--- /dev/null
+From 3146bc64d12377a74dbda12b96ea32da3774ae07 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Mon, 25 Jul 2016 16:59:52 +0100
+Subject: arm64: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 3146bc64d12377a74dbda12b96ea32da3774ae07 upstream.
+
+AT_VECTOR_SIZE_ARCH should be defined with the maximum number of
+NEW_AUX_ENT entries that ARCH_DLINFO can contain, but it wasn't defined
+for arm64 at all even though ARCH_DLINFO will contain one NEW_AUX_ENT
+for the VDSO address.
+
+This shouldn't be a problem as AT_VECTOR_SIZE_BASE includes space for
+AT_BASE_PLATFORM which arm64 doesn't use, but lets define it now and add
+the comment above ARCH_DLINFO as found in several other architectures to
+remind future modifiers of ARCH_DLINFO to keep AT_VECTOR_SIZE_ARCH up to
+date.
+
+Fixes: f668cd1673aa ("arm64: ELF definitions")
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/include/asm/elf.h | 1 +
+ arch/arm64/include/uapi/asm/auxvec.h | 2 ++
+ 2 files changed, 3 insertions(+)
+
+--- a/arch/arm64/include/asm/elf.h
++++ b/arch/arm64/include/asm/elf.h
+@@ -137,6 +137,7 @@ extern unsigned long randomize_et_dyn(un
+
+ #define SET_PERSONALITY(ex) clear_thread_flag(TIF_32BIT);
+
++/* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */
+ #define ARCH_DLINFO \
+ do { \
+ NEW_AUX_ENT(AT_SYSINFO_EHDR, \
+--- a/arch/arm64/include/uapi/asm/auxvec.h
++++ b/arch/arm64/include/uapi/asm/auxvec.h
+@@ -19,4 +19,6 @@
+ /* vDSO location */
+ #define AT_SYSINFO_EHDR 33
+
++#define AT_VECTOR_SIZE_ARCH 1 /* entries in ARCH_DLINFO */
++
+ #endif
--- /dev/null
+From 3eb53b20d7bd1374598cfb1feaa081fcac0e76cd Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sat, 20 Aug 2016 11:51:38 +0200
+Subject: parisc: Fix order of EREFUSED define in errno.h
+
+From: Helge Deller <deller@gmx.de>
+
+commit 3eb53b20d7bd1374598cfb1feaa081fcac0e76cd upstream.
+
+When building gccgo in userspace, errno.h gets parsed and the go include file
+sysinfo.go is generated.
+
+Since EREFUSED is defined to the same value as ECONNREFUSED, and ECONNREFUSED
+is defined later on in errno.h, this leads to go complaining that EREFUSED
+isn't defined yet.
+
+Fix this trivial problem by moving the define of EREFUSED down after
+ECONNREFUSED in errno.h (and clean up the indenting while touching this line).
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/include/uapi/asm/errno.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/parisc/include/uapi/asm/errno.h
++++ b/arch/parisc/include/uapi/asm/errno.h
+@@ -97,10 +97,10 @@
+ #define ENOTCONN 235 /* Transport endpoint is not connected */
+ #define ESHUTDOWN 236 /* Cannot send after transport endpoint shutdown */
+ #define ETOOMANYREFS 237 /* Too many references: cannot splice */
+-#define EREFUSED ECONNREFUSED /* for HP's NFS apparently */
+ #define ETIMEDOUT 238 /* Connection timed out */
+ #define ECONNREFUSED 239 /* Connection refused */
+-#define EREMOTERELEASE 240 /* Remote peer released connection */
++#define EREFUSED ECONNREFUSED /* for HP's NFS apparently */
++#define EREMOTERELEASE 240 /* Remote peer released connection */
+ #define EHOSTDOWN 241 /* Host is down */
+ #define EHOSTUNREACH 242 /* No route to host */
+
x86-mm-disable-preemption-during-cr3-read-write.patch
+arm64-define-at_vector_size_arch-for-arch_dlinfo.patch
+parisc-fix-order-of-erefused-define-in-errno.h.patch
+virtio-fix-memory-leak-in-virtqueue_add.patch
--- /dev/null
+From 58625edf9e2515ed41dac2a24fa8004030a87b87 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyj.lk@gmail.com>
+Date: Tue, 2 Aug 2016 14:16:31 +0000
+Subject: virtio: fix memory leak in virtqueue_add()
+
+From: Wei Yongjun <weiyj.lk@gmail.com>
+
+commit 58625edf9e2515ed41dac2a24fa8004030a87b87 upstream.
+
+When using the indirect buffers feature, 'desc' is allocated in
+virtqueue_add() but isn't freed before leaving on a ring full error,
+causing a memory leak.
+
+For example, it seems rather clear that this can trigger
+with virtio net if mergeable buffers are not used.
+
+Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/virtio/virtio_ring.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -239,6 +239,8 @@ static inline int virtqueue_add(struct v
+ * host should service the ring ASAP. */
+ if (out_sgs)
+ vq->notify(&vq->vq);
++ if (indirect)
++ kfree(desc);
+ END_USE(vq);
+ return -ENOSPC;
+ }