diff options
| -rw-r--r-- | main/linux-grsec/APKBUILD | 18 | ||||
| -rw-r--r-- | main/linux-grsec/grsecurity-3.1-3.14.39-201504190814.patch (renamed from main/linux-grsec/grsecurity-3.1-3.14.37-201503270048.patch) | 925 |
2 files changed, 710 insertions, 233 deletions
diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD index fe7521a306..76221d0fd5 100644 --- a/main/linux-grsec/APKBUILD +++ b/main/linux-grsec/APKBUILD @@ -2,12 +2,12 @@ _flavor=grsec pkgname=linux-${_flavor} -pkgver=3.14.37 +pkgver=3.14.39 case $pkgver in *.*.*) _kernver=${pkgver%.*};; *.*) _kernver=${pkgver};; esac -pkgrel=1 +pkgrel=0 pkgdesc="Linux kernel with grsecurity" url=http://grsecurity.net depends="mkinitfs linux-firmware" @@ -17,7 +17,7 @@ _config=${config:-kernelconfig.${CARCH}} install= source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz - grsecurity-3.1-3.14.37-201503270048.patch + grsecurity-3.1-3.14.39-201504190814.patch fix-memory-map-for-PIE-applications.patch imx6q-no-unclocked-sleep.patch @@ -165,24 +165,24 @@ dev() { } md5sums="b621207b3f6ecbb67db18b13258f8ea8 linux-3.14.tar.xz -cbc19671d2c8bab0eaf18bf3afa54f7b patch-3.14.37.xz -0d1341b1b8588274baa747e40db8df57 grsecurity-3.1-3.14.37-201503270048.patch +218b2bb75d29f418f855c321226d6649 patch-3.14.39.xz +4b05d20cee52a15ca3444edda9432aa3 grsecurity-3.1-3.14.39-201504190814.patch c6a4ae7e8ca6159e1631545515805216 fix-memory-map-for-PIE-applications.patch 1a307fc1d63231bf01d22493a4f14378 imx6q-no-unclocked-sleep.patch 1f60121fff5a7d333850a711af06483a kernelconfig.x86 8a29f777b9063647508fc20ef7a4c8fb kernelconfig.x86_64 e18158a62b940c4b12bafbacd1e00639 kernelconfig.armhf" sha256sums="61558aa490855f42b6340d1a1596be47454909629327c49a5e4e10268065dffa linux-3.14.tar.xz -ae2c25e7c53bffaf4e6f951a56eaa8ca645e7125cd28f16f870b7dc8aaa66b49 patch-3.14.37.xz -0e533151c70a94084f6c408c3d77ed2c61e8bf96c347cc29e655a4511382dde7 grsecurity-3.1-3.14.37-201503270048.patch +9c50ad5aacfbb8c6f8c3666e305a23d50c922ea0a13dbf44a8e15a9637f1d880 patch-3.14.39.xz +27caa69b2d965f6734564af6ce82fc55d73b75f38036617cb9d04017df03585e grsecurity-3.1-3.14.39-201504190814.patch 500f3577310be52e87b9fecdc2e9c4ca43210fd97d69089f9005d484563f74c7 fix-memory-map-for-PIE-applications.patch 21179fbb22a5b74af0a609350ae1a170e232908572b201d02e791d2ce0a685d3 imx6q-no-unclocked-sleep.patch 1ee2e685f6d841b68c37be5e25a7c61a387d3cdd1532337f08aafd6e476c1ee6 kernelconfig.x86 4dcdace21c3b91e38d7f2eb1659b75233015cccd3b9e2c8a365fe2081126ed49 kernelconfig.x86_64 655e230d216896c769ec184cb7ec4f95aea3a13326251ffdf35c17426687d1b9 kernelconfig.armhf" sha512sums="5730d83a7a81134c1e77c0bf89e42dee4f8251ad56c1ac2be20c59e26fdfaa7bea55f277e7af156b637f22e1584914a46089af85039177cb43485089c74ac26e linux-3.14.tar.xz -40439c1262331ffd594a110bab6c2da04abd7718fb3f79661de46e0c7cd99d4d8e003bb412be2348df843d7d9abe310caf1e3cc1ec5343e4b92f0769b9cfada4 patch-3.14.37.xz -139ed90ebf47aeb7f0bfd4c64a3e8c1b387641500f9ec4a972ec1ed2b9583b4b4e9618502b025dc83bbe08ab12735d78e1998c22c682c04b322ccd01db616bc5 grsecurity-3.1-3.14.37-201503270048.patch +4017169218fad8e4fae2582e34f0217924cbda8c7bfc537761af7aa45adab76b4ec365290a243bcdf5d4c7ece66a29624ba043b4bec62f2137f711e5f7138e78 patch-3.14.39.xz +dbb2c6f98efc199290ca14531ffa1eb6016130e1fb665bdd10886d56b177553ae5234be4322929c63b256abaea07d10e7247d03505654b08718cbeaae6a45cb0 grsecurity-3.1-3.14.39-201504190814.patch 4665c56ae1bbac311f9205d64918e84ee8b01d47d6e2396ff6b8adfb10aada7f7254531ce62e31edbb65c2a54a830f09ad05d314dfcd75d6272f4068945ad7c7 fix-memory-map-for-PIE-applications.patch 87d1ad59732f265a5b0db54490dc1762c14ea4b868e7eb1aedc3ce57b48046de7bbc08cf5cfcf6f1380fa84063b0edb16ba3d5e3c5670be9bbb229275c88b221 imx6q-no-unclocked-sleep.patch e9b231e87e81e61f1b8e2f13a9e977abda92ea4ff7110347e1b5eb687be4af4e0fe5dc6a8cd1cb4e23afab5fd5a9baf1b609842fe53e0b78f0299acf1f4a5131 kernelconfig.x86 diff --git a/main/linux-grsec/grsecurity-3.1-3.14.37-201503270048.patch b/main/linux-grsec/grsecurity-3.1-3.14.39-201504190814.patch index e462e33ba7..71f78fbe40 100644 --- a/main/linux-grsec/grsecurity-3.1-3.14.37-201503270048.patch +++ b/main/linux-grsec/grsecurity-3.1-3.14.39-201504190814.patch @@ -235,21 +235,24 @@ index b89a739..e289b9b 100644 +zconf.lex.c zoffset.h diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 5d91ba1..935a4e7 100644 +index 5d91ba1..ef1d374 100644 --- a/Documentation/kernel-parameters.txt +++ b/Documentation/kernel-parameters.txt -@@ -1084,6 +1084,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted. +@@ -1084,6 +1084,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted. Format: <unsigned int> such that (rxsize & ~0x1fffc0) == 0. Default: 1024 + grsec_proc_gid= [GRKERNSEC_PROC_USERGROUP] Chooses GID to + ignore grsecurity's /proc restrictions + ++ grsec_sysfs_restrict= Format: 0 | 1 ++ Default: 1 ++ Disables GRKERNSEC_SYSFS_RESTRICT if enabled in config + hashdist= [KNL,NUMA] Large hashes allocated during boot are distributed across NUMA nodes. Defaults on for 64-bit NUMA, off otherwise. -@@ -2081,6 +2085,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted. +@@ -2081,6 +2088,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted. noexec=on: enable non-executable mappings (default) noexec=off: disable non-executable mappings @@ -260,7 +263,7 @@ index 5d91ba1..935a4e7 100644 nosmap [X86] Disable SMAP (Supervisor Mode Access Prevention) even if it is supported by processor. -@@ -2348,6 +2356,30 @@ bytes respectively. Such letter suffixes can also be entirely omitted. +@@ -2348,6 +2359,30 @@ bytes respectively. Such letter suffixes can also be entirely omitted. the specified number of seconds. This is to be used if your oopses keep scrolling off the screen. @@ -292,7 +295,7 @@ index 5d91ba1..935a4e7 100644 pcd. [PARIDE] diff --git a/Makefile b/Makefile -index c24acc0..eab5b13 100644 +index b40845e..c9b79e2 100644 --- a/Makefile +++ b/Makefile @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -8618,7 +8621,7 @@ index 063b65d..7a26e9d 100644 ld r4,_DAR(r1) bl .bad_page_fault diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S -index 38d5073..f00af8d 100644 +index 5193116..1fed658 100644 --- a/arch/powerpc/kernel/exceptions-64s.S +++ b/arch/powerpc/kernel/exceptions-64s.S @@ -1584,10 +1584,10 @@ handle_page_fault: @@ -10165,10 +10168,18 @@ index 0167d26..767bb0c 100644 #include <asm/uaccess_64.h> #else diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h -index 53a28dd..50c38c3 100644 +index 53a28dd..6e11369 100644 --- a/arch/sparc/include/asm/uaccess_32.h +++ b/arch/sparc/include/asm/uaccess_32.h -@@ -250,27 +250,46 @@ extern unsigned long __copy_user(void __user *to, const void __user *from, unsig +@@ -47,6 +47,7 @@ + #define __user_ok(addr, size) ({ (void)(size); (addr) < STACK_TOP; }) + #define __kernel_ok (segment_eq(get_fs(), KERNEL_DS)) + #define __access_ok(addr,size) (__user_ok((addr) & get_fs().seg,(size))) ++#define access_ok_noprefault(type, addr, size) access_ok((type), (addr), (size)) + #define access_ok(type, addr, size) \ + ({ (void)(type); __access_ok((unsigned long)(addr), size); }) + +@@ -250,27 +251,46 @@ extern unsigned long __copy_user(void __user *to, const void __user *from, unsig static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n) { @@ -10220,7 +10231,7 @@ index 53a28dd..50c38c3 100644 } diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h -index ad7e178..c9e7423 100644 +index ad7e178..26cd4a7 100644 --- a/arch/sparc/include/asm/uaccess_64.h +++ b/arch/sparc/include/asm/uaccess_64.h @@ -10,6 +10,7 @@ @@ -10231,7 +10242,19 @@ index ad7e178..c9e7423 100644 #include <asm/asi.h> #include <asm/spitfire.h> #include <asm-generic/uaccess-unaligned.h> -@@ -214,8 +215,15 @@ extern unsigned long copy_from_user_fixup(void *to, const void __user *from, +@@ -54,6 +55,11 @@ static inline int __access_ok(const void __user * addr, unsigned long size) + return 1; + } + ++static inline int access_ok_noprefault(int type, const void __user * addr, unsigned long size) ++{ ++ return 1; ++} ++ + static inline int access_ok(int type, const void __user * addr, unsigned long size) + { + return 1; +@@ -214,8 +220,15 @@ extern unsigned long copy_from_user_fixup(void *to, const void __user *from, static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long size) { @@ -10248,7 +10271,7 @@ index ad7e178..c9e7423 100644 if (unlikely(ret)) ret = copy_from_user_fixup(to, from, size); -@@ -231,8 +239,15 @@ extern unsigned long copy_to_user_fixup(void __user *to, const void *from, +@@ -231,8 +244,15 @@ extern unsigned long copy_to_user_fixup(void __user *to, const void *from, static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long size) { @@ -21150,7 +21173,7 @@ index c005fdd..e33da29 100644 if (c->x86_model == 3 && c->x86_mask == 0) size = 64; diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index e6bddd5..517213d 100644 +index e6bddd5..5b0c55c 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -88,60 +88,6 @@ static const struct cpu_dev default_cpu = { @@ -21283,10 +21306,20 @@ index e6bddd5..517213d 100644 gdt_descr.size = GDT_SIZE - 1; load_gdt(&gdt_descr); /* Reload the per-cpu base */ -@@ -885,6 +884,10 @@ static void identify_cpu(struct cpuinfo_x86 *c) +@@ -885,6 +884,20 @@ static void identify_cpu(struct cpuinfo_x86 *c) setup_smep(c); setup_smap(c); ++#ifdef CONFIG_X86_32 ++#ifdef CONFIG_PAX_PAGEEXEC ++ if (!(__supported_pte_mask & _PAGE_NX)) ++ clear_cpu_cap(c, X86_FEATURE_PSE); ++#endif ++#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF) ++ clear_cpu_cap(c, X86_FEATURE_SEP); ++#endif ++#endif ++ +#ifdef CONFIG_X86_64 + setup_pcid(c); +#endif @@ -21294,18 +21327,7 @@ index e6bddd5..517213d 100644 /* * The vendor-specific functions might have changed features. * Now we do "generic changes." -@@ -893,6 +896,10 @@ static void identify_cpu(struct cpuinfo_x86 *c) - /* Filter out anything that depends on CPUID levels we don't have */ - filter_cpuid_features(c, true); - -+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)) -+ setup_clear_cpu_cap(X86_FEATURE_SEP); -+#endif -+ - /* If the model name is still unset, do table lookup. */ - if (!c->x86_model_id[0]) { - const char *p; -@@ -1080,10 +1087,12 @@ static __init int setup_disablecpuid(char *arg) +@@ -1080,10 +1093,12 @@ static __init int setup_disablecpuid(char *arg) } __setup("clearcpuid=", setup_disablecpuid); @@ -21321,7 +21343,7 @@ index e6bddd5..517213d 100644 DEFINE_PER_CPU_FIRST(union irq_stack_union, irq_stack_union) __aligned(PAGE_SIZE) __visible; -@@ -1097,7 +1106,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned = +@@ -1097,7 +1112,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned = EXPORT_PER_CPU_SYMBOL(current_task); DEFINE_PER_CPU(unsigned long, kernel_stack) = @@ -21330,7 +21352,7 @@ index e6bddd5..517213d 100644 EXPORT_PER_CPU_SYMBOL(kernel_stack); DEFINE_PER_CPU(char *, irq_stack_ptr) = -@@ -1247,7 +1256,7 @@ void cpu_init(void) +@@ -1247,7 +1262,7 @@ void cpu_init(void) load_ucode_ap(); cpu = stack_smp_processor_id(); @@ -21339,7 +21361,7 @@ index e6bddd5..517213d 100644 oist = &per_cpu(orig_ist, cpu); #ifdef CONFIG_NUMA -@@ -1282,7 +1291,6 @@ void cpu_init(void) +@@ -1282,7 +1297,6 @@ void cpu_init(void) wrmsrl(MSR_KERNEL_GS_BASE, 0); barrier(); @@ -21347,7 +21369,7 @@ index e6bddd5..517213d 100644 enable_x2apic(); /* -@@ -1334,7 +1342,7 @@ void cpu_init(void) +@@ -1334,7 +1348,7 @@ void cpu_init(void) { int cpu = smp_processor_id(); struct task_struct *curr = current; @@ -26989,7 +27011,7 @@ index 2f355d2..e75ed0a 100644 return ret; diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c -index c752cb4..866c432 100644 +index a6aa91f..74ba85d 100644 --- a/arch/x86/kernel/reboot.c +++ b/arch/x86/kernel/reboot.c @@ -68,6 +68,11 @@ static int __init set_bios_reboot(const struct dmi_system_id *d) @@ -27035,7 +27057,7 @@ index c752cb4..866c432 100644 "rm" (real_mode_header->machine_real_restart_asm), "a" (type)); #else -@@ -470,7 +497,7 @@ void __attribute__((weak)) mach_reboot_fixups(void) +@@ -480,7 +507,7 @@ void __attribute__((weak)) mach_reboot_fixups(void) * try to force a triple fault and then cycle between hitting the keyboard * controller and doing that */ @@ -27044,7 +27066,7 @@ index c752cb4..866c432 100644 { int i; int attempt = 0; -@@ -593,13 +620,13 @@ void native_machine_shutdown(void) +@@ -603,13 +630,13 @@ void native_machine_shutdown(void) #endif } @@ -27060,7 +27082,7 @@ index c752cb4..866c432 100644 { pr_notice("machine restart\n"); -@@ -608,7 +635,7 @@ static void native_machine_restart(char *__unused) +@@ -618,7 +645,7 @@ static void native_machine_restart(char *__unused) __machine_emergency_restart(0); } @@ -27069,7 +27091,7 @@ index c752cb4..866c432 100644 { /* Stop other cpus and apics */ machine_shutdown(); -@@ -618,7 +645,7 @@ static void native_machine_halt(void) +@@ -628,7 +655,7 @@ static void native_machine_halt(void) stop_this_cpu(NULL); } @@ -27078,7 +27100,7 @@ index c752cb4..866c432 100644 { if (pm_power_off) { if (!reboot_force) -@@ -627,9 +654,10 @@ static void native_machine_power_off(void) +@@ -637,9 +664,10 @@ static void native_machine_power_off(void) } /* A fallback in case there is no PM info available */ tboot_shutdown(TB_SHUTDOWN_HALT); @@ -30219,7 +30241,7 @@ index 7609e0e..b449b98 100644 } EXPORT_SYMBOL(csum_partial_copy_to_user); diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S -index a451235..1daa956 100644 +index a451235..a74bfa3 100644 --- a/arch/x86/lib/getuser.S +++ b/arch/x86/lib/getuser.S @@ -33,17 +33,40 @@ @@ -30244,8 +30266,6 @@ index a451235..1daa956 100644 GET_THREAD_INFO(%_ASM_DX) cmp TI_addr_limit(%_ASM_DX),%_ASM_AX jae bad_get_user - ASM_STAC --1: movzbl (%_ASM_AX),%edx + +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) + mov pax_user_shadow_base,%_ASM_DX @@ -30257,6 +30277,8 @@ index a451235..1daa956 100644 + +#endif + + ASM_STAC +-1: movzbl (%_ASM_AX),%edx +1: __copyuser_seg movzbl (%_ASM_AX),%edx xor %eax,%eax ASM_CLAC @@ -30274,8 +30296,6 @@ index a451235..1daa956 100644 GET_THREAD_INFO(%_ASM_DX) cmp TI_addr_limit(%_ASM_DX),%_ASM_AX jae bad_get_user - ASM_STAC --2: movzwl -1(%_ASM_AX),%edx + +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) + mov pax_user_shadow_base,%_ASM_DX @@ -30287,6 +30307,8 @@ index a451235..1daa956 100644 + +#endif + + ASM_STAC +-2: movzwl -1(%_ASM_AX),%edx +2: __copyuser_seg movzwl -1(%_ASM_AX),%edx xor %eax,%eax ASM_CLAC @@ -30304,8 +30326,6 @@ index a451235..1daa956 100644 GET_THREAD_INFO(%_ASM_DX) cmp TI_addr_limit(%_ASM_DX),%_ASM_AX jae bad_get_user - ASM_STAC --3: movl -3(%_ASM_AX),%edx + +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) + mov pax_user_shadow_base,%_ASM_DX @@ -30317,6 +30337,8 @@ index a451235..1daa956 100644 + +#endif + + ASM_STAC +-3: movl -3(%_ASM_AX),%edx +3: __copyuser_seg movl -3(%_ASM_AX),%edx xor %eax,%eax ASM_CLAC @@ -30895,7 +30917,7 @@ index f6d13ee..d789440 100644 3: CFI_RESTORE_STATE diff --git a/arch/x86/lib/putuser.S b/arch/x86/lib/putuser.S -index fc6ba17..d4d989d 100644 +index fc6ba17..14ad9a5 100644 --- a/arch/x86/lib/putuser.S +++ b/arch/x86/lib/putuser.S @@ -16,7 +16,9 @@ @@ -30943,8 +30965,6 @@ index fc6ba17..d4d989d 100644 + GET_THREAD_INFO(%_ASM_BX) cmp TI_addr_limit(%_ASM_BX),%_ASM_CX jae bad_put_user - ASM_STAC --1: movb %al,(%_ASM_CX) + +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) + mov pax_user_shadow_base,%_ASM_BX @@ -30956,6 +30976,8 @@ index fc6ba17..d4d989d 100644 + +#endif + + ASM_STAC +-1: movb %al,(%_ASM_CX) +1: __copyuser_seg movb %al,(_DEST) xor %eax,%eax EXIT @@ -30970,8 +30992,6 @@ index fc6ba17..d4d989d 100644 sub $1,%_ASM_BX cmp %_ASM_BX,%_ASM_CX jae bad_put_user - ASM_STAC --2: movw %ax,(%_ASM_CX) + +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) + mov pax_user_shadow_base,%_ASM_BX @@ -30983,6 +31003,8 @@ index fc6ba17..d4d989d 100644 + +#endif + + ASM_STAC +-2: movw %ax,(%_ASM_CX) +2: __copyuser_seg movw %ax,(_DEST) xor %eax,%eax EXIT @@ -30997,8 +31019,6 @@ index fc6ba17..d4d989d 100644 sub $3,%_ASM_BX cmp %_ASM_BX,%_ASM_CX jae bad_put_user - ASM_STAC --3: movl %eax,(%_ASM_CX) + +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) + mov pax_user_shadow_base,%_ASM_BX @@ -31010,6 +31030,8 @@ index fc6ba17..d4d989d 100644 + +#endif + + ASM_STAC +-3: movl %eax,(%_ASM_CX) +3: __copyuser_seg movl %eax,(_DEST) xor %eax,%eax EXIT @@ -31024,8 +31046,6 @@ index fc6ba17..d4d989d 100644 sub $7,%_ASM_BX cmp %_ASM_BX,%_ASM_CX jae bad_put_user - ASM_STAC --4: mov %_ASM_AX,(%_ASM_CX) + +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) + mov pax_user_shadow_base,%_ASM_BX @@ -31037,6 +31057,8 @@ index fc6ba17..d4d989d 100644 + +#endif + + ASM_STAC +-4: mov %_ASM_AX,(%_ASM_CX) +4: __copyuser_seg mov %_ASM_AX,(_DEST) #ifdef CONFIG_X86_32 -5: movl %edx,4(%_ASM_CX) @@ -37083,7 +37105,7 @@ index c68e724..e863008 100644 /* parse the table header to get the table length */ if (count <= sizeof(struct acpi_table_header)) diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c -index 17f9ec5..d9a455e 100644 +index fd8496a..bd2c3e3 100644 --- a/drivers/acpi/processor_idle.c +++ b/drivers/acpi/processor_idle.c @@ -952,7 +952,7 @@ static int acpi_processor_setup_cpuidle_states(struct acpi_processor *pr) @@ -40379,7 +40401,7 @@ index ca89412..a7b9c49 100644 cpuidle_curr_governor->rating < gov->rating) cpuidle_switch_governor(gov); diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c -index e918b6d..f87ea80 100644 +index dcaae4c..80cd4dd 100644 --- a/drivers/cpuidle/sysfs.c +++ b/drivers/cpuidle/sysfs.c @@ -135,7 +135,7 @@ static struct attribute *cpuidle_switch_attrs[] = { @@ -43372,25 +43394,20 @@ index 9f5ad7c..588cd84 100644 wake_up_process(pool->thread); } } -diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c -index a841123..055ebeb 100644 ---- a/drivers/infiniband/core/umem.c -+++ b/drivers/infiniband/core/umem.c -@@ -94,6 +94,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, - if (dmasync) - dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); +diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c +index 2adc143..619e970 100644 +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -923,6 +923,9 @@ ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file, + if (copy_from_user(&cmd, buf, sizeof cmd)) + return -EFAULT; -+ /* -+ * If the combination of the addr and size requested for this memory -+ * region causes an integer overflow, return error. -+ */ -+ if ((PAGE_ALIGN(addr + size) <= size) || -+ (PAGE_ALIGN(addr + size) <= addr)) -+ return ERR_PTR(-EINVAL); ++ if (!access_ok_noprefault(VERIFY_READ, cmd.start, cmd.length)) ++ return -EFAULT; + - if (!can_do_mlock()) - return ERR_PTR(-EPERM); - + INIT_UDATA(&udata, buf + sizeof cmd, + (unsigned long) cmd.response + sizeof resp, + in_len - sizeof cmd, out_len - sizeof resp); diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c index 41b1195..27971a0 100644 --- a/drivers/infiniband/hw/cxgb4/mem.c @@ -43503,10 +43520,10 @@ index 1f95bba..9530f87 100644 sdata, wqe->wr.wr.atomic.swap); goto send_comp; diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c -index f2a3f48..673ec79 100644 +index 2592ab5..0d35c7e 100644 --- a/drivers/infiniband/hw/mlx4/mad.c +++ b/drivers/infiniband/hw/mlx4/mad.c -@@ -98,7 +98,7 @@ __be64 mlx4_ib_gen_node_guid(void) +@@ -106,7 +106,7 @@ __be64 mlx4_ib_gen_node_guid(void) __be64 mlx4_ib_get_new_demux_tid(struct mlx4_ib_demux_ctx *ctx) { @@ -45211,7 +45228,7 @@ index e9d33ad..dae9880d 100644 pmd->bl_info.value_type.inc = data_block_inc; pmd->bl_info.value_type.dec = data_block_dec; diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index 1582c3da..2a5ea0b 100644 +index e400591..a94ae6b 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -187,9 +187,9 @@ struct mapped_device { @@ -45246,7 +45263,7 @@ index 1582c3da..2a5ea0b 100644 wake_up(&md->eventq); } -@@ -2740,18 +2740,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action, +@@ -2746,18 +2746,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action, uint32_t dm_next_uevent_seq(struct mapped_device *md) { @@ -51786,10 +51803,10 @@ index d8afec8..3ec7152 100644 /* check if the device is still usable */ if (unlikely(cmd->device->sdev_state == SDEV_DEL)) { diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c -index 64e487a..384f684 100644 +index 719bd82..c996ebc 100644 --- a/drivers/scsi/scsi_lib.c +++ b/drivers/scsi/scsi_lib.c -@@ -1482,7 +1482,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q) +@@ -1484,7 +1484,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q) shost = sdev->host; scsi_init_cmd_errh(cmd); cmd->result = DID_NO_CONNECT << 16; @@ -51798,7 +51815,7 @@ index 64e487a..384f684 100644 /* * SCSI request completion path will do scsi_device_unbusy(), -@@ -1508,9 +1508,9 @@ static void scsi_softirq_done(struct request *rq) +@@ -1510,9 +1510,9 @@ static void scsi_softirq_done(struct request *rq) INIT_LIST_HEAD(&cmd->eh_entry); @@ -51965,10 +51982,10 @@ index eb81c98..e6716ae 100644 return blk_trace_startstop(sdp->device->request_queue, 1); case BLKTRACESTOP: diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index fbf3b22..f5c8b60 100644 +index d6563ec..a1c5da2 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c -@@ -1980,7 +1980,7 @@ int spi_bus_unlock(struct spi_master *master) +@@ -1981,7 +1981,7 @@ int spi_bus_unlock(struct spi_master *master) EXPORT_SYMBOL_GPL(spi_bus_unlock); /* portable code must never pass more than 32 bytes */ @@ -53320,7 +53337,7 @@ index 2ebe47b..3205833 100644 dlci->modem_rx = 0; diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index 850e232..59a0ccd 100644 +index 8ab46ad..b8db1e2 100644 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c @@ -115,7 +115,7 @@ struct n_tty_data { @@ -53332,7 +53349,7 @@ index 850e232..59a0ccd 100644 size_t line_start; /* protected by output lock */ -@@ -2526,6 +2526,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops) +@@ -2578,6 +2578,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops) { *ops = tty_ldisc_N_TTY; ops->owner = NULL; @@ -58483,7 +58500,7 @@ index ce25d75..dc09eeb 100644 &data); if (!inode) { diff --git a/fs/aio.c b/fs/aio.c -index 2f7e8c2..6c0f6ec 100644 +index 3241659..62856eb 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -389,7 +389,7 @@ static int aio_setup_ring(struct kioctx *ctx) @@ -60198,10 +60215,10 @@ index 5d12d69..161d0ce 100644 GLOBAL_EXTERN atomic_t smBufAllocCount; GLOBAL_EXTERN atomic_t midCount; diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index 0218a9b..2f1ac75 100644 +index 40ddb6e..8f3e755 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c -@@ -1904,10 +1904,14 @@ static int cifs_writepages(struct address_space *mapping, +@@ -1905,10 +1905,14 @@ static int cifs_writepages(struct address_space *mapping, index = mapping->writeback_index; /* Start from prev offset */ end = -1; } else { @@ -60351,7 +60368,7 @@ index e9ad8d3..6395e45 100644 } diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c -index 34a17d4..9ca186f 100644 +index 30f3eb5..a01371c 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -364,8 +364,8 @@ smb2_clear_stats(struct cifs_tcon *tcon) @@ -61038,21 +61055,32 @@ index 4366127..b8c2cf9 100644 dcache_init(); inode_init(); diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c -index 1ff8fe5..5bf8b25 100644 +index 1ff8fe5..31407fe 100644 --- a/fs/debugfs/inode.c +++ b/fs/debugfs/inode.c -@@ -424,7 +424,11 @@ EXPORT_SYMBOL_GPL(debugfs_create_file); +@@ -422,10 +422,20 @@ EXPORT_SYMBOL_GPL(debugfs_create_file); + * If debugfs is not enabled in the kernel, the value -%ENODEV will be + * returned. */ ++#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT ++extern int grsec_enable_sysfs_restrict; ++#endif ++ struct dentry *debugfs_create_dir(const char *name, struct dentry *parent) { +- return __create_file(name, S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO, +- parent, NULL, NULL); ++ umode_t mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO; ++ +#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT -+ return __create_file(name, S_IFDIR | S_IRWXU, -+#else - return __create_file(name, S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO, ++ if (grsec_enable_sysfs_restrict) ++ mode = S_IFDIR | S_IRWXU; +#endif - parent, NULL, NULL); ++ ++ return __create_file(name, mode, parent, NULL, NULL); } EXPORT_SYMBOL_GPL(debugfs_create_dir); + diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c index a85ceb7..5097313b 100644 --- a/fs/ecryptfs/inode.c @@ -68319,10 +68347,21 @@ index ae0c3ce..9ee641c 100644 generic_fillattr(inode, stat); return 0; diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c -index ee0d761..b346c58 100644 +index ee0d761..2f33d21 100644 --- a/fs/sysfs/dir.c +++ b/fs/sysfs/dir.c -@@ -62,9 +62,16 @@ void sysfs_warn_dup(struct kernfs_node *parent, const char *name) +@@ -54,6 +54,10 @@ void sysfs_warn_dup(struct kernfs_node *parent, const char *name) + kfree(path); + } + ++#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT ++extern int grsec_enable_sysfs_restrict; ++#endif ++ + /** + * sysfs_create_dir_ns - create a directory for an object with a namespace tag + * @kobj: object we're creating directory for +@@ -62,9 +66,16 @@ void sysfs_warn_dup(struct kernfs_node *parent, const char *name) int sysfs_create_dir_ns(struct kobject *kobj, const void *ns) { struct kernfs_node *parent, *kn; @@ -68339,7 +68378,7 @@ index ee0d761..b346c58 100644 if (kobj->parent) parent = kobj->parent->sd; else -@@ -73,11 +80,22 @@ int sysfs_create_dir_ns(struct kobject *kobj, const void *ns) +@@ -73,11 +84,24 @@ int sysfs_create_dir_ns(struct kobject *kobj, const void *ns) if (!parent) return -ENOENT; @@ -68354,6 +68393,8 @@ index ee0d761..b346c58 100644 + (!strcmp(parent_name, "fs") && (!strcmp(name, "selinux") || !strcmp(name, "fuse") || !strcmp(name, "ecryptfs"))) || + (!strcmp(parent_name, "system") && !strcmp(name, "cpu"))) + mode = S_IRWXU | S_IRUGO | S_IXUGO; ++ if (!grsec_enable_sysfs_restrict) ++ mode = S_IRWXU | S_IRUGO | S_IXUGO; +#endif + + kn = kernfs_create_dir_ns(parent, name, @@ -81924,7 +81965,7 @@ index 4d89e0e..5281847 100644 /* flags */ #define CPUFREQ_STICKY (1 << 0) /* driver isn't removed even if diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h -index 50fcbb0..9d2dbd9 100644 +index d133817..3429a09 100644 --- a/include/linux/cpuidle.h +++ b/include/linux/cpuidle.h @@ -50,7 +50,8 @@ struct cpuidle_state { @@ -81937,7 +81978,7 @@ index 50fcbb0..9d2dbd9 100644 /* Idle State Flags */ #define CPUIDLE_FLAG_TIME_VALID (0x01) /* is residency time measurable? */ -@@ -192,7 +193,7 @@ struct cpuidle_governor { +@@ -191,7 +192,7 @@ struct cpuidle_governor { void (*reflect) (struct cpuidle_device *dev, int index); struct module *owner; @@ -86017,7 +86058,7 @@ index a964f72..b475afb 100644 } diff --git a/include/linux/sched.h b/include/linux/sched.h -index 218b058..7a1fb15 100644 +index 218b058..30088db 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -133,6 +133,7 @@ struct fs_struct; @@ -86272,6 +86313,15 @@ index 218b058..7a1fb15 100644 { return tsk->pid; } +@@ -1695,7 +1809,7 @@ static inline pid_t task_tgid_vnr(struct task_struct *tsk) + } + + +-static int pid_alive(const struct task_struct *p); ++static inline int pid_alive(const struct task_struct *p); + static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns) + { + pid_t pid = 0; @@ -2015,6 +2129,25 @@ extern u64 sched_clock_cpu(int cpu); extern void sched_clock_init(void); @@ -88618,6 +88668,26 @@ index ef6103b..d4e65dd 100644 #define ELFMAG0 0x7f /* EI_MAG */ #define ELFMAG1 'E' #define ELFMAG2 'L' +diff --git a/include/uapi/linux/netfilter/xt_connlimit.h b/include/uapi/linux/netfilter/xt_connlimit.h +index f165609..d1366f0 100644 +--- a/include/uapi/linux/netfilter/xt_connlimit.h ++++ b/include/uapi/linux/netfilter/xt_connlimit.h +@@ -22,8 +22,13 @@ struct xt_connlimit_info { + #endif + }; + unsigned int limit; +- /* revision 1 */ +- __u32 flags; ++ union { ++ /* revision 0 */ ++ unsigned int inverse; ++ ++ /* revision 1 */ ++ __u32 flags; ++ }; + + /* Used internally by the kernel */ + struct xt_connlimit_data *data __attribute__((aligned(8))); diff --git a/include/uapi/linux/personality.h b/include/uapi/linux/personality.h index aa169c4..6a2771d 100644 --- a/include/uapi/linux/personality.h @@ -89117,7 +89187,7 @@ index 93b6139..8d628b7 100644 next_state = Reset; return 0; diff --git a/init/main.c b/init/main.c -index 58c132d..ac3f3b0 100644 +index 58c132d..310b5fa 100644 --- a/init/main.c +++ b/init/main.c @@ -97,6 +97,8 @@ extern void radix_tree_init(void); @@ -89129,7 +89199,7 @@ index 58c132d..ac3f3b0 100644 /* * Debug helper: via this flag we know that we are in 'early bootup code' * where only the boot processor is running with IRQ disabled. This means -@@ -158,6 +160,75 @@ static int __init set_reset_devices(char *str) +@@ -158,6 +160,85 @@ static int __init set_reset_devices(char *str) __setup("reset_devices", set_reset_devices); @@ -89142,6 +89212,16 @@ index 58c132d..ac3f3b0 100644 +} +__setup("grsec_proc_gid=", setup_grsec_proc_gid); +#endif ++#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT ++int grsec_enable_sysfs_restrict = 1; ++static int __init setup_grsec_sysfs_restrict(char *str) ++{ ++ if (!simple_strtol(str, NULL, 0)) ++ grsec_enable_sysfs_restrict = 0; ++ return 1; ++} ++__setup("grsec_sysfs_restrict", setup_grsec_sysfs_restrict); ++#endif + +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) +unsigned long pax_user_shadow_base __read_only; @@ -89205,7 +89285,7 @@ index 58c132d..ac3f3b0 100644 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, }; const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, }; static const char *panic_later, *panic_param; -@@ -692,25 +763,24 @@ int __init_or_module do_one_initcall(initcall_t fn) +@@ -692,25 +773,24 @@ int __init_or_module do_one_initcall(initcall_t fn) { int count = preempt_count(); int ret; @@ -89236,7 +89316,7 @@ index 58c132d..ac3f3b0 100644 return ret; } -@@ -817,8 +887,8 @@ static int run_init_process(const char *init_filename) +@@ -817,8 +897,8 @@ static int run_init_process(const char *init_filename) { argv_init[0] = init_filename; return do_execve(getname_kernel(init_filename), @@ -89247,7 +89327,7 @@ index 58c132d..ac3f3b0 100644 } static int try_to_run_init_process(const char *init_filename) -@@ -835,6 +905,10 @@ static int try_to_run_init_process(const char *init_filename) +@@ -835,6 +915,10 @@ static int try_to_run_init_process(const char *init_filename) return ret; } @@ -89258,7 +89338,7 @@ index 58c132d..ac3f3b0 100644 static noinline void __init kernel_init_freeable(void); static int __ref kernel_init(void *unused) -@@ -859,6 +933,11 @@ static int __ref kernel_init(void *unused) +@@ -859,6 +943,11 @@ static int __ref kernel_init(void *unused) ramdisk_execute_command, ret); } @@ -89270,7 +89350,7 @@ index 58c132d..ac3f3b0 100644 /* * We try each of these until one succeeds. * -@@ -914,7 +993,7 @@ static noinline void __init kernel_init_freeable(void) +@@ -914,7 +1003,7 @@ static noinline void __init kernel_init_freeable(void) do_basic_setup(); /* Open the /dev/console on the rootfs, this should never fail */ @@ -89279,7 +89359,7 @@ index 58c132d..ac3f3b0 100644 pr_err("Warning: unable to open an initial console.\n"); (void) sys_dup(0); -@@ -927,11 +1006,13 @@ static noinline void __init kernel_init_freeable(void) +@@ -927,11 +1016,13 @@ static noinline void __init kernel_init_freeable(void) if (!ramdisk_execute_command) ramdisk_execute_command = "/init"; @@ -90191,7 +90271,7 @@ index 449518e..2658dd6 100644 #ifdef CONFIG_MODULE_UNLOAD { diff --git a/kernel/events/core.c b/kernel/events/core.c -index 69cffb4..54dc2d9 100644 +index 60146fe..2e89117 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -159,8 +159,15 @@ static struct srcu_struct pmus_srcu; @@ -90263,7 +90343,7 @@ index 69cffb4..54dc2d9 100644 arch_perf_update_userpage(userpg, now); -@@ -4381,7 +4388,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size, +@@ -4391,7 +4398,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size, /* Data. */ sp = perf_user_stack_pointer(regs); @@ -90272,7 +90352,7 @@ index 69cffb4..54dc2d9 100644 dyn_size = dump_size - rem; perf_output_skip(handle, rem); -@@ -4472,11 +4479,11 @@ static void perf_output_read_one(struct perf_output_handle *handle, +@@ -4482,11 +4489,11 @@ static void perf_output_read_one(struct perf_output_handle *handle, values[n++] = perf_event_count(event); if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) { values[n++] = enabled + @@ -90286,7 +90366,7 @@ index 69cffb4..54dc2d9 100644 } if (read_format & PERF_FORMAT_ID) values[n++] = primary_event_id(event); -@@ -6755,7 +6762,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, +@@ -6765,7 +6772,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, event->parent = parent_event; event->ns = get_pid_ns(task_active_pid_ns(current)); @@ -90295,7 +90375,7 @@ index 69cffb4..54dc2d9 100644 event->state = PERF_EVENT_STATE_INACTIVE; -@@ -7055,6 +7062,11 @@ SYSCALL_DEFINE5(perf_event_open, +@@ -7065,6 +7072,11 @@ SYSCALL_DEFINE5(perf_event_open, if (flags & ~PERF_FLAG_ALL) return -EINVAL; @@ -90307,7 +90387,7 @@ index 69cffb4..54dc2d9 100644 err = perf_copy_attr(attr_uptr, &attr); if (err) return err; -@@ -7393,10 +7405,10 @@ static void sync_child_event(struct perf_event *child_event, +@@ -7403,10 +7415,10 @@ static void sync_child_event(struct perf_event *child_event, /* * Add back the child's count to the parent's count: */ @@ -91230,7 +91310,7 @@ index 18ff0b9..40b0eab 100644 /* Don't allow clients that don't understand the native diff --git a/kernel/kmod.c b/kernel/kmod.c -index 6b375af..c1c119c 100644 +index 6b375af..d5d59d4 100644 --- a/kernel/kmod.c +++ b/kernel/kmod.c @@ -75,7 +75,7 @@ static void free_modprobe_argv(struct subprocess_info *info) @@ -91369,9 +91449,9 @@ index 6b375af..c1c119c 100644 + */ + if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) && + strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) && -+ strncmp(sub_info->path, "/usr/libexec/", 13) && ++ strncmp(sub_info->path, "/usr/libexec/", 13) && strncmp(sub_info->path, "/usr/bin/", 9) && + strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) { -+ printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path); ++ printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of permitted system paths\n", sub_info->path); + retval = -EPERM; + goto fail; + } @@ -94017,7 +94097,7 @@ index a63f4dc..349bbb0 100644 unsigned long timeout) { diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 9a3f3c4..943fa11 100644 +index 5e973ef..9a0e514 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -1775,7 +1775,7 @@ void set_numabalancing_state(bool enabled) @@ -94041,7 +94121,7 @@ index 9a3f3c4..943fa11 100644 if (!prev->mm) { prev->active_mm = NULL; -@@ -3053,6 +3055,8 @@ int can_nice(const struct task_struct *p, const int nice) +@@ -3055,6 +3057,8 @@ int can_nice(const struct task_struct *p, const int nice) /* convert nice value [19,-20] to rlimit style value [1,40] */ int nice_rlim = 20 - nice; @@ -94050,7 +94130,7 @@ index 9a3f3c4..943fa11 100644 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) || capable(CAP_SYS_NICE)); } -@@ -3086,7 +3090,8 @@ SYSCALL_DEFINE1(nice, int, increment) +@@ -3088,7 +3092,8 @@ SYSCALL_DEFINE1(nice, int, increment) if (nice > 19) nice = 19; @@ -94060,7 +94140,7 @@ index 9a3f3c4..943fa11 100644 return -EPERM; retval = security_task_setnice(current, nice); -@@ -3359,6 +3364,7 @@ recheck: +@@ -3361,6 +3366,7 @@ recheck: if (policy != p->policy && !rlim_rtprio) return -EPERM; @@ -94068,7 +94148,7 @@ index 9a3f3c4..943fa11 100644 /* can't increase priority */ if (attr->sched_priority > p->rt_priority && attr->sched_priority > rlim_rtprio) -@@ -4732,8 +4738,10 @@ void idle_task_exit(void) +@@ -4734,8 +4740,10 @@ void idle_task_exit(void) BUG_ON(cpu_online(smp_processor_id())); @@ -94080,7 +94160,7 @@ index 9a3f3c4..943fa11 100644 mmdrop(mm); } -@@ -4811,7 +4819,7 @@ static void migrate_tasks(unsigned int dead_cpu) +@@ -4813,7 +4821,7 @@ static void migrate_tasks(unsigned int dead_cpu) #if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_SYSCTL) @@ -94089,7 +94169,7 @@ index 9a3f3c4..943fa11 100644 { .procname = "sched_domain", .mode = 0555, -@@ -4828,17 +4836,17 @@ static struct ctl_table sd_ctl_root[] = { +@@ -4830,17 +4838,17 @@ static struct ctl_table sd_ctl_root[] = { {} }; @@ -94111,7 +94191,7 @@ index 9a3f3c4..943fa11 100644 /* * In the intermediate directories, both the child directory and -@@ -4846,22 +4854,25 @@ static void sd_free_ctl_entry(struct ctl_table **tablep) +@@ -4848,22 +4856,25 @@ static void sd_free_ctl_entry(struct ctl_table **tablep) * will always be set. In the lowest directory the names are * static strings and all have proc handlers. */ @@ -94143,7 +94223,7 @@ index 9a3f3c4..943fa11 100644 const char *procname, void *data, int maxlen, umode_t mode, proc_handler *proc_handler, bool load_idx) -@@ -4881,7 +4892,7 @@ set_table_entry(struct ctl_table *entry, +@@ -4883,7 +4894,7 @@ set_table_entry(struct ctl_table *entry, static struct ctl_table * sd_alloc_ctl_domain_table(struct sched_domain *sd) { @@ -94152,7 +94232,7 @@ index 9a3f3c4..943fa11 100644 if (table == NULL) return NULL; -@@ -4916,9 +4927,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd) +@@ -4918,9 +4929,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd) return table; } @@ -94164,7 +94244,7 @@ index 9a3f3c4..943fa11 100644 struct sched_domain *sd; int domain_num = 0, i; char buf[32]; -@@ -4945,11 +4956,13 @@ static struct ctl_table_header *sd_sysctl_header; +@@ -4947,11 +4958,13 @@ static struct ctl_table_header *sd_sysctl_header; static void register_sched_domain_sysctl(void) { int i, cpu_num = num_possible_cpus(); @@ -94179,7 +94259,7 @@ index 9a3f3c4..943fa11 100644 if (entry == NULL) return; -@@ -4972,8 +4985,12 @@ static void unregister_sched_domain_sysctl(void) +@@ -4974,8 +4987,12 @@ static void unregister_sched_domain_sysctl(void) if (sd_sysctl_header) unregister_sysctl_table(sd_sysctl_header); sd_sysctl_header = NULL; @@ -95201,7 +95281,7 @@ index e3be87e..abc908f 100644 /* make curr_ret_stack visible before we add the ret_stack */ smp_wmb(); diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index 774a080..7fa60b1 100644 +index 774a080..d09b170 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -352,9 +352,9 @@ struct buffer_data_page { @@ -95216,17 +95296,22 @@ index 774a080..7fa60b1 100644 unsigned long real_end; /* real end of data */ struct buffer_data_page *page; /* Actual data page */ }; -@@ -473,8 +473,8 @@ struct ring_buffer_per_cpu { +@@ -473,11 +473,11 @@ struct ring_buffer_per_cpu { unsigned long last_overrun; local_t entries_bytes; local_t entries; - local_t overrun; - local_t commit_overrun; +- local_t dropped_events; + local_unchecked_t overrun; + local_unchecked_t commit_overrun; - local_t dropped_events; ++ local_unchecked_t dropped_events; local_t committing; - local_t commits; +- local_t commits; ++ local_unchecked_t commits; + unsigned long read; + unsigned long read_bytes; + u64 write_stamp; @@ -1005,8 +1005,8 @@ static int rb_tail_page_update(struct ring_buffer_per_cpu *cpu_buffer, * * We add a counter to the write field to denote this. @@ -95318,6 +95403,15 @@ index 774a080..7fa60b1 100644 goto out_reset; } +@@ -2330,7 +2330,7 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer, + * this is easy, just stop here. + */ + if (!(buffer->flags & RB_FL_OVERWRITE)) { +- local_inc(&cpu_buffer->dropped_events); ++ local_inc_unchecked(&cpu_buffer->dropped_events); + goto out_reset; + } + @@ -2356,7 +2356,7 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer, cpu_buffer->tail_page) && (cpu_buffer->commit_page == @@ -95363,6 +95457,42 @@ index 774a080..7fa60b1 100644 if (index == old_index) { /* update counters */ local_sub(event_length, &cpu_buffer->entries_bytes); +@@ -2486,7 +2486,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer, + static void rb_start_commit(struct ring_buffer_per_cpu *cpu_buffer) + { + local_inc(&cpu_buffer->committing); +- local_inc(&cpu_buffer->commits); ++ local_inc_unchecked(&cpu_buffer->commits); + } + + static inline void rb_end_commit(struct ring_buffer_per_cpu *cpu_buffer) +@@ -2498,7 +2498,7 @@ static inline void rb_end_commit(struct ring_buffer_per_cpu *cpu_buffer) + return; + + again: +- commits = local_read(&cpu_buffer->commits); ++ commits = local_read_unchecked(&cpu_buffer->commits); + /* synchronize with interrupts */ + barrier(); + if (local_read(&cpu_buffer->committing) == 1) +@@ -2514,7 +2514,7 @@ static inline void rb_end_commit(struct ring_buffer_per_cpu *cpu_buffer) + * updating of the commit page and the clearing of the + * committing counter. + */ +- if (unlikely(local_read(&cpu_buffer->commits) != commits) && ++ if (unlikely(local_read_unchecked(&cpu_buffer->commits) != commits) && + !local_read(&cpu_buffer->committing)) { + local_inc(&cpu_buffer->committing); + goto again; +@@ -2544,7 +2544,7 @@ rb_reserve_next_event(struct ring_buffer *buffer, + barrier(); + if (unlikely(ACCESS_ONCE(cpu_buffer->buffer) != buffer)) { + local_dec(&cpu_buffer->committing); +- local_dec(&cpu_buffer->commits); ++ local_dec_unchecked(&cpu_buffer->commits); + return NULL; + } + #endif @@ -2863,7 +2863,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer, /* Do the likely case first */ @@ -95408,6 +95538,15 @@ index 774a080..7fa60b1 100644 return ret; } +@@ -3293,7 +3293,7 @@ ring_buffer_dropped_events_cpu(struct ring_buffer *buffer, int cpu) + return 0; + + cpu_buffer = buffer->buffers[cpu]; +- ret = local_read(&cpu_buffer->dropped_events); ++ ret = local_read_unchecked(&cpu_buffer->dropped_events); + + return ret; + } @@ -3356,7 +3356,7 @@ unsigned long ring_buffer_overruns(struct ring_buffer *buffer) /* if you care about this being correct, lock the buffer */ for_each_buffer_cpu(buffer, cpu) { @@ -95448,7 +95587,7 @@ index 774a080..7fa60b1 100644 local_set(&cpu_buffer->head_page->page->commit, 0); cpu_buffer->head_page->read = 0; -@@ -4145,14 +4145,14 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer) +@@ -4145,18 +4145,18 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer) INIT_LIST_HEAD(&cpu_buffer->reader_page->list); INIT_LIST_HEAD(&cpu_buffer->new_pages); @@ -95462,11 +95601,17 @@ index 774a080..7fa60b1 100644 local_set(&cpu_buffer->entries_bytes, 0); - local_set(&cpu_buffer->overrun, 0); - local_set(&cpu_buffer->commit_overrun, 0); +- local_set(&cpu_buffer->dropped_events, 0); + local_set_unchecked(&cpu_buffer->overrun, 0); + local_set_unchecked(&cpu_buffer->commit_overrun, 0); - local_set(&cpu_buffer->dropped_events, 0); ++ local_set_unchecked(&cpu_buffer->dropped_events, 0); local_set(&cpu_buffer->entries, 0); local_set(&cpu_buffer->committing, 0); +- local_set(&cpu_buffer->commits, 0); ++ local_set_unchecked(&cpu_buffer->commits, 0); + cpu_buffer->read = 0; + cpu_buffer->read_bytes = 0; + @@ -4557,8 +4557,8 @@ int ring_buffer_read_page(struct ring_buffer *buffer, rb_init_page(bpage); bpage = reader->page; @@ -96410,6 +96555,22 @@ index f07a40d..0a445a7 100644 retval = 1; } spin_unlock(&lockref->lock); +diff --git a/lib/nlattr.c b/lib/nlattr.c +index 10ad042d..25b47b5 100644 +--- a/lib/nlattr.c ++++ b/lib/nlattr.c +@@ -274,7 +274,11 @@ int nla_memcpy(void *dest, const struct nlattr *src, int count) + { + int minlen = min_t(int, count, nla_len(src)); + ++ BUG_ON(minlen < 0); ++ + memcpy(dest, nla_data(src), minlen); ++ if (count > minlen) ++ memset(dest + minlen, 0, count - minlen); + + return minlen; + } diff --git a/lib/percpu-refcount.c b/lib/percpu-refcount.c index 963b703..438bc51 100644 --- a/lib/percpu-refcount.c @@ -99790,7 +99951,7 @@ index 76b3f90..d79b8e2 100644 struct mm_struct *mm; diff --git a/mm/page-writeback.c b/mm/page-writeback.c -index 9f45f87..749bfd8 100644 +index 51d8d15..24c90d7 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -685,7 +685,7 @@ static long long pos_ratio_polynom(unsigned long setpoint, @@ -103893,6 +104054,19 @@ index bf2cb4a..d83ba8a 100644 p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW; p->rate_tokens = 0; /* 60*HZ is arbitrary, but chosen enough high so that the first +diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c +index ecb34b5..5c5ab40 100644 +--- a/net/ipv4/ip_forward.c ++++ b/net/ipv4/ip_forward.c +@@ -82,7 +82,7 @@ static int ip_forward_finish_gso(struct sk_buff *skb) + + features = netif_skb_dev_features(skb, dst->dev); + segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK); +- if (IS_ERR(segs)) { ++ if (IS_ERR_OR_NULL(segs)) { + kfree_skb(skb); + return -ENOMEM; + } diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c index 9ff497d..877a388 100644 --- a/net/ipv4/ip_fragment.c @@ -106045,43 +106219,6 @@ index 1a3c7e0..80f8b0c 100644 if (!llc_proc_dir) goto out; -diff --git a/net/llc/sysctl_net_llc.c b/net/llc/sysctl_net_llc.c -index 612a5dd..799bafc 100644 ---- a/net/llc/sysctl_net_llc.c -+++ b/net/llc/sysctl_net_llc.c -@@ -18,28 +18,28 @@ static struct ctl_table llc2_timeout_table[] = { - { - .procname = "ack", - .data = &sysctl_llc2_ack_timeout, -- .maxlen = sizeof(long), -+ .maxlen = sizeof(sysctl_llc2_ack_timeout), - .mode = 0644, - .proc_handler = proc_dointvec_jiffies, - }, - { - .procname = "busy", - .data = &sysctl_llc2_busy_timeout, -- .maxlen = sizeof(long), -+ .maxlen = sizeof(sysctl_llc2_busy_timeout), - .mode = 0644, - .proc_handler = proc_dointvec_jiffies, - }, - { - .procname = "p", - .data = &sysctl_llc2_p_timeout, -- .maxlen = sizeof(long), -+ .maxlen = sizeof(sysctl_llc2_p_timeout), - .mode = 0644, - .proc_handler = proc_dointvec_jiffies, - }, - { - .procname = "rej", - .data = &sysctl_llc2_rej_timeout, -- .maxlen = sizeof(long), -+ .maxlen = sizeof(sysctl_llc2_rej_timeout), - .mode = 0644, - .proc_handler = proc_dointvec_jiffies, - }, diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index 453e974..b3a43a5 100644 --- a/net/mac80211/cfg.c @@ -106116,7 +106253,7 @@ index 453e974..b3a43a5 100644 if (local->use_chanctx) *chandef = local->monitor_chandef; diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h -index bf7a1bb..1619d8e 100644 +index e278c64..f6d3f3d 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -28,6 +28,7 @@ @@ -106127,7 +106264,7 @@ index bf7a1bb..1619d8e 100644 #include "key.h" #include "sta_info.h" #include "debug.h" -@@ -995,7 +996,7 @@ struct ieee80211_local { +@@ -1006,7 +1007,7 @@ struct ieee80211_local { /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */ spinlock_t queue_stop_reason_lock; @@ -106767,6 +106904,19 @@ index 6ff12a1..d1815b6 100644 goto nla_put_failure; if (data_len) { +diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c +index 108120f..5b169db 100644 +--- a/net/netfilter/nfnetlink_queue_core.c ++++ b/net/netfilter/nfnetlink_queue_core.c +@@ -665,7 +665,7 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum) + * returned by nf_queue. For instance, callers rely on -ECANCELED to + * mean 'ignore this hook'. + */ +- if (IS_ERR(segs)) ++ if (IS_ERR_OR_NULL(segs)) + goto out_err; + queued = 0; + err = 0; diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c index 7350723..c58f861 100644 --- a/net/netfilter/nft_compat.c @@ -106789,6 +106939,60 @@ index 7350723..c58f861 100644 set_fs(old_fs); ret = nla_put(skb, NFTA_MATCH_INFO, XT_ALIGN(m->matchsize), out); kfree(out); +diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c +index c40b269..b73fd7d 100644 +--- a/net/netfilter/xt_connlimit.c ++++ b/net/netfilter/xt_connlimit.c +@@ -274,25 +274,38 @@ static void connlimit_mt_destroy(const struct xt_mtdtor_param *par) + kfree(info->data); + } + +-static struct xt_match connlimit_mt_reg __read_mostly = { +- .name = "connlimit", +- .revision = 1, +- .family = NFPROTO_UNSPEC, +- .checkentry = connlimit_mt_check, +- .match = connlimit_mt, +- .matchsize = sizeof(struct xt_connlimit_info), +- .destroy = connlimit_mt_destroy, +- .me = THIS_MODULE, ++static struct xt_match connlimit_mt_reg[] __read_mostly = { ++ { ++ .name = "connlimit", ++ .revision = 0, ++ .family = NFPROTO_UNSPEC, ++ .checkentry = connlimit_mt_check, ++ .match = connlimit_mt, ++ .matchsize = sizeof(struct xt_connlimit_info), ++ .destroy = connlimit_mt_destroy, ++ .me = THIS_MODULE, ++ }, ++ { ++ .name = "connlimit", ++ .revision = 1, ++ .family = NFPROTO_UNSPEC, ++ .checkentry = connlimit_mt_check, ++ .match = connlimit_mt, ++ .matchsize = sizeof(struct xt_connlimit_info), ++ .destroy = connlimit_mt_destroy, ++ .me = THIS_MODULE, ++ }, + }; + + static int __init connlimit_mt_init(void) + { +- return xt_register_match(&connlimit_mt_reg); ++ return xt_register_matches(connlimit_mt_reg, ++ ARRAY_SIZE(connlimit_mt_reg)); + } + + static void __exit connlimit_mt_exit(void) + { +- xt_unregister_match(&connlimit_mt_reg); ++ xt_unregister_matches(connlimit_mt_reg, ARRAY_SIZE(connlimit_mt_reg)); + } + + module_init(connlimit_mt_init); diff --git a/net/netfilter/xt_gradm.c b/net/netfilter/xt_gradm.c new file mode 100644 index 0000000..c566332 @@ -106945,6 +107149,19 @@ index b74aa07..d41926e 100644 sax->fsa_ax25.sax25_call = nr->source_addr; *uaddr_len = sizeof(struct sockaddr_ax25); } +diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c +index 270b77d..0a9d0981 100644 +--- a/net/openvswitch/datapath.c ++++ b/net/openvswitch/datapath.c +@@ -314,6 +314,8 @@ static int queue_gso_packets(struct datapath *dp, struct sk_buff *skb, + segs = __skb_gso_segment(skb, NETIF_F_SG, false); + if (IS_ERR(segs)) + return PTR_ERR(segs); ++ if (segs == NULL) ++ return -EINVAL; + + /* Queue all of the segments. */ + skb = segs; diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 48b1817..d2c096b 100644 --- a/net/packet/af_packet.c @@ -107073,6 +107290,18 @@ index e5b65ac..f3b6fb7 100644 if (likely(*recent == gen)) return 0; +diff --git a/net/rds/connection.c b/net/rds/connection.c +index 378c3a6..ba4382c 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -193,6 +193,7 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr, + } + + atomic_set(&conn->c_state, RDS_CONN_DOWN); ++ conn->c_send_gen = 0; + conn->c_reconnect_jiffies = 0; + INIT_DELAYED_WORK(&conn->c_send_w, rds_send_worker); + INIT_DELAYED_WORK(&conn->c_recv_w, rds_recv_worker); diff --git a/net/rds/ib.h b/net/rds/ib.h index 7280ab8..e04f4ea 100644 --- a/net/rds/ib.h @@ -107206,10 +107435,18 @@ index 4e37c1c..40084d8 100644 rds_rdma_free_op(op); else diff --git a/net/rds/rds.h b/net/rds/rds.h -index 48f8ffc..0ef3eec 100644 +index 48f8ffc..5c46cac 100644 --- a/net/rds/rds.h +++ b/net/rds/rds.h -@@ -449,7 +449,7 @@ struct rds_transport { +@@ -110,6 +110,7 @@ struct rds_connection { + void *c_transport_data; + + atomic_t c_state; ++ unsigned long c_send_gen; + unsigned long c_flags; + unsigned long c_reconnect_jiffies; + struct delayed_work c_send_w; +@@ -449,7 +450,7 @@ struct rds_transport { void (*sync_mr)(void *trans_private, int direction); void (*free_mr)(void *trans_private, int invalidate); void (*flush_mrs)(void); @@ -107219,10 +107456,85 @@ index 48f8ffc..0ef3eec 100644 struct rds_sock { struct sock rs_sk; diff --git a/net/rds/send.c b/net/rds/send.c -index a82fb66..1ea9251 100644 +index a82fb66..54c5c19 100644 --- a/net/rds/send.c +++ b/net/rds/send.c -@@ -593,8 +593,11 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status) +@@ -140,8 +140,11 @@ int rds_send_xmit(struct rds_connection *conn) + struct scatterlist *sg; + int ret = 0; + LIST_HEAD(to_be_dropped); ++ int batch_count; ++ unsigned long send_gen = 0; + + restart: ++ batch_count = 0; + + /* + * sendmsg calls here after having queued its message on the send +@@ -157,6 +160,17 @@ restart: + } + + /* ++ * we record the send generation after doing the xmit acquire. ++ * if someone else manages to jump in and do some work, we'll use ++ * this to avoid a goto restart farther down. ++ * ++ * The acquire_in_xmit() check above ensures that only one ++ * caller can increment c_send_gen at any time. ++ */ ++ conn->c_send_gen++; ++ send_gen = conn->c_send_gen; ++ ++ /* + * rds_conn_shutdown() sets the conn state and then tests RDS_IN_XMIT, + * we do the opposite to avoid races. + */ +@@ -202,6 +216,16 @@ restart: + if (!rm) { + unsigned int len; + ++ batch_count++; ++ ++ /* we want to process as big a batch as we can, but ++ * we also want to avoid softlockups. If we've been ++ * through a lot of messages, lets back off and see ++ * if anyone else jumps in ++ */ ++ if (batch_count >= 1024) ++ goto over_batch; ++ + spin_lock_irqsave(&conn->c_lock, flags); + + if (!list_empty(&conn->c_send_queue)) { +@@ -357,9 +381,9 @@ restart: + } + } + ++over_batch: + if (conn->c_trans->xmit_complete) + conn->c_trans->xmit_complete(conn); +- + release_in_xmit(conn); + + /* Nuke any messages we decided not to retransmit. */ +@@ -380,10 +404,15 @@ restart: + * If the transport cannot continue (i.e ret != 0), then it must + * call us when more room is available, such as from the tx + * completion handler. ++ * ++ * We have an extra generation check here so that if someone manages ++ * to jump in after our release_in_xmit, we'll see that they have done ++ * some work and we will skip our goto + */ + if (ret == 0) { + smp_mb(); +- if (!list_empty(&conn->c_send_queue)) { ++ if (!list_empty(&conn->c_send_queue) && ++ send_gen == conn->c_send_gen) { + rds_stats_inc(s_send_lock_queue_raced); + goto restart; + } +@@ -593,8 +622,11 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status) sock_put(rds_rs_to_sk(rs)); } rs = rm->m_rs; @@ -107235,7 +107547,7 @@ index a82fb66..1ea9251 100644 spin_lock(&rs->rs_lock); if (test_and_clear_bit(RDS_MSG_ON_SOCK, &rm->m_flags)) { -@@ -638,9 +641,6 @@ unlock_and_drop: +@@ -638,9 +670,6 @@ unlock_and_drop: * queue. This means that in the TCP case, the message may not have been * assigned the m_ack_seq yet - but that's fine as long as tcp_is_acked * checks the RDS_MSG_HAS_ACK_SEQ bit. @@ -107245,7 +107557,7 @@ index a82fb66..1ea9251 100644 */ void rds_send_drop_acked(struct rds_connection *conn, u64 ack, is_acked_func is_acked) -@@ -711,6 +711,9 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest) +@@ -711,6 +740,9 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest) */ if (!test_and_clear_bit(RDS_MSG_ON_CONN, &rm->m_flags)) { spin_unlock_irqrestore(&conn->c_lock, flags); @@ -107255,27 +107567,6 @@ index a82fb66..1ea9251 100644 continue; } list_del_init(&rm->m_conn_item); -diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c -index b5cb2aa..35773ad 100644 ---- a/net/rds/sysctl.c -+++ b/net/rds/sysctl.c -@@ -71,14 +71,14 @@ static struct ctl_table rds_sysctl_rds_table[] = { - { - .procname = "max_unacked_packets", - .data = &rds_sysctl_max_unacked_packets, -- .maxlen = sizeof(unsigned long), -+ .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = proc_dointvec, - }, - { - .procname = "max_unacked_bytes", - .data = &rds_sysctl_max_unacked_bytes, -- .maxlen = sizeof(unsigned long), -+ .maxlen = sizeof(int), - .mode = 0644, - .proc_handler = proc_dointvec, - }, diff --git a/net/rds/tcp.c b/net/rds/tcp.c index edac9ef..16bcb98 100644 --- a/net/rds/tcp.c @@ -108510,7 +108801,7 @@ index 6424372..afd36e9 100644 sub->evt.event = htohl(event, sub->swap); sub->evt.found_lower = htohl(found_lower, sub->swap); diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index 94404f1..5c1346e 100644 +index 94404f1..ac544a1 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -791,6 +791,12 @@ static struct sock *unix_find_other(struct net *net, @@ -108591,12 +108882,33 @@ index 94404f1..5c1346e 100644 seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu", s, -@@ -2373,8 +2399,10 @@ static int unix_seq_show(struct seq_file *seq, void *v) +@@ -2371,10 +2397,29 @@ static int unix_seq_show(struct seq_file *seq, void *v) + seq_putc(seq, '@'); + i++; } - for ( ; i < len; i++) - seq_putc(seq, u->addr->name->sun_path[i]); +- for ( ; i < len; i++) +- seq_putc(seq, u->addr->name->sun_path[i]); - } - unix_state_unlock(s); ++ for ( ; i < len; i++) { ++ char c = u->addr->name->sun_path[i]; ++ switch (c) { ++ case '\n': ++ seq_putc(seq, '\\'); ++ seq_putc(seq, 'n'); ++ break; ++ case '\t': ++ seq_putc(seq, '\\'); ++ seq_putc(seq, 't'); ++ break; ++ case '\\': ++ seq_putc(seq, '\\'); ++ seq_putc(seq, '\\'); ++ break; ++ default: ++ seq_putc(seq, c); ++ } ++ } + } else if (peer) + seq_printf(seq, " P%lu", sock_i_ino(peer)); + @@ -108758,6 +109070,19 @@ index 0917f04..f4e3d8c 100644 return -ENOMEM; if (!proc_create("x25/route", S_IRUGO, init_net.proc_net, +diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c +index 3bb2cdc..616d812 100644 +--- a/net/xfrm/xfrm_output.c ++++ b/net/xfrm/xfrm_output.c +@@ -157,6 +157,8 @@ static int xfrm_output_gso(struct sk_buff *skb) + kfree_skb(skb); + if (IS_ERR(segs)) + return PTR_ERR(segs); ++ if (segs == NULL) ++ return -EINVAL; + + do { + struct sk_buff *nskb = segs->next; diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 59cf325..e7fa6f0 100644 --- a/net/xfrm/xfrm_policy.c @@ -109129,14 +109454,14 @@ index 078fe1d..fbdb363 100644 fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianness? %#x\n", diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh new file mode 100644 -index 0000000..822fa9e +index 0000000..eaa4fce --- /dev/null +++ b/scripts/gcc-plugin.sh @@ -0,0 +1,51 @@ +#!/bin/sh +srctree=$(dirname "$0") +gccplugins_dir=$($3 -print-file-name=plugin) -+plugincc=$($1 -E - -o /dev/null -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF ++plugincc=$($1 -E -x c++ - -o /dev/null -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF +#include "gcc-common.h" +#if BUILDING_GCC_VERSION >= 4008 || defined(ENABLE_BUILD_WITH_CXX) +#warning $2 CXX @@ -112174,10 +112499,10 @@ index 0000000..5452feea +} diff --git a/tools/gcc/colorize_plugin.c b/tools/gcc/colorize_plugin.c new file mode 100644 -index 0000000..54461af +index 0000000..d44bd9f --- /dev/null +++ b/tools/gcc/colorize_plugin.c -@@ -0,0 +1,210 @@ +@@ -0,0 +1,215 @@ +/* + * Copyright 2012-2014 by PaX Team <pageexec@freemail.hu> + * Licensed under the GPL v2 @@ -112282,7 +112607,8 @@ index 0000000..54461af +#if BUILDING_GCC_VERSION >= 4008 + .optinfo_flags = OPTGROUP_NONE, +#endif -+#if BUILDING_GCC_VERSION >= 4009 ++#if BUILDING_GCC_VERSION >= 5000 ++#elif BUILDING_GCC_VERSION == 4009 + .has_gate = false, + .has_execute = true, +#else @@ -112308,7 +112634,11 @@ index 0000000..54461af +class colorize_rearm_pass : public simple_ipa_opt_pass { +public: + colorize_rearm_pass() : simple_ipa_opt_pass(colorize_rearm_pass_data, g) {} ++#if BUILDING_GCC_VERSION >= 5000 ++ virtual unsigned int execute(function *) { return execute_colorize_rearm(); } ++#else + unsigned int execute() { return execute_colorize_rearm(); } ++#endif +}; +} + @@ -112954,10 +113284,10 @@ index 0000000..3b5af59 +} diff --git a/tools/gcc/gcc-common.h b/tools/gcc/gcc-common.h new file mode 100644 -index 0000000..cd95c07 +index 0000000..14ec226 --- /dev/null +++ b/tools/gcc/gcc-common.h -@@ -0,0 +1,375 @@ +@@ -0,0 +1,520 @@ +#ifndef GCC_COMMON_H_INCLUDED +#define GCC_COMMON_H_INCLUDED + @@ -113038,6 +113368,10 @@ index 0000000..cd95c07 +#include "tree-cfgcleanup.h" +#endif + ++#if BUILDING_GCC_VERSION >= 4008 ++#include "is-a.h" ++#endif ++ +#include "diagnostic.h" +//#include "tree-diagnostic.h" +#include "tree-dump.h" @@ -113080,6 +113414,9 @@ index 0000000..cd95c07 +//#include "lto-streamer.h" +#endif +//#include "lto-compress.h" ++#if BUILDING_GCC_VERSION >= 5000 ++//#include "lto-section-names.h" ++#endif + +//#include "expr.h" where are you... +extern rtx emit_move_insn(rtx x, rtx y); @@ -113108,11 +113445,11 @@ index 0000000..cd95c07 +#define C_TYPE_FIELDS_READONLY(TYPE) TREE_LANG_FLAG_1(TYPE) + +#if BUILDING_GCC_VERSION == 4005 -+#define FOR_EACH_VEC_ELT_REVERSE(T,V,I,P) for (I = VEC_length(T, (V)) - 1; VEC_iterate(T, (V), (I), (P)); (I)--) -+#define FOR_EACH_LOCAL_DECL(FUN, I, D) FOR_EACH_VEC_ELT_REVERSE(tree, (FUN)->local_decls, I, D) ++#define FOR_EACH_LOCAL_DECL(FUN, I, D) for (tree vars = (FUN)->local_decls; vars && (D = TREE_VALUE(vars)); vars = TREE_CHAIN(vars), I) +#define DECL_CHAIN(NODE) (TREE_CHAIN(DECL_MINIMAL_CHECK(NODE))) +#define FOR_EACH_VEC_ELT(T, V, I, P) for (I = 0; VEC_iterate(T, (V), (I), (P)); ++(I)) +#define TODO_rebuild_cgraph_edges 0 ++#define SCOPE_FILE_SCOPE_P(EXP) (!(EXP)) + +#ifndef O_BINARY +#define O_BINARY 0 @@ -113256,6 +113593,7 @@ index 0000000..cd95c07 +#define PROP_loops 0 +#define NODE_SYMBOL(node) (node) +#define NODE_DECL(node) (node)->decl ++#define INSN_LOCATION(INSN) RTL_LOCATION(INSN) + +static inline int bb_loop_depth(const_basic_block bb) +{ @@ -113276,6 +113614,13 @@ index 0000000..cd95c07 + cgraph_create_edge_including_clones((caller), (callee), (old_call_stmt), (call_stmt), (count), (freq), (reason)) +#endif + ++#if BUILDING_GCC_VERSION == 4007 || BUILDING_GCC_VERSION == 4008 ++static inline struct cgraph_node *cgraph_alias_target(struct cgraph_node *n) ++{ ++ return cgraph_alias_aliased_node(n); ++} ++#endif ++ +#if BUILDING_GCC_VERSION <= 4008 +#define ENTRY_BLOCK_PTR_FOR_FN(FN) ENTRY_BLOCK_PTR_FOR_FUNCTION(FN) +#define EXIT_BLOCK_PTR_FOR_FN(FN) EXIT_BLOCK_PTR_FOR_FUNCTION(FN) @@ -113295,6 +113640,11 @@ index 0000000..cd95c07 +} + +#define ipa_remove_stmt_references(cnode, stmt) ++typedef union gimple_statement_d gasm; ++typedef union gimple_statement_d gassign; ++typedef union gimple_statement_d gcall; ++typedef union gimple_statement_d gphi; ++typedef union gimple_statement_d greturn; +#endif + +#if BUILDING_GCC_VERSION == 4008 @@ -113312,6 +113662,29 @@ index 0000000..cd95c07 + +#if BUILDING_GCC_VERSION <= 4009 +#define TODO_verify_il 0 ++#define AVAIL_INTERPOSABLE AVAIL_OVERWRITABLE ++#endif ++ ++#if BUILDING_GCC_VERSION == 4009 ++typedef struct gimple_statement_base gasm; ++typedef struct gimple_statement_base gassign; ++typedef struct gimple_statement_base gcall; ++typedef struct gimple_statement_base gphi; ++typedef struct gimple_statement_base greturn; ++#endif ++ ++#if BUILDING_GCC_VERSION <= 4009 ++typedef struct rtx_def rtx_insn; ++ ++static inline gasm *as_a_gasm(gimple stmt) ++{ ++ return stmt; ++} ++ ++static inline gcall *as_a_gcall(gimple stmt) ++{ ++ return stmt; ++} +#endif + +#if BUILDING_GCC_VERSION >= 4009 @@ -113328,8 +113701,110 @@ index 0000000..cd95c07 +#define TODO_verify_stmts TODO_verify_il +#define TODO_verify_rtl_sharing TODO_verify_il + ++#define TREE_INT_CST_HIGH(NODE) ({ TREE_INT_CST_EXT_NUNITS(NODE) > 1 ? (unsigned HOST_WIDE_INT)TREE_INT_CST_ELT(NODE, 1) : 0; }) ++ ++#define INSN_DELETED_P(insn) (insn)->deleted() ++ ++extern bool is_simple_builtin(tree); ++ ++// symtab/cgraph related +#define debug_cgraph_node(node) (node)->debug() +#define cgraph_get_node(decl) cgraph_node::get(decl) ++#define cgraph_n_nodes symtab->cgraph_count ++#define cgraph_max_uid symtab->cgraph_max_uid ++ ++typedef struct cgraph_node *cgraph_node_ptr; ++typedef struct cgraph_edge *cgraph_edge_p; ++ ++static inline void change_decl_assembler_name(tree decl, tree name) ++{ ++ symtab->change_decl_assembler_name(decl, name); ++} ++ ++static inline void varpool_finalize_decl(tree decl) ++{ ++ varpool_node::finalize_decl(decl); ++} ++ ++static inline cgraph_node_ptr cgraph_function_node(cgraph_node_ptr node, enum availability *availability) ++{ ++ return node->function_symbol(availability); ++} ++ ++static inline cgraph_node_ptr cgraph_function_or_thunk_node(cgraph_node_ptr node, enum availability *availability = NULL) ++{ ++ return node->ultimate_alias_target(availability); ++} ++ ++static inline bool cgraph_only_called_directly_p(cgraph_node_ptr node) ++{ ++ return node->only_called_directly_p(); ++} ++ ++static inline enum availability cgraph_function_body_availability(cgraph_node_ptr node) ++{ ++ return node->get_availability(); ++} ++ ++static inline cgraph_node_ptr cgraph_alias_target(cgraph_node_ptr node) ++{ ++ return node->get_alias_target(); ++} ++ ++static inline struct cgraph_node_hook_list *cgraph_add_function_insertion_hook(cgraph_node_hook hook, void *data) ++{ ++ return symtab->add_cgraph_insertion_hook(hook, data); ++} ++ ++static inline void cgraph_remove_function_insertion_hook(struct cgraph_node_hook_list *entry) ++{ ++ symtab->remove_cgraph_insertion_hook(entry); ++} ++ ++static inline struct cgraph_node_hook_list *cgraph_add_node_removal_hook(cgraph_node_hook hook, void *data) ++{ ++ return symtab->add_cgraph_removal_hook(hook, data); ++} ++ ++static inline void cgraph_remove_node_removal_hook(struct cgraph_node_hook_list *entry) ++{ ++ symtab->remove_cgraph_removal_hook(entry); ++} ++ ++static inline struct cgraph_2node_hook_list *cgraph_add_node_duplication_hook(cgraph_2node_hook hook, void *data) ++{ ++ return symtab->add_cgraph_duplication_hook(hook, data); ++} ++ ++static inline void cgraph_remove_node_duplication_hook(struct cgraph_2node_hook_list *entry) ++{ ++ symtab->remove_cgraph_duplication_hook(entry); ++} ++ ++// gimple related ++static inline gimple gimple_build_assign_with_ops(enum tree_code subcode, tree lhs, tree op1, tree op2 MEM_STAT_DECL) ++{ ++ return gimple_build_assign(lhs, subcode, op1, op2 PASS_MEM_STAT); ++} ++ ++static inline gasm *as_a_gasm(gimple stmt) ++{ ++ return as_a<gasm *>(stmt); ++} ++ ++static inline gcall *as_a_gcall(gimple stmt) ++{ ++ return as_a<gcall *>(stmt); ++} ++ ++// IPA/LTO related ++#define ipa_ref_list_referring_iterate(L,I,P) (L)->referring.iterate((I), &(P)) ++#define ipa_ref_list_reference_iterate(L,I,P) (L)->reference.iterate((I), &(P)) ++ ++static inline cgraph_node_ptr ipa_ref_referring_node(struct ipa_ref *ref) ++{ ++ return dyn_cast<cgraph_node_ptr>(ref->referring); ++} +#endif + +#endif @@ -114066,10 +114541,10 @@ index 0000000..89f256d +} diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c new file mode 100644 -index 0000000..e48b323 +index 0000000..2a39357 --- /dev/null +++ b/tools/gcc/latent_entropy_plugin.c -@@ -0,0 +1,466 @@ +@@ -0,0 +1,467 @@ +/* + * Copyright 2012-2014 by the PaX Team <pageexec@freemail.hu> + * Licensed under the GPL v2 @@ -114095,7 +114570,7 @@ index 0000000..e48b323 + +int plugin_is_GPL_compatible; + -+static tree latent_entropy_decl; ++static GTY(()) tree latent_entropy_decl; + +static struct plugin_info latent_entropy_plugin_info = { + .version = "201409101820", @@ -114440,6 +114915,7 @@ index 0000000..e48b323 + TREE_STATIC(latent_entropy_decl) = 1; + TREE_PUBLIC(latent_entropy_decl) = 1; + TREE_USED(latent_entropy_decl) = 1; ++ DECL_PRESERVE_P(latent_entropy_decl) = 1; + TREE_THIS_VOLATILE(latent_entropy_decl) = 1; + DECL_EXTERNAL(latent_entropy_decl) = 1; + DECL_ARTIFICIAL(latent_entropy_decl) = 1; @@ -119546,7 +120022,7 @@ index 0000000..7c9e6d1 + diff --git a/tools/gcc/size_overflow_plugin/size_overflow.h b/tools/gcc/size_overflow_plugin/size_overflow.h new file mode 100644 -index 0000000..e5b4e50 +index 0000000..37f8fc3 --- /dev/null +++ b/tools/gcc/size_overflow_plugin/size_overflow.h @@ -0,0 +1,127 @@ @@ -119579,11 +120055,11 @@ index 0000000..e5b4e50 +}; + +// size_overflow_plugin.c -+extern tree report_size_overflow_decl; -+extern tree size_overflow_type_HI; -+extern tree size_overflow_type_SI; -+extern tree size_overflow_type_DI; -+extern tree size_overflow_type_TI; ++extern GTY(()) tree report_size_overflow_decl; ++extern GTY(()) tree size_overflow_type_HI; ++extern GTY(()) tree size_overflow_type_SI; ++extern GTY(()) tree size_overflow_type_DI; ++extern GTY(()) tree size_overflow_type_TI; + + +// size_overflow_plugin_hash.c @@ -126597,10 +127073,10 @@ index 0000000..0888f6c + diff --git a/tools/gcc/stackleak_plugin.c b/tools/gcc/stackleak_plugin.c new file mode 100644 -index 0000000..924652b +index 0000000..90125d6 --- /dev/null +++ b/tools/gcc/stackleak_plugin.c -@@ -0,0 +1,395 @@ +@@ -0,0 +1,396 @@ +/* + * Copyright 2011-2014 by the PaX Team <pageexec@freemail.hu> + * Licensed under the GPL v2 @@ -126628,7 +127104,8 @@ index 0000000..924652b +static int track_frame_size = -1; +static const char track_function[] = "pax_track_stack"; +static const char check_function[] = "pax_check_alloca"; -+static tree track_function_decl, check_function_decl; ++static GTY(()) tree track_function_decl; ++static GTY(()) tree check_function_decl; +static bool init_locals; + +static struct plugin_info stackleak_plugin_info = { |