diff options
| -rw-r--r-- | main/linux-grsec/APKBUILD | 16 | ||||
| -rw-r--r-- | main/linux-grsec/grsecurity-3.0-3.14.10-201407012152.patch (renamed from main/linux-grsec/grsecurity-3.0-3.14.8-201406222110.patch) | 767 |
2 files changed, 379 insertions, 404 deletions
diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD index 8a7b82a8e1..a9dad4e95e 100644 --- a/main/linux-grsec/APKBUILD +++ b/main/linux-grsec/APKBUILD @@ -2,7 +2,7 @@ _flavor=grsec pkgname=linux-${_flavor} -pkgver=3.14.8 +pkgver=3.14.10 case $pkgver in *.*.*) _kernver=${pkgver%.*};; *.*) _kernver=${pkgver};; @@ -17,7 +17,7 @@ _config=${config:-kernelconfig.${CARCH}} install= source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz - grsecurity-3.0-3.14.8-201406222110.patch + grsecurity-3.0-3.14.10-201407012152.patch fix-memory-map-for-PIE-applications.patch imx6q-no-unclocked-sleep.patch @@ -165,24 +165,24 @@ dev() { } md5sums="b621207b3f6ecbb67db18b13258f8ea8 linux-3.14.tar.xz -f612535d2c5d954b5e885757c387ae54 patch-3.14.8.xz -a0519c8c05be0bf6a06e9c4b8fba680b grsecurity-3.0-3.14.8-201406222110.patch +13d435d77d719cd845fb82627aa07974 patch-3.14.10.xz +e43935611420bfaa55f68ba32d43be58 grsecurity-3.0-3.14.10-201407012152.patch c6a4ae7e8ca6159e1631545515805216 fix-memory-map-for-PIE-applications.patch 1a307fc1d63231bf01d22493a4f14378 imx6q-no-unclocked-sleep.patch 83f0e1b1d2413bcb2dddcf87a10dc42b kernelconfig.x86 0b07cc6ece6232c631e2d55f2dd860d6 kernelconfig.x86_64 887980f603af6a1ac6f67edeae2e0d07 kernelconfig.armhf" sha256sums="61558aa490855f42b6340d1a1596be47454909629327c49a5e4e10268065dffa linux-3.14.tar.xz -0edab0f772836162e5e57ef294d83e88153c15a12f394914c6a25b49e408e8f1 patch-3.14.8.xz -8acb478a24bd57145dc1524d8f2e4e1b9cc0de652b373a1eb9535e0c41385949 grsecurity-3.0-3.14.8-201406222110.patch +e93bcbbd4568449e771f420ddd281a797b8df92ff265d59f849c3f53172fd95e patch-3.14.10.xz +a16bb425114a1e19296d6daed4daed821df3177881de17f2e529cf4f09012984 grsecurity-3.0-3.14.10-201407012152.patch 500f3577310be52e87b9fecdc2e9c4ca43210fd97d69089f9005d484563f74c7 fix-memory-map-for-PIE-applications.patch 21179fbb22a5b74af0a609350ae1a170e232908572b201d02e791d2ce0a685d3 imx6q-no-unclocked-sleep.patch 5431d66b9c1af413b4dc6f91de00a6e830e3d780a79c5f85d2d8b013b151c169 kernelconfig.x86 9f420cee74896fd3578c3b342188438ac5d6b0f327586c108367abcfc3f1e6ff kernelconfig.x86_64 ab3e07f85f4dd090b2d22b485881031bd479a1c34fc9a2e9707cb8cdebfcfda4 kernelconfig.armhf" sha512sums="5730d83a7a81134c1e77c0bf89e42dee4f8251ad56c1ac2be20c59e26fdfaa7bea55f277e7af156b637f22e1584914a46089af85039177cb43485089c74ac26e linux-3.14.tar.xz -a71fdb5391d664ecccef6602df638588e6202992415a788ad85fab9878ec6b76034c37de824069cfc6d6d502a1fab0eba98c69170f410d28951335e19d94db72 patch-3.14.8.xz -4a8ef5cc67205d12721e40738551672afc6d1041509143969b043da476afdac09cc39a468ddb511bda8c1cc376c3c336d33e4333eebea773831b28b637c66099 grsecurity-3.0-3.14.8-201406222110.patch +807783caa9ff492b936b1deef2da96bfb4af5429adc4810de66fbc709ab1a707e26c03edb66a10e429ad5038697c0d522d7f63075382db5d65f622f727be5452 patch-3.14.10.xz +1d12d3ee7d37ecc5eafefa5866c2910f53be22019c1de538de279527c63e0c4855c07c29d4b55dfdb9aacd9c9d830cfae8acef456c04566ff1967d593d15d377 grsecurity-3.0-3.14.10-201407012152.patch 4665c56ae1bbac311f9205d64918e84ee8b01d47d6e2396ff6b8adfb10aada7f7254531ce62e31edbb65c2a54a830f09ad05d314dfcd75d6272f4068945ad7c7 fix-memory-map-for-PIE-applications.patch 87d1ad59732f265a5b0db54490dc1762c14ea4b868e7eb1aedc3ce57b48046de7bbc08cf5cfcf6f1380fa84063b0edb16ba3d5e3c5670be9bbb229275c88b221 imx6q-no-unclocked-sleep.patch 03f817222bf5812fa8363542e4ab108767212c67efe3994ea8fe9d0751215d9c3f166ce41de41f9070c855db6c04606828dc61265a1738920b984a24077347c4 kernelconfig.x86 diff --git a/main/linux-grsec/grsecurity-3.0-3.14.8-201406222110.patch b/main/linux-grsec/grsecurity-3.0-3.14.10-201407012152.patch index aeeb2f060e..ba8d0ddfdd 100644 --- a/main/linux-grsec/grsecurity-3.0-3.14.8-201406222110.patch +++ b/main/linux-grsec/grsecurity-3.0-3.14.10-201407012152.patch @@ -287,7 +287,7 @@ index 7116fda..d8ed6e8 100644 pcd. [PARIDE] diff --git a/Makefile b/Makefile -index ef1d59b..7030652 100644 +index bd5d673..00eaa40 100644 --- a/Makefile +++ b/Makefile @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -2956,11 +2956,23 @@ index 4693188..4596c5e 100644 static int (*invoke_psci_fn)(u32, u32, u32, u32); diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c -index 0dd3b79..e018f64 100644 +index 0dd3b79..b67388e 100644 --- a/arch/arm/kernel/ptrace.c +++ b/arch/arm/kernel/ptrace.c -@@ -929,10 +929,19 @@ static int tracehook_report_syscall(struct pt_regs *regs, - return current_thread_info()->syscall; +@@ -908,7 +908,7 @@ enum ptrace_syscall_dir { + PTRACE_SYSCALL_EXIT, + }; + +-static int tracehook_report_syscall(struct pt_regs *regs, ++static void tracehook_report_syscall(struct pt_regs *regs, + enum ptrace_syscall_dir dir) + { + unsigned long ip; +@@ -926,19 +926,29 @@ static int tracehook_report_syscall(struct pt_regs *regs, + current_thread_info()->syscall = -1; + + regs->ARM_ip = ip; +- return current_thread_info()->syscall; } +#ifdef CONFIG_GRKERNSEC_SETXID @@ -2979,6 +2991,15 @@ index 0dd3b79..e018f64 100644 /* Do the secure computing check first; failures should be fast. */ if (secure_computing(scno) == -1) return -1; + + if (test_thread_flag(TIF_SYSCALL_TRACE)) +- scno = tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER); ++ tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER); ++ ++ scno = current_thread_info()->syscall; + + if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) + trace_sys_enter(regs, scno); diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c index 1e8b030..37c3022 100644 --- a/arch/arm/kernel/setup.c @@ -5437,10 +5458,10 @@ index 7225dad..2a7c8256 100644 /* * If for any reason at all we couldn't handle the fault, make diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c -index 68232db..6ca80af 100644 +index 76069c1..c2aa816 100644 --- a/arch/ia64/mm/hugetlbpage.c +++ b/arch/ia64/mm/hugetlbpage.c -@@ -154,6 +154,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u +@@ -149,6 +149,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u unsigned long pgoff, unsigned long flags) { struct vm_unmapped_area_info info; @@ -5448,7 +5469,7 @@ index 68232db..6ca80af 100644 if (len > RGN_MAP_LIMIT) return -ENOMEM; -@@ -177,6 +178,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u +@@ -172,6 +173,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u info.high_limit = HPAGE_REGION_BASE + RGN_MAP_LIMIT; info.align_mask = PAGE_MASK & (HPAGE_SIZE - 1); info.align_offset = 0; @@ -5551,10 +5572,10 @@ index 2d6f0de..de5f5ac 100644 #define smp_load_acquire(p) \ diff --git a/arch/metag/mm/hugetlbpage.c b/arch/metag/mm/hugetlbpage.c -index 0424315..defcca9 100644 +index 3c52fa6..11b2ad8 100644 --- a/arch/metag/mm/hugetlbpage.c +++ b/arch/metag/mm/hugetlbpage.c -@@ -205,6 +205,7 @@ hugetlb_get_unmapped_area_new_pmd(unsigned long len) +@@ -200,6 +200,7 @@ hugetlb_get_unmapped_area_new_pmd(unsigned long len) info.high_limit = TASK_SIZE; info.align_mask = PAGE_MASK & HUGEPT_MASK; info.align_offset = 0; @@ -12213,7 +12234,7 @@ index c4d3da6..1aed043 100644 if (write && !pmd_write(pmd)) diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c -index 9bd9ce8..dc84852 100644 +index d329537..2c3746a 100644 --- a/arch/sparc/mm/hugetlbpage.c +++ b/arch/sparc/mm/hugetlbpage.c @@ -25,8 +25,10 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *filp, @@ -12485,10 +12506,10 @@ index b6cde32..c0cb736 100644 else copy_from_user_overflow(); diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c -index 0cb3bba..7338b2d 100644 +index e514899..f8743c4 100644 --- a/arch/tile/mm/hugetlbpage.c +++ b/arch/tile/mm/hugetlbpage.c -@@ -212,6 +212,7 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file, +@@ -207,6 +207,7 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file, info.high_limit = TASK_SIZE; info.align_mask = PAGE_MASK & ~huge_page_mask(h); info.align_offset = 0; @@ -12496,7 +12517,7 @@ index 0cb3bba..7338b2d 100644 return vm_unmapped_area(&info); } -@@ -229,6 +230,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file, +@@ -224,6 +225,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file, info.high_limit = current->mm->mmap_base; info.align_mask = PAGE_MASK & ~huge_page_mask(h); info.align_offset = 0; @@ -12622,7 +12643,7 @@ index ad8f795..2c7eec6 100644 /* * Memory returned by kmalloc() may be used for DMA, so we must make diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 0af5250..59f9597 100644 +index 1981dd9..8f3ff4d 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -126,7 +126,7 @@ config X86 @@ -22468,7 +22489,7 @@ index 01d1c18..8073693 100644 #include <asm/processor.h> #include <asm/fcntl.h> diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S -index a2a4f46..6cab058 100644 +index 6491353..a918952 100644 --- a/arch/x86/kernel/entry_32.S +++ b/arch/x86/kernel/entry_32.S @@ -177,13 +177,153 @@ @@ -22745,7 +22766,7 @@ index a2a4f46..6cab058 100644 testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp) jnz sysenter_audit sysenter_do_call: -@@ -441,12 +613,24 @@ sysenter_do_call: +@@ -442,12 +614,24 @@ sysenter_after_call: testl $_TIF_ALLWORK_MASK, %ecx jne sysexit_audit sysenter_exit: @@ -22770,7 +22791,7 @@ index a2a4f46..6cab058 100644 PTGS_TO_GS ENABLE_INTERRUPTS_SYSEXIT -@@ -463,6 +647,9 @@ sysenter_audit: +@@ -464,6 +648,9 @@ sysenter_audit: movl %eax,%edx /* 2nd arg: syscall number */ movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */ call __audit_syscall_entry @@ -22780,7 +22801,7 @@ index a2a4f46..6cab058 100644 pushl_cfi %ebx movl PT_EAX(%esp),%eax /* reload syscall number */ jmp sysenter_do_call -@@ -488,10 +675,16 @@ sysexit_audit: +@@ -489,10 +676,16 @@ sysexit_audit: CFI_ENDPROC .pushsection .fixup,"ax" @@ -22799,7 +22820,7 @@ index a2a4f46..6cab058 100644 PTGS_TO_GS_EX ENDPROC(ia32_sysenter_target) -@@ -506,6 +699,11 @@ ENTRY(system_call) +@@ -507,6 +700,11 @@ ENTRY(system_call) pushl_cfi %eax # save orig_eax SAVE_ALL GET_THREAD_INFO(%ebp) @@ -22811,7 +22832,7 @@ index a2a4f46..6cab058 100644 # system call tracing in operation / emulation testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp) jnz syscall_trace_entry -@@ -524,6 +722,15 @@ syscall_exit: +@@ -525,6 +723,15 @@ syscall_exit: testl $_TIF_ALLWORK_MASK, %ecx # current->work jne syscall_exit_work @@ -22827,7 +22848,7 @@ index a2a4f46..6cab058 100644 restore_all: TRACE_IRQS_IRET restore_all_notrace: -@@ -580,14 +787,34 @@ ldt_ss: +@@ -576,14 +783,34 @@ ldt_ss: * compensating for the offset by changing to the ESPFIX segment with * a base address that matches for the difference. */ @@ -22865,7 +22886,7 @@ index a2a4f46..6cab058 100644 pushl_cfi $__ESPFIX_SS pushl_cfi %eax /* new kernel esp */ /* Disable interrupts, but do not irqtrace this section: we -@@ -616,20 +843,18 @@ work_resched: +@@ -612,20 +839,18 @@ work_resched: movl TI_flags(%ebp), %ecx andl $_TIF_WORK_MASK, %ecx # is there any work to be done other # than syscall tracing? @@ -22888,7 +22909,7 @@ index a2a4f46..6cab058 100644 #endif TRACE_IRQS_ON ENABLE_INTERRUPTS(CLBR_NONE) -@@ -650,7 +875,7 @@ work_notifysig_v86: +@@ -646,7 +871,7 @@ work_notifysig_v86: movl %eax, %esp jmp 1b #endif @@ -22897,7 +22918,7 @@ index a2a4f46..6cab058 100644 # perform syscall exit tracing ALIGN -@@ -658,11 +883,14 @@ syscall_trace_entry: +@@ -654,11 +879,14 @@ syscall_trace_entry: movl $-ENOSYS,PT_EAX(%esp) movl %esp, %eax call syscall_trace_enter @@ -22913,7 +22934,7 @@ index a2a4f46..6cab058 100644 # perform syscall exit tracing ALIGN -@@ -675,21 +903,25 @@ syscall_exit_work: +@@ -671,26 +899,30 @@ syscall_exit_work: movl %esp, %eax call syscall_trace_leave jmp resume_userspace @@ -22936,13 +22957,19 @@ index a2a4f46..6cab058 100644 syscall_badsys: movl $-ENOSYS,PT_EAX(%esp) - jmp resume_userspace + jmp syscall_exit -END(syscall_badsys) +ENDPROC(syscall_badsys) + + sysenter_badsys: + movl $-ENOSYS,PT_EAX(%esp) + jmp sysenter_after_call +-END(syscall_badsys) ++ENDPROC(sysenter_badsys) CFI_ENDPROC /* * End of kprobes section -@@ -705,8 +937,15 @@ END(syscall_badsys) +@@ -706,8 +938,15 @@ END(syscall_badsys) * normal stack and adjusts ESP with the matching offset. */ /* fixup the stack */ @@ -22960,7 +22987,7 @@ index a2a4f46..6cab058 100644 shl $16, %eax addl %esp, %eax /* the adjusted stack pointer */ pushl_cfi $__KERNEL_DS -@@ -759,7 +998,7 @@ vector=vector+1 +@@ -760,7 +999,7 @@ vector=vector+1 .endr 2: jmp common_interrupt .endr @@ -22969,7 +22996,7 @@ index a2a4f46..6cab058 100644 .previous END(interrupt) -@@ -820,7 +1059,7 @@ ENTRY(coprocessor_error) +@@ -821,7 +1060,7 @@ ENTRY(coprocessor_error) pushl_cfi $do_coprocessor_error jmp error_code CFI_ENDPROC @@ -22978,7 +23005,7 @@ index a2a4f46..6cab058 100644 ENTRY(simd_coprocessor_error) RING0_INT_FRAME -@@ -833,7 +1072,7 @@ ENTRY(simd_coprocessor_error) +@@ -834,7 +1073,7 @@ ENTRY(simd_coprocessor_error) .section .altinstructions,"a" altinstruction_entry 661b, 663f, X86_FEATURE_XMM, 662b-661b, 664f-663f .previous @@ -22987,7 +23014,7 @@ index a2a4f46..6cab058 100644 663: pushl $do_simd_coprocessor_error 664: .previous -@@ -842,7 +1081,7 @@ ENTRY(simd_coprocessor_error) +@@ -843,7 +1082,7 @@ ENTRY(simd_coprocessor_error) #endif jmp error_code CFI_ENDPROC @@ -22996,7 +23023,7 @@ index a2a4f46..6cab058 100644 ENTRY(device_not_available) RING0_INT_FRAME -@@ -851,18 +1090,18 @@ ENTRY(device_not_available) +@@ -852,18 +1091,18 @@ ENTRY(device_not_available) pushl_cfi $do_device_not_available jmp error_code CFI_ENDPROC @@ -23018,7 +23045,7 @@ index a2a4f46..6cab058 100644 #endif ENTRY(overflow) -@@ -872,7 +1111,7 @@ ENTRY(overflow) +@@ -873,7 +1112,7 @@ ENTRY(overflow) pushl_cfi $do_overflow jmp error_code CFI_ENDPROC @@ -23027,7 +23054,7 @@ index a2a4f46..6cab058 100644 ENTRY(bounds) RING0_INT_FRAME -@@ -881,7 +1120,7 @@ ENTRY(bounds) +@@ -882,7 +1121,7 @@ ENTRY(bounds) pushl_cfi $do_bounds jmp error_code CFI_ENDPROC @@ -23036,7 +23063,7 @@ index a2a4f46..6cab058 100644 ENTRY(invalid_op) RING0_INT_FRAME -@@ -890,7 +1129,7 @@ ENTRY(invalid_op) +@@ -891,7 +1130,7 @@ ENTRY(invalid_op) pushl_cfi $do_invalid_op jmp error_code CFI_ENDPROC @@ -23045,7 +23072,7 @@ index a2a4f46..6cab058 100644 ENTRY(coprocessor_segment_overrun) RING0_INT_FRAME -@@ -899,7 +1138,7 @@ ENTRY(coprocessor_segment_overrun) +@@ -900,7 +1139,7 @@ ENTRY(coprocessor_segment_overrun) pushl_cfi $do_coprocessor_segment_overrun jmp error_code CFI_ENDPROC @@ -23054,7 +23081,7 @@ index a2a4f46..6cab058 100644 ENTRY(invalid_TSS) RING0_EC_FRAME -@@ -907,7 +1146,7 @@ ENTRY(invalid_TSS) +@@ -908,7 +1147,7 @@ ENTRY(invalid_TSS) pushl_cfi $do_invalid_TSS jmp error_code CFI_ENDPROC @@ -23063,7 +23090,7 @@ index a2a4f46..6cab058 100644 ENTRY(segment_not_present) RING0_EC_FRAME -@@ -915,7 +1154,7 @@ ENTRY(segment_not_present) +@@ -916,7 +1155,7 @@ ENTRY(segment_not_present) pushl_cfi $do_segment_not_present jmp error_code CFI_ENDPROC @@ -23072,7 +23099,7 @@ index a2a4f46..6cab058 100644 ENTRY(stack_segment) RING0_EC_FRAME -@@ -923,7 +1162,7 @@ ENTRY(stack_segment) +@@ -924,7 +1163,7 @@ ENTRY(stack_segment) pushl_cfi $do_stack_segment jmp error_code CFI_ENDPROC @@ -23081,7 +23108,7 @@ index a2a4f46..6cab058 100644 ENTRY(alignment_check) RING0_EC_FRAME -@@ -931,7 +1170,7 @@ ENTRY(alignment_check) +@@ -932,7 +1171,7 @@ ENTRY(alignment_check) pushl_cfi $do_alignment_check jmp error_code CFI_ENDPROC @@ -23090,7 +23117,7 @@ index a2a4f46..6cab058 100644 ENTRY(divide_error) RING0_INT_FRAME -@@ -940,7 +1179,7 @@ ENTRY(divide_error) +@@ -941,7 +1180,7 @@ ENTRY(divide_error) pushl_cfi $do_divide_error jmp error_code CFI_ENDPROC @@ -23099,7 +23126,7 @@ index a2a4f46..6cab058 100644 #ifdef CONFIG_X86_MCE ENTRY(machine_check) -@@ -950,7 +1189,7 @@ ENTRY(machine_check) +@@ -951,7 +1190,7 @@ ENTRY(machine_check) pushl_cfi machine_check_vector jmp error_code CFI_ENDPROC @@ -23108,7 +23135,7 @@ index a2a4f46..6cab058 100644 #endif ENTRY(spurious_interrupt_bug) -@@ -960,7 +1199,7 @@ ENTRY(spurious_interrupt_bug) +@@ -961,7 +1200,7 @@ ENTRY(spurious_interrupt_bug) pushl_cfi $do_spurious_interrupt_bug jmp error_code CFI_ENDPROC @@ -23117,7 +23144,7 @@ index a2a4f46..6cab058 100644 /* * End of kprobes section */ -@@ -1070,7 +1309,7 @@ BUILD_INTERRUPT3(hyperv_callback_vector, HYPERVISOR_CALLBACK_VECTOR, +@@ -1071,7 +1310,7 @@ BUILD_INTERRUPT3(hyperv_callback_vector, HYPERVISOR_CALLBACK_VECTOR, ENTRY(mcount) ret @@ -23126,7 +23153,7 @@ index a2a4f46..6cab058 100644 ENTRY(ftrace_caller) cmpl $0, function_trace_stop -@@ -1103,7 +1342,7 @@ ftrace_graph_call: +@@ -1104,7 +1343,7 @@ ftrace_graph_call: .globl ftrace_stub ftrace_stub: ret @@ -23135,7 +23162,7 @@ index a2a4f46..6cab058 100644 ENTRY(ftrace_regs_caller) pushf /* push flags before compare (in cs location) */ -@@ -1207,7 +1446,7 @@ trace: +@@ -1208,7 +1447,7 @@ trace: popl %ecx popl %eax jmp ftrace_stub @@ -23144,7 +23171,7 @@ index a2a4f46..6cab058 100644 #endif /* CONFIG_DYNAMIC_FTRACE */ #endif /* CONFIG_FUNCTION_TRACER */ -@@ -1225,7 +1464,7 @@ ENTRY(ftrace_graph_caller) +@@ -1226,7 +1465,7 @@ ENTRY(ftrace_graph_caller) popl %ecx popl %eax ret @@ -23153,7 +23180,7 @@ index a2a4f46..6cab058 100644 .globl return_to_handler return_to_handler: -@@ -1291,15 +1530,18 @@ error_code: +@@ -1292,15 +1531,18 @@ error_code: movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart REG_TO_PTGS %ecx SET_KERNEL_GS %ecx @@ -23174,7 +23201,7 @@ index a2a4f46..6cab058 100644 /* * Debug traps and NMI can happen at the one SYSENTER instruction -@@ -1342,7 +1584,7 @@ debug_stack_correct: +@@ -1343,7 +1585,7 @@ debug_stack_correct: call do_debug jmp ret_from_exception CFI_ENDPROC @@ -23183,7 +23210,7 @@ index a2a4f46..6cab058 100644 /* * NMI is doubly nasty. It can happen _while_ we're handling -@@ -1380,6 +1622,9 @@ nmi_stack_correct: +@@ -1381,6 +1623,9 @@ nmi_stack_correct: xorl %edx,%edx # zero error code movl %esp,%eax # pt_regs pointer call do_nmi @@ -23193,7 +23220,7 @@ index a2a4f46..6cab058 100644 jmp restore_all_notrace CFI_ENDPROC -@@ -1416,12 +1661,15 @@ nmi_espfix_stack: +@@ -1417,12 +1662,15 @@ nmi_espfix_stack: FIXUP_ESPFIX_STACK # %eax == %esp xorl %edx,%edx # zero error code call do_nmi @@ -23210,7 +23237,7 @@ index a2a4f46..6cab058 100644 ENTRY(int3) RING0_INT_FRAME -@@ -1434,14 +1682,14 @@ ENTRY(int3) +@@ -1435,14 +1683,14 @@ ENTRY(int3) call do_int3 jmp ret_from_exception CFI_ENDPROC @@ -23227,7 +23254,7 @@ index a2a4f46..6cab058 100644 #ifdef CONFIG_KVM_GUEST ENTRY(async_page_fault) -@@ -1450,7 +1698,7 @@ ENTRY(async_page_fault) +@@ -1451,7 +1699,7 @@ ENTRY(async_page_fault) pushl_cfi $do_async_page_fault jmp error_code CFI_ENDPROC @@ -25962,7 +25989,7 @@ index 898160b..758cde8 100644 reset_current_kprobe(); preempt_enable_no_resched(); diff --git a/arch/x86/kernel/ksysfs.c b/arch/x86/kernel/ksysfs.c -index c2bedae..25e7ab6 100644 +index c2bedae..25e7ab60 100644 --- a/arch/x86/kernel/ksysfs.c +++ b/arch/x86/kernel/ksysfs.c @@ -184,7 +184,7 @@ out: @@ -28694,7 +28721,7 @@ index c697625..a032162 100644 out: diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c -index 9736529..ab4f54c 100644 +index 0069118..c28ec0a 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -55,7 +55,7 @@ @@ -32588,10 +32615,10 @@ index 4500142..53a363c 100644 return (void *)vaddr; diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c -index 8c9f647..57cb402 100644 +index 8b977eb..4732c33 100644 --- a/arch/x86/mm/hugetlbpage.c +++ b/arch/x86/mm/hugetlbpage.c -@@ -90,23 +90,24 @@ int pmd_huge_support(void) +@@ -80,23 +80,24 @@ int pud_huge(pud_t pud) #ifdef CONFIG_HUGETLB_PAGE static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file, unsigned long addr, unsigned long len, @@ -32619,7 +32646,7 @@ index 8c9f647..57cb402 100644 { struct hstate *h = hstate_file(file); struct vm_unmapped_area_info info; -@@ -118,6 +119,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file, +@@ -108,6 +109,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file, info.high_limit = current->mm->mmap_base; info.align_mask = PAGE_MASK & ~huge_page_mask(h); info.align_offset = 0; @@ -32627,7 +32654,7 @@ index 8c9f647..57cb402 100644 addr = vm_unmapped_area(&info); /* -@@ -130,6 +132,12 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file, +@@ -120,6 +122,12 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file, VM_BUG_ON(addr != -ENOMEM); info.flags = 0; info.low_limit = TASK_UNMAPPED_BASE; @@ -32640,7 +32667,7 @@ index 8c9f647..57cb402 100644 info.high_limit = TASK_SIZE; addr = vm_unmapped_area(&info); } -@@ -144,10 +152,20 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, +@@ -134,10 +142,20 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, struct hstate *h = hstate_file(file); struct mm_struct *mm = current->mm; struct vm_area_struct *vma; @@ -32662,7 +32689,7 @@ index 8c9f647..57cb402 100644 return -ENOMEM; if (flags & MAP_FIXED) { -@@ -156,19 +174,22 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, +@@ -146,19 +164,22 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, return addr; } @@ -40406,7 +40433,9 @@ index 3b7d32d..05c2f74 100644 ret = -EFAULT; goto done; diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c -index 345be03..158368d 100644 +old mode 100644 +new mode 100755 +index 345be03..65b66c0 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -233,7 +233,7 @@ module_exit(drm_core_exit); @@ -40427,6 +40456,17 @@ index 345be03..158368d 100644 unsigned int nr = DRM_IOCTL_NR(cmd); int retcode = -EINVAL; char stack_kdata[128]; +@@ -380,8 +380,9 @@ long drm_ioctl(struct file *filp, + retcode = -EFAULT; + goto err_i1; + } +- } else ++ } else if (cmd & IOC_OUT) { + memset(kdata, 0, usize); ++ } + + if (ioctl->flags & DRM_UNLOCKED) + retcode = func(dev, kdata, file_priv); diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c index 7f2af9a..1561914 100644 --- a/drivers/gpu/drm/drm_fops.c @@ -41982,10 +42022,10 @@ index ec0ae2d..dc0780b 100644 /* copy over all the bus versions */ if (dev->bus && dev->bus->pm) { diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 8a5384c..cf63c18 100644 +index 7cd42ea..a367c48 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c -@@ -2422,7 +2422,7 @@ EXPORT_SYMBOL_GPL(hid_ignore); +@@ -2432,7 +2432,7 @@ EXPORT_SYMBOL_GPL(hid_ignore); int hid_add_device(struct hid_device *hdev) { @@ -41994,7 +42034,7 @@ index 8a5384c..cf63c18 100644 int ret; if (WARN_ON(hdev->status & HID_STAT_ADDED)) -@@ -2456,7 +2456,7 @@ int hid_add_device(struct hid_device *hdev) +@@ -2466,7 +2466,7 @@ int hid_add_device(struct hid_device *hdev) /* XXX hack, any other cleaner solution after the driver core * is converted to allow more than 20 bytes as the device name? */ dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus, @@ -42085,10 +42125,10 @@ index bcb4950..61dba6c 100644 if (!virtaddr) goto cleanup; diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c -index 7e17a54..a50a33d 100644 +index 393fd8a..079e13f 100644 --- a/drivers/hv/hv_balloon.c +++ b/drivers/hv/hv_balloon.c -@@ -464,7 +464,7 @@ MODULE_PARM_DESC(hot_add, "If set attempt memory hot_add"); +@@ -470,7 +470,7 @@ MODULE_PARM_DESC(hot_add, "If set attempt memory hot_add"); module_param(pressure_report_delay, uint, (S_IRUGO | S_IWUSR)); MODULE_PARM_DESC(pressure_report_delay, "Delay in secs in reporting pressure"); @@ -42097,7 +42137,7 @@ index 7e17a54..a50a33d 100644 static int dm_ring_size = (5 * PAGE_SIZE); -@@ -886,7 +886,7 @@ static void hot_add_req(struct work_struct *dummy) +@@ -893,7 +893,7 @@ static void hot_add_req(struct work_struct *dummy) pr_info("Memory hot add failed\n"); dm->state = DM_INITIALIZED; @@ -42106,7 +42146,7 @@ index 7e17a54..a50a33d 100644 vmbus_sendpacket(dm->dev->channel, &resp, sizeof(struct dm_hot_add_response), (unsigned long)NULL, -@@ -960,7 +960,7 @@ static void post_status(struct hv_dynmem_device *dm) +@@ -973,7 +973,7 @@ static void post_status(struct hv_dynmem_device *dm) memset(&status, 0, sizeof(struct dm_status)); status.hdr.type = DM_STATUS_REPORT; status.hdr.size = sizeof(struct dm_status); @@ -42115,7 +42155,7 @@ index 7e17a54..a50a33d 100644 /* * The host expects the guest to report free memory. -@@ -980,7 +980,7 @@ static void post_status(struct hv_dynmem_device *dm) +@@ -993,7 +993,7 @@ static void post_status(struct hv_dynmem_device *dm) * send the status. This can happen if we were interrupted * after we picked our transaction ID. */ @@ -42123,8 +42163,8 @@ index 7e17a54..a50a33d 100644 + if (status.hdr.trans_id != atomic_read_unchecked(&trans_id)) return; - vmbus_sendpacket(dm->dev->channel, &status, -@@ -1108,7 +1108,7 @@ static void balloon_up(struct work_struct *dummy) + /* +@@ -1129,7 +1129,7 @@ static void balloon_up(struct work_struct *dummy) */ do { @@ -42133,7 +42173,7 @@ index 7e17a54..a50a33d 100644 ret = vmbus_sendpacket(dm_device.dev->channel, bl_resp, bl_resp->hdr.size, -@@ -1152,7 +1152,7 @@ static void balloon_down(struct hv_dynmem_device *dm, +@@ -1175,7 +1175,7 @@ static void balloon_down(struct hv_dynmem_device *dm, memset(&resp, 0, sizeof(struct dm_unballoon_response)); resp.hdr.type = DM_UNBALLOON_RESPONSE; @@ -42142,7 +42182,7 @@ index 7e17a54..a50a33d 100644 resp.hdr.size = sizeof(struct dm_unballoon_response); vmbus_sendpacket(dm_device.dev->channel, &resp, -@@ -1215,7 +1215,7 @@ static void version_resp(struct hv_dynmem_device *dm, +@@ -1238,7 +1238,7 @@ static void version_resp(struct hv_dynmem_device *dm, memset(&version_req, 0, sizeof(struct dm_version_request)); version_req.hdr.type = DM_VERSION_REQUEST; version_req.hdr.size = sizeof(struct dm_version_request); @@ -42151,7 +42191,7 @@ index 7e17a54..a50a33d 100644 version_req.version.version = DYNMEM_PROTOCOL_VERSION_WIN7; version_req.is_last_attempt = 1; -@@ -1385,7 +1385,7 @@ static int balloon_probe(struct hv_device *dev, +@@ -1408,7 +1408,7 @@ static int balloon_probe(struct hv_device *dev, memset(&version_req, 0, sizeof(struct dm_version_request)); version_req.hdr.type = DM_VERSION_REQUEST; version_req.hdr.size = sizeof(struct dm_version_request); @@ -42160,7 +42200,7 @@ index 7e17a54..a50a33d 100644 version_req.version.version = DYNMEM_PROTOCOL_VERSION_WIN8; version_req.is_last_attempt = 0; -@@ -1416,7 +1416,7 @@ static int balloon_probe(struct hv_device *dev, +@@ -1439,7 +1439,7 @@ static int balloon_probe(struct hv_device *dev, memset(&cap_msg, 0, sizeof(struct dm_capabilities)); cap_msg.hdr.type = DM_CAPABILITIES_REPORT; cap_msg.hdr.size = sizeof(struct dm_capabilities); @@ -46368,6 +46408,20 @@ index 455d4c3..3353ee7 100644 } if (!request_mem_region(mem->start, mem_size, pdev->name)) { +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index dbcff50..5ed5124 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -793,7 +793,8 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp, + + return; + } +- bnx2x_frag_free(fp, new_data); ++ if (new_data) ++ bnx2x_frag_free(fp, new_data); + drop: + /* drop the packet and keep the buffer in the bin */ + DP(NETIF_MSG_RX_STATUS, diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h index a89a40f..5a8a2ac 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h @@ -46635,18 +46689,6 @@ index be7d7a6..a8983f8 100644 break; default: dev_err(&adapter->pdev->dev, "Invalid Virtual NIC opmode\n"); -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c -index 7d4f549..3e46c89 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c -@@ -1022,6 +1022,7 @@ static int qlcnic_dcb_peer_app_info(struct net_device *netdev, - struct qlcnic_dcb_cee *peer; - int i; - -+ memset(info, 0, sizeof(*info)); - *app_count = 0; - - if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state)) diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c index 7763962..c3499a7 100644 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c @@ -46768,7 +46810,7 @@ index bf0d55e..82bcfbd1 100644 priv = netdev_priv(dev); priv->phy = phy; diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c -index 20bb669..9a0e17e 100644 +index 5adecc5..aec7730 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -991,13 +991,15 @@ static const struct nla_policy macvlan_policy[IFLA_MACVLAN_MAX + 1] = { @@ -46794,7 +46836,7 @@ index 20bb669..9a0e17e 100644 return rtnl_link_register(ops); }; -@@ -1052,7 +1054,7 @@ static int macvlan_device_event(struct notifier_block *unused, +@@ -1051,7 +1053,7 @@ static int macvlan_device_event(struct notifier_block *unused, return NOTIFY_DONE; } @@ -46873,10 +46915,10 @@ index 1252d9c..80e660b 100644 /* We've got a compressed packet; read the change byte */ diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c -index c8624a8..f0a4f6a 100644 +index 26d8c29..bbc6837 100644 --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c -@@ -2869,7 +2869,7 @@ static int team_device_event(struct notifier_block *unused, +@@ -2874,7 +2874,7 @@ static int team_device_event(struct notifier_block *unused, return NOTIFY_DONE; } @@ -47035,10 +47077,10 @@ index a2515887..6d13233 100644 /* we will have to manufacture ethernet headers, prepare template */ diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index d091e52..568bb179 100644 +index 40ad25d..8703023 100644 --- a/drivers/net/vxlan.c +++ b/drivers/net/vxlan.c -@@ -2847,7 +2847,7 @@ nla_put_failure: +@@ -2846,7 +2846,7 @@ nla_put_failure: return -EMSGSIZE; } @@ -47047,7 +47089,7 @@ index d091e52..568bb179 100644 .kind = "vxlan", .maxtype = IFLA_VXLAN_MAX, .policy = vxlan_policy, -@@ -2894,7 +2894,7 @@ static int vxlan_lowerdev_event(struct notifier_block *unused, +@@ -2893,7 +2893,7 @@ static int vxlan_lowerdev_event(struct notifier_block *unused, return NOTIFY_DONE; } @@ -50857,10 +50899,10 @@ index 26416c1..e796a3d 100644 spin_lock_init(&dev->t10_wwn.t10_vpd_lock); INIT_LIST_HEAD(&dev->t10_pr.registration_list); diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 98b48d4..f4297e5 100644 +index 24f5279..046edc5 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c -@@ -1137,7 +1137,7 @@ transport_check_alloc_task_attr(struct se_cmd *cmd) +@@ -1154,7 +1154,7 @@ transport_check_alloc_task_attr(struct se_cmd *cmd) * Used to determine when ORDERED commands should go from * Dormant to Active status. */ @@ -52602,7 +52644,7 @@ index 4d11449..f4ccabf 100644 INIT_LIST_HEAD(&dev->ep0.urb_list); dev->ep0.desc.bLength = USB_DT_ENDPOINT_SIZE; diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 2da0a5a..4870e09 100644 +index 09e9619..d266724 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -532,8 +532,6 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep, @@ -56506,7 +56548,7 @@ index ce25d75..dc09eeb 100644 &data); if (!inode) { diff --git a/fs/aio.c b/fs/aio.c -index 04cd768..25949c1 100644 +index 19e7d95..af5756a 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -375,7 +375,7 @@ static int aio_setup_ring(struct kioctx *ctx) @@ -57809,10 +57851,10 @@ index d04db81..96e54f1 100644 wake_up(&root->fs_info->transaction_wait); wake_up(&root->fs_info->transaction_blocked_wait); diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c -index 865f4cf..f321e86 100644 +index ff286f3..8153a14 100644 --- a/fs/btrfs/sysfs.c +++ b/fs/btrfs/sysfs.c -@@ -436,7 +436,7 @@ static int addrm_unknown_feature_attrs(struct btrfs_fs_info *fs_info, bool add) +@@ -437,7 +437,7 @@ static int addrm_unknown_feature_attrs(struct btrfs_fs_info *fs_info, bool add) for (set = 0; set < FEAT_MAX; set++) { int i; struct attribute *attrs[2]; @@ -58459,10 +58501,10 @@ index 35ddc3e..563e809 100644 } diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c -index 8603447..f9caeee 100644 +index 049a3f2..0f41305 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c -@@ -2094,8 +2094,7 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, +@@ -2099,8 +2099,7 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, default: cifs_dbg(VFS, "info level %u isn't supported\n", srch_inf->info_level); @@ -59798,7 +59840,7 @@ index 6ea7b14..8fa16d9 100644 if (free_clusters >= (nclusters + dirty_clusters + resv_clusters)) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 3a603a8..9b868ba 100644 +index 62f024c..a6a1a61 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -1269,19 +1269,19 @@ struct ext4_sb_info { @@ -59831,8 +59873,65 @@ index 3a603a8..9b868ba 100644 atomic_t s_lock_busy; /* locality groups */ +diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c +index 594009f..c30cbe2 100644 +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -389,7 +389,13 @@ static int ext4_alloc_branch(handle_t *handle, struct inode *inode, + return 0; + failed: + for (; i >= 0; i--) { +- if (i != indirect_blks && branch[i].bh) ++ /* ++ * We want to ext4_forget() only freshly allocated indirect ++ * blocks. Buffer for new_blocks[i-1] is at branch[i].bh and ++ * buffer at branch[0].bh is indirect block / inode already ++ * existing before ext4_alloc_branch() was called. ++ */ ++ if (i > 0 && i != indirect_blks && branch[i].bh) + ext4_forget(handle, 1, inode, branch[i].bh, + branch[i].bh->b_blocknr); + ext4_free_blocks(handle, inode, NULL, new_blocks[i], +@@ -1312,16 +1318,24 @@ static int free_hole_blocks(handle_t *handle, struct inode *inode, + blk = *i_data; + if (level > 0) { + ext4_lblk_t first2; ++ ext4_lblk_t count2; ++ + bh = sb_bread(inode->i_sb, le32_to_cpu(blk)); + if (!bh) { + EXT4_ERROR_INODE_BLOCK(inode, le32_to_cpu(blk), + "Read failure"); + return -EIO; + } +- first2 = (first > offset) ? first - offset : 0; ++ if (first > offset) { ++ first2 = first - offset; ++ count2 = count; ++ } else { ++ first2 = 0; ++ count2 = count - (offset - first); ++ } + ret = free_hole_blocks(handle, inode, bh, + (__le32 *)bh->b_data, level - 1, +- first2, count - offset, ++ first2, count2, + inode->i_sb->s_blocksize >> 2); + if (ret) { + brelse(bh); +@@ -1331,8 +1345,8 @@ static int free_hole_blocks(handle_t *handle, struct inode *inode, + if (level == 0 || + (bh && all_zeroes((__le32 *)bh->b_data, + (__le32 *)bh->b_data + addr_per_block))) { +- ext4_free_data(handle, inode, parent_bh, &blk, &blk+1); +- *i_data = 0; ++ ext4_free_data(handle, inode, parent_bh, ++ i_data, i_data + 1); + } + brelse(bh); + bh = NULL; diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 04a5c75..09894fa 100644 +index 08ddfda..a48f3f6 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -1880,7 +1880,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac, @@ -80818,7 +80917,7 @@ index c45c089..298841c 100644 u32 remainder; return div_u64_rem(dividend, divisor, &remainder); diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h -index 5f1ea75..5125ac5 100644 +index 5bba088..7ad4ae7 100644 --- a/include/linux/mempolicy.h +++ b/include/linux/mempolicy.h @@ -91,6 +91,10 @@ static inline struct mempolicy *mpol_dup(struct mempolicy *pol) @@ -80832,7 +80931,7 @@ index 5f1ea75..5125ac5 100644 static inline void mpol_get(struct mempolicy *pol) { -@@ -223,6 +227,9 @@ static inline void mpol_free_shared_policy(struct shared_policy *p) +@@ -229,6 +233,9 @@ static inline void mpol_free_shared_policy(struct shared_policy *p) } #define vma_policy(vma) NULL @@ -81173,10 +81272,10 @@ index c5d5278..f0b68c8 100644 } diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index 9b61b9b..52147d6b 100644 +index e6800f0..d59674e 100644 --- a/include/linux/mmzone.h +++ b/include/linux/mmzone.h -@@ -396,7 +396,7 @@ struct zone { +@@ -400,7 +400,7 @@ struct zone { unsigned long flags; /* zone flags, see below */ /* Zone statistics */ @@ -81186,18 +81285,9 @@ index 9b61b9b..52147d6b 100644 /* * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h -index 45e9214..a7227d6 100644 +index 45e9214..4a547ac 100644 --- a/include/linux/mod_devicetable.h +++ b/include/linux/mod_devicetable.h -@@ -13,7 +13,7 @@ - typedef unsigned long kernel_ulong_t; - #endif - --#define PCI_ANY_ID (~0) -+#define PCI_ANY_ID ((__u16)~0) - - struct pci_device_id { - __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/ @@ -139,7 +139,7 @@ struct usb_device_id { #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200 #define USB_DEVICE_ID_MATCH_INT_NUMBER 0x0400 @@ -81544,36 +81634,6 @@ index 0000000..33f4af8 +}; + +#endif -diff --git a/include/linux/netlink.h b/include/linux/netlink.h -index aad8eea..034cda7 100644 ---- a/include/linux/netlink.h -+++ b/include/linux/netlink.h -@@ -16,9 +16,10 @@ static inline struct nlmsghdr *nlmsg_hdr(const struct sk_buff *skb) - } - - enum netlink_skb_flags { -- NETLINK_SKB_MMAPED = 0x1, /* Packet data is mmaped */ -- NETLINK_SKB_TX = 0x2, /* Packet was sent by userspace */ -- NETLINK_SKB_DELIVERED = 0x4, /* Packet was delivered */ -+ NETLINK_SKB_MMAPED = 0x1, /* Packet data is mmaped */ -+ NETLINK_SKB_TX = 0x2, /* Packet was sent by userspace */ -+ NETLINK_SKB_DELIVERED = 0x4, /* Packet was delivered */ -+ NETLINK_SKB_DST = 0x8, /* Dst set in sendto or sendmsg */ - }; - - struct netlink_skb_parms { -@@ -169,4 +170,11 @@ struct netlink_tap { - extern int netlink_add_tap(struct netlink_tap *nt); - extern int netlink_remove_tap(struct netlink_tap *nt); - -+bool __netlink_ns_capable(const struct netlink_skb_parms *nsp, -+ struct user_namespace *ns, int cap); -+bool netlink_ns_capable(const struct sk_buff *skb, -+ struct user_namespace *ns, int cap); -+bool netlink_capable(const struct sk_buff *skb, int cap); -+bool netlink_net_capable(const struct sk_buff *skb, int cap); -+ - #endif /* __LINUX_NETLINK_H */ diff --git a/include/linux/nls.h b/include/linux/nls.h index 520681b..1d67ed2 100644 --- a/include/linux/nls.h @@ -82921,7 +82981,7 @@ index 6ae004e..2743532 100644 /* * Callback to arch code if there's nosmp or maxcpus=0 on the diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h -index 302ab80..3233276 100644 +index 46cca4c..3323536 100644 --- a/include/linux/sock_diag.h +++ b/include/linux/sock_diag.h @@ -11,7 +11,7 @@ struct sock; @@ -83833,7 +83893,7 @@ index c55aeed..b3393f4 100644 /** inet_connection_sock - INET connection oriented sock * diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h -index 6efe73c..1a44af7 100644 +index 058271b..1a44af7 100644 --- a/include/net/inetpeer.h +++ b/include/net/inetpeer.h @@ -47,8 +47,8 @@ struct inet_peer { @@ -83847,20 +83907,11 @@ index 6efe73c..1a44af7 100644 }; struct rcu_head rcu; struct inet_peer *gc_next; -@@ -177,16 +177,9 @@ static inline void inet_peer_refcheck(const struct inet_peer *p) - /* can be called with or without local BH being disabled */ - static inline int inet_getid(struct inet_peer *p, int more) +@@ -179,7 +179,7 @@ static inline int inet_getid(struct inet_peer *p, int more) { -- int old, new; more++; inet_peer_refcheck(p); -- do { -- old = atomic_read(&p->ip_id_count); -- new = old + more; -- if (!new) -- new = 1; -- } while (atomic_cmpxchg(&p->ip_id_count, old, new) != old); -- return new; +- return atomic_add_return(more, &p->ip_id_count) - more; + return atomic_add_return_unchecked(more, &p->ip_id_count) - more; } @@ -84328,7 +84379,7 @@ index 0dfcc92..7967849 100644 /* Structure to track chunk fragments that have been acked, but peer diff --git a/include/net/sock.h b/include/net/sock.h -index b9586a1..b2948c0 100644 +index 57c31dd..f5e5196 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -348,7 +348,7 @@ struct sock { @@ -84367,6 +84418,17 @@ index b9586a1..b2948c0 100644 static inline struct sock_iocb *kiocb_to_siocb(struct kiocb *iocb) { +@@ -1755,8 +1755,8 @@ sk_dst_get(struct sock *sk) + + rcu_read_lock(); + dst = rcu_dereference(sk->sk_dst_cache); +- if (dst) +- dst_hold(dst); ++ if (dst && !atomic_inc_not_zero(&dst->__refcnt)) ++ dst = NULL; + rcu_read_unlock(); + return dst; + } @@ -1830,7 +1830,7 @@ static inline void sk_nocaps_add(struct sock *sk, netdev_features_t flags) } @@ -85819,7 +85881,7 @@ index 8d6e145..33e0b1e 100644 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim; set_fs(fs); diff --git a/kernel/audit.c b/kernel/audit.c -index d5f31c1..06646e1 100644 +index 0c9dc86..a891393 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -122,7 +122,7 @@ u32 audit_sig_sid = 0; @@ -86656,7 +86718,7 @@ index 81b3d67..ef189a4 100644 { struct signal_struct *sig = current->signal; diff --git a/kernel/fork.c b/kernel/fork.c -index a17621c..2a89549 100644 +index 45da005c..6581b2b 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -180,6 +180,48 @@ void thread_info_cache_init(void) @@ -87055,7 +87117,7 @@ index a17621c..2a89549 100644 /* * Do this prior waking up the new thread - the thread pointer * might get invalid after that point, if the thread exits quickly. -@@ -1612,6 +1725,8 @@ long do_fork(unsigned long clone_flags, +@@ -1614,6 +1727,8 @@ long do_fork(unsigned long clone_flags, if (clone_flags & CLONE_PARENT_SETTID) put_user(nr, parent_tidptr); @@ -87064,7 +87126,7 @@ index a17621c..2a89549 100644 if (clone_flags & CLONE_VFORK) { p->vfork_done = &vfork; init_completion(&vfork); -@@ -1728,7 +1843,7 @@ void __init proc_caches_init(void) +@@ -1732,7 +1847,7 @@ void __init proc_caches_init(void) mm_cachep = kmem_cache_create("mm_struct", sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN, SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL); @@ -87073,7 +87135,7 @@ index a17621c..2a89549 100644 mmap_init(); nsproxy_cache_init(); } -@@ -1768,7 +1883,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp) +@@ -1772,7 +1887,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp) return 0; /* don't need lock here; in the worst case we'll do useless copy */ @@ -87082,7 +87144,7 @@ index a17621c..2a89549 100644 return 0; *new_fsp = copy_fs_struct(fs); -@@ -1875,7 +1990,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags) +@@ -1879,7 +1994,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags) fs = current->fs; spin_lock(&fs->lock); current->fs = new_fs; @@ -92587,10 +92649,10 @@ index 0000000..7cd6065 @@ -0,0 +1 @@ +-grsec diff --git a/mm/Kconfig b/mm/Kconfig -index 2888024..c15a810 100644 +index 9b63c15..2ab509e 100644 --- a/mm/Kconfig +++ b/mm/Kconfig -@@ -326,10 +326,11 @@ config KSM +@@ -329,10 +329,11 @@ config KSM root has set /sys/kernel/mm/ksm/run to 1 (if CONFIG_SYSFS is set). config DEFAULT_MMAP_MIN_ADDR @@ -92605,7 +92667,7 @@ index 2888024..c15a810 100644 This is the portion of low virtual memory which should be protected from userspace allocation. Keeping a user from writing to low pages can help reduce the impact of kernel NULL pointer bugs. -@@ -360,7 +361,7 @@ config MEMORY_FAILURE +@@ -363,7 +364,7 @@ config MEMORY_FAILURE config HWPOISON_INJECT tristate "HWPoison pages injector" @@ -93032,7 +93094,7 @@ index 539eeb9..e24a987 100644 if (end == start) return error; diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index e346fa9..5d32f0a 100644 +index 33365e9..2234ef9 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -61,7 +61,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0; @@ -93053,7 +93115,7 @@ index e346fa9..5d32f0a 100644 #ifdef __ARCH_SI_TRAPNO si.si_trapno = trapno; #endif -@@ -762,7 +762,7 @@ static struct page_state { +@@ -795,7 +795,7 @@ static struct page_state { unsigned long res; char *msg; int (*action)(struct page *p, unsigned long pfn); @@ -93062,7 +93124,7 @@ index e346fa9..5d32f0a 100644 { reserved, reserved, "reserved kernel", me_kernel }, /* * free pages are specially detected outside this table: -@@ -1062,7 +1062,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags) +@@ -1095,7 +1095,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags) nr_pages = 1 << compound_order(hpage); else /* normal page or thp */ nr_pages = 1; @@ -93071,7 +93133,7 @@ index e346fa9..5d32f0a 100644 /* * We need/can do nothing about count=0 pages. -@@ -1091,7 +1091,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags) +@@ -1124,7 +1124,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags) if (PageHWPoison(hpage)) { if ((hwpoison_filter(p) && TestClearPageHWPoison(p)) || (p != hpage && TestSetPageHWPoison(hpage))) { @@ -93080,7 +93142,7 @@ index e346fa9..5d32f0a 100644 unlock_page(hpage); return 0; } -@@ -1157,14 +1157,14 @@ int memory_failure(unsigned long pfn, int trapno, int flags) +@@ -1190,14 +1190,14 @@ int memory_failure(unsigned long pfn, int trapno, int flags) */ if (!PageHWPoison(p)) { printk(KERN_ERR "MCE %#lx: just unpoisoned\n", pfn); @@ -93097,7 +93159,7 @@ index e346fa9..5d32f0a 100644 unlock_page(hpage); put_page(hpage); return 0; -@@ -1386,7 +1386,7 @@ int unpoison_memory(unsigned long pfn) +@@ -1419,7 +1419,7 @@ int unpoison_memory(unsigned long pfn) return 0; } if (TestClearPageHWPoison(p)) @@ -93106,7 +93168,7 @@ index e346fa9..5d32f0a 100644 pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn); return 0; } -@@ -1400,7 +1400,7 @@ int unpoison_memory(unsigned long pfn) +@@ -1433,7 +1433,7 @@ int unpoison_memory(unsigned long pfn) */ if (TestClearPageHWPoison(page)) { pr_info("MCE: Software-unpoisoned page %#lx\n", pfn); @@ -93115,7 +93177,7 @@ index e346fa9..5d32f0a 100644 freeit = 1; if (PageHuge(page)) clear_page_hwpoison_huge_page(page); -@@ -1525,11 +1525,11 @@ static int soft_offline_huge_page(struct page *page, int flags) +@@ -1558,11 +1558,11 @@ static int soft_offline_huge_page(struct page *page, int flags) if (PageHuge(page)) { set_page_hwpoison_huge_page(hpage); dequeue_hwpoisoned_huge_page(hpage); @@ -93129,7 +93191,7 @@ index e346fa9..5d32f0a 100644 } } return ret; -@@ -1568,7 +1568,7 @@ static int __soft_offline_page(struct page *page, int flags) +@@ -1601,7 +1601,7 @@ static int __soft_offline_page(struct page *page, int flags) put_page(page); pr_info("soft_offline: %#lx: invalidated\n", pfn); SetPageHWPoison(page); @@ -93138,7 +93200,7 @@ index e346fa9..5d32f0a 100644 return 0; } -@@ -1619,7 +1619,7 @@ static int __soft_offline_page(struct page *page, int flags) +@@ -1652,7 +1652,7 @@ static int __soft_offline_page(struct page *page, int flags) if (!is_free_buddy_page(page)) pr_info("soft offline: %#lx: page leaked\n", pfn); @@ -93147,7 +93209,7 @@ index e346fa9..5d32f0a 100644 } } else { pr_info("soft offline: %#lx: isolation failed: %d, page count %d, type %lx\n", -@@ -1693,11 +1693,11 @@ int soft_offline_page(struct page *page, int flags) +@@ -1726,11 +1726,11 @@ int soft_offline_page(struct page *page, int flags) if (PageHuge(page)) { set_page_hwpoison_huge_page(hpage); dequeue_hwpoisoned_huge_page(hpage); @@ -95675,7 +95737,7 @@ index 8740213..f87e25b 100644 struct mm_struct *mm; diff --git a/mm/page-writeback.c b/mm/page-writeback.c -index 8f6daa6..1f8587c 100644 +index d013dba..d5ae30d 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -685,7 +685,7 @@ static long long pos_ratio_polynom(unsigned long setpoint, @@ -95688,7 +95750,7 @@ index 8f6daa6..1f8587c 100644 unsigned long bg_thresh, unsigned long dirty, diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 7387a67..67105e4 100644 +index 4b5d4f6..56dfb0a 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -61,6 +61,7 @@ @@ -95793,7 +95855,7 @@ index 7387a67..67105e4 100644 } } -@@ -6565,4 +6605,4 @@ void dump_page(struct page *page, char *reason) +@@ -6577,4 +6617,4 @@ void dump_page(struct page *page, char *reason) { dump_page_badflags(page, reason, 0); } @@ -95877,10 +95939,10 @@ index fd26d04..0cea1b0 100644 if (!mm || IS_ERR(mm)) { rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; diff --git a/mm/rmap.c b/mm/rmap.c -index 5d91bb7..3784601 100644 +index cdbd312..2e1e0b9 100644 --- a/mm/rmap.c +++ b/mm/rmap.c -@@ -163,6 +163,10 @@ int anon_vma_prepare(struct vm_area_struct *vma) +@@ -164,6 +164,10 @@ int anon_vma_prepare(struct vm_area_struct *vma) struct anon_vma *anon_vma = vma->anon_vma; struct anon_vma_chain *avc; @@ -95891,7 +95953,7 @@ index 5d91bb7..3784601 100644 might_sleep(); if (unlikely(!anon_vma)) { struct mm_struct *mm = vma->vm_mm; -@@ -172,6 +176,12 @@ int anon_vma_prepare(struct vm_area_struct *vma) +@@ -173,6 +177,12 @@ int anon_vma_prepare(struct vm_area_struct *vma) if (!avc) goto out_enomem; @@ -95904,7 +95966,7 @@ index 5d91bb7..3784601 100644 anon_vma = find_mergeable_anon_vma(vma); allocated = NULL; if (!anon_vma) { -@@ -185,6 +195,18 @@ int anon_vma_prepare(struct vm_area_struct *vma) +@@ -186,6 +196,18 @@ int anon_vma_prepare(struct vm_area_struct *vma) /* page_table_lock to protect against threads */ spin_lock(&mm->page_table_lock); if (likely(!vma->anon_vma)) { @@ -95923,7 +95985,7 @@ index 5d91bb7..3784601 100644 vma->anon_vma = anon_vma; anon_vma_chain_link(vma, avc, anon_vma); allocated = NULL; -@@ -195,12 +217,24 @@ int anon_vma_prepare(struct vm_area_struct *vma) +@@ -196,12 +218,24 @@ int anon_vma_prepare(struct vm_area_struct *vma) if (unlikely(allocated)) put_anon_vma(allocated); @@ -95948,7 +96010,7 @@ index 5d91bb7..3784601 100644 anon_vma_chain_free(avc); out_enomem: return -ENOMEM; -@@ -236,7 +270,7 @@ static inline void unlock_anon_vma_root(struct anon_vma *root) +@@ -237,7 +271,7 @@ static inline void unlock_anon_vma_root(struct anon_vma *root) * Attach the anon_vmas from src to dst. * Returns 0 on success, -ENOMEM on failure. */ @@ -95957,7 +96019,7 @@ index 5d91bb7..3784601 100644 { struct anon_vma_chain *avc, *pavc; struct anon_vma *root = NULL; -@@ -269,7 +303,7 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) +@@ -270,7 +304,7 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) * the corresponding VMA in the parent process is attached to. * Returns 0 on success, non-zero on failure. */ @@ -95966,7 +96028,7 @@ index 5d91bb7..3784601 100644 { struct anon_vma_chain *avc; struct anon_vma *anon_vma; -@@ -373,8 +407,10 @@ static void anon_vma_ctor(void *data) +@@ -374,8 +408,10 @@ static void anon_vma_ctor(void *data) void __init anon_vma_init(void) { anon_vma_cachep = kmem_cache_create("anon_vma", sizeof(struct anon_vma), @@ -97258,7 +97320,7 @@ index a24aa22..a0d41ae 100644 } #endif diff --git a/mm/vmalloc.c b/mm/vmalloc.c -index 0fdf968..f044efb 100644 +index 0fdf968..991ff6a 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -38,6 +38,21 @@ struct vfree_deferred { @@ -97457,15 +97519,6 @@ index 0fdf968..f044efb 100644 if (flags & VM_IOREMAP) align = 1ul << clamp(fls(size), PAGE_SHIFT, IOREMAP_MAX_ORDER); -@@ -1503,7 +1592,7 @@ EXPORT_SYMBOL(vfree); - * Free the virtually contiguous memory area starting at @addr, - * which was created from the page array passed to vmap(). - * -- * Must not be called in interrupt context. -+ * Must not be called in NMI context. - */ - void vunmap(const void *addr) - { @@ -1514,6 +1603,23 @@ void vunmap(const void *addr) } EXPORT_SYMBOL(vunmap); @@ -98073,7 +98126,7 @@ index 6afa3b4..7a14180 100644 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) && rfc.mode != chan->mode) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c -index d58f76b..b69600a 100644 +index d4b7702..7122922 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -625,7 +625,8 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, @@ -98268,7 +98321,7 @@ index dcb75c0..24b1b43 100644 } diff --git a/net/can/gw.c b/net/can/gw.c -index ac31891..4799c17 100644 +index 050a211..bb9fe33 100644 --- a/net/can/gw.c +++ b/net/can/gw.c @@ -80,7 +80,6 @@ MODULE_PARM_DESC(max_hops, @@ -98487,7 +98540,7 @@ index a16ed7b..eb44d17 100644 return err; diff --git a/net/core/dev.c b/net/core/dev.c -index fccc195..c8486ab 100644 +index 4c1b483..3d45b13 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1688,14 +1688,14 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb) @@ -98579,6 +98632,40 @@ index cf999e0..c59a975 100644 } } EXPORT_SYMBOL(dev_load); +diff --git a/net/core/dst.c b/net/core/dst.c +index ca4231e..15b6792 100644 +--- a/net/core/dst.c ++++ b/net/core/dst.c +@@ -267,6 +267,15 @@ again: + } + EXPORT_SYMBOL(dst_destroy); + ++static void dst_destroy_rcu(struct rcu_head *head) ++{ ++ struct dst_entry *dst = container_of(head, struct dst_entry, rcu_head); ++ ++ dst = dst_destroy(dst); ++ if (dst) ++ __dst_free(dst); ++} ++ + void dst_release(struct dst_entry *dst) + { + if (dst) { +@@ -274,11 +283,8 @@ void dst_release(struct dst_entry *dst) + + newrefcnt = atomic_dec_return(&dst->__refcnt); + WARN_ON(newrefcnt < 0); +- if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) { +- dst = dst_destroy(dst); +- if (dst) +- __dst_free(dst); +- } ++ if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) ++ call_rcu(&dst->rcu_head, dst_destroy_rcu); + } + } + EXPORT_SYMBOL(dst_release); diff --git a/net/core/filter.c b/net/core/filter.c index ebce437..9fed9d0 100644 --- a/net/core/filter.c @@ -98876,7 +98963,7 @@ index fdac61c..e5e5b46 100644 pr_warn("cannot create /proc/net/%s\n", PG_PROC_DIR); return -ENODEV; diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 83b9d6a..cff1ce7 100644 +index aef1500..4b61acd 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -58,7 +58,7 @@ struct rtnl_link { @@ -98986,10 +99073,10 @@ index e5ae776e..15c90cb 100644 } diff --git a/net/core/sock.c b/net/core/sock.c -index c0fc6bd..51d8326 100644 +index c806956..e5599ea 100644 --- a/net/core/sock.c +++ b/net/core/sock.c -@@ -393,7 +393,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) +@@ -442,7 +442,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) struct sk_buff_head *list = &sk->sk_receive_queue; if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) { @@ -98998,7 +99085,7 @@ index c0fc6bd..51d8326 100644 trace_sock_rcvqueue_full(sk, skb); return -ENOMEM; } -@@ -403,7 +403,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) +@@ -452,7 +452,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) return err; if (!sk_rmem_schedule(sk, skb, skb->truesize)) { @@ -99007,7 +99094,7 @@ index c0fc6bd..51d8326 100644 return -ENOBUFS; } -@@ -423,7 +423,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) +@@ -472,7 +472,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) skb_dst_force(skb); spin_lock_irqsave(&list->lock, flags); @@ -99016,7 +99103,7 @@ index c0fc6bd..51d8326 100644 __skb_queue_tail(list, skb); spin_unlock_irqrestore(&list->lock, flags); -@@ -443,7 +443,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested) +@@ -492,7 +492,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested) skb->dev = NULL; if (sk_rcvqueues_full(sk, skb, sk->sk_rcvbuf)) { @@ -99025,7 +99112,7 @@ index c0fc6bd..51d8326 100644 goto discard_and_relse; } if (nested) -@@ -461,7 +461,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested) +@@ -510,7 +510,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested) mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_); } else if (sk_add_backlog(sk, skb, sk->sk_rcvbuf)) { bh_unlock_sock(sk); @@ -99034,7 +99121,7 @@ index c0fc6bd..51d8326 100644 goto discard_and_relse; } -@@ -949,12 +949,12 @@ int sock_getsockopt(struct socket *sock, int level, int optname, +@@ -998,12 +998,12 @@ int sock_getsockopt(struct socket *sock, int level, int optname, struct timeval tm; } v; @@ -99050,7 +99137,7 @@ index c0fc6bd..51d8326 100644 return -EINVAL; memset(&v, 0, sizeof(v)); -@@ -1106,11 +1106,11 @@ int sock_getsockopt(struct socket *sock, int level, int optname, +@@ -1155,11 +1155,11 @@ int sock_getsockopt(struct socket *sock, int level, int optname, case SO_PEERNAME: { @@ -99064,7 +99151,7 @@ index c0fc6bd..51d8326 100644 return -EINVAL; if (copy_to_user(optval, address, len)) return -EFAULT; -@@ -1191,7 +1191,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname, +@@ -1240,7 +1240,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname, if (len > lv) len = lv; @@ -99073,7 +99160,7 @@ index c0fc6bd..51d8326 100644 return -EFAULT; lenout: if (put_user(len, optlen)) -@@ -2326,7 +2326,7 @@ void sock_init_data(struct socket *sock, struct sock *sk) +@@ -2375,7 +2375,7 @@ void sock_init_data(struct socket *sock, struct sock *sk) */ smp_wmb(); atomic_set(&sk->sk_refcnt, 1); @@ -99082,7 +99169,7 @@ index c0fc6bd..51d8326 100644 } EXPORT_SYMBOL(sock_init_data); -@@ -2454,6 +2454,7 @@ void sock_enable_timestamp(struct sock *sk, int flag) +@@ -2503,6 +2503,7 @@ void sock_enable_timestamp(struct sock *sk, int flag) int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len, int level, int type) { @@ -99090,7 +99177,7 @@ index c0fc6bd..51d8326 100644 struct sock_exterr_skb *serr; struct sk_buff *skb, *skb2; int copied, err; -@@ -2475,7 +2476,8 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len, +@@ -2524,7 +2525,8 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len, sock_recv_timestamp(msg, sk, skb); serr = SKB_EXT_ERR(skb); @@ -99101,7 +99188,7 @@ index c0fc6bd..51d8326 100644 msg->msg_flags |= MSG_ERRQUEUE; err = copied; diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c -index 6a7fae2..d7c22e6 100644 +index c38e7a2..773e3d7 100644 --- a/net/core/sock_diag.c +++ b/net/core/sock_diag.c @@ -9,26 +9,33 @@ @@ -99244,7 +99331,7 @@ index 4c04848..f575934 100644 static struct sock *dn_alloc_sock(struct net *net, struct socket *sock, gfp_t gfp) diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c -index a603823..a36ee0b 100644 +index 3b726f3..1af6368 100644 --- a/net/decnet/dn_dev.c +++ b/net/decnet/dn_dev.c @@ -200,7 +200,7 @@ static struct dn_dev_sysctl_table { @@ -99581,6 +99668,42 @@ index 580dd96..9fcef7e 100644 msg.msg_controllen = len; msg.msg_flags = flags; +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 0c3a5d1..c05c07d 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -73,12 +73,7 @@ static void __tunnel_dst_set(struct ip_tunnel_dst *idst, + { + struct dst_entry *old_dst; + +- if (dst) { +- if (dst->flags & DST_NOCACHE) +- dst = NULL; +- else +- dst_clone(dst); +- } ++ dst_clone(dst); + old_dst = xchg((__force struct dst_entry **)&idst->dst, dst); + dst_release(old_dst); + } +@@ -108,13 +103,14 @@ static struct rtable *tunnel_rtable_get(struct ip_tunnel *t, u32 cookie) + + rcu_read_lock(); + dst = rcu_dereference(this_cpu_ptr(t->dst_cache)->dst); ++ if (dst && !atomic_inc_not_zero(&dst->__refcnt)) ++ dst = NULL; + if (dst) { + if (dst->obsolete && dst->ops->check(dst, cookie) == NULL) { +- rcu_read_unlock(); + tunnel_dst_reset(t); +- return NULL; ++ dst_release(dst); ++ dst = NULL; + } +- dst_hold(dst); + } + rcu_read_unlock(); + return (struct rtable *)dst; diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c index e4a8f76..dd8ad72 100644 --- a/net/ipv4/ip_vti.c @@ -99635,7 +99758,7 @@ index b3e86ea..18ce98c 100644 return res; } diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c -index 812b183..56cbe9c 100644 +index 62eaa00..29b2dc2 100644 --- a/net/ipv4/ipip.c +++ b/net/ipv4/ipip.c @@ -124,7 +124,7 @@ MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN"); @@ -100100,7 +100223,7 @@ index 44eba05..b36864b 100644 hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table); if (hdr == NULL) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index eeaac39..dc29942 100644 +index e364746..598e76e 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -761,7 +761,7 @@ static void tcp_update_pacing_rate(struct sock *sk) @@ -100112,7 +100235,7 @@ index eeaac39..dc29942 100644 sk->sk_max_pacing_rate); } -@@ -4485,7 +4485,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb, +@@ -4484,7 +4484,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb, * simplifies code) */ static void @@ -100121,7 +100244,7 @@ index eeaac39..dc29942 100644 struct sk_buff *head, struct sk_buff *tail, u32 start, u32 end) { -@@ -5562,6 +5562,7 @@ discard: +@@ -5561,6 +5561,7 @@ discard: tcp_paws_reject(&tp->rx_opt, 0)) goto discard_and_undo; @@ -100129,7 +100252,7 @@ index eeaac39..dc29942 100644 if (th->syn) { /* We see SYN without ACK. It is attempt of * simultaneous connect with crossed SYNs. -@@ -5612,6 +5613,7 @@ discard: +@@ -5611,6 +5612,7 @@ discard: goto discard; #endif } @@ -100137,7 +100260,7 @@ index eeaac39..dc29942 100644 /* "fifth, if neither of the SYN or RST bits is set then * drop the segment and return." */ -@@ -5658,7 +5660,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb, +@@ -5657,7 +5659,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb, goto discard; if (th->syn) { @@ -100275,7 +100398,7 @@ index 64f0354..a81b39d 100644 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) { /* Has it gone just too far? */ diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 77bd16f..3ce366b 100644 +index b25e852..cdc3258 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -87,6 +87,7 @@ @@ -100383,7 +100506,7 @@ index 77bd16f..3ce366b 100644 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0); /* -@@ -2350,7 +2374,7 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f, +@@ -2354,7 +2378,7 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f, from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)), 0, sock_i_ino(sp), atomic_read(&sp->sk_refcnt), sp, @@ -100581,10 +100704,10 @@ index 2465d18..bc5bf7f 100644 .maxtype = IFLA_GRE_MAX, .policy = ip6gre_policy, diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 0e51f68..1f501e1 100644 +index 9120339..cfdd84f 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c -@@ -85,7 +85,7 @@ static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2) +@@ -86,7 +86,7 @@ static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2) static int ip6_tnl_dev_init(struct net_device *dev); static void ip6_tnl_dev_setup(struct net_device *dev); @@ -100593,7 +100716,7 @@ index 0e51f68..1f501e1 100644 static int ip6_tnl_net_id __read_mostly; struct ip6_tnl_net { -@@ -1714,7 +1714,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = { +@@ -1715,7 +1715,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = { [IFLA_IPTUN_PROTO] = { .type = NLA_U8 }, }; @@ -100729,36 +100852,27 @@ index 767ab8d..c5ec70a 100644 return -ENOMEM; } diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c -index 827f795..bdff9eb 100644 +index b31a012..c36f09c 100644 --- a/net/ipv6/output_core.c +++ b/net/ipv6/output_core.c -@@ -9,8 +9,8 @@ +@@ -9,7 +9,7 @@ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt) { - static atomic_t ipv6_fragmentation_id; -- int old, new; + static atomic_unchecked_t ipv6_fragmentation_id; -+ int id; + int ident; #if IS_ENABLED(CONFIG_IPV6) - if (rt && !(rt->dst.flags & DST_NOPEER)) { -@@ -26,13 +26,8 @@ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt) +@@ -26,7 +26,7 @@ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt) } } #endif -- do { -- old = atomic_read(&ipv6_fragmentation_id); -- new = old + 1; -- if (!new) -- new = 1; -- } while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old); -- fhdr->identification = htonl(new); -+ id = atomic_inc_return_unchecked(&ipv6_fragmentation_id); -+ fhdr->identification = htonl(id); +- ident = atomic_inc_return(&ipv6_fragmentation_id); ++ ident = atomic_inc_return_unchecked(&ipv6_fragmentation_id); + fhdr->identification = htonl(ident); } EXPORT_SYMBOL(ipv6_select_ident); - diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c index bda7429..469b26b 100644 --- a/net/ipv6/ping.c @@ -100963,7 +101077,7 @@ index 7cc1102..7785931 100644 table = kmemdup(ipv6_route_table_template, sizeof(ipv6_route_table_template), diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c -index b4d74c8..b4f3fbe 100644 +index fe548ba..0dfa744 100644 --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c @@ -74,7 +74,7 @@ static void ipip6_tunnel_setup(struct net_device *dev); @@ -101057,7 +101171,7 @@ index 889079b..a04512c 100644 } diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 1e586d9..2b8ad76 100644 +index 20b63d2..31a777d 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -76,6 +76,10 @@ static unsigned int udp6_ehashfn(struct net *net, @@ -101263,7 +101377,7 @@ index b9ac598..f88cc56 100644 return; diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c -index c4b7218..c7e9f14 100644 +index 1465363..c7e9f14 100644 --- a/net/iucv/af_iucv.c +++ b/net/iucv/af_iucv.c @@ -773,10 +773,10 @@ static int iucv_sock_autobind(struct sock *sk) @@ -101279,15 +101393,6 @@ index c4b7218..c7e9f14 100644 } write_unlock_bh(&iucv_sk_list.lock); -@@ -1829,7 +1829,7 @@ static void iucv_callback_txdone(struct iucv_path *path, - spin_lock_irqsave(&list->lock, flags); - - while (list_skb != (struct sk_buff *)list) { -- if (msg->tag != IUCV_SKB_CB(list_skb)->tag) { -+ if (msg->tag == IUCV_SKB_CB(list_skb)->tag) { - this = list_skb; - break; - } diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c index cd5b8ec..f205e6b 100644 --- a/net/iucv/iucv.c @@ -101386,7 +101491,7 @@ index b127902..9dc4947 100644 /* number of interfaces with corresponding FIF_ flags */ int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll, diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c -index ce1c443..6cd39e1 100644 +index 8f7fabc..e400523 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -529,7 +529,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up) @@ -102149,7 +102254,7 @@ index 11de55e..f25e448 100644 return 0; } diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 04748ab6..c72ef1f 100644 +index 7f40fd2..c72ef1f 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -257,7 +257,7 @@ static void netlink_overrun(struct sock *sk) @@ -102161,137 +102266,7 @@ index 04748ab6..c72ef1f 100644 } static void netlink_rcv_wake(struct sock *sk) -@@ -1360,7 +1360,74 @@ retry: - return err; - } - --static inline int netlink_capable(const struct socket *sock, unsigned int flag) -+/** -+ * __netlink_ns_capable - General netlink message capability test -+ * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace. -+ * @user_ns: The user namespace of the capability to use -+ * @cap: The capability to use -+ * -+ * Test to see if the opener of the socket we received the message -+ * from had when the netlink socket was created and the sender of the -+ * message has has the capability @cap in the user namespace @user_ns. -+ */ -+bool __netlink_ns_capable(const struct netlink_skb_parms *nsp, -+ struct user_namespace *user_ns, int cap) -+{ -+ return ((nsp->flags & NETLINK_SKB_DST) || -+ file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) && -+ ns_capable(user_ns, cap); -+} -+EXPORT_SYMBOL(__netlink_ns_capable); -+ -+/** -+ * netlink_ns_capable - General netlink message capability test -+ * @skb: socket buffer holding a netlink command from userspace -+ * @user_ns: The user namespace of the capability to use -+ * @cap: The capability to use -+ * -+ * Test to see if the opener of the socket we received the message -+ * from had when the netlink socket was created and the sender of the -+ * message has has the capability @cap in the user namespace @user_ns. -+ */ -+bool netlink_ns_capable(const struct sk_buff *skb, -+ struct user_namespace *user_ns, int cap) -+{ -+ return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap); -+} -+EXPORT_SYMBOL(netlink_ns_capable); -+ -+/** -+ * netlink_capable - Netlink global message capability test -+ * @skb: socket buffer holding a netlink command from userspace -+ * @cap: The capability to use -+ * -+ * Test to see if the opener of the socket we received the message -+ * from had when the netlink socket was created and the sender of the -+ * message has has the capability @cap in all user namespaces. -+ */ -+bool netlink_capable(const struct sk_buff *skb, int cap) -+{ -+ return netlink_ns_capable(skb, &init_user_ns, cap); -+} -+EXPORT_SYMBOL(netlink_capable); -+ -+/** -+ * netlink_net_capable - Netlink network namespace message capability test -+ * @skb: socket buffer holding a netlink command from userspace -+ * @cap: The capability to use -+ * -+ * Test to see if the opener of the socket we received the message -+ * from had when the netlink socket was created and the sender of the -+ * message has has the capability @cap over the network namespace of -+ * the socket we received the message from. -+ */ -+bool netlink_net_capable(const struct sk_buff *skb, int cap) -+{ -+ return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap); -+} -+EXPORT_SYMBOL(netlink_net_capable); -+ -+static inline int netlink_allowed(const struct socket *sock, unsigned int flag) - { - return (nl_table[sock->sk->sk_protocol].flags & flag) || - ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN); -@@ -1428,7 +1495,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, - - /* Only superuser is allowed to listen multicasts */ - if (nladdr->nl_groups) { -- if (!netlink_capable(sock, NL_CFG_F_NONROOT_RECV)) -+ if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV)) - return -EPERM; - err = netlink_realloc_groups(sk); - if (err) -@@ -1490,7 +1557,7 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, - return -EINVAL; - - if ((nladdr->nl_groups || nladdr->nl_pid) && -- !netlink_capable(sock, NL_CFG_F_NONROOT_SEND)) -+ !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) - return -EPERM; - - if (!nlk->portid) -@@ -2096,7 +2163,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname, - break; - case NETLINK_ADD_MEMBERSHIP: - case NETLINK_DROP_MEMBERSHIP: { -- if (!netlink_capable(sock, NL_CFG_F_NONROOT_RECV)) -+ if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV)) - return -EPERM; - err = netlink_realloc_groups(sk); - if (err) -@@ -2228,6 +2295,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, - struct sk_buff *skb; - int err; - struct scm_cookie scm; -+ u32 netlink_skb_flags = 0; - - if (msg->msg_flags&MSG_OOB) - return -EOPNOTSUPP; -@@ -2247,8 +2315,9 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, - dst_group = ffs(addr->nl_groups); - err = -EPERM; - if ((dst_group || dst_portid) && -- !netlink_capable(sock, NL_CFG_F_NONROOT_SEND)) -+ !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) - goto out; -+ netlink_skb_flags |= NETLINK_SKB_DST; - } else { - dst_portid = nlk->dst_portid; - dst_group = nlk->dst_group; -@@ -2278,6 +2347,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, - NETLINK_CB(skb).portid = nlk->portid; - NETLINK_CB(skb).dst_group = dst_group; - NETLINK_CB(skb).creds = siocb->scm->creds; -+ NETLINK_CB(skb).flags = netlink_skb_flags; - - err = -EFAULT; - if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) { -@@ -2933,7 +3003,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v) +@@ -3003,7 +3003,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v) sk_wmem_alloc_get(s), nlk->cb_running, atomic_read(&s->sk_refcnt), @@ -104540,7 +104515,7 @@ index 0865b3e..7235dd4 100644 __ksymtab_gpl : { *(SORT(___ksymtab_gpl+*)) } __ksymtab_unused : { *(SORT(___ksymtab_unused+*)) } diff --git a/scripts/package/builddeb b/scripts/package/builddeb -index f46e4dd..090e168 100644 +index 152d4d2..791684c 100644 --- a/scripts/package/builddeb +++ b/scripts/package/builddeb @@ -291,6 +291,7 @@ fi @@ -105689,7 +105664,7 @@ index f79fa8b..6161868 100644 }; extern struct ima_h_table ima_htable; diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c -index c38bbce..f45133d 100644 +index 025824a..2a681b1 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -137,7 +137,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, |