commit: 1346d58afe1360a7eb64307476c9de5bfe3eaf19
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Fri Jan 2 16:00:58 2015 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Fri Jan 2 16:00:58 2015 +0000
URL:
http://sources.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=1346d58a
Bump 3.2.65 to 3.2.66
---
{3.2.65 => 3.2.66}/0000_README | 4 +
{3.2.65 => 3.2.66}/1021_linux-3.2.22.patch | 0
{3.2.65 => 3.2.66}/1022_linux-3.2.23.patch | 0
{3.2.65 => 3.2.66}/1023_linux-3.2.24.patch | 0
{3.2.65 => 3.2.66}/1024_linux-3.2.25.patch | 0
{3.2.65 => 3.2.66}/1025_linux-3.2.26.patch | 0
{3.2.65 => 3.2.66}/1026_linux-3.2.27.patch | 0
{3.2.65 => 3.2.66}/1027_linux-3.2.28.patch | 0
{3.2.65 => 3.2.66}/1028_linux-3.2.29.patch | 0
{3.2.65 => 3.2.66}/1029_linux-3.2.30.patch | 0
{3.2.65 => 3.2.66}/1030_linux-3.2.31.patch | 0
{3.2.65 => 3.2.66}/1031_linux-3.2.32.patch | 0
{3.2.65 => 3.2.66}/1032_linux-3.2.33.patch | 0
{3.2.65 => 3.2.66}/1033_linux-3.2.34.patch | 0
{3.2.65 => 3.2.66}/1034_linux-3.2.35.patch | 0
{3.2.65 => 3.2.66}/1035_linux-3.2.36.patch | 0
{3.2.65 => 3.2.66}/1036_linux-3.2.37.patch | 0
{3.2.65 => 3.2.66}/1037_linux-3.2.38.patch | 0
{3.2.65 => 3.2.66}/1038_linux-3.2.39.patch | 0
{3.2.65 => 3.2.66}/1039_linux-3.2.40.patch | 0
{3.2.65 => 3.2.66}/1040_linux-3.2.41.patch | 0
{3.2.65 => 3.2.66}/1041_linux-3.2.42.patch | 0
{3.2.65 => 3.2.66}/1042_linux-3.2.43.patch | 0
{3.2.65 => 3.2.66}/1043_linux-3.2.44.patch | 0
{3.2.65 => 3.2.66}/1044_linux-3.2.45.patch | 0
{3.2.65 => 3.2.66}/1045_linux-3.2.46.patch | 0
{3.2.65 => 3.2.66}/1046_linux-3.2.47.patch | 0
{3.2.65 => 3.2.66}/1047_linux-3.2.48.patch | 0
{3.2.65 => 3.2.66}/1048_linux-3.2.49.patch | 0
{3.2.65 => 3.2.66}/1049_linux-3.2.50.patch | 0
{3.2.65 => 3.2.66}/1050_linux-3.2.51.patch | 0
{3.2.65 => 3.2.66}/1051_linux-3.2.52.patch | 0
{3.2.65 => 3.2.66}/1052_linux-3.2.53.patch | 0
{3.2.65 => 3.2.66}/1053_linux-3.2.54.patch | 0
{3.2.65 => 3.2.66}/1054_linux-3.2.55.patch | 0
{3.2.65 => 3.2.66}/1055_linux-3.2.56.patch | 0
{3.2.65 => 3.2.66}/1056_linux-3.2.57.patch | 0
{3.2.65 => 3.2.66}/1057_linux-3.2.58.patch | 0
{3.2.65 => 3.2.66}/1058_linux-3.2.59.patch | 0
{3.2.65 => 3.2.66}/1059_linux-3.2.60.patch | 0
{3.2.65 => 3.2.66}/1060_linux-3.2.61.patch | 0
{3.2.65 => 3.2.66}/1061_linux-3.2.62.patch | 0
{3.2.65 => 3.2.66}/1062_linux-3.2.63.patch | 0
{3.2.65 => 3.2.66}/1063_linux-3.2.64.patch | 0
{3.2.65 => 3.2.66}/1064_linux-3.2.65.patch | 0
3.2.66/1065_linux-3.2.66.patch | 2041 ++++++++++++++++++++
.../4420_grsecurity-3.0-3.2.65-201412280855.patch | 0
{3.2.65 => 3.2.66}/4425_grsec_remove_EI_PAX.patch | 0
.../4427_force_XATTR_PAX_tmpfs.patch | 0
.../4430_grsec-remove-localversion-grsec.patch | 0
{3.2.65 => 3.2.66}/4435_grsec-mute-warnings.patch | 0
.../4440_grsec-remove-protected-paths.patch | 0
.../4450_grsec-kconfig-default-gids.patch | 0
.../4465_selinux-avc_audit-log-curr_ip.patch | 0
{3.2.65 => 3.2.66}/4470_disable-compat_vdso.patch | 0
{3.2.65 => 3.2.66}/4475_emutramp_default_on.patch | 0
56 files changed, 2045 insertions(+)
diff --git a/3.2.65/0000_README b/3.2.66/0000_README
similarity index 98%
rename from 3.2.65/0000_README
rename to 3.2.66/0000_README
index 153f045..96a6e23 100644
--- a/3.2.65/0000_README
+++ b/3.2.66/0000_README
@@ -178,6 +178,10 @@ Patch: 1064_linux-3.2.65.patch
From: http://www.kernel.org
Desc: Linux 3.2.65
+Patch: 1065_linux-3.2.66.patch
+From: http://www.kernel.org
+Desc: Linux 3.2.66
+
Patch: 4420_grsecurity-3.0-3.2.65-201412280855.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.2.65/1021_linux-3.2.22.patch b/3.2.66/1021_linux-3.2.22.patch
similarity index 100%
rename from 3.2.65/1021_linux-3.2.22.patch
rename to 3.2.66/1021_linux-3.2.22.patch
diff --git a/3.2.65/1022_linux-3.2.23.patch b/3.2.66/1022_linux-3.2.23.patch
similarity index 100%
rename from 3.2.65/1022_linux-3.2.23.patch
rename to 3.2.66/1022_linux-3.2.23.patch
diff --git a/3.2.65/1023_linux-3.2.24.patch b/3.2.66/1023_linux-3.2.24.patch
similarity index 100%
rename from 3.2.65/1023_linux-3.2.24.patch
rename to 3.2.66/1023_linux-3.2.24.patch
diff --git a/3.2.65/1024_linux-3.2.25.patch b/3.2.66/1024_linux-3.2.25.patch
similarity index 100%
rename from 3.2.65/1024_linux-3.2.25.patch
rename to 3.2.66/1024_linux-3.2.25.patch
diff --git a/3.2.65/1025_linux-3.2.26.patch b/3.2.66/1025_linux-3.2.26.patch
similarity index 100%
rename from 3.2.65/1025_linux-3.2.26.patch
rename to 3.2.66/1025_linux-3.2.26.patch
diff --git a/3.2.65/1026_linux-3.2.27.patch b/3.2.66/1026_linux-3.2.27.patch
similarity index 100%
rename from 3.2.65/1026_linux-3.2.27.patch
rename to 3.2.66/1026_linux-3.2.27.patch
diff --git a/3.2.65/1027_linux-3.2.28.patch b/3.2.66/1027_linux-3.2.28.patch
similarity index 100%
rename from 3.2.65/1027_linux-3.2.28.patch
rename to 3.2.66/1027_linux-3.2.28.patch
diff --git a/3.2.65/1028_linux-3.2.29.patch b/3.2.66/1028_linux-3.2.29.patch
similarity index 100%
rename from 3.2.65/1028_linux-3.2.29.patch
rename to 3.2.66/1028_linux-3.2.29.patch
diff --git a/3.2.65/1029_linux-3.2.30.patch b/3.2.66/1029_linux-3.2.30.patch
similarity index 100%
rename from 3.2.65/1029_linux-3.2.30.patch
rename to 3.2.66/1029_linux-3.2.30.patch
diff --git a/3.2.65/1030_linux-3.2.31.patch b/3.2.66/1030_linux-3.2.31.patch
similarity index 100%
rename from 3.2.65/1030_linux-3.2.31.patch
rename to 3.2.66/1030_linux-3.2.31.patch
diff --git a/3.2.65/1031_linux-3.2.32.patch b/3.2.66/1031_linux-3.2.32.patch
similarity index 100%
rename from 3.2.65/1031_linux-3.2.32.patch
rename to 3.2.66/1031_linux-3.2.32.patch
diff --git a/3.2.65/1032_linux-3.2.33.patch b/3.2.66/1032_linux-3.2.33.patch
similarity index 100%
rename from 3.2.65/1032_linux-3.2.33.patch
rename to 3.2.66/1032_linux-3.2.33.patch
diff --git a/3.2.65/1033_linux-3.2.34.patch b/3.2.66/1033_linux-3.2.34.patch
similarity index 100%
rename from 3.2.65/1033_linux-3.2.34.patch
rename to 3.2.66/1033_linux-3.2.34.patch
diff --git a/3.2.65/1034_linux-3.2.35.patch b/3.2.66/1034_linux-3.2.35.patch
similarity index 100%
rename from 3.2.65/1034_linux-3.2.35.patch
rename to 3.2.66/1034_linux-3.2.35.patch
diff --git a/3.2.65/1035_linux-3.2.36.patch b/3.2.66/1035_linux-3.2.36.patch
similarity index 100%
rename from 3.2.65/1035_linux-3.2.36.patch
rename to 3.2.66/1035_linux-3.2.36.patch
diff --git a/3.2.65/1036_linux-3.2.37.patch b/3.2.66/1036_linux-3.2.37.patch
similarity index 100%
rename from 3.2.65/1036_linux-3.2.37.patch
rename to 3.2.66/1036_linux-3.2.37.patch
diff --git a/3.2.65/1037_linux-3.2.38.patch b/3.2.66/1037_linux-3.2.38.patch
similarity index 100%
rename from 3.2.65/1037_linux-3.2.38.patch
rename to 3.2.66/1037_linux-3.2.38.patch
diff --git a/3.2.65/1038_linux-3.2.39.patch b/3.2.66/1038_linux-3.2.39.patch
similarity index 100%
rename from 3.2.65/1038_linux-3.2.39.patch
rename to 3.2.66/1038_linux-3.2.39.patch
diff --git a/3.2.65/1039_linux-3.2.40.patch b/3.2.66/1039_linux-3.2.40.patch
similarity index 100%
rename from 3.2.65/1039_linux-3.2.40.patch
rename to 3.2.66/1039_linux-3.2.40.patch
diff --git a/3.2.65/1040_linux-3.2.41.patch b/3.2.66/1040_linux-3.2.41.patch
similarity index 100%
rename from 3.2.65/1040_linux-3.2.41.patch
rename to 3.2.66/1040_linux-3.2.41.patch
diff --git a/3.2.65/1041_linux-3.2.42.patch b/3.2.66/1041_linux-3.2.42.patch
similarity index 100%
rename from 3.2.65/1041_linux-3.2.42.patch
rename to 3.2.66/1041_linux-3.2.42.patch
diff --git a/3.2.65/1042_linux-3.2.43.patch b/3.2.66/1042_linux-3.2.43.patch
similarity index 100%
rename from 3.2.65/1042_linux-3.2.43.patch
rename to 3.2.66/1042_linux-3.2.43.patch
diff --git a/3.2.65/1043_linux-3.2.44.patch b/3.2.66/1043_linux-3.2.44.patch
similarity index 100%
rename from 3.2.65/1043_linux-3.2.44.patch
rename to 3.2.66/1043_linux-3.2.44.patch
diff --git a/3.2.65/1044_linux-3.2.45.patch b/3.2.66/1044_linux-3.2.45.patch
similarity index 100%
rename from 3.2.65/1044_linux-3.2.45.patch
rename to 3.2.66/1044_linux-3.2.45.patch
diff --git a/3.2.65/1045_linux-3.2.46.patch b/3.2.66/1045_linux-3.2.46.patch
similarity index 100%
rename from 3.2.65/1045_linux-3.2.46.patch
rename to 3.2.66/1045_linux-3.2.46.patch
diff --git a/3.2.65/1046_linux-3.2.47.patch b/3.2.66/1046_linux-3.2.47.patch
similarity index 100%
rename from 3.2.65/1046_linux-3.2.47.patch
rename to 3.2.66/1046_linux-3.2.47.patch
diff --git a/3.2.65/1047_linux-3.2.48.patch b/3.2.66/1047_linux-3.2.48.patch
similarity index 100%
rename from 3.2.65/1047_linux-3.2.48.patch
rename to 3.2.66/1047_linux-3.2.48.patch
diff --git a/3.2.65/1048_linux-3.2.49.patch b/3.2.66/1048_linux-3.2.49.patch
similarity index 100%
rename from 3.2.65/1048_linux-3.2.49.patch
rename to 3.2.66/1048_linux-3.2.49.patch
diff --git a/3.2.65/1049_linux-3.2.50.patch b/3.2.66/1049_linux-3.2.50.patch
similarity index 100%
rename from 3.2.65/1049_linux-3.2.50.patch
rename to 3.2.66/1049_linux-3.2.50.patch
diff --git a/3.2.65/1050_linux-3.2.51.patch b/3.2.66/1050_linux-3.2.51.patch
similarity index 100%
rename from 3.2.65/1050_linux-3.2.51.patch
rename to 3.2.66/1050_linux-3.2.51.patch
diff --git a/3.2.65/1051_linux-3.2.52.patch b/3.2.66/1051_linux-3.2.52.patch
similarity index 100%
rename from 3.2.65/1051_linux-3.2.52.patch
rename to 3.2.66/1051_linux-3.2.52.patch
diff --git a/3.2.65/1052_linux-3.2.53.patch b/3.2.66/1052_linux-3.2.53.patch
similarity index 100%
rename from 3.2.65/1052_linux-3.2.53.patch
rename to 3.2.66/1052_linux-3.2.53.patch
diff --git a/3.2.65/1053_linux-3.2.54.patch b/3.2.66/1053_linux-3.2.54.patch
similarity index 100%
rename from 3.2.65/1053_linux-3.2.54.patch
rename to 3.2.66/1053_linux-3.2.54.patch
diff --git a/3.2.65/1054_linux-3.2.55.patch b/3.2.66/1054_linux-3.2.55.patch
similarity index 100%
rename from 3.2.65/1054_linux-3.2.55.patch
rename to 3.2.66/1054_linux-3.2.55.patch
diff --git a/3.2.65/1055_linux-3.2.56.patch b/3.2.66/1055_linux-3.2.56.patch
similarity index 100%
rename from 3.2.65/1055_linux-3.2.56.patch
rename to 3.2.66/1055_linux-3.2.56.patch
diff --git a/3.2.65/1056_linux-3.2.57.patch b/3.2.66/1056_linux-3.2.57.patch
similarity index 100%
rename from 3.2.65/1056_linux-3.2.57.patch
rename to 3.2.66/1056_linux-3.2.57.patch
diff --git a/3.2.65/1057_linux-3.2.58.patch b/3.2.66/1057_linux-3.2.58.patch
similarity index 100%
rename from 3.2.65/1057_linux-3.2.58.patch
rename to 3.2.66/1057_linux-3.2.58.patch
diff --git a/3.2.65/1058_linux-3.2.59.patch b/3.2.66/1058_linux-3.2.59.patch
similarity index 100%
rename from 3.2.65/1058_linux-3.2.59.patch
rename to 3.2.66/1058_linux-3.2.59.patch
diff --git a/3.2.65/1059_linux-3.2.60.patch b/3.2.66/1059_linux-3.2.60.patch
similarity index 100%
rename from 3.2.65/1059_linux-3.2.60.patch
rename to 3.2.66/1059_linux-3.2.60.patch
diff --git a/3.2.65/1060_linux-3.2.61.patch b/3.2.66/1060_linux-3.2.61.patch
similarity index 100%
rename from 3.2.65/1060_linux-3.2.61.patch
rename to 3.2.66/1060_linux-3.2.61.patch
diff --git a/3.2.65/1061_linux-3.2.62.patch b/3.2.66/1061_linux-3.2.62.patch
similarity index 100%
rename from 3.2.65/1061_linux-3.2.62.patch
rename to 3.2.66/1061_linux-3.2.62.patch
diff --git a/3.2.65/1062_linux-3.2.63.patch b/3.2.66/1062_linux-3.2.63.patch
similarity index 100%
rename from 3.2.65/1062_linux-3.2.63.patch
rename to 3.2.66/1062_linux-3.2.63.patch
diff --git a/3.2.65/1063_linux-3.2.64.patch b/3.2.66/1063_linux-3.2.64.patch
similarity index 100%
rename from 3.2.65/1063_linux-3.2.64.patch
rename to 3.2.66/1063_linux-3.2.64.patch
diff --git a/3.2.65/1064_linux-3.2.65.patch b/3.2.66/1064_linux-3.2.65.patch
similarity index 100%
rename from 3.2.65/1064_linux-3.2.65.patch
rename to 3.2.66/1064_linux-3.2.65.patch
diff --git a/3.2.66/1065_linux-3.2.66.patch b/3.2.66/1065_linux-3.2.66.patch
new file mode 100644
index 0000000..73fa646
--- /dev/null
+++ b/3.2.66/1065_linux-3.2.66.patch
@@ -0,0 +1,2041 @@
+diff --git a/Makefile b/Makefile
+index 1433109..f08f8bf 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 65
++SUBLEVEL = 66
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/powerpc/platforms/cell/spufs/inode.c
b/arch/powerpc/platforms/cell/spufs/inode.c
+index 70ec4e9..941d5cb 100644
+--- a/arch/powerpc/platforms/cell/spufs/inode.c
++++ b/arch/powerpc/platforms/cell/spufs/inode.c
+@@ -165,7 +165,7 @@ static void spufs_prune_dir(struct dentry *dir)
+ struct dentry *dentry, *tmp;
+
+ mutex_lock(&dir->d_inode->i_mutex);
+- list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_u.d_child) {
++ list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_child) {
+ spin_lock(&dentry->d_lock);
+ if (!(d_unhashed(dentry)) && dentry->d_inode) {
+ dget_dlock(dentry);
+@@ -223,7 +223,7 @@ out:
+ * - free child's inode if possible
+ * - free child
+ */
+- list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_u.d_child) {
++ list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_child) {
+ dput(dentry);
+ }
+
+diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
+index b2f44de..fd65e5e2 100644
+--- a/arch/s390/kernel/time.c
++++ b/arch/s390/kernel/time.c
+@@ -110,20 +110,10 @@ static void fixup_clock_comparator(unsigned long long
delta)
+ set_clock_comparator(S390_lowcore.clock_comparator);
+ }
+
+-static int s390_next_ktime(ktime_t expires,
++static int s390_next_event(unsigned long delta,
+ struct clock_event_device *evt)
+ {
+- struct timespec ts;
+- u64 nsecs;
+-
+- ts.tv_sec = ts.tv_nsec = 0;
+- monotonic_to_bootbased(&ts);
+- nsecs = ktime_to_ns(ktime_add(timespec_to_ktime(ts), expires));
+- do_div(nsecs, 125);
+- S390_lowcore.clock_comparator = sched_clock_base_cc + (nsecs << 9);
+- /* Program the maximum value if we have an overflow (== year 2042) */
+- if (unlikely(S390_lowcore.clock_comparator < sched_clock_base_cc))
+- S390_lowcore.clock_comparator = -1ULL;
++ S390_lowcore.clock_comparator = get_clock() + delta;
+ set_clock_comparator(S390_lowcore.clock_comparator);
+ return 0;
+ }
+@@ -148,15 +138,14 @@ void init_cpu_timer(void)
+ cpu = smp_processor_id();
+ cd = &per_cpu(comparators, cpu);
+ cd->name = "comparator";
+- cd->features = CLOCK_EVT_FEAT_ONESHOT |
+- CLOCK_EVT_FEAT_KTIME;
++ cd->features = CLOCK_EVT_FEAT_ONESHOT;
+ cd->mult = 16777;
+ cd->shift = 12;
+ cd->min_delta_ns = 1;
+ cd->max_delta_ns = LONG_MAX;
+ cd->rating = 400;
+ cd->cpumask = cpumask_of(cpu);
+- cd->set_next_ktime = s390_next_ktime;
++ cd->set_next_event = s390_next_event;
+ cd->set_mode = s390_set_mode;
+
+ clockevents_register_device(cd);
+diff --git a/arch/x86/crypto/ghash-clmulni-intel_asm.S
b/arch/x86/crypto/ghash-clmulni-intel_asm.S
+index 1eb7f90..eb4d2a2 100644
+--- a/arch/x86/crypto/ghash-clmulni-intel_asm.S
++++ b/arch/x86/crypto/ghash-clmulni-intel_asm.S
+@@ -24,10 +24,6 @@
+ .align 16
+ .Lbswap_mask:
+ .octa 0x000102030405060708090a0b0c0d0e0f
+-.Lpoly:
+- .octa 0xc2000000000000000000000000000001
+-.Ltwo_one:
+- .octa 0x00000001000000000000000000000001
+
+ #define DATA %xmm0
+ #define SHASH %xmm1
+@@ -131,27 +127,3 @@ ENTRY(clmul_ghash_update)
+ movups DATA, (%rdi)
+ .Lupdate_just_ret:
+ ret
+-
+-/*
+- * void clmul_ghash_setkey(be128 *shash, const u8 *key);
+- *
+- * Calculate hash_key << 1 mod poly
+- */
+-ENTRY(clmul_ghash_setkey)
+- movaps .Lbswap_mask, BSWAP
+- movups (%rsi), %xmm0
+- PSHUFB_XMM BSWAP %xmm0
+- movaps %xmm0, %xmm1
+- psllq $1, %xmm0
+- psrlq $63, %xmm1
+- movaps %xmm1, %xmm2
+- pslldq $8, %xmm1
+- psrldq $8, %xmm2
+- por %xmm1, %xmm0
+- # reduction
+- pshufd $0b00100100, %xmm2, %xmm1
+- pcmpeqd .Ltwo_one, %xmm1
+- pand .Lpoly, %xmm1
+- pxor %xmm1, %xmm0
+- movups %xmm0, (%rdi)
+- ret
+diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c
b/arch/x86/crypto/ghash-clmulni-intel_glue.c
+index 976aa64..294a264 100644
+--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c
++++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c
+@@ -29,8 +29,6 @@ void clmul_ghash_mul(char *dst, const be128 *shash);
+ void clmul_ghash_update(char *dst, const char *src, unsigned int srclen,
+ const be128 *shash);
+
+-void clmul_ghash_setkey(be128 *shash, const u8 *key);
+-
+ struct ghash_async_ctx {
+ struct cryptd_ahash *cryptd_tfm;
+ };
+@@ -57,13 +55,23 @@ static int ghash_setkey(struct crypto_shash *tfm,
+ const u8 *key, unsigned int keylen)
+ {
+ struct ghash_ctx *ctx = crypto_shash_ctx(tfm);
++ be128 *x = (be128 *)key;
++ u64 a, b;
+
+ if (keylen != GHASH_BLOCK_SIZE) {
+ crypto_shash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
+ return -EINVAL;
+ }
+
+- clmul_ghash_setkey(&ctx->shash, key);
++ /* perform multiplication by 'x' in GF(2^128) */
++ a = be64_to_cpu(x->a);
++ b = be64_to_cpu(x->b);
++
++ ctx->shash.a = (__be64)((b << 1) | (a >> 63));
++ ctx->shash.b = (__be64)((a << 1) | (b >> 63));
++
++ if (a >> 63)
++ ctx->shash.b ^= cpu_to_be64(0xc2);
+
+ return 0;
+ }
+diff --git a/arch/x86/include/asm/cpufeature.h
b/arch/x86/include/asm/cpufeature.h
+index a315f1c..b8a5fe5 100644
+--- a/arch/x86/include/asm/cpufeature.h
++++ b/arch/x86/include/asm/cpufeature.h
+@@ -193,6 +193,7 @@
+ #define X86_FEATURE_DECODEASSISTS (8*32+12) /* AMD Decode Assists support */
+ #define X86_FEATURE_PAUSEFILTER (8*32+13) /* AMD filtered pause intercept */
+ #define X86_FEATURE_PFTHRESHOLD (8*32+14) /* AMD pause filter threshold */
++#define X86_FEATURE_VMMCALL ( 8*32+15) /* Prefer vmmcall to vmcall */
+
+
+ /* Intel-defined CPU features, CPUID level 0x00000007:0 (ebx), word 9 */
+diff --git a/arch/x86/include/asm/kvm_para.h b/arch/x86/include/asm/kvm_para.h
+index 734c376..9f0a680 100644
+--- a/arch/x86/include/asm/kvm_para.h
++++ b/arch/x86/include/asm/kvm_para.h
+@@ -91,15 +91,21 @@ struct kvm_vcpu_pv_apf_data {
+
+ #ifdef __KERNEL__
+ #include <asm/processor.h>
++#include <asm/alternative.h>
+
+ extern void kvmclock_init(void);
+ extern int kvm_register_clock(char *txt);
+
+
+-/* This instruction is vmcall. On non-VT architectures, it will generate a
+- * trap that we will then rewrite to the appropriate instruction.
++#ifdef CONFIG_DEBUG_RODATA
++#define KVM_HYPERCALL \
++ ALTERNATIVE(".byte 0x0f,0x01,0xc1", ".byte 0x0f,0x01,0xd9",
X86_FEATURE_VMMCALL)
++#else
++/* On AMD processors, vmcall will generate a trap that we will
++ * then rewrite to the appropriate instruction.
+ */
+ #define KVM_HYPERCALL ".byte 0x0f,0x01,0xc1"
++#endif
+
+ /* For KVM hypercalls, a three-byte sequence of either the vmrun or the vmmrun
+ * instruction. The hypervisor may replace it with something else but only
the
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index f07becc..2d44a28 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -469,6 +469,13 @@ static void __cpuinit early_init_amd(struct cpuinfo_x86
*c)
+ set_cpu_cap(c, X86_FEATURE_EXTD_APICID);
+ }
+ #endif
++
++ /*
++ * This is only needed to tell the kernel whether to use VMCALL
++ * and VMMCALL. VMMCALL is never executed except under virt, so
++ * we can set it unconditionally.
++ */
++ set_cpu_cap(c, X86_FEATURE_VMMCALL);
+ }
+
+ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index a9c2116..4b6701e 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -419,7 +419,14 @@ static void kvm_leave_lazy_mmu(void)
+ static void __init paravirt_ops_setup(void)
+ {
+ pv_info.name = "KVM";
+- pv_info.paravirt_enabled = 1;
++
++ /*
++ * KVM isn't paravirt in the sense of paravirt_enabled. A KVM
++ * guest kernel works like a bare metal kernel with additional
++ * features, and paravirt_enabled is about features that are
++ * missing.
++ */
++ pv_info.paravirt_enabled = 0;
+
+ if (kvm_para_has_feature(KVM_FEATURE_NOP_IO_DELAY))
+ pv_cpu_ops.io_delay = kvm_io_delay;
+diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
+index 44842d7..e90eca0 100644
+--- a/arch/x86/kernel/kvmclock.c
++++ b/arch/x86/kernel/kvmclock.c
+@@ -203,7 +203,6 @@ void __init kvmclock_init(void)
+ #endif
+ kvm_get_preset_lpj();
+ clocksource_register_hz(&kvm_clock, NSEC_PER_SEC);
+- pv_info.paravirt_enabled = 1;
+ pv_info.name = "KVM";
+
+ if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE_STABLE_BIT))
+diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
+index bcfec2d..7af7338 100644
+--- a/arch/x86/kernel/tls.c
++++ b/arch/x86/kernel/tls.c
+@@ -28,6 +28,21 @@ static int get_free_idx(void)
+ return -ESRCH;
+ }
+
++static bool tls_desc_okay(const struct user_desc *info)
++{
++ if (LDT_empty(info))
++ return true;
++
++ /*
++ * espfix is required for 16-bit data segments, but espfix
++ * only works for LDT segments.
++ */
++ if (!info->seg_32bit)
++ return false;
++
++ return true;
++}
++
+ static void set_tls_desc(struct task_struct *p, int idx,
+ const struct user_desc *info, int n)
+ {
+@@ -67,6 +82,9 @@ int do_set_thread_area(struct task_struct *p, int idx,
+ if (copy_from_user(&info, u_info, sizeof(info)))
+ return -EFAULT;
+
++ if (!tls_desc_okay(&info))
++ return -EINVAL;
++
+ if (idx == -1)
+ idx = info.entry_number;
+
+@@ -197,6 +215,7 @@ int regset_tls_set(struct task_struct *target, const
struct user_regset *regset,
+ {
+ struct user_desc infobuf[GDT_ENTRY_TLS_ENTRIES];
+ const struct user_desc *info;
++ int i;
+
+ if (pos >= GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
+ (pos % sizeof(struct user_desc)) != 0 ||
+@@ -210,6 +229,10 @@ int regset_tls_set(struct task_struct *target, const
struct user_regset *regset,
+ else
+ info = infobuf;
+
++ for (i = 0; i < count / sizeof(struct user_desc); i++)
++ if (!tls_desc_okay(info + i))
++ return -EINVAL;
++
+ set_tls_desc(target,
+ GDT_ENTRY_TLS_MIN + (pos / sizeof(struct user_desc)),
+ info, count / sizeof(struct user_desc));
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 2d7d0df..bb179cc 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -4846,7 +4846,7 @@ static int handle_emulation_failure(struct kvm_vcpu
*vcpu)
+
+ ++vcpu->stat.insn_emulation_fail;
+ trace_kvm_emulate_insn_failed(vcpu);
+- if (!is_guest_mode(vcpu)) {
++ if (!is_guest_mode(vcpu) && kvm_x86_ops->get_cpl(vcpu) == 0) {
+ vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+ vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
+ vcpu->run->internal.ndata = 0;
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 923ac15..81f32e5 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -331,6 +331,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */
++ { PCI_VDEVICE(INTEL, 0x9d03), board_ahci }, /* Sunrise Point-LP AHCI */
++ { PCI_VDEVICE(INTEL, 0x9d05), board_ahci }, /* Sunrise Point-LP RAID */
++ { PCI_VDEVICE(INTEL, 0x9d07), board_ahci }, /* Sunrise Point-LP RAID */
+ { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */
+ { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H RAID */
+ { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */
+@@ -499,6 +502,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ * enabled. https://bugzilla.kernel.org/show_bug.cgi?id=60731
+ */
+ { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_nomsi },
++ { PCI_VDEVICE(SAMSUNG, 0xa800), board_ahci_nomsi },
+
+ /* Enmotus */
+ { PCI_DEVICE(0x1c44, 0x8000), board_ahci },
+diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
+index 78ae7b6..54702f8 100644
+--- a/drivers/ata/sata_fsl.c
++++ b/drivers/ata/sata_fsl.c
+@@ -1338,7 +1338,7 @@ static int sata_fsl_probe(struct platform_device *ofdev)
+ host_priv->csr_base = csr_base;
+
+ irq = irq_of_parse_and_map(ofdev->dev.of_node, 0);
+- if (irq < 0) {
++ if (!irq) {
+ dev_err(&ofdev->dev, "invalid irq from platform\n");
+ goto error_exit_with_cleanup;
+ }
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index 3f1799b..09851ce 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -1815,7 +1815,17 @@ int drm_mode_getfb(struct drm_device *dev,
+ r->depth = fb->depth;
+ r->bpp = fb->bits_per_pixel;
+ r->pitch = fb->pitch;
+- fb->funcs->create_handle(fb, file_priv, &r->handle);
++ if (file_priv->is_master || capable(CAP_SYS_ADMIN)) {
++ ret = fb->funcs->create_handle(fb, file_priv, &r->handle);
++ } else {
++ /* GET_FB() is an unprivileged ioctl so we must not
++ * return a buffer-handle to non-master processes! For
++ * backwards-compatibility reasons, we cannot make
++ * GET_FB() privileged, so just return an invalid handle
++ * for non-masters. */
++ r->handle = 0;
++ ret = 0;
++ }
+
+ out:
+ mutex_unlock(&dev->mode_config.mutex);
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c
b/drivers/gpu/drm/i915/intel_lvds.c
+index fadd021..4da8182 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -914,6 +914,18 @@ bool intel_lvds_init(struct drm_device *dev)
+ int pipe;
+ u8 pin;
+
++ /*
++ * Unlock registers and just leave them unlocked. Do this before
++ * checking quirk lists to avoid bogus WARNINGs.
++ */
++ if (HAS_PCH_SPLIT(dev)) {
++ I915_WRITE(PCH_PP_CONTROL,
++ I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
++ } else {
++ I915_WRITE(PP_CONTROL,
++ I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
++ }
++
+ /* Skip init on machines we know falsely report LVDS */
+ if (dmi_check_system(intel_no_lvds))
+ return false;
+@@ -1088,19 +1100,6 @@ out:
+ pwm = I915_READ(BLC_PWM_PCH_CTL1);
+ pwm |= PWM_PCH_ENABLE;
+ I915_WRITE(BLC_PWM_PCH_CTL1, pwm);
+- /*
+- * Unlock registers and just
+- * leave them unlocked
+- */
+- I915_WRITE(PCH_PP_CONTROL,
+- I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
+- } else {
+- /*
+- * Unlock registers and just
+- * leave them unlocked
+- */
+- I915_WRITE(PP_CONTROL,
+- I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
+ }
+ dev_priv->lid_notifier.notifier_call = intel_lid_notify;
+ if (acpi_lid_notifier_register(&dev_priv->lid_notifier)) {
+diff --git a/drivers/i2c/busses/i2c-davinci.c
b/drivers/i2c/busses/i2c-davinci.c
+index 79b4bcb..1837fe6 100644
+--- a/drivers/i2c/busses/i2c-davinci.c
++++ b/drivers/i2c/busses/i2c-davinci.c
+@@ -416,11 +416,9 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct
i2c_msg *msg, int stop)
+ if (dev->cmd_err & DAVINCI_I2C_STR_NACK) {
+ if (msg->flags & I2C_M_IGNORE_NAK)
+ return msg->len;
+- if (stop) {
+- w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG);
+- w |= DAVINCI_I2C_MDR_STP;
+- davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w);
+- }
++ w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG);
++ w |= DAVINCI_I2C_MDR_STP;
++ davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w);
+ return -EREMOTEIO;
+ }
+ return -EIO;
+diff --git a/drivers/media/dvb/ttusb-dec/ttusbdecfe.c
b/drivers/media/dvb/ttusb-dec/ttusbdecfe.c
+index 21260aa..852870b 100644
+--- a/drivers/media/dvb/ttusb-dec/ttusbdecfe.c
++++ b/drivers/media/dvb/ttusb-dec/ttusbdecfe.c
+@@ -154,6 +154,9 @@ static int ttusbdecfe_dvbs_diseqc_send_master_cmd(struct
dvb_frontend* fe, struc
+ 0x00, 0x00, 0x00, 0x00,
+ 0x00, 0x00 };
+
++ if (cmd->msg_len > sizeof(b) - 4)
++ return -EINVAL;
++
+ memcpy(&b[4], cmd->msg, cmd->msg_len);
+
+ state->config->send_command(fe, 0x72,
+diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
+index 654a5e9..61d3d1f 100644
+--- a/drivers/net/Kconfig
++++ b/drivers/net/Kconfig
+@@ -143,6 +143,7 @@ config MACVLAN
+ config MACVTAP
+ tristate "MAC-VLAN based tap driver (EXPERIMENTAL)"
+ depends on MACVLAN
++ depends on INET
+ help
+ This adds a specialized tap character device driver that is based
+ on the MAC-VLAN network interface, called macvtap. A macvtap device
+@@ -195,6 +196,7 @@ config RIONET_RX_SIZE
+
+ config TUN
+ tristate "Universal TUN/TAP device driver support"
++ depends on INET
+ select CRC32
+ ---help---
+ TUN/TAP provides packet reception and transmission for user space
+diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
+index b0f9015..0e6e57e 100644
+--- a/drivers/net/macvtap.c
++++ b/drivers/net/macvtap.c
+@@ -15,6 +15,7 @@
+ #include <linux/cdev.h>
+ #include <linux/fs.h>
+
++#include <net/ipv6.h>
+ #include <net/net_namespace.h>
+ #include <net/rtnetlink.h>
+ #include <net/sock.h>
+@@ -577,6 +578,8 @@ static int macvtap_skb_from_vnet_hdr(struct sk_buff *skb,
+ break;
+ case VIRTIO_NET_HDR_GSO_UDP:
+ gso_type = SKB_GSO_UDP;
++ if (skb->protocol == htons(ETH_P_IPV6))
++ ipv6_proxy_select_ident(skb);
+ break;
+ default:
+ return -EINVAL;
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index ee1aab0..2fbbca6 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -64,6 +64,7 @@
+ #include <linux/nsproxy.h>
+ #include <linux/virtio_net.h>
+ #include <linux/rcupdate.h>
++#include <net/ipv6.h>
+ #include <net/net_namespace.h>
+ #include <net/netns/generic.h>
+ #include <net/rtnetlink.h>
+@@ -695,6 +696,8 @@ static ssize_t tun_get_user(struct tun_struct *tun,
+ break;
+ }
+
++ skb_reset_network_header(skb);
++
+ if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+ pr_debug("GSO!\n");
+ switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
+@@ -706,6 +709,8 @@ static ssize_t tun_get_user(struct tun_struct *tun,
+ break;
+ case VIRTIO_NET_HDR_GSO_UDP:
+ skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
++ if (skb->protocol == htons(ETH_P_IPV6))
++ ipv6_proxy_select_ident(skb);
+ break;
+ default:
+ tun->dev->stats.rx_frame_errors++;
+diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
+index 2278dad..5babd94 100644
+--- a/drivers/usb/core/inode.c
++++ b/drivers/usb/core/inode.c
+@@ -212,7 +212,7 @@ static void update_bus(struct dentry *bus)
+
+ mutex_lock(&bus->d_inode->i_mutex);
+
+- list_for_each_entry(dev, &bus->d_subdirs, d_u.d_child)
++ list_for_each_entry(dev, &bus->d_subdirs, d_child)
+ if (dev->d_inode)
+ update_dev(dev);
+
+@@ -229,7 +229,7 @@ static void update_sb(struct super_block *sb)
+
+ mutex_lock_nested(&root->d_inode->i_mutex, I_MUTEX_PARENT);
+
+- list_for_each_entry(bus, &root->d_subdirs, d_u.d_child) {
++ list_for_each_entry(bus, &root->d_subdirs, d_child) {
+ if (bus->d_inode) {
+ switch (S_IFMT & bus->d_inode->i_mode) {
+ case S_IFDIR:
+@@ -345,7 +345,7 @@ static int usbfs_empty (struct dentry *dentry)
+
+ spin_lock(&dentry->d_lock);
+ list_for_each(list, &dentry->d_subdirs) {
+- struct dentry *de = list_entry(list, struct dentry,
d_u.d_child);
++ struct dentry *de = list_entry(list, struct dentry, d_child);
+
+ spin_lock_nested(&de->d_lock, DENTRY_D_LOCK_NESTED);
+ if (usbfs_positive(de)) {
+diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
+index 0b5745e..30d4fa8 100644
+--- a/fs/9p/vfs_inode_dotl.c
++++ b/fs/9p/vfs_inode_dotl.c
+@@ -81,7 +81,7 @@ static struct dentry *v9fs_dentry_from_dir_inode(struct
inode *inode)
+ spin_lock(&inode->i_lock);
+ /* Directory should have only one entry. */
+ BUG_ON(S_ISDIR(inode->i_mode) && !list_is_singular(&inode->i_dentry));
+- dentry = list_entry(inode->i_dentry.next, struct dentry, d_alias);
++ dentry = list_entry(inode->i_dentry.next, struct dentry, d_u.d_alias);
+ spin_unlock(&inode->i_lock);
+ return dentry;
+ }
+diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c
+index de37ec8..43c05d8 100644
+--- a/fs/affs/amigaffs.c
++++ b/fs/affs/amigaffs.c
+@@ -132,7 +132,7 @@ affs_fix_dcache(struct dentry *dentry, u32 entry_ino)
+ head = &inode->i_dentry;
+ next = head->next;
+ while (next != head) {
+- dentry = list_entry(next, struct dentry, d_alias);
++ dentry = list_entry(next, struct dentry, d_u.d_alias);
+ if (entry_ino == (u32)(long)dentry->d_fsdata) {
+ dentry->d_fsdata = data;
+ break;
+diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
+index 2c69d12..7fc0371 100644
+--- a/fs/autofs4/expire.c
++++ b/fs/autofs4/expire.c
+@@ -100,7 +100,7 @@ static struct dentry *get_next_positive_subdir(struct
dentry *prev,
+ p = prev;
+ spin_lock(&p->d_lock);
+ again:
+- next = p->d_u.d_child.next;
++ next = p->d_child.next;
+ start:
+ if (next == &root->d_subdirs) {
+ spin_unlock(&p->d_lock);
+@@ -109,7 +109,7 @@ start:
+ return NULL;
+ }
+
+- q = list_entry(next, struct dentry, d_u.d_child);
++ q = list_entry(next, struct dentry, d_child);
+
+ spin_lock_nested(&q->d_lock, DENTRY_D_LOCK_NESTED);
+ /* Negative dentry - try next */
+@@ -165,13 +165,13 @@ again:
+ goto relock;
+ }
+ spin_unlock(&p->d_lock);
+- next = p->d_u.d_child.next;
++ next = p->d_child.next;
+ p = parent;
+ if (next != &parent->d_subdirs)
+ break;
+ }
+ }
+- ret = list_entry(next, struct dentry, d_u.d_child);
++ ret = list_entry(next, struct dentry, d_child);
+
+ spin_lock_nested(&ret->d_lock, DENTRY_D_LOCK_NESTED);
+ /* Negative dentry - try next */
+@@ -455,7 +455,7 @@ found:
+ spin_lock(&sbi->lookup_lock);
+ spin_lock(&expired->d_parent->d_lock);
+ spin_lock_nested(&expired->d_lock, DENTRY_D_LOCK_NESTED);
+- list_move(&expired->d_parent->d_subdirs, &expired->d_u.d_child);
++ list_move(&expired->d_parent->d_subdirs, &expired->d_child);
+ spin_unlock(&expired->d_lock);
+ spin_unlock(&expired->d_parent->d_lock);
+ spin_unlock(&sbi->lookup_lock);
+diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
+index 790fa63..2e936c6 100644
+--- a/fs/autofs4/root.c
++++ b/fs/autofs4/root.c
+@@ -651,7 +651,7 @@ static void autofs_clear_leaf_automount_flags(struct
dentry *dentry)
+ /* only consider parents below dentrys in the root */
+ if (IS_ROOT(parent->d_parent))
+ return;
+- d_child = &dentry->d_u.d_child;
++ d_child = &dentry->d_child;
+ /* Set parent managed if it's becoming empty */
+ if (d_child->next == &parent->d_subdirs &&
+ d_child->prev == &parent->d_subdirs)
+diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
+index 9895400..7903e62 100644
+--- a/fs/ceph/dir.c
++++ b/fs/ceph/dir.c
+@@ -104,7 +104,7 @@ static unsigned fpos_off(loff_t p)
+ /*
+ * When possible, we try to satisfy a readdir by peeking at the
+ * dcache. We make this work by carefully ordering dentries on
+- * d_u.d_child when we initially get results back from the MDS, and
++ * d_child when we initially get results back from the MDS, and
+ * falling back to a "normal" sync readdir if any dentries in the dir
+ * are dropped.
+ *
+@@ -140,11 +140,11 @@ static int __dcache_readdir(struct file *filp,
+ p = parent->d_subdirs.prev;
+ dout(" initial p %p/%p\n", p->prev, p->next);
+ } else {
+- p = last->d_u.d_child.prev;
++ p = last->d_child.prev;
+ }
+
+ more:
+- dentry = list_entry(p, struct dentry, d_u.d_child);
++ dentry = list_entry(p, struct dentry, d_child);
+ di = ceph_dentry(dentry);
+ while (1) {
+ dout(" p %p/%p %s d_subdirs %p/%p\n", p->prev, p->next,
+@@ -166,7 +166,7 @@ more:
+ !dentry->d_inode ? " null" : "");
+ spin_unlock(&dentry->d_lock);
+ p = p->prev;
+- dentry = list_entry(p, struct dentry, d_u.d_child);
++ dentry = list_entry(p, struct dentry, d_child);
+ di = ceph_dentry(dentry);
+ }
+
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 87fb132..8e889b7 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -868,9 +868,9 @@ static void ceph_set_dentry_offset(struct dentry *dn)
+
+ spin_lock(&dir->d_lock);
+ spin_lock_nested(&dn->d_lock, DENTRY_D_LOCK_NESTED);
+- list_move(&dn->d_u.d_child, &dir->d_subdirs);
++ list_move(&dn->d_child, &dir->d_subdirs);
+ dout("set_dentry_offset %p %lld (%p %p)\n", dn, di->offset,
+- dn->d_u.d_child.prev, dn->d_u.d_child.next);
++ dn->d_child.prev, dn->d_child.next);
+ spin_unlock(&dn->d_lock);
+ spin_unlock(&dir->d_lock);
+ }
+@@ -1256,7 +1256,7 @@ retry_lookup:
+ /* reorder parent's d_subdirs */
+ spin_lock(&parent->d_lock);
+ spin_lock_nested(&dn->d_lock, DENTRY_D_LOCK_NESTED);
+- list_move(&dn->d_u.d_child, &parent->d_subdirs);
++ list_move(&dn->d_child, &parent->d_subdirs);
+ spin_unlock(&dn->d_lock);
+ spin_unlock(&parent->d_lock);
+ }
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index c0c51e1..710dd05 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -823,7 +823,7 @@ inode_has_hashed_dentries(struct inode *inode)
+ struct dentry *dentry;
+
+ spin_lock(&inode->i_lock);
+- list_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++ list_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ if (!d_unhashed(dentry) || IS_ROOT(dentry)) {
+ spin_unlock(&inode->i_lock);
+ return true;
+diff --git a/fs/coda/cache.c b/fs/coda/cache.c
+index 6901578..4b2e5cb 100644
+--- a/fs/coda/cache.c
++++ b/fs/coda/cache.c
+@@ -95,7 +95,7 @@ static void coda_flag_children(struct dentry *parent, int
flag)
+ spin_lock(&parent->d_lock);
+ list_for_each(child, &parent->d_subdirs)
+ {
+- de = list_entry(child, struct dentry, d_u.d_child);
++ de = list_entry(child, struct dentry, d_child);
+ /* don't know what to do with negative dentries */
+ if ( ! de->d_inode )
+ continue;
+diff --git a/fs/dcache.c b/fs/dcache.c
+index d322929..3f65742 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -42,7 +42,7 @@
+ /*
+ * Usage:
+ * dcache->d_inode->i_lock protects:
+- * - i_dentry, d_alias, d_inode of aliases
++ * - i_dentry, d_u.d_alias, d_inode of aliases
+ * dcache_hash_bucket lock protects:
+ * - the dcache hash table
+ * s_anon bl list spinlock protects:
+@@ -57,7 +57,7 @@
+ * - d_unhashed()
+ * - d_parent and d_subdirs
+ * - childrens' d_child and d_parent
+- * - d_alias, d_inode
++ * - d_u.d_alias, d_inode
+ *
+ * Ordering:
+ * dentry->d_inode->i_lock
+@@ -140,7 +140,6 @@ static void __d_free(struct rcu_head *head)
+ {
+ struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu);
+
+- WARN_ON(!list_empty(&dentry->d_alias));
+ if (dname_external(dentry))
+ kfree(dentry->d_name.name);
+ kmem_cache_free(dentry_cache, dentry);
+@@ -151,6 +150,7 @@ static void __d_free(struct rcu_head *head)
+ */
+ static void d_free(struct dentry *dentry)
+ {
++ WARN_ON(!list_empty(&dentry->d_u.d_alias));
+ BUG_ON(dentry->d_count);
+ this_cpu_dec(nr_dentry);
+ if (dentry->d_op && dentry->d_op->d_release)
+@@ -189,7 +189,7 @@ static void dentry_iput(struct dentry * dentry)
+ struct inode *inode = dentry->d_inode;
+ if (inode) {
+ dentry->d_inode = NULL;
+- list_del_init(&dentry->d_alias);
++ list_del_init(&dentry->d_u.d_alias);
+ spin_unlock(&dentry->d_lock);
+ spin_unlock(&inode->i_lock);
+ if (!inode->i_nlink)
+@@ -213,7 +213,7 @@ static void dentry_unlink_inode(struct dentry * dentry)
+ {
+ struct inode *inode = dentry->d_inode;
+ dentry->d_inode = NULL;
+- list_del_init(&dentry->d_alias);
++ list_del_init(&dentry->d_u.d_alias);
+ dentry_rcuwalk_barrier(dentry);
+ spin_unlock(&dentry->d_lock);
+ spin_unlock(&inode->i_lock);
+@@ -306,9 +306,9 @@ static struct dentry *d_kill(struct dentry *dentry, struct
dentry *parent)
+ __releases(parent->d_lock)
+ __releases(dentry->d_inode->i_lock)
+ {
+- list_del(&dentry->d_u.d_child);
++ __list_del_entry(&dentry->d_child);
+ /*
+- * Inform try_to_ascend() that we are no longer attached to the
++ * Inform ascending readers that we are no longer attached to the
+ * dentry tree
+ */
+ dentry->d_flags |= DCACHE_DENTRY_KILLED;
+@@ -624,7 +624,7 @@ static struct dentry *__d_find_alias(struct inode *inode,
int want_discon)
+
+ again:
+ discon_alias = NULL;
+- list_for_each_entry(alias, &inode->i_dentry, d_alias) {
++ list_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
+ spin_lock(&alias->d_lock);
+ if (S_ISDIR(inode->i_mode) || !d_unhashed(alias)) {
+ if (IS_ROOT(alias) &&
+@@ -677,7 +677,7 @@ void d_prune_aliases(struct inode *inode)
+ struct dentry *dentry;
+ restart:
+ spin_lock(&inode->i_lock);
+- list_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++ list_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ spin_lock(&dentry->d_lock);
+ if (!dentry->d_count) {
+ __dget_dlock(dentry);
+@@ -857,7 +857,7 @@ static void shrink_dcache_for_umount_subtree(struct dentry
*dentry)
+ /* descend to the first leaf in the current subtree */
+ while (!list_empty(&dentry->d_subdirs))
+ dentry = list_entry(dentry->d_subdirs.next,
+- struct dentry, d_u.d_child);
++ struct dentry, d_child);
+
+ /* consume the dentries from this leaf up through its parents
+ * until we find one with children or run out altogether */
+@@ -889,17 +889,17 @@ static void shrink_dcache_for_umount_subtree(struct
dentry *dentry)
+
+ if (IS_ROOT(dentry)) {
+ parent = NULL;
+- list_del(&dentry->d_u.d_child);
++ list_del(&dentry->d_child);
+ } else {
+ parent = dentry->d_parent;
+ parent->d_count--;
+- list_del(&dentry->d_u.d_child);
++ list_del(&dentry->d_child);
+ }
+
+ inode = dentry->d_inode;
+ if (inode) {
+ dentry->d_inode = NULL;
+- list_del_init(&dentry->d_alias);
++ list_del_init(&dentry->d_u.d_alias);
+ if (dentry->d_op && dentry->d_op->d_iput)
+ dentry->d_op->d_iput(dentry, inode);
+ else
+@@ -917,7 +917,7 @@ static void shrink_dcache_for_umount_subtree(struct dentry
*dentry)
+ } while (list_empty(&dentry->d_subdirs));
+
+ dentry = list_entry(dentry->d_subdirs.next,
+- struct dentry, d_u.d_child);
++ struct dentry, d_child);
+ }
+ }
+
+@@ -949,34 +949,6 @@ void shrink_dcache_for_umount(struct super_block *sb)
+ }
+ }
+
+-/*
+- * This tries to ascend one level of parenthood, but
+- * we can race with renaming, so we need to re-check
+- * the parenthood after dropping the lock and check
+- * that the sequence number still matches.
+- */
+-static struct dentry *try_to_ascend(struct dentry *old, int locked, unsigned
seq)
+-{
+- struct dentry *new = old->d_parent;
+-
+- rcu_read_lock();
+- spin_unlock(&old->d_lock);
+- spin_lock(&new->d_lock);
+-
+- /*
+- * might go back up the wrong parent if we have had a rename
+- * or deletion
+- */
+- if (new != old->d_parent ||
+- (old->d_flags & DCACHE_DENTRY_KILLED) ||
+- (!locked && read_seqretry(&rename_lock, seq))) {
+- spin_unlock(&new->d_lock);
+- new = NULL;
+- }
+- rcu_read_unlock();
+- return new;
+-}
+-
+
+ /*
+ * Search for at least 1 mount point in the dentry's subdirs.
+@@ -1010,7 +982,7 @@ repeat:
+ resume:
+ while (next != &this_parent->d_subdirs) {
+ struct list_head *tmp = next;
+- struct dentry *dentry = list_entry(tmp, struct dentry,
d_u.d_child);
++ struct dentry *dentry = list_entry(tmp, struct dentry, d_child);
+ next = tmp->next;
+
+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+@@ -1032,17 +1004,32 @@ resume:
+ /*
+ * All done at this level ... ascend and resume the search.
+ */
++ rcu_read_lock();
++ascend:
+ if (this_parent != parent) {
+ struct dentry *child = this_parent;
+- this_parent = try_to_ascend(this_parent, locked, seq);
+- if (!this_parent)
++ this_parent = child->d_parent;
++
++ spin_unlock(&child->d_lock);
++ spin_lock(&this_parent->d_lock);
++
++ /* might go back up the wrong parent if we have had a rename */
++ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- next = child->d_u.d_child.next;
++ next = child->d_child.next;
++ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ if (next == &this_parent->d_subdirs)
++ goto ascend;
++ child = list_entry(next, struct dentry, d_child);
++ next = next->next;
++ }
++ rcu_read_unlock();
+ goto resume;
+ }
+- spin_unlock(&this_parent->d_lock);
+ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
++ spin_unlock(&this_parent->d_lock);
++ rcu_read_unlock();
+ if (locked)
+ write_sequnlock(&rename_lock);
+ return 0; /* No mount points found in tree */
+@@ -1054,6 +1041,8 @@ positive:
+ return 1;
+
+ rename_retry:
++ spin_unlock(&this_parent->d_lock);
++ rcu_read_unlock();
+ if (locked)
+ goto again;
+ locked = 1;
+@@ -1093,7 +1082,7 @@ repeat:
+ resume:
+ while (next != &this_parent->d_subdirs) {
+ struct list_head *tmp = next;
+- struct dentry *dentry = list_entry(tmp, struct dentry,
d_u.d_child);
++ struct dentry *dentry = list_entry(tmp, struct dentry, d_child);
+ next = tmp->next;
+
+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+@@ -1139,23 +1128,40 @@ resume:
+ /*
+ * All done at this level ... ascend and resume the search.
+ */
++ rcu_read_lock();
++ascend:
+ if (this_parent != parent) {
+ struct dentry *child = this_parent;
+- this_parent = try_to_ascend(this_parent, locked, seq);
+- if (!this_parent)
++ this_parent = child->d_parent;
++
++ spin_unlock(&child->d_lock);
++ spin_lock(&this_parent->d_lock);
++
++ /* might go back up the wrong parent if we have had a rename */
++ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- next = child->d_u.d_child.next;
++ next = child->d_child.next;
++ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ if (next == &this_parent->d_subdirs)
++ goto ascend;
++ child = list_entry(next, struct dentry, d_child);
++ next = next->next;
++ }
++ rcu_read_unlock();
+ goto resume;
+ }
+ out:
+- spin_unlock(&this_parent->d_lock);
+ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
++ spin_unlock(&this_parent->d_lock);
++ rcu_read_unlock();
+ if (locked)
+ write_sequnlock(&rename_lock);
+ return found;
+
+ rename_retry:
++ spin_unlock(&this_parent->d_lock);
++ rcu_read_unlock();
+ if (found)
+ return found;
+ if (locked)
+@@ -1230,8 +1236,8 @@ struct dentry *__d_alloc(struct super_block *sb, const
struct qstr *name)
+ INIT_HLIST_BL_NODE(&dentry->d_hash);
+ INIT_LIST_HEAD(&dentry->d_lru);
+ INIT_LIST_HEAD(&dentry->d_subdirs);
+- INIT_LIST_HEAD(&dentry->d_alias);
+- INIT_LIST_HEAD(&dentry->d_u.d_child);
++ INIT_LIST_HEAD(&dentry->d_u.d_alias);
++ INIT_LIST_HEAD(&dentry->d_child);
+ d_set_d_op(dentry, dentry->d_sb->s_d_op);
+
+ this_cpu_inc(nr_dentry);
+@@ -1261,7 +1267,7 @@ struct dentry *d_alloc(struct dentry * parent, const
struct qstr *name)
+ */
+ __dget_dlock(parent);
+ dentry->d_parent = parent;
+- list_add(&dentry->d_u.d_child, &parent->d_subdirs);
++ list_add(&dentry->d_child, &parent->d_subdirs);
+ spin_unlock(&parent->d_lock);
+
+ return dentry;
+@@ -1318,7 +1324,7 @@ static void __d_instantiate(struct dentry *dentry,
struct inode *inode)
+ if (inode) {
+ if (unlikely(IS_AUTOMOUNT(inode)))
+ dentry->d_flags |= DCACHE_NEED_AUTOMOUNT;
+- list_add(&dentry->d_alias, &inode->i_dentry);
++ list_add(&dentry->d_u.d_alias, &inode->i_dentry);
+ }
+ dentry->d_inode = inode;
+ dentry_rcuwalk_barrier(dentry);
+@@ -1343,7 +1349,7 @@ static void __d_instantiate(struct dentry *dentry,
struct inode *inode)
+
+ void d_instantiate(struct dentry *entry, struct inode * inode)
+ {
+- BUG_ON(!list_empty(&entry->d_alias));
++ BUG_ON(!list_empty(&entry->d_u.d_alias));
+ if (inode)
+ spin_lock(&inode->i_lock);
+ __d_instantiate(entry, inode);
+@@ -1382,7 +1388,7 @@ static struct dentry *__d_instantiate_unique(struct
dentry *entry,
+ return NULL;
+ }
+
+- list_for_each_entry(alias, &inode->i_dentry, d_alias) {
++ list_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
+ struct qstr *qstr = &alias->d_name;
+
+ /*
+@@ -1408,7 +1414,7 @@ struct dentry *d_instantiate_unique(struct dentry
*entry, struct inode *inode)
+ {
+ struct dentry *result;
+
+- BUG_ON(!list_empty(&entry->d_alias));
++ BUG_ON(!list_empty(&entry->d_u.d_alias));
+
+ if (inode)
+ spin_lock(&inode->i_lock);
+@@ -1458,7 +1464,7 @@ static struct dentry * __d_find_any_alias(struct inode
*inode)
+
+ if (list_empty(&inode->i_dentry))
+ return NULL;
+- alias = list_first_entry(&inode->i_dentry, struct dentry, d_alias);
++ alias = list_first_entry(&inode->i_dentry, struct dentry, d_u.d_alias);
+ __dget(alias);
+ return alias;
+ }
+@@ -1525,7 +1531,7 @@ struct dentry *d_obtain_alias(struct inode *inode)
+ spin_lock(&tmp->d_lock);
+ tmp->d_inode = inode;
+ tmp->d_flags |= DCACHE_DISCONNECTED;
+- list_add(&tmp->d_alias, &inode->i_dentry);
++ list_add(&tmp->d_u.d_alias, &inode->i_dentry);
+ hlist_bl_lock(&tmp->d_sb->s_anon);
+ hlist_bl_add_head(&tmp->d_hash, &tmp->d_sb->s_anon);
+ hlist_bl_unlock(&tmp->d_sb->s_anon);
+@@ -1931,7 +1937,7 @@ int d_validate(struct dentry *dentry, struct dentry
*dparent)
+ struct dentry *child;
+
+ spin_lock(&dparent->d_lock);
+- list_for_each_entry(child, &dparent->d_subdirs, d_u.d_child) {
++ list_for_each_entry(child, &dparent->d_subdirs, d_child) {
+ if (dentry == child) {
+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+ __dget_dlock(dentry);
+@@ -2178,8 +2184,8 @@ static void __d_move(struct dentry * dentry, struct
dentry * target)
+ /* Unhash the target: dput() will then get rid of it */
+ __d_drop(target);
+
+- list_del(&dentry->d_u.d_child);
+- list_del(&target->d_u.d_child);
++ list_del(&dentry->d_child);
++ list_del(&target->d_child);
+
+ /* Switch the names.. */
+ switch_names(dentry, target);
+@@ -2189,15 +2195,15 @@ static void __d_move(struct dentry * dentry, struct
dentry * target)
+ if (IS_ROOT(dentry)) {
+ dentry->d_parent = target->d_parent;
+ target->d_parent = target;
+- INIT_LIST_HEAD(&target->d_u.d_child);
++ INIT_LIST_HEAD(&target->d_child);
+ } else {
+ swap(dentry->d_parent, target->d_parent);
+
+ /* And add them back to the (new) parent lists */
+- list_add(&target->d_u.d_child, &target->d_parent->d_subdirs);
++ list_add(&target->d_child, &target->d_parent->d_subdirs);
+ }
+
+- list_add(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs);
++ list_add(&dentry->d_child, &dentry->d_parent->d_subdirs);
+
+ write_seqcount_end(&target->d_seq);
+ write_seqcount_end(&dentry->d_seq);
+@@ -2304,18 +2310,18 @@ static void __d_materialise_dentry(struct dentry
*dentry, struct dentry *anon)
+ swap(dentry->d_name.hash, anon->d_name.hash);
+
+ dentry->d_parent = (aparent == anon) ? dentry : aparent;
+- list_del(&dentry->d_u.d_child);
++ list_del(&dentry->d_child);
+ if (!IS_ROOT(dentry))
+- list_add(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs);
++ list_add(&dentry->d_child, &dentry->d_parent->d_subdirs);
+ else
+- INIT_LIST_HEAD(&dentry->d_u.d_child);
++ INIT_LIST_HEAD(&dentry->d_child);
+
+ anon->d_parent = (dparent == dentry) ? anon : dparent;
+- list_del(&anon->d_u.d_child);
++ list_del(&anon->d_child);
+ if (!IS_ROOT(anon))
+- list_add(&anon->d_u.d_child, &anon->d_parent->d_subdirs);
++ list_add(&anon->d_child, &anon->d_parent->d_subdirs);
+ else
+- INIT_LIST_HEAD(&anon->d_u.d_child);
++ INIT_LIST_HEAD(&anon->d_child);
+
+ write_seqcount_end(&dentry->d_seq);
+ write_seqcount_end(&anon->d_seq);
+@@ -2893,7 +2899,7 @@ repeat:
+ resume:
+ while (next != &this_parent->d_subdirs) {
+ struct list_head *tmp = next;
+- struct dentry *dentry = list_entry(tmp, struct dentry,
d_u.d_child);
++ struct dentry *dentry = list_entry(tmp, struct dentry, d_child);
+ next = tmp->next;
+
+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+@@ -2914,26 +2920,43 @@ resume:
+ }
+ spin_unlock(&dentry->d_lock);
+ }
++ rcu_read_lock();
++ascend:
+ if (this_parent != root) {
+ struct dentry *child = this_parent;
+ if (!(this_parent->d_flags & DCACHE_GENOCIDE)) {
+ this_parent->d_flags |= DCACHE_GENOCIDE;
+ this_parent->d_count--;
+ }
+- this_parent = try_to_ascend(this_parent, locked, seq);
+- if (!this_parent)
++ this_parent = child->d_parent;
++
++ spin_unlock(&child->d_lock);
++ spin_lock(&this_parent->d_lock);
++
++ /* might go back up the wrong parent if we have had a rename */
++ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- next = child->d_u.d_child.next;
++ next = child->d_child.next;
++ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ if (next == &this_parent->d_subdirs)
++ goto ascend;
++ child = list_entry(next, struct dentry, d_child);
++ next = next->next;
++ }
++ rcu_read_unlock();
+ goto resume;
+ }
+- spin_unlock(&this_parent->d_lock);
+ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
++ spin_unlock(&this_parent->d_lock);
++ rcu_read_unlock();
+ if (locked)
+ write_sequnlock(&rename_lock);
+ return;
+
+ rename_retry:
++ spin_unlock(&this_parent->d_lock);
++ rcu_read_unlock();
+ if (locked)
+ goto again;
+ locked = 1;
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index 01951c6b..6ac0893 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -399,7 +399,7 @@ void debugfs_remove_recursive(struct dentry *dentry)
+ * use the d_u.d_child as the rcu head and corrupt this list.
+ */
+ spin_lock(&parent->d_lock);
+- list_for_each_entry(child, &parent->d_subdirs, d_u.d_child) {
++ list_for_each_entry(child, &parent->d_subdirs, d_child) {
+ if (!debugfs_positive(child))
+ continue;
+
+diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
+index b05acb7..3bbf5e7 100644
+--- a/fs/exportfs/expfs.c
++++ b/fs/exportfs/expfs.c
+@@ -50,7 +50,7 @@ find_acceptable_alias(struct dentry *result,
+
+ inode = result->d_inode;
+ spin_lock(&inode->i_lock);
+- list_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++ list_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ dget(dentry);
+ spin_unlock(&inode->i_lock);
+ if (toput)
+diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
+index a8d03a4..019c29c 100644
+--- a/fs/ext4/fsync.c
++++ b/fs/ext4/fsync.c
+@@ -139,7 +139,7 @@ static int ext4_sync_parent(struct inode *inode)
+ spin_lock(&inode->i_lock);
+ if (!list_empty(&inode->i_dentry)) {
+ dentry = list_first_entry(&inode->i_dentry,
+- struct dentry, d_alias);
++ struct dentry, d_u.d_alias);
+ dget(dentry);
+ }
+ spin_unlock(&inode->i_lock);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index cd39fa7..c9f2e3d 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1986,7 +1986,7 @@ int ext4_orphan_add(handle_t *handle, struct inode
*inode)
+ struct ext4_iloc iloc;
+ int err = 0, rc;
+
+- if (!ext4_handle_valid(handle) || is_bad_inode(inode))
++ if (!EXT4_SB(sb)->s_journal || is_bad_inode(inode))
+ return 0;
+
+ mutex_lock(&EXT4_SB(sb)->s_orphan_lock);
+@@ -2060,8 +2060,7 @@ int ext4_orphan_del(handle_t *handle, struct inode
*inode)
+ struct ext4_iloc iloc;
+ int err = 0;
+
+- /* ext4_handle_valid() assumes a valid handle_t pointer */
+- if (handle && !ext4_handle_valid(handle) &&
++ if (!EXT4_SB(inode->i_sb)->s_journal &&
+ !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS))
+ return 0;
+
+@@ -2081,7 +2080,7 @@ int ext4_orphan_del(handle_t *handle, struct inode
*inode)
+ * transaction handle with which to update the orphan list on
+ * disk, but we still need to remove the inode from the linked
+ * list in memory. */
+- if (sbi->s_journal && !handle)
++ if (!handle)
+ goto out;
+
+ err = ext4_reserve_inode_write(handle, inode, &iloc);
+diff --git a/fs/libfs.c b/fs/libfs.c
+index f6d411e..ce85edf 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -104,18 +104,18 @@ loff_t dcache_dir_lseek(struct file *file, loff_t
offset, int origin)
+
+ spin_lock(&dentry->d_lock);
+ /* d_lock not required for cursor */
+- list_del(&cursor->d_u.d_child);
++ list_del(&cursor->d_child);
+ p = dentry->d_subdirs.next;
+ while (n && p != &dentry->d_subdirs) {
+ struct dentry *next;
+- next = list_entry(p, struct dentry,
d_u.d_child);
++ next = list_entry(p, struct dentry, d_child);
+ spin_lock_nested(&next->d_lock,
DENTRY_D_LOCK_NESTED);
+ if (simple_positive(next))
+ n--;
+ spin_unlock(&next->d_lock);
+ p = p->next;
+ }
+- list_add_tail(&cursor->d_u.d_child, p);
++ list_add_tail(&cursor->d_child, p);
+ spin_unlock(&dentry->d_lock);
+ }
+ }
+@@ -139,7 +139,7 @@ int dcache_readdir(struct file * filp, void * dirent,
filldir_t filldir)
+ {
+ struct dentry *dentry = filp->f_path.dentry;
+ struct dentry *cursor = filp->private_data;
+- struct list_head *p, *q = &cursor->d_u.d_child;
++ struct list_head *p, *q = &cursor->d_child;
+ ino_t ino;
+ int i = filp->f_pos;
+
+@@ -165,7 +165,7 @@ int dcache_readdir(struct file * filp, void * dirent,
filldir_t filldir)
+
+ for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
+ struct dentry *next;
+- next = list_entry(p, struct dentry,
d_u.d_child);
++ next = list_entry(p, struct dentry, d_child);
+ spin_lock_nested(&next->d_lock,
DENTRY_D_LOCK_NESTED);
+ if (!simple_positive(next)) {
+ spin_unlock(&next->d_lock);
+@@ -282,7 +282,7 @@ int simple_empty(struct dentry *dentry)
+ int ret = 0;
+
+ spin_lock(&dentry->d_lock);
+- list_for_each_entry(child, &dentry->d_subdirs, d_u.d_child) {
++ list_for_each_entry(child, &dentry->d_subdirs, d_child) {
+ spin_lock_nested(&child->d_lock, DENTRY_D_LOCK_NESTED);
+ if (simple_positive(child)) {
+ spin_unlock(&child->d_lock);
+diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c
+index 844bd64..efa38a9 100644
+--- a/fs/ncpfs/dir.c
++++ b/fs/ncpfs/dir.c
+@@ -391,7 +391,7 @@ ncp_dget_fpos(struct dentry *dentry, struct dentry
*parent, unsigned long fpos)
+ spin_lock(&parent->d_lock);
+ next = parent->d_subdirs.next;
+ while (next != &parent->d_subdirs) {
+- dent = list_entry(next, struct dentry, d_u.d_child);
++ dent = list_entry(next, struct dentry, d_child);
+ if ((unsigned long)dent->d_fsdata == fpos) {
+ if (dent->d_inode)
+ dget(dent);
+diff --git a/fs/ncpfs/ncplib_kernel.h b/fs/ncpfs/ncplib_kernel.h
+index 09881e6..64a817a 100644
+--- a/fs/ncpfs/ncplib_kernel.h
++++ b/fs/ncpfs/ncplib_kernel.h
+@@ -194,7 +194,7 @@ ncp_renew_dentries(struct dentry *parent)
+ spin_lock(&parent->d_lock);
+ next = parent->d_subdirs.next;
+ while (next != &parent->d_subdirs) {
+- dentry = list_entry(next, struct dentry, d_u.d_child);
++ dentry = list_entry(next, struct dentry, d_child);
+
+ if (dentry->d_fsdata == NULL)
+ ncp_age_dentry(server, dentry);
+@@ -216,7 +216,7 @@ ncp_invalidate_dircache_entries(struct dentry *parent)
+ spin_lock(&parent->d_lock);
+ next = parent->d_subdirs.next;
+ while (next != &parent->d_subdirs) {
+- dentry = list_entry(next, struct dentry, d_u.d_child);
++ dentry = list_entry(next, struct dentry, d_child);
+ dentry->d_fsdata = NULL;
+ ncp_age_dentry(server, dentry);
+ next = next->next;
+diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c
+index dcb6154..d7abf9e 100644
+--- a/fs/nfs/getroot.c
++++ b/fs/nfs/getroot.c
+@@ -65,7 +65,7 @@ static int nfs_superblock_set_dummy_root(struct super_block
*sb, struct inode *i
+ */
+ spin_lock(&sb->s_root->d_inode->i_lock);
+ spin_lock(&sb->s_root->d_lock);
+- list_del_init(&sb->s_root->d_alias);
++ list_del_init(&sb->s_root->d_u.d_alias);
+ spin_unlock(&sb->s_root->d_lock);
+ spin_unlock(&sb->s_root->d_inode->i_lock);
+ }
+diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
+index 79b47cb..f8ea28f 100644
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -62,14 +62,14 @@ void __fsnotify_update_child_dentry_flags(struct inode
*inode)
+ spin_lock(&inode->i_lock);
+ /* run all of the dentries associated with this inode. Since this is a
+ * directory, there damn well better only be one item on this list */
+- list_for_each_entry(alias, &inode->i_dentry, d_alias) {
++ list_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
+ struct dentry *child;
+
+ /* run all of the children of the original inode and fix their
+ * d_flags to indicate parental interest (their parent is the
+ * original inode) */
+ spin_lock(&alias->d_lock);
+- list_for_each_entry(child, &alias->d_subdirs, d_u.d_child) {
++ list_for_each_entry(child, &alias->d_subdirs, d_child) {
+ if (!child->d_inode)
+ continue;
+
+diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
+index e5ba348..26977cc 100644
+--- a/fs/ocfs2/dcache.c
++++ b/fs/ocfs2/dcache.c
+@@ -175,7 +175,7 @@ struct dentry *ocfs2_find_local_alias(struct inode *inode,
+
+ spin_lock(&inode->i_lock);
+ list_for_each(p, &inode->i_dentry) {
+- dentry = list_entry(p, struct dentry, d_alias);
++ dentry = list_entry(p, struct dentry, d_u.d_alias);
+
+ spin_lock(&dentry->d_lock);
+ if (ocfs2_match_dentry(dentry, parent_blkno, skip_unhashed)) {
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index af37ce3..a0f6ded 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -1176,13 +1176,22 @@ update_time:
+ return 0;
+ }
+
++/*
++ * Maximum length of linked list formed by ICB hierarchy. The chosen number is
++ * arbitrary - just that we hopefully don't limit any real use of rewritten
++ * inode on write-once media but avoid looping for too long on corrupted
media.
++ */
++#define UDF_MAX_ICB_NESTING 1024
++
+ static void __udf_read_inode(struct inode *inode)
+ {
+ struct buffer_head *bh = NULL;
+ struct fileEntry *fe;
+ uint16_t ident;
+ struct udf_inode_info *iinfo = UDF_I(inode);
++ unsigned int indirections = 0;
+
++reread:
+ /*
+ * Set defaults, but the inode is still incomplete!
+ * Note: get_new_inode() sets the following on a new inode:
+@@ -1219,28 +1228,26 @@ static void __udf_read_inode(struct inode *inode)
+ ibh = udf_read_ptagged(inode->i_sb, &iinfo->i_location, 1,
+ &ident);
+ if (ident == TAG_IDENT_IE && ibh) {
+- struct buffer_head *nbh = NULL;
+ struct kernel_lb_addr loc;
+ struct indirectEntry *ie;
+
+ ie = (struct indirectEntry *)ibh->b_data;
+ loc = lelb_to_cpu(ie->indirectICB.extLocation);
+
+- if (ie->indirectICB.extLength &&
+- (nbh = udf_read_ptagged(inode->i_sb, &loc, 0,
+- &ident))) {
+- if (ident == TAG_IDENT_FE ||
+- ident == TAG_IDENT_EFE) {
+- memcpy(&iinfo->i_location,
+- &loc,
+- sizeof(struct kernel_lb_addr));
+- brelse(bh);
+- brelse(ibh);
+- brelse(nbh);
+- __udf_read_inode(inode);
++ if (ie->indirectICB.extLength) {
++ brelse(bh);
++ brelse(ibh);
++ memcpy(&iinfo->i_location, &loc,
++ sizeof(struct kernel_lb_addr));
++ if (++indirections > UDF_MAX_ICB_NESTING) {
++ udf_err(inode->i_sb,
++ "too many ICBs in ICB hierarchy"
++ " (max %d supported)\n",
++ UDF_MAX_ICB_NESTING);
++ make_bad_inode(inode);
+ return;
+ }
+- brelse(nbh);
++ goto reread;
+ }
+ }
+ brelse(ibh);
+diff --git a/include/linux/dcache.h b/include/linux/dcache.h
+index 1dfe974..99374de 100644
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -133,15 +133,15 @@ struct dentry {
+ void *d_fsdata; /* fs-specific data */
+
+ struct list_head d_lru; /* LRU list */
++ struct list_head d_child; /* child of parent list */
++ struct list_head d_subdirs; /* our children */
+ /*
+- * d_child and d_rcu can share memory
++ * d_alias and d_rcu can share memory
+ */
+ union {
+- struct list_head d_child; /* child of parent list */
++ struct list_head d_alias; /* inode alias list */
+ struct rcu_head d_rcu;
+ } d_u;
+- struct list_head d_subdirs; /* our children */
+- struct list_head d_alias; /* inode alias list */
+ };
+
+ /*
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index 00a2eb6..ab2e6d7 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -481,6 +481,7 @@ static inline int ipv6_addr_diff(const struct in6_addr
*a1, const struct in6_add
+ }
+
+ extern void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
++void ipv6_proxy_select_ident(struct sk_buff *skb);
+
+ /*
+ * Prototypes exported by ipv6
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 238255b..e90235f 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1214,11 +1214,13 @@ extern int tcp_v4_md5_do_del(struct sock *sk, __be32
addr);
+ #define tcp_twsk_md5_key(twsk) NULL
+ #endif
+
+-extern struct tcp_md5sig_pool __percpu *tcp_alloc_md5sig_pool(struct sock *);
+-extern void tcp_free_md5sig_pool(void);
++extern bool tcp_alloc_md5sig_pool(void);
+
+ extern struct tcp_md5sig_pool *tcp_get_md5sig_pool(void);
+-extern void tcp_put_md5sig_pool(void);
++static inline void tcp_put_md5sig_pool(void)
++{
++ local_bh_enable();
++}
+
+ extern int tcp_md5_hash_header(struct tcp_md5sig_pool *, const struct tcphdr
*);
+ extern int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *, const struct
sk_buff *,
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index ffcf896..eafb6dd 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -881,7 +881,7 @@ static void cgroup_clear_directory(struct dentry *dentry)
+ spin_lock(&dentry->d_lock);
+ node = dentry->d_subdirs.next;
+ while (node != &dentry->d_subdirs) {
+- struct dentry *d = list_entry(node, struct dentry, d_u.d_child);
++ struct dentry *d = list_entry(node, struct dentry, d_child);
+
+ spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED);
+ list_del_init(node);
+@@ -915,7 +915,7 @@ static void cgroup_d_remove_dir(struct dentry *dentry)
+ parent = dentry->d_parent;
+ spin_lock(&parent->d_lock);
+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+- list_del_init(&dentry->d_u.d_child);
++ list_del_init(&dentry->d_child);
+ spin_unlock(&dentry->d_lock);
+ spin_unlock(&parent->d_lock);
+ remove_dir(dentry);
+diff --git a/mm/memory.c b/mm/memory.c
+index 5a7f314..628cadc 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -870,20 +870,20 @@ copy_one_pte(struct mm_struct *dst_mm, struct mm_struct
*src_mm,
+ if (!pte_file(pte)) {
+ swp_entry_t entry = pte_to_swp_entry(pte);
+
+- if (swap_duplicate(entry) < 0)
+- return entry.val;
+-
+- /* make sure dst_mm is on swapoff's mmlist. */
+- if (unlikely(list_empty(&dst_mm->mmlist))) {
+- spin_lock(&mmlist_lock);
+- if (list_empty(&dst_mm->mmlist))
+- list_add(&dst_mm->mmlist,
+- &src_mm->mmlist);
+- spin_unlock(&mmlist_lock);
+- }
+- if (likely(!non_swap_entry(entry)))
++ if (likely(!non_swap_entry(entry))) {
++ if (swap_duplicate(entry) < 0)
++ return entry.val;
++
++ /* make sure dst_mm is on swapoff's mmlist. */
++ if (unlikely(list_empty(&dst_mm->mmlist))) {
++ spin_lock(&mmlist_lock);
++ if (list_empty(&dst_mm->mmlist))
++ list_add(&dst_mm->mmlist,
++ &src_mm->mmlist);
++ spin_unlock(&mmlist_lock);
++ }
+ rss[MM_SWAPENTS]++;
+- else if (is_write_migration_entry(entry) &&
++ } else if (is_write_migration_entry(entry) &&
+ is_cow_mapping(vm_flags)) {
+ /*
+ * COW mappings require pages in both parent
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
+index 76da979..1cdb4a9 100644
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -467,7 +467,7 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info
*fi)
+ return 1;
+
+ attrlen = rtnh_attrlen(rtnh);
+- if (attrlen < 0) {
++ if (attrlen > 0) {
+ struct nlattr *nla, *attrs = rtnh_attrs(rtnh);
+
+ nla = nla_find(attrs, attrlen, RTA_GATEWAY);
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 115157b..bf2e54b 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1472,6 +1472,7 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb,
__be32 daddr,
+ struct ipcm_cookie ipc;
+ struct flowi4 fl4;
+ struct rtable *rt = skb_rtable(skb);
++ int err;
+
+ if (ip_options_echo(&replyopts.opt.opt, skb))
+ return;
+@@ -1509,8 +1510,13 @@ void ip_send_reply(struct sock *sk, struct sk_buff
*skb, __be32 daddr,
+ sk->sk_priority = skb->priority;
+ sk->sk_protocol = ip_hdr(skb)->protocol;
+ sk->sk_bound_dev_if = arg->bound_dev_if;
+- ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base, len, 0,
+- &ipc, &rt, MSG_DONTWAIT);
++ err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base,
++ len, 0, &ipc, &rt, MSG_DONTWAIT);
++ if (unlikely(err)) {
++ ip_flush_pending_frames(sk);
++ goto out;
++ }
++
+ if ((skb = skb_peek(&sk->sk_write_queue)) != NULL) {
+ if (arg->csumoffset >= 0)
+ *((__sum16 *)skb_transport_header(skb) +
+@@ -1519,7 +1525,7 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb,
__be32 daddr,
+ skb->ip_summed = CHECKSUM_NONE;
+ ip_push_pending_frames(sk, &fl4);
+ }
+-
++out:
+ bh_unlock_sock(sk);
+
+ ip_rt_put(rt);
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index ec8b4b7e..32c9e83 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2863,104 +2863,42 @@ int tcp_gro_complete(struct sk_buff *skb)
+ EXPORT_SYMBOL(tcp_gro_complete);
+
+ #ifdef CONFIG_TCP_MD5SIG
+-static unsigned long tcp_md5sig_users;
+-static struct tcp_md5sig_pool __percpu *tcp_md5sig_pool;
+-static DEFINE_SPINLOCK(tcp_md5sig_pool_lock);
++static DEFINE_PER_CPU(struct tcp_md5sig_pool, tcp_md5sig_pool);
++static DEFINE_MUTEX(tcp_md5sig_mutex);
++static bool tcp_md5sig_pool_populated = false;
+
+-static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool __percpu *pool)
++static void __tcp_alloc_md5sig_pool(void)
+ {
+ int cpu;
+
+ for_each_possible_cpu(cpu) {
+- struct tcp_md5sig_pool *p = per_cpu_ptr(pool, cpu);
++ if (!per_cpu(tcp_md5sig_pool, cpu).md5_desc.tfm) {
++ struct crypto_hash *hash;
+
+- if (p->md5_desc.tfm)
+- crypto_free_hash(p->md5_desc.tfm);
+- }
+- free_percpu(pool);
+-}
+-
+-void tcp_free_md5sig_pool(void)
+-{
+- struct tcp_md5sig_pool __percpu *pool = NULL;
+-
+- spin_lock_bh(&tcp_md5sig_pool_lock);
+- if (--tcp_md5sig_users == 0) {
+- pool = tcp_md5sig_pool;
+- tcp_md5sig_pool = NULL;
++ hash = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC);
++ if (IS_ERR_OR_NULL(hash))
++ return;
++ per_cpu(tcp_md5sig_pool, cpu).md5_desc.tfm = hash;
++ }
+ }
+- spin_unlock_bh(&tcp_md5sig_pool_lock);
+- if (pool)
+- __tcp_free_md5sig_pool(pool);
++ /* before setting tcp_md5sig_pool_populated, we must commit all writes
++ * to memory. See smp_rmb() in tcp_get_md5sig_pool()
++ */
++ smp_wmb();
++ tcp_md5sig_pool_populated = true;
+ }
+-EXPORT_SYMBOL(tcp_free_md5sig_pool);
+
+-static struct tcp_md5sig_pool __percpu *
+-__tcp_alloc_md5sig_pool(struct sock *sk)
++bool tcp_alloc_md5sig_pool(void)
+ {
+- int cpu;
+- struct tcp_md5sig_pool __percpu *pool;
+-
+- pool = alloc_percpu(struct tcp_md5sig_pool);
+- if (!pool)
+- return NULL;
+-
+- for_each_possible_cpu(cpu) {
+- struct crypto_hash *hash;
++ if (unlikely(!tcp_md5sig_pool_populated)) {
++ mutex_lock(&tcp_md5sig_mutex);
+
+- hash = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC);
+- if (!hash || IS_ERR(hash))
+- goto out_free;
++ if (!tcp_md5sig_pool_populated)
++ __tcp_alloc_md5sig_pool();
+
+- per_cpu_ptr(pool, cpu)->md5_desc.tfm = hash;
++ mutex_unlock(&tcp_md5sig_mutex);
+ }
+- return pool;
+-out_free:
+- __tcp_free_md5sig_pool(pool);
+- return NULL;
+-}
+-
+-struct tcp_md5sig_pool __percpu *tcp_alloc_md5sig_pool(struct sock *sk)
+-{
+- struct tcp_md5sig_pool __percpu *pool;
+- int alloc = 0;
+-
+-retry:
+- spin_lock_bh(&tcp_md5sig_pool_lock);
+- pool = tcp_md5sig_pool;
+- if (tcp_md5sig_users++ == 0) {
+- alloc = 1;
+- spin_unlock_bh(&tcp_md5sig_pool_lock);
+- } else if (!pool) {
+- tcp_md5sig_users--;
+- spin_unlock_bh(&tcp_md5sig_pool_lock);
+- cpu_relax();
+- goto retry;
+- } else
+- spin_unlock_bh(&tcp_md5sig_pool_lock);
+-
+- if (alloc) {
+- /* we cannot hold spinlock here because this may sleep. */
+- struct tcp_md5sig_pool __percpu *p;
+-
+- p = __tcp_alloc_md5sig_pool(sk);
+- spin_lock_bh(&tcp_md5sig_pool_lock);
+- if (!p) {
+- tcp_md5sig_users--;
+- spin_unlock_bh(&tcp_md5sig_pool_lock);
+- return NULL;
+- }
+- pool = tcp_md5sig_pool;
+- if (pool) {
+- /* oops, it has already been assigned. */
+- spin_unlock_bh(&tcp_md5sig_pool_lock);
+- __tcp_free_md5sig_pool(p);
+- } else {
+- tcp_md5sig_pool = pool = p;
+- spin_unlock_bh(&tcp_md5sig_pool_lock);
+- }
+- }
+- return pool;
++ return tcp_md5sig_pool_populated;
+ }
+ EXPORT_SYMBOL(tcp_alloc_md5sig_pool);
+
+@@ -2974,31 +2912,18 @@ EXPORT_SYMBOL(tcp_alloc_md5sig_pool);
+ */
+ struct tcp_md5sig_pool *tcp_get_md5sig_pool(void)
+ {
+- struct tcp_md5sig_pool __percpu *p;
+-
+ local_bh_disable();
+
+- spin_lock(&tcp_md5sig_pool_lock);
+- p = tcp_md5sig_pool;
+- if (p)
+- tcp_md5sig_users++;
+- spin_unlock(&tcp_md5sig_pool_lock);
+-
+- if (p)
+- return this_cpu_ptr(p);
+-
++ if (tcp_md5sig_pool_populated) {
++ /* coupled with smp_wmb() in __tcp_alloc_md5sig_pool() */
++ smp_rmb();
++ return this_cpu_ptr(&tcp_md5sig_pool);
++ }
+ local_bh_enable();
+ return NULL;
+ }
+ EXPORT_SYMBOL(tcp_get_md5sig_pool);
+
+-void tcp_put_md5sig_pool(void)
+-{
+- local_bh_enable();
+- tcp_free_md5sig_pool();
+-}
+-EXPORT_SYMBOL(tcp_put_md5sig_pool);
+-
+ int tcp_md5_hash_header(struct tcp_md5sig_pool *hp,
+ const struct tcphdr *th)
+ {
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 26eb8e2..b4e0eb4 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -938,8 +938,7 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
+ }
+
+ md5sig = tp->md5sig_info;
+- if (md5sig->entries4 == 0 &&
+- tcp_alloc_md5sig_pool(sk) == NULL) {
++ if (md5sig->entries4 == 0 && !tcp_alloc_md5sig_pool()) {
+ kfree(newkey);
+ return -ENOMEM;
+ }
+@@ -949,8 +948,6 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
+ (md5sig->entries4 + 1)), GFP_ATOMIC);
+ if (!keys) {
+ kfree(newkey);
+- if (md5sig->entries4 == 0)
+- tcp_free_md5sig_pool();
+ return -ENOMEM;
+ }
+
+@@ -994,7 +991,6 @@ int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
+ kfree(tp->md5sig_info->keys4);
+ tp->md5sig_info->keys4 = NULL;
+ tp->md5sig_info->alloced4 = 0;
+- tcp_free_md5sig_pool();
+ } else if (tp->md5sig_info->entries4 != i) {
+ /* Need to do some manipulation */
+ memmove(&tp->md5sig_info->keys4[i],
+@@ -1022,7 +1018,6 @@ static void tcp_v4_clear_md5_list(struct sock *sk)
+ for (i = 0; i < tp->md5sig_info->entries4; i++)
+ kfree(tp->md5sig_info->keys4[i].base.key);
+ tp->md5sig_info->entries4 = 0;
+- tcp_free_md5sig_pool();
+ }
+ if (tp->md5sig_info->keys4) {
+ kfree(tp->md5sig_info->keys4);
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index 66363b6..00e1530 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -365,7 +365,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
+ if (key != NULL) {
+ memcpy(&tcptw->tw_md5_key, key->key,
key->keylen);
+ tcptw->tw_md5_keylen = key->keylen;
+- if (tcp_alloc_md5sig_pool(sk) == NULL)
++ if (!tcp_alloc_md5sig_pool())
+ BUG();
+ }
+ } while (0);
+@@ -403,11 +403,6 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
+
+ void tcp_twsk_destructor(struct sock *sk)
+ {
+-#ifdef CONFIG_TCP_MD5SIG
+- struct tcp_timewait_sock *twsk = tcp_twsk(sk);
+- if (twsk->tw_md5_keylen)
+- tcp_free_md5sig_pool();
+-#endif
+ }
+ EXPORT_SYMBOL_GPL(tcp_twsk_destructor);
+
+diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile
+index 686934a..4b20d56 100644
+--- a/net/ipv6/Makefile
++++ b/net/ipv6/Makefile
+@@ -37,6 +37,6 @@ obj-$(CONFIG_NETFILTER) += netfilter/
+ obj-$(CONFIG_IPV6_SIT) += sit.o
+ obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.o
+
+-obj-y += addrconf_core.o exthdrs_core.o
++obj-y += addrconf_core.o exthdrs_core.o output_core.o
+
+ obj-$(subst m,y,$(CONFIG_IPV6)) += inet6_hashtables.o
+diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
+new file mode 100644
+index 0000000..a6126c6
+--- /dev/null
++++ b/net/ipv6/output_core.c
+@@ -0,0 +1,38 @@
++#include <linux/export.h>
++#include <linux/skbuff.h>
++#include <net/ip.h>
++#include <net/ipv6.h>
++
++/* This function exists only for tap drivers that must support broken
++ * clients requesting UFO without specifying an IPv6 fragment ID.
++ *
++ * This is similar to ipv6_select_ident() but we use an independent hash
++ * seed to limit information leakage.
++ */
++void ipv6_proxy_select_ident(struct sk_buff *skb)
++{
++ static u32 ip6_proxy_idents_hashrnd __read_mostly;
++ static bool hashrnd_initialized = false;
++ struct in6_addr buf[2];
++ struct in6_addr *addrs;
++ u32 hash, id;
++
++ addrs = skb_header_pointer(skb,
++ skb_network_offset(skb) +
++ offsetof(struct ipv6hdr, saddr),
++ sizeof(buf), buf);
++ if (!addrs)
++ return;
++
++ if (unlikely(!hashrnd_initialized)) {
++ hashrnd_initialized = true;
++ get_random_bytes(&ip6_proxy_idents_hashrnd,
++ sizeof(ip6_proxy_idents_hashrnd));
++ }
++ hash = __ipv6_addr_jhash(&addrs[1], ip6_proxy_idents_hashrnd);
++ hash = __ipv6_addr_jhash(&addrs[0], hash);
++
++ id = ip_idents_reserve(hash, 1);
++ skb_shinfo(skb)->ip6_frag_id = htonl(id);
++}
++EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident);
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 057a9d2..655cc60 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -592,7 +592,7 @@ static int tcp_v6_md5_do_add(struct sock *sk, const struct
in6_addr *peer,
+ sk_nocaps_add(sk, NETIF_F_GSO_MASK);
+ }
+ if (tp->md5sig_info->entries6 == 0 &&
+- tcp_alloc_md5sig_pool(sk) == NULL) {
++ !tcp_alloc_md5sig_pool()) {
+ kfree(newkey);
+ return -ENOMEM;
+ }
+@@ -602,8 +602,6 @@ static int tcp_v6_md5_do_add(struct sock *sk, const struct
in6_addr *peer,
+
+ if (!keys) {
+ kfree(newkey);
+- if (tp->md5sig_info->entries6 == 0)
+- tcp_free_md5sig_pool();
+ return -ENOMEM;
+ }
+
+@@ -649,7 +647,6 @@ static int tcp_v6_md5_do_del(struct sock *sk, const struct
in6_addr *peer)
+ kfree(tp->md5sig_info->keys6);
+ tp->md5sig_info->keys6 = NULL;
+ tp->md5sig_info->alloced6 = 0;
+- tcp_free_md5sig_pool();
+ } else {
+ /* shrink the database */
+ if (tp->md5sig_info->entries6 != i)
+@@ -673,7 +670,6 @@ static void tcp_v6_clear_md5_list (struct sock *sk)
+ for (i = 0; i < tp->md5sig_info->entries6; i++)
+ kfree(tp->md5sig_info->keys6[i].base.key);
+ tp->md5sig_info->entries6 = 0;
+- tcp_free_md5sig_pool();
+ }
+
+ kfree(tp->md5sig_info->keys6);
+@@ -684,7 +680,6 @@ static void tcp_v6_clear_md5_list (struct sock *sk)
+ for (i = 0; i < tp->md5sig_info->entries4; i++)
+ kfree(tp->md5sig_info->keys4[i].base.key);
+ tp->md5sig_info->entries4 = 0;
+- tcp_free_md5sig_pool();
+ }
+
+ kfree(tp->md5sig_info->keys4);
+diff --git a/net/sctp/auth.c b/net/sctp/auth.c
+index 333926d..53d455c 100644
+--- a/net/sctp/auth.c
++++ b/net/sctp/auth.c
+@@ -866,8 +866,6 @@ int sctp_auth_set_key(struct sctp_endpoint *ep,
+ list_add(&cur_key->key_list, sh_keys);
+
+ cur_key->key = key;
+- sctp_auth_key_hold(key);
+-
+ return 0;
+ nomem:
+ if (!replace)
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index 5bd9aa9..c3b8549 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -384,12 +384,12 @@ int sctp_packet_transmit(struct sctp_packet *packet)
+ sk = chunk->skb->sk;
+
+ /* Allocate the new skb. */
+- nskb = alloc_skb(packet->size + LL_MAX_HEADER, GFP_ATOMIC);
++ nskb = alloc_skb(packet->size + MAX_HEADER, GFP_ATOMIC);
+ if (!nskb)
+ goto nomem;
+
+ /* Make sure the outbound skb has enough header room reserved. */
+- skb_reserve(nskb, packet->overhead + LL_MAX_HEADER);
++ skb_reserve(nskb, packet->overhead + MAX_HEADER);
+
+ /* Set the owning socket so that we know where to get the
+ * destination IP address.
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index d8d4704..c40952c 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -2570,6 +2570,9 @@ do_addr_param:
+ addr_param = param.v + sizeof(sctp_addip_param_t);
+
+ af = sctp_get_af_specific(param_type2af(param.p->type));
++ if (af == NULL)
++ break;
++
+ af->from_addr_param(&addr, addr_param,
+ htons(asoc->peer.port), 0);
+
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index b4f802d..4dd8dcf 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -1197,7 +1197,7 @@ static void sel_remove_entries(struct dentry *de)
+ spin_lock(&de->d_lock);
+ node = de->d_subdirs.next;
+ while (node != &de->d_subdirs) {
+- struct dentry *d = list_entry(node, struct dentry, d_u.d_child);
++ struct dentry *d = list_entry(node, struct dentry, d_child);
+
+ spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED);
+ list_del_init(node);
+@@ -1704,12 +1704,12 @@ static void sel_remove_classes(void)
+
+ list_for_each(class_node, &class_dir->d_subdirs) {
+ struct dentry *class_subdir = list_entry(class_node,
+- struct dentry, d_u.d_child);
++ struct dentry, d_child);
+ struct list_head *class_subdir_node;
+
+ list_for_each(class_subdir_node, &class_subdir->d_subdirs) {
+ struct dentry *d = list_entry(class_subdir_node,
+- struct dentry, d_u.d_child);
++ struct dentry, d_child);
+
+ if (d->d_inode)
+ if (d->d_inode->i_mode & S_IFDIR)
diff --git a/3.2.65/4420_grsecurity-3.0-3.2.65-201412280855.patch
b/3.2.66/4420_grsecurity-3.0-3.2.65-201412280855.patch
similarity index 100%
rename from 3.2.65/4420_grsecurity-3.0-3.2.65-201412280855.patch
rename to 3.2.66/4420_grsecurity-3.0-3.2.65-201412280855.patch
diff --git a/3.2.65/4425_grsec_remove_EI_PAX.patch
b/3.2.66/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 3.2.65/4425_grsec_remove_EI_PAX.patch
rename to 3.2.66/4425_grsec_remove_EI_PAX.patch
diff --git a/3.2.65/4427_force_XATTR_PAX_tmpfs.patch
b/3.2.66/4427_force_XATTR_PAX_tmpfs.patch
similarity index 100%
rename from 3.2.65/4427_force_XATTR_PAX_tmpfs.patch
rename to 3.2.66/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.2.65/4430_grsec-remove-localversion-grsec.patch
b/3.2.66/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 3.2.65/4430_grsec-remove-localversion-grsec.patch
rename to 3.2.66/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.65/4435_grsec-mute-warnings.patch
b/3.2.66/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 3.2.65/4435_grsec-mute-warnings.patch
rename to 3.2.66/4435_grsec-mute-warnings.patch
diff --git a/3.2.65/4440_grsec-remove-protected-paths.patch
b/3.2.66/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 3.2.65/4440_grsec-remove-protected-paths.patch
rename to 3.2.66/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.65/4450_grsec-kconfig-default-gids.patch
b/3.2.66/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 3.2.65/4450_grsec-kconfig-default-gids.patch
rename to 3.2.66/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.65/4465_selinux-avc_audit-log-curr_ip.patch
b/3.2.66/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 3.2.65/4465_selinux-avc_audit-log-curr_ip.patch
rename to 3.2.66/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.65/4470_disable-compat_vdso.patch
b/3.2.66/4470_disable-compat_vdso.patch
similarity index 100%
rename from 3.2.65/4470_disable-compat_vdso.patch
rename to 3.2.66/4470_disable-compat_vdso.patch
diff --git a/3.2.65/4475_emutramp_default_on.patch
b/3.2.66/4475_emutramp_default_on.patch
similarity index 100%
rename from 3.2.65/4475_emutramp_default_on.patch
rename to 3.2.66/4475_emutramp_default_on.patch
