summaryrefslogtreecommitdiffstats
path: root/testing/linux-virt-grsec
diff options
context:
space:
mode:
authorNatanael Copa <ncopa@alpinelinux.org>2012-09-17 19:23:58 +0000
committerNatanael Copa <ncopa@alpinelinux.org>2012-09-17 19:30:34 +0000
commitfd4ebdb299d5fbf2bb09168ce2c530364be16c9b (patch)
tree7710260e056bfb3d88937bb232f9bfd8d97f30fa /testing/linux-virt-grsec
parentc2e5b06819796406457ef99bb3e0bffc2a96880b (diff)
downloadaports-fd4ebdb299d5fbf2bb09168ce2c530364be16c9b.tar.bz2
aports-fd4ebdb299d5fbf2bb09168ce2c530364be16c9b.tar.xz
testing/linux-virt-grsec: upgrade to 3.4.11
Diffstat (limited to 'testing/linux-virt-grsec')
-rw-r--r--testing/linux-virt-grsec/APKBUILD14
-rw-r--r--testing/linux-virt-grsec/grsecurity-2.9.1-3.4.11-1.patch (renamed from testing/linux-virt-grsec/grsecurity-2.9.1-3.4.5-201207171624.patch)5252
-rw-r--r--testing/linux-virt-grsec/kernelconfig.x863
-rw-r--r--testing/linux-virt-grsec/kernelconfig.x86_643
4 files changed, 3881 insertions, 1391 deletions
diff --git a/testing/linux-virt-grsec/APKBUILD b/testing/linux-virt-grsec/APKBUILD
index 92eae2421..a7870849e 100644
--- a/testing/linux-virt-grsec/APKBUILD
+++ b/testing/linux-virt-grsec/APKBUILD
@@ -2,9 +2,9 @@
_flavor=grsec
pkgname=linux-virt-${_flavor}
-pkgver=3.4.5
+pkgver=3.4.11
_kernver=3.4
-pkgrel=3
+pkgrel=0
pkgdesc="Linux kernel with grsecurity"
url=http://grsecurity.net
depends="mkinitfs linux-firmware"
@@ -14,7 +14,7 @@ _config=${config:-kernelconfig.${CARCH}}
install=
source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz
http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz
- grsecurity-2.9.1-3.4.5-201207171624.patch
+ grsecurity-2.9.1-$pkgver-1.patch
xen-xsave.patch
kernelconfig.x86
@@ -137,8 +137,8 @@ dev() {
}
md5sums="967f72983655e2479f951195953e8480 linux-3.4.tar.xz
-e60f1d8032069d091f3692c1d7a89b8b patch-3.4.5.xz
-2d4274ea6a7ebb913b989952155a14e1 grsecurity-2.9.1-3.4.5-201207171624.patch
+2149df47fc96fec05787bf0197fb7b16 patch-3.4.11.xz
+261e513021d40a01ebd18947fde0ab1d grsecurity-2.9.1-3.4.11-1.patch
0d095dbf194d5609ad260ecd3f0ab15d xen-xsave.patch
-454b72a498ddc9c40bbe20594d04b2cb kernelconfig.x86
-0cdb1e4ea4045e2792e4331ac1ebea38 kernelconfig.x86_64"
+edf0b2f99cb5391e424bd7edf6f88c6c kernelconfig.x86
+32cbb968820788def5fd2677b61351c1 kernelconfig.x86_64"
diff --git a/testing/linux-virt-grsec/grsecurity-2.9.1-3.4.5-201207171624.patch b/testing/linux-virt-grsec/grsecurity-2.9.1-3.4.11-1.patch
index a842b50b1..cb22897eb 100644
--- a/testing/linux-virt-grsec/grsecurity-2.9.1-3.4.5-201207171624.patch
+++ b/testing/linux-virt-grsec/grsecurity-2.9.1-3.4.11-1.patch
@@ -1,5 +1,5 @@
diff --git a/Documentation/dontdiff b/Documentation/dontdiff
-index b4a898f..a0e01d0 100644
+index b4a898f..781c7ad 100644
--- a/Documentation/dontdiff
+++ b/Documentation/dontdiff
@@ -2,9 +2,11 @@
@@ -22,7 +22,7 @@ index b4a898f..a0e01d0 100644
*.grep
*.grp
*.gz
-@@ -48,9 +51,11 @@
+@@ -48,14 +51,17 @@
*.tab.h
*.tex
*.ver
@@ -34,7 +34,14 @@ index b4a898f..a0e01d0 100644
*_vga16.c
*~
\#*#
-@@ -69,6 +74,7 @@ Image
+ *.9
+-.*
++.[^g]*
++.gen*
+ .*.d
+ .mm
+ 53c700_d.h
+@@ -69,6 +75,7 @@ Image
Module.markers
Module.symvers
PENDING
@@ -42,7 +49,7 @@ index b4a898f..a0e01d0 100644
SCCS
System.map*
TAGS
-@@ -80,6 +86,7 @@ aic7*seq.h*
+@@ -80,6 +87,7 @@ aic7*seq.h*
aicasm
aicdb.h*
altivec*.c
@@ -50,7 +57,7 @@ index b4a898f..a0e01d0 100644
asm-offsets.h
asm_offsets.h
autoconf.h*
-@@ -92,19 +99,24 @@ bounds.h
+@@ -92,19 +100,24 @@ bounds.h
bsetup
btfixupprep
build
@@ -75,7 +82,7 @@ index b4a898f..a0e01d0 100644
conmakehash
consolemap_deftbl.c*
cpustr.h
-@@ -115,9 +127,11 @@ devlist.h*
+@@ -115,9 +128,11 @@ devlist.h*
dnotify_test
docproc
dslm
@@ -87,7 +94,7 @@ index b4a898f..a0e01d0 100644
fixdep
flask.h
fore200e_mkfirm
-@@ -125,12 +139,15 @@ fore200e_pca_fw.c*
+@@ -125,12 +140,15 @@ fore200e_pca_fw.c*
gconf
gconf.glade.h
gen-devlist
@@ -103,7 +110,7 @@ index b4a898f..a0e01d0 100644
hpet_example
hugepage-mmap
hugepage-shm
-@@ -145,7 +162,7 @@ int32.c
+@@ -145,7 +163,7 @@ int32.c
int4.c
int8.c
kallsyms
@@ -112,7 +119,7 @@ index b4a898f..a0e01d0 100644
keywords.c
ksym.c*
ksym.h*
-@@ -153,7 +170,7 @@ kxgettext
+@@ -153,7 +171,7 @@ kxgettext
lkc_defs.h
lex.c
lex.*.c
@@ -121,7 +128,7 @@ index b4a898f..a0e01d0 100644
logo_*.c
logo_*_clut224.c
logo_*_mono.c
-@@ -164,14 +181,15 @@ machtypes.h
+@@ -164,14 +182,15 @@ machtypes.h
map
map_hugetlb
maui_boot.h
@@ -138,7 +145,7 @@ index b4a898f..a0e01d0 100644
mkprep
mkregtable
mktables
-@@ -188,6 +206,7 @@ oui.c*
+@@ -188,6 +207,7 @@ oui.c*
page-types
parse.c
parse.h
@@ -146,7 +153,7 @@ index b4a898f..a0e01d0 100644
patches*
pca200e.bin
pca200e_ecd.bin2
-@@ -197,6 +216,7 @@ perf-archive
+@@ -197,6 +217,7 @@ perf-archive
piggyback
piggy.gzip
piggy.S
@@ -154,7 +161,7 @@ index b4a898f..a0e01d0 100644
pnmtologo
ppc_defs.h*
pss_boot.h
-@@ -207,6 +227,7 @@ r300_reg_safe.h
+@@ -207,6 +228,7 @@ r300_reg_safe.h
r420_reg_safe.h
r600_reg_safe.h
recordmcount
@@ -162,7 +169,7 @@ index b4a898f..a0e01d0 100644
relocs
rlim_names.h
rn50_reg_safe.h
-@@ -216,7 +237,9 @@ series
+@@ -216,7 +238,9 @@ series
setup
setup.bin
setup.elf
@@ -172,7 +179,7 @@ index b4a898f..a0e01d0 100644
sm_tbl*
split-include
syscalltab.h
-@@ -227,6 +250,7 @@ tftpboot.img
+@@ -227,6 +251,7 @@ tftpboot.img
timeconst.h
times.h*
trix_boot.h
@@ -180,7 +187,7 @@ index b4a898f..a0e01d0 100644
utsrelease.h*
vdso-syms.lds
vdso.lds
-@@ -238,13 +262,17 @@ vdso32.lds
+@@ -238,13 +263,17 @@ vdso32.lds
vdso32.so.dbg
vdso64.lds
vdso64.so.dbg
@@ -198,7 +205,7 @@ index b4a898f..a0e01d0 100644
vmlinuz
voffset.h
vsyscall.lds
-@@ -252,9 +280,11 @@ vsyscall_32.lds
+@@ -252,9 +281,11 @@ vsyscall_32.lds
wanxlfw.inc
uImage
unifdef
@@ -228,8 +235,41 @@ index c1601e5..08557ce 100644
pcbit= [HW,ISDN]
pcd. [PARIDE]
+diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
+index 88fd7f5..b318a78 100644
+--- a/Documentation/sysctl/fs.txt
++++ b/Documentation/sysctl/fs.txt
+@@ -163,16 +163,22 @@ This value can be used to query and set the core dump mode for setuid
+ or otherwise protected/tainted binaries. The modes are
+
+ 0 - (default) - traditional behaviour. Any process which has changed
+- privilege levels or is execute only will not be dumped
++ privilege levels or is execute only will not be dumped.
+ 1 - (debug) - all processes dump core when possible. The core dump is
+ owned by the current user and no security is applied. This is
+ intended for system debugging situations only. Ptrace is unchecked.
++ This is insecure as it allows regular users to examine the memory
++ contents of privileged processes.
+ 2 - (suidsafe) - any binary which normally would not be dumped is dumped
+- readable by root only. This allows the end user to remove
+- such a dump but not access it directly. For security reasons
+- core dumps in this mode will not overwrite one another or
+- other files. This mode is appropriate when administrators are
+- attempting to debug problems in a normal environment.
++ anyway, but only if the "core_pattern" kernel sysctl is set to
++ either a pipe handler or a fully qualified path. (For more details
++ on this limitation, see CVE-2006-2451.) This mode is appropriate
++ when administrators are attempting to debug problems in a normal
++ environment, and either have a core dump pipe handler that knows
++ to treat privileged core dumps with care, or specific directory
++ defined for catching core dumps. If a core dump happens without
++ a pipe handler or fully qualifid path, a message will be emitted
++ to syslog warning about the lack of a correct setting.
+
+ ==============================================================
+
diff --git a/Makefile b/Makefile
-index a2e69a0..cc487da 100644
+index 22345c0..33cbc29 100644
--- a/Makefile
+++ b/Makefile
@@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -255,7 +295,7 @@ index a2e69a0..cc487da 100644
$(Q)$(MAKE) $(build)=scripts/basic
$(Q)rm -f .tmp_quiet_recordmcount
-@@ -564,6 +565,56 @@ else
+@@ -564,6 +565,60 @@ else
KBUILD_CFLAGS += -O2
endif
@@ -286,12 +326,16 @@ index a2e69a0..cc487da 100644
+endif
+COLORIZE_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/colorize_plugin.so
+ifdef CONFIG_PAX_SIZE_OVERFLOW
-+SIZE_OVERFLOW_PLUGIN := -fplugin=$(objtree)/tools/gcc/size_overflow_plugin.so -DSIZE_OVERFLOW_PLUGIN
++SIZE_OVERFLOW_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/size_overflow_plugin.so -DSIZE_OVERFLOW_PLUGIN
++endif
++ifdef CONFIG_PAX_LATENT_ENTROPY
++LATENT_ENTROPY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/latent_entropy_plugin.so -DLATENT_ENTROPY_PLUGIN
+endif
+GCC_PLUGINS_CFLAGS := $(CONSTIFY_PLUGIN_CFLAGS) $(STACKLEAK_PLUGIN_CFLAGS) $(KALLOCSTAT_PLUGIN_CFLAGS)
-+GCC_PLUGINS_CFLAGS += $(KERNEXEC_PLUGIN_CFLAGS) $(CHECKER_PLUGIN_CFLAGS) $(COLORIZE_PLUGIN_CFLAGS) $(SIZE_OVERFLOW_PLUGIN)
++GCC_PLUGINS_CFLAGS += $(KERNEXEC_PLUGIN_CFLAGS) $(CHECKER_PLUGIN_CFLAGS) $(COLORIZE_PLUGIN_CFLAGS)
++GCC_PLUGINS_CFLAGS += $(SIZE_OVERFLOW_PLUGIN_CFLAGS) $(LATENT_ENTROPY_PLUGIN_CFLAGS)
+GCC_PLUGINS_AFLAGS := $(KERNEXEC_PLUGIN_AFLAGS)
-+export PLUGINCC CONSTIFY_PLUGIN STACKLEAK_PLUGIN KERNEXEC_PLUGIN CHECKER_PLUGIN SIZE_OVERFLOW_PLUGIN
++export PLUGINCC CONSTIFY_PLUGIN
+ifeq ($(KBUILD_EXTMOD),)
+gcc-plugins:
+ $(Q)$(MAKE) $(build)=tools/gcc
@@ -312,7 +356,7 @@ index a2e69a0..cc487da 100644
include $(srctree)/arch/$(SRCARCH)/Makefile
ifneq ($(CONFIG_FRAME_WARN),0)
-@@ -708,7 +759,7 @@ export mod_strip_cmd
+@@ -708,7 +763,7 @@ export mod_strip_cmd
ifeq ($(KBUILD_EXTMOD),)
@@ -321,7 +365,7 @@ index a2e69a0..cc487da 100644
vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
$(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-@@ -932,6 +983,8 @@ vmlinux.o: $(modpost-init) $(vmlinux-main) FORCE
+@@ -932,6 +987,8 @@ vmlinux.o: $(modpost-init) $(vmlinux-main) FORCE
# The actual objects are generated when descending,
# make sure no implicit rule kicks in
@@ -330,7 +374,7 @@ index a2e69a0..cc487da 100644
$(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
# Handle descending into subdirectories listed in $(vmlinux-dirs)
-@@ -941,7 +994,7 @@ $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
+@@ -941,7 +998,7 @@ $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
# Error messages still appears in the original language
PHONY += $(vmlinux-dirs)
@@ -339,7 +383,7 @@ index a2e69a0..cc487da 100644
$(Q)$(MAKE) $(build)=$@
# Store (new) KERNELRELASE string in include/config/kernel.release
-@@ -985,6 +1038,7 @@ prepare0: archprepare FORCE
+@@ -985,6 +1042,7 @@ prepare0: archprepare FORCE
$(Q)$(MAKE) $(build)=.
# All the preparing..
@@ -347,7 +391,7 @@ index a2e69a0..cc487da 100644
prepare: prepare0
# Generate some files
-@@ -1092,6 +1146,8 @@ all: modules
+@@ -1092,6 +1150,8 @@ all: modules
# using awk while concatenating to the final file.
PHONY += modules
@@ -356,7 +400,7 @@ index a2e69a0..cc487da 100644
modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
$(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
@$(kecho) ' Building modules, stage 2.';
-@@ -1107,7 +1163,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
+@@ -1107,7 +1167,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
# Target to prepare building external modules
PHONY += modules_prepare
@@ -365,7 +409,7 @@ index a2e69a0..cc487da 100644
# Target to install modules
PHONY += modules_install
-@@ -1166,7 +1222,7 @@ CLEAN_FILES += vmlinux System.map \
+@@ -1166,7 +1226,7 @@ CLEAN_FILES += vmlinux System.map \
MRPROPER_DIRS += include/config usr/include include/generated \
arch/*/include/generated
MRPROPER_FILES += .config .config.old .version .old_version \
@@ -374,7 +418,7 @@ index a2e69a0..cc487da 100644
Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS
# clean - Delete most, but leave enough to build external modules
-@@ -1204,6 +1260,7 @@ distclean: mrproper
+@@ -1204,6 +1264,7 @@ distclean: mrproper
\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
-o -name '.*.rej' \
@@ -382,7 +426,7 @@ index a2e69a0..cc487da 100644
-o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
-type f -print | xargs rm -f
-@@ -1364,6 +1421,8 @@ PHONY += $(module-dirs) modules
+@@ -1364,6 +1425,8 @@ PHONY += $(module-dirs) modules
$(module-dirs): crmodverdir $(objtree)/Module.symvers
$(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
@@ -391,7 +435,7 @@ index a2e69a0..cc487da 100644
modules: $(module-dirs)
@$(kecho) ' Building modules, stage 2.';
$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1490,17 +1549,21 @@ else
+@@ -1490,17 +1553,21 @@ else
target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
endif
@@ -417,7 +461,7 @@ index a2e69a0..cc487da 100644
$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
%.symtypes: %.c prepare scripts FORCE
$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1510,11 +1573,15 @@ endif
+@@ -1510,11 +1577,15 @@ endif
$(cmd_crmodverdir)
$(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
$(build)=$(build-dir)
@@ -748,7 +792,7 @@ index 5eecab1..609abc0 100644
/* Allow reads even for write-only mappings */
if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
-index 68374ba..cff7196 100644
+index 68374ba..b095124 100644
--- a/arch/arm/include/asm/atomic.h
+++ b/arch/arm/include/asm/atomic.h
@@ -17,17 +17,35 @@
@@ -909,7 +953,7 @@ index 68374ba..cff7196 100644
-"1: ldrex %0, [%3]\n"
-" sub %0, %0, %4\n"
+"1: ldrex %1, [%3]\n"
-+" sub %0, %1, %4\n"
++" subs %0, %1, %4\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+" bvc 3f\n"
@@ -1136,13 +1180,11 @@ index 68374ba..cff7196 100644
static inline u64 atomic64_add_return(u64 i, atomic64_t *v)
{
-- u64 result;
-- unsigned long tmp;
+ u64 result, tmp;
-
- smp_mb();
-
- __asm__ __volatile__("@ atomic64_add_return\n"
++
++ smp_mb();
++
++ __asm__ __volatile__("@ atomic64_add_return\n"
+"1: ldrexd %1, %H1, [%3]\n"
+" adds %0, %1, %4\n"
+" adcs %H0, %H1, %H4\n"
@@ -1175,19 +1217,21 @@ index 68374ba..cff7196 100644
+
+static inline u64 atomic64_add_return_unchecked(u64 i, atomic64_unchecked_t *v)
+{
-+ u64 result;
-+ unsigned long tmp;
-+
-+ smp_mb();
-+
+ u64 result;
+ unsigned long tmp;
+
+ smp_mb();
+
+- __asm__ __volatile__("@ atomic64_add_return\n"
+ __asm__ __volatile__("@ atomic64_add_return_unchecked\n"
"1: ldrexd %0, %H0, [%3]\n"
" adds %0, %0, %4\n"
" adc %H0, %H0, %H4\n"
-@@ -318,6 +607,36 @@ static inline void atomic64_sub(u64 i, atomic64_t *v)
+@@ -318,23 +607,34 @@ static inline void atomic64_sub(u64 i, atomic64_t *v)
__asm__ __volatile__("@ atomic64_sub\n"
"1: ldrexd %0, %H0, [%3]\n"
" subs %0, %0, %4\n"
+-" sbc %H0, %H0, %H4\n"
+" sbcs %H0, %H0, %H4\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
@@ -1196,48 +1240,49 @@ index 68374ba..cff7196 100644
+"3:\n"
+#endif
+
-+" strexd %1, %0, %H0, [%3]\n"
-+" teq %1, #0\n"
-+" bne 1b"
+ " strexd %1, %0, %H0, [%3]\n"
+ " teq %1, #0\n"
+ " bne 1b"
+
+#ifdef CONFIG_PAX_REFCOUNT
+"\n4:\n"
+ _ASM_EXTABLE(2b, 4b)
+#endif
+
-+ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
-+ : "r" (&v->counter), "r" (i)
-+ : "cc");
-+}
-+
+ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
+ : "r" (&v->counter), "r" (i)
+ : "cc");
+ }
+
+-static inline u64 atomic64_sub_return(u64 i, atomic64_t *v)
+static inline void atomic64_sub_unchecked(u64 i, atomic64_unchecked_t *v)
-+{
-+ u64 result;
-+ unsigned long tmp;
-+
+ {
+ u64 result;
+ unsigned long tmp;
+
+- smp_mb();
+-
+- __asm__ __volatile__("@ atomic64_sub_return\n"
+ __asm__ __volatile__("@ atomic64_sub_unchecked\n"
-+"1: ldrexd %0, %H0, [%3]\n"
-+" subs %0, %0, %4\n"
+ "1: ldrexd %0, %H0, [%3]\n"
+ " subs %0, %0, %4\n"
" sbc %H0, %H0, %H4\n"
- " strexd %1, %0, %H0, [%3]\n"
- " teq %1, #0\n"
-@@ -329,18 +648,32 @@ static inline void atomic64_sub(u64 i, atomic64_t *v)
-
- static inline u64 atomic64_sub_return(u64 i, atomic64_t *v)
- {
-- u64 result;
-- unsigned long tmp;
+@@ -344,6 +644,39 @@ static inline u64 atomic64_sub_return(u64 i, atomic64_t *v)
+ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
+ : "r" (&v->counter), "r" (i)
+ : "cc");
++}
++
++static inline u64 atomic64_sub_return(u64 i, atomic64_t *v)
++{
+ u64 result, tmp;
-
- smp_mb();
-
- __asm__ __volatile__("@ atomic64_sub_return\n"
--"1: ldrexd %0, %H0, [%3]\n"
--" subs %0, %0, %4\n"
--" sbc %H0, %H0, %H4\n"
++
++ smp_mb();
++
++ __asm__ __volatile__("@ atomic64_sub_return\n"
+"1: ldrexd %1, %H1, [%3]\n"
+" subs %0, %1, %4\n"
-+" sbc %H0, %H1, %H4\n"
++" sbcs %H0, %H1, %H4\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+" bvc 3f\n"
@@ -1247,18 +1292,21 @@ index 68374ba..cff7196 100644
+"3:\n"
+#endif
+
- " strexd %1, %0, %H0, [%3]\n"
- " teq %1, #0\n"
- " bne 1b"
++" strexd %1, %0, %H0, [%3]\n"
++" teq %1, #0\n"
++" bne 1b"
+
+#ifdef CONFIG_PAX_REFCOUNT
+"\n4:\n"
+ _ASM_EXTABLE(2b, 4b)
+#endif
+
- : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
- : "r" (&v->counter), "r" (i)
- : "cc");
++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
++ : "r" (&v->counter), "r" (i)
++ : "cc");
+
+ smp_mb();
+
@@ -374,6 +707,30 @@ static inline u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old, u64 new)
return oldval;
}
@@ -1306,7 +1354,7 @@ index 68374ba..cff7196 100644
-" sbc %H0, %H0, #0\n"
+"1: ldrexd %1, %H1, [%3]\n"
+" subs %0, %1, #1\n"
-+" sbc %H0, %H1, #0\n"
++" sbcs %H0, %H1, #0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+" bvc 3f\n"
@@ -1339,7 +1387,8 @@ index 68374ba..cff7196 100644
-" beq 2f\n"
+" beq 4f\n"
" adds %0, %0, %6\n"
- " adc %H0, %H0, %H6\n"
+-" adc %H0, %H0, %H6\n"
++" adcs %H0, %H0, %H6\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+" bvc 3f\n"
@@ -1391,7 +1440,7 @@ index 75fe66b..2255c86 100644
/*
* Memory returned by kmalloc() may be used for DMA, so we must make
diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
-index 1252a26..9dc17b5 100644
+index 42dec04..adcf84a 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -108,7 +108,7 @@ struct cpu_cache_fns {
@@ -1612,7 +1661,7 @@ index b57c75e..ed2d6b2 100644
EXPORT_SYMBOL(__get_user_1);
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
-index 2b7b017..c380fa2 100644
+index 48f3624..eabfb29 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -28,7 +28,6 @@
@@ -1623,7 +1672,7 @@ index 2b7b017..c380fa2 100644
#include <linux/hw_breakpoint.h>
#include <linux/cpuidle.h>
-@@ -275,9 +274,10 @@ void machine_power_off(void)
+@@ -276,9 +275,10 @@ void machine_power_off(void)
machine_shutdown();
if (pm_power_off)
pm_power_off();
@@ -1635,7 +1684,7 @@ index 2b7b017..c380fa2 100644
{
machine_shutdown();
-@@ -519,12 +519,6 @@ unsigned long get_wchan(struct task_struct *p)
+@@ -521,12 +521,6 @@ unsigned long get_wchan(struct task_struct *p)
return 0;
}
@@ -1694,7 +1743,7 @@ index ebfac78..cbea9c0 100644
#endif
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
-index 63d402f..db1d714 100644
+index a8ad1e3..859d689 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -264,6 +264,8 @@ static int __die(const char *str, int err, struct thread_info *thread, struct pt
@@ -2319,7 +2368,7 @@ index 0f01de2..d37d309 100644
#define __cacheline_aligned __aligned(L1_CACHE_BYTES)
#define ____cacheline_aligned __aligned(L1_CACHE_BYTES)
diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
-index 7d91166..88ab87e 100644
+index 6e6fe18..a6ae668 100644
--- a/arch/ia64/include/asm/atomic.h
+++ b/arch/ia64/include/asm/atomic.h
@@ -208,6 +208,16 @@ atomic64_add_negative (__s64 i, atomic64_t *v)
@@ -2896,7 +2945,7 @@ index 881d18b..cea38bc 100644
/*
diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
-index 0d85d8e..ec71487 100644
+index abb13e8..cd2d702 100644
--- a/arch/mips/include/asm/thread_info.h
+++ b/arch/mips/include/asm/thread_info.h
@@ -123,6 +123,8 @@ register struct thread_info *__current_thread_info __asm__("$28");
@@ -3237,7 +3286,7 @@ index 4ce7a01..449202a 100644
#endif /* __ASM_OPENRISC_CACHE_H */
diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
-index 6c6defc..d30653d 100644
+index af9cf30..2aae9b2 100644
--- a/arch/parisc/include/asm/atomic.h
+++ b/arch/parisc/include/asm/atomic.h
@@ -229,6 +229,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
@@ -3911,7 +3960,7 @@ index 4aad413..85d86bf 100644
#define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
#define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
-index 9d7f0fb..a28fe69 100644
+index cae0ed7..da44a51 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -212,6 +212,7 @@
@@ -4208,7 +4257,7 @@ index 2e3200c..72095ce 100644
/* Find this entry, or if that fails, the next avail. entry */
while (entry->jump[0]) {
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
-index 4937c96..70714b7 100644
+index 94178e5..e6076f0 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -681,8 +681,8 @@ void show_regs(struct pt_regs * regs)
@@ -4222,7 +4271,7 @@ index 4937c96..70714b7 100644
#endif
show_stack(current, (unsigned long *) regs->gpr[1]);
if (!user_mode(regs))
-@@ -1186,10 +1186,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
+@@ -1178,10 +1178,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
newsp = stack[0];
ip = stack[STACK_FRAME_LR_SAVE];
if (!firstframe || ip != lr) {
@@ -4235,7 +4284,7 @@ index 4937c96..70714b7 100644
(void *)current->ret_stack[curr_frame].ret);
curr_frame--;
}
-@@ -1209,7 +1209,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
+@@ -1201,7 +1201,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
struct pt_regs *regs = (struct pt_regs *)
(sp + STACK_FRAME_OVERHEAD);
lr = regs->link;
@@ -4244,7 +4293,7 @@ index 4937c96..70714b7 100644
regs->trap, (void *)regs->nip, (void *)lr);
firstframe = 1;
}
-@@ -1282,58 +1282,3 @@ void thread_info_cache_init(void)
+@@ -1274,58 +1274,3 @@ void thread_info_cache_init(void)
}
#endif /* THREAD_SHIFT < PAGE_SHIFT */
@@ -4369,7 +4418,7 @@ index 2692efd..6673d2e 100644
} else {
err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
-index 1589723..cefe690 100644
+index ae0843f..f16372c 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -133,6 +133,8 @@ static unsigned __kprobes long oops_begin(struct pt_regs *regs)
@@ -4893,7 +4942,7 @@ index 60055ce..ee4b252 100644
- return ret;
-}
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
-index 2857c48..d047481 100644
+index a64fe53..5c66963 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -92,10 +92,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
@@ -4919,7 +4968,7 @@ index 2857c48..d047481 100644
mm->get_unmapped_area = arch_get_unmapped_area_topdown;
mm->unmap_area = arch_unmap_area_topdown;
}
-@@ -166,10 +178,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
+@@ -174,10 +186,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
*/
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE;
@@ -5678,13 +5727,13 @@ index a1091afb..380228e 100644
{
- unsigned long ret = ___copy_to_user(to, from, size);
+ unsigned long ret;
-
++
+ if ((long)size < 0 || size > INT_MAX)
+ return size;
+
+ if (!__builtin_constant_p(size))
+ check_object_size(from, size, true);
-+
+
+ ret = ___copy_to_user(to, from, size);
if (unlikely(ret))
ret = copy_to_user_fixup(to, from, size);
@@ -6516,7 +6565,7 @@ index 301421c..e2535d1 100644
obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o gup.o
obj-y += fault_$(BITS).o
diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
-index df3155a..eb708b8 100644
+index df3155a..9c41fb9 100644
--- a/arch/sparc/mm/fault_32.c
+++ b/arch/sparc/mm/fault_32.c
@@ -21,6 +21,9 @@
@@ -6529,7 +6578,7 @@ index df3155a..eb708b8 100644
#include <asm/page.h>
#include <asm/pgtable.h>
-@@ -207,6 +210,268 @@ static unsigned long compute_si_addr(struct pt_regs *regs, int text_fault)
+@@ -207,6 +210,277 @@ static unsigned long compute_si_addr(struct pt_regs *regs, int text_fault)
return safe_compute_effective_address(regs, insn);
}
@@ -6620,40 +6669,49 @@ index df3155a..eb708b8 100644
+ }
+ } while (0);
+
-+ { /* PaX: patched PLT emulation #2 */
++ do { /* PaX: patched PLT emulation #2 */
+ unsigned int ba;
+
+ err = get_user(ba, (unsigned int *)regs->pc);
+
-+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
++ if (err)
++ break;
++
++ if ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30480000U) {
+ unsigned int addr;
+
-+ addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
++ if ((ba & 0xFFC00000U) == 0x30800000U)
++ addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
++ else
++ addr = regs->pc + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
+ regs->pc = addr;
+ regs->npc = addr+4;
+ return 2;
+ }
-+ }
++ } while (0);
+
+ do { /* PaX: patched PLT emulation #3 */
-+ unsigned int sethi, jmpl, nop;
++ unsigned int sethi, bajmpl, nop;
+
+ err = get_user(sethi, (unsigned int *)regs->pc);
-+ err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
++ err |= get_user(bajmpl, (unsigned int *)(regs->pc+4));
+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
+
+ if (err)
+ break;
+
+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
++ ((bajmpl & 0xFFFFE000U) == 0x81C06000U || (bajmpl & 0xFFF80000U) == 0x30480000U) &&
+ nop == 0x01000000U)
+ {
+ unsigned int addr;
+
+ addr = (sethi & 0x003FFFFFU) << 10;
+ regs->u_regs[UREG_G1] = addr;
-+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
++ if ((bajmpl & 0xFFFFE000U) == 0x81C06000U)
++ addr += (((bajmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
++ else
++ addr = regs->pc + ((((bajmpl | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
+ regs->pc = addr;
+ regs->npc = addr+4;
+ return 2;
@@ -6798,7 +6856,7 @@ index df3155a..eb708b8 100644
static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
int text_fault)
{
-@@ -282,6 +547,24 @@ good_area:
+@@ -282,6 +556,24 @@ good_area:
if(!(vma->vm_flags & VM_WRITE))
goto bad_area;
} else {
@@ -6824,7 +6882,7 @@ index df3155a..eb708b8 100644
if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
goto bad_area;
diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
-index 1fe0429..aee2e87 100644
+index 1fe0429..8dd5dd5 100644
--- a/arch/sparc/mm/fault_64.c
+++ b/arch/sparc/mm/fault_64.c
@@ -21,6 +21,9 @@
@@ -6846,7 +6904,7 @@ index 1fe0429..aee2e87 100644
printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
dump_stack();
unhandled_fault(regs->tpc, current, regs);
-@@ -272,6 +275,457 @@ static void noinline __kprobes bogus_32bit_fault_address(struct pt_regs *regs,
+@@ -272,6 +275,466 @@ static void noinline __kprobes bogus_32bit_fault_address(struct pt_regs *regs,
show_regs(regs);
}
@@ -6941,15 +6999,21 @@ index 1fe0429..aee2e87 100644
+ }
+ } while (0);
+
-+ { /* PaX: patched PLT emulation #2 */
++ do { /* PaX: patched PLT emulation #2 */
+ unsigned int ba;
+
+ err = get_user(ba, (unsigned int *)regs->tpc);
+
-+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
++ if (err)
++ break;
++
++ if ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30480000U) {
+ unsigned long addr;
+
-+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
++ if ((ba & 0xFFC00000U) == 0x30800000U)
++ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
++ else
++ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
+
+ if (test_thread_flag(TIF_32BIT))
+ addr &= 0xFFFFFFFFUL;
@@ -6958,27 +7022,30 @@ index 1fe0429..aee2e87 100644
+ regs->tnpc = addr+4;
+ return 2;
+ }
-+ }
++ } while (0);
+
+ do { /* PaX: patched PLT emulation #3 */
-+ unsigned int sethi, jmpl, nop;
++ unsigned int sethi, bajmpl, nop;
+
+ err = get_user(sethi, (unsigned int *)regs->tpc);
-+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
++ err |= get_user(bajmpl, (unsigned int *)(regs->tpc+4));
+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
+
+ if (err)
+ break;
+
+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
++ ((bajmpl & 0xFFFFE000U) == 0x81C06000U || (bajmpl & 0xFFF80000U) == 0x30480000U) &&
+ nop == 0x01000000U)
+ {
+ unsigned long addr;
+
+ addr = (sethi & 0x003FFFFFU) << 10;
+ regs->u_regs[UREG_G1] = addr;
-+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
++ if ((bajmpl & 0xFFFFE000U) == 0x81C06000U)
++ addr += (((bajmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
++ else
++ addr = regs->tpc + ((((bajmpl | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
+
+ if (test_thread_flag(TIF_32BIT))
+ addr &= 0xFFFFFFFFUL;
@@ -7304,7 +7371,7 @@ index 1fe0429..aee2e87 100644
asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
{
struct mm_struct *mm = current->mm;
-@@ -343,6 +797,29 @@ retry:
+@@ -343,6 +806,29 @@ retry:
if (!vma)
goto bad_area;
@@ -8056,10 +8123,10 @@ index 4d3ff03..e4972ff 100644
err = check_flags();
}
diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
-index f1bbeeb..aff09cb 100644
+index f1bbeeb..e58f183 100644
--- a/arch/x86/boot/header.S
+++ b/arch/x86/boot/header.S
-@@ -372,7 +372,7 @@ setup_data: .quad 0 # 64-bit physical pointer to
+@@ -372,10 +372,14 @@ setup_data: .quad 0 # 64-bit physical pointer to
# single linked list of
# struct setup_data
@@ -8067,7 +8134,14 @@ index f1bbeeb..aff09cb 100644
+pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
#define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++#define VO_INIT_SIZE (VO__end - VO__text - __PAGE_OFFSET - ____LOAD_PHYSICAL_ADDR)
++#else
#define VO_INIT_SIZE (VO__end - VO__text)
++#endif
+ #if ZO_INIT_SIZE > VO_INIT_SIZE
+ #define INIT_SIZE ZO_INIT_SIZE
+ #else
diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c
index db75d07..8e6d0af 100644
--- a/arch/x86/boot/memory.c
@@ -9130,7 +9204,7 @@ index 20370c6..a2eb9b0 100644
"popl %%ebp\n\t"
"popl %%edi\n\t"
diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
-index 58cb6d4..ca9010d 100644
+index 58cb6d4..a4b806c 100644
--- a/arch/x86/include/asm/atomic.h
+++ b/arch/x86/include/asm/atomic.h
@@ -22,7 +22,18 @@
@@ -9538,6 +9612,52 @@ index 58cb6d4..ca9010d 100644
/*
* atomic_dec_if_positive - decrement by 1 if old value positive
+@@ -293,14 +552,37 @@ static inline void atomic_or_long(unsigned long *v1, unsigned long v2)
+ #endif
+
+ /* These are x86-specific, used by some header files */
+-#define atomic_clear_mask(mask, addr) \
+- asm volatile(LOCK_PREFIX "andl %0,%1" \
+- : : "r" (~(mask)), "m" (*(addr)) : "memory")
+-
+-#define atomic_set_mask(mask, addr) \
+- asm volatile(LOCK_PREFIX "orl %0,%1" \
+- : : "r" ((unsigned)(mask)), "m" (*(addr)) \
+- : "memory")
++static inline void atomic_clear_mask(unsigned int mask, atomic_t *v)
++{
++ asm volatile(LOCK_PREFIX "andl %1,%0"
++ : "+m" (v->counter)
++ : "r" (~(mask))
++ : "memory");
++}
++
++static inline void atomic_clear_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
++{
++ asm volatile(LOCK_PREFIX "andl %1,%0"
++ : "+m" (v->counter)
++ : "r" (~(mask))
++ : "memory");
++}
++
++static inline void atomic_set_mask(unsigned int mask, atomic_t *v)
++{
++ asm volatile(LOCK_PREFIX "orl %1,%0"
++ : "+m" (v->counter)
++ : "r" (mask)
++ : "memory");
++}
++
++static inline void atomic_set_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
++{
++ asm volatile(LOCK_PREFIX "orl %1,%0"
++ : "+m" (v->counter)
++ : "r" (mask)
++ : "memory");
++}
+
+ /* Atomic operations are already serializing on x86 */
+ #define smp_mb__before_atomic_dec() barrier()
diff --git a/arch/x86/include/asm/atomic64_32.h b/arch/x86/include/asm/atomic64_32.h
index 1981199..36b9dfb 100644
--- a/arch/x86/include/asm/atomic64_32.h
@@ -10191,10 +10311,24 @@ index 99480e5..d81165b 100644
({ \
__typeof__ (*(ptr)) __ret = (inc); \
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
-index f91e80f..7f9bd27 100644
+index f91e80f..7731066 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
-@@ -371,7 +371,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
+@@ -202,11 +202,12 @@
+ #define X86_FEATURE_BMI1 (9*32+ 3) /* 1st group bit manipulation extensions */
+ #define X86_FEATURE_HLE (9*32+ 4) /* Hardware Lock Elision */
+ #define X86_FEATURE_AVX2 (9*32+ 5) /* AVX2 instructions */
+-#define X86_FEATURE_SMEP (9*32+ 7) /* Supervisor Mode Execution Protection */
++#define X86_FEATURE_SMEP (9*32+ 7) /* Supervisor Mode Execution Prevention */
+ #define X86_FEATURE_BMI2 (9*32+ 8) /* 2nd group bit manipulation extensions */
+ #define X86_FEATURE_ERMS (9*32+ 9) /* Enhanced REP MOVSB/STOSB */
+ #define X86_FEATURE_INVPCID (9*32+10) /* Invalidate Processor Context ID */
+ #define X86_FEATURE_RTM (9*32+11) /* Restricted Transactional Memory */
++#define X86_FEATURE_SMAP (9*32+20) /* Supervisor Mode Access Prevention */
+
+ #if defined(__KERNEL__) && !defined(__ASSEMBLY__)
+
+@@ -371,7 +372,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
".section .discard,\"aw\",@progbits\n"
" .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
".previous\n"
@@ -11019,9 +11153,9 @@ index 6902152..da4283a 100644
+#endif
+
}
-+#endif
- }
--#endif
+- }
+ #endif
++ }
}
#define activate_mm(prev, next) \
@@ -11760,6 +11894,18 @@ index 013286a..8b42f4f 100644
#define pgprot_writecombine pgprot_writecombine
extern pgprot_t pgprot_writecombine(pgprot_t prot);
+diff --git a/arch/x86/include/asm/processor-flags.h b/arch/x86/include/asm/processor-flags.h
+index f8ab3ea..67889db 100644
+--- a/arch/x86/include/asm/processor-flags.h
++++ b/arch/x86/include/asm/processor-flags.h
+@@ -63,6 +63,7 @@
+ #define X86_CR4_RDWRGSFS 0x00010000 /* enable RDWRGSFS support */
+ #define X86_CR4_OSXSAVE 0x00040000 /* enable xsave and xrestore */
+ #define X86_CR4_SMEP 0x00100000 /* enable SMEP support */
++#define X86_CR4_SMAP 0x00200000 /* enable SMAP support */
+
+ /*
+ * x86-64 Task Priority Register, CR8
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 4fa7dcc..764e33a 100644
--- a/arch/x86/include/asm/processor.h
@@ -11941,7 +12087,7 @@ index dcfde52..dbfea06 100644
}
#endif
diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h
-index 92f29706..a79cbbb 100644
+index 92f29706..d0a1a53 100644
--- a/arch/x86/include/asm/reboot.h
+++ b/arch/x86/include/asm/reboot.h
@@ -6,19 +6,19 @@
@@ -11966,7 +12112,7 @@ index 92f29706..a79cbbb 100644
void native_machine_crash_shutdown(struct pt_regs *regs);
void native_machine_shutdown(void);
-void machine_real_restart(unsigned int type);
-+void machine_real_restart(unsigned int type) __noreturn;
++void __noreturn machine_real_restart(unsigned int type);
/* These must match dispatch_table in reboot_32.S */
#define MRR_BIOS 0
#define MRR_APM 1
@@ -12315,15 +12461,7 @@ index 70bbe39..4ae2bd4 100644
- void *data,
- unsigned long *end,
- int *graph);
-+typedef unsigned long walk_stack_t(struct task_struct *task,
-+ void *stack_start,
-+ unsigned long *stack,
-+ unsigned long bp,
-+ const struct stacktrace_ops *ops,
-+ void *data,
-+ unsigned long *end,
-+ int *graph);
-
+-
-extern unsigned long
-print_context_stack(struct thread_info *tinfo,
- unsigned long *stack, unsigned long bp,
@@ -12335,6 +12473,15 @@ index 70bbe39..4ae2bd4 100644
- unsigned long *stack, unsigned long bp,
- const struct stacktrace_ops *ops, void *data,
- unsigned long *end, int *graph);
++typedef unsigned long walk_stack_t(struct task_struct *task,
++ void *stack_start,
++ unsigned long *stack,
++ unsigned long bp,
++ const struct stacktrace_ops *ops,
++ void *data,
++ unsigned long *end,
++ int *graph);
++
+extern walk_stack_t print_context_stack;
+extern walk_stack_t print_context_stack_bp;
@@ -12474,43 +12621,16 @@ index ad6df8c..5e0cf6e 100644
/* Only used for 64 bit */
#define _TIF_DO_NOTIFY_MASK \
-@@ -173,45 +171,40 @@ struct thread_info {
+@@ -173,6 +171,23 @@ struct thread_info {
ret; \
})
--#ifdef CONFIG_X86_32
--
--#define STACK_WARN (THREAD_SIZE/8)
--/*
-- * macros/functions for gaining access to the thread information structure
-- *
-- * preempt_count needs to be 1 initially, until the scheduler is functional.
-- */
--#ifndef __ASSEMBLY__
--
--
--/* how to get the current stack pointer from C */
--register unsigned long current_stack_pointer asm("esp") __used;
--
--/* how to get the thread information struct from C */
--static inline struct thread_info *current_thread_info(void)
--{
-- return (struct thread_info *)
-- (current_stack_pointer & ~(THREAD_SIZE - 1));
--}
--
--#else /* !__ASSEMBLY__ */
--
+#ifdef __ASSEMBLY__
- /* how to get the thread information struct from ASM */
- #define GET_THREAD_INFO(reg) \
-- movl $-THREAD_SIZE, reg; \
-- andl %esp, reg
++/* how to get the thread information struct from ASM */
++#define GET_THREAD_INFO(reg) \
+ mov PER_CPU_VAR(current_tinfo), reg
-
- /* use this one if reg already contains %esp */
--#define GET_THREAD_INFO_WITH_ESP(reg) \
-- andl $-THREAD_SIZE, reg
++
++/* use this one if reg already contains %esp */
+#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
+#else
+/* how to get the thread information struct from C */
@@ -12522,19 +12642,35 @@ index ad6df8c..5e0cf6e 100644
+}
+#endif
+
-+#ifdef CONFIG_X86_32
-+
-+#define STACK_WARN (THREAD_SIZE/8)
-+/*
-+ * macros/functions for gaining access to the thread information structure
-+ *
-+ * preempt_count needs to be 1 initially, until the scheduler is functional.
-+ */
-+#ifndef __ASSEMBLY__
-+
-+/* how to get the current stack pointer from C */
-+register unsigned long current_stack_pointer asm("esp") __used;
+ #ifdef CONFIG_X86_32
+ #define STACK_WARN (THREAD_SIZE/8)
+@@ -183,35 +198,13 @@ struct thread_info {
+ */
+ #ifndef __ASSEMBLY__
+
+-
+ /* how to get the current stack pointer from C */
+ register unsigned long current_stack_pointer asm("esp") __used;
+
+-/* how to get the thread information struct from C */
+-static inline struct thread_info *current_thread_info(void)
+-{
+- return (struct thread_info *)
+- (current_stack_pointer & ~(THREAD_SIZE - 1));
+-}
+-
+-#else /* !__ASSEMBLY__ */
+-
+-/* how to get the thread information struct from ASM */
+-#define GET_THREAD_INFO(reg) \
+- movl $-THREAD_SIZE, reg; \
+- andl %esp, reg
+-
+-/* use this one if reg already contains %esp */
+-#define GET_THREAD_INFO_WITH_ESP(reg) \
+- andl $-THREAD_SIZE, reg
+-
#endif
#else /* X86_32 */
@@ -12912,18 +13048,18 @@ index 8084bc7..3d6ec37 100644
unsigned long n)
{
- return __copy_from_user_ll_nocache_nozero(to, from, n);
+-}
+ if ((long)n < 0)
+ return n;
-+
-+ return __copy_from_user_ll_nocache_nozero(to, from, n);
- }
-unsigned long __must_check copy_to_user(void __user *to,
- const void *from, unsigned long n);
-unsigned long __must_check _copy_from_user(void *to,
- const void __user *from,
- unsigned long n);
--
++ return __copy_from_user_ll_nocache_nozero(to, from, n);
++}
+
+extern void copy_to_user_overflow(void)
+#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
+ __compiletime_error("copy_to_user() buffer size is not provably correct")
@@ -12963,6 +13099,7 @@ index 8084bc7..3d6ec37 100644
- if (likely(sz == -1 || sz >= n))
- n = _copy_from_user(to, from, n);
- else
+- copy_from_user_overflow();
+ if (unlikely(sz != (size_t)-1 && sz < n))
+ copy_to_user_overflow();
+ else if (access_ok(VERIFY_WRITE, to, n))
@@ -12990,10 +13127,9 @@ index 8084bc7..3d6ec37 100644
+copy_from_user(void *to, const void __user *from, unsigned long n)
+{
+ size_t sz = __compiletime_object_size(to);
-+
+
+ if (unlikely(sz != (size_t)-1 && sz < n))
- copy_from_user_overflow();
--
++ copy_from_user_overflow();
+ else if (access_ok(VERIFY_READ, from, n))
+ n = __copy_from_user(to, from, n);
+ else if ((long)n > 0) {
@@ -13015,7 +13151,7 @@ index 8084bc7..3d6ec37 100644
#endif /* _ASM_X86_UACCESS_32_H */
diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
-index fcd4b6f..ef04f8f 100644
+index fcd4b6f..835efe7 100644
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -10,6 +10,9 @@
@@ -13028,7 +13164,7 @@ index fcd4b6f..ef04f8f 100644
/*
* Copy To/From Userspace
-@@ -17,12 +20,14 @@
+@@ -17,12 +20,12 @@
/* Handles exceptions in both to and from, but doesn't do access_ok */
__must_check unsigned long
@@ -13038,15 +13174,14 @@ index fcd4b6f..ef04f8f 100644
-copy_user_generic_unrolled(void *to, const void *from, unsigned len);
+copy_user_generic_unrolled(void *to, const void *from, unsigned long len) __size_overflow(3);
- static __always_inline __must_check unsigned long
+-static __always_inline __must_check unsigned long
-copy_user_generic(void *to, const void *from, unsigned len)
-+copy_user_generic(void *to, const void *from, unsigned long len) __size_overflow(3);
-+static __always_inline __must_check unsigned long
++static __always_inline __must_check __size_overflow(3) unsigned long
+copy_user_generic(void *to, const void *from, unsigned long len)
{
unsigned ret;
-@@ -32,142 +37,238 @@ copy_user_generic(void *to, const void *from, unsigned len)
+@@ -32,142 +35,238 @@ copy_user_generic(void *to, const void *from, unsigned len)
ASM_OUTPUT2("=a" (ret), "=D" (to), "=S" (from),
"=d" (len)),
"1" (to), "2" (from), "3" (len)
@@ -13333,7 +13468,7 @@ index fcd4b6f..ef04f8f 100644
ret, "b", "b", "=q", 1);
if (likely(!ret))
__put_user_asm(tmp, (u8 __user *)dst,
-@@ -176,7 +277,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
+@@ -176,7 +275,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
}
case 2: {
u16 tmp;
@@ -13342,7 +13477,7 @@ index fcd4b6f..ef04f8f 100644
ret, "w", "w", "=r", 2);
if (likely(!ret))
__put_user_asm(tmp, (u16 __user *)dst,
-@@ -186,7 +287,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
+@@ -186,7 +285,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
case 4: {
u32 tmp;
@@ -13351,7 +13486,7 @@ index fcd4b6f..ef04f8f 100644
ret, "l", "k", "=r", 4);
if (likely(!ret))
__put_user_asm(tmp, (u32 __user *)dst,
-@@ -195,7 +296,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
+@@ -195,7 +294,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
}
case 8: {
u64 tmp;
@@ -13360,7 +13495,7 @@ index fcd4b6f..ef04f8f 100644
ret, "q", "", "=r", 8);
if (likely(!ret))
__put_user_asm(tmp, (u64 __user *)dst,
-@@ -203,47 +304,92 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
+@@ -203,47 +302,92 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
return ret;
}
default:
@@ -13712,7 +13847,7 @@ index 7261083..5c12053 100644
bogus_magic:
jmp bogus_magic
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
-index 1f84794..e23f862 100644
+index 73ef56c..0238021 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -276,6 +276,13 @@ void __init_or_module apply_alternatives(struct alt_instr *start,
@@ -14016,16 +14151,16 @@ index 68de2dc..1f3c720 100644
+
+#ifdef CONFIG_PAX_KERNEXEC
+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
- #endif
-
++#endif
++
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+ OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
+ OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
+#ifdef CONFIG_X86_64
+ OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched);
+#endif
-+#endif
-+
+ #endif
+
+#endif
+
+ BLANK();
@@ -14243,7 +14378,7 @@ index 3e6ff6c..54b4992 100644
}
#endif
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
-index 61604ae..98250a5 100644
+index 0d2db0e..7c1fb04 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -42,6 +42,7 @@
@@ -14303,7 +14438,7 @@ index 61604ae..98250a5 100644
wait_for_panic();
if (!monarch_timeout)
goto out;
-@@ -1535,7 +1536,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
+@@ -1537,7 +1538,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
}
/* Call the installed machine check handler for this CPU setup. */
@@ -14312,7 +14447,7 @@ index 61604ae..98250a5 100644
unexpected_machine_check;
/*
-@@ -1558,7 +1559,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
+@@ -1560,7 +1561,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
return;
}
@@ -14322,7 +14457,7 @@ index 61604ae..98250a5 100644
__mcheck_cpu_init_generic();
__mcheck_cpu_init_vendor(c);
-@@ -1572,7 +1575,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
+@@ -1574,7 +1577,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
*/
static DEFINE_SPINLOCK(mce_chrdev_state_lock);
@@ -14331,7 +14466,7 @@ index 61604ae..98250a5 100644
static int mce_chrdev_open_exclu; /* already open exclusive? */
static int mce_chrdev_open(struct inode *inode, struct file *file)
-@@ -1580,7 +1583,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
+@@ -1582,7 +1585,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
spin_lock(&mce_chrdev_state_lock);
if (mce_chrdev_open_exclu ||
@@ -14340,7 +14475,7 @@ index 61604ae..98250a5 100644
spin_unlock(&mce_chrdev_state_lock);
return -EBUSY;
-@@ -1588,7 +1591,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
+@@ -1590,7 +1593,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
if (file->f_flags & O_EXCL)
mce_chrdev_open_exclu = 1;
@@ -14349,7 +14484,7 @@ index 61604ae..98250a5 100644
spin_unlock(&mce_chrdev_state_lock);
-@@ -1599,7 +1602,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
+@@ -1601,7 +1604,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
{
spin_lock(&mce_chrdev_state_lock);
@@ -14358,7 +14493,7 @@ index 61604ae..98250a5 100644
mce_chrdev_open_exclu = 0;
spin_unlock(&mce_chrdev_state_lock);
-@@ -2324,7 +2327,7 @@ struct dentry *mce_get_debugfs_dir(void)
+@@ -2326,7 +2329,7 @@ struct dentry *mce_get_debugfs_dir(void)
static void mce_reset(void)
{
cpu_missing = 0;
@@ -17218,12 +17353,8 @@ index 40f4eb3..6d24d9d 100644
- addq %rbp, level3_kernel_pgt + (510*8)(%rip)
- addq %rbp, level3_kernel_pgt + (511*8)(%rip)
-+ addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
-+
-+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
-+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
-
- addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
+-
+- addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
-
- /* Add an Identity mapping if I am above 1G */
- leaq _text(%rip), %rdi
@@ -17233,11 +17364,14 @@ index 40f4eb3..6d24d9d 100644
- shrq $PUD_SHIFT, %rax
- andq $(PTRS_PER_PUD - 1), %rax
- jz ident_complete
--
++ addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
+
- leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
- leaq level3_ident_pgt(%rip), %rbx
- movq %rdx, 0(%rbx, %rax, 8)
--
++ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
++ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
+
- movq %rdi, %rax
- shrq $PMD_SHIFT, %rax
- andq $(PTRS_PER_PMD - 1), %rax
@@ -17245,6 +17379,7 @@ index 40f4eb3..6d24d9d 100644
- leaq level2_spare_pgt(%rip), %rbx
- movq %rdx, 0(%rbx, %rax, 8)
-ident_complete:
++ addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
+ addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
/*
@@ -17313,9 +17448,9 @@ index 40f4eb3..6d24d9d 100644
.asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
early_idt_ripmsg:
.asciz "RIP %s\n"
-+ .previous
- #endif /* CONFIG_EARLY_PRINTK */
-- .previous
+-#endif /* CONFIG_EARLY_PRINTK */
+ .previous
++#endif /* CONFIG_EARLY_PRINTK */
+ .section .rodata,"a",@progbits
#define NEXT_PAGE(name) \
@@ -17793,15 +17928,15 @@ index d04d3ec..ea4b374 100644
if (regs->sp >= curbase + sizeof(struct thread_info) +
diff --git a/arch/x86/kernel/kdebugfs.c b/arch/x86/kernel/kdebugfs.c
-index 1d5d31e..ab846ed 100644
+index 1d5d31e..72731d4 100644
--- a/arch/x86/kernel/kdebugfs.c
+++ b/arch/x86/kernel/kdebugfs.c
-@@ -28,6 +28,8 @@ struct setup_data_node {
+@@ -27,7 +27,7 @@ struct setup_data_node {
+ u32 len;
};
- static ssize_t setup_data_read(struct file *file, char __user *user_buf,
-+ size_t count, loff_t *ppos) __size_overflow(3);
-+static ssize_t setup_data_read(struct file *file, char __user *user_buf,
+-static ssize_t setup_data_read(struct file *file, char __user *user_buf,
++static ssize_t __size_overflow(3) setup_data_read(struct file *file, char __user *user_buf,
size_t count, loff_t *ppos)
{
struct setup_data_node *node = file->private_data;
@@ -18303,10 +18438,10 @@ index ab13760..01218e0 100644
ret = paravirt_patch_ident_32(insnbuf, len);
- else if (opfunc == _paravirt_ident_64)
+ else if (opfunc == (void *)_paravirt_ident_64)
- ret = paravirt_patch_ident_64(insnbuf, len);
++ ret = paravirt_patch_ident_64(insnbuf, len);
+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
+ else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
-+ ret = paravirt_patch_ident_64(insnbuf, len);
+ ret = paravirt_patch_ident_64(insnbuf, len);
+#endif
else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
@@ -18549,7 +18684,7 @@ index 1d92a5a..7bc8c29 100644
+
+ if (v8086_mode(regs))
+ return;
-
++
+ rdtscl(time);
+
+ /* P4 seems to return a 0 LSB, ignore it */
@@ -18566,7 +18701,7 @@ index 1d92a5a..7bc8c29 100644
+
+ thread->sp0 ^= time;
+ load_sp0(init_tss + smp_processor_id(), thread);
-+
+
+#ifdef CONFIG_X86_64
+ percpu_write(kernel_stack, thread->sp0);
+#endif
@@ -18828,7 +18963,7 @@ index 42eb330..139955c 100644
return ret;
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
-index 3034ee5..7cfbfa6 100644
+index 3034ee5..554ae2d 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -35,7 +35,7 @@ void (*pm_power_off)(void);
@@ -18877,7 +19012,7 @@ index 3034ee5..7cfbfa6 100644
/* GDT[0]: GDT self-pointer */
lowmem_gdt[0] =
-@@ -385,7 +389,33 @@ void machine_real_restart(unsigned int type)
+@@ -385,7 +389,35 @@ void machine_real_restart(unsigned int type)
GDT_ENTRY(0x009b, restart_pa, 0xffff);
/* Jump to the identity-mapped low memory code */
@@ -18888,7 +19023,9 @@ index 3034ee5..7cfbfa6 100644
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
-+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
++ loadsegment(ds, __KERNEL_DS);
++ loadsegment(es, __KERNEL_DS);
++ loadsegment(ss, __KERNEL_DS);
+#endif
+#ifdef CONFIG_PAX_KERNEXEC
+ gdt[GDT_ENTRY_KERNEL_CS].base0 = 0;
@@ -18911,16 +19048,16 @@ index 3034ee5..7cfbfa6 100644
}
#ifdef CONFIG_APM_MODULE
EXPORT_SYMBOL(machine_real_restart);
-@@ -564,7 +594,7 @@ void __attribute__((weak)) mach_reboot_fixups(void)
+@@ -564,7 +596,7 @@ void __attribute__((weak)) mach_reboot_fixups(void)
* try to force a triple fault and then cycle between hitting the keyboard
* controller and doing that
*/
-static void native_machine_emergency_restart(void)
-+__noreturn static void native_machine_emergency_restart(void)
++static void __noreturn native_machine_emergency_restart(void)
{
int i;
int attempt = 0;
-@@ -688,13 +718,13 @@ void native_machine_shutdown(void)
+@@ -688,13 +720,13 @@ void native_machine_shutdown(void)
#endif
}
@@ -18932,29 +19069,29 @@ index 3034ee5..7cfbfa6 100644
}
-static void native_machine_restart(char *__unused)
-+static __noreturn void native_machine_restart(char *__unused)
++static void __noreturn native_machine_restart(char *__unused)
{
printk("machine restart\n");
-@@ -703,7 +733,7 @@ static void native_machine_restart(char *__unused)
+@@ -703,7 +735,7 @@ static void native_machine_restart(char *__unused)
__machine_emergency_restart(0);
}
-static void native_machine_halt(void)
-+static __noreturn void native_machine_halt(void)
++static void __noreturn native_machine_halt(void)
{
/* stop other cpus and apics */
machine_shutdown();
-@@ -714,7 +744,7 @@ static void native_machine_halt(void)
+@@ -714,7 +746,7 @@ static void native_machine_halt(void)
stop_this_cpu(NULL);
}
-static void native_machine_power_off(void)
-+__noreturn static void native_machine_power_off(void)
++static void __noreturn native_machine_power_off(void)
{
if (pm_power_off) {
if (!reboot_force)
-@@ -723,6 +753,7 @@ static void native_machine_power_off(void)
+@@ -723,6 +755,7 @@ static void native_machine_power_off(void)
}
/* a fallback in case there is no PM info available */
tboot_shutdown(TB_SHUTDOWN_HALT);
@@ -19271,12 +19408,7 @@ index 0b0cb5f..db6b9ed 100644
- const char *const argv[],
- const char *const envp[])
+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
- {
-- long __res;
-- asm volatile ("int $0x80"
-- : "=a" (__res)
-- : "0" (__NR_execve), "b" (filename), "c" (argv), "d" (envp) : "memory");
-- return __res;
++{
+ unsigned long pax_task_size = TASK_SIZE;
+
+#ifdef CONFIG_PAX_SEGMEXEC
@@ -19384,7 +19516,12 @@ index 0b0cb5f..db6b9ed 100644
+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ const unsigned long len, const unsigned long pgoff,
+ const unsigned long flags)
-+{
+ {
+- long __res;
+- asm volatile ("int $0x80"
+- : "=a" (__res)
+- : "0" (__NR_execve), "b" (filename), "c" (argv), "d" (envp) : "memory");
+- return __res;
+ struct vm_area_struct *vma;
+ struct mm_struct *mm = current->mm;
+ unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
@@ -20005,7 +20142,7 @@ index 255f58a..5e91150 100644
goto cannot_handle;
if ((segoffs >> 16) == BIOSSEG)
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
-index 0f703f1..9e15f64 100644
+index 0f703f1..3b426f3 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -26,6 +26,13 @@
@@ -20074,7 +20211,7 @@ index 0f703f1..9e15f64 100644
HEAD_TEXT
#ifdef CONFIG_X86_32
. = ALIGN(PAGE_SIZE);
-@@ -108,13 +128,47 @@ SECTIONS
+@@ -108,13 +128,48 @@ SECTIONS
IRQENTRY_TEXT
*(.fixup)
*(.gnu.warning)
@@ -20094,8 +20231,8 @@ index 0f703f1..9e15f64 100644
+ MODULES_EXEC_VADDR = .;
+ BYTE(0)
+ . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
-+ . = ALIGN(HPAGE_SIZE);
-+ MODULES_EXEC_END = . - 1;
++ . = ALIGN(HPAGE_SIZE) - 1;
++ MODULES_EXEC_END = .;
+#endif
+
+ } :module
@@ -20103,6 +20240,7 @@ index 0f703f1..9e15f64 100644
+
+ .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
+ /* End of text section */
++ BYTE(0)
+ _etext = . - __KERNEL_TEXT_OFFSET;
+ }
+
@@ -20126,7 +20264,7 @@ index 0f703f1..9e15f64 100644
#if defined(CONFIG_DEBUG_RODATA)
/* .text should occupy whole number of pages */
-@@ -126,16 +180,20 @@ SECTIONS
+@@ -126,16 +181,20 @@ SECTIONS
/* Data */
.data : AT(ADDR(.data) - LOAD_OFFSET) {
@@ -20150,7 +20288,7 @@ index 0f703f1..9e15f64 100644
PAGE_ALIGNED_DATA(PAGE_SIZE)
-@@ -176,12 +234,19 @@ SECTIONS
+@@ -176,12 +235,19 @@ SECTIONS
#endif /* CONFIG_X86_64 */
/* Init code and data - will be freed after init */
@@ -20173,7 +20311,7 @@ index 0f703f1..9e15f64 100644
/*
* percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
* output PHDR, so the next output section - .init.text - should
-@@ -190,12 +255,27 @@ SECTIONS
+@@ -190,12 +256,27 @@ SECTIONS
PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu)
#endif
@@ -20206,7 +20344,7 @@ index 0f703f1..9e15f64 100644
/*
* Code and data for a variety of lowlevel trampolines, to be
-@@ -269,19 +349,12 @@ SECTIONS
+@@ -269,19 +350,12 @@ SECTIONS
}
. = ALIGN(8);
@@ -20227,7 +20365,7 @@ index 0f703f1..9e15f64 100644
PERCPU_SECTION(INTERNODE_CACHE_BYTES)
#endif
-@@ -300,16 +373,10 @@ SECTIONS
+@@ -300,16 +374,10 @@ SECTIONS
.smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
__smp_locks = .;
*(.smp_locks)
@@ -20245,7 +20383,7 @@ index 0f703f1..9e15f64 100644
/* BSS */
. = ALIGN(PAGE_SIZE);
.bss : AT(ADDR(.bss) - LOAD_OFFSET) {
-@@ -325,6 +392,7 @@ SECTIONS
+@@ -325,6 +393,7 @@ SECTIONS
__brk_base = .;
. += 64 * 1024; /* 64k alignment slop space */
*(.brk_reservation) /* areas brk users have reserved */
@@ -20253,7 +20391,7 @@ index 0f703f1..9e15f64 100644
__brk_limit = .;
}
-@@ -351,13 +419,12 @@ SECTIONS
+@@ -351,13 +420,12 @@ SECTIONS
* for the boot processor.
*/
#define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
@@ -22829,7 +22967,7 @@ index a63efd6..ccecad8 100644
ret
CFI_ENDPROC
diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
-index ef2a6a5..3b28862 100644
+index ef2a6a5..dc7f3dd 100644
--- a/arch/x86/lib/usercopy_32.c
+++ b/arch/x86/lib/usercopy_32.c
@@ -41,10 +41,12 @@ do { \
@@ -22936,7 +23074,7 @@ index ef2a6a5..3b28862 100644
".section .fixup,\"ax\"\n"
"101: lea 0(%%eax,%0,4),%0\n"
" jmp 100b\n"
-@@ -247,46 +253,155 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
+@@ -247,46 +253,153 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
}
static unsigned long
@@ -23046,9 +23184,7 @@ index ef2a6a5..3b28862 100644
+ return size;
+}
+
-+static unsigned long
-+__copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size) __size_overflow(3);
-+static unsigned long
++static unsigned long __size_overflow(3)
__copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
{
int d0, d1;
@@ -23110,7 +23246,7 @@ index ef2a6a5..3b28862 100644
" movl %%eax, 56(%3)\n"
" movl %%edx, 60(%3)\n"
" addl $-64, %0\n"
-@@ -298,9 +413,9 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
+@@ -298,9 +411,9 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
" shrl $2, %0\n"
" andl $3, %%eax\n"
" cld\n"
@@ -23122,12 +23258,12 @@ index ef2a6a5..3b28862 100644
"8:\n"
".section .fixup,\"ax\"\n"
"9: lea 0(%%eax,%0,4),%0\n"
-@@ -347,47 +462,49 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
+@@ -346,48 +459,48 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
+ * hyoshiok@miraclelinux.com
*/
- static unsigned long __copy_user_zeroing_intel_nocache(void *to,
-+ const void __user *from, unsigned long size) __size_overflow(3);
-+static unsigned long __copy_user_zeroing_intel_nocache(void *to,
+-static unsigned long __copy_user_zeroing_intel_nocache(void *to,
++static unsigned long __size_overflow(3) __copy_user_zeroing_intel_nocache(void *to,
const void __user *from, unsigned long size)
{
int d0, d1;
@@ -23190,7 +23326,7 @@ index ef2a6a5..3b28862 100644
" movnti %%eax, 56(%3)\n"
" movnti %%edx, 60(%3)\n"
" addl $-64, %0\n"
-@@ -400,9 +517,9 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
+@@ -400,9 +513,9 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
" shrl $2, %0\n"
" andl $3, %%eax\n"
" cld\n"
@@ -23202,12 +23338,12 @@ index ef2a6a5..3b28862 100644
"8:\n"
".section .fixup,\"ax\"\n"
"9: lea 0(%%eax,%0,4),%0\n"
-@@ -444,47 +561,49 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
+@@ -443,48 +556,48 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
+ return size;
}
- static unsigned long __copy_user_intel_nocache(void *to,
-+ const void __user *from, unsigned long size) __size_overflow(3);
-+static unsigned long __copy_user_intel_nocache(void *to,
+-static unsigned long __copy_user_intel_nocache(void *to,
++static unsigned long __size_overflow(3) __copy_user_intel_nocache(void *to,
const void __user *from, unsigned long size)
{
int d0, d1;
@@ -23270,7 +23406,7 @@ index ef2a6a5..3b28862 100644
" movnti %%eax, 56(%3)\n"
" movnti %%edx, 60(%3)\n"
" addl $-64, %0\n"
-@@ -497,9 +616,9 @@ static unsigned long __copy_user_intel_nocache(void *to,
+@@ -497,9 +610,9 @@ static unsigned long __copy_user_intel_nocache(void *to,
" shrl $2, %0\n"
" andl $3, %%eax\n"
" cld\n"
@@ -23282,7 +23418,7 @@ index ef2a6a5..3b28862 100644
"8:\n"
".section .fixup,\"ax\"\n"
"9: lea 0(%%eax,%0,4),%0\n"
-@@ -542,32 +661,36 @@ static unsigned long __copy_user_intel_nocache(void *to,
+@@ -542,32 +655,36 @@ static unsigned long __copy_user_intel_nocache(void *to,
*/
unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
unsigned long size);
@@ -23324,7 +23460,7 @@ index ef2a6a5..3b28862 100644
".section .fixup,\"ax\"\n" \
"5: addl %3,%0\n" \
" jmp 2b\n" \
-@@ -595,14 +718,14 @@ do { \
+@@ -595,14 +712,14 @@ do { \
" negl %0\n" \
" andl $7,%0\n" \
" subl %0,%3\n" \
@@ -23342,7 +23478,7 @@ index ef2a6a5..3b28862 100644
"2:\n" \
".section .fixup,\"ax\"\n" \
"5: addl %3,%0\n" \
-@@ -688,9 +811,9 @@ survive:
+@@ -688,9 +805,9 @@ survive:
}
#endif
if (movsl_is_ok(to, from, n))
@@ -23354,7 +23490,7 @@ index ef2a6a5..3b28862 100644
return n;
}
EXPORT_SYMBOL(__copy_to_user_ll);
-@@ -710,10 +833,9 @@ unsigned long __copy_from_user_ll_nozero(void *to, const void __user *from,
+@@ -710,10 +827,9 @@ unsigned long __copy_from_user_ll_nozero(void *to, const void __user *from,
unsigned long n)
{
if (movsl_is_ok(to, from, n))
@@ -23367,7 +23503,7 @@ index ef2a6a5..3b28862 100644
return n;
}
EXPORT_SYMBOL(__copy_from_user_ll_nozero);
-@@ -740,65 +862,50 @@ unsigned long __copy_from_user_ll_nocache_nozero(void *to, const void __user *fr
+@@ -740,65 +856,50 @@ unsigned long __copy_from_user_ll_nocache_nozero(void *to, const void __user *fr
if (n > 64 && cpu_has_xmm2)
n = __copy_user_intel_nocache(to, from, n);
else
@@ -23396,13 +23532,16 @@ index ef2a6a5..3b28862 100644
- */
-unsigned long
-copy_to_user(void __user *to, const void *from, unsigned long n)
--{
++void copy_from_user_overflow(void)
+ {
- if (access_ok(VERIFY_WRITE, to, n))
- n = __copy_to_user(to, from, n);
- return n;
--}
++ WARN(1, "Buffer overflow detected!\n");
+ }
-EXPORT_SYMBOL(copy_to_user);
--
++EXPORT_SYMBOL(copy_from_user_overflow);
+
-/**
- * copy_from_user: - Copy a block of data from user space.
- * @to: Destination address, in kernel space.
@@ -23421,30 +23560,23 @@ index ef2a6a5..3b28862 100644
- */
-unsigned long
-_copy_from_user(void *to, const void __user *from, unsigned long n)
--{
++void copy_to_user_overflow(void)
+ {
- if (access_ok(VERIFY_READ, from, n))
- n = __copy_from_user(to, from, n);
- else
- memset(to, 0, n);
- return n;
--}
--EXPORT_SYMBOL(_copy_from_user);
--
- void copy_from_user_overflow(void)
- {
- WARN(1, "Buffer overflow detected!\n");
- }
- EXPORT_SYMBOL(copy_from_user_overflow);
-+
-+void copy_to_user_overflow(void)
-+{
+ WARN(1, "Buffer overflow detected!\n");
-+}
+ }
+-EXPORT_SYMBOL(_copy_from_user);
+EXPORT_SYMBOL(copy_to_user_overflow);
-+
+
+-void copy_from_user_overflow(void)
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+void __set_fs(mm_segment_t x)
-+{
+ {
+- WARN(1, "Buffer overflow detected!\n");
+ switch (x.seg) {
+ case 0:
+ loadsegment(gs, 0);
@@ -23459,7 +23591,8 @@ index ef2a6a5..3b28862 100644
+ BUG();
+ }
+ return;
-+}
+ }
+-EXPORT_SYMBOL(copy_from_user_overflow);
+EXPORT_SYMBOL(__set_fs);
+
+void set_fs(mm_segment_t x)
@@ -23894,7 +24027,7 @@ index 3ecfd1a..304d554 100644
if (error_code & PF_WRITE) {
/* write, present and write, not present: */
if (unlikely(!(vma->vm_flags & VM_WRITE)))
-@@ -1005,18 +1197,33 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
+@@ -1005,19 +1197,34 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
{
struct vm_area_struct *vma;
struct task_struct *tsk;
@@ -23905,11 +24038,7 @@ index 3ecfd1a..304d554 100644
unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
(write ? FAULT_FLAG_WRITE : 0);
-- tsk = current;
-- mm = tsk->mm;
--
- /* Get the faulting address: */
-- address = read_cr2();
++ /* Get the faulting address: */
+ unsigned long address = read_cr2();
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
@@ -23928,11 +24057,15 @@ index 3ecfd1a..304d554 100644
+ }
+#endif
+
-+ tsk = current;
-+ mm = tsk->mm;
+ tsk = current;
+ mm = tsk->mm;
+- /* Get the faulting address: */
+- address = read_cr2();
+-
/*
* Detect and handle instructions that would cause a page fault for
+ * both a tracked kernel page and a userspace page.
@@ -1077,7 +1284,7 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
* User-mode registers count as a user access even for any
* potential system fault or CPU buglet:
@@ -24313,10 +24446,10 @@ index 6f31ee5..8ee4164 100644
return (void *)vaddr;
diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
-index f6679a7..8f795a3 100644
+index b91e485..d00e7c9 100644
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
-@@ -266,13 +266,20 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
+@@ -277,13 +277,20 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
struct hstate *h = hstate_file(file);
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
@@ -24341,7 +24474,7 @@ index f6679a7..8f795a3 100644
}
full_search:
-@@ -280,26 +287,27 @@ full_search:
+@@ -291,26 +298,27 @@ full_search:
for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
/* At this point: (!vma || addr < vma->vm_end). */
@@ -24376,7 +24509,7 @@ index f6679a7..8f795a3 100644
}
static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
-@@ -310,9 +318,8 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
+@@ -321,9 +329,8 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
unsigned long base = mm->mmap_base;
@@ -24387,7 +24520,7 @@ index f6679a7..8f795a3 100644
/* don't allow allocations above current base */
if (mm->free_area_cache > base)
-@@ -322,16 +329,15 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
+@@ -333,16 +340,15 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
largest_hole = 0;
mm->free_area_cache = base;
}
@@ -24406,7 +24539,7 @@ index f6679a7..8f795a3 100644
/*
* Lookup failure means no vma is above this address,
* i.e. return with success:
-@@ -340,10 +346,10 @@ try_again:
+@@ -351,10 +357,10 @@ try_again:
if (!vma)
return addr;
@@ -24420,7 +24553,7 @@ index f6679a7..8f795a3 100644
} else if (mm->free_area_cache == vma->vm_end) {
/* pull free_area_cache down to the first hole */
mm->free_area_cache = vma->vm_start;
-@@ -352,29 +358,34 @@ try_again:
+@@ -363,29 +369,34 @@ try_again:
/* remember the largest hole we saw so far */
if (addr + largest_hole < vma->vm_start)
@@ -24468,7 +24601,7 @@ index f6679a7..8f795a3 100644
mm->cached_hole_size = ~0UL;
addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
len, pgoff, flags);
-@@ -382,6 +393,7 @@ fail:
+@@ -393,6 +404,7 @@ fail:
/*
* Restore the topdown base:
*/
@@ -24476,7 +24609,7 @@ index f6679a7..8f795a3 100644
mm->free_area_cache = base;
mm->cached_hole_size = ~0UL;
-@@ -395,10 +407,19 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+@@ -406,10 +418,19 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
struct hstate *h = hstate_file(file);
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
@@ -24497,7 +24630,7 @@ index f6679a7..8f795a3 100644
return -ENOMEM;
if (flags & MAP_FIXED) {
-@@ -410,8 +431,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
+@@ -421,8 +442,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
if (addr) {
addr = ALIGN(addr, huge_page_size(h));
vma = find_vma(mm, addr);
@@ -24541,6 +24674,7 @@ index 4f0cec7..00976ce 100644
+
int devmem_is_allowed(unsigned long pagenr)
{
+- if (pagenr <= 256)
+#ifdef CONFIG_GRKERNSEC_KMEM
+ /* allow BDA */
+ if (!pagenr)
@@ -24550,7 +24684,7 @@ index 4f0cec7..00976ce 100644
+ return 1;
+#else
+ if (!pagenr)
-+ return 1;
+ return 1;
+#ifdef CONFIG_VM86
+ if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
+ return 1;
@@ -24561,8 +24695,7 @@ index 4f0cec7..00976ce 100644
+ return 1;
+#ifdef CONFIG_GRKERNSEC_KMEM
+ /* throw out everything else below 1MB */
- if (pagenr <= 256)
-- return 1;
++ if (pagenr <= 256)
+ return 0;
+#endif
if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
@@ -25539,7 +25672,7 @@ index 8573b83..4f3ed7e 100644
+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src)
+{
+ unsigned int count = USER_PGD_PTRS;
-
++
+ while (count--)
+ *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
+}
@@ -25562,7 +25695,7 @@ index 8573b83..4f3ed7e 100644
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+ pgd = __pgd(pgd_val(pgd) & clone_pgd_mask);
+#endif
-+
+
+ *dst++ = pgd;
+ }
+
@@ -26100,6 +26233,19 @@ index d6aa6e8..266395a 100644
unsigned long stack = kernel_stack_pointer(regs);
if (depth)
dump_trace(NULL, regs, (unsigned long *)stack, 0,
+diff --git a/arch/x86/pci/i386.c b/arch/x86/pci/i386.c
+index 831971e..dd8ca6f 100644
+--- a/arch/x86/pci/i386.c
++++ b/arch/x86/pci/i386.c
+@@ -57,7 +57,7 @@ static struct pcibios_fwaddrmap *pcibios_fwaddrmap_lookup(struct pci_dev *dev)
+ {
+ struct pcibios_fwaddrmap *map;
+
+- WARN_ON(!spin_is_locked(&pcibios_fwaddrmap_lock));
++ WARN_ON_SMP(!spin_is_locked(&pcibios_fwaddrmap_lock));
+
+ list_for_each_entry(map, &pcibios_fwaddrmappings, list)
+ if (map->dev == dev)
diff --git a/arch/x86/pci/mrst.c b/arch/x86/pci/mrst.c
index 140942f..8a5cc55 100644
--- a/arch/x86/pci/mrst.c
@@ -26466,7 +26612,7 @@ index 40e4469..1ab536e 100644
gdt_descr.size = GDT_SIZE - 1;
load_gdt(&gdt_descr);
diff --git a/arch/x86/platform/efi/efi_stub_32.S b/arch/x86/platform/efi/efi_stub_32.S
-index fbe66e6..c5c0dd2 100644
+index fbe66e6..f62f167 100644
--- a/arch/x86/platform/efi/efi_stub_32.S
+++ b/arch/x86/platform/efi/efi_stub_32.S
@@ -6,7 +6,9 @@
@@ -26488,22 +26634,35 @@ index fbe66e6..c5c0dd2 100644
ENTRY(efi_call_phys)
/*
* 0. The function can only be called in Linux kernel. So CS has been
-@@ -36,9 +38,11 @@ ENTRY(efi_call_phys)
+@@ -36,10 +38,24 @@ ENTRY(efi_call_phys)
* The mapping of lower virtual memory has been created in prelog and
* epilog.
*/
- movl $1f, %edx
- subl $__PAGE_OFFSET, %edx
- jmp *%edx
++#ifdef CONFIG_PAX_KERNEXEC
+ movl $(__KERNEXEC_EFI_DS), %edx
+ mov %edx, %ds
+ mov %edx, %es
+ mov %edx, %ss
-+ ljmp $(__KERNEXEC_EFI_CS),$1f-__PAGE_OFFSET
++ addl $2f,(1f)
++ ljmp *(1f)
++
++__INITDATA
++1: .long __LOAD_PHYSICAL_ADDR, __KERNEXEC_EFI_CS
++.previous
++
++2:
++ subl $2b,(1b)
++#else
++ jmp 1f-__PAGE_OFFSET
1:
++#endif
/*
-@@ -47,14 +51,8 @@ ENTRY(efi_call_phys)
+ * 2. Now on the top of stack is the return
+@@ -47,14 +63,8 @@ ENTRY(efi_call_phys)
* parameter 2, ..., param n. To make things easy, we save the return
* address of efi_call_phys in a global variable.
*/
@@ -26520,7 +26679,7 @@ index fbe66e6..c5c0dd2 100644
/*
* 3. Clear PG bit in %CR0.
-@@ -73,9 +71,8 @@ ENTRY(efi_call_phys)
+@@ -73,9 +83,8 @@ ENTRY(efi_call_phys)
/*
* 5. Call the physical function.
*/
@@ -26531,7 +26690,7 @@ index fbe66e6..c5c0dd2 100644
/*
* 6. After EFI runtime service returns, control will return to
* following instruction. We'd better readjust stack pointer first.
-@@ -88,35 +85,32 @@ ENTRY(efi_call_phys)
+@@ -88,35 +97,40 @@ ENTRY(efi_call_phys)
movl %cr0, %edx
orl $0x80000000, %edx
movl %edx, %cr0
@@ -26544,7 +26703,15 @@ index fbe66e6..c5c0dd2 100644
*/
- movl $1f, %edx
- jmp *%edx
-+ ljmp $(__KERNEL_CS),$1f+__PAGE_OFFSET
++#ifdef CONFIG_PAX_KERNEXEC
++ movl $(__KERNEL_DS), %edx
++ mov %edx, %ds
++ mov %edx, %es
++ mov %edx, %ss
++ ljmp $(__KERNEL_CS),$1f
++#else
++ jmp 1f+__PAGE_OFFSET
++#endif
1:
+ movl $(__KERNEL_DS), %edx
+ mov %edx, %ds
@@ -26690,7 +26857,7 @@ index 218cdb1..fd55c08 100644
syscall_init(); /* This sets MSR_*STAR and related */
#endif
diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
-index b685296..e00eb65 100644
+index b685296..4ac6aaa 100644
--- a/arch/x86/tools/relocs.c
+++ b/arch/x86/tools/relocs.c
@@ -12,10 +12,13 @@
@@ -26783,7 +26950,7 @@ index b685296..e00eb65 100644
}
+ base = 0;
+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
++#ifdef CONFIG_X86_32
+ for (j = 0; j < ehdr.e_phnum; j++) {
+ if (phdr[j].p_type != PT_LOAD )
+ continue;
@@ -26860,7 +27027,7 @@ index b685296..e00eb65 100644
+
+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
+ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
-+ if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
++ if (!strcmp(sec_name(sym->st_shndx), ".text.end") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
+ continue;
+ if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
+ continue;
@@ -27448,20 +27615,18 @@ index 6296b40..417c00f 100644
if (!gpt)
return NULL;
-+ if (!le32_to_cpu(gpt->num_partition_entries))
-+ return NULL;
-+ pte = kcalloc(le32_to_cpu(gpt->num_partition_entries), le32_to_cpu(gpt->sizeof_partition_entry), GFP_KERNEL);
-+ if (!pte)
-+ return NULL;
-+
- count = le32_to_cpu(gpt->num_partition_entries) *
- le32_to_cpu(gpt->sizeof_partition_entry);
+- count = le32_to_cpu(gpt->num_partition_entries) *
+- le32_to_cpu(gpt->sizeof_partition_entry);
- if (!count)
-- return NULL;
++ if (!le32_to_cpu(gpt->num_partition_entries))
+ return NULL;
- pte = kzalloc(count, GFP_KERNEL);
-- if (!pte)
-- return NULL;
--
++ pte = kcalloc(le32_to_cpu(gpt->num_partition_entries), le32_to_cpu(gpt->sizeof_partition_entry), GFP_KERNEL);
+ if (!pte)
+ return NULL;
+
++ count = le32_to_cpu(gpt->num_partition_entries) *
++ le32_to_cpu(gpt->sizeof_partition_entry);
if (read_lba(state, le64_to_cpu(gpt->partition_entry_lba),
(u8 *) pte,
count) < count) {
@@ -27655,7 +27820,7 @@ index 251c7b62..000462d 100644
bool enable = !device_may_wakeup(&dev->dev);
device_set_wakeup_enable(&dev->dev, enable);
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
-index 0734086..3ad3e4c 100644
+index bbac51e..4c094f9 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -556,7 +556,7 @@ static int __cpuinit acpi_processor_add(struct acpi_device *device)
@@ -29468,7 +29633,7 @@ index 47ff7e4..0c7d340 100644
.part_num = MBCS_PART_NUM,
.mfg_num = MBCS_MFG_NUM,
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
-index d6e9d08..4493e89 100644
+index d6e9d08..0c314bf 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -18,6 +18,7 @@
@@ -29530,7 +29695,7 @@ index d6e9d08..4493e89 100644
- remaining = copy_to_user(buf, ptr, sz);
+#ifdef CONFIG_PAX_USERCOPY
-+ temp = kmalloc(sz, GFP_KERNEL);
++ temp = kmalloc(sz, GFP_KERNEL|GFP_USERCOPY);
+ if (!temp) {
+ unxlate_dev_mem_ptr(p, ptr);
+ return -ENOMEM;
@@ -29575,7 +29740,7 @@ index d6e9d08..4493e89 100644
- if (copy_to_user(buf, kbuf, sz))
+#ifdef CONFIG_PAX_USERCOPY
-+ temp = kmalloc(sz, GFP_KERNEL);
++ temp = kmalloc(sz, GFP_KERNEL|GFP_USERCOPY);
+ if (!temp)
+ return -ENOMEM;
+ memcpy(temp, kbuf, sz);
@@ -29617,10 +29782,10 @@ index 9df78e2..01ba9ae 100644
*ppos = i;
diff --git a/drivers/char/random.c b/drivers/char/random.c
-index 4ec04a7..4a092ed 100644
+index d98b2a6..230b4c6 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
-@@ -261,8 +261,13 @@
+@@ -272,8 +272,13 @@
/*
* Configuration information
*/
@@ -29634,7 +29799,7 @@ index 4ec04a7..4a092ed 100644
#define SEC_XFER_SIZE 512
#define EXTRACT_SIZE 10
-@@ -300,10 +305,17 @@ static struct poolinfo {
+@@ -313,10 +318,17 @@ static struct poolinfo {
int poolwords;
int tap1, tap2, tap3, tap4, tap5;
} poolinfo_table[] = {
@@ -29652,7 +29817,36 @@ index 4ec04a7..4a092ed 100644
#if 0
/* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
{ 2048, 1638, 1231, 819, 411, 1 },
-@@ -913,7 +925,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
+@@ -527,8 +539,8 @@ static void _mix_pool_bytes(struct entropy_store *r, const void *in,
+ input_rotate += i ? 7 : 14;
+ }
+
+- ACCESS_ONCE(r->input_rotate) = input_rotate;
+- ACCESS_ONCE(r->add_ptr) = i;
++ ACCESS_ONCE_RW(r->input_rotate) = input_rotate;
++ ACCESS_ONCE_RW(r->add_ptr) = i;
+ smp_wmb();
+
+ if (out)
+@@ -799,6 +811,17 @@ void add_disk_randomness(struct gendisk *disk)
+ }
+ #endif
+
++#ifdef CONFIG_PAX_LATENT_ENTROPY
++u64 latent_entropy;
++
++__init void transfer_latent_entropy(void)
++{
++ mix_pool_bytes(&input_pool, &latent_entropy, sizeof(latent_entropy));
++ mix_pool_bytes(&nonblocking_pool, &latent_entropy, sizeof(latent_entropy));
++// printk(KERN_INFO "PAX: transferring latent entropy: %16llx\n", latent_entropy);
++}
++#endif
++
+ /*********************************************************************
+ *
+ * Entropy extraction routines
+@@ -1008,7 +1031,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
extract_buf(r, tmp);
i = min_t(int, nbytes, EXTRACT_SIZE);
@@ -29661,7 +29855,7 @@ index 4ec04a7..4a092ed 100644
ret = -EFAULT;
break;
}
-@@ -1238,7 +1250,7 @@ EXPORT_SYMBOL(generate_random_uuid);
+@@ -1342,7 +1365,7 @@ EXPORT_SYMBOL(generate_random_uuid);
#include <linux/sysctl.h>
static int min_read_thresh = 8, min_write_thresh;
@@ -29713,7 +29907,7 @@ index 45713f0..8286d21 100644
return 0;
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
-index ad7c732..5aa8054 100644
+index 08427ab..1ab10b7 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -415,7 +415,7 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
@@ -29946,10 +30140,10 @@ index 9047f55..e47c7ff 100644
void fw_card_initialize(struct fw_card *card,
const struct fw_card_driver *driver, struct device *device);
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
-index 153980b..4b4d046 100644
+index b298158..7ed8432 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
-@@ -449,11 +449,6 @@ void __init dmi_scan_machine(void)
+@@ -452,11 +452,6 @@ void __init dmi_scan_machine(void)
}
}
else {
@@ -29961,7 +30155,7 @@ index 153980b..4b4d046 100644
p = dmi_ioremap(0xF0000, 0x10000);
if (p == NULL)
goto error;
-@@ -723,7 +718,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
+@@ -726,7 +721,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
if (buf == NULL)
return -1;
@@ -30441,7 +30635,7 @@ index 26c67a7..8d4cbcb 100644
INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
INIT_WORK(&dev_priv->error_work, i915_error_work_func);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index d4d162f..e80037c 100644
+index 3de3d9b..7cb4130 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2254,7 +2254,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb)
@@ -30462,16 +30656,19 @@ index d4d162f..e80037c 100644
}
static bool intel_crtc_driving_pch(struct drm_crtc *crtc)
-@@ -7286,7 +7286,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
+@@ -7273,9 +7273,8 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
+
+ obj = work->old_fb_obj;
- atomic_clear_mask(1 << intel_crtc->plane,
- &obj->pending_flip.counter);
+- atomic_clear_mask(1 << intel_crtc->plane,
+- &obj->pending_flip.counter);
- if (atomic_read(&obj->pending_flip) == 0)
++ atomic_clear_mask_unchecked(1 << intel_crtc->plane, &obj->pending_flip);
+ if (atomic_read_unchecked(&obj->pending_flip) == 0)
wake_up(&dev_priv->pending_flip_queue);
schedule_work(&work->work);
-@@ -7582,7 +7582,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
+@@ -7571,7 +7570,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
/* Block clients from rendering to the new back buffer until
* the flip occurs and the object is no longer visible.
*/
@@ -30480,7 +30677,7 @@ index d4d162f..e80037c 100644
ret = dev_priv->display.queue_flip(dev, crtc, fb, obj);
if (ret)
-@@ -7596,7 +7596,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
+@@ -7585,7 +7584,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
return 0;
cleanup_pending:
@@ -30689,7 +30886,7 @@ index 2746402..c8dc4a4 100644
.train_set = nv50_sor_dp_train_set,
.train_adj = nv50_sor_dp_train_adj
diff --git a/drivers/gpu/drm/nouveau/nvd0_display.c b/drivers/gpu/drm/nouveau/nvd0_display.c
-index 0247250..d2f6aaf 100644
+index 8a555fb..2743fe6 100644
--- a/drivers/gpu/drm/nouveau/nvd0_display.c
+++ b/drivers/gpu/drm/nouveau/nvd0_display.c
@@ -1366,7 +1366,7 @@ nvd0_sor_dpms(struct drm_encoder *encoder, int mode)
@@ -31177,10 +31374,10 @@ index 8a8725c..afed796 100644
marker = list_first_entry(&queue->head,
struct vmw_marker, head);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
-index 4da66b4..e948655 100644
+index 41d4437..631c2e5 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
-@@ -2063,7 +2063,7 @@ static bool hid_ignore(struct hid_device *hdev)
+@@ -2073,7 +2073,7 @@ static bool hid_ignore(struct hid_device *hdev)
int hid_add_device(struct hid_device *hdev)
{
@@ -31189,7 +31386,7 @@ index 4da66b4..e948655 100644
int ret;
if (WARN_ON(hdev->status & HID_STAT_ADDED))
-@@ -2078,7 +2078,7 @@ int hid_add_device(struct hid_device *hdev)
+@@ -2088,7 +2088,7 @@ int hid_add_device(struct hid_device *hdev)
/* XXX hack, any other cleaner solution after the driver core
* is converted to allow more than 20 bytes as the device name? */
dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
@@ -32698,10 +32895,10 @@ index b8d8611..7a4a04b 100644
#include <linux/input.h>
#include <linux/gameport.h>
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
-index fd7a0d5..a4af10c 100644
+index 42f7b25..09fcf46 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
-@@ -710,7 +710,7 @@ static void xpad_led_set(struct led_classdev *led_cdev,
+@@ -714,7 +714,7 @@ static void xpad_led_set(struct led_classdev *led_cdev,
static int xpad_led_probe(struct usb_xpad *xpad)
{
@@ -32710,7 +32907,7 @@ index fd7a0d5..a4af10c 100644
long led_no;
struct xpad_led *led;
struct led_classdev *led_cdev;
-@@ -723,7 +723,7 @@ static int xpad_led_probe(struct usb_xpad *xpad)
+@@ -727,7 +727,7 @@ static int xpad_led_probe(struct usb_xpad *xpad)
if (!led)
return -ENOMEM;
@@ -32901,7 +33098,7 @@ index b5fdcb7..5b6c59f 100644
printk(KERN_INFO "lguest: mapped switcher at %p\n",
diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
-index 3980903..ce25c5e 100644
+index 39809035..ce25c5e 100644
--- a/drivers/lguest/x86/core.c
+++ b/drivers/lguest/x86/core.c
@@ -59,7 +59,7 @@ static struct {
@@ -33047,7 +33244,7 @@ index a1a3e6d..1918bfc 100644
DMWARN("name not supplied when creating device");
return -EINVAL;
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
-index d039de8..0cf5b87 100644
+index b58b7a3..8018b19 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -40,7 +40,7 @@ enum dm_raid1_error {
@@ -33113,7 +33310,7 @@ index d039de8..0cf5b87 100644
ms->mirror[mirror].error_type = 0;
ms->mirror[mirror].offset = offset;
-@@ -1351,7 +1351,7 @@ static void mirror_resume(struct dm_target *ti)
+@@ -1352,7 +1352,7 @@ static void mirror_resume(struct dm_target *ti)
*/
static char device_status_char(struct mirror *m)
{
@@ -33258,7 +33455,7 @@ index e24143c..ce2f21a1 100644
void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 2b30ffd..bf789ce 100644
+index 9ee8ce3..362b519 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -277,10 +277,10 @@ EXPORT_SYMBOL_GPL(md_trim_bio);
@@ -33330,7 +33527,7 @@ index 2b30ffd..bf789ce 100644
INIT_LIST_HEAD(&rdev->same_set);
init_waitqueue_head(&rdev->blocked_wait);
-@@ -6738,7 +6738,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
+@@ -6748,7 +6748,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
spin_unlock(&pers_lock);
seq_printf(seq, "\n");
@@ -33339,7 +33536,7 @@ index 2b30ffd..bf789ce 100644
return 0;
}
if (v == (void*)2) {
-@@ -6841,7 +6841,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
+@@ -6851,7 +6851,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
return error;
seq = file->private_data;
@@ -33348,7 +33545,7 @@ index 2b30ffd..bf789ce 100644
return error;
}
-@@ -6855,7 +6855,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
+@@ -6865,7 +6865,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
/* always allow read */
mask = POLLIN | POLLRDNORM;
@@ -33357,7 +33554,7 @@ index 2b30ffd..bf789ce 100644
mask |= POLLERR | POLLPRI;
return mask;
}
-@@ -6899,7 +6899,7 @@ static int is_mddev_idle(struct mddev *mddev, int init)
+@@ -6909,7 +6909,7 @@ static int is_mddev_idle(struct mddev *mddev, int init)
struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
(int)part_stat_read(&disk->part0, sectors[1]) -
@@ -33447,7 +33644,7 @@ index 1cbfc6b..56e1dbb 100644
/*----------------------------------------------------------------*/
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index d7e9577..faa512f2 100644
+index 23904d2..c4801f9 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1688,7 +1688,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
@@ -33459,7 +33656,7 @@ index d7e9577..faa512f2 100644
}
sectors -= s;
sect += s;
-@@ -1902,7 +1902,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk,
+@@ -1908,7 +1908,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk,
test_bit(In_sync, &rdev->flags)) {
if (r1_sync_page_io(rdev, sect, s,
conf->tmppage, READ)) {
@@ -33594,7 +33791,7 @@ index a7d876f..8c21b61 100644
struct dvb_demux *demux;
void *priv;
diff --git a/drivers/media/dvb/dvb-core/dvbdev.c b/drivers/media/dvb/dvb-core/dvbdev.c
-index 00a6732..70a682e 100644
+index 39eab73..60033e7 100644
--- a/drivers/media/dvb/dvb-core/dvbdev.c
+++ b/drivers/media/dvb/dvb-core/dvbdev.c
@@ -192,7 +192,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
@@ -33693,6 +33890,33 @@ index 9cde353..8c6a1c3 100644
struct i2c_client i2c_client;
u32 i2c_rc;
+diff --git a/drivers/media/video/cx25821/cx25821-core.c b/drivers/media/video/cx25821/cx25821-core.c
+index 7930ca5..235bf7d 100644
+--- a/drivers/media/video/cx25821/cx25821-core.c
++++ b/drivers/media/video/cx25821/cx25821-core.c
+@@ -912,9 +912,6 @@ static int cx25821_dev_setup(struct cx25821_dev *dev)
+ list_add_tail(&dev->devlist, &cx25821_devlist);
+ mutex_unlock(&cx25821_devlist_mutex);
+
+- strcpy(cx25821_boards[UNKNOWN_BOARD].name, "unknown");
+- strcpy(cx25821_boards[CX25821_BOARD].name, "cx25821");
+-
+ if (dev->pci->device != 0x8210) {
+ pr_info("%s(): Exiting. Incorrect Hardware device = 0x%02x\n",
+ __func__, dev->pci->device);
+diff --git a/drivers/media/video/cx25821/cx25821.h b/drivers/media/video/cx25821/cx25821.h
+index b9aa801..029f293 100644
+--- a/drivers/media/video/cx25821/cx25821.h
++++ b/drivers/media/video/cx25821/cx25821.h
+@@ -187,7 +187,7 @@ enum port {
+ };
+
+ struct cx25821_board {
+- char *name;
++ const char *name;
+ enum port porta;
+ enum port portb;
+ enum port portc;
diff --git a/drivers/media/video/cx88/cx88-alsa.c b/drivers/media/video/cx88/cx88-alsa.c
index 04bf662..e0ac026 100644
--- a/drivers/media/video/cx88/cx88-alsa.c
@@ -34071,6 +34295,19 @@ index 2b1482a..5d33616 100644
union axis_conversion ac; /* hw -> logical axis */
int mapped_btns[3];
+diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
+index 28adefe..08aad69 100644
+--- a/drivers/misc/lkdtm.c
++++ b/drivers/misc/lkdtm.c
+@@ -477,6 +477,8 @@ static ssize_t lkdtm_debugfs_read(struct file *f, char __user *user_buf,
+ int i, n, out;
+
+ buf = (char *)__get_free_page(GFP_KERNEL);
++ if (buf == NULL)
++ return -ENOMEM;
+
+ n = snprintf(buf, PAGE_SIZE, "Available crash types:\n");
+ for (i = 0; i < ARRAY_SIZE(cp_type); i++)
diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
index 2f30bad..c4c13d0 100644
--- a/drivers/misc/sgi-gru/gruhandles.c
@@ -34172,6 +34409,31 @@ index 5c3ce24..4915ccb 100644
- atomic_long_t flush_tlb_gru;
- atomic_long_t flush_tlb_gru_tgh;
- atomic_long_t flush_tlb_gru_zero_asid;
+-
+- atomic_long_t copy_gpa;
+- atomic_long_t read_gpa;
+-
+- atomic_long_t mesq_receive;
+- atomic_long_t mesq_receive_none;
+- atomic_long_t mesq_send;
+- atomic_long_t mesq_send_failed;
+- atomic_long_t mesq_noop;
+- atomic_long_t mesq_send_unexpected_error;
+- atomic_long_t mesq_send_lb_overflow;
+- atomic_long_t mesq_send_qlimit_reached;
+- atomic_long_t mesq_send_amo_nacked;
+- atomic_long_t mesq_send_put_nacked;
+- atomic_long_t mesq_page_overflow;
+- atomic_long_t mesq_qf_locked;
+- atomic_long_t mesq_qf_noop_not_full;
+- atomic_long_t mesq_qf_switch_head_failed;
+- atomic_long_t mesq_qf_unexpected_error;
+- atomic_long_t mesq_noop_unexpected_error;
+- atomic_long_t mesq_noop_lb_overflow;
+- atomic_long_t mesq_noop_qlimit_reached;
+- atomic_long_t mesq_noop_amo_nacked;
+- atomic_long_t mesq_noop_put_nacked;
+- atomic_long_t mesq_noop_page_overflow;
+ atomic_long_unchecked_t vdata_alloc;
+ atomic_long_unchecked_t vdata_free;
+ atomic_long_unchecked_t gts_alloc;
@@ -34223,33 +34485,10 @@ index 5c3ce24..4915ccb 100644
+ atomic_long_unchecked_t flush_tlb_gru;
+ atomic_long_unchecked_t flush_tlb_gru_tgh;
+ atomic_long_unchecked_t flush_tlb_gru_zero_asid;
-
-- atomic_long_t copy_gpa;
-- atomic_long_t read_gpa;
++
+ atomic_long_unchecked_t copy_gpa;
+ atomic_long_unchecked_t read_gpa;
-
-- atomic_long_t mesq_receive;
-- atomic_long_t mesq_receive_none;
-- atomic_long_t mesq_send;
-- atomic_long_t mesq_send_failed;
-- atomic_long_t mesq_noop;
-- atomic_long_t mesq_send_unexpected_error;
-- atomic_long_t mesq_send_lb_overflow;
-- atomic_long_t mesq_send_qlimit_reached;
-- atomic_long_t mesq_send_amo_nacked;
-- atomic_long_t mesq_send_put_nacked;
-- atomic_long_t mesq_page_overflow;
-- atomic_long_t mesq_qf_locked;
-- atomic_long_t mesq_qf_noop_not_full;
-- atomic_long_t mesq_qf_switch_head_failed;
-- atomic_long_t mesq_qf_unexpected_error;
-- atomic_long_t mesq_noop_unexpected_error;
-- atomic_long_t mesq_noop_lb_overflow;
-- atomic_long_t mesq_noop_qlimit_reached;
-- atomic_long_t mesq_noop_amo_nacked;
-- atomic_long_t mesq_noop_put_nacked;
-- atomic_long_t mesq_noop_page_overflow;
++
+ atomic_long_unchecked_t mesq_receive;
+ atomic_long_unchecked_t mesq_receive_none;
+ atomic_long_unchecked_t mesq_send;
@@ -34341,11 +34580,27 @@ index 8d082b4..aa749ae 100644
/*
* Timer function to enforce the timelimit on the partition disengage.
+diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
+index 2b62232..acfaeeb 100644
+--- a/drivers/misc/ti-st/st_core.c
++++ b/drivers/misc/ti-st/st_core.c
+@@ -349,6 +349,11 @@ void st_int_recv(void *disc_data,
+ st_gdata->rx_skb = alloc_skb(
+ st_gdata->list[type]->max_frame_size,
+ GFP_ATOMIC);
++ if (st_gdata->rx_skb == NULL) {
++ pr_err("out of memory: dropping\n");
++ goto done;
++ }
++
+ skb_reserve(st_gdata->rx_skb,
+ st_gdata->list[type]->reserve);
+ /* next 2 required for BT only */
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
-index 69ef0be..f3ef91e 100644
+index 504da71..9722d43 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
-@@ -652,7 +652,7 @@ static const struct sdhci_pci_fixes sdhci_via = {
+@@ -653,7 +653,7 @@ static const struct sdhci_pci_fixes sdhci_via = {
.probe = via_probe,
};
@@ -34790,6 +35045,36 @@ index 8636e83..ab9bbc3 100644
struct ixgbe_mbx_stats stats;
u32 timeout;
u32 usec_delay;
+diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+index 307611a..d8e4562 100644
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -969,8 +969,6 @@ static irqreturn_t ixgbevf_msix_clean_tx(int irq, void *data)
+ r_idx = find_first_bit(q_vector->txr_idx, adapter->num_tx_queues);
+ for (i = 0; i < q_vector->txr_count; i++) {
+ tx_ring = &(adapter->tx_ring[r_idx]);
+- tx_ring->total_bytes = 0;
+- tx_ring->total_packets = 0;
+ ixgbevf_clean_tx_irq(adapter, tx_ring);
+ r_idx = find_next_bit(q_vector->txr_idx, adapter->num_tx_queues,
+ r_idx + 1);
+@@ -994,16 +992,6 @@ static irqreturn_t ixgbevf_msix_clean_rx(int irq, void *data)
+ struct ixgbe_hw *hw = &adapter->hw;
+ struct ixgbevf_ring *rx_ring;
+ int r_idx;
+- int i;
+-
+- r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues);
+- for (i = 0; i < q_vector->rxr_count; i++) {
+- rx_ring = &(adapter->rx_ring[r_idx]);
+- rx_ring->total_bytes = 0;
+- rx_ring->total_packets = 0;
+- r_idx = find_next_bit(q_vector->rxr_idx, adapter->num_rx_queues,
+- r_idx + 1);
+- }
+
+ if (!q_vector->rxr_count)
+ return IRQ_HANDLED;
diff --git a/drivers/net/ethernet/intel/ixgbevf/vf.h b/drivers/net/ethernet/intel/ixgbevf/vf.h
index 25c951d..cc7cf33 100644
--- a/drivers/net/ethernet/intel/ixgbevf/vf.h
@@ -34867,7 +35152,7 @@ index 4a518a3..936b334 100644
#define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath) \
((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next)
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
-index 161e045..0bb5b86 100644
+index a73bbe7..94abcb7 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -708,17 +708,17 @@ struct rtl8169_private {
@@ -34920,10 +35205,10 @@ index c07cfe9..81cbf7e 100644
/* To mask all all interrupts.*/
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
-index 48d56da..a27e46c 100644
+index 9bdfaba..3d8f8d4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
-@@ -1584,7 +1584,7 @@ static const struct file_operations stmmac_rings_status_fops = {
+@@ -1587,7 +1587,7 @@ static const struct file_operations stmmac_rings_status_fops = {
.open = stmmac_sysfs_ring_open,
.read = seq_read,
.llseek = seq_lseek,
@@ -34932,7 +35217,7 @@ index 48d56da..a27e46c 100644
};
static int stmmac_sysfs_dma_cap_read(struct seq_file *seq, void *v)
-@@ -1656,7 +1656,7 @@ static const struct file_operations stmmac_dma_cap_fops = {
+@@ -1659,7 +1659,7 @@ static const struct file_operations stmmac_dma_cap_fops = {
.open = stmmac_sysfs_dma_cap_open,
.read = seq_read,
.llseek = seq_lseek,
@@ -35393,10 +35678,10 @@ index a66a13b..0ef399e 100644
static u16 ar9003_calc_ptr_chksum(struct ar9003_txc *ads)
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
-index e88f182..4e57f5d 100644
+index f8e1fbb..bbc303c 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
-@@ -614,7 +614,7 @@ struct ath_hw_private_ops {
+@@ -615,7 +615,7 @@ struct ath_hw_private_ops {
/* ANI */
void (*ani_cache_ini_regs)(struct ath_hw *ah);
@@ -35405,7 +35690,7 @@ index e88f182..4e57f5d 100644
/**
* struct ath_hw_ops - callbacks used by hardware code and driver code
-@@ -644,7 +644,7 @@ struct ath_hw_ops {
+@@ -645,7 +645,7 @@ struct ath_hw_ops {
void (*antdiv_comb_conf_set)(struct ath_hw *ah,
struct ath_hw_antcomb_conf *antconf);
@@ -35414,7 +35699,7 @@ index e88f182..4e57f5d 100644
struct ath_nf_limits {
s16 max;
-@@ -664,7 +664,7 @@ enum ath_cal_list {
+@@ -665,7 +665,7 @@ enum ath_cal_list {
#define AH_FASTCC 0x4
struct ath_hw {
@@ -36164,7 +36449,7 @@ index 1a99d4b..e85d64b 100644
/*
* Queue element to wait for room in request queue. FIFO order is
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
-index a3a056a..b9bbc2f 100644
+index b48c24f..dac0fbc 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -42,7 +42,7 @@
@@ -36176,7 +36461,7 @@ index a3a056a..b9bbc2f 100644
static void scsi_host_cls_release(struct device *dev)
-@@ -360,7 +360,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
+@@ -361,7 +361,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
* subtract one because we increment first then return, but we need to
* know what the next host number was before increment
*/
@@ -36476,6 +36761,19 @@ index d109cc3..09f4e7d 100644
.qc_prep = ata_noop_qc_prep,
.qc_issue = sas_ata_qc_issue,
.qc_fill_rtf = sas_ata_qc_fill_rtf,
+diff --git a/drivers/scsi/lpfc/Makefile b/drivers/scsi/lpfc/Makefile
+index fe5d396..e93d526 100644
+--- a/drivers/scsi/lpfc/Makefile
++++ b/drivers/scsi/lpfc/Makefile
+@@ -22,7 +22,7 @@
+ ccflags-$(GCOV) := -fprofile-arcs -ftest-coverage
+ ccflags-$(GCOV) += -O0
+
+-ccflags-y += -Werror
++#ccflags-y += -Werror
+
+ obj-$(CONFIG_SCSI_LPFC) := lpfc.o
+
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index 3a1ffdd..8eb7c71 100644
--- a/drivers/scsi/lpfc/lpfc.h
@@ -36839,10 +37137,10 @@ index 07322ec..91ccc23 100644
/* check if the device is still usable */
if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
-index 4037fd5..a19fcc7 100644
+index 2bc0362..a858ebe 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
-@@ -1415,7 +1415,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
+@@ -1425,7 +1425,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
shost = sdev->host;
scsi_init_cmd_errh(cmd);
cmd->result = DID_NO_CONNECT << 16;
@@ -36851,7 +37149,7 @@ index 4037fd5..a19fcc7 100644
/*
* SCSI request completion path will do scsi_device_unbusy(),
-@@ -1441,9 +1441,9 @@ static void scsi_softirq_done(struct request *rq)
+@@ -1451,9 +1451,9 @@ static void scsi_softirq_done(struct request *rq)
INIT_LIST_HEAD(&cmd->eh_entry);
@@ -36864,7 +37162,7 @@ index 4037fd5..a19fcc7 100644
disposition = scsi_decide_disposition(cmd);
if (disposition != SUCCESS &&
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
-index 04c2a27..9d8bd66 100644
+index bb7c482..7551a95 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -660,7 +660,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr, \
@@ -37329,7 +37627,7 @@ index f015839..b15dfc4 100644
(cmd->transport_state & CMD_T_STOP) != 0,
(cmd->transport_state & CMD_T_SENT) != 0);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index 443704f..92d3517 100644
+index 222f1c5..0cdfd3e 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1355,7 +1355,7 @@ struct se_device *transport_add_device_to_core_hba(
@@ -37359,7 +37657,7 @@ index 443704f..92d3517 100644
atomic_read(&cmd->t_task_cdbs_ex_left),
(cmd->transport_state & CMD_T_ACTIVE) != 0,
(cmd->transport_state & CMD_T_STOP) != 0,
-@@ -2216,9 +2216,9 @@ check_depth:
+@@ -2217,9 +2217,9 @@ check_depth:
cmd = task->task_se_cmd;
spin_lock_irqsave(&cmd->t_state_lock, flags);
task->task_flags |= (TF_ACTIVE | TF_SENT);
@@ -38106,7 +38404,7 @@ index d956965..4179a77 100644
file->f_version = event_count;
return POLLIN | POLLRDNORM;
diff --git a/drivers/usb/early/ehci-dbgp.c b/drivers/usb/early/ehci-dbgp.c
-index 1fc8f12..20647c1 100644
+index 347bb05..63e1b73 100644
--- a/drivers/usb/early/ehci-dbgp.c
+++ b/drivers/usb/early/ehci-dbgp.c
@@ -97,7 +97,8 @@ static inline u32 dbgp_len_update(u32 x, u32 len)
@@ -41561,7 +41859,7 @@ index d146e18..12d1bd1 100644
fd_offset + ex.a_text);
if (error != N_DATADDR(ex)) {
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index 16f7354..666524e 100644
+index 16f7354..7cc1e24 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -32,6 +32,7 @@
@@ -41692,7 +41990,7 @@ index 16f7354..666524e 100644
error = -ENOMEM;
goto out_close;
}
-@@ -525,6 +549,349 @@ out:
+@@ -525,6 +549,311 @@ out:
return error;
}
@@ -41712,15 +42010,6 @@ index 16f7354..666524e 100644
+ pax_flags |= MF_PAX_SEGMEXEC;
+#endif
+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ if ((__supported_pte_mask & _PAGE_NX))
-+ pax_flags &= ~MF_PAX_SEGMEXEC;
-+ else
-+ pax_flags &= ~MF_PAX_PAGEEXEC;
-+ }
-+#endif
-+
+#ifdef CONFIG_PAX_EMUTRAMP
+ if (elf_phdata->p_flags & PF_EMUTRAMP)
+ pax_flags |= MF_PAX_EMUTRAMP;
@@ -41754,15 +42043,6 @@ index 16f7354..666524e 100644
+ pax_flags |= MF_PAX_SEGMEXEC;
+#endif
+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ if ((__supported_pte_mask & _PAGE_NX))
-+ pax_flags &= ~MF_PAX_SEGMEXEC;
-+ else
-+ pax_flags &= ~MF_PAX_PAGEEXEC;
-+ }
-+#endif
-+
+#ifdef CONFIG_PAX_EMUTRAMP
+ if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
+ pax_flags |= MF_PAX_EMUTRAMP;
@@ -41798,15 +42078,6 @@ index 16f7354..666524e 100644
+ pax_flags |= MF_PAX_SEGMEXEC;
+#endif
+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ if ((__supported_pte_mask & _PAGE_NX))
-+ pax_flags &= ~MF_PAX_SEGMEXEC;
-+ else
-+ pax_flags &= ~MF_PAX_PAGEEXEC;
-+ }
-+#endif
-+
+#ifdef CONFIG_PAX_EMUTRAMP
+ if (pax_flags_softmode & MF_PAX_EMUTRAMP)
+ pax_flags |= MF_PAX_EMUTRAMP;
@@ -41840,15 +42111,6 @@ index 16f7354..666524e 100644
+ pax_flags |= MF_PAX_SEGMEXEC;
+#endif
+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ if ((__supported_pte_mask & _PAGE_NX))
-+ pax_flags &= ~MF_PAX_SEGMEXEC;
-+ else
-+ pax_flags &= ~MF_PAX_PAGEEXEC;
-+ }
-+#endif
-+
+#ifdef CONFIG_PAX_EMUTRAMP
+ if (!(pax_flags_hardmode & MF_PAX_EMUTRAMP))
+ pax_flags |= MF_PAX_EMUTRAMP;
@@ -41868,7 +42130,7 @@ index 16f7354..666524e 100644
+}
+#endif
+
-+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_XATTR_PAX_FLAGS)
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
+{
+ unsigned long pax_flags = 0UL;
@@ -41885,15 +42147,6 @@ index 16f7354..666524e 100644
+ pax_flags |= MF_PAX_SEGMEXEC;
+#endif
+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+ if ((__supported_pte_mask & _PAGE_NX))
-+ pax_flags &= ~MF_PAX_SEGMEXEC;
-+ else
-+ pax_flags &= ~MF_PAX_PAGEEXEC;
-+ }
-+#endif
-+
+#ifdef CONFIG_PAX_EMUTRAMP
+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
+ pax_flags |= MF_PAX_EMUTRAMP;
@@ -41915,19 +42168,17 @@ index 16f7354..666524e 100644
+ pax_flags |= MF_PAX_PAGEEXEC;
+#endif
+
++#ifdef CONFIG_PAX_SEGMEXEC
++ pax_flags |= MF_PAX_SEGMEXEC;
++#endif
++
+#ifdef CONFIG_PAX_MPROTECT
+ pax_flags |= MF_PAX_MPROTECT;
+#endif
+
+#ifdef CONFIG_PAX_RANDMMAP
-+ pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (!(pax_flags & MF_PAX_PAGEEXEC) || !(__supported_pte_mask & _PAGE_NX)) {
-+ pax_flags &= ~MF_PAX_PAGEEXEC;
-+ pax_flags |= MF_PAX_SEGMEXEC;
-+ }
++ if (randomize_va_space)
++ pax_flags |= MF_PAX_RANDMMAP;
+#endif
+
+#endif
@@ -42031,6 +42282,15 @@ index 16f7354..666524e 100644
+ if (pt_pax_flags != ~0UL)
+ pax_flags = pt_pax_flags;
+
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
++ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++ if ((__supported_pte_mask & _PAGE_NX))
++ pax_flags &= ~MF_PAX_SEGMEXEC;
++ else
++ pax_flags &= ~MF_PAX_PAGEEXEC;
++ }
++#endif
++
+ if (0 > pax_check_flags(&pax_flags))
+ return -EINVAL;
+
@@ -42042,7 +42302,7 @@ index 16f7354..666524e 100644
/*
* These are the functions used to load ELF style executables and shared
* libraries. There is no binary dependent code anywhere else.
-@@ -541,6 +908,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
+@@ -541,6 +870,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
{
unsigned int random_variable = 0;
@@ -42054,7 +42314,7 @@ index 16f7354..666524e 100644
if ((current->flags & PF_RANDOMIZE) &&
!(current->personality & ADDR_NO_RANDOMIZE)) {
random_variable = get_random_int() & STACK_RND_MASK;
-@@ -559,7 +931,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -559,7 +893,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
unsigned long load_addr = 0, load_bias = 0;
int load_addr_set = 0;
char * elf_interpreter = NULL;
@@ -42063,7 +42323,7 @@ index 16f7354..666524e 100644
struct elf_phdr *elf_ppnt, *elf_phdata;
unsigned long elf_bss, elf_brk;
int retval, i;
-@@ -569,11 +941,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -569,11 +903,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
unsigned long start_code, end_code, start_data, end_data;
unsigned long reloc_func_desc __maybe_unused = 0;
int executable_stack = EXSTACK_DEFAULT;
@@ -42076,7 +42336,7 @@ index 16f7354..666524e 100644
loc = kmalloc(sizeof(*loc), GFP_KERNEL);
if (!loc) {
-@@ -709,11 +1081,81 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -709,11 +1043,81 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
goto out_free_dentry;
/* OK, This is the point of no return */
@@ -42101,7 +42361,7 @@ index 16f7354..666524e 100644
+
+ current->mm->def_flags = 0;
+
-+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_XATTR_PAX_FLAGS)
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
+ if (0 > pax_parse_pax_flags(&loc->elf_ex, elf_phdata, bprm->file)) {
+ send_sig(SIGKILL, current, 0);
+ goto out_free_dentry;
@@ -42159,7 +42419,7 @@ index 16f7354..666524e 100644
if (elf_read_implies_exec(loc->elf_ex, executable_stack))
current->personality |= READ_IMPLIES_EXEC;
-@@ -804,6 +1246,20 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -804,6 +1208,20 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
#else
load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
#endif
@@ -42180,7 +42440,7 @@ index 16f7354..666524e 100644
}
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
-@@ -836,9 +1292,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -836,9 +1254,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
* allowed task size. Note that p_filesz must always be
* <= p_memsz so it is only necessary to check p_memsz.
*/
@@ -42193,7 +42453,7 @@ index 16f7354..666524e 100644
/* set_brk can never work. Avoid overflows. */
send_sig(SIGKILL, current, 0);
retval = -EINVAL;
-@@ -877,11 +1333,40 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -877,10 +1295,39 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
goto out_free_dentry;
}
if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
@@ -42205,8 +42465,8 @@ index 16f7354..666524e 100644
+ * file specifies odd protections. So
+ * we don't check the return value
+ */
- }
-
++ }
++
+#ifdef CONFIG_PAX_RANDMMAP
+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
+ unsigned long start, size;
@@ -42231,13 +42491,12 @@ index 16f7354..666524e 100644
+ send_sig(SIGKILL, current, 0);
+ goto out_free_dentry;
+ }
-+ }
+ }
+#endif
-+
+
if (elf_interpreter) {
unsigned long uninitialized_var(interp_map_addr);
-
-@@ -1109,7 +1594,7 @@ static bool always_dump_vma(struct vm_area_struct *vma)
+@@ -1109,7 +1556,7 @@ static bool always_dump_vma(struct vm_area_struct *vma)
* Decide what to dump of a segment, part, all or none.
*/
static unsigned long vma_dump_size(struct vm_area_struct *vma,
@@ -42246,7 +42505,7 @@ index 16f7354..666524e 100644
{
#define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
-@@ -1146,7 +1631,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+@@ -1146,7 +1593,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
if (vma->vm_file == NULL)
return 0;
@@ -42255,7 +42514,7 @@ index 16f7354..666524e 100644
goto whole;
/*
-@@ -1368,9 +1853,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
+@@ -1368,9 +1815,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
{
elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
int i = 0;
@@ -42267,7 +42526,7 @@ index 16f7354..666524e 100644
fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
}
-@@ -1892,14 +2377,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
+@@ -1892,14 +2339,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
}
static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
@@ -42284,7 +42543,7 @@ index 16f7354..666524e 100644
return size;
}
-@@ -1993,7 +2478,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1993,7 +2440,7 @@ static int elf_core_dump(struct coredump_params *cprm)
dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
@@ -42293,7 +42552,7 @@ index 16f7354..666524e 100644
offset += elf_core_extra_data_size();
e_shoff = offset;
-@@ -2007,10 +2492,12 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2007,10 +2454,12 @@ static int elf_core_dump(struct coredump_params *cprm)
offset = dataoff;
size += sizeof(*elf);
@@ -42306,7 +42565,7 @@ index 16f7354..666524e 100644
if (size > cprm->limit
|| !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
goto end_coredump;
-@@ -2024,7 +2511,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2024,7 +2473,7 @@ static int elf_core_dump(struct coredump_params *cprm)
phdr.p_offset = offset;
phdr.p_vaddr = vma->vm_start;
phdr.p_paddr = 0;
@@ -42315,7 +42574,7 @@ index 16f7354..666524e 100644
phdr.p_memsz = vma->vm_end - vma->vm_start;
offset += phdr.p_filesz;
phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -2035,6 +2522,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2035,6 +2484,7 @@ static int elf_core_dump(struct coredump_params *cprm)
phdr.p_align = ELF_EXEC_PAGESIZE;
size += sizeof(phdr);
@@ -42323,7 +42582,7 @@ index 16f7354..666524e 100644
if (size > cprm->limit
|| !dump_write(cprm->file, &phdr, sizeof(phdr)))
goto end_coredump;
-@@ -2059,7 +2547,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2059,7 +2509,7 @@ static int elf_core_dump(struct coredump_params *cprm)
unsigned long addr;
unsigned long end;
@@ -42332,7 +42591,7 @@ index 16f7354..666524e 100644
for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
struct page *page;
-@@ -2068,6 +2556,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2068,6 +2518,7 @@ static int elf_core_dump(struct coredump_params *cprm)
page = get_dump_page(addr);
if (page) {
void *kaddr = kmap(page);
@@ -42340,7 +42599,7 @@ index 16f7354..666524e 100644
stop = ((size += PAGE_SIZE) > cprm->limit) ||
!dump_write(cprm->file, kaddr,
PAGE_SIZE);
-@@ -2085,6 +2574,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2085,6 +2536,7 @@ static int elf_core_dump(struct coredump_params *cprm)
if (e_phnum == PN_XNUM) {
size += sizeof(*shdr4extnum);
@@ -42348,7 +42607,7 @@ index 16f7354..666524e 100644
if (size > cprm->limit
|| !dump_write(cprm->file, shdr4extnum,
sizeof(*shdr4extnum)))
-@@ -2105,6 +2595,97 @@ out:
+@@ -2105,6 +2557,97 @@ out:
#endif /* CONFIG_ELF_CORE */
@@ -42483,7 +42742,7 @@ index 6b2daf9..a70dccb 100644
goto err;
}
diff --git a/fs/bio.c b/fs/bio.c
-index 84da885..2149cd9 100644
+index 84da885..bac1d48 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -838,7 +838,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
@@ -42495,6 +42754,15 @@ index 84da885..2149cd9 100644
return ERR_PTR(-EINVAL);
nr_pages += end - start;
+@@ -972,7 +972,7 @@ static struct bio *__bio_map_user_iov(struct request_queue *q,
+ /*
+ * Overflow, abort
+ */
+- if (end < start)
++ if (end < start || end - start > INT_MAX - nr_pages)
+ return ERR_PTR(-EINVAL);
+
+ nr_pages += end - start;
@@ -1234,7 +1234,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
const int read = bio_data_dir(bio) == READ;
struct bio_map_data *bmd = bio->bi_private;
@@ -42625,51 +42893,6 @@ index 646ee21..f020f87 100644
if (!del) {
spin_lock(&rc->reloc_root_tree.lock);
-diff --git a/fs/buffer.c b/fs/buffer.c
-index ad5938c..0bc1bed 100644
---- a/fs/buffer.c
-+++ b/fs/buffer.c
-@@ -1036,6 +1036,9 @@ grow_buffers(struct block_device *bdev, sector_t block, int size)
- static struct buffer_head *
- __getblk_slow(struct block_device *bdev, sector_t block, int size)
- {
-+ int ret;
-+ struct buffer_head *bh;
-+
- /* Size must be multiple of hard sectorsize */
- if (unlikely(size & (bdev_logical_block_size(bdev)-1) ||
- (size < 512 || size > PAGE_SIZE))) {
-@@ -1048,20 +1051,21 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size)
- return NULL;
- }
-
-- for (;;) {
-- struct buffer_head * bh;
-- int ret;
-+retry:
-+ bh = __find_get_block(bdev, block, size);
-+ if (bh)
-+ return bh;
-
-+ ret = grow_buffers(bdev, block, size);
-+ if (ret == 0) {
-+ free_more_memory();
-+ goto retry;
-+ } else if (ret > 0) {
- bh = __find_get_block(bdev, block, size);
- if (bh)
- return bh;
--
-- ret = grow_buffers(bdev, block, size);
-- if (ret < 0)
-- return NULL;
-- if (ret == 0)
-- free_more_memory();
- }
-+ return NULL;
- }
-
- /*
diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
index 622f469..e8d2d55 100644
--- a/fs/cachefiles/bind.c
@@ -43171,7 +43394,7 @@ index 6901578..d402eb5 100644
return hit;
diff --git a/fs/compat.c b/fs/compat.c
-index f2944ac..62845d2 100644
+index 2b371b3..7e947e3 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -490,7 +490,7 @@ compat_sys_io_setup(unsigned nr_reqs, u32 __user *ctx32p)
@@ -43465,7 +43688,7 @@ index b2a34a1..162fa69 100644
return rc;
}
diff --git a/fs/exec.c b/fs/exec.c
-index 29e5f84..ec81452 100644
+index 126e01c..be60c6e 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -55,6 +55,15 @@
@@ -43925,7 +44148,7 @@ index 29e5f84..ec81452 100644
cn->corename = kmalloc(cn->size, GFP_KERNEL);
cn->used = 0;
-@@ -1821,6 +1953,228 @@ out:
+@@ -1821,6 +1953,250 @@ out:
return ispipe;
}
@@ -44070,7 +44293,7 @@ index 29e5f84..ec81452 100644
+
+#ifdef CONFIG_PAX_USERCOPY
+/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
-+int object_is_on_stack(const void *obj, unsigned long len)
++static noinline int check_stack_object(const void *obj, unsigned long len)
+{
+ const void * const stack = task_stack_page(current);
+ const void * const stackend = stack + THREAD_SIZE;
@@ -44116,7 +44339,7 @@ index 29e5f84..ec81452 100644
+#endif
+}
+
-+__noreturn void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
++static __noreturn void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
+{
+ if (current->signal->curr_ip)
+ printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
@@ -44130,6 +44353,28 @@ index 29e5f84..ec81452 100644
+}
+#endif
+
++void check_object_size(const void *ptr, unsigned long n, bool to)
++{
++
++#ifdef CONFIG_PAX_USERCOPY
++ const char *type;
++
++ if (!n)
++ return;
++
++ type = check_heap_object(ptr, n, to);
++ if (!type) {
++ if (check_stack_object(ptr, n) != -1)
++ return;
++ type = "<process stack>";
++ }
++
++ pax_report_usercopy(ptr, n, to, type);
++#endif
++
++}
++EXPORT_SYMBOL(check_object_size);
++
+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
+void pax_track_stack(void)
+{
@@ -44154,7 +44399,37 @@ index 29e5f84..ec81452 100644
static int zap_process(struct task_struct *start, int exit_code)
{
struct task_struct *t;
-@@ -2018,17 +2372,17 @@ static void wait_for_dump_helpers(struct file *file)
+@@ -1980,17 +2356,17 @@ static void coredump_finish(struct mm_struct *mm)
+ void set_dumpable(struct mm_struct *mm, int value)
+ {
+ switch (value) {
+- case 0:
++ case SUID_DUMPABLE_DISABLED:
+ clear_bit(MMF_DUMPABLE, &mm->flags);
+ smp_wmb();
+ clear_bit(MMF_DUMP_SECURELY, &mm->flags);
+ break;
+- case 1:
++ case SUID_DUMPABLE_ENABLED:
+ set_bit(MMF_DUMPABLE, &mm->flags);
+ smp_wmb();
+ clear_bit(MMF_DUMP_SECURELY, &mm->flags);
+ break;
+- case 2:
++ case SUID_DUMPABLE_SAFE:
+ set_bit(MMF_DUMP_SECURELY, &mm->flags);
+ smp_wmb();
+ set_bit(MMF_DUMPABLE, &mm->flags);
+@@ -2003,7 +2379,7 @@ static int __get_dumpable(unsigned long mm_flags)
+ int ret;
+
+ ret = mm_flags & MMF_DUMPABLE_MASK;
+- return (ret >= 2) ? 2 : ret;
++ return (ret > SUID_DUMPABLE_ENABLED) ? SUID_DUMPABLE_SAFE : ret;
+ }
+
+ int get_dumpable(struct mm_struct *mm)
+@@ -2018,17 +2394,17 @@ static void wait_for_dump_helpers(struct file *file)
pipe = file->f_path.dentry->d_inode->i_pipe;
pipe_lock(pipe);
@@ -44177,16 +44452,17 @@ index 29e5f84..ec81452 100644
pipe_unlock(pipe);
}
-@@ -2089,7 +2443,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2089,7 +2465,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
int retval = 0;
int flag = 0;
int ispipe;
- static atomic_t core_dump_count = ATOMIC_INIT(0);
++ bool need_nonrelative = false;
+ static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
struct coredump_params cprm = {
.signr = signr,
.regs = regs,
-@@ -2104,6 +2458,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2104,6 +2481,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
audit_core_dumps(signr);
@@ -44196,7 +44472,28 @@ index 29e5f84..ec81452 100644
binfmt = mm->binfmt;
if (!binfmt || !binfmt->core_dump)
goto fail;
-@@ -2171,7 +2528,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2114,14 +2494,16 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+ if (!cred)
+ goto fail;
+ /*
+- * We cannot trust fsuid as being the "true" uid of the
+- * process nor do we know its entire history. We only know it
+- * was tainted so we dump it as root in mode 2.
++ * We cannot trust fsuid as being the "true" uid of the process
++ * nor do we know its entire history. We only know it was tainted
++ * so we dump it as root in mode 2, and only into a controlled
++ * environment (pipe handler or fully qualified path).
+ */
+- if (__get_dumpable(cprm.mm_flags) == 2) {
++ if (__get_dumpable(cprm.mm_flags) == SUID_DUMPABLE_SAFE) {
+ /* Setuid core dump mode */
+ flag = O_EXCL; /* Stop rewrite attacks */
+ cred->fsuid = 0; /* Dump root private */
++ need_nonrelative = true;
+ }
+
+ retval = coredump_wait(exit_code, &core_state);
+@@ -2171,7 +2553,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
}
cprm.limit = RLIM_INFINITY;
@@ -44205,7 +44502,7 @@ index 29e5f84..ec81452 100644
if (core_pipe_limit && (core_pipe_limit < dump_count)) {
printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
task_tgid_vnr(current), current->comm);
-@@ -2198,6 +2555,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2198,9 +2580,19 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
} else {
struct inode *inode;
@@ -44214,7 +44511,18 @@ index 29e5f84..ec81452 100644
if (cprm.limit < binfmt->min_coredump)
goto fail_unlock;
-@@ -2241,7 +2600,7 @@ close_fail:
++ if (need_nonrelative && cn.corename[0] != '/') {
++ printk(KERN_WARNING "Pid %d(%s) can only dump core "\
++ "to fully qualified path!\n",
++ task_tgid_vnr(current), current->comm);
++ printk(KERN_WARNING "Skipping core dump\n");
++ goto fail_unlock;
++ }
++
+ cprm.file = filp_open(cn.corename,
+ O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
+ 0600);
+@@ -2241,7 +2633,7 @@ close_fail:
filp_close(cprm.file, NULL);
fail_dropcount:
if (ispipe)
@@ -44223,7 +44531,7 @@ index 29e5f84..ec81452 100644
fail_unlock:
kfree(cn.corename);
fail_corename:
-@@ -2260,7 +2619,7 @@ fail:
+@@ -2260,7 +2652,7 @@ fail:
*/
int dump_write(struct file *file, const void *addr, int nr)
{
@@ -44263,7 +44571,7 @@ index baac1b1..1499b62 100644
}
return 1;
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
-index 8da837b..ed3835b 100644
+index df76291..60a4ad3 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -463,8 +463,8 @@ static int ext4_has_free_clusters(struct ext4_sb_info *sbi,
@@ -44278,10 +44586,10 @@ index 8da837b..ed3835b 100644
if (free_clusters >= (nclusters + dirty_clusters))
return 1;
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
-index 0e01e90..ae2bd5e 100644
+index 47d1c8c..a8e1cc7 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
-@@ -1225,19 +1225,19 @@ struct ext4_sb_info {
+@@ -1224,19 +1224,19 @@ struct ext4_sb_info {
unsigned long s_mb_last_start;
/* stats for buddy allocator */
@@ -44471,10 +44779,10 @@ index 75e7c1f..1eb3e4d 100644
break;
err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
diff --git a/fs/fifo.c b/fs/fifo.c
-index b1a524d..4ee270e 100644
+index cf6f434..3d7942c 100644
--- a/fs/fifo.c
+++ b/fs/fifo.c
-@@ -58,10 +58,10 @@ static int fifo_open(struct inode *inode, struct file *filp)
+@@ -59,10 +59,10 @@ static int fifo_open(struct inode *inode, struct file *filp)
*/
filp->f_op = &read_pipefifo_fops;
pipe->r_counter++;
@@ -44503,10 +44811,10 @@ index b1a524d..4ee270e 100644
- if (!pipe->readers) {
+ if (!atomic_read(&pipe->readers)) {
- wait_for_partner(inode, &pipe->r_counter);
- if (signal_pending(current))
+ if (wait_for_partner(inode, &pipe->r_counter))
goto err_wr;
-@@ -105,11 +105,11 @@ static int fifo_open(struct inode *inode, struct file *filp)
+ }
+@@ -104,11 +104,11 @@ static int fifo_open(struct inode *inode, struct file *filp)
*/
filp->f_op = &rdwr_pipefifo_fops;
@@ -44521,7 +44829,7 @@ index b1a524d..4ee270e 100644
wake_up_partner(inode);
break;
-@@ -123,19 +123,19 @@ static int fifo_open(struct inode *inode, struct file *filp)
+@@ -122,19 +122,19 @@ static int fifo_open(struct inode *inode, struct file *filp)
return 0;
err_rd:
@@ -44838,26 +45146,13 @@ index f6aad48..88dcf26 100644
-extern atomic_t fscache_n_op_gc;
-extern atomic_t fscache_n_op_cancelled;
-extern atomic_t fscache_n_op_rejected;
-+extern atomic_unchecked_t fscache_n_op_pend;
-+extern atomic_unchecked_t fscache_n_op_run;
-+extern atomic_unchecked_t fscache_n_op_enqueue;
-+extern atomic_unchecked_t fscache_n_op_deferred_release;
-+extern atomic_unchecked_t fscache_n_op_release;
-+extern atomic_unchecked_t fscache_n_op_gc;
-+extern atomic_unchecked_t fscache_n_op_cancelled;
-+extern atomic_unchecked_t fscache_n_op_rejected;
-
+-
-extern atomic_t fscache_n_attr_changed;
-extern atomic_t fscache_n_attr_changed_ok;
-extern atomic_t fscache_n_attr_changed_nobufs;
-extern atomic_t fscache_n_attr_changed_nomem;
-extern atomic_t fscache_n_attr_changed_calls;
-+extern atomic_unchecked_t fscache_n_attr_changed;
-+extern atomic_unchecked_t fscache_n_attr_changed_ok;
-+extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
-+extern atomic_unchecked_t fscache_n_attr_changed_nomem;
-+extern atomic_unchecked_t fscache_n_attr_changed_calls;
-
+-
-extern atomic_t fscache_n_allocs;
-extern atomic_t fscache_n_allocs_ok;
-extern atomic_t fscache_n_allocs_wait;
@@ -44866,15 +45161,7 @@ index f6aad48..88dcf26 100644
-extern atomic_t fscache_n_allocs_object_dead;
-extern atomic_t fscache_n_alloc_ops;
-extern atomic_t fscache_n_alloc_op_waits;
-+extern atomic_unchecked_t fscache_n_allocs;
-+extern atomic_unchecked_t fscache_n_allocs_ok;
-+extern atomic_unchecked_t fscache_n_allocs_wait;
-+extern atomic_unchecked_t fscache_n_allocs_nobufs;
-+extern atomic_unchecked_t fscache_n_allocs_intr;
-+extern atomic_unchecked_t fscache_n_allocs_object_dead;
-+extern atomic_unchecked_t fscache_n_alloc_ops;
-+extern atomic_unchecked_t fscache_n_alloc_op_waits;
-
+-
-extern atomic_t fscache_n_retrievals;
-extern atomic_t fscache_n_retrievals_ok;
-extern atomic_t fscache_n_retrievals_wait;
@@ -44885,17 +45172,7 @@ index f6aad48..88dcf26 100644
-extern atomic_t fscache_n_retrievals_object_dead;
-extern atomic_t fscache_n_retrieval_ops;
-extern atomic_t fscache_n_retrieval_op_waits;
-+extern atomic_unchecked_t fscache_n_retrievals;
-+extern atomic_unchecked_t fscache_n_retrievals_ok;
-+extern atomic_unchecked_t fscache_n_retrievals_wait;
-+extern atomic_unchecked_t fscache_n_retrievals_nodata;
-+extern atomic_unchecked_t fscache_n_retrievals_nobufs;
-+extern atomic_unchecked_t fscache_n_retrievals_intr;
-+extern atomic_unchecked_t fscache_n_retrievals_nomem;
-+extern atomic_unchecked_t fscache_n_retrievals_object_dead;
-+extern atomic_unchecked_t fscache_n_retrieval_ops;
-+extern atomic_unchecked_t fscache_n_retrieval_op_waits;
-
+-
-extern atomic_t fscache_n_stores;
-extern atomic_t fscache_n_stores_ok;
-extern atomic_t fscache_n_stores_again;
@@ -44906,6 +45183,84 @@ index f6aad48..88dcf26 100644
-extern atomic_t fscache_n_store_pages;
-extern atomic_t fscache_n_store_radix_deletes;
-extern atomic_t fscache_n_store_pages_over_limit;
+-
+-extern atomic_t fscache_n_store_vmscan_not_storing;
+-extern atomic_t fscache_n_store_vmscan_gone;
+-extern atomic_t fscache_n_store_vmscan_busy;
+-extern atomic_t fscache_n_store_vmscan_cancelled;
+-
+-extern atomic_t fscache_n_marks;
+-extern atomic_t fscache_n_uncaches;
+-
+-extern atomic_t fscache_n_acquires;
+-extern atomic_t fscache_n_acquires_null;
+-extern atomic_t fscache_n_acquires_no_cache;
+-extern atomic_t fscache_n_acquires_ok;
+-extern atomic_t fscache_n_acquires_nobufs;
+-extern atomic_t fscache_n_acquires_oom;
+-
+-extern atomic_t fscache_n_updates;
+-extern atomic_t fscache_n_updates_null;
+-extern atomic_t fscache_n_updates_run;
+-
+-extern atomic_t fscache_n_relinquishes;
+-extern atomic_t fscache_n_relinquishes_null;
+-extern atomic_t fscache_n_relinquishes_waitcrt;
+-extern atomic_t fscache_n_relinquishes_retire;
+-
+-extern atomic_t fscache_n_cookie_index;
+-extern atomic_t fscache_n_cookie_data;
+-extern atomic_t fscache_n_cookie_special;
+-
+-extern atomic_t fscache_n_object_alloc;
+-extern atomic_t fscache_n_object_no_alloc;
+-extern atomic_t fscache_n_object_lookups;
+-extern atomic_t fscache_n_object_lookups_negative;
+-extern atomic_t fscache_n_object_lookups_positive;
+-extern atomic_t fscache_n_object_lookups_timed_out;
+-extern atomic_t fscache_n_object_created;
+-extern atomic_t fscache_n_object_avail;
+-extern atomic_t fscache_n_object_dead;
+-
+-extern atomic_t fscache_n_checkaux_none;
+-extern atomic_t fscache_n_checkaux_okay;
+-extern atomic_t fscache_n_checkaux_update;
+-extern atomic_t fscache_n_checkaux_obsolete;
++extern atomic_unchecked_t fscache_n_op_pend;
++extern atomic_unchecked_t fscache_n_op_run;
++extern atomic_unchecked_t fscache_n_op_enqueue;
++extern atomic_unchecked_t fscache_n_op_deferred_release;
++extern atomic_unchecked_t fscache_n_op_release;
++extern atomic_unchecked_t fscache_n_op_gc;
++extern atomic_unchecked_t fscache_n_op_cancelled;
++extern atomic_unchecked_t fscache_n_op_rejected;
++
++extern atomic_unchecked_t fscache_n_attr_changed;
++extern atomic_unchecked_t fscache_n_attr_changed_ok;
++extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
++extern atomic_unchecked_t fscache_n_attr_changed_nomem;
++extern atomic_unchecked_t fscache_n_attr_changed_calls;
++
++extern atomic_unchecked_t fscache_n_allocs;
++extern atomic_unchecked_t fscache_n_allocs_ok;
++extern atomic_unchecked_t fscache_n_allocs_wait;
++extern atomic_unchecked_t fscache_n_allocs_nobufs;
++extern atomic_unchecked_t fscache_n_allocs_intr;
++extern atomic_unchecked_t fscache_n_allocs_object_dead;
++extern atomic_unchecked_t fscache_n_alloc_ops;
++extern atomic_unchecked_t fscache_n_alloc_op_waits;
++
++extern atomic_unchecked_t fscache_n_retrievals;
++extern atomic_unchecked_t fscache_n_retrievals_ok;
++extern atomic_unchecked_t fscache_n_retrievals_wait;
++extern atomic_unchecked_t fscache_n_retrievals_nodata;
++extern atomic_unchecked_t fscache_n_retrievals_nobufs;
++extern atomic_unchecked_t fscache_n_retrievals_intr;
++extern atomic_unchecked_t fscache_n_retrievals_nomem;
++extern atomic_unchecked_t fscache_n_retrievals_object_dead;
++extern atomic_unchecked_t fscache_n_retrieval_ops;
++extern atomic_unchecked_t fscache_n_retrieval_op_waits;
++
+extern atomic_unchecked_t fscache_n_stores;
+extern atomic_unchecked_t fscache_n_stores_ok;
+extern atomic_unchecked_t fscache_n_stores_again;
@@ -44916,66 +45271,35 @@ index f6aad48..88dcf26 100644
+extern atomic_unchecked_t fscache_n_store_pages;
+extern atomic_unchecked_t fscache_n_store_radix_deletes;
+extern atomic_unchecked_t fscache_n_store_pages_over_limit;
-
--extern atomic_t fscache_n_store_vmscan_not_storing;
--extern atomic_t fscache_n_store_vmscan_gone;
--extern atomic_t fscache_n_store_vmscan_busy;
--extern atomic_t fscache_n_store_vmscan_cancelled;
++
+extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
+extern atomic_unchecked_t fscache_n_store_vmscan_gone;
+extern atomic_unchecked_t fscache_n_store_vmscan_busy;
+extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
-
--extern atomic_t fscache_n_marks;
--extern atomic_t fscache_n_uncaches;
++
+extern atomic_unchecked_t fscache_n_marks;
+extern atomic_unchecked_t fscache_n_uncaches;
-
--extern atomic_t fscache_n_acquires;
--extern atomic_t fscache_n_acquires_null;
--extern atomic_t fscache_n_acquires_no_cache;
--extern atomic_t fscache_n_acquires_ok;
--extern atomic_t fscache_n_acquires_nobufs;
--extern atomic_t fscache_n_acquires_oom;
++
+extern atomic_unchecked_t fscache_n_acquires;
+extern atomic_unchecked_t fscache_n_acquires_null;
+extern atomic_unchecked_t fscache_n_acquires_no_cache;
+extern atomic_unchecked_t fscache_n_acquires_ok;
+extern atomic_unchecked_t fscache_n_acquires_nobufs;
+extern atomic_unchecked_t fscache_n_acquires_oom;
-
--extern atomic_t fscache_n_updates;
--extern atomic_t fscache_n_updates_null;
--extern atomic_t fscache_n_updates_run;
++
+extern atomic_unchecked_t fscache_n_updates;
+extern atomic_unchecked_t fscache_n_updates_null;
+extern atomic_unchecked_t fscache_n_updates_run;
-
--extern atomic_t fscache_n_relinquishes;
--extern atomic_t fscache_n_relinquishes_null;
--extern atomic_t fscache_n_relinquishes_waitcrt;
--extern atomic_t fscache_n_relinquishes_retire;
++
+extern atomic_unchecked_t fscache_n_relinquishes;
+extern atomic_unchecked_t fscache_n_relinquishes_null;
+extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
+extern atomic_unchecked_t fscache_n_relinquishes_retire;
-
--extern atomic_t fscache_n_cookie_index;
--extern atomic_t fscache_n_cookie_data;
--extern atomic_t fscache_n_cookie_special;
++
+extern atomic_unchecked_t fscache_n_cookie_index;
+extern atomic_unchecked_t fscache_n_cookie_data;
+extern atomic_unchecked_t fscache_n_cookie_special;
-
--extern atomic_t fscache_n_object_alloc;
--extern atomic_t fscache_n_object_no_alloc;
--extern atomic_t fscache_n_object_lookups;
--extern atomic_t fscache_n_object_lookups_negative;
--extern atomic_t fscache_n_object_lookups_positive;
--extern atomic_t fscache_n_object_lookups_timed_out;
--extern atomic_t fscache_n_object_created;
--extern atomic_t fscache_n_object_avail;
--extern atomic_t fscache_n_object_dead;
++
+extern atomic_unchecked_t fscache_n_object_alloc;
+extern atomic_unchecked_t fscache_n_object_no_alloc;
+extern atomic_unchecked_t fscache_n_object_lookups;
@@ -44985,11 +45309,7 @@ index f6aad48..88dcf26 100644
+extern atomic_unchecked_t fscache_n_object_created;
+extern atomic_unchecked_t fscache_n_object_avail;
+extern atomic_unchecked_t fscache_n_object_dead;
-
--extern atomic_t fscache_n_checkaux_none;
--extern atomic_t fscache_n_checkaux_okay;
--extern atomic_t fscache_n_checkaux_update;
--extern atomic_t fscache_n_checkaux_obsolete;
++
+extern atomic_unchecked_t fscache_n_checkaux_none;
+extern atomic_unchecked_t fscache_n_checkaux_okay;
+extern atomic_unchecked_t fscache_n_checkaux_update;
@@ -45655,27 +45975,13 @@ index 4765190..2a067f2 100644
-atomic_t fscache_n_op_gc;
-atomic_t fscache_n_op_cancelled;
-atomic_t fscache_n_op_rejected;
-+atomic_unchecked_t fscache_n_op_pend;
-+atomic_unchecked_t fscache_n_op_run;
-+atomic_unchecked_t fscache_n_op_enqueue;
-+atomic_unchecked_t fscache_n_op_requeue;
-+atomic_unchecked_t fscache_n_op_deferred_release;
-+atomic_unchecked_t fscache_n_op_release;
-+atomic_unchecked_t fscache_n_op_gc;
-+atomic_unchecked_t fscache_n_op_cancelled;
-+atomic_unchecked_t fscache_n_op_rejected;
-
+-
-atomic_t fscache_n_attr_changed;
-atomic_t fscache_n_attr_changed_ok;
-atomic_t fscache_n_attr_changed_nobufs;
-atomic_t fscache_n_attr_changed_nomem;
-atomic_t fscache_n_attr_changed_calls;
-+atomic_unchecked_t fscache_n_attr_changed;
-+atomic_unchecked_t fscache_n_attr_changed_ok;
-+atomic_unchecked_t fscache_n_attr_changed_nobufs;
-+atomic_unchecked_t fscache_n_attr_changed_nomem;
-+atomic_unchecked_t fscache_n_attr_changed_calls;
-
+-
-atomic_t fscache_n_allocs;
-atomic_t fscache_n_allocs_ok;
-atomic_t fscache_n_allocs_wait;
@@ -45684,15 +45990,7 @@ index 4765190..2a067f2 100644
-atomic_t fscache_n_allocs_object_dead;
-atomic_t fscache_n_alloc_ops;
-atomic_t fscache_n_alloc_op_waits;
-+atomic_unchecked_t fscache_n_allocs;
-+atomic_unchecked_t fscache_n_allocs_ok;
-+atomic_unchecked_t fscache_n_allocs_wait;
-+atomic_unchecked_t fscache_n_allocs_nobufs;
-+atomic_unchecked_t fscache_n_allocs_intr;
-+atomic_unchecked_t fscache_n_allocs_object_dead;
-+atomic_unchecked_t fscache_n_alloc_ops;
-+atomic_unchecked_t fscache_n_alloc_op_waits;
-
+-
-atomic_t fscache_n_retrievals;
-atomic_t fscache_n_retrievals_ok;
-atomic_t fscache_n_retrievals_wait;
@@ -45703,17 +46001,7 @@ index 4765190..2a067f2 100644
-atomic_t fscache_n_retrievals_object_dead;
-atomic_t fscache_n_retrieval_ops;
-atomic_t fscache_n_retrieval_op_waits;
-+atomic_unchecked_t fscache_n_retrievals;
-+atomic_unchecked_t fscache_n_retrievals_ok;
-+atomic_unchecked_t fscache_n_retrievals_wait;
-+atomic_unchecked_t fscache_n_retrievals_nodata;
-+atomic_unchecked_t fscache_n_retrievals_nobufs;
-+atomic_unchecked_t fscache_n_retrievals_intr;
-+atomic_unchecked_t fscache_n_retrievals_nomem;
-+atomic_unchecked_t fscache_n_retrievals_object_dead;
-+atomic_unchecked_t fscache_n_retrieval_ops;
-+atomic_unchecked_t fscache_n_retrieval_op_waits;
-
+-
-atomic_t fscache_n_stores;
-atomic_t fscache_n_stores_ok;
-atomic_t fscache_n_stores_again;
@@ -45724,6 +46012,85 @@ index 4765190..2a067f2 100644
-atomic_t fscache_n_store_pages;
-atomic_t fscache_n_store_radix_deletes;
-atomic_t fscache_n_store_pages_over_limit;
+-
+-atomic_t fscache_n_store_vmscan_not_storing;
+-atomic_t fscache_n_store_vmscan_gone;
+-atomic_t fscache_n_store_vmscan_busy;
+-atomic_t fscache_n_store_vmscan_cancelled;
+-
+-atomic_t fscache_n_marks;
+-atomic_t fscache_n_uncaches;
+-
+-atomic_t fscache_n_acquires;
+-atomic_t fscache_n_acquires_null;
+-atomic_t fscache_n_acquires_no_cache;
+-atomic_t fscache_n_acquires_ok;
+-atomic_t fscache_n_acquires_nobufs;
+-atomic_t fscache_n_acquires_oom;
+-
+-atomic_t fscache_n_updates;
+-atomic_t fscache_n_updates_null;
+-atomic_t fscache_n_updates_run;
+-
+-atomic_t fscache_n_relinquishes;
+-atomic_t fscache_n_relinquishes_null;
+-atomic_t fscache_n_relinquishes_waitcrt;
+-atomic_t fscache_n_relinquishes_retire;
+-
+-atomic_t fscache_n_cookie_index;
+-atomic_t fscache_n_cookie_data;
+-atomic_t fscache_n_cookie_special;
+-
+-atomic_t fscache_n_object_alloc;
+-atomic_t fscache_n_object_no_alloc;
+-atomic_t fscache_n_object_lookups;
+-atomic_t fscache_n_object_lookups_negative;
+-atomic_t fscache_n_object_lookups_positive;
+-atomic_t fscache_n_object_lookups_timed_out;
+-atomic_t fscache_n_object_created;
+-atomic_t fscache_n_object_avail;
+-atomic_t fscache_n_object_dead;
+-
+-atomic_t fscache_n_checkaux_none;
+-atomic_t fscache_n_checkaux_okay;
+-atomic_t fscache_n_checkaux_update;
+-atomic_t fscache_n_checkaux_obsolete;
++atomic_unchecked_t fscache_n_op_pend;
++atomic_unchecked_t fscache_n_op_run;
++atomic_unchecked_t fscache_n_op_enqueue;
++atomic_unchecked_t fscache_n_op_requeue;
++atomic_unchecked_t fscache_n_op_deferred_release;
++atomic_unchecked_t fscache_n_op_release;
++atomic_unchecked_t fscache_n_op_gc;
++atomic_unchecked_t fscache_n_op_cancelled;
++atomic_unchecked_t fscache_n_op_rejected;
++
++atomic_unchecked_t fscache_n_attr_changed;
++atomic_unchecked_t fscache_n_attr_changed_ok;
++atomic_unchecked_t fscache_n_attr_changed_nobufs;
++atomic_unchecked_t fscache_n_attr_changed_nomem;
++atomic_unchecked_t fscache_n_attr_changed_calls;
++
++atomic_unchecked_t fscache_n_allocs;
++atomic_unchecked_t fscache_n_allocs_ok;
++atomic_unchecked_t fscache_n_allocs_wait;
++atomic_unchecked_t fscache_n_allocs_nobufs;
++atomic_unchecked_t fscache_n_allocs_intr;
++atomic_unchecked_t fscache_n_allocs_object_dead;
++atomic_unchecked_t fscache_n_alloc_ops;
++atomic_unchecked_t fscache_n_alloc_op_waits;
++
++atomic_unchecked_t fscache_n_retrievals;
++atomic_unchecked_t fscache_n_retrievals_ok;
++atomic_unchecked_t fscache_n_retrievals_wait;
++atomic_unchecked_t fscache_n_retrievals_nodata;
++atomic_unchecked_t fscache_n_retrievals_nobufs;
++atomic_unchecked_t fscache_n_retrievals_intr;
++atomic_unchecked_t fscache_n_retrievals_nomem;
++atomic_unchecked_t fscache_n_retrievals_object_dead;
++atomic_unchecked_t fscache_n_retrieval_ops;
++atomic_unchecked_t fscache_n_retrieval_op_waits;
++
+atomic_unchecked_t fscache_n_stores;
+atomic_unchecked_t fscache_n_stores_ok;
+atomic_unchecked_t fscache_n_stores_again;
@@ -45734,66 +46101,35 @@ index 4765190..2a067f2 100644
+atomic_unchecked_t fscache_n_store_pages;
+atomic_unchecked_t fscache_n_store_radix_deletes;
+atomic_unchecked_t fscache_n_store_pages_over_limit;
-
--atomic_t fscache_n_store_vmscan_not_storing;
--atomic_t fscache_n_store_vmscan_gone;
--atomic_t fscache_n_store_vmscan_busy;
--atomic_t fscache_n_store_vmscan_cancelled;
++
+atomic_unchecked_t fscache_n_store_vmscan_not_storing;
+atomic_unchecked_t fscache_n_store_vmscan_gone;
+atomic_unchecked_t fscache_n_store_vmscan_busy;
+atomic_unchecked_t fscache_n_store_vmscan_cancelled;
-
--atomic_t fscache_n_marks;
--atomic_t fscache_n_uncaches;
++
+atomic_unchecked_t fscache_n_marks;
+atomic_unchecked_t fscache_n_uncaches;
-
--atomic_t fscache_n_acquires;
--atomic_t fscache_n_acquires_null;
--atomic_t fscache_n_acquires_no_cache;
--atomic_t fscache_n_acquires_ok;
--atomic_t fscache_n_acquires_nobufs;
--atomic_t fscache_n_acquires_oom;
++
+atomic_unchecked_t fscache_n_acquires;
+atomic_unchecked_t fscache_n_acquires_null;
+atomic_unchecked_t fscache_n_acquires_no_cache;
+atomic_unchecked_t fscache_n_acquires_ok;
+atomic_unchecked_t fscache_n_acquires_nobufs;
+atomic_unchecked_t fscache_n_acquires_oom;
-
--atomic_t fscache_n_updates;
--atomic_t fscache_n_updates_null;
--atomic_t fscache_n_updates_run;
++
+atomic_unchecked_t fscache_n_updates;
+atomic_unchecked_t fscache_n_updates_null;
+atomic_unchecked_t fscache_n_updates_run;
-
--atomic_t fscache_n_relinquishes;
--atomic_t fscache_n_relinquishes_null;
--atomic_t fscache_n_relinquishes_waitcrt;
--atomic_t fscache_n_relinquishes_retire;
++
+atomic_unchecked_t fscache_n_relinquishes;
+atomic_unchecked_t fscache_n_relinquishes_null;
+atomic_unchecked_t fscache_n_relinquishes_waitcrt;
+atomic_unchecked_t fscache_n_relinquishes_retire;
-
--atomic_t fscache_n_cookie_index;
--atomic_t fscache_n_cookie_data;
--atomic_t fscache_n_cookie_special;
++
+atomic_unchecked_t fscache_n_cookie_index;
+atomic_unchecked_t fscache_n_cookie_data;
+atomic_unchecked_t fscache_n_cookie_special;
-
--atomic_t fscache_n_object_alloc;
--atomic_t fscache_n_object_no_alloc;
--atomic_t fscache_n_object_lookups;
--atomic_t fscache_n_object_lookups_negative;
--atomic_t fscache_n_object_lookups_positive;
--atomic_t fscache_n_object_lookups_timed_out;
--atomic_t fscache_n_object_created;
--atomic_t fscache_n_object_avail;
--atomic_t fscache_n_object_dead;
++
+atomic_unchecked_t fscache_n_object_alloc;
+atomic_unchecked_t fscache_n_object_no_alloc;
+atomic_unchecked_t fscache_n_object_lookups;
@@ -45803,11 +46139,7 @@ index 4765190..2a067f2 100644
+atomic_unchecked_t fscache_n_object_created;
+atomic_unchecked_t fscache_n_object_avail;
+atomic_unchecked_t fscache_n_object_dead;
-
--atomic_t fscache_n_checkaux_none;
--atomic_t fscache_n_checkaux_okay;
--atomic_t fscache_n_checkaux_update;
--atomic_t fscache_n_checkaux_obsolete;
++
+atomic_unchecked_t fscache_n_checkaux_none;
+atomic_unchecked_t fscache_n_checkaux_okay;
+atomic_unchecked_t fscache_n_checkaux_update;
@@ -46027,7 +46359,7 @@ index 3426521..3b75162 100644
cuse_class = class_create(THIS_MODULE, "cuse");
if (IS_ERR(cuse_class))
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
-index 7df2b5e..5804aa7 100644
+index f4246cf..b4aed1d 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1242,7 +1242,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
@@ -46181,18 +46513,9 @@ index 8392cb8..80d6193 100644
memcpy(c->data, &cookie, 4);
c->len=4;
diff --git a/fs/locks.c b/fs/locks.c
-index 0d68f1f..3114738 100644
+index fcc50ab..c3dacf2 100644
--- a/fs/locks.c
+++ b/fs/locks.c
-@@ -1465,7 +1465,7 @@ int generic_setlease(struct file *filp, long arg, struct file_lock **flp)
- case F_WRLCK:
- return generic_add_lease(filp, arg, flp);
- default:
-- BUG();
-+ return -EINVAL;
- }
- }
- EXPORT_SYMBOL(generic_setlease);
@@ -2075,16 +2075,16 @@ void locks_remove_flock(struct file *filp)
return;
@@ -47071,7 +47394,7 @@ index 5d22872..523db20 100644
kfree(link);
}
diff --git a/fs/open.c b/fs/open.c
-index 3f1108b..822d7f7 100644
+index cf1d34f..e58a595 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -31,6 +31,8 @@
@@ -47168,7 +47491,7 @@ index 3f1108b..822d7f7 100644
newattrs.ia_valid = ATTR_CTIME;
if (user != (uid_t) -1) {
newattrs.ia_valid |= ATTR_UID;
-@@ -987,6 +1024,7 @@ long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
+@@ -988,6 +1025,7 @@ long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
} else {
fsnotify_open(f);
fd_install(fd, f);
@@ -47496,7 +47819,7 @@ index f9bd395..acb7847 100644
+}
+#endif
diff --git a/fs/proc/base.c b/fs/proc/base.c
-index 9fc77b4..04761b8 100644
+index 9fc77b4..4877d08 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -109,6 +109,14 @@ struct pid_entry {
@@ -47514,7 +47837,19 @@ index 9fc77b4..04761b8 100644
#define NOD(NAME, MODE, IOP, FOP, OP) { \
.name = (NAME), \
.len = sizeof(NAME) - 1, \
-@@ -213,6 +221,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
+@@ -198,11 +206,6 @@ static int proc_root_link(struct dentry *dentry, struct path *path)
+ return result;
+ }
+
+-struct mm_struct *mm_for_maps(struct task_struct *task)
+-{
+- return mm_access(task, PTRACE_MODE_READ);
+-}
+-
+ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
+ {
+ int res = 0;
+@@ -213,6 +216,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
if (!mm->arg_end)
goto out_mm; /* Shh! No looking before we're done */
@@ -47524,7 +47859,7 @@ index 9fc77b4..04761b8 100644
len = mm->arg_end - mm->arg_start;
if (len > PAGE_SIZE)
-@@ -240,12 +251,28 @@ out:
+@@ -240,12 +246,28 @@ out:
return res;
}
@@ -47536,7 +47871,8 @@ index 9fc77b4..04761b8 100644
+
static int proc_pid_auxv(struct task_struct *task, char *buffer)
{
- struct mm_struct *mm = mm_for_maps(task);
+- struct mm_struct *mm = mm_for_maps(task);
++ struct mm_struct *mm = mm_access(task, PTRACE_MODE_READ);
int res = PTR_ERR(mm);
if (mm && !IS_ERR(mm)) {
unsigned int nwords = 0;
@@ -47553,7 +47889,7 @@ index 9fc77b4..04761b8 100644
do {
nwords += 2;
} while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
-@@ -259,7 +286,7 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer)
+@@ -259,7 +281,7 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer)
}
@@ -47562,7 +47898,7 @@ index 9fc77b4..04761b8 100644
/*
* Provides a wchan file via kallsyms in a proper one-value-per-file format.
* Returns the resolved symbol. If that fails, simply return the address.
-@@ -298,7 +325,7 @@ static void unlock_trace(struct task_struct *task)
+@@ -298,7 +320,7 @@ static void unlock_trace(struct task_struct *task)
mutex_unlock(&task->signal->cred_guard_mutex);
}
@@ -47571,7 +47907,7 @@ index 9fc77b4..04761b8 100644
#define MAX_STACK_TRACE_DEPTH 64
-@@ -489,7 +516,7 @@ static int proc_pid_limits(struct task_struct *task, char *buffer)
+@@ -489,7 +511,7 @@ static int proc_pid_limits(struct task_struct *task, char *buffer)
return count;
}
@@ -47580,7 +47916,7 @@ index 9fc77b4..04761b8 100644
static int proc_pid_syscall(struct task_struct *task, char *buffer)
{
long nr;
-@@ -518,7 +545,7 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
+@@ -518,7 +540,7 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
/************************************************************************/
/* permission checks */
@@ -47589,7 +47925,7 @@ index 9fc77b4..04761b8 100644
{
struct task_struct *task;
int allowed = 0;
-@@ -528,7 +555,10 @@ static int proc_fd_access_allowed(struct inode *inode)
+@@ -528,7 +550,10 @@ static int proc_fd_access_allowed(struct inode *inode)
*/
task = get_proc_task(inode);
if (task) {
@@ -47601,7 +47937,7 @@ index 9fc77b4..04761b8 100644
put_task_struct(task);
}
return allowed;
-@@ -566,10 +596,35 @@ static bool has_pid_permissions(struct pid_namespace *pid,
+@@ -566,10 +591,35 @@ static bool has_pid_permissions(struct pid_namespace *pid,
struct task_struct *task,
int hide_pid_min)
{
@@ -47637,7 +47973,7 @@ index 9fc77b4..04761b8 100644
return ptrace_may_access(task, PTRACE_MODE_READ);
}
-@@ -587,7 +642,11 @@ static int proc_pid_permission(struct inode *inode, int mask)
+@@ -587,7 +637,11 @@ static int proc_pid_permission(struct inode *inode, int mask)
put_task_struct(task);
if (!has_perms) {
@@ -47649,8 +47985,35 @@ index 9fc77b4..04761b8 100644
/*
* Let's make getdents(), stat(), and open()
* consistent with each other. If a process
-@@ -702,6 +761,10 @@ static int mem_open(struct inode* inode, struct file* file)
- file->f_mode |= FMODE_UNSIGNED_OFFSET;
+@@ -677,7 +731,7 @@ static const struct file_operations proc_single_file_operations = {
+ .release = single_release,
+ };
+
+-static int mem_open(struct inode* inode, struct file* file)
++static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
+ {
+ struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
+ struct mm_struct *mm;
+@@ -685,7 +739,12 @@ static int mem_open(struct inode* inode, struct file* file)
+ if (!task)
+ return -ESRCH;
+
+- mm = mm_access(task, PTRACE_MODE_ATTACH);
++ if (gr_acl_handle_procpidmem(task)) {
++ put_task_struct(task);
++ return -EPERM;
++ }
++
++ mm = mm_access(task, mode);
+ put_task_struct(task);
+
+ if (IS_ERR(mm))
+@@ -698,13 +757,26 @@ static int mem_open(struct inode* inode, struct file* file)
+ mmput(mm);
+ }
+
+- /* OK to pass negative loff_t, we can catch out-of-range */
+- file->f_mode |= FMODE_UNSIGNED_OFFSET;
file->private_data = mm;
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
@@ -47660,7 +48023,21 @@ index 9fc77b4..04761b8 100644
return 0;
}
-@@ -713,6 +776,17 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
++static int mem_open(struct inode *inode, struct file *file)
++{
++ int ret;
++ ret = __mem_open(inode, file, PTRACE_MODE_ATTACH);
++
++ /* OK to pass negative loff_t, we can catch out-of-range */
++ file->f_mode |= FMODE_UNSIGNED_OFFSET;
++
++ return ret;
++}
++
+ static ssize_t mem_rw(struct file *file, char __user *buf,
+ size_t count, loff_t *ppos, int write)
+ {
+@@ -713,6 +785,17 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
ssize_t copied;
char *page;
@@ -47678,17 +48055,101 @@ index 9fc77b4..04761b8 100644
if (!mm)
return 0;
-@@ -813,6 +887,9 @@ static ssize_t environ_read(struct file *file, char __user *buf,
- if (!task)
- goto out_no_task;
+@@ -801,42 +884,49 @@ static const struct file_operations proc_mem_operations = {
+ .release = mem_release,
+ };
-+ if (gr_acl_handle_procpidmem(task))
-+ goto out;
++static int environ_open(struct inode *inode, struct file *file)
++{
++ return __mem_open(inode, file, PTRACE_MODE_READ);
++}
+
- ret = -ENOMEM;
+ static ssize_t environ_read(struct file *file, char __user *buf,
+ size_t count, loff_t *ppos)
+ {
+- struct task_struct *task = get_proc_task(file->f_dentry->d_inode);
+ char *page;
+ unsigned long src = *ppos;
+- int ret = -ESRCH;
+- struct mm_struct *mm;
++ int ret = 0;
++ struct mm_struct *mm = file->private_data;
+
+- if (!task)
+- goto out_no_task;
++ if (!mm)
++ return 0;
++
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ if (file->f_version != current->exec_id) {
++ gr_log_badprocpid("environ");
++ return 0;
++ }
++#endif
+
+- ret = -ENOMEM;
page = (char *)__get_free_page(GFP_TEMPORARY);
if (!page)
-@@ -1433,7 +1510,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
+- goto out;
+-
+-
+- mm = mm_for_maps(task);
+- ret = PTR_ERR(mm);
+- if (!mm || IS_ERR(mm))
+- goto out_free;
++ return -ENOMEM;
+
+ ret = 0;
++ if (!atomic_inc_not_zero(&mm->mm_users))
++ goto free;
+ while (count > 0) {
+- int this_len, retval, max_len;
+-
+- this_len = mm->env_end - (mm->env_start + src);
++ size_t this_len, max_len;
++ int retval;
+
+- if (this_len <= 0)
++ if (src >= (mm->env_end - mm->env_start))
+ break;
+
+- max_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
+- this_len = (this_len > max_len) ? max_len : this_len;
++ this_len = mm->env_end - (mm->env_start + src);
++
++ max_len = min_t(size_t, PAGE_SIZE, count);
++ this_len = min(max_len, this_len);
+
+- retval = access_process_vm(task, (mm->env_start + src),
++ retval = access_remote_vm(mm, (mm->env_start + src),
+ page, this_len, 0);
+
+ if (retval <= 0) {
+@@ -855,19 +945,18 @@ static ssize_t environ_read(struct file *file, char __user *buf,
+ count -= retval;
+ }
+ *ppos = src;
+-
+ mmput(mm);
+-out_free:
++
++free:
+ free_page((unsigned long) page);
+-out:
+- put_task_struct(task);
+-out_no_task:
+ return ret;
+ }
+
+ static const struct file_operations proc_environ_operations = {
++ .open = environ_open,
+ .read = environ_read,
+ .llseek = generic_file_llseek,
++ .release = mem_release,
+ };
+
+ static ssize_t oom_adjust_read(struct file *file, char __user *buf,
+@@ -1433,7 +1522,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
path_put(&nd->path);
/* Are we allowed to snoop on the tasks file descriptors? */
@@ -47697,7 +48158,7 @@ index 9fc77b4..04761b8 100644
goto out;
error = PROC_I(inode)->op.proc_get_link(dentry, &nd->path);
-@@ -1472,8 +1549,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
+@@ -1472,8 +1561,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
struct path path;
/* Are we allowed to snoop on the tasks file descriptors? */
@@ -47718,7 +48179,7 @@ index 9fc77b4..04761b8 100644
error = PROC_I(inode)->op.proc_get_link(dentry, &path);
if (error)
-@@ -1538,7 +1625,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
+@@ -1538,7 +1637,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
rcu_read_lock();
cred = __task_cred(task);
inode->i_uid = cred->euid;
@@ -47730,7 +48191,7 @@ index 9fc77b4..04761b8 100644
rcu_read_unlock();
}
security_task_to_inode(task, inode);
-@@ -1574,10 +1665,19 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
+@@ -1574,10 +1677,19 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
return -ENOENT;
}
if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
@@ -47750,7 +48211,7 @@ index 9fc77b4..04761b8 100644
}
}
rcu_read_unlock();
-@@ -1615,11 +1715,20 @@ int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
+@@ -1615,11 +1727,20 @@ int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
if (task) {
if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
@@ -47771,7 +48232,7 @@ index 9fc77b4..04761b8 100644
rcu_read_unlock();
} else {
inode->i_uid = 0;
-@@ -1737,7 +1846,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
+@@ -1737,7 +1858,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
int fd = proc_fd(inode);
if (task) {
@@ -47781,7 +48242,21 @@ index 9fc77b4..04761b8 100644
put_task_struct(task);
}
if (files) {
-@@ -2338,11 +2448,21 @@ static const struct file_operations proc_map_files_operations = {
+@@ -2025,11 +2147,8 @@ static int map_files_d_revalidate(struct dentry *dentry, struct nameidata *nd)
+ if (!task)
+ goto out_notask;
+
+- if (!ptrace_may_access(task, PTRACE_MODE_READ))
+- goto out;
+-
+- mm = get_task_mm(task);
+- if (!mm)
++ mm = mm_access(task, PTRACE_MODE_READ);
++ if (IS_ERR_OR_NULL(mm))
+ goto out;
+
+ if (!dname_to_vma_addr(dentry, &vm_start, &vm_end)) {
+@@ -2338,11 +2457,21 @@ static const struct file_operations proc_map_files_operations = {
*/
static int proc_fd_permission(struct inode *inode, int mask)
{
@@ -47805,7 +48280,7 @@ index 9fc77b4..04761b8 100644
return rv;
}
-@@ -2452,6 +2572,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
+@@ -2452,6 +2581,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
if (!task)
goto out_no_task;
@@ -47815,7 +48290,7 @@ index 9fc77b4..04761b8 100644
/*
* Yes, it does not scale. And it should not. Don't add
* new entries into /proc/<tgid>/ without very good reasons.
-@@ -2496,6 +2619,9 @@ static int proc_pident_readdir(struct file *filp,
+@@ -2496,6 +2628,9 @@ static int proc_pident_readdir(struct file *filp,
if (!task)
goto out_no_task;
@@ -47825,7 +48300,7 @@ index 9fc77b4..04761b8 100644
ret = 0;
i = filp->f_pos;
switch (i) {
-@@ -2766,7 +2892,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
+@@ -2766,7 +2901,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
void *cookie)
{
@@ -47834,7 +48309,7 @@ index 9fc77b4..04761b8 100644
if (!IS_ERR(s))
__putname(s);
}
-@@ -2967,7 +3093,7 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2967,7 +3102,7 @@ static const struct pid_entry tgid_base_stuff[] = {
REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
#endif
REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
@@ -47843,7 +48318,7 @@ index 9fc77b4..04761b8 100644
INF("syscall", S_IRUGO, proc_pid_syscall),
#endif
INF("cmdline", S_IRUGO, proc_pid_cmdline),
-@@ -2992,10 +3118,10 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2992,10 +3127,10 @@ static const struct pid_entry tgid_base_stuff[] = {
#ifdef CONFIG_SECURITY
DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
#endif
@@ -47856,7 +48331,7 @@ index 9fc77b4..04761b8 100644
ONE("stack", S_IRUGO, proc_pid_stack),
#endif
#ifdef CONFIG_SCHEDSTATS
-@@ -3029,6 +3155,9 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -3029,6 +3164,9 @@ static const struct pid_entry tgid_base_stuff[] = {
#ifdef CONFIG_HARDWALL
INF("hardwall", S_IRUGO, proc_pid_hardwall),
#endif
@@ -47866,7 +48341,7 @@ index 9fc77b4..04761b8 100644
};
static int proc_tgid_base_readdir(struct file * filp,
-@@ -3155,7 +3284,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
+@@ -3155,7 +3293,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
if (!inode)
goto out;
@@ -47881,7 +48356,7 @@ index 9fc77b4..04761b8 100644
inode->i_op = &proc_tgid_base_inode_operations;
inode->i_fop = &proc_tgid_base_operations;
inode->i_flags|=S_IMMUTABLE;
-@@ -3197,7 +3333,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
+@@ -3197,7 +3342,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
if (!task)
goto out;
@@ -47893,7 +48368,7 @@ index 9fc77b4..04761b8 100644
put_task_struct(task);
out:
return result;
-@@ -3260,6 +3400,8 @@ static int proc_pid_fill_cache(struct file *filp, void *dirent, filldir_t filldi
+@@ -3260,6 +3409,8 @@ static int proc_pid_fill_cache(struct file *filp, void *dirent, filldir_t filldi
static int fake_filldir(void *buf, const char *name, int namelen,
loff_t offset, u64 ino, unsigned d_type)
{
@@ -47902,7 +48377,7 @@ index 9fc77b4..04761b8 100644
return 0;
}
-@@ -3326,7 +3468,7 @@ static const struct pid_entry tid_base_stuff[] = {
+@@ -3326,7 +3477,7 @@ static const struct pid_entry tid_base_stuff[] = {
REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
#endif
REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
@@ -47911,7 +48386,7 @@ index 9fc77b4..04761b8 100644
INF("syscall", S_IRUGO, proc_pid_syscall),
#endif
INF("cmdline", S_IRUGO, proc_pid_cmdline),
-@@ -3350,10 +3492,10 @@ static const struct pid_entry tid_base_stuff[] = {
+@@ -3350,10 +3501,10 @@ static const struct pid_entry tid_base_stuff[] = {
#ifdef CONFIG_SECURITY
DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
#endif
@@ -48005,10 +48480,19 @@ index 205c922..2ee4c57 100644
if (de->size)
inode->i_size = de->size;
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
-index 5f79bb8..eeccee4 100644
+index 5f79bb8..e9ab85d 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
-@@ -54,6 +54,9 @@ extern int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
+@@ -31,8 +31,6 @@ struct vmalloc_info {
+ unsigned long largest_chunk;
+ };
+
+-extern struct mm_struct *mm_for_maps(struct task_struct *);
+-
+ #ifdef CONFIG_MMU
+ #define VMALLOC_TOTAL (VMALLOC_END - VMALLOC_START)
+ extern void get_vmalloc_info(struct vmalloc_info *vmi);
+@@ -54,6 +52,9 @@ extern int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
struct pid *pid, struct task_struct *task);
extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
struct pid *pid, struct task_struct *task);
@@ -48040,9 +48524,7 @@ index 86c67ee..cdca321 100644
} else {
if (kern_addr_valid(start)) {
- unsigned long n;
-+ char *elf_buf;
-+ mm_segment_t oldfs;
-
+-
- n = copy_to_user(buffer, (char *)start, tsz);
- /*
- * We cannot distinguish between fault on source
@@ -48053,6 +48535,9 @@ index 86c67ee..cdca321 100644
- if (n) {
- if (clear_user(buffer + tsz - n,
- n))
++ char *elf_buf;
++ mm_segment_t oldfs;
++
+ elf_buf = kmalloc(tsz, GFP_KERNEL);
+ if (!elf_buf)
+ return -ENOMEM;
@@ -48277,7 +48762,7 @@ index eed44bf..abeb499 100644
}
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index 7faaf2a..096c28b 100644
+index 7faaf2a..7793015 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -11,12 +11,19 @@
@@ -48337,6 +48822,15 @@ index 7faaf2a..096c28b 100644
}
unsigned long task_vsize(struct mm_struct *mm)
+@@ -125,7 +149,7 @@ static void *m_start(struct seq_file *m, loff_t *pos)
+ if (!priv->task)
+ return ERR_PTR(-ESRCH);
+
+- mm = mm_for_maps(priv->task);
++ mm = mm_access(priv->task, PTRACE_MODE_READ);
+ if (!mm || IS_ERR(mm))
+ return mm;
+ down_read(&mm->mmap_sem);
@@ -231,13 +255,13 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
}
@@ -48444,6 +48938,15 @@ index 7faaf2a..096c28b 100644
mss.resident >> 10,
(unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
mss.shared_clean >> 10,
+@@ -919,7 +970,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
+ if (!pm.buffer)
+ goto out_task;
+
+- mm = mm_for_maps(task);
++ mm = mm_access(task, PTRACE_MODE_READ);
+ ret = PTR_ERR(mm);
+ if (!mm || IS_ERR(mm))
+ goto out_free;
@@ -1138,6 +1189,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
int n;
char buffer[50];
@@ -48476,7 +48979,7 @@ index 7faaf2a..096c28b 100644
seq_printf(m, " heap");
} else {
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
-index 74fe164..899e77b 100644
+index 74fe164..0848f95 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
@@ -48497,6 +49000,15 @@ index 74fe164..899e77b 100644
} else if (mm) {
pid_t tid = vm_is_stack(priv->task, vma, is_pid);
+@@ -223,7 +223,7 @@ static void *m_start(struct seq_file *m, loff_t *pos)
+ if (!priv->task)
+ return ERR_PTR(-ESRCH);
+
+- mm = mm_for_maps(priv->task);
++ mm = mm_access(priv->task, PTRACE_MODE_READ);
+ if (!mm || IS_ERR(mm)) {
+ put_task_struct(priv->task);
+ priv->task = NULL;
diff --git a/fs/quota/netlink.c b/fs/quota/netlink.c
index d67908b..d13f6a6 100644
--- a/fs/quota/netlink.c
@@ -48670,7 +49182,7 @@ index a59d271..e12d1cf 100644
#define __fs_changed(gen,s) (gen != get_generation (s))
#define fs_changed(gen,s) \
diff --git a/fs/select.c b/fs/select.c
-index 17d33d0..da0bf5c 100644
+index 0baa0a3..7795e27 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -20,6 +20,7 @@
@@ -48690,7 +49202,7 @@ index 17d33d0..da0bf5c 100644
return -EINVAL;
diff --git a/fs/seq_file.c b/fs/seq_file.c
-index 0cbd049..cab1127 100644
+index 0cbd049..64e705c 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -9,6 +9,7 @@
@@ -48711,6 +49223,42 @@ index 0cbd049..cab1127 100644
/*
* Wrappers around seq_open(e.g. swaps_open) need to be
+@@ -92,7 +96,7 @@ static int traverse(struct seq_file *m, loff_t offset)
+ return 0;
+ }
+ if (!m->buf) {
+- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
++ m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL | GFP_USERCOPY);
+ if (!m->buf)
+ return -ENOMEM;
+ }
+@@ -132,7 +136,7 @@ static int traverse(struct seq_file *m, loff_t offset)
+ Eoverflow:
+ m->op->stop(m, p);
+ kfree(m->buf);
+- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
++ m->buf = kmalloc(m->size <<= 1, GFP_KERNEL | GFP_USERCOPY);
+ return !m->buf ? -ENOMEM : -EAGAIN;
+ }
+
+@@ -187,7 +191,7 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
+
+ /* grab buffer if we didn't have one */
+ if (!m->buf) {
+- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
++ m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL | GFP_USERCOPY);
+ if (!m->buf)
+ goto Enomem;
+ }
+@@ -228,7 +232,7 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
+ goto Fill;
+ m->op->stop(m, p);
+ kfree(m->buf);
+- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
++ m->buf = kmalloc(m->size <<= 1, GFP_KERNEL | GFP_USERCOPY);
+ if (!m->buf)
+ goto Enomem;
+ m->count = 0;
@@ -567,7 +571,7 @@ static void single_stop(struct seq_file *p, void *v)
int single_open(struct file *file, int (*show)(struct seq_file *, void *),
void *data)
@@ -49127,10 +49675,10 @@ index 3011b87..1ab03e9 100644
kfree(s);
diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
new file mode 100644
-index 0000000..b9e7d6f
+index 0000000..4d533f1
--- /dev/null
+++ b/grsecurity/Kconfig
-@@ -0,0 +1,940 @@
+@@ -0,0 +1,941 @@
+#
+# grecurity configuration
+#
@@ -49259,6 +49807,7 @@ index 0000000..b9e7d6f
+config GRKERNSEC_HIDESYM
+ bool "Hide kernel symbols"
+ default y if GRKERNSEC_CONFIG_AUTO
++ select PAX_USERCOPY_SLABS
+ help
+ If you say Y here, getting information on loaded modules, and
+ displaying all kernel symbols through a syscall will be restricted
@@ -58907,8 +59456,23 @@ index f1c8ca6..b5c1cc7 100644
#define ACPI_DRIVER_ALL_NOTIFY_EVENTS 0x1 /* system AND device events */
+diff --git a/include/asm-generic/4level-fixup.h b/include/asm-generic/4level-fixup.h
+index 77ff547..181834f 100644
+--- a/include/asm-generic/4level-fixup.h
++++ b/include/asm-generic/4level-fixup.h
+@@ -13,8 +13,10 @@
+ #define pmd_alloc(mm, pud, address) \
+ ((unlikely(pgd_none(*(pud))) && __pmd_alloc(mm, pud, address))? \
+ NULL: pmd_offset(pud, address))
++#define pmd_alloc_kernel(mm, pud, address) pmd_alloc((mm), (pud), (address))
+
+ #define pud_alloc(mm, pgd, address) (pgd)
++#define pud_alloc_kernel(mm, pgd, address) pud_alloc((mm), (pgd), (address))
+ #define pud_offset(pgd, start) (pgd)
+ #define pud_none(pud) 0
+ #define pud_bad(pud) 0
diff --git a/include/asm-generic/atomic-long.h b/include/asm-generic/atomic-long.h
-index b7babf0..71e4e74 100644
+index b7babf0..3ba8aee 100644
--- a/include/asm-generic/atomic-long.h
+++ b/include/asm-generic/atomic-long.h
@@ -22,6 +22,12 @@
@@ -59161,7 +59725,7 @@ index b7babf0..71e4e74 100644
static inline long atomic_long_dec_return(atomic_long_t *l)
{
atomic_t *v = (atomic_t *)l;
-@@ -255,4 +393,49 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
+@@ -255,4 +393,55 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
#endif /* BITS_PER_LONG == 64 */
@@ -59179,6 +59743,10 @@ index b7babf0..71e4e74 100644
+ atomic_dec_unchecked((atomic_unchecked_t *)NULL);
+ atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
+ (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
++#ifdef CONFIG_X86
++ atomic_clear_mask_unchecked(0, NULL);
++ atomic_set_mask_unchecked(0, NULL);
++#endif
+
+ atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
+ atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
@@ -59200,6 +59768,8 @@ index b7babf0..71e4e74 100644
+#define atomic_dec_unchecked(v) atomic_dec(v)
+#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
+#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
++#define atomic_clear_mask_unchecked(mask, v) atomic_clear_mask((mask), (v))
++#define atomic_set_mask_unchecked(mask, v) atomic_set_mask((mask), (v))
+
+#define atomic_long_read_unchecked(v) atomic_long_read(v)
+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
@@ -59211,6 +59781,19 @@ index b7babf0..71e4e74 100644
+#endif
+
#endif /* _ASM_GENERIC_ATOMIC_LONG_H */
+diff --git a/include/asm-generic/atomic.h b/include/asm-generic/atomic.h
+index 1ced641..c896ee8 100644
+--- a/include/asm-generic/atomic.h
++++ b/include/asm-generic/atomic.h
+@@ -159,7 +159,7 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
+ * Atomically clears the bits set in @mask from @v
+ */
+ #ifndef atomic_clear_mask
+-static inline void atomic_clear_mask(unsigned long mask, atomic_t *v)
++static inline void atomic_clear_mask(unsigned int mask, atomic_t *v)
+ {
+ unsigned long flags;
+
diff --git a/include/asm-generic/atomic64.h b/include/asm-generic/atomic64.h
index b18ce4f..2ee2843 100644
--- a/include/asm-generic/atomic64.h
@@ -59676,10 +60259,10 @@ index 42e55de..1cd0e66 100644
extern struct cleancache_ops
cleancache_register_ops(struct cleancache_ops *ops);
diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
-index 2f40791..a62d196 100644
+index 2f40791..938880e 100644
--- a/include/linux/compiler-gcc4.h
+++ b/include/linux/compiler-gcc4.h
-@@ -32,6 +32,16 @@
+@@ -32,6 +32,21 @@
#define __linktime_error(message) __attribute__((__error__(message)))
#if __GNUC_MINOR__ >= 5
@@ -59691,12 +60274,17 @@ index 2f40791..a62d196 100644
+
+#ifdef SIZE_OVERFLOW_PLUGIN
+#define __size_overflow(...) __attribute__((size_overflow(__VA_ARGS__)))
++#define __intentional_overflow(...) __attribute__((intentional_overflow(__VA_ARGS__)))
++#endif
++
++#ifdef LATENT_ENTROPY_PLUGIN
++#define __latent_entropy __attribute__((latent_entropy))
+#endif
+
/*
* Mark a position in code as unreachable. This can be used to
* suppress control flow warnings after asm blocks that transfer
-@@ -47,6 +57,11 @@
+@@ -47,6 +62,11 @@
#define __noclone __attribute__((__noclone__))
#endif
@@ -59709,7 +60297,7 @@ index 2f40791..a62d196 100644
#if __GNUC_MINOR__ > 0
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
-index 923d093..726c17f 100644
+index 923d093..3625de1 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -5,31 +5,62 @@
@@ -59785,7 +60373,7 @@ index 923d093..726c17f 100644
#endif
#ifdef __KERNEL__
-@@ -264,6 +297,18 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
+@@ -264,6 +297,26 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
# define __attribute_const__ /* unimplemented */
#endif
@@ -59801,10 +60389,18 @@ index 923d093..726c17f 100644
+# define __size_overflow(...)
+#endif
+
++#ifndef __latent_entropy
++# define __latent_entropy
++#endif
++
++#ifndef __intentional_overflow
++# define __intentional_overflow(...)
++#endif
++
/*
* Tell gcc if a function is cold. The compiler will assume any path
* directly leading to the call is unlikely.
-@@ -273,6 +318,22 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
+@@ -273,6 +326,22 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
#define __cold
#endif
@@ -59827,7 +60423,7 @@ index 923d093..726c17f 100644
/* Simple shorthand for a section definition */
#ifndef __section
# define __section(S) __attribute__ ((__section__(#S)))
-@@ -308,6 +369,7 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
+@@ -308,6 +377,7 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
* use is to mediate communication between process-level code and irq/NMI
* handlers, all running on the same CPU.
*/
@@ -59905,6 +60501,22 @@ index dfc099e..e583e66 100644
#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
+diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
+index f9a2e5e..c392120 100644
+--- a/include/linux/dmaengine.h
++++ b/include/linux/dmaengine.h
+@@ -993,9 +993,9 @@ struct dma_pinned_list {
+ struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len);
+ void dma_unpin_iovec_pages(struct dma_pinned_list* pinned_list);
+
+-dma_cookie_t dma_memcpy_to_iovec(struct dma_chan *chan, struct iovec *iov,
++dma_cookie_t __intentional_overflow(0) dma_memcpy_to_iovec(struct dma_chan *chan, struct iovec *iov,
+ struct dma_pinned_list *pinned_list, unsigned char *kdata, size_t len);
+-dma_cookie_t dma_memcpy_pg_to_iovec(struct dma_chan *chan, struct iovec *iov,
++dma_cookie_t __intentional_overflow(0) dma_memcpy_pg_to_iovec(struct dma_chan *chan, struct iovec *iov,
+ struct dma_pinned_list *pinned_list, struct page *page,
+ unsigned int offset, size_t len);
+
diff --git a/include/linux/efi.h b/include/linux/efi.h
index ec45ccd..9923c32 100644
--- a/include/linux/efi.h
@@ -60138,6 +60750,49 @@ index 017a7fb..33a8507 100644
struct disk_events *ev;
#ifdef CONFIG_BLK_DEV_INTEGRITY
struct blk_integrity *integrity;
+diff --git a/include/linux/gfp.h b/include/linux/gfp.h
+index 581e74b..8c34a24 100644
+--- a/include/linux/gfp.h
++++ b/include/linux/gfp.h
+@@ -38,6 +38,12 @@ struct vm_area_struct;
+ #define ___GFP_OTHER_NODE 0x800000u
+ #define ___GFP_WRITE 0x1000000u
+
++#ifdef CONFIG_PAX_USERCOPY_SLABS
++#define ___GFP_USERCOPY 0x2000000u
++#else
++#define ___GFP_USERCOPY 0
++#endif
++
+ /*
+ * GFP bitmasks..
+ *
+@@ -87,6 +93,7 @@ struct vm_area_struct;
+ #define __GFP_NO_KSWAPD ((__force gfp_t)___GFP_NO_KSWAPD)
+ #define __GFP_OTHER_NODE ((__force gfp_t)___GFP_OTHER_NODE) /* On behalf of other node */
+ #define __GFP_WRITE ((__force gfp_t)___GFP_WRITE) /* Allocator intends to dirty page */
++#define __GFP_USERCOPY ((__force gfp_t)___GFP_USERCOPY)/* Allocator intends to copy page to/from userland */
+
+ /*
+ * This may seem redundant, but it's a way of annotating false positives vs.
+@@ -94,7 +101,7 @@ struct vm_area_struct;
+ */
+ #define __GFP_NOTRACK_FALSE_POSITIVE (__GFP_NOTRACK)
+
+-#define __GFP_BITS_SHIFT 25 /* Room for N __GFP_FOO bits */
++#define __GFP_BITS_SHIFT 26 /* Room for N __GFP_FOO bits */
+ #define __GFP_BITS_MASK ((__force gfp_t)((1 << __GFP_BITS_SHIFT) - 1))
+
+ /* This equals 0, but use constants in case they ever change */
+@@ -148,6 +155,8 @@ struct vm_area_struct;
+ /* 4GB DMA on some platforms */
+ #define GFP_DMA32 __GFP_DMA32
+
++#define GFP_USERCOPY __GFP_USERCOPY
++
+ /* Convert GFP flags to their corresponding migrate type */
+ static inline int allocflags_to_migratetype(gfp_t gfp_flags)
+ {
diff --git a/include/linux/gracl.h b/include/linux/gracl.h
new file mode 100644
index 0000000..c938b1f
@@ -61316,10 +61971,54 @@ index 58404b0..439ed95 100644
};
diff --git a/include/linux/init.h b/include/linux/init.h
-index 6b95109..4aca62c 100644
+index 6b95109..bcbdd68 100644
--- a/include/linux/init.h
+++ b/include/linux/init.h
-@@ -294,13 +294,13 @@ void __init parse_early_options(char *cmdline);
+@@ -39,9 +39,15 @@
+ * Also note, that this data cannot be "const".
+ */
+
++#ifdef MODULE
++#define add_latent_entropy
++#else
++#define add_latent_entropy __latent_entropy
++#endif
++
+ /* These are for everybody (although not all archs will actually
+ discard it in modules) */
+-#define __init __section(.init.text) __cold notrace
++#define __init __section(.init.text) __cold notrace add_latent_entropy
+ #define __initdata __section(.init.data)
+ #define __initconst __section(.init.rodata)
+ #define __exitdata __section(.exit.data)
+@@ -83,7 +89,7 @@
+ #define __exit __section(.exit.text) __exitused __cold notrace
+
+ /* Used for HOTPLUG */
+-#define __devinit __section(.devinit.text) __cold notrace
++#define __devinit __section(.devinit.text) __cold notrace add_latent_entropy
+ #define __devinitdata __section(.devinit.data)
+ #define __devinitconst __section(.devinit.rodata)
+ #define __devexit __section(.devexit.text) __exitused __cold notrace
+@@ -91,7 +97,7 @@
+ #define __devexitconst __section(.devexit.rodata)
+
+ /* Used for HOTPLUG_CPU */
+-#define __cpuinit __section(.cpuinit.text) __cold notrace
++#define __cpuinit __section(.cpuinit.text) __cold notrace add_latent_entropy
+ #define __cpuinitdata __section(.cpuinit.data)
+ #define __cpuinitconst __section(.cpuinit.rodata)
+ #define __cpuexit __section(.cpuexit.text) __exitused __cold notrace
+@@ -99,7 +105,7 @@
+ #define __cpuexitconst __section(.cpuexit.rodata)
+
+ /* Used for MEMORY_HOTPLUG */
+-#define __meminit __section(.meminit.text) __cold notrace
++#define __meminit __section(.meminit.text) __cold notrace add_latent_entropy
+ #define __meminitdata __section(.meminit.data)
+ #define __meminitconst __section(.meminit.rodata)
+ #define __memexit __section(.memexit.text) __exitused __cold notrace
+@@ -294,13 +300,13 @@ void __init parse_early_options(char *cmdline);
/* Each module must use one module_init(). */
#define module_init(initfn) \
@@ -61576,7 +62275,7 @@ index 9b07725..3d55001 100644
/**
* struct ux500_charger - power supply ux500 charger sub class
diff --git a/include/linux/mm.h b/include/linux/mm.h
-index 74aa71b..4ae97ba 100644
+index 441a564..81a3499 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -116,7 +116,14 @@ extern unsigned int kobjsize(const void *objp);
@@ -61736,7 +62435,7 @@ index 74aa71b..4ae97ba 100644
struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
unsigned long pfn, unsigned long size, pgprot_t);
-@@ -1602,7 +1612,7 @@ extern int unpoison_memory(unsigned long pfn);
+@@ -1603,7 +1613,7 @@ extern int unpoison_memory(unsigned long pfn);
extern int sysctl_memory_failure_early_kill;
extern int sysctl_memory_failure_recovery;
extern void shake_page(struct page *p, int access);
@@ -61745,7 +62444,7 @@ index 74aa71b..4ae97ba 100644
extern int soft_offline_page(struct page *page, int flags);
extern void dump_page(struct page *page);
-@@ -1633,5 +1643,11 @@ static inline unsigned int debug_guardpage_minorder(void) { return 0; }
+@@ -1634,5 +1644,11 @@ static inline unsigned int debug_guardpage_minorder(void) { return 0; }
static inline bool page_is_guard(struct page *page) { return false; }
#endif /* CONFIG_DEBUG_PAGEALLOC */
@@ -62251,10 +62950,25 @@ index 85c5073..51fac8b 100644
struct ctl_table_header;
struct ctl_table;
diff --git a/include/linux/random.h b/include/linux/random.h
-index 8f74538..02a1012 100644
+index ac621ce..e085135 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
-@@ -69,12 +69,17 @@ void srandom32(u32 seed);
+@@ -53,6 +53,14 @@ extern void add_input_randomness(unsigned int type, unsigned int code,
+ unsigned int value);
+ extern void add_interrupt_randomness(int irq, int irq_flags);
+
++#ifdef CONFIG_PAX_LATENT_ENTROPY
++extern void transfer_latent_entropy(void);
++#endif
++
++#ifdef CONFIG_PAX_LATENT_ENTROPY
++extern void transfer_latent_entropy(void);
++#endif
++
+ extern void get_random_bytes(void *buf, int nbytes);
+ extern void get_random_bytes_arch(void *buf, int nbytes);
+ void generate_random_uuid(unsigned char uuid_out[16]);
+@@ -69,12 +77,17 @@ void srandom32(u32 seed);
u32 prandom32(struct rnd_state *);
@@ -62367,7 +63081,7 @@ index fd07c45..4676b8e 100644
static inline void anon_vma_merge(struct vm_area_struct *vma,
struct vm_area_struct *next)
diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 81a173c..85ccd8f 100644
+index 7b06169..eb46ae3 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -100,6 +100,7 @@ struct bio_list;
@@ -62392,7 +63106,19 @@ index 81a173c..85ccd8f 100644
extern void arch_pick_mmap_layout(struct mm_struct *mm);
extern unsigned long
arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
-@@ -643,6 +647,17 @@ struct signal_struct {
+@@ -404,6 +408,11 @@ static inline void arch_pick_mmap_layout(struct mm_struct *mm) {}
+ extern void set_dumpable(struct mm_struct *mm, int value);
+ extern int get_dumpable(struct mm_struct *mm);
+
++/* get/set_dumpable() values */
++#define SUID_DUMPABLE_DISABLED 0
++#define SUID_DUMPABLE_ENABLED 1
++#define SUID_DUMPABLE_SAFE 2
++
+ /* mm flags */
+ /* dumpable bits */
+ #define MMF_DUMPABLE 0 /* core dump is permitted */
+@@ -643,6 +652,17 @@ struct signal_struct {
#ifdef CONFIG_TASKSTATS
struct taskstats *stats;
#endif
@@ -62410,7 +63136,7 @@ index 81a173c..85ccd8f 100644
#ifdef CONFIG_AUDIT
unsigned audit_tty;
struct tty_audit_buf *tty_audit_buf;
-@@ -726,6 +741,11 @@ struct user_struct {
+@@ -726,6 +746,11 @@ struct user_struct {
struct key *session_keyring; /* UID's default session keyring */
#endif
@@ -62422,7 +63148,7 @@ index 81a173c..85ccd8f 100644
/* Hash table maintenance information */
struct hlist_node uidhash_node;
uid_t uid;
-@@ -1386,8 +1406,8 @@ struct task_struct {
+@@ -1386,8 +1411,8 @@ struct task_struct {
struct list_head thread_group;
struct completion *vfork_done; /* for vfork() */
@@ -62433,7 +63159,7 @@ index 81a173c..85ccd8f 100644
cputime_t utime, stime, utimescaled, stimescaled;
cputime_t gtime;
-@@ -1403,13 +1423,6 @@ struct task_struct {
+@@ -1403,13 +1428,6 @@ struct task_struct {
struct task_cputime cputime_expires;
struct list_head cpu_timers[3];
@@ -62447,7 +63173,7 @@ index 81a173c..85ccd8f 100644
char comm[TASK_COMM_LEN]; /* executable name excluding path
- access with [gs]et_task_comm (which lock
it with task_lock())
-@@ -1426,8 +1439,16 @@ struct task_struct {
+@@ -1426,8 +1444,16 @@ struct task_struct {
#endif
/* CPU-specific state of this task */
struct thread_struct thread;
@@ -62464,7 +63190,7 @@ index 81a173c..85ccd8f 100644
/* open file information */
struct files_struct *files;
/* namespaces */
-@@ -1469,6 +1490,11 @@ struct task_struct {
+@@ -1469,6 +1495,11 @@ struct task_struct {
struct rt_mutex_waiter *pi_blocked_on;
#endif
@@ -62476,7 +63202,7 @@ index 81a173c..85ccd8f 100644
#ifdef CONFIG_DEBUG_MUTEXES
/* mutex deadlock detection */
struct mutex_waiter *blocked_on;
-@@ -1585,6 +1611,27 @@ struct task_struct {
+@@ -1585,6 +1616,27 @@ struct task_struct {
unsigned long default_timer_slack_ns;
struct list_head *scm_work_list;
@@ -62504,7 +63230,7 @@ index 81a173c..85ccd8f 100644
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
/* Index of current stored address in ret_stack */
int curr_ret_stack;
-@@ -1619,6 +1666,51 @@ struct task_struct {
+@@ -1619,6 +1671,51 @@ struct task_struct {
#endif
};
@@ -62551,12 +63277,12 @@ index 81a173c..85ccd8f 100644
+extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
+extern void pax_report_insns(struct pt_regs *regs, void *pc, void *sp);
+extern void pax_report_refcount_overflow(struct pt_regs *regs);
-+extern __noreturn void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type);
++extern void check_object_size(const void *ptr, unsigned long n, bool to);
+
/* Future-safe accessor for struct task_struct's cpus_allowed. */
#define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
-@@ -2138,7 +2230,9 @@ void yield(void);
+@@ -2146,7 +2243,9 @@ void yield(void);
extern struct exec_domain default_exec_domain;
union thread_union {
@@ -62566,7 +63292,7 @@ index 81a173c..85ccd8f 100644
unsigned long stack[THREAD_SIZE/sizeof(long)];
};
-@@ -2171,6 +2265,7 @@ extern struct pid_namespace init_pid_ns;
+@@ -2179,6 +2278,7 @@ extern struct pid_namespace init_pid_ns;
*/
extern struct task_struct *find_task_by_vpid(pid_t nr);
@@ -62574,7 +63300,7 @@ index 81a173c..85ccd8f 100644
extern struct task_struct *find_task_by_pid_ns(pid_t nr,
struct pid_namespace *ns);
-@@ -2314,7 +2409,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
+@@ -2322,7 +2422,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
extern void exit_itimers(struct signal_struct *);
extern void flush_itimer_signals(void);
@@ -62583,7 +63309,7 @@ index 81a173c..85ccd8f 100644
extern void daemonize(const char *, ...);
extern int allow_signal(int);
-@@ -2515,13 +2610,17 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
+@@ -2523,9 +2623,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
#endif
@@ -62595,14 +63321,6 @@ index 81a173c..85ccd8f 100644
return (obj >= stack) && (obj < (stack + THREAD_SIZE));
}
-
-+#ifdef CONFIG_PAX_USERCOPY
-+extern int object_is_on_stack(const void *obj, unsigned long len);
-+#endif
-+
- extern void thread_info_cache_init(void);
-
- #ifdef CONFIG_DEBUG_STACK_USAGE
diff --git a/include/linux/screen_info.h b/include/linux/screen_info.h
index 899fbb4..1cb4138 100644
--- a/include/linux/screen_info.h
@@ -62667,9 +63385,18 @@ index 92808b8..c28cac4 100644
/* shm_mode upper byte flags */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
-index c1bae8d..2dbcd31 100644
+index c1bae8d..f25c5e2 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
+@@ -560,7 +560,7 @@ extern void __kfree_skb(struct sk_buff *skb);
+ extern struct sk_buff *__alloc_skb(unsigned int size,
+ gfp_t priority, int fclone, int node);
+ extern struct sk_buff *build_skb(void *data);
+-static inline struct sk_buff *alloc_skb(unsigned int size,
++static inline struct sk_buff * __intentional_overflow(0) alloc_skb(unsigned int size,
+ gfp_t priority)
+ {
+ return __alloc_skb(size, priority, 0, NUMA_NO_NODE);
@@ -663,7 +663,7 @@ static inline struct skb_shared_hwtstamps *skb_hwtstamps(struct sk_buff *skb)
*/
static inline int skb_queue_empty(const struct sk_buff_head *list)
@@ -62706,8 +63433,17 @@ index c1bae8d..2dbcd31 100644
#endif
extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
+@@ -2097,7 +2097,7 @@ extern struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags,
+ int noblock, int *err);
+ extern unsigned int datagram_poll(struct file *file, struct socket *sock,
+ struct poll_table_struct *wait);
+-extern int skb_copy_datagram_iovec(const struct sk_buff *from,
++extern int __intentional_overflow(0) skb_copy_datagram_iovec(const struct sk_buff *from,
+ int offset, struct iovec *to,
+ int size);
+ extern int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
diff --git a/include/linux/slab.h b/include/linux/slab.h
-index a595dce..c403597 100644
+index a595dce..dfab0d2 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -11,12 +11,20 @@
@@ -62722,7 +63458,7 @@ index a595dce..c403597 100644
*/
#define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
+
-+#ifdef CONFIG_PAX_USERCOPY
++#ifdef CONFIG_PAX_USERCOPY_SLABS
+#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
+#else
+#define SLAB_USERCOPY 0x00000000UL
@@ -62748,15 +63484,16 @@ index a595dce..c403597 100644
/*
* struct kmem_cache related prototypes
-@@ -161,6 +172,7 @@ void * __must_check krealloc(const void *, size_t, gfp_t);
+@@ -161,6 +172,8 @@ void * __must_check krealloc(const void *, size_t, gfp_t);
void kfree(const void *);
void kzfree(const void *);
size_t ksize(const void *);
-+void check_object_size(const void *ptr, unsigned long n, bool to);
++const char *check_heap_object(const void *ptr, unsigned long n, bool to);
++bool is_usercopy_object(const void *ptr);
/*
* Allocator specific definitions. These are mainly used to establish optimized
-@@ -240,6 +252,7 @@ size_t ksize(const void *);
+@@ -240,6 +253,7 @@ size_t ksize(const void *);
* for general use, and so are not documented here. For a full list of
* potential flags, always refer to linux/gfp.h.
*/
@@ -62764,7 +63501,7 @@ index a595dce..c403597 100644
static inline void *kmalloc_array(size_t n, size_t size, gfp_t flags)
{
if (size != 0 && n > ULONG_MAX / size)
-@@ -298,7 +311,7 @@ static inline void *kmem_cache_alloc_node(struct kmem_cache *cachep,
+@@ -298,7 +312,7 @@ static inline void *kmem_cache_alloc_node(struct kmem_cache *cachep,
*/
#if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_SLUB) || \
(defined(CONFIG_SLAB) && defined(CONFIG_TRACING))
@@ -62773,7 +63510,7 @@ index a595dce..c403597 100644
#define kmalloc_track_caller(size, flags) \
__kmalloc_track_caller(size, flags, _RET_IP_)
#else
-@@ -317,7 +330,7 @@ extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long);
+@@ -317,7 +331,7 @@ extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long);
*/
#if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_SLUB) || \
(defined(CONFIG_SLAB) && defined(CONFIG_TRACING))
@@ -62783,7 +63520,7 @@ index a595dce..c403597 100644
__kmalloc_node_track_caller(size, flags, node, \
_RET_IP_)
diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
-index fbd1117..d4d8ef8 100644
+index fbd1117..0a3d314 100644
--- a/include/linux/slab_def.h
+++ b/include/linux/slab_def.h
@@ -66,10 +66,10 @@ struct kmem_cache {
@@ -62801,7 +63538,16 @@ index fbd1117..d4d8ef8 100644
/*
* If debugging is enabled, then the allocator can add additional
-@@ -107,7 +107,7 @@ struct cache_sizes {
+@@ -103,11 +103,16 @@ struct cache_sizes {
+ #ifdef CONFIG_ZONE_DMA
+ struct kmem_cache *cs_dmacachep;
+ #endif
++
++#ifdef CONFIG_PAX_USERCOPY_SLABS
++ struct kmem_cache *cs_usercopycachep;
++#endif
++
+ };
extern struct cache_sizes malloc_sizes[];
void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
@@ -62810,7 +63556,21 @@ index fbd1117..d4d8ef8 100644
#ifdef CONFIG_TRACING
extern void *kmem_cache_alloc_trace(size_t size,
-@@ -160,7 +160,7 @@ found:
+@@ -150,6 +155,13 @@ found:
+ cachep = malloc_sizes[i].cs_dmacachep;
+ else
+ #endif
++
++#ifdef CONFIG_PAX_USERCOPY_SLABS
++ if (flags & GFP_USERCOPY)
++ cachep = malloc_sizes[i].cs_usercopycachep;
++ else
++#endif
++
+ cachep = malloc_sizes[i].cs_cachep;
+
+ ret = kmem_cache_alloc_trace(size, cachep, flags);
+@@ -160,7 +172,7 @@ found:
}
#ifdef CONFIG_NUMA
@@ -62819,8 +63579,22 @@ index fbd1117..d4d8ef8 100644
extern void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node);
#ifdef CONFIG_TRACING
+@@ -203,6 +215,13 @@ found:
+ cachep = malloc_sizes[i].cs_dmacachep;
+ else
+ #endif
++
++#ifdef CONFIG_PAX_USERCOPY_SLABS
++ if (flags & GFP_USERCOPY)
++ cachep = malloc_sizes[i].cs_usercopycachep;
++ else
++#endif
++
+ cachep = malloc_sizes[i].cs_cachep;
+
+ return kmem_cache_alloc_node_trace(size, cachep, flags, node);
diff --git a/include/linux/slob_def.h b/include/linux/slob_def.h
-index 0ec00b3..39cb7fc 100644
+index 0ec00b3..22b4715 100644
--- a/include/linux/slob_def.h
+++ b/include/linux/slob_def.h
@@ -9,7 +9,7 @@ static __always_inline void *kmem_cache_alloc(struct kmem_cache *cachep,
@@ -62832,16 +63606,17 @@ index 0ec00b3..39cb7fc 100644
static __always_inline void *kmalloc_node(size_t size, gfp_t flags, int node)
{
-@@ -29,6 +29,7 @@ static __always_inline void *kmalloc(size_t size, gfp_t flags)
+@@ -29,7 +29,7 @@ static __always_inline void *kmalloc(size_t size, gfp_t flags)
return __kmalloc_node(size, flags, -1);
}
-+static __always_inline void *__kmalloc(size_t size, gfp_t flags) __size_overflow(1);
- static __always_inline void *__kmalloc(size_t size, gfp_t flags)
+-static __always_inline void *__kmalloc(size_t size, gfp_t flags)
++static __always_inline __size_overflow(1) void *__kmalloc(size_t size, gfp_t flags)
{
return kmalloc(size, flags);
+ }
diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
-index c2f8c8b..be9e036 100644
+index c2f8c8b..d992a41 100644
--- a/include/linux/slub_def.h
+++ b/include/linux/slub_def.h
@@ -92,7 +92,7 @@ struct kmem_cache {
@@ -62853,15 +63628,16 @@ index c2f8c8b..be9e036 100644
void (*ctor)(void *);
int inuse; /* Offset to metadata */
int align; /* Alignment */
-@@ -153,6 +153,7 @@ extern struct kmem_cache *kmalloc_caches[SLUB_PAGE_SHIFT];
+@@ -153,7 +153,7 @@ extern struct kmem_cache *kmalloc_caches[SLUB_PAGE_SHIFT];
* Sorry that the following has to be that ugly but some versions of GCC
* have trouble with constant propagation and loops.
*/
-+static __always_inline int kmalloc_index(size_t size) __size_overflow(1);
- static __always_inline int kmalloc_index(size_t size)
+-static __always_inline int kmalloc_index(size_t size)
++static __always_inline __size_overflow(1) int kmalloc_index(size_t size)
{
if (!size)
-@@ -218,7 +219,7 @@ static __always_inline struct kmem_cache *kmalloc_slab(size_t size)
+ return 0;
+@@ -218,7 +218,7 @@ static __always_inline struct kmem_cache *kmalloc_slab(size_t size)
}
void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
@@ -62870,15 +63646,16 @@ index c2f8c8b..be9e036 100644
static __always_inline void *
kmalloc_order(size_t size, gfp_t flags, unsigned int order)
-@@ -259,6 +260,7 @@ kmalloc_order_trace(size_t size, gfp_t flags, unsigned int order)
+@@ -259,7 +259,7 @@ kmalloc_order_trace(size_t size, gfp_t flags, unsigned int order)
}
#endif
-+static __always_inline void *kmalloc_large(size_t size, gfp_t flags) __size_overflow(1);
- static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
+-static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
++static __always_inline __size_overflow(1) void *kmalloc_large(size_t size, gfp_t flags)
{
unsigned int order = get_order(size);
-@@ -284,7 +286,7 @@ static __always_inline void *kmalloc(size_t size, gfp_t flags)
+ return kmalloc_order_trace(size, flags, order);
+@@ -284,7 +284,7 @@ static __always_inline void *kmalloc(size_t size, gfp_t flags)
}
#ifdef CONFIG_NUMA
@@ -63428,7 +64205,7 @@ index 10422ef..662570f 100644
fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
#define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
-index 72522f0..6f03a2b 100644
+index 72522f0..2965e05 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -510,7 +510,7 @@ struct ip_vs_conn {
@@ -63449,6 +64226,15 @@ index 72522f0..6f03a2b 100644
atomic_t weight; /* server weight */
atomic_t refcnt; /* reference counter */
+@@ -1356,7 +1356,7 @@ static inline void ip_vs_notrack(struct sk_buff *skb)
+ struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
+
+ if (!ct || !nf_ct_is_untracked(ct)) {
+- nf_reset(skb);
++ nf_conntrack_put(skb->nfct);
+ skb->nfct = &nf_ct_untracked_get()->ct_general;
+ skb->nfctinfo = IP_CT_NEW;
+ nf_conntrack_get(skb->nfct);
diff --git a/include/net/irda/ircomm_core.h b/include/net/irda/ircomm_core.h
index 69b610a..fe3962c 100644
--- a/include/net/irda/ircomm_core.h
@@ -63511,6 +64297,19 @@ index 34c996f..bb3b4d4 100644
struct pneigh_entry {
struct pneigh_entry *next;
+diff --git a/include/net/netdma.h b/include/net/netdma.h
+index 8ba8ce2..99b7fff 100644
+--- a/include/net/netdma.h
++++ b/include/net/netdma.h
+@@ -24,7 +24,7 @@
+ #include <linux/dmaengine.h>
+ #include <linux/skbuff.h>
+
+-int dma_skb_copy_datagram_iovec(struct dma_chan* chan,
++int __intentional_overflow(3,5) dma_skb_copy_datagram_iovec(struct dma_chan* chan,
+ struct sk_buff *skb, int offset, struct iovec *to,
+ size_t len, struct dma_pinned_list *pinned_list);
+
diff --git a/include/net/netlink.h b/include/net/netlink.h
index f394fe5..fd073f9 100644
--- a/include/net/netlink.h
@@ -63557,7 +64356,7 @@ index a2ef814..31a8e3f 100644
#define SCTP_DISABLE_DEBUG
#define SCTP_ASSERT(expr, str, func)
diff --git a/include/net/sock.h b/include/net/sock.h
-index 5a0a58a..2e3d4d0 100644
+index 5a0a58a..ed2bf11 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -302,7 +302,7 @@ struct sock {
@@ -63578,10 +64377,48 @@ index 5a0a58a..2e3d4d0 100644
int copy, int offset)
{
if (skb->ip_summed == CHECKSUM_NONE) {
+@@ -1953,7 +1953,7 @@ static inline void sk_stream_moderate_sndbuf(struct sock *sk)
+ }
+ }
+
+-struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp);
++struct sk_buff * __intentional_overflow(0) sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp);
+
+ static inline struct page *sk_stream_alloc_page(struct sock *sk)
+ {
diff --git a/include/net/tcp.h b/include/net/tcp.h
-index f75a04d..702cf06 100644
+index f75a04d..e8f5101 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
+@@ -478,7 +478,7 @@ extern void tcp_retransmit_timer(struct sock *sk);
+ extern void tcp_xmit_retransmit_queue(struct sock *);
+ extern void tcp_simple_retransmit(struct sock *);
+ extern int tcp_trim_head(struct sock *, struct sk_buff *, u32);
+-extern int tcp_fragment(struct sock *, struct sk_buff *, u32, unsigned int);
++extern int __intentional_overflow(3) tcp_fragment(struct sock *, struct sk_buff *, u32, unsigned int);
+
+ extern void tcp_send_probe0(struct sock *);
+ extern void tcp_send_partial(struct sock *);
+@@ -641,8 +641,8 @@ struct tcp_skb_cb {
+ struct inet6_skb_parm h6;
+ #endif
+ } header; /* For incoming frames */
+- __u32 seq; /* Starting sequence number */
+- __u32 end_seq; /* SEQ + FIN + SYN + datalen */
++ __u32 seq __intentional_overflow(0); /* Starting sequence number */
++ __u32 end_seq __intentional_overflow(0); /* SEQ + FIN + SYN + datalen */
+ __u32 when; /* used to compute rtt's */
+ __u8 tcp_flags; /* TCP header flags. (tcp[13]) */
+ __u8 sacked; /* State flags for SACK/FACK. */
+@@ -655,7 +655,7 @@ struct tcp_skb_cb {
+ #define TCPCB_EVER_RETRANS 0x80 /* Ever retransmitted frame */
+ #define TCPCB_RETRANS (TCPCB_SACKED_RETRANS|TCPCB_EVER_RETRANS)
+
+- __u32 ack_seq; /* Sequence number ACK'd */
++ __u32 ack_seq __intentional_overflow(0); /* Sequence number ACK'd */
+ };
+
+ #define TCP_SKB_CB(__skb) ((struct tcp_skb_cb *)&((__skb)->cb[0]))
@@ -1425,7 +1425,7 @@ struct tcp_seq_afinfo {
char *name;
sa_family_t family;
@@ -63781,10 +64618,10 @@ index 4119966..1a4671c 100644
const struct firmware *dsp_microcode;
const struct firmware *controller_microcode;
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
-index aaccc5f..092d568 100644
+index 3ad5b33..1fa86f4 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
-@@ -447,7 +447,7 @@ struct t10_reservation_ops {
+@@ -448,7 +448,7 @@ struct t10_reservation_ops {
int (*t10_seq_non_holder)(struct se_cmd *, unsigned char *, u32);
int (*t10_pr_register)(struct se_cmd *);
int (*t10_pr_clear)(struct se_cmd *);
@@ -63793,7 +64630,7 @@ index aaccc5f..092d568 100644
struct t10_reservation {
/* Reservation effects all target ports */
-@@ -576,7 +576,7 @@ struct se_cmd {
+@@ -577,7 +577,7 @@ struct se_cmd {
atomic_t t_se_count;
atomic_t t_task_cdbs_left;
atomic_t t_task_cdbs_ex_left;
@@ -63802,7 +64639,7 @@ index aaccc5f..092d568 100644
unsigned int transport_state;
#define CMD_T_ABORTED (1 << 0)
#define CMD_T_ACTIVE (1 << 1)
-@@ -802,7 +802,7 @@ struct se_device {
+@@ -803,7 +803,7 @@ struct se_device {
spinlock_t stats_lock;
/* Active commands on this virtual SE device */
atomic_t simple_cmds;
@@ -64256,7 +65093,7 @@ index 8216c30..25e8e32 100644
next_state = Reset;
return 0;
diff --git a/init/main.c b/init/main.c
-index b08c5f7..09f865e 100644
+index b08c5f7..3688049 100644
--- a/init/main.c
+++ b/init/main.c
@@ -95,6 +95,8 @@ static inline void mark_rodata_ro(void) { }
@@ -64268,7 +65105,7 @@ index b08c5f7..09f865e 100644
/*
* Debug helper: via this flag we know that we are in 'early bootup code'
* where only the boot processor is running with IRQ disabled. This means
-@@ -148,6 +150,49 @@ static int __init set_reset_devices(char *str)
+@@ -148,6 +150,51 @@ static int __init set_reset_devices(char *str)
__setup("reset_devices", set_reset_devices);
@@ -64292,7 +65129,9 @@ index b08c5f7..09f865e 100644
+ gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
+ gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
+ }
-+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
++ loadsegment(ds, __KERNEL_DS);
++ loadsegment(es, __KERNEL_DS);
++ loadsegment(ss, __KERNEL_DS);
+#else
+ memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
+ memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
@@ -64318,7 +65157,7 @@ index b08c5f7..09f865e 100644
static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
static const char *panic_later, *panic_param;
-@@ -674,6 +719,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -674,6 +721,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
{
int count = preempt_count();
int ret;
@@ -64326,7 +65165,7 @@ index b08c5f7..09f865e 100644
if (initcall_debug)
ret = do_one_initcall_debug(fn);
-@@ -686,15 +732,15 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -686,15 +734,15 @@ int __init_or_module do_one_initcall(initcall_t fn)
sprintf(msgbuf, "error code %d ", ret);
if (preempt_count() != count) {
@@ -64346,7 +65185,39 @@ index b08c5f7..09f865e 100644
}
return ret;
-@@ -865,7 +911,7 @@ static int __init kernel_init(void * unused)
+@@ -747,8 +795,14 @@ static void __init do_initcall_level(int level)
+ level, level,
+ repair_env_string);
+
+- for (fn = initcall_levels[level]; fn < initcall_levels[level+1]; fn++)
++ for (fn = initcall_levels[level]; fn < initcall_levels[level+1]; fn++) {
+ do_one_initcall(*fn);
++
++#ifdef CONFIG_PAX_LATENT_ENTROPY
++ transfer_latent_entropy();
++#endif
++
++ }
+ }
+
+ static void __init do_initcalls(void)
+@@ -782,8 +836,14 @@ static void __init do_pre_smp_initcalls(void)
+ {
+ initcall_t *fn;
+
+- for (fn = __initcall_start; fn < __initcall0_start; fn++)
++ for (fn = __initcall_start; fn < __initcall0_start; fn++) {
+ do_one_initcall(*fn);
++
++#ifdef CONFIG_PAX_LATENT_ENTROPY
++ transfer_latent_entropy();
++#endif
++
++ }
+ }
+
+ static void run_init_process(const char *init_filename)
+@@ -865,7 +925,7 @@ static int __init kernel_init(void * unused)
do_basic_setup();
/* Open the /dev/console on the rootfs, this should never fail */
@@ -64355,7 +65226,7 @@ index b08c5f7..09f865e 100644
printk(KERN_WARNING "Warning: unable to open an initial console.\n");
(void) sys_dup(0);
-@@ -878,11 +924,13 @@ static int __init kernel_init(void * unused)
+@@ -878,11 +938,13 @@ static int __init kernel_init(void * unused)
if (!ramdisk_execute_command)
ramdisk_execute_command = "/init";
@@ -64383,7 +65254,7 @@ index 28bd64d..c66b72a 100644
if (u->mq_bytes + mq_bytes < u->mq_bytes ||
u->mq_bytes + mq_bytes > rlimit(RLIMIT_MSGQUEUE)) {
diff --git a/ipc/msg.c b/ipc/msg.c
-index 7385de2..a8180e08 100644
+index 7385de2..a8180e0 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -309,18 +309,19 @@ static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg)
@@ -65205,7 +66076,7 @@ index fd126f8..70b755b 100644
/*
diff --git a/kernel/exit.c b/kernel/exit.c
-index 9d81012..d7911f1 100644
+index bfbd856..0dd1897 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -59,6 +59,10 @@
@@ -65427,7 +66298,7 @@ index 8163333..aee97f3 100644
if (mpnt->vm_flags & VM_DONTCOPY) {
long pages = vma_pages(mpnt);
mm->total_vm -= pages;
-@@ -354,54 +422,11 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -354,56 +422,13 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
-pages);
continue;
}
@@ -65438,11 +66309,7 @@ index 8163333..aee97f3 100644
- if (security_vm_enough_memory_mm(oldmm, len)) /* sic */
- goto fail_nomem;
- charge = len;
-+ tmp = dup_vma(mm, oldmm, mpnt);
-+ if (!tmp) {
-+ retval = -ENOMEM;
-+ goto out;
- }
+- }
- tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
- if (!tmp)
- goto fail_nomem;
@@ -65474,18 +66341,24 @@ index 8163333..aee97f3 100644
- vma_prio_tree_add(tmp, mpnt);
- flush_dcache_mmap_unlock(mapping);
- mutex_unlock(&mapping->i_mmap_mutex);
-- }
--
-- /*
++ tmp = dup_vma(mm, oldmm, mpnt);
++ if (!tmp) {
++ retval = -ENOMEM;
++ goto out;
+ }
+
+ /*
- * Clear hugetlb-related page reserves for children. This only
- * affects MAP_PRIVATE mappings. Faults generated by the child
- * are not guaranteed to succeed, even if read-only
- */
- if (is_vm_hugetlb_page(tmp))
- reset_vma_resv_huge_pages(tmp);
-
- /*
+-
+- /*
* Link in the new vma and copy the page table entries.
+ */
+ *pprev = tmp;
@@ -424,6 +449,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
if (retval)
goto out;
@@ -65618,7 +66491,7 @@ index 8163333..aee97f3 100644
else
new_fs = fs;
diff --git a/kernel/futex.c b/kernel/futex.c
-index e2b0fb9..db818ac 100644
+index 3717e7b..473c750 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -54,6 +54,7 @@
@@ -65641,7 +66514,7 @@ index e2b0fb9..db818ac 100644
/*
* The futex address must be "naturally" aligned.
*/
-@@ -2711,6 +2717,7 @@ static int __init futex_init(void)
+@@ -2714,6 +2720,7 @@ static int __init futex_init(void)
{
u32 curval;
int i;
@@ -65649,7 +66522,7 @@ index e2b0fb9..db818ac 100644
/*
* This will fail and we want it. Some arch implementations do
-@@ -2722,8 +2729,11 @@ static int __init futex_init(void)
+@@ -2725,8 +2732,11 @@ static int __init futex_init(void)
* implementation, the non-functional ones will return
* -ENOSYS.
*/
@@ -65687,18 +66560,18 @@ index 9b22d03..6295b62 100644
prev->next = info->next;
else
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
-index ae34bf5..4e2f3d0 100644
+index 6db7a5e..25b6648 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
-@@ -1393,7 +1393,7 @@ void hrtimer_peek_ahead_timers(void)
+@@ -1407,7 +1407,7 @@ void hrtimer_peek_ahead_timers(void)
local_irq_restore(flags);
}
-static void run_hrtimer_softirq(struct softirq_action *h)
+static void run_hrtimer_softirq(void)
{
- hrtimer_peek_ahead_timers();
- }
+ struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
+
diff --git a/kernel/jump_label.c b/kernel/jump_label.c
index 4304919..408c4c0 100644
--- a/kernel/jump_label.c
@@ -65735,7 +66608,7 @@ index 4304919..408c4c0 100644
static int
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
-index 079f1d3..a407562 100644
+index 079f1d3..4e80e69 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -11,6 +11,9 @@
@@ -65831,7 +66704,30 @@ index 079f1d3..a407562 100644
/* Some debugging symbols have no name. Ignore them. */
if (!iter->name[0])
return 0;
-@@ -540,7 +583,7 @@ static int kallsyms_open(struct inode *inode, struct file *file)
+@@ -515,11 +558,22 @@ static int s_show(struct seq_file *m, void *p)
+ */
+ type = iter->exported ? toupper(iter->type) :
+ tolower(iter->type);
++
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ seq_printf(m, "%pP %c %s\t[%s]\n", (void *)iter->value,
++ type, iter->name, iter->module_name);
++#else
+ seq_printf(m, "%pK %c %s\t[%s]\n", (void *)iter->value,
+ type, iter->name, iter->module_name);
++#endif
+ } else
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ seq_printf(m, "%pP %c %s\n", (void *)iter->value,
++ iter->type, iter->name);
++#else
+ seq_printf(m, "%pK %c %s\n", (void *)iter->value,
+ iter->type, iter->name);
++#endif
+ return 0;
+ }
+
+@@ -540,7 +594,7 @@ static int kallsyms_open(struct inode *inode, struct file *file)
struct kallsym_iter *iter;
int ret;
@@ -66528,10 +67424,8 @@ index 78ac6ec..e87db0e 100644
+ kmemleak_not_leak(ptr);
+ if (!ptr && mod->init_size_rw) {
+ module_free(mod, mod->module_core_rw);
- return -ENOMEM;
- }
-- memset(ptr, 0, mod->init_size);
-- mod->module_init = ptr;
++ return -ENOMEM;
++ }
+ memset(ptr, 0, mod->init_size_rw);
+ mod->module_init_rw = ptr;
+
@@ -66554,8 +67448,10 @@ index 78ac6ec..e87db0e 100644
+ module_free_exec(mod, mod->module_core_rx);
+ module_free(mod, mod->module_init_rw);
+ module_free(mod, mod->module_core_rw);
-+ return -ENOMEM;
-+ }
+ return -ENOMEM;
+ }
+- memset(ptr, 0, mod->init_size);
+- mod->module_init = ptr;
+
+ pax_open_kernel();
+ memset(ptr, 0, mod->init_size_rx);
@@ -66935,10 +67831,25 @@ index a307cc9..27fd2e9 100644
/* set it to 0 if there are no waiters left: */
diff --git a/kernel/panic.c b/kernel/panic.c
-index 9ed023b..e49543e 100644
+index 9ed023b..4846159 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
-@@ -402,7 +402,7 @@ static void warn_slowpath_common(const char *file, int line, void *caller,
+@@ -75,6 +75,14 @@ void panic(const char *fmt, ...)
+ int state = 0;
+
+ /*
++ * Disable local interrupts. This will prevent panic_smp_self_stop
++ * from deadlocking the first cpu that invokes the panic, since
++ * there is nothing to prevent an interrupt handler (that runs
++ * after the panic_lock is acquired) from invoking panic again.
++ */
++ local_irq_disable();
++
++ /*
+ * It's possible to come here directly from a panic-assertion and
+ * not have preempt disabled. Some functions called from here want
+ * preempt to be disabled. No point enabling it later though...
+@@ -402,7 +410,7 @@ static void warn_slowpath_common(const char *file, int line, void *caller,
const char *board;
printk(KERN_WARNING "------------[ cut here ]------------\n");
@@ -66947,7 +67858,7 @@ index 9ed023b..e49543e 100644
board = dmi_get_system_info(DMI_PRODUCT_NAME);
if (board)
printk(KERN_WARNING "Hardware name: %s\n", board);
-@@ -457,7 +457,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
+@@ -457,7 +465,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
*/
void __stack_chk_fail(void)
{
@@ -67932,10 +68843,10 @@ index 0984a21..939f183 100644
#ifdef CONFIG_RT_GROUP_SCHED
/*
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index 2000e06..79cf3d8 100644
+index ef6a8f2..d9bc4df 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
-@@ -3907,6 +3907,8 @@ int can_nice(const struct task_struct *p, const int nice)
+@@ -4044,6 +4044,8 @@ int can_nice(const struct task_struct *p, const int nice)
/* convert nice value [19,-20] to rlimit style value [1,40] */
int nice_rlim = 20 - nice;
@@ -67944,7 +68855,7 @@ index 2000e06..79cf3d8 100644
return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
capable(CAP_SYS_NICE));
}
-@@ -3940,7 +3942,8 @@ SYSCALL_DEFINE1(nice, int, increment)
+@@ -4077,7 +4079,8 @@ SYSCALL_DEFINE1(nice, int, increment)
if (nice > 19)
nice = 19;
@@ -67954,7 +68865,7 @@ index 2000e06..79cf3d8 100644
return -EPERM;
retval = security_task_setnice(current, nice);
-@@ -4097,6 +4100,7 @@ recheck:
+@@ -4234,6 +4237,7 @@ recheck:
unsigned long rlim_rtprio =
task_rlimit(p, RLIMIT_RTPRIO);
@@ -68359,7 +69270,7 @@ index e7006eb..8fb7c51 100644
break;
}
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
-index 4ab1187..0b75ced 100644
+index 4ab1187..33f4f2b 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -91,7 +91,6 @@
@@ -68370,7 +69281,7 @@ index 4ab1187..0b75ced 100644
/* External variables not in a header file. */
extern int sysctl_overcommit_memory;
extern int sysctl_overcommit_ratio;
-@@ -169,10 +168,8 @@ static int proc_taint(struct ctl_table *table, int write,
+@@ -169,10 +168,13 @@ static int proc_taint(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos);
#endif
@@ -68378,10 +69289,15 @@ index 4ab1187..0b75ced 100644
static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos);
-#endif
++
++static int proc_dointvec_minmax_coredump(struct ctl_table *table, int write,
++ void __user *buffer, size_t *lenp, loff_t *ppos);
++static int proc_dostring_coredump(struct ctl_table *table, int write,
++ void __user *buffer, size_t *lenp, loff_t *ppos);
#ifdef CONFIG_MAGIC_SYSRQ
/* Note: sysrq code uses it's own private copy */
-@@ -196,6 +193,8 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
+@@ -196,6 +198,8 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
#endif
@@ -68390,7 +69306,7 @@ index 4ab1187..0b75ced 100644
static struct ctl_table kern_table[];
static struct ctl_table vm_table[];
static struct ctl_table fs_table[];
-@@ -210,6 +209,20 @@ extern struct ctl_table epoll_table[];
+@@ -210,6 +214,20 @@ extern struct ctl_table epoll_table[];
int sysctl_legacy_va_layout;
#endif
@@ -68411,7 +69327,7 @@ index 4ab1187..0b75ced 100644
/* The default sysctl tables: */
static struct ctl_table sysctl_base_table[] = {
-@@ -256,6 +269,22 @@ static int max_extfrag_threshold = 1000;
+@@ -256,6 +274,22 @@ static int max_extfrag_threshold = 1000;
#endif
static struct ctl_table kern_table[] = {
@@ -68434,7 +69350,16 @@ index 4ab1187..0b75ced 100644
{
.procname = "sched_child_runs_first",
.data = &sysctl_sched_child_runs_first,
-@@ -540,7 +569,7 @@ static struct ctl_table kern_table[] = {
+@@ -410,7 +444,7 @@ static struct ctl_table kern_table[] = {
+ .data = core_pattern,
+ .maxlen = CORENAME_MAX_SIZE,
+ .mode = 0644,
+- .proc_handler = proc_dostring,
++ .proc_handler = proc_dostring_coredump,
+ },
+ {
+ .procname = "core_pipe_limit",
+@@ -540,7 +574,7 @@ static struct ctl_table kern_table[] = {
.data = &modprobe_path,
.maxlen = KMOD_PATH_LEN,
.mode = 0644,
@@ -68443,7 +69368,7 @@ index 4ab1187..0b75ced 100644
},
{
.procname = "modules_disabled",
-@@ -707,16 +736,20 @@ static struct ctl_table kern_table[] = {
+@@ -707,16 +741,20 @@ static struct ctl_table kern_table[] = {
.extra1 = &zero,
.extra2 = &one,
},
@@ -68465,7 +69390,7 @@ index 4ab1187..0b75ced 100644
{
.procname = "ngroups_max",
.data = &ngroups_max,
-@@ -1215,6 +1248,13 @@ static struct ctl_table vm_table[] = {
+@@ -1215,6 +1253,13 @@ static struct ctl_table vm_table[] = {
.proc_handler = proc_dointvec_minmax,
.extra1 = &zero,
},
@@ -68479,7 +69404,16 @@ index 4ab1187..0b75ced 100644
#else
{
.procname = "nr_trim_pages",
-@@ -1645,6 +1685,16 @@ int proc_dostring(struct ctl_table *table, int write,
+@@ -1498,7 +1543,7 @@ static struct ctl_table fs_table[] = {
+ .data = &suid_dumpable,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec_minmax,
++ .proc_handler = proc_dointvec_minmax_coredump,
+ .extra1 = &zero,
+ .extra2 = &two,
+ },
+@@ -1645,6 +1690,16 @@ int proc_dostring(struct ctl_table *table, int write,
buffer, lenp, ppos);
}
@@ -68496,7 +69430,7 @@ index 4ab1187..0b75ced 100644
static size_t proc_skip_spaces(char **buf)
{
size_t ret;
-@@ -1750,6 +1800,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
+@@ -1750,6 +1805,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
len = strlen(tmp);
if (len > *size)
len = *size;
@@ -68505,7 +69439,7 @@ index 4ab1187..0b75ced 100644
if (copy_to_user(*buf, tmp, len))
return -EFAULT;
*size -= len;
-@@ -1942,7 +1994,6 @@ static int proc_taint(struct ctl_table *table, int write,
+@@ -1942,7 +1999,6 @@ static int proc_taint(struct ctl_table *table, int write,
return err;
}
@@ -68513,7 +69447,7 @@ index 4ab1187..0b75ced 100644
static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
{
-@@ -1951,7 +2002,6 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
+@@ -1951,7 +2007,6 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
}
@@ -68521,7 +69455,42 @@ index 4ab1187..0b75ced 100644
struct do_proc_dointvec_minmax_conv_param {
int *min;
-@@ -2066,8 +2116,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
+@@ -2009,6 +2064,34 @@ int proc_dointvec_minmax(struct ctl_table *table, int write,
+ do_proc_dointvec_minmax_conv, &param);
+ }
+
++static void validate_coredump_safety(void)
++{
++ if (suid_dumpable == SUID_DUMPABLE_SAFE &&
++ core_pattern[0] != '/' && core_pattern[0] != '|') {
++ printk(KERN_WARNING "Unsafe core_pattern used with "\
++ "suid_dumpable=2. Pipe handler or fully qualified "\
++ "core dump path required.\n");
++ }
++}
++
++static int proc_dointvec_minmax_coredump(struct ctl_table *table, int write,
++ void __user *buffer, size_t *lenp, loff_t *ppos)
++{
++ int error = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
++ if (!error)
++ validate_coredump_safety();
++ return error;
++}
++
++static int proc_dostring_coredump(struct ctl_table *table, int write,
++ void __user *buffer, size_t *lenp, loff_t *ppos)
++{
++ int error = proc_dostring(table, write, buffer, lenp, ppos);
++ if (!error)
++ validate_coredump_safety();
++ return error;
++}
++
+ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int write,
+ void __user *buffer,
+ size_t *lenp, loff_t *ppos,
+@@ -2066,8 +2149,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
*i = val;
} else {
val = convdiv * (*i) / convmul;
@@ -68534,7 +69503,7 @@ index 4ab1187..0b75ced 100644
err = proc_put_long(&buffer, &left, val, false);
if (err)
break;
-@@ -2459,6 +2512,12 @@ int proc_dostring(struct ctl_table *table, int write,
+@@ -2459,6 +2545,12 @@ int proc_dostring(struct ctl_table *table, int write,
return -ENOSYS;
}
@@ -68547,7 +69516,7 @@ index 4ab1187..0b75ced 100644
int proc_dointvec(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
{
-@@ -2515,5 +2574,6 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
+@@ -2515,5 +2607,6 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
EXPORT_SYMBOL(proc_dostring);
@@ -68691,7 +69660,7 @@ index f113755..ec24223 100644
cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
tick_broadcast_clear_oneshot(cpu);
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index d42574df..247414c 100644
+index 7c50de8..e29a94d 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -14,6 +14,7 @@
@@ -68702,7 +69671,7 @@ index d42574df..247414c 100644
#include <linux/syscore_ops.h>
#include <linux/clocksource.h>
#include <linux/jiffies.h>
-@@ -373,6 +374,8 @@ int do_settimeofday(const struct timespec *tv)
+@@ -388,6 +389,8 @@ int do_settimeofday(const struct timespec *tv)
if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
return -EINVAL;
@@ -69319,7 +70288,7 @@ index 3ac50dc..240bb7e 100644
static inline void *ptr_to_indirect(void *ptr)
{
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
-index abbabec..362988d 100644
+index abbabec..6779788 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -16,6 +16,9 @@
@@ -69391,7 +70360,44 @@ index abbabec..362988d 100644
case 'B':
return symbol_string(buf, end, ptr, spec, *fmt);
case 'R':
-@@ -1653,11 +1669,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
+@@ -920,12 +936,15 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
+ va_end(va);
+ return buf;
+ }
++ case 'P':
++ break;
+ case 'K':
+ /*
+ * %pK cannot be used in IRQ context because its test
+ * for CAP_SYSLOG would be meaningless.
+ */
+- if (in_irq() || in_serving_softirq() || in_nmi()) {
++ if (kptr_restrict && (in_irq() || in_serving_softirq() ||
++ in_nmi())) {
+ if (spec.field_width == -1)
+ spec.field_width = 2 * sizeof(void *);
+ return string(buf, end, "pK-error", spec);
+@@ -942,6 +961,19 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
+ }
+ break;
+ }
++
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ /* 'P' = approved pointers to copy to userland,
++ as in the /proc/kallsyms case, as we make it display nothing
++ for non-root users, and the real contents for root users
++ */
++ if (ptr > TASK_SIZE && *fmt != 'P' && is_usercopy_object(buf)) {
++ printk(KERN_ALERT "grsec: kernel infoleak detected! Please report this log to spender@grsecurity.net.\n");
++ dump_stack();
++ ptr = NULL;
++ }
++#endif
++
+ spec.flags |= SMALL;
+ if (spec.field_width == -1) {
+ spec.field_width = 2 * sizeof(void *);
+@@ -1653,11 +1685,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
typeof(type) value; \
if (sizeof(type) == 8) { \
args = PTR_ALIGN(args, sizeof(u32)); \
@@ -69406,7 +70412,7 @@ index abbabec..362988d 100644
} \
args += sizeof(type); \
value; \
-@@ -1720,7 +1736,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
+@@ -1720,7 +1752,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
case FORMAT_TYPE_STR: {
const char *str_arg = args;
args += strlen(str_arg) + 1;
@@ -69529,10 +70535,10 @@ index f0e5306..cb9398e 100644
/* if an huge pmd materialized from under us just retry later */
if (unlikely(pmd_trans_huge(*pmd)))
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 263e177..3f36aec 100644
+index a799df5..a987032 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
-@@ -2446,6 +2446,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2462,6 +2462,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
return 1;
}
@@ -69560,7 +70566,7 @@ index 263e177..3f36aec 100644
/*
* Hugetlb_cow() should be called with page lock of the original hugepage held.
* Called with hugetlb_instantiation_mutex held and pte_page locked so we
-@@ -2558,6 +2579,11 @@ retry_avoidcopy:
+@@ -2574,6 +2595,11 @@ retry_avoidcopy:
make_huge_pte(vma, new_page, 1));
page_remove_rmap(old_page);
hugepage_add_new_anon_rmap(new_page, vma, address);
@@ -69572,7 +70578,7 @@ index 263e177..3f36aec 100644
/* Make the old page be freed below */
new_page = old_page;
mmu_notifier_invalidate_range_end(mm,
-@@ -2712,6 +2738,10 @@ retry:
+@@ -2728,6 +2754,10 @@ retry:
&& (vma->vm_flags & VM_SHARED)));
set_huge_pte_at(mm, address, ptep, new_pte);
@@ -69583,7 +70589,7 @@ index 263e177..3f36aec 100644
if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
/* Optimization, do the COW without a second fault */
ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
-@@ -2741,6 +2771,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2757,6 +2787,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
static DEFINE_MUTEX(hugetlb_instantiation_mutex);
struct hstate *h = hstate_vma(vma);
@@ -69594,7 +70600,7 @@ index 263e177..3f36aec 100644
address &= huge_page_mask(h);
ptep = huge_pte_offset(mm, address);
-@@ -2754,6 +2788,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2770,6 +2804,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
VM_FAULT_SET_HINDEX(h - hstates);
}
@@ -69749,7 +70755,7 @@ index 55f645c..cde5320 100644
if (end == start)
goto out;
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
-index 97cc273..6ed703f 100644
+index 274c3cc..4836a70 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -61,7 +61,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0;
@@ -69770,7 +70776,7 @@ index 97cc273..6ed703f 100644
#ifdef __ARCH_SI_TRAPNO
si.si_trapno = trapno;
#endif
-@@ -1036,7 +1036,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
+@@ -1038,7 +1038,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
}
nr_pages = 1 << compound_trans_order(hpage);
@@ -69779,7 +70785,7 @@ index 97cc273..6ed703f 100644
/*
* We need/can do nothing about count=0 pages.
-@@ -1066,7 +1066,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
+@@ -1068,7 +1068,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
if (!PageHWPoison(hpage)
|| (hwpoison_filter(p) && TestClearPageHWPoison(p))
|| (p != hpage && TestSetPageHWPoison(hpage))) {
@@ -69788,7 +70794,7 @@ index 97cc273..6ed703f 100644
return 0;
}
set_page_hwpoison_huge_page(hpage);
-@@ -1124,7 +1124,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
+@@ -1126,7 +1126,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
}
if (hwpoison_filter(p)) {
if (TestClearPageHWPoison(p))
@@ -69797,7 +70803,7 @@ index 97cc273..6ed703f 100644
unlock_page(hpage);
put_page(hpage);
return 0;
-@@ -1319,7 +1319,7 @@ int unpoison_memory(unsigned long pfn)
+@@ -1321,7 +1321,7 @@ int unpoison_memory(unsigned long pfn)
return 0;
}
if (TestClearPageHWPoison(p))
@@ -69806,7 +70812,7 @@ index 97cc273..6ed703f 100644
pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn);
return 0;
}
-@@ -1333,7 +1333,7 @@ int unpoison_memory(unsigned long pfn)
+@@ -1335,7 +1335,7 @@ int unpoison_memory(unsigned long pfn)
*/
if (TestClearPageHWPoison(page)) {
pr_info("MCE: Software-unpoisoned page %#lx\n", pfn);
@@ -69815,7 +70821,7 @@ index 97cc273..6ed703f 100644
freeit = 1;
if (PageHuge(page))
clear_page_hwpoison_huge_page(page);
-@@ -1446,7 +1446,7 @@ static int soft_offline_huge_page(struct page *page, int flags)
+@@ -1448,7 +1448,7 @@ static int soft_offline_huge_page(struct page *page, int flags)
}
done:
if (!PageHWPoison(hpage))
@@ -69824,7 +70830,7 @@ index 97cc273..6ed703f 100644
set_page_hwpoison_huge_page(hpage);
dequeue_hwpoisoned_huge_page(hpage);
/* keep elevated page count for bad page */
-@@ -1577,7 +1577,7 @@ int soft_offline_page(struct page *page, int flags)
+@@ -1579,7 +1579,7 @@ int soft_offline_page(struct page *page, int flags)
return ret;
done:
@@ -70478,7 +71484,7 @@ index 6105f47..3363489 100644
return 0;
}
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index bf5b485..e44c2cb 100644
+index 9afcbad..bfa00c2 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -619,6 +619,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
@@ -70554,7 +71560,7 @@ index bf5b485..e44c2cb 100644
capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE);
diff --git a/mm/mlock.c b/mm/mlock.c
-index ef726e8..13e0901 100644
+index ef726e8..cd7f1ec 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -13,6 +13,7 @@
@@ -70565,6 +71571,15 @@ index ef726e8..13e0901 100644
#include <linux/sched.h>
#include <linux/export.h>
#include <linux/rmap.h>
+@@ -376,7 +377,7 @@ static int do_mlock(unsigned long start, size_t len, int on)
+ {
+ unsigned long nstart, end, tmp;
+ struct vm_area_struct * vma, * prev;
+- int error;
++ int error = 0;
+
+ VM_BUG_ON(start & ~PAGE_MASK);
+ VM_BUG_ON(len != PAGE_ALIGN(len));
@@ -385,6 +386,9 @@ static int do_mlock(unsigned long start, size_t len, int on)
return -EINVAL;
if (end == start)
@@ -72514,7 +73529,7 @@ index 9d65a02..7c877e7 100644
return -ENOMEM;
diff --git a/mm/slab.c b/mm/slab.c
-index e901a36..ee8fe97 100644
+index e901a36..9ff3f90 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -153,7 +153,7 @@
@@ -72568,16 +73583,36 @@ index e901a36..ee8fe97 100644
{
u32 offset = (obj - slab->s_mem);
return reciprocal_divide(offset, cache->reciprocal_buffer_size);
-@@ -568,7 +568,7 @@ struct cache_names {
+@@ -563,12 +563,13 @@ EXPORT_SYMBOL(malloc_sizes);
+ struct cache_names {
+ char *name;
+ char *name_dma;
++ char *name_usercopy;
+ };
+
static struct cache_names __initdata cache_names[] = {
- #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
+-#define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
++#define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)", .name_usercopy = "size-" #x "(USERCOPY)" },
#include <linux/kmalloc_sizes.h>
- {NULL,}
+ {NULL}
#undef CACHE
};
-@@ -1588,7 +1588,7 @@ void __init kmem_cache_init(void)
+@@ -756,6 +757,12 @@ static inline struct kmem_cache *__find_general_cachep(size_t size,
+ if (unlikely(gfpflags & GFP_DMA))
+ return csizep->cs_dmacachep;
+ #endif
++
++#ifdef CONFIG_PAX_USERCOPY_SLABS
++ if (unlikely(gfpflags & GFP_USERCOPY))
++ return csizep->cs_usercopycachep;
++#endif
++
+ return csizep->cs_cachep;
+ }
+
+@@ -1588,7 +1595,7 @@ void __init kmem_cache_init(void)
sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
sizes[INDEX_AC].cs_size,
ARCH_KMALLOC_MINALIGN,
@@ -72586,7 +73621,7 @@ index e901a36..ee8fe97 100644
NULL);
if (INDEX_AC != INDEX_L3) {
-@@ -1596,7 +1596,7 @@ void __init kmem_cache_init(void)
+@@ -1596,7 +1603,7 @@ void __init kmem_cache_init(void)
kmem_cache_create(names[INDEX_L3].name,
sizes[INDEX_L3].cs_size,
ARCH_KMALLOC_MINALIGN,
@@ -72595,7 +73630,7 @@ index e901a36..ee8fe97 100644
NULL);
}
-@@ -1614,7 +1614,7 @@ void __init kmem_cache_init(void)
+@@ -1614,7 +1621,7 @@ void __init kmem_cache_init(void)
sizes->cs_cachep = kmem_cache_create(names->name,
sizes->cs_size,
ARCH_KMALLOC_MINALIGN,
@@ -72604,7 +73639,24 @@ index e901a36..ee8fe97 100644
NULL);
}
#ifdef CONFIG_ZONE_DMA
-@@ -4390,10 +4390,10 @@ static int s_show(struct seq_file *m, void *p)
+@@ -1626,6 +1633,16 @@ void __init kmem_cache_init(void)
+ SLAB_PANIC,
+ NULL);
+ #endif
++
++#ifdef CONFIG_PAX_USERCOPY_SLABS
++ sizes->cs_usercopycachep = kmem_cache_create(
++ names->name_usercopy,
++ sizes->cs_size,
++ ARCH_KMALLOC_MINALIGN,
++ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
++ NULL);
++#endif
++
+ sizes++;
+ names++;
+ }
+@@ -4390,10 +4407,10 @@ static int s_show(struct seq_file *m, void *p)
}
/* cpu stats */
{
@@ -72619,7 +73671,7 @@ index e901a36..ee8fe97 100644
seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
allochit, allocmiss, freehit, freemiss);
-@@ -4652,13 +4652,62 @@ static int __init slab_proc_init(void)
+@@ -4652,13 +4669,71 @@ static int __init slab_proc_init(void)
{
proc_create("slabinfo",S_IWUSR|S_IRUSR,NULL,&proc_slabinfo_operations);
#ifdef CONFIG_DEBUG_SLAB_LEAK
@@ -72631,60 +73683,69 @@ index e901a36..ee8fe97 100644
module_init(slab_proc_init);
#endif
-+void check_object_size(const void *ptr, unsigned long n, bool to)
++bool is_usercopy_object(const void *ptr)
+{
++ struct page *page;
++ struct kmem_cache *cachep;
++
++ if (ZERO_OR_NULL_PTR(ptr))
++ return false;
++
++ if (!slab_is_available())
++ return false;
++
++ if (!virt_addr_valid(ptr))
++ return false;
++
++ page = virt_to_head_page(ptr);
++
++ if (!PageSlab(page))
++ return false;
++
++ cachep = page_get_cache(page);
++ return cachep->flags & SLAB_USERCOPY;
++}
+
+#ifdef CONFIG_PAX_USERCOPY
++const char *check_heap_object(const void *ptr, unsigned long n, bool to)
++{
+ struct page *page;
-+ struct kmem_cache *cachep = NULL;
++ struct kmem_cache *cachep;
+ struct slab *slabp;
+ unsigned int objnr;
+ unsigned long offset;
-+ const char *type;
+
-+ if (!n)
-+ return;
-+
-+ type = "<null>";
+ if (ZERO_OR_NULL_PTR(ptr))
-+ goto report;
++ return "<null>";
+
+ if (!virt_addr_valid(ptr))
-+ return;
++ return NULL;
+
+ page = virt_to_head_page(ptr);
+
-+ type = "<process stack>";
-+ if (!PageSlab(page)) {
-+ if (object_is_on_stack(ptr, n) == -1)
-+ goto report;
-+ return;
-+ }
++ if (!PageSlab(page))
++ return NULL;
+
+ cachep = page_get_cache(page);
-+ type = cachep->name;
+ if (!(cachep->flags & SLAB_USERCOPY))
-+ goto report;
++ return cachep->name;
+
+ slabp = page_get_slab(page);
+ objnr = obj_to_index(cachep, slabp, ptr);
+ BUG_ON(objnr >= cachep->num);
+ offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
+ if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
-+ return;
-+
-+report:
-+ pax_report_usercopy(ptr, n, to, type);
-+#endif
++ return NULL;
+
++ return cachep->name;
+}
-+EXPORT_SYMBOL(check_object_size);
++#endif
+
/**
* ksize - get the actual amount of memory allocated for a given object
* @objp: Pointer to the object
diff --git a/mm/slob.c b/mm/slob.c
-index 8105be4..e045f96 100644
+index 8105be4..33e52d7 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -29,7 +29,7 @@
@@ -72704,17 +73765,18 @@ index 8105be4..e045f96 100644
#include <linux/slab.h>
#include <linux/mm.h>
#include <linux/swap.h> /* struct reclaim_state */
-@@ -102,7 +103,8 @@ struct slob_page {
+@@ -100,9 +101,8 @@ struct slob_page {
+ union {
+ struct {
unsigned long flags; /* mandatory */
- atomic_t _count; /* mandatory */
+- atomic_t _count; /* mandatory */
slobidx_t units; /* free units left in page */
- unsigned long pad[2];
-+ unsigned long pad[1];
+ unsigned long size; /* size when >=PAGE_SIZE */
slob_t *free; /* first free slob_t in page */
struct list_head list; /* linked list of free pages */
};
-@@ -135,7 +137,7 @@ static LIST_HEAD(free_slob_large);
+@@ -135,7 +135,7 @@ static LIST_HEAD(free_slob_large);
*/
static inline int is_slob_page(struct slob_page *sp)
{
@@ -72723,7 +73785,7 @@ index 8105be4..e045f96 100644
}
static inline void set_slob_page(struct slob_page *sp)
-@@ -150,7 +152,7 @@ static inline void clear_slob_page(struct slob_page *sp)
+@@ -150,7 +150,7 @@ static inline void clear_slob_page(struct slob_page *sp)
static inline struct slob_page *slob_page(const void *addr)
{
@@ -72732,7 +73794,7 @@ index 8105be4..e045f96 100644
}
/*
-@@ -210,7 +212,7 @@ static void set_slob(slob_t *s, slobidx_t size, slob_t *next)
+@@ -210,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_t size, slob_t *next)
/*
* Return the size of a slob block.
*/
@@ -72741,7 +73803,7 @@ index 8105be4..e045f96 100644
{
if (s->units > 0)
return s->units;
-@@ -220,7 +222,7 @@ static slobidx_t slob_units(slob_t *s)
+@@ -220,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
/*
* Return the next free slob block pointer after this one.
*/
@@ -72750,7 +73812,7 @@ index 8105be4..e045f96 100644
{
slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
slobidx_t next;
-@@ -235,7 +237,7 @@ static slob_t *slob_next(slob_t *s)
+@@ -235,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
/*
* Returns true if s is the last free block in its page.
*/
@@ -72759,7 +73821,7 @@ index 8105be4..e045f96 100644
{
return !((unsigned long)slob_next(s) & ~PAGE_MASK);
}
-@@ -254,6 +256,7 @@ static void *slob_new_pages(gfp_t gfp, int order, int node)
+@@ -254,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, int order, int node)
if (!page)
return NULL;
@@ -72767,7 +73829,7 @@ index 8105be4..e045f96 100644
return page_address(page);
}
-@@ -370,11 +373,11 @@ static void *slob_alloc(size_t size, gfp_t gfp, int align, int node)
+@@ -370,11 +371,11 @@ static void *slob_alloc(size_t size, gfp_t gfp, int align, int node)
if (!b)
return NULL;
sp = slob_page(b);
@@ -72780,7 +73842,7 @@ index 8105be4..e045f96 100644
INIT_LIST_HEAD(&sp->list);
set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
set_slob_page_free(sp, slob_list);
-@@ -476,10 +479,9 @@ out:
+@@ -476,10 +477,9 @@ out:
* End of slob allocator proper. Begin kmem_cache_alloc and kmalloc frontend.
*/
@@ -72793,7 +73855,7 @@ index 8105be4..e045f96 100644
void *ret;
gfp &= gfp_allowed_mask;
-@@ -494,7 +496,10 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
+@@ -494,7 +494,10 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
if (!m)
return NULL;
@@ -72805,7 +73867,7 @@ index 8105be4..e045f96 100644
ret = (void *)m + align;
trace_kmalloc_node(_RET_IP_, ret,
-@@ -506,16 +511,25 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
+@@ -506,16 +509,25 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
gfp |= __GFP_COMP;
ret = slob_new_pages(gfp, order, node);
if (ret) {
@@ -72835,7 +73897,7 @@ index 8105be4..e045f96 100644
return ret;
}
EXPORT_SYMBOL(__kmalloc_node);
-@@ -533,13 +547,92 @@ void kfree(const void *block)
+@@ -533,13 +545,88 @@ void kfree(const void *block)
sp = slob_page(block);
if (is_slob_page(sp)) {
int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
@@ -72853,40 +73915,39 @@ index 8105be4..e045f96 100644
}
EXPORT_SYMBOL(kfree);
-+void check_object_size(const void *ptr, unsigned long n, bool to)
++bool is_usercopy_object(const void *ptr)
+{
++ if (!slab_is_available())
++ return false;
++
++ // PAX: TODO
++
++ return false;
++}
+
+#ifdef CONFIG_PAX_USERCOPY
++const char *check_heap_object(const void *ptr, unsigned long n, bool to)
++{
+ struct slob_page *sp;
+ const slob_t *free;
+ const void *base;
+ unsigned long flags;
-+ const char *type;
+
-+ if (!n)
-+ return;
-+
-+ type = "<null>";
+ if (ZERO_OR_NULL_PTR(ptr))
-+ goto report;
++ return "<null>";
+
+ if (!virt_addr_valid(ptr))
-+ return;
++ return NULL;
+
-+ type = "<process stack>";
+ sp = slob_page(ptr);
-+ if (!PageSlab((struct page *)sp)) {
-+ if (object_is_on_stack(ptr, n) == -1)
-+ goto report;
-+ return;
-+ }
++ if (!PageSlab((struct page *)sp))
++ return NULL;
+
-+ type = "<slob>";
+ if (sp->size) {
+ base = page_address(&sp->page);
+ if (base <= ptr && n <= sp->size - (ptr - base))
-+ return;
-+ goto report;
++ return NULL;
++ return "<slob>";
+ }
+
+ /* some tricky double walking to find the chunk */
@@ -72894,7 +73955,7 @@ index 8105be4..e045f96 100644
+ base = (void *)((unsigned long)ptr & PAGE_MASK);
+ free = sp->free;
+
-+ while (!slob_last(free) && (void *)free <= ptr) {
++ while ((void *)free <= ptr) {
+ base = free + slob_units(free);
+ free = slob_next(free);
+ }
@@ -72917,21 +73978,18 @@ index 8105be4..e045f96 100644
+ break;
+
+ spin_unlock_irqrestore(&slob_lock, flags);
-+ return;
++ return NULL;
+ }
+
+ spin_unlock_irqrestore(&slob_lock, flags);
-+report:
-+ pax_report_usercopy(ptr, n, to, type);
-+#endif
-+
++ return "<slob>";
+}
-+EXPORT_SYMBOL(check_object_size);
++#endif
+
/* can't use ksize for kmem_cache_alloc memory, only kmalloc */
size_t ksize(const void *block)
{
-@@ -552,10 +645,10 @@ size_t ksize(const void *block)
+@@ -552,10 +639,10 @@ size_t ksize(const void *block)
sp = slob_page(block);
if (is_slob_page(sp)) {
int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
@@ -72945,11 +74003,11 @@ index 8105be4..e045f96 100644
}
EXPORT_SYMBOL(ksize);
-@@ -571,8 +664,13 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+@@ -571,8 +658,13 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
{
struct kmem_cache *c;
-+#ifdef CONFIG_PAX_USERCOPY
++#ifdef CONFIG_PAX_USERCOPY_SLABS
+ c = __kmalloc_node_align(sizeof(struct kmem_cache),
+ GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
+#else
@@ -72959,11 +74017,11 @@ index 8105be4..e045f96 100644
if (c) {
c->name = name;
-@@ -614,17 +712,25 @@ void *kmem_cache_alloc_node(struct kmem_cache *c, gfp_t flags, int node)
+@@ -614,17 +706,25 @@ void *kmem_cache_alloc_node(struct kmem_cache *c, gfp_t flags, int node)
lockdep_trace_alloc(flags);
-+#ifdef CONFIG_PAX_USERCOPY
++#ifdef CONFIG_PAX_USERCOPY_SLABS
+ b = __kmalloc_node_align(c->size, flags, node, c->align);
+#else
if (c->size < PAGE_SIZE) {
@@ -72985,7 +74043,7 @@ index 8105be4..e045f96 100644
if (c->ctor)
c->ctor(b);
-@@ -636,10 +742,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
+@@ -636,10 +736,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
static void __kmem_cache_free(void *b, int size)
{
@@ -73004,13 +74062,13 @@ index 8105be4..e045f96 100644
}
static void kmem_rcu_free(struct rcu_head *head)
-@@ -652,17 +764,31 @@ static void kmem_rcu_free(struct rcu_head *head)
+@@ -652,17 +758,31 @@ static void kmem_rcu_free(struct rcu_head *head)
void kmem_cache_free(struct kmem_cache *c, void *b)
{
+ int size = c->size;
+
-+#ifdef CONFIG_PAX_USERCOPY
++#ifdef CONFIG_PAX_USERCOPY_SLABS
+ if (size + c->align < PAGE_SIZE) {
+ size += c->align;
+ b -= c->align;
@@ -73030,7 +74088,7 @@ index 8105be4..e045f96 100644
+ __kmem_cache_free(b, size);
}
-+#ifdef CONFIG_PAX_USERCOPY
++#ifdef CONFIG_PAX_USERCOPY_SLABS
+ trace_kfree(_RET_IP_, b);
+#else
trace_kmem_cache_free(_RET_IP_, b);
@@ -73040,7 +74098,7 @@ index 8105be4..e045f96 100644
EXPORT_SYMBOL(kmem_cache_free);
diff --git a/mm/slub.c b/mm/slub.c
-index 71de9b5..dd263c5 100644
+index 71de9b5..51f97c9 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -209,7 +209,7 @@ struct track {
@@ -73098,58 +74156,92 @@ index 71de9b5..dd263c5 100644
list_del(&s->list);
up_write(&slub_lock);
if (kmem_cache_close(s)) {
-@@ -3405,6 +3406,50 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
+@@ -3223,6 +3224,10 @@ static struct kmem_cache *kmem_cache;
+ static struct kmem_cache *kmalloc_dma_caches[SLUB_PAGE_SHIFT];
+ #endif
+
++#ifdef CONFIG_PAX_USERCOPY_SLABS
++static struct kmem_cache *kmalloc_usercopy_caches[SLUB_PAGE_SHIFT];
++#endif
++
+ static int __init setup_slub_min_order(char *str)
+ {
+ get_option(&str, &slub_min_order);
+@@ -3337,6 +3342,13 @@ static struct kmem_cache *get_slab(size_t size, gfp_t flags)
+ return kmalloc_dma_caches[index];
+
+ #endif
++
++#ifdef CONFIG_PAX_USERCOPY_SLABS
++ if (flags & SLAB_USERCOPY)
++ return kmalloc_usercopy_caches[index];
++
++#endif
++
+ return kmalloc_caches[index];
+ }
+
+@@ -3405,6 +3417,59 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
EXPORT_SYMBOL(__kmalloc_node);
#endif
-+void check_object_size(const void *ptr, unsigned long n, bool to)
++bool is_usercopy_object(const void *ptr)
+{
++ struct page *page;
++ struct kmem_cache *s;
++
++ if (ZERO_OR_NULL_PTR(ptr))
++ return false;
++
++ if (!slab_is_available())
++ return false;
++
++ if (!virt_addr_valid(ptr))
++ return false;
++
++ page = virt_to_head_page(ptr);
++
++ if (!PageSlab(page))
++ return false;
++
++ s = page->slab;
++ return s->flags & SLAB_USERCOPY;
++}
+
+#ifdef CONFIG_PAX_USERCOPY
++const char *check_heap_object(const void *ptr, unsigned long n, bool to)
++{
+ struct page *page;
-+ struct kmem_cache *s = NULL;
++ struct kmem_cache *s;
+ unsigned long offset;
-+ const char *type;
+
-+ if (!n)
-+ return;
-+
-+ type = "<null>";
+ if (ZERO_OR_NULL_PTR(ptr))
-+ goto report;
++ return "<null>";
+
+ if (!virt_addr_valid(ptr))
-+ return;
++ return NULL;
+
+ page = virt_to_head_page(ptr);
+
-+ type = "<process stack>";
-+ if (!PageSlab(page)) {
-+ if (object_is_on_stack(ptr, n) == -1)
-+ goto report;
-+ return;
-+ }
++ if (!PageSlab(page))
++ return NULL;
+
+ s = page->slab;
-+ type = s->name;
+ if (!(s->flags & SLAB_USERCOPY))
-+ goto report;
++ return s->name;
+
+ offset = (ptr - page_address(page)) % s->size;
+ if (offset <= s->objsize && n <= s->objsize - offset)
-+ return;
-+
-+report:
-+ pax_report_usercopy(ptr, n, to, type);
-+#endif
++ return NULL;
+
++ return s->name;
+}
-+EXPORT_SYMBOL(check_object_size);
++#endif
+
size_t ksize(const void *object)
{
struct page *page;
-@@ -3679,7 +3724,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
+@@ -3679,7 +3744,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
int node;
list_add(&s->list, &slab_caches);
@@ -73158,7 +74250,7 @@ index 71de9b5..dd263c5 100644
for_each_node_state(node, N_NORMAL_MEMORY) {
struct kmem_cache_node *n = get_node(s, node);
-@@ -3799,17 +3844,17 @@ void __init kmem_cache_init(void)
+@@ -3799,17 +3864,17 @@ void __init kmem_cache_init(void)
/* Caches that are not of the two-to-the-power-of size */
if (KMALLOC_MIN_SIZE <= 32) {
@@ -73179,7 +74271,30 @@ index 71de9b5..dd263c5 100644
caches++;
}
-@@ -3877,7 +3922,7 @@ static int slab_unmergeable(struct kmem_cache *s)
+@@ -3851,6 +3916,22 @@ void __init kmem_cache_init(void)
+ }
+ }
+ #endif
++
++#ifdef CONFIG_PAX_USERCOPY_SLABS
++ for (i = 0; i < SLUB_PAGE_SHIFT; i++) {
++ struct kmem_cache *s = kmalloc_caches[i];
++
++ if (s && s->size) {
++ char *name = kasprintf(GFP_NOWAIT,
++ "usercopy-kmalloc-%d", s->objsize);
++
++ BUG_ON(!name);
++ kmalloc_usercopy_caches[i] = create_kmalloc_cache(name,
++ s->objsize, SLAB_USERCOPY);
++ }
++ }
++#endif
++
+ printk(KERN_INFO
+ "SLUB: Genslabs=%d, HWalign=%d, Order=%d-%d, MinObjects=%d,"
+ " CPUs=%d, Nodes=%d\n",
+@@ -3877,7 +3958,7 @@ static int slab_unmergeable(struct kmem_cache *s)
/*
* We may have set a slab to be unmergeable during bootstrap.
*/
@@ -73188,7 +74303,7 @@ index 71de9b5..dd263c5 100644
return 1;
return 0;
-@@ -3936,7 +3981,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+@@ -3936,7 +4017,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
down_write(&slub_lock);
s = find_mergeable(size, align, flags, name, ctor);
if (s) {
@@ -73197,7 +74312,7 @@ index 71de9b5..dd263c5 100644
/*
* Adjust the object sizes so that we clear
* the complete object on kzalloc.
-@@ -3945,7 +3990,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+@@ -3945,7 +4026,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
if (sysfs_slab_alias(s, name)) {
@@ -73206,7 +74321,7 @@ index 71de9b5..dd263c5 100644
goto err;
}
up_write(&slub_lock);
-@@ -4074,7 +4119,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
+@@ -4074,7 +4155,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
}
#endif
@@ -73215,7 +74330,7 @@ index 71de9b5..dd263c5 100644
static int count_inuse(struct page *page)
{
return page->inuse;
-@@ -4461,12 +4506,12 @@ static void resiliency_test(void)
+@@ -4461,12 +4542,12 @@ static void resiliency_test(void)
validate_slab_cache(kmalloc_caches[9]);
}
#else
@@ -73230,7 +74345,7 @@ index 71de9b5..dd263c5 100644
enum slab_stat_type {
SL_ALL, /* All slabs */
SL_PARTIAL, /* Only partially allocated slabs */
-@@ -4709,7 +4754,7 @@ SLAB_ATTR_RO(ctor);
+@@ -4709,7 +4790,7 @@ SLAB_ATTR_RO(ctor);
static ssize_t aliases_show(struct kmem_cache *s, char *buf)
{
@@ -73239,7 +74354,7 @@ index 71de9b5..dd263c5 100644
}
SLAB_ATTR_RO(aliases);
-@@ -5280,6 +5325,7 @@ static char *create_unique_id(struct kmem_cache *s)
+@@ -5280,6 +5361,7 @@ static char *create_unique_id(struct kmem_cache *s)
return name;
}
@@ -73247,7 +74362,7 @@ index 71de9b5..dd263c5 100644
static int sysfs_slab_add(struct kmem_cache *s)
{
int err;
-@@ -5342,6 +5388,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
+@@ -5342,6 +5424,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
kobject_del(&s->kobj);
kobject_put(&s->kobj);
}
@@ -73255,7 +74370,7 @@ index 71de9b5..dd263c5 100644
/*
* Need to buffer aliases during bootup until sysfs becomes
-@@ -5355,6 +5402,7 @@ struct saved_alias {
+@@ -5355,6 +5438,7 @@ struct saved_alias {
static struct saved_alias *alias_list;
@@ -73263,7 +74378,7 @@ index 71de9b5..dd263c5 100644
static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
{
struct saved_alias *al;
-@@ -5377,6 +5425,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
+@@ -5377,6 +5461,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
alias_list = al;
return 0;
}
@@ -73383,7 +74498,7 @@ index ae962b3..0bba886 100644
mm->unmap_area = arch_unmap_area;
}
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
-index 1196c77..2e608e8 100644
+index 1196c77..fb1cca8 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
@@ -73507,17 +74622,17 @@ index 1196c77..2e608e8 100644
if (!pmd_none(*pmd)) {
pte_t *ptep, pte;
-@@ -332,6 +372,10 @@ static void purge_vmap_area_lazy(void);
+@@ -329,6 +369,10 @@ static void purge_vmap_area_lazy(void);
+ * Allocate a region of KVA of the specified size and alignment, within the
+ * vstart and vend.
+ */
++static __size_overflow(1) struct vmap_area *alloc_vmap_area(unsigned long size,
++ unsigned long align,
++ unsigned long vstart, unsigned long vend,
++ int node, gfp_t gfp_mask) __size_overflow(1);
static struct vmap_area *alloc_vmap_area(unsigned long size,
unsigned long align,
unsigned long vstart, unsigned long vend,
-+ int node, gfp_t gfp_mask) __size_overflow(1);
-+static struct vmap_area *alloc_vmap_area(unsigned long size,
-+ unsigned long align,
-+ unsigned long vstart, unsigned long vend,
- int node, gfp_t gfp_mask)
- {
- struct vmap_area *va;
@@ -1320,6 +1364,16 @@ static struct vm_struct *__get_vm_area_node(unsigned long size,
struct vm_struct *area;
@@ -73650,10 +74765,10 @@ index 7db1b9b..e9f6b07 100644
return 0;
}
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
-index efea35b..9c8dd0b 100644
+index cf4a49c..de3b32e 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
-@@ -554,8 +554,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg)
+@@ -557,8 +557,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg)
err = -EPERM;
if (!capable(CAP_NET_ADMIN))
break;
@@ -73900,10 +75015,10 @@ index 5238b6b..c9798ce 100644
hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
}
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
-index 6f9c25b..d19fd66 100644
+index 9a86759..f0951ea 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
-@@ -2466,8 +2466,10 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, voi
+@@ -2467,8 +2467,10 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, voi
break;
case L2CAP_CONF_RFC:
@@ -73916,7 +75031,7 @@ index 6f9c25b..d19fd66 100644
if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
rfc.mode != chan->mode)
-@@ -2585,8 +2587,10 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
+@@ -2586,8 +2588,10 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
switch (type) {
case L2CAP_CONF_RFC:
@@ -73999,7 +75114,7 @@ index 3d79b12..8de85fa 100644
diff --git a/net/compat.c b/net/compat.c
-index e055708..3f80795 100644
+index ae6d67a..95dbaf6 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -71,9 +71,9 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
@@ -74064,8 +75179,8 @@ index e055708..3f80795 100644
- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
+ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
struct compat_cmsghdr cmhdr;
- int cmlen;
-
+ struct compat_timeval ctv;
+ struct compat_timespec cts[3];
@@ -275,7 +275,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
@@ -74143,7 +75258,7 @@ index e4fbfd6..6a6ac94 100644
return err;
diff --git a/net/core/dev.c b/net/core/dev.c
-index 533c586..f78a55f 100644
+index c299416..8733baa 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1136,9 +1136,13 @@ void dev_load(struct net *net, const char *name)
@@ -74160,7 +75275,7 @@ index 533c586..f78a55f 100644
}
}
EXPORT_SYMBOL(dev_load);
-@@ -1602,7 +1606,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
+@@ -1603,7 +1607,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
{
if (skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY) {
if (skb_copy_ubufs(skb, GFP_ATOMIC)) {
@@ -74169,7 +75284,7 @@ index 533c586..f78a55f 100644
kfree_skb(skb);
return NET_RX_DROP;
}
-@@ -1612,7 +1616,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
+@@ -1613,7 +1617,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
nf_reset(skb);
if (unlikely(!is_skb_forwardable(dev, skb))) {
@@ -74178,7 +75293,7 @@ index 533c586..f78a55f 100644
kfree_skb(skb);
return NET_RX_DROP;
}
-@@ -2042,7 +2046,7 @@ static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
+@@ -2043,7 +2047,7 @@ static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
struct dev_gso_cb {
void (*destructor)(struct sk_buff *skb);
@@ -74187,7 +75302,7 @@ index 533c586..f78a55f 100644
#define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
-@@ -2877,7 +2881,7 @@ enqueue:
+@@ -2878,7 +2882,7 @@ enqueue:
local_irq_restore(flags);
@@ -74196,7 +75311,7 @@ index 533c586..f78a55f 100644
kfree_skb(skb);
return NET_RX_DROP;
}
-@@ -2949,7 +2953,7 @@ int netif_rx_ni(struct sk_buff *skb)
+@@ -2950,7 +2954,7 @@ int netif_rx_ni(struct sk_buff *skb)
}
EXPORT_SYMBOL(netif_rx_ni);
@@ -74205,7 +75320,7 @@ index 533c586..f78a55f 100644
{
struct softnet_data *sd = &__get_cpu_var(softnet_data);
-@@ -3237,7 +3241,7 @@ ncls:
+@@ -3238,7 +3242,7 @@ ncls:
if (pt_prev) {
ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
} else {
@@ -74214,7 +75329,7 @@ index 533c586..f78a55f 100644
kfree_skb(skb);
/* Jamal, now you will not able to escape explaining
* me how you were going to use this. :-)
-@@ -3797,7 +3801,7 @@ void netif_napi_del(struct napi_struct *napi)
+@@ -3798,7 +3802,7 @@ void netif_napi_del(struct napi_struct *napi)
}
EXPORT_SYMBOL(netif_napi_del);
@@ -74223,7 +75338,7 @@ index 533c586..f78a55f 100644
{
struct softnet_data *sd = &__get_cpu_var(softnet_data);
unsigned long time_limit = jiffies + 2;
-@@ -4267,8 +4271,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v)
+@@ -4268,8 +4272,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v)
else
seq_printf(seq, "%04x", ntohs(pt->type));
@@ -74237,7 +75352,7 @@ index 533c586..f78a55f 100644
}
return 0;
-@@ -5818,7 +5827,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
+@@ -5821,7 +5830,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
} else {
netdev_stats_to_stats64(storage, &dev->stats);
}
@@ -74309,7 +75424,7 @@ index 7e7aeb0..2a998cb 100644
m->msg_iov = iov;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index 90430b7..0032ec0 100644
+index 900fc61..90d0583 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -56,7 +56,7 @@ struct rtnl_link {
@@ -74770,6 +75885,19 @@ index 167ea10..4b15883 100644
if (peer->tcp_ts_stamp) {
ts = peer->tcp_ts;
tsage = get_seconds() - peer->tcp_ts_stamp;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 56a9c8d..82e01c0 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -4726,7 +4726,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
+ * simplifies code)
+ */
+ static void
+-tcp_collapse(struct sock *sk, struct sk_buff_head *list,
++__intentional_overflow(5,6) tcp_collapse(struct sock *sk, struct sk_buff_head *list,
+ struct sk_buff *head, struct sk_buff *tail,
+ u32 start, u32 end)
+ {
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 0cb86ce..8e7fda8 100644
--- a/net/ipv4/tcp_ipv4.c
@@ -75772,7 +76900,7 @@ index 00bdb1d..6725a48 100644
if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
cp->protocol == IPPROTO_SCTP) {
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
-index f558998..9cdff60 100644
+index f558998..7dfb054 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -788,7 +788,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
@@ -75784,7 +76912,30 @@ index f558998..9cdff60 100644
/* bind the service */
if (!dest->svc) {
-@@ -2028,7 +2028,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
+@@ -1521,11 +1521,12 @@ static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
+ {
+ struct net_device *dev = ptr;
+ struct net *net = dev_net(dev);
++ struct netns_ipvs *ipvs = net_ipvs(net);
+ struct ip_vs_service *svc;
+ struct ip_vs_dest *dest;
+ unsigned int idx;
+
+- if (event != NETDEV_UNREGISTER)
++ if (event != NETDEV_UNREGISTER || !ipvs)
+ return NOTIFY_DONE;
+ IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
+ EnterFunction(2);
+@@ -1551,7 +1552,7 @@ static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
+ }
+ }
+
+- list_for_each_entry(dest, &net_ipvs(net)->dest_trash, n_list) {
++ list_for_each_entry(dest, &ipvs->dest_trash, n_list) {
+ __ip_vs_dev_reset(dest, dev);
+ }
+ mutex_unlock(&__ip_vs_mutex);
+@@ -2028,7 +2029,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
" %-7s %-6d %-10d %-10d\n",
&dest->addr.in6,
ntohs(dest->port),
@@ -75793,7 +76944,7 @@ index f558998..9cdff60 100644
atomic_read(&dest->weight),
atomic_read(&dest->activeconns),
atomic_read(&dest->inactconns));
-@@ -2039,7 +2039,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
+@@ -2039,7 +2040,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
"%-7s %-6d %-10d %-10d\n",
ntohl(dest->addr.ip),
ntohs(dest->port),
@@ -75802,7 +76953,7 @@ index f558998..9cdff60 100644
atomic_read(&dest->weight),
atomic_read(&dest->activeconns),
atomic_read(&dest->inactconns));
-@@ -2509,7 +2509,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
+@@ -2509,7 +2510,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
entry.addr = dest->addr.ip;
entry.port = dest->port;
@@ -75811,7 +76962,7 @@ index f558998..9cdff60 100644
entry.weight = atomic_read(&dest->weight);
entry.u_threshold = dest->u_threshold;
entry.l_threshold = dest->l_threshold;
-@@ -3042,7 +3042,7 @@ static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
+@@ -3042,7 +3043,7 @@ static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
@@ -75864,6 +77015,33 @@ index 7fd66de..e6fb361 100644
goto out;
}
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 729f157..ac0fa7b 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1538,6 +1538,10 @@ err_proto:
+ #define UNCONFIRMED_NULLS_VAL ((1<<30)+0)
+ #define DYING_NULLS_VAL ((1<<30)+1)
+
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++static atomic_unchecked_t conntrack_cache_id = ATOMIC_INIT(0);
++#endif
++
+ static int nf_conntrack_init_net(struct net *net)
+ {
+ int ret;
+@@ -1551,7 +1555,11 @@ static int nf_conntrack_init_net(struct net *net)
+ goto err_stat;
+ }
+
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++ net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%08lx", atomic_inc_return_unchecked(&conntrack_cache_id));
++#else
+ net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net);
++#endif
+ if (!net->ct.slabname) {
+ ret = -ENOMEM;
+ goto err_slabname;
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 66b2c54..c7884e3 100644
--- a/net/netfilter/nfnetlink_log.c
@@ -76020,7 +77198,7 @@ index 06592d8..64860f6 100644
*uaddr_len = sizeof(struct sockaddr_ax25);
}
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 4f2c0df..f0ff342 100644
+index 4f2c0df..a1a00a5 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1687,7 +1687,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
@@ -76041,7 +77219,26 @@ index 4f2c0df..f0ff342 100644
spin_unlock(&sk->sk_receive_queue.lock);
drop_n_restore:
-@@ -3294,7 +3294,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -2641,6 +2641,7 @@ out:
+
+ static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
+ {
++ struct sock_extended_err ee;
+ struct sock_exterr_skb *serr;
+ struct sk_buff *skb, *skb2;
+ int copied, err;
+@@ -2662,8 +2663,9 @@ static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
+ sock_recv_timestamp(msg, sk, skb);
+
+ serr = SKB_EXT_ERR(skb);
++ ee = serr->ee;
+ put_cmsg(msg, SOL_PACKET, PACKET_TX_TIMESTAMP,
+- sizeof(serr->ee), &serr->ee);
++ sizeof ee, &ee);
+
+ msg->msg_flags |= MSG_ERRQUEUE;
+ err = copied;
+@@ -3294,7 +3296,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
case PACKET_HDRLEN:
if (len > sizeof(int))
len = sizeof(int);
@@ -76050,7 +77247,7 @@ index 4f2c0df..f0ff342 100644
return -EFAULT;
switch (val) {
case TPACKET_V1:
-@@ -3344,7 +3344,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3344,7 +3346,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
if (put_user(len, optlen))
return -EFAULT;
@@ -76259,6 +77456,27 @@ index 4503335..db566b4 100644
}
#endif
+diff --git a/net/rds/recv.c b/net/rds/recv.c
+index 5c6e9f1..9f0f17c 100644
+--- a/net/rds/recv.c
++++ b/net/rds/recv.c
+@@ -410,6 +410,8 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
+
+ rdsdebug("size %zu flags 0x%x timeo %ld\n", size, msg_flags, timeo);
+
++ msg->msg_namelen = 0;
++
+ if (msg_flags & MSG_OOB)
+ goto out;
+
+@@ -485,6 +487,7 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
+ sin->sin_port = inc->i_hdr.h_sport;
+ sin->sin_addr.s_addr = inc->i_saddr;
+ memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
++ msg->msg_namelen = sizeof(*sin);
+ }
+ break;
+ }
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index edac9ef..16bcb98 100644
--- a/net/rds/tcp.c
@@ -76560,10 +77778,10 @@ index 1e2eee8..ce3967e 100644
assoc->assoc_id,
assoc->sndbuf_used,
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 92ba71d..9a97902 100644
+index dba20d6..9352c05 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
-@@ -4569,7 +4569,7 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
+@@ -4577,7 +4577,7 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
if (space_left < addrlen)
return -ENOMEM;
@@ -76573,7 +77791,7 @@ index 92ba71d..9a97902 100644
to += addrlen;
cnt++;
diff --git a/net/socket.c b/net/socket.c
-index 851edcd..b786851 100644
+index 06ffa0f..aff61b1 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -88,6 +88,7 @@
@@ -76602,7 +77820,7 @@ index 851edcd..b786851 100644
static struct file_system_type sock_fs_type = {
.name = "sockfs",
-@@ -1207,6 +1210,8 @@ int __sock_create(struct net *net, int family, int type, int protocol,
+@@ -1210,6 +1213,8 @@ int __sock_create(struct net *net, int family, int type, int protocol,
return -EAFNOSUPPORT;
if (type < 0 || type >= SOCK_MAX)
return -EINVAL;
@@ -76611,7 +77829,7 @@ index 851edcd..b786851 100644
/* Compatibility.
-@@ -1339,6 +1344,16 @@ SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
+@@ -1342,6 +1347,16 @@ SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
@@ -76628,7 +77846,7 @@ index 851edcd..b786851 100644
retval = sock_create(family, type, protocol, &sock);
if (retval < 0)
goto out;
-@@ -1451,6 +1466,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
+@@ -1454,6 +1469,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
if (sock) {
err = move_addr_to_kernel(umyaddr, addrlen, &address);
if (err >= 0) {
@@ -76643,7 +77861,7 @@ index 851edcd..b786851 100644
err = security_socket_bind(sock,
(struct sockaddr *)&address,
addrlen);
-@@ -1459,6 +1482,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
+@@ -1462,6 +1485,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
(struct sockaddr *)
&address, addrlen);
}
@@ -76651,7 +77869,7 @@ index 851edcd..b786851 100644
fput_light(sock->file, fput_needed);
}
return err;
-@@ -1482,10 +1506,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, backlog)
+@@ -1485,10 +1509,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, backlog)
if ((unsigned)backlog > somaxconn)
backlog = somaxconn;
@@ -76672,7 +77890,7 @@ index 851edcd..b786851 100644
fput_light(sock->file, fput_needed);
}
return err;
-@@ -1529,6 +1563,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
+@@ -1532,6 +1566,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
newsock->type = sock->type;
newsock->ops = sock->ops;
@@ -76691,7 +77909,7 @@ index 851edcd..b786851 100644
/*
* We don't need try_module_get here, as the listening socket (sock)
* has the protocol module (sock->ops->owner) held.
-@@ -1567,6 +1613,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
+@@ -1570,6 +1616,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
fd_install(newfd, newfile);
err = newfd;
@@ -76700,7 +77918,7 @@ index 851edcd..b786851 100644
out_put:
fput_light(sock->file, fput_needed);
out:
-@@ -1599,6 +1647,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
+@@ -1602,6 +1650,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
int, addrlen)
{
struct socket *sock;
@@ -76708,7 +77926,7 @@ index 851edcd..b786851 100644
struct sockaddr_storage address;
int err, fput_needed;
-@@ -1609,6 +1658,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
+@@ -1612,6 +1661,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
if (err < 0)
goto out_put;
@@ -76726,7 +77944,7 @@ index 851edcd..b786851 100644
err =
security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
if (err)
-@@ -1966,7 +2026,7 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -1969,7 +2029,7 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
* checking falls down on this.
*/
if (copy_from_user(ctl_buf,
@@ -76735,7 +77953,7 @@ index 851edcd..b786851 100644
ctl_len))
goto out_freectl;
msg_sys->msg_control = ctl_buf;
-@@ -2136,7 +2196,7 @@ static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -2139,7 +2199,7 @@ static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
* kernel msghdr to use the kernel address space)
*/
@@ -76744,7 +77962,7 @@ index 851edcd..b786851 100644
uaddr_len = COMPAT_NAMELEN(msg);
if (MSG_CMSG_COMPAT & flags) {
err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
-@@ -2758,7 +2818,7 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2761,7 +2821,7 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
}
ifr = compat_alloc_user_space(buf_size);
@@ -76753,7 +77971,7 @@ index 851edcd..b786851 100644
if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
return -EFAULT;
-@@ -2782,12 +2842,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2785,12 +2845,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
offsetof(struct ethtool_rxnfc, fs.ring_cookie));
if (copy_in_user(rxnfc, compat_rxnfc,
@@ -76770,7 +77988,7 @@ index 851edcd..b786851 100644
copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
sizeof(rxnfc->rule_cnt)))
return -EFAULT;
-@@ -2799,12 +2859,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2802,12 +2862,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
if (convert_out) {
if (copy_in_user(compat_rxnfc, rxnfc,
@@ -76787,7 +78005,7 @@ index 851edcd..b786851 100644
copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
sizeof(rxnfc->rule_cnt)))
return -EFAULT;
-@@ -2874,7 +2934,7 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
+@@ -2877,7 +2937,7 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
old_fs = get_fs();
set_fs(KERNEL_DS);
err = dev_ioctl(net, cmd,
@@ -76796,7 +78014,7 @@ index 851edcd..b786851 100644
set_fs(old_fs);
return err;
-@@ -2983,7 +3043,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
+@@ -2986,7 +3046,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
old_fs = get_fs();
set_fs(KERNEL_DS);
@@ -76805,7 +78023,7 @@ index 851edcd..b786851 100644
set_fs(old_fs);
if (cmd == SIOCGIFMAP && !err) {
-@@ -3088,7 +3148,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
+@@ -3091,7 +3151,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
ret |= __get_user(rtdev, &(ur4->rt_dev));
if (rtdev) {
ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
@@ -76814,7 +78032,7 @@ index 851edcd..b786851 100644
devname[15] = 0;
} else
r4.rt_dev = NULL;
-@@ -3314,8 +3374,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
+@@ -3317,8 +3377,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
int __user *uoptlen;
int err;
@@ -76825,7 +78043,7 @@ index 851edcd..b786851 100644
set_fs(KERNEL_DS);
if (level == SOL_SOCKET)
-@@ -3335,7 +3395,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
+@@ -3338,7 +3398,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
char __user *uoptval;
int err;
@@ -76835,7 +78053,7 @@ index 851edcd..b786851 100644
set_fs(KERNEL_DS);
if (level == SOL_SOCKET)
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
-index 994cfea..5343b6b 100644
+index eda32ae..1c9fa7c 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -240,9 +240,9 @@ static int rpc_wait_bit_killable(void *word)
@@ -77175,7 +78393,7 @@ index d510353..26c8a32 100644
dput(path.dentry);
path.dentry = dentry;
diff --git a/net/wireless/core.h b/net/wireless/core.h
-index 3ac2dd0..fbe533e 100644
+index ce5597c..46d01db 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -27,7 +27,7 @@ struct cfg80211_registered_device {
@@ -77536,7 +78754,7 @@ index 44ddaa5..a3119bd 100644
sprintf(alias, "dmi*");
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index c4e7d15..4241aef 100644
+index c4e7d15..dad16c1 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -922,6 +922,7 @@ enum mismatch {
@@ -77578,12 +78796,12 @@ index c4e7d15..4241aef 100644
free(prl_to);
break;
+ case DATA_TO_TEXT:
-+/*
++#if 0
+ fprintf(stderr,
-+ "The variable %s references\n"
-+ "the %s %s%s%s\n",
-+ fromsym, to, sec2annotation(tosec), tosym, to_p);
-+*/
++ "The %s %s:%s references\n"
++ "the %s %s:%s%s\n",
++ from, fromsec, fromsym, to, tosec, tosym, to_p);
++#endif
+ break;
}
fprintf(stderr, "\n");
@@ -77682,10 +78900,10 @@ index 5c11312..72742b5 100644
write_hex_cnt = 0;
for (i = 0; i < logo_clutsize; i++) {
diff --git a/security/Kconfig b/security/Kconfig
-index ccc61f8..7244cf1 100644
+index ccc61f8..0759500 100644
--- a/security/Kconfig
+++ b/security/Kconfig
-@@ -4,6 +4,861 @@
+@@ -4,6 +4,876 @@
menu "Security options"
@@ -77710,10 +78928,14 @@ index ccc61f8..7244cf1 100644
+ bool
+ default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
+
++ config PAX_USERCOPY_SLABS
++ bool
++
+config GRKERNSEC
+ bool "Grsecurity"
+ select CRYPTO
+ select CRYPTO_SHA256
++ select PROC_FS
+ select STOP_MACHINE
+ help
+ If you say Y here, you will be able to configure many features
@@ -77944,13 +79166,12 @@ index ccc61f8..7244cf1 100644
+ has been deprecated in favour of PT_PAX_FLAGS and XATTR_PAX_FLAGS
+ support.
+
-+ If you have applications not marked by the PT_PAX_FLAGS ELF program
-+ header and you cannot use XATTR_PAX_FLAGS then you MUST enable this
-+ option otherwise they will not get any protection.
-+
+ Note that if you enable PT_PAX_FLAGS or XATTR_PAX_FLAGS marking
+ support as well, they will override the legacy EI_PAX marks.
+
++ If you enable none of the marking options then all applications
++ will run with PaX enabled on them by default.
++
+config PAX_PT_PAX_FLAGS
+ bool 'Use ELF program header marking'
+ default y if GRKERNSEC_CONFIG_AUTO
@@ -77963,15 +79184,14 @@ index ccc61f8..7244cf1 100644
+ integrated into the toolchain (the binutils patch is available
+ from http://pax.grsecurity.net).
+
-+ If you have applications not marked by the PT_PAX_FLAGS ELF program
-+ header then you MUST enable either XATTR_PAX_FLAGS or EI_PAX marking
-+ support otherwise they will not get any protection.
++ Note that if you enable the legacy EI_PAX marking support as well,
++ the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
+
+ If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
+ must make sure that the marks are the same if a binary has both marks.
+
-+ Note that if you enable the legacy EI_PAX marking support as well,
-+ the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
++ If you enable none of the marking options then all applications
++ will run with PaX enabled on them by default.
+
+config PAX_XATTR_PAX_FLAGS
+ bool 'Use filesystem extended attributes marking'
@@ -77996,15 +79216,14 @@ index ccc61f8..7244cf1 100644
+ isofs, udf, vfat) so copying files through such filesystems will
+ lose the extended attributes and these PaX markings.
+
-+ If you have applications not marked by the PT_PAX_FLAGS ELF program
-+ header then you MUST enable either XATTR_PAX_FLAGS or EI_PAX marking
-+ support otherwise they will not get any protection.
++ Note that if you enable the legacy EI_PAX marking support as well,
++ the EI_PAX marks will be overridden by the XATTR_PAX_FLAGS marks.
+
+ If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
+ must make sure that the marks are the same if a binary has both marks.
+
-+ Note that if you enable the legacy EI_PAX marking support as well,
-+ the EI_PAX marks will be overridden by the XATTR_PAX_FLAGS marks.
++ If you enable none of the marking options then all applications
++ will run with PaX enabled on them by default.
+
+choice
+ prompt 'MAC system integration'
@@ -78494,6 +79713,7 @@ index ccc61f8..7244cf1 100644
+ default y if GRKERNSEC_CONFIG_AUTO
+ depends on X86 || PPC || SPARC || ARM
+ depends on GRKERNSEC && (SLAB || SLUB || SLOB)
++ select PAX_USERCOPY_SLABS
+ help
+ By saying Y here the kernel will enforce the size of heap objects
+ when they are copied in either direction between the kernel and
@@ -78534,6 +79754,19 @@ index ccc61f8..7244cf1 100644
+ Homepage:
+ http://www.grsecurity.net/~ephox/overflow_plugin/
+
++config PAX_LATENT_ENTROPY
++ bool "Generate some entropy during boot"
++ default y if GRKERNSEC_CONFIG_AUTO
++ help
++ By saying Y here the kernel will instrument early boot code to
++ extract some entropy from both original and artificially created
++ program state. This will help especially embedded systems where
++ there is little 'natural' source of entropy normally. The cost
++ is some slowdown of the boot process.
++
++ Note that entropy extracted this way is not cryptographically
++ secure!
++
+endmenu
+
+endmenu
@@ -78547,7 +79780,7 @@ index ccc61f8..7244cf1 100644
config KEYS
bool "Enable access key retention support"
help
-@@ -169,7 +1024,7 @@ config INTEL_TXT
+@@ -169,7 +1039,7 @@ config INTEL_TXT
config LSM_MMAP_MIN_ADDR
int "Low address space for LSM to protect from user allocation"
depends on SECURITY && SECURITY_SELINUX
@@ -78740,7 +79973,7 @@ index f728728..6457a0c 100644
/*
diff --git a/security/security.c b/security/security.c
-index bf619ff..8179030 100644
+index bf619ff..cf3683f 100644
--- a/security/security.c
+++ b/security/security.c
@@ -20,6 +20,7 @@
@@ -78772,8 +80005,18 @@ index bf619ff..8179030 100644
}
/* Save user chosen LSM */
+@@ -123,7 +126,9 @@ int __init register_security(struct security_operations *ops)
+ if (security_ops != &default_security_ops)
+ return -EAGAIN;
+
++ pax_open_kernel();
+ security_ops = ops;
++ pax_close_kernel();
+
+ return 0;
+ }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
-index d85b793..a164832 100644
+index 5626222..891e275 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -95,8 +95,6 @@
@@ -79411,12 +80654,19 @@ index da5fa1a..113cd02 100644
int last_frame_number; /* stored frame number */
int last_delay; /* stored delay */
};
+diff --git a/tools/gcc/.gitignore b/tools/gcc/.gitignore
+new file mode 100644
+index 0000000..50f2f2f
+--- /dev/null
++++ b/tools/gcc/.gitignore
+@@ -0,0 +1 @@
++size_overflow_hash.h
diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
new file mode 100644
-index 0000000..f4f9986
+index 0000000..1d09b7e
--- /dev/null
+++ b/tools/gcc/Makefile
-@@ -0,0 +1,41 @@
+@@ -0,0 +1,43 @@
+#CC := gcc
+#PLUGIN_SOURCE_FILES := pax_plugin.c
+#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
@@ -79438,6 +80688,7 @@ index 0000000..f4f9986
+$(HOSTLIBS)-$(CONFIG_CHECKER_PLUGIN) += checker_plugin.so
+$(HOSTLIBS)-y += colorize_plugin.so
+$(HOSTLIBS)-$(CONFIG_PAX_SIZE_OVERFLOW) += size_overflow_plugin.so
++$(HOSTLIBS)-$(CONFIG_PAX_LATENT_ENTROPY) += latent_entropy_plugin.so
+
+always := $($(HOSTLIBS)-y)
+
@@ -79448,6 +80699,7 @@ index 0000000..f4f9986
+checker_plugin-objs := checker_plugin.o
+colorize_plugin-objs := colorize_plugin.o
+size_overflow_plugin-objs := size_overflow_plugin.o
++latent_entropy_plugin-objs := latent_entropy_plugin.o
+
+$(obj)/size_overflow_plugin.o: $(objtree)/$(obj)/size_overflow_hash.h
+
@@ -79637,7 +80889,7 @@ index 0000000..d41b5af
+}
diff --git a/tools/gcc/colorize_plugin.c b/tools/gcc/colorize_plugin.c
new file mode 100644
-index 0000000..7a5e311
+index 0000000..846aeb0
--- /dev/null
+++ b/tools/gcc/colorize_plugin.c
@@ -0,0 +1,148 @@
@@ -79775,7 +81027,7 @@ index 0000000..7a5e311
+ struct register_pass_info colorize_rearm_pass_info = {
+ .pass = &pass_ipa_colorize_rearm.pass,
+ .reference_pass_name = "*free_lang_data",
-+ .ref_pass_instance_number = 0,
++ .ref_pass_instance_number = 1,
+ .pos_op = PASS_POS_INSERT_AFTER
+ };
+
@@ -79791,7 +81043,7 @@ index 0000000..7a5e311
+}
diff --git a/tools/gcc/constify_plugin.c b/tools/gcc/constify_plugin.c
new file mode 100644
-index 0000000..89b7f56
+index 0000000..048d4ff
--- /dev/null
+++ b/tools/gcc/constify_plugin.c
@@ -0,0 +1,328 @@
@@ -80097,7 +81349,7 @@ index 0000000..89b7f56
+ struct register_pass_info local_variable_pass_info = {
+ .pass = &pass_local_variable.pass,
+ .reference_pass_name = "*referenced_vars",
-+ .ref_pass_instance_number = 0,
++ .ref_pass_instance_number = 1,
+ .pos_op = PASS_POS_INSERT_AFTER
+ };
+
@@ -80125,10 +81377,10 @@ index 0000000..89b7f56
+}
diff --git a/tools/gcc/generate_size_overflow_hash.sh b/tools/gcc/generate_size_overflow_hash.sh
new file mode 100644
-index 0000000..a0fe8b2
+index 0000000..7d66989
--- /dev/null
+++ b/tools/gcc/generate_size_overflow_hash.sh
-@@ -0,0 +1,94 @@
+@@ -0,0 +1,96 @@
+#!/bin/bash
+
+# This script generates the hash table (size_overflow_hash.h) for the size_overflow gcc plugin (size_overflow_plugin.c).
@@ -80176,9 +81428,10 @@ index 0000000..a0fe8b2
+
+ cat "$database" | while read data
+ do
-+ data_array=($data)
++ data_array=(${data// /?})
++ data_array=(${data_array[@]//+/ })
+ struct_hash_name="${data_array[0]}"
-+ funcn="${data_array[1]}"
++ funcn="${data_array[1]//\?/ }"
+ params="${data_array[2]}"
+ next="${data_array[5]}"
+
@@ -80202,9 +81455,10 @@ index 0000000..a0fe8b2
+
+create_array_elements () {
+ index=0
-+ grep -v "nohasharray" $database | sort -n -k 4 | while read data
++ grep -v "nohasharray" $database | sort -n -t '+' -k 4 | while read data
+ do
-+ data_array=($data)
++ data_array=(${data// /?})
++ data_array=(${data_array//+/ })
+ i="${data_array[3]}"
+ hash="${data_array[4]}"
+ while [[ $index -lt $i ]]
@@ -80225,7 +81479,7 @@ index 0000000..a0fe8b2
+exit 0
diff --git a/tools/gcc/kallocstat_plugin.c b/tools/gcc/kallocstat_plugin.c
new file mode 100644
-index 0000000..a5eabce
+index 0000000..a86e422
--- /dev/null
+++ b/tools/gcc/kallocstat_plugin.c
@@ -0,0 +1,167 @@
@@ -80382,7 +81636,7 @@ index 0000000..a5eabce
+ struct register_pass_info kallocstat_pass_info = {
+ .pass = &kallocstat_pass.pass,
+ .reference_pass_name = "ssa",
-+ .ref_pass_instance_number = 0,
++ .ref_pass_instance_number = 1,
+ .pos_op = PASS_POS_INSERT_AFTER
+ };
+
@@ -80398,7 +81652,7 @@ index 0000000..a5eabce
+}
diff --git a/tools/gcc/kernexec_plugin.c b/tools/gcc/kernexec_plugin.c
new file mode 100644
-index 0000000..d8a8da2
+index 0000000..98011fa
--- /dev/null
+++ b/tools/gcc/kernexec_plugin.c
@@ -0,0 +1,427 @@
@@ -80774,19 +82028,19 @@ index 0000000..d8a8da2
+ struct register_pass_info kernexec_reload_pass_info = {
+ .pass = &kernexec_reload_pass.pass,
+ .reference_pass_name = "ssa",
-+ .ref_pass_instance_number = 0,
++ .ref_pass_instance_number = 1,
+ .pos_op = PASS_POS_INSERT_AFTER
+ };
+ struct register_pass_info kernexec_fptr_pass_info = {
+ .pass = &kernexec_fptr_pass.pass,
+ .reference_pass_name = "ssa",
-+ .ref_pass_instance_number = 0,
++ .ref_pass_instance_number = 1,
+ .pos_op = PASS_POS_INSERT_AFTER
+ };
+ struct register_pass_info kernexec_retaddr_pass_info = {
+ .pass = &kernexec_retaddr_pass.pass,
+ .reference_pass_name = "pro_and_epilogue",
-+ .ref_pass_instance_number = 0,
++ .ref_pass_instance_number = 1,
+ .pos_op = PASS_POS_INSERT_AFTER
+ };
+
@@ -80829,12 +82083,313 @@ index 0000000..d8a8da2
+
+ return 0;
+}
+diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c
+new file mode 100644
+index 0000000..b8008f7
+--- /dev/null
++++ b/tools/gcc/latent_entropy_plugin.c
+@@ -0,0 +1,295 @@
++/*
++ * Copyright 2012 by the PaX Team <pageexec@freemail.hu>
++ * Licensed under the GPL v2
++ *
++ * Note: the choice of the license means that the compilation process is
++ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
++ * but for the kernel it doesn't matter since it doesn't link against
++ * any of the gcc libraries
++ *
++ * gcc plugin to help generate a little bit of entropy from program state,
++ * used during boot in the kernel
++ *
++ * TODO:
++ * - add ipa pass to identify not explicitly marked candidate functions
++ * - mix in more program state (function arguments/return values, loop variables, etc)
++ * - more instrumentation control via attribute parameters
++ *
++ * BUGS:
++ * - LTO needs -flto-partition=none for now
++ */
++#include "gcc-plugin.h"
++#include "config.h"
++#include "system.h"
++#include "coretypes.h"
++#include "tree.h"
++#include "tree-pass.h"
++#include "flags.h"
++#include "intl.h"
++#include "toplev.h"
++#include "plugin.h"
++//#include "expr.h" where are you...
++#include "diagnostic.h"
++#include "plugin-version.h"
++#include "tm.h"
++#include "function.h"
++#include "basic-block.h"
++#include "gimple.h"
++#include "rtl.h"
++#include "emit-rtl.h"
++#include "tree-flow.h"
++
++int plugin_is_GPL_compatible;
++
++static tree latent_entropy_decl;
++
++static struct plugin_info latent_entropy_plugin_info = {
++ .version = "201207271820",
++ .help = NULL
++};
++
++static unsigned int execute_latent_entropy(void);
++static bool gate_latent_entropy(void);
++
++static struct gimple_opt_pass latent_entropy_pass = {
++ .pass = {
++ .type = GIMPLE_PASS,
++ .name = "latent_entropy",
++ .gate = gate_latent_entropy,
++ .execute = execute_latent_entropy,
++ .sub = NULL,
++ .next = NULL,
++ .static_pass_number = 0,
++ .tv_id = TV_NONE,
++ .properties_required = PROP_gimple_leh | PROP_cfg,
++ .properties_provided = 0,
++ .properties_destroyed = 0,
++ .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
++ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_update_ssa
++ }
++};
++
++static tree handle_latent_entropy_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
++{
++ if (TREE_CODE(*node) != FUNCTION_DECL) {
++ *no_add_attrs = true;
++ error("%qE attribute only applies to functions", name);
++ }
++ return NULL_TREE;
++}
++
++static struct attribute_spec latent_entropy_attr = {
++ .name = "latent_entropy",
++ .min_length = 0,
++ .max_length = 0,
++ .decl_required = true,
++ .type_required = false,
++ .function_type_required = false,
++ .handler = handle_latent_entropy_attribute,
++#if BUILDING_GCC_VERSION >= 4007
++ .affects_type_identity = false
++#endif
++};
++
++static void register_attributes(void *event_data, void *data)
++{
++ register_attribute(&latent_entropy_attr);
++}
++
++static bool gate_latent_entropy(void)
++{
++ tree latent_entropy_attr;
++
++ latent_entropy_attr = lookup_attribute("latent_entropy", DECL_ATTRIBUTES(current_function_decl));
++ return latent_entropy_attr != NULL_TREE;
++}
++
++static unsigned HOST_WIDE_INT seed;
++static unsigned HOST_WIDE_INT get_random_const(void)
++{
++ seed = (seed >> 1U) ^ (-(seed & 1ULL) & 0xD800000000000000ULL);
++ return seed;
++}
++
++static enum tree_code get_op(tree *rhs)
++{
++ static enum tree_code op;
++ unsigned HOST_WIDE_INT random_const;
++
++ random_const = get_random_const();
++
++ switch (op) {
++ case BIT_XOR_EXPR:
++ op = PLUS_EXPR;
++ break;
++
++ case PLUS_EXPR:
++ if (rhs) {
++ op = LROTATE_EXPR;
++ random_const &= HOST_BITS_PER_WIDE_INT - 1;
++ break;
++ }
++
++ case LROTATE_EXPR:
++ default:
++ op = BIT_XOR_EXPR;
++ break;
++ }
++ if (rhs)
++ *rhs = build_int_cstu(unsigned_intDI_type_node, random_const);
++ return op;
++}
++
++static void perturb_local_entropy(basic_block bb, tree local_entropy)
++{
++ gimple_stmt_iterator gsi;
++ gimple assign;
++ tree addxorrol, rhs;
++ enum tree_code op;
++
++ op = get_op(&rhs);
++ addxorrol = fold_build2_loc(UNKNOWN_LOCATION, op, unsigned_intDI_type_node, local_entropy, rhs);
++ assign = gimple_build_assign(local_entropy, addxorrol);
++ find_referenced_vars_in(assign);
++//debug_bb(bb);
++ gsi = gsi_after_labels(bb);
++ gsi_insert_before(&gsi, assign, GSI_NEW_STMT);
++ update_stmt(assign);
++}
++
++static void perturb_latent_entropy(basic_block bb, tree rhs)
++{
++ gimple_stmt_iterator gsi;
++ gimple assign;
++ tree addxorrol, temp;
++
++ // 1. create temporary copy of latent_entropy
++ temp = create_tmp_var(unsigned_intDI_type_node, "temp_latent_entropy");
++ add_referenced_var(temp);
++ mark_sym_for_renaming(temp);
++
++ // 2. read...
++ assign = gimple_build_assign(temp, latent_entropy_decl);
++ find_referenced_vars_in(assign);
++ gsi = gsi_after_labels(bb);
++ gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
++ update_stmt(assign);
++
++ // 3. ...modify...
++ addxorrol = fold_build2_loc(UNKNOWN_LOCATION, get_op(NULL), unsigned_intDI_type_node, temp, rhs);
++ assign = gimple_build_assign(temp, addxorrol);
++ find_referenced_vars_in(assign);
++ gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
++ update_stmt(assign);
++
++ // 4. ...write latent_entropy
++ assign = gimple_build_assign(latent_entropy_decl, temp);
++ find_referenced_vars_in(assign);
++ gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
++ update_stmt(assign);
++}
++
++static unsigned int execute_latent_entropy(void)
++{
++ basic_block bb;
++ gimple assign;
++ gimple_stmt_iterator gsi;
++ tree local_entropy;
++
++ if (!latent_entropy_decl) {
++ struct varpool_node *node;
++
++ for (node = varpool_nodes; node; node = node->next) {
++ tree var = node->decl;
++ if (strcmp(IDENTIFIER_POINTER(DECL_NAME(var)), "latent_entropy"))
++ continue;
++ latent_entropy_decl = var;
++// debug_tree(var);
++ break;
++ }
++ if (!latent_entropy_decl) {
++// debug_tree(current_function_decl);
++ return 0;
++ }
++ }
++
++//fprintf(stderr, "latent_entropy: %s\n", IDENTIFIER_POINTER(DECL_NAME(current_function_decl)));
++
++ // 1. create local entropy variable
++ local_entropy = create_tmp_var(unsigned_intDI_type_node, "local_entropy");
++ add_referenced_var(local_entropy);
++ mark_sym_for_renaming(local_entropy);
++
++ // 2. initialize local entropy variable
++ bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
++ if (dom_info_available_p(CDI_DOMINATORS))
++ set_immediate_dominator(CDI_DOMINATORS, bb, ENTRY_BLOCK_PTR);
++ gsi = gsi_start_bb(bb);
++
++ assign = gimple_build_assign(local_entropy, build_int_cstu(unsigned_intDI_type_node, get_random_const()));
++// gimple_set_location(assign, loc);
++ find_referenced_vars_in(assign);
++ gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
++ update_stmt(assign);
++ bb = bb->next_bb;
++
++ // 3. instrument each BB with an operation on the local entropy variable
++ while (bb != EXIT_BLOCK_PTR) {
++ perturb_local_entropy(bb, local_entropy);
++ bb = bb->next_bb;
++ };
++
++ // 4. mix local entropy into the global entropy variable
++ perturb_latent_entropy(EXIT_BLOCK_PTR->prev_bb, local_entropy);
++ return 0;
++}
++
++static void start_unit_callback(void *gcc_data, void *user_data)
++{
++#if BUILDING_GCC_VERSION >= 4007
++ seed = get_random_seed(false);
++#else
++ sscanf(get_random_seed(false), "%" HOST_WIDE_INT_PRINT "x", &seed);
++ seed *= seed;
++#endif
++
++ if (in_lto_p)
++ return;
++
++ // extern u64 latent_entropy
++ latent_entropy_decl = build_decl(UNKNOWN_LOCATION, VAR_DECL, get_identifier("latent_entropy"), unsigned_intDI_type_node);
++
++ TREE_STATIC(latent_entropy_decl) = 1;
++ TREE_PUBLIC(latent_entropy_decl) = 1;
++ TREE_USED(latent_entropy_decl) = 1;
++ TREE_THIS_VOLATILE(latent_entropy_decl) = 1;
++ DECL_EXTERNAL(latent_entropy_decl) = 1;
++ DECL_ARTIFICIAL(latent_entropy_decl) = 0;
++ DECL_INITIAL(latent_entropy_decl) = NULL;
++// DECL_ASSEMBLER_NAME(latent_entropy_decl);
++// varpool_finalize_decl(latent_entropy_decl);
++// varpool_mark_needed_node(latent_entropy_decl);
++}
++
++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
++{
++ const char * const plugin_name = plugin_info->base_name;
++ struct register_pass_info latent_entropy_pass_info = {
++ .pass = &latent_entropy_pass.pass,
++ .reference_pass_name = "optimized",
++ .ref_pass_instance_number = 1,
++ .pos_op = PASS_POS_INSERT_BEFORE
++ };
++
++ if (!plugin_default_version_check(version, &gcc_version)) {
++ error(G_("incompatible gcc/plugin versions"));
++ return 1;
++ }
++
++ register_callback(plugin_name, PLUGIN_INFO, NULL, &latent_entropy_plugin_info);
++ register_callback ("start_unit", PLUGIN_START_UNIT, &start_unit_callback, NULL);
++ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &latent_entropy_pass_info);
++ register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
++
++ return 0;
++}
diff --git a/tools/gcc/size_overflow_hash.data b/tools/gcc/size_overflow_hash.data
new file mode 100644
-index 0000000..daaa86c
+index 0000000..ba0e88b
--- /dev/null
+++ b/tools/gcc/size_overflow_hash.data
-@@ -0,0 +1,2486 @@
+@@ -0,0 +1,3028 @@
+_000001_hash alloc_dr 2 65495 _000001_hash NULL
+_000002_hash __copy_from_user 3 10918 _000002_hash NULL
+_000003_hash copy_from_user 3 17559 _000003_hash NULL
@@ -81157,7 +82712,7 @@ index 0000000..daaa86c
+_000331_hash lcd_write 3 14857 _000331_hash &_000014_hash
+_000332_hash ldm_frag_add 2 5611 _000332_hash NULL
+_000333_hash __lgread 4 31668 _000333_hash NULL
-+_000334_hash libipw_alloc_txb 1 27579 _000334_hash NULL
++_000334_hash libipw_alloc_txb 1-3-2 27579 _000334_hash NULL
+_000335_hash link_send_sections_long 4 46556 _000335_hash NULL
+_000336_hash listxattr 3 12769 _000336_hash NULL
+_000337_hash LoadBitmap 2 19658 _000337_hash NULL
@@ -81185,7 +82740,7 @@ index 0000000..daaa86c
+_000360_hash mpi_resize 2 44674 _000360_hash NULL
+_000361_hash mptctl_getiocinfo 2 28545 _000361_hash NULL
+_000362_hash mtdchar_readoob 4 31200 _000362_hash NULL
-+_000363_hash mtdchar_write 3 56831 _000363_hash NULL
++_000363_hash mtdchar_write 3 56831 _002688_hash NULL nohasharray
+_000364_hash mtdchar_writeoob 4 3393 _000364_hash NULL
+_000365_hash mtd_device_parse_register 5 5024 _000365_hash NULL
+_000366_hash mtf_test_write 3 18844 _000366_hash NULL
@@ -81292,7 +82847,7 @@ index 0000000..daaa86c
+_000472_hash rfcomm_sock_setsockopt 5 18254 _000472_hash NULL
+_000473_hash rndis_add_response 2 58544 _000473_hash NULL
+_000474_hash rndis_set_oid 4 6547 _000474_hash NULL
-+_000475_hash rngapi_reset 3 34366 _000475_hash NULL
++_000475_hash rngapi_reset 3 34366 _002911_hash NULL nohasharray
+_000476_hash roccat_common_receive 4 53407 _000476_hash NULL
+_000477_hash roccat_common_send 4 12284 _000477_hash NULL
+_000478_hash rpc_malloc 2 43573 _000478_hash NULL
@@ -81478,7 +83033,7 @@ index 0000000..daaa86c
+_000667_hash zd_usb_read_fw 4 22049 _000667_hash NULL
+_000668_hash zerocopy_sg_from_iovec 3 11828 _000668_hash NULL
+_000669_hash zoran_write 3 22404 _000669_hash NULL
-+_000671_hash acpi_ex_allocate_name_string 2 7685 _000671_hash NULL
++_000671_hash acpi_ex_allocate_name_string 2 7685 _002855_hash NULL nohasharray
+_000672_hash acpi_os_allocate_zeroed 1 37422 _000672_hash NULL
+_000673_hash acpi_ut_initialize_buffer 2 47143 _002314_hash NULL nohasharray
+_000674_hash ad7879_spi_xfer 3 36311 _000674_hash NULL
@@ -81537,7 +83092,7 @@ index 0000000..daaa86c
+_000733_hash ath6kl_wmi_send_mgmt_cmd 7 17347 _000733_hash NULL
+_000734_hash ath_descdma_setup 5 12257 _000734_hash NULL
+_000735_hash ath_rx_edma_init 2 65483 _000735_hash NULL
-+_000736_hash ati_create_gatt_pages 1 4722 _000736_hash NULL
++_000736_hash ati_create_gatt_pages 1 4722 _003142_hash NULL nohasharray
+_000737_hash au0828_init_isoc 2-3 61917 _000737_hash NULL
+_000739_hash audit_init_entry 1 38644 _000739_hash NULL
+_000740_hash ax25_sendmsg 4 62770 _000740_hash NULL
@@ -81573,7 +83128,7 @@ index 0000000..daaa86c
+_000774_hash cfg80211_roamed_bss 4-6 50198 _000774_hash NULL
+_000776_hash cifs_readdata_alloc 1 50318 _000776_hash NULL
+_000777_hash cifs_readv_from_socket 3 19109 _000777_hash NULL
-+_000778_hash cifs_writedata_alloc 1 32880 _000778_hash NULL
++_000778_hash cifs_writedata_alloc 1 32880 _003176_hash NULL nohasharray
+_000779_hash cnic_alloc_dma 3 34641 _000779_hash NULL
+_000780_hash configfs_write_file 3 61621 _000780_hash NULL
+_000781_hash construct_key 3 11329 _000781_hash NULL
@@ -81663,7 +83218,7 @@ index 0000000..daaa86c
+_000873_hash ib_send_cm_rtu 3 63138 _000873_hash NULL
+_000874_hash ieee80211_key_alloc 3 19065 _000874_hash NULL
+_000875_hash ieee80211_mgmt_tx 9 46860 _000875_hash NULL
-+_000876_hash ieee80211_send_probe_req 6 6924 _000876_hash NULL
++_000876_hash ieee80211_send_probe_req 6-4 6924 _000876_hash NULL
+_000877_hash if_writecmd 2 815 _000877_hash NULL
+_000878_hash init_bch 1-2 64130 _000878_hash NULL
+_000880_hash init_ipath 1 48187 _000880_hash NULL
@@ -81722,7 +83277,7 @@ index 0000000..daaa86c
+_000937_hash kvm_read_guest_page_mmu 6 37611 _000937_hash NULL
+_000938_hash kvm_set_irq_routing 3 48704 _000938_hash NULL
+_000939_hash kvm_write_guest_cached 4 11106 _000939_hash NULL
-+_000940_hash kvm_write_guest_page 5 63555 _000940_hash NULL
++_000940_hash kvm_write_guest_page 5 63555 _002809_hash NULL nohasharray
+_000941_hash l2cap_skbuff_fromiovec 3-4 35003 _000941_hash NULL
+_000943_hash l2tp_ip_sendmsg 4 50411 _000943_hash NULL
+_000944_hash l2tp_session_create 1 25286 _000944_hash NULL
@@ -81950,7 +83505,7 @@ index 0000000..daaa86c
+_001186_hash timeout_write 3 50991 _001186_hash NULL
+_001187_hash tipc_link_send_sections_fast 4 37920 _001187_hash NULL
+_001188_hash tipc_subseq_alloc 1 5957 _001188_hash NULL
-+_001189_hash tm6000_read_write_usb 7 50774 _001189_hash NULL
++_001189_hash tm6000_read_write_usb 7 50774 _002917_hash NULL nohasharray
+_001190_hash tnode_alloc 1 49407 _001190_hash NULL
+_001191_hash tomoyo_commit_ok 2 20167 _001191_hash NULL
+_001192_hash tomoyo_scan_bprm 2-4 15642 _001192_hash NULL
@@ -81970,7 +83525,7 @@ index 0000000..daaa86c
+_001208_hash update_pmkid 4 2481 _001208_hash NULL
+_001209_hash usb_alloc_coherent 2 65444 _001209_hash NULL
+_001210_hash uvc_alloc_buffers 2 9656 _001210_hash NULL
-+_001211_hash uvc_alloc_entity 3 20836 _001211_hash NULL
++_001211_hash uvc_alloc_entity 3-4 20836 _001211_hash NULL
+_001212_hash v4l2_ctrl_new 7 38725 _001212_hash NULL
+_001213_hash v4l2_event_subscribe 3 19510 _001213_hash NULL
+_001214_hash vb2_read 3 42703 _001214_hash NULL
@@ -81997,7 +83552,7 @@ index 0000000..daaa86c
+_001237_hash _xfs_buf_get_pages 2 46811 _001237_hash NULL
+_001238_hash xfs_da_buf_make 1 55845 _001238_hash NULL
+_001239_hash xfs_da_grow_inode_int 3 21785 _001239_hash NULL
-+_001240_hash xfs_dir_cilookup_result 3 64288 _001240_hash NULL
++_001240_hash xfs_dir_cilookup_result 3 64288 _003130_hash NULL nohasharray
+_001241_hash xfs_iext_add_indirect_multi 3 32400 _001241_hash NULL
+_001242_hash xfs_iext_inline_to_direct 2 12384 _001242_hash NULL
+_001243_hash xfs_iroot_realloc 2 46826 _001243_hash NULL
@@ -82096,7 +83651,7 @@ index 0000000..daaa86c
+_001343_hash dump_midi 3 51040 _001343_hash NULL
+_001344_hash dvb_dmxdev_set_buffer_size 2 55643 _001344_hash NULL
+_001345_hash dvb_dvr_set_buffer_size 2 9840 _001345_hash NULL
-+_001346_hash dvb_ringbuffer_pkt_read_user 3-5 4303 _001346_hash NULL
++_001346_hash dvb_ringbuffer_pkt_read_user 3-5-2 4303 _001346_hash NULL
+_001348_hash dvb_ringbuffer_read_user 3 56702 _001348_hash NULL
+_001349_hash ecryptfs_filldir 3 6622 _001349_hash NULL
+_001350_hash ecryptfs_readlink 3 40775 _001350_hash NULL
@@ -82270,7 +83825,7 @@ index 0000000..daaa86c
+_001530_hash sys_getxattr 4 37418 _001530_hash NULL
+_001531_hash sys_kexec_load 2 14222 _001531_hash NULL
+_001532_hash sys_msgsnd 3 44537 _001532_hash &_000129_hash
-+_001533_hash sys_process_vm_readv 3-5 19090 _001533_hash NULL
++_001533_hash sys_process_vm_readv 3-5 19090 _003178_hash NULL nohasharray
+_001535_hash sys_process_vm_writev 3-5 4928 _001535_hash NULL
+_001537_hash sys_sched_getaffinity 2 60033 _001537_hash NULL
+_001538_hash sys_setsockopt 5 35320 _001538_hash NULL
@@ -82336,7 +83891,7 @@ index 0000000..daaa86c
+_001603_hash xfs_iext_realloc_indirect 2 59211 _001603_hash NULL
+_001604_hash xfs_inumbers_fmt 3 12817 _001604_hash NULL
+_001605_hash xlog_recover_add_to_cont_trans 4 44102 _001605_hash NULL
-+_001606_hash xz_dec_lzma2_create 2 36353 _001606_hash NULL
++_001606_hash xz_dec_lzma2_create 2 36353 _002745_hash NULL nohasharray
+_001607_hash _zd_iowrite32v_locked 3 44725 _001607_hash NULL
+_001608_hash aat2870_reg_read_file 3 12221 _001608_hash NULL
+_001609_hash add_sctp_bind_addr 3 12269 _001609_hash NULL
@@ -82376,7 +83931,7 @@ index 0000000..daaa86c
+_001645_hash bfad_debugfs_read 3 13119 _001645_hash NULL
+_001646_hash bfad_debugfs_read_regrd 3 57830 _001646_hash NULL
+_001647_hash blk_init_tags 1 30592 _001647_hash NULL
-+_001648_hash blk_queue_init_tags 2 44355 _001648_hash NULL
++_001648_hash blk_queue_init_tags 2 44355 _002686_hash NULL nohasharray
+_001649_hash blk_rq_map_kern 4 47004 _001649_hash NULL
+_001650_hash bm_entry_read 3 10976 _001650_hash NULL
+_001651_hash bm_status_read 3 19583 _001651_hash NULL
@@ -82450,9 +84005,9 @@ index 0000000..daaa86c
+_001721_hash generic_readlink 3 32654 _001721_hash NULL
+_001722_hash gpio_power_read 3 36059 _001722_hash NULL
+_001723_hash hash_recvmsg 4 50924 _001723_hash NULL
-+_001724_hash ht40allow_map_read 3 55209 _001724_hash NULL
++_001724_hash ht40allow_map_read 3 55209 _002830_hash NULL nohasharray
+_001725_hash hwflags_read 3 52318 _001725_hash NULL
-+_001726_hash hysdn_conf_read 3 42324 _001726_hash NULL
++_001726_hash hysdn_conf_read 3 42324 _003159_hash NULL nohasharray
+_001727_hash i2400m_rx_stats_read 3 57706 _001727_hash NULL
+_001728_hash i2400m_tx_stats_read 3 28527 _001728_hash NULL
+_001729_hash idmouse_read 3 63374 _001729_hash NULL
@@ -82533,7 +84088,7 @@ index 0000000..daaa86c
+_001805_hash iwl_dbgfs_rxon_flags_read 3 20795 _001805_hash NULL
+_001806_hash iwl_dbgfs_rx_queue_read 3 19943 _001806_hash NULL
+_001807_hash iwl_dbgfs_rx_statistics_read 3 62687 _001807_hash &_000425_hash
-+_001808_hash iwl_dbgfs_sensitivity_read 3 63116 _001808_hash NULL
++_001808_hash iwl_dbgfs_sensitivity_read 3 63116 _003026_hash NULL nohasharray
+_001809_hash iwl_dbgfs_sleep_level_override_read 3 3038 _001809_hash NULL
+_001810_hash iwl_dbgfs_sram_read 3 44505 _001810_hash NULL
+_001811_hash iwl_dbgfs_stations_read 3 9309 _001811_hash NULL
@@ -82599,7 +84154,7 @@ index 0000000..daaa86c
+_001873_hash mwifiex_info_read 3 53447 _001873_hash NULL
+_001874_hash mwifiex_rdeeprom_read 3 51429 _001874_hash NULL
+_001875_hash mwifiex_regrdwr_read 3 34472 _001875_hash NULL
-+_001876_hash nfsd_vfs_read 6 62605 _001876_hash NULL
++_001876_hash nfsd_vfs_read 6 62605 _003003_hash NULL nohasharray
+_001877_hash nfsd_vfs_write 6 54577 _001877_hash NULL
+_001878_hash nfs_idmap_lookup_id 2 10660 _001878_hash NULL
+_001879_hash o2hb_debug_read 3 37851 _001879_hash NULL
@@ -82712,7 +84267,7 @@ index 0000000..daaa86c
+_001986_hash rx_out_of_mem_read 3 10157 _001986_hash NULL
+_001987_hash rx_path_reset_read 3 23801 _001987_hash NULL
+_001988_hash rxpipe_beacon_buffer_thres_host_int_trig_rx_data_read 3 55106 _001988_hash NULL
-+_001989_hash rxpipe_descr_host_int_trig_rx_data_read 3 22001 _001989_hash NULL
++_001989_hash rxpipe_descr_host_int_trig_rx_data_read 3 22001 _003089_hash NULL nohasharray
+_001990_hash rxpipe_missed_beacon_host_int_trig_rx_data_read 3 63405 _001990_hash NULL
+_001991_hash rxpipe_rx_prep_beacon_drop_read 3 2403 _001991_hash NULL
+_001992_hash rxpipe_tx_xfr_host_int_trig_rx_data_read 3 35538 _001992_hash NULL
@@ -82833,7 +84388,7 @@ index 0000000..daaa86c
+_002116_hash exofs_read_kern 6 39921 _002116_hash &_001885_hash
+_002117_hash fc_change_queue_depth 2 36841 _002117_hash NULL
+_002118_hash forced_ps_read 3 31685 _002118_hash NULL
-+_002119_hash frequency_read 3 64031 _002119_hash NULL
++_002119_hash frequency_read 3 64031 _003106_hash NULL nohasharray
+_002120_hash get_alua_req 3 4166 _002120_hash NULL
+_002121_hash get_rdac_req 3 45882 _002121_hash NULL
+_002122_hash hci_sock_recvmsg 4 7072 _002122_hash NULL
@@ -82871,7 +84426,7 @@ index 0000000..daaa86c
+_002154_hash ieee80211_if_read_flags 3 57470 _002389_hash NULL nohasharray
+_002155_hash ieee80211_if_read_fwded_frames 3 36520 _002155_hash NULL
+_002156_hash ieee80211_if_read_fwded_mcast 3 39571 _002156_hash &_000151_hash
-+_002157_hash ieee80211_if_read_fwded_unicast 3 59740 _002157_hash NULL
++_002157_hash ieee80211_if_read_fwded_unicast 3 59740 _002859_hash NULL nohasharray
+_002158_hash ieee80211_if_read_last_beacon 3 31257 _002158_hash NULL
+_002159_hash ieee80211_if_read_min_discovery_timeout 3 13946 _002159_hash NULL
+_002160_hash ieee80211_if_read_num_buffered_multicast 3 12716 _002160_hash NULL
@@ -83181,7 +84736,7 @@ index 0000000..daaa86c
+_002482_hash gru_alloc_gts 2-3 60056 _002482_hash NULL
+_002484_hash handle_eviocgbit 3 44193 _002484_hash NULL
+_002485_hash hid_parse_report 3 51737 _002485_hash NULL
-+_002486_hash ieee80211_alloc_txb 1 52477 _002486_hash NULL
++_002486_hash ieee80211_alloc_txb 1-2 52477 _002486_hash NULL
+_002487_hash ieee80211_wx_set_gen_ie 3 51399 _002487_hash NULL
+_002488_hash ieee80211_wx_set_gen_ie_rsl 3 3521 _002488_hash NULL
+_002489_hash init_cdev 1 8274 _002489_hash NULL
@@ -83209,7 +84764,7 @@ index 0000000..daaa86c
+_002511_hash queue_reply 3 22416 _002511_hash NULL
+_002512_hash Realloc 2 34961 _002512_hash NULL
+_002513_hash rfc4106_set_key 3 54519 _002513_hash NULL
-+_002514_hash rtllib_alloc_txb 1 21687 _002514_hash NULL
++_002514_hash rtllib_alloc_txb 1-2 21687 _002514_hash NULL
+_002515_hash rtllib_wx_set_gen_ie 3 59808 _002515_hash NULL
+_002516_hash rts51x_transfer_data_partial 6 5735 _002516_hash NULL
+_002517_hash sparse_early_usemaps_alloc_node 4 9269 _002517_hash NULL
@@ -83227,7 +84782,7 @@ index 0000000..daaa86c
+_002529_hash xpc_kzalloc_cacheline_aligned 1 65433 _002529_hash NULL
+_002530_hash xsd_read 3 15653 _002530_hash NULL
+_002531_hash compat_do_readv_writev 4 49102 _002531_hash NULL
-+_002532_hash compat_keyctl_instantiate_key_iov 3 57431 _002532_hash NULL
++_002532_hash compat_keyctl_instantiate_key_iov 3 57431 _003117_hash NULL nohasharray
+_002533_hash compat_process_vm_rw 3-5 22254 _002533_hash NULL
+_002535_hash compat_sys_setsockopt 5 3326 _002535_hash NULL
+_002536_hash ipath_cdev_init 1 37752 _002536_hash NULL
@@ -83318,15 +84873,557 @@ index 0000000..daaa86c
+_002631_hash v9fs_fid_readn 4 60544 _002631_hash NULL
+_002632_hash v9fs_file_read 3 40858 _002632_hash NULL
+_002633_hash __devres_alloc 2 25598 _002633_hash NULL
-+_002634_hash acl_alloc 1 35979 _002634_hash NULL
-+_002635_hash acl_alloc_stack_init 1 60630 _002635_hash NULL
-+_002636_hash acl_alloc_num 1-2 60778 _002636_hash NULL
++_002634_hash alloc_dummy_extent_buffer 2 56374 _002634_hash NULL
++_002635_hash alloc_fdtable 1 17389 _002635_hash NULL
++_002636_hash alloc_large_system_hash 2 22391 _002636_hash NULL
++_002637_hash alloc_ldt 2 21972 _002637_hash NULL
++_002638_hash __alloc_skb 1 23940 _002638_hash NULL
++_002639_hash __ata_change_queue_depth 3 23484 _002639_hash NULL
++_002640_hash btrfs_alloc_free_block 3 8986 _002640_hash NULL
++_002641_hash btrfs_find_device_for_logical 2 44993 _002641_hash NULL
++_002642_hash ccid3_hc_rx_getsockopt 3 62331 _002642_hash NULL
++_002643_hash ccid3_hc_tx_getsockopt 3 16314 _002643_hash NULL
++_002644_hash cifs_readdata_alloc 1 26360 _002644_hash NULL
++_002645_hash cistpl_vers_1 4 15023 _002645_hash NULL
++_002646_hash cmm_read 3 57520 _002646_hash NULL
++_002647_hash cosa_read 3 25966 _002647_hash NULL
++_002648_hash dm_table_create 3 35687 _002648_hash NULL
++_002649_hash dpcm_state_read_file 3 65489 _002649_hash NULL
++_002651_hash edac_mc_alloc 4 3611 _002651_hash NULL
++_002652_hash ep0_read 3 38095 _002652_hash NULL
++_002653_hash event_buffer_read 3 48772 _002765_hash NULL nohasharray
++_002654_hash extend_netdev_table 2 21453 _002654_hash NULL
++_002655_hash extract_entropy_user 3 26952 _002655_hash NULL
++_002656_hash fcoe_ctlr_device_add 3 1793 _002656_hash NULL
++_002657_hash fd_do_readv 3 51297 _002657_hash NULL
++_002658_hash fd_do_writev 3 29329 _002658_hash NULL
++_002659_hash ffs_ep0_read 3 2672 _002659_hash NULL
++_002660_hash fill_readbuf 3 32464 _002660_hash NULL
++_002661_hash fw_iso_buffer_alloc 2 13704 _002661_hash NULL
++_002662_hash get_fd_set 1 3866 _002662_hash NULL
++_002663_hash hidraw_report_event 3 20503 _002663_hash NULL
++_002664_hash ieee80211_if_read_ht_opmode 3 29044 _002664_hash NULL
++_002665_hash ieee80211_if_read_num_mcast_sta 3 12419 _002665_hash NULL
++_002666_hash iwl_dbgfs_calib_disabled_read 3 22649 _002666_hash NULL
++_002667_hash iwl_dbgfs_rf_reset_read 3 26512 _002667_hash NULL
++_002668_hash ixgbe_alloc_q_vector 4-6 24439 _002668_hash NULL
++_002670_hash joydev_handle_JSIOCSAXMAP 3 48898 _002836_hash NULL nohasharray
++_002671_hash joydev_handle_JSIOCSBTNMAP 3 15643 _002671_hash NULL
++_002672_hash __kfifo_from_user_r 3 60345 _002672_hash NULL
++_002673_hash kstrtoint_from_user 2 8778 _002673_hash NULL
++_002674_hash kstrtol_from_user 2 10168 _002674_hash NULL
++_002675_hash kstrtoll_from_user 2 19500 _002675_hash NULL
++_002676_hash kstrtos16_from_user 2 28300 _002676_hash NULL
++_002677_hash kstrtos8_from_user 2 58268 _002677_hash NULL
++_002678_hash kstrtou16_from_user 2 54274 _002678_hash NULL
++_002679_hash kstrtou8_from_user 2 55599 _002679_hash NULL
++_002680_hash kstrtouint_from_user 2 10536 _002680_hash NULL
++_002681_hash kstrtoul_from_user 2 64569 _002681_hash NULL
++_002682_hash kstrtoull_from_user 2 63026 _002682_hash NULL
++_002683_hash l2cap_create_iframe_pdu 3 40055 _002683_hash NULL
++_002684_hash l2tp_ip6_recvmsg 4 62874 _002684_hash NULL
++_002685_hash mem_cgroup_read 5 22461 _002685_hash NULL
++_002686_hash nfs_fscache_get_super_cookie 3 44355 _002686_hash &_001648_hash
++_002687_hash nfs_pgarray_set 2 1085 _002687_hash NULL
++_002688_hash ntfs_rl_realloc 3 56831 _002688_hash &_000363_hash
++_002689_hash ntfs_rl_realloc_nofail 3 32173 _002689_hash NULL
++_002690_hash pn533_dep_link_up 5 22154 _002690_hash NULL
++_002691_hash port_fops_write 3 54627 _002691_hash NULL
++_002692_hash ptp_read 4 63251 _002692_hash NULL
++_002693_hash qla4xxx_change_queue_depth 2 1268 _002693_hash NULL
++_002694_hash reqsk_queue_alloc 2 40272 _002694_hash NULL
++_002695_hash resize_info_buffer 2 62889 _002695_hash NULL
++_002696_hash rfkill_fop_write 3 64808 _002696_hash NULL
++_002697_hash rt2x00debug_write_rfcsr 3 41473 _002697_hash NULL
++_002698_hash rvmalloc 1 46873 _002698_hash NULL
++_002699_hash rw_copy_check_uvector 3 45748 _002699_hash NULL
++_002700_hash sctp_getsockopt_active_key 2 45483 _002700_hash NULL
++_002701_hash sctp_getsockopt_adaptation_layer 2 45375 _002701_hash NULL
++_002702_hash sctp_getsockopt_assoc_ids 2 9043 _002702_hash NULL
++_002703_hash sctp_getsockopt_associnfo 2 58169 _002703_hash NULL
++_002704_hash sctp_getsockopt_assoc_number 2 6384 _002704_hash NULL
++_002705_hash sctp_getsockopt_auto_asconf 2 46584 _002705_hash NULL
++_002706_hash sctp_getsockopt_context 2 52490 _002706_hash NULL
++_002707_hash sctp_getsockopt_default_send_param 2 63056 _002707_hash NULL
++_002708_hash sctp_getsockopt_disable_fragments 2 12330 _002708_hash NULL
++_002709_hash sctp_getsockopt_fragment_interleave 2 51215 _002709_hash NULL
++_002710_hash sctp_getsockopt_initmsg 2 26042 _002710_hash NULL
++_002711_hash sctp_getsockopt_mappedv4 2 20044 _002711_hash NULL
++_002712_hash sctp_getsockopt_nodelay 2 9560 _002712_hash NULL
++_002713_hash sctp_getsockopt_partial_delivery_point 2 60952 _002713_hash NULL
++_002714_hash sctp_getsockopt_peeloff 2 59190 _002714_hash NULL
++_002715_hash sctp_getsockopt_peer_addr_info 2 6024 _002715_hash NULL
++_002716_hash sctp_getsockopt_peer_addr_params 2 53645 _002716_hash NULL
++_002717_hash sctp_getsockopt_primary_addr 2 24639 _002717_hash NULL
++_002718_hash sctp_getsockopt_rtoinfo 2 62027 _002718_hash NULL
++_002719_hash sctp_getsockopt_sctp_status 2 56540 _002719_hash NULL
++_002720_hash self_check_write 5 50856 _002720_hash NULL
++_002721_hash smk_read_mapped 3 7562 _002721_hash NULL
++_002722_hash smk_set_cipso 3 20379 _002722_hash NULL
++_002723_hash smk_user_access 3 24440 _002723_hash NULL
++_002724_hash smk_write_mapped 3 13519 _002724_hash NULL
++_002725_hash smk_write_rules_list 3 18565 _002725_hash NULL
++_002726_hash snd_mixart_BA0_read 5 45069 _002726_hash NULL
++_002727_hash snd_mixart_BA1_read 5 5082 _002727_hash NULL
++_002728_hash snd_pcm_oss_read2 3 54387 _002728_hash NULL
++_002729_hash syslog_print 2 307 _002729_hash NULL
++_002730_hash tcp_dma_try_early_copy 3 4457 _002730_hash NULL
++_002731_hash tcp_send_rcvq 3 11316 _002731_hash NULL
++_002732_hash tomoyo_init_log 2 61526 _002732_hash NULL
++_002733_hash ubi_dump_flash 4 46381 _002733_hash NULL
++_002734_hash ubi_eba_atomic_leb_change 5 60379 _002734_hash NULL
++_002735_hash ubi_eba_write_leb 5-6 36029 _002735_hash NULL
++_002737_hash ubi_eba_write_leb_st 5 44343 _002737_hash NULL
++_002738_hash ubi_self_check_all_ff 4 41959 _002738_hash NULL
++_002739_hash unix_bind 3 15668 _002739_hash NULL
++_002740_hash usbvision_rvmalloc 1 19655 _002740_hash NULL
++_002742_hash v4l2_ctrl_new 7 24927 _002742_hash NULL
++_002743_hash v4l2_event_subscribe 3 53687 _002743_hash NULL
++_002744_hash v9fs_direct_read 3 45546 _002744_hash NULL
++_002745_hash v9fs_file_readn 4 36353 _002745_hash &_001606_hash
++_002746_hash __videobuf_alloc_vb 1 5665 _002746_hash NULL
++_002747_hash wm8350_write 3 24480 _002747_hash NULL
++_002748_hash xfs_buf_read_uncached 3 42844 _002748_hash NULL
++_002749_hash yurex_write 3 8761 _002749_hash NULL
++_002750_hash alloc_skb 1 55439 _002750_hash NULL
++_002751_hash alloc_skb_fclone 1 3467 _002751_hash NULL
++_002752_hash ata_scsi_change_queue_depth 2 23126 _002752_hash NULL
++_002753_hash ath6kl_disconnect_timeout_write 3 794 _002753_hash NULL
++_002754_hash ath6kl_keepalive_write 3 45600 _002754_hash NULL
++_002755_hash ath6kl_lrssi_roam_write 3 8362 _002755_hash NULL
++_002756_hash ath6kl_regread_write 3 14220 _002756_hash NULL
++_002757_hash core_sys_select 1 47494 _002757_hash NULL
++_002758_hash do_syslog 3 56807 _002758_hash NULL
++_002759_hash expand_fdtable 2 39273 _002759_hash NULL
++_002760_hash fd_execute_cmd 3 1132 _002760_hash NULL
++_002761_hash get_chars 3 40373 _002761_hash NULL
++_002762_hash hid_report_raw_event 4 2762 _002762_hash NULL
++_002763_hash inet_csk_listen_start 2 38233 _002763_hash NULL
++_002764_hash kstrtou32_from_user 2 30361 _002764_hash NULL
++_002765_hash l2cap_segment_sdu 4 48772 _002765_hash &_002653_hash
++_002766_hash __netdev_alloc_skb 2 18595 _002766_hash NULL
++_002767_hash nfs_readdata_alloc 2 65015 _002767_hash NULL
++_002768_hash nfs_writedata_alloc 2 12133 _002768_hash NULL
++_002769_hash ntfs_rl_append 2-4 6037 _002769_hash NULL
++_002771_hash ntfs_rl_insert 2-4 4931 _002771_hash NULL
++_002773_hash ntfs_rl_replace 2-4 14136 _002773_hash NULL
++_002775_hash ntfs_rl_split 2-4 52328 _002775_hash NULL
++_002777_hash port_fops_read 3 49626 _002777_hash NULL
++_002778_hash random_read 3 13815 _002778_hash NULL
++_002779_hash sg_proc_write_adio 3 45704 _002779_hash NULL
++_002780_hash sg_proc_write_dressz 3 46316 _002780_hash NULL
++_002781_hash tcp_sendmsg 4 30296 _002781_hash NULL
++_002782_hash tomoyo_write_log2 2 34318 _002782_hash NULL
++_002783_hash ubi_leb_change 4 10289 _002783_hash NULL
++_002784_hash ubi_leb_write 4-5 5478 _002784_hash NULL
++_002786_hash urandom_read 3 30462 _002786_hash NULL
++_002787_hash v9fs_cached_file_read 3 2514 _002787_hash NULL
++_002788_hash __videobuf_alloc_cached 1 12740 _002788_hash NULL
++_002789_hash __videobuf_alloc_uncached 1 55711 _002789_hash NULL
++_002790_hash wm8350_block_write 3 19727 _002790_hash NULL
++_002791_hash alloc_tx 2 32143 _002791_hash NULL
++_002792_hash alloc_wr 1-2 24635 _002792_hash NULL
++_002794_hash ath6kl_endpoint_stats_write 3 59621 _002794_hash NULL
++_002795_hash ath6kl_fwlog_mask_write 3 24810 _002795_hash NULL
++_002796_hash ath9k_wmi_cmd 4 327 _002796_hash NULL
++_002797_hash atm_alloc_charge 2 19517 _002879_hash NULL nohasharray
++_002798_hash ax25_output 2 22736 _002798_hash NULL
++_002799_hash bcsp_prepare_pkt 3 12961 _002799_hash NULL
++_002800_hash bt_skb_alloc 1 6404 _002800_hash NULL
++_002801_hash capinc_tty_write 3 28539 _002801_hash NULL
++_002802_hash cfpkt_create_pfx 1-2 23594 _002802_hash NULL
++_002804_hash cmd_complete 6 51629 _002804_hash NULL
++_002805_hash cmtp_add_msgpart 4 9252 _002805_hash NULL
++_002806_hash cmtp_send_interopmsg 7 376 _002806_hash NULL
++_002807_hash cxgb3_get_cpl_reply_skb 2 10620 _002807_hash NULL
++_002808_hash dbg_leb_change 4 23555 _002808_hash NULL
++_002809_hash dbg_leb_write 4-5 63555 _002809_hash &_000940_hash
++_002811_hash dccp_listen_start 2 35918 _002811_hash NULL
++_002812_hash __dev_alloc_skb 1 28681 _002812_hash NULL
++_002813_hash diva_os_alloc_message_buffer 1 64568 _002813_hash NULL
++_002814_hash dn_alloc_skb 2 6631 _002814_hash NULL
++_002815_hash do_pselect 1 62061 _002815_hash NULL
++_002816_hash _fc_frame_alloc 1 43568 _002816_hash NULL
++_002817_hash find_skb 2 20431 _002817_hash NULL
++_002818_hash fm_send_cmd 5 39639 _002818_hash NULL
++_002819_hash gem_alloc_skb 2 51715 _002819_hash NULL
++_002820_hash get_packet 3 41914 _002820_hash NULL
++_002821_hash get_packet 3 5747 _002821_hash NULL
++_002822_hash get_packet_pg 4 28023 _002822_hash NULL
++_002823_hash get_skb 2 63008 _002823_hash NULL
++_002824_hash hidp_queue_report 3 1881 _002824_hash NULL
++_002825_hash __hidp_send_ctrl_message 4 28303 _002825_hash NULL
++_002826_hash hycapi_rx_capipkt 3 11602 _002826_hash NULL
++_002827_hash i2400m_net_rx 5 27170 _002827_hash NULL
++_002828_hash igmpv3_newpack 2 35912 _002828_hash NULL
++_002829_hash inet_listen 2 14723 _002829_hash NULL
++_002830_hash isdn_net_ciscohdlck_alloc_skb 2 55209 _002830_hash &_001724_hash
++_002831_hash isdn_ppp_ccp_xmit_reset 6 63297 _002831_hash NULL
++_002832_hash kmsg_read 3 46514 _002832_hash NULL
++_002833_hash _l2_alloc_skb 1 11883 _002833_hash NULL
++_002834_hash l3_alloc_skb 1 32289 _002834_hash NULL
++_002835_hash llc_alloc_frame 4 64366 _002835_hash NULL
++_002836_hash mac_drv_rx_init 2 48898 _002836_hash &_002670_hash
++_002837_hash mgmt_event 4 12810 _002837_hash NULL
++_002838_hash mI_alloc_skb 1 24770 _002838_hash NULL
++_002839_hash nci_skb_alloc 2 49757 _002839_hash NULL
++_002840_hash netdev_alloc_skb 2 62437 _002840_hash NULL
++_002841_hash __netdev_alloc_skb_ip_align 2 55067 _002841_hash NULL
++_002842_hash new_skb 1 21148 _002842_hash NULL
++_002843_hash nfc_alloc_recv_skb 1 10244 _002843_hash NULL
++_002844_hash nfcwilink_skb_alloc 1 16167 _002844_hash NULL
++_002845_hash nfulnl_alloc_skb 2 65207 _002845_hash NULL
++_002846_hash ni65_alloc_mem 3 10664 _002846_hash NULL
++_002847_hash pep_alloc_skb 3 46303 _002847_hash NULL
++_002848_hash pn_raw_send 2 54330 _002848_hash NULL
++_002849_hash __pskb_copy 2 9038 _002849_hash NULL
++_002850_hash refill_pool 2 19477 _002850_hash NULL
++_002851_hash rfcomm_wmalloc 2 58090 _002851_hash NULL
++_002852_hash rx 4 57944 _002852_hash NULL
++_002853_hash sctp_ulpevent_new 1 33377 _002853_hash NULL
++_002854_hash send_command 4 10832 _002854_hash NULL
++_002855_hash skb_copy_expand 2-3 7685 _002855_hash &_000671_hash
++_002857_hash sk_stream_alloc_skb 2 57622 _002857_hash NULL
++_002858_hash sock_alloc_send_pskb 2 21246 _002858_hash NULL
++_002859_hash sock_rmalloc 2 59740 _002859_hash &_002157_hash
++_002860_hash sock_wmalloc 2 16472 _002860_hash NULL
++_002861_hash solos_param_store 4 34755 _002861_hash NULL
++_002862_hash sys_select 1 38827 _002862_hash NULL
++_002863_hash sys_syslog 3 10746 _002863_hash NULL
++_002864_hash t4vf_pktgl_to_skb 2 39005 _002864_hash NULL
++_002865_hash tcp_collapse 5-6 63294 _002865_hash NULL
++_002867_hash tipc_cfg_reply_alloc 1 27606 _002867_hash NULL
++_002868_hash ubifs_leb_change 4 17789 _002868_hash NULL
++_002869_hash ubifs_leb_write 4-5 22679 _002869_hash NULL
++_002871_hash ulog_alloc_skb 1 23427 _002871_hash NULL
++_002872_hash _alloc_mISDN_skb 3 52232 _002872_hash NULL
++_002873_hash ath9k_multi_regread 4 65056 _002873_hash NULL
++_002874_hash ath_rxbuf_alloc 2 24745 _002874_hash NULL
++_002875_hash ax25_send_frame 2 19964 _002875_hash NULL
++_002876_hash bchannel_get_rxbuf 2 37213 _002876_hash NULL
++_002877_hash cfpkt_create 1 18197 _002877_hash NULL
++_002878_hash console_store 4 36007 _002878_hash NULL
++_002879_hash dev_alloc_skb 1 19517 _002879_hash &_002797_hash
++_002880_hash dn_nsp_do_disc 2-6 49474 _002880_hash NULL
++_002882_hash do_write_orph_node 2 64343 _002882_hash NULL
++_002883_hash dsp_cmx_send_member 2 15625 _002883_hash NULL
++_002884_hash fc_frame_alloc 2 1596 _002884_hash NULL
++_002885_hash fc_frame_alloc_fill 2 59394 _002885_hash NULL
++_002886_hash fmc_send_cmd 5 20435 _002886_hash NULL
++_002887_hash hci_send_cmd 3 43810 _002887_hash NULL
++_002888_hash hci_si_event 3 1404 _002888_hash NULL
++_002889_hash hfcpci_empty_bfifo 4 62323 _002889_hash NULL
++_002890_hash hidp_send_ctrl_message 4 43702 _002890_hash NULL
++_002891_hash hysdn_sched_rx 3 60533 _002891_hash NULL
++_002892_hash inet_dccp_listen 2 28565 _002892_hash NULL
++_002893_hash ip6_append_data 4-5 36490 _002893_hash NULL
++_002894_hash __ip_append_data 7-8 36191 _002894_hash NULL
++_002895_hash l1oip_socket_recv 6 56537 _002895_hash NULL
++_002896_hash l2cap_build_cmd 4 48676 _002896_hash NULL
++_002897_hash l2down_create 4 21755 _002897_hash NULL
++_002898_hash l2up_create 3 6430 _002898_hash NULL
++_002899_hash ldisc_receive 4 41516 _002899_hash NULL
++_002902_hash lro_gen_skb 6 2644 _002902_hash NULL
++_002903_hash macvtap_alloc_skb 2-4-3 50629 _002903_hash NULL
++_002906_hash mgmt_device_found 10 14146 _002906_hash NULL
++_002907_hash nci_send_cmd 3 58206 _002907_hash NULL
++_002908_hash netdev_alloc_skb_ip_align 2 40811 _002908_hash NULL
++_002909_hash nfcwilink_send_bts_cmd 3 10802 _002909_hash NULL
++_002910_hash nfqnl_mangle 2 14583 _002910_hash NULL
++_002911_hash p54_alloc_skb 3 34366 _002911_hash &_000475_hash
++_002912_hash packet_alloc_skb 2-5-4 62602 _002912_hash NULL
++_002915_hash pep_indicate 5 38611 _002915_hash NULL
++_002916_hash pep_reply 5 50582 _002916_hash NULL
++_002917_hash pipe_handler_request 5 50774 _002917_hash &_001189_hash
++_002918_hash ql_process_mac_rx_page 4 15543 _002918_hash NULL
++_002919_hash ql_process_mac_rx_skb 4 6689 _002919_hash NULL
++_002920_hash rfcomm_tty_write 3 51603 _002920_hash NULL
++_002921_hash send_mpa_reject 3 7135 _002921_hash NULL
++_002922_hash send_mpa_reply 3 32372 _002922_hash NULL
++_002923_hash set_rxd_buffer_pointer 8 9950 _002923_hash NULL
++_002924_hash sge_rx 3 50594 _002924_hash NULL
++_002925_hash skb_cow_data 2 11565 _002925_hash NULL
++_002926_hash smp_build_cmd 3 45853 _002926_hash NULL
++_002927_hash sock_alloc_send_skb 2 23720 _002927_hash NULL
++_002928_hash sys_pselect6 1 57449 _002928_hash NULL
++_002929_hash tcp_fragment 3 20436 _002929_hash NULL
++_002930_hash teiup_create 3 43201 _002930_hash NULL
++_002931_hash tg3_run_loopback 2 30093 _002931_hash NULL
++_002932_hash tun_alloc_skb 2-4-3 41216 _002932_hash NULL
++_002935_hash ubifs_write_node 5 11258 _002935_hash NULL
++_002936_hash use_pool 2 64607 _002936_hash NULL
++_002937_hash vxge_rx_alloc 3 52024 _002937_hash NULL
++_002938_hash add_packet 3 54433 _002938_hash NULL
++_002939_hash add_rx_skb 3 8257 _002939_hash NULL
++_002940_hash ath6kl_buf_alloc 1 57304 _002940_hash NULL
++_002941_hash bat_iv_ogm_aggregate_new 2 2620 _002941_hash NULL
++_002942_hash bnx2fc_process_l2_frame_compl 3 65072 _002942_hash NULL
++_002943_hash brcmu_pkt_buf_get_skb 1 5556 _002943_hash NULL
++_002944_hash br_send_bpdu 3 29669 _002944_hash NULL
++_002945_hash bt_skb_send_alloc 2 6581 _002945_hash NULL
++_002946_hash c4iw_reject_cr 3 28174 _002946_hash NULL
++_002947_hash carl9170_rx_copy_data 2 21656 _002947_hash NULL
++_002948_hash cfpkt_add_body 3 44630 _002948_hash NULL
++_002949_hash cfpkt_append 3 61206 _002949_hash NULL
++_002950_hash cosa_net_setup_rx 2 38594 _002950_hash NULL
++_002951_hash cxgb4_pktgl_to_skb 2 61899 _002951_hash NULL
++_002952_hash dn_alloc_send_pskb 2 4465 _002952_hash NULL
++_002953_hash dn_nsp_return_disc 2 60296 _002953_hash NULL
++_002954_hash dn_nsp_send_disc 2 23469 _002954_hash NULL
++_002955_hash dsp_tone_hw_message 3 17678 _002955_hash NULL
++_002956_hash dvb_net_sec 3 37884 _002956_hash NULL
++_002957_hash e1000_check_copybreak 3 62448 _002957_hash NULL
++_002958_hash fast_rx_path 3 59214 _002958_hash NULL
++_002959_hash fc_fcp_frame_alloc 2 12624 _002959_hash NULL
++_002960_hash fcoe_ctlr_send_keep_alive 3 15308 _002960_hash NULL
++_002961_hash fwnet_incoming_packet 3 40380 _002961_hash NULL
++_002962_hash fwnet_pd_new 4 39947 _002962_hash NULL
++_002963_hash got_frame 2 16028 _002963_hash NULL
++_002964_hash gsm_mux_rx_netchar 3 33336 _002964_hash NULL
++_002965_hash hdlcdev_rx 3 997 _002965_hash NULL
++_002966_hash hdlc_empty_fifo 2 18397 _002966_hash NULL
++_002967_hash hfc_empty_fifo 2 57972 _002967_hash NULL
++_002968_hash hfcpci_empty_fifo 4 2427 _002968_hash NULL
++_002969_hash hfcsusb_rx_frame 3 52745 _002969_hash NULL
++_002970_hash hidp_output_raw_report 3 5629 _002970_hash NULL
++_002971_hash hscx_empty_fifo 2 13360 _002971_hash NULL
++_002972_hash hysdn_rx_netpkt 3 16136 _002972_hash NULL
++_002973_hash ieee80211_fragment 4 33112 _002973_hash NULL
++_002974_hash ieee80211_probereq_get 4-6 29069 _002974_hash NULL
++_002976_hash ieee80211_send_auth 5 24121 _002976_hash NULL
++_002977_hash ieee80211_set_probe_resp 3 10077 _002977_hash NULL
++_002978_hash ieee80211_tdls_mgmt 8 9581 _002978_hash NULL
++_002979_hash ip6_ufo_append_data 5-7-6 4780 _002979_hash NULL
++_002982_hash ip_ufo_append_data 6-8-7 12775 _002982_hash NULL
++_002985_hash ipw_packet_received_skb 2 1230 _002985_hash NULL
++_002986_hash iwch_reject_cr 3 23901 _002986_hash NULL
++_002987_hash iwm_rx_packet_alloc 3 9898 _002987_hash NULL
++_002988_hash ixgb_check_copybreak 3 5847 _002988_hash NULL
++_002989_hash l1oip_socket_parse 4 4507 _002989_hash NULL
++_002990_hash l2cap_send_cmd 4 14548 _002990_hash NULL
++_002991_hash l2tp_ip6_sendmsg 4 7461 _002991_hash NULL
++_002993_hash lowpan_fragment_xmit 3-4 22095 _002993_hash NULL
++_002996_hash mcs_unwrap_fir 3 25733 _002996_hash NULL
++_002997_hash mcs_unwrap_mir 3 9455 _002997_hash NULL
++_002998_hash mld_newpack 2 50950 _002998_hash NULL
++_002999_hash nfc_alloc_send_skb 4 3167 _002999_hash NULL
++_003000_hash p54_download_eeprom 4 43842 _003000_hash NULL
++_003002_hash ppp_tx_cp 5 62044 _003002_hash NULL
++_003003_hash prism2_send_mgmt 4 62605 _003003_hash &_001876_hash
++_003004_hash prism2_sta_send_mgmt 5 43916 _003004_hash NULL
++_003005_hash _queue_data 4 54983 _003005_hash NULL
++_003006_hash read_dma 3 55086 _003006_hash NULL
++_003007_hash read_fifo 3 826 _003007_hash NULL
++_003008_hash receive_copy 3 12216 _003008_hash NULL
++_003009_hash rtl8169_try_rx_copy 3 705 _003009_hash NULL
++_003010_hash _rtl92s_firmware_downloadcode 3 14021 _003010_hash NULL
++_003011_hash rx_data 4 60442 _003011_hash NULL
++_003012_hash sis190_try_rx_copy 3 57069 _003012_hash NULL
++_003013_hash skge_rx_get 3 40598 _003013_hash NULL
++_003014_hash tcp_mark_head_lost 2 35895 _003014_hash NULL
++_003015_hash tcp_match_skb_to_sack 3-4 23568 _003015_hash NULL
++_003017_hash tso_fragment 3 29050 _003017_hash NULL
++_003018_hash tt_response_fill_table 1 57902 _003018_hash NULL
++_003020_hash udpv6_sendmsg 4 22316 _003020_hash NULL
++_003021_hash velocity_rx_copy 2 34583 _003021_hash NULL
++_003022_hash W6692_empty_Bfifo 2 47804 _003022_hash NULL
++_003023_hash zd_mac_rx 3 38296 _003023_hash NULL
++_003024_hash ath6kl_wmi_get_new_buf 1 52304 _003024_hash NULL
++_003025_hash bat_iv_ogm_queue_add 3 30870 _003025_hash NULL
++_003026_hash brcmf_alloc_pkt_and_read 2 63116 _003026_hash &_001808_hash
++_003027_hash brcmf_sdcard_recv_buf 6 38179 _003027_hash NULL
++_003028_hash brcmf_sdcard_rwdata 5 65041 _003028_hash NULL
++_003029_hash brcmf_sdcard_send_buf 6 7713 _003029_hash NULL
++_003030_hash carl9170_handle_mpdu 3 11056 _003030_hash NULL
++_003031_hash cfpkt_add_trail 3 27260 _003031_hash NULL
++_003032_hash cfpkt_pad_trail 2 55511 _003032_hash NULL
++_003033_hash dvb_net_sec_callback 2 28786 _003033_hash NULL
++_003034_hash fwnet_receive_packet 9 50537 _003034_hash NULL
++_003035_hash handle_rx_packet 3 58993 _003035_hash NULL
++_003036_hash HDLC_irq 2 8709 _003036_hash NULL
++_003037_hash hdlc_rpr_irq 2 10240 _003037_hash NULL
++_003043_hash ipwireless_network_packet_received 4 51277 _003043_hash NULL
++_003044_hash l2cap_bredr_sig_cmd 3 49065 _003044_hash NULL
++_003045_hash l2cap_sock_alloc_skb_cb 2 33532 _003045_hash NULL
++_003046_hash llcp_allocate_pdu 3 19866 _003046_hash NULL
++_003047_hash ppp_cp_event 6 2965 _003047_hash NULL
++_003048_hash receive_client_update_packet 3 49104 _003048_hash NULL
++_003049_hash receive_server_sync_packet 3 59021 _003049_hash NULL
++_003050_hash sky2_receive 2 13407 _003050_hash NULL
++_003051_hash tcp_sacktag_walk 5-6 49703 _003051_hash NULL
++_003053_hash tcp_write_xmit 2 64602 _003053_hash NULL
++_003054_hash ath6kl_wmi_add_wow_pattern_cmd 4 12842 _003054_hash NULL
++_003055_hash ath6kl_wmi_beginscan_cmd 8 25462 _003055_hash NULL
++_003056_hash ath6kl_wmi_send_probe_response_cmd 6 31728 _003056_hash NULL
++_003057_hash ath6kl_wmi_set_appie_cmd 5 39266 _003057_hash NULL
++_003058_hash ath6kl_wmi_set_ie_cmd 6 37260 _003058_hash NULL
++_003059_hash ath6kl_wmi_startscan_cmd 8 33674 _003059_hash NULL
++_003060_hash ath6kl_wmi_test_cmd 3 27312 _003060_hash NULL
++_003061_hash brcmf_sdbrcm_membytes 3-5 37324 _003061_hash NULL
++_003063_hash brcmf_sdbrcm_read_control 3 22721 _003063_hash NULL
++_003064_hash brcmf_tx_frame 3 20978 _003064_hash NULL
++_003065_hash __carl9170_rx 3 56784 _003065_hash NULL
++_003066_hash cfpkt_setlen 2 49343 _003066_hash NULL
++_003067_hash hdlc_irq_one 2 3944 _003067_hash NULL
++_003069_hash tcp_push_one 2 48816 _003069_hash NULL
++_003070_hash __tcp_push_pending_frames 2 48148 _003070_hash NULL
++_003071_hash brcmf_sdbrcm_bus_txctl 3 42492 _003071_hash NULL
++_003072_hash carl9170_rx 3 13272 _003072_hash NULL
++_003073_hash carl9170_rx_stream 3 1334 _003073_hash NULL
++_003074_hash tcp_push 3 10680 _003074_hash NULL
++_003075_hash create_log 2 8225 _003075_hash NULL
++_003076_hash expand_files 2 17080 _003076_hash NULL
++_003077_hash iio_device_alloc 1 41440 _003077_hash NULL
++_003078_hash OS_mem_token_alloc 1 14276 _003078_hash NULL
++_003079_hash packet_came 3 18072 _003079_hash NULL
++_003080_hash softsynth_write 3 3455 _003080_hash NULL
++_003081_hash alloc_fd 1 37637 _003081_hash NULL
++_003082_hash sys_dup3 2 33421 _003082_hash NULL
++_003083_hash do_fcntl 3 31468 _003083_hash NULL
++_003084_hash sys_dup2 2 25284 _003084_hash NULL
++_003085_hash sys_fcntl 3 19267 _003085_hash NULL
++_003086_hash sys_fcntl64 3 29031 _003086_hash NULL
++_003087_hash cmpk_message_handle_tx 4 54024 _003087_hash NULL
++_003088_hash comedi_buf_alloc 3 24822 _003088_hash NULL
++_003089_hash compat_rw_copy_check_uvector 3 22001 _003089_hash &_001989_hash
++_003090_hash compat_sys_fcntl64 3 60256 _003090_hash NULL
++_003091_hash evtchn_write 3 43278 _003091_hash NULL
++_003092_hash fw_download_code 3 13249 _003092_hash NULL
++_003093_hash fwSendNullPacket 2 54618 _003093_hash NULL
++_003095_hash ieee80211_authentication_req 3 63973 _003095_hash NULL
++_003097_hash rtllib_authentication_req 3 26713 _003097_hash NULL
++_003098_hash SendTxCommandPacket 3 42901 _003098_hash NULL
++_003099_hash snd_nm256_capture_copy 5 28622 _003099_hash NULL
++_003100_hash snd_nm256_playback_copy 5 38567 _003100_hash NULL
++_003101_hash tomoyo_init_log 2 14806 _003101_hash NULL
++_003102_hash usbdux_attach_common 4 51764 _003102_hash NULL
++_003103_hash compat_sys_fcntl 3 15654 _003103_hash NULL
++_003104_hash ieee80211_auth_challenge 3 18810 _003104_hash NULL
++_003105_hash ieee80211_rtl_auth_challenge 3 61897 _003105_hash NULL
++_003106_hash resize_async_buffer 4 64031 _003106_hash &_002119_hash
++_003107_hash rtllib_auth_challenge 3 12493 _003107_hash NULL
++_003108_hash tomoyo_write_log2 2 11732 _003108_hash NULL
++_003109_hash l2cap_sock_alloc_skb_cb 2 27671 _003109_hash NULL
++_003110_hash tcp_sacktag_walk 5-6 26339 _003110_hash NULL
++_003112_hash tcp_write_xmit 2 39755 _003112_hash NULL
++_003113_hash ab8500_address_write 3 4099 _003113_hash NULL
++_003114_hash ab8500_bank_write 3 51960 _003114_hash NULL
++_003115_hash ab8500_val_write 3 16473 _003115_hash NULL
++_003116_hash allocate_probes 1 40204 _003116_hash NULL
++_003117_hash alloc_ftrace_hash 1 57431 _003117_hash &_002532_hash
++_003118_hash __alloc_preds 2 9492 _003118_hash NULL
++_003119_hash __alloc_pred_stack 2 26687 _003119_hash NULL
++_003120_hash alloc_sched_domains 1 47756 _003120_hash NULL
++_003121_hash alloc_trace_probe 6 12323 _003121_hash NULL
++_003122_hash blk_dropped_read 3 4168 _003122_hash NULL
++_003123_hash blk_msg_write 3 13655 _003123_hash NULL
++_003124_hash cyttsp_probe 4 1940 _003124_hash NULL
++_003125_hash dccpprobe_read 3 52549 _003125_hash NULL
++_003126_hash event_enable_read 3 7074 _003126_hash NULL
++_003127_hash event_enable_write 3 45238 _003127_hash NULL
++_003128_hash event_filter_read 3 23494 _003128_hash NULL
++_003129_hash event_filter_write 3 56609 _003129_hash NULL
++_003130_hash event_id_read 3 64288 _003130_hash &_001240_hash
++_003131_hash ftrace_pid_write 3 39710 _003131_hash NULL
++_003132_hash ftrace_profile_read 3 21327 _003132_hash NULL
++_003133_hash ftrace_profile_write 3 53327 _003133_hash NULL
++_003134_hash hsc_msg_alloc 1 60990 _003134_hash NULL
++_003135_hash hsc_write 3 55875 _003135_hash NULL
++_003136_hash hsi_alloc_controller 1 41802 _003136_hash NULL
++_003137_hash hsi_register_board_info 2 13820 _003137_hash NULL
++_003138_hash ivtvfb_write 3 40023 _003138_hash NULL
++_003139_hash probes_write 3 29711 _003139_hash NULL
++_003140_hash rb_simple_read 3 45972 _003140_hash NULL
++_003141_hash rb_simple_write 3 20890 _003141_hash NULL
++_003142_hash show_header 3 4722 _003142_hash &_000736_hash
++_003143_hash stack_max_size_read 3 1445 _003143_hash NULL
++_003144_hash stack_max_size_write 3 36068 _003144_hash NULL
++_003145_hash subsystem_filter_read 3 62310 _003145_hash NULL
++_003146_hash subsystem_filter_write 3 13022 _003146_hash NULL
++_003147_hash system_enable_read 3 25815 _003147_hash NULL
++_003148_hash system_enable_write 3 61396 _003148_hash NULL
++_003149_hash trace_options_core_read 3 47390 _003149_hash NULL
++_003150_hash trace_options_core_write 3 61551 _003150_hash NULL
++_003151_hash trace_options_read 3 11419 _003151_hash NULL
++_003152_hash trace_options_write 3 48275 _003152_hash NULL
++_003153_hash trace_parser_get_init 2 31379 _003153_hash NULL
++_003154_hash trace_seq_to_user 3 65398 _003154_hash NULL
++_003155_hash tracing_buffers_read 3 11124 _003155_hash NULL
++_003156_hash tracing_clock_write 3 27961 _003156_hash NULL
++_003157_hash tracing_cpumask_read 3 7010 _003157_hash NULL
++_003158_hash tracing_ctrl_read 3 46922 _003158_hash NULL
++_003159_hash tracing_ctrl_write 3 42324 _003159_hash &_001726_hash
++_003160_hash tracing_entries_read 3 8345 _003160_hash NULL
++_003161_hash tracing_entries_write 3 60563 _003161_hash NULL
++_003162_hash tracing_max_lat_read 3 8890 _003162_hash NULL
++_003163_hash tracing_max_lat_write 3 8728 _003163_hash NULL
++_003164_hash tracing_read_dyn_info 3 45468 _003164_hash NULL
++_003165_hash tracing_readme_read 3 16493 _003165_hash NULL
++_003166_hash tracing_saved_cmdlines_read 3 21434 _003166_hash NULL
++_003167_hash tracing_set_trace_read 3 44122 _003167_hash NULL
++_003168_hash tracing_set_trace_write 3 57096 _003168_hash NULL
++_003169_hash tracing_stats_read 3 34537 _003169_hash NULL
++_003170_hash tracing_total_entries_read 3 62817 _003170_hash NULL
++_003171_hash tracing_trace_options_write 3 153 _003171_hash NULL
++_003172_hash ttm_put_pages 2 9179 _003172_hash NULL
++_003173_hash u_memcpya 2-3 30139 _003173_hash NULL
++_003174_hash alloc_and_copy_ftrace_hash 1 29368 _003174_hash NULL
++_003175_hash ath6kl_sdio_alloc_prep_scat_req 2 51986 _003175_hash NULL
++_003176_hash ath6kl_usb_submit_ctrl_in 6 32880 _003176_hash &_000778_hash
++_003177_hash ath6kl_usb_submit_ctrl_out 6 9978 _003177_hash NULL
++_003178_hash brcmf_usbdev_qinit 2 19090 _003178_hash &_001533_hash
++_003179_hash brcmf_usb_dl_cmd 4 53130 _003179_hash NULL
++_003180_hash create_trace_probe 1 20175 _003180_hash NULL
++_003181_hash da9052_group_write 3 4534 _003181_hash NULL
++_003182_hash mmio_read 4 40348 _003182_hash NULL
++_003183_hash ptp_filter_init 2 36780 _003183_hash NULL
++_003184_hash read_file_dfs 3 43145 _003184_hash NULL
++_003185_hash tracing_read_pipe 3 35312 _003185_hash NULL
++_003186_hash vivi_read 3 23073 _003186_hash NULL
++_003187_hash arcfb_write 3 8702 _003187_hash NULL
++_003188_hash beacon_interval_write 3 17952 _003188_hash NULL
++_003189_hash brcmf_usb_attach 1-2 44656 _003189_hash NULL
++_003191_hash broadsheetfb_write 3 39976 _003191_hash NULL
++_003192_hash broadsheet_spiflash_rewrite_sector 2 54864 _003192_hash NULL
++_003193_hash dtim_interval_write 3 30489 _003193_hash NULL
++_003194_hash dynamic_ps_timeout_write 3 37713 _003194_hash NULL
++_003195_hash f_audio_buffer_alloc 1 41110 _003195_hash NULL
++_003196_hash fb_sys_read 3 13778 _003196_hash NULL
++_003197_hash fb_sys_write 3 33130 _003197_hash NULL
++_003198_hash forced_ps_write 3 37209 _003198_hash NULL
++_003199_hash gpio_power_write 3 1991 _003199_hash NULL
++_003200_hash hecubafb_write 3 26942 _003200_hash NULL
++_003201_hash metronomefb_write 3 8823 _003201_hash NULL
++_003202_hash odev_update 2 50169 _003202_hash NULL
++_003203_hash oz_add_farewell 5 20652 _003203_hash NULL
++_003204_hash oz_cdev_read 3 20659 _003204_hash NULL
++_003205_hash oz_cdev_write 3 33852 _003205_hash NULL
++_003206_hash oz_ep_alloc 2 5587 _003206_hash NULL
++_003207_hash pmcraid_copy_sglist 3 38431 _003207_hash NULL
++_003208_hash rx_streaming_always_write 3 32357 _003208_hash NULL
++_003209_hash rx_streaming_interval_write 3 50120 _003209_hash NULL
++_003210_hash split_scan_timeout_write 3 52128 _003210_hash NULL
++_003211_hash suspend_dtim_interval_write 3 48854 _003211_hash NULL
++_003212_hash ufx_alloc_urb_list 3 10349 _003212_hash NULL
++_003213_hash viafb_dfph_proc_write 3 49288 _003213_hash NULL
++_003214_hash viafb_dfpl_proc_write 3 627 _003214_hash NULL
++_003215_hash viafb_dvp0_proc_write 3 23023 _003215_hash NULL
++_003216_hash viafb_dvp1_proc_write 3 48864 _003216_hash NULL
++_003217_hash viafb_vt1636_proc_write 3 16018 _003217_hash NULL
++_003218_hash wl1271_rx_handle_data 3 56360 _003218_hash NULL
++_003219_hash wl12xx_cmd_build_probe_req 6-8 3098 _003219_hash NULL
++_003220_hash picolcd_fb_write 3 2318 _003220_hash NULL
++_003221_hash dlfb_ops_write 3 64150 _003221_hash NULL
++_003222_hash ufx_ops_write 3 54848 _003222_hash NULL
++_003223_hash viafb_iga1_odev_proc_write 3 36241 _003223_hash NULL
++_003224_hash viafb_iga2_odev_proc_write 3 2363 _003224_hash NULL
++_003225_hash xenfb_write 3 43412 _003225_hash NULL
diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
new file mode 100644
-index 0000000..cc96254
+index 0000000..24b6c8e
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin.c
-@@ -0,0 +1,1204 @@
+@@ -0,0 +1,1595 @@
+/*
+ * Copyright 2011, 2012 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2, or (at your option) v3
@@ -83369,6 +85466,14 @@ index 0000000..cc96254
+
+#include "size_overflow_hash.h"
+
++enum marked {
++ MARKED_NO, MARKED_YES, MARKED_NOT_INTENTIONAL
++};
++
++enum overflow_reason {
++ OVERFLOW_NONE, OVERFLOW_INTENTIONAL
++};
++
+#define __unused __attribute__((__unused__))
+#define NAME(node) IDENTIFIER_POINTER(DECL_NAME(node))
+#define NAME_LEN(node) IDENTIFIER_LENGTH(DECL_NAME(node))
@@ -83376,7 +85481,9 @@ index 0000000..cc96254
+#define AFTER_STMT false
+#define CREATE_NEW_VAR NULL_TREE
+#define CODES_LIMIT 32
-+#define MAX_PARAM 10
++#define MAX_PARAM 16
++#define MY_STMT GF_PLF_1
++#define NO_CAST_CHECK GF_PLF_2
+
+#if BUILDING_GCC_VERSION == 4005
+#define DECL_CHAIN(NODE) (TREE_CHAIN(DECL_MINIMAL_CHECK(NODE)))
@@ -83386,20 +85493,30 @@ index 0000000..cc96254
+void debug_gimple_stmt(gimple gs);
+
+static tree expand(struct pointer_set_t *visited, bool *potentionally_overflowed, tree var);
-+static tree signed_size_overflow_type;
-+static tree unsigned_size_overflow_type;
+static tree report_size_overflow_decl;
+static tree const_char_ptr_type_node;
+static unsigned int handle_function(void);
++static void check_size_overflow(gimple stmt, tree size_overflow_type, tree cast_rhs, tree rhs, bool *potentionally_overflowed, bool before);
++static tree get_size_overflow_type(gimple stmt, tree node);
+
+static struct plugin_info size_overflow_plugin_info = {
-+ .version = "20120618beta",
++ .version = "20120811beta",
+ .help = "no-size-overflow\tturn off size overflow checking\n",
+};
+
+static tree handle_size_overflow_attribute(tree *node, tree __unused name, tree args, int __unused flags, bool *no_add_attrs)
+{
-+ unsigned int arg_count = type_num_arguments(*node);
++ unsigned int arg_count;
++
++ if (TREE_CODE(*node) == FUNCTION_DECL)
++ arg_count = type_num_arguments(TREE_TYPE(*node));
++ else if (TREE_CODE(*node) == FUNCTION_TYPE || TREE_CODE(*node) == METHOD_TYPE)
++ arg_count = type_num_arguments(*node);
++ else {
++ *no_add_attrs = true;
++ error("%qE attribute only applies to functions", name);
++ return NULL_TREE;
++ }
+
+ for (; args; args = TREE_CHAIN(args)) {
+ tree position = TREE_VALUE(args);
@@ -83411,22 +85528,36 @@ index 0000000..cc96254
+ return NULL_TREE;
+}
+
-+static struct attribute_spec no_size_overflow_attr = {
++static struct attribute_spec size_overflow_attr = {
+ .name = "size_overflow",
+ .min_length = 1,
+ .max_length = -1,
-+ .decl_required = false,
-+ .type_required = true,
-+ .function_type_required = true,
++ .decl_required = true,
++ .type_required = false,
++ .function_type_required = false,
+ .handler = handle_size_overflow_attribute,
+#if BUILDING_GCC_VERSION >= 4007
+ .affects_type_identity = false
+#endif
+};
+
++static struct attribute_spec intentional_overflow_attr = {
++ .name = "intentional_overflow",
++ .min_length = 1,
++ .max_length = -1,
++ .decl_required = true,
++ .type_required = false,
++ .function_type_required = false,
++ .handler = NULL,
++#if BUILDING_GCC_VERSION >= 4007
++ .affects_type_identity = false
++#endif
++};
++
+static void register_attributes(void __unused *event_data, void __unused *data)
+{
-+ register_attribute(&no_size_overflow_attr);
++ register_attribute(&size_overflow_attr);
++ register_attribute(&intentional_overflow_attr);
+}
+
+// http://www.team5150.com/~andrew/noncryptohashzoo2~/CrapWow.html
@@ -83477,11 +85608,12 @@ index 0000000..cc96254
+
+static inline gimple get_def_stmt(tree node)
+{
++ gcc_assert(node != NULL_TREE);
+ gcc_assert(TREE_CODE(node) == SSA_NAME);
+ return SSA_NAME_DEF_STMT(node);
+}
+
-+static unsigned char get_tree_code(tree type)
++static unsigned char get_tree_code(const_tree type)
+{
+ switch (TREE_CODE(type)) {
+ case ARRAY_TYPE:
@@ -83508,13 +85640,17 @@ index 0000000..cc96254
+ return 10;
+ case REFERENCE_TYPE:
+ return 11;
++ case OFFSET_TYPE:
++ return 12;
++ case COMPLEX_TYPE:
++ return 13;
+ default:
-+ debug_tree(type);
++ debug_tree((tree)type);
+ gcc_unreachable();
+ }
+}
+
-+static size_t add_type_codes(tree type, unsigned char *tree_codes, size_t len)
++static size_t add_type_codes(const_tree type, unsigned char *tree_codes, size_t len)
+{
+ gcc_assert(type != NULL_TREE);
+
@@ -83639,11 +85775,11 @@ index 0000000..cc96254
+ gcc_assert(TREE_CODE(arg) != COMPONENT_REF);
+
+ type = TREE_TYPE(arg);
-+ // skip function pointers
-+ if (TREE_CODE(type) == POINTER_TYPE && TREE_CODE(TREE_TYPE(type)) == FUNCTION_TYPE)
++
++ if (TREE_CODE(type) == POINTER_TYPE)
+ return;
+
-+ if (lookup_attribute("size_overflow", TYPE_ATTRIBUTES(TREE_TYPE(func))))
++ if (lookup_attribute("size_overflow", DECL_ATTRIBUTES(func)))
+ return;
+
+ argnum = find_arg_number(arg, func);
@@ -83664,6 +85800,22 @@ index 0000000..cc96254
+ return new_var;
+}
+
++static gimple create_binary_assign(enum tree_code code, gimple stmt, tree rhs1, tree rhs2)
++{
++ gimple assign;
++ gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
++ tree type = TREE_TYPE(rhs1);
++ tree lhs = create_new_var(type);
++
++ assign = gimple_build_assign_with_ops(code, lhs, rhs1, rhs2);
++ gimple_set_lhs(assign, make_ssa_name(lhs, assign));
++
++ gsi_insert_before(&gsi, assign, GSI_NEW_STMT);
++ update_stmt(assign);
++ gimple_set_plf(assign, MY_STMT, true);
++ return assign;
++}
++
+static bool is_bool(tree node)
+{
+ tree type;
@@ -83683,34 +85835,63 @@ index 0000000..cc96254
+
+static tree cast_a_tree(tree type, tree var)
+{
-+ gcc_assert(type != NULL_TREE && var != NULL_TREE);
++ gcc_assert(type != NULL_TREE);
++ gcc_assert(var != NULL_TREE);
+ gcc_assert(fold_convertible_p(type, var));
+
+ return fold_convert(type, var);
+}
+
-+static tree signed_cast(tree var)
-+{
-+ return cast_a_tree(signed_size_overflow_type, var);
-+}
-+
-+static gimple build_cast_stmt(tree type, tree var, tree new_var, location_t loc)
++static gimple build_cast_stmt(tree type, tree var, tree new_var, gimple_stmt_iterator *gsi, bool before)
+{
+ gimple assign;
++ location_t loc;
++
++ gcc_assert(type != NULL_TREE && var != NULL_TREE);
++ if (gsi_end_p(*gsi) && before == BEFORE_STMT)
++ gcc_unreachable();
+
+ if (new_var == CREATE_NEW_VAR)
+ new_var = create_new_var(type);
+
+ assign = gimple_build_assign(new_var, cast_a_tree(type, var));
-+ gimple_set_location(assign, loc);
++
++ if (!gsi_end_p(*gsi)) {
++ loc = gimple_location(gsi_stmt(*gsi));
++ gimple_set_location(assign, loc);
++ }
++
+ gimple_set_lhs(assign, make_ssa_name(new_var, assign));
+
++ if (before)
++ gsi_insert_before(gsi, assign, GSI_NEW_STMT);
++ else
++ gsi_insert_after(gsi, assign, GSI_NEW_STMT);
++ update_stmt(assign);
++ gimple_set_plf(assign, MY_STMT, true);
++
+ return assign;
+}
+
++static tree cast_to_new_size_overflow_type(gimple stmt, tree new_rhs1, tree size_overflow_type, bool before)
++{
++ gimple assign;
++ gimple_stmt_iterator gsi;
++
++ if (new_rhs1 == NULL_TREE)
++ return NULL_TREE;
++
++ if (!useless_type_conversion_p(TREE_TYPE(new_rhs1), size_overflow_type)) {
++ gsi = gsi_for_stmt(stmt);
++ assign = build_cast_stmt(size_overflow_type, new_rhs1, CREATE_NEW_VAR, &gsi, before);
++ return gimple_get_lhs(assign);
++ }
++ return new_rhs1;
++}
++
+static tree create_assign(struct pointer_set_t *visited, bool *potentionally_overflowed, gimple oldstmt, tree rhs1, bool before)
+{
-+ tree oldstmt_rhs1;
++ tree oldstmt_rhs1, size_overflow_type, lhs;
+ enum tree_code code;
+ gimple stmt;
+ gimple_stmt_iterator gsi;
@@ -83724,13 +85905,24 @@ index 0000000..cc96254
+ gcc_unreachable();
+ }
+
++ if (gimple_code(oldstmt) == GIMPLE_ASM)
++ lhs = rhs1;
++ else
++ lhs = gimple_get_lhs(oldstmt);
++
+ oldstmt_rhs1 = gimple_assign_rhs1(oldstmt);
+ code = TREE_CODE(oldstmt_rhs1);
-+ if (code == PARM_DECL || (code == SSA_NAME && gimple_code(get_def_stmt(oldstmt_rhs1)) == GIMPLE_NOP))
-+ check_missing_attribute(oldstmt_rhs1);
++ if (code == PARM_DECL || (code == SSA_NAME && gimple_code(get_def_stmt(oldstmt_rhs1)) == GIMPLE_NOP)) {
++ argnum = search_missing_attribute(oldstmt_rhs1);
++ if (argnum && is_already_marked(get_original_function_decl(current_function_decl), argnum) == MARKED_YES) {
++ *overflowed = OVERFLOW_INTENTIONAL;
++ return NULL_TREE;
++ }
++
++ }
+
-+ stmt = build_cast_stmt(signed_size_overflow_type, rhs1, CREATE_NEW_VAR, gimple_location(oldstmt));
+ gsi = gsi_for_stmt(oldstmt);
++ pointer_set_insert(visited, oldstmt);
+ if (lookup_stmt_eh_lp(oldstmt) != 0) {
+ basic_block next_bb, cur_bb;
+ edge e;
@@ -83748,18 +85940,20 @@ index 0000000..cc96254
+
+ gsi = gsi_after_labels(next_bb);
+ gcc_assert(!gsi_end_p(gsi));
++
+ before = true;
++ oldstmt = gsi_stmt(gsi);
++ pointer_set_insert(visited, oldstmt);
+ }
-+ if (before)
-+ gsi_insert_before(&gsi, stmt, GSI_NEW_STMT);
-+ else
-+ gsi_insert_after(&gsi, stmt, GSI_NEW_STMT);
-+ update_stmt(stmt);
-+ pointer_set_insert(visited, oldstmt);
++
++ size_overflow_type = get_size_overflow_type(oldstmt, lhs);
++
++ stmt = build_cast_stmt(size_overflow_type, rhs1, CREATE_NEW_VAR, &gsi, before);
++ gimple_set_plf(stmt, MY_STMT, true);
+ return gimple_get_lhs(stmt);
+}
+
-+static tree dup_assign(struct pointer_set_t *visited, bool *potentionally_overflowed, gimple oldstmt, tree rhs1, tree rhs2, tree __unused rhs3)
++static tree dup_assign(struct pointer_set_t *visited, bool *potentionally_overflowed, gimple oldstmt, tree size_overflow_type, tree rhs1, tree rhs2, tree __unused rhs3)
+{
+ tree new_var, lhs = gimple_get_lhs(oldstmt);
+ gimple stmt;
@@ -83768,17 +85962,21 @@ index 0000000..cc96254
+ if (!*potentionally_overflowed)
+ return NULL_TREE;
+
++ if (gimple_plf(oldstmt, MY_STMT))
++ return lhs;
++
+ if (gimple_num_ops(oldstmt) != 4 && rhs1 == NULL_TREE) {
+ rhs1 = gimple_assign_rhs1(oldstmt);
-+ rhs1 = create_assign(visited, potentionally_overflowed, oldstmt, rhs1, BEFORE_STMT);
++ rhs1 = create_assign(visited, overflowed, oldstmt, rhs1, BEFORE_STMT);
+ }
+ if (gimple_num_ops(oldstmt) == 3 && rhs2 == NULL_TREE) {
+ rhs2 = gimple_assign_rhs2(oldstmt);
-+ rhs2 = create_assign(visited, potentionally_overflowed, oldstmt, rhs2, BEFORE_STMT);
++ rhs2 = create_assign(visited, overflowed, oldstmt, rhs2, BEFORE_STMT);
+ }
+
+ stmt = gimple_copy(oldstmt);
+ gimple_set_location(stmt, gimple_location(oldstmt));
++ gimple_set_plf(stmt, MY_STMT, true);
+
+ if (gimple_assign_rhs_code(oldstmt) == WIDEN_MULT_EXPR)
+ gimple_assign_set_rhs_code(stmt, MULT_EXPR);
@@ -83786,13 +85984,13 @@ index 0000000..cc96254
+ if (is_bool(lhs))
+ new_var = SSA_NAME_VAR(lhs);
+ else
-+ new_var = create_new_var(signed_size_overflow_type);
++ new_var = create_new_var(size_overflow_type);
+ new_var = make_ssa_name(new_var, stmt);
+ gimple_set_lhs(stmt, new_var);
+
+ if (rhs1 != NULL_TREE) {
+ if (!gimple_assign_cast_p(oldstmt))
-+ rhs1 = signed_cast(rhs1);
++ rhs1 = cast_a_tree(size_overflow_type, rhs1);
+ gimple_assign_set_rhs1(stmt, rhs1);
+ }
+
@@ -83827,6 +86025,7 @@ index 0000000..cc96254
+ gsi = gsi_for_stmt(oldstmt);
+ gsi_insert_after(&gsi, phi, GSI_NEW_STMT);
+ gimple_set_bb(phi, bb);
++ gimple_set_plf(phi, MY_STMT, true);
+ return phi;
+}
+
@@ -83840,28 +86039,29 @@ index 0000000..cc96254
+ return first_bb;
+}
+
-+static gimple cast_old_phi_arg(gimple oldstmt, tree arg, tree new_var, unsigned int i)
++static tree cast_old_phi_arg(gimple oldstmt, tree size_overflow_type, tree arg, tree new_var, unsigned int i)
+{
+ basic_block bb;
-+ gimple newstmt, def_stmt;
++ gimple newstmt;
+ gimple_stmt_iterator gsi;
++ bool before = BEFORE_STMT;
+
-+ newstmt = build_cast_stmt(signed_size_overflow_type, arg, new_var, gimple_location(oldstmt));
-+ if (TREE_CODE(arg) == SSA_NAME) {
-+ def_stmt = get_def_stmt(arg);
-+ if (gimple_code(def_stmt) != GIMPLE_NOP) {
-+ gsi = gsi_for_stmt(def_stmt);
-+ gsi_insert_after(&gsi, newstmt, GSI_NEW_STMT);
-+ return newstmt;
-+ }
++ if (TREE_CODE(arg) == SSA_NAME && gimple_code(get_def_stmt(arg)) != GIMPLE_NOP) {
++ gsi = gsi_for_stmt(get_def_stmt(arg));
++ newstmt = build_cast_stmt(size_overflow_type, arg, new_var, &gsi, AFTER_STMT);
++ return gimple_get_lhs(newstmt);
+ }
+
+ bb = gimple_phi_arg_edge(oldstmt, i)->src;
-+ if (bb->index == 0)
-+ bb = create_a_first_bb();
+ gsi = gsi_after_labels(bb);
-+ gsi_insert_before(&gsi, newstmt, GSI_NEW_STMT);
-+ return newstmt;
++ if (bb->index == 0) {
++ bb = create_a_first_bb();
++ gsi = gsi_start_bb(bb);
++ }
++ if (gsi_end_p(gsi))
++ before = AFTER_STMT;
++ newstmt = build_cast_stmt(size_overflow_type, arg, new_var, &gsi, before);
++ return gimple_get_lhs(newstmt);
+}
+
+static gimple handle_new_phi_arg(tree arg, tree new_var, tree new_rhs)
@@ -83894,30 +86094,36 @@ index 0000000..cc96254
+
+ gimple_set_lhs(newstmt, make_ssa_name(new_var, newstmt));
+ gsi_insert(&gsi, newstmt, GSI_NEW_STMT);
++ gimple_set_plf(newstmt, MY_STMT, true);
+ update_stmt(newstmt);
+ return newstmt;
+}
+
-+static tree build_new_phi_arg(struct pointer_set_t *visited, bool *potentionally_overflowed, tree arg, tree new_var)
++static tree build_new_phi_arg(struct pointer_set_t *visited, bool *potentionally_overflowed, tree size_overflow_type, tree arg, tree new_var)
+{
+ gimple newstmt;
+ tree new_rhs;
+
+ new_rhs = expand(visited, potentionally_overflowed, arg);
-+
+ if (new_rhs == NULL_TREE)
+ return NULL_TREE;
+
++ new_rhs = cast_to_new_size_overflow_type(get_def_stmt(new_rhs), new_rhs, size_overflow_type, AFTER_STMT);
++
+ newstmt = handle_new_phi_arg(arg, new_var, new_rhs);
+ return gimple_get_lhs(newstmt);
+}
+
-+static tree build_new_phi(struct pointer_set_t *visited, bool *potentionally_overflowed, gimple oldstmt)
++static tree build_new_phi(struct pointer_set_t *visited, bool *potentionally_overflowed, tree var)
+{
-+ gimple phi;
-+ tree new_var = create_new_var(signed_size_overflow_type);
++ gimple phi, oldstmt = get_def_stmt(var);
++ tree new_var, size_overflow_type;
+ unsigned int i, n = gimple_phi_num_args(oldstmt);
+
++ size_overflow_type = get_size_overflow_type(oldstmt, var);
++
++ new_var = create_new_var(size_overflow_type);
++
+ pointer_set_insert(visited, oldstmt);
+ phi = overflow_create_phi_node(oldstmt, new_var);
+ for (i = 0; i < n; i++) {
@@ -83925,10 +86131,10 @@ index 0000000..cc96254
+
+ arg = gimple_phi_arg_def(oldstmt, i);
+ if (is_gimple_constant(arg))
-+ arg = signed_cast(arg);
-+ lhs = build_new_phi_arg(visited, potentionally_overflowed, arg, new_var);
++ arg = cast_a_tree(size_overflow_type, arg);
++ lhs = build_new_phi_arg(visited, potentionally_overflowed, size_overflow_type, arg, new_var);
+ if (lhs == NULL_TREE)
-+ lhs = gimple_get_lhs(cast_old_phi_arg(oldstmt, arg, new_var, i));
++ lhs = cast_old_phi_arg(oldstmt, size_overflow_type, arg, new_var, i);
+ add_phi_arg(phi, lhs, gimple_phi_arg_edge(oldstmt, i), gimple_location(oldstmt));
+ }
+
@@ -83936,35 +86142,132 @@ index 0000000..cc96254
+ return gimple_phi_result(phi);
+}
+
-+static tree handle_unary_rhs(struct pointer_set_t *visited, bool *potentionally_overflowed, tree var)
++static tree change_assign_rhs(gimple stmt, tree orig_rhs, tree new_rhs)
+{
-+ gimple def_stmt = get_def_stmt(var);
-+ tree new_rhs1, rhs1 = gimple_assign_rhs1(def_stmt);
++ gimple assign;
++ gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
++ tree origtype = TREE_TYPE(orig_rhs);
++
++ gcc_assert(gimple_code(stmt) == GIMPLE_ASSIGN);
++
++ assign = build_cast_stmt(origtype, new_rhs, CREATE_NEW_VAR, &gsi, BEFORE_STMT);
++ return gimple_get_lhs(assign);
++}
++
++static void change_rhs1(gimple stmt, tree new_rhs1)
++{
++ tree assign_rhs;
++ tree rhs = gimple_assign_rhs1(stmt);
++
++ assign_rhs = change_assign_rhs(stmt, rhs, new_rhs1);
++ gimple_assign_set_rhs1(stmt, assign_rhs);
++ update_stmt(stmt);
++}
++
++static bool check_mode_type(gimple stmt)
++{
++ tree lhs = gimple_get_lhs(stmt);
++ tree lhs_type = TREE_TYPE(lhs);
++ tree rhs_type = TREE_TYPE(gimple_assign_rhs1(stmt));
++ enum machine_mode lhs_mode = TYPE_MODE(lhs_type);
++ enum machine_mode rhs_mode = TYPE_MODE(rhs_type);
++
++ if (rhs_mode == lhs_mode && TYPE_UNSIGNED(rhs_type) == TYPE_UNSIGNED(lhs_type))
++ return false;
++
++ if (rhs_mode == SImode && lhs_mode == DImode && (TYPE_UNSIGNED(rhs_type) || !TYPE_UNSIGNED(lhs_type)))
++ return false;
++
++ return true;
++}
++
++static bool check_undefined_integer_operation(gimple stmt)
++{
++ gimple def_stmt;
++ tree lhs = gimple_get_lhs(stmt);
++ tree rhs1 = gimple_assign_rhs1(stmt);
++ tree rhs1_type = TREE_TYPE(rhs1);
++ tree lhs_type = TREE_TYPE(lhs);
++
++ if (TYPE_MODE(rhs1_type) != TYPE_MODE(lhs_type) || TYPE_UNSIGNED(rhs1_type) == TYPE_UNSIGNED(lhs_type))
++ return false;
++
++ def_stmt = get_def_stmt(rhs1);
++ if (gimple_code(def_stmt) != GIMPLE_ASSIGN)
++ return false;
++
++ if (gimple_assign_rhs_code(def_stmt) != MINUS_EXPR)
++ return false;
++ return true;
++}
++
++static tree handle_unary_rhs(struct pointer_set_t *visited, bool *potentionally_overflowed, gimple stmt)
++{
++ tree size_overflow_type, lhs = gimple_get_lhs(stmt);
++ tree new_rhs1, rhs1 = gimple_assign_rhs1(stmt);
++ tree rhs1_type = TREE_TYPE(rhs1);
++ tree lhs_type = TREE_TYPE(lhs);
+
+ *potentionally_overflowed = true;
++
+ new_rhs1 = expand(visited, potentionally_overflowed, rhs1);
-+ if (new_rhs1 == NULL_TREE) {
-+ if (TREE_CODE(TREE_TYPE(rhs1)) == POINTER_TYPE)
-+ return create_assign(visited, potentionally_overflowed, def_stmt, var, AFTER_STMT);
-+ else
-+ return create_assign(visited, potentionally_overflowed, def_stmt, rhs1, AFTER_STMT);
++
++ if (new_rhs1 == NULL_TREE || TREE_CODE(rhs1_type) == POINTER_TYPE)
++ return create_assign(visited, potentionally_overflowed, stmt, lhs, AFTER_STMT);
++
++ if (gimple_plf(stmt, MY_STMT))
++ return lhs;
++
++ if (gimple_plf(stmt, NO_CAST_CHECK)) {
++ size_overflow_type = get_size_overflow_type(stmt, rhs1);
++ new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
++ return dup_assign(visited, potentionally_overflowed, stmt, size_overflow_type, new_rhs1, NULL_TREE, NULL_TREE);
++ }
++
++ if (!gimple_assign_cast_p(stmt)) {
++ size_overflow_type = get_size_overflow_type(stmt, lhs);
++ new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
++ return dup_assign(visited, potentionally_overflowed, stmt, size_overflow_type, new_rhs1, NULL_TREE, NULL_TREE);
+ }
-+ return dup_assign(visited, potentionally_overflowed, def_stmt, new_rhs1, NULL_TREE, NULL_TREE);
++
++ if (check_undefined_integer_operation(stmt)) {
++ size_overflow_type = get_size_overflow_type(stmt, lhs);
++ new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
++ return dup_assign(visited, potentionally_overflowed, stmt, size_overflow_type, new_rhs1, NULL_TREE, NULL_TREE);
++ }
++
++ size_overflow_type = get_size_overflow_type(stmt, rhs1);
++ new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
++
++ change_rhs1(stmt, new_rhs1);
++ check_size_overflow(stmt, size_overflow_type, new_rhs1, rhs1, potentionally_overflowed, BEFORE_STMT);
++
++ if (TYPE_UNSIGNED(rhs1_type) != TYPE_UNSIGNED(lhs_type))
++ return create_assign(visited, potentionally_overflowed, stmt, lhs, AFTER_STMT);
++
++ if (!check_mode_type(stmt))
++ return create_assign(visited, potentionally_overflowed, stmt, lhs, AFTER_STMT);
++
++ size_overflow_type = get_size_overflow_type(stmt, lhs);
++ new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
++
++ check_size_overflow(stmt, size_overflow_type, new_rhs1, lhs, potentionally_overflowed, BEFORE_STMT);
++
++ return create_assign(visited, potentionally_overflowed, stmt, lhs, AFTER_STMT);
+}
+
-+static tree handle_unary_ops(struct pointer_set_t *visited, bool *potentionally_overflowed, tree var)
++static tree handle_unary_ops(struct pointer_set_t *visited, bool *potentionally_overflowed, tree lhs)
+{
-+ gimple def_stmt = get_def_stmt(var);
++ gimple def_stmt = get_def_stmt(lhs);
+ tree rhs1 = gimple_assign_rhs1(def_stmt);
+
+ if (is_gimple_constant(rhs1))
-+ return dup_assign(visited, potentionally_overflowed, def_stmt, signed_cast(rhs1), NULL_TREE, NULL_TREE);
++ return create_assign(visited, potentionally_overflowed, def_stmt, lhs, AFTER_STMT);
+
+ gcc_assert(TREE_CODE(rhs1) != COND_EXPR);
+ switch (TREE_CODE(rhs1)) {
+ case SSA_NAME:
-+ return handle_unary_rhs(visited, potentionally_overflowed, var);
-+
++ return handle_unary_rhs(visited, potentionally_overflowed, def_stmt);
+ case ARRAY_REF:
+ case BIT_FIELD_REF:
+ case ADDR_EXPR:
@@ -83976,7 +86279,7 @@ index 0000000..cc96254
+ case PARM_DECL:
+ case TARGET_MEM_REF:
+ case VAR_DECL:
-+ return create_assign(visited, potentionally_overflowed, def_stmt, var, AFTER_STMT);
++ return create_assign(visited, overflowed, def_stmt, lhs, AFTER_STMT);
+
+ default:
+ debug_gimple_stmt(def_stmt);
@@ -84012,11 +86315,12 @@ index 0000000..cc96254
+ return build1(ADDR_EXPR, ptr_type_node, string);
+}
+
-+static void insert_cond_result(basic_block bb_true, gimple stmt, tree arg)
++static void insert_cond_result(basic_block bb_true, gimple stmt, tree arg, bool min)
+{
+ gimple func_stmt, def_stmt;
-+ tree current_func, loc_file, loc_line;
++ tree current_func, loc_file, loc_line, ssa_name;
+ expanded_location xloc;
++ char ssa_name_buf[100];
+ gimple_stmt_iterator gsi = gsi_start_bb(bb_true);
+
+ def_stmt = get_def_stmt(arg);
@@ -84036,8 +86340,15 @@ index 0000000..cc96254
+ current_func = build_string(NAME_LEN(current_function_decl) + 1, NAME(current_function_decl));
+ current_func = create_string_param(current_func);
+
-+ // void report_size_overflow(const char *file, unsigned int line, const char *func)
-+ func_stmt = gimple_build_call(report_size_overflow_decl, 3, loc_file, loc_line, current_func);
++ if (min)
++ snprintf(ssa_name_buf, 100, "%s_%u (min)\n", NAME(SSA_NAME_VAR(arg)), SSA_NAME_VERSION(arg));
++ else
++ snprintf(ssa_name_buf, 100, "%s_%u (max)\n", NAME(SSA_NAME_VAR(arg)), SSA_NAME_VERSION(arg));
++ ssa_name = build_string(100, ssa_name_buf);
++ ssa_name = create_string_param(ssa_name);
++
++ // void report_size_overflow(const char *file, unsigned int line, const char *func, const char *ssa_name)
++ func_stmt = gimple_build_call(report_size_overflow_decl, 4, loc_file, loc_line, current_func, ssa_name);
+
+ gsi_insert_after(&gsi, func_stmt, GSI_CONTINUE_LINKING);
+}
@@ -84049,14 +86360,15 @@ index 0000000..cc96254
+ inform(loc, "Integer size_overflow check applied here.");
+}
+
-+static void insert_check_size_overflow(gimple stmt, enum tree_code cond_code, tree arg, tree type_value)
++static void insert_check_size_overflow(gimple stmt, enum tree_code cond_code, tree arg, tree type_value, bool before, bool min)
+{
+ basic_block cond_bb, join_bb, bb_true;
+ edge e;
+ gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
+
+ cond_bb = gimple_bb(stmt);
-+ gsi_prev(&gsi);
++ if (before)
++ gsi_prev(&gsi);
+ if (gsi_end_p(gsi))
+ e = split_block_after_labels(cond_bb);
+ else
@@ -84082,80 +86394,221 @@ index 0000000..cc96254
+ }
+
+ insert_cond(cond_bb, arg, cond_code, type_value);
-+ insert_cond_result(bb_true, stmt, arg);
++ insert_cond_result(bb_true, stmt, arg, min);
+
+// print_the_code_insertions(stmt);
+}
+
-+static gimple cast_to_unsigned_size_overflow_type(gimple stmt, tree cast_rhs)
++static void check_size_overflow(gimple stmt, tree size_overflow_type, tree cast_rhs, tree rhs, bool *potentionally_overflowed, bool before)
+{
-+ gimple ucast_stmt;
-+ gimple_stmt_iterator gsi;
-+ location_t loc = gimple_location(stmt);
++ tree cast_rhs_type, type_max_type, type_min_type, type_max, type_min, rhs_type = TREE_TYPE(rhs);
++ gcc_assert(rhs_type != NULL_TREE);
++ gcc_assert(TREE_CODE(rhs_type) == INTEGER_TYPE || TREE_CODE(rhs_type) == BOOLEAN_TYPE || TREE_CODE(rhs_type) == ENUMERAL_TYPE);
+
-+ ucast_stmt = build_cast_stmt(unsigned_size_overflow_type, cast_rhs, CREATE_NEW_VAR, loc);
-+ gsi = gsi_for_stmt(stmt);
-+ gsi_insert_before(&gsi, ucast_stmt, GSI_SAME_STMT);
-+ return ucast_stmt;
++ if (!*potentionally_overflowed)
++ return;
++
++ type_max = cast_a_tree(size_overflow_type, TYPE_MAX_VALUE(rhs_type));
++ type_min = cast_a_tree(size_overflow_type, TYPE_MIN_VALUE(rhs_type));
++
++ gcc_assert(!TREE_OVERFLOW(type_max));
++
++ cast_rhs_type = TREE_TYPE(cast_rhs);
++ type_max_type = TREE_TYPE(type_max);
++ type_min_type = TREE_TYPE(type_min);
++ gcc_assert(useless_type_conversion_p(cast_rhs_type, type_max_type));
++ gcc_assert(useless_type_conversion_p(type_max_type, type_min_type));
++
++ insert_check_size_overflow(stmt, GT_EXPR, cast_rhs, type_max, before, false);
++ insert_check_size_overflow(stmt, LT_EXPR, cast_rhs, type_min, before, true);
+}
+
-+static void check_size_overflow(gimple stmt, tree cast_rhs, tree rhs, bool *potentionally_overflowed)
++static tree get_handle_const_assign_size_overflow_type(gimple def_stmt, tree var_rhs)
+{
-+ tree type_max, type_min, rhs_type = TREE_TYPE(rhs);
-+ gimple ucast_stmt;
++ gimple var_rhs_def_stmt;
++ tree lhs = gimple_get_lhs(def_stmt);
++ tree lhs_type = TREE_TYPE(lhs);
++ tree rhs1_type = TREE_TYPE(gimple_assign_rhs1(def_stmt));
++ tree rhs2_type = TREE_TYPE(gimple_assign_rhs2(def_stmt));
+
-+ if (!*potentionally_overflowed)
-+ return;
++ if (var_rhs == NULL_TREE)
++ return get_size_overflow_type(def_stmt, lhs);
+
-+ if (TYPE_UNSIGNED(rhs_type)) {
-+ ucast_stmt = cast_to_unsigned_size_overflow_type(stmt, cast_rhs);
-+ type_max = cast_a_tree(unsigned_size_overflow_type, TYPE_MAX_VALUE(rhs_type));
-+ insert_check_size_overflow(stmt, GT_EXPR, gimple_get_lhs(ucast_stmt), type_max);
-+ } else {
-+ type_max = signed_cast(TYPE_MAX_VALUE(rhs_type));
-+ insert_check_size_overflow(stmt, GT_EXPR, cast_rhs, type_max);
++ var_rhs_def_stmt = get_def_stmt(var_rhs);
++
++ if (TREE_CODE_CLASS(gimple_assign_rhs_code(def_stmt)) == tcc_comparison)
++ return get_size_overflow_type(var_rhs_def_stmt, var_rhs);
+
-+ type_min = signed_cast(TYPE_MIN_VALUE(rhs_type));
-+ insert_check_size_overflow(stmt, LT_EXPR, cast_rhs, type_min);
++ if (gimple_assign_rhs_code(def_stmt) == LSHIFT_EXPR)
++ return get_size_overflow_type(var_rhs_def_stmt, var_rhs);
++
++ if (gimple_assign_rhs_code(def_stmt) == RSHIFT_EXPR)
++ return get_size_overflow_type(var_rhs_def_stmt, var_rhs);
++
++ if (!useless_type_conversion_p(lhs_type, rhs1_type) || !useless_type_conversion_p(rhs1_type, rhs2_type)) {
++ debug_gimple_stmt(def_stmt);
++ gcc_unreachable();
+ }
++
++ return get_size_overflow_type(def_stmt, lhs);
+}
+
-+static tree change_assign_rhs(gimple stmt, tree orig_rhs, tree new_rhs)
++static tree handle_const_assign(struct pointer_set_t *visited, bool *potentionally_overflowed, gimple def_stmt, tree var_rhs, tree new_rhs1, tree new_rhs2)
+{
-+ gimple assign;
-+ gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
-+ tree origtype = TREE_TYPE(orig_rhs);
++ tree new_rhs, size_overflow_type, orig_rhs;
++ void (*gimple_assign_set_rhs)(gimple, tree);
++ tree rhs1 = gimple_assign_rhs1(def_stmt);
++ tree rhs2 = gimple_assign_rhs2(def_stmt);
++ tree lhs = gimple_get_lhs(def_stmt);
+
-+ gcc_assert(gimple_code(stmt) == GIMPLE_ASSIGN);
++ if (var_rhs == NULL_TREE)
++ return create_assign(visited, potentionally_overflowed, def_stmt, lhs, AFTER_STMT);
+
-+ assign = build_cast_stmt(origtype, new_rhs, CREATE_NEW_VAR, gimple_location(stmt));
-+ gsi_insert_before(&gsi, assign, GSI_SAME_STMT);
-+ update_stmt(assign);
-+ return gimple_get_lhs(assign);
-+}
++ if (new_rhs2 == NULL_TREE) {
++ size_overflow_type = get_handle_const_assign_size_overflow_type(def_stmt, new_rhs1);
++ new_rhs2 = cast_a_tree(size_overflow_type, rhs2);
++ orig_rhs = rhs1;
++ gimple_assign_set_rhs = &gimple_assign_set_rhs1;
++ } else {
++ size_overflow_type = get_handle_const_assign_size_overflow_type(def_stmt, new_rhs2);
++ new_rhs1 = cast_a_tree(size_overflow_type, rhs1);
++ orig_rhs = rhs2;
++ gimple_assign_set_rhs = &gimple_assign_set_rhs2;
++ }
+
-+static tree handle_const_assign(struct pointer_set_t *visited, bool *potentionally_overflowed, gimple def_stmt, tree var, tree orig_rhs, tree var_rhs, tree new_rhs1, tree new_rhs2, void (*gimple_assign_set_rhs)(gimple, tree))
-+{
-+ tree new_rhs;
++ var_rhs = cast_to_new_size_overflow_type(def_stmt, var_rhs, size_overflow_type, BEFORE_STMT);
+
+ if (gimple_assign_rhs_code(def_stmt) == MIN_EXPR)
-+ return dup_assign(visited, potentionally_overflowed, def_stmt, new_rhs1, new_rhs2, NULL_TREE);
++ return dup_assign(visited, potentionally_overflowed, def_stmt, size_overflow_type, new_rhs1, new_rhs2, NULL_TREE);
+
-+ if (var_rhs == NULL_TREE)
-+ return create_assign(visited, potentionally_overflowed, def_stmt, var, AFTER_STMT);
++ check_size_overflow(def_stmt, size_overflow_type, var_rhs, orig_rhs, potentionally_overflowed, BEFORE_STMT);
+
+ new_rhs = change_assign_rhs(def_stmt, orig_rhs, var_rhs);
+ gimple_assign_set_rhs(def_stmt, new_rhs);
+ update_stmt(def_stmt);
+
-+ check_size_overflow(def_stmt, var_rhs, orig_rhs, potentionally_overflowed);
-+ return create_assign(visited, potentionally_overflowed, def_stmt, var, AFTER_STMT);
++ return create_assign(visited, potentionally_overflowed, def_stmt, lhs, AFTER_STMT);
+}
+
-+static tree handle_binary_ops(struct pointer_set_t *visited, bool *potentionally_overflowed, tree var)
++static tree get_cast_def_stmt_rhs(tree new_rhs)
+{
-+ tree rhs1, rhs2;
-+ gimple def_stmt = get_def_stmt(var);
++ gimple def_stmt;
++
++ def_stmt = get_def_stmt(new_rhs);
++ // get_size_overflow_type
++ if (LONG_TYPE_SIZE != GET_MODE_BITSIZE(SImode))
++ gcc_assert(gimple_assign_cast_p(def_stmt));
++ return gimple_assign_rhs1(def_stmt);
++}
++
++static tree cast_to_int_TI_type_and_check(bool *potentionally_overflowed, gimple stmt, tree new_rhs)
++{
++ gimple_stmt_iterator gsi;
++ gimple cast_stmt, def_stmt;
++ enum machine_mode mode = TYPE_MODE(TREE_TYPE(new_rhs));
++
++ if (mode != TImode && mode != DImode) {
++ def_stmt = get_def_stmt(new_rhs);
++ gcc_assert(gimple_assign_cast_p(def_stmt));
++ new_rhs = gimple_assign_rhs1(def_stmt);
++ mode = TYPE_MODE(TREE_TYPE(new_rhs));
++ }
++
++ gcc_assert(mode == TImode || mode == DImode);
++
++ if (mode == TYPE_MODE(intTI_type_node) && useless_type_conversion_p(TREE_TYPE(new_rhs), intTI_type_node))
++ return new_rhs;
++
++ gsi = gsi_for_stmt(stmt);
++ cast_stmt = build_cast_stmt(intTI_type_node, new_rhs, CREATE_NEW_VAR, &gsi, BEFORE_STMT);
++ new_rhs = gimple_get_lhs(cast_stmt);
++
++ if (mode == DImode)
++ return new_rhs;
++
++ check_size_overflow(stmt, intTI_type_node, new_rhs, new_rhs, overflowed, BEFORE_STMT);
++
++ return new_rhs;
++}
++
++static bool is_an_integer_trunction(gimple stmt)
++{
++ gimple rhs1_def_stmt, rhs2_def_stmt;
++ tree rhs1_def_stmt_rhs1, rhs2_def_stmt_rhs1;
++ enum machine_mode rhs1_def_stmt_rhs1_mode, rhs2_def_stmt_rhs1_mode;
++ tree rhs1 = gimple_assign_rhs1(stmt);
++ tree rhs2 = gimple_assign_rhs2(stmt);
++ enum machine_mode rhs1_mode = TYPE_MODE(TREE_TYPE(rhs1));
++ enum machine_mode rhs2_mode = TYPE_MODE(TREE_TYPE(rhs2));
++
++ if (is_gimple_constant(rhs1) || is_gimple_constant(rhs2))
++ return false;
++
++ gcc_assert(TREE_CODE(rhs1) == SSA_NAME && TREE_CODE(rhs2) == SSA_NAME);
++
++ if (gimple_assign_rhs_code(stmt) != MINUS_EXPR || rhs1_mode != SImode || rhs2_mode != SImode)
++ return false;
++
++ rhs1_def_stmt = get_def_stmt(rhs1);
++ rhs2_def_stmt = get_def_stmt(rhs2);
++ if (!gimple_assign_cast_p(rhs1_def_stmt) || !gimple_assign_cast_p(rhs2_def_stmt))
++ return false;
++
++ rhs1_def_stmt_rhs1 = gimple_assign_rhs1(rhs1_def_stmt);
++ rhs2_def_stmt_rhs1 = gimple_assign_rhs1(rhs2_def_stmt);
++ rhs1_def_stmt_rhs1_mode = TYPE_MODE(TREE_TYPE(rhs1_def_stmt_rhs1));
++ rhs2_def_stmt_rhs1_mode = TYPE_MODE(TREE_TYPE(rhs2_def_stmt_rhs1));
++ if (rhs1_def_stmt_rhs1_mode != DImode || rhs2_def_stmt_rhs1_mode != DImode)
++ return false;
++
++ gimple_set_plf(rhs1_def_stmt, NO_CAST_CHECK, true);
++ gimple_set_plf(rhs2_def_stmt, NO_CAST_CHECK, true);
++ return true;
++}
++
++static tree handle_integer_truncation(struct pointer_set_t *visited, bool *potentionally_overflowed, tree lhs)
++{
++ tree new_rhs1, new_rhs2, size_overflow_type;
++ tree new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1, new_lhs;
++ tree new_rhs1_def_stmt_rhs1_type, new_rhs2_def_stmt_rhs1_type;
++ gimple assign, stmt = get_def_stmt(lhs);
++ tree rhs1 = gimple_assign_rhs1(stmt);
++ tree rhs2 = gimple_assign_rhs2(stmt);
++
++ if (!is_an_integer_trunction(stmt))
++ return NULL_TREE;
++
++ new_rhs1 = expand(visited, overflowed, rhs1);
++ new_rhs2 = expand(visited, overflowed, rhs2);
++
++ if (*overflowed == OVERFLOW_INTENTIONAL)
++ return NULL_TREE;
++
++ new_rhs1_def_stmt_rhs1 = get_cast_def_stmt_rhs(new_rhs1);
++ new_rhs2_def_stmt_rhs1 = get_cast_def_stmt_rhs(new_rhs2);
++
++ new_rhs1_def_stmt_rhs1_type = TREE_TYPE(new_rhs1_def_stmt_rhs1);
++ new_rhs2_def_stmt_rhs1_type = TREE_TYPE(new_rhs2_def_stmt_rhs1);
++
++ if (!useless_type_conversion_p(new_rhs1_def_stmt_rhs1_type, new_rhs2_def_stmt_rhs1_type)) {
++ new_rhs1_def_stmt_rhs1 = cast_to_int_TI_type_and_check(potentionally_overflowed, stmt, new_rhs1_def_stmt_rhs1);
++ new_rhs2_def_stmt_rhs1 = cast_to_int_TI_type_and_check(potentionally_overflowed, stmt, new_rhs2_def_stmt_rhs1);
++ }
++
++ assign = create_binary_assign(MINUS_EXPR, stmt, new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1);
++ new_lhs = gimple_get_lhs(assign);
++ check_size_overflow(assign, TREE_TYPE(new_lhs), new_lhs, rhs1, potentionally_overflowed, AFTER_STMT);
++
++ size_overflow_type = get_size_overflow_type(stmt, lhs);
++ new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
++ new_rhs2 = cast_to_new_size_overflow_type(stmt, new_rhs2, size_overflow_type, BEFORE_STMT);
++ return dup_assign(visited, potentionally_overflowed, stmt, size_overflow_type, new_rhs1, new_rhs2, NULL_TREE);
++}
++
++static tree handle_binary_ops(struct pointer_set_t *visited, bool *potentionally_overflowed, tree lhs)
++{
++ tree rhs1, rhs2, size_overflow_type, new_lhs;
++ gimple def_stmt = get_def_stmt(lhs);
+ tree new_rhs1 = NULL_TREE;
+ tree new_rhs2 = NULL_TREE;
+
@@ -84176,32 +86629,41 @@ index 0000000..cc96254
+ case EXACT_DIV_EXPR:
+ case POINTER_PLUS_EXPR:
+ case BIT_AND_EXPR:
-+ return create_assign(visited, potentionally_overflowed, def_stmt, var, AFTER_STMT);
++ return create_assign(visited, potentionally_overflowed, def_stmt, lhs, AFTER_STMT);
+ default:
+ break;
+ }
+
+ *potentionally_overflowed = true;
+
++ new_lhs = handle_integer_truncation(visited, potentionally_overflowed, lhs);
++ if (new_lhs != NULL_TREE)
++ return new_lhs;
++
+ if (TREE_CODE(rhs1) == SSA_NAME)
+ new_rhs1 = expand(visited, potentionally_overflowed, rhs1);
+ if (TREE_CODE(rhs2) == SSA_NAME)
+ new_rhs2 = expand(visited, potentionally_overflowed, rhs2);
+
+ if (is_gimple_constant(rhs2))
-+ return handle_const_assign(visited, potentionally_overflowed, def_stmt, var, rhs1, new_rhs1, new_rhs1, signed_cast(rhs2), &gimple_assign_set_rhs1);
++ return handle_const_assign(visited, potentionally_overflowed, def_stmt, new_rhs1, new_rhs1, NULL_TREE);
+
+ if (is_gimple_constant(rhs1))
-+ return handle_const_assign(visited, potentionally_overflowed, def_stmt, var, rhs2, new_rhs2, signed_cast(rhs1), new_rhs2, &gimple_assign_set_rhs2);
++ return handle_const_assign(visited, potentionally_overflowed, def_stmt, new_rhs2, NULL_TREE, new_rhs2);
++
++ size_overflow_type = get_size_overflow_type(def_stmt, lhs);
+
-+ return dup_assign(visited, potentionally_overflowed, def_stmt, new_rhs1, new_rhs2, NULL_TREE);
++ new_rhs1 = cast_to_new_size_overflow_type(def_stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
++ new_rhs2 = cast_to_new_size_overflow_type(def_stmt, new_rhs2, size_overflow_type, BEFORE_STMT);
++
++ return dup_assign(visited, potentionally_overflowed, def_stmt, size_overflow_type, new_rhs1, new_rhs2, NULL_TREE);
+}
+
+#if BUILDING_GCC_VERSION >= 4007
-+static tree get_new_rhs(struct pointer_set_t *visited, bool *potentionally_overflowed, tree rhs)
++static tree get_new_rhs(struct pointer_set_t *visited, bool *potentionally_overflowed, tree size_overflow_type, tree rhs)
+{
+ if (is_gimple_constant(rhs))
-+ return signed_cast(rhs);
++ return cast_a_tree(size_overflow_type, rhs);
+ if (TREE_CODE(rhs) != SSA_NAME)
+ return NULL_TREE;
+ return expand(visited, potentionally_overflowed, rhs);
@@ -84209,61 +86671,72 @@ index 0000000..cc96254
+
+static tree handle_ternary_ops(struct pointer_set_t *visited, bool *potentionally_overflowed, tree var)
+{
-+ tree rhs1, rhs2, rhs3, new_rhs1, new_rhs2, new_rhs3;
++ tree rhs1, rhs2, rhs3, new_rhs1, new_rhs2, new_rhs3, size_overflow_type;
+ gimple def_stmt = get_def_stmt(var);
+
+ *potentionally_overflowed = true;
+
++ size_overflow_type = get_size_overflow_type(def_stmt, var);
++
+ rhs1 = gimple_assign_rhs1(def_stmt);
+ rhs2 = gimple_assign_rhs2(def_stmt);
+ rhs3 = gimple_assign_rhs3(def_stmt);
-+ new_rhs1 = get_new_rhs(visited, potentionally_overflowed, rhs1);
-+ new_rhs2 = get_new_rhs(visited, potentionally_overflowed, rhs2);
-+ new_rhs3 = get_new_rhs(visited, potentionally_overflowed, rhs3);
++ new_rhs1 = get_new_rhs(visited, potentionally_overflowed, size_overflow_type, rhs1);
++ new_rhs2 = get_new_rhs(visited, potentionally_overflowed, size_overflow_type, rhs2);
++ new_rhs3 = get_new_rhs(visited, potentionally_overflowed, size_overflow_type, rhs3);
++
++ new_rhs1 = cast_to_new_size_overflow_type(def_stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
++ new_rhs2 = cast_to_new_size_overflow_type(def_stmt, new_rhs2, size_overflow_type, BEFORE_STMT);
++ new_rhs3 = cast_to_new_size_overflow_type(def_stmt, new_rhs3, size_overflow_type, BEFORE_STMT);
+
-+ if (new_rhs1 == NULL_TREE && new_rhs2 != NULL_TREE && new_rhs3 != NULL_TREE)
-+ return dup_assign(visited, potentionally_overflowed, def_stmt, new_rhs1, new_rhs2, new_rhs3);
-+ error("handle_ternary_ops: unknown rhs");
-+ gcc_unreachable();
++ return dup_assign(visited, potentionally_overflowed, def_stmt, size_overflow_type, new_rhs1, new_rhs2, new_rhs3);
+}
+#endif
+
-+static void set_size_overflow_type(tree node)
++static tree get_size_overflow_type(gimple stmt, tree node)
+{
-+ switch (TYPE_MODE(TREE_TYPE(node))) {
++ tree type;
++
++ gcc_assert(node != NULL_TREE);
++
++ type = TREE_TYPE(node);
++
++ if (gimple_plf(stmt, MY_STMT))
++ return TREE_TYPE(node);
++
++ switch (TYPE_MODE(type)) {
++ case QImode:
++ return (TYPE_UNSIGNED(type)) ? unsigned_intHI_type_node : intHI_type_node;
++ case HImode:
++ return (TYPE_UNSIGNED(type)) ? unsigned_intSI_type_node : intSI_type_node;
+ case SImode:
-+ signed_size_overflow_type = intDI_type_node;
-+ unsigned_size_overflow_type = unsigned_intDI_type_node;
-+ break;
++ return (TYPE_UNSIGNED(type)) ? unsigned_intDI_type_node : intDI_type_node;
+ case DImode:
-+ if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode)) {
-+ signed_size_overflow_type = intDI_type_node;
-+ unsigned_size_overflow_type = unsigned_intDI_type_node;
-+ } else {
-+ signed_size_overflow_type = intTI_type_node;
-+ unsigned_size_overflow_type = unsigned_intTI_type_node;
-+ }
-+ break;
++ if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode))
++ return (TYPE_UNSIGNED(type)) ? unsigned_intDI_type_node : intDI_type_node;
++ return (TYPE_UNSIGNED(type)) ? unsigned_intTI_type_node : intTI_type_node;
+ default:
-+ error("set_size_overflow_type: unsupported gcc configuration.");
++ debug_tree((tree)node);
++ error("get_size_overflow_type: unsupported gcc configuration.");
+ gcc_unreachable();
+ }
+}
+
+static tree expand_visited(gimple def_stmt)
+{
-+ gimple tmp;
++ gimple next_stmt;
+ gimple_stmt_iterator gsi = gsi_for_stmt(def_stmt);
+
+ gsi_next(&gsi);
-+ tmp = gsi_stmt(gsi);
-+ switch (gimple_code(tmp)) {
++ next_stmt = gsi_stmt(gsi);
++
++ switch (gimple_code(next_stmt)) {
+ case GIMPLE_ASSIGN:
-+ return gimple_get_lhs(tmp);
++ return gimple_get_lhs(next_stmt);
+ case GIMPLE_PHI:
-+ return gimple_phi_result(tmp);
++ return gimple_phi_result(next_stmt);
+ case GIMPLE_CALL:
-+ return gimple_call_lhs(tmp);
++ return gimple_call_lhs(next_stmt);
+ default:
+ return NULL_TREE;
+ }
@@ -84281,19 +86754,18 @@ index 0000000..cc96254
+ return NULL_TREE;
+
+ gcc_assert(code == INTEGER_TYPE || code == POINTER_TYPE || code == BOOLEAN_TYPE || code == ENUMERAL_TYPE);
-+ if (code != INTEGER_TYPE)
-+ return NULL_TREE;
+
-+ if (SSA_NAME_IS_DEFAULT_DEF(var)) {
++ if (TREE_CODE(SSA_NAME_VAR(var)) == PARM_DECL)
+ check_missing_attribute(var);
-+ return NULL_TREE;
-+ }
+
+ def_stmt = get_def_stmt(var);
+
+ if (!def_stmt)
+ return NULL_TREE;
+
++ if (gimple_plf(def_stmt, MY_STMT))
++ return var;
++
+ if (pointer_set_contains(visited, def_stmt))
+ return expand_visited(def_stmt);
+
@@ -84302,7 +86774,7 @@ index 0000000..cc96254
+ check_missing_attribute(var);
+ return NULL_TREE;
+ case GIMPLE_PHI:
-+ return build_new_phi(visited, potentionally_overflowed, def_stmt);
++ return build_new_phi(visited, potentionally_overflowed, var);
+ case GIMPLE_CALL:
+ case GIMPLE_ASM:
+ return create_assign(visited, potentionally_overflowed, def_stmt, var, AFTER_STMT);
@@ -84332,9 +86804,7 @@ index 0000000..cc96254
+
+ gcc_assert(gimple_code(stmt) == GIMPLE_CALL);
+
-+ assign = build_cast_stmt(origtype, newarg, CREATE_NEW_VAR, gimple_location(stmt));
-+ gsi_insert_before(&gsi, assign, GSI_SAME_STMT);
-+ update_stmt(assign);
++ assign = build_cast_stmt(origtype, newarg, CREATE_NEW_VAR, &gsi, BEFORE_STMT);
+
+ gimple_call_set_arg(stmt, argnum, gimple_get_lhs(assign));
+ update_stmt(stmt);
@@ -84371,7 +86841,9 @@ index 0000000..cc96254
+{
+ struct pointer_set_t *visited;
+ tree arg, newarg;
-+ bool potentionally_overflowed;
++ enum overflow_reason overflowed = OVERFLOW_NONE;
++ location_t loc;
++ enum marked is_marked;
+
+ arg = get_function_arg(argnum, stmt, fndecl);
+ if (arg == NULL_TREE)
@@ -84384,8 +86856,6 @@ index 0000000..cc96254
+
+ check_arg_type(arg);
+
-+ set_size_overflow_type(arg);
-+
+ visited = pointer_set_create();
+ potentionally_overflowed = false;
+ newarg = expand(visited, &potentionally_overflowed, arg);
@@ -84396,7 +86866,7 @@ index 0000000..cc96254
+
+ change_function_arg(stmt, arg, argnum, newarg);
+
-+ check_size_overflow(stmt, newarg, arg, &potentionally_overflowed);
++ check_size_overflow(stmt, TREE_TYPE(newarg), newarg, arg, &potentionally_overflowed, BEFORE_STMT);
+}
+
+static void handle_function_by_attribute(gimple stmt, tree attr, tree fndecl)
@@ -84424,14 +86894,29 @@ index 0000000..cc96254
+ handle_function_arg(stmt, fndecl, num - 1);
+}
+
++static void set_plf_false(void)
++{
++ basic_block bb;
++
++ FOR_ALL_BB(bb) {
++ gimple_stmt_iterator si;
++
++ for (si = gsi_start_bb(bb); !gsi_end_p(si); gsi_next(&si))
++ gimple_set_plf(gsi_stmt(si), MY_STMT, false);
++ for (si = gsi_start_phis(bb); !gsi_end_p(si); gsi_next(&si))
++ gimple_set_plf(gsi_stmt(si), MY_STMT, false);
++ }
++}
++
+static unsigned int handle_function(void)
+{
-+ basic_block bb = ENTRY_BLOCK_PTR->next_bb;
-+ int saved_last_basic_block = last_basic_block;
++ basic_block next, bb = ENTRY_BLOCK_PTR->next_bb;
++
++ set_plf_false();
+
+ do {
+ gimple_stmt_iterator gsi;
-+ basic_block next = bb->next_bb;
++ next = bb->next_bb;
+
+ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
+ tree fndecl, attr;
@@ -84444,15 +86929,16 @@ index 0000000..cc96254
+ continue;
+ if (gimple_call_num_args(stmt) == 0)
+ continue;
-+ attr = lookup_attribute("size_overflow", TYPE_ATTRIBUTES(TREE_TYPE(fndecl)));
++ attr = lookup_attribute("size_overflow", DECL_ATTRIBUTES(fndecl));
+ if (!attr || !TREE_VALUE(attr))
+ handle_function_by_hash(stmt, fndecl);
+ else
+ handle_function_by_attribute(stmt, attr, fndecl);
+ gsi = gsi_for_stmt(stmt);
++ next = gimple_bb(stmt)->next_bb;
+ }
+ bb = next;
-+ } while (bb && bb->index <= saved_last_basic_block);
++ } while (bb);
+ return 0;
+}
+
@@ -84480,11 +86966,12 @@ index 0000000..cc96254
+
+ const_char_ptr_type_node = build_pointer_type(build_type_variant(char_type_node, 1, 0));
+
-+ // void report_size_overflow(const char *loc_file, unsigned int loc_line, const char *current_func)
++ // void report_size_overflow(const char *loc_file, unsigned int loc_line, const char *current_func, const char *ssa_var)
+ fntype = build_function_type_list(void_type_node,
+ const_char_ptr_type_node,
+ unsigned_type_node,
+ const_char_ptr_type_node,
++ const_char_ptr_type_node,
+ NULL_TREE);
+ report_size_overflow_decl = build_fn_decl("report_size_overflow", fntype);
+
@@ -84492,6 +86979,7 @@ index 0000000..cc96254
+ TREE_PUBLIC(report_size_overflow_decl) = 1;
+ DECL_EXTERNAL(report_size_overflow_decl) = 1;
+ DECL_ARTIFICIAL(report_size_overflow_decl) = 1;
++ TREE_THIS_VOLATILE(report_size_overflow_decl) = 1;
+}
+
+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
@@ -84524,7 +87012,7 @@ index 0000000..cc96254
+
+ register_callback(plugin_name, PLUGIN_INFO, NULL, &size_overflow_plugin_info);
+ if (enable) {
-+ register_callback ("start_unit", PLUGIN_START_UNIT, &start_unit_callback, NULL);
++ register_callback("start_unit", PLUGIN_START_UNIT, &start_unit_callback, NULL);
+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &size_overflow_pass_info);
+ }
+ register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
@@ -84533,7 +87021,7 @@ index 0000000..cc96254
+}
diff --git a/tools/gcc/stackleak_plugin.c b/tools/gcc/stackleak_plugin.c
new file mode 100644
-index 0000000..b87ec9d
+index 0000000..38d2014
--- /dev/null
+++ b/tools/gcc/stackleak_plugin.c
@@ -0,0 +1,313 @@
@@ -84806,13 +87294,13 @@ index 0000000..b87ec9d
+ .pass = &stackleak_tree_instrument_pass.pass,
+// .reference_pass_name = "tree_profile",
+ .reference_pass_name = "optimized",
-+ .ref_pass_instance_number = 0,
++ .ref_pass_instance_number = 1,
+ .pos_op = PASS_POS_INSERT_BEFORE
+ };
+ struct register_pass_info stackleak_final_pass_info = {
+ .pass = &stackleak_final_rtl_opt_pass.pass,
+ .reference_pass_name = "final",
-+ .ref_pass_instance_number = 0,
++ .ref_pass_instance_number = 1,
+ .pos_op = PASS_POS_INSERT_BEFORE
+ };
+
diff --git a/testing/linux-virt-grsec/kernelconfig.x86 b/testing/linux-virt-grsec/kernelconfig.x86
index bf72d2f68..f1633f262 100644
--- a/testing/linux-virt-grsec/kernelconfig.x86
+++ b/testing/linux-virt-grsec/kernelconfig.x86
@@ -1,6 +1,6 @@
#
# Automatically generated file; DO NOT EDIT.
-# Linux/i386 3.4.5 Kernel Configuration
+# Linux/i386 3.4.11 Kernel Configuration
#
# CONFIG_64BIT is not set
CONFIG_X86_32=y
@@ -3281,6 +3281,7 @@ CONFIG_PAX_RANDMMAP=y
CONFIG_PAX_REFCOUNT=y
# CONFIG_PAX_USERCOPY is not set
# CONFIG_PAX_SIZE_OVERFLOW is not set
+# CONFIG_PAX_LATENT_ENTROPY is not set
#
# Memory Protections
diff --git a/testing/linux-virt-grsec/kernelconfig.x86_64 b/testing/linux-virt-grsec/kernelconfig.x86_64
index 7e4285d34..b63baab15 100644
--- a/testing/linux-virt-grsec/kernelconfig.x86_64
+++ b/testing/linux-virt-grsec/kernelconfig.x86_64
@@ -1,6 +1,6 @@
#
# Automatically generated file; DO NOT EDIT.
-# Linux/x86_64 3.4.5 Kernel Configuration
+# Linux/x86_64 3.4.11 Kernel Configuration
#
CONFIG_64BIT=y
# CONFIG_X86_32 is not set
@@ -3230,6 +3230,7 @@ CONFIG_PAX_RANDMMAP=y
CONFIG_PAX_REFCOUNT=y
# CONFIG_PAX_USERCOPY is not set
# CONFIG_PAX_SIZE_OVERFLOW is not set
+# CONFIG_PAX_LATENT_ENTROPY is not set
#
# Memory Protections