summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--main/linux-grsec/APKBUILD28
-rw-r--r--main/linux-grsec/grsecurity-2.9.1-3.9.8-201306272057.patch (renamed from main/linux-grsec/grsecurity-2.9.1-3.9.7-201306231443.patch)1224
-rw-r--r--main/linux-grsec/kernelconfig.x863
-rw-r--r--main/linux-grsec/kernelconfig.x86_643
4 files changed, 516 insertions, 742 deletions
diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 1b93d5b90..ebbddba2a 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -2,7 +2,7 @@
_flavor=grsec
pkgname=linux-${_flavor}
-pkgver=3.9.7
+pkgver=3.9.8
case $pkgver in
*.*.*) _kernver=${pkgver%.*};;
*.*) _kernver=${pkgver};;
@@ -17,7 +17,7 @@ _config=${config:-kernelconfig.${CARCH}}
install=
source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz
http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz
- grsecurity-2.9.1-3.9.7-201306231443.patch
+ grsecurity-2.9.1-3.9.8-201306272057.patch
0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch
0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch
@@ -149,35 +149,35 @@ dev() {
}
md5sums="4348c9b6b2eb3144d601e87c19d5d909 linux-3.9.tar.xz
-74005c469fbd309ab631d981e2d3a6e7 patch-3.9.7.xz
-a5db3ef848185c32ad4b0bbfe19106aa grsecurity-2.9.1-3.9.7-201306231443.patch
+c5f2166686a913abf550bfed8b77df27 patch-3.9.8.xz
+53d60133a86b812060b048275f928041 grsecurity-2.9.1-3.9.8-201306272057.patch
a16f11b12381efb3bec79b9bfb329836 0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch
656ae7b10dd2f18dbfa1011041d08d60 0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch
aa454ffb96428586447775c21449e284 0003-ipv4-properly-refresh-rtable-entries-on-pmtu-redirec.patch
2a12a3717052e878c0cd42aa935bfcf4 0004-ipv4-rate-limit-updating-of-next-hop-exceptions-with.patch
6ce5fed63aad3f1a1ff1b9ba7b741822 0005-ipv4-use-separate-genid-for-next-hop-exceptions.patch
1a5800a2122ba0cc0d06733cb3bb8b8f 0006-ipv4-use-next-hop-exceptions-also-for-input-routes.patch
-bfb5ddcfbc1c9f30253de200ec2a0eb0 kernelconfig.x86
-0b6534366d8abbd36c40744163c81e5a kernelconfig.x86_64"
+d89089b3c7eb94dd9f65cf8a357fc36d kernelconfig.x86
+eb147f09fef5996a488c247790205cd6 kernelconfig.x86_64"
sha256sums="60bc3e64ee5dc778de2cd7cd7640abf518a4c9d4f31b8ed624e16fad53f54541 linux-3.9.tar.xz
-23db9de5ffa2f8f36d61da85ee46656a3373f8868415c1f3c77c51c41fabfda8 patch-3.9.7.xz
-0aa3ec9d60640ee06ca6c6aed877ce2ee99c2b8a2ee8be50ad92c43ed6570617 grsecurity-2.9.1-3.9.7-201306231443.patch
+2eda9068e81269467e3c247f3343a146731fc45284b12b4bc546bc44dbb263e7 patch-3.9.8.xz
+587022b1fc72157e43011551404c7d664dcc3b6c95b72a853ef2ce721e474057 grsecurity-2.9.1-3.9.8-201306272057.patch
6af3757ac36a6cd3cda7b0a71b08143726383b19261294a569ad7f4042c72df3 0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch
dc8e82108615657f1fb9d641efd42255a5761c06edde1b00a41ae0d314d548f0 0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch
0985caa0f3ee8ed0959aeaa4214f5f8057ae8e61d50dcae39194912d31e14892 0003-ipv4-properly-refresh-rtable-entries-on-pmtu-redirec.patch
260fd1807838b68305a96992bf7d3302a2a8ef3a3b08fe079ba9a07e6422f736 0004-ipv4-rate-limit-updating-of-next-hop-exceptions-with.patch
ae32bb72afa170e6c3788c564b342763aba5945afacc1e2ebfc096adf50d77a3 0005-ipv4-use-separate-genid-for-next-hop-exceptions.patch
fc613ac466610b866b721c41836fd5bfb2d4b75bceb67972dc6369d7f62ff47e 0006-ipv4-use-next-hop-exceptions-also-for-input-routes.patch
-c017c0a47fa0dfdefe148aa73e8a19fabb1957dc699de0f94d8d4d9a45bf5abe kernelconfig.x86
-aafae208fc72eaad9d09fcd8220e0d70379d8c7c7f658c10aa96990dc0b36207 kernelconfig.x86_64"
+de3c17420664ae4e52826c6e602aade0deeae94f72253f85b3e48771491ed5d6 kernelconfig.x86
+e1cce320f207cc2ba72b9d154c7060c8cbed52c664319dfd21f24e8956d0bf3e kernelconfig.x86_64"
sha512sums="77fa521f42380409f8ab400c26f7b00e225cb075ef40834bb263325cfdcc3e65aef8511ec2fc2b50bbf4f50e226fb5ab07d7a479aaf09162adbbf318325d0790 linux-3.9.tar.xz
-dcf38bca1ee1b90bffd97c74c00720613dbab9183aa600401a821fe20ea665629bc43544053bd2ffe18ebfe1ee2d72d139f22d2f070374f5e231831ed6c89251 patch-3.9.7.xz
-73f819bd44c724bbdc2e01ed4154c9fd53d0a8d1099ffabf56e995d82a9dbcb03c742e1c048cae9b0052d43dbda4d1c2150f6c14a1b958c25eef8b5571047f80 grsecurity-2.9.1-3.9.7-201306231443.patch
+60b7d694d39faf937e7b732eb3117b8442059c5c8857c9d439eec8a87d5bc185505e64062f5ae02c3512acf5af778caf615c35d3499cb8089a4569c05da65b9c patch-3.9.8.xz
+4ca36180a1fc325a558acf73ec9fe3808542498a8f808f73b87a9f6b05ff290d5a5ab20ce39c547a18ce37d093a9857f5c77c495796e62fef986dfa301a9e566 grsecurity-2.9.1-3.9.8-201306272057.patch
81e78593288e8b0fd2c03ea9fc1450323887707f087e911f172450a122bc9b591ee83394836789730d951aeec13d0b75a64e1c05f04364abf8f80d883ddc4a02 0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch
51ecb15b669f6a82940a13a38939116e003bf5dfd24496771c8279e907b72adcc63d607f0340a2940d757e12ddadb7d45c7af78ae311d284935a6296dbcac00c 0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch
57d0a8bd35d19cf657ded58efe24517d2252aec6984040713ba173a34edb5887ececaa2985076bc6a149eaa57639fd98a042c1c2d226ed4ad8dd5ed0e230717e 0003-ipv4-properly-refresh-rtable-entries-on-pmtu-redirec.patch
d2f578ad1d6e1fe52b55863e5bf338ae8201b828a498ec3e42e549c55295d3d1c6c3adfa9e226d711e3486628ed56ab996484e219d79ac4b0c0ec684ebd380aa 0004-ipv4-rate-limit-updating-of-next-hop-exceptions-with.patch
28a33e644bf2faf99c8dd6dbccfe14e140dfdd8824a8fb2d58aa7deb9e572f130d92b6b35ee181084050d82166bdf2e498a451a2a538a67b7ab84204405d2d87 0005-ipv4-use-separate-genid-for-next-hop-exceptions.patch
249140374c19a5599876268ff5b3cda2e136681aee103b4a9fff5d7d346f8e3295a907fb43db0701b8a9fece64c299ad2abac0434259cce6631307ce84090205 0006-ipv4-use-next-hop-exceptions-also-for-input-routes.patch
-bcf675bafd3aac174195a2d38571b9b54f4b6e0635ab3363699ae8845794dc44bcfe952585fae881d81065d4a25333a3e033808c99c977aa4a797b81e5a36c3f kernelconfig.x86
-a8bf4cc1cdb4d1bde9fe4cd4040a596a52a24817fad15b29785ba10ab1d80fd4ae9589ac92f98c8b6b3b5e5510f01b9c9b96b11a2cf05c9684eb0bd62ee6676e kernelconfig.x86_64"
+c51ac429c3e811976318a7ca2a4f7fc48bcf290e885ceeb09a1a56ee32c37b673f6e789789cf36876747bd54e4dc55d340ad888ba0eb8e7f45f60e8ef7ea67b4 kernelconfig.x86
+584e778f96a05388051b05eb6f1c20377bc8aad72d0cd678323af7aaaab85ecc992244fe6bf3f27ab88131903490fd8af3c3fb56062490dd90dca1ba91d4da21 kernelconfig.x86_64"
diff --git a/main/linux-grsec/grsecurity-2.9.1-3.9.7-201306231443.patch b/main/linux-grsec/grsecurity-2.9.1-3.9.8-201306272057.patch
index 5af323247..3efd0e4c4 100644
--- a/main/linux-grsec/grsecurity-2.9.1-3.9.7-201306231443.patch
+++ b/main/linux-grsec/grsecurity-2.9.1-3.9.8-201306272057.patch
@@ -263,7 +263,7 @@ index 8ccbf27..afffeb4 100644
pcd. [PARIDE]
diff --git a/Makefile b/Makefile
-index a129b15..548231d 100644
+index b013cbe..4ca639b 100644
--- a/Makefile
+++ b/Makefile
@@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -811,10 +811,10 @@ index 0c4132d..88f0d53 100644
/* Allow reads even for write-only mappings */
if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
-index 1cacda4..2cef624 100644
+index 70cd012..71b82cd 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
-@@ -1850,7 +1850,7 @@ config ALIGNMENT_TRAP
+@@ -1860,7 +1860,7 @@ config ALIGNMENT_TRAP
config UACCESS_WITH_MEMCPY
bool "Use kernel mem{cpy,set}() for {copy_to,clear}_user()"
@@ -3799,7 +3799,7 @@ index 04d9006..c547d85 100644
return __arm_ioremap_caller(phys_addr, size, mtype,
__builtin_return_address(0));
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
-index 10062ce..cd34fb9 100644
+index 10062ce..8695745 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -59,6 +59,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
@@ -3876,20 +3876,7 @@ index 10062ce..cd34fb9 100644
addr = vm_unmapped_area(&info);
/*
-@@ -162,6 +172,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
- VM_BUG_ON(addr != -ENOMEM);
- info.flags = 0;
- info.low_limit = mm->mmap_base;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ info.low_limit += mm->delta_mmap;
-+#endif
-+
- info.high_limit = TASK_SIZE;
- addr = vm_unmapped_area(&info);
- }
-@@ -173,6 +189,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
+@@ -173,6 +183,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
{
unsigned long random_factor = 0UL;
@@ -3900,7 +3887,7 @@ index 10062ce..cd34fb9 100644
/* 8 bits of randomness in 20 address space bits */
if ((current->flags & PF_RANDOMIZE) &&
!(current->personality & ADDR_NO_RANDOMIZE))
-@@ -180,10 +200,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
+@@ -180,10 +194,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
@@ -5767,19 +5754,6 @@ index e0a8235..ce2f1e1 100644
ret = __copy_from_user(to, from, n);
else
copy_from_user_overflow();
-diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
-index 5709c5e..14285ca 100644
---- a/arch/parisc/kernel/drivers.c
-+++ b/arch/parisc/kernel/drivers.c
-@@ -394,7 +394,7 @@ EXPORT_SYMBOL(print_pci_hwpath);
- static void setup_bus_id(struct parisc_device *padev)
- {
- struct hardware_path path;
-- char name[20];
-+ char name[28];
- char *output = name;
- int i;
-
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index 2a625fb..9908930 100644
--- a/arch/parisc/kernel/module.c
@@ -5883,20 +5857,6 @@ index 2a625fb..9908930 100644
DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
me->arch.unwind_section, table, end, gp);
-diff --git a/arch/parisc/kernel/setup.c b/arch/parisc/kernel/setup.c
-index a3328c2..3b812eb 100644
---- a/arch/parisc/kernel/setup.c
-+++ b/arch/parisc/kernel/setup.c
-@@ -69,7 +69,8 @@ void __init setup_cmdline(char **cmdline_p)
- /* called from hpux boot loader */
- boot_command_line[0] = '\0';
- } else {
-- strcpy(boot_command_line, (char *)__va(boot_args[1]));
-+ strlcpy(boot_command_line, (char *)__va(boot_args[1]),
-+ COMMAND_LINE_SIZE);
-
- #ifdef CONFIG_BLK_DEV_INITRD
- if (boot_args[2] != 0) /* did palo pass us a ramdisk? */
diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
index 5dfd248..64914ac 100644
--- a/arch/parisc/kernel/sys_parisc.c
@@ -5972,10 +5932,10 @@ index 5dfd248..64914ac 100644
return addr;
}
diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
-index aeb8f8f..27a6c2f 100644
+index c6ae9f5..e9c3cf4 100644
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
-@@ -732,9 +732,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
+@@ -733,9 +733,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
down_read(&current->mm->mmap_sem);
vma = find_vma(current->mm,regs->iaoq[0]);
@@ -10285,7 +10245,7 @@ index ad8f795..2c7eec6 100644
/*
* Memory returned by kmalloc() may be used for DMA, so we must make
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 6ef2a37..74ad6ad 100644
+index de80b33..c0f0899 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -243,7 +243,7 @@ config X86_HT
@@ -19028,7 +18988,7 @@ index 8f3e2de..934870f 100644
/*
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
-index c1d01e6..1bef85a 100644
+index c1d01e6..7f633850 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -59,6 +59,8 @@
@@ -19115,7 +19075,7 @@ index c1d01e6..1bef85a 100644
#endif
-@@ -284,6 +293,311 @@ ENTRY(native_usergs_sysret64)
+@@ -284,6 +293,309 @@ ENTRY(native_usergs_sysret64)
ENDPROC(native_usergs_sysret64)
#endif /* CONFIG_PARAVIRT */
@@ -19245,9 +19205,9 @@ index c1d01e6..1bef85a 100644
+ sub phys_base(%rip),%rbx
+
+#ifdef CONFIG_PARAVIRT
-+ pushq %rdi
+ cmpl $0, pv_info+PARAVIRT_enabled
+ jz 1f
++ pushq %rdi
+ i = 0
+ .rept USER_PGD_PTRS
+ mov i*8(%rbx),%rsi
@@ -19256,6 +19216,7 @@ index c1d01e6..1bef85a 100644
+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
+ i = i + 1
+ .endr
++ popq %rdi
+ jmp 2f
+1:
+#endif
@@ -19267,7 +19228,7 @@ index c1d01e6..1bef85a 100644
+ .endr
+
+#ifdef CONFIG_PARAVIRT
-+2: popq %rdi
++2:
+#endif
+ SET_RDI_INTO_CR3
+
@@ -19308,7 +19269,6 @@ index c1d01e6..1bef85a 100644
+ sub phys_base(%rip),%rbx
+
+#ifdef CONFIG_PARAVIRT
-+ pushq %rdi
+ cmpl $0, pv_info+PARAVIRT_enabled
+ jz 1f
+ i = 0
@@ -19319,8 +19279,6 @@ index c1d01e6..1bef85a 100644
+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
+ i = i + 1
+ .endr
-+ popq %rdi
-+ PV_RESTORE_REGS(CLBR_RDI)
+ jmp 2f
+1:
+#endif
@@ -19332,7 +19290,7 @@ index c1d01e6..1bef85a 100644
+ .endr
+
+#ifdef CONFIG_PARAVIRT
-+2:
++2: PV_RESTORE_REGS(CLBR_RDI)
+#endif
+
+ popq %rbx
@@ -19350,8 +19308,8 @@ index c1d01e6..1bef85a 100644
+#ifdef CONFIG_PAX_KERNEXEC
+ GET_CR0_INTO_RDI
+ bts $16,%rdi
-+ SET_RDI_INTO_CR0
+ jc 110f
++ SET_RDI_INTO_CR0
+ or $2,%ebx
+110:
+#endif
@@ -19359,8 +19317,8 @@ index c1d01e6..1bef85a 100644
+
+ .macro pax_exit_kernel_nmi
+#ifdef CONFIG_PAX_KERNEXEC
-+ test $2,%ebx
-+ jz 110f
++ btr $1,%ebx
++ jnc 110f
+ GET_CR0_INTO_RDI
+ btr $16,%rdi
+ SET_RDI_INTO_CR0
@@ -19427,7 +19385,7 @@ index c1d01e6..1bef85a 100644
.macro TRACE_IRQS_IRETQ offset=ARGOFFSET
#ifdef CONFIG_TRACE_IRQFLAGS
-@@ -375,8 +689,8 @@ ENDPROC(native_usergs_sysret64)
+@@ -375,8 +687,8 @@ ENDPROC(native_usergs_sysret64)
.endm
.macro UNFAKE_STACK_FRAME
@@ -19438,7 +19396,7 @@ index c1d01e6..1bef85a 100644
.endm
/*
-@@ -463,7 +777,7 @@ ENDPROC(native_usergs_sysret64)
+@@ -463,7 +775,7 @@ ENDPROC(native_usergs_sysret64)
movq %rsp, %rsi
leaq -RBP(%rsp),%rdi /* arg1 for handler */
@@ -19447,7 +19405,7 @@ index c1d01e6..1bef85a 100644
je 1f
SWAPGS
/*
-@@ -498,9 +812,10 @@ ENTRY(save_rest)
+@@ -498,9 +810,10 @@ ENTRY(save_rest)
movq_cfi r15, R15+16
movq %r11, 8(%rsp) /* return address */
FIXUP_TOP_OF_STACK %r11, 16
@@ -19459,7 +19417,7 @@ index c1d01e6..1bef85a 100644
/* save complete stack frame */
.pushsection .kprobes.text, "ax"
-@@ -529,9 +844,10 @@ ENTRY(save_paranoid)
+@@ -529,9 +842,10 @@ ENTRY(save_paranoid)
js 1f /* negative -> in kernel */
SWAPGS
xorl %ebx,%ebx
@@ -19472,7 +19430,7 @@ index c1d01e6..1bef85a 100644
.popsection
/*
-@@ -553,7 +869,7 @@ ENTRY(ret_from_fork)
+@@ -553,7 +867,7 @@ ENTRY(ret_from_fork)
RESTORE_REST
@@ -19481,7 +19439,7 @@ index c1d01e6..1bef85a 100644
jz 1f
testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
-@@ -571,7 +887,7 @@ ENTRY(ret_from_fork)
+@@ -571,7 +885,7 @@ ENTRY(ret_from_fork)
RESTORE_REST
jmp int_ret_from_sys_call
CFI_ENDPROC
@@ -19490,7 +19448,7 @@ index c1d01e6..1bef85a 100644
/*
* System call entry. Up to 6 arguments in registers are supported.
-@@ -608,7 +924,7 @@ END(ret_from_fork)
+@@ -608,7 +922,7 @@ END(ret_from_fork)
ENTRY(system_call)
CFI_STARTPROC simple
CFI_SIGNAL_FRAME
@@ -19499,7 +19457,7 @@ index c1d01e6..1bef85a 100644
CFI_REGISTER rip,rcx
/*CFI_REGISTER rflags,r11*/
SWAPGS_UNSAFE_STACK
-@@ -621,16 +937,23 @@ GLOBAL(system_call_after_swapgs)
+@@ -621,16 +935,23 @@ GLOBAL(system_call_after_swapgs)
movq %rsp,PER_CPU_VAR(old_rsp)
movq PER_CPU_VAR(kernel_stack),%rsp
@@ -19525,7 +19483,7 @@ index c1d01e6..1bef85a 100644
jnz tracesys
system_call_fastpath:
#if __SYSCALL_MASK == ~0
-@@ -640,7 +963,7 @@ system_call_fastpath:
+@@ -640,7 +961,7 @@ system_call_fastpath:
cmpl $__NR_syscall_max,%eax
#endif
ja badsys
@@ -19534,7 +19492,7 @@ index c1d01e6..1bef85a 100644
call *sys_call_table(,%rax,8) # XXX: rip relative
movq %rax,RAX-ARGOFFSET(%rsp)
/*
-@@ -654,10 +977,13 @@ sysret_check:
+@@ -654,10 +975,13 @@ sysret_check:
LOCKDEP_SYS_EXIT
DISABLE_INTERRUPTS(CLBR_NONE)
TRACE_IRQS_OFF
@@ -19549,7 +19507,7 @@ index c1d01e6..1bef85a 100644
/*
* sysretq will re-enable interrupts:
*/
-@@ -709,14 +1035,18 @@ badsys:
+@@ -709,14 +1033,18 @@ badsys:
* jump back to the normal fast path.
*/
auditsys:
@@ -19569,7 +19527,7 @@ index c1d01e6..1bef85a 100644
jmp system_call_fastpath
/*
-@@ -737,7 +1067,7 @@ sysret_audit:
+@@ -737,7 +1065,7 @@ sysret_audit:
/* Do syscall tracing */
tracesys:
#ifdef CONFIG_AUDITSYSCALL
@@ -19578,7 +19536,7 @@ index c1d01e6..1bef85a 100644
jz auditsys
#endif
SAVE_REST
-@@ -745,12 +1075,16 @@ tracesys:
+@@ -745,12 +1073,16 @@ tracesys:
FIXUP_TOP_OF_STACK %rdi
movq %rsp,%rdi
call syscall_trace_enter
@@ -19595,7 +19553,7 @@ index c1d01e6..1bef85a 100644
RESTORE_REST
#if __SYSCALL_MASK == ~0
cmpq $__NR_syscall_max,%rax
-@@ -759,7 +1093,7 @@ tracesys:
+@@ -759,7 +1091,7 @@ tracesys:
cmpl $__NR_syscall_max,%eax
#endif
ja int_ret_from_sys_call /* RAX(%rsp) set to -ENOSYS above */
@@ -19604,7 +19562,7 @@ index c1d01e6..1bef85a 100644
call *sys_call_table(,%rax,8)
movq %rax,RAX-ARGOFFSET(%rsp)
/* Use IRET because user could have changed frame */
-@@ -780,7 +1114,9 @@ GLOBAL(int_with_check)
+@@ -780,7 +1112,9 @@ GLOBAL(int_with_check)
andl %edi,%edx
jnz int_careful
andl $~TS_COMPAT,TI_status(%rcx)
@@ -19615,7 +19573,7 @@ index c1d01e6..1bef85a 100644
/* Either reschedule or signal or syscall exit tracking needed. */
/* First do a reschedule test. */
-@@ -826,7 +1162,7 @@ int_restore_rest:
+@@ -826,7 +1160,7 @@ int_restore_rest:
TRACE_IRQS_OFF
jmp int_with_check
CFI_ENDPROC
@@ -19624,7 +19582,7 @@ index c1d01e6..1bef85a 100644
.macro FORK_LIKE func
ENTRY(stub_\func)
-@@ -839,9 +1175,10 @@ ENTRY(stub_\func)
+@@ -839,9 +1173,10 @@ ENTRY(stub_\func)
DEFAULT_FRAME 0 8 /* offset 8: return address */
call sys_\func
RESTORE_TOP_OF_STACK %r11, 8
@@ -19636,7 +19594,7 @@ index c1d01e6..1bef85a 100644
.endm
.macro FIXED_FRAME label,func
-@@ -851,9 +1188,10 @@ ENTRY(\label)
+@@ -851,9 +1186,10 @@ ENTRY(\label)
FIXUP_TOP_OF_STACK %r11, 8-ARGOFFSET
call \func
RESTORE_TOP_OF_STACK %r11, 8-ARGOFFSET
@@ -19648,7 +19606,7 @@ index c1d01e6..1bef85a 100644
.endm
FORK_LIKE clone
-@@ -870,9 +1208,10 @@ ENTRY(ptregscall_common)
+@@ -870,9 +1206,10 @@ ENTRY(ptregscall_common)
movq_cfi_restore R12+8, r12
movq_cfi_restore RBP+8, rbp
movq_cfi_restore RBX+8, rbx
@@ -19660,7 +19618,7 @@ index c1d01e6..1bef85a 100644
ENTRY(stub_execve)
CFI_STARTPROC
-@@ -885,7 +1224,7 @@ ENTRY(stub_execve)
+@@ -885,7 +1222,7 @@ ENTRY(stub_execve)
RESTORE_REST
jmp int_ret_from_sys_call
CFI_ENDPROC
@@ -19669,7 +19627,7 @@ index c1d01e6..1bef85a 100644
/*
* sigreturn is special because it needs to restore all registers on return.
-@@ -902,7 +1241,7 @@ ENTRY(stub_rt_sigreturn)
+@@ -902,7 +1239,7 @@ ENTRY(stub_rt_sigreturn)
RESTORE_REST
jmp int_ret_from_sys_call
CFI_ENDPROC
@@ -19678,7 +19636,7 @@ index c1d01e6..1bef85a 100644
#ifdef CONFIG_X86_X32_ABI
ENTRY(stub_x32_rt_sigreturn)
-@@ -916,7 +1255,7 @@ ENTRY(stub_x32_rt_sigreturn)
+@@ -916,7 +1253,7 @@ ENTRY(stub_x32_rt_sigreturn)
RESTORE_REST
jmp int_ret_from_sys_call
CFI_ENDPROC
@@ -19687,7 +19645,7 @@ index c1d01e6..1bef85a 100644
ENTRY(stub_x32_execve)
CFI_STARTPROC
-@@ -930,7 +1269,7 @@ ENTRY(stub_x32_execve)
+@@ -930,7 +1267,7 @@ ENTRY(stub_x32_execve)
RESTORE_REST
jmp int_ret_from_sys_call
CFI_ENDPROC
@@ -19696,7 +19654,7 @@ index c1d01e6..1bef85a 100644
#endif
-@@ -967,7 +1306,7 @@ vector=vector+1
+@@ -967,7 +1304,7 @@ vector=vector+1
2: jmp common_interrupt
.endr
CFI_ENDPROC
@@ -19705,7 +19663,7 @@ index c1d01e6..1bef85a 100644
.previous
END(interrupt)
-@@ -987,6 +1326,16 @@ END(interrupt)
+@@ -987,6 +1324,16 @@ END(interrupt)
subq $ORIG_RAX-RBP, %rsp
CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
SAVE_ARGS_IRQ
@@ -19722,7 +19680,7 @@ index c1d01e6..1bef85a 100644
call \func
.endm
-@@ -1019,7 +1368,7 @@ ret_from_intr:
+@@ -1019,7 +1366,7 @@ ret_from_intr:
exit_intr:
GET_THREAD_INFO(%rcx)
@@ -19731,7 +19689,7 @@ index c1d01e6..1bef85a 100644
je retint_kernel
/* Interrupt came from user space */
-@@ -1041,12 +1390,16 @@ retint_swapgs: /* return to user-space */
+@@ -1041,12 +1388,16 @@ retint_swapgs: /* return to user-space */
* The iretq could re-enable interrupts:
*/
DISABLE_INTERRUPTS(CLBR_ANY)
@@ -19748,7 +19706,7 @@ index c1d01e6..1bef85a 100644
/*
* The iretq could re-enable interrupts:
*/
-@@ -1129,7 +1482,7 @@ ENTRY(retint_kernel)
+@@ -1129,7 +1480,7 @@ ENTRY(retint_kernel)
#endif
CFI_ENDPROC
@@ -19757,7 +19715,7 @@ index c1d01e6..1bef85a 100644
/*
* End of kprobes section
*/
-@@ -1147,7 +1500,7 @@ ENTRY(\sym)
+@@ -1147,7 +1498,7 @@ ENTRY(\sym)
interrupt \do_sym
jmp ret_from_intr
CFI_ENDPROC
@@ -19766,7 +19724,7 @@ index c1d01e6..1bef85a 100644
.endm
#ifdef CONFIG_SMP
-@@ -1203,12 +1556,22 @@ ENTRY(\sym)
+@@ -1203,12 +1554,22 @@ ENTRY(\sym)
CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
call error_entry
DEFAULT_FRAME 0
@@ -19790,7 +19748,7 @@ index c1d01e6..1bef85a 100644
.endm
.macro paranoidzeroentry sym do_sym
-@@ -1221,15 +1584,25 @@ ENTRY(\sym)
+@@ -1221,15 +1582,25 @@ ENTRY(\sym)
CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
call save_paranoid
TRACE_IRQS_OFF
@@ -19818,7 +19776,7 @@ index c1d01e6..1bef85a 100644
.macro paranoidzeroentry_ist sym do_sym ist
ENTRY(\sym)
INTR_FRAME
-@@ -1240,14 +1613,30 @@ ENTRY(\sym)
+@@ -1240,14 +1611,30 @@ ENTRY(\sym)
CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
call save_paranoid
TRACE_IRQS_OFF_DEBUG
@@ -19850,7 +19808,7 @@ index c1d01e6..1bef85a 100644
.endm
.macro errorentry sym do_sym
-@@ -1259,13 +1648,23 @@ ENTRY(\sym)
+@@ -1259,13 +1646,23 @@ ENTRY(\sym)
CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
call error_entry
DEFAULT_FRAME 0
@@ -19875,7 +19833,7 @@ index c1d01e6..1bef85a 100644
.endm
/* error code is on the stack already */
-@@ -1279,13 +1678,23 @@ ENTRY(\sym)
+@@ -1279,13 +1676,23 @@ ENTRY(\sym)
call save_paranoid
DEFAULT_FRAME 0
TRACE_IRQS_OFF
@@ -19900,7 +19858,7 @@ index c1d01e6..1bef85a 100644
.endm
zeroentry divide_error do_divide_error
-@@ -1315,9 +1724,10 @@ gs_change:
+@@ -1315,9 +1722,10 @@ gs_change:
2: mfence /* workaround */
SWAPGS
popfq_cfi
@@ -19912,7 +19870,7 @@ index c1d01e6..1bef85a 100644
_ASM_EXTABLE(gs_change,bad_gs)
.section .fixup,"ax"
-@@ -1345,9 +1755,10 @@ ENTRY(call_softirq)
+@@ -1345,9 +1753,10 @@ ENTRY(call_softirq)
CFI_DEF_CFA_REGISTER rsp
CFI_ADJUST_CFA_OFFSET -8
decl PER_CPU_VAR(irq_count)
@@ -19924,7 +19882,7 @@ index c1d01e6..1bef85a 100644
#ifdef CONFIG_XEN
zeroentry xen_hypervisor_callback xen_do_hypervisor_callback
-@@ -1385,7 +1796,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
+@@ -1385,7 +1794,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
decl PER_CPU_VAR(irq_count)
jmp error_exit
CFI_ENDPROC
@@ -19933,7 +19891,7 @@ index c1d01e6..1bef85a 100644
/*
* Hypervisor uses this for application faults while it executes.
-@@ -1444,7 +1855,7 @@ ENTRY(xen_failsafe_callback)
+@@ -1444,7 +1853,7 @@ ENTRY(xen_failsafe_callback)
SAVE_ALL
jmp error_exit
CFI_ENDPROC
@@ -19942,7 +19900,7 @@ index c1d01e6..1bef85a 100644
apicinterrupt HYPERVISOR_CALLBACK_VECTOR \
xen_hvm_callback_vector xen_evtchn_do_upcall
-@@ -1498,16 +1909,31 @@ ENTRY(paranoid_exit)
+@@ -1498,16 +1907,31 @@ ENTRY(paranoid_exit)
TRACE_IRQS_OFF_DEBUG
testl %ebx,%ebx /* swapgs needed? */
jnz paranoid_restore
@@ -19975,7 +19933,7 @@ index c1d01e6..1bef85a 100644
jmp irq_return
paranoid_userspace:
GET_THREAD_INFO(%rcx)
-@@ -1536,7 +1962,7 @@ paranoid_schedule:
+@@ -1536,7 +1960,7 @@ paranoid_schedule:
TRACE_IRQS_OFF
jmp paranoid_userspace
CFI_ENDPROC
@@ -19984,7 +19942,7 @@ index c1d01e6..1bef85a 100644
/*
* Exception entry point. This expects an error code/orig_rax on the stack.
-@@ -1563,12 +1989,13 @@ ENTRY(error_entry)
+@@ -1563,12 +1987,13 @@ ENTRY(error_entry)
movq_cfi r14, R14+8
movq_cfi r15, R15+8
xorl %ebx,%ebx
@@ -19999,7 +19957,7 @@ index c1d01e6..1bef85a 100644
ret
/*
-@@ -1595,7 +2022,7 @@ bstep_iret:
+@@ -1595,7 +2020,7 @@ bstep_iret:
movq %rcx,RIP+8(%rsp)
jmp error_swapgs
CFI_ENDPROC
@@ -20008,7 +19966,7 @@ index c1d01e6..1bef85a 100644
/* ebx: no swapgs flag (1: don't need swapgs, 0: need it) */
-@@ -1615,7 +2042,7 @@ ENTRY(error_exit)
+@@ -1615,7 +2040,7 @@ ENTRY(error_exit)
jnz retint_careful
jmp retint_swapgs
CFI_ENDPROC
@@ -20017,7 +19975,7 @@ index c1d01e6..1bef85a 100644
/*
* Test if a given stack is an NMI stack or not.
-@@ -1673,9 +2100,11 @@ ENTRY(nmi)
+@@ -1673,9 +2098,11 @@ ENTRY(nmi)
* If %cs was not the kernel segment, then the NMI triggered in user
* space, which means it is definitely not nested.
*/
@@ -20030,7 +19988,7 @@ index c1d01e6..1bef85a 100644
/*
* Check the special variable on the stack to see if NMIs are
* executing.
-@@ -1709,8 +2138,7 @@ nested_nmi:
+@@ -1709,8 +2136,7 @@ nested_nmi:
1:
/* Set up the interrupted NMIs stack to jump to repeat_nmi */
@@ -20040,7 +19998,7 @@ index c1d01e6..1bef85a 100644
CFI_ADJUST_CFA_OFFSET 1*8
leaq -10*8(%rsp), %rdx
pushq_cfi $__KERNEL_DS
-@@ -1728,6 +2156,7 @@ nested_nmi_out:
+@@ -1728,6 +2154,7 @@ nested_nmi_out:
CFI_RESTORE rdx
/* No need to check faults here */
@@ -20048,7 +20006,7 @@ index c1d01e6..1bef85a 100644
INTERRUPT_RETURN
CFI_RESTORE_STATE
-@@ -1844,6 +2273,8 @@ end_repeat_nmi:
+@@ -1844,6 +2271,8 @@ end_repeat_nmi:
*/
movq %cr2, %r12
@@ -20057,7 +20015,7 @@ index c1d01e6..1bef85a 100644
/* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
movq %rsp,%rdi
movq $-1,%rsi
-@@ -1856,26 +2287,31 @@ end_repeat_nmi:
+@@ -1856,26 +2285,31 @@ end_repeat_nmi:
movq %r12, %cr2
1:
@@ -20604,7 +20562,7 @@ index 73afd11..d1670f5 100644
+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
+ .endr
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
-index 321d65e..e9437f7 100644
+index 321d65e..7830f05 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -20,6 +20,8 @@
@@ -20770,7 +20728,7 @@ index 321d65e..e9437f7 100644
NEXT_PAGE(level2_kernel_pgt)
/*
* 512 MB kernel mapping. We spend a full page on this pagetable
-@@ -488,38 +536,64 @@ NEXT_PAGE(level2_kernel_pgt)
+@@ -488,39 +536,64 @@ NEXT_PAGE(level2_kernel_pgt)
KERNEL_IMAGE_SIZE/PMD_SIZE)
NEXT_PAGE(level2_fixmap_pgt)
@@ -20844,8 +20802,9 @@ index 321d65e..e9437f7 100644
- .skip IDT_ENTRIES * 16
+ .fill 512,8,0
- __PAGE_ALIGNED_BSS
+- __PAGE_ALIGNED_BSS
NEXT_PAGE(empty_zero_page)
+ .skip PAGE_SIZE
diff --git a/arch/x86/kernel/i386_ksyms_32.c b/arch/x86/kernel/i386_ksyms_32.c
index 0fa6912..37fce70 100644
--- a/arch/x86/kernel/i386_ksyms_32.c
@@ -22601,7 +22560,7 @@ index f2bb9c9..bed145d7 100644
1:
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
-index fae9134..f8e4a47 100644
+index fae9134..8fcd87c 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -111,6 +111,7 @@
@@ -22644,7 +22603,7 @@ index fae9134..f8e4a47 100644
void __init setup_arch(char **cmdline_p)
{
+#ifdef CONFIG_X86_32
-+ memblock_reserve(LOAD_PHYSICAL_ADDR, __pa_symbol(__bss_stop) - ____LOAD_PHYSICAL_ADDR);
++ memblock_reserve(LOAD_PHYSICAL_ADDR, __pa_symbol(__bss_stop) - LOAD_PHYSICAL_ADDR);
+#else
memblock_reserve(__pa_symbol(_text),
(unsigned long)__bss_stop - (unsigned long)_text);
@@ -22923,10 +22882,10 @@ index 9b4d51d..5d28b58 100644
switch (opcode[i]) {
diff --git a/arch/x86/kernel/sys_i386_32.c b/arch/x86/kernel/sys_i386_32.c
new file mode 100644
-index 0000000..207bec6
+index 0000000..5877189
--- /dev/null
+++ b/arch/x86/kernel/sys_i386_32.c
-@@ -0,0 +1,250 @@
+@@ -0,0 +1,189 @@
+/*
+ * This file contains various random system calls that
+ * have a non-standard calling sequence on the Linux/i386
@@ -22947,6 +22906,7 @@ index 0000000..207bec6
+#include <linux/file.h>
+#include <linux/utsname.h>
+#include <linux/ipc.h>
++#include <linux/elf.h>
+
+#include <linux/uaccess.h>
+#include <linux/unistd.h>
@@ -22969,13 +22929,28 @@ index 0000000..207bec6
+ return 0;
+}
+
++/*
++ * Align a virtual address to avoid aliasing in the I$ on AMD F15h.
++ */
++static unsigned long get_align_mask(void)
++{
++ if (va_align.flags < 0 || !(va_align.flags & ALIGN_VA_32))
++ return 0;
++
++ if (!(current->flags & PF_RANDOMIZE))
++ return 0;
++
++ return va_align.mask;
++}
++
+unsigned long
+arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ unsigned long len, unsigned long pgoff, unsigned long flags)
+{
+ struct mm_struct *mm = current->mm;
+ struct vm_area_struct *vma;
-+ unsigned long start_addr, pax_task_size = TASK_SIZE;
++ unsigned long pax_task_size = TASK_SIZE;
++ struct vm_unmapped_area_info info;
+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
+
+#ifdef CONFIG_PAX_SEGMEXEC
@@ -23003,61 +22978,35 @@ index 0000000..207bec6
+ return addr;
+ }
+ }
-+ if (len > mm->cached_hole_size) {
-+ start_addr = addr = mm->free_area_cache;
-+ } else {
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
-+ }
++
++ info.flags = 0;
++ info.length = len;
++ info.align_mask = filp ? get_align_mask() : 0;
++ info.align_offset = pgoff << PAGE_SHIFT;
++ info.threadstack_offset = offset;
+
+#ifdef CONFIG_PAX_PAGEEXEC
-+ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
-+ start_addr = 0x00110000UL;
++ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE)) {
++ info.low_limit = 0x00110000UL;
++ info.high_limit = mm->start_code;
+
+#ifdef CONFIG_PAX_RANDMMAP
+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ start_addr += mm->delta_mmap & 0x03FFF000UL;
++ info.low_limit += mm->delta_mmap & 0x03FFF000UL;
+#endif
+
-+ if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
-+ start_addr = addr = mm->mmap_base;
-+ else
-+ addr = start_addr;
-+ }
++ if (info.low_limit < info.high_limit) {
++ addr = vm_unmapped_area(&info);
++ if (!IS_ERR_VALUE(addr))
++ return addr;
++ }
++ } else
+#endif
+
-+full_search:
-+ for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
-+ /* At this point: (!vma || addr < vma->vm_end). */
-+ if (pax_task_size - len < addr) {
-+ /*
-+ * Start a new search - just in case we missed
-+ * some holes.
-+ */
-+ if (start_addr != mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
-+ goto full_search;
-+ }
-+ return -ENOMEM;
-+ }
-+ if (check_heap_stack_gap(vma, addr, len, offset))
-+ break;
-+ if (addr + mm->cached_hole_size < vma->vm_start)
-+ mm->cached_hole_size = vma->vm_start - addr;
-+ addr = vma->vm_end;
-+ if (mm->start_brk <= addr && addr < mm->mmap_base) {
-+ start_addr = addr = mm->mmap_base;
-+ mm->cached_hole_size = 0;
-+ goto full_search;
-+ }
-+ }
++ info.low_limit = mm->mmap_base;
++ info.high_limit = pax_task_size;
+
-+ /*
-+ * Remember the place where we stopped the search:
-+ */
-+ mm->free_area_cache = addr + len;
-+ return addr;
++ return vm_unmapped_area(&info);
+}
+
+unsigned long
@@ -23067,7 +23016,8 @@ index 0000000..207bec6
+{
+ struct vm_area_struct *vma;
+ struct mm_struct *mm = current->mm;
-+ unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
++ unsigned long addr = addr0, pax_task_size = TASK_SIZE;
++ struct vm_unmapped_area_info info;
+ unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
+
+#ifdef CONFIG_PAX_SEGMEXEC
@@ -23103,46 +23053,18 @@ index 0000000..207bec6
+ }
+ }
+
-+ /* check if free_area_cache is useful for us */
-+ if (len <= mm->cached_hole_size) {
-+ mm->cached_hole_size = 0;
-+ mm->free_area_cache = mm->mmap_base;
-+ }
-+
-+ /* either no address requested or can't fit in requested address hole */
-+ addr = mm->free_area_cache;
-+
-+ /* make sure it can fit in the remaining address space */
-+ if (addr > len) {
-+ vma = find_vma(mm, addr-len);
-+ if (check_heap_stack_gap(vma, addr - len, len, offset))
-+ /* remember the address as a hint for next time */
-+ return (mm->free_area_cache = addr-len);
-+ }
-+
-+ if (mm->mmap_base < len)
-+ goto bottomup;
-+
-+ addr = mm->mmap_base-len;
-+
-+ do {
-+ /*
-+ * Lookup failure means no vma is above this address,
-+ * else if new region fits below vma->vm_start,
-+ * return with success:
-+ */
-+ vma = find_vma(mm, addr);
-+ if (check_heap_stack_gap(vma, addr, len, offset))
-+ /* remember the address as a hint for next time */
-+ return (mm->free_area_cache = addr);
-+
-+ /* remember the largest hole we saw so far */
-+ if (addr + mm->cached_hole_size < vma->vm_start)
-+ mm->cached_hole_size = vma->vm_start - addr;
++ info.flags = VM_UNMAPPED_AREA_TOPDOWN;
++ info.length = len;
++ info.low_limit = PAGE_SIZE;
++ info.high_limit = mm->mmap_base;
++ info.align_mask = filp ? get_align_mask() : 0;
++ info.align_offset = pgoff << PAGE_SHIFT;
++ info.threadstack_offset = offset;
+
-+ /* try just below the current vma->vm_start */
-+ addr = skip_heap_stack_gap(vma, len, offset);
-+ } while (!IS_ERR_VALUE(addr));
++ addr = vm_unmapped_area(&info);
++ if (!(addr & ~PAGE_MASK))
++ return addr;
++ VM_BUG_ON(addr != -ENOMEM);
+
+bottomup:
+ /*
@@ -23151,31 +23073,7 @@ index 0000000..207bec6
+ * can happen with large stack limits and large mmap()
+ * allocations.
+ */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
-+ else
-+#endif
-+
-+ mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+ mm->free_area_cache = mm->mmap_base;
-+ mm->cached_hole_size = ~0UL;
-+ addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
-+ /*
-+ * Restore the topdown base:
-+ */
-+ mm->mmap_base = base;
-+ mm->free_area_cache = base;
-+ mm->cached_hole_size = ~0UL;
-+
-+ return addr;
++ return arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
+}
diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
index dbded5a..ace2781 100644
@@ -24301,10 +24199,10 @@ index 0af1807..06912bb 100644
vcpu->arch.regs_avail = ~((1 << VCPU_REGS_RIP) | (1 << VCPU_REGS_RSP)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index e172132..c3d3e27 100644
+index 8563b45..272f1fe 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
-@@ -1686,8 +1686,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
+@@ -1685,8 +1685,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
{
struct kvm *kvm = vcpu->kvm;
int lm = is_long_mode(vcpu);
@@ -24315,7 +24213,7 @@ index e172132..c3d3e27 100644
u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
: kvm->arch.xen_hvm_config.blob_size_32;
u32 page_num = data & ~PAGE_MASK;
-@@ -2567,6 +2567,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
+@@ -2566,6 +2566,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
if (n < msr_list.nmsrs)
goto out;
r = -EFAULT;
@@ -24324,7 +24222,7 @@ index e172132..c3d3e27 100644
if (copy_to_user(user_msr_list->indices, &msrs_to_save,
num_msrs_to_save * sizeof(u32)))
goto out;
-@@ -2696,7 +2698,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
+@@ -2695,7 +2697,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
struct kvm_interrupt *irq)
{
@@ -24333,7 +24231,7 @@ index e172132..c3d3e27 100644
return -EINVAL;
if (irqchip_in_kernel(vcpu->kvm))
return -ENXIO;
-@@ -5247,7 +5249,7 @@ static struct notifier_block pvclock_gtod_notifier = {
+@@ -5246,7 +5248,7 @@ static struct notifier_block pvclock_gtod_notifier = {
};
#endif
@@ -30491,31 +30389,6 @@ index c77b24a..c979855 100644
return !(ret & 0xff00);
}
EXPORT_SYMBOL(pcibios_set_irq_routing);
-diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
-index 90f3a52..714e825 100644
---- a/arch/x86/platform/efi/efi.c
-+++ b/arch/x86/platform/efi/efi.c
-@@ -1059,7 +1059,10 @@ efi_status_t efi_query_variable_store(u32 attributes, unsigned long size)
- * that by attempting to use more space than is available.
- */
- unsigned long dummy_size = remaining_size + 1024;
-- void *dummy = kmalloc(dummy_size, GFP_ATOMIC);
-+ void *dummy = kzalloc(dummy_size, GFP_ATOMIC);
-+
-+ if (!dummy)
-+ return EFI_OUT_OF_RESOURCES;
-
- status = efi.set_variable(efi_dummy_name, &EFI_DUMMY_GUID,
- EFI_VARIABLE_NON_VOLATILE |
-@@ -1079,6 +1082,8 @@ efi_status_t efi_query_variable_store(u32 attributes, unsigned long size)
- 0, dummy);
- }
-
-+ kfree(dummy);
-+
- /*
- * The runtime code may now have triggered a garbage collection
- * run, so check the variable info again
diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
index 40e4469..1ab536e 100644
--- a/arch/x86/platform/efi/efi_32.c
@@ -37668,7 +37541,7 @@ index 04c69af..5f92d00 100644
#include <linux/input.h>
#include <linux/gameport.h>
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
-index d6cbfe9..6225402 100644
+index fa061d4..4a6957c 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -735,7 +735,7 @@ static void xpad_led_set(struct led_classdev *led_cdev,
@@ -38029,7 +37902,7 @@ index 64e204e..c6bf189 100644
.callback = ss4200_led_dmi_callback,
.ident = "Intel SS4200-E",
diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
-index a5ebc00..982886f 100644
+index a5ebc00..3de3364 100644
--- a/drivers/lguest/core.c
+++ b/drivers/lguest/core.c
@@ -92,9 +92,17 @@ static __init int map_switcher(void)
@@ -38037,7 +37910,7 @@ index a5ebc00..982886f 100644
* allocates an extra guard page, so we need space for that.
*/
+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
+ switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
+ VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
+ + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
@@ -40147,7 +40020,7 @@ index b0c3de9..fc5857e 100644
return -EIO;
}
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
-index 15ba8c4..3f56838 100644
+index 54fd2ef..33c8a4f 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -740,22 +740,22 @@ struct rtl8169_private {
@@ -40290,10 +40163,23 @@ index 011062e..ada88e9 100644
};
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
-index a449439..1e468fe 100644
+index acf6450..8f771b7 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
-@@ -1090,7 +1090,7 @@ static int macvtap_device_event(struct notifier_block *unused,
+@@ -525,8 +525,10 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
+ return -EMSGSIZE;
+ num_pages = get_user_pages_fast(base, size, 0, &page[i]);
+ if (num_pages != size) {
+- for (i = 0; i < num_pages; i++)
+- put_page(page[i]);
++ int j;
++
++ for (j = 0; j < num_pages; j++)
++ put_page(page[i + j]);
+ return -EFAULT;
+ }
+ truesize = size * PAGE_SIZE;
+@@ -1099,7 +1101,7 @@ static int macvtap_device_event(struct notifier_block *unused,
return NOTIFY_DONE;
}
@@ -40350,7 +40236,7 @@ index 1252d9c..80e660b 100644
/* We've got a compressed packet; read the change byte */
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
-index bf34192..fba3500 100644
+index 0017b67..ab8f595 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -2668,7 +2668,7 @@ static int team_device_event(struct notifier_block *unused,
@@ -40363,10 +40249,23 @@ index bf34192..fba3500 100644
};
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index 755fa9e..631fdce 100644
+index 8ad822e..eb895f1 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
-@@ -1841,7 +1841,7 @@ unlock:
+@@ -1013,8 +1013,10 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
+ return -EMSGSIZE;
+ num_pages = get_user_pages_fast(base, size, 0, &page[i]);
+ if (num_pages != size) {
+- for (i = 0; i < num_pages; i++)
+- put_page(page[i]);
++ int j;
++
++ for (j = 0; j < num_pages; j++)
++ put_page(page[i + j]);
+ return -EFAULT;
+ }
+ truesize = size * PAGE_SIZE;
+@@ -1859,7 +1861,7 @@ unlock:
}
static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
@@ -40375,7 +40274,7 @@ index 755fa9e..631fdce 100644
{
struct tun_file *tfile = file->private_data;
struct tun_struct *tun;
-@@ -1853,6 +1853,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
+@@ -1871,6 +1873,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
int vnet_hdr_sz;
int ret;
@@ -40477,10 +40376,10 @@ index e2dd324..be92fcf 100644
hso_start_serial_device(serial_table[i], GFP_NOIO);
hso_kick_transmit(dev2ser(serial_table[i]));
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
-index 7cee7a3..1eb9f3b 100644
+index a4fe5f1..6c9e77f 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
-@@ -1443,7 +1443,7 @@ nla_put_failure:
+@@ -1454,7 +1454,7 @@ nla_put_failure:
return -EMSGSIZE;
}
@@ -40489,6 +40388,62 @@ index 7cee7a3..1eb9f3b 100644
.kind = "vxlan",
.maxtype = IFLA_VXLAN_MAX,
.policy = vxlan_policy,
+diff --git a/drivers/net/wan/dlci.c b/drivers/net/wan/dlci.c
+index 147614e..6a8a382 100644
+--- a/drivers/net/wan/dlci.c
++++ b/drivers/net/wan/dlci.c
+@@ -384,21 +384,37 @@ static int dlci_del(struct dlci_add *dlci)
+ struct frad_local *flp;
+ struct net_device *master, *slave;
+ int err;
++ bool found = false;
++
++ rtnl_lock();
+
+ /* validate slave device */
+ master = __dev_get_by_name(&init_net, dlci->devname);
+- if (!master)
+- return -ENODEV;
++ if (!master) {
++ err = -ENODEV;
++ goto out;
++ }
++
++ list_for_each_entry(dlp, &dlci_devs, list) {
++ if (dlp->master == master) {
++ found = true;
++ break;
++ }
++ }
++ if (!found) {
++ err = -ENODEV;
++ goto out;
++ }
+
+ if (netif_running(master)) {
+- return -EBUSY;
++ err = -EBUSY;
++ goto out;
+ }
+
+ dlp = netdev_priv(master);
+ slave = dlp->slave;
+ flp = netdev_priv(slave);
+
+- rtnl_lock();
+ err = (*flp->deassoc)(slave, master);
+ if (!err) {
+ list_del(&dlp->list);
+@@ -407,8 +423,8 @@ static int dlci_del(struct dlci_add *dlci)
+
+ dev_put(slave);
+ }
++out:
+ rtnl_unlock();
+-
+ return err;
+ }
+
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 5ac5f7a..5f82012 100644
--- a/drivers/net/wireless/at76c50x-usb.c
@@ -43581,10 +43536,10 @@ index 1f8cba6..47b06c2 100644
}
EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
-index 125e0fd..8c50690 100644
+index 74a5e8b..40c36a7 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
-@@ -800,8 +800,10 @@ static void __init unix98_pty_init(void)
+@@ -797,8 +797,10 @@ static void __init unix98_pty_init(void)
panic("Couldn't register Unix98 pts driver");
/* Now create the /dev/ptmx special device */
@@ -44398,7 +44353,7 @@ index a9af1b9a..1e08e7f 100644
ret = -EPERM;
goto reterr;
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
-index c8b9262..7e824e6 100644
+index b645c47..a55c182 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -25,6 +25,7 @@
@@ -44431,7 +44386,7 @@ index c8b9262..7e824e6 100644
}
static struct device_attribute uio_class_attributes[] = {
-@@ -397,7 +398,7 @@ void uio_event_notify(struct uio_info *info)
+@@ -398,7 +399,7 @@ void uio_event_notify(struct uio_info *info)
{
struct uio_device *idev = info->uio_dev;
@@ -44440,7 +44395,7 @@ index c8b9262..7e824e6 100644
wake_up_interruptible(&idev->wait);
kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
}
-@@ -450,7 +451,7 @@ static int uio_open(struct inode *inode, struct file *filep)
+@@ -451,7 +452,7 @@ static int uio_open(struct inode *inode, struct file *filep)
}
listener->dev = idev;
@@ -44449,7 +44404,7 @@ index c8b9262..7e824e6 100644
filep->private_data = listener;
if (idev->info->open) {
-@@ -501,7 +502,7 @@ static unsigned int uio_poll(struct file *filep, poll_table *wait)
+@@ -502,7 +503,7 @@ static unsigned int uio_poll(struct file *filep, poll_table *wait)
return -EIO;
poll_wait(filep, &idev->wait, wait);
@@ -44458,7 +44413,7 @@ index c8b9262..7e824e6 100644
return POLLIN | POLLRDNORM;
return 0;
}
-@@ -526,7 +527,7 @@ static ssize_t uio_read(struct file *filep, char __user *buf,
+@@ -527,7 +528,7 @@ static ssize_t uio_read(struct file *filep, char __user *buf,
do {
set_current_state(TASK_INTERRUPTIBLE);
@@ -44467,7 +44422,7 @@ index c8b9262..7e824e6 100644
if (event_count != listener->event_count) {
if (copy_to_user(buf, &event_count, count))
retval = -EFAULT;
-@@ -595,13 +596,13 @@ static int uio_find_mem_index(struct vm_area_struct *vma)
+@@ -596,13 +597,13 @@ static int uio_find_mem_index(struct vm_area_struct *vma)
static void uio_vma_open(struct vm_area_struct *vma)
{
struct uio_device *idev = vma->vm_private_data;
@@ -44483,7 +44438,7 @@ index c8b9262..7e824e6 100644
}
static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-@@ -808,7 +809,7 @@ int __uio_register_device(struct module *owner,
+@@ -809,7 +810,7 @@ int __uio_register_device(struct module *owner,
idev->owner = owner;
idev->info = info;
init_waitqueue_head(&idev->wait);
@@ -57045,7 +57000,7 @@ index ca9ecaa..60100c7 100644
kfree(s);
diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
new file mode 100644
-index 0000000..ba9c5e3
+index 0000000..4fb1dde
--- /dev/null
+++ b/grsecurity/Kconfig
@@ -0,0 +1,1053 @@
@@ -57156,7 +57111,7 @@ index 0000000..ba9c5e3
+config GRKERNSEC_RAND_THREADSTACK
+ bool "Insert random gaps between thread stacks"
+ default y if GRKERNSEC_CONFIG_AUTO
-+ depends on PAX_RANDMMAP && !PPC && BROKEN
++ depends on PAX_RANDMMAP && !PPC
+ help
+ If you say Y here, a random-sized gap will be enforced between allocated
+ thread stacks. Glibc's NPTL and other threading libraries that
@@ -70255,7 +70210,7 @@ index b8ba855..0148090 100644
u32 remainder;
return div_u64_rem(dividend, divisor, &remainder);
diff --git a/include/linux/mm.h b/include/linux/mm.h
-index e2091b8..821db54 100644
+index e2091b8..3c7b38c 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -101,6 +101,11 @@ extern unsigned int kobjsize(const void *objp);
@@ -70428,14 +70383,29 @@ index e2091b8..821db54 100644
#ifdef CONFIG_MMU
extern int __mm_populate(unsigned long addr, unsigned long len,
-@@ -1483,6 +1497,7 @@ struct vm_unmapped_area_info {
+@@ -1483,10 +1497,11 @@ struct vm_unmapped_area_info {
unsigned long high_limit;
unsigned long align_mask;
unsigned long align_offset;
+ unsigned long threadstack_offset;
};
- extern unsigned long unmapped_area(struct vm_unmapped_area_info *info);
+-extern unsigned long unmapped_area(struct vm_unmapped_area_info *info);
+-extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info);
++extern unsigned long unmapped_area(const struct vm_unmapped_area_info *info);
++extern unsigned long unmapped_area_topdown(const struct vm_unmapped_area_info *info);
+
+ /*
+ * Search for an unmapped address range.
+@@ -1498,7 +1513,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info);
+ * - satisfies (begin_addr & align_mask) == (align_offset & align_mask)
+ */
+ static inline unsigned long
+-vm_unmapped_area(struct vm_unmapped_area_info *info)
++vm_unmapped_area(const struct vm_unmapped_area_info *info)
+ {
+ if (!(info->flags & VM_UNMAPPED_AREA_TOPDOWN))
+ return unmapped_area(info);
@@ -1561,6 +1576,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
struct vm_area_struct **pprev);
@@ -70968,7 +70938,7 @@ index 45fc162..01a4068 100644
/**
* struct hotplug_slot_info - used to notify the hotplug pci core of the state of the slot
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
-index 1d795df..b0a6449 100644
+index 2f522a3..494e45f 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -333,8 +333,8 @@ struct perf_event {
@@ -70993,7 +70963,7 @@ index 1d795df..b0a6449 100644
/*
* Protect attach/detach and child_list:
-@@ -704,7 +704,7 @@ static inline void perf_callchain_store(struct perf_callchain_entry *entry, u64
+@@ -703,7 +703,7 @@ static inline void perf_callchain_store(struct perf_callchain_entry *entry, u64
entry->ip[entry->nr++] = ip;
}
@@ -71002,7 +70972,7 @@ index 1d795df..b0a6449 100644
extern int sysctl_perf_event_mlock;
extern int sysctl_perf_event_sample_rate;
-@@ -712,19 +712,24 @@ extern int perf_proc_update_handler(struct ctl_table *table, int write,
+@@ -711,19 +711,24 @@ extern int perf_proc_update_handler(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp,
loff_t *ppos);
@@ -71030,7 +71000,7 @@ index 1d795df..b0a6449 100644
}
extern void perf_event_init(void);
-@@ -812,7 +817,7 @@ static inline void perf_restore_debug_store(void) { }
+@@ -811,7 +816,7 @@ static inline void perf_restore_debug_store(void) { }
*/
#define perf_cpu_notifier(fn) \
do { \
@@ -71039,7 +71009,7 @@ index 1d795df..b0a6449 100644
{ .notifier_call = fn, .priority = CPU_PRI_PERF }; \
unsigned long cpu = smp_processor_id(); \
unsigned long flags; \
-@@ -831,7 +836,7 @@ do { \
+@@ -830,7 +835,7 @@ do { \
struct perf_pmu_events_attr {
struct device_attribute attr;
u64 id;
@@ -71702,7 +71672,7 @@ index 429c199..4d42e38 100644
/* shm_mode upper byte flags */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
-index b8292d8..96db310 100644
+index 1f2803c..4858a3d 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -599,7 +599,7 @@ extern bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
@@ -72023,20 +71993,6 @@ index e8d702e..0a56eb4 100644
int sock_diag_register(const struct sock_diag_handler *h);
void sock_diag_unregister(const struct sock_diag_handler *h);
-diff --git a/include/linux/socket.h b/include/linux/socket.h
-index 2b9f74b..e897bdc 100644
---- a/include/linux/socket.h
-+++ b/include/linux/socket.h
-@@ -321,6 +321,9 @@ extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data);
-
- struct timespec;
-
-+/* The __sys_...msg variants allow MSG_CMSG_COMPAT */
-+extern long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags);
-+extern long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags);
- extern int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
- unsigned int flags, struct timespec *timeout);
- extern int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg,
diff --git a/include/linux/sonet.h b/include/linux/sonet.h
index 680f9a3..f13aeb0 100644
--- a/include/linux/sonet.h
@@ -75189,7 +75145,7 @@ index 00eb8f7..d7e3244 100644
#ifdef CONFIG_MODULE_UNLOAD
{
diff --git a/kernel/events/core.c b/kernel/events/core.c
-index 9fcb094..353baaaf 100644
+index f8ddcfb..77c06ec 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -154,8 +154,15 @@ static struct srcu_struct pmus_srcu;
@@ -75218,7 +75174,7 @@ index 9fcb094..353baaaf 100644
static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
enum event_type_t event_type);
-@@ -2677,7 +2684,7 @@ static void __perf_event_read(void *info)
+@@ -2674,7 +2681,7 @@ static void __perf_event_read(void *info)
static inline u64 perf_event_count(struct perf_event *event)
{
@@ -75227,7 +75183,7 @@ index 9fcb094..353baaaf 100644
}
static u64 perf_event_read(struct perf_event *event)
-@@ -3007,9 +3014,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
+@@ -3020,9 +3027,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
mutex_lock(&event->child_mutex);
total += perf_event_read(event);
*enabled += event->total_time_enabled +
@@ -75239,7 +75195,7 @@ index 9fcb094..353baaaf 100644
list_for_each_entry(child, &event->child_list, child_list) {
total += perf_event_read(child);
-@@ -3412,10 +3419,10 @@ void perf_event_update_userpage(struct perf_event *event)
+@@ -3408,10 +3415,10 @@ void perf_event_update_userpage(struct perf_event *event)
userpg->offset -= local64_read(&event->hw.prev_count);
userpg->time_enabled = enabled +
@@ -75252,7 +75208,7 @@ index 9fcb094..353baaaf 100644
arch_perf_update_userpage(userpg, now);
-@@ -3886,7 +3893,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
+@@ -3961,7 +3968,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
/* Data. */
sp = perf_user_stack_pointer(regs);
@@ -75261,7 +75217,7 @@ index 9fcb094..353baaaf 100644
dyn_size = dump_size - rem;
perf_output_skip(handle, rem);
-@@ -3974,11 +3981,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
+@@ -4049,11 +4056,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
values[n++] = perf_event_count(event);
if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
values[n++] = enabled +
@@ -75275,7 +75231,7 @@ index 9fcb094..353baaaf 100644
}
if (read_format & PERF_FORMAT_ID)
values[n++] = primary_event_id(event);
-@@ -4726,12 +4733,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
+@@ -4801,12 +4808,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
* need to add enough zero bytes after the string to handle
* the 64bit alignment we do later.
*/
@@ -75290,7 +75246,7 @@ index 9fcb094..353baaaf 100644
if (IS_ERR(name)) {
name = strncpy(tmp, "//toolong", sizeof(tmp));
goto got_name;
-@@ -6167,7 +6174,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+@@ -6242,7 +6249,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
event->parent = parent_event;
event->ns = get_pid_ns(task_active_pid_ns(current));
@@ -75299,7 +75255,7 @@ index 9fcb094..353baaaf 100644
event->state = PERF_EVENT_STATE_INACTIVE;
-@@ -6463,6 +6470,11 @@ SYSCALL_DEFINE5(perf_event_open,
+@@ -6552,6 +6559,11 @@ SYSCALL_DEFINE5(perf_event_open,
if (flags & ~PERF_FLAG_ALL)
return -EINVAL;
@@ -75311,7 +75267,7 @@ index 9fcb094..353baaaf 100644
err = perf_copy_attr(attr_uptr, &attr);
if (err)
return err;
-@@ -6795,10 +6807,10 @@ static void sync_child_event(struct perf_event *child_event,
+@@ -6884,10 +6896,10 @@ static void sync_child_event(struct perf_event *child_event,
/*
* Add back the child's count to the parent's count:
*/
@@ -75326,10 +75282,10 @@ index 9fcb094..353baaaf 100644
/*
diff --git a/kernel/events/internal.h b/kernel/events/internal.h
-index eb675c4..54912ff 100644
+index ca65997..cc8cee4 100644
--- a/kernel/events/internal.h
+++ b/kernel/events/internal.h
-@@ -77,10 +77,10 @@ static inline unsigned long perf_data_size(struct ring_buffer *rb)
+@@ -81,10 +81,10 @@ static inline unsigned long perf_data_size(struct ring_buffer *rb)
return rb->nr_pages << (PAGE_SHIFT + page_order(rb));
}
@@ -75342,7 +75298,7 @@ index eb675c4..54912ff 100644
{ \
unsigned long size, written; \
\
-@@ -112,17 +112,17 @@ static inline int memcpy_common(void *dst, const void *src, size_t n)
+@@ -116,17 +116,17 @@ static inline int memcpy_common(void *dst, const void *src, size_t n)
return n;
}
@@ -82244,7 +82200,7 @@ index 79b7cf7..9944291 100644
capable(CAP_IPC_LOCK))
ret = do_mlockall(flags);
diff --git a/mm/mmap.c b/mm/mmap.c
-index 0dceed8..e7cfc40 100644
+index 0dceed8..bfcaf45 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -33,6 +33,7 @@
@@ -82645,10 +82601,11 @@ index 0dceed8..e7cfc40 100644
kmem_cache_free(vm_area_cachep, vma);
unacct_error:
if (charged)
-@@ -1584,6 +1744,62 @@ unacct_error:
+@@ -1584,7 +1744,63 @@ unacct_error:
return error;
}
+-unsigned long unmapped_area(struct vm_unmapped_area_info *info)
+#ifdef CONFIG_GRKERNSEC_RAND_THREADSTACK
+unsigned long gr_rand_threadstack_offset(const struct mm_struct *mm, const struct file *filp, unsigned long flags)
+{
@@ -82705,10 +82662,76 @@ index 0dceed8..e7cfc40 100644
+ return -ENOMEM;
+}
+
- unsigned long unmapped_area(struct vm_unmapped_area_info *info)
++unsigned long unmapped_area(const struct vm_unmapped_area_info *info)
{
/*
-@@ -1803,6 +2019,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ * We implement the search by looking for an rbtree node that
+@@ -1632,11 +1848,29 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
+ }
+ }
+
+- gap_start = vma->vm_prev ? vma->vm_prev->vm_end : 0;
++ gap_start = vma->vm_prev ? vma->vm_prev->vm_end: 0;
+ check_current:
+ /* Check if current node has a suitable gap */
+ if (gap_start > high_limit)
+ return -ENOMEM;
++
++ if (gap_end - gap_start > info->threadstack_offset)
++ gap_start += info->threadstack_offset;
++ else
++ gap_start = gap_end;
++
++ if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP)) {
++ if (gap_end - gap_start > sysctl_heap_stack_gap)
++ gap_start += sysctl_heap_stack_gap;
++ else
++ gap_start = gap_end;
++ }
++ if (vma->vm_flags & VM_GROWSDOWN) {
++ if (gap_end - gap_start > sysctl_heap_stack_gap)
++ gap_end -= sysctl_heap_stack_gap;
++ else
++ gap_end = gap_start;
++ }
+ if (gap_end >= low_limit && gap_end - gap_start >= length)
+ goto found;
+
+@@ -1686,7 +1920,7 @@ found:
+ return gap_start;
+ }
+
+-unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
++unsigned long unmapped_area_topdown(const struct vm_unmapped_area_info *info)
+ {
+ struct mm_struct *mm = current->mm;
+ struct vm_area_struct *vma;
+@@ -1740,6 +1974,24 @@ check_current:
+ gap_end = vma->vm_start;
+ if (gap_end < low_limit)
+ return -ENOMEM;
++
++ if (gap_end - gap_start > info->threadstack_offset)
++ gap_end -= info->threadstack_offset;
++ else
++ gap_end = gap_start;
++
++ if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP)) {
++ if (gap_end - gap_start > sysctl_heap_stack_gap)
++ gap_start += sysctl_heap_stack_gap;
++ else
++ gap_start = gap_end;
++ }
++ if (vma->vm_flags & VM_GROWSDOWN) {
++ if (gap_end - gap_start > sysctl_heap_stack_gap)
++ gap_end -= sysctl_heap_stack_gap;
++ else
++ gap_end = gap_start;
++ }
+ if (gap_start <= high_limit && gap_end - gap_start >= length)
+ goto found;
+
+@@ -1803,6 +2055,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
struct vm_unmapped_area_info info;
@@ -82716,7 +82739,7 @@ index 0dceed8..e7cfc40 100644
if (len > TASK_SIZE)
return -ENOMEM;
-@@ -1810,29 +2027,45 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1810,29 +2063,45 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
if (flags & MAP_FIXED)
return addr;
@@ -82765,7 +82788,7 @@ index 0dceed8..e7cfc40 100644
mm->free_area_cache = addr;
}
-@@ -1850,6 +2083,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1850,6 +2119,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
struct mm_struct *mm = current->mm;
unsigned long addr = addr0;
struct vm_unmapped_area_info info;
@@ -82773,7 +82796,7 @@ index 0dceed8..e7cfc40 100644
/* requested length too big for entire address space */
if (len > TASK_SIZE)
-@@ -1858,12 +2092,15 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1858,12 +2128,15 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
if (flags & MAP_FIXED)
return addr;
@@ -82791,7 +82814,7 @@ index 0dceed8..e7cfc40 100644
return addr;
}
-@@ -1872,6 +2109,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1872,6 +2145,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
info.low_limit = PAGE_SIZE;
info.high_limit = mm->mmap_base;
info.align_mask = 0;
@@ -82799,7 +82822,7 @@ index 0dceed8..e7cfc40 100644
addr = vm_unmapped_area(&info);
/*
-@@ -1884,6 +2122,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1884,6 +2158,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
VM_BUG_ON(addr != -ENOMEM);
info.flags = 0;
info.low_limit = TASK_UNMAPPED_BASE;
@@ -82812,7 +82835,7 @@ index 0dceed8..e7cfc40 100644
info.high_limit = TASK_SIZE;
addr = vm_unmapped_area(&info);
}
-@@ -1894,6 +2138,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1894,6 +2174,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
{
@@ -82825,7 +82848,7 @@ index 0dceed8..e7cfc40 100644
/*
* Is this a new hole at the highest possible address?
*/
-@@ -1901,8 +2151,10 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
+@@ -1901,8 +2187,10 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
mm->free_area_cache = addr;
/* dont allow allocations above current base */
@@ -82837,7 +82860,7 @@ index 0dceed8..e7cfc40 100644
}
unsigned long
-@@ -2001,6 +2253,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
+@@ -2001,6 +2289,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
return vma;
}
@@ -82866,7 +82889,7 @@ index 0dceed8..e7cfc40 100644
/*
* Verify that the stack growth is acceptable and
* update accounting. This is shared with both the
-@@ -2017,6 +2291,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2017,6 +2327,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
return -ENOMEM;
/* Stack limit test */
@@ -82874,7 +82897,7 @@ index 0dceed8..e7cfc40 100644
if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
return -ENOMEM;
-@@ -2027,6 +2302,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2027,6 +2338,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
locked = mm->locked_vm + grow;
limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
limit >>= PAGE_SHIFT;
@@ -82882,7 +82905,7 @@ index 0dceed8..e7cfc40 100644
if (locked > limit && !capable(CAP_IPC_LOCK))
return -ENOMEM;
}
-@@ -2056,37 +2332,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2056,37 +2368,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
* PA-RISC uses this for its stack; IA64 for its Register Backing Store.
* vma is the last one with address > vma->vm_end. Have to extend vma.
*/
@@ -82940,7 +82963,7 @@ index 0dceed8..e7cfc40 100644
unsigned long size, grow;
size = address - vma->vm_start;
-@@ -2121,6 +2408,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+@@ -2121,6 +2444,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
}
}
}
@@ -82949,7 +82972,7 @@ index 0dceed8..e7cfc40 100644
vma_unlock_anon_vma(vma);
khugepaged_enter_vma_merge(vma);
validate_mm(vma->vm_mm);
-@@ -2135,6 +2424,8 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2135,6 +2460,8 @@ int expand_downwards(struct vm_area_struct *vma,
unsigned long address)
{
int error;
@@ -82958,7 +82981,7 @@ index 0dceed8..e7cfc40 100644
/*
* We must make sure the anon_vma is allocated
-@@ -2148,6 +2439,15 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2148,6 +2475,15 @@ int expand_downwards(struct vm_area_struct *vma,
if (error)
return error;
@@ -82974,7 +82997,7 @@ index 0dceed8..e7cfc40 100644
vma_lock_anon_vma(vma);
/*
-@@ -2157,9 +2457,17 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2157,9 +2493,17 @@ int expand_downwards(struct vm_area_struct *vma,
*/
/* Somebody else might have raced and expanded it already */
@@ -82993,7 +83016,7 @@ index 0dceed8..e7cfc40 100644
size = vma->vm_end - address;
grow = (vma->vm_start - address) >> PAGE_SHIFT;
-@@ -2184,13 +2492,27 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2184,13 +2528,27 @@ int expand_downwards(struct vm_area_struct *vma,
vma->vm_pgoff -= grow;
anon_vma_interval_tree_post_update_vma(vma);
vma_gap_update(vma);
@@ -83021,7 +83044,7 @@ index 0dceed8..e7cfc40 100644
khugepaged_enter_vma_merge(vma);
validate_mm(vma->vm_mm);
return error;
-@@ -2288,6 +2610,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2288,6 +2646,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
do {
long nrpages = vma_pages(vma);
@@ -83035,7 +83058,7 @@ index 0dceed8..e7cfc40 100644
if (vma->vm_flags & VM_ACCOUNT)
nr_accounted += nrpages;
vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
-@@ -2333,6 +2662,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2333,6 +2698,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
insertion_point = (prev ? &prev->vm_next : &mm->mmap);
vma->vm_prev = NULL;
do {
@@ -83052,7 +83075,7 @@ index 0dceed8..e7cfc40 100644
vma_rb_erase(vma, &mm->mm_rb);
mm->map_count--;
tail_vma = vma;
-@@ -2364,14 +2703,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2364,14 +2739,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
struct vm_area_struct *new;
int err = -ENOMEM;
@@ -83086,7 +83109,7 @@ index 0dceed8..e7cfc40 100644
/* most fields are the same, copy all, and then fixup */
*new = *vma;
-@@ -2384,6 +2742,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2384,6 +2778,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
}
@@ -83109,7 +83132,7 @@ index 0dceed8..e7cfc40 100644
pol = mpol_dup(vma_policy(vma));
if (IS_ERR(pol)) {
err = PTR_ERR(pol);
-@@ -2406,6 +2780,36 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2406,6 +2816,36 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
else
err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
@@ -83146,7 +83169,7 @@ index 0dceed8..e7cfc40 100644
/* Success. */
if (!err)
return 0;
-@@ -2415,10 +2819,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2415,10 +2855,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
new->vm_ops->close(new);
if (new->vm_file)
fput(new->vm_file);
@@ -83166,7 +83189,7 @@ index 0dceed8..e7cfc40 100644
kmem_cache_free(vm_area_cachep, new);
out_err:
return err;
-@@ -2431,6 +2843,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2431,6 +2879,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
unsigned long addr, int new_below)
{
@@ -83182,7 +83205,7 @@ index 0dceed8..e7cfc40 100644
if (mm->map_count >= sysctl_max_map_count)
return -ENOMEM;
-@@ -2442,11 +2863,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2442,11 +2899,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
* work. This now handles partial unmappings.
* Jeremy Fitzhardinge <jeremy@goop.org>
*/
@@ -83213,7 +83236,7 @@ index 0dceed8..e7cfc40 100644
if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
return -EINVAL;
-@@ -2521,6 +2961,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+@@ -2521,6 +2997,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
/* Fix up all other VM information */
remove_vma_list(mm, vma);
@@ -83222,7 +83245,7 @@ index 0dceed8..e7cfc40 100644
return 0;
}
-@@ -2529,6 +2971,13 @@ int vm_munmap(unsigned long start, size_t len)
+@@ -2529,6 +3007,13 @@ int vm_munmap(unsigned long start, size_t len)
int ret;
struct mm_struct *mm = current->mm;
@@ -83236,7 +83259,7 @@ index 0dceed8..e7cfc40 100644
down_write(&mm->mmap_sem);
ret = do_munmap(mm, start, len);
up_write(&mm->mmap_sem);
-@@ -2542,16 +2991,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+@@ -2542,16 +3027,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
return vm_munmap(addr, len);
}
@@ -83253,7 +83276,7 @@ index 0dceed8..e7cfc40 100644
/*
* this is really a simplified "do_mmap". it only handles
* anonymous maps. eventually we may be able to do some
-@@ -2565,6 +3004,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2565,6 +3040,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
struct rb_node ** rb_link, * rb_parent;
pgoff_t pgoff = addr >> PAGE_SHIFT;
int error;
@@ -83261,7 +83284,7 @@ index 0dceed8..e7cfc40 100644
len = PAGE_ALIGN(len);
if (!len)
-@@ -2572,16 +3012,30 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2572,16 +3048,30 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
@@ -83293,7 +83316,7 @@ index 0dceed8..e7cfc40 100644
locked += mm->locked_vm;
lock_limit = rlimit(RLIMIT_MEMLOCK);
lock_limit >>= PAGE_SHIFT;
-@@ -2598,21 +3052,20 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2598,21 +3088,20 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
/*
* Clear old maps. this also does some error checking for us
*/
@@ -83318,7 +83341,7 @@ index 0dceed8..e7cfc40 100644
return -ENOMEM;
/* Can we just expand an old private anonymous mapping? */
-@@ -2626,7 +3079,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2626,7 +3115,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
*/
vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
if (!vma) {
@@ -83327,7 +83350,7 @@ index 0dceed8..e7cfc40 100644
return -ENOMEM;
}
-@@ -2640,9 +3093,10 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2640,9 +3129,10 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
vma_link(mm, vma, prev, rb_link, rb_parent);
out:
perf_event_mmap(vma);
@@ -83340,7 +83363,7 @@ index 0dceed8..e7cfc40 100644
return addr;
}
-@@ -2704,6 +3158,7 @@ void exit_mmap(struct mm_struct *mm)
+@@ -2704,6 +3194,7 @@ void exit_mmap(struct mm_struct *mm)
while (vma) {
if (vma->vm_flags & VM_ACCOUNT)
nr_accounted += vma_pages(vma);
@@ -83348,7 +83371,7 @@ index 0dceed8..e7cfc40 100644
vma = remove_vma(vma);
}
vm_unacct_memory(nr_accounted);
-@@ -2720,6 +3175,13 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2720,6 +3211,13 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
struct vm_area_struct *prev;
struct rb_node **rb_link, *rb_parent;
@@ -83362,7 +83385,7 @@ index 0dceed8..e7cfc40 100644
/*
* The vm_pgoff of a purely anonymous vma should be irrelevant
* until its first write fault, when page's anon_vma and index
-@@ -2743,7 +3205,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2743,7 +3241,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
security_vm_enough_memory_mm(mm, vma_pages(vma)))
return -ENOMEM;
@@ -83384,7 +83407,7 @@ index 0dceed8..e7cfc40 100644
return 0;
}
-@@ -2763,6 +3239,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2763,6 +3275,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
struct mempolicy *pol;
bool faulted_in_anon_vma = true;
@@ -83393,7 +83416,7 @@ index 0dceed8..e7cfc40 100644
/*
* If anonymous vma has not yet been faulted, update new pgoff
* to match new location, to increase its chance of merging.
-@@ -2829,6 +3307,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2829,6 +3343,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
return NULL;
}
@@ -83433,7 +83456,7 @@ index 0dceed8..e7cfc40 100644
/*
* Return true if the calling process may expand its vm space by the passed
* number of pages
-@@ -2840,6 +3351,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+@@ -2840,6 +3387,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
@@ -83441,7 +83464,7 @@ index 0dceed8..e7cfc40 100644
if (cur + npages > lim)
return 0;
return 1;
-@@ -2910,6 +3422,22 @@ int install_special_mapping(struct mm_struct *mm,
+@@ -2910,6 +3458,22 @@ int install_special_mapping(struct mm_struct *mm,
vma->vm_start = addr;
vma->vm_end = addr + len;
@@ -85864,10 +85887,20 @@ index 6a93614..1415549 100644
err = -EFAULT;
break;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
-index c5f9cd6..8d23158 100644
+index c5f9cd6..dfc8ec1 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
-@@ -3395,8 +3395,10 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
+@@ -2743,6 +2743,9 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
+ BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
+ conn, code, ident, dlen);
+
++ if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
++ return NULL;
++
+ len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
+ count = min_t(unsigned int, conn->mtu, len);
+
+@@ -3395,8 +3398,10 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
break;
case L2CAP_CONF_RFC:
@@ -85880,6 +85913,15 @@ index c5f9cd6..8d23158 100644
if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
rfc.mode != chan->mode)
+@@ -4221,7 +4226,7 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn,
+ struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
+ u16 type, result;
+
+- if (cmd_len != sizeof(*rsp))
++ if (cmd_len < sizeof(*rsp))
+ return -EPROTO;
+
+ type = __le16_to_cpu(rsp->type);
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 1bcfb84..dad9f98 100644
--- a/net/bluetooth/l2cap_sock.c
@@ -86111,7 +86153,7 @@ index 117814a..ad4fb73 100644
if (__rtnl_register(PF_CAN, RTM_GETROUTE, NULL, cgw_dump_jobs, NULL)) {
diff --git a/net/compat.c b/net/compat.c
-index 79ae884..0541331 100644
+index f0a1ba6..0541331 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -71,9 +71,9 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
@@ -86241,45 +86283,7 @@ index 79ae884..0541331 100644
struct group_filter __user *kgf;
int __user *koptlen;
u32 interface, fmode, numsrc;
-@@ -734,19 +734,25 @@ static unsigned char nas[21] = {
-
- asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
- {
-- return sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
-+ if (flags & MSG_CMSG_COMPAT)
-+ return -EINVAL;
-+ return __sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
- }
-
- asmlinkage long compat_sys_sendmmsg(int fd, struct compat_mmsghdr __user *mmsg,
- unsigned int vlen, unsigned int flags)
- {
-+ if (flags & MSG_CMSG_COMPAT)
-+ return -EINVAL;
- return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
- flags | MSG_CMSG_COMPAT);
- }
-
- asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
- {
-- return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
-+ if (flags & MSG_CMSG_COMPAT)
-+ return -EINVAL;
-+ return __sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
- }
-
- asmlinkage long compat_sys_recv(int fd, void __user *buf, size_t len, unsigned int flags)
-@@ -768,6 +774,9 @@ asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
- int datagrams;
- struct timespec ktspec;
-
-+ if (flags & MSG_CMSG_COMPAT)
-+ return -EINVAL;
-+
- if (COMPAT_USE_64BIT_TIME)
- return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
- flags | MSG_CMSG_COMPAT,
-@@ -796,7 +805,7 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
+@@ -805,7 +805,7 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
if (call < SYS_SOCKET || call > SYS_SENDMMSG)
return -EINVAL;
@@ -86302,7 +86306,7 @@ index 368f9c3..f82d4a3 100644
return err;
diff --git a/net/core/dev.c b/net/core/dev.c
-index 9a278e9..15f2b9e 100644
+index c9eb9e6..922c789 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1617,7 +1617,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
@@ -86332,7 +86336,7 @@ index 9a278e9..15f2b9e 100644
#define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
-@@ -3093,7 +3093,7 @@ enqueue:
+@@ -3099,7 +3099,7 @@ enqueue:
local_irq_restore(flags);
@@ -86341,7 +86345,7 @@ index 9a278e9..15f2b9e 100644
kfree_skb(skb);
return NET_RX_DROP;
}
-@@ -3165,7 +3165,7 @@ int netif_rx_ni(struct sk_buff *skb)
+@@ -3171,7 +3171,7 @@ int netif_rx_ni(struct sk_buff *skb)
}
EXPORT_SYMBOL(netif_rx_ni);
@@ -86350,7 +86354,7 @@ index 9a278e9..15f2b9e 100644
{
struct softnet_data *sd = &__get_cpu_var(softnet_data);
-@@ -3490,7 +3490,7 @@ ncls:
+@@ -3496,7 +3496,7 @@ ncls:
ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
} else {
drop:
@@ -86359,7 +86363,7 @@ index 9a278e9..15f2b9e 100644
kfree_skb(skb);
/* Jamal, now you will not able to escape explaining
* me how you were going to use this. :-)
-@@ -4095,7 +4095,7 @@ void netif_napi_del(struct napi_struct *napi)
+@@ -4101,7 +4101,7 @@ void netif_napi_del(struct napi_struct *napi)
}
EXPORT_SYMBOL(netif_napi_del);
@@ -86368,7 +86372,7 @@ index 9a278e9..15f2b9e 100644
{
struct softnet_data *sd = &__get_cpu_var(softnet_data);
unsigned long time_limit = jiffies + 2;
-@@ -5522,7 +5522,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
+@@ -5528,7 +5528,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
} else {
netdev_stats_to_stats64(storage, &dev->stats);
}
@@ -86639,7 +86643,7 @@ index e61a8bb..6a2f13c 100644
#ifdef CONFIG_INET
static u32 seq_scale(u32 seq)
diff --git a/net/core/sock.c b/net/core/sock.c
-index 1432266..1a0d4a1 100644
+index 684c37d..b541900 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -390,7 +390,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
@@ -87168,7 +87172,7 @@ index 52c273e..579060b 100644
return -ENOMEM;
}
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
-index 91d66db..4af7d99 100644
+index c7e8c04..56cb4c1 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -124,7 +124,7 @@ static bool log_ecn_error = true;
@@ -87298,7 +87302,7 @@ index bf6c5cf..ab2e9c6 100644
return res;
}
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
-index 8f024d4..8b3500c 100644
+index 7533846..d2361d1 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -138,7 +138,7 @@ struct ipip_net {
@@ -87486,10 +87490,10 @@ index dd44e0a..06dcca4 100644
static int raw_seq_show(struct seq_file *seq, void *v)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index 6e28514..5e1b055 100644
+index cfede9a..22248f9 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
-@@ -2553,34 +2553,34 @@ static struct ctl_table ipv4_route_flush_table[] = {
+@@ -2558,34 +2558,34 @@ static struct ctl_table ipv4_route_flush_table[] = {
.maxlen = sizeof(int),
.mode = 0200,
.proc_handler = ipv4_sysctl_rtcache_flush,
@@ -87532,7 +87536,7 @@ index 6e28514..5e1b055 100644
err_dup:
return -ENOMEM;
}
-@@ -2603,7 +2603,7 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
+@@ -2608,7 +2608,7 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
static __net_init int rt_genid_init(struct net *net)
{
@@ -87681,29 +87685,11 @@ index 960fd29..d55bf64 100644
hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table);
if (hdr == NULL)
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index e220207..cdeb839 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -3383,8 +3383,11 @@ int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *hp,
-
- for (i = 0; i < shi->nr_frags; ++i) {
- const struct skb_frag_struct *f = &shi->frags[i];
-- struct page *page = skb_frag_page(f);
-- sg_set_page(&sg, page, skb_frag_size(f), f->page_offset);
-+ unsigned int offset = f->page_offset;
-+ struct page *page = skb_frag_page(f) + (offset >> PAGE_SHIFT);
-+
-+ sg_set_page(&sg, page, skb_frag_size(f),
-+ offset_in_page(offset));
- if (crypto_hash_update(desc, &sg, skb_frag_size(f)))
- return 1;
- }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index 13b9c08..d33a8d0 100644
+index 59163c8..8277c51 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
-@@ -4724,7 +4724,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
+@@ -4727,7 +4727,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
* simplifies code)
*/
static void
@@ -87712,7 +87698,7 @@ index 13b9c08..d33a8d0 100644
struct sk_buff *head, struct sk_buff *tail,
u32 start, u32 end)
{
-@@ -5838,6 +5838,7 @@ discard:
+@@ -5841,6 +5841,7 @@ discard:
tcp_paws_reject(&tp->rx_opt, 0))
goto discard_and_undo;
@@ -87720,7 +87706,7 @@ index 13b9c08..d33a8d0 100644
if (th->syn) {
/* We see SYN without ACK. It is attempt of
* simultaneous connect with crossed SYNs.
-@@ -5888,6 +5889,7 @@ discard:
+@@ -5891,6 +5892,7 @@ discard:
goto discard;
#endif
}
@@ -87728,7 +87714,7 @@ index 13b9c08..d33a8d0 100644
/* "fifth, if neither of the SYN or RST bits is set then
* drop the segment and return."
*/
-@@ -5932,7 +5934,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -5935,7 +5937,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
goto discard;
if (th->syn) {
@@ -88023,7 +88009,7 @@ index 9a459be..086b866 100644
return -ENOMEM;
}
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index dae802c..bfa4baa 100644
+index 50a4c7c..50a27e6 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2274,7 +2274,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
@@ -88035,7 +88021,7 @@ index dae802c..bfa4baa 100644
if (ops->ndo_do_ioctl) {
mm_segment_t oldfs = get_fs();
-@@ -4410,7 +4410,7 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write,
+@@ -4412,7 +4412,7 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write,
int *valp = ctl->data;
int val = *valp;
loff_t pos = *ppos;
@@ -88044,7 +88030,7 @@ index dae802c..bfa4baa 100644
int ret;
/*
-@@ -4492,7 +4492,7 @@ int addrconf_sysctl_disable(ctl_table *ctl, int write,
+@@ -4494,7 +4494,7 @@ int addrconf_sysctl_disable(ctl_table *ctl, int write,
int *valp = ctl->data;
int val = *valp;
loff_t pos = *ppos;
@@ -88107,18 +88093,28 @@ index 95d13c7..791fe2f 100644
.maxtype = IFLA_GRE_MAX,
.policy = ip6gre_policy,
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index 155eccf..851fdae 100644
+index 851fdae..9d4d1fd 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
-@@ -1147,7 +1147,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
- if (WARN_ON(np->cork.opt))
- return -EINVAL;
+@@ -822,11 +822,17 @@ static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
+ const struct flowi6 *fl6)
+ {
+ struct ipv6_pinfo *np = inet6_sk(sk);
+- struct rt6_info *rt = (struct rt6_info *)dst;
++ struct rt6_info *rt;
-- np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
-+ np->cork.opt = kzalloc(opt->tot_len, sk->sk_allocation);
- if (unlikely(np->cork.opt == NULL))
- return -ENOBUFS;
+ if (!dst)
+ goto out;
++ if (dst->ops->family != AF_INET6) {
++ dst_release(dst);
++ return NULL;
++ }
++
++ rt = (struct rt6_info *)dst;
+ /* Yes, checking route validity in not connected
+ * case is not very simple. Take into account,
+ * that we do not support routing by source, TOS,
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index fff83cb..82d49dd 100644
--- a/net/ipv6/ip6_tunnel.c
@@ -88697,10 +88693,26 @@ index 4fe76ff..426a904 100644
};
diff --git a/net/key/af_key.c b/net/key/af_key.c
-index 5b1e5af..2358147 100644
+index 5b1e5af..1b929e7 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
-@@ -3041,10 +3041,10 @@ static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, const struc
+@@ -1710,6 +1710,7 @@ static int key_notify_sa_flush(const struct km_event *c)
+ hdr->sadb_msg_version = PF_KEY_V2;
+ hdr->sadb_msg_errno = (uint8_t) 0;
+ hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
++ hdr->sadb_msg_reserved = 0;
+
+ pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
+
+@@ -2695,6 +2696,7 @@ static int key_notify_policy_flush(const struct km_event *c)
+ hdr->sadb_msg_errno = (uint8_t) 0;
+ hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
+ hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
++ hdr->sadb_msg_reserved = 0;
+ pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
+ return 0;
+
+@@ -3041,10 +3043,10 @@ static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, const struc
static u32 get_acqseq(void)
{
u32 res;
@@ -88713,33 +88725,6 @@ index 5b1e5af..2358147 100644
} while (!res);
return res;
}
-diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
-index 637a341..8dec687 100644
---- a/net/l2tp/l2tp_ppp.c
-+++ b/net/l2tp/l2tp_ppp.c
-@@ -346,19 +346,19 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
- skb_put(skb, 2);
-
- /* Copy user data into skb */
-- error = memcpy_fromiovec(skb->data, m->msg_iov, total_len);
-+ error = memcpy_fromiovec(skb_put(skb, total_len), m->msg_iov,
-+ total_len);
- if (error < 0) {
- kfree_skb(skb);
- goto error_put_sess_tun;
- }
-- skb_put(skb, total_len);
-
- l2tp_xmit_skb(session, skb, session->hdr_len);
-
- sock_put(ps->tunnel_sock);
- sock_put(sk);
-
-- return error;
-+ return total_len;
-
- error_put_sess_tun:
- sock_put(ps->tunnel_sock);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 843d8c4..cb04fa1 100644
--- a/net/mac80211/cfg.c
@@ -89356,6 +89341,22 @@ index 9e31269..bc4c1b7 100644
mutex_unlock(&nf_log_mutex);
}
+diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c
+index 96ccdf7..dac11f7 100644
+--- a/net/netfilter/nf_nat_sip.c
++++ b/net/netfilter/nf_nat_sip.c
+@@ -230,9 +230,10 @@ static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff,
+ &ct->tuplehash[!dir].tuple.src.u3,
+ false);
+ if (!mangle_packet(skb, protoff, dataoff, dptr, datalen,
+- poff, plen, buffer, buflen))
++ poff, plen, buffer, buflen)) {
+ nf_ct_helper_log(skb, ct, "cannot mangle received");
+ return NF_DROP;
++ }
+ }
+
+ /* The rport= parameter (RFC 3581) contains the port number
diff --git a/net/netfilter/nf_sockopt.c b/net/netfilter/nf_sockopt.c
index f042ae5..30ea486 100644
--- a/net/netfilter/nf_sockopt.c
@@ -89576,10 +89577,10 @@ index 103bd70..f21aad3 100644
*uaddr_len = sizeof(struct sockaddr_ax25);
}
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index f83e172..223ffe1 100644
+index e50f72a..f71867d 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
-@@ -1571,7 +1571,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1578,7 +1578,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
spin_lock(&sk->sk_receive_queue.lock);
po->stats.tp_packets++;
@@ -89588,7 +89589,7 @@ index f83e172..223ffe1 100644
__skb_queue_tail(&sk->sk_receive_queue, skb);
spin_unlock(&sk->sk_receive_queue.lock);
sk->sk_data_ready(sk, skb->len);
-@@ -1580,7 +1580,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1587,7 +1587,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
drop_n_acct:
spin_lock(&sk->sk_receive_queue.lock);
po->stats.tp_drops++;
@@ -89597,7 +89598,7 @@ index f83e172..223ffe1 100644
spin_unlock(&sk->sk_receive_queue.lock);
drop_n_restore:
-@@ -2558,6 +2558,7 @@ out:
+@@ -2579,6 +2579,7 @@ out:
static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
{
@@ -89605,7 +89606,7 @@ index f83e172..223ffe1 100644
struct sock_exterr_skb *serr;
struct sk_buff *skb, *skb2;
int copied, err;
-@@ -2579,8 +2580,9 @@ static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
+@@ -2600,8 +2601,9 @@ static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
sock_recv_timestamp(msg, sk, skb);
serr = SKB_EXT_ERR(skb);
@@ -89616,22 +89617,7 @@ index f83e172..223ffe1 100644
msg->msg_flags |= MSG_ERRQUEUE;
err = copied;
-@@ -2769,12 +2771,11 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
- return -EOPNOTSUPP;
-
- uaddr->sa_family = AF_PACKET;
-+ memset(uaddr->sa_data, 0, sizeof(uaddr->sa_data));
- rcu_read_lock();
- dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex);
- if (dev)
-- strncpy(uaddr->sa_data, dev->name, 14);
-- else
-- memset(uaddr->sa_data, 0, 14);
-+ strlcpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data));
- rcu_read_unlock();
- *uaddr_len = sizeof(*uaddr);
-
-@@ -3205,7 +3206,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3225,7 +3227,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
case PACKET_HDRLEN:
if (len > sizeof(int))
len = sizeof(int);
@@ -89640,7 +89626,7 @@ index f83e172..223ffe1 100644
return -EFAULT;
switch (val) {
case TPACKET_V1:
-@@ -3247,7 +3248,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3267,7 +3269,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
len = lv;
if (put_user(len, optlen))
return -EFAULT;
@@ -90176,33 +90162,6 @@ index 391a245..296b3d7 100644
}
/* Initialize IPv6 support and register with socket layer. */
-diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
-index 01dca75..e9426bb 100644
---- a/net/sctp/outqueue.c
-+++ b/net/sctp/outqueue.c
-@@ -206,6 +206,8 @@ static inline int sctp_cacc_skip(struct sctp_transport *primary,
- */
- void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
- {
-+ memset(q, 0, sizeof(struct sctp_outq));
-+
- q->asoc = asoc;
- INIT_LIST_HEAD(&q->out_chunk_list);
- INIT_LIST_HEAD(&q->control_chunk_list);
-@@ -213,13 +215,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
- INIT_LIST_HEAD(&q->sacked);
- INIT_LIST_HEAD(&q->abandoned);
-
-- q->fast_rtx = 0;
-- q->outstanding_bytes = 0;
- q->empty = 1;
-- q->cork = 0;
--
-- q->malloced = 0;
-- q->out_qlen = 0;
- }
-
- /* Free the outqueue structure and any related pending chunks.
diff --git a/net/sctp/probe.c b/net/sctp/probe.c
index ad0dba8..e62c225 100644
--- a/net/sctp/probe.c
@@ -90287,7 +90246,7 @@ index 8aab894..f6b7e7d 100644
sctp_generate_t1_cookie_event,
sctp_generate_t1_init_event,
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index b907073..7bea2ca 100644
+index 02c43e4..7bea2ca 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2166,11 +2166,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
@@ -90305,20 +90264,7 @@ index b907073..7bea2ca 100644
/*
* At the time when a user app subscribes to SCTP_SENDER_DRY_EVENT,
-@@ -4002,6 +4004,12 @@ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
-
- /* Release our hold on the endpoint. */
- sp = sctp_sk(sk);
-+ /* This could happen during socket init, thus we bail out
-+ * early, since the rest of the below is not setup either.
-+ */
-+ if (sp->ep == NULL)
-+ return;
-+
- if (sp->do_auto_asconf) {
- sp->do_auto_asconf = 0;
- list_del(&sp->auto_asconf_list);
-@@ -4215,13 +4223,16 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
+@@ -4221,13 +4223,16 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
int __user *optlen)
{
@@ -90336,7 +90282,7 @@ index b907073..7bea2ca 100644
return -EFAULT;
return 0;
}
-@@ -4239,6 +4250,8 @@ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
+@@ -4245,6 +4250,8 @@ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
*/
static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optval, int __user *optlen)
{
@@ -90345,7 +90291,7 @@ index b907073..7bea2ca 100644
/* Applicable to UDP-style socket only */
if (sctp_style(sk, TCP))
return -EOPNOTSUPP;
-@@ -4247,7 +4260,8 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
+@@ -4253,7 +4260,8 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
len = sizeof(int);
if (put_user(len, optlen))
return -EFAULT;
@@ -90355,7 +90301,7 @@ index b907073..7bea2ca 100644
return -EFAULT;
return 0;
}
-@@ -4619,12 +4633,15 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
+@@ -4625,12 +4633,15 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
*/
static int sctp_getsockopt_initmsg(struct sock *sk, int len, char __user *optval, int __user *optlen)
{
@@ -90372,7 +90318,7 @@ index b907073..7bea2ca 100644
return -EFAULT;
return 0;
}
-@@ -4665,6 +4682,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
+@@ -4671,6 +4682,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
if (space_left < addrlen)
return -ENOMEM;
@@ -90404,7 +90350,7 @@ index bf3c6e8..376d8d0 100644
table = kmemdup(sctp_net_table, sizeof(sctp_net_table), GFP_KERNEL);
diff --git a/net/socket.c b/net/socket.c
-index 88f759a..74be616 100644
+index e216502..74be616 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -88,6 +88,7 @@
@@ -90575,16 +90521,7 @@ index 88f759a..74be616 100644
int err, err2;
int fput_needed;
-@@ -1978,7 +2040,7 @@ struct used_address {
- unsigned int name_len;
- };
-
--static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
-+static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
- struct msghdr *msg_sys, unsigned int flags,
- struct used_address *used_address)
- {
-@@ -2045,7 +2107,7 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -2045,7 +2107,7 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
* checking falls down on this.
*/
if (copy_from_user(ctl_buf,
@@ -90593,83 +90530,7 @@ index 88f759a..74be616 100644
ctl_len))
goto out_freectl;
msg_sys->msg_control = ctl_buf;
-@@ -2093,20 +2155,28 @@ out:
- * BSD sendmsg interface
- */
-
-+long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
-+{
-+ int fput_needed, err;
-+ struct msghdr msg_sys;
-+ struct socket *sock;
-+
-+ sock = sockfd_lookup_light(fd, &err, &fput_needed);
-+ if (!sock)
-+ goto out;
-+
-+ err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
-+
-+ fput_light(sock->file, fput_needed);
-+out:
-+ return err;
-+}
-+
- SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
- {
-- int fput_needed, err;
-- struct msghdr msg_sys;
-- struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
--
-- if (!sock)
-- goto out;
--
-- err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
--
-- fput_light(sock->file, fput_needed);
--out:
-- return err;
-+ if (flags & MSG_CMSG_COMPAT)
-+ return -EINVAL;
-+ return __sys_sendmsg(fd, msg, flags);
- }
-
- /*
-@@ -2139,15 +2209,16 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
-
- while (datagrams < vlen) {
- if (MSG_CMSG_COMPAT & flags) {
-- err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
-- &msg_sys, flags, &used_address);
-+ err = ___sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
-+ &msg_sys, flags, &used_address);
- if (err < 0)
- break;
- err = __put_user(err, &compat_entry->msg_len);
- ++compat_entry;
- } else {
-- err = __sys_sendmsg(sock, (struct msghdr __user *)entry,
-- &msg_sys, flags, &used_address);
-+ err = ___sys_sendmsg(sock,
-+ (struct msghdr __user *)entry,
-+ &msg_sys, flags, &used_address);
- if (err < 0)
- break;
- err = put_user(err, &entry->msg_len);
-@@ -2171,10 +2242,12 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
- SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
- unsigned int, vlen, unsigned int, flags)
- {
-+ if (flags & MSG_CMSG_COMPAT)
-+ return -EINVAL;
- return __sys_sendmmsg(fd, mmsg, vlen, flags);
- }
-
--static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
-+static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
- struct msghdr *msg_sys, unsigned int flags, int nosec)
- {
- struct compat_msghdr __user *msg_compat =
-@@ -2185,7 +2258,7 @@ static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -2196,7 +2258,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
int err, total_len, len;
/* kernel mode address */
@@ -90678,7 +90539,7 @@ index 88f759a..74be616 100644
/* user mode address pointers */
struct sockaddr __user *uaddr;
-@@ -2213,7 +2286,7 @@ static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -2224,7 +2286,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
* kernel msghdr to use the kernel address space)
*/
@@ -90687,84 +90548,7 @@ index 88f759a..74be616 100644
uaddr_len = COMPAT_NAMELEN(msg);
if (MSG_CMSG_COMPAT & flags) {
err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
-@@ -2266,21 +2339,29 @@ out:
- * BSD recvmsg interface
- */
-
-+long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags)
-+{
-+ int fput_needed, err;
-+ struct msghdr msg_sys;
-+ struct socket *sock;
-+
-+ sock = sockfd_lookup_light(fd, &err, &fput_needed);
-+ if (!sock)
-+ goto out;
-+
-+ err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
-+
-+ fput_light(sock->file, fput_needed);
-+out:
-+ return err;
-+}
-+
- SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
- unsigned int, flags)
- {
-- int fput_needed, err;
-- struct msghdr msg_sys;
-- struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
--
-- if (!sock)
-- goto out;
--
-- err = __sys_recvmsg(sock, msg, &msg_sys, flags, 0);
--
-- fput_light(sock->file, fput_needed);
--out:
-- return err;
-+ if (flags & MSG_CMSG_COMPAT)
-+ return -EINVAL;
-+ return __sys_recvmsg(fd, msg, flags);
- }
-
- /*
-@@ -2320,17 +2401,18 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
- * No need to ask LSM for more than the first datagram.
- */
- if (MSG_CMSG_COMPAT & flags) {
-- err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
-- &msg_sys, flags & ~MSG_WAITFORONE,
-- datagrams);
-+ err = ___sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
-+ &msg_sys, flags & ~MSG_WAITFORONE,
-+ datagrams);
- if (err < 0)
- break;
- err = __put_user(err, &compat_entry->msg_len);
- ++compat_entry;
- } else {
-- err = __sys_recvmsg(sock, (struct msghdr __user *)entry,
-- &msg_sys, flags & ~MSG_WAITFORONE,
-- datagrams);
-+ err = ___sys_recvmsg(sock,
-+ (struct msghdr __user *)entry,
-+ &msg_sys, flags & ~MSG_WAITFORONE,
-+ datagrams);
- if (err < 0)
- break;
- err = put_user(err, &entry->msg_len);
-@@ -2397,6 +2479,9 @@ SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
- int datagrams;
- struct timespec timeout_sys;
-
-+ if (flags & MSG_CMSG_COMPAT)
-+ return -EINVAL;
-+
- if (!timeout)
- return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
-
-@@ -2952,7 +3037,7 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
+@@ -2975,7 +3037,7 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
old_fs = get_fs();
set_fs(KERNEL_DS);
err = dev_ioctl(net, cmd,
@@ -90773,7 +90557,7 @@ index 88f759a..74be616 100644
set_fs(old_fs);
return err;
-@@ -3061,7 +3146,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
+@@ -3084,7 +3146,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
old_fs = get_fs();
set_fs(KERNEL_DS);
@@ -90782,7 +90566,7 @@ index 88f759a..74be616 100644
set_fs(old_fs);
if (cmd == SIOCGIFMAP && !err) {
-@@ -3166,7 +3251,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
+@@ -3189,7 +3251,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
ret |= __get_user(rtdev, &(ur4->rt_dev));
if (rtdev) {
ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
@@ -90791,7 +90575,7 @@ index 88f759a..74be616 100644
devname[15] = 0;
} else
r4.rt_dev = NULL;
-@@ -3392,8 +3477,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
+@@ -3415,8 +3477,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
int __user *uoptlen;
int err;
@@ -90802,7 +90586,7 @@ index 88f759a..74be616 100644
set_fs(KERNEL_DS);
if (level == SOL_SOCKET)
-@@ -3413,7 +3498,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
+@@ -3436,7 +3498,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
char __user *uoptval;
int err;
@@ -91300,18 +91084,6 @@ index c8717c1..08539f5 100644
err = handler(dev, info, (union iwreq_data *) iwp, extra);
iwp->length += essid_compat;
-diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
-index bcfda89..0cf003d 100644
---- a/net/xfrm/xfrm_output.c
-+++ b/net/xfrm/xfrm_output.c
-@@ -64,6 +64,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
-
- if (unlikely(x->km.state != XFRM_STATE_VALID)) {
- XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID);
-+ err = -EINVAL;
- goto error;
- }
-
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 167c67d..3f2ae427 100644
--- a/net/xfrm/xfrm_policy.c
diff --git a/main/linux-grsec/kernelconfig.x86 b/main/linux-grsec/kernelconfig.x86
index 3f5031657..de622fca8 100644
--- a/main/linux-grsec/kernelconfig.x86
+++ b/main/linux-grsec/kernelconfig.x86
@@ -1,6 +1,6 @@
#
# Automatically generated file; DO NOT EDIT.
-# Linux/x86 3.9.7 Kernel Configuration
+# Linux/x86 3.9.8 Kernel Configuration
#
# CONFIG_64BIT is not set
CONFIG_X86_32=y
@@ -5523,6 +5523,7 @@ CONFIG_GRKERNSEC_KMEM=y
# CONFIG_GRKERNSEC_VM86 is not set
# CONFIG_GRKERNSEC_IO is not set
CONFIG_GRKERNSEC_PERF_HARDEN=y
+# CONFIG_GRKERNSEC_RAND_THREADSTACK is not set
CONFIG_GRKERNSEC_PROC_MEMMAP=y
# CONFIG_GRKERNSEC_BRUTE is not set
# CONFIG_GRKERNSEC_MODHARDEN is not set
diff --git a/main/linux-grsec/kernelconfig.x86_64 b/main/linux-grsec/kernelconfig.x86_64
index f338d7ad0..feaf716d8 100644
--- a/main/linux-grsec/kernelconfig.x86_64
+++ b/main/linux-grsec/kernelconfig.x86_64
@@ -1,6 +1,6 @@
#
# Automatically generated file; DO NOT EDIT.
-# Linux/x86 3.9.7 Kernel Configuration
+# Linux/x86 3.9.8 Kernel Configuration
#
CONFIG_64BIT=y
CONFIG_X86_64=y
@@ -5460,6 +5460,7 @@ CONFIG_GRKERNSEC_KMEM=y
# CONFIG_GRKERNSEC_IO is not set
CONFIG_GRKERNSEC_JIT_HARDEN=y
CONFIG_GRKERNSEC_PERF_HARDEN=y
+# CONFIG_GRKERNSEC_RAND_THREADSTACK is not set
CONFIG_GRKERNSEC_PROC_MEMMAP=y
# CONFIG_GRKERNSEC_BRUTE is not set
# CONFIG_GRKERNSEC_MODHARDEN is not set