diff -druNp --no-dereference linux-libre-4.4.81-gnu/arch/arm/kvm/mmu.c linux-libre-4.4.82-gnu/arch/arm/kvm/mmu.c
--- linux-libre-4.4.81-gnu/arch/arm/kvm/mmu.c	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/arch/arm/kvm/mmu.c	2017-08-12 22:29:34.000000000 -0400
@@ -1629,12 +1629,16 @@ static int kvm_test_age_hva_handler(stru
 
 int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end)
 {
+	if (!kvm->arch.pgd)
+		return 0;
 	trace_kvm_age_hva(start, end);
 	return handle_hva_to_gpa(kvm, start, end, kvm_age_hva_handler, NULL);
 }
 
 int kvm_test_age_hva(struct kvm *kvm, unsigned long hva)
 {
+	if (!kvm->arch.pgd)
+		return 0;
 	trace_kvm_test_age_hva(hva);
 	return handle_hva_to_gpa(kvm, hva, hva, kvm_test_age_hva_handler, NULL);
 }
diff -druNp --no-dereference linux-libre-4.4.81-gnu/arch/s390/net/bpf_jit_comp.c linux-libre-4.4.82-gnu/arch/s390/net/bpf_jit_comp.c
--- linux-libre-4.4.81-gnu/arch/s390/net/bpf_jit_comp.c	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/arch/s390/net/bpf_jit_comp.c	2017-08-12 22:29:34.000000000 -0400
@@ -1250,7 +1250,8 @@ static int bpf_jit_prog(struct bpf_jit *
 		insn_count = bpf_jit_insn(jit, fp, i);
 		if (insn_count < 0)
 			return -1;
-		jit->addrs[i + 1] = jit->prg; /* Next instruction address */
+		/* Next instruction address */
+		jit->addrs[i + insn_count] = jit->prg;
 	}
 	bpf_jit_epilogue(jit);
 
diff -druNp --no-dereference linux-libre-4.4.81-gnu/arch/sparc/include/asm/mmu_context_64.h linux-libre-4.4.82-gnu/arch/sparc/include/asm/mmu_context_64.h
--- linux-libre-4.4.81-gnu/arch/sparc/include/asm/mmu_context_64.h	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/arch/sparc/include/asm/mmu_context_64.h	2017-08-12 22:29:34.000000000 -0400
@@ -25,9 +25,11 @@ void destroy_context(struct mm_struct *m
 void __tsb_context_switch(unsigned long pgd_pa,
 			  struct tsb_config *tsb_base,
 			  struct tsb_config *tsb_huge,
-			  unsigned long tsb_descr_pa);
+			  unsigned long tsb_descr_pa,
+			  unsigned long secondary_ctx);
 
-static inline void tsb_context_switch(struct mm_struct *mm)
+static inline void tsb_context_switch_ctx(struct mm_struct *mm,
+					  unsigned long ctx)
 {
 	__tsb_context_switch(__pa(mm->pgd),
 			     &mm->context.tsb_block[0],
@@ -38,9 +40,12 @@ static inline void tsb_context_switch(st
 #else
 			     NULL
 #endif
-			     , __pa(&mm->context.tsb_descr[0]));
+			     , __pa(&mm->context.tsb_descr[0]),
+			     ctx);
 }
 
+#define tsb_context_switch(X) tsb_context_switch_ctx(X, 0)
+
 void tsb_grow(struct mm_struct *mm,
 	      unsigned long tsb_index,
 	      unsigned long mm_rss);
@@ -110,8 +115,7 @@ static inline void switch_mm(struct mm_s
 	 * cpu0 to update it's TSB because at that point the cpu_vm_mask
 	 * only had cpu1 set in it.
 	 */
-	load_secondary_context(mm);
-	tsb_context_switch(mm);
+	tsb_context_switch_ctx(mm, CTX_HWBITS(mm->context));
 
 	/* Any time a processor runs a context on an address space
 	 * for the first time, we must flush that context out of the
diff -druNp --no-dereference linux-libre-4.4.81-gnu/arch/sparc/kernel/tsb.S linux-libre-4.4.82-gnu/arch/sparc/kernel/tsb.S
--- linux-libre-4.4.81-gnu/arch/sparc/kernel/tsb.S	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/arch/sparc/kernel/tsb.S	2017-08-12 22:29:34.000000000 -0400
@@ -375,6 +375,7 @@ tsb_flush:
 	 * %o1:	TSB base config pointer
 	 * %o2:	TSB huge config pointer, or NULL if none
 	 * %o3:	Hypervisor TSB descriptor physical address
+	 * %o4: Secondary context to load, if non-zero
 	 *
 	 * We have to run this whole thing with interrupts
 	 * disabled so that the current cpu doesn't change
@@ -387,6 +388,17 @@ __tsb_context_switch:
 	rdpr	%pstate, %g1
 	wrpr	%g1, PSTATE_IE, %pstate
 
+	brz,pn	%o4, 1f
+	 mov	SECONDARY_CONTEXT, %o5
+
+661:	stxa	%o4, [%o5] ASI_DMMU
+	.section .sun4v_1insn_patch, "ax"
+	.word	661b
+	stxa	%o4, [%o5] ASI_MMU
+	.previous
+	flush	%g6
+
+1:
 	TRAP_LOAD_TRAP_BLOCK(%g2, %g3)
 
 	stx	%o0, [%g2 + TRAP_PER_CPU_PGD_PADDR]
diff -druNp --no-dereference linux-libre-4.4.81-gnu/arch/sparc/power/hibernate.c linux-libre-4.4.82-gnu/arch/sparc/power/hibernate.c
--- linux-libre-4.4.81-gnu/arch/sparc/power/hibernate.c	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/arch/sparc/power/hibernate.c	2017-08-12 22:29:34.000000000 -0400
@@ -35,6 +35,5 @@ void restore_processor_state(void)
 {
 	struct mm_struct *mm = current->active_mm;
 
-	load_secondary_context(mm);
-	tsb_context_switch(mm);
+	tsb_context_switch_ctx(mm, CTX_HWBITS(mm->context));
 }
diff -druNp --no-dereference linux-libre-4.4.81-gnu/Makefile linux-libre-4.4.82-gnu/Makefile
--- linux-libre-4.4.81-gnu/Makefile	2017-08-11 13:55:38.000000000 -0400
+++ linux-libre-4.4.82-gnu/Makefile	2017-08-13 12:37:05.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 81
+SUBLEVEL = 82
 EXTRAVERSION = -gnu
 NAME = Blurry Fish Butt
 
diff -druNp --no-dereference linux-libre-4.4.81-gnu/mm/mempool.c linux-libre-4.4.82-gnu/mm/mempool.c
--- linux-libre-4.4.81-gnu/mm/mempool.c	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/mm/mempool.c	2017-08-12 22:29:34.000000000 -0400
@@ -135,8 +135,8 @@ static void *remove_element(mempool_t *p
 	void *element = pool->elements[--pool->curr_nr];
 
 	BUG_ON(pool->curr_nr < 0);
-	check_element(pool, element);
 	kasan_unpoison_element(pool, element);
+	check_element(pool, element);
 	return element;
 }
 
diff -druNp --no-dereference linux-libre-4.4.81-gnu/net/core/dev.c linux-libre-4.4.82-gnu/net/core/dev.c
--- linux-libre-4.4.81-gnu/net/core/dev.c	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/net/core/dev.c	2017-08-12 22:29:34.000000000 -0400
@@ -2551,7 +2551,7 @@ static inline bool skb_needs_check(struc
 {
 	if (tx_path)
 		return skb->ip_summed != CHECKSUM_PARTIAL &&
-		       skb->ip_summed != CHECKSUM_NONE;
+		       skb->ip_summed != CHECKSUM_UNNECESSARY;
 
 	return skb->ip_summed == CHECKSUM_NONE;
 }
diff -druNp --no-dereference linux-libre-4.4.81-gnu/net/ipv4/ip_output.c linux-libre-4.4.82-gnu/net/ipv4/ip_output.c
--- linux-libre-4.4.81-gnu/net/ipv4/ip_output.c	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/net/ipv4/ip_output.c	2017-08-12 22:29:34.000000000 -0400
@@ -922,11 +922,12 @@ static int __ip_append_data(struct sock
 		csummode = CHECKSUM_PARTIAL;
 
 	cork->length += length;
-	if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) ||
-	     (skb && skb_is_gso(skb))) &&
+	if ((skb && skb_is_gso(skb)) ||
+	    (((length + (skb ? skb->len : fragheaderlen)) > mtu) &&
+	    (skb_queue_len(queue) <= 1) &&
 	    (sk->sk_protocol == IPPROTO_UDP) &&
 	    (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
-	    (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
+	    (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx)) {
 		err = ip_ufo_append_data(sk, queue, getfrag, from, length,
 					 hh_len, fragheaderlen, transhdrlen,
 					 maxfraglen, flags);
@@ -1242,6 +1243,7 @@ ssize_t	ip_append_page(struct sock *sk,
 		return -EINVAL;
 
 	if ((size + skb->len > mtu) &&
+	    (skb_queue_len(&sk->sk_write_queue) == 1) &&
 	    (sk->sk_protocol == IPPROTO_UDP) &&
 	    (rt->dst.dev->features & NETIF_F_UFO)) {
 		if (skb->ip_summed != CHECKSUM_PARTIAL)
diff -druNp --no-dereference linux-libre-4.4.81-gnu/net/ipv4/tcp_input.c linux-libre-4.4.82-gnu/net/ipv4/tcp_input.c
--- linux-libre-4.4.81-gnu/net/ipv4/tcp_input.c	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/net/ipv4/tcp_input.c	2017-08-12 22:29:34.000000000 -0400
@@ -2503,8 +2503,8 @@ static inline void tcp_end_cwnd_reductio
 	struct tcp_sock *tp = tcp_sk(sk);
 
 	/* Reset cwnd to ssthresh in CWR or Recovery (unless it's undone) */
-	if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR ||
-	    (tp->undo_marker && tp->snd_ssthresh < TCP_INFINITE_SSTHRESH)) {
+	if (tp->snd_ssthresh < TCP_INFINITE_SSTHRESH &&
+	    (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR || tp->undo_marker)) {
 		tp->snd_cwnd = tp->snd_ssthresh;
 		tp->snd_cwnd_stamp = tcp_time_stamp;
 	}
diff -druNp --no-dereference linux-libre-4.4.81-gnu/net/ipv4/tcp_output.c linux-libre-4.4.82-gnu/net/ipv4/tcp_output.c
--- linux-libre-4.4.81-gnu/net/ipv4/tcp_output.c	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/net/ipv4/tcp_output.c	2017-08-12 22:29:34.000000000 -0400
@@ -3256,6 +3256,9 @@ int tcp_connect(struct sock *sk)
 	struct sk_buff *buff;
 	int err;
 
+	if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
+		return -EHOSTUNREACH; /* Routing failure or similar. */
+
 	tcp_connect_init(sk);
 
 	if (unlikely(tp->repair)) {
diff -druNp --no-dereference linux-libre-4.4.81-gnu/net/ipv4/tcp_timer.c linux-libre-4.4.82-gnu/net/ipv4/tcp_timer.c
--- linux-libre-4.4.81-gnu/net/ipv4/tcp_timer.c	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/net/ipv4/tcp_timer.c	2017-08-12 22:29:34.000000000 -0400
@@ -606,7 +606,8 @@ static void tcp_keepalive_timer (unsigne
 		goto death;
 	}
 
-	if (!sock_flag(sk, SOCK_KEEPOPEN) || sk->sk_state == TCP_CLOSE)
+	if (!sock_flag(sk, SOCK_KEEPOPEN) ||
+	    ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT)))
 		goto out;
 
 	elapsed = keepalive_time_when(tp);
diff -druNp --no-dereference linux-libre-4.4.81-gnu/net/ipv4/udp.c linux-libre-4.4.82-gnu/net/ipv4/udp.c
--- linux-libre-4.4.81-gnu/net/ipv4/udp.c	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/net/ipv4/udp.c	2017-08-12 22:29:34.000000000 -0400
@@ -819,7 +819,7 @@ static int udp_send_skb(struct sk_buff *
 	if (is_udplite)  				 /*     UDP-Lite      */
 		csum = udplite_csum(skb);
 
-	else if (sk->sk_no_check_tx) {   /* UDP csum disabled */
+	else if (sk->sk_no_check_tx && !skb_is_gso(skb)) {   /* UDP csum off */
 
 		skb->ip_summed = CHECKSUM_NONE;
 		goto send;
diff -druNp --no-dereference linux-libre-4.4.81-gnu/net/ipv4/udp_offload.c linux-libre-4.4.82-gnu/net/ipv4/udp_offload.c
--- linux-libre-4.4.81-gnu/net/ipv4/udp_offload.c	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/net/ipv4/udp_offload.c	2017-08-12 22:29:34.000000000 -0400
@@ -231,7 +231,7 @@ static struct sk_buff *udp4_ufo_fragment
 	if (uh->check == 0)
 		uh->check = CSUM_MANGLED_0;
 
-	skb->ip_summed = CHECKSUM_NONE;
+	skb->ip_summed = CHECKSUM_UNNECESSARY;
 
 	/* Fragment the skb. IP headers of the fragments are updated in
 	 * inet_gso_segment()
diff -druNp --no-dereference linux-libre-4.4.81-gnu/net/ipv6/ip6_output.c linux-libre-4.4.82-gnu/net/ipv6/ip6_output.c
--- linux-libre-4.4.81-gnu/net/ipv6/ip6_output.c	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/net/ipv6/ip6_output.c	2017-08-12 22:29:34.000000000 -0400
@@ -1357,11 +1357,12 @@ emsgsize:
 	 */
 
 	cork->length += length;
-	if ((((length + (skb ? skb->len : headersize)) > mtu) ||
-	     (skb && skb_is_gso(skb))) &&
+	if ((skb && skb_is_gso(skb)) ||
+	    (((length + (skb ? skb->len : headersize)) > mtu) &&
+	    (skb_queue_len(queue) <= 1) &&
 	    (sk->sk_protocol == IPPROTO_UDP) &&
 	    (rt->dst.dev->features & NETIF_F_UFO) &&
-	    (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
+	    (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk))) {
 		err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
 					  hh_len, fragheaderlen, exthdrlen,
 					  transhdrlen, mtu, flags, fl6);
diff -druNp --no-dereference linux-libre-4.4.81-gnu/net/ipv6/udp_offload.c linux-libre-4.4.82-gnu/net/ipv6/udp_offload.c
--- linux-libre-4.4.81-gnu/net/ipv6/udp_offload.c	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/net/ipv6/udp_offload.c	2017-08-12 22:29:34.000000000 -0400
@@ -86,7 +86,7 @@ static struct sk_buff *udp6_ufo_fragment
 		if (uh->check == 0)
 			uh->check = CSUM_MANGLED_0;
 
-		skb->ip_summed = CHECKSUM_NONE;
+		skb->ip_summed = CHECKSUM_UNNECESSARY;
 
 		/* Check if there is enough headroom to insert fragment header. */
 		tnl_hlen = skb_tnl_header_len(skb);
diff -druNp --no-dereference linux-libre-4.4.81-gnu/net/packet/af_packet.c linux-libre-4.4.82-gnu/net/packet/af_packet.c
--- linux-libre-4.4.81-gnu/net/packet/af_packet.c	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/net/packet/af_packet.c	2017-08-12 22:29:34.000000000 -0400
@@ -3622,14 +3622,19 @@ packet_setsockopt(struct socket *sock, i
 
 		if (optlen != sizeof(val))
 			return -EINVAL;
-		if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-			return -EBUSY;
 		if (copy_from_user(&val, optval, sizeof(val)))
 			return -EFAULT;
 		if (val > INT_MAX)
 			return -EINVAL;
-		po->tp_reserve = val;
-		return 0;
+		lock_sock(sk);
+		if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
+			ret = -EBUSY;
+		} else {
+			po->tp_reserve = val;
+			ret = 0;
+		}
+		release_sock(sk);
+		return ret;
 	}
 	case PACKET_LOSS:
 	{
diff -druNp --no-dereference linux-libre-4.4.81-gnu/net/sched/act_ipt.c linux-libre-4.4.82-gnu/net/sched/act_ipt.c
--- linux-libre-4.4.81-gnu/net/sched/act_ipt.c	2017-08-11 12:22:51.000000000 -0400
+++ linux-libre-4.4.82-gnu/net/sched/act_ipt.c	2017-08-12 22:29:34.000000000 -0400
@@ -42,8 +42,8 @@ static int ipt_init_target(struct xt_ent
 		return PTR_ERR(target);
 
 	t->u.kernel.target = target;
+	memset(&par, 0, sizeof(par));
 	par.table     = table;
-	par.entryinfo = NULL;
 	par.target    = target;
 	par.targinfo  = t->data;
 	par.hook_mask = hook;
