.mount		= gadgetfs_mount,
+ 	.kill_sb	= gadgetfs_kill_sb,
+ };
++MODULE_ALIAS_FS("gadgetfs");
+ 
+ /*----------------------------------------------------------------------*/
+ 
 diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
 index e39b188..1fffda8 100644
 --- a/drivers/usb/storage/realtek_cr.c
@@ -46771,6 +46886,18 @@ index 88714ae..16c2e11 100644
  
  
  static inline u32 get_pll_internal_frequency(u32 ref_freq,
+diff --git a/drivers/xen/xenfs/super.c b/drivers/xen/xenfs/super.c
+index 1aa3897..3a6b3f1 100644
+--- a/drivers/xen/xenfs/super.c
++++ b/drivers/xen/xenfs/super.c
+@@ -116,6 +116,7 @@ static struct file_system_type xenfs_type = {
+ 	.mount =	xenfs_mount,
+ 	.kill_sb =	kill_litter_super,
+ };
++MODULE_ALIAS_FS("xenfs");
+ 
+ static int __init xenfs_init(void)
+ {
 diff --git a/drivers/xen/xenfs/xenstored.c b/drivers/xen/xenfs/xenstored.c
 index fef20db..d28b1ab 100644
 --- a/drivers/xen/xenfs/xenstored.c
@@ -46801,6 +46928,15 @@ index 879ed88..bc03a01 100644
  
  	P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
  		IS_ERR(s) ? "<error>" : s);
+diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
+index c70251d..fe305fd 100644
+--- a/fs/9p/vfs_super.c
++++ b/fs/9p/vfs_super.c
+@@ -366,3 +366,4 @@ struct file_system_type v9fs_fs_type = {
+ 	.owner = THIS_MODULE,
+ 	.fs_flags = FS_RENAME_DOES_D_MOVE|FS_REVAL_DOT,
+ };
++MODULE_ALIAS_FS("9p");
 diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
 index 79e2ca7..5828ad1 100644
 --- a/fs/Kconfig.binfmt
@@ -46814,6 +46950,42 @@ index 79e2ca7..5828ad1 100644
  	---help---
  	  A.out (Assembler.OUTput) is a set of formats for libraries and
  	  executables used in the earliest versions of UNIX.  Linux used
+diff --git a/fs/adfs/super.c b/fs/adfs/super.c
+index c8bf36a..d7b2b33 100644
+--- a/fs/adfs/super.c
++++ b/fs/adfs/super.c
+@@ -516,6 +516,7 @@ static struct file_system_type adfs_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("adfs");
+ 
+ static int __init init_adfs_fs(void)
+ {
+diff --git a/fs/affs/super.c b/fs/affs/super.c
+index b31507d..5b42a3b 100644
+--- a/fs/affs/super.c
++++ b/fs/affs/super.c
+@@ -597,6 +597,7 @@ static struct file_system_type affs_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("affs");
+ 
+ static int __init init_affs_fs(void)
+ {
+diff --git a/fs/afs/super.c b/fs/afs/super.c
+index 356dcf0..c0046cd 100644
+--- a/fs/afs/super.c
++++ b/fs/afs/super.c
+@@ -43,6 +43,7 @@ struct file_system_type afs_fs_type = {
+ 	.kill_sb	= afs_kill_super,
+ 	.fs_flags	= 0,
+ };
++MODULE_ALIAS_FS("afs");
+ 
+ static const struct super_operations afs_super_ops = {
+ 	.statfs		= afs_statfs,
 diff --git a/fs/aio.c b/fs/aio.c
 index 3b65ee7..0e57d2e 100644
 --- a/fs/aio.c
@@ -46872,6 +47044,18 @@ index b8f55c4..4c2b80c 100644
  		if (limit != RLIM_INFINITY && offset > limit)
  			goto out_sig;
  		if (offset > inode->i_sb->s_maxbytes)
+diff --git a/fs/autofs4/init.c b/fs/autofs4/init.c
+index c038727..4ba2927 100644
+--- a/fs/autofs4/init.c
++++ b/fs/autofs4/init.c
+@@ -26,6 +26,7 @@ static struct file_system_type autofs_fs_type = {
+ 	.mount		= autofs_mount,
+ 	.kill_sb	= autofs4_kill_sb,
+ };
++MODULE_ALIAS_FS("autofs");
+ 
+ static int __init init_autofs4_fs(void)
+ {
 diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
 index e1fbdee..69291a4 100644
 --- a/fs/autofs4/waitq.c
@@ -46932,7 +47116,7 @@ index 2722387..c8dd2a7 100644
  {
  	if (BEFS_SB(sb)->byte_order == BEFS_BYTESEX_LE)
 diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
-index 8342ca6..82fd192 100644
+index 8342ca6..a9dca40 100644
 --- a/fs/befs/linuxvfs.c
 +++ b/fs/befs/linuxvfs.c
 @@ -503,7 +503,7 @@ static void befs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
@@ -46944,6 +47128,26 @@ index 8342ca6..82fd192 100644
  		if (!IS_ERR(link))
  			kfree(link);
  	}
+@@ -937,6 +937,7 @@ static struct file_system_type befs_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,	
+ };
++MODULE_ALIAS_FS("befs");
+ 
+ static int __init
+ init_befs_fs(void)
+diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
+index 697af5b..ab6db36 100644
+--- a/fs/bfs/inode.c
++++ b/fs/bfs/inode.c
+@@ -470,6 +470,7 @@ static struct file_system_type bfs_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("bfs");
+ 
+ static int __init init_bfs_fs(void)
+ {
 diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
 index a6395bd..f1e376a 100644
 --- a/fs/binfmt_aout.c
@@ -47958,6 +48162,18 @@ index 1bffbe0..c8c283e 100644
  			ret = result;
  			goto err;
  		}
+diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
+index 7423cb9..9379ddd 100644
+--- a/fs/binfmt_misc.c
++++ b/fs/binfmt_misc.c
+@@ -719,6 +719,7 @@ static struct file_system_type bm_fs_type = {
+ 	.mount		= bm_mount,
+ 	.kill_sb	= kill_litter_super,
+ };
++MODULE_ALIAS_FS("binfmt_misc");
+ 
+ static int __init init_misc_binfmt(void)
+ {
 diff --git a/fs/bio.c b/fs/bio.c
 index 4fc4dbb..bae9dce 100644
 --- a/fs/bio.c
@@ -48111,6 +48327,18 @@ index ddf2c90..37afd35 100644
  		swarn.path = path;
  		iterate_extent_inodes(fs_info, path, found_key.objectid,
  					extent_offset,
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index 200f63b..490b833 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -1227,6 +1227,7 @@ static struct file_system_type btrfs_fs_type = {
+ 	.kill_sb	= kill_anon_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("btrfs");
+ 
+ /*
+  * used by btrfsctl to scan devices when no FS is mounted
 diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
 index 622f469..e8d2d55 100644
 --- a/fs/cachefiles/bind.c
@@ -48287,6 +48515,18 @@ index 9895400..78a67e7 100644
  		return ceph_lookup_open(dir, dentry, nd, mode, 1);
  	}
  
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index b48f15f..9fe4eab 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -896,6 +896,7 @@ static struct file_system_type ceph_fs_type = {
+ 	.kill_sb	= ceph_kill_sb,
+ 	.fs_flags	= FS_RENAME_DOES_D_MOVE,
+ };
++MODULE_ALIAS_FS("ceph");
+ 
+ #define _STRINGIFY(x) #x
+ #define STRINGIFY(x) _STRINGIFY(x)
 diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
 index 84e8c07..6170d31 100644
 --- a/fs/cifs/cifs_debug.c
@@ -48421,10 +48661,18 @@ index 84e8c07..6170d31 100644
  		}
  	}
 diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
-index 25bb97f..e0c51aa 100644
+index 25bb97f..a0095de 100644
 --- a/fs/cifs/cifsfs.c
 +++ b/fs/cifs/cifsfs.c
-@@ -1018,7 +1018,7 @@ cifs_init_request_bufs(void)
+@@ -799,6 +799,7 @@ struct file_system_type cifs_fs_type = {
+ 	.kill_sb = cifs_kill_sb,
+ 	/*  .fs_flags */
+ };
++MODULE_ALIAS_FS("cifs");
+ const struct inode_operations cifs_dir_inode_ops = {
+ 	.create = cifs_create,
+ 	.lookup = cifs_lookup,
+@@ -1018,7 +1019,7 @@ cifs_init_request_bufs(void)
  	cifs_req_cachep = kmem_cache_create("cifs_request",
  					    CIFSMaxBufSize +
  					    MAX_CIFS_HDR_SIZE, 0,
@@ -48433,7 +48681,7 @@ index 25bb97f..e0c51aa 100644
  	if (cifs_req_cachep == NULL)
  		return -ENOMEM;
  
-@@ -1045,7 +1045,7 @@ cifs_init_request_bufs(void)
+@@ -1045,7 +1046,7 @@ cifs_init_request_bufs(void)
  	efficient to alloc 1 per page off the slab compared to 17K (5page)
  	alloc of large cifs buffers even when page debugging is on */
  	cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
@@ -48442,7 +48690,7 @@ index 25bb97f..e0c51aa 100644
  			NULL);
  	if (cifs_sm_req_cachep == NULL) {
  		mempool_destroy(cifs_req_poolp);
-@@ -1130,8 +1130,8 @@ init_cifs(void)
+@@ -1130,8 +1131,8 @@ init_cifs(void)
  	atomic_set(&bufAllocCount, 0);
  	atomic_set(&smBufAllocCount, 0);
  #ifdef CONFIG_CIFS_STATS2
@@ -48634,6 +48882,16 @@ index 6901578..d402eb5 100644
  	spin_unlock(&cii->c_lock);
  
  	return hit;
+diff --git a/fs/coda/inode.c b/fs/coda/inode.c
+index 871b277..7dcf232 100644
+--- a/fs/coda/inode.c
++++ b/fs/coda/inode.c
+@@ -326,4 +326,5 @@ struct file_system_type coda_fs_type = {
+ 	.kill_sb	= kill_anon_super,
+ 	.fs_flags	= FS_BINARY_MOUNTDATA,
+ };
++MODULE_ALIAS_FS("coda");
+ 
 diff --git a/fs/compat.c b/fs/compat.c
 index 4bf082d..d33d8b7 100644
 --- a/fs/compat.c
@@ -48849,6 +49107,30 @@ index 9a37a9b..80968f3 100644
  
  				/*
  				 * We'll have a dentry and an inode for
+diff --git a/fs/configfs/mount.c b/fs/configfs/mount.c
+index 276e15c..aeac324 100644
+--- a/fs/configfs/mount.c
++++ b/fs/configfs/mount.c
+@@ -117,6 +117,7 @@ static struct file_system_type configfs_fs_type = {
+ 	.mount		= configfs_do_mount,
+ 	.kill_sb	= kill_litter_super,
+ };
++MODULE_ALIAS_FS("configfs");
+ 
+ int configfs_pin_fs(void)
+ {
+diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
+index 739fb59..5385976 100644
+--- a/fs/cramfs/inode.c
++++ b/fs/cramfs/inode.c
+@@ -576,6 +576,7 @@ static struct file_system_type cramfs_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("cramfs");
+ 
+ static int __init init_cramfs_fs(void)
+ {
 diff --git a/fs/dcache.c b/fs/dcache.c
 index e923bf4..dcc8779 100644
 --- a/fs/dcache.c
@@ -48879,10 +49161,18 @@ index e923bf4..dcc8779 100644
  	dcache_init();
  	inode_init();
 diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
-index f3a257d..715ac0f 100644
+index f3a257d..9235188 100644
 --- a/fs/debugfs/inode.c
 +++ b/fs/debugfs/inode.c
-@@ -261,7 +261,11 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
+@@ -145,6 +145,7 @@ static struct file_system_type debug_fs_type = {
+ 	.mount =	debug_mount,
+ 	.kill_sb =	kill_litter_super,
+ };
++MODULE_ALIAS_FS("debugfs");
+ 
+ static int debugfs_create_by_name(const char *name, mode_t mode,
+ 				  struct dentry *parent,
+@@ -261,7 +262,11 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
  struct dentry *debugfs_create_dir(const char *name, struct dentry *parent)
  {
  	return debugfs_create_file(name, 
@@ -48925,6 +49215,18 @@ index a9be90d..3cf866c 100644
  	if (!IS_ERR(buf)) {
  		/* Free the char* */
  		kfree(buf);
+diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
+index 94afdfd..bdb8854 100644
+--- a/fs/ecryptfs/main.c
++++ b/fs/ecryptfs/main.c
+@@ -629,6 +629,7 @@ static struct file_system_type ecryptfs_fs_type = {
+ 	.kill_sb = ecryptfs_kill_block_super,
+ 	.fs_flags = 0
+ };
++MODULE_ALIAS_FS("ecryptfs");
+ 
+ /**
+  * inode_info_init_once
 diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
 index de42310..867dddd 100644
 --- a/fs/ecryptfs/miscdev.c
@@ -48960,6 +49262,18 @@ index 608c1c3..7d040a8 100644
  	set_fs(fs_save);
  	return rc;
  }
+diff --git a/fs/efs/super.c b/fs/efs/super.c
+index 0f31acb..395ebc9 100644
+--- a/fs/efs/super.c
++++ b/fs/efs/super.c
+@@ -33,6 +33,7 @@ static struct file_system_type efs_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("efs");
+ 
+ static struct pt_types sgi_pt_types[] = {
+ 	{0x00,		"SGI vh"},
 diff --git a/fs/eventpoll.c b/fs/eventpoll.c
 index 451b9b8..12e5a03 100644
 --- a/fs/eventpoll.c
@@ -49939,6 +50253,18 @@ index 312e297..2573111 100644
  }
  EXPORT_SYMBOL(dump_write);
  
+diff --git a/fs/exofs/super.c b/fs/exofs/super.c
+index 7ed5000..cbe7b49 100644
+--- a/fs/exofs/super.c
++++ b/fs/exofs/super.c
+@@ -1008,6 +1008,7 @@ static struct file_system_type exofs_type = {
+ 	.mount          = exofs_mount,
+ 	.kill_sb        = generic_shutdown_super,
+ };
++MODULE_ALIAS_FS("exofs");
+ 
+ static int __init init_exofs(void)
+ {
 diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
 index a8cbe1b..fed04cb 100644
 --- a/fs/ext2/balloc.c
@@ -49952,6 +50278,18 @@ index a8cbe1b..fed04cb 100644
  		sbi->s_resuid != current_fsuid() &&
  		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
  		return 0;
+diff --git a/fs/ext2/super.c b/fs/ext2/super.c
+index bd8ac16..43811b9 100644
+--- a/fs/ext2/super.c
++++ b/fs/ext2/super.c
+@@ -1494,6 +1494,7 @@ static struct file_system_type ext2_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("ext2");
+ 
+ static int __init init_ext2_fs(void)
+ {
 diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
 index a203892..4e64db5 100644
 --- a/fs/ext3/balloc.c
@@ -49969,6 +50307,18 @@ index a203892..4e64db5 100644
  		return 0;
  	}
  	return 1;
+diff --git a/fs/ext3/super.c b/fs/ext3/super.c
+index b7f314f..ef3b16c 100644
+--- a/fs/ext3/super.c
++++ b/fs/ext3/super.c
+@@ -3065,6 +3065,7 @@ static struct file_system_type ext3_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("ext3");
+ 
+ static int __init init_ext3_fs(void)
+ {
 diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
 index 2845a1f..f29de63 100644
 --- a/fs/ext4/balloc.c
@@ -50136,10 +50486,28 @@ index 7b18563..4dc0cd9 100644
  
  	return 0;
 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index cc386b2..fe2ab97 100644
+index cc386b2..22725d2 100644
 --- a/fs/ext4/super.c
 +++ b/fs/ext4/super.c
-@@ -2467,7 +2467,7 @@ struct ext4_attr {
+@@ -92,6 +92,8 @@ static struct file_system_type ext2_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("ext2");
++MODULE_ALIAS("ext2");
+ #define IS_EXT2_SB(sb) ((sb)->s_bdev->bd_holder == &ext2_fs_type)
+ #else
+ #define IS_EXT2_SB(sb) (0)
+@@ -106,6 +108,8 @@ static struct file_system_type ext3_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("ext3");
++MODULE_ALIAS("ext3");
+ #define IS_EXT3_SB(sb) ((sb)->s_bdev->bd_holder == &ext3_fs_type)
+ #else
+ #define IS_EXT3_SB(sb) (0)
+@@ -2467,7 +2471,7 @@ struct ext4_attr {
  	ssize_t (*store)(struct ext4_attr *, struct ext4_sb_info *,
  			 const char *, size_t);
  	int offset;
@@ -50148,7 +50516,7 @@ index cc386b2..fe2ab97 100644
  
  static int parse_strtoul(const char *buf,
  		unsigned long max, unsigned long *value)
-@@ -3173,7 +3173,6 @@ int ext4_calculate_overhead(struct super_block *sb)
+@@ -3173,7 +3177,6 @@ int ext4_calculate_overhead(struct super_block *sb)
  	ext4_fsblk_t overhead = 0;
  	char *buf = (char *) get_zeroed_page(GFP_KERNEL);
  
@@ -50156,6 +50524,54 @@ index cc386b2..fe2ab97 100644
  	if (!buf)
  		return -ENOMEM;
  
+@@ -5035,7 +5038,6 @@ static inline int ext2_feature_set_ok(struct super_block *sb)
+ 		return 0;
+ 	return 1;
+ }
+-MODULE_ALIAS("ext2");
+ #else
+ static inline void register_as_ext2(void) { }
+ static inline void unregister_as_ext2(void) { }
+@@ -5068,7 +5070,6 @@ static inline int ext3_feature_set_ok(struct super_block *sb)
+ 		return 0;
+ 	return 1;
+ }
+-MODULE_ALIAS("ext3");
+ #else
+ static inline void register_as_ext3(void) { }
+ static inline void unregister_as_ext3(void) { }
+@@ -5082,6 +5083,7 @@ static struct file_system_type ext4_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("ext4");
+ 
+ static int __init ext4_init_feat_adverts(void)
+ {
+diff --git a/fs/fat/namei_msdos.c b/fs/fat/namei_msdos.c
+index 216b419..350a088 100644
+--- a/fs/fat/namei_msdos.c
++++ b/fs/fat/namei_msdos.c
+@@ -674,6 +674,7 @@ static struct file_system_type msdos_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("msdos");
+ 
+ static int __init init_msdos_fs(void)
+ {
+diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
+index c25cf15..e5ea08a 100644
+--- a/fs/fat/namei_vfat.c
++++ b/fs/fat/namei_vfat.c
+@@ -1090,6 +1090,7 @@ static struct file_system_type vfat_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("vfat");
+ 
+ static int __init init_vfat_fs(void)
+ {
 diff --git a/fs/fcntl.c b/fs/fcntl.c
 index 22764c7..86372c9 100644
 --- a/fs/fcntl.c
@@ -50293,22 +50709,44 @@ index 4c6992d..104cdea 100644
  		return -EMFILE;
  
 diff --git a/fs/filesystems.c b/fs/filesystems.c
-index 0845f84..7b4ebef 100644
+index 0845f84..bf3fd05 100644
 --- a/fs/filesystems.c
 +++ b/fs/filesystems.c
 @@ -274,7 +274,12 @@ struct file_system_type *get_fs_type(const char *name)
  	int len = dot ? dot - name : strlen(name);
  
  	fs = __get_fs_type(name, len);
+-	if (!fs && (request_module("%.*s", len, name) == 0))
 +	
 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+	if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
++	if (!fs && (___request_module(true, "grsec_modharden_fs", "fs-%.*s", len, name) == 0))
 +#else
- 	if (!fs && (request_module("%.*s", len, name) == 0))
++	if (!fs && (request_module("fs-%.*s", len, name) == 0))
 +#endif
  		fs = __get_fs_type(name, len);
  
  	if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
+diff --git a/fs/freevxfs/vxfs_super.c b/fs/freevxfs/vxfs_super.c
+index 9d1c995..7685971 100644
+--- a/fs/freevxfs/vxfs_super.c
++++ b/fs/freevxfs/vxfs_super.c
+@@ -52,7 +52,6 @@ MODULE_AUTHOR("Christoph Hellwig");
+ MODULE_DESCRIPTION("Veritas Filesystem (VxFS) driver");
+ MODULE_LICENSE("Dual BSD/GPL");
+ 
+-MODULE_ALIAS("vxfs"); /* makes mount -t vxfs autoload the module */
+ 
+ 
+ static void		vxfs_put_super(struct super_block *);
+@@ -259,6 +258,8 @@ static struct file_system_type vxfs_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("vxfs"); /* makes mount -t vxfs autoload the module */
++MODULE_ALIAS("vxfs");
+ 
+ static int __init
+ vxfs_init(void)
 diff --git a/fs/fs_struct.c b/fs/fs_struct.c
 index 78b519c..0386555 100644
 --- a/fs/fs_struct.c
@@ -51720,6 +52158,18 @@ index 4765190..2a067f2 100644
  
  	seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
  		   atomic_read(&fscache_n_cop_alloc_object),
+diff --git a/fs/fuse/control.c b/fs/fuse/control.c
+index 42593c5..0c6d731 100644
+--- a/fs/fuse/control.c
++++ b/fs/fuse/control.c
+@@ -347,6 +347,7 @@ static struct file_system_type fuse_ctl_fs_type = {
+ 	.mount		= fuse_ctl_mount,
+ 	.kill_sb	= fuse_ctl_kill_sb,
+ };
++MODULE_ALIAS_FS("fusectl");
+ 
+ int __init fuse_ctl_init(void)
+ {
 diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
 index 3426521..3b75162 100644
 --- a/fs/fuse/cuse.c
@@ -51767,6 +52217,26 @@ index 5ef7afb..5fc7f4f 100644
  {
  	if (!IS_ERR(link))
  		free_page((unsigned long) link);
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index 1f82d95..763ac54 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -1092,6 +1092,7 @@ static struct file_system_type fuse_fs_type = {
+ 	.mount		= fuse_mount,
+ 	.kill_sb	= fuse_kill_sb_anon,
+ };
++MODULE_ALIAS_FS("fuse");
+ 
+ #ifdef CONFIG_BLOCK
+ static struct dentry *fuse_mount_blk(struct file_system_type *fs_type,
+@@ -1121,6 +1122,7 @@ static struct file_system_type fuseblk_fs_type = {
+ 	.kill_sb	= fuse_kill_sb_blk,
+ 	.fs_flags	= FS_REQUIRES_DEV | FS_HAS_SUBTYPE,
+ };
++MODULE_ALIAS_FS("fuseblk");
+ 
+ static inline int register_fuseblk(void)
+ {
 diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
 index cfd4959..a780959 100644
 --- a/fs/gfs2/inode.c
@@ -51780,8 +52250,94 @@ index cfd4959..a780959 100644
  	if (!IS_ERR(s))
  		kfree(s);
  }
+diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
+index cb23c2b..2fa1ea5 100644
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -19,6 +19,7 @@
+ #include <linux/mount.h>
+ #include <linux/gfs2_ondisk.h>
+ #include <linux/quotaops.h>
++#include <linux/module.h>
+ 
+ #include "gfs2.h"
+ #include "incore.h"
+@@ -1395,6 +1396,7 @@ struct file_system_type gfs2_fs_type = {
+ 	.kill_sb = gfs2_kill_sb,
+ 	.owner = THIS_MODULE,
+ };
++MODULE_ALIAS_FS("gfs2");
+ 
+ struct file_system_type gfs2meta_fs_type = {
+ 	.name = "gfs2meta",
+@@ -1402,4 +1404,4 @@ struct file_system_type gfs2meta_fs_type = {
+ 	.mount = gfs2_mount_meta,
+ 	.owner = THIS_MODULE,
+ };
+-
++MODULE_ALIAS_FS("gfs2meta");
+diff --git a/fs/hfs/super.c b/fs/hfs/super.c
+index 1b55f70..bd6c289 100644
+--- a/fs/hfs/super.c
++++ b/fs/hfs/super.c
+@@ -460,6 +460,7 @@ static struct file_system_type hfs_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("hfs");
+ 
+ static void hfs_init_once(void *p)
+ {
+diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
+index d24a9b6..b398147 100644
+--- a/fs/hfsplus/super.c
++++ b/fs/hfsplus/super.c
+@@ -582,6 +582,7 @@ static struct file_system_type hfsplus_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("hfsplus");
+ 
+ static void hfsplus_init_once(void *p)
+ {
+diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
+index 2f72da5..7ee87b1 100644
+--- a/fs/hostfs/hostfs_kern.c
++++ b/fs/hostfs/hostfs_kern.c
+@@ -999,6 +999,7 @@ static struct file_system_type hostfs_type = {
+ 	.kill_sb	= hostfs_kill_sb,
+ 	.fs_flags 	= 0,
+ };
++MODULE_ALIAS_FS("hostfs");
+ 
+ static int __init init_hostfs(void)
+ {
+diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
+index 98580a3..c95accd 100644
+--- a/fs/hpfs/super.c
++++ b/fs/hpfs/super.c
+@@ -685,6 +685,7 @@ static struct file_system_type hpfs_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("hpfs");
+ 
+ static int __init init_hpfs_fs(void)
+ {
+diff --git a/fs/hppfs/hppfs.c b/fs/hppfs/hppfs.c
+index f590b11..414cf4b 100644
+--- a/fs/hppfs/hppfs.c
++++ b/fs/hppfs/hppfs.c
+@@ -758,6 +758,7 @@ static struct file_system_type hppfs_type = {
+ 	.kill_sb	= kill_anon_super,
+ 	.fs_flags 	= 0,
+ };
++MODULE_ALIAS_FS("hppfs");
+ 
+ static int __init init_hppfs(void)
+ {
 diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
-index 0aa424a..3ba7b5f 100644
+index 0aa424a..332097d8 100644
 --- a/fs/hugetlbfs/inode.c
 +++ b/fs/hugetlbfs/inode.c
 @@ -134,6 +134,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
@@ -51838,9 +52394,11 @@ index 0aa424a..3ba7b5f 100644
  		addr = ALIGN(vma->vm_end, huge_page_size(h));
  	}
  }
-@@ -897,7 +903,7 @@ static struct file_system_type hugetlbfs_fs_type = {
+@@ -896,8 +902,9 @@ static struct file_system_type hugetlbfs_fs_type = {
+ 	.mount		= hugetlbfs_mount,
  	.kill_sb	= kill_litter_super,
  };
++MODULE_ALIAS_FS("hugetlbfs");
  
 -static struct vfsmount *hugetlbfs_vfsmount;
 +struct vfsmount *hugetlbfs_vfsmount;
@@ -51880,6 +52438,25 @@ index ee4e66b..9a39f9c 100644
  	wake_up_bit(&inode->i_state, __I_NEW);
  	spin_unlock(&inode->i_lock);
  }
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index f950059..78748e8 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -1545,6 +1545,8 @@ static struct file_system_type iso9660_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("iso9660");
++MODULE_ALIAS("iso9660");
+ 
+ static int __init init_iso9660_fs(void)
+ {
+@@ -1582,5 +1584,3 @@ static void __exit exit_iso9660_fs(void)
+ module_init(init_iso9660_fs)
+ module_exit(exit_iso9660_fs)
+ MODULE_LICENSE("GPL");
+-/* Actual filesystem name is iso9660, as requested in filesystems.c */
+-MODULE_ALIAS("iso9660");
 diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
 index e513f19..2ab1351 100644
 --- a/fs/jffs2/erase.c
@@ -51894,6 +52471,18 @@ index e513f19..2ab1351 100644
  		};
  
  		jffs2_prealloc_raw_node_refs(c, jeb, 1);
+diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
+index e7e9744..0de4fd9 100644
+--- a/fs/jffs2/super.c
++++ b/fs/jffs2/super.c
+@@ -357,6 +357,7 @@ static struct file_system_type jffs2_fs_type = {
+ 	.mount =	jffs2_mount,
+ 	.kill_sb =	jffs2_kill_sb,
+ };
++MODULE_ALIAS_FS("jffs2");
+ 
+ static int __init init_jffs2_fs(void)
+ {
 diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
 index 464cd76..3a3ed7e 100644
 --- a/fs/jffs2/wbuf.c
@@ -51909,7 +52498,7 @@ index 464cd76..3a3ed7e 100644
  
  /*
 diff --git a/fs/jfs/super.c b/fs/jfs/super.c
-index a44eff076..ad896ca 100644
+index a44eff076..0003471 100644
 --- a/fs/jfs/super.c
 +++ b/fs/jfs/super.c
 @@ -221,7 +221,7 @@ static const match_table_t tokens = {
@@ -51930,7 +52519,15 @@ index a44eff076..ad896ca 100644
  				unload_nls(nls_map);
  			if (!strcmp(args[0].from, "none"))
  				nls_map = NULL;
-@@ -802,7 +802,7 @@ static int __init init_jfs_fs(void)
+@@ -780,6 +780,7 @@ static struct file_system_type jfs_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("jfs");
+ 
+ static void init_once(void *foo)
+ {
+@@ -802,7 +803,7 @@ static int __init init_jfs_fs(void)
  
  	jfs_inode_cachep =
  	    kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
@@ -52010,6 +52607,30 @@ index fcc50ab..c3dacf26 100644
  	}
  
  	lock_flocks();
+diff --git a/fs/logfs/super.c b/fs/logfs/super.c
+index e795c234..136932a 100644
+--- a/fs/logfs/super.c
++++ b/fs/logfs/super.c
+@@ -609,6 +609,7 @@ static struct file_system_type logfs_fs_type = {
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ 
+ };
++MODULE_ALIAS_FS("logfs");
+ 
+ static int __init logfs_init(void)
+ {
+diff --git a/fs/minix/inode.c b/fs/minix/inode.c
+index 4d46a6a..dee1cdf 100644
+--- a/fs/minix/inode.c
++++ b/fs/minix/inode.c
+@@ -653,6 +653,7 @@ static struct file_system_type minix_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("minix");
+ 
+ static int __init init_minix_fs(void)
+ {
 diff --git a/fs/namei.c b/fs/namei.c
 index 9680cef..36c9152 100644
 --- a/fs/namei.c
@@ -52664,6 +53285,18 @@ index ca4913a..8d4cf9e 100644
  	get_fs_root(current->fs, &root);
  	error = lock_mount(&old);
  	if (error)
+diff --git a/fs/ncpfs/inode.c b/fs/ncpfs/inode.c
+index cbd1a61..b43f68b 100644
+--- a/fs/ncpfs/inode.c
++++ b/fs/ncpfs/inode.c
+@@ -1041,6 +1041,7 @@ static struct file_system_type ncp_fs_type = {
+ 	.kill_sb	= kill_anon_super,
+ 	.fs_flags	= FS_BINARY_MOUNTDATA,
+ };
++MODULE_ALIAS_FS("ncpfs");
+ 
+ static int __init init_ncp_fs(void)
+ {
 diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
 index 168cb93..20486571 100644
 --- a/fs/nfs/callback_xdr.c
@@ -52733,6 +53366,34 @@ index b78b5b6..c64d84f 100644
  }
  
  void nfs_fattr_init(struct nfs_fattr *fattr)
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index 1943898..396c460 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -282,6 +282,7 @@ static struct file_system_type nfs_fs_type = {
+ 	.kill_sb	= nfs_kill_super,
+ 	.fs_flags	= FS_RENAME_DOES_D_MOVE|FS_REVAL_DOT|FS_BINARY_MOUNTDATA,
+ };
++MODULE_ALIAS_FS("nfs");
+ 
+ struct file_system_type nfs_xdev_fs_type = {
+ 	.owner		= THIS_MODULE,
+@@ -338,6 +339,8 @@ static struct file_system_type nfs4_remote_fs_type = {
+ 	.kill_sb	= nfs4_kill_super,
+ 	.fs_flags	= FS_RENAME_DOES_D_MOVE|FS_REVAL_DOT|FS_BINARY_MOUNTDATA,
+ };
++MODULE_ALIAS_FS("nfs4");
++MODULE_ALIAS("nfs4");
+ 
+ struct file_system_type nfs4_xdev_fs_type = {
+ 	.owner		= THIS_MODULE,
+@@ -3089,6 +3092,4 @@ static struct dentry *nfs4_referral_mount(struct file_system_type *fs_type,
+ 	return res;
+ }
+ 
+-MODULE_ALIAS("nfs4");
+-
+ #endif /* CONFIG_NFS_V4 */
 diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
 index fe5c5fb6..638dac1 100644
 --- a/fs/nfsd/nfs4proc.c
@@ -52777,6 +53438,18 @@ index 24afa96..a92d930 100644
  	int nops;
  };
  
+diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
+index c45a2ea..1a6bd66 100644
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -1102,6 +1102,7 @@ static struct file_system_type nfsd_fs_type = {
+ 	.mount		= nfsd_mount,
+ 	.kill_sb	= kill_litter_super,
+ };
++MODULE_ALIAS_FS("nfsd");
+ 
+ #ifdef CONFIG_PROC_FS
+ static int create_proc_exports_entry(void)
 diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
 index 1ec1fde..a58f201 100644
 --- a/fs/nfsd/vfs.c
@@ -52808,6 +53481,18 @@ index 1ec1fde..a58f201 100644
  	set_fs(oldfs);
  
  	if (host_err < 0)
+diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
+index 97bfbdd..e7f644a 100644
+--- a/fs/nilfs2/super.c
++++ b/fs/nilfs2/super.c
+@@ -1370,6 +1370,7 @@ struct file_system_type nilfs_fs_type = {
+ 	.kill_sb  = kill_block_super,
+ 	.fs_flags = FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("nilfs2");
+ 
+ static void nilfs_inode_init_once(void *obj)
+ {
 diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
 index 1c98f53..41e6a04 100644
 --- a/fs/nilfs2/the_nilfs.c
@@ -52970,6 +53655,30 @@ index c587e2d..3641eaa 100644
  
 -const struct inode_operations ntfs_empty_inode_ops = {};
 +const struct inode_operations ntfs_empty_inode_ops __read_only;
+diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
+index b52706d..68a038f 100644
+--- a/fs/ntfs/super.c
++++ b/fs/ntfs/super.c
+@@ -3072,6 +3072,7 @@ static struct file_system_type ntfs_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("ntfs");
+ 
+ /* Stable names for the slab caches. */
+ static const char ntfs_index_ctx_cache_name[] = "ntfs_index_ctx_cache";
+diff --git a/fs/ocfs2/dlmfs/dlmfs.c b/fs/ocfs2/dlmfs/dlmfs.c
+index b420767..bbf1094 100644
+--- a/fs/ocfs2/dlmfs/dlmfs.c
++++ b/fs/ocfs2/dlmfs/dlmfs.c
+@@ -662,6 +662,7 @@ static struct file_system_type dlmfs_fs_type = {
+ 	.mount		= dlmfs_mount,
+ 	.kill_sb	= kill_litter_super,
+ };
++MODULE_ALIAS_FS("ocfs2_dlmfs");
+ 
+ static int __init init_dlmfs_fs(void)
+ {
 diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
 index 210c352..a174f83 100644
 --- a/fs/ocfs2/localalloc.c
@@ -53063,7 +53772,7 @@ index b7e74b5..19c6536 100644
  		}
  	}
 diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
-index 4994f8b..eaab8eb 100644
+index 4994f8b..04a9180 100644
 --- a/fs/ocfs2/super.c
 +++ b/fs/ocfs2/super.c
 @@ -301,11 +301,11 @@ static int ocfs2_osb_dump(struct ocfs2_super *osb, char *buf, int len)
@@ -53083,7 +53792,15 @@ index 4994f8b..eaab8eb 100644
  
  	out += snprintf(buf + out, len - out,
  			"%10s => State: %u  Descriptor: %llu  Size: %u bits  "
-@@ -2119,11 +2119,11 @@ static int ocfs2_initialize_super(struct super_block *sb,
+@@ -1270,6 +1270,7 @@ static struct file_system_type ocfs2_fs_type = {
+ 	.fs_flags       = FS_REQUIRES_DEV|FS_RENAME_DOES_D_MOVE,
+ 	.next           = NULL
+ };
++MODULE_ALIAS_FS("ocfs2");
+ 
+ static int ocfs2_check_set_options(struct super_block *sb,
+ 				   struct mount_options *options)
+@@ -2119,11 +2120,11 @@ static int ocfs2_initialize_super(struct super_block *sb,
  	spin_lock_init(&osb->osb_xattr_lock);
  	ocfs2_init_steal_slots(osb);
  
@@ -53113,6 +53830,18 @@ index 5d22872..523db20 100644
  	if (!IS_ERR(link))
  		kfree(link);
  }
+diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
+index e043c4c..f99d456 100644
+--- a/fs/omfs/inode.c
++++ b/fs/omfs/inode.c
+@@ -570,6 +570,7 @@ static struct file_system_type omfs_fs_type = {
+ 	.kill_sb = kill_block_super,
+ 	.fs_flags = FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("omfs");
+ 
+ static int __init init_omfs_fs(void)
+ {
 diff --git a/fs/open.c b/fs/open.c
 index b8485d3..e18561a 100644
 --- a/fs/open.c
@@ -53219,6 +53948,18 @@ index b8485d3..e18561a 100644
  			}
  		}
  		putname(tmp);
+diff --git a/fs/openpromfs/inode.c b/fs/openpromfs/inode.c
+index e4e0ff7..458929b 100644
+--- a/fs/openpromfs/inode.c
++++ b/fs/openpromfs/inode.c
+@@ -434,6 +434,7 @@ static struct file_system_type openprom_fs_type = {
+ 	.mount		= openprom_mount,
+ 	.kill_sb	= kill_anon_super,
+ };
++MODULE_ALIAS_FS("openpromfs");
+ 
+ static void op_inode_init_once(void *data)
+ {
 diff --git a/fs/partitions/efi.c b/fs/partitions/efi.c
 index 6296b40..417c00f 100644
 --- a/fs/partitions/efi.c
@@ -54764,6 +55505,18 @@ index 980de54..78b2faa 100644
  	if (!mm || IS_ERR(mm)) {
  		put_task_struct(priv->task);
  		priv->task = NULL;
+diff --git a/fs/qnx4/inode.c b/fs/qnx4/inode.c
+index 3bdd214..e570832 100644
+--- a/fs/qnx4/inode.c
++++ b/fs/qnx4/inode.c
+@@ -473,6 +473,7 @@ static struct file_system_type qnx4_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("qnx4");
+ 
+ static int __init init_qnx4_fs(void)
+ {
 diff --git a/fs/quota/netlink.c b/fs/quota/netlink.c
 index d67908b..d13f6a6 100644
 --- a/fs/quota/netlink.c
@@ -54927,6 +55680,30 @@ index 7a99811..a7c96c4 100644
  		   SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
  		   SF(s_do_balance), SF(s_unneeded_left_neighbor),
  		   SF(s_good_search_by_key_reada), SF(s_bmaps),
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index 569498a..0886e50f 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -2295,6 +2295,7 @@ struct file_system_type reiserfs_fs_type = {
+ 	.kill_sb = reiserfs_kill_sb,
+ 	.fs_flags = FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("reiserfs");
+ 
+ MODULE_DESCRIPTION("ReiserFS journaled filesystem");
+ MODULE_AUTHOR("Hans Reiser <reiser@namesys.com>");
+diff --git a/fs/romfs/super.c b/fs/romfs/super.c
+index 8b4089f..2575128 100644
+--- a/fs/romfs/super.c
++++ b/fs/romfs/super.c
+@@ -602,6 +602,7 @@ static struct file_system_type romfs_fs_type = {
+ 	.kill_sb	= romfs_kill_sb,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("romfs");
+ 
+ /*
+  * inode storage initialiser
 diff --git a/fs/select.c b/fs/select.c
 index d33418f..2a5345e 100644
 --- a/fs/select.c
@@ -55168,6 +55945,18 @@ index 58ab918..e471089 100644
  		ret = -EAGAIN;
  
  	pipe_unlock(ipipe);
+diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
+index 4619247..e3910db 100644
+--- a/fs/squashfs/super.c
++++ b/fs/squashfs/super.c
+@@ -481,6 +481,7 @@ static struct file_system_type squashfs_fs_type = {
+ 	.kill_sb = kill_block_super,
+ 	.fs_flags = FS_REQUIRES_DEV
+ };
++MODULE_ALIAS_FS("squashfs");
+ 
+ static const struct super_operations squashfs_super_ops = {
+ 	.alloc_inode = squashfs_alloc_inode,
 diff --git a/fs/stat.c b/fs/stat.c
 index 7b21801..ee8fe9b 100644
 --- a/fs/stat.c
@@ -55311,6 +56100,33 @@ index a7ac78f..02158e1 100644
  	if (!IS_ERR(page))
  		free_page((unsigned long)page);
  }
+diff --git a/fs/sysv/super.c b/fs/sysv/super.c
+index f60c196..b2d8fdc 100644
+--- a/fs/sysv/super.c
++++ b/fs/sysv/super.c
+@@ -545,6 +545,7 @@ static struct file_system_type sysv_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("sysv");
+ 
+ static struct file_system_type v7_fs_type = {
+ 	.owner		= THIS_MODULE,
+@@ -553,6 +554,8 @@ static struct file_system_type v7_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("v7");
++MODULE_ALIAS("v7");
+ 
+ static int __init init_sysv_fs(void)
+ {
+@@ -586,5 +589,4 @@ static void __exit exit_sysv_fs(void)
+ 
+ module_init(init_sysv_fs)
+ module_exit(exit_sysv_fs)
+-MODULE_ALIAS("v7");
+ MODULE_LICENSE("GPL");
 diff --git a/fs/sysv/sysv.h b/fs/sysv/sysv.h
 index bb55cdb..e9ebb8a 100644
 --- a/fs/sysv/sysv.h
@@ -55337,6 +56153,18 @@ index 9228950..bbad895 100644
  {
  	int err;
  
+diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
+index 2f467e5..3222f9b 100644
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -2192,6 +2192,7 @@ static struct file_system_type ubifs_fs_type = {
+ 	.mount   = ubifs_mount,
+ 	.kill_sb = kill_ubifs_super,
+ };
++MODULE_ALIAS_FS("ubifs");
+ 
+ /*
+  * Inode slab cache constructor.
 diff --git a/fs/udf/misc.c b/fs/udf/misc.c
 index c175b4d..8f36a16 100644
 --- a/fs/udf/misc.c
@@ -55350,6 +56178,30 @@ index c175b4d..8f36a16 100644
  	u8 checksum = 0;
  	int i;
  	for (i = 0; i < sizeof(struct tag); ++i)
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index f66439e..9af489f 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -116,6 +116,7 @@ static struct file_system_type udf_fstype = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("udf");
+ 
+ static struct kmem_cache *udf_inode_cachep;
+ 
+diff --git a/fs/ufs/super.c b/fs/ufs/super.c
+index 3915ade..00fcbf4 100644
+--- a/fs/ufs/super.c
++++ b/fs/ufs/super.c
+@@ -1484,6 +1484,7 @@ static struct file_system_type ufs_fs_type = {
+ 	.kill_sb	= kill_block_super,
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("ufs");
+ 
+ static int __init init_ufs_fs(void)
+ {
 diff --git a/fs/ufs/swab.h b/fs/ufs/swab.h
 index 8d974c4..b82f6ec 100644
 --- a/fs/ufs/swab.h
@@ -55551,6 +56403,18 @@ index 87323f1..dab9d00 100644
  	int		error;		/* error value */
  
  	ip = issum ? mp->m_rsumip : mp->m_rbmip;
+diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
+index 8a89949..6776861 100644
+--- a/fs/xfs/xfs_super.c
++++ b/fs/xfs/xfs_super.c
+@@ -1474,6 +1474,7 @@ static struct file_system_type xfs_fs_type = {
+ 	.kill_sb		= kill_block_super,
+ 	.fs_flags		= FS_REQUIRES_DEV,
+ };
++MODULE_ALIAS_FS("xfs");
+ 
+ STATIC int __init
+ xfs_init_zones(void)
 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
 new file mode 100644
 index 0000000..52786fd
@@ -67137,7 +68001,7 @@ index 8eeb205..d59bfa2 100644
  	struct sock_filter     	insns[0];
  };
 diff --git a/include/linux/fs.h b/include/linux/fs.h
-index a276817..3355087 100644
+index a276817..ba31358 100644
 --- a/include/linux/fs.h
 +++ b/include/linux/fs.h
 @@ -1618,7 +1618,8 @@ struct file_operations {
@@ -67150,7 +68014,16 @@ index a276817..3355087 100644
  
  struct inode_operations {
  	struct dentry * (*lookup) (struct inode *,struct dentry *, struct nameidata *);
-@@ -2716,5 +2717,15 @@ static inline void inode_has_no_xattr(struct inode *inode)
+@@ -1885,6 +1886,8 @@ struct file_system_type {
+ 	struct lock_class_key i_mutex_dir_key;
+ };
+ 
++#define MODULE_ALIAS_FS(NAME) MODULE_ALIAS("fs-" NAME)
++
+ extern struct dentry *mount_ns(struct file_system_type *fs_type, int flags,
+ 	void *data, int (*fill_super)(struct super_block *, void *, int));
+ extern struct dentry *mount_bdev(struct file_system_type *fs_type,
+@@ -2716,5 +2719,15 @@ static inline void inode_has_no_xattr(struct inode *inode)
  		inode->i_flags |= S_NOSEC;
  }
  
@@ -89563,6 +90436,26 @@ index b2250da..db374b7 100644
  	clnt->cl_stats->rpccnt++;
  	task->tk_action = call_reserve;
  }
+diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
+index bfddd68..567429b 100644
+--- a/net/sunrpc/rpc_pipe.c
++++ b/net/sunrpc/rpc_pipe.c
+@@ -1059,6 +1059,8 @@ static struct file_system_type rpc_pipe_fs_type = {
+ 	.mount		= rpc_mount,
+ 	.kill_sb	= kill_litter_super,
+ };
++MODULE_ALIAS_FS("rpc_pipefs");
++MODULE_ALIAS("rpc_pipefs");
+ 
+ static void
+ init_once(void *foo)
+@@ -1104,6 +1106,3 @@ void unregister_rpc_pipefs(void)
+ 	kmem_cache_destroy(rpc_inode_cachep);
+ 	unregister_filesystem(&rpc_pipe_fs_type);
+ }
+-
+-/* Make 'mount -t rpc_pipefs ...' autoload this module. */
+-MODULE_ALIAS("rpc_pipefs");
 diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
 index dc6af27..e3fba77 100644
 --- a/net/sunrpc/sched.c
@@ -90739,7 +91632,7 @@ index 38f6617..e70b72b 100755
  
  exuberant()
 diff --git a/security/Kconfig b/security/Kconfig
-index 51bd5a0..43546c5 100644
+index 51bd5a0..14ae375 100644
 --- a/security/Kconfig
 +++ b/security/Kconfig
 @@ -4,6 +4,944 @@
@@ -91498,7 +92391,7 @@ index 51bd5a0..43546c5 100644
 +
 +config PAX_MEMORY_STACKLEAK
 +	bool "Sanitize kernel stack"
-+	default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY && !(GRKERNSEC_CONFIG_VIRT_HOST && GRKERNSEC_CONFIG_VIRT_XEN))
++	default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
 +	depends on X86
 +	help
 +	  By saying Y here the kernel will erase the kernel stack before it
@@ -101891,10 +102784,10 @@ index 0000000..ac2901e
 +}
 diff --git a/tools/gcc/structleak_plugin.c b/tools/gcc/structleak_plugin.c
 new file mode 100644
-index 0000000..5afca14
+index 0000000..41770fc
 --- /dev/null
 +++ b/tools/gcc/structleak_plugin.c
-@@ -0,0 +1,271 @@
+@@ -0,0 +1,272 @@
 +/*
 + * Copyright 2013 by PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -102039,9 +102932,11 @@ index 0000000..5afca14
 +		// we're looking for an assignment of a single rhs...
 +		if (!gimple_assign_single_p(stmt))
 +			continue;
++#if BUILDING_GCC_VERSION >= 4007
 +		// ... of a non-clobbering expression...
 +		if (TREE_CLOBBER_P(rhs1))
 +			continue;
++#endif
 +		// ... to our variable...
 +		if (gimple_get_lhs(stmt) != var)
 +			continue;
@@ -102051,8 +102946,7 @@ index 0000000..5afca14
 +	}
 +
 +	// build the initializer expression
-+	initializer = make_node(CONSTRUCTOR);
-+	TREE_TYPE(initializer) = TREE_TYPE(var);
++	initializer = build_constructor(TREE_TYPE(var), NULL);
 +
 +	// build the initializer stmt
 +	init_stmt = gimple_build_assign(var, initializer);
diff --git a/3.8.6/0000_README b/3.8.7/0000_README
index e81d7f0..3317c66 100644
--- a/3.8.6/0000_README
+++ b/3.8.7/0000_README
@@ -2,7 +2,11 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.9.1-3.8.6-201304111817.patch
+Patch:	1006_linux-3.8.7.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.8.7
+
+Patch:	4420_grsecurity-2.9.1-3.8.7-201304122027.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.8.7/1006_linux-3.8.7.patch b/3.8.7/1006_linux-3.8.7.patch
new file mode 100644
index 0000000..99e0538
--- /dev/null
+++ b/3.8.7/1006_linux-3.8.7.patch
@@ -0,0 +1,2238 @@
+diff --git a/Makefile b/Makefile
+index 10075d6..85204da 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 8
+-SUBLEVEL = 6
++SUBLEVEL = 7
+ EXTRAVERSION =
+ NAME = Displaced Humerus Anterior
+ 
+diff --git a/arch/alpha/kernel/sys_nautilus.c b/arch/alpha/kernel/sys_nautilus.c
+index 4d4c046..1383f86 100644
+--- a/arch/alpha/kernel/sys_nautilus.c
++++ b/arch/alpha/kernel/sys_nautilus.c
+@@ -188,6 +188,10 @@ nautilus_machine_check(unsigned long vector, unsigned long la_ptr)
+ extern void free_reserved_mem(void *, void *);
+ extern void pcibios_claim_one_bus(struct pci_bus *);
+ 
++static struct resource irongate_io = {
++	.name	= "Irongate PCI IO",
++	.flags	= IORESOURCE_IO,
++};
+ static struct resource irongate_mem = {
+ 	.name	= "Irongate PCI MEM",
+ 	.flags	= IORESOURCE_MEM,
+@@ -209,6 +213,7 @@ nautilus_init_pci(void)
+ 
+ 	irongate = pci_get_bus_and_slot(0, 0);
+ 	bus->self = irongate;
++	bus->resource[0] = &irongate_io;
+ 	bus->resource[1] = &irongate_mem;
+ 
+ 	pci_bus_size_bridges(bus);
+diff --git a/arch/arm/mach-exynos/common.c b/arch/arm/mach-exynos/common.c
+index 1a89824..3b6de7a 100644
+--- a/arch/arm/mach-exynos/common.c
++++ b/arch/arm/mach-exynos/common.c
+@@ -299,6 +299,7 @@ void exynos4_restart(char mode, const char *cmd)
+ 
+ void exynos5_restart(char mode, const char *cmd)
+ {
++	struct device_node *np;
+ 	u32 val;
+ 	void __iomem *addr;
+ 
+@@ -306,8 +307,9 @@ void exynos5_restart(char mode, const char *cmd)
+ 		val = 0x1;
+ 		addr = EXYNOS_SWRESET;
+ 	} else if (of_machine_is_compatible("samsung,exynos5440")) {
+-		val = (0x10 << 20) | (0x1 << 16);
+-		addr = EXYNOS5440_SWRESET;
++		np = of_find_compatible_node(NULL, NULL, "samsung,exynos5440-clock");
++		addr = of_iomap(np, 0) + 0xcc;
++		val = (0xfff << 20) | (0x1 << 16);
+ 	} else {
+ 		pr_err("%s: cannot support non-DT\n", __func__);
+ 		return;
+diff --git a/arch/mips/kernel/mcount.S b/arch/mips/kernel/mcount.S
+index 1658676..33d0671 100644
+--- a/arch/mips/kernel/mcount.S
++++ b/arch/mips/kernel/mcount.S
+@@ -46,10 +46,9 @@
+ 	PTR_L	a5, PT_R9(sp)
+ 	PTR_L	a6, PT_R10(sp)
+ 	PTR_L	a7, PT_R11(sp)
+-#else
+-	PTR_ADDIU	sp, PT_SIZE
+ #endif
+-.endm
++	PTR_ADDIU	sp, PT_SIZE
++	.endm
+ 
+ 	.macro RETURN_BACK
+ 	jr ra
+@@ -68,7 +67,11 @@ NESTED(ftrace_caller, PT_SIZE, ra)
+ 	.globl _mcount
+ _mcount:
+ 	b	ftrace_stub
+-	addiu sp,sp,8
++#ifdef CONFIG_32BIT
++	 addiu sp,sp,8
++#else
++	 nop
++#endif
+ 
+ 	/* When tracing is activated, it calls ftrace_caller+8 (aka here) */
+ 	lw	t1, function_trace_stop
+diff --git a/arch/mips/lib/bitops.c b/arch/mips/lib/bitops.c
+index 239a9c9..f3f7756 100644
+--- a/arch/mips/lib/bitops.c
++++ b/arch/mips/lib/bitops.c
+@@ -90,12 +90,12 @@ int __mips_test_and_set_bit(unsigned long nr,
+ 	unsigned bit = nr & SZLONG_MASK;
+ 	unsigned long mask;
+ 	unsigned long flags;
+-	unsigned long res;
++	int res;
+ 
+ 	a += nr >> SZLONG_LOG;
+ 	mask = 1UL << bit;
+ 	raw_local_irq_save(flags);
+-	res = (mask & *a);
++	res = (mask & *a) != 0;
+ 	*a |= mask;
+ 	raw_local_irq_restore(flags);
+ 	return res;
+@@ -116,12 +116,12 @@ int __mips_test_and_set_bit_lock(unsigned long nr,
+ 	unsigned bit = nr & SZLONG_MASK;
+ 	unsigned long mask;
+ 	unsigned long flags;
+-	unsigned long res;
++	int res;
+ 
+ 	a += nr >> SZLONG_LOG;
+ 	mask = 1UL << bit;
+ 	raw_local_irq_save(flags);
+-	res = (mask & *a);
++	res = (mask & *a) != 0;
+ 	*a |= mask;
+ 	raw_local_irq_restore(flags);
+ 	return res;
+@@ -141,12 +141,12 @@ int __mips_test_and_clear_bit(unsigned long nr, volatile unsigned long *addr)
+ 	unsigned bit = nr & SZLONG_MASK;
+ 	unsigned long mask;
+ 	unsigned long flags;
+-	unsigned long res;
++	int res;
+ 
+ 	a += nr >> SZLONG_LOG;
+ 	mask = 1UL << bit;
+ 	raw_local_irq_save(flags);
+-	res = (mask & *a);
++	res = (mask & *a) != 0;
+ 	*a &= ~mask;
+ 	raw_local_irq_restore(flags);
+ 	return res;
+@@ -166,12 +166,12 @@ int __mips_test_and_change_bit(unsigned long nr, volatile unsigned long *addr)
+ 	unsigned bit = nr & SZLONG_MASK;
+ 	unsigned long mask;
+ 	unsigned long flags;
+-	unsigned long res;
++	int res;
+ 
+ 	a += nr >> SZLONG_LOG;
+ 	mask = 1UL << bit;
+ 	raw_local_irq_save(flags);
+-	res = (mask & *a);
++	res = (mask & *a) != 0;
+ 	*a ^= mask;
+ 	raw_local_irq_restore(flags);
+ 	return res;
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index 0da39fe..299731e 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -186,7 +186,13 @@ static long pSeries_lpar_hpte_remove(unsigned long hpte_group)
+ 					   (0x1UL << 4), &dummy1, &dummy2);
+ 		if (lpar_rc == H_SUCCESS)
+ 			return i;
+-		BUG_ON(lpar_rc != H_NOT_FOUND);
++
++		/*
++		 * The test for adjunct partition is performed before the
++		 * ANDCOND test.  H_RESOURCE may be returned, so we need to
++		 * check for that as well.
++		 */
++		BUG_ON(lpar_rc != H_NOT_FOUND && lpar_rc != H_RESOURCE);
+ 
+ 		slot_offset++;
+ 		slot_offset &= 0x7;
+diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
+index 8a84501..5ef205c 100644
+--- a/arch/x86/boot/compressed/Makefile
++++ b/arch/x86/boot/compressed/Makefile
+@@ -4,7 +4,7 @@
+ # create a compressed vmlinux image from the original vmlinux
+ #
+ 
+-targets := vmlinux.lds vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma vmlinux.bin.xz vmlinux.bin.lzo head_$(BITS).o misc.o string.o cmdline.o early_serial_console.o piggy.o
++targets := vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma vmlinux.bin.xz vmlinux.bin.lzo
+ 
+ KBUILD_CFLAGS := -m$(BITS) -D__KERNEL__ $(LINUX_INCLUDE) -O2
+ KBUILD_CFLAGS += -fno-strict-aliasing -fPIC
+@@ -29,7 +29,6 @@ VMLINUX_OBJS = $(obj)/vmlinux.lds $(obj)/head_$(BITS).o $(obj)/misc.o \
+ 	$(obj)/piggy.o
+ 
+ $(obj)/eboot.o: KBUILD_CFLAGS += -fshort-wchar -mno-red-zone
+-$(obj)/efi_stub_$(BITS).o: KBUILD_CLFAGS += -fshort-wchar -mno-red-zone
+ 
+ ifeq ($(CONFIG_EFI_STUB), y)
+ 	VMLINUX_OBJS += $(obj)/eboot.o $(obj)/efi_stub_$(BITS).o
+@@ -43,7 +42,7 @@ OBJCOPYFLAGS_vmlinux.bin :=  -R .comment -S
+ $(obj)/vmlinux.bin: vmlinux FORCE
+ 	$(call if_changed,objcopy)
+ 
+-targets += vmlinux.bin.all vmlinux.relocs
++targets += $(patsubst $(obj)/%,%,$(VMLINUX_OBJS)) vmlinux.bin.all vmlinux.relocs
+ 
+ CMD_RELOCS = arch/x86/tools/relocs
+ quiet_cmd_relocs = RELOCS  $@
+diff --git a/arch/x86/include/asm/syscall.h b/arch/x86/include/asm/syscall.h
+index 1ace47b..2e188d6 100644
+--- a/arch/x86/include/asm/syscall.h
++++ b/arch/x86/include/asm/syscall.h
+@@ -29,13 +29,13 @@ extern const unsigned long sys_call_table[];
+  */
+ static inline int syscall_get_nr(struct task_struct *task, struct pt_regs *regs)
+ {
+-	return regs->orig_ax & __SYSCALL_MASK;
++	return regs->orig_ax;
+ }
+ 
+ static inline void syscall_rollback(struct task_struct *task,
+ 				    struct pt_regs *regs)
+ {
+-	regs->ax = regs->orig_ax & __SYSCALL_MASK;
++	regs->ax = regs->orig_ax;
+ }
+ 
+ static inline long syscall_get_error(struct task_struct *task,
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index 7881477..6d2f7c0 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -229,6 +229,8 @@ queue_store_##name(struct request_queue *q, const char *page, size_t count) \
+ 	unsigned long val;						\
+ 	ssize_t ret;							\
+ 	ret = queue_var_store(&val, page, count);			\
++	if (ret < 0)							\
++		 return ret;						\
+ 	if (neg)							\
+ 		val = !val;						\
+ 									\
+diff --git a/crypto/gcm.c b/crypto/gcm.c
+index 1a25263..b97b186 100644
+--- a/crypto/gcm.c
++++ b/crypto/gcm.c
+@@ -44,6 +44,7 @@ struct crypto_rfc4543_ctx {
+ 
+ struct crypto_rfc4543_req_ctx {
+ 	u8 auth_tag[16];
++	u8 assocbuf[32];
+ 	struct scatterlist cipher[1];
+ 	struct scatterlist payload[2];
+ 	struct scatterlist assoc[2];
+@@ -1142,9 +1143,19 @@ static struct aead_request *crypto_rfc4543_crypt(struct aead_request *req,
+ 	scatterwalk_crypto_chain(payload, dst, vdst == req->iv + 8, 2);
+ 	assoclen += 8 + req->cryptlen - (enc ? 0 : authsize);
+ 
+-	sg_init_table(assoc, 2);
+-	sg_set_page(assoc, sg_page(req->assoc), req->assoc->length,
+-		    req->assoc->offset);
++	if (req->assoc->length == req->assoclen) {
++		sg_init_table(assoc, 2);
++		sg_set_page(assoc, sg_page(req->assoc), req->assoc->length,
++			    req->assoc->offset);
++	} else {
++		BUG_ON(req->assoclen > sizeof(rctx->assocbuf));
++
++		scatterwalk_map_and_copy(rctx->assocbuf, req->assoc, 0,
++					 req->assoclen, 0);
++
++		sg_init_table(assoc, 2);
++		sg_set_buf(assoc, rctx->assocbuf, req->assoclen);
++	}
+ 	scatterwalk_crypto_chain(assoc, payload, 0, 2);
+ 
+ 	aead_request_set_tfm(subreq, ctx->child);
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index 7928d4d..eb73798 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -454,7 +454,6 @@ static int acpi_pci_root_add(struct acpi_device *device)
+ 	acpi_handle handle;
+ 	struct acpi_device *child;
+ 	u32 flags, base_flags;
+-	bool is_osc_granted = false;
+ 
+ 	root = kzalloc(sizeof(struct acpi_pci_root), GFP_KERNEL);
+ 	if (!root)
+@@ -525,60 +524,6 @@ static int acpi_pci_root_add(struct acpi_device *device)
+ 	flags = base_flags = OSC_PCI_SEGMENT_GROUPS_SUPPORT;
+ 	acpi_pci_osc_support(root, flags);
+ 
+-	/* Indicate support for various _OSC capabilities. */
+-	if (pci_ext_cfg_avail())
+-		flags |= OSC_EXT_PCI_CONFIG_SUPPORT;
+-	if (pcie_aspm_support_enabled()) {
+-		flags |= OSC_ACTIVE_STATE_PWR_SUPPORT |
+-		OSC_CLOCK_PWR_CAPABILITY_SUPPORT;
+-	}
+-	if (pci_msi_enabled())
+-		flags |= OSC_MSI_SUPPORT;
+-	if (flags != base_flags) {
+-		status = acpi_pci_osc_support(root, flags);
+-		if (ACPI_FAILURE(status)) {
+-			dev_info(&device->dev, "ACPI _OSC support "
+-				"notification failed, disabling PCIe ASPM\n");
+-			pcie_no_aspm();
+-			flags = base_flags;
+-		}
+-	}
+-	if (!pcie_ports_disabled
+-	    && (flags & ACPI_PCIE_REQ_SUPPORT) == ACPI_PCIE_REQ_SUPPORT) {
+-		flags = OSC_PCI_EXPRESS_CAP_STRUCTURE_CONTROL
+-			| OSC_PCI_EXPRESS_NATIVE_HP_CONTROL
+-			| OSC_PCI_EXPRESS_PME_CONTROL;
+-
+-		if (pci_aer_available()) {
+-			if (aer_acpi_firmware_first())
+-				dev_dbg(&device->dev,
+-					"PCIe errors handled by BIOS.\n");
+-			else
+-				flags |= OSC_PCI_EXPRESS_AER_CONTROL;
+-		}
+-
+-		dev_info(&device->dev,
+-			"Requesting ACPI _OSC control (0x%02x)\n", flags);
+-
+-		status = acpi_pci_osc_control_set(device->handle, &flags,
+-				       OSC_PCI_EXPRESS_CAP_STRUCTURE_CONTROL);
+-		if (ACPI_SUCCESS(status)) {
+-			is_osc_granted = true;
+-			dev_info(&device->dev,
+-				"ACPI _OSC control (0x%02x) granted\n", flags);
+-		} else {
+-			is_osc_granted = false;
+-			dev_info(&device->dev,
+-				"ACPI _OSC request failed (%s), "
+-				"returned control mask: 0x%02x\n",
+-				acpi_format_exception(status), flags);
+-		}
+-	} else {
+-		dev_info(&device->dev,
+-			"Unable to request _OSC control "
+-			"(_OSC support mask: 0x%02x)\n", flags);
+-	}
+-
+ 	/*
+ 	 * TBD: Need PCI interface for enumeration/configuration of roots.
+ 	 */
+@@ -618,14 +563,66 @@ static int acpi_pci_root_add(struct acpi_device *device)
+ 	list_for_each_entry(child, &device->children, node)
+ 		acpi_pci_bridge_scan(child);
+ 
+-	/* ASPM setting */
+-	if (is_osc_granted) {
+-		if (acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_ASPM)
+-			pcie_clear_aspm(root->bus);
++	/* Indicate support for various _OSC capabilities. */
++	if (pci_ext_cfg_avail())
++		flags |= OSC_EXT_PCI_CONFIG_SUPPORT;
++	if (pcie_aspm_support_enabled())
++		flags |= OSC_ACTIVE_STATE_PWR_SUPPORT |
++			OSC_CLOCK_PWR_CAPABILITY_SUPPORT;
++	if (pci_msi_enabled())
++		flags |= OSC_MSI_SUPPORT;
++	if (flags != base_flags) {
++		status = acpi_pci_osc_support(root, flags);
++		if (ACPI_FAILURE(status)) {
++			dev_info(root->bus->bridge, "ACPI _OSC support "
++				"notification failed, disabling PCIe ASPM\n");
++			pcie_no_aspm();
++			flags = base_flags;
++		}
++	}
++
++	if (!pcie_ports_disabled
++	    && (flags & ACPI_PCIE_REQ_SUPPORT) == ACPI_PCIE_REQ_SUPPORT) {
++		flags = OSC_PCI_EXPRESS_CAP_STRUCTURE_CONTROL
++			| OSC_PCI_EXPRESS_NATIVE_HP_CONTROL
++			| OSC_PCI_EXPRESS_PME_CONTROL;
++
++		if (pci_aer_available()) {
++			if (aer_acpi_firmware_first())
++				dev_dbg(root->bus->bridge,
++					"PCIe errors handled by BIOS.\n");
++			else
++				flags |= OSC_PCI_EXPRESS_AER_CONTROL;
++		}
++
++		dev_info(root->bus->bridge,
++			"Requesting ACPI _OSC control (0x%02x)\n", flags);
++
++		status = acpi_pci_osc_control_set(device->handle, &flags,
++					OSC_PCI_EXPRESS_CAP_STRUCTURE_CONTROL);
++		if (ACPI_SUCCESS(status)) {
++			dev_info(root->bus->bridge,
++				"ACPI _OSC control (0x%02x) granted\n", flags);
++			if (acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_ASPM) {
++				/*
++				 * We have ASPM control, but the FADT indicates
++				 * that it's unsupported. Clear it.
++				 */
++				pcie_clear_aspm(root->bus);
++			}
++		} else {
++			dev_info(root->bus->bridge,
++				"ACPI _OSC request failed (%s), "
++				"returned control mask: 0x%02x\n",
++				acpi_format_exception(status), flags);
++			pr_info("ACPI _OSC control for PCIe not granted, "
++				"disabling ASPM\n");
++			pcie_no_aspm();
++		}
+ 	} else {
+-		pr_info("ACPI _OSC control for PCIe not granted, "
+-			"disabling ASPM\n");
+-		pcie_no_aspm();
++		dev_info(root->bus->bridge,
++			 "Unable to request _OSC control "
++			 "(_OSC support mask: 0x%02x)\n", flags);
+ 	}
+ 
+ 	pci_acpi_add_bus_pm_notifier(device, root->bus);
+diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
+index d2ba439..78283bb 100644
+--- a/drivers/ata/ata_piix.c
++++ b/drivers/ata/ata_piix.c
+@@ -150,6 +150,7 @@ enum piix_controller_ids {
+ 	tolapai_sata,
+ 	piix_pata_vmw,			/* PIIX4 for VMware, spurious DMA_ERR */
+ 	ich8_sata_snb,
++	ich8_2port_sata_snb,
+ };
+ 
+ struct piix_map_db {
+@@ -304,7 +305,7 @@ static const struct pci_device_id piix_pci_tbl[] = {
+ 	/* SATA Controller IDE (Lynx Point) */
+ 	{ 0x8086, 0x8c01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+ 	/* SATA Controller IDE (Lynx Point) */
+-	{ 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
++	{ 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
+ 	/* SATA Controller IDE (Lynx Point) */
+ 	{ 0x8086, 0x8c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+ 	/* SATA Controller IDE (Lynx Point-LP) */
+@@ -439,6 +440,7 @@ static const struct piix_map_db *piix_map_db_table[] = {
+ 	[ich8m_apple_sata]	= &ich8m_apple_map_db,
+ 	[tolapai_sata]		= &tolapai_map_db,
+ 	[ich8_sata_snb]		= &ich8_map_db,
++	[ich8_2port_sata_snb]	= &ich8_2port_map_db,
+ };
+ 
+ static struct pci_bits piix_enable_bits[] = {
+@@ -1242,6 +1244,16 @@ static struct ata_port_info piix_port_info[] = {
+ 		.udma_mask	= ATA_UDMA6,
+ 		.port_ops	= &piix_sata_ops,
+ 	},
++
++	[ich8_2port_sata_snb] =
++	{
++		.flags		= PIIX_SATA_FLAGS | PIIX_FLAG_SIDPR
++					| PIIX_FLAG_PIO16,
++		.pio_mask	= ATA_PIO4,
++		.mwdma_mask	= ATA_MWDMA2,
++		.udma_mask	= ATA_UDMA6,
++		.port_ops	= &piix_sata_ops,
++	},
+ };
+ 
+ #define AHCI_PCI_BAR 5
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 46cd3f4..501c209 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2329,7 +2329,7 @@ int ata_dev_configure(struct ata_device *dev)
+ 		 * from SATA Settings page of Identify Device Data Log.
+ 		 */
+ 		if (ata_id_has_devslp(dev->id)) {
+-			u8 sata_setting[ATA_SECT_SIZE];
++			u8 *sata_setting = ap->sector_buf;
+ 			int i, j;
+ 
+ 			dev->flags |= ATA_DFLAG_DEVSLP;
+@@ -2437,6 +2437,9 @@ int ata_dev_configure(struct ata_device *dev)
+ 		dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128,
+ 					 dev->max_sectors);
+ 
++	if (dev->horkage & ATA_HORKAGE_MAX_SEC_LBA48)
++		dev->max_sectors = ATA_MAX_SECTORS_LBA48;
++
+ 	if (ap->ops->dev_config)
+ 		ap->ops->dev_config(dev);
+ 
+@@ -4098,6 +4101,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ 	/* Weird ATAPI devices */
+ 	{ "TORiSAN DVD-ROM DRD-N216", NULL,	ATA_HORKAGE_MAX_SEC_128 },
+ 	{ "QUANTUM DAT    DAT72-000", NULL,	ATA_HORKAGE_ATAPI_MOD16_DMA },
++	{ "Slimtype DVD A  DS8A8SH", NULL,	ATA_HORKAGE_MAX_SEC_LBA48 },
+ 
+ 	/* Devices we expect to fail diagnostics */
+ 
+diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
+index e6732cf..79f4fca 100644
+--- a/drivers/base/regmap/regcache-rbtree.c
++++ b/drivers/base/regmap/regcache-rbtree.c
+@@ -398,7 +398,7 @@ static int regcache_rbtree_sync(struct regmap *map, unsigned int min,
+ 			base = 0;
+ 
+ 		if (max < rbnode->base_reg + rbnode->blklen)
+-			end = rbnode->base_reg + rbnode->blklen - max;
++			end = max - rbnode->base_reg + 1;
+ 		else
+ 			end = rbnode->blklen;
+ 
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index f00b059..ab3a020 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -662,12 +662,12 @@ struct regmap *regmap_init(struct device *dev,
+ 		}
+ 	}
+ 
++	regmap_debugfs_init(map, config->name);
++
+ 	ret = regcache_init(map, config);
+ 	if (ret != 0)
+ 		goto err_range;
+ 
+-	regmap_debugfs_init(map, config->name);
+-
+ 	/* Add a devres resource for dev_get_regmap() */
+ 	m = devres_alloc(dev_get_regmap_release, sizeof(*m), GFP_KERNEL);
+ 	if (!m) {
+diff --git a/drivers/cpufreq/exynos-cpufreq.c b/drivers/cpufreq/exynos-cpufreq.c
+index 7012ea8..41fc550 100644
+--- a/drivers/cpufreq/exynos-cpufreq.c
++++ b/drivers/cpufreq/exynos-cpufreq.c
+@@ -222,8 +222,6 @@ static int exynos_cpufreq_cpu_init(struct cpufreq_policy *policy)
+ 
+ 	cpufreq_frequency_table_get_attr(exynos_info->freq_table, policy->cpu);
+ 
+-	locking_frequency = exynos_getspeed(0);
+-
+ 	/* set the transition latency value */
+ 	policy->cpuinfo.transition_latency = 100000;
+ 
+@@ -288,6 +286,8 @@ static int __init exynos_cpufreq_init(void)
+ 		goto err_vdd_arm;
+ 	}
+ 
++	locking_frequency = exynos_getspeed(0);
++
+ 	register_pm_notifier(&exynos_cpufreq_nb);
+ 
+ 	if (cpufreq_register_driver(&exynos_driver)) {
+diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c
+index 8bc5fef..22c9063 100644
+--- a/drivers/crypto/ux500/cryp/cryp_core.c
++++ b/drivers/crypto/ux500/cryp/cryp_core.c
+@@ -1750,7 +1750,7 @@ static struct platform_driver cryp_driver = {
+ 	.shutdown = ux500_cryp_shutdown,
+ 	.driver = {
+ 		.owner = THIS_MODULE,
+-		.name  = "cryp1"
++		.name  = "cryp1",
+ 		.pm    = &ux500_cryp_pm,
+ 	}
+ };
+diff --git a/drivers/eisa/pci_eisa.c b/drivers/eisa/pci_eisa.c
+index cdae207..6c3fca9 100644
+--- a/drivers/eisa/pci_eisa.c
++++ b/drivers/eisa/pci_eisa.c
+@@ -19,10 +19,10 @@
+ /* There is only *one* pci_eisa device per machine, right ? */
+ static struct eisa_root_device pci_eisa_root;
+ 
+-static int __init pci_eisa_init(struct pci_dev *pdev,
+-				const struct pci_device_id *ent)
++static int __init pci_eisa_init(struct pci_dev *pdev)
+ {
+-	int rc;
++	int rc, i;
++	struct resource *res, *bus_res = NULL;
+ 
+ 	if ((rc = pci_enable_device (pdev))) {
+ 		printk (KERN_ERR "pci_eisa : Could not enable device %s\n",
+@@ -30,9 +30,30 @@ static int __init pci_eisa_init(struct pci_dev *pdev,
+ 		return rc;
+ 	}
+ 
++	/*
++	 * The Intel 82375 PCI-EISA bridge is a subtractive-decode PCI
++	 * device, so the resources available on EISA are the same as those
++	 * available on the 82375 bus.  This works the same as a PCI-PCI
++	 * bridge in subtractive-decode mode (see pci_read_bridge_bases()).
++	 * We assume other PCI-EISA bridges are similar.
++	 *
++	 * eisa_root_register() can only deal with a single io port resource,
++	*  so we use the first valid io port resource.
++	 */
++	pci_bus_for_each_resource(pdev->bus, res, i)
++		if (res && (res->flags & IORESOURCE_IO)) {
++			bus_res = res;
++			break;
++		}
++
++	if (!bus_res) {
++		dev_err(&pdev->dev, "No resources available\n");
++		return -1;
++	}
++
+ 	pci_eisa_root.dev              = &pdev->dev;
+-	pci_eisa_root.res	       = pdev->bus->resource[0];
+-	pci_eisa_root.bus_base_addr    = pdev->bus->resource[0]->start;
++	pci_eisa_root.res	       = bus_res;
++	pci_eisa_root.bus_base_addr    = bus_res->start;
+ 	pci_eisa_root.slots	       = EISA_MAX_SLOTS;
+ 	pci_eisa_root.dma_mask         = pdev->dma_mask;
+ 	dev_set_drvdata(pci_eisa_root.dev, &pci_eisa_root);
+@@ -45,22 +66,26 @@ static int __init pci_eisa_init(struct pci_dev *pdev,
+ 	return 0;
+ }
+ 
+-static struct pci_device_id pci_eisa_pci_tbl[] = {
+-	{ PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+-	  PCI_CLASS_BRIDGE_EISA << 8, 0xffff00, 0 },
+-	{ 0, }
+-};
++/*
++ * We have to call pci_eisa_init_early() before pnpacpi_init()/isapnp_init().
++ *   Otherwise pnp resource will get enabled early and could prevent eisa
++ *   to be initialized.
++ * Also need to make sure pci_eisa_init_early() is called after
++ * x86/pci_subsys_init().
++ * So need to use subsys_initcall_sync with it.
++ */
++static int __init pci_eisa_init_early(void)
++{
++	struct pci_dev *dev = NULL;
++	int ret;
+ 
+-static struct pci_driver __refdata pci_eisa_driver = {
+-	.name		= "pci_eisa",
+-	.id_table	= pci_eisa_pci_tbl,
+-	.probe		= pci_eisa_init,
+-};
++	for_each_pci_dev(dev)
++		if ((dev->class >> 8) == PCI_CLASS_BRIDGE_EISA) {
++			ret = pci_eisa_init(dev);
++			if (ret)
++				return ret;
++		}
+ 
+-static int __init pci_eisa_init_module (void)
+-{
+-	return pci_register_driver (&pci_eisa_driver);
++	return 0;
+ }
+-
+-device_initcall(pci_eisa_init_module);
+-MODULE_DEVICE_TABLE(pci, pci_eisa_pci_tbl);
++subsys_initcall_sync(pci_eisa_init_early);
+diff --git a/drivers/gpio/gpio-stmpe.c b/drivers/gpio/gpio-stmpe.c
+index 770476a..3ce5bc3 100644
+--- a/drivers/gpio/gpio-stmpe.c
++++ b/drivers/gpio/gpio-stmpe.c
+@@ -307,11 +307,15 @@ static const struct irq_domain_ops stmpe_gpio_irq_simple_ops = {
+ 	.xlate = irq_domain_xlate_twocell,
+ };
+ 
+-static int stmpe_gpio_irq_init(struct stmpe_gpio *stmpe_gpio)
++static int stmpe_gpio_irq_init(struct stmpe_gpio *stmpe_gpio,
++		struct device_node *np)
+ {
+-	int base = stmpe_gpio->irq_base;
++	int base = 0;
+ 
+-	stmpe_gpio->domain = irq_domain_add_simple(NULL,
++	if (!np)
++		base = stmpe_gpio->irq_base;
++
++	stmpe_gpio->domain = irq_domain_add_simple(np,
+ 				stmpe_gpio->chip.ngpio, base,
+ 				&stmpe_gpio_irq_simple_ops, stmpe_gpio);
+ 	if (!stmpe_gpio->domain) {
+@@ -346,6 +350,9 @@ static int stmpe_gpio_probe(struct platform_device *pdev)
+ 	stmpe_gpio->chip = template_chip;
+ 	stmpe_gpio->chip.ngpio = stmpe->num_gpios;
+ 	stmpe_gpio->chip.dev = &pdev->dev;
++#ifdef CONFIG_OF
++	stmpe_gpio->chip.of_node = np;
++#endif
+ 	stmpe_gpio->chip.base = pdata ? pdata->gpio_base : -1;
+ 
+ 	if (pdata)
+@@ -366,7 +373,7 @@ static int stmpe_gpio_probe(struct platform_device *pdev)
+ 		goto out_free;
+ 
+ 	if (irq >= 0) {
+-		ret = stmpe_gpio_irq_init(stmpe_gpio);
++		ret = stmpe_gpio_irq_init(stmpe_gpio, np);
+ 		if (ret)
+ 			goto out_disable;
+ 
+diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
+index 133b413..32d7775 100644
+--- a/drivers/gpu/drm/drm_fops.c
++++ b/drivers/gpu/drm/drm_fops.c
+@@ -123,6 +123,7 @@ int drm_open(struct inode *inode, struct file *filp)
+ 	int retcode = 0;
+ 	int need_setup = 0;
+ 	struct address_space *old_mapping;
++	struct address_space *old_imapping;
+ 
+ 	minor = idr_find(&drm_minors_idr, minor_id);
+ 	if (!minor)
+@@ -137,6 +138,7 @@ int drm_open(struct inode *inode, struct file *filp)
+ 	if (!dev->open_count++)
+ 		need_setup = 1;
+ 	mutex_lock(&dev->struct_mutex);
++	old_imapping = inode->i_mapping;
+ 	old_mapping = dev->dev_mapping;
+ 	if (old_mapping == NULL)
+ 		dev->dev_mapping = &inode->i_data;
+@@ -159,8 +161,8 @@ int drm_open(struct inode *inode, struct file *filp)
+ 
+ err_undo:
+ 	mutex_lock(&dev->struct_mutex);
+-	filp->f_mapping = old_mapping;
+-	inode->i_mapping = old_mapping;
++	filp->f_mapping = old_imapping;
++	inode->i_mapping = old_imapping;
+ 	iput(container_of(dev->dev_mapping, struct inode, i_data));
+ 	dev->dev_mapping = old_mapping;
+ 	mutex_unlock(&dev->struct_mutex);
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index 7adf5a7..ba8805a 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -43,7 +43,7 @@ eb_create(int size)
+ {
+ 	struct eb_objects *eb;
+ 	int count = PAGE_SIZE / sizeof(struct hlist_head) / 2;
+-	BUILD_BUG_ON(!is_power_of_2(PAGE_SIZE / sizeof(struct hlist_head)));
++	BUILD_BUG_ON_NOT_POWER_OF_2(PAGE_SIZE / sizeof(struct hlist_head));
+ 	while (count > size)
+ 		count >>= 1;
+ 	eb = kzalloc(count*sizeof(struct hlist_head) +
+diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
+index b52ed09..625b091 100644
+--- a/drivers/gpu/drm/i915/intel_crt.c
++++ b/drivers/gpu/drm/i915/intel_crt.c
+@@ -45,6 +45,9 @@
+ 
+ struct intel_crt {
+ 	struct intel_encoder base;
++	/* DPMS state is stored in the connector, which we need in the
++	 * encoder's enable/disable callbacks */
++	struct intel_connector *connector;
+ 	bool force_hotplug_required;
+ 	u32 adpa_reg;
+ };
+@@ -81,29 +84,6 @@ static bool intel_crt_get_hw_state(struct intel_encoder *encoder,
+ 	return true;
+ }
+ 
+-static void intel_disable_crt(struct intel_encoder *encoder)
+-{
+-	struct drm_i915_private *dev_priv = encoder->base.dev->dev_private;
+-	struct intel_crt *crt = intel_encoder_to_crt(encoder);
+-	u32 temp;
+-
+-	temp = I915_READ(crt->adpa_reg);
+-	temp |= ADPA_HSYNC_CNTL_DISABLE | ADPA_VSYNC_CNTL_DISABLE;
+-	temp &= ~ADPA_DAC_ENABLE;
+-	I915_WRITE(crt->adpa_reg, temp);
+-}
+-
+-static void intel_enable_crt(struct intel_encoder *encoder)
+-{
+-	struct drm_i915_private *dev_priv = encoder->base.dev->dev_private;
+-	struct intel_crt *crt = intel_encoder_to_crt(encoder);
+-	u32 temp;
+-
+-	temp = I915_READ(crt->adpa_reg);
+-	temp |= ADPA_DAC_ENABLE;
+-	I915_WRITE(crt->adpa_reg, temp);
+-}
+-
+ /* Note: The caller is required to filter out dpms modes not supported by the
+  * platform. */
+ static void intel_crt_set_dpms(struct intel_encoder *encoder, int mode)
+@@ -135,6 +115,19 @@ static void intel_crt_set_dpms(struct intel_encoder *encoder, int mode)
+ 	I915_WRITE(crt->adpa_reg, temp);
+ }
+ 
++static void intel_disable_crt(struct intel_encoder *encoder)
++{
++	intel_crt_set_dpms(encoder, DRM_MODE_DPMS_OFF);
++}
++
++static void intel_enable_crt(struct intel_encoder *encoder)
++{
++	struct intel_crt *crt = intel_encoder_to_crt(encoder);
++
++	intel_crt_set_dpms(encoder, crt->connector->base.dpms);
++}
++
++
+ static void intel_crt_dpms(struct drm_connector *connector, int mode)
+ {
+ 	struct drm_device *dev = connector->dev;
+@@ -746,6 +739,7 @@ void intel_crt_init(struct drm_device *dev)
+ 	}
+ 
+ 	connector = &intel_connector->base;
++	crt->connector = intel_connector;
+ 	drm_connector_init(dev, &intel_connector->base,
+ 			   &intel_crt_connector_funcs, DRM_MODE_CONNECTOR_VGA);
+ 
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index e6e4df7..d3f834a 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -8901,6 +8901,15 @@ static struct intel_quirk intel_quirks[] = {
+ 
+ 	/* Acer Aspire 4736Z */
+ 	{ 0x2a42, 0x1025, 0x0260, quirk_invert_brightness },
++
++	/* Acer/eMachines G725 */
++	{ 0x2a42, 0x1025, 0x0210, quirk_invert_brightness },
++
++	/* Acer/eMachines e725 */
++	{ 0x2a42, 0x1025, 0x0212, quirk_invert_brightness },
++
++	/* Acer/Packard Bell NCL20 */
++	{ 0x2a42, 0x1025, 0x034b, quirk_invert_brightness },
+ };
+ 
+ static void intel_init_quirks(struct drm_device *dev)
+diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
+index 4f50c40..2e7c949 100644
+--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
++++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
+@@ -751,8 +751,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
+ 	int i;
+ 	unsigned char misc = 0;
+ 	unsigned char ext_vga[6];
+-	unsigned char ext_vga_index24;
+-	unsigned char dac_index90 = 0;
+ 	u8 bppshift;
+ 
+ 	static unsigned char dacvalue[] = {
+@@ -803,7 +801,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
+ 		option2 = 0x0000b000;
+ 		break;
+ 	case G200_ER:
+-		dac_index90 = 0;
+ 		break;
+ 	}
+ 
+@@ -852,10 +849,8 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
+ 		WREG_DAC(i, dacvalue[i]);
+ 	}
+ 
+-	if (mdev->type == G200_ER) {
+-		WREG_DAC(0x90, dac_index90);
+-	}
+-
++	if (mdev->type == G200_ER)
++		WREG_DAC(0x90, 0);
+ 
+ 	if (option)
+ 		pci_write_config_dword(dev->pdev, PCI_MGA_OPTION, option);
+@@ -952,8 +947,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
+ 	if (mdev->type == G200_WB)
+ 		ext_vga[1] |= 0x88;
+ 
+-	ext_vga_index24 = 0x05;
+-
+ 	/* Set pixel clocks */
+ 	misc = 0x2d;
+ 	WREG8(MGA_MISC_OUT, misc);
+@@ -965,7 +958,7 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
+ 	}
+ 
+ 	if (mdev->type == G200_ER)
+-		WREG_ECRT(24, ext_vga_index24);
++		WREG_ECRT(0x24, 0x5);
+ 
+ 	if (mdev->type == G200_EV) {
+ 		WREG_ECRT(6, 0);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
+index 4124192..b569fe8 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
++++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
+@@ -386,7 +386,7 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
+ 	struct nouveau_drm *drm = nouveau_drm(dev);
+ 	struct nouveau_device *device = nv_device(drm->device);
+ 	struct nouveau_abi16 *abi16 = nouveau_abi16_get(file_priv, dev);
+-	struct nouveau_abi16_chan *chan, *temp;
++	struct nouveau_abi16_chan *chan = NULL, *temp;
+ 	struct nouveau_abi16_ntfy *ntfy;
+ 	struct nouveau_object *object;
+ 	struct nv_dma_class args = {};
+@@ -399,10 +399,11 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
+ 	if (unlikely(nv_device(abi16->device)->card_type >= NV_C0))
+ 		return nouveau_abi16_put(abi16, -EINVAL);
+ 
+-	list_for_each_entry_safe(chan, temp, &abi16->channels, head) {
+-		if (chan->chan->handle == (NVDRM_CHAN | info->channel))
++	list_for_each_entry(temp, &abi16->channels, head) {
++		if (temp->chan->handle == (NVDRM_CHAN | info->channel)) {
++			chan = temp;
+ 			break;
+-		chan = NULL;
++		}
+ 	}
+ 
+ 	if (!chan)
+@@ -454,17 +455,18 @@ nouveau_abi16_ioctl_gpuobj_free(ABI16_IOCTL_ARGS)
+ {
+ 	struct drm_nouveau_gpuobj_free *fini = data;
+ 	struct nouveau_abi16 *abi16 = nouveau_abi16_get(file_priv, dev);
+-	struct nouveau_abi16_chan *chan, *temp;
++	struct nouveau_abi16_chan *chan = NULL, *temp;
+ 	struct nouveau_abi16_ntfy *ntfy;
+ 	int ret;
+ 
+ 	if (unlikely(!abi16))
+ 		return -ENOMEM;
+ 
+-	list_for_each_entry_safe(chan, temp, &abi16->channels, head) {
+-		if (chan->chan->handle == (NVDRM_CHAN | fini->channel))
++	list_for_each_entry(temp, &abi16->channels, head) {
++		if (temp->chan->handle == (NVDRM_CHAN | fini->channel)) {
++			chan = temp;
+ 			break;
+-		chan = NULL;
++		}
+ 	}
+ 
+ 	if (!chan)
+diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
+index 25ddf3e..811062c 100644
+--- a/drivers/hid/hid-magicmouse.c
++++ b/drivers/hid/hid-magicmouse.c
+@@ -462,6 +462,21 @@ static int magicmouse_input_mapping(struct hid_device *hdev,
+ 	return 0;
+ }
+ 
++static void magicmouse_input_configured(struct hid_device *hdev,
++		struct hid_input *hi)
++
++{
++	struct magicmouse_sc *msc = hid_get_drvdata(hdev);
++
++	int ret = magicmouse_setup_input(msc->input, hdev);
++	if (ret) {
++		hid_err(hdev, "magicmouse setup input failed (%d)\n", ret);
++		/* clean msc->input to notify probe() of the failure */
++		msc->input = NULL;
++	}
++}
++
++
+ static int magicmouse_probe(struct hid_device *hdev,
+ 	const struct hid_device_id *id)
+ {
+@@ -493,15 +508,10 @@ static int magicmouse_probe(struct hid_device *hdev,
+ 		goto err_free;
+ 	}
+ 
+-	/* We do this after hid-input is done parsing reports so that
+-	 * hid-input uses the most natural button and axis IDs.
+-	 */
+-	if (msc->input) {
+-		ret = magicmouse_setup_input(msc->input, hdev);
+-		if (ret) {
+-			hid_err(hdev, "magicmouse setup input failed (%d)\n", ret);
+-			goto err_stop_hw;
+-		}
++	if (!msc->input) {
++		hid_err(hdev, "magicmouse input not registered\n");
++		ret = -ENOMEM;
++		goto err_stop_hw;
+ 	}
+ 
+ 	if (id->product == USB_DEVICE_ID_APPLE_MAGICMOUSE)
+@@ -568,6 +578,7 @@ static struct hid_driver magicmouse_driver = {
+ 	.remove = magicmouse_remove,
+ 	.raw_event = magicmouse_raw_event,
+ 	.input_mapping = magicmouse_input_mapping,
++	.input_configured = magicmouse_input_configured,
+ };
+ 
+ static int __init magicmouse_init(void)
+diff --git a/drivers/hwspinlock/hwspinlock_core.c b/drivers/hwspinlock/hwspinlock_core.c
+index db713c0..461a0d7 100644
+--- a/drivers/hwspinlock/hwspinlock_core.c
++++ b/drivers/hwspinlock/hwspinlock_core.c
+@@ -416,6 +416,8 @@ static int __hwspin_lock_request(struct hwspinlock *hwlock)
+ 	ret = pm_runtime_get_sync(dev);
+ 	if (ret < 0) {
+ 		dev_err(dev, "%s: can't power on device\n", __func__);
++		pm_runtime_put_noidle(dev);
++		module_put(dev->driver->owner);
+ 		return ret;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index b3e3294..0d03d38 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -7858,12 +7858,19 @@ static int __init ixgbe_init_module(void)
+ 	ixgbe_dbg_init();
+ #endif /* CONFIG_DEBUG_FS */
+ 
++	ret = pci_register_driver(&ixgbe_driver);
++	if (ret) {
++#ifdef CONFIG_DEBUG_FS
++		ixgbe_dbg_exit();
++#endif /* CONFIG_DEBUG_FS */
++		return ret;
++	}
++
+ #ifdef CONFIG_IXGBE_DCA
+ 	dca_register_notify(&dca_notifier);
+ #endif
+ 
+-	ret = pci_register_driver(&ixgbe_driver);
+-	return ret;
++	return 0;
+ }
+ 
+ module_init(ixgbe_init_module);
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 998974f..2d849da 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -3819,6 +3819,30 @@ static void rtl_init_mdio_ops(struct rtl8169_private *tp)
+ 	}
+ }
+ 
++static void rtl_speed_down(struct rtl8169_private *tp)
++{
++	u32 adv;
++	int lpa;
++
++	rtl_writephy(tp, 0x1f, 0x0000);
++	lpa = rtl_readphy(tp, MII_LPA);
++
++	if (lpa & (LPA_10HALF | LPA_10FULL))
++		adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full;
++	else if (lpa & (LPA_100HALF | LPA_100FULL))
++		adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full |
++		      ADVERTISED_100baseT_Half | ADVERTISED_100baseT_Full;
++	else
++		adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full |
++		      ADVERTISED_100baseT_Half | ADVERTISED_100baseT_Full |
++		      (tp->mii.supports_gmii ?
++		       ADVERTISED_1000baseT_Half |
++		       ADVERTISED_1000baseT_Full : 0);
++
++	rtl8169_set_speed(tp->dev, AUTONEG_ENABLE, SPEED_1000, DUPLEX_FULL,
++			  adv);
++}
++
+ static void rtl_wol_suspend_quirk(struct rtl8169_private *tp)
+ {
+ 	void __iomem *ioaddr = tp->mmio_addr;
+@@ -3849,9 +3873,7 @@ static bool rtl_wol_pll_power_down(struct rtl8169_private *tp)
+ 	if (!(__rtl8169_get_wol(tp) & WAKE_ANY))
+ 		return false;
+ 
+-	rtl_writephy(tp, 0x1f, 0x0000);
+-	rtl_writephy(tp, MII_BMCR, 0x0000);
+-
++	rtl_speed_down(tp);
+ 	rtl_wol_suspend_quirk(tp);
+ 
+ 	return true;
+diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
+index cdb11b3..3eca710 100644
+--- a/drivers/net/wireless/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/mwifiex/cfg80211.c
+@@ -1846,7 +1846,8 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
+ 		}
+ 	}
+ 
+-	for (i = 0; i < request->n_channels; i++) {
++	for (i = 0; i < min_t(u32, request->n_channels,
++			      MWIFIEX_USER_SCAN_CHAN_MAX); i++) {
+ 		chan = request->channels[i];
+ 		priv->user_scan_cfg->chan_list[i].chan_number = chan->hw_value;
+ 		priv->user_scan_cfg->chan_list[i].radio_type = chan->band;
+diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
+index 8955a0e..771be26 100644
+--- a/drivers/net/wireless/mwifiex/scan.c
++++ b/drivers/net/wireless/mwifiex/scan.c
+@@ -1371,8 +1371,10 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
+ 			queue_work(adapter->workqueue, &adapter->main_work);
+ 
+ 			/* Perform internal scan synchronously */
+-			if (!priv->scan_request)
++			if (!priv->scan_request) {
++				dev_dbg(adapter->dev, "wait internal scan\n");
+ 				mwifiex_wait_queue_complete(adapter, cmd_node);
++			}
+ 		} else {
+ 			spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
+ 					       flags);
+@@ -1768,7 +1770,12 @@ check_next_scan:
+ 		/* Need to indicate IOCTL complete */
+ 		if (adapter->curr_cmd->wait_q_enabled) {
+ 			adapter->cmd_wait_q.status = 0;
+-			mwifiex_complete_cmd(adapter, adapter->curr_cmd);
++			if (!priv->scan_request) {
++				dev_dbg(adapter->dev,
++					"complete internal scan\n");
++				mwifiex_complete_cmd(adapter,
++						     adapter->curr_cmd);
++			}
+ 		}
+ 		if (priv->report_scan_result)
+ 			priv->report_scan_result = false;
+diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
+index a0c8cae..b1c673e 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
++++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
+@@ -52,8 +52,8 @@ int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
+ 		udelay(REGISTER_BUSY_DELAY);
+ 	}
+ 
+-	ERROR(rt2x00dev, "Indirect register access failed: "
+-	      "offset=0x%.08x, value=0x%.08x\n", offset, *reg);
++	printk_once(KERN_ERR "%s() Indirect register access failed: "
++	      "offset=0x%.08x, value=0x%.08x\n", __func__, offset, *reg);
+ 	*reg = ~0;
+ 
+ 	return 0;
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index 1af4008..21354bf 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -53,14 +53,15 @@ static void pci_acpi_wake_dev(acpi_handle handle, u32 event, void *context)
+ 		return;
+ 	}
+ 
+-	if (!pci_dev->pm_cap || !pci_dev->pme_support
+-	     || pci_check_pme_status(pci_dev)) {
+-		if (pci_dev->pme_poll)
+-			pci_dev->pme_poll = false;
++	/* Clear PME Status if set. */
++	if (pci_dev->pme_support)
++		pci_check_pme_status(pci_dev);
+ 
+-		pci_wakeup_event(pci_dev);
+-		pm_runtime_resume(&pci_dev->dev);
+-	}
++	if (pci_dev->pme_poll)
++		pci_dev->pme_poll = false;
++
++	pci_wakeup_event(pci_dev);
++	pm_runtime_resume(&pci_dev->dev);
+ 
+ 	if (pci_dev->subordinate)
+ 		pci_pme_wakeup_bus(pci_dev->subordinate);
+diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
+index 08c243a..ed4d094 100644
+--- a/drivers/pci/pcie/portdrv_pci.c
++++ b/drivers/pci/pcie/portdrv_pci.c
+@@ -185,14 +185,6 @@ static const struct dev_pm_ops pcie_portdrv_pm_ops = {
+ #endif /* !PM */
+ 
+ /*
+- * PCIe port runtime suspend is broken for some chipsets, so use a
+- * black list to disable runtime PM for these chipsets.
+- */
+-static const struct pci_device_id port_runtime_pm_black_list[] = {
+-	{ /* end: all zeroes */ }
+-};
+-
+-/*
+  * pcie_portdrv_probe - Probe PCI-Express port devices
+  * @dev: PCI-Express port device being probed
+  *
+@@ -225,16 +217,11 @@ static int pcie_portdrv_probe(struct pci_dev *dev,
+ 	 * it by default.
+ 	 */
+ 	dev->d3cold_allowed = false;
+-	if (!pci_match_id(port_runtime_pm_black_list, dev))
+-		pm_runtime_put_noidle(&dev->dev);
+-
+ 	return 0;
+ }
+ 
+ static void pcie_portdrv_remove(struct pci_dev *dev)
+ {
+-	if (!pci_match_id(port_runtime_pm_black_list, dev))
+-		pm_runtime_get_noresume(&dev->dev);
+ 	pcie_port_device_remove(dev);
+ 	pci_disable_device(dev);
+ }
+diff --git a/drivers/platform/x86/msi-wmi.c b/drivers/platform/x86/msi-wmi.c
+index 2264331..b96766b 100644
+--- a/drivers/platform/x86/msi-wmi.c
++++ b/drivers/platform/x86/msi-wmi.c
+@@ -176,7 +176,7 @@ static void msi_wmi_notify(u32 value, void *context)
+ 				pr_debug("Suppressed key event 0x%X - "
+ 					 "Last press was %lld us ago\n",
+ 					 key->code, ktime_to_us(diff));
+-				return;
++				goto msi_wmi_notify_exit;
+ 			}
+ 			last_pressed[key->code - SCANCODE_BASE] = cur;
+ 
+@@ -195,6 +195,8 @@ static void msi_wmi_notify(u32 value, void *context)
+ 			pr_info("Unknown key pressed - %x\n", eventcode);
+ 	} else
+ 		pr_info("Unknown event received\n");
++
++msi_wmi_notify_exit:
+ 	kfree(response.pointer);
+ }
+ 
+diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
+index 96ce101..a936efb 100644
+--- a/drivers/remoteproc/Kconfig
++++ b/drivers/remoteproc/Kconfig
+@@ -5,7 +5,7 @@ config REMOTEPROC
+ 	tristate
+ 	depends on EXPERIMENTAL
+ 	depends on HAS_DMA
+-	select FW_CONFIG
++	select FW_LOADER
+ 	select VIRTIO
+ 
+ config OMAP_REMOTEPROC
+diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
+index dd3bfaf..752b507 100644
+--- a/drivers/remoteproc/remoteproc_core.c
++++ b/drivers/remoteproc/remoteproc_core.c
+@@ -370,10 +370,12 @@ static int rproc_handle_vdev(struct rproc *rproc, struct fw_rsc_vdev *rsc,
+ 	/* it is now safe to add the virtio device */
+ 	ret = rproc_add_virtio_dev(rvdev, rsc->id);
+ 	if (ret)
+-		goto free_rvdev;
++		goto remove_rvdev;
+ 
+ 	return 0;
+ 
++remove_rvdev:
++	list_del(&rvdev->node);
+ free_rvdev:
+ 	kfree(rvdev);
+ 	return ret;
+diff --git a/drivers/remoteproc/ste_modem_rproc.c b/drivers/remoteproc/ste_modem_rproc.c
+index a7743c0..fb95c42 100644
+--- a/drivers/remoteproc/ste_modem_rproc.c
++++ b/drivers/remoteproc/ste_modem_rproc.c
+@@ -240,6 +240,8 @@ static int sproc_drv_remove(struct platform_device *pdev)
+ 
+ 	/* Unregister as remoteproc device */
+ 	rproc_del(sproc->rproc);
++	dma_free_coherent(sproc->rproc->dev.parent, SPROC_FW_SIZE,
++			  sproc->fw_addr, sproc->fw_dma_addr);
+ 	rproc_put(sproc->rproc);
+ 
+ 	mdev->drv_data = NULL;
+@@ -297,10 +299,13 @@ static int sproc_probe(struct platform_device *pdev)
+ 	/* Register as a remoteproc device */
+ 	err = rproc_add(rproc);
+ 	if (err)
+-		goto free_rproc;
++		goto free_mem;
+ 
+ 	return 0;
+ 
++free_mem:
++	dma_free_coherent(rproc->dev.parent, SPROC_FW_SIZE,
++			  sproc->fw_addr, sproc->fw_dma_addr);
+ free_rproc:
+ 	/* Reset device data upon error */
+ 	mdev->drv_data = NULL;
+diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
+index d38b267..b6469e2 100644
+--- a/drivers/rtc/rtc-at91rm9200.c
++++ b/drivers/rtc/rtc-at91rm9200.c
+@@ -44,7 +44,6 @@ static DECLARE_COMPLETION(at91_rtc_updated);
+ static unsigned int at91_alarm_year = AT91_RTC_EPOCH;
+ static void __iomem *at91_rtc_regs;
+ static int irq;
+-static u32 at91_rtc_imr;
+ 
+ /*
+  * Decode time/date into rtc_time structure
+@@ -109,11 +108,9 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm)
+ 	cr = at91_rtc_read(AT91_RTC_CR);
+ 	at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM);
+ 
+-	at91_rtc_imr |= AT91_RTC_ACKUPD;
+ 	at91_rtc_write(AT91_RTC_IER, AT91_RTC_ACKUPD);
+ 	wait_for_completion(&at91_rtc_updated);	/* wait for ACKUPD interrupt */
+ 	at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD);
+-	at91_rtc_imr &= ~AT91_RTC_ACKUPD;
+ 
+ 	at91_rtc_write(AT91_RTC_TIMR,
+ 			  bin2bcd(tm->tm_sec) << 0
+@@ -145,7 +142,7 @@ static int at91_rtc_readalarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 	tm->tm_yday = rtc_year_days(tm->tm_mday, tm->tm_mon, tm->tm_year);
+ 	tm->tm_year = at91_alarm_year - 1900;
+ 
+-	alrm->enabled = (at91_rtc_imr & AT91_RTC_ALARM)
++	alrm->enabled = (at91_rtc_read(AT91_RTC_IMR) & AT91_RTC_ALARM)
+ 			? 1 : 0;
+ 
+ 	pr_debug("%s(): %4d-%02d-%02d %02d:%02d:%02d\n", __func__,
+@@ -171,7 +168,6 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 	tm.tm_sec = alrm->time.tm_sec;
+ 
+ 	at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
+-	at91_rtc_imr &= ~AT91_RTC_ALARM;
+ 	at91_rtc_write(AT91_RTC_TIMALR,
+ 		  bin2bcd(tm.tm_sec) << 0
+ 		| bin2bcd(tm.tm_min) << 8
+@@ -184,7 +180,6 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 
+ 	if (alrm->enabled) {
+ 		at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
+-		at91_rtc_imr |= AT91_RTC_ALARM;
+ 		at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
+ 	}
+ 
+@@ -201,12 +196,9 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
+ 
+ 	if (enabled) {
+ 		at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
+-		at91_rtc_imr |= AT91_RTC_ALARM;
+ 		at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
+-	} else {
++	} else
+ 		at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
+-		at91_rtc_imr &= ~AT91_RTC_ALARM;
+-	}
+ 
+ 	return 0;
+ }
+@@ -215,10 +207,12 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
+  */
+ static int at91_rtc_proc(struct device *dev, struct seq_file *seq)
+ {
++	unsigned long imr = at91_rtc_read(AT91_RTC_IMR);
++
+ 	seq_printf(seq, "update_IRQ\t: %s\n",
+-			(at91_rtc_imr & AT91_RTC_ACKUPD) ? "yes" : "no");
++			(imr & AT91_RTC_ACKUPD) ? "yes" : "no");
+ 	seq_printf(seq, "periodic_IRQ\t: %s\n",
+-			(at91_rtc_imr & AT91_RTC_SECEV) ? "yes" : "no");
++			(imr & AT91_RTC_SECEV) ? "yes" : "no");
+ 
+ 	return 0;
+ }
+@@ -233,7 +227,7 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
+ 	unsigned int rtsr;
+ 	unsigned long events = 0;
+ 
+-	rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_imr;
++	rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_read(AT91_RTC_IMR);
+ 	if (rtsr) {		/* this interrupt is shared!  Is it ours? */
+ 		if (rtsr & AT91_RTC_ALARM)
+ 			events |= (RTC_AF | RTC_IRQF);
+@@ -297,7 +291,6 @@ static int __init at91_rtc_probe(struct platform_device *pdev)
+ 	at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
+ 					AT91_RTC_SECEV | AT91_RTC_TIMEV |
+ 					AT91_RTC_CALEV);
+-	at91_rtc_imr = 0;
+ 
+ 	ret = request_irq(irq, at91_rtc_interrupt,
+ 				IRQF_SHARED,
+@@ -337,7 +330,6 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
+ 	at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
+ 					AT91_RTC_SECEV | AT91_RTC_TIMEV |
+ 					AT91_RTC_CALEV);
+-	at91_rtc_imr = 0;
+ 	free_irq(irq, pdev);
+ 
+ 	rtc_device_unregister(rtc);
+@@ -350,35 +342,31 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
+ 
+ /* AT91RM9200 RTC Power management control */
+ 
+-static u32 at91_rtc_bkpimr;
+-
++static u32 at91_rtc_imr;
+ 
+ static int at91_rtc_suspend(struct device *dev)
+ {
+ 	/* this IRQ is shared with DBGU and other hardware which isn't
+ 	 * necessarily doing PM like we are...
+ 	 */
+-	at91_rtc_bkpimr = at91_rtc_imr & (AT91_RTC_ALARM|AT91_RTC_SECEV);
+-	if (at91_rtc_bkpimr) {
+-		if (device_may_wakeup(dev)) {
++	at91_rtc_imr = at91_rtc_read(AT91_RTC_IMR)
++			& (AT91_RTC_ALARM|AT91_RTC_SECEV);
++	if (at91_rtc_imr) {
++		if (device_may_wakeup(dev))
+ 			enable_irq_wake(irq);
+-		} else {
+-			at91_rtc_write(AT91_RTC_IDR, at91_rtc_bkpimr);
+-			at91_rtc_imr &= ~at91_rtc_bkpimr;
+-		}
+-}
++		else
++			at91_rtc_write(AT91_RTC_IDR, at91_rtc_imr);
++	}
+ 	return 0;
+ }
+ 
+ static int at91_rtc_resume(struct device *dev)
+ {
+-	if (at91_rtc_bkpimr) {
+-		if (device_may_wakeup(dev)) {
++	if (at91_rtc_imr) {
++		if (device_may_wakeup(dev))
+ 			disable_irq_wake(irq);
+-		} else {
+-			at91_rtc_imr |= at91_rtc_bkpimr;
+-			at91_rtc_write(AT91_RTC_IER, at91_rtc_bkpimr);
+-		}
++		else
++			at91_rtc_write(AT91_RTC_IER, at91_rtc_imr);
+ 	}
+ 	return 0;
+ }
+diff --git a/drivers/rtc/rtc-at91rm9200.h b/drivers/rtc/rtc-at91rm9200.h
+index 5f940b6..da1945e 100644
+--- a/drivers/rtc/rtc-at91rm9200.h
++++ b/drivers/rtc/rtc-at91rm9200.h
+@@ -64,6 +64,7 @@
+ #define	AT91_RTC_SCCR		0x1c			/* Status Clear Command Register */
+ #define	AT91_RTC_IER		0x20			/* Interrupt Enable Register */
+ #define	AT91_RTC_IDR		0x24			/* Interrupt Disable Register */
++#define	AT91_RTC_IMR		0x28			/* Interrupt Mask Register */
+ 
+ #define	AT91_RTC_VER		0x2c			/* Valid Entry Register */
+ #define		AT91_RTC_NVTIM		(1 <<  0)		/* Non valid Time */
+diff --git a/drivers/spi/spi-mpc512x-psc.c b/drivers/spi/spi-mpc512x-psc.c
+index cb3a310..41e21bf 100644
+--- a/drivers/spi/spi-mpc512x-psc.c
++++ b/drivers/spi/spi-mpc512x-psc.c
+@@ -164,7 +164,7 @@ static int mpc512x_psc_spi_transfer_rxtx(struct spi_device *spi,
+ 
+ 		for (i = count; i > 0; i--) {
+ 			data = tx_buf ? *tx_buf++ : 0;
+-			if (len == EOFBYTE)
++			if (len == EOFBYTE && t->cs_change)
+ 				setbits32(&fifo->txcmd, MPC512x_PSC_FIFO_EOF);
+ 			out_8(&fifo->txdata_8, data);
+ 			len--;
+diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
+index ad93231..6796a25 100644
+--- a/drivers/spi/spi-s3c64xx.c
++++ b/drivers/spi/spi-s3c64xx.c
+@@ -997,25 +997,30 @@ static irqreturn_t s3c64xx_spi_irq(int irq, void *data)
+ {
+ 	struct s3c64xx_spi_driver_data *sdd = data;
+ 	struct spi_master *spi = sdd->master;
+-	unsigned int val;
++	unsigned int val, clr = 0;
+ 
+-	val = readl(sdd->regs + S3C64XX_SPI_PENDING_CLR);
++	val = readl(sdd->regs + S3C64XX_SPI_STATUS);
+ 
+-	val &= S3C64XX_SPI_PND_RX_OVERRUN_CLR |
+-		S3C64XX_SPI_PND_RX_UNDERRUN_CLR |
+-		S3C64XX_SPI_PND_TX_OVERRUN_CLR |
+-		S3C64XX_SPI_PND_TX_UNDERRUN_CLR;
+-
+-	writel(val, sdd->regs + S3C64XX_SPI_PENDING_CLR);
+-
+-	if (val & S3C64XX_SPI_PND_RX_OVERRUN_CLR)
++	if (val & S3C64XX_SPI_ST_RX_OVERRUN_ERR) {
++		clr = S3C64XX_SPI_PND_RX_OVERRUN_CLR;
+ 		dev_err(&spi->dev, "RX overrun\n");
+-	if (val & S3C64XX_SPI_PND_RX_UNDERRUN_CLR)
++	}
++	if (val & S3C64XX_SPI_ST_RX_UNDERRUN_ERR) {
++		clr |= S3C64XX_SPI_PND_RX_UNDERRUN_CLR;
+ 		dev_err(&spi->dev, "RX underrun\n");
+-	if (val & S3C64XX_SPI_PND_TX_OVERRUN_CLR)
++	}
++	if (val & S3C64XX_SPI_ST_TX_OVERRUN_ERR) {
++		clr |= S3C64XX_SPI_PND_TX_OVERRUN_CLR;
+ 		dev_err(&spi->dev, "TX overrun\n");
+-	if (val & S3C64XX_SPI_PND_TX_UNDERRUN_CLR)
++	}
++	if (val & S3C64XX_SPI_ST_TX_UNDERRUN_ERR) {
++		clr |= S3C64XX_SPI_PND_TX_UNDERRUN_CLR;
+ 		dev_err(&spi->dev, "TX underrun\n");
++	}
++
++	/* Clear the pending irq by setting and then clearing it */
++	writel(clr, sdd->regs + S3C64XX_SPI_PENDING_CLR);
++	writel(0, sdd->regs + S3C64XX_SPI_PENDING_CLR);
+ 
+ 	return IRQ_HANDLED;
+ }
+@@ -1039,9 +1044,13 @@ static void s3c64xx_spi_hwinit(struct s3c64xx_spi_driver_data *sdd, int channel)
+ 	writel(0, regs + S3C64XX_SPI_MODE_CFG);
+ 	writel(0, regs + S3C64XX_SPI_PACKET_CNT);
+ 
+-	/* Clear any irq pending bits */
+-	writel(readl(regs + S3C64XX_SPI_PENDING_CLR),
+-				regs + S3C64XX_SPI_PENDING_CLR);
++	/* Clear any irq pending bits, should set and clear the bits */
++	val = S3C64XX_SPI_PND_RX_OVERRUN_CLR |
++		S3C64XX_SPI_PND_RX_UNDERRUN_CLR |
++		S3C64XX_SPI_PND_TX_OVERRUN_CLR |
++		S3C64XX_SPI_PND_TX_UNDERRUN_CLR;
++	writel(val, regs + S3C64XX_SPI_PENDING_CLR);
++	writel(0, regs + S3C64XX_SPI_PENDING_CLR);
+ 
+ 	writel(0, regs + S3C64XX_SPI_SWAP_CFG);
+ 
+diff --git a/drivers/thermal/thermal_sys.c b/drivers/thermal/thermal_sys.c
+index 8c8ce80..bfbf9fb 100644
+--- a/drivers/thermal/thermal_sys.c
++++ b/drivers/thermal/thermal_sys.c
+@@ -1807,6 +1807,7 @@ static int __init thermal_init(void)
+ 		idr_destroy(&thermal_cdev_idr);
+ 		mutex_destroy(&thermal_idr_lock);
+ 		mutex_destroy(&thermal_list_lock);
++		return result;
+ 	}
+ 	result = genetlink_init();
+ 	return result;
+diff --git a/drivers/tty/serial/8250/8250_pnp.c b/drivers/tty/serial/8250/8250_pnp.c
+index b3455a9..35d9ab9 100644
+--- a/drivers/tty/serial/8250/8250_pnp.c
++++ b/drivers/tty/serial/8250/8250_pnp.c
+@@ -429,7 +429,6 @@ serial_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id)
+ {
+ 	struct uart_8250_port uart;
+ 	int ret, line, flags = dev_id->driver_data;
+-	struct resource *res = NULL;
+ 
+ 	if (flags & UNKNOWN_DEV) {
+ 		ret = serial_pnp_guess_board(dev);
+@@ -440,12 +439,11 @@ serial_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id)
+ 	memset(&uart, 0, sizeof(uart));
+ 	if (pnp_irq_valid(dev, 0))
+ 		uart.port.irq = pnp_irq(dev, 0);
+-	if ((flags & CIR_PORT) && pnp_port_valid(dev, 2))
+-		res = pnp_get_resource(dev, IORESOURCE_IO, 2);
+-	else if (pnp_port_valid(dev, 0))
+-		res = pnp_get_resource(dev, IORESOURCE_IO, 0);
+-	if (pnp_resource_enabled(res)) {
+-		uart.port.iobase = res->start;
++	if ((flags & CIR_PORT) && pnp_port_valid(dev, 2)) {
++		uart.port.iobase = pnp_port_start(dev, 2);
++		uart.port.iotype = UPIO_PORT;
++	} else if (pnp_port_valid(dev, 0)) {
++		uart.port.iobase = pnp_port_start(dev, 0);
+ 		uart.port.iotype = UPIO_PORT;
+ 	} else if (pnp_mem_valid(dev, 0)) {
+ 		uart.port.mapbase = pnp_mem_start(dev, 0);
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index b28e66c..4a62e12 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -331,6 +331,7 @@ static long vfio_pci_ioctl(void *device_data,
+ 
+ 		if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) {
+ 			size_t size;
++			int max = vfio_pci_get_irq_count(vdev, hdr.index);
+ 
+ 			if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL)
+ 				size = sizeof(uint8_t);
+@@ -340,7 +341,7 @@ static long vfio_pci_ioctl(void *device_data,
+ 				return -EINVAL;
+ 
+ 			if (hdr.argsz - minsz < hdr.count * size ||
+-			    hdr.count > vfio_pci_get_irq_count(vdev, hdr.index))
++			    hdr.start >= max || hdr.start + hdr.count > max)
+ 				return -EINVAL;
+ 
+ 			data = memdup_user((void __user *)(arg + minsz),
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 2e9779b..c53189d 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -300,7 +300,7 @@ int nfs40_walk_client_list(struct nfs_client *new,
+ 			   struct rpc_cred *cred)
+ {
+ 	struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
+-	struct nfs_client *pos, *n, *prev = NULL;
++	struct nfs_client *pos, *prev = NULL;
+ 	struct nfs4_setclientid_res clid = {
+ 		.clientid	= new->cl_clientid,
+ 		.confirm	= new->cl_confirm,
+@@ -308,10 +308,23 @@ int nfs40_walk_client_list(struct nfs_client *new,
+ 	int status = -NFS4ERR_STALE_CLIENTID;
+ 
+ 	spin_lock(&nn->nfs_client_lock);
+-	list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
++	list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
+ 		/* If "pos" isn't marked ready, we can't trust the
+ 		 * remaining fields in "pos" */
+-		if (pos->cl_cons_state < NFS_CS_READY)
++		if (pos->cl_cons_state > NFS_CS_READY) {
++			atomic_inc(&pos->cl_count);
++			spin_unlock(&nn->nfs_client_lock);
++
++			if (prev)
++				nfs_put_client(prev);
++			prev = pos;
++
++			status = nfs_wait_client_init_complete(pos);
++			spin_lock(&nn->nfs_client_lock);
++			if (status < 0)
++				continue;
++		}
++		if (pos->cl_cons_state != NFS_CS_READY)
+ 			continue;
+ 
+ 		if (pos->rpc_ops != new->rpc_ops)
+@@ -423,16 +436,16 @@ int nfs41_walk_client_list(struct nfs_client *new,
+ 			   struct rpc_cred *cred)
+ {
+ 	struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
+-	struct nfs_client *pos, *n, *prev = NULL;
++	struct nfs_client *pos, *prev = NULL;
+ 	int status = -NFS4ERR_STALE_CLIENTID;
+ 
+ 	spin_lock(&nn->nfs_client_lock);
+-	list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
++	list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
+ 		/* If "pos" isn't marked ready, we can't trust the
+ 		 * remaining fields in "pos", especially the client
+ 		 * ID and serverowner fields.  Wait for CREATE_SESSION
+ 		 * to finish. */
+-		if (pos->cl_cons_state < NFS_CS_READY) {
++		if (pos->cl_cons_state > NFS_CS_READY) {
+ 			atomic_inc(&pos->cl_count);
+ 			spin_unlock(&nn->nfs_client_lock);
+ 
+@@ -440,18 +453,17 @@ int nfs41_walk_client_list(struct nfs_client *new,
+ 				nfs_put_client(prev);
+ 			prev = pos;
+ 
+-			nfs4_schedule_lease_recovery(pos);
+ 			status = nfs_wait_client_init_complete(pos);
+-			if (status < 0) {
+-				nfs_put_client(pos);
+-				spin_lock(&nn->nfs_client_lock);
+-				continue;
++			if (status == 0) {
++				nfs4_schedule_lease_recovery(pos);
++				status = nfs4_wait_clnt_recover(pos);
+ 			}
+-			status = pos->cl_cons_state;
+ 			spin_lock(&nn->nfs_client_lock);
+ 			if (status < 0)
+ 				continue;
+ 		}
++		if (pos->cl_cons_state != NFS_CS_READY)
++			continue;
+ 
+ 		if (pos->rpc_ops != new->rpc_ops)
+ 			continue;
+@@ -469,17 +481,18 @@ int nfs41_walk_client_list(struct nfs_client *new,
+ 			continue;
+ 
+ 		atomic_inc(&pos->cl_count);
+-		spin_unlock(&nn->nfs_client_lock);
++		*result = pos;
++		status = 0;
+ 		dprintk("NFS: <-- %s using nfs_client = %p ({%d})\n",
+ 			__func__, pos, atomic_read(&pos->cl_count));
+-
+-		*result = pos;
+-		return 0;
++		break;
+ 	}
+ 
+ 	/* No matching nfs_client found. */
+ 	spin_unlock(&nn->nfs_client_lock);
+ 	dprintk("NFS: <-- %s status = %d\n", __func__, status);
++	if (prev)
++		nfs_put_client(prev);
+ 	return status;
+ }
+ #endif	/* CONFIG_NFS_V4_1 */
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index e61f68d..994fbe2 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1877,7 +1877,13 @@ again:
+ 			status = PTR_ERR(clnt);
+ 			break;
+ 		}
+-		clp->cl_rpcclient = clnt;
++		/* Note: this is safe because we haven't yet marked the
++		 * client as ready, so we are the only user of
++		 * clp->cl_rpcclient
++		 */
++		clnt = xchg(&clp->cl_rpcclient, clnt);
++		rpc_shutdown_client(clnt);
++		clnt = clp->cl_rpcclient;
+ 		goto again;
+ 
+ 	case -NFS4ERR_MINOR_VERS_MISMATCH:
+diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
+index c196369..4cce1d9 100644
+--- a/fs/reiserfs/xattr.c
++++ b/fs/reiserfs/xattr.c
+@@ -187,8 +187,8 @@ fill_with_dentries(void *buf, const char *name, int namelen, loff_t offset,
+ 	if (dbuf->count == ARRAY_SIZE(dbuf->dentries))
+ 		return -ENOSPC;
+ 
+-	if (name[0] == '.' && (name[1] == '\0' ||
+-			       (name[1] == '.' && name[2] == '\0')))
++	if (name[0] == '.' && (namelen < 2 ||
++			       (namelen == 2 && name[1] == '.')))
+ 		return 0;
+ 
+ 	dentry = lookup_one_len(name, dbuf->xadir, namelen);
+diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
+index ddc0f6a..97f6875 100644
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1568,6 +1568,12 @@ static int ubifs_remount_rw(struct ubifs_info *c)
+ 	c->remounting_rw = 1;
+ 	c->ro_mount = 0;
+ 
++	if (c->space_fixup) {
++		err = ubifs_fixup_free_space(c);
++		if (err)
++			return err;
++	}
++
+ 	err = check_free_space(c);
+ 	if (err)
+ 		goto out;
+@@ -1684,12 +1690,6 @@ static int ubifs_remount_rw(struct ubifs_info *c)
+ 		err = dbg_check_space_info(c);
+ 	}
+ 
+-	if (c->space_fixup) {
+-		err = ubifs_fixup_free_space(c);
+-		if (err)
+-			goto out;
+-	}
+-
+ 	mutex_unlock(&c->umount_mutex);
+ 	return err;
+ 
+diff --git a/include/linux/ata.h b/include/linux/ata.h
+index 8f7a3d6..ee0bd95 100644
+--- a/include/linux/ata.h
++++ b/include/linux/ata.h
+@@ -954,7 +954,7 @@ static inline int atapi_cdb_len(const u16 *dev_id)
+ 	}
+ }
+ 
+-static inline bool atapi_command_packet_set(const u16 *dev_id)
++static inline int atapi_command_packet_set(const u16 *dev_id)
+ {
+ 	return (dev_id[ATA_ID_CONFIG] >> 8) & 0x1f;
+ }
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 649e5f8..0621bca 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -398,6 +398,7 @@ enum {
+ 	ATA_HORKAGE_NOSETXFER	= (1 << 14),	/* skip SETXFER, SATA only */
+ 	ATA_HORKAGE_BROKEN_FPDMA_AA	= (1 << 15),	/* skip AA */
+ 	ATA_HORKAGE_DUMP_ID	= (1 << 16),	/* dump IDENTIFY data */
++	ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17),	/* Set max sects to 65535 */
+ 
+ 	 /* DMA mask for user DMA control: User visible values; DO NOT
+ 	    renumber */
+diff --git a/include/linux/preempt.h b/include/linux/preempt.h
+index 5a710b9..87a03c7 100644
+--- a/include/linux/preempt.h
++++ b/include/linux/preempt.h
+@@ -93,14 +93,20 @@ do { \
+ 
+ #else /* !CONFIG_PREEMPT_COUNT */
+ 
+-#define preempt_disable()		do { } while (0)
+-#define sched_preempt_enable_no_resched()	do { } while (0)
+-#define preempt_enable_no_resched()	do { } while (0)
+-#define preempt_enable()		do { } while (0)
+-
+-#define preempt_disable_notrace()		do { } while (0)
+-#define preempt_enable_no_resched_notrace()	do { } while (0)
+-#define preempt_enable_notrace()		do { } while (0)
++/*
++ * Even if we don't have any preemption, we need preempt disable/enable
++ * to be barriers, so that we don't have things like get_user/put_user
++ * that can cause faults and scheduling migrate into our preempt-protected
++ * region.
++ */
++#define preempt_disable()		barrier()
++#define sched_preempt_enable_no_resched()	barrier()
++#define preempt_enable_no_resched()	barrier()
++#define preempt_enable()		barrier()
++
++#define preempt_disable_notrace()		barrier()
++#define preempt_enable_no_resched_notrace()	barrier()
++#define preempt_enable_notrace()		barrier()
+ 
+ #endif /* CONFIG_PREEMPT_COUNT */
+ 
+diff --git a/include/linux/spinlock_up.h b/include/linux/spinlock_up.h
+index a26e2fb..e2369c1 100644
+--- a/include/linux/spinlock_up.h
++++ b/include/linux/spinlock_up.h
+@@ -16,7 +16,10 @@
+  * In the debug case, 1 means unlocked, 0 means locked. (the values
+  * are inverted, to catch initialization bugs)
+  *
+- * No atomicity anywhere, we are on UP.
++ * No atomicity anywhere, we are on UP. However, we still need
++ * the compiler barriers, because we do not want the compiler to
++ * move potentially faulting instructions (notably user accesses)
++ * into the locked sequence, resulting in non-atomic execution.
+  */
+ 
+ #ifdef CONFIG_DEBUG_SPINLOCK
+@@ -25,6 +28,7 @@
+ static inline void arch_spin_lock(arch_spinlock_t *lock)
+ {
+ 	lock->slock = 0;
++	barrier();
+ }
+ 
+ static inline void
+@@ -32,6 +36,7 @@ arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long flags)
+ {
+ 	local_irq_save(flags);
+ 	lock->slock = 0;
++	barrier();
+ }
+ 
+ static inline int arch_spin_trylock(arch_spinlock_t *lock)
+@@ -39,32 +44,34 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock)
+ 	char oldval = lock->slock;
+ 
+ 	lock->slock = 0;
++	barrier();
+ 
+ 	return oldval > 0;
+ }
+ 
+ static inline void arch_spin_unlock(arch_spinlock_t *lock)
+ {
++	barrier();
+ 	lock->slock = 1;
+ }
+ 
+ /*
+  * Read-write spinlocks. No debug version.
+  */
+-#define arch_read_lock(lock)		do { (void)(lock); } while (0)
+-#define arch_write_lock(lock)		do { (void)(lock); } while (0)
+-#define arch_read_trylock(lock)	({ (void)(lock); 1; })
+-#define arch_write_trylock(lock)	({ (void)(lock); 1; })
+-#define arch_read_unlock(lock)		do { (void)(lock); } while (0)
+-#define arch_write_unlock(lock)	do { (void)(lock); } while (0)
++#define arch_read_lock(lock)		do { barrier(); (void)(lock); } while (0)
++#define arch_write_lock(lock)		do { barrier(); (void)(lock); } while (0)
++#define arch_read_trylock(lock)	({ barrier(); (void)(lock); 1; })
++#define arch_write_trylock(lock)	({ barrier(); (void)(lock); 1; })
++#define arch_read_unlock(lock)		do { barrier(); (void)(lock); } while (0)
++#define arch_write_unlock(lock)	do { barrier(); (void)(lock); } while (0)
+ 
+ #else /* DEBUG_SPINLOCK */
+ #define arch_spin_is_locked(lock)	((void)(lock), 0)
+ /* for sched.c and kernel_lock.c: */
+-# define arch_spin_lock(lock)		do { (void)(lock); } while (0)
+-# define arch_spin_lock_flags(lock, flags)	do { (void)(lock); } while (0)
+-# define arch_spin_unlock(lock)	do { (void)(lock); } while (0)
+-# define arch_spin_trylock(lock)	({ (void)(lock); 1; })
++# define arch_spin_lock(lock)		do { barrier(); (void)(lock); } while (0)
++# define arch_spin_lock_flags(lock, flags)	do { barrier(); (void)(lock); } while (0)
++# define arch_spin_unlock(lock)	do { barrier(); (void)(lock); } while (0)
++# define arch_spin_trylock(lock)	({ barrier(); (void)(lock); 1; })
+ #endif /* DEBUG_SPINLOCK */
+ 
+ #define arch_spin_is_contended(lock)	(((void)(lock), 0))
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index b27052c..64bc5d8 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -4537,12 +4537,8 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
+ 		ftrace_startup_sysctl();
+ 
+ 		/* we are starting ftrace again */
+-		if (ftrace_ops_list != &ftrace_list_end) {
+-			if (ftrace_ops_list->next == &ftrace_list_end)
+-				ftrace_trace_function = ftrace_ops_list->func;
+-			else
+-				ftrace_trace_function = ftrace_ops_list_func;
+-		}
++		if (ftrace_ops_list != &ftrace_list_end)
++			update_ftrace_function();
+ 
+ 	} else {
+ 		/* stopping ftrace calls (just send to ftrace_stub) */
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 8832b87..90db251 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1922,7 +1922,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
+ 
+ 	/* Check the cache first. */
+ 	/* (Cache hit rate is typically around 35%.) */
+-	vma = mm->mmap_cache;
++	vma = ACCESS_ONCE(mm->mmap_cache);
+ 	if (!(vma && vma->vm_end > addr && vma->vm_start <= addr)) {
+ 		struct rb_node *rb_node;
+ 
+diff --git a/mm/nommu.c b/mm/nommu.c
+index 79c3cac..bbe1f3f 100644
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -819,7 +819,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
+ 	struct vm_area_struct *vma;
+ 
+ 	/* check the cache first */
+-	vma = mm->mmap_cache;
++	vma = ACCESS_ONCE(mm->mmap_cache);
+ 	if (vma && vma->vm_start <= addr && vma->vm_end > addr)
+ 		return vma;
+ 
+diff --git a/net/can/gw.c b/net/can/gw.c
+index 574dda78e..28e7bdc 100644
+--- a/net/can/gw.c
++++ b/net/can/gw.c
+@@ -436,7 +436,7 @@ static int cgw_notifier(struct notifier_block *nb,
+ 			if (gwj->src.dev == dev || gwj->dst.dev == dev) {
+ 				hlist_del(&gwj->list);
+ 				cgw_unregister_filter(gwj);
+-				kfree(gwj);
++				kmem_cache_free(cgw_cache, gwj);
+ 			}
+ 		}
+ 	}
+@@ -829,7 +829,7 @@ static void cgw_remove_all_jobs(void)
+ 	hlist_for_each_entry_safe(gwj, n, nx, &cgw_list, list) {
+ 		hlist_del(&gwj->list);
+ 		cgw_unregister_filter(gwj);
+-		kfree(gwj);
++		kmem_cache_free(cgw_cache, gwj);
+ 	}
+ }
+ 
+@@ -885,7 +885,7 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
+ 
+ 		hlist_del(&gwj->list);
+ 		cgw_unregister_filter(gwj);
+-		kfree(gwj);
++		kmem_cache_free(cgw_cache, gwj);
+ 		err = 0;
+ 		break;
+ 	}
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 0479c64..49c48c6 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2499,7 +2499,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
+ 			list_del(&dep->list);
+ 			mutex_unlock(&local->mtx);
+ 
+-			ieee80211_roc_notify_destroy(dep);
++			ieee80211_roc_notify_destroy(dep, true);
+ 			return 0;
+ 		}
+ 
+@@ -2539,7 +2539,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
+ 			ieee80211_start_next_roc(local);
+ 		mutex_unlock(&local->mtx);
+ 
+-		ieee80211_roc_notify_destroy(found);
++		ieee80211_roc_notify_destroy(found, true);
+ 	} else {
+ 		/* work may be pending so use it all the time */
+ 		found->abort = true;
+@@ -2549,6 +2549,8 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
+ 
+ 		/* work will clean up etc */
+ 		flush_delayed_work(&found->work);
++		WARN_ON(!found->to_be_freed);
++		kfree(found);
+ 	}
+ 
+ 	return 0;
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 2ed065c..55d8f89 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -346,6 +346,7 @@ struct ieee80211_roc_work {
+ 	struct ieee80211_channel *chan;
+ 
+ 	bool started, abort, hw_begun, notified;
++	bool to_be_freed;
+ 
+ 	unsigned long hw_start_time;
+ 
+@@ -1363,7 +1364,7 @@ void ieee80211_offchannel_return(struct ieee80211_local *local);
+ void ieee80211_roc_setup(struct ieee80211_local *local);
+ void ieee80211_start_next_roc(struct ieee80211_local *local);
+ void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata);
+-void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc);
++void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free);
+ void ieee80211_sw_roc_work(struct work_struct *work);
+ void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc);
+ 
+diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
+index a3ad4c3..7acbdaa 100644
+--- a/net/mac80211/offchannel.c
++++ b/net/mac80211/offchannel.c
+@@ -299,10 +299,13 @@ void ieee80211_start_next_roc(struct ieee80211_local *local)
+ 	}
+ }
+ 
+-void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
++void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free)
+ {
+ 	struct ieee80211_roc_work *dep, *tmp;
+ 
++	if (WARN_ON(roc->to_be_freed))
++		return;
++
+ 	/* was never transmitted */
+ 	if (roc->frame) {
+ 		cfg80211_mgmt_tx_status(&roc->sdata->wdev,
+@@ -318,9 +321,12 @@ void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
+ 						   GFP_KERNEL);
+ 
+ 	list_for_each_entry_safe(dep, tmp, &roc->dependents, list)
+-		ieee80211_roc_notify_destroy(dep);
++		ieee80211_roc_notify_destroy(dep, true);
+ 
+-	kfree(roc);
++	if (free)
++		kfree(roc);
++	else
++		roc->to_be_freed = true;
+ }
+ 
+ void ieee80211_sw_roc_work(struct work_struct *work)
+@@ -333,6 +339,9 @@ void ieee80211_sw_roc_work(struct work_struct *work)
+ 
+ 	mutex_lock(&local->mtx);
+ 
++	if (roc->to_be_freed)
++		goto out_unlock;
++
+ 	if (roc->abort)
+ 		goto finish;
+ 
+@@ -372,7 +381,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
+  finish:
+ 		list_del(&roc->list);
+ 		started = roc->started;
+-		ieee80211_roc_notify_destroy(roc);
++		ieee80211_roc_notify_destroy(roc, !roc->abort);
+ 
+ 		if (started) {
+ 			drv_flush(local, false);
+@@ -412,7 +421,7 @@ static void ieee80211_hw_roc_done(struct work_struct *work)
+ 
+ 	list_del(&roc->list);
+ 
+-	ieee80211_roc_notify_destroy(roc);
++	ieee80211_roc_notify_destroy(roc, true);
+ 
+ 	/* if there's another roc, start it now */
+ 	ieee80211_start_next_roc(local);
+@@ -462,12 +471,14 @@ void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata)
+ 	list_for_each_entry_safe(roc, tmp, &tmp_list, list) {
+ 		if (local->ops->remain_on_channel) {
+ 			list_del(&roc->list);
+-			ieee80211_roc_notify_destroy(roc);
++			ieee80211_roc_notify_destroy(roc, true);
+ 		} else {
+ 			ieee80211_queue_delayed_work(&local->hw, &roc->work, 0);
+ 
+ 			/* work will clean up etc */
+ 			flush_delayed_work(&roc->work);
++			WARN_ON(!roc->to_be_freed);
++			kfree(roc);
+ 		}
+ 	}
+ 
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 507b5e8..716aa41 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -511,7 +511,7 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
+ 	new = rpc_new_client(args, xprt);
+ 	if (IS_ERR(new)) {
+ 		err = PTR_ERR(new);
+-		goto out_put;
++		goto out_err;
+ 	}
+ 
+ 	atomic_inc(&clnt->cl_count);
+@@ -524,8 +524,6 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
+ 	new->cl_chatty = clnt->cl_chatty;
+ 	return new;
+ 
+-out_put:
+-	xprt_put(xprt);
+ out_err:
+ 	dprintk("RPC:       %s: returned error %d\n", __func__, err);
+ 	return ERR_PTR(err);
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index e46b6a3..622f726 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -173,7 +173,7 @@ const char *snd_hda_get_jack_type(u32 cfg)
+ 		"Line Out", "Speaker", "HP Out", "CD",
+ 		"SPDIF Out", "Digital Out", "Modem Line", "Modem Hand",
+ 		"Line In", "Aux", "Mic", "Telephony",
+-		"SPDIF In", "Digitial In", "Reserved", "Other"
++		"SPDIF In", "Digital In", "Reserved", "Other"
+ 	};
+ 
+ 	return jack_types[(cfg & AC_DEFCFG_DEVICE)
+diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
+index 4c054f4..86f6468 100644
+--- a/sound/pci/hda/hda_eld.c
++++ b/sound/pci/hda/hda_eld.c
+@@ -322,7 +322,7 @@ int snd_hdmi_get_eld(struct hdmi_eld *eld,
+ 		     struct hda_codec *codec, hda_nid_t nid)
+ {
+ 	int i;
+-	int ret;
++	int ret = 0;
+ 	int size;
+ 	unsigned char *buf;
+ 
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 47fb18d..ee975a2 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6720,7 +6720,8 @@ static int alc662_parse_auto_config(struct hda_codec *codec)
+ 	const hda_nid_t *ssids;
+ 
+ 	if (codec->vendor_id == 0x10ec0272 || codec->vendor_id == 0x10ec0663 ||
+-	    codec->vendor_id == 0x10ec0665 || codec->vendor_id == 0x10ec0670)
++	    codec->vendor_id == 0x10ec0665 || codec->vendor_id == 0x10ec0670 ||
++	    codec->vendor_id == 0x10ec0671)
+ 		ssids = alc663_ssids;
+ 	else
+ 		ssids = alc662_ssids;
+@@ -7173,6 +7174,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
+ 	{ .id = 0x10ec0665, .name = "ALC665", .patch = patch_alc662 },
+ 	{ .id = 0x10ec0668, .name = "ALC668", .patch = patch_alc662 },
+ 	{ .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 },
++	{ .id = 0x10ec0671, .name = "ALC671", .patch = patch_alc662 },
+ 	{ .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 },
+ 	{ .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 },
+ 	{ .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 },
+diff --git a/sound/soc/fsl/imx-ssi.c b/sound/soc/fsl/imx-ssi.c
+index 3b48042..63e453f 100644
+--- a/sound/soc/fsl/imx-ssi.c
++++ b/sound/soc/fsl/imx-ssi.c
+@@ -496,6 +496,8 @@ static void imx_ssi_ac97_reset(struct snd_ac97 *ac97)
+ 
+ 	if (imx_ssi->ac97_reset)
+ 		imx_ssi->ac97_reset(ac97);
++	/* First read sometimes fails, do a dummy read */
++	imx_ssi_ac97_read(ac97, 0);
+ }
+ 
+ static void imx_ssi_ac97_warm_reset(struct snd_ac97 *ac97)
+@@ -504,6 +506,9 @@ static void imx_ssi_ac97_warm_reset(struct snd_ac97 *ac97)
+ 
+ 	if (imx_ssi->ac97_warm_reset)
+ 		imx_ssi->ac97_warm_reset(ac97);
++
++	/* First read sometimes fails, do a dummy read */
++	imx_ssi_ac97_read(ac97, 0);
+ }
+ 
+ struct snd_ac97_bus_ops soc_ac97_ops = {
+diff --git a/sound/soc/sh/dma-sh7760.c b/sound/soc/sh/dma-sh7760.c
+index 19eff8f..1a8b03e 100644
+--- a/sound/soc/sh/dma-sh7760.c
++++ b/sound/soc/sh/dma-sh7760.c
+@@ -342,8 +342,8 @@ static int camelot_pcm_new(struct snd_soc_pcm_runtime *rtd)
+ 	return 0;
+ }
+ 
+-static struct snd_soc_platform sh7760_soc_platform = {
+-	.pcm_ops 	= &camelot_pcm_ops,
++static struct snd_soc_platform_driver sh7760_soc_platform = {
++	.ops		= &camelot_pcm_ops,
+ 	.pcm_new	= camelot_pcm_new,
+ 	.pcm_free	= camelot_pcm_free,
+ };
+diff --git a/sound/soc/spear/spear_pcm.c b/sound/soc/spear/spear_pcm.c
+index 9b76cc5..5e7aebe 100644
+--- a/sound/soc/spear/spear_pcm.c
++++ b/sound/soc/spear/spear_pcm.c
+@@ -149,9 +149,9 @@ static void spear_pcm_free(struct snd_pcm *pcm)
+ 
+ static u64 spear_pcm_dmamask = DMA_BIT_MASK(32);
+ 
+-static int spear_pcm_new(struct snd_card *card,
+-		struct snd_soc_dai *dai, struct snd_pcm *pcm)
++static int spear_pcm_new(struct snd_soc_pcm_runtime *rtd)
+ {
++	struct snd_card *card = rtd->card->snd_card;
+ 	int ret;
+ 
+ 	if (!card->dev->dma_mask)
+@@ -159,16 +159,16 @@ static int spear_pcm_new(struct snd_card *card,
+ 	if (!card->dev->coherent_dma_mask)
+ 		card->dev->coherent_dma_mask = DMA_BIT_MASK(32);
+ 
+-	if (dai->driver->playback.channels_min) {
+-		ret = spear_pcm_preallocate_dma_buffer(pcm,
++	if (rtd->cpu_dai->driver->playback.channels_min) {
++		ret = spear_pcm_preallocate_dma_buffer(rtd->pcm,
+ 				SNDRV_PCM_STREAM_PLAYBACK,
+ 				spear_pcm_hardware.buffer_bytes_max);
+ 		if (ret)
+ 			return ret;
+ 	}
+ 
+-	if (dai->driver->capture.channels_min) {
+-		ret = spear_pcm_preallocate_dma_buffer(pcm,
++	if (rtd->cpu_dai->driver->capture.channels_min) {
++		ret = spear_pcm_preallocate_dma_buffer(rtd->pcm,
+ 				SNDRV_PCM_STREAM_CAPTURE,
+ 				spear_pcm_hardware.buffer_bytes_max);
+ 		if (ret)
diff --git a/3.8.6/4420_grsecurity-2.9.1-3.8.6-201304111817.patch b/3.8.7/4420_grsecurity-2.9.1-3.8.7-201304122027.patch
index a155950..a493e4d 100644
--- a/3.8.6/4420_grsecurity-2.9.1-3.8.6-201304111817.patch
+++ b/3.8.7/4420_grsecurity-2.9.1-3.8.7-201304122027.patch
@@ -259,7 +259,7 @@ index 986614d..e8bfedc 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 10075d6..8a01f3b 100644
+index 85204da..9d99250 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -10722,7 +10722,7 @@ index 18997e5..83d9c67 100644
  	return diff;
  }
 diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
-index 8a84501..b2d165f 100644
+index 5ef205c..342191d 100644
 --- a/arch/x86/boot/compressed/Makefile
 +++ b/arch/x86/boot/compressed/Makefile
 @@ -14,6 +14,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=small
@@ -31431,7 +31431,7 @@ index 431e875..cbb23f3 100644
 -}
 -__setup("vdso=", vdso_setup);
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 2262003..f229ced 100644
+index 2262003..3ee61cf 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
 @@ -100,8 +100,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -31459,10 +31459,19 @@ index 2262003..f229ced 100644
  	unsigned int size = dtr->size + 1;
 -	unsigned pages = (size + PAGE_SIZE - 1) / PAGE_SIZE;
 -	unsigned long frames[pages];
-+	unsigned long frames[65536 / PAGE_SIZE];
++	unsigned long frames[(GDT_SIZE + PAGE_SIZE - 1) / PAGE_SIZE];
  	int f;
  
  	/*
+@@ -554,7 +550,7 @@ static void __init xen_load_gdt_boot(const struct desc_ptr *dtr)
+ 	 * 8-byte entries, or 16 4k pages..
+ 	 */
+ 
+-	BUG_ON(size > 65536);
++	BUG_ON(size > GDT_SIZE);
+ 	BUG_ON(va & ~PAGE_MASK);
+ 
+ 	for (f = 0; va < dtr->address + size; va += PAGE_SIZE, f++) {
 @@ -939,7 +935,7 @@ static u32 xen_safe_apic_wait_icr_idle(void)
          return 0;
  }
@@ -31529,22 +31538,20 @@ index 2262003..f229ced 100644
  
  	xen_setup_features();
  
-@@ -1399,14 +1405,7 @@ asmlinkage void __init xen_start_kernel(void)
- 		pv_mmu_ops.ptep_modify_prot_commit = xen_ptep_modify_prot_commit;
- 	}
+@@ -1401,13 +1407,6 @@ asmlinkage void __init xen_start_kernel(void)
+ 
+ 	machine_ops = xen_machine_ops;
  
--	machine_ops = xen_machine_ops;
--
 -	/*
 -	 * The only reliable way to retain the initial address of the
 -	 * percpu gdt_page is to remember it here, so we can go and
 -	 * mark it RW later, when the initial percpu area is freed.
 -	 */
 -	xen_initial_gdt = &per_cpu(gdt_page, 0);
-+	memcpy((void *)&machine_ops, &xen_machine_ops, sizeof machine_ops);
- 
+-
  	xen_smp_init();
  
+ #ifdef CONFIG_ACPI_NUMA
 @@ -1598,7 +1597,7 @@ static int __cpuinit xen_hvm_cpu_notify(struct notifier_block *self,
  	return NOTIFY_OK;
  }
@@ -32253,10 +32260,10 @@ index 6cd7805..07facb3 100644
  				unsigned long timeout_msec)
  {
 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index 46cd3f4..0871ad0 100644
+index 501c209..5f28b4d 100644
 --- a/drivers/ata/libata-core.c
 +++ b/drivers/ata/libata-core.c
-@@ -4780,7 +4780,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
+@@ -4784,7 +4784,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
  	struct ata_port *ap;
  	unsigned int tag;
  
@@ -32265,7 +32272,7 @@ index 46cd3f4..0871ad0 100644
  	ap = qc->ap;
  
  	qc->flags = 0;
-@@ -4796,7 +4796,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
+@@ -4800,7 +4800,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
  	struct ata_port *ap;
  	struct ata_link *link;
  
@@ -32274,7 +32281,7 @@ index 46cd3f4..0871ad0 100644
  	WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
  	ap = qc->ap;
  	link = qc->dev->link;
-@@ -5892,6 +5892,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5896,6 +5896,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
  		return;
  
  	spin_lock(&lock);
@@ -32282,7 +32289,7 @@ index 46cd3f4..0871ad0 100644
  
  	for (cur = ops->inherits; cur; cur = cur->inherits) {
  		void **inherit = (void **)cur;
-@@ -5905,8 +5906,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5909,8 +5910,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
  		if (IS_ERR(*pp))
  			*pp = NULL;
  
@@ -35106,7 +35113,7 @@ index be174ca..7f38143 100644
  
  	DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
 diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
-index 133b413..fd68225 100644
+index 32d7775..c8be5e1 100644
 --- a/drivers/gpu/drm/drm_fops.c
 +++ b/drivers/gpu/drm/drm_fops.c
 @@ -71,7 +71,7 @@ static int drm_setup(struct drm_device * dev)
@@ -35118,7 +35125,7 @@ index 133b413..fd68225 100644
  
  	dev->sigdata.lock = NULL;
  
-@@ -134,7 +134,7 @@ int drm_open(struct inode *inode, struct file *filp)
+@@ -135,7 +135,7 @@ int drm_open(struct inode *inode, struct file *filp)
  	if (drm_device_is_unplugged(dev))
  		return -ENODEV;
  
@@ -35126,8 +35133,8 @@ index 133b413..fd68225 100644
 +	if (local_inc_return(&dev->open_count) == 1)
  		need_setup = 1;
  	mutex_lock(&dev->struct_mutex);
- 	old_mapping = dev->dev_mapping;
-@@ -149,7 +149,7 @@ int drm_open(struct inode *inode, struct file *filp)
+ 	old_imapping = inode->i_mapping;
+@@ -151,7 +151,7 @@ int drm_open(struct inode *inode, struct file *filp)
  	retcode = drm_open_helper(inode, filp, dev);
  	if (retcode)
  		goto err_undo;
@@ -35136,7 +35143,7 @@ index 133b413..fd68225 100644
  	if (need_setup) {
  		retcode = drm_setup(dev);
  		if (retcode)
-@@ -164,7 +164,7 @@ err_undo:
+@@ -166,7 +166,7 @@ err_undo:
  	iput(container_of(dev->dev_mapping, struct inode, i_data));
  	dev->dev_mapping = old_mapping;
  	mutex_unlock(&dev->struct_mutex);
@@ -35145,7 +35152,7 @@ index 133b413..fd68225 100644
  	return retcode;
  }
  EXPORT_SYMBOL(drm_open);
-@@ -438,7 +438,7 @@ int drm_release(struct inode *inode, struct file *filp)
+@@ -440,7 +440,7 @@ int drm_release(struct inode *inode, struct file *filp)
  
  	mutex_lock(&drm_global_mutex);
  
@@ -35154,7 +35161,7 @@ index 133b413..fd68225 100644
  
  	if (dev->driver->preclose)
  		dev->driver->preclose(dev, file_priv);
-@@ -447,10 +447,10 @@ int drm_release(struct inode *inode, struct file *filp)
+@@ -449,10 +449,10 @@ int drm_release(struct inode *inode, struct file *filp)
  	 * Begin inline drm_release
  	 */
  
@@ -35167,7 +35174,7 @@ index 133b413..fd68225 100644
  
  	/* Release any auth tokens that might point to this file_priv,
  	   (do that under the drm_global_mutex) */
-@@ -547,8 +547,8 @@ int drm_release(struct inode *inode, struct file *filp)
+@@ -549,8 +549,8 @@ int drm_release(struct inode *inode, struct file *filp)
  	 * End inline drm_release
  	 */
  
@@ -35482,7 +35489,7 @@ index 7339a4b..445aaba 100644
  	return container_of(adapter, struct intel_gmbus, adapter)->force_bit;
  }
 diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-index 7adf5a7..e24fb51 100644
+index ba8805a..39d5330 100644
 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
 +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
 @@ -672,7 +672,7 @@ i915_gem_execbuffer_move_to_gpu(struct intel_ring_buffer *ring,
@@ -35654,7 +35661,7 @@ index fe84338..a863190 100644
  	iir = I915_READ(IIR);
  
 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index e6e4df7..6a9a1bd 100644
+index d3f834a..0ad1b37 100644
 --- a/drivers/gpu/drm/i915/intel_display.c
 +++ b/drivers/gpu/drm/i915/intel_display.c
 @@ -2255,7 +2255,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb)
@@ -35832,58 +35839,6 @@ index 598c281..60d590e 100644
  		      - *sequence) <= (1 << 23)));
  
  	*sequence = cur_fence;
-diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
-index 4f50c40..2e7c949 100644
---- a/drivers/gpu/drm/mgag200/mgag200_mode.c
-+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
-@@ -751,8 +751,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
- 	int i;
- 	unsigned char misc = 0;
- 	unsigned char ext_vga[6];
--	unsigned char ext_vga_index24;
--	unsigned char dac_index90 = 0;
- 	u8 bppshift;
- 
- 	static unsigned char dacvalue[] = {
-@@ -803,7 +801,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
- 		option2 = 0x0000b000;
- 		break;
- 	case G200_ER:
--		dac_index90 = 0;
- 		break;
- 	}
- 
-@@ -852,10 +849,8 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
- 		WREG_DAC(i, dacvalue[i]);
- 	}
- 
--	if (mdev->type == G200_ER) {
--		WREG_DAC(0x90, dac_index90);
--	}
--
-+	if (mdev->type == G200_ER)
-+		WREG_DAC(0x90, 0);
- 
- 	if (option)
- 		pci_write_config_dword(dev->pdev, PCI_MGA_OPTION, option);
-@@ -952,8 +947,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
- 	if (mdev->type == G200_WB)
- 		ext_vga[1] |= 0x88;
- 
--	ext_vga_index24 = 0x05;
--
- 	/* Set pixel clocks */
- 	misc = 0x2d;
- 	WREG8(MGA_MISC_OUT, misc);
-@@ -965,7 +958,7 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
- 	}
- 
- 	if (mdev->type == G200_ER)
--		WREG_ECRT(24, ext_vga_index24);
-+		WREG_ECRT(0x24, 0x5);
- 
- 	if (mdev->type == G200_EV) {
- 		WREG_ECRT(6, 0);
 diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
 index 865eddf..62c4cc3 100644
 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -40132,7 +40087,7 @@ index fbe5363..266b4e3 100644
  		__vxge_hw_mempool_create(vpath->hldev,
  			fifo->config->memblock_size,
 diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
-index 998974f..ecd26db 100644
+index 2d849da..23bba3b 100644
 --- a/drivers/net/ethernet/realtek/r8169.c
 +++ b/drivers/net/ethernet/realtek/r8169.c
 @@ -741,22 +741,22 @@ struct rtl8169_private {
@@ -40902,20 +40857,6 @@ index ff90855..e46d223 100644
  	}
  
  	spin_lock_init(&hwsim_radio_lock);
-diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
-index cdb11b3..3eca710 100644
---- a/drivers/net/wireless/mwifiex/cfg80211.c
-+++ b/drivers/net/wireless/mwifiex/cfg80211.c
-@@ -1846,7 +1846,8 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
- 		}
- 	}
- 
--	for (i = 0; i < request->n_channels; i++) {
-+	for (i = 0; i < min_t(u32, request->n_channels,
-+			      MWIFIEX_USER_SCAN_CHAN_MAX); i++) {
- 		chan = request->channels[i];
- 		priv->user_scan_cfg->chan_list[i].chan_number = chan->hw_value;
- 		priv->user_scan_cfg->chan_list[i].radio_type = chan->band;
 diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
 index abe1d03..fb02c22 100644
 --- a/drivers/net/wireless/rndis_wlan.c
@@ -45017,27 +44958,6 @@ index 57c01ab..8a05959 100644
  }
  
  /*
-diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
-index b28e66c..4a62e12 100644
---- a/drivers/vfio/pci/vfio_pci.c
-+++ b/drivers/vfio/pci/vfio_pci.c
-@@ -331,6 +331,7 @@ static long vfio_pci_ioctl(void *device_data,
- 
- 		if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) {
- 			size_t size;
-+			int max = vfio_pci_get_irq_count(vdev, hdr.index);
- 
- 			if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL)
- 				size = sizeof(uint8_t);
-@@ -340,7 +341,7 @@ static long vfio_pci_ioctl(void *device_data,
- 				return -EINVAL;
- 
- 			if (hdr.argsz - minsz < hdr.count * size ||
--			    hdr.count > vfio_pci_get_irq_count(vdev, hdr.index))
-+			    hdr.start >= max || hdr.start + hdr.count > max)
- 				return -EINVAL;
- 
- 			data = memdup_user((void __user *)(arg + minsz),
 diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
 index 8c55011..eed4ae1a 100644
 --- a/drivers/video/aty/aty128fb.c
@@ -54335,112 +54255,6 @@ index ebeb94c..ff35337 100644
  }
  
  void nfs_fattr_init(struct nfs_fattr *fattr)
-diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
-index 2e9779b..c53189d 100644
---- a/fs/nfs/nfs4client.c
-+++ b/fs/nfs/nfs4client.c
-@@ -300,7 +300,7 @@ int nfs40_walk_client_list(struct nfs_client *new,
- 			   struct rpc_cred *cred)
- {
- 	struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
--	struct nfs_client *pos, *n, *prev = NULL;
-+	struct nfs_client *pos, *prev = NULL;
- 	struct nfs4_setclientid_res clid = {
- 		.clientid	= new->cl_clientid,
- 		.confirm	= new->cl_confirm,
-@@ -308,10 +308,23 @@ int nfs40_walk_client_list(struct nfs_client *new,
- 	int status = -NFS4ERR_STALE_CLIENTID;
- 
- 	spin_lock(&nn->nfs_client_lock);
--	list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
-+	list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
- 		/* If "pos" isn't marked ready, we can't trust the
- 		 * remaining fields in "pos" */
--		if (pos->cl_cons_state < NFS_CS_READY)
-+		if (pos->cl_cons_state > NFS_CS_READY) {
-+			atomic_inc(&pos->cl_count);
-+			spin_unlock(&nn->nfs_client_lock);
-+
-+			if (prev)
-+				nfs_put_client(prev);
-+			prev = pos;
-+
-+			status = nfs_wait_client_init_complete(pos);
-+			spin_lock(&nn->nfs_client_lock);
-+			if (status < 0)
-+				continue;
-+		}
-+		if (pos->cl_cons_state != NFS_CS_READY)
- 			continue;
- 
- 		if (pos->rpc_ops != new->rpc_ops)
-@@ -423,16 +436,16 @@ int nfs41_walk_client_list(struct nfs_client *new,
- 			   struct rpc_cred *cred)
- {
- 	struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
--	struct nfs_client *pos, *n, *prev = NULL;
-+	struct nfs_client *pos, *prev = NULL;
- 	int status = -NFS4ERR_STALE_CLIENTID;
- 
- 	spin_lock(&nn->nfs_client_lock);
--	list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
-+	list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
- 		/* If "pos" isn't marked ready, we can't trust the
- 		 * remaining fields in "pos", especially the client
- 		 * ID and serverowner fields.  Wait for CREATE_SESSION
- 		 * to finish. */
--		if (pos->cl_cons_state < NFS_CS_READY) {
-+		if (pos->cl_cons_state > NFS_CS_READY) {
- 			atomic_inc(&pos->cl_count);
- 			spin_unlock(&nn->nfs_client_lock);
- 
-@@ -440,18 +453,17 @@ int nfs41_walk_client_list(struct nfs_client *new,
- 				nfs_put_client(prev);
- 			prev = pos;
- 
--			nfs4_schedule_lease_recovery(pos);
- 			status = nfs_wait_client_init_complete(pos);
--			if (status < 0) {
--				nfs_put_client(pos);
--				spin_lock(&nn->nfs_client_lock);
--				continue;
-+			if (status == 0) {
-+				nfs4_schedule_lease_recovery(pos);
-+				status = nfs4_wait_clnt_recover(pos);
- 			}
--			status = pos->cl_cons_state;
- 			spin_lock(&nn->nfs_client_lock);
- 			if (status < 0)
- 				continue;
- 		}
-+		if (pos->cl_cons_state != NFS_CS_READY)
-+			continue;
- 
- 		if (pos->rpc_ops != new->rpc_ops)
- 			continue;
-@@ -469,17 +481,18 @@ int nfs41_walk_client_list(struct nfs_client *new,
- 			continue;
- 
- 		atomic_inc(&pos->cl_count);
--		spin_unlock(&nn->nfs_client_lock);
-+		*result = pos;
-+		status = 0;
- 		dprintk("NFS: <-- %s using nfs_client = %p ({%d})\n",
- 			__func__, pos, atomic_read(&pos->cl_count));
--
--		*result = pos;
--		return 0;
-+		break;
- 	}
- 
- 	/* No matching nfs_client found. */
- 	spin_unlock(&nn->nfs_client_lock);
- 	dprintk("NFS: <-- %s status = %d\n", __func__, status);
-+	if (prev)
-+		nfs_put_client(prev);
- 	return status;
- }
- #endif	/* CONFIG_NFS_V4_1 */
 diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
 index 9d1c5db..1e13db8 100644
 --- a/fs/nfsd/nfs4proc.c
@@ -56521,21 +56335,6 @@ index 157e474..65a6114 100644
  #define FILESYSTEM_CHANGED_TB(tb)  (get_generation((tb)->tb_sb) != (tb)->fs_gen)
  #define __fs_changed(gen,s) (gen != get_generation (s))
  #define fs_changed(gen,s)		\
-diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
-index c196369..4cce1d9 100644
---- a/fs/reiserfs/xattr.c
-+++ b/fs/reiserfs/xattr.c
-@@ -187,8 +187,8 @@ fill_with_dentries(void *buf, const char *name, int namelen, loff_t offset,
- 	if (dbuf->count == ARRAY_SIZE(dbuf->dentries))
- 		return -ENOSPC;
- 
--	if (name[0] == '.' && (name[1] == '\0' ||
--			       (name[1] == '.' && name[2] == '\0')))
-+	if (name[0] == '.' && (namelen < 2 ||
-+			       (namelen == 2 && name[1] == '.')))
- 		return 0;
- 
- 	dentry = lookup_one_len(name, dbuf->xadir, namelen);
 diff --git a/fs/select.c b/fs/select.c
 index 2ef72d9..f213b17 100644
 --- a/fs/select.c
@@ -70200,10 +69999,10 @@ index 2c497ab..afe32f5 100644
  
  int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
 diff --git a/include/linux/libata.h b/include/linux/libata.h
-index 649e5f8..ead5194 100644
+index 0621bca..24d6851 100644
 --- a/include/linux/libata.h
 +++ b/include/linux/libata.h
-@@ -915,7 +915,7 @@ struct ata_port_operations {
+@@ -916,7 +916,7 @@ struct ata_port_operations {
  	 * fields must be pointers.
  	 */
  	const struct ata_port_operations	*inherits;
@@ -79575,7 +79374,7 @@ index c0bd030..62a1927 100644
  	ret = -EIO;
  	bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index b27052c..d99d82a 100644
+index 64bc5d8..1ed69e2 100644
 --- a/kernel/trace/ftrace.c
 +++ b/kernel/trace/ftrace.c
 @@ -668,7 +668,6 @@ int ftrace_profile_pages_init(struct ftrace_profile_stat *stat)
@@ -79626,7 +79425,7 @@ index b27052c..d99d82a 100644
  
  	start_pg = ftrace_allocate_pages(count);
  	if (!start_pg)
-@@ -4559,8 +4565,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
+@@ -4555,8 +4561,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
  #ifdef CONFIG_FUNCTION_GRAPH_TRACER
  
  static int ftrace_graph_active;
@@ -79635,7 +79434,7 @@ index b27052c..d99d82a 100644
  int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
  {
  	return 0;
-@@ -4704,6 +4708,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
+@@ -4700,6 +4704,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
  	return NOTIFY_DONE;
  }
  
@@ -79646,7 +79445,7 @@ index b27052c..d99d82a 100644
  int register_ftrace_graph(trace_func_graph_ret_t retfunc,
  			trace_func_graph_ent_t entryfunc)
  {
-@@ -4717,7 +4725,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
+@@ -4713,7 +4721,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
  		goto out;
  	}
  
@@ -82144,7 +81943,7 @@ index c9bd528..da8d069 100644
  	    capable(CAP_IPC_LOCK))
  		ret = do_mlockall(flags);
 diff --git a/mm/mmap.c b/mm/mmap.c
-index 8832b87..04240d1 100644
+index 90db251..04240d1 100644
 --- a/mm/mmap.c
 +++ b/mm/mmap.c
 @@ -32,6 +32,7 @@
@@ -82727,15 +82526,6 @@ index 8832b87..04240d1 100644
  }
  
  unsigned long
-@@ -1922,7 +2172,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
- 
- 	/* Check the cache first. */
- 	/* (Cache hit rate is typically around 35%.) */
--	vma = mm->mmap_cache;
-+	vma = ACCESS_ONCE(mm->mmap_cache);
- 	if (!(vma && vma->vm_end > addr && vma->vm_start <= addr)) {
- 		struct rb_node *rb_node;
- 
 @@ -1974,6 +2224,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
  	return vma;
  }
@@ -83695,7 +83485,7 @@ index e1031e1..1f2a0a1 100644
  out:
  	if (ret & ~PAGE_MASK)
 diff --git a/mm/nommu.c b/mm/nommu.c
-index 79c3cac..b2601ea 100644
+index bbe1f3f..b2601ea 100644
 --- a/mm/nommu.c
 +++ b/mm/nommu.c
 @@ -62,7 +62,6 @@ int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
@@ -83706,15 +83496,6 @@ index 79c3cac..b2601ea 100644
  
  atomic_long_t mmap_pages_allocated;
  
-@@ -819,7 +818,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
- 	struct vm_area_struct *vma;
- 
- 	/* check the cache first */
--	vma = mm->mmap_cache;
-+	vma = ACCESS_ONCE(mm->mmap_cache);
- 	if (vma && vma->vm_start <= addr && vma->vm_end > addr)
- 		return vma;
- 
 @@ -839,15 +838,6 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
  EXPORT_SYMBOL(find_vma);
  
@@ -85969,7 +85750,7 @@ index ddac1ee..3ee0a78 100644
  };
  
 diff --git a/net/can/gw.c b/net/can/gw.c
-index 574dda78e..d42c4cd 100644
+index 28e7bdc..d42c4cd 100644
 --- a/net/can/gw.c
 +++ b/net/can/gw.c
 @@ -67,7 +67,6 @@ MODULE_AUTHOR("Oliver Hartkopp <oliver.hartkopp@volkswagen.de>");
@@ -85980,33 +85761,6 @@ index 574dda78e..d42c4cd 100644
  
  static struct kmem_cache *cgw_cache __read_mostly;
  
-@@ -436,7 +435,7 @@ static int cgw_notifier(struct notifier_block *nb,
- 			if (gwj->src.dev == dev || gwj->dst.dev == dev) {
- 				hlist_del(&gwj->list);
- 				cgw_unregister_filter(gwj);
--				kfree(gwj);
-+				kmem_cache_free(cgw_cache, gwj);
- 			}
- 		}
- 	}
-@@ -829,7 +828,7 @@ static void cgw_remove_all_jobs(void)
- 	hlist_for_each_entry_safe(gwj, n, nx, &cgw_list, list) {
- 		hlist_del(&gwj->list);
- 		cgw_unregister_filter(gwj);
--		kfree(gwj);
-+		kmem_cache_free(cgw_cache, gwj);
- 	}
- }
- 
-@@ -885,7 +884,7 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
- 
- 		hlist_del(&gwj->list);
- 		cgw_unregister_filter(gwj);
--		kfree(gwj);
-+		kmem_cache_free(cgw_cache, gwj);
- 		err = 0;
- 		break;
- 	}
 @@ -893,6 +892,10 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
  	return err;
  }
@@ -88512,7 +88266,7 @@ index 5b426a6..970032b 100644
  	return res;
  }
 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index 0479c64..9e72ff4 100644
+index 49c48c6..9e72ff4 100644
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
 @@ -790,7 +790,7 @@ static int ieee80211_set_monitor_channel(struct wiphy *wiphy,
@@ -88524,34 +88278,7 @@ index 0479c64..9e72ff4 100644
  		local->_oper_channel = chandef->chan;
  		local->_oper_channel_type = cfg80211_get_chandef_type(chandef);
  		ieee80211_hw_config(local, 0);
-@@ -2499,7 +2499,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
- 			list_del(&dep->list);
- 			mutex_unlock(&local->mtx);
- 
--			ieee80211_roc_notify_destroy(dep);
-+			ieee80211_roc_notify_destroy(dep, true);
- 			return 0;
- 		}
- 
-@@ -2539,7 +2539,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
- 			ieee80211_start_next_roc(local);
- 		mutex_unlock(&local->mtx);
- 
--		ieee80211_roc_notify_destroy(found);
-+		ieee80211_roc_notify_destroy(found, true);
- 	} else {
- 		/* work may be pending so use it all the time */
- 		found->abort = true;
-@@ -2549,6 +2549,8 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
- 
- 		/* work will clean up etc */
- 		flush_delayed_work(&found->work);
-+		WARN_ON(!found->to_be_freed);
-+		kfree(found);
- 	}
- 
- 	return 0;
-@@ -2716,7 +2718,7 @@ static void ieee80211_mgmt_frame_register(struct wiphy *wiphy,
+@@ -2718,7 +2718,7 @@ static void ieee80211_mgmt_frame_register(struct wiphy *wiphy,
  		else
  			local->probe_req_reg--;
  
@@ -88561,7 +88288,7 @@ index 0479c64..9e72ff4 100644
  
  		ieee80211_queue_work(&local->hw, &local->reconfig_filter);
 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index 2ed065c..bec0c2b 100644
+index 55d8f89..bec0c2b 100644
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
 @@ -28,6 +28,7 @@
@@ -88572,15 +88299,7 @@ index 2ed065c..bec0c2b 100644
  #include "key.h"
  #include "sta_info.h"
  #include "debug.h"
-@@ -346,6 +347,7 @@ struct ieee80211_roc_work {
- 	struct ieee80211_channel *chan;
- 
- 	bool started, abort, hw_begun, notified;
-+	bool to_be_freed;
- 
- 	unsigned long hw_start_time;
- 
-@@ -909,7 +911,7 @@ struct ieee80211_local {
+@@ -910,7 +911,7 @@ struct ieee80211_local {
  	/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
  	spinlock_t queue_stop_reason_lock;
  
@@ -88589,15 +88308,6 @@ index 2ed065c..bec0c2b 100644
  	int monitors, cooked_mntrs;
  	/* number of interfaces with corresponding FIF_ flags */
  	int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
-@@ -1363,7 +1365,7 @@ void ieee80211_offchannel_return(struct ieee80211_local *local);
- void ieee80211_roc_setup(struct ieee80211_local *local);
- void ieee80211_start_next_roc(struct ieee80211_local *local);
- void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata);
--void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc);
-+void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free);
- void ieee80211_sw_roc_work(struct work_struct *work);
- void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc);
- 
 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
 index 8be854e..ad72a69 100644
 --- a/net/mac80211/iface.c
@@ -88678,84 +88388,6 @@ index 1b087ff..bf600e9 100644
  		ret = drv_config(local, changed);
  		/*
  		 * Goal:
-diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
-index a3ad4c3..7acbdaa 100644
---- a/net/mac80211/offchannel.c
-+++ b/net/mac80211/offchannel.c
-@@ -299,10 +299,13 @@ void ieee80211_start_next_roc(struct ieee80211_local *local)
- 	}
- }
- 
--void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
-+void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free)
- {
- 	struct ieee80211_roc_work *dep, *tmp;
- 
-+	if (WARN_ON(roc->to_be_freed))
-+		return;
-+
- 	/* was never transmitted */
- 	if (roc->frame) {
- 		cfg80211_mgmt_tx_status(&roc->sdata->wdev,
-@@ -318,9 +321,12 @@ void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
- 						   GFP_KERNEL);
- 
- 	list_for_each_entry_safe(dep, tmp, &roc->dependents, list)
--		ieee80211_roc_notify_destroy(dep);
-+		ieee80211_roc_notify_destroy(dep, true);
- 
--	kfree(roc);
-+	if (free)
-+		kfree(roc);
-+	else
-+		roc->to_be_freed = true;
- }
- 
- void ieee80211_sw_roc_work(struct work_struct *work)
-@@ -333,6 +339,9 @@ void ieee80211_sw_roc_work(struct work_struct *work)
- 
- 	mutex_lock(&local->mtx);
- 
-+	if (roc->to_be_freed)
-+		goto out_unlock;
-+
- 	if (roc->abort)
- 		goto finish;
- 
-@@ -372,7 +381,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
-  finish:
- 		list_del(&roc->list);
- 		started = roc->started;
--		ieee80211_roc_notify_destroy(roc);
-+		ieee80211_roc_notify_destroy(roc, !roc->abort);
- 
- 		if (started) {
- 			drv_flush(local, false);
-@@ -412,7 +421,7 @@ static void ieee80211_hw_roc_done(struct work_struct *work)
- 
- 	list_del(&roc->list);
- 
--	ieee80211_roc_notify_destroy(roc);
-+	ieee80211_roc_notify_destroy(roc, true);
- 
- 	/* if there's another roc, start it now */
- 	ieee80211_start_next_roc(local);
-@@ -462,12 +471,14 @@ void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata)
- 	list_for_each_entry_safe(roc, tmp, &tmp_list, list) {
- 		if (local->ops->remain_on_channel) {
- 			list_del(&roc->list);
--			ieee80211_roc_notify_destroy(roc);
-+			ieee80211_roc_notify_destroy(roc, true);
- 		} else {
- 			ieee80211_queue_delayed_work(&local->hw, &roc->work, 0);
- 
- 			/* work will clean up etc */
- 			flush_delayed_work(&roc->work);
-+			WARN_ON(!roc->to_be_freed);
-+			kfree(roc);
- 		}
- 	}
- 
 diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
 index 79a48f3..5e185c9 100644
 --- a/net/mac80211/pm.c
@@ -90556,7 +90188,7 @@ index 2ca51c7..ee5feb5 100644
  	set_fs(KERNEL_DS);
  	if (level == SOL_SOCKET)
 diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
-index 507b5e8..75e88ea 100644
+index 716aa41..75e88ea 100644
 --- a/net/sunrpc/clnt.c
 +++ b/net/sunrpc/clnt.c
 @@ -303,10 +303,8 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
@@ -90583,25 +90215,7 @@ index 507b5e8..75e88ea 100644
  	return ERR_PTR(err);
  }
  
-@@ -511,7 +508,7 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
- 	new = rpc_new_client(args, xprt);
- 	if (IS_ERR(new)) {
- 		err = PTR_ERR(new);
--		goto out_put;
-+		goto out_err;
- 	}
- 
- 	atomic_inc(&clnt->cl_count);
-@@ -524,8 +521,6 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
- 	new->cl_chatty = clnt->cl_chatty;
- 	return new;
- 
--out_put:
--	xprt_put(xprt);
- out_err:
- 	dprintk("RPC:       %s: returned error %d\n", __func__, err);
- 	return ERR_PTR(err);
-@@ -1272,7 +1267,9 @@ call_start(struct rpc_task *task)
+@@ -1270,7 +1267,9 @@ call_start(struct rpc_task *task)
  			(RPC_IS_ASYNC(task) ? "async" : "sync"));
  
  	/* Increment call count */
@@ -91710,7 +91324,7 @@ index e4fd45b..2eeb5c4 100644
  	shdr = (Elf_Shdr *)((char *)ehdr + _r(&ehdr->e_shoff));
  	shstrtab_sec = shdr + r2(&ehdr->e_shstrndx);
 diff --git a/security/Kconfig b/security/Kconfig
-index e9c6ac7..721e9d0 100644
+index e9c6ac7..20df9f1 100644
 --- a/security/Kconfig
 +++ b/security/Kconfig
 @@ -4,6 +4,944 @@
@@ -92469,7 +92083,7 @@ index e9c6ac7..721e9d0 100644
 +
 +config PAX_MEMORY_STACKLEAK
 +	bool "Sanitize kernel stack"
-+	default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY && !(GRKERNSEC_CONFIG_VIRT_HOST && GRKERNSEC_CONFIG_VIRT_XEN))
++	default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
 +	depends on X86
 +	help
 +	  By saying Y here the kernel will erase the kernel stack before it
@@ -103961,10 +103575,10 @@ index 0000000..ac2901e
 +}
 diff --git a/tools/gcc/structleak_plugin.c b/tools/gcc/structleak_plugin.c
 new file mode 100644
-index 0000000..5afca14
+index 0000000..41770fc
 --- /dev/null
 +++ b/tools/gcc/structleak_plugin.c
-@@ -0,0 +1,271 @@
+@@ -0,0 +1,272 @@
 +/*
 + * Copyright 2013 by PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -104109,9 +103723,11 @@ index 0000000..5afca14
 +		// we're looking for an assignment of a single rhs...
 +		if (!gimple_assign_single_p(stmt))
 +			continue;
++#if BUILDING_GCC_VERSION >= 4007
 +		// ... of a non-clobbering expression...
 +		if (TREE_CLOBBER_P(rhs1))
 +			continue;
++#endif
 +		// ... to our variable...
 +		if (gimple_get_lhs(stmt) != var)
 +			continue;
@@ -104121,8 +103737,7 @@ index 0000000..5afca14
 +	}
 +
 +	// build the initializer expression
-+	initializer = make_node(CONSTRUCTOR);
-+	TREE_TYPE(initializer) = TREE_TYPE(var);
++	initializer = build_constructor(TREE_TYPE(var), NULL);
 +
 +	// build the initializer stmt
 +	init_stmt = gimple_build_assign(var, initializer);
diff --git a/3.8.6/4425_grsec_remove_EI_PAX.patch b/3.8.7/4425_grsec_remove_EI_PAX.patch
index 7d06ac2..7d06ac2 100644
--- a/3.8.6/4425_grsec_remove_EI_PAX.patch
+++ b/3.8.7/4425_grsec_remove_EI_PAX.patch
diff --git a/3.8.6/4430_grsec-remove-localversion-grsec.patch b/3.8.7/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.8.6/4430_grsec-remove-localversion-grsec.patch
+++ b/3.8.7/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.8.6/4435_grsec-mute-warnings.patch b/3.8.7/4435_grsec-mute-warnings.patch
index ed941d5..ed941d5 100644
--- a/3.8.6/4435_grsec-mute-warnings.patch
+++ b/3.8.7/4435_grsec-mute-warnings.patch
diff --git a/3.8.6/4440_grsec-remove-protected-paths.patch b/3.8.7/4440_grsec-remove-protected-paths.patch
index 637934a..637934a 100644
--- a/3.8.6/4440_grsec-remove-protected-paths.patch
+++ b/3.8.7/4440_grsec-remove-protected-paths.patch
diff --git a/3.8.6/4450_grsec-kconfig-default-gids.patch b/3.8.7/4450_grsec-kconfig-default-gids.patch
index 7c20c40..7c20c40 100644
--- a/3.8.6/4450_grsec-kconfig-default-gids.patch
+++ b/3.8.7/4450_grsec-kconfig-default-gids.patch
diff --git a/3.8.6/4465_selinux-avc_audit-log-curr_ip.patch b/3.8.7/4465_selinux-avc_audit-log-curr_ip.patch
index 0a309c8..0a309c8 100644
--- a/3.8.6/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.8.7/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.8.6/4470_disable-compat_vdso.patch b/3.8.7/4470_disable-compat_vdso.patch
index 3ef36aa..3ef36aa 100644
--- a/3.8.6/4470_disable-compat_vdso.patch
+++ b/3.8.7/4470_disable-compat_vdso.patch