main/linux-grsec: upgrade to 3.14.29

2 files changed, 115 insertions, 87 deletions

diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 0a71251df..63072add3 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -2,12 +2,12 @@
 
 _flavor=grsec
 pkgname=linux-${_flavor}
-pkgver=3.14.28
+pkgver=3.14.29
 case $pkgver in
 *.*.*)	_kernver=${pkgver%.*};;
 *.*)	_kernver=${pkgver};;
 esac
-pkgrel=1
+pkgrel=0
 pkgdesc="Linux kernel with grsecurity"
 url=http://grsecurity.net
 depends="mkinitfs linux-firmware"
@@ -17,7 +17,7 @@ _config=${config:-kernelconfig.${CARCH}}
 install=
 source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz
 	http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz
-	grsecurity-3.0-3.14.28-201501142323.patch
+	grsecurity-3.0-3.14.29-201501182217.patch
 
 	fix-memory-map-for-PIE-applications.patch
 	imx6q-no-unclocked-sleep.patch
@@ -166,8 +166,8 @@ dev() {
 }
 
 md5sums="b621207b3f6ecbb67db18b13258f8ea8  linux-3.14.tar.xz
-502a4ee34af04e9b9e375e254f7b9a8f  patch-3.14.28.xz
-ec66b87cfa54e5b5bc5b1a3f762d7441  grsecurity-3.0-3.14.28-201501142323.patch
+27e0d59e4348d87fba25db6cda180092  patch-3.14.29.xz
+a11c1fe1e8077d8573802df0c56ae3a4  grsecurity-3.0-3.14.29-201501182217.patch
 c6a4ae7e8ca6159e1631545515805216  fix-memory-map-for-PIE-applications.patch
 1a307fc1d63231bf01d22493a4f14378  imx6q-no-unclocked-sleep.patch
 1ced4011e09c6e0a72101d65670f0b5c  net-v2-gre-fix-the-inner-mac-header-in-nbma-tunnel-xmit-path.patch
@@ -175,8 +175,8 @@ c6a4ae7e8ca6159e1631545515805216  fix-memory-map-for-PIE-applications.patch
 38b50cd1a7670f886c5e9fe9f1f91496  kernelconfig.x86_64
 6709c83fbbd38d40f31d39f0022d4ce9  kernelconfig.armhf"
 sha256sums="61558aa490855f42b6340d1a1596be47454909629327c49a5e4e10268065dffa  linux-3.14.tar.xz
-e3c79a30ac959c84c329be5461da88a5c79c6463da30d376c27bb103aee79b51  patch-3.14.28.xz
-55484132973b1c65a335a2f42cd87b59d45c7044fcaddae9698ce8e5c6d47373  grsecurity-3.0-3.14.28-201501142323.patch
+38b6a77a0364f0045e2006bbc3638db298d92e8d02bd7daef302d21c5fdc029b  patch-3.14.29.xz
+3f22ab2bdba95d82bf186670fd6b2dfa77d6d9863eb9b13b149132ca329771bc  grsecurity-3.0-3.14.29-201501182217.patch
 500f3577310be52e87b9fecdc2e9c4ca43210fd97d69089f9005d484563f74c7  fix-memory-map-for-PIE-applications.patch
 21179fbb22a5b74af0a609350ae1a170e232908572b201d02e791d2ce0a685d3  imx6q-no-unclocked-sleep.patch
 2c8158a2a4042ac1bcbfa046eb1c7966de56d3797eee99d153d2b176dfff165c  net-v2-gre-fix-the-inner-mac-header-in-nbma-tunnel-xmit-path.patch
@@ -184,8 +184,8 @@ bf953a65ba047b5316509da5bc7a6dbcee12767e343d26e8360369d27bfdbe78  kernelconfig.x
 d555a01f2b464e20cfa71c67ea6d571f80c707c5a3fea33879de09b085e2d7b6  kernelconfig.x86_64
 01a6c90cf0643f8727d120aede2267ca7303c4ebe548c5d19222d4387ceb98cc  kernelconfig.armhf"
 sha512sums="5730d83a7a81134c1e77c0bf89e42dee4f8251ad56c1ac2be20c59e26fdfaa7bea55f277e7af156b637f22e1584914a46089af85039177cb43485089c74ac26e  linux-3.14.tar.xz
-ae4dc86ff594f1a4c1a2a8786a1ad1293e539c8225ae202b87ad474c22dbe1906cd919566307a69ae48f2e3819d1024e6997adaff48a2184ac87ec61a38b6a34  patch-3.14.28.xz
-4e5d53f2a15011e51b538863cd9d36619bd6452151d99275b67f5942537b03f0e1d5cb06594e301ae3ee294461d891656023b793eeafcabcaec9e55a26bdfae2  grsecurity-3.0-3.14.28-201501142323.patch
+e95d0ec8bb426a3517c72189007c2bd004320d2b53b01db4d9f88da7523517047f84716252d8e8400233304f0bcae326a517d6c7f8b893e102e2a48a9c21b8bf  patch-3.14.29.xz
+fa2ea9e14327977dd3e97301dedc2e4b9f9c405ab1d8f28b8a03386a047b592dbc87b5a6a3ddd835a59e6c197532eadbb78ba064cb76f48fec4bf44ba58afb56  grsecurity-3.0-3.14.29-201501182217.patch
 4665c56ae1bbac311f9205d64918e84ee8b01d47d6e2396ff6b8adfb10aada7f7254531ce62e31edbb65c2a54a830f09ad05d314dfcd75d6272f4068945ad7c7  fix-memory-map-for-PIE-applications.patch
 87d1ad59732f265a5b0db54490dc1762c14ea4b868e7eb1aedc3ce57b48046de7bbc08cf5cfcf6f1380fa84063b0edb16ba3d5e3c5670be9bbb229275c88b221  imx6q-no-unclocked-sleep.patch
 ce0429ba660fa010252e09fc812680b8dafb7b6b213c8eabde89e289f3db536253b81841ec1a73de5408e5556dd5e99c3536dc48457750bfdf7845a3df2b9a79  net-v2-gre-fix-the-inner-mac-header-in-nbma-tunnel-xmit-path.patch
diff --git a/main/linux-grsec/grsecurity-3.0-3.14.28-201501142323.patch b/main/linux-grsec/grsecurity-3.0-3.14.29-201501182217.patch
index 7a014f0e6..6a5071f9a 100644
--- a/main/linux-grsec/grsecurity-3.0-3.14.28-201501142323.patch
+++ b/main/linux-grsec/grsecurity-3.0-3.14.29-201501182217.patch
@@ -292,7 +292,7 @@ index 7116fda..2f71588 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index a2e572b..b0e0734 100644
+index 7aff64e..32dc1aa 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -3047,7 +3047,7 @@ index 0dd3b79..b67388e 100644
  	if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
  		trace_sys_enter(regs, scno);
 diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
-index 1e8b030..37c3022 100644
+index aab70f6..bd2751b 100644
 --- a/arch/arm/kernel/setup.c
 +++ b/arch/arm/kernel/setup.c
 @@ -100,21 +100,23 @@ EXPORT_SYMBOL(system_serial_high);
@@ -3153,7 +3153,7 @@ index 04d6388..5115238 100644
 -	return page;
 -}
 diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
-index b7b4c86..47c4f77 100644
+index 8cd3724..ea86e94 100644
 --- a/arch/arm/kernel/smp.c
 +++ b/arch/arm/kernel/smp.c
 @@ -73,7 +73,7 @@ enum ipi_msg_type {
@@ -21766,10 +21766,10 @@ index 95700e5..19779f8 100644
  	.attrs = NULL, /* patched at runtime */
  };
 diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
-index 047f540..afdeba0 100644
+index 2f98588..aa6f3c4 100644
 --- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
 +++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
-@@ -3326,7 +3326,7 @@ static void __init uncore_types_exit(struct intel_uncore_type **types)
+@@ -3342,7 +3342,7 @@ static void __init uncore_types_exit(struct intel_uncore_type **types)
  static int __init uncore_type_init(struct intel_uncore_type *type)
  {
  	struct intel_uncore_pmu *pmus;
@@ -35954,7 +35954,7 @@ index d6bfb87..876ee18 100644
  	return NULL;
  }
 diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c
-index 431e875..cbb23f3 100644
+index ab6ba35..7ede14e 100644
 --- a/arch/x86/vdso/vma.c
 +++ b/arch/x86/vdso/vma.c
 @@ -16,8 +16,6 @@
@@ -35966,15 +35966,20 @@ index 431e875..cbb23f3 100644
  extern char vdso_start[], vdso_end[];
  extern unsigned short vdso_sync_cpuid;
  
-@@ -141,7 +139,6 @@ static unsigned long vdso_addr(unsigned long start, unsigned len)
- 	 * unaligned here as a result of stack start randomization.
- 	 */
- 	addr = PAGE_ALIGN(addr);
--	addr = align_vdso_addr(addr);
+@@ -152,12 +150,6 @@ static unsigned long vdso_addr(unsigned long start, unsigned len)
+ 		addr = start;
+ 	}
  
+-	/*
+-	 * Forcibly align the final address in case we have a hardware
+-	 * issue that requires alignment for performance reasons.
+-	 */
+-	addr = align_vdso_addr(addr);
+-
  	return addr;
  }
-@@ -154,30 +151,31 @@ static int setup_additional_pages(struct linux_binprm *bprm,
+ 
+@@ -169,30 +161,37 @@ static int setup_additional_pages(struct linux_binprm *bprm,
  				  unsigned size)
  {
  	struct mm_struct *mm = current->mm;
@@ -35992,7 +35997,13 @@ index 431e875..cbb23f3 100644
 +#endif
 +
  	addr = vdso_addr(mm->start_stack, size);
++
++	/*
++	 * Forcibly align the final address in case we have a hardware
++	 * issue that requires alignment for performance reasons.
++	 */
 +	addr = align_vdso_addr(addr);
++
  	addr = get_unmapped_area(NULL, addr, size, 0, 0);
  	if (IS_ERR_VALUE(addr)) {
  		ret = addr;
@@ -36015,7 +36026,7 @@ index 431e875..cbb23f3 100644
  
  up_fail:
  	up_write(&mm->mmap_sem);
-@@ -197,10 +195,3 @@ int x32_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+@@ -212,10 +211,3 @@ int x32_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
  				      vdsox32_size);
  }
  #endif
@@ -36039,7 +36050,7 @@ index 01b9026..1e476df 100644
  	  This is the Linux Xen port.  Enabling this will allow the
  	  kernel to boot in a paravirtualized environment under the
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 201d09a..e4723e5 100644
+index 201d09a..be93768 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
 @@ -123,8 +123,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -36127,7 +36138,19 @@ index 201d09a..e4723e5 100644
  {
  	if (pm_power_off)
  		pm_power_off();
-@@ -1564,7 +1560,17 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1455,8 +1451,9 @@ static void __ref xen_setup_gdt(int cpu)
+ 	pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry_boot;
+ 	pv_cpu_ops.load_gdt = xen_load_gdt_boot;
+ 
+-	setup_stack_canary_segment(0);
+-	switch_to_new_gdt(0);
++	setup_stack_canary_segment(cpu);
++	load_percpu_segment(cpu);
++	switch_to_new_gdt(cpu);
+ 
+ 	pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry;
+ 	pv_cpu_ops.load_gdt = xen_load_gdt;
+@@ -1564,7 +1561,17 @@ asmlinkage void __init xen_start_kernel(void)
  	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
  
  	/* Work out if we support NX */
@@ -36146,7 +36169,7 @@ index 201d09a..e4723e5 100644
  
  	/* Get mfn list */
  	xen_build_dynamic_phys_to_machine();
-@@ -1592,13 +1598,6 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1592,13 +1599,6 @@ asmlinkage void __init xen_start_kernel(void)
  
  	machine_ops = xen_machine_ops;
  
@@ -36558,7 +36581,7 @@ index a0926a6..b2b14b2 100644
  			err = -EFAULT;
  			goto out;
 diff --git a/block/genhd.c b/block/genhd.c
-index e6723bd..703e4ac 100644
+index a8d586a..d9910b1 100644
 --- a/block/genhd.c
 +++ b/block/genhd.c
 @@ -469,21 +469,24 @@ static char *bdevt_str(dev_t devt, char *buf)
@@ -38091,10 +38114,10 @@ index 969c3c2..9b72956 100644
  }
  
 diff --git a/drivers/base/bus.c b/drivers/base/bus.c
-index 59dc808..f10c74e 100644
+index 45d0fa7..89244c9 100644
 --- a/drivers/base/bus.c
 +++ b/drivers/base/bus.c
-@@ -1124,7 +1124,7 @@ int subsys_interface_register(struct subsys_interface *sif)
+@@ -1126,7 +1126,7 @@ int subsys_interface_register(struct subsys_interface *sif)
  		return -EINVAL;
  
  	mutex_lock(&subsys->p->mutex);
@@ -38103,7 +38126,7 @@ index 59dc808..f10c74e 100644
  	if (sif->add_dev) {
  		subsys_dev_iter_init(&iter, subsys, NULL, NULL);
  		while ((dev = subsys_dev_iter_next(&iter)))
-@@ -1149,7 +1149,7 @@ void subsys_interface_unregister(struct subsys_interface *sif)
+@@ -1151,7 +1151,7 @@ void subsys_interface_unregister(struct subsys_interface *sif)
  	subsys = sif->subsys;
  
  	mutex_lock(&subsys->p->mutex);
@@ -42491,10 +42514,10 @@ index 37ac7b5..d52a5c9 100644
  	/* copy over all the bus versions */
  	if (dev->bus && dev->bus->pm) {
 diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
-index 7cd42ea..a367c48 100644
+index d92c7d9..ba3e5c0 100644
 --- a/drivers/hid/hid-core.c
 +++ b/drivers/hid/hid-core.c
-@@ -2432,7 +2432,7 @@ EXPORT_SYMBOL_GPL(hid_ignore);
+@@ -2433,7 +2433,7 @@ EXPORT_SYMBOL_GPL(hid_ignore);
  
  int hid_add_device(struct hid_device *hdev)
  {
@@ -42503,7 +42526,7 @@ index 7cd42ea..a367c48 100644
  	int ret;
  
  	if (WARN_ON(hdev->status & HID_STAT_ADDED))
-@@ -2466,7 +2466,7 @@ int hid_add_device(struct hid_device *hdev)
+@@ -2467,7 +2467,7 @@ int hid_add_device(struct hid_device *hdev)
  	/* XXX hack, any other cleaner solution after the driver core
  	 * is converted to allow more than 20 bytes as the device name? */
  	dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
@@ -48928,7 +48951,7 @@ index 729ffbf..49f50e3 100644
  
  static u16 ar9003_calc_ptr_chksum(struct ar9003_txc *ads)
 diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
-index 0acd4b5..0591c91 100644
+index 32ae0a4..90fdaf5 100644
 --- a/drivers/net/wireless/ath/ath9k/hw.h
 +++ b/drivers/net/wireless/ath/ath9k/hw.h
 @@ -629,7 +629,7 @@ struct ath_hw_private_ops {
@@ -49736,7 +49759,7 @@ index e1e7026..d28dd33 100644
  #define ASPM_STATE_ALL		(ASPM_STATE_L0S | ASPM_STATE_L1)
  
 diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
-index 34dff3a..70a5646 100644
+index 5b428db..553e4e3 100644
 --- a/drivers/pci/probe.c
 +++ b/drivers/pci/probe.c
 @@ -175,7 +175,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
@@ -52932,7 +52955,7 @@ index 2ebe47b..3205833 100644
  
  	dlci->modem_rx = 0;
 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
-index 28ac3f3..9019b3b 100644
+index d46b4cc..c470f00 100644
 --- a/drivers/tty/n_tty.c
 +++ b/drivers/tty/n_tty.c
 @@ -115,7 +115,7 @@ struct n_tty_data {
@@ -52944,7 +52967,7 @@ index 28ac3f3..9019b3b 100644
  	size_t line_start;
  
  	/* protected by output lock */
-@@ -2520,6 +2520,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
+@@ -2521,6 +2521,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
  {
  	*ops = tty_ldisc_N_TTY;
  	ops->owner = NULL;
@@ -53160,7 +53183,7 @@ index c0f2b3e..7e3f80c 100644
  	if (unlikely(pdev->id < 0 || pdev->id >= UART_NR))
  		return -ENXIO;
 diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
-index 9cd706d..6ff2de7 100644
+index 7d3a3f5..0ac875e 100644
 --- a/drivers/tty/serial/samsung.c
 +++ b/drivers/tty/serial/samsung.c
 @@ -463,11 +463,16 @@ static void s3c24xx_serial_shutdown(struct uart_port *port)
@@ -53180,7 +53203,7 @@ index 9cd706d..6ff2de7 100644
  	dbg("s3c24xx_serial_startup: port=%p (%08lx,%p)\n",
  	    port->mapbase, port->membase);
  
-@@ -1141,10 +1146,6 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
+@@ -1145,10 +1150,6 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
  	/* setup info for port */
  	port->dev	= &platdev->dev;
  
@@ -59304,7 +59327,7 @@ index cbd3a7d6f..c6a2881 100644
  
  		WARN_ON(trans->transid != btrfs_header_generation(parent));
 diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
-index 451b00c..a2cccee 100644
+index 12e3556..eea9bcf 100644
 --- a/fs/btrfs/delayed-inode.c
 +++ b/fs/btrfs/delayed-inode.c
 @@ -459,7 +459,7 @@ static int __btrfs_add_delayed_deletion_item(struct btrfs_delayed_node *node,
@@ -64706,7 +64729,7 @@ index 86f5d3e..ae2d35a 100644
  static struct nfsd4_operation nfsd4_ops[];
  
 diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
-index 8657335..cd3e37f 100644
+index dd1afa3..509afd1 100644
 --- a/fs/nfsd/nfs4xdr.c
 +++ b/fs/nfsd/nfs4xdr.c
 @@ -1542,7 +1542,7 @@ nfsd4_decode_notsupp(struct nfsd4_compoundargs *argp, void *p)
@@ -65022,10 +65045,10 @@ index 0440134..d52c93a 100644
  bail:
  	if (handle)
 diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
-index feed025f..cee9402 100644
+index b242762..04fc642 100644
 --- a/fs/ocfs2/namei.c
 +++ b/fs/ocfs2/namei.c
-@@ -158,7 +158,7 @@ bail_add:
+@@ -166,7 +166,7 @@ bail_add:
  		 * NOTE: This dentry already has ->d_op set from
  		 * ocfs2_get_parent() and ocfs2_get_dentry()
  		 */
@@ -83806,7 +83829,7 @@ index 5bba088..7ad4ae7 100644
  static inline int
  vma_dup_policy(struct vm_area_struct *src, struct vm_area_struct *dst)
 diff --git a/include/linux/mm.h b/include/linux/mm.h
-index d5039da..152c9ea 100644
+index 46b8ab5..6823be2 100644
 --- a/include/linux/mm.h
 +++ b/include/linux/mm.h
 @@ -127,6 +127,11 @@ extern unsigned int kobjsize(const void *objp);
@@ -89374,7 +89397,7 @@ index 0b097c8..11dd5c5 100644
  #ifdef CONFIG_MODULE_UNLOAD
  		{
 diff --git a/kernel/events/core.c b/kernel/events/core.c
-index 4bbb27a..decf605 100644
+index 69cffb4..54dc2d9 100644
 --- a/kernel/events/core.c
 +++ b/kernel/events/core.c
 @@ -159,8 +159,15 @@ static struct srcu_struct pmus_srcu;
@@ -96360,7 +96383,7 @@ index a98c7fc..393f8f1 100644
  	}
  	unset_migratetype_isolate(page, MIGRATE_MOVABLE);
 diff --git a/mm/memory.c b/mm/memory.c
-index 48d7365..732f880 100644
+index 924429e..732f880 100644
 --- a/mm/memory.c
 +++ b/mm/memory.c
 @@ -403,6 +403,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
@@ -96799,7 +96822,7 @@ index 48d7365..732f880 100644
 -		if (prev && prev->vm_end == address)
 -			return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
 -
--		expand_downwards(vma, address - PAGE_SIZE);
+-		return expand_downwards(vma, address - PAGE_SIZE);
 -	}
 -	if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
 -		struct vm_area_struct *next = vma->vm_next;
@@ -96808,7 +96831,7 @@ index 48d7365..732f880 100644
 -		if (next && next->vm_start == address + PAGE_SIZE)
 -			return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
 -
--		expand_upwards(vma, address + PAGE_SIZE);
+-		return expand_upwards(vma, address + PAGE_SIZE);
 -	}
 -	return 0;
 -}
@@ -97245,7 +97268,7 @@ index b1eb536..091d154 100644
  	    capable(CAP_IPC_LOCK))
  		ret = do_mlockall(flags);
 diff --git a/mm/mmap.c b/mm/mmap.c
-index b91ac80..390920e 100644
+index 085bcd8..cb98f9f 100644
 --- a/mm/mmap.c
 +++ b/mm/mmap.c
 @@ -37,6 +37,7 @@
@@ -97902,15 +97925,17 @@ index b91ac80..390920e 100644
  /*
   * Verify that the stack growth is acceptable and
   * update accounting. This is shared with both the
-@@ -2065,6 +2370,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
- 		return -ENOMEM;
+@@ -2066,8 +2371,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
  
  	/* Stack limit test */
-+	gr_learn_resource(current, RLIMIT_STACK, size, 1);
- 	if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
+ 	actual_size = size;
+-	if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN)))
+-		actual_size -= PAGE_SIZE;
++	gr_learn_resource(current, RLIMIT_STACK, actual_size, 1);
+ 	if (actual_size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
  		return -ENOMEM;
  
-@@ -2075,6 +2381,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2078,6 +2382,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
  		locked = mm->locked_vm + grow;
  		limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
  		limit >>= PAGE_SHIFT;
@@ -97918,7 +97943,7 @@ index b91ac80..390920e 100644
  		if (locked > limit && !capable(CAP_IPC_LOCK))
  			return -ENOMEM;
  	}
-@@ -2104,37 +2411,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2107,37 +2412,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
   * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
   * vma is the last one with address > vma->vm_end.  Have to extend vma.
   */
@@ -97976,7 +98001,7 @@ index b91ac80..390920e 100644
  		unsigned long size, grow;
  
  		size = address - vma->vm_start;
-@@ -2169,6 +2487,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+@@ -2172,6 +2488,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
  			}
  		}
  	}
@@ -97985,7 +98010,7 @@ index b91ac80..390920e 100644
  	vma_unlock_anon_vma(vma);
  	khugepaged_enter_vma_merge(vma);
  	validate_mm(vma->vm_mm);
-@@ -2183,6 +2503,8 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2186,6 +2504,8 @@ int expand_downwards(struct vm_area_struct *vma,
  				   unsigned long address)
  {
  	int error;
@@ -97994,7 +98019,7 @@ index b91ac80..390920e 100644
  
  	/*
  	 * We must make sure the anon_vma is allocated
-@@ -2196,6 +2518,15 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2199,6 +2519,15 @@ int expand_downwards(struct vm_area_struct *vma,
  	if (error)
  		return error;
  
@@ -98010,7 +98035,7 @@ index b91ac80..390920e 100644
  	vma_lock_anon_vma(vma);
  
  	/*
-@@ -2205,9 +2536,17 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2208,9 +2537,17 @@ int expand_downwards(struct vm_area_struct *vma,
  	 */
  
  	/* Somebody else might have raced and expanded it already */
@@ -98029,7 +98054,7 @@ index b91ac80..390920e 100644
  		size = vma->vm_end - address;
  		grow = (vma->vm_start - address) >> PAGE_SHIFT;
  
-@@ -2232,13 +2571,27 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2235,13 +2572,27 @@ int expand_downwards(struct vm_area_struct *vma,
  				vma->vm_pgoff -= grow;
  				anon_vma_interval_tree_post_update_vma(vma);
  				vma_gap_update(vma);
@@ -98057,7 +98082,7 @@ index b91ac80..390920e 100644
  	khugepaged_enter_vma_merge(vma);
  	validate_mm(vma->vm_mm);
  	return error;
-@@ -2336,6 +2689,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2339,6 +2690,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
  	do {
  		long nrpages = vma_pages(vma);
  
@@ -98071,7 +98096,7 @@ index b91ac80..390920e 100644
  		if (vma->vm_flags & VM_ACCOUNT)
  			nr_accounted += nrpages;
  		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
-@@ -2380,6 +2740,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2383,6 +2741,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
  	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
  	vma->vm_prev = NULL;
  	do {
@@ -98088,7 +98113,7 @@ index b91ac80..390920e 100644
  		vma_rb_erase(vma, &mm->mm_rb);
  		mm->map_count--;
  		tail_vma = vma;
-@@ -2407,14 +2777,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2410,14 +2778,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	struct vm_area_struct *new;
  	int err = -ENOMEM;
  
@@ -98122,7 +98147,7 @@ index b91ac80..390920e 100644
  	/* most fields are the same, copy all, and then fixup */
  	*new = *vma;
  
-@@ -2427,6 +2816,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2430,6 +2817,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
  	}
  
@@ -98145,7 +98170,7 @@ index b91ac80..390920e 100644
  	err = vma_dup_policy(vma, new);
  	if (err)
  		goto out_free_vma;
-@@ -2447,6 +2852,38 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2450,6 +2853,38 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	else
  		err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
  
@@ -98184,7 +98209,7 @@ index b91ac80..390920e 100644
  	/* Success. */
  	if (!err)
  		return 0;
-@@ -2456,10 +2893,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2459,10 +2894,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  		new->vm_ops->close(new);
  	if (new->vm_file)
  		fput(new->vm_file);
@@ -98204,7 +98229,7 @@ index b91ac80..390920e 100644
  	kmem_cache_free(vm_area_cachep, new);
   out_err:
  	return err;
-@@ -2472,6 +2917,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2475,6 +2918,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  	      unsigned long addr, int new_below)
  {
@@ -98220,7 +98245,7 @@ index b91ac80..390920e 100644
  	if (mm->map_count >= sysctl_max_map_count)
  		return -ENOMEM;
  
-@@ -2483,11 +2937,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2486,11 +2938,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
   * work.  This now handles partial unmappings.
   * Jeremy Fitzhardinge <jeremy@goop.org>
   */
@@ -98251,7 +98276,7 @@ index b91ac80..390920e 100644
  	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
  		return -EINVAL;
  
-@@ -2562,6 +3035,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+@@ -2565,6 +3036,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
  	/* Fix up all other VM information */
  	remove_vma_list(mm, vma);
  
@@ -98260,7 +98285,7 @@ index b91ac80..390920e 100644
  	return 0;
  }
  
-@@ -2570,6 +3045,13 @@ int vm_munmap(unsigned long start, size_t len)
+@@ -2573,6 +3046,13 @@ int vm_munmap(unsigned long start, size_t len)
  	int ret;
  	struct mm_struct *mm = current->mm;
  
@@ -98274,7 +98299,7 @@ index b91ac80..390920e 100644
  	down_write(&mm->mmap_sem);
  	ret = do_munmap(mm, start, len);
  	up_write(&mm->mmap_sem);
-@@ -2583,16 +3065,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+@@ -2586,16 +3066,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
  	return vm_munmap(addr, len);
  }
  
@@ -98291,7 +98316,7 @@ index b91ac80..390920e 100644
  /*
   *  this is really a simplified "do_mmap".  it only handles
   *  anonymous maps.  eventually we may be able to do some
-@@ -2606,6 +3078,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2609,6 +3079,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	struct rb_node ** rb_link, * rb_parent;
  	pgoff_t pgoff = addr >> PAGE_SHIFT;
  	int error;
@@ -98299,7 +98324,7 @@ index b91ac80..390920e 100644
  
  	len = PAGE_ALIGN(len);
  	if (!len)
-@@ -2613,10 +3086,24 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2616,10 +3087,24 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  
  	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
  
@@ -98324,7 +98349,7 @@ index b91ac80..390920e 100644
  	error = mlock_future_check(mm, mm->def_flags, len);
  	if (error)
  		return error;
-@@ -2630,21 +3117,20 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2633,21 +3118,20 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	/*
  	 * Clear old maps.  this also does some error checking for us
  	 */
@@ -98349,7 +98374,7 @@ index b91ac80..390920e 100644
  		return -ENOMEM;
  
  	/* Can we just expand an old private anonymous mapping? */
-@@ -2658,7 +3144,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2661,7 +3145,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	 */
  	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
  	if (!vma) {
@@ -98358,7 +98383,7 @@ index b91ac80..390920e 100644
  		return -ENOMEM;
  	}
  
-@@ -2672,10 +3158,11 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2675,10 +3159,11 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	vma_link(mm, vma, prev, rb_link, rb_parent);
  out:
  	perf_event_mmap(vma);
@@ -98372,7 +98397,7 @@ index b91ac80..390920e 100644
  	return addr;
  }
  
-@@ -2737,6 +3224,7 @@ void exit_mmap(struct mm_struct *mm)
+@@ -2740,6 +3225,7 @@ void exit_mmap(struct mm_struct *mm)
  	while (vma) {
  		if (vma->vm_flags & VM_ACCOUNT)
  			nr_accounted += vma_pages(vma);
@@ -98380,7 +98405,7 @@ index b91ac80..390920e 100644
  		vma = remove_vma(vma);
  	}
  	vm_unacct_memory(nr_accounted);
-@@ -2754,6 +3242,13 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2757,6 +3243,13 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
  	struct vm_area_struct *prev;
  	struct rb_node **rb_link, *rb_parent;
  
@@ -98394,7 +98419,7 @@ index b91ac80..390920e 100644
  	/*
  	 * The vm_pgoff of a purely anonymous vma should be irrelevant
  	 * until its first write fault, when page's anon_vma and index
-@@ -2777,7 +3272,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2780,7 +3273,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
  	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
  		return -ENOMEM;
  
@@ -98416,7 +98441,7 @@ index b91ac80..390920e 100644
  	return 0;
  }
  
-@@ -2796,6 +3305,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2799,6 +3306,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	struct rb_node **rb_link, *rb_parent;
  	bool faulted_in_anon_vma = true;
  
@@ -98425,7 +98450,7 @@ index b91ac80..390920e 100644
  	/*
  	 * If anonymous vma has not yet been faulted, update new pgoff
  	 * to match new location, to increase its chance of merging.
-@@ -2860,6 +3371,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2863,6 +3372,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	return NULL;
  }
  
@@ -98465,7 +98490,7 @@ index b91ac80..390920e 100644
  /*
   * Return true if the calling process may expand its vm space by the passed
   * number of pages
-@@ -2871,6 +3415,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+@@ -2874,6 +3416,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
  
  	lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
  
@@ -98473,7 +98498,7 @@ index b91ac80..390920e 100644
  	if (cur + npages > lim)
  		return 0;
  	return 1;
-@@ -2941,6 +3486,22 @@ int install_special_mapping(struct mm_struct *mm,
+@@ -2944,6 +3487,22 @@ int install_special_mapping(struct mm_struct *mm,
  	vma->vm_start = addr;
  	vma->vm_end = addr + len;
  
@@ -110510,10 +110535,10 @@ index 4c41c90..37f3631 100644
  	return snd_seq_device_register_driver(SNDRV_SEQ_DEV_ID_EMU10K1_SYNTH, &ops,
  					      sizeof(struct snd_emu10k1_synth_arg));
 diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
-index dafcf82..dd9356f 100644
+index f6e5c4e..7df65ef 100644
 --- a/sound/pci/hda/hda_codec.c
 +++ b/sound/pci/hda/hda_codec.c
-@@ -983,14 +983,10 @@ find_codec_preset(struct hda_codec *codec)
+@@ -985,14 +985,10 @@ find_codec_preset(struct hda_codec *codec)
  	mutex_unlock(&preset_mutex);
  
  	if (mod_requested < HDA_MODREQ_MAX_COUNT) {
@@ -110530,7 +110555,7 @@ index dafcf82..dd9356f 100644
  		mod_requested++;
  		goto again;
  	}
-@@ -2739,7 +2735,7 @@ static int get_kctl_0dB_offset(struct snd_kcontrol *kctl, int *step_to_check)
+@@ -2741,7 +2737,7 @@ static int get_kctl_0dB_offset(struct snd_kcontrol *kctl, int *step_to_check)
  		/* FIXME: set_fs() hack for obtaining user-space TLV data */
  		mm_segment_t fs = get_fs();
  		set_fs(get_ds());
@@ -118439,10 +118464,10 @@ index 0000000..4378111
 +}
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
 new file mode 100644
-index 0000000..19cb000
+index 0000000..dfb7516
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,6035 @@
+@@ -0,0 +1,6038 @@
 +intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL
 +ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
 +storvsc_connect_to_vsp_22 storvsc_connect_to_vsp 2 22 NULL
@@ -119357,6 +119382,7 @@ index 0000000..19cb000
 +hidg_alloc_ep_req_10159 hidg_alloc_ep_req 2 10159 NULL
 +asd_store_update_bios_10165 asd_store_update_bios 4 10165 NULL
 +kstrtol_from_user_10168 kstrtol_from_user 2 10168 NULL
++persistent_ram_vmap_10169 persistent_ram_vmap 2-1 10169 NULL
 +proc_pid_attr_read_10173 proc_pid_attr_read 3 10173 NULL
 +jffs2_user_setxattr_10182 jffs2_user_setxattr 4 10182 NULL
 +xfs_attr_rmtval_copyout_10222 xfs_attr_rmtval_copyout 0 10222 NULL nohasharray
@@ -122103,6 +122129,7 @@ index 0000000..19cb000
 +sd_completed_bytes_39705 sd_completed_bytes 0 39705 NULL
 +ftrace_pid_write_39710 ftrace_pid_write 3 39710 NULL
 +adt7316_spi_multi_read_39765 adt7316_spi_multi_read 3 39765 NULL
++persistent_ram_buffer_map_39776 persistent_ram_buffer_map 1-2 39776 NULL
 +security_inode_listsecurity_39812 security_inode_listsecurity 0 39812 NULL
 +snd_pcm_oss_writev3_39818 snd_pcm_oss_writev3 3 39818 NULL
 +get_priv_size_39828 get_priv_size 0-1 39828 NULL
@@ -124216,6 +124243,7 @@ index 0000000..19cb000
 +altera_irscan_62396 altera_irscan 2 62396 NULL
 +set_ssp_62411 set_ssp 4 62411 NULL
 +udf_expand_file_adinicb_62470 udf_expand_file_adinicb 0 62470 NULL
++persistent_ram_new_62493 persistent_ram_new 1-2 62493 NULL
 +ext_rts51x_sd_execute_read_data_62501 ext_rts51x_sd_execute_read_data 9 62501 NULL
 +pep_sendmsg_62524 pep_sendmsg 4 62524 NULL
 +test_iso_queue_62534 test_iso_queue 5 62534 NULL