main/linux-grsec: upgrade to grsecurity-2.2.2-3.2.2-201201252117

4 files changed, 236 insertions, 608 deletions

diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 8ef503f326..c846f07ee1 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -2,7 +2,7 @@
 
 _flavor=grsec
 pkgname=linux-${_flavor}
-pkgver=3.2.1
+pkgver=3.2.2
 _kernver=3.2
 pkgrel=0
 pkgdesc="Linux kernel with grsecurity"
@@ -14,7 +14,7 @@ _config=${config:-kernelconfig.${CARCH}}
 install=
 source="ftp://ftp.kernel.org/pub/linux/kernel/v3.0/linux-$_kernver.tar.bz2
 	ftp://ftp.kernel.org/pub/linux/kernel/v3.0/patch-$pkgver.bz2
-	grsecurity-2.2.2-3.2.1-201201221501.patch
+	grsecurity-2.2.2-3.2.2-201201252117.patch
 	
 	0004-arp-flush-arp-cache-on-device-change.patch
 
@@ -140,10 +140,10 @@ dev() {
 }
 
 md5sums="7ceb61f87c097fc17509844b71268935  linux-3.2.tar.bz2
-31fc34340f11118873463a1d59d47b7f  patch-3.2.1.bz2
-2248338d08df062a843a0b601064e781  grsecurity-2.2.2-3.2.1-201201221501.patch
+e9e53fba37c5e2afa4cdecab234120bd  patch-3.2.2.bz2
+c50a77c1b3a7317fad080e64569ad8dd  grsecurity-2.2.2-3.2.2-201201252117.patch
 776adeeb5272093574f8836c5037dd7d  0004-arp-flush-arp-cache-on-device-change.patch
 f3eda7112ef074a4121ec6de943c63ee  x86-centaur-enable-cx8-for-via-eden-too.patch
 62cc7d7b5ba7ef05b72ff91c0411c189  linux-3.0.x-regression-with-ipv4-routes-having-mtu.patch
-c21699aa138e209cd889582c2ef80e61  kernelconfig.x86
-af26ec54258f5cde5fa41c434abae34e  kernelconfig.x86_64"
+fca35f0f47e31720a87ba9d3bedf76aa  kernelconfig.x86
+79ae970fb58cc5eac8fcf0af0cc6f710  kernelconfig.x86_64"
diff --git a/main/linux-grsec/grsecurity-2.2.2-3.2.1-201201221501.patch b/main/linux-grsec/grsecurity-2.2.2-3.2.2-201201252117.patch
index ff965370cf..4d4d52eccf 100644
--- a/main/linux-grsec/grsecurity-2.2.2-3.2.1-201201221501.patch
+++ b/main/linux-grsec/grsecurity-2.2.2-3.2.2-201201252117.patch
@@ -186,7 +186,7 @@ index 81c287f..d456d02 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index c5edffa..26654d7 100644
+index 2f684da..bf21f8d 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -22993,7 +22993,7 @@ index d87dd6d..bf3fa66 100644
  
  	pte = kmemcheck_pte_lookup(address);
 diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
-index 4b5ba85..f166ad2 100644
+index 845df68..1d8d29f 100644
 --- a/arch/x86/mm/mmap.c
 +++ b/arch/x86/mm/mmap.c
 @@ -52,7 +52,7 @@ static unsigned int stack_maxrandom_size(void)
@@ -24900,18 +24900,10 @@ index 7b72502..646105c 100644
  			err = -EFAULT;
  			goto out;
 diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
-index fbdf0d8..e8f3caf 100644
+index 688be8a..8a37d98 100644
 --- a/block/scsi_ioctl.c
 +++ b/block/scsi_ioctl.c
-@@ -24,6 +24,7 @@
- #include <linux/capability.h>
- #include <linux/completion.h>
- #include <linux/cdrom.h>
-+#include <linux/ratelimit.h>
- #include <linux/slab.h>
- #include <linux/times.h>
- #include <asm/uaccess.h>
-@@ -222,8 +223,20 @@ EXPORT_SYMBOL(blk_verify_command);
+@@ -223,8 +223,20 @@ EXPORT_SYMBOL(blk_verify_command);
  static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
  			     struct sg_io_hdr *hdr, fmode_t mode)
  {
@@ -24933,7 +24925,7 @@ index fbdf0d8..e8f3caf 100644
  	if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
  		return -EPERM;
  
-@@ -432,6 +445,8 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
+@@ -433,6 +445,8 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
  	int err;
  	unsigned int in_len, out_len, bytes, opcode, cmdlen;
  	char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
@@ -24942,7 +24934,7 @@ index fbdf0d8..e8f3caf 100644
  
  	if (!sic)
  		return -EINVAL;
-@@ -465,9 +480,18 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
+@@ -466,9 +480,18 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
  	 */
  	err = -EFAULT;
  	rq->cmd_len = cmdlen;
@@ -24962,64 +24954,6 @@ index fbdf0d8..e8f3caf 100644
  	if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
  		goto error;
  
-@@ -690,6 +714,57 @@ int scsi_cmd_ioctl(struct request_queue *q, struct gendisk *bd_disk, fmode_t mod
- }
- EXPORT_SYMBOL(scsi_cmd_ioctl);
- 
-+int scsi_verify_blk_ioctl(struct block_device *bd, unsigned int cmd)
-+{
-+	if (bd && bd == bd->bd_contains)
-+		return 0;
-+
-+	/* Actually none of these is particularly useful on a partition,
-+	 * but they are safe.
-+	 */
-+	switch (cmd) {
-+	case SCSI_IOCTL_GET_IDLUN:
-+	case SCSI_IOCTL_GET_BUS_NUMBER:
-+	case SCSI_IOCTL_GET_PCI:
-+	case SCSI_IOCTL_PROBE_HOST:
-+	case SG_GET_VERSION_NUM:
-+	case SG_SET_TIMEOUT:
-+	case SG_GET_TIMEOUT:
-+	case SG_GET_RESERVED_SIZE:
-+	case SG_SET_RESERVED_SIZE:
-+	case SG_EMULATED_HOST:
-+		return 0;
-+	case CDROM_GET_CAPABILITY:
-+		/* Keep this until we remove the printk below.  udev sends it
-+		 * and we do not want to spam dmesg about it.   CD-ROMs do
-+		 * not have partitions, so we get here only for disks.
-+		 */
-+		return -ENOIOCTLCMD;
-+	default:
-+		break;
-+	}
-+
-+	/* In particular, rule out all resets and host-specific ioctls.  */
-+	printk_ratelimited(KERN_WARNING
-+			   "%s: sending ioctl %x to a partition!\n", current->comm, cmd);
-+
-+	return capable(CAP_SYS_RAWIO) ? 0 : -ENOIOCTLCMD;
-+}
-+EXPORT_SYMBOL(scsi_verify_blk_ioctl);
-+
-+int scsi_cmd_blk_ioctl(struct block_device *bd, fmode_t mode,
-+		       unsigned int cmd, void __user *arg)
-+{
-+	int ret;
-+
-+	ret = scsi_verify_blk_ioctl(bd, cmd);
-+	if (ret < 0)
-+		return ret;
-+
-+	return scsi_cmd_ioctl(bd->bd_disk->queue, bd->bd_disk, mode, cmd, arg);
-+}
-+EXPORT_SYMBOL(scsi_cmd_blk_ioctl);
-+
- static int __init blk_scsi_ioctl_init(void)
- {
- 	blk_set_cmd_filter_defaults(&blk_default_cmd_filter);
 diff --git a/crypto/cryptd.c b/crypto/cryptd.c
 index 671d4d6..5f24030 100644
 --- a/crypto/cryptd.c
@@ -26281,7 +26215,7 @@ index caf995f..6f76697 100644
  
  /**
 diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
-index 587cce5..77b928b 100644
+index b0f553b..77b928b 100644
 --- a/drivers/block/cciss.c
 +++ b/drivers/block/cciss.c
 @@ -1198,6 +1198,8 @@ static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
@@ -26293,27 +26227,6 @@ index 587cce5..77b928b 100644
  	err = 0;
  	err |=
  	    copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
-@@ -1735,7 +1737,7 @@ static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
- 	case CCISS_BIG_PASSTHRU:
- 		return cciss_bigpassthru(h, argp);
- 
--	/* scsi_cmd_ioctl handles these, below, though some are not */
-+	/* scsi_cmd_blk_ioctl handles these, below, though some are not */
- 	/* very meaningful for cciss.  SG_IO is the main one people want. */
- 
- 	case SG_GET_VERSION_NUM:
-@@ -1746,9 +1748,9 @@ static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
- 	case SG_EMULATED_HOST:
- 	case SG_IO:
- 	case SCSI_IOCTL_SEND_COMMAND:
--		return scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
-+		return scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
- 
--	/* scsi_cmd_ioctl would normally handle these, below, but */
-+	/* scsi_cmd_blk_ioctl would normally handle these, below, but */
- 	/* they aren't a good fit for cciss, as CD-ROMs are */
- 	/* not supported, and we don't have any bus/target/lun */
- 	/* which we present to the kernel. */
 @@ -3007,7 +3009,7 @@ static void start_io(ctlr_info_t *h)
  	while (!list_empty(&h->reqQ)) {
  		c = list_entry(h->reqQ.next, CommandList_struct, list);
@@ -26828,57 +26741,6 @@ index 1e888c9..05cf1b0 100644
  	set_fs(old_fs);
  	if (likely(bw == len))
  		return 0;
-diff --git a/drivers/block/ub.c b/drivers/block/ub.c
-index 0e376d4..7333b9e 100644
---- a/drivers/block/ub.c
-+++ b/drivers/block/ub.c
-@@ -1744,12 +1744,11 @@ static int ub_bd_release(struct gendisk *disk, fmode_t mode)
- static int ub_bd_ioctl(struct block_device *bdev, fmode_t mode,
-     unsigned int cmd, unsigned long arg)
- {
--	struct gendisk *disk = bdev->bd_disk;
- 	void __user *usermem = (void __user *) arg;
- 	int ret;
- 
- 	mutex_lock(&ub_mutex);
--	ret = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, usermem);
-+	ret = scsi_cmd_blk_ioctl(bdev, mode, cmd, usermem);
- 	mutex_unlock(&ub_mutex);
- 
- 	return ret;
-diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
-index 4d0b70a..e46f2f7 100644
---- a/drivers/block/virtio_blk.c
-+++ b/drivers/block/virtio_blk.c
-@@ -243,8 +243,8 @@ static int virtblk_ioctl(struct block_device *bdev, fmode_t mode,
- 	if (!virtio_has_feature(vblk->vdev, VIRTIO_BLK_F_SCSI))
- 		return -ENOTTY;
- 
--	return scsi_cmd_ioctl(disk->queue, disk, mode, cmd,
--			      (void __user *)data);
-+	return scsi_cmd_blk_ioctl(bdev, mode, cmd,
-+				  (void __user *)data);
- }
- 
- /* We provide getgeo only to please some old bootloader/partitioning tools */
-diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
-index f997c27..cedb231 100644
---- a/drivers/cdrom/cdrom.c
-+++ b/drivers/cdrom/cdrom.c
-@@ -2747,12 +2747,11 @@ int cdrom_ioctl(struct cdrom_device_info *cdi, struct block_device *bdev,
- {
- 	void __user *argp = (void __user *)arg;
- 	int ret;
--	struct gendisk *disk = bdev->bd_disk;
- 
- 	/*
- 	 * Try the generic SCSI command ioctl's first.
- 	 */
--	ret = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
-+	ret = scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
- 	if (ret != -ENOTTY)
- 		return ret;
- 
 diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
 index 4364303..9adf4ee 100644
 --- a/drivers/char/Kconfig
@@ -27713,6 +27575,19 @@ index b153674..ad2ba9b 100644
  	{
  	 PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
  	 },
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index 7a402bf..af0b211 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -367,7 +367,7 @@ static const struct pci_id_table pci_dev_descr_sbridge_table[] = {
+ /*
+  *	pci_device_id	table for which devices we are looking for
+  */
+-static const struct pci_device_id sbridge_pci_tbl[] __devinitdata = {
++static const struct pci_device_id sbridge_pci_tbl[] __devinitconst = {
+ 	{PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SBRIDGE_IMC_TA)},
+ 	{0,}			/* 0 terminated list. */
+ };
 diff --git a/drivers/edac/x38_edac.c b/drivers/edac/x38_edac.c
 index b6f47de..c5acf3a 100644
 --- a/drivers/edac/x38_edac.c
@@ -28721,10 +28596,10 @@ index 8227e76..ce0b195 100644
  /*
   * Asic structures
 diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
-index c4d00a1..f0fdc90 100644
+index 9b39145..389b93b 100644
 --- a/drivers/gpu/drm/radeon/radeon_device.c
 +++ b/drivers/gpu/drm/radeon/radeon_device.c
-@@ -684,7 +684,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev)
+@@ -687,7 +687,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev)
  	bool can_switch;
  
  	spin_lock(&dev->count_lock);
@@ -29062,10 +28937,10 @@ index 8a8725c..afed796 100644
  			marker = list_first_entry(&queue->head,
  						 struct vmw_marker, head);
 diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
-index af35384..5ab3c36 100644
+index bb656d8..4169fca 100644
 --- a/drivers/hid/hid-core.c
 +++ b/drivers/hid/hid-core.c
-@@ -2000,7 +2000,7 @@ static bool hid_ignore(struct hid_device *hdev)
+@@ -2012,7 +2012,7 @@ static bool hid_ignore(struct hid_device *hdev)
  
  int hid_add_device(struct hid_device *hdev)
  {
@@ -29074,7 +28949,7 @@ index af35384..5ab3c36 100644
  	int ret;
  
  	if (WARN_ON(hdev->status & HID_STAT_ADDED))
-@@ -2015,7 +2015,7 @@ int hid_add_device(struct hid_device *hdev)
+@@ -2027,7 +2027,7 @@ int hid_add_device(struct hid_device *hdev)
  	/* XXX hack, any other cleaner solution after the driver core
  	 * is converted to allow more than 20 bytes as the device name? */
  	dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
@@ -29500,20 +29375,6 @@ index 8126824..55a2798 100644
  			drive->dma = 0;
  	}
  }
-diff --git a/drivers/ide/ide-floppy_ioctl.c b/drivers/ide/ide-floppy_ioctl.c
-index d267b7a..a22ca84 100644
---- a/drivers/ide/ide-floppy_ioctl.c
-+++ b/drivers/ide/ide-floppy_ioctl.c
-@@ -292,8 +292,7 @@ int ide_floppy_ioctl(ide_drive_t *drive, struct block_device *bdev,
- 	 * and CDROM_SEND_PACKET (legacy) ioctls
- 	 */
- 	if (cmd != CDROM_SEND_PACKET && cmd != SCSI_IOCTL_SEND_COMMAND)
--		err = scsi_cmd_ioctl(bdev->bd_disk->queue, bdev->bd_disk,
--				mode, cmd, argp);
-+		err = scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
- 
- 	if (err == -ENOTTY)
- 		err = generic_ide_ioctl(drive, bdev, cmd, arg);
 diff --git a/drivers/ide/ide-pci-generic.c b/drivers/ide/ide-pci-generic.c
 index a743e68..1cfd674 100644
 --- a/drivers/ide/ide-pci-generic.c
@@ -31441,10 +31302,10 @@ index 1cbfc6b..56e1dbb 100644
  /*----------------------------------------------------------------*/
  
 diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index ede2461..9c4c691 100644
+index 7d9e071..015b1d5 100644
 --- a/drivers/md/raid1.c
 +++ b/drivers/md/raid1.c
-@@ -1559,7 +1559,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
+@@ -1568,7 +1568,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
  			if (r1_sync_page_io(rdev, sect, s,
  					    bio->bi_io_vec[idx].bv_page,
  					    READ) != 0)
@@ -31453,7 +31314,7 @@ index ede2461..9c4c691 100644
  		}
  		sectors -= s;
  		sect += s;
-@@ -1772,7 +1772,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk,
+@@ -1781,7 +1781,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk,
  			    test_bit(In_sync, &rdev->flags)) {
  				if (r1_sync_page_io(rdev, sect, s,
  						    conf->tmppage, READ)) {
@@ -33232,7 +33093,7 @@ index b592016..fe47870 100644
  		| set11nRateFlags(i->rates, 2)
  		| set11nRateFlags(i->rates, 3)
 diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
-index ccde784..db012b3 100644
+index f5ae3c6..7936af3 100644
 --- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
 +++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
 @@ -35,47 +35,47 @@ ar9003_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
@@ -33398,10 +33259,10 @@ index bea8524..c677c06 100644
  struct brcms_phy {
  	struct brcms_phy_pub pubpi_ro;
 diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
-index b282d86..bee832f 100644
+index 05f2ad1..ae00eea 100644
 --- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
 +++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
-@@ -3686,7 +3686,9 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
+@@ -3685,7 +3685,9 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
  	 */
  	if (iwl3945_mod_params.disable_hw_scan) {
  		IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
@@ -34938,51 +34799,6 @@ index 21a045e..ec89e03 100644
  	dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
  
  	transport_setup_device(&rport->dev);
-diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
-index fa3a591..fd96409 100644
---- a/drivers/scsi/sd.c
-+++ b/drivers/scsi/sd.c
-@@ -1074,6 +1074,10 @@ static int sd_ioctl(struct block_device *bdev, fmode_t mode,
- 	SCSI_LOG_IOCTL(1, sd_printk(KERN_INFO, sdkp, "sd_ioctl: disk=%s, "
- 				    "cmd=0x%x\n", disk->disk_name, cmd));
- 
-+	error = scsi_verify_blk_ioctl(bdev, cmd);
-+	if (error < 0)
-+		return error;
-+
- 	/*
- 	 * If we are in the middle of error recovery, don't let anyone
- 	 * else try and use this device.  Also, if error recovery fails, it
-@@ -1096,7 +1100,7 @@ static int sd_ioctl(struct block_device *bdev, fmode_t mode,
- 			error = scsi_ioctl(sdp, cmd, p);
- 			break;
- 		default:
--			error = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, p);
-+			error = scsi_cmd_blk_ioctl(bdev, mode, cmd, p);
- 			if (error != -ENOTTY)
- 				break;
- 			error = scsi_ioctl(sdp, cmd, p);
-@@ -1266,6 +1270,11 @@ static int sd_compat_ioctl(struct block_device *bdev, fmode_t mode,
- 			   unsigned int cmd, unsigned long arg)
- {
- 	struct scsi_device *sdev = scsi_disk(bdev->bd_disk)->device;
-+	int ret;
-+
-+	ret = scsi_verify_blk_ioctl(bdev, cmd);
-+	if (ret < 0)
-+		return ret;
- 
- 	/*
- 	 * If we are in the middle of error recovery, don't let anyone
-@@ -1277,8 +1286,6 @@ static int sd_compat_ioctl(struct block_device *bdev, fmode_t mode,
- 		return -ENODEV;
- 	       
- 	if (sdev->host->hostt->compat_ioctl) {
--		int ret;
--
- 		ret = sdev->host->hostt->compat_ioctl(sdev, cmd, (void __user *)arg);
- 
- 		return ret;
 diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
 index 441a1c5..07cece7 100644
 --- a/drivers/scsi/sg.c
@@ -35474,7 +35290,7 @@ index 6845228..df77141 100644
  
  		core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
 diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index 0257658..09433d5 100644
+index e87d0eb..856cbcc 100644
 --- a/drivers/target/target_core_transport.c
 +++ b/drivers/target/target_core_transport.c
 @@ -1343,7 +1343,7 @@ struct se_device *transport_add_device_to_core_hba(
@@ -35525,7 +35341,7 @@ index 0257658..09433d5 100644
  		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
  		return false;
  	}
-@@ -4495,7 +4495,7 @@ int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
+@@ -4509,7 +4509,7 @@ int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
  {
  	int ret = 0;
  
@@ -35534,7 +35350,7 @@ index 0257658..09433d5 100644
  		if (!send_status ||
  		     (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
  			return 1;
-@@ -4532,7 +4532,7 @@ void transport_send_task_abort(struct se_cmd *cmd)
+@@ -4546,7 +4546,7 @@ void transport_send_task_abort(struct se_cmd *cmd)
  	 */
  	if (cmd->data_direction == DMA_TO_DEVICE) {
  		if (cmd->se_tfo->write_pending_status(cmd) != 0) {
@@ -39567,7 +39383,7 @@ index 79e2ca7..5828ad1 100644
  	  A.out (Assembler.OUTput) is a set of formats for libraries and
  	  executables used in the earliest versions of UNIX.  Linux used
 diff --git a/fs/aio.c b/fs/aio.c
-index 78c514c..22ac304 100644
+index 969beb0..09fab51 100644
 --- a/fs/aio.c
 +++ b/fs/aio.c
 @@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx *ctx)
@@ -39579,7 +39395,7 @@ index 78c514c..22ac304 100644
  		return -EINVAL;
  
  	nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
-@@ -1454,22 +1454,27 @@ static ssize_t aio_fsync(struct kiocb *iocb)
+@@ -1461,22 +1461,27 @@ static ssize_t aio_fsync(struct kiocb *iocb)
  static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
  {
  	ssize_t ret;
@@ -41454,10 +41270,10 @@ index 9a37a9b..35792b6 100644
  				/*
  				 * We'll have a dentry and an inode for
 diff --git a/fs/dcache.c b/fs/dcache.c
-index 89509b5..d33331b 100644
+index f7908ae..920a680 100644
 --- a/fs/dcache.c
 +++ b/fs/dcache.c
-@@ -3056,7 +3056,7 @@ void __init vfs_caches_init(unsigned long mempages)
+@@ -3042,7 +3042,7 @@ void __init vfs_caches_init(unsigned long mempages)
  	mempages -= reserve;
  
  	names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
@@ -41533,7 +41349,7 @@ index 3745f7c..89cc7a3 100644
  	return rc;
  }
 diff --git a/fs/exec.c b/fs/exec.c
-index 3625464..8dcadcf 100644
+index 3625464..d08b205 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
 @@ -55,12 +55,28 @@
@@ -41800,7 +41616,18 @@ index 3625464..8dcadcf 100644
  	/*
  	 * We move the actual failure in case of RLIMIT_NPROC excess from
  	 * set*uid() to execve() because too many poorly written programs
-@@ -1503,6 +1531,16 @@ static int do_execve_common(const char *filename,
+@@ -1497,12 +1525,27 @@ static int do_execve_common(const char *filename,
+ 	if (IS_ERR(file))
+ 		goto out_unmark;
+ 
++	if (gr_ptrace_readexec(file, bprm->unsafe)) {
++		retval = -EPERM;
++		goto out_file;
++	}
++
+ 	sched_exec();
+ 
+ 	bprm->file = file;
  	bprm->filename = filename;
  	bprm->interp = filename;
  
@@ -41817,7 +41644,7 @@ index 3625464..8dcadcf 100644
  	retval = bprm_mm_init(bprm);
  	if (retval)
  		goto out_file;
-@@ -1532,9 +1570,40 @@ static int do_execve_common(const char *filename,
+@@ -1532,9 +1575,40 @@ static int do_execve_common(const char *filename,
  	if (retval < 0)
  		goto out;
  
@@ -41859,7 +41686,7 @@ index 3625464..8dcadcf 100644
  
  	/* execve succeeded */
  	current->fs->in_exec = 0;
-@@ -1545,6 +1614,14 @@ static int do_execve_common(const char *filename,
+@@ -1545,6 +1619,14 @@ static int do_execve_common(const char *filename,
  		put_files_struct(displaced);
  	return retval;
  
@@ -41874,7 +41701,7 @@ index 3625464..8dcadcf 100644
  out:
  	if (bprm->mm) {
  		acct_arg_size(bprm, 0);
-@@ -1618,7 +1695,7 @@ static int expand_corename(struct core_name *cn)
+@@ -1618,7 +1700,7 @@ static int expand_corename(struct core_name *cn)
  {
  	char *old_corename = cn->corename;
  
@@ -41883,7 +41710,7 @@ index 3625464..8dcadcf 100644
  	cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
  
  	if (!cn->corename) {
-@@ -1715,7 +1792,7 @@ static int format_corename(struct core_name *cn, long signr)
+@@ -1715,7 +1797,7 @@ static int format_corename(struct core_name *cn, long signr)
  	int pid_in_pattern = 0;
  	int err = 0;
  
@@ -41892,7 +41719,7 @@ index 3625464..8dcadcf 100644
  	cn->corename = kmalloc(cn->size, GFP_KERNEL);
  	cn->used = 0;
  
-@@ -1812,6 +1889,218 @@ out:
+@@ -1812,6 +1894,218 @@ out:
  	return ispipe;
  }
  
@@ -42111,7 +41938,7 @@ index 3625464..8dcadcf 100644
  static int zap_process(struct task_struct *start, int exit_code)
  {
  	struct task_struct *t;
-@@ -2023,17 +2312,17 @@ static void wait_for_dump_helpers(struct file *file)
+@@ -2023,17 +2317,17 @@ static void wait_for_dump_helpers(struct file *file)
  	pipe = file->f_path.dentry->d_inode->i_pipe;
  
  	pipe_lock(pipe);
@@ -42134,7 +41961,7 @@ index 3625464..8dcadcf 100644
  	pipe_unlock(pipe);
  
  }
-@@ -2094,7 +2383,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2094,7 +2388,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  	int retval = 0;
  	int flag = 0;
  	int ispipe;
@@ -42143,7 +41970,7 @@ index 3625464..8dcadcf 100644
  	struct coredump_params cprm = {
  		.signr = signr,
  		.regs = regs,
-@@ -2109,6 +2398,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2109,6 +2403,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  
  	audit_core_dumps(signr);
  
@@ -42153,7 +41980,7 @@ index 3625464..8dcadcf 100644
  	binfmt = mm->binfmt;
  	if (!binfmt || !binfmt->core_dump)
  		goto fail;
-@@ -2176,7 +2468,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2176,7 +2473,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  		}
  		cprm.limit = RLIM_INFINITY;
  
@@ -42162,7 +41989,7 @@ index 3625464..8dcadcf 100644
  		if (core_pipe_limit && (core_pipe_limit < dump_count)) {
  			printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
  			       task_tgid_vnr(current), current->comm);
-@@ -2203,6 +2495,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2203,6 +2500,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  	} else {
  		struct inode *inode;
  
@@ -42171,7 +41998,7 @@ index 3625464..8dcadcf 100644
  		if (cprm.limit < binfmt->min_coredump)
  			goto fail_unlock;
  
-@@ -2246,7 +2540,7 @@ close_fail:
+@@ -2246,7 +2545,7 @@ close_fail:
  		filp_close(cprm.file, NULL);
  fail_dropcount:
  	if (ispipe)
@@ -42180,7 +42007,7 @@ index 3625464..8dcadcf 100644
  fail_unlock:
  	kfree(cn.corename);
  fail_corename:
-@@ -2265,7 +2559,7 @@ fail:
+@@ -2265,7 +2564,7 @@ fail:
   */
  int dump_write(struct file *file, const void *addr, int nr)
  {
@@ -44688,7 +44515,7 @@ index cfc6d44..b4632a5 100644
  	error = lock_mount(&old);
  	if (error)
 diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
-index 281ae95..dd895b9 100644
+index 3db6b82..a57597e 100644
 --- a/fs/nfs/blocklayout/blocklayout.c
 +++ b/fs/nfs/blocklayout/blocklayout.c
 @@ -90,7 +90,7 @@ static int is_writable(struct pnfs_block_extent *be, sector_t isect)
@@ -44778,32 +44605,6 @@ index 9fde1c0..14e8827 100644
  			 fanotify_event_metadata.event_len))
  		goto out_kill_access_response;
  
-diff --git a/fs/notify/mark.c b/fs/notify/mark.c
-index e14587d..f104d56 100644
---- a/fs/notify/mark.c
-+++ b/fs/notify/mark.c
-@@ -135,9 +135,6 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
- 
- 	mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE;
- 
--	/* 1 from caller and 1 for being on i_list/g_list */
--	BUG_ON(atomic_read(&mark->refcnt) < 2);
--
- 	spin_lock(&group->mark_lock);
- 
- 	if (mark->flags & FSNOTIFY_MARK_FLAG_INODE) {
-@@ -182,6 +179,11 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
- 		iput(inode);
- 
- 	/*
-+	 * We don't necessarily have a ref on mark from caller so the above iput
-+	 * may have already destroyed it.  Don't touch from now on.
-+	 */
-+
-+	/*
- 	 * it's possible that this group tried to destroy itself, but this
- 	 * this mark was simultaneously being freed by inode.  If that's the
- 	 * case, we finish freeing the group here.
 diff --git a/fs/notify/notification.c b/fs/notify/notification.c
 index ee18815..7aa5d01 100644
 --- a/fs/notify/notification.c
@@ -45395,7 +45196,7 @@ index 3a1dafd..d41fc37 100644
 +}
 +#endif
 diff --git a/fs/proc/base.c b/fs/proc/base.c
-index 851ba3d..813fd0b 100644
+index 1fc1dca..813fd0b 100644
 --- a/fs/proc/base.c
 +++ b/fs/proc/base.c
 @@ -107,6 +107,22 @@ struct pid_entry {
@@ -45421,79 +45222,12 @@ index 851ba3d..813fd0b 100644
  #define NOD(NAME, MODE, IOP, FOP, OP) {			\
  	.name = (NAME),					\
  	.len  = sizeof(NAME) - 1,			\
-@@ -194,65 +210,7 @@ static int proc_root_link(struct inode *inode, struct path *path)
- 	return result;
- }
- 
--static struct mm_struct *__check_mem_permission(struct task_struct *task)
--{
--	struct mm_struct *mm;
--
--	mm = get_task_mm(task);
--	if (!mm)
--		return ERR_PTR(-EINVAL);
--
--	/*
--	 * A task can always look at itself, in case it chooses
--	 * to use system calls instead of load instructions.
--	 */
--	if (task == current)
--		return mm;
--
--	/*
--	 * If current is actively ptrace'ing, and would also be
--	 * permitted to freshly attach with ptrace now, permit it.
--	 */
--	if (task_is_stopped_or_traced(task)) {
--		int match;
--		rcu_read_lock();
--		match = (ptrace_parent(task) == current);
--		rcu_read_unlock();
--		if (match && ptrace_may_access(task, PTRACE_MODE_ATTACH))
--			return mm;
--	}
--
--	/*
--	 * No one else is allowed.
--	 */
--	mmput(mm);
--	return ERR_PTR(-EPERM);
--}
--
--/*
-- * If current may access user memory in @task return a reference to the
-- * corresponding mm, otherwise ERR_PTR.
-- */
--static struct mm_struct *check_mem_permission(struct task_struct *task)
--{
--	struct mm_struct *mm;
--	int err;
--
--	/*
--	 * Avoid racing if task exec's as we might get a new mm but validate
--	 * against old credentials.
--	 */
--	err = mutex_lock_killable(&task->signal->cred_guard_mutex);
--	if (err)
--		return ERR_PTR(err);
--
--	mm = __check_mem_permission(task);
--	mutex_unlock(&task->signal->cred_guard_mutex);
--
--	return mm;
--}
--
--struct mm_struct *mm_for_maps(struct task_struct *task)
-+static struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
- {
- 	struct mm_struct *mm;
- 	int err;
-@@ -262,16 +220,23 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
+@@ -204,10 +220,12 @@ static struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
  		return ERR_PTR(err);
  
  	mm = get_task_mm(task);
 -	if (mm && mm != current->mm &&
--			!ptrace_may_access(task, PTRACE_MODE_READ)) {
+-			!ptrace_may_access(task, mode)) {
 -		mmput(mm);
 -		mm = ERR_PTR(-EACCES);
 +	if (mm) {
@@ -45505,18 +45239,7 @@ index 851ba3d..813fd0b 100644
  	}
  	mutex_unlock(&task->signal->cred_guard_mutex);
  
- 	return mm;
- }
- 
-+struct mm_struct *mm_for_maps(struct task_struct *task)
-+{
-+	return mm_access(task, PTRACE_MODE_READ);
-+}
-+
- static int proc_pid_cmdline(struct task_struct *task, char * buffer)
- {
- 	int res = 0;
-@@ -282,6 +247,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
+@@ -229,6 +247,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
  	if (!mm->arg_end)
  		goto out_mm;	/* Shh! No looking before we're done */
  
@@ -45526,7 +45249,7 @@ index 851ba3d..813fd0b 100644
   	len = mm->arg_end - mm->arg_start;
   
  	if (len > PAGE_SIZE)
-@@ -309,12 +277,28 @@ out:
+@@ -256,12 +277,28 @@ out:
  	return res;
  }
  
@@ -45555,7 +45278,7 @@ index 851ba3d..813fd0b 100644
  		do {
  			nwords += 2;
  		} while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
-@@ -328,7 +312,7 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer)
+@@ -275,7 +312,7 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer)
  }
  
  
@@ -45564,7 +45287,7 @@ index 851ba3d..813fd0b 100644
  /*
   * Provides a wchan file via kallsyms in a proper one-value-per-file format.
   * Returns the resolved symbol.  If that fails, simply return the address.
-@@ -367,7 +351,7 @@ static void unlock_trace(struct task_struct *task)
+@@ -314,7 +351,7 @@ static void unlock_trace(struct task_struct *task)
  	mutex_unlock(&task->signal->cred_guard_mutex);
  }
  
@@ -45573,7 +45296,7 @@ index 851ba3d..813fd0b 100644
  
  #define MAX_STACK_TRACE_DEPTH	64
  
-@@ -558,7 +542,7 @@ static int proc_pid_limits(struct task_struct *task, char *buffer)
+@@ -505,7 +542,7 @@ static int proc_pid_limits(struct task_struct *task, char *buffer)
  	return count;
  }
  
@@ -45582,7 +45305,7 @@ index 851ba3d..813fd0b 100644
  static int proc_pid_syscall(struct task_struct *task, char *buffer)
  {
  	long nr;
-@@ -587,7 +571,7 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
+@@ -534,7 +571,7 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
  /************************************************************************/
  
  /* permission checks */
@@ -45591,7 +45314,7 @@ index 851ba3d..813fd0b 100644
  {
  	struct task_struct *task;
  	int allowed = 0;
-@@ -597,7 +581,10 @@ static int proc_fd_access_allowed(struct inode *inode)
+@@ -544,7 +581,10 @@ static int proc_fd_access_allowed(struct inode *inode)
  	 */
  	task = get_proc_task(inode);
  	if (task) {
@@ -45603,75 +45326,7 @@ index 851ba3d..813fd0b 100644
  		put_task_struct(task);
  	}
  	return allowed;
-@@ -816,38 +803,39 @@ static const struct file_operations proc_single_file_operations = {
- 
- static int mem_open(struct inode* inode, struct file* file)
- {
--	file->private_data = (void*)((long)current->self_exec_id);
-+	struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
-+	struct mm_struct *mm;
-+
-+	if (!task)
-+		return -ESRCH;
-+
-+	mm = mm_access(task, PTRACE_MODE_ATTACH);
-+	put_task_struct(task);
-+
-+	if (IS_ERR(mm))
-+		return PTR_ERR(mm);
-+
- 	/* OK to pass negative loff_t, we can catch out-of-range */
- 	file->f_mode |= FMODE_UNSIGNED_OFFSET;
-+	file->private_data = mm;
-+
- 	return 0;
- }
- 
- static ssize_t mem_read(struct file * file, char __user * buf,
- 			size_t count, loff_t *ppos)
- {
--	struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
-+	int ret;
- 	char *page;
- 	unsigned long src = *ppos;
--	int ret = -ESRCH;
--	struct mm_struct *mm;
-+	struct mm_struct *mm = file->private_data;
- 
--	if (!task)
--		goto out_no_task;
-+	if (!mm)
-+		return 0;
- 
--	ret = -ENOMEM;
- 	page = (char *)__get_free_page(GFP_TEMPORARY);
- 	if (!page)
--		goto out;
--
--	mm = check_mem_permission(task);
--	ret = PTR_ERR(mm);
--	if (IS_ERR(mm))
--		goto out_free;
--
--	ret = -EIO;
-- 
--	if (file->private_data != (void*)((long)current->self_exec_id))
--		goto out_put;
-+		return -ENOMEM;
- 
- 	ret = 0;
-  
-@@ -874,42 +862,28 @@ static ssize_t mem_read(struct file * file, char __user * buf,
- 	}
- 	*ppos = src;
- 
--out_put:
--	mmput(mm);
--out_free:
- 	free_page((unsigned long) page);
--out:
--	put_task_struct(task);
--out_no_task:
+@@ -826,6 +866,10 @@ static ssize_t mem_read(struct file * file, char __user * buf,
  	return ret;
  }
  
@@ -45682,75 +45337,15 @@ index 851ba3d..813fd0b 100644
  static ssize_t mem_write(struct file * file, const char __user *buf,
  			 size_t count, loff_t *ppos)
  {
- 	int copied;
- 	char *page;
--	struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
- 	unsigned long dst = *ppos;
--	struct mm_struct *mm;
-+	struct mm_struct *mm = file->private_data;
- 
--	copied = -ESRCH;
--	if (!task)
--		goto out_no_task;
-+	if (!mm)
-+		return 0;
- 
--	copied = -ENOMEM;
- 	page = (char *)__get_free_page(GFP_TEMPORARY);
- 	if (!page)
--		goto out_task;
--
--	mm = check_mem_permission(task);
--	copied = PTR_ERR(mm);
--	if (IS_ERR(mm))
--		goto out_free;
--
--	copied = -EIO;
--	if (file->private_data != (void *)((long)current->self_exec_id))
--		goto out_mm;
-+		return -ENOMEM;
- 
- 	copied = 0;
- 	while (count > 0) {
-@@ -933,15 +907,10 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
- 	}
- 	*ppos = dst;
- 
--out_mm:
--	mmput(mm);
--out_free:
+@@ -866,6 +910,7 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
  	free_page((unsigned long) page);
--out_task:
--	put_task_struct(task);
--out_no_task:
  	return copied;
  }
 +#endif
  
  loff_t mem_lseek(struct file *file, loff_t offset, int orig)
  {
-@@ -959,11 +928,20 @@ loff_t mem_lseek(struct file *file, loff_t offset, int orig)
- 	return file->f_pos;
- }
- 
-+static int mem_release(struct inode *inode, struct file *file)
-+{
-+	struct mm_struct *mm = file->private_data;
-+
-+	mmput(mm);
-+	return 0;
-+}
-+
- static const struct file_operations proc_mem_operations = {
- 	.llseek		= mem_lseek,
- 	.read		= mem_read,
- 	.write		= mem_write,
- 	.open		= mem_open,
-+	.release	= mem_release,
- };
- 
- static ssize_t environ_read(struct file *file, char __user *buf,
-@@ -978,6 +956,9 @@ static ssize_t environ_read(struct file *file, char __user *buf,
+@@ -911,6 +956,9 @@ static ssize_t environ_read(struct file *file, char __user *buf,
  	if (!task)
  		goto out_no_task;
  
@@ -45760,7 +45355,7 @@ index 851ba3d..813fd0b 100644
  	ret = -ENOMEM;
  	page = (char *)__get_free_page(GFP_TEMPORARY);
  	if (!page)
-@@ -1600,7 +1581,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
+@@ -1533,7 +1581,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
  	path_put(&nd->path);
  
  	/* Are we allowed to snoop on the tasks file descriptors? */
@@ -45769,7 +45364,7 @@ index 851ba3d..813fd0b 100644
  		goto out;
  
  	error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
-@@ -1639,8 +1620,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
+@@ -1572,8 +1620,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
  	struct path path;
  
  	/* Are we allowed to snoop on the tasks file descriptors? */
@@ -45790,7 +45385,7 @@ index 851ba3d..813fd0b 100644
  
  	error = PROC_I(inode)->op.proc_get_link(inode, &path);
  	if (error)
-@@ -1705,7 +1696,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
+@@ -1638,7 +1696,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
  		rcu_read_lock();
  		cred = __task_cred(task);
  		inode->i_uid = cred->euid;
@@ -45802,7 +45397,7 @@ index 851ba3d..813fd0b 100644
  		rcu_read_unlock();
  	}
  	security_task_to_inode(task, inode);
-@@ -1723,6 +1718,9 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
+@@ -1656,6 +1718,9 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
  	struct inode *inode = dentry->d_inode;
  	struct task_struct *task;
  	const struct cred *cred;
@@ -45812,7 +45407,7 @@ index 851ba3d..813fd0b 100644
  
  	generic_fillattr(inode, stat);
  
-@@ -1730,13 +1728,41 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
+@@ -1663,13 +1728,41 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
  	stat->uid = 0;
  	stat->gid = 0;
  	task = pid_task(proc_pid(inode), PIDTYPE_PID);
@@ -45855,7 +45450,7 @@ index 851ba3d..813fd0b 100644
  	}
  	rcu_read_unlock();
  	return 0;
-@@ -1773,11 +1799,20 @@ int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
+@@ -1706,11 +1799,20 @@ int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
  
  	if (task) {
  		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
@@ -45876,7 +45471,7 @@ index 851ba3d..813fd0b 100644
  			rcu_read_unlock();
  		} else {
  			inode->i_uid = 0;
-@@ -1895,7 +1930,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
+@@ -1828,7 +1930,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
  	int fd = proc_fd(inode);
  
  	if (task) {
@@ -45886,7 +45481,7 @@ index 851ba3d..813fd0b 100644
  		put_task_struct(task);
  	}
  	if (files) {
-@@ -2163,11 +2199,21 @@ static const struct file_operations proc_fd_operations = {
+@@ -2096,11 +2199,21 @@ static const struct file_operations proc_fd_operations = {
   */
  static int proc_fd_permission(struct inode *inode, int mask)
  {
@@ -45910,7 +45505,7 @@ index 851ba3d..813fd0b 100644
  	return rv;
  }
  
-@@ -2277,6 +2323,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
+@@ -2210,6 +2323,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
  	if (!task)
  		goto out_no_task;
  
@@ -45920,7 +45515,7 @@ index 851ba3d..813fd0b 100644
  	/*
  	 * Yes, it does not scale. And it should not. Don't add
  	 * new entries into /proc/<tgid>/ without very good reasons.
-@@ -2321,6 +2370,9 @@ static int proc_pident_readdir(struct file *filp,
+@@ -2254,6 +2370,9 @@ static int proc_pident_readdir(struct file *filp,
  	if (!task)
  		goto out_no_task;
  
@@ -45930,7 +45525,7 @@ index 851ba3d..813fd0b 100644
  	ret = 0;
  	i = filp->f_pos;
  	switch (i) {
-@@ -2591,7 +2643,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
+@@ -2524,7 +2643,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
  static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
  				void *cookie)
  {
@@ -45939,7 +45534,7 @@ index 851ba3d..813fd0b 100644
  	if (!IS_ERR(s))
  		__putname(s);
  }
-@@ -2789,7 +2841,7 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2722,7 +2841,7 @@ static const struct pid_entry tgid_base_stuff[] = {
  	REG("autogroup",  S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
  #endif
  	REG("comm",      S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
@@ -45948,7 +45543,7 @@ index 851ba3d..813fd0b 100644
  	INF("syscall",    S_IRUGO, proc_pid_syscall),
  #endif
  	INF("cmdline",    S_IRUGO, proc_pid_cmdline),
-@@ -2814,10 +2866,10 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2747,10 +2866,10 @@ static const struct pid_entry tgid_base_stuff[] = {
  #ifdef CONFIG_SECURITY
  	DIR("attr",       S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
  #endif
@@ -45961,7 +45556,7 @@ index 851ba3d..813fd0b 100644
  	ONE("stack",      S_IRUGO, proc_pid_stack),
  #endif
  #ifdef CONFIG_SCHEDSTATS
-@@ -2851,6 +2903,9 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2784,6 +2903,9 @@ static const struct pid_entry tgid_base_stuff[] = {
  #ifdef CONFIG_HARDWALL
  	INF("hardwall",   S_IRUGO, proc_pid_hardwall),
  #endif
@@ -45971,7 +45566,7 @@ index 851ba3d..813fd0b 100644
  };
  
  static int proc_tgid_base_readdir(struct file * filp,
-@@ -2976,7 +3031,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
+@@ -2909,7 +3031,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
  	if (!inode)
  		goto out;
  
@@ -45986,7 +45581,7 @@ index 851ba3d..813fd0b 100644
  	inode->i_op = &proc_tgid_base_inode_operations;
  	inode->i_fop = &proc_tgid_base_operations;
  	inode->i_flags|=S_IMMUTABLE;
-@@ -3018,7 +3080,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
+@@ -2951,7 +3080,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
  	if (!task)
  		goto out;
  
@@ -45998,7 +45593,7 @@ index 851ba3d..813fd0b 100644
  	put_task_struct(task);
  out:
  	return result;
-@@ -3083,6 +3149,11 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
+@@ -3016,6 +3149,11 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
  {
  	unsigned int nr;
  	struct task_struct *reaper;
@@ -46010,7 +45605,7 @@ index 851ba3d..813fd0b 100644
  	struct tgid_iter iter;
  	struct pid_namespace *ns;
  
-@@ -3106,8 +3177,27 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
+@@ -3039,8 +3177,27 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
  	for (iter = next_tgid(ns, iter);
  	     iter.task;
  	     iter.tgid += 1, iter = next_tgid(ns, iter)) {
@@ -46039,7 +45634,7 @@ index 851ba3d..813fd0b 100644
  			put_task_struct(iter.task);
  			goto out;
  		}
-@@ -3135,7 +3225,7 @@ static const struct pid_entry tid_base_stuff[] = {
+@@ -3068,7 +3225,7 @@ static const struct pid_entry tid_base_stuff[] = {
  	REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
  #endif
  	REG("comm",      S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
@@ -46048,7 +45643,7 @@ index 851ba3d..813fd0b 100644
  	INF("syscall",   S_IRUGO, proc_pid_syscall),
  #endif
  	INF("cmdline",   S_IRUGO, proc_pid_cmdline),
-@@ -3159,10 +3249,10 @@ static const struct pid_entry tid_base_stuff[] = {
+@@ -3092,10 +3249,10 @@ static const struct pid_entry tid_base_stuff[] = {
  #ifdef CONFIG_SECURITY
  	DIR("attr",      S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
  #endif
@@ -46267,7 +45862,7 @@ index f738024..876984a 100644
  	rcu_read_lock();
  	task = pid_task(proc_pid(dir), PIDTYPE_PID);
 diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
-index a6b6217..3d0953c 100644
+index a6b6217..1e0579d 100644
 --- a/fs/proc/proc_sysctl.c
 +++ b/fs/proc/proc_sysctl.c
 @@ -9,11 +9,13 @@
@@ -46301,7 +45896,20 @@ index a6b6217..3d0953c 100644
  out:
  	sysctl_head_finish(head);
  	return err;
-@@ -245,6 +253,9 @@ static int proc_sys_fill_cache(struct file *filp, void *dirent,
+@@ -163,6 +171,12 @@ static ssize_t proc_sys_call_handler(struct file *filp, void __user *buf,
+ 	if (!table->proc_handler)
+ 		goto out;
+ 
++#ifdef CONFIG_GRKERNSEC
++	error = -EPERM;
++	if (write && !capable(CAP_SYS_ADMIN))
++		goto out;
++#endif
++
+ 	/* careful: calling conventions are nasty here */
+ 	res = count;
+ 	error = table->proc_handler(table, write, buf, &res, ppos);
+@@ -245,6 +259,9 @@ static int proc_sys_fill_cache(struct file *filp, void *dirent,
  				return -ENOMEM;
  			} else {
  				d_set_d_op(child, &proc_sys_dentry_operations);
@@ -46311,7 +45919,7 @@ index a6b6217..3d0953c 100644
  				d_add(child, inode);
  			}
  		} else {
-@@ -273,6 +284,9 @@ static int scan(struct ctl_table_header *head, ctl_table *table,
+@@ -273,6 +290,9 @@ static int scan(struct ctl_table_header *head, ctl_table *table,
  		if (*pos < file->f_pos)
  			continue;
  
@@ -46321,7 +45929,7 @@ index a6b6217..3d0953c 100644
  		res = proc_sys_fill_cache(file, dirent, filldir, head, table);
  		if (res)
  			return res;
-@@ -398,6 +412,9 @@ static int proc_sys_getattr(struct vfsmount *mnt, struct dentry *dentry, struct
+@@ -398,6 +418,9 @@ static int proc_sys_getattr(struct vfsmount *mnt, struct dentry *dentry, struct
  	if (IS_ERR(head))
  		return PTR_ERR(head);
  
@@ -46331,7 +45939,7 @@ index a6b6217..3d0953c 100644
  	generic_fillattr(inode, stat);
  	if (table)
  		stat->mode = (stat->mode & S_IFMT) | table->mode;
-@@ -420,13 +437,13 @@ static const struct file_operations proc_sys_dir_file_operations = {
+@@ -420,13 +443,13 @@ static const struct file_operations proc_sys_dir_file_operations = {
  	.llseek		= generic_file_llseek,
  };
  
@@ -46368,7 +45976,7 @@ index 03102d9..4ae347e 100644
  }
  
 diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index e418c5a..e66a99c 100644
+index 7dcd2a2..d1d9cb6 100644
 --- a/fs/proc/task_mmu.c
 +++ b/fs/proc/task_mmu.c
 @@ -52,8 +52,13 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
@@ -46501,7 +46109,7 @@ index e418c5a..e66a99c 100644
  		   mss.resident >> 10,
  		   (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
  		   mss.shared_clean  >> 10,
-@@ -1033,7 +1064,7 @@ static int show_numa_map(struct seq_file *m, void *v)
+@@ -1036,7 +1067,7 @@ static int show_numa_map(struct seq_file *m, void *v)
  
  	if (file) {
  		seq_printf(m, " file=");
@@ -47156,10 +46764,10 @@ index 23ce927..e274cc1 100644
  		kfree(s);
 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
 new file mode 100644
-index 0000000..4639511
+index 0000000..fbe6950d9
 --- /dev/null
 +++ b/grsecurity/Kconfig
-@@ -0,0 +1,1051 @@
+@@ -0,0 +1,1067 @@
 +#
 +# grecurity configuration
 +#
@@ -47298,6 +46906,7 @@ index 0000000..4639511
 +	select GRKERNSEC_AUDIT_MOUNT
 +	select GRKERNSEC_MODHARDEN if (MODULES)
 +	select GRKERNSEC_HARDEN_PTRACE
++	select GRKERNSEC_PTRACE_READEXEC
 +	select GRKERNSEC_VM86 if (X86_32)
 +	select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC)
 +	select PAX
@@ -47960,6 +47569,21 @@ index 0000000..4639511
 +	  option is enabled, a sysctl option with name "harden_ptrace" is
 +	  created.
 +
++config GRKERNSEC_PTRACE_READEXEC
++	bool "Require read access to ptrace sensitive binaries"
++	help
++	  If you say Y here, read permission will be required by any unprivileged
++	  process to ptrace suid/sgid binaries.  Note that the ability to
++	  ptrace privileged binaries and retain that binary's privilege is
++	  already not possible.  This option is useful in environments that
++	  remove the read bits (e.g. file mode 4711) from suid binaries to
++	  prevent infoleaking of their contents.  What this option adds
++	  is consistency to the use of that file mode, as the binary could normally
++	  be read out when run without privileges while ptracing.
++
++	  If the sysctl option is enabled, a sysctl option with name "ptrace_readexec"
++	  is created.
++
 +config GRKERNSEC_SETXID
 +	bool "Enforce consistent multithreaded privileges"
 +	help
@@ -55137,10 +54761,10 @@ index 0000000..8ca18bf
 +}
 diff --git a/grsecurity/grsec_init.c b/grsecurity/grsec_init.c
 new file mode 100644
-index 0000000..cb8e5a1
+index 0000000..01ddde4
 --- /dev/null
 +++ b/grsecurity/grsec_init.c
-@@ -0,0 +1,273 @@
+@@ -0,0 +1,277 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/mm.h>
@@ -55150,6 +54774,7 @@ index 0000000..cb8e5a1
 +#include <linux/percpu.h>
 +#include <linux/module.h>
 +
++int grsec_enable_ptrace_readexec;
 +int grsec_enable_setxid;
 +int grsec_enable_brute;
 +int grsec_enable_link;
@@ -55303,6 +54928,9 @@ index 0000000..cb8e5a1
 +	grsec_enable_group = 1;
 +	grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
 +#endif
++#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
++	grsec_enable_ptrace_readexec = 1;
++#endif
 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
 +	grsec_enable_chdir = 1;
 +#endif
@@ -55942,14 +55570,14 @@ index 0000000..a3b12a0
 +}
 diff --git a/grsecurity/grsec_ptrace.c b/grsecurity/grsec_ptrace.c
 new file mode 100644
-index 0000000..472c1d6
+index 0000000..f7f29aa
 --- /dev/null
 +++ b/grsecurity/grsec_ptrace.c
-@@ -0,0 +1,14 @@
+@@ -0,0 +1,30 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/grinternal.h>
-+#include <linux/grsecurity.h>
++#include <linux/security.h>
 +
 +void
 +gr_audit_ptrace(struct task_struct *task)
@@ -55960,6 +55588,22 @@ index 0000000..472c1d6
 +#endif
 +	return;
 +}
++
++int
++gr_ptrace_readexec(struct file *file, int unsafe_flags)
++{
++#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
++	const struct dentry *dentry = file->f_path.dentry;
++	const struct vfsmount *mnt = file->f_path.mnt;
++
++	if (grsec_enable_ptrace_readexec && (unsafe_flags & LSM_UNSAFE_PTRACE) && 
++	    (inode_permission(dentry->d_inode, MAY_READ) || !gr_acl_handle_open(dentry, mnt, MAY_READ))) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_READEXEC_MSG, dentry, mnt);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
 diff --git a/grsecurity/grsec_sig.c b/grsecurity/grsec_sig.c
 new file mode 100644
 index 0000000..7a5b2de
@@ -56425,10 +56069,10 @@ index 0000000..4030d57
 +}
 diff --git a/grsecurity/grsec_sysctl.c b/grsecurity/grsec_sysctl.c
 new file mode 100644
-index 0000000..bceef2f
+index 0000000..a1aedd7
 --- /dev/null
 +++ b/grsecurity/grsec_sysctl.c
-@@ -0,0 +1,442 @@
+@@ -0,0 +1,451 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/sysctl.h>
@@ -56492,6 +56136,15 @@ index 0000000..bceef2f
 +		.proc_handler	= &proc_dointvec,
 +	},
 +#endif
++#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
++	{
++		.procname	= "ptrace_readexec",
++		.data		= &grsec_enable_ptrace_readexec,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
 +#ifdef CONFIG_GRKERNSEC_SETXID
 +	{
 +		.procname	= "consistent_setxid",
@@ -57645,20 +57298,10 @@ index fd88a39..f4d0bad 100644
  };
  
 diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
-index 94acd81..3ab569b 100644
+index 0ed1eb0..3ab569b 100644
 --- a/include/linux/blkdev.h
 +++ b/include/linux/blkdev.h
-@@ -675,6 +675,9 @@ extern int blk_insert_cloned_request(struct request_queue *q,
- 				     struct request *rq);
- extern void blk_delay_queue(struct request_queue *, unsigned long);
- extern void blk_recount_segments(struct request_queue *, struct bio *);
-+extern int scsi_verify_blk_ioctl(struct block_device *, unsigned int);
-+extern int scsi_cmd_blk_ioctl(struct block_device *, fmode_t,
-+			      unsigned int, void __user *);
- extern int scsi_cmd_ioctl(struct request_queue *, struct gendisk *, fmode_t,
- 			  unsigned int, void __user *);
- extern int sg_scsi_ioctl(struct request_queue *, struct gendisk *, fmode_t,
-@@ -1312,7 +1315,7 @@ struct block_device_operations {
+@@ -1315,7 +1315,7 @@ struct block_device_operations {
  	/* this callback is with swap_lock and sometimes page table lock held */
  	void (*swap_slot_free_notify) (struct block_device *, unsigned long);
  	struct module *owner;
@@ -58744,10 +58387,10 @@ index 0000000..b30e9bc
 +#endif
 diff --git a/include/linux/grinternal.h b/include/linux/grinternal.h
 new file mode 100644
-index 0000000..60cda84
+index 0000000..da390f1
 --- /dev/null
 +++ b/include/linux/grinternal.h
-@@ -0,0 +1,220 @@
+@@ -0,0 +1,221 @@
 +#ifndef __GRINTERNAL_H
 +#define __GRINTERNAL_H
 +
@@ -58784,6 +58427,7 @@ index 0000000..60cda84
 +char *gr_to_filename3(const struct dentry *dentry,
 +			    const struct vfsmount *mnt);
 +
++extern int grsec_enable_ptrace_readexec;
 +extern int grsec_enable_harden_ptrace;
 +extern int grsec_enable_link;
 +extern int grsec_enable_fifo;
@@ -58970,10 +58614,10 @@ index 0000000..60cda84
 +#endif
 diff --git a/include/linux/grmsg.h b/include/linux/grmsg.h
 new file mode 100644
-index 0000000..9d5fd4a
+index 0000000..cf49370
 --- /dev/null
 +++ b/include/linux/grmsg.h
-@@ -0,0 +1,108 @@
+@@ -0,0 +1,109 @@
 +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
 +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
 +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
@@ -59081,13 +58725,14 @@ index 0000000..9d5fd4a
 +#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
 +#define GR_VM86_MSG "denied use of vm86 by "
 +#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
++#define GR_PTRACE_READEXEC_MSG "denied ptrace of unreadable suid/sgid binary %.950s by "
 +#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
 diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
 new file mode 100644
-index 0000000..4620f36
+index 0000000..1ca3931
 --- /dev/null
 +++ b/include/linux/grsecurity.h
-@@ -0,0 +1,231 @@
+@@ -0,0 +1,233 @@
 +#ifndef GR_SECURITY_H
 +#define GR_SECURITY_H
 +#include <linux/fs.h>
@@ -59303,6 +58948,8 @@ index 0000000..4620f36
 +void gr_audit_ptrace(struct task_struct *task);
 +dev_t gr_get_dev_from_dentry(struct dentry *dentry);
 +
++int gr_ptrace_readexec(struct file *file, int unsafe_flags);
++
 +#ifdef CONFIG_GRKERNSEC
 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
 +void gr_handle_vm86(void);
@@ -61823,10 +61470,10 @@ index 444cd6b..3327cc5 100644
  	const struct firmware *dsp_microcode;
  	const struct firmware *controller_microcode;
 diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
-index 6873c7d..b1e8009 100644
+index a79886c..b483af6 100644
 --- a/include/target/target_core_base.h
 +++ b/include/target/target_core_base.h
-@@ -345,7 +345,7 @@ struct t10_reservation_ops {
+@@ -346,7 +346,7 @@ struct t10_reservation_ops {
  	int (*t10_seq_non_holder)(struct se_cmd *, unsigned char *, u32);
  	int (*t10_pr_register)(struct se_cmd *);
  	int (*t10_pr_clear)(struct se_cmd *);
@@ -61835,7 +61482,7 @@ index 6873c7d..b1e8009 100644
  
  struct t10_reservation {
  	/* Reservation effects all target ports */
-@@ -464,8 +464,8 @@ struct se_cmd {
+@@ -465,8 +465,8 @@ struct se_cmd {
  	atomic_t		t_se_count;
  	atomic_t		t_task_cdbs_left;
  	atomic_t		t_task_cdbs_ex_left;
@@ -61846,7 +61493,7 @@ index 6873c7d..b1e8009 100644
  	atomic_t		t_transport_active;
  	atomic_t		t_transport_complete;
  	atomic_t		t_transport_queue_active;
-@@ -703,7 +703,7 @@ struct se_device {
+@@ -704,7 +704,7 @@ struct se_device {
  	/* Active commands on this virtual SE device */
  	atomic_t		simple_cmds;
  	atomic_t		depth_left;
@@ -61922,7 +61569,7 @@ index 43298f9..2f56c12 100644
  	  Randomizing heap placement makes heap exploits harder, but it
  	  also breaks ancient binaries (including anything libc5 based).
 diff --git a/init/do_mounts.c b/init/do_mounts.c
-index 0f6e1d9..89d0af4 100644
+index db6e5ee..7677ff7 100644
 --- a/init/do_mounts.c
 +++ b/init/do_mounts.c
 @@ -325,11 +325,11 @@ static void __init get_fs_names(char *page)
@@ -61939,7 +61586,7 @@ index 0f6e1d9..89d0af4 100644
  	ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
  	printk(KERN_INFO
  	       "VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
-@@ -421,18 +421,18 @@ void __init change_floppy(char *fmt, ...)
+@@ -448,18 +448,18 @@ void __init change_floppy(char *fmt, ...)
  	va_start(args, fmt);
  	vsprintf(buf, fmt, args);
  	va_end(args);
@@ -61961,7 +61608,7 @@ index 0f6e1d9..89d0af4 100644
  		termios.c_lflag |= ICANON;
  		sys_ioctl(fd, TCSETSF, (long)&termios);
  		sys_close(fd);
-@@ -526,6 +526,6 @@ void __init prepare_namespace(void)
+@@ -553,6 +553,6 @@ void __init prepare_namespace(void)
  	mount_root();
  out:
  	devtmpfs_mount("dev");
@@ -62412,7 +62059,7 @@ index 5215a81..cfc0cac 100644
  	sem_params.flg = semflg;
  	sem_params.u.nsems = nsems;
 diff --git a/ipc/shm.c b/ipc/shm.c
-index 02ecf2c..be05b1e 100644
+index b76be5b..859e750 100644
 --- a/ipc/shm.c
 +++ b/ipc/shm.c
 @@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp);
@@ -62470,16 +62117,7 @@ index 02ecf2c..be05b1e 100644
  	shm_params.key = key;
  	shm_params.flg = shmflg;
  	shm_params.u.size = size;
-@@ -870,8 +887,6 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf)
- 	case SHM_LOCK:
- 	case SHM_UNLOCK:
- 	{
--		struct file *uninitialized_var(shm_file);
--
- 		lru_add_drain_all();  /* drain pagevecs to lru lists */
- 
- 		shp = shm_lock_check(ns, shmid);
-@@ -981,6 +996,12 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
+@@ -988,6 +1005,12 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
  		f_mode = FMODE_READ | FMODE_WRITE;
  	}
  	if (shmflg & SHM_EXEC) {
@@ -62492,7 +62130,7 @@ index 02ecf2c..be05b1e 100644
  		prot |= PROT_EXEC;
  		acc_mode |= S_IXUGO;
  	}
-@@ -1004,9 +1025,21 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
+@@ -1011,9 +1034,21 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
  	if (err)
  		goto out_unlock;
  
@@ -63942,7 +63580,7 @@ index a4bea97..7a1ae9a 100644
  		/*
  		 * If ret is 0, either ____call_usermodehelper failed and the
 diff --git a/kernel/kprobes.c b/kernel/kprobes.c
-index e5d8464..4cc8cf0 100644
+index 52fd049..3def6a8 100644
 --- a/kernel/kprobes.c
 +++ b/kernel/kprobes.c
 @@ -185,7 +185,7 @@ static kprobe_opcode_t __kprobes *__get_insn_slot(struct kprobe_insn_cache *c)
@@ -66872,7 +66510,7 @@ index 16fc34a..efd8bb8 100644
  	ret = -EIO;
  	bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index b1e8943..369e4ff 100644
+index 25b4f4d..6f4772d 100644
 --- a/kernel/trace/ftrace.c
 +++ b/kernel/trace/ftrace.c
 @@ -1587,12 +1587,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
@@ -66895,7 +66533,7 @@ index b1e8943..369e4ff 100644
  }
  
  /*
-@@ -2609,7 +2614,7 @@ static void ftrace_free_entry_rcu(struct rcu_head *rhp)
+@@ -2608,7 +2613,7 @@ static void ftrace_free_entry_rcu(struct rcu_head *rhp)
  
  int
  register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
@@ -67431,10 +67069,10 @@ index 011b110..b492af2 100644
  	  from userspace allocation.  Keeping a user from writing to low pages
  	  can help reduce the impact of kernel NULL pointer bugs.
 diff --git a/mm/filemap.c b/mm/filemap.c
-index 5f0a3c9..4f87f0c 100644
+index 90286a4..f441caa 100644
 --- a/mm/filemap.c
 +++ b/mm/filemap.c
-@@ -1784,7 +1784,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
+@@ -1770,7 +1770,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
  	struct address_space *mapping = file->f_mapping;
  
  	if (!mapping->a_ops->readpage)
@@ -67443,7 +67081,7 @@ index 5f0a3c9..4f87f0c 100644
  	file_accessed(file);
  	vma->vm_ops = &generic_file_vm_ops;
  	vma->vm_flags |= VM_CAN_NONLINEAR;
-@@ -2190,6 +2190,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i
+@@ -2176,6 +2176,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i
                          *pos = i_size_read(inode);
  
  		if (limit != RLIM_INFINITY) {
@@ -70236,7 +69874,7 @@ index b982290..7d73f53 100644
  	new->vm_region = region;
  
 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 2b8ba3a..386d603 100644
+index 485be89..c059ad3 100644
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
 @@ -341,7 +341,7 @@ out:
@@ -70450,7 +70088,7 @@ index a4fd368..e0ffec7 100644
  	struct anon_vma_chain *avc;
  	struct anon_vma *anon_vma;
 diff --git a/mm/shmem.c b/mm/shmem.c
-index d672250..2b233c1 100644
+index 6c253f7..367e20a 100644
 --- a/mm/shmem.c
 +++ b/mm/shmem.c
 @@ -31,7 +31,7 @@
@@ -70471,7 +70109,7 @@ index d672250..2b233c1 100644
  
  struct shmem_xattr {
  	struct list_head list;	/* anchored by shmem_inode_info->xattr_list */
-@@ -2155,8 +2155,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
+@@ -2180,8 +2180,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
  	int err = -ENOMEM;
  
  	/* Round up to L1_CACHE_BYTES to resist false sharing */
@@ -71008,7 +70646,7 @@ index 8105be4..579da9d 100644
  EXPORT_SYMBOL(kmem_cache_free);
  
 diff --git a/mm/slub.c b/mm/slub.c
-index ed3334d..1739c9b 100644
+index 1a919f0..1739c9b 100644
 --- a/mm/slub.c
 +++ b/mm/slub.c
 @@ -208,7 +208,7 @@ struct track {
@@ -71029,19 +70667,7 @@ index ed3334d..1739c9b 100644
  		s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
  #ifdef CONFIG_STACKTRACE
  	{
-@@ -2166,6 +2166,11 @@ redo:
- 		goto new_slab;
- 	}
- 
-+	/* must check again c->freelist in case of cpu migration or IRQ */
-+	object = c->freelist;
-+	if (object)
-+		goto load_freelist;
-+
- 	stat(s, ALLOC_SLOWPATH);
- 
- 	do {
-@@ -2554,6 +2559,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
+@@ -2559,6 +2559,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
  
  	page = virt_to_head_page(x);
  
@@ -71050,7 +70676,7 @@ index ed3334d..1739c9b 100644
  	slab_free(s, page, x, _RET_IP_);
  
  	trace_kmem_cache_free(_RET_IP_, x);
-@@ -2587,7 +2594,7 @@ static int slub_min_objects;
+@@ -2592,7 +2594,7 @@ static int slub_min_objects;
   * Merge control. If this is set then no merging of slab caches will occur.
   * (Could be removed. This was introduced to pacify the merge skeptics.)
   */
@@ -71059,7 +70685,7 @@ index ed3334d..1739c9b 100644
  
  /*
   * Calculate the order of allocation given an slab object size.
-@@ -3037,7 +3044,7 @@ static int kmem_cache_open(struct kmem_cache *s,
+@@ -3042,7 +3044,7 @@ static int kmem_cache_open(struct kmem_cache *s,
  	else
  		s->cpu_partial = 30;
  
@@ -71068,7 +70694,7 @@ index ed3334d..1739c9b 100644
  #ifdef CONFIG_NUMA
  	s->remote_node_defrag_ratio = 1000;
  #endif
-@@ -3141,8 +3148,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
+@@ -3146,8 +3148,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
  void kmem_cache_destroy(struct kmem_cache *s)
  {
  	down_write(&slub_lock);
@@ -71078,7 +70704,7 @@ index ed3334d..1739c9b 100644
  		list_del(&s->list);
  		up_write(&slub_lock);
  		if (kmem_cache_close(s)) {
-@@ -3353,6 +3359,50 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
+@@ -3358,6 +3359,50 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
  EXPORT_SYMBOL(__kmalloc_node);
  #endif
  
@@ -71129,7 +70755,7 @@ index ed3334d..1739c9b 100644
  size_t ksize(const void *object)
  {
  	struct page *page;
-@@ -3627,7 +3677,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
+@@ -3632,7 +3677,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
  	int node;
  
  	list_add(&s->list, &slab_caches);
@@ -71138,7 +70764,7 @@ index ed3334d..1739c9b 100644
  
  	for_each_node_state(node, N_NORMAL_MEMORY) {
  		struct kmem_cache_node *n = get_node(s, node);
-@@ -3744,17 +3794,17 @@ void __init kmem_cache_init(void)
+@@ -3749,17 +3794,17 @@ void __init kmem_cache_init(void)
  
  	/* Caches that are not of the two-to-the-power-of size */
  	if (KMALLOC_MIN_SIZE <= 32) {
@@ -71159,7 +70785,7 @@ index ed3334d..1739c9b 100644
  		caches++;
  	}
  
-@@ -3822,7 +3872,7 @@ static int slab_unmergeable(struct kmem_cache *s)
+@@ -3827,7 +3872,7 @@ static int slab_unmergeable(struct kmem_cache *s)
  	/*
  	 * We may have set a slab to be unmergeable during bootstrap.
  	 */
@@ -71168,7 +70794,7 @@ index ed3334d..1739c9b 100644
  		return 1;
  
  	return 0;
-@@ -3881,7 +3931,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+@@ -3886,7 +3931,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
  	down_write(&slub_lock);
  	s = find_mergeable(size, align, flags, name, ctor);
  	if (s) {
@@ -71177,7 +70803,7 @@ index ed3334d..1739c9b 100644
  		/*
  		 * Adjust the object sizes so that we clear
  		 * the complete object on kzalloc.
-@@ -3890,7 +3940,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+@@ -3895,7 +3940,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
  		s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
  
  		if (sysfs_slab_alias(s, name)) {
@@ -71186,7 +70812,7 @@ index ed3334d..1739c9b 100644
  			goto err;
  		}
  		up_write(&slub_lock);
-@@ -4018,7 +4068,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
+@@ -4023,7 +4068,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
  }
  #endif
  
@@ -71195,7 +70821,7 @@ index ed3334d..1739c9b 100644
  static int count_inuse(struct page *page)
  {
  	return page->inuse;
-@@ -4405,12 +4455,12 @@ static void resiliency_test(void)
+@@ -4410,12 +4455,12 @@ static void resiliency_test(void)
  	validate_slab_cache(kmalloc_caches[9]);
  }
  #else
@@ -71210,7 +70836,7 @@ index ed3334d..1739c9b 100644
  enum slab_stat_type {
  	SL_ALL,			/* All slabs */
  	SL_PARTIAL,		/* Only partially allocated slabs */
-@@ -4651,7 +4701,7 @@ SLAB_ATTR_RO(ctor);
+@@ -4656,7 +4701,7 @@ SLAB_ATTR_RO(ctor);
  
  static ssize_t aliases_show(struct kmem_cache *s, char *buf)
  {
@@ -71219,7 +70845,7 @@ index ed3334d..1739c9b 100644
  }
  SLAB_ATTR_RO(aliases);
  
-@@ -5218,6 +5268,7 @@ static char *create_unique_id(struct kmem_cache *s)
+@@ -5223,6 +5268,7 @@ static char *create_unique_id(struct kmem_cache *s)
  	return name;
  }
  
@@ -71227,7 +70853,7 @@ index ed3334d..1739c9b 100644
  static int sysfs_slab_add(struct kmem_cache *s)
  {
  	int err;
-@@ -5280,6 +5331,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
+@@ -5285,6 +5331,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
  	kobject_del(&s->kobj);
  	kobject_put(&s->kobj);
  }
@@ -71235,7 +70861,7 @@ index ed3334d..1739c9b 100644
  
  /*
   * Need to buffer aliases during bootup until sysfs becomes
-@@ -5293,6 +5345,7 @@ struct saved_alias {
+@@ -5298,6 +5345,7 @@ struct saved_alias {
  
  static struct saved_alias *alias_list;
  
@@ -71243,7 +70869,7 @@ index ed3334d..1739c9b 100644
  static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  {
  	struct saved_alias *al;
-@@ -5315,6 +5368,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
+@@ -5320,6 +5368,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  	alias_list = al;
  	return 0;
  }
@@ -73656,7 +73282,7 @@ index 1e733e9..3d73c9f 100644
  	return res;
  }
 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index ea10a51..9a4f0cc 100644
+index 73495f1..ad51356 100644
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
 @@ -27,6 +27,7 @@
@@ -73667,7 +73293,7 @@ index ea10a51..9a4f0cc 100644
  #include "key.h"
  #include "sta_info.h"
  
-@@ -761,7 +762,7 @@ struct ieee80211_local {
+@@ -764,7 +765,7 @@ struct ieee80211_local {
  	/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
  	spinlock_t queue_stop_reason_lock;
  
@@ -73735,10 +73361,10 @@ index 30d7355..e260095 100644
  			napi_disable(&local->napi);
  		ieee80211_clear_tx_pending(local);
 diff --git a/net/mac80211/main.c b/net/mac80211/main.c
-index cae4435..76e3372 100644
+index a7536fd..4039cc0 100644
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -209,7 +209,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
+@@ -163,7 +163,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
  		local->hw.conf.power_level = power;
  	}
  
@@ -76460,7 +76086,7 @@ index 3ccf7ac..d73ad64 100644
  };
  extern struct ima_h_table ima_htable;
 diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
-index 0d50df0..e94dd2a 100644
+index 88a2788..581ab92 100644
 --- a/security/integrity/ima/ima_api.c
 +++ b/security/integrity/ima/ima_api.c
 @@ -75,7 +75,7 @@ void ima_add_violation(struct inode *inode, const unsigned char *filename,
@@ -76511,10 +76137,10 @@ index e1aa2b4..52027bf 100644
  }
  
 diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
-index 8e28f04..d5951b1 100644
+index 55a6271..ad829c3 100644
 --- a/security/integrity/ima/ima_queue.c
 +++ b/security/integrity/ima/ima_queue.c
-@@ -79,7 +79,7 @@ static int ima_add_digest_entry(struct ima_template_entry *entry)
+@@ -81,7 +81,7 @@ static int ima_add_digest_entry(struct ima_template_entry *entry)
  	INIT_LIST_HEAD(&qe->later);
  	list_add_tail_rcu(&qe->later, &ima_measurements);
  
diff --git a/main/linux-grsec/kernelconfig.x86 b/main/linux-grsec/kernelconfig.x86
index 9711293865..9ba8e66787 100644
--- a/main/linux-grsec/kernelconfig.x86
+++ b/main/linux-grsec/kernelconfig.x86
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/i386 3.2.1 Kernel Configuration
+# Linux/i386 3.2.2 Kernel Configuration
 #
 # CONFIG_64BIT is not set
 CONFIG_X86_32=y
@@ -5171,6 +5171,7 @@ CONFIG_GRKERNSEC_PROC_IPADDR=y
 #
 # CONFIG_GRKERNSEC_DMESG is not set
 CONFIG_GRKERNSEC_HARDEN_PTRACE=y
+CONFIG_GRKERNSEC_PTRACE_READEXEC=y
 CONFIG_GRKERNSEC_SETXID=y
 # CONFIG_GRKERNSEC_TPE is not set
 
diff --git a/main/linux-grsec/kernelconfig.x86_64 b/main/linux-grsec/kernelconfig.x86_64
index 433702e715..5fe9f305b7 100644
--- a/main/linux-grsec/kernelconfig.x86_64
+++ b/main/linux-grsec/kernelconfig.x86_64
@@ -5144,6 +5144,7 @@ CONFIG_GRKERNSEC_PROC_IPADDR=y
 #
 # CONFIG_GRKERNSEC_DMESG is not set
 CONFIG_GRKERNSEC_HARDEN_PTRACE=y
+CONFIG_GRKERNSEC_PTRACE_READEXEC=y
 CONFIG_GRKERNSEC_SETXID=y
 # CONFIG_GRKERNSEC_TPE is not set