Merge branch 'master' into staging

22 files changed, 55 insertions, 157 deletions

diff --git a/pkgs/os-specific/linux/busybox/busybox-in-store.patch b/pkgs/os-specific/linux/busybox/busybox-in-store.patch
index ea245a49259b..ab072efd930d 100644
--- a/pkgs/os-specific/linux/busybox/busybox-in-store.patch
+++ b/pkgs/os-specific/linux/busybox/busybox-in-store.patch
@@ -2,14 +2,13 @@ Allow BusyBox to be invoked as "<something>-busybox". This is
 necessary when it's run from the Nix store as <hash>-busybox during
 stdenv bootstrap.
 
-diff -ru -x '*~' busybox-1.22.1-orig/libbb/appletlib.c busybox-1.22.1/libbb/appletlib.c
---- busybox-1.22.1-orig/libbb/appletlib.c	2014-01-09 19:15:44.000000000 +0100
-+++ busybox-1.22.1/libbb/appletlib.c	2014-10-29 09:53:01.232052068 +0100
-@@ -764,7 +764,7 @@
+--- busybox-1.24.2-orig/libbb/appletlib.c	2016-03-17 21:35:49.000000000 +0100
++++ busybox-1.24.2/libbb/appletlib.c	2016-09-25 08:48:18.293104041 +0200
+@@ -779,7 +779,7 @@
  	int applet = find_applet_by_name(name);
  	if (applet >= 0)
  		run_applet_no_and_exit(applet, argv);
--	if (strncmp(name, "busybox", 7) == 0)
+-	if (is_prefixed_with(name, "busybox"))
 +	if (strstr(name, "busybox") != 0)
  		exit(busybox_main(argv));
  }
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index a33a0584a206..2563c4428223 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -26,11 +26,11 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "busybox-1.23.2";
+  name = "busybox-1.24.2";
 
   src = fetchurl {
     url = "http://busybox.net/downloads/${name}.tar.bz2";
-    sha256 = "16ii9sqracvh2r1gfzhmlypl269nnbkpvrwa7270k35d3bigk9h5";
+    sha256 = "0mf8f6ly8yi1fbr15jkyv6hxwh2x800x661rcd11rwsnqqzga7p7";
   };
 
   hardeningDisable = [ "format" ] ++ lib.optional enableStatic [ "fortify" ];
diff --git a/pkgs/os-specific/linux/iotop/default.nix b/pkgs/os-specific/linux/iotop/default.nix
index a83d4a2ad9fd..505468d849a6 100644
--- a/pkgs/os-specific/linux/iotop/default.nix
+++ b/pkgs/os-specific/linux/iotop/default.nix
@@ -1,15 +1,14 @@
-{ stdenv, fetchurl, buildPythonApplication, pythonPackages }:
+{ stdenv, fetchurl, pythonPackages }:
 
-buildPythonApplication rec {
+pythonPackages.buildPythonApplication rec {
   name = "iotop-0.6";
-  namePrefix = "";
 
   src = fetchurl {
     url = "http://guichaz.free.fr/iotop/files/${name}.tar.bz2";
     sha256 = "0nzprs6zqax0cwq8h7hnszdl3d2m4c2d4vjfxfxbnjfs9sia5pis";
   };
 
-  pythonPath = [ pythonPackages.curses ];
+  propagatedBuildInputs = [ pythonPackages.curses ];
 
   doCheck = false;
 
diff --git a/pkgs/os-specific/linux/iproute/1000-ubuntu-poc-fan-driver.patch b/pkgs/os-specific/linux/iproute/1000-ubuntu-poc-fan-driver.patch
index ca91b8160008..e0c8278d488d 100644
--- a/pkgs/os-specific/linux/iproute/1000-ubuntu-poc-fan-driver.patch
+++ b/pkgs/os-specific/linux/iproute/1000-ubuntu-poc-fan-driver.patch
@@ -57,7 +57,7 @@ Index: iproute2-4.1.1/ip/link_iptnl.c
 +
 +		if (addr)
 +			fprintf(f, "underlay %s ",
-+				format_host(AF_INET, 4, &addr, s1, sizeof(s1)));
++				format_host_r(AF_INET, 4, &addr, s1, sizeof(s1)));
 +	}
 +
  	if (tb[IFLA_IPTUN_LINK] && rta_getattr_u32(tb[IFLA_IPTUN_LINK])) {
diff --git a/pkgs/os-specific/linux/iproute/1001-ubuntu-poc-fan-driver-v3.patch b/pkgs/os-specific/linux/iproute/1001-ubuntu-poc-fan-driver-v3.patch
index a940b341ea0f..634daa0de29f 100644
--- a/pkgs/os-specific/linux/iproute/1001-ubuntu-poc-fan-driver-v3.patch
+++ b/pkgs/os-specific/linux/iproute/1001-ubuntu-poc-fan-driver-v3.patch
@@ -111,9 +111,9 @@ Index: iproute2-4.1.1/ip/link_iptnl.c
 +		p = RTA_PAYLOAD(i);
 +		m = RTA_DATA(i);
 +		fprintf(f, "%s/%d:%s/%d ",
-+			rt_addr_n2a(AF_INET, p, &m->overlay, b1, INET_ADDRSTRLEN),
++			rt_addr_n2a_r(AF_INET, p, &m->overlay, b1, INET_ADDRSTRLEN),
 +			m->overlay_prefix,
-+			rt_addr_n2a(AF_INET, p, &m->underlay, b2, INET_ADDRSTRLEN),
++			rt_addr_n2a_r(AF_INET, p, &m->underlay, b2, INET_ADDRSTRLEN),
 +			m->underlay_prefix);
 +	}
 +}
diff --git a/pkgs/os-specific/linux/iproute/1002-ubuntu-poc-fan-driver-vxlan.patch b/pkgs/os-specific/linux/iproute/1002-ubuntu-poc-fan-driver-vxlan.patch
index 2ddc2840bdd1..070023d0b923 100644
--- a/pkgs/os-specific/linux/iproute/1002-ubuntu-poc-fan-driver-vxlan.patch
+++ b/pkgs/os-specific/linux/iproute/1002-ubuntu-poc-fan-driver-vxlan.patch
@@ -6,9 +6,9 @@ Index: iproute2-4.3.0/include/linux/if_link.h
 --- iproute2-4.3.0.orig/include/linux/if_link.h
 +++ iproute2-4.3.0/include/linux/if_link.h
 @@ -392,6 +392,7 @@ enum {
- 	IFLA_VXLAN_GBP,
- 	IFLA_VXLAN_REMCSUM_NOPARTIAL,
  	IFLA_VXLAN_COLLECT_METADATA,
+ 	IFLA_VXLAN_LABEL,
+ 	IFLA_VXLAN_GPE,
 +	IFLA_VXLAN_FAN_MAP = 33,
  	__IFLA_VXLAN_MAX
  };
@@ -88,9 +88,9 @@ Index: iproute2-4.3.0/ip/iplink_vxlan.c
  			  struct nlmsghdr *n)
  {
 @@ -201,6 +243,10 @@ static int vxlan_parse_opt(struct link_u
- 			udp6zerocsumrx = 0;
- 		} else if (!matches(*argv, "gbp")) {
  			gbp = 1;
+ 		} else if (!matches(*argv, "gpe")) {
+ 			gpe = 1;
 +		} else if (!matches(*argv, "fan-map")) {
 +			NEXT_ARG();
 +			if (fan_parse_map(&argc, &argv, n))
@@ -117,9 +117,9 @@ Index: iproute2-4.3.0/ip/iplink_vxlan.c
 +		p = RTA_PAYLOAD(i);
 +		m = RTA_DATA(i);
 +		fprintf(f, "%s/%d:%s/%d ",
-+			rt_addr_n2a(AF_INET, p, &m->overlay, b1, INET_ADDRSTRLEN),
++			rt_addr_n2a_r(AF_INET, p, &m->overlay, b1, INET_ADDRSTRLEN),
 +			m->overlay_prefix,
-+			rt_addr_n2a(AF_INET, p, &m->underlay, b2, INET_ADDRSTRLEN),
++			rt_addr_n2a_r(AF_INET, p, &m->underlay, b2, INET_ADDRSTRLEN),
 +			m->underlay_prefix);
 +	}
 +}
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 6813b5bcf1b4..6f6c0c66cc3b 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -3,11 +3,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "iproute2-4.5.0";
+  name = "iproute2-${version}";
+  version = "4.7.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/iproute2/${name}.tar.xz";
-    sha256 = "0jj9phsi8m2sbnz7bbh9cf9vckm67hs62ab5srdwnrg4acpjj59z";
+    sha256 = "14kvpdlxq8204f5ayfdfb6mc0423mbf3px9q0spdly9sng7xnq4g";
   };
 
   patches = lib.optionals enableFan [
@@ -28,6 +29,7 @@ stdenv.mkDerivation rec {
     "LIBDIR=$(out)/lib"
     "SBINDIR=$(out)/sbin"
     "MANDIR=$(out)/share/man"
+    "BASH_COMPDIR=$(out)/share/bash-completion/completions"
     "DOCDIR=$(TMPDIR)/share/doc/${name}" # Don't install docs
   ];
 
diff --git a/pkgs/os-specific/linux/jool/source.nix b/pkgs/os-specific/linux/jool/source.nix
index 60415c0d009a..48ba70e620e8 100644
--- a/pkgs/os-specific/linux/jool/source.nix
+++ b/pkgs/os-specific/linux/jool/source.nix
@@ -1,9 +1,9 @@
 { fetchzip }:
 
 rec {
-  version = "3.4.4";
+  version = "3.4.5";
   src = fetchzip {
     url = "https://github.com/NICMx/releases/raw/master/Jool/Jool-${version}.zip";
-    sha256 = "1k5iyfzjdzl5q64234r806pf6b3qdflvjpw06pnwl0ycj05p5frr";
+    sha256 = "045j3ax6c5jg8037hhrbgqgznr0a114xrmn03wkasnvsxpsx4hkb";
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 107c87434de4..d7dab32e2971 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -512,9 +512,15 @@ with stdenv.lib;
   TRANSPARENT_HUGEPAGE_MADVISE? y
 
   # zram support (e.g for in-memory compressed swap).
-  ZSMALLOC y
   ZRAM m
   ZSWAP? y
+  ZBUD? y
+  ${optionalString (versionOlder version "3.18") ''
+    ZSMALLOC y
+  ''}
+  ${optionalString (versionAtLeast version "3.18") ''
+    ZSMALLOC m
+  ''}
 
   # Enable PCIe and USB for the brcmfmac driver
   BRCMFMAC_USB? y
diff --git a/pkgs/os-specific/linux/kernel/gcc5-link-apm.patch b/pkgs/os-specific/linux/kernel/gcc5-link-apm.patch
deleted file mode 100644
index e415c2d9f2b4..000000000000
--- a/pkgs/os-specific/linux/kernel/gcc5-link-apm.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 54c2f3fdb941204cad136024c7b854b7ad112ab6 Mon Sep 17 00:00:00 2001
-From: Andi Kleen <ak@linux.intel.com>
-Date: Mon, 5 Aug 2013 15:02:45 -0700
-Subject: x86, asmlinkage, apm: Make APM data structure used from assembler
- visible
-
-Signed-off-by: Andi Kleen <ak@linux.intel.com>
-Link: http://lkml.kernel.org/r/1375740170-7446-12-git-send-email-andi@firstfloor.org
-Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
----
- arch/x86/kernel/apm_32.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
-index 53a4e27..3ab0343 100644
---- a/arch/x86/kernel/apm_32.c
-+++ b/arch/x86/kernel/apm_32.c
-@@ -392,7 +392,7 @@ static struct cpuidle_device apm_cpuidle_device;
- /*
-  * Local variables
-  */
--static struct {
-+__visible struct {
- 	unsigned long	offset;
- 	unsigned short	segment;
- } apm_bios_entry;
--- 
-cgit v0.12
-
diff --git a/pkgs/os-specific/linux/kernel/gcc5-link-lguest.patch b/pkgs/os-specific/linux/kernel/gcc5-link-lguest.patch
deleted file mode 100644
index b2474f572ae1..000000000000
--- a/pkgs/os-specific/linux/kernel/gcc5-link-lguest.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From cdd77e87eae52b7251acc5990207a1c4500a84ce Mon Sep 17 00:00:00 2001
-From: Andi Kleen <ak@linux.intel.com>
-Date: Tue, 5 Nov 2013 21:22:28 +1030
-Subject: x86, asmlinkage, lguest: Pass in globals into assembler statement
-
-Tell the compiler that the inline assembler statement
-references lguest_entry.
-
-This fixes compile problems with LTO where the variable
-and the assembler code may end up in different files.
-
-Cc: x86@kernel.org
-Cc: rusty@rustcorp.com.au
-Signed-off-by: Andi Kleen <ak@linux.intel.com>
-Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
----
- drivers/lguest/x86/core.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
-index 5169239..922a1ac 100644
---- a/drivers/lguest/x86/core.c
-+++ b/drivers/lguest/x86/core.c
-@@ -157,7 +157,7 @@ static void run_guest_once(struct lg_cpu *cpu, struct lguest_pages *pages)
- 	 * stack, then the address of this call.  This stack layout happens to
- 	 * exactly match the stack layout created by an interrupt...
- 	 */
--	asm volatile("pushf; lcall *lguest_entry"
-+	asm volatile("pushf; lcall *%4"
- 		     /*
- 		      * This is how we tell GCC that %eax ("a") and %ebx ("b")
- 		      * are changed by this routine.  The "=" means output.
-@@ -169,7 +169,9 @@ static void run_guest_once(struct lg_cpu *cpu, struct lguest_pages *pages)
- 		      * physical address of the Guest's top-level page
- 		      * directory.
- 		      */
--		     : "0"(pages), "1"(__pa(cpu->lg->pgdirs[cpu->cpu_pgd].pgdir))
-+		     : "0"(pages), 
-+		       "1"(__pa(cpu->lg->pgdirs[cpu->cpu_pgd].pgdir)),
-+		       "m"(lguest_entry)
- 		     /*
- 		      * We tell gcc that all these registers could change,
- 		      * which means we don't have to save and restore them in
--- 
-cgit v0.12
-
diff --git a/pkgs/os-specific/linux/kernel/linux-3.10.nix b/pkgs/os-specific/linux/kernel/linux-3.10.nix
index 27b97054d1ae..a46a75c01caf 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.10.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.10.102";
+  version = "3.10.103";
   extraMeta.branch = "3.10";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0hvymhmbvpmpz1jk0xwhxyskijdh6bzakqj7k0gaa2y0wdj33pxi";
+    sha256 = "008dz40zig0fhkm3hjmcn0kn5b1sfvpxb7dc4fbsddb6gifrh44v";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.12.nix b/pkgs/os-specific/linux/kernel/linux-3.12.nix
index 3d98da9526bb..e14d722ad5df 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.12.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.12.62";
+  version = "3.12.63";
   extraMeta.branch = "3.12";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0a9vghq3z5xhr9xssfivb78d3i74h4kn15wqgls1cw5qzyhc1wb0";
+    sha256 = "0srg7xd68n10b28c3l5qa4dx5qr84ci7fdn48wcj79y7h2s0367x";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.18.nix b/pkgs/os-specific/linux/kernel/linux-3.18.nix
index 98151295d1b5..75f5d6de6311 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.18.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.18.40";
+  version = "3.18.42";
   extraMeta.branch = "3.18";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0x94lp4vkw1472m8sq308r8aw96nirkwppkjvqi2240ayw89d5jb";
+    sha256 = "0ymimvy8kp2a2x0h31m3sipwx1h80576ws04k3cl49wgcgjwpwn4";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.1.nix b/pkgs/os-specific/linux/kernel/linux-4.1.nix
index 1f89edecfe6c..43b69196b8c8 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.1.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.1.31";
+  version = "4.1.33";
   extraMeta.branch = "4.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0madbh1sdkf8gk6ns0zacygvfrpzrl1vd1a4qw8py7slg1bpk79n";
+    sha256 = "15ms5mvvf0wpmscv8l5irp4j7j3l6k61hcjx9ln41pz6si00zj3l";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 6f6a720b4120..bd90ec057dbc 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.4.20";
+  version = "4.4.22";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1ammaspil0xxw32c5j4mznkhfbpz1i14rm4n148d0fa1m5qbqcfj";
+    sha256 = "03qsdnlcycfy8l4q2578qrvpj3xj1gc3aijb46q4ym9vvihmd7b2";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.6.nix b/pkgs/os-specific/linux/kernel/linux-4.6.nix
deleted file mode 100644
index 6bca1bfe718c..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-4.6.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ stdenv, fetchurl, perl, buildLinux, ... } @ args:
-
-import ./generic.nix (args // rec {
-  version = "4.6.7";
-  extraMeta.branch = "4.6";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "107acpq6jk48ng25jlyv905zslrrv77yxwr46mqbq5lxg8rdg7fh";
-  };
-
-  kernelPatches = args.kernelPatches;
-
-  features.iwlwifi = true;
-  features.efiBootStub = true;
-  features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
-  features.netfilterRPFilter = true;
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.7.nix b/pkgs/os-specific/linux/kernel/linux-4.7.nix
index 54b4469a6080..85be8019dfca 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.7.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.7.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.7.4";
+  version = "4.7.5";
   extraMeta.branch = "4.7";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1zc9lwa9anyn0civwzkymaxgx7v4vwgc6aqsg390qslbazkggaa6";
+    sha256 = "14nh37v2ankal763zrwd3yrdpbg2ni1yr33kdqjiqrja4vqazc4p";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-grsecurity.nix b/pkgs/os-specific/linux/kernel/linux-grsecurity.nix
index 54b4469a6080..85be8019dfca 100644
--- a/pkgs/os-specific/linux/kernel/linux-grsecurity.nix
+++ b/pkgs/os-specific/linux/kernel/linux-grsecurity.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.7.4";
+  version = "4.7.5";
   extraMeta.branch = "4.7";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1zc9lwa9anyn0civwzkymaxgx7v4vwgc6aqsg390qslbazkggaa6";
+    sha256 = "14nh37v2ankal763zrwd3yrdpbg2ni1yr33kdqjiqrja4vqazc4p";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index a8197fd49189..b15d66278d91 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -38,16 +38,6 @@ in
 
 rec {
 
-  link_lguest =
-    { name = "gcc5-link-lguest";
-      patch = ./gcc5-link-lguest.patch;
-    };
-
-  link_apm =
-    { name = "gcc5-link-apm";
-      patch = ./gcc5-link-apm.patch;
-    };
-
   bridge_stp_helper =
     { name = "bridge-stp-helper";
       patch = ./bridge-stp-helper.patch;
@@ -96,9 +86,9 @@ rec {
   };
 
   grsecurity_testing = grsecPatch
-    { kver   = "4.7.4";
-      grrev  = "201609211951";
-      sha256 = "0h5lxl04rvww02ww0y21id6dc8mhglls8dqhjdcxdcpahxq1fb6y";
+    { kver   = "4.7.5";
+      grrev  = "201609261522";
+      sha256 = "1306lw3byw6cyi0dqh0dcl67l0bi043zmp3582hjpkwj934bahf7";
     };
 
   # This patch relaxes grsec constraints on the location of usermode helpers,
diff --git a/pkgs/os-specific/linux/spl/default.nix b/pkgs/os-specific/linux/spl/default.nix
index bed1d517e56d..c86efe22f6ef 100644
--- a/pkgs/os-specific/linux/spl/default.nix
+++ b/pkgs/os-specific/linux/spl/default.nix
@@ -17,13 +17,13 @@ assert buildKernel -> kernel != null;
 stdenv.mkDerivation rec {
   name = "spl-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
 
-  version = "0.6.5.7";
+  version = "0.6.5.8";
 
   src = fetchFromGitHub {
     owner = "zfsonlinux";
     repo = "spl";
     rev = "spl-${version}";
-    sha256 = "0i9ak4wqn444i6362xq5xl0msvcck8qqypp0fynrxq8mddzypwps";
+    sha256 = "000yvaccqlkrq15sdz0734fp3lkmx58182cdcfpm4869i0q7rf0s";
   };
 
   patches = [ ./const.patch ./install_prefix.patch ];
@@ -59,11 +59,7 @@ stdenv.mkDerivation rec {
     homepage = http://zfsonlinux.org/;
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ jcumming wizeman wkennington ];
-    broken = buildKernel
-      && (kernel.features.grsecurity or
-            # spl marked as broken until following patch is released
-            # https://github.com/zfsonlinux/spl/commit/fdbc1ba99d1f4d3958189079eee9b6c957e0264b
-            (versionAtLeast  kernel.version "4.7"));
+    maintainers = with maintainers; [ jcumming wizeman wkennington fpletz ];
+    broken = buildKernel && (kernel.features.grsecurity or false);
   };
 }
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 4b5d7e35daeb..f2cf9eca4dc0 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -20,13 +20,13 @@ assert buildKernel -> kernel != null && spl != null;
 stdenv.mkDerivation rec {
   name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
 
-  version = "0.6.5.7";
+  version = "0.6.5.8";
 
   src = fetchFromGitHub {
     owner = "zfsonlinux";
     repo = "zfs";
     rev = "zfs-${version}";
-    sha256 = "17mshxyp8k7i9a7ys0rznhkz83f6650pby9ka48d6gzgcwv9nnsm";
+    sha256 = "0qccz1832p3i80qlrrrypypspb9sy9hmpgcfx9vmhnqmkf0yri4a";
   };
 
   patches = [ ./nix-build.patch ];
@@ -109,6 +109,6 @@ stdenv.mkDerivation rec {
     homepage = http://zfsonlinux.org/;
     license = licenses.cddl;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ jcumming wizeman wkennington ];
+    maintainers = with maintainers; [ jcumming wizeman wkennington fpletz ];
   };
 }