aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNatanael Copa <ncopa@alpinelinux.org>2013-06-11 07:06:00 +0000
committerNatanael Copa <ncopa@alpinelinux.org>2013-06-19 06:38:19 +0000
commitf535ac0d0ba8351b98b4658280277391bf4e03c1 (patch)
treed212bf40263f0377d7c907891d0e22da8c3594bb
parent89c55ac8ee5a7b0f023e3d5cb7f53cc0afec8dcf (diff)
downloadalpine_aports-f535ac0d0ba8351b98b4658280277391bf4e03c1.tar.bz2
alpine_aports-f535ac0d0ba8351b98b4658280277391bf4e03c1.tar.xz
alpine_aports-f535ac0d0ba8351b98b4658280277391bf4e03c1.zip
main/linux-grsec: upgrade to 3.9.5
(cherry picked from commit 26c4e189e825d62d0249fb5f499bcb545d40e1ab) fixes #2078
Diffstat
-rw-r--r--main/linux-grsec/APKBUILD39
-rw-r--r--main/linux-grsec/grsecurity-2.9.1-3.9.5-201306102218.patch (renamed from main/linux-grsec/grsecurity-2.9.1-3.9.4-201306011536.patch)799
-rw-r--r--main/linux-grsec/ipsec-xfrm-properly-handle-invalid-states-as-an-error.patch44
-rw-r--r--main/linux-grsec/kernelconfig.x863
-rw-r--r--main/linux-grsec/kernelconfig.x86_643
-rw-r--r--main/linux-grsec/leds-leds-gpio-reserve-gpio-before-using-it.patch114
6 files changed, 386 insertions, 616 deletions
diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index fc6b18a8da..997d1d4726 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -2,12 +2,12 @@
2 2
3_flavor=grsec 3_flavor=grsec
4pkgname=linux-${_flavor} 4pkgname=linux-${_flavor}
5pkgver=3.9.4 5pkgver=3.9.5
6case $pkgver in 6case $pkgver in
7*.*.*) _kernver=${pkgver%.*};; 7*.*.*) _kernver=${pkgver%.*};;
8*.*) _kernver=${pkgver};; 8*.*) _kernver=${pkgver};;
9esac 9esac
10pkgrel=1 10pkgrel=0
11pkgdesc="Linux kernel with grsecurity" 11pkgdesc="Linux kernel with grsecurity"
12url=http://grsecurity.net 12url=http://grsecurity.net
13depends="mkinitfs linux-firmware" 13depends="mkinitfs linux-firmware"
@@ -17,10 +17,7 @@ _config=${config:-kernelconfig.${CARCH}}
17install= 17install=
18source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz 18source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz
19 http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz 19 http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz
20 grsecurity-2.9.1-3.9.4-201306011536.patch 20 grsecurity-2.9.1-3.9.5-201306102218.patch
21
22 leds-leds-gpio-reserve-gpio-before-using-it.patch
23 ipsec-xfrm-properly-handle-invalid-states-as-an-error.patch
24 21
25 0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch 22 0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch
26 0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch 23 0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch
@@ -152,41 +149,35 @@ dev() {
152} 149}
153 150
154md5sums="4348c9b6b2eb3144d601e87c19d5d909 linux-3.9.tar.xz 151md5sums="4348c9b6b2eb3144d601e87c19d5d909 linux-3.9.tar.xz
155922c4553299e6692a28761d3032fc012 patch-3.9.4.xz 152aa22187ae5cd482a69097e9e59244491 patch-3.9.5.xz
15608c33c99cb779ebd296d2b274c2deeda grsecurity-2.9.1-3.9.4-201306011536.patch 15358dec4906c5abc6dc29355eb31816933 grsecurity-2.9.1-3.9.5-201306102218.patch
15783db7136608d8101ae130728539dc376 leds-leds-gpio-reserve-gpio-before-using-it.patch
158ac9a50bdbe91ba6e5205e83f7e734ff5 ipsec-xfrm-properly-handle-invalid-states-as-an-error.patch
159a16f11b12381efb3bec79b9bfb329836 0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch 154a16f11b12381efb3bec79b9bfb329836 0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch
160656ae7b10dd2f18dbfa1011041d08d60 0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch 155656ae7b10dd2f18dbfa1011041d08d60 0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch
161aa454ffb96428586447775c21449e284 0003-ipv4-properly-refresh-rtable-entries-on-pmtu-redirec.patch 156aa454ffb96428586447775c21449e284 0003-ipv4-properly-refresh-rtable-entries-on-pmtu-redirec.patch
1622a12a3717052e878c0cd42aa935bfcf4 0004-ipv4-rate-limit-updating-of-next-hop-exceptions-with.patch 1572a12a3717052e878c0cd42aa935bfcf4 0004-ipv4-rate-limit-updating-of-next-hop-exceptions-with.patch
1636ce5fed63aad3f1a1ff1b9ba7b741822 0005-ipv4-use-separate-genid-for-next-hop-exceptions.patch 1586ce5fed63aad3f1a1ff1b9ba7b741822 0005-ipv4-use-separate-genid-for-next-hop-exceptions.patch
1641a5800a2122ba0cc0d06733cb3bb8b8f 0006-ipv4-use-next-hop-exceptions-also-for-input-routes.patch 1591a5800a2122ba0cc0d06733cb3bb8b8f 0006-ipv4-use-next-hop-exceptions-also-for-input-routes.patch
165fd6fd35309c0e8c1f05cb725df958f22 kernelconfig.x86 1603e219a1f25136b204d00865939532fe9 kernelconfig.x86
166fd61ff58d25155997c0d6f73e7ca7a7d kernelconfig.x86_64" 1611d057c89927a68e5f44896887ad3e379 kernelconfig.x86_64"
167sha256sums="60bc3e64ee5dc778de2cd7cd7640abf518a4c9d4f31b8ed624e16fad53f54541 linux-3.9.tar.xz 162sha256sums="60bc3e64ee5dc778de2cd7cd7640abf518a4c9d4f31b8ed624e16fad53f54541 linux-3.9.tar.xz
168694ea0d527556c5a214597596f37cdb598d2a0652d6f5e86b8c0de718990ccec patch-3.9.4.xz 163f25145ff6ddde7a633839aabfd97b0d8239e14c494fd16210871229a35c1c0de patch-3.9.5.xz
1693bf95754ba94f3dfa7a91d92726e83c9092feab9e990f70d31bc52974bff27b0 grsecurity-2.9.1-3.9.4-201306011536.patch 164196ee8f6b9fc368ac7c09dc6f929e947f4a02b7ef66c2f84f00fa7f682774604 grsecurity-2.9.1-3.9.5-201306102218.patch
17013676bc5610a8d03e788ac76734babd1338b023bb39559452ee54652b046e6f4 leds-leds-gpio-reserve-gpio-before-using-it.patch
171ab0dcb52342990ad05af5ce21acd1e95fb65cc7e76ec98e45c7ece7433bc9f23 ipsec-xfrm-properly-handle-invalid-states-as-an-error.patch
1726af3757ac36a6cd3cda7b0a71b08143726383b19261294a569ad7f4042c72df3 0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch 1656af3757ac36a6cd3cda7b0a71b08143726383b19261294a569ad7f4042c72df3 0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch
173dc8e82108615657f1fb9d641efd42255a5761c06edde1b00a41ae0d314d548f0 0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch 166dc8e82108615657f1fb9d641efd42255a5761c06edde1b00a41ae0d314d548f0 0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch
1740985caa0f3ee8ed0959aeaa4214f5f8057ae8e61d50dcae39194912d31e14892 0003-ipv4-properly-refresh-rtable-entries-on-pmtu-redirec.patch 1670985caa0f3ee8ed0959aeaa4214f5f8057ae8e61d50dcae39194912d31e14892 0003-ipv4-properly-refresh-rtable-entries-on-pmtu-redirec.patch
175260fd1807838b68305a96992bf7d3302a2a8ef3a3b08fe079ba9a07e6422f736 0004-ipv4-rate-limit-updating-of-next-hop-exceptions-with.patch 168260fd1807838b68305a96992bf7d3302a2a8ef3a3b08fe079ba9a07e6422f736 0004-ipv4-rate-limit-updating-of-next-hop-exceptions-with.patch
176ae32bb72afa170e6c3788c564b342763aba5945afacc1e2ebfc096adf50d77a3 0005-ipv4-use-separate-genid-for-next-hop-exceptions.patch 169ae32bb72afa170e6c3788c564b342763aba5945afacc1e2ebfc096adf50d77a3 0005-ipv4-use-separate-genid-for-next-hop-exceptions.patch
177fc613ac466610b866b721c41836fd5bfb2d4b75bceb67972dc6369d7f62ff47e 0006-ipv4-use-next-hop-exceptions-also-for-input-routes.patch 170fc613ac466610b866b721c41836fd5bfb2d4b75bceb67972dc6369d7f62ff47e 0006-ipv4-use-next-hop-exceptions-also-for-input-routes.patch
178b44c6671b344ddae1da94e6c051a0e708af8609c1f2ff40d962301ed5023c83a kernelconfig.x86 171cc3bd3d23f6a73ea6488c158de9d195ad5e3d87859ce02d92a04f0e08c9503d3 kernelconfig.x86
1797a6700a6db89f8c2c7f8cce7d77f4ddb3fcad889d72c709c2833af795ef1bc79 kernelconfig.x86_64" 172b780ef646b3b30a5b0307102367e17d45bb3a0ab7e37cf92a1ce783c3149243a kernelconfig.x86_64"
180sha512sums="77fa521f42380409f8ab400c26f7b00e225cb075ef40834bb263325cfdcc3e65aef8511ec2fc2b50bbf4f50e226fb5ab07d7a479aaf09162adbbf318325d0790 linux-3.9.tar.xz 173sha512sums="77fa521f42380409f8ab400c26f7b00e225cb075ef40834bb263325cfdcc3e65aef8511ec2fc2b50bbf4f50e226fb5ab07d7a479aaf09162adbbf318325d0790 linux-3.9.tar.xz
1812a2eb511a610e8e3ddbc38b8bce0b96e60875009b7981542c98f0de3a601632a205fa9f90c6912094196dbda6536083b3990b28204c243a406f5595c40df0965 patch-3.9.4.xz 1748e9a064adadd062c7ca52c44de19dfd46b029e60f2832988a606e086b669ea699861ec57732d4abfb16e486f767d123fcfd66da7c2ddde380b7c13582bb44983 patch-3.9.5.xz
182eb326ded756cbe086c7999c5a982b6b695ae8ee3c25523a22acd480d97de0603d86eeef5252fe957ed5ccd4e7736db271a253264108e757b23a9bd3e82b32529 grsecurity-2.9.1-3.9.4-201306011536.patch 175704f65e048888c64aa02214e80103745f16f2ddebe9e8304331208436481ca6b1fcadc2e862203142ac98b6d5f7c409ba542b68c11775c4e7ba765a63b3ab2a6 grsecurity-2.9.1-3.9.5-201306102218.patch
18310d2cf4fb308d1bc8cb5b9df3f9a6d7b9cef453244673bcbe66bd9b64af410a498e203d4dfa51f53461362ad981736eadc46537616b2c0514f57f4d8864c830d leds-leds-gpio-reserve-gpio-before-using-it.patch
184769291e92f2f5ae5375d98b80bf8790b089c87437f1660cf8d5e9d45d7221280b6824bcb1d2564cbe12310a88df48443c56ecc9ce5468858829088221aa80327 ipsec-xfrm-properly-handle-invalid-states-as-an-error.patch
18581e78593288e8b0fd2c03ea9fc1450323887707f087e911f172450a122bc9b591ee83394836789730d951aeec13d0b75a64e1c05f04364abf8f80d883ddc4a02 0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch 17681e78593288e8b0fd2c03ea9fc1450323887707f087e911f172450a122bc9b591ee83394836789730d951aeec13d0b75a64e1c05f04364abf8f80d883ddc4a02 0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch
18651ecb15b669f6a82940a13a38939116e003bf5dfd24496771c8279e907b72adcc63d607f0340a2940d757e12ddadb7d45c7af78ae311d284935a6296dbcac00c 0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch 17751ecb15b669f6a82940a13a38939116e003bf5dfd24496771c8279e907b72adcc63d607f0340a2940d757e12ddadb7d45c7af78ae311d284935a6296dbcac00c 0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch
18757d0a8bd35d19cf657ded58efe24517d2252aec6984040713ba173a34edb5887ececaa2985076bc6a149eaa57639fd98a042c1c2d226ed4ad8dd5ed0e230717e 0003-ipv4-properly-refresh-rtable-entries-on-pmtu-redirec.patch 17857d0a8bd35d19cf657ded58efe24517d2252aec6984040713ba173a34edb5887ececaa2985076bc6a149eaa57639fd98a042c1c2d226ed4ad8dd5ed0e230717e 0003-ipv4-properly-refresh-rtable-entries-on-pmtu-redirec.patch
188d2f578ad1d6e1fe52b55863e5bf338ae8201b828a498ec3e42e549c55295d3d1c6c3adfa9e226d711e3486628ed56ab996484e219d79ac4b0c0ec684ebd380aa 0004-ipv4-rate-limit-updating-of-next-hop-exceptions-with.patch 179d2f578ad1d6e1fe52b55863e5bf338ae8201b828a498ec3e42e549c55295d3d1c6c3adfa9e226d711e3486628ed56ab996484e219d79ac4b0c0ec684ebd380aa 0004-ipv4-rate-limit-updating-of-next-hop-exceptions-with.patch
18928a33e644bf2faf99c8dd6dbccfe14e140dfdd8824a8fb2d58aa7deb9e572f130d92b6b35ee181084050d82166bdf2e498a451a2a538a67b7ab84204405d2d87 0005-ipv4-use-separate-genid-for-next-hop-exceptions.patch 18028a33e644bf2faf99c8dd6dbccfe14e140dfdd8824a8fb2d58aa7deb9e572f130d92b6b35ee181084050d82166bdf2e498a451a2a538a67b7ab84204405d2d87 0005-ipv4-use-separate-genid-for-next-hop-exceptions.patch
190249140374c19a5599876268ff5b3cda2e136681aee103b4a9fff5d7d346f8e3295a907fb43db0701b8a9fece64c299ad2abac0434259cce6631307ce84090205 0006-ipv4-use-next-hop-exceptions-also-for-input-routes.patch 181249140374c19a5599876268ff5b3cda2e136681aee103b4a9fff5d7d346f8e3295a907fb43db0701b8a9fece64c299ad2abac0434259cce6631307ce84090205 0006-ipv4-use-next-hop-exceptions-also-for-input-routes.patch
1912516c47145f53cfa5624a9a8839b3590fd16a980aa4c8c48af4db025960d33abe855a5c698ee701a0d3704a96a9a3f93cd6c3cc8c9b8fdf73f230c15ad2f7611 kernelconfig.x86 18200fd8694455935f96e46b6624388b8c04af27ce4295040362da78c34bf9f08382bc69c1b8b273145573a59e3b4eecfa251119560da19ab390f171a8a6da18298 kernelconfig.x86
1920a3739e5e1fe29fcce8c686d8ac223316467a2efaaa18cb3d1abf6c7a66dc86be12c26755dff1aef6d0f5a028ce4f6dfc5664ab42b484046949f401f3b9198f9 kernelconfig.x86_64" 1836276f503f9dd7ea228b1661f9a36edcf18d2c4cfb6d9c4e3e1496a4f70709cc693fc8498186d86dd3f303c909c50e478cb95e08a05f50bda77c9cf165aca1ba1 kernelconfig.x86_64"
diff --git a/main/linux-grsec/grsecurity-2.9.1-3.9.4-201306011536.patch b/main/linux-grsec/grsecurity-2.9.1-3.9.5-201306102218.patch
index 9a1a55c812..49e438f1bb 100644
--- a/main/linux-grsec/grsecurity-2.9.1-3.9.4-201306011536.patch
+++ b/main/linux-grsec/grsecurity-2.9.1-3.9.5-201306102218.patch
@@ -259,7 +259,7 @@ index 8ccbf27..afffeb4 100644
259 259
260 pcd. [PARIDE] 260 pcd. [PARIDE]
261diff --git a/Makefile b/Makefile 261diff --git a/Makefile b/Makefile
262index bfbfaf9..d0b1bb8 100644 262index 8818c95..ced0bb1 100644
263--- a/Makefile 263--- a/Makefile
264+++ b/Makefile 264+++ b/Makefile
265@@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ 265@@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -3390,7 +3390,7 @@ index 044c31d..2ee0861 100644
3390 struct omap_device *omap_device_alloc(struct platform_device *pdev, 3390 struct omap_device *omap_device_alloc(struct platform_device *pdev,
3391 struct omap_hwmod **ohs, int oh_cnt); 3391 struct omap_hwmod **ohs, int oh_cnt);
3392diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c 3392diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
3393index a202a47..c430564 100644 3393index 3a750de..4c9b88f 100644
3394--- a/arch/arm/mach-omap2/omap_hwmod.c 3394--- a/arch/arm/mach-omap2/omap_hwmod.c
3395+++ b/arch/arm/mach-omap2/omap_hwmod.c 3395+++ b/arch/arm/mach-omap2/omap_hwmod.c
3396@@ -191,10 +191,10 @@ struct omap_hwmod_soc_ops { 3396@@ -191,10 +191,10 @@ struct omap_hwmod_soc_ops {
@@ -5763,6 +5763,19 @@ index e0a8235..ce2f1e1 100644
5763 ret = __copy_from_user(to, from, n); 5763 ret = __copy_from_user(to, from, n);
5764 else 5764 else
5765 copy_from_user_overflow(); 5765 copy_from_user_overflow();
5766diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
5767index 5709c5e..14285ca 100644
5768--- a/arch/parisc/kernel/drivers.c
5769+++ b/arch/parisc/kernel/drivers.c
5770@@ -394,7 +394,7 @@ EXPORT_SYMBOL(print_pci_hwpath);
5771 static void setup_bus_id(struct parisc_device *padev)
5772 {
5773 struct hardware_path path;
5774- char name[20];
5775+ char name[28];
5776 char *output = name;
5777 int i;
5778
5766diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c 5779diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
5767index 2a625fb..9908930 100644 5780index 2a625fb..9908930 100644
5768--- a/arch/parisc/kernel/module.c 5781--- a/arch/parisc/kernel/module.c
@@ -5866,6 +5879,20 @@ index 2a625fb..9908930 100644
5866 5879
5867 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n", 5880 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
5868 me->arch.unwind_section, table, end, gp); 5881 me->arch.unwind_section, table, end, gp);
5882diff --git a/arch/parisc/kernel/setup.c b/arch/parisc/kernel/setup.c
5883index a3328c2..3b812eb 100644
5884--- a/arch/parisc/kernel/setup.c
5885+++ b/arch/parisc/kernel/setup.c
5886@@ -69,7 +69,8 @@ void __init setup_cmdline(char **cmdline_p)
5887 /* called from hpux boot loader */
5888 boot_command_line[0] = '\0';
5889 } else {
5890- strcpy(boot_command_line, (char *)__va(boot_args[1]));
5891+ strlcpy(boot_command_line, (char *)__va(boot_args[1]),
5892+ COMMAND_LINE_SIZE);
5893
5894 #ifdef CONFIG_BLK_DEV_INITRD
5895 if (boot_args[2] != 0) /* did palo pass us a ramdisk? */
5869diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c 5896diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
5870index 5dfd248..64914ac 100644 5897index 5dfd248..64914ac 100644
5871--- a/arch/parisc/kernel/sys_parisc.c 5898--- a/arch/parisc/kernel/sys_parisc.c
@@ -6353,10 +6380,10 @@ index 4aad413..85d86bf 100644
6353 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */ 6380 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
6354 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */ 6381 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
6355diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h 6382diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
6356index c9c67fc..e10c012 100644 6383index 3b097a8..8f8c774 100644
6357--- a/arch/powerpc/include/asm/reg.h 6384--- a/arch/powerpc/include/asm/reg.h
6358+++ b/arch/powerpc/include/asm/reg.h 6385+++ b/arch/powerpc/include/asm/reg.h
6359@@ -245,6 +245,7 @@ 6386@@ -234,6 +234,7 @@
6360 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */ 6387 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
6361 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */ 6388 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
6362 #define DSISR_NOHPTE 0x40000000 /* no translation found */ 6389 #define DSISR_NOHPTE 0x40000000 /* no translation found */
@@ -6790,10 +6817,10 @@ index f9b30c6..d72e7a3 100644
6790 6817
6791 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) 6818 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
6792diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c 6819diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
6793index 95068bf..9ba1814 100644 6820index 201385c..0f01828 100644
6794--- a/arch/powerpc/kernel/signal_32.c 6821--- a/arch/powerpc/kernel/signal_32.c
6795+++ b/arch/powerpc/kernel/signal_32.c 6822+++ b/arch/powerpc/kernel/signal_32.c
6796@@ -982,7 +982,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka, 6823@@ -976,7 +976,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
6797 /* Save user registers on the stack */ 6824 /* Save user registers on the stack */
6798 frame = &rt_sf->uc.uc_mcontext; 6825 frame = &rt_sf->uc.uc_mcontext;
6799 addr = frame; 6826 addr = frame;
@@ -6803,10 +6830,10 @@ index 95068bf..9ba1814 100644
6803 tramp = current->mm->context.vdso_base + vdso32_rt_sigtramp; 6830 tramp = current->mm->context.vdso_base + vdso32_rt_sigtramp;
6804 } else { 6831 } else {
6805diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c 6832diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
6806index c179428..58acdaa 100644 6833index 3459473..2d40783 100644
6807--- a/arch/powerpc/kernel/signal_64.c 6834--- a/arch/powerpc/kernel/signal_64.c
6808+++ b/arch/powerpc/kernel/signal_64.c 6835+++ b/arch/powerpc/kernel/signal_64.c
6809@@ -758,7 +758,7 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info, 6836@@ -749,7 +749,7 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
6810 #endif 6837 #endif
6811 6838
6812 /* Set up to return from userspace. */ 6839 /* Set up to return from userspace. */
@@ -6829,10 +6856,10 @@ index 3ce1f86..c30e629 100644
6829 }; 6856 };
6830 6857
6831diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c 6858diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
6832index 83efa2f..6bb5839 100644 6859index 1c22b2d..3b56e67 100644
6833--- a/arch/powerpc/kernel/traps.c 6860--- a/arch/powerpc/kernel/traps.c
6834+++ b/arch/powerpc/kernel/traps.c 6861+++ b/arch/powerpc/kernel/traps.c
6835@@ -141,6 +141,8 @@ static unsigned __kprobes long oops_begin(struct pt_regs *regs) 6862@@ -142,6 +142,8 @@ static unsigned __kprobes long oops_begin(struct pt_regs *regs)
6836 return flags; 6863 return flags;
6837 } 6864 }
6838 6865
@@ -6841,7 +6868,7 @@ index 83efa2f..6bb5839 100644
6841 static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, 6868 static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs,
6842 int signr) 6869 int signr)
6843 { 6870 {
6844@@ -190,6 +192,9 @@ static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, 6871@@ -191,6 +193,9 @@ static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs,
6845 panic("Fatal exception in interrupt"); 6872 panic("Fatal exception in interrupt");
6846 if (panic_on_oops) 6873 if (panic_on_oops)
6847 panic("Fatal exception"); 6874 panic("Fatal exception");
@@ -20475,7 +20502,7 @@ index 73afd11..d1670f5 100644
20475+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0 20502+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
20476+ .endr 20503+ .endr
20477diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S 20504diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
20478index 08f7e80..40cbed5 100644 20505index 321d65e..e9437f7 100644
20479--- a/arch/x86/kernel/head_64.S 20506--- a/arch/x86/kernel/head_64.S
20480+++ b/arch/x86/kernel/head_64.S 20507+++ b/arch/x86/kernel/head_64.S
20481@@ -20,6 +20,8 @@ 20508@@ -20,6 +20,8 @@
@@ -20516,7 +20543,7 @@ index 08f7e80..40cbed5 100644
20516 20543
20517 /* 20544 /*
20518 * Set up the identity mapping for the switchover. These 20545 * Set up the identity mapping for the switchover. These
20519@@ -175,8 +187,8 @@ ENTRY(secondary_startup_64) 20546@@ -177,8 +189,8 @@ ENTRY(secondary_startup_64)
20520 movq $(init_level4_pgt - __START_KERNEL_map), %rax 20547 movq $(init_level4_pgt - __START_KERNEL_map), %rax
20521 1: 20548 1:
20522 20549
@@ -20527,7 +20554,7 @@ index 08f7e80..40cbed5 100644
20527 movq %rcx, %cr4 20554 movq %rcx, %cr4
20528 20555
20529 /* Setup early boot stage 4 level pagetables. */ 20556 /* Setup early boot stage 4 level pagetables. */
20530@@ -197,10 +209,18 @@ ENTRY(secondary_startup_64) 20557@@ -199,10 +211,18 @@ ENTRY(secondary_startup_64)
20531 movl $MSR_EFER, %ecx 20558 movl $MSR_EFER, %ecx
20532 rdmsr 20559 rdmsr
20533 btsl $_EFER_SCE, %eax /* Enable System Call */ 20560 btsl $_EFER_SCE, %eax /* Enable System Call */
@@ -20547,7 +20574,7 @@ index 08f7e80..40cbed5 100644
20547 1: wrmsr /* Make changes effective */ 20574 1: wrmsr /* Make changes effective */
20548 20575
20549 /* Setup cr0 */ 20576 /* Setup cr0 */
20550@@ -280,6 +300,7 @@ ENTRY(secondary_startup_64) 20577@@ -282,6 +302,7 @@ ENTRY(secondary_startup_64)
20551 * REX.W + FF /5 JMP m16:64 Jump far, absolute indirect, 20578 * REX.W + FF /5 JMP m16:64 Jump far, absolute indirect,
20552 * address given in m16:64. 20579 * address given in m16:64.
20553 */ 20580 */
@@ -20555,7 +20582,7 @@ index 08f7e80..40cbed5 100644
20555 movq initial_code(%rip),%rax 20582 movq initial_code(%rip),%rax
20556 pushq $0 # fake return address to stop unwinder 20583 pushq $0 # fake return address to stop unwinder
20557 pushq $__KERNEL_CS # set correct cs 20584 pushq $__KERNEL_CS # set correct cs
20558@@ -386,7 +407,7 @@ ENTRY(early_idt_handler) 20585@@ -388,7 +409,7 @@ ENTRY(early_idt_handler)
20559 call dump_stack 20586 call dump_stack
20560 #ifdef CONFIG_KALLSYMS 20587 #ifdef CONFIG_KALLSYMS
20561 leaq early_idt_ripmsg(%rip),%rdi 20588 leaq early_idt_ripmsg(%rip),%rdi
@@ -20564,7 +20591,7 @@ index 08f7e80..40cbed5 100644
20564 call __print_symbol 20591 call __print_symbol
20565 #endif 20592 #endif
20566 #endif /* EARLY_PRINTK */ 20593 #endif /* EARLY_PRINTK */
20567@@ -414,6 +435,7 @@ ENDPROC(early_idt_handler) 20594@@ -416,6 +437,7 @@ ENDPROC(early_idt_handler)
20568 early_recursion_flag: 20595 early_recursion_flag:
20569 .long 0 20596 .long 0
20570 20597
@@ -20572,7 +20599,7 @@ index 08f7e80..40cbed5 100644
20572 #ifdef CONFIG_EARLY_PRINTK 20599 #ifdef CONFIG_EARLY_PRINTK
20573 early_idt_msg: 20600 early_idt_msg:
20574 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n" 20601 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
20575@@ -443,27 +465,50 @@ NEXT_PAGE(early_dynamic_pgts) 20602@@ -445,27 +467,50 @@ NEXT_PAGE(early_dynamic_pgts)
20576 20603
20577 .data 20604 .data
20578 20605
@@ -20631,7 +20658,7 @@ index 08f7e80..40cbed5 100644
20631 20658
20632 NEXT_PAGE(level3_kernel_pgt) 20659 NEXT_PAGE(level3_kernel_pgt)
20633 .fill L3_START_KERNEL,8,0 20660 .fill L3_START_KERNEL,8,0
20634@@ -471,6 +516,9 @@ NEXT_PAGE(level3_kernel_pgt) 20661@@ -473,6 +518,9 @@ NEXT_PAGE(level3_kernel_pgt)
20635 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE 20662 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
20636 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE 20663 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
20637 20664
@@ -20641,7 +20668,7 @@ index 08f7e80..40cbed5 100644
20641 NEXT_PAGE(level2_kernel_pgt) 20668 NEXT_PAGE(level2_kernel_pgt)
20642 /* 20669 /*
20643 * 512 MB kernel mapping. We spend a full page on this pagetable 20670 * 512 MB kernel mapping. We spend a full page on this pagetable
20644@@ -486,38 +534,64 @@ NEXT_PAGE(level2_kernel_pgt) 20671@@ -488,38 +536,64 @@ NEXT_PAGE(level2_kernel_pgt)
20645 KERNEL_IMAGE_SIZE/PMD_SIZE) 20672 KERNEL_IMAGE_SIZE/PMD_SIZE)
20646 20673
20647 NEXT_PAGE(level2_fixmap_pgt) 20674 NEXT_PAGE(level2_fixmap_pgt)
@@ -20743,10 +20770,10 @@ index 0fa6912..37fce70 100644
20743+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR); 20770+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
20744+#endif 20771+#endif
20745diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c 20772diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
20746index 245a71d..89d9ce4 100644 20773index cb33909..1163b40 100644
20747--- a/arch/x86/kernel/i387.c 20774--- a/arch/x86/kernel/i387.c
20748+++ b/arch/x86/kernel/i387.c 20775+++ b/arch/x86/kernel/i387.c
20749@@ -55,7 +55,7 @@ static inline bool interrupted_kernel_fpu_idle(void) 20776@@ -51,7 +51,7 @@ static inline bool interrupted_kernel_fpu_idle(void)
20750 static inline bool interrupted_user_mode(void) 20777 static inline bool interrupted_user_mode(void)
20751 { 20778 {
20752 struct pt_regs *regs = get_irq_regs(); 20779 struct pt_regs *regs = get_irq_regs();
@@ -23943,7 +23970,7 @@ index a20ecb5..d0e2194 100644
23943 23970
23944 out: 23971 out:
23945diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c 23972diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
23946index 59622c9..f338414 100644 23973index 698eece..776b682 100644
23947--- a/arch/x86/kvm/emulate.c 23974--- a/arch/x86/kvm/emulate.c
23948+++ b/arch/x86/kvm/emulate.c 23975+++ b/arch/x86/kvm/emulate.c
23949@@ -328,6 +328,7 @@ static void invalidate_registers(struct x86_emulate_ctxt *ctxt) 23976@@ -328,6 +328,7 @@ static void invalidate_registers(struct x86_emulate_ctxt *ctxt)
@@ -31882,10 +31909,10 @@ index 34c8216..f56c828 100644
31882 unsigned long timeout_msec) 31909 unsigned long timeout_msec)
31883 { 31910 {
31884diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c 31911diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
31885index 63c743b..0422dc6 100644 31912index cf15aee..e0b7078 100644
31886--- a/drivers/ata/libata-core.c 31913--- a/drivers/ata/libata-core.c
31887+++ b/drivers/ata/libata-core.c 31914+++ b/drivers/ata/libata-core.c
31888@@ -4786,7 +4786,7 @@ void ata_qc_free(struct ata_queued_cmd *qc) 31915@@ -4792,7 +4792,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
31889 struct ata_port *ap; 31916 struct ata_port *ap;
31890 unsigned int tag; 31917 unsigned int tag;
31891 31918
@@ -31894,7 +31921,7 @@ index 63c743b..0422dc6 100644
31894 ap = qc->ap; 31921 ap = qc->ap;
31895 31922
31896 qc->flags = 0; 31923 qc->flags = 0;
31897@@ -4802,7 +4802,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc) 31924@@ -4808,7 +4808,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
31898 struct ata_port *ap; 31925 struct ata_port *ap;
31899 struct ata_link *link; 31926 struct ata_link *link;
31900 31927
@@ -31903,7 +31930,7 @@ index 63c743b..0422dc6 100644
31903 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE)); 31930 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
31904 ap = qc->ap; 31931 ap = qc->ap;
31905 link = qc->dev->link; 31932 link = qc->dev->link;
31906@@ -5920,6 +5920,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops) 31933@@ -5926,6 +5926,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
31907 return; 31934 return;
31908 31935
31909 spin_lock(&lock); 31936 spin_lock(&lock);
@@ -31911,7 +31938,7 @@ index 63c743b..0422dc6 100644
31911 31938
31912 for (cur = ops->inherits; cur; cur = cur->inherits) { 31939 for (cur = ops->inherits; cur; cur = cur->inherits) {
31913 void **inherit = (void **)cur; 31940 void **inherit = (void **)cur;
31914@@ -5933,8 +5934,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops) 31941@@ -5939,8 +5940,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
31915 if (IS_ERR(*pp)) 31942 if (IS_ERR(*pp))
31916 *pp = NULL; 31943 *pp = NULL;
31917 31944
@@ -31951,7 +31978,7 @@ index f9b983a..887b9d8 100644
31951 return 0; 31978 return 0;
31952 } 31979 }
31953diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c 31980diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
31954index 77a7480..05cde58 100644 31981index 77a7480d..05cde58 100644
31955--- a/drivers/atm/ambassador.c 31982--- a/drivers/atm/ambassador.c
31956+++ b/drivers/atm/ambassador.c 31983+++ b/drivers/atm/ambassador.c
31957@@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev, tx_out * tx) { 31984@@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev, tx_out * tx) {
@@ -33220,7 +33247,7 @@ index 7fda30e..eb5dfe0 100644
33220 /* queue and queue Info */ 33247 /* queue and queue Info */
33221 struct list_head reqQ; 33248 struct list_head reqQ;
33222diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c 33249diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
33223index 3f08713..56a586a 100644 33250index 3f08713..87d4b4a 100644
33224--- a/drivers/block/cpqarray.c 33251--- a/drivers/block/cpqarray.c
33225+++ b/drivers/block/cpqarray.c 33252+++ b/drivers/block/cpqarray.c
33226@@ -404,7 +404,7 @@ static int cpqarray_register_ctlr(int i, struct pci_dev *pdev) 33253@@ -404,7 +404,7 @@ static int cpqarray_register_ctlr(int i, struct pci_dev *pdev)
@@ -33295,7 +33322,15 @@ index 3f08713..56a586a 100644
33295 a1 = a; a &= ~3; 33322 a1 = a; a &= ~3;
33296 if ((c = h->cmpQ) == NULL) 33323 if ((c = h->cmpQ) == NULL)
33297 { 33324 {
33298@@ -1449,11 +1449,11 @@ static int sendcmd( 33325@@ -1195,6 +1195,7 @@ out_passthru:
33326 ida_pci_info_struct pciinfo;
33327
33328 if (!arg) return -EINVAL;
33329+ memset(&pciinfo, 0, sizeof(pciinfo));
33330 pciinfo.bus = host->pci_dev->bus->number;
33331 pciinfo.dev_fn = host->pci_dev->devfn;
33332 pciinfo.board_id = host->board_id;
33333@@ -1449,11 +1450,11 @@ static int sendcmd(
33299 /* 33334 /*
33300 * Disable interrupt 33335 * Disable interrupt
33301 */ 33336 */
@@ -33309,7 +33344,7 @@ index 3f08713..56a586a 100644
33309 if (temp != 0) { 33344 if (temp != 0) {
33310 break; 33345 break;
33311 } 33346 }
33312@@ -1466,7 +1466,7 @@ DBG( 33347@@ -1466,7 +1467,7 @@ DBG(
33313 /* 33348 /*
33314 * Send the cmd 33349 * Send the cmd
33315 */ 33350 */
@@ -33318,7 +33353,7 @@ index 3f08713..56a586a 100644
33318 complete = pollcomplete(ctlr); 33353 complete = pollcomplete(ctlr);
33319 33354
33320 pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr, 33355 pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
33321@@ -1549,9 +1549,9 @@ static int revalidate_allvol(ctlr_info_t *host) 33356@@ -1549,9 +1550,9 @@ static int revalidate_allvol(ctlr_info_t *host)
33322 * we check the new geometry. Then turn interrupts back on when 33357 * we check the new geometry. Then turn interrupts back on when
33323 * we're done. 33358 * we're done.
33324 */ 33359 */
@@ -33330,7 +33365,7 @@ index 3f08713..56a586a 100644
33330 33365
33331 for(i=0; i<NWD; i++) { 33366 for(i=0; i<NWD; i++) {
33332 struct gendisk *disk = ida_gendisk[ctlr][i]; 33367 struct gendisk *disk = ida_gendisk[ctlr][i];
33333@@ -1591,7 +1591,7 @@ static int pollcomplete(int ctlr) 33368@@ -1591,7 +1592,7 @@ static int pollcomplete(int ctlr)
33334 /* Wait (up to 2 seconds) for a command to complete */ 33369 /* Wait (up to 2 seconds) for a command to complete */
33335 33370
33336 for (i = 200000; i > 0; i--) { 33371 for (i = 200000; i > 0; i--) {
@@ -33542,7 +33577,7 @@ index 2e7de7a..ed86dc0 100644
33542 static DEFINE_MUTEX(pktcdvd_mutex); 33577 static DEFINE_MUTEX(pktcdvd_mutex);
33543 static struct pktcdvd_device *pkt_devs[MAX_WRITERS]; 33578 static struct pktcdvd_device *pkt_devs[MAX_WRITERS];
33544diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c 33579diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
33545index d620b44..587561e 100644 33580index d620b44..e9abc80 100644
33546--- a/drivers/cdrom/cdrom.c 33581--- a/drivers/cdrom/cdrom.c
33547+++ b/drivers/cdrom/cdrom.c 33582+++ b/drivers/cdrom/cdrom.c
33548@@ -416,7 +416,6 @@ int register_cdrom(struct cdrom_device_info *cdi) 33583@@ -416,7 +416,6 @@ int register_cdrom(struct cdrom_device_info *cdi)
@@ -33575,6 +33610,24 @@ index d620b44..587561e 100644
33575 cdinfo(CD_REG_UNREG, "drive \"/dev/%s\" unregistered\n", cdi->name); 33610 cdinfo(CD_REG_UNREG, "drive \"/dev/%s\" unregistered\n", cdi->name);
33576 } 33611 }
33577 33612
33613@@ -2107,7 +2108,7 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
33614 */
33615 nr = nframes;
33616 do {
33617- cgc.buffer = kmalloc(CD_FRAMESIZE_RAW * nr, GFP_KERNEL);
33618+ cgc.buffer = kzalloc(CD_FRAMESIZE_RAW * nr, GFP_KERNEL);
33619 if (cgc.buffer)
33620 break;
33621
33622@@ -2882,7 +2883,7 @@ static noinline int mmc_ioctl_cdrom_read_data(struct cdrom_device_info *cdi,
33623 if (lba < 0)
33624 return -EINVAL;
33625
33626- cgc->buffer = kmalloc(blocksize, GFP_KERNEL);
33627+ cgc->buffer = kzalloc(blocksize, GFP_KERNEL);
33628 if (cgc->buffer == NULL)
33629 return -ENOMEM;
33630
33578diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c 33631diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
33579index d59cdcb..11afddf 100644 33632index d59cdcb..11afddf 100644
33580--- a/drivers/cdrom/gdrom.c 33633--- a/drivers/cdrom/gdrom.c
@@ -33882,6 +33935,18 @@ index 2c644af..d4d7f17 100644
33882 }; 33935 };
33883 33936
33884 static int memory_open(struct inode *inode, struct file *filp) 33937 static int memory_open(struct inode *inode, struct file *filp)
33938diff --git a/drivers/char/mwave/tp3780i.c b/drivers/char/mwave/tp3780i.c
33939index c689697..04e6d6a 100644
33940--- a/drivers/char/mwave/tp3780i.c
33941+++ b/drivers/char/mwave/tp3780i.c
33942@@ -479,6 +479,7 @@ int tp3780I_QueryAbilities(THINKPAD_BD_DATA * pBDData, MW_ABILITIES * pAbilities
33943 PRINTK_2(TRACE_TP3780I,
33944 "tp3780i::tp3780I_QueryAbilities entry pBDData %p\n", pBDData);
33945
33946+ memset(pAbilities, 0, sizeof(*pAbilities));
33947 /* fill out standard constant fields */
33948 pAbilities->instr_per_sec = pBDData->rDspSettings.uIps;
33949 pAbilities->data_size = pBDData->rDspSettings.uDStoreSize;
33885diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c 33950diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
33886index 9df78e2..01ba9ae 100644 33951index 9df78e2..01ba9ae 100644
33887--- a/drivers/char/nvram.c 33952--- a/drivers/char/nvram.c
@@ -33971,7 +34036,7 @@ index 5c5cc00..ac9edb7 100644
33971 34036
33972 if (cmd != SIOCWANDEV) 34037 if (cmd != SIOCWANDEV)
33973diff --git a/drivers/char/random.c b/drivers/char/random.c 34038diff --git a/drivers/char/random.c b/drivers/char/random.c
33974index 32a6c57..98038d5 100644 34039index eccd7cc..98038d5 100644
33975--- a/drivers/char/random.c 34040--- a/drivers/char/random.c
33976+++ b/drivers/char/random.c 34041+++ b/drivers/char/random.c
33977@@ -272,8 +272,13 @@ 34042@@ -272,8 +272,13 @@
@@ -34017,85 +34082,7 @@ index 32a6c57..98038d5 100644
34017 smp_wmb(); 34082 smp_wmb();
34018 34083
34019 if (out) 34084 if (out)
34020@@ -865,16 +877,24 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min, 34085@@ -1032,7 +1044,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
34021 if (r->entropy_count / 8 < min + reserved) {
34022 nbytes = 0;
34023 } else {
34024+ int entropy_count, orig;
34025+retry:
34026+ entropy_count = orig = ACCESS_ONCE(r->entropy_count);
34027 /* If limited, never pull more than available */
34028- if (r->limit && nbytes + reserved >= r->entropy_count / 8)
34029- nbytes = r->entropy_count/8 - reserved;
34030+ if (r->limit && nbytes + reserved >= entropy_count / 8)
34031+ nbytes = entropy_count/8 - reserved;
34032
34033- if (r->entropy_count / 8 >= nbytes + reserved)
34034- r->entropy_count -= nbytes*8;
34035- else
34036- r->entropy_count = reserved;
34037+ if (entropy_count / 8 >= nbytes + reserved) {
34038+ entropy_count -= nbytes*8;
34039+ if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
34040+ goto retry;
34041+ } else {
34042+ entropy_count = reserved;
34043+ if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
34044+ goto retry;
34045+ }
34046
34047- if (r->entropy_count < random_write_wakeup_thresh)
34048+ if (entropy_count < random_write_wakeup_thresh)
34049 wakeup_write = 1;
34050 }
34051
34052@@ -957,10 +977,23 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
34053 {
34054 ssize_t ret = 0, i;
34055 __u8 tmp[EXTRACT_SIZE];
34056+ unsigned long flags;
34057
34058 /* if last_data isn't primed, we need EXTRACT_SIZE extra bytes */
34059- if (fips_enabled && !r->last_data_init)
34060- nbytes += EXTRACT_SIZE;
34061+ if (fips_enabled) {
34062+ spin_lock_irqsave(&r->lock, flags);
34063+ if (!r->last_data_init) {
34064+ r->last_data_init = true;
34065+ spin_unlock_irqrestore(&r->lock, flags);
34066+ trace_extract_entropy(r->name, EXTRACT_SIZE,
34067+ r->entropy_count, _RET_IP_);
34068+ xfer_secondary_pool(r, EXTRACT_SIZE);
34069+ extract_buf(r, tmp);
34070+ spin_lock_irqsave(&r->lock, flags);
34071+ memcpy(r->last_data, tmp, EXTRACT_SIZE);
34072+ }
34073+ spin_unlock_irqrestore(&r->lock, flags);
34074+ }
34075
34076 trace_extract_entropy(r->name, nbytes, r->entropy_count, _RET_IP_);
34077 xfer_secondary_pool(r, nbytes);
34078@@ -970,19 +1003,6 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
34079 extract_buf(r, tmp);
34080
34081 if (fips_enabled) {
34082- unsigned long flags;
34083-
34084-
34085- /* prime last_data value if need be, per fips 140-2 */
34086- if (!r->last_data_init) {
34087- spin_lock_irqsave(&r->lock, flags);
34088- memcpy(r->last_data, tmp, EXTRACT_SIZE);
34089- r->last_data_init = true;
34090- nbytes -= EXTRACT_SIZE;
34091- spin_unlock_irqrestore(&r->lock, flags);
34092- extract_buf(r, tmp);
34093- }
34094-
34095 spin_lock_irqsave(&r->lock, flags);
34096 if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
34097 panic("Hardware RNG duplicated output!\n");
34098@@ -1024,7 +1044,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
34099 34086
34100 extract_buf(r, tmp); 34087 extract_buf(r, tmp);
34101 i = min_t(int, nbytes, EXTRACT_SIZE); 34088 i = min_t(int, nbytes, EXTRACT_SIZE);
@@ -34104,7 +34091,7 @@ index 32a6c57..98038d5 100644
34104 ret = -EFAULT; 34091 ret = -EFAULT;
34105 break; 34092 break;
34106 } 34093 }
34107@@ -1360,7 +1380,7 @@ EXPORT_SYMBOL(generate_random_uuid); 34094@@ -1368,7 +1380,7 @@ EXPORT_SYMBOL(generate_random_uuid);
34108 #include <linux/sysctl.h> 34095 #include <linux/sysctl.h>
34109 34096
34110 static int min_read_thresh = 8, min_write_thresh; 34097 static int min_read_thresh = 8, min_write_thresh;
@@ -34113,7 +34100,7 @@ index 32a6c57..98038d5 100644
34113 static int max_write_thresh = INPUT_POOL_WORDS * 32; 34100 static int max_write_thresh = INPUT_POOL_WORDS * 32;
34114 static char sysctl_bootid[16]; 34101 static char sysctl_bootid[16];
34115 34102
34116@@ -1376,7 +1396,7 @@ static char sysctl_bootid[16]; 34103@@ -1384,7 +1396,7 @@ static char sysctl_bootid[16];
34117 static int proc_do_uuid(ctl_table *table, int write, 34104 static int proc_do_uuid(ctl_table *table, int write,
34118 void __user *buffer, size_t *lenp, loff_t *ppos) 34105 void __user *buffer, size_t *lenp, loff_t *ppos)
34119 { 34106 {
@@ -35743,10 +35730,10 @@ index 5a82b6b..9e69c73 100644
35743 if (regcomp 35730 if (regcomp
35744 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) { 35731 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
35745diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c 35732diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
35746index 44b8034..cc722fd 100644 35733index 5073665..31d15a6 100644
35747--- a/drivers/gpu/drm/radeon/radeon_device.c 35734--- a/drivers/gpu/drm/radeon/radeon_device.c
35748+++ b/drivers/gpu/drm/radeon/radeon_device.c 35735+++ b/drivers/gpu/drm/radeon/radeon_device.c
35749@@ -977,7 +977,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev) 35736@@ -976,7 +976,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev)
35750 bool can_switch; 35737 bool can_switch;
35751 35738
35752 spin_lock(&dev->count_lock); 35739 spin_lock(&dev->count_lock);
@@ -37505,6 +37492,37 @@ index 89562a8..218999b 100644
37505 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */ 37492 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
37506 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */ 37493 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
37507 capimsg_setu16(skb->data, 16, len); /* Data length */ 37494 capimsg_setu16(skb->data, 16, len); /* Data length */
37495diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
37496index 9b1b274..c123709 100644
37497--- a/drivers/isdn/capi/kcapi.c
37498+++ b/drivers/isdn/capi/kcapi.c
37499@@ -93,7 +93,7 @@ capi_ctr_put(struct capi_ctr *ctr)
37500
37501 static inline struct capi_ctr *get_capi_ctr_by_nr(u16 contr)
37502 {
37503- if (contr - 1 >= CAPI_MAXCONTR)
37504+ if (contr < 1 || contr - 1 >= CAPI_MAXCONTR)
37505 return NULL;
37506
37507 return capi_controller[contr - 1];
37508@@ -103,7 +103,7 @@ static inline struct capi20_appl *__get_capi_appl_by_nr(u16 applid)
37509 {
37510 lockdep_assert_held(&capi_controller_lock);
37511
37512- if (applid - 1 >= CAPI_MAXAPPL)
37513+ if (applid < 1 || applid - 1 >= CAPI_MAXAPPL)
37514 return NULL;
37515
37516 return capi_applications[applid - 1];
37517@@ -111,7 +111,7 @@ static inline struct capi20_appl *__get_capi_appl_by_nr(u16 applid)
37518
37519 static inline struct capi20_appl *get_capi_appl_by_nr(u16 applid)
37520 {
37521- if (applid - 1 >= CAPI_MAXAPPL)
37522+ if (applid < 1 || applid - 1 >= CAPI_MAXAPPL)
37523 return NULL;
37524
37525 return rcu_dereference(capi_applications[applid - 1]);
37508diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c 37526diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
37509index e2b5396..c5486dc 100644 37527index e2b5396..c5486dc 100644
37510--- a/drivers/isdn/gigaset/interface.c 37528--- a/drivers/isdn/gigaset/interface.c
@@ -39597,7 +39615,7 @@ index ff90760..08d8aed 100644
39597 /** 39615 /**
39598 * bnx2x_config_rx_mode - Send and RX_MODE ramrod according to the provided parameters. 39616 * bnx2x_config_rx_mode - Send and RX_MODE ramrod according to the provided parameters.
39599diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h 39617diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
39600index 8d7d4c2..95f7681 100644 39618index 25309bf..fcfd54c 100644
39601--- a/drivers/net/ethernet/broadcom/tg3.h 39619--- a/drivers/net/ethernet/broadcom/tg3.h
39602+++ b/drivers/net/ethernet/broadcom/tg3.h 39620+++ b/drivers/net/ethernet/broadcom/tg3.h
39603@@ -147,6 +147,7 @@ 39621@@ -147,6 +147,7 @@
@@ -40506,10 +40524,10 @@ index 12c4f31..484d948 100644
40506 40524
40507 memset(buf, 0, sizeof(buf)); 40525 memset(buf, 0, sizeof(buf));
40508diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c 40526diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
40509index cffdf4f..7cefb69 100644 40527index 2b49f48..14fc244 100644
40510--- a/drivers/net/wireless/mac80211_hwsim.c 40528--- a/drivers/net/wireless/mac80211_hwsim.c
40511+++ b/drivers/net/wireless/mac80211_hwsim.c 40529+++ b/drivers/net/wireless/mac80211_hwsim.c
40512@@ -2144,25 +2144,19 @@ static int __init init_mac80211_hwsim(void) 40530@@ -2143,25 +2143,19 @@ static int __init init_mac80211_hwsim(void)
40513 40531
40514 if (channels > 1) { 40532 if (channels > 1) {
40515 hwsim_if_comb.num_different_channels = channels; 40533 hwsim_if_comb.num_different_channels = channels;
@@ -42680,7 +42698,7 @@ index 5f13890..36a044b 100644
42680 42698
42681 pDevice->apdev->type = ARPHRD_IEEE80211; 42699 pDevice->apdev->type = ARPHRD_IEEE80211;
42682diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c 42700diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
42683index bc5e9da..dacd556 100644 42701index a94e66f..31984d0 100644
42684--- a/drivers/staging/vt6656/hostap.c 42702--- a/drivers/staging/vt6656/hostap.c
42685+++ b/drivers/staging/vt6656/hostap.c 42703+++ b/drivers/staging/vt6656/hostap.c
42686@@ -60,14 +60,13 @@ static int msglevel =MSG_LEVEL_INFO; 42704@@ -60,14 +60,13 @@ static int msglevel =MSG_LEVEL_INFO;
@@ -42751,48 +42769,6 @@ index adbe5a8..d387359 100644
42751 extern void tmem_register_hostops(struct tmem_hostops *m); 42769 extern void tmem_register_hostops(struct tmem_hostops *m);
42752 42770
42753 /* core tmem accessor functions */ 42771 /* core tmem accessor functions */
42754diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
42755index ca2be40..93ae910 100644
42756--- a/drivers/target/iscsi/iscsi_target_parameters.c
42757+++ b/drivers/target/iscsi/iscsi_target_parameters.c
42758@@ -712,9 +712,9 @@ static int iscsi_add_notunderstood_response(
42759 }
42760 INIT_LIST_HEAD(&extra_response->er_list);
42761
42762- strncpy(extra_response->key, key, strlen(key) + 1);
42763- strncpy(extra_response->value, NOTUNDERSTOOD,
42764- strlen(NOTUNDERSTOOD) + 1);
42765+ strlcpy(extra_response->key, key, sizeof(extra_response->key));
42766+ strlcpy(extra_response->value, NOTUNDERSTOOD,
42767+ sizeof(extra_response->value));
42768
42769 list_add_tail(&extra_response->er_list,
42770 &param_list->extra_response_list);
42771@@ -1583,8 +1583,6 @@ int iscsi_decode_text_input(
42772
42773 if (phase & PHASE_SECURITY) {
42774 if (iscsi_check_for_auth_key(key) > 0) {
42775- char *tmpptr = key + strlen(key);
42776- *tmpptr = '=';
42777 kfree(tmpbuf);
42778 return 1;
42779 }
42780diff --git a/drivers/target/iscsi/iscsi_target_parameters.h b/drivers/target/iscsi/iscsi_target_parameters.h
42781index 1e1b750..2c536a0 100644
42782--- a/drivers/target/iscsi/iscsi_target_parameters.h
42783+++ b/drivers/target/iscsi/iscsi_target_parameters.h
42784@@ -1,8 +1,10 @@
42785 #ifndef ISCSI_PARAMETERS_H
42786 #define ISCSI_PARAMETERS_H
42787
42788+#include <scsi/iscsi_proto.h>
42789+
42790 struct iscsi_extra_response {
42791- char key[64];
42792+ char key[KEY_MAXLEN];
42793 char value[32];
42794 struct list_head er_list;
42795 } ____cacheline_aligned;
42796diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c 42772diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
42797index 2e4d655..fd72e68 100644 42773index 2e4d655..fd72e68 100644
42798--- a/drivers/target/target_core_device.c 42774--- a/drivers/target/target_core_device.c
@@ -42807,10 +42783,10 @@ index 2e4d655..fd72e68 100644
42807 spin_lock_init(&dev->t10_wwn.t10_vpd_lock); 42783 spin_lock_init(&dev->t10_wwn.t10_vpd_lock);
42808 INIT_LIST_HEAD(&dev->t10_pr.registration_list); 42784 INIT_LIST_HEAD(&dev->t10_pr.registration_list);
42809diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c 42785diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
42810index 0d46276..f327cab5 100644 42786index fc9a5a0..1d5975e 100644
42811--- a/drivers/target/target_core_transport.c 42787--- a/drivers/target/target_core_transport.c
42812+++ b/drivers/target/target_core_transport.c 42788+++ b/drivers/target/target_core_transport.c
42813@@ -1080,7 +1080,7 @@ transport_check_alloc_task_attr(struct se_cmd *cmd) 42789@@ -1081,7 +1081,7 @@ transport_check_alloc_task_attr(struct se_cmd *cmd)
42814 * Used to determine when ORDERED commands should go from 42790 * Used to determine when ORDERED commands should go from
42815 * Dormant to Active status. 42791 * Dormant to Active status.
42816 */ 42792 */
@@ -43153,10 +43129,10 @@ index 4a43ef5d7..aa71f27 100644
43153 dlci_get(dlci->gsm->dlci[0]); 43129 dlci_get(dlci->gsm->dlci[0]);
43154 mux_get(dlci->gsm); 43130 mux_get(dlci->gsm);
43155diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c 43131diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
43156index 05e72be..67f6a0f 100644 43132index 1f8cba6..47b06c2 100644
43157--- a/drivers/tty/n_tty.c 43133--- a/drivers/tty/n_tty.c
43158+++ b/drivers/tty/n_tty.c 43134+++ b/drivers/tty/n_tty.c
43159@@ -2197,6 +2197,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops) 43135@@ -2205,6 +2205,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
43160 { 43136 {
43161 *ops = tty_ldisc_N_TTY; 43137 *ops = tty_ldisc_N_TTY;
43162 ops->owner = NULL; 43138 ops->owner = NULL;
@@ -44078,7 +44054,7 @@ index c8b9262..7e824e6 100644
44078 ret = uio_get_minor(idev); 44054 ret = uio_get_minor(idev);
44079 if (ret) 44055 if (ret)
44080diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c 44056diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
44081index b7eb86a..c00402f 100644 44057index 8a7eb77..c00402f 100644
44082--- a/drivers/usb/atm/cxacru.c 44058--- a/drivers/usb/atm/cxacru.c
44083+++ b/drivers/usb/atm/cxacru.c 44059+++ b/drivers/usb/atm/cxacru.c
44084@@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev, 44060@@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev,
@@ -44090,16 +44066,6 @@ index b7eb86a..c00402f 100644
44090 return -EINVAL; 44066 return -EINVAL;
44091 pos += tmp; 44067 pos += tmp;
44092 44068
44093@@ -686,7 +686,8 @@ static int cxacru_cm_get_array(struct cxacru_data *instance, enum cxacru_cm_requ
44094 {
44095 int ret, len;
44096 __le32 *buf;
44097- int offb, offd;
44098+ int offb;
44099+ unsigned int offd;
44100 const int stride = CMD_PACKET_SIZE / (4 * 2) - 1;
44101 int buflen = ((size - 1) / stride + 1 + size * 2) * 4;
44102
44103diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c 44069diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
44104index 35f10bf..6a38a0b 100644 44070index 35f10bf..6a38a0b 100644
44105--- a/drivers/usb/atm/usbatm.c 44071--- a/drivers/usb/atm/usbatm.c
@@ -51161,39 +51127,6 @@ index febbe0e..782c4fd 100644
51161 51127
51162 static int parse_strtoul(const char *buf, 51128 static int parse_strtoul(const char *buf,
51163 unsigned long max, unsigned long *value) 51129 unsigned long max, unsigned long *value)
51164diff --git a/fs/fat/inode.c b/fs/fat/inode.c
51165index acf6e47..e7a7fde 100644
51166--- a/fs/fat/inode.c
51167+++ b/fs/fat/inode.c
51168@@ -1223,6 +1223,19 @@ static int fat_read_root(struct inode *inode)
51169 return 0;
51170 }
51171
51172+static unsigned long calc_fat_clusters(struct super_block *sb)
51173+{
51174+ struct msdos_sb_info *sbi = MSDOS_SB(sb);
51175+
51176+ /* Divide first to avoid overflow */
51177+ if (sbi->fat_bits != 12) {
51178+ unsigned long ent_per_sec = sb->s_blocksize * 8 / sbi->fat_bits;
51179+ return ent_per_sec * sbi->fat_length;
51180+ }
51181+
51182+ return sbi->fat_length * sb->s_blocksize * 8 / sbi->fat_bits;
51183+}
51184+
51185 /*
51186 * Read the super block of an MS-DOS FS.
51187 */
51188@@ -1427,7 +1440,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
51189 sbi->dirty = b->fat16.state & FAT_STATE_DIRTY;
51190
51191 /* check that FAT table does not overflow */
51192- fat_clusters = sbi->fat_length * sb->s_blocksize * 8 / sbi->fat_bits;
51193+ fat_clusters = calc_fat_clusters(sb);
51194 total_clusters = min(total_clusters, fat_clusters - FAT_START_ENT);
51195 if (total_clusters > MAX_FAT(sb)) {
51196 if (!silent)
51197diff --git a/fs/fcntl.c b/fs/fcntl.c 51130diff --git a/fs/fcntl.c b/fs/fcntl.c
51198index 6599222..e7bf0de 100644 51131index 6599222..e7bf0de 100644
51199--- a/fs/fcntl.c 51132--- a/fs/fcntl.c
@@ -52844,10 +52777,10 @@ index 11dfa0c..6f64416 100644
52844 if (!ret) 52777 if (!ret)
52845 ret = -EPIPE; 52778 ret = -EPIPE;
52846diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c 52779diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
52847index ff15522..092a0f6 100644 52780index 185c479..51b9986 100644
52848--- a/fs/fuse/dir.c 52781--- a/fs/fuse/dir.c
52849+++ b/fs/fuse/dir.c 52782+++ b/fs/fuse/dir.c
52850@@ -1409,7 +1409,7 @@ static char *read_link(struct dentry *dentry) 52783@@ -1415,7 +1415,7 @@ static char *read_link(struct dentry *dentry)
52851 return link; 52784 return link;
52852 } 52785 }
52853 52786
@@ -53940,10 +53873,18 @@ index e7bc1d7..06bd4bb 100644
53940 } 53873 }
53941 53874
53942diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c 53875diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
53943index 5d84442..bf24453 100644 53876index 5d84442..2c034ba 100644
53944--- a/fs/notify/fanotify/fanotify_user.c 53877--- a/fs/notify/fanotify/fanotify_user.c
53945+++ b/fs/notify/fanotify/fanotify_user.c 53878+++ b/fs/notify/fanotify/fanotify_user.c
53946@@ -251,8 +251,8 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group, 53879@@ -121,6 +121,7 @@ static int fill_event_metadata(struct fsnotify_group *group,
53880 metadata->event_len = FAN_EVENT_METADATA_LEN;
53881 metadata->metadata_len = FAN_EVENT_METADATA_LEN;
53882 metadata->vers = FANOTIFY_METADATA_VERSION;
53883+ metadata->reserved = 0;
53884 metadata->mask = event->mask & FAN_ALL_OUTGOING_EVENTS;
53885 metadata->pid = pid_vnr(event->tgid);
53886 if (unlikely(event->mask & FAN_Q_OVERFLOW))
53887@@ -251,8 +252,8 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
53947 53888
53948 fd = fanotify_event_metadata.fd; 53889 fd = fanotify_event_metadata.fd;
53949 ret = -EFAULT; 53890 ret = -EFAULT;
@@ -56526,7 +56467,7 @@ index d681e34..2a3f5ab 100644
56526 goto out_put; 56467 goto out_put;
56527 56468
56528diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c 56469diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
56529index d82efaa..0904a8e 100644 56470index ca9ecaa..60100c7 100644
56530--- a/fs/xfs/xfs_iops.c 56471--- a/fs/xfs/xfs_iops.c
56531+++ b/fs/xfs/xfs_iops.c 56472+++ b/fs/xfs/xfs_iops.c
56532@@ -395,7 +395,7 @@ xfs_vn_put_link( 56473@@ -395,7 +395,7 @@ xfs_vn_put_link(
@@ -56540,10 +56481,10 @@ index d82efaa..0904a8e 100644
56540 kfree(s); 56481 kfree(s);
56541diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig 56482diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
56542new file mode 100644 56483new file mode 100644
56543index 0000000..7174794 56484index 0000000..ba9c5e3
56544--- /dev/null 56485--- /dev/null
56545+++ b/grsecurity/Kconfig 56486+++ b/grsecurity/Kconfig
56546@@ -0,0 +1,1031 @@ 56487@@ -0,0 +1,1053 @@
56547+# 56488+#
56548+# grecurity configuration 56489+# grecurity configuration
56549+# 56490+#
@@ -56629,6 +56570,25 @@ index 0000000..7174794
56629+ If you're using KERNEXEC, it's recommended that you enable this option 56570+ If you're using KERNEXEC, it's recommended that you enable this option
56630+ to supplement the hardening of the kernel. 56571+ to supplement the hardening of the kernel.
56631+ 56572+
56573+config GRKERNSEC_PERF_HARDEN
56574+ bool "Disable unprivileged PERF_EVENTS usage by default"
56575+ default y if GRKERNSEC_CONFIG_AUTO
56576+ depends on PERF_EVENTS
56577+ help
56578+ If you say Y here, the range of acceptable values for the
56579+ /proc/sys/kernel/perf_event_paranoid sysctl will be expanded to allow and
56580+ default to a new value: 3. When the sysctl is set to this value, no
56581+ unprivileged use of the PERF_EVENTS syscall interface will be permitted.
56582+
56583+ Though PERF_EVENTS can be used legitimately for performance monitoring
56584+ and low-level application profiling, it is forced on regardless of
56585+ configuration, has been at fault for several vulnerabilities, and
56586+ creates new opportunities for side channels and other information leaks.
56587+
56588+ This feature puts PERF_EVENTS into a secure default state and permits
56589+ the administrator to change out of it temporarily if unprivileged
56590+ application profiling is needed.
56591+
56632+config GRKERNSEC_RAND_THREADSTACK 56592+config GRKERNSEC_RAND_THREADSTACK
56633+ bool "Insert random gaps between thread stacks" 56593+ bool "Insert random gaps between thread stacks"
56634+ default y if GRKERNSEC_CONFIG_AUTO 56594+ default y if GRKERNSEC_CONFIG_AUTO
@@ -56739,6 +56699,9 @@ index 0000000..7174794
56739+ useful protection against local kernel exploitation of overflows 56699+ useful protection against local kernel exploitation of overflows
56740+ and arbitrary read/write vulnerabilities. 56700+ and arbitrary read/write vulnerabilities.
56741+ 56701+
56702+ It is highly recommended that you enable GRKERNSEC_PERF_HARDEN
56703+ in addition to this feature.
56704+
56742+config GRKERNSEC_KERN_LOCKOUT 56705+config GRKERNSEC_KERN_LOCKOUT
56743+ bool "Active kernel exploit response" 56706+ bool "Active kernel exploit response"
56744+ default y if GRKERNSEC_CONFIG_AUTO 56707+ default y if GRKERNSEC_CONFIG_AUTO
@@ -70441,7 +70404,7 @@ index 45fc162..01a4068 100644
70441 /** 70404 /**
70442 * struct hotplug_slot_info - used to notify the hotplug pci core of the state of the slot 70405 * struct hotplug_slot_info - used to notify the hotplug pci core of the state of the slot
70443diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h 70406diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
70444index 1d795df..727aa7b 100644 70407index 1d795df..b0a6449 100644
70445--- a/include/linux/perf_event.h 70408--- a/include/linux/perf_event.h
70446+++ b/include/linux/perf_event.h 70409+++ b/include/linux/perf_event.h
70447@@ -333,8 +333,8 @@ struct perf_event { 70410@@ -333,8 +333,8 @@ struct perf_event {
@@ -70475,8 +70438,15 @@ index 1d795df..727aa7b 100644
70475 extern int sysctl_perf_event_mlock; 70438 extern int sysctl_perf_event_mlock;
70476 extern int sysctl_perf_event_sample_rate; 70439 extern int sysctl_perf_event_sample_rate;
70477 70440
70478@@ -714,17 +714,17 @@ extern int perf_proc_update_handler(struct ctl_table *table, int write, 70441@@ -712,19 +712,24 @@ extern int perf_proc_update_handler(struct ctl_table *table, int write,
70442 void __user *buffer, size_t *lenp,
70443 loff_t *ppos);
70479 70444
70445+static inline bool perf_paranoid_any(void)
70446+{
70447+ return sysctl_perf_event_legitimately_concerned > 2;
70448+}
70449+
70480 static inline bool perf_paranoid_tracepoint_raw(void) 70450 static inline bool perf_paranoid_tracepoint_raw(void)
70481 { 70451 {
70482- return sysctl_perf_event_paranoid > -1; 70452- return sysctl_perf_event_paranoid > -1;
@@ -70496,7 +70466,7 @@ index 1d795df..727aa7b 100644
70496 } 70466 }
70497 70467
70498 extern void perf_event_init(void); 70468 extern void perf_event_init(void);
70499@@ -812,7 +812,7 @@ static inline void perf_restore_debug_store(void) { } 70469@@ -812,7 +817,7 @@ static inline void perf_restore_debug_store(void) { }
70500 */ 70470 */
70501 #define perf_cpu_notifier(fn) \ 70471 #define perf_cpu_notifier(fn) \
70502 do { \ 70472 do { \
@@ -70505,7 +70475,7 @@ index 1d795df..727aa7b 100644
70505 { .notifier_call = fn, .priority = CPU_PRI_PERF }; \ 70475 { .notifier_call = fn, .priority = CPU_PRI_PERF }; \
70506 unsigned long cpu = smp_processor_id(); \ 70476 unsigned long cpu = smp_processor_id(); \
70507 unsigned long flags; \ 70477 unsigned long flags; \
70508@@ -831,7 +831,7 @@ do { \ 70478@@ -831,7 +836,7 @@ do { \
70509 struct perf_pmu_events_attr { 70479 struct perf_pmu_events_attr {
70510 struct device_attribute attr; 70480 struct device_attribute attr;
70511 u64 id; 70481 u64 id;
@@ -72906,10 +72876,10 @@ index a6a059c..2243336 100644
72906 struct snd_soc_platform { 72876 struct snd_soc_platform {
72907 const char *name; 72877 const char *name;
72908diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h 72878diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
72909index c4af592..20c52d2 100644 72879index f8640f3..b72d113 100644
72910--- a/include/target/target_core_base.h 72880--- a/include/target/target_core_base.h
72911+++ b/include/target/target_core_base.h 72881+++ b/include/target/target_core_base.h
72912@@ -657,7 +657,7 @@ struct se_device { 72882@@ -658,7 +658,7 @@ struct se_device {
72913 spinlock_t stats_lock; 72883 spinlock_t stats_lock;
72914 /* Active commands on this virtual SE device */ 72884 /* Active commands on this virtual SE device */
72915 atomic_t simple_cmds; 72885 atomic_t simple_cmds;
@@ -74209,10 +74179,10 @@ index f6c2ce5..982c0f9 100644
74209+ return ns_capable_nolog(ns, cap) && kuid_has_mapping(ns, inode->i_uid); 74179+ return ns_capable_nolog(ns, cap) && kuid_has_mapping(ns, inode->i_uid);
74210+} 74180+}
74211diff --git a/kernel/cgroup.c b/kernel/cgroup.c 74181diff --git a/kernel/cgroup.c b/kernel/cgroup.c
74212index ba1f977..f840d9c 100644 74182index a48de6a..df24bfe 100644
74213--- a/kernel/cgroup.c 74183--- a/kernel/cgroup.c
74214+++ b/kernel/cgroup.c 74184+++ b/kernel/cgroup.c
74215@@ -5569,7 +5569,7 @@ static int cgroup_css_links_read(struct cgroup *cont, 74185@@ -5567,7 +5567,7 @@ static int cgroup_css_links_read(struct cgroup *cont,
74216 struct css_set *cg = link->cg; 74186 struct css_set *cg = link->cg;
74217 struct task_struct *task; 74187 struct task_struct *task;
74218 int count = 0; 74188 int count = 0;
@@ -74632,15 +74602,19 @@ index 00eb8f7..d7e3244 100644
74632 #ifdef CONFIG_MODULE_UNLOAD 74602 #ifdef CONFIG_MODULE_UNLOAD
74633 { 74603 {
74634diff --git a/kernel/events/core.c b/kernel/events/core.c 74604diff --git a/kernel/events/core.c b/kernel/events/core.c
74635index 9fcb094..fd68c54 100644 74605index 9fcb094..8370228 100644
74636--- a/kernel/events/core.c 74606--- a/kernel/events/core.c
74637+++ b/kernel/events/core.c 74607+++ b/kernel/events/core.c
74638@@ -155,7 +155,11 @@ static struct srcu_struct pmus_srcu; 74608@@ -154,8 +154,15 @@ static struct srcu_struct pmus_srcu;
74609 * 0 - disallow raw tracepoint access for unpriv
74639 * 1 - disallow cpu events for unpriv 74610 * 1 - disallow cpu events for unpriv
74640 * 2 - disallow kernel profiling for unpriv 74611 * 2 - disallow kernel profiling for unpriv
74612+ * 3 - disallow all unpriv perf event use
74641 */ 74613 */
74642-int sysctl_perf_event_paranoid __read_mostly = 1; 74614-int sysctl_perf_event_paranoid __read_mostly = 1;
74643+#ifdef CONFIG_GRKERNSEC_HIDESYM 74615+#ifdef CONFIG_GRKERNSEC_PERF_HARDEN
74616+int sysctl_perf_event_legitimately_concerned __read_mostly = 3;
74617+#elif CONFIG_GRKERNSEC_HIDESYM
74644+int sysctl_perf_event_legitimately_concerned __read_mostly = 2; 74618+int sysctl_perf_event_legitimately_concerned __read_mostly = 2;
74645+#else 74619+#else
74646+int sysctl_perf_event_legitimately_concerned __read_mostly = 1; 74620+int sysctl_perf_event_legitimately_concerned __read_mostly = 1;
@@ -74648,7 +74622,7 @@ index 9fcb094..fd68c54 100644
74648 74622
74649 /* Minimum for 512 kiB + 1 user control page */ 74623 /* Minimum for 512 kiB + 1 user control page */
74650 int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */ 74624 int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */
74651@@ -182,7 +186,7 @@ int perf_proc_update_handler(struct ctl_table *table, int write, 74625@@ -182,7 +189,7 @@ int perf_proc_update_handler(struct ctl_table *table, int write,
74652 return 0; 74626 return 0;
74653 } 74627 }
74654 74628
@@ -74657,7 +74631,7 @@ index 9fcb094..fd68c54 100644
74657 74631
74658 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx, 74632 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
74659 enum event_type_t event_type); 74633 enum event_type_t event_type);
74660@@ -2677,7 +2681,7 @@ static void __perf_event_read(void *info) 74634@@ -2677,7 +2684,7 @@ static void __perf_event_read(void *info)
74661 74635
74662 static inline u64 perf_event_count(struct perf_event *event) 74636 static inline u64 perf_event_count(struct perf_event *event)
74663 { 74637 {
@@ -74666,7 +74640,7 @@ index 9fcb094..fd68c54 100644
74666 } 74640 }
74667 74641
74668 static u64 perf_event_read(struct perf_event *event) 74642 static u64 perf_event_read(struct perf_event *event)
74669@@ -3007,9 +3011,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running) 74643@@ -3007,9 +3014,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
74670 mutex_lock(&event->child_mutex); 74644 mutex_lock(&event->child_mutex);
74671 total += perf_event_read(event); 74645 total += perf_event_read(event);
74672 *enabled += event->total_time_enabled + 74646 *enabled += event->total_time_enabled +
@@ -74678,7 +74652,7 @@ index 9fcb094..fd68c54 100644
74678 74652
74679 list_for_each_entry(child, &event->child_list, child_list) { 74653 list_for_each_entry(child, &event->child_list, child_list) {
74680 total += perf_event_read(child); 74654 total += perf_event_read(child);
74681@@ -3412,10 +3416,10 @@ void perf_event_update_userpage(struct perf_event *event) 74655@@ -3412,10 +3419,10 @@ void perf_event_update_userpage(struct perf_event *event)
74682 userpg->offset -= local64_read(&event->hw.prev_count); 74656 userpg->offset -= local64_read(&event->hw.prev_count);
74683 74657
74684 userpg->time_enabled = enabled + 74658 userpg->time_enabled = enabled +
@@ -74691,7 +74665,7 @@ index 9fcb094..fd68c54 100644
74691 74665
74692 arch_perf_update_userpage(userpg, now); 74666 arch_perf_update_userpage(userpg, now);
74693 74667
74694@@ -3886,7 +3890,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size, 74668@@ -3886,7 +3893,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
74695 74669
74696 /* Data. */ 74670 /* Data. */
74697 sp = perf_user_stack_pointer(regs); 74671 sp = perf_user_stack_pointer(regs);
@@ -74700,7 +74674,7 @@ index 9fcb094..fd68c54 100644
74700 dyn_size = dump_size - rem; 74674 dyn_size = dump_size - rem;
74701 74675
74702 perf_output_skip(handle, rem); 74676 perf_output_skip(handle, rem);
74703@@ -3974,11 +3978,11 @@ static void perf_output_read_one(struct perf_output_handle *handle, 74677@@ -3974,11 +3981,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
74704 values[n++] = perf_event_count(event); 74678 values[n++] = perf_event_count(event);
74705 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) { 74679 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
74706 values[n++] = enabled + 74680 values[n++] = enabled +
@@ -74714,7 +74688,7 @@ index 9fcb094..fd68c54 100644
74714 } 74688 }
74715 if (read_format & PERF_FORMAT_ID) 74689 if (read_format & PERF_FORMAT_ID)
74716 values[n++] = primary_event_id(event); 74690 values[n++] = primary_event_id(event);
74717@@ -4726,12 +4730,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event) 74691@@ -4726,12 +4733,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
74718 * need to add enough zero bytes after the string to handle 74692 * need to add enough zero bytes after the string to handle
74719 * the 64bit alignment we do later. 74693 * the 64bit alignment we do later.
74720 */ 74694 */
@@ -74729,7 +74703,7 @@ index 9fcb094..fd68c54 100644
74729 if (IS_ERR(name)) { 74703 if (IS_ERR(name)) {
74730 name = strncpy(tmp, "//toolong", sizeof(tmp)); 74704 name = strncpy(tmp, "//toolong", sizeof(tmp));
74731 goto got_name; 74705 goto got_name;
74732@@ -6167,7 +6171,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, 74706@@ -6167,7 +6174,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
74733 event->parent = parent_event; 74707 event->parent = parent_event;
74734 74708
74735 event->ns = get_pid_ns(task_active_pid_ns(current)); 74709 event->ns = get_pid_ns(task_active_pid_ns(current));
@@ -74738,7 +74712,19 @@ index 9fcb094..fd68c54 100644
74738 74712
74739 event->state = PERF_EVENT_STATE_INACTIVE; 74713 event->state = PERF_EVENT_STATE_INACTIVE;
74740 74714
74741@@ -6795,10 +6799,10 @@ static void sync_child_event(struct perf_event *child_event, 74715@@ -6463,6 +6470,11 @@ SYSCALL_DEFINE5(perf_event_open,
74716 if (flags & ~PERF_FLAG_ALL)
74717 return -EINVAL;
74718
74719+#ifdef CONFIG_GRKERNSEC_PERF_HARDEN
74720+ if (perf_paranoid_any() && !capable(CAP_SYS_ADMIN))
74721+ return -EACCES;
74722+#endif
74723+
74724 err = perf_copy_attr(attr_uptr, &attr);
74725 if (err)
74726 return err;
74727@@ -6795,10 +6807,10 @@ static void sync_child_event(struct perf_event *child_event,
74742 /* 74728 /*
74743 * Add back the child's count to the parent's count: 74729 * Add back the child's count to the parent's count:
74744 */ 74730 */
@@ -75791,7 +75777,7 @@ index b2c71c5..7b88d63 100644
75791 seq_printf(m, "%40s %14lu %29s %pS\n", 75777 seq_printf(m, "%40s %14lu %29s %pS\n",
75792 name, stats->contending_point[i], 75778 name, stats->contending_point[i],
75793diff --git a/kernel/module.c b/kernel/module.c 75779diff --git a/kernel/module.c b/kernel/module.c
75794index 0925c9a..6b044ac 100644 75780index 97f202c..109575f 100644
75795--- a/kernel/module.c 75781--- a/kernel/module.c
75796+++ b/kernel/module.c 75782+++ b/kernel/module.c
75797@@ -61,6 +61,7 @@ 75783@@ -61,6 +61,7 @@
@@ -75956,7 +75942,7 @@ index 0925c9a..6b044ac 100644
75956 set_memory_ro); 75942 set_memory_ro);
75957 } 75943 }
75958 } 75944 }
75959@@ -1881,16 +1883,19 @@ static void free_module(struct module *mod) 75945@@ -1886,16 +1888,19 @@ static void free_module(struct module *mod)
75960 75946
75961 /* This may be NULL, but that's OK */ 75947 /* This may be NULL, but that's OK */
75962 unset_module_init_ro_nx(mod); 75948 unset_module_init_ro_nx(mod);
@@ -75979,7 +75965,7 @@ index 0925c9a..6b044ac 100644
75979 75965
75980 #ifdef CONFIG_MPU 75966 #ifdef CONFIG_MPU
75981 update_protections(current->mm); 75967 update_protections(current->mm);
75982@@ -1960,9 +1965,31 @@ static int simplify_symbols(struct module *mod, const struct load_info *info) 75968@@ -1965,9 +1970,31 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
75983 int ret = 0; 75969 int ret = 0;
75984 const struct kernel_symbol *ksym; 75970 const struct kernel_symbol *ksym;
75985 75971
@@ -76011,7 +75997,7 @@ index 0925c9a..6b044ac 100644
76011 switch (sym[i].st_shndx) { 75997 switch (sym[i].st_shndx) {
76012 case SHN_COMMON: 75998 case SHN_COMMON:
76013 /* We compiled with -fno-common. These are not 75999 /* We compiled with -fno-common. These are not
76014@@ -1983,7 +2010,9 @@ static int simplify_symbols(struct module *mod, const struct load_info *info) 76000@@ -1988,7 +2015,9 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
76015 ksym = resolve_symbol_wait(mod, info, name); 76001 ksym = resolve_symbol_wait(mod, info, name);
76016 /* Ok if resolved. */ 76002 /* Ok if resolved. */
76017 if (ksym && !IS_ERR(ksym)) { 76003 if (ksym && !IS_ERR(ksym)) {
@@ -76021,7 +76007,7 @@ index 0925c9a..6b044ac 100644
76021 break; 76007 break;
76022 } 76008 }
76023 76009
76024@@ -2002,11 +2031,20 @@ static int simplify_symbols(struct module *mod, const struct load_info *info) 76010@@ -2007,11 +2036,20 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
76025 secbase = (unsigned long)mod_percpu(mod); 76011 secbase = (unsigned long)mod_percpu(mod);
76026 else 76012 else
76027 secbase = info->sechdrs[sym[i].st_shndx].sh_addr; 76013 secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
@@ -76042,7 +76028,7 @@ index 0925c9a..6b044ac 100644
76042 return ret; 76028 return ret;
76043 } 76029 }
76044 76030
76045@@ -2090,22 +2128,12 @@ static void layout_sections(struct module *mod, struct load_info *info) 76031@@ -2095,22 +2133,12 @@ static void layout_sections(struct module *mod, struct load_info *info)
76046 || s->sh_entsize != ~0UL 76032 || s->sh_entsize != ~0UL
76047 || strstarts(sname, ".init")) 76033 || strstarts(sname, ".init"))
76048 continue; 76034 continue;
@@ -76069,7 +76055,7 @@ index 0925c9a..6b044ac 100644
76069 } 76055 }
76070 76056
76071 pr_debug("Init section allocation order:\n"); 76057 pr_debug("Init section allocation order:\n");
76072@@ -2119,23 +2147,13 @@ static void layout_sections(struct module *mod, struct load_info *info) 76058@@ -2124,23 +2152,13 @@ static void layout_sections(struct module *mod, struct load_info *info)
76073 || s->sh_entsize != ~0UL 76059 || s->sh_entsize != ~0UL
76074 || !strstarts(sname, ".init")) 76060 || !strstarts(sname, ".init"))
76075 continue; 76061 continue;
@@ -76098,7 +76084,7 @@ index 0925c9a..6b044ac 100644
76098 } 76084 }
76099 } 76085 }
76100 76086
76101@@ -2308,7 +2326,7 @@ static void layout_symtab(struct module *mod, struct load_info *info) 76087@@ -2313,7 +2331,7 @@ static void layout_symtab(struct module *mod, struct load_info *info)
76102 76088
76103 /* Put symbol section at end of init part of module. */ 76089 /* Put symbol section at end of init part of module. */
76104 symsect->sh_flags |= SHF_ALLOC; 76090 symsect->sh_flags |= SHF_ALLOC;
@@ -76107,7 +76093,7 @@ index 0925c9a..6b044ac 100644
76107 info->index.sym) | INIT_OFFSET_MASK; 76093 info->index.sym) | INIT_OFFSET_MASK;
76108 pr_debug("\t%s\n", info->secstrings + symsect->sh_name); 76094 pr_debug("\t%s\n", info->secstrings + symsect->sh_name);
76109 76095
76110@@ -2325,13 +2343,13 @@ static void layout_symtab(struct module *mod, struct load_info *info) 76096@@ -2330,13 +2348,13 @@ static void layout_symtab(struct module *mod, struct load_info *info)
76111 } 76097 }
76112 76098
76113 /* Append room for core symbols at end of core part. */ 76099 /* Append room for core symbols at end of core part. */
@@ -76125,7 +76111,7 @@ index 0925c9a..6b044ac 100644
76125 info->index.str) | INIT_OFFSET_MASK; 76111 info->index.str) | INIT_OFFSET_MASK;
76126 pr_debug("\t%s\n", info->secstrings + strsect->sh_name); 76112 pr_debug("\t%s\n", info->secstrings + strsect->sh_name);
76127 } 76113 }
76128@@ -2349,12 +2367,14 @@ static void add_kallsyms(struct module *mod, const struct load_info *info) 76114@@ -2354,12 +2372,14 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
76129 /* Make sure we get permanent strtab: don't use info->strtab. */ 76115 /* Make sure we get permanent strtab: don't use info->strtab. */
76130 mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr; 76116 mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
76131 76117
@@ -76142,7 +76128,7 @@ index 0925c9a..6b044ac 100644
76142 src = mod->symtab; 76128 src = mod->symtab;
76143 for (ndst = i = 0; i < mod->num_symtab; i++) { 76129 for (ndst = i = 0; i < mod->num_symtab; i++) {
76144 if (i == 0 || 76130 if (i == 0 ||
76145@@ -2366,6 +2386,8 @@ static void add_kallsyms(struct module *mod, const struct load_info *info) 76131@@ -2371,6 +2391,8 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
76146 } 76132 }
76147 } 76133 }
76148 mod->core_num_syms = ndst; 76134 mod->core_num_syms = ndst;
@@ -76151,7 +76137,7 @@ index 0925c9a..6b044ac 100644
76151 } 76137 }
76152 #else 76138 #else
76153 static inline void layout_symtab(struct module *mod, struct load_info *info) 76139 static inline void layout_symtab(struct module *mod, struct load_info *info)
76154@@ -2399,17 +2421,33 @@ void * __weak module_alloc(unsigned long size) 76140@@ -2404,17 +2426,33 @@ void * __weak module_alloc(unsigned long size)
76155 return vmalloc_exec(size); 76141 return vmalloc_exec(size);
76156 } 76142 }
76157 76143
@@ -76190,7 +76176,7 @@ index 0925c9a..6b044ac 100644
76190 mutex_unlock(&module_mutex); 76176 mutex_unlock(&module_mutex);
76191 } 76177 }
76192 return ret; 76178 return ret;
76193@@ -2685,8 +2723,14 @@ static struct module *setup_load_info(struct load_info *info, int flags) 76179@@ -2690,8 +2728,14 @@ static struct module *setup_load_info(struct load_info *info, int flags)
76194 static int check_modinfo(struct module *mod, struct load_info *info, int flags) 76180 static int check_modinfo(struct module *mod, struct load_info *info, int flags)
76195 { 76181 {
76196 const char *modmagic = get_modinfo(info, "vermagic"); 76182 const char *modmagic = get_modinfo(info, "vermagic");
@@ -76205,7 +76191,7 @@ index 0925c9a..6b044ac 100644
76205 if (flags & MODULE_INIT_IGNORE_VERMAGIC) 76191 if (flags & MODULE_INIT_IGNORE_VERMAGIC)
76206 modmagic = NULL; 76192 modmagic = NULL;
76207 76193
76208@@ -2712,7 +2756,7 @@ static int check_modinfo(struct module *mod, struct load_info *info, int flags) 76194@@ -2717,7 +2761,7 @@ static int check_modinfo(struct module *mod, struct load_info *info, int flags)
76209 } 76195 }
76210 76196
76211 /* Set up license info based on the info section */ 76197 /* Set up license info based on the info section */
@@ -76214,7 +76200,7 @@ index 0925c9a..6b044ac 100644
76214 76200
76215 return 0; 76201 return 0;
76216 } 76202 }
76217@@ -2806,7 +2850,7 @@ static int move_module(struct module *mod, struct load_info *info) 76203@@ -2811,7 +2855,7 @@ static int move_module(struct module *mod, struct load_info *info)
76218 void *ptr; 76204 void *ptr;
76219 76205
76220 /* Do the allocs. */ 76206 /* Do the allocs. */
@@ -76223,7 +76209,7 @@ index 0925c9a..6b044ac 100644
76223 /* 76209 /*
76224 * The pointer to this block is stored in the module structure 76210 * The pointer to this block is stored in the module structure
76225 * which is inside the block. Just mark it as not being a 76211 * which is inside the block. Just mark it as not being a
76226@@ -2816,11 +2860,11 @@ static int move_module(struct module *mod, struct load_info *info) 76212@@ -2821,11 +2865,11 @@ static int move_module(struct module *mod, struct load_info *info)
76227 if (!ptr) 76213 if (!ptr)
76228 return -ENOMEM; 76214 return -ENOMEM;
76229 76215
@@ -76239,7 +76225,7 @@ index 0925c9a..6b044ac 100644
76239 /* 76225 /*
76240 * The pointer to this block is stored in the module structure 76226 * The pointer to this block is stored in the module structure
76241 * which is inside the block. This block doesn't need to be 76227 * which is inside the block. This block doesn't need to be
76242@@ -2829,13 +2873,45 @@ static int move_module(struct module *mod, struct load_info *info) 76228@@ -2834,13 +2878,45 @@ static int move_module(struct module *mod, struct load_info *info)
76243 */ 76229 */
76244 kmemleak_ignore(ptr); 76230 kmemleak_ignore(ptr);
76245 if (!ptr) { 76231 if (!ptr) {
@@ -76289,7 +76275,7 @@ index 0925c9a..6b044ac 100644
76289 76275
76290 /* Transfer each section which specifies SHF_ALLOC */ 76276 /* Transfer each section which specifies SHF_ALLOC */
76291 pr_debug("final section addresses:\n"); 76277 pr_debug("final section addresses:\n");
76292@@ -2846,16 +2922,45 @@ static int move_module(struct module *mod, struct load_info *info) 76278@@ -2851,16 +2927,45 @@ static int move_module(struct module *mod, struct load_info *info)
76293 if (!(shdr->sh_flags & SHF_ALLOC)) 76279 if (!(shdr->sh_flags & SHF_ALLOC))
76294 continue; 76280 continue;
76295 76281
@@ -76342,7 +76328,7 @@ index 0925c9a..6b044ac 100644
76342 pr_debug("\t0x%lx %s\n", 76328 pr_debug("\t0x%lx %s\n",
76343 (long)shdr->sh_addr, info->secstrings + shdr->sh_name); 76329 (long)shdr->sh_addr, info->secstrings + shdr->sh_name);
76344 } 76330 }
76345@@ -2912,12 +3017,12 @@ static void flush_module_icache(const struct module *mod) 76331@@ -2917,12 +3022,12 @@ static void flush_module_icache(const struct module *mod)
76346 * Do it before processing of module parameters, so the module 76332 * Do it before processing of module parameters, so the module
76347 * can provide parameter accessor functions of its own. 76333 * can provide parameter accessor functions of its own.
76348 */ 76334 */
@@ -76361,7 +76347,7 @@ index 0925c9a..6b044ac 100644
76361 76347
76362 set_fs(old_fs); 76348 set_fs(old_fs);
76363 } 76349 }
76364@@ -2987,8 +3092,10 @@ out: 76350@@ -2992,8 +3097,10 @@ out:
76365 static void module_deallocate(struct module *mod, struct load_info *info) 76351 static void module_deallocate(struct module *mod, struct load_info *info)
76366 { 76352 {
76367 percpu_modfree(mod); 76353 percpu_modfree(mod);
@@ -76374,7 +76360,7 @@ index 0925c9a..6b044ac 100644
76374 } 76360 }
76375 76361
76376 int __weak module_finalize(const Elf_Ehdr *hdr, 76362 int __weak module_finalize(const Elf_Ehdr *hdr,
76377@@ -3001,7 +3108,9 @@ int __weak module_finalize(const Elf_Ehdr *hdr, 76363@@ -3006,7 +3113,9 @@ int __weak module_finalize(const Elf_Ehdr *hdr,
76378 static int post_relocation(struct module *mod, const struct load_info *info) 76364 static int post_relocation(struct module *mod, const struct load_info *info)
76379 { 76365 {
76380 /* Sort exception table now relocations are done. */ 76366 /* Sort exception table now relocations are done. */
@@ -76384,7 +76370,7 @@ index 0925c9a..6b044ac 100644
76384 76370
76385 /* Copy relocated percpu area over. */ 76371 /* Copy relocated percpu area over. */
76386 percpu_modcopy(mod, (void *)info->sechdrs[info->index.pcpu].sh_addr, 76372 percpu_modcopy(mod, (void *)info->sechdrs[info->index.pcpu].sh_addr,
76387@@ -3055,16 +3164,16 @@ static int do_init_module(struct module *mod) 76373@@ -3060,16 +3169,16 @@ static int do_init_module(struct module *mod)
76388 MODULE_STATE_COMING, mod); 76374 MODULE_STATE_COMING, mod);
76389 76375
76390 /* Set RO and NX regions for core */ 76376 /* Set RO and NX regions for core */
@@ -76409,7 +76395,7 @@ index 0925c9a..6b044ac 100644
76409 76395
76410 do_mod_ctors(mod); 76396 do_mod_ctors(mod);
76411 /* Start the module */ 76397 /* Start the module */
76412@@ -3126,11 +3235,12 @@ static int do_init_module(struct module *mod) 76398@@ -3131,11 +3240,12 @@ static int do_init_module(struct module *mod)
76413 mod->strtab = mod->core_strtab; 76399 mod->strtab = mod->core_strtab;
76414 #endif 76400 #endif
76415 unset_module_init_ro_nx(mod); 76401 unset_module_init_ro_nx(mod);
@@ -76427,7 +76413,7 @@ index 0925c9a..6b044ac 100644
76427 mutex_unlock(&module_mutex); 76413 mutex_unlock(&module_mutex);
76428 wake_up_all(&module_wq); 76414 wake_up_all(&module_wq);
76429 76415
76430@@ -3257,9 +3367,38 @@ static int load_module(struct load_info *info, const char __user *uargs, 76416@@ -3262,9 +3372,38 @@ static int load_module(struct load_info *info, const char __user *uargs,
76431 if (err) 76417 if (err)
76432 goto free_unload; 76418 goto free_unload;
76433 76419
@@ -76466,7 +76452,7 @@ index 0925c9a..6b044ac 100644
76466 /* Fix up syms, so that st_value is a pointer to location. */ 76452 /* Fix up syms, so that st_value is a pointer to location. */
76467 err = simplify_symbols(mod, info); 76453 err = simplify_symbols(mod, info);
76468 if (err < 0) 76454 if (err < 0)
76469@@ -3275,13 +3414,6 @@ static int load_module(struct load_info *info, const char __user *uargs, 76455@@ -3280,13 +3419,6 @@ static int load_module(struct load_info *info, const char __user *uargs,
76470 76456
76471 flush_module_icache(mod); 76457 flush_module_icache(mod);
76472 76458
@@ -76480,7 +76466,7 @@ index 0925c9a..6b044ac 100644
76480 dynamic_debug_setup(info->debug, info->num_debug); 76466 dynamic_debug_setup(info->debug, info->num_debug);
76481 76467
76482 /* Finally it's fully formed, ready to start executing. */ 76468 /* Finally it's fully formed, ready to start executing. */
76483@@ -3316,11 +3448,10 @@ static int load_module(struct load_info *info, const char __user *uargs, 76469@@ -3321,11 +3453,10 @@ static int load_module(struct load_info *info, const char __user *uargs,
76484 ddebug_cleanup: 76470 ddebug_cleanup:
76485 dynamic_debug_remove(info->debug); 76471 dynamic_debug_remove(info->debug);
76486 synchronize_sched(); 76472 synchronize_sched();
@@ -76493,7 +76479,7 @@ index 0925c9a..6b044ac 100644
76493 free_unload: 76479 free_unload:
76494 module_unload_free(mod); 76480 module_unload_free(mod);
76495 unlink_mod: 76481 unlink_mod:
76496@@ -3403,10 +3534,16 @@ static const char *get_ksymbol(struct module *mod, 76482@@ -3408,10 +3539,16 @@ static const char *get_ksymbol(struct module *mod,
76497 unsigned long nextval; 76483 unsigned long nextval;
76498 76484
76499 /* At worse, next value is at end of module */ 76485 /* At worse, next value is at end of module */
@@ -76513,7 +76499,7 @@ index 0925c9a..6b044ac 100644
76513 76499
76514 /* Scan for closest preceding symbol, and next symbol. (ELF 76500 /* Scan for closest preceding symbol, and next symbol. (ELF
76515 starts real symbols at 1). */ 76501 starts real symbols at 1). */
76516@@ -3659,7 +3796,7 @@ static int m_show(struct seq_file *m, void *p) 76502@@ -3664,7 +3801,7 @@ static int m_show(struct seq_file *m, void *p)
76517 return 0; 76503 return 0;
76518 76504
76519 seq_printf(m, "%s %u", 76505 seq_printf(m, "%s %u",
@@ -76522,7 +76508,7 @@ index 0925c9a..6b044ac 100644
76522 print_unload_info(m, mod); 76508 print_unload_info(m, mod);
76523 76509
76524 /* Informative for users. */ 76510 /* Informative for users. */
76525@@ -3668,7 +3805,7 @@ static int m_show(struct seq_file *m, void *p) 76511@@ -3673,7 +3810,7 @@ static int m_show(struct seq_file *m, void *p)
76526 mod->state == MODULE_STATE_COMING ? "Loading": 76512 mod->state == MODULE_STATE_COMING ? "Loading":
76527 "Live"); 76513 "Live");
76528 /* Used by oprofile and other similar tools. */ 76514 /* Used by oprofile and other similar tools. */
@@ -76531,7 +76517,7 @@ index 0925c9a..6b044ac 100644
76531 76517
76532 /* Taints info */ 76518 /* Taints info */
76533 if (mod->taints) 76519 if (mod->taints)
76534@@ -3704,7 +3841,17 @@ static const struct file_operations proc_modules_operations = { 76520@@ -3709,7 +3846,17 @@ static const struct file_operations proc_modules_operations = {
76535 76521
76536 static int __init proc_modules_init(void) 76522 static int __init proc_modules_init(void)
76537 { 76523 {
@@ -76549,7 +76535,7 @@ index 0925c9a..6b044ac 100644
76549 return 0; 76535 return 0;
76550 } 76536 }
76551 module_init(proc_modules_init); 76537 module_init(proc_modules_init);
76552@@ -3765,14 +3912,14 @@ struct module *__module_address(unsigned long addr) 76538@@ -3770,14 +3917,14 @@ struct module *__module_address(unsigned long addr)
76553 { 76539 {
76554 struct module *mod; 76540 struct module *mod;
76555 76541
@@ -76567,7 +76553,7 @@ index 0925c9a..6b044ac 100644
76567 return mod; 76553 return mod;
76568 } 76554 }
76569 return NULL; 76555 return NULL;
76570@@ -3807,11 +3954,20 @@ bool is_module_text_address(unsigned long addr) 76556@@ -3812,11 +3959,20 @@ bool is_module_text_address(unsigned long addr)
76571 */ 76557 */
76572 struct module *__module_text_address(unsigned long addr) 76558 struct module *__module_text_address(unsigned long addr)
76573 { 76559 {
@@ -78585,7 +78571,7 @@ index 0da73cf..5c2af3c 100644
78585 if (!retval) { 78571 if (!retval) {
78586 if (old_rlim) 78572 if (old_rlim)
78587diff --git a/kernel/sysctl.c b/kernel/sysctl.c 78573diff --git a/kernel/sysctl.c b/kernel/sysctl.c
78588index afc1dc6..5e28bbf 100644 78574index afc1dc6..f6cf355 100644
78589--- a/kernel/sysctl.c 78575--- a/kernel/sysctl.c
78590+++ b/kernel/sysctl.c 78576+++ b/kernel/sysctl.c
78591@@ -93,7 +93,6 @@ 78577@@ -93,7 +93,6 @@
@@ -78596,6 +78582,34 @@ index afc1dc6..5e28bbf 100644
78596 /* External variables not in a header file. */ 78582 /* External variables not in a header file. */
78597 extern int sysctl_overcommit_memory; 78583 extern int sysctl_overcommit_memory;
78598 extern int sysctl_overcommit_ratio; 78584 extern int sysctl_overcommit_ratio;
78585@@ -120,18 +119,18 @@ extern int blk_iopoll_enabled;
78586
78587 /* Constants used for minimum and maximum */
78588 #ifdef CONFIG_LOCKUP_DETECTOR
78589-static int sixty = 60;
78590-static int neg_one = -1;
78591+static int sixty __read_only = 60;
78592 #endif
78593
78594-static int zero;
78595-static int __maybe_unused one = 1;
78596-static int __maybe_unused two = 2;
78597-static int __maybe_unused three = 3;
78598-static unsigned long one_ul = 1;
78599-static int one_hundred = 100;
78600+static int neg_one __read_only = -1;
78601+static int zero __read_only = 0;
78602+static int __maybe_unused one __read_only = 1;
78603+static int __maybe_unused two __read_only = 2;
78604+static int __maybe_unused three __read_only = 3;
78605+static unsigned long one_ul __read_only = 1;
78606+static int one_hundred __read_only = 100;
78607 #ifdef CONFIG_PRINTK
78608-static int ten_thousand = 10000;
78609+static int ten_thousand __read_only = 10000;
78610 #endif
78611
78612 /* this is needed for the proc_doulongvec_minmax of vm_dirty_bytes */
78599@@ -178,10 +177,8 @@ static int proc_taint(struct ctl_table *table, int write, 78613@@ -178,10 +177,8 @@ static int proc_taint(struct ctl_table *table, int write,
78600 void __user *buffer, size_t *lenp, loff_t *ppos); 78614 void __user *buffer, size_t *lenp, loff_t *ppos);
78601 #endif 78615 #endif
@@ -78691,7 +78705,7 @@ index afc1dc6..5e28bbf 100644
78691 { 78705 {
78692 .procname = "ngroups_max", 78706 .procname = "ngroups_max",
78693 .data = &ngroups_max, 78707 .data = &ngroups_max,
78694@@ -1026,8 +1059,8 @@ static struct ctl_table kern_table[] = { 78708@@ -1026,10 +1059,17 @@ static struct ctl_table kern_table[] = {
78695 */ 78709 */
78696 { 78710 {
78697 .procname = "perf_event_paranoid", 78711 .procname = "perf_event_paranoid",
@@ -78700,9 +78714,19 @@ index afc1dc6..5e28bbf 100644
78700+ .data = &sysctl_perf_event_legitimately_concerned, 78714+ .data = &sysctl_perf_event_legitimately_concerned,
78701+ .maxlen = sizeof(sysctl_perf_event_legitimately_concerned), 78715+ .maxlen = sizeof(sysctl_perf_event_legitimately_concerned),
78702 .mode = 0644, 78716 .mode = 0644,
78703 .proc_handler = proc_dointvec, 78717- .proc_handler = proc_dointvec,
78718+ /* go ahead, be a hero */
78719+ .proc_handler = proc_dointvec_minmax_sysadmin,
78720+ .extra1 = &neg_one,
78721+#ifdef CONFIG_GRKERNSEC_PERF_HARDEN
78722+ .extra2 = &three,
78723+#else
78724+ .extra2 = &two,
78725+#endif
78704 }, 78726 },
78705@@ -1283,6 +1316,13 @@ static struct ctl_table vm_table[] = { 78727 {
78728 .procname = "perf_event_mlock_kb",
78729@@ -1283,6 +1323,13 @@ static struct ctl_table vm_table[] = {
78706 .proc_handler = proc_dointvec_minmax, 78730 .proc_handler = proc_dointvec_minmax,
78707 .extra1 = &zero, 78731 .extra1 = &zero,
78708 }, 78732 },
@@ -78716,7 +78740,7 @@ index afc1dc6..5e28bbf 100644
78716 #else 78740 #else
78717 { 78741 {
78718 .procname = "nr_trim_pages", 78742 .procname = "nr_trim_pages",
78719@@ -1733,6 +1773,16 @@ int proc_dostring(struct ctl_table *table, int write, 78743@@ -1733,6 +1780,16 @@ int proc_dostring(struct ctl_table *table, int write,
78720 buffer, lenp, ppos); 78744 buffer, lenp, ppos);
78721 } 78745 }
78722 78746
@@ -78733,7 +78757,7 @@ index afc1dc6..5e28bbf 100644
78733 static size_t proc_skip_spaces(char **buf) 78757 static size_t proc_skip_spaces(char **buf)
78734 { 78758 {
78735 size_t ret; 78759 size_t ret;
78736@@ -1838,6 +1888,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val, 78760@@ -1838,6 +1895,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
78737 len = strlen(tmp); 78761 len = strlen(tmp);
78738 if (len > *size) 78762 if (len > *size)
78739 len = *size; 78763 len = *size;
@@ -78742,7 +78766,7 @@ index afc1dc6..5e28bbf 100644
78742 if (copy_to_user(*buf, tmp, len)) 78766 if (copy_to_user(*buf, tmp, len))
78743 return -EFAULT; 78767 return -EFAULT;
78744 *size -= len; 78768 *size -= len;
78745@@ -2002,7 +2054,7 @@ int proc_dointvec(struct ctl_table *table, int write, 78769@@ -2002,7 +2061,7 @@ int proc_dointvec(struct ctl_table *table, int write,
78746 static int proc_taint(struct ctl_table *table, int write, 78770 static int proc_taint(struct ctl_table *table, int write,
78747 void __user *buffer, size_t *lenp, loff_t *ppos) 78771 void __user *buffer, size_t *lenp, loff_t *ppos)
78748 { 78772 {
@@ -78751,7 +78775,7 @@ index afc1dc6..5e28bbf 100644
78751 unsigned long tmptaint = get_taint(); 78775 unsigned long tmptaint = get_taint();
78752 int err; 78776 int err;
78753 78777
78754@@ -2030,7 +2082,6 @@ static int proc_taint(struct ctl_table *table, int write, 78778@@ -2030,7 +2089,6 @@ static int proc_taint(struct ctl_table *table, int write,
78755 return err; 78779 return err;
78756 } 78780 }
78757 78781
@@ -78759,7 +78783,7 @@ index afc1dc6..5e28bbf 100644
78759 static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write, 78783 static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
78760 void __user *buffer, size_t *lenp, loff_t *ppos) 78784 void __user *buffer, size_t *lenp, loff_t *ppos)
78761 { 78785 {
78762@@ -2039,7 +2090,6 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write, 78786@@ -2039,7 +2097,6 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
78763 78787
78764 return proc_dointvec_minmax(table, write, buffer, lenp, ppos); 78788 return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
78765 } 78789 }
@@ -78767,7 +78791,7 @@ index afc1dc6..5e28bbf 100644
78767 78791
78768 struct do_proc_dointvec_minmax_conv_param { 78792 struct do_proc_dointvec_minmax_conv_param {
78769 int *min; 78793 int *min;
78770@@ -2186,8 +2236,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int 78794@@ -2186,8 +2243,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
78771 *i = val; 78795 *i = val;
78772 } else { 78796 } else {
78773 val = convdiv * (*i) / convmul; 78797 val = convdiv * (*i) / convmul;
@@ -78780,7 +78804,7 @@ index afc1dc6..5e28bbf 100644
78780 err = proc_put_long(&buffer, &left, val, false); 78804 err = proc_put_long(&buffer, &left, val, false);
78781 if (err) 78805 if (err)
78782 break; 78806 break;
78783@@ -2579,6 +2632,12 @@ int proc_dostring(struct ctl_table *table, int write, 78807@@ -2579,6 +2639,12 @@ int proc_dostring(struct ctl_table *table, int write,
78784 return -ENOSYS; 78808 return -ENOSYS;
78785 } 78809 }
78786 78810
@@ -78793,7 +78817,7 @@ index afc1dc6..5e28bbf 100644
78793 int proc_dointvec(struct ctl_table *table, int write, 78817 int proc_dointvec(struct ctl_table *table, int write,
78794 void __user *buffer, size_t *lenp, loff_t *ppos) 78818 void __user *buffer, size_t *lenp, loff_t *ppos)
78795 { 78819 {
78796@@ -2635,5 +2694,6 @@ EXPORT_SYMBOL(proc_dointvec_minmax); 78820@@ -2635,5 +2701,6 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
78797 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies); 78821 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
78798 EXPORT_SYMBOL(proc_dointvec_ms_jiffies); 78822 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
78799 EXPORT_SYMBOL(proc_dostring); 78823 EXPORT_SYMBOL(proc_dostring);
@@ -80367,24 +80391,6 @@ index b32b70c..e512eb0 100644
80367 pkmap_count[last_pkmap_nr] = 1; 80391 pkmap_count[last_pkmap_nr] = 1;
80368 set_page_address(page, (void *)vaddr); 80392 set_page_address(page, (void *)vaddr);
80369 80393
80370diff --git a/mm/huge_memory.c b/mm/huge_memory.c
80371index e2f7f5aa..a4510d4 100644
80372--- a/mm/huge_memory.c
80373+++ b/mm/huge_memory.c
80374@@ -2318,7 +2318,12 @@ static void collapse_huge_page(struct mm_struct *mm,
80375 pte_unmap(pte);
80376 spin_lock(&mm->page_table_lock);
80377 BUG_ON(!pmd_none(*pmd));
80378- set_pmd_at(mm, address, pmd, _pmd);
80379+ /*
80380+ * We can only use set_pmd_at when establishing
80381+ * hugepmds and never for establishing regular pmds that
80382+ * points to regular pagetables. Use pmd_populate for that
80383+ */
80384+ pmd_populate(mm, pmd, pmd_pgtable(_pmd));
80385 spin_unlock(&mm->page_table_lock);
80386 anon_vma_unlock_write(vma->anon_vma);
80387 goto out;
80388diff --git a/mm/hugetlb.c b/mm/hugetlb.c 80394diff --git a/mm/hugetlb.c b/mm/hugetlb.c
80389index 1a12f5b..a85b8fc 100644 80395index 1a12f5b..a85b8fc 100644
80390--- a/mm/hugetlb.c 80396--- a/mm/hugetlb.c
@@ -81553,7 +81559,7 @@ index 7431001..0f8344e 100644
81553 capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE); 81559 capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE);
81554 81560
81555diff --git a/mm/migrate.c b/mm/migrate.c 81561diff --git a/mm/migrate.c b/mm/migrate.c
81556index 3bbaf5d..299b0e9 100644 81562index 22ed5c1..87c424c 100644
81557--- a/mm/migrate.c 81563--- a/mm/migrate.c
81558+++ b/mm/migrate.c 81564+++ b/mm/migrate.c
81559@@ -1382,8 +1382,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages, 81565@@ -1382,8 +1382,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
@@ -82849,133 +82855,6 @@ index 0dceed8..671951c 100644
82849 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND; 82855 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
82850 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags); 82856 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
82851 82857
82852diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c
82853index be04122..6725ff1 100644
82854--- a/mm/mmu_notifier.c
82855+++ b/mm/mmu_notifier.c
82856@@ -40,48 +40,44 @@ void __mmu_notifier_release(struct mm_struct *mm)
82857 int id;
82858
82859 /*
82860- * srcu_read_lock() here will block synchronize_srcu() in
82861- * mmu_notifier_unregister() until all registered
82862- * ->release() callouts this function makes have
82863- * returned.
82864+ * SRCU here will block mmu_notifier_unregister until
82865+ * ->release returns.
82866 */
82867 id = srcu_read_lock(&srcu);
82868+ hlist_for_each_entry_rcu(mn, &mm->mmu_notifier_mm->list, hlist)
82869+ /*
82870+ * If ->release runs before mmu_notifier_unregister it must be
82871+ * handled, as it's the only way for the driver to flush all
82872+ * existing sptes and stop the driver from establishing any more
82873+ * sptes before all the pages in the mm are freed.
82874+ */
82875+ if (mn->ops->release)
82876+ mn->ops->release(mn, mm);
82877+ srcu_read_unlock(&srcu, id);
82878+
82879 spin_lock(&mm->mmu_notifier_mm->lock);
82880 while (unlikely(!hlist_empty(&mm->mmu_notifier_mm->list))) {
82881 mn = hlist_entry(mm->mmu_notifier_mm->list.first,
82882 struct mmu_notifier,
82883 hlist);
82884-
82885 /*
82886- * Unlink. This will prevent mmu_notifier_unregister()
82887- * from also making the ->release() callout.
82888+ * We arrived before mmu_notifier_unregister so
82889+ * mmu_notifier_unregister will do nothing other than to wait
82890+ * for ->release to finish and for mmu_notifier_unregister to
82891+ * return.
82892 */
82893 hlist_del_init_rcu(&mn->hlist);
82894- spin_unlock(&mm->mmu_notifier_mm->lock);
82895-
82896- /*
82897- * Clear sptes. (see 'release' description in mmu_notifier.h)
82898- */
82899- if (mn->ops->release)
82900- mn->ops->release(mn, mm);
82901-
82902- spin_lock(&mm->mmu_notifier_mm->lock);
82903 }
82904 spin_unlock(&mm->mmu_notifier_mm->lock);
82905
82906 /*
82907- * All callouts to ->release() which we have done are complete.
82908- * Allow synchronize_srcu() in mmu_notifier_unregister() to complete
82909- */
82910- srcu_read_unlock(&srcu, id);
82911-
82912- /*
82913- * mmu_notifier_unregister() may have unlinked a notifier and may
82914- * still be calling out to it. Additionally, other notifiers
82915- * may have been active via vmtruncate() et. al. Block here
82916- * to ensure that all notifier callouts for this mm have been
82917- * completed and the sptes are really cleaned up before returning
82918- * to exit_mmap().
82919+ * synchronize_srcu here prevents mmu_notifier_release from returning to
82920+ * exit_mmap (which would proceed with freeing all pages in the mm)
82921+ * until the ->release method returns, if it was invoked by
82922+ * mmu_notifier_unregister.
82923+ *
82924+ * The mmu_notifier_mm can't go away from under us because one mm_count
82925+ * is held by exit_mmap.
82926 */
82927 synchronize_srcu(&srcu);
82928 }
82929@@ -292,31 +288,34 @@ void mmu_notifier_unregister(struct mmu_notifier *mn, struct mm_struct *mm)
82930 {
82931 BUG_ON(atomic_read(&mm->mm_count) <= 0);
82932
82933- spin_lock(&mm->mmu_notifier_mm->lock);
82934 if (!hlist_unhashed(&mn->hlist)) {
82935+ /*
82936+ * SRCU here will force exit_mmap to wait for ->release to
82937+ * finish before freeing the pages.
82938+ */
82939 int id;
82940
82941- /*
82942- * Ensure we synchronize up with __mmu_notifier_release().
82943- */
82944 id = srcu_read_lock(&srcu);
82945-
82946- hlist_del_rcu(&mn->hlist);
82947- spin_unlock(&mm->mmu_notifier_mm->lock);
82948-
82949- if (mn->ops->release)
82950- mn->ops->release(mn, mm);
82951-
82952 /*
82953- * Allow __mmu_notifier_release() to complete.
82954+ * exit_mmap will block in mmu_notifier_release to guarantee
82955+ * that ->release is called before freeing the pages.
82956 */
82957+ if (mn->ops->release)
82958+ mn->ops->release(mn, mm);
82959 srcu_read_unlock(&srcu, id);
82960- } else
82961+
82962+ spin_lock(&mm->mmu_notifier_mm->lock);
82963+ /*
82964+ * Can not use list_del_rcu() since __mmu_notifier_release
82965+ * can delete it before we hold the lock.
82966+ */
82967+ hlist_del_init_rcu(&mn->hlist);
82968 spin_unlock(&mm->mmu_notifier_mm->lock);
82969+ }
82970
82971 /*
82972- * Wait for any running method to finish, including ->release() if it
82973- * was run by __mmu_notifier_release() instead of us.
82974+ * Wait for any running method to finish, of course including
82975+ * ->release if it was run by mmu_notifier_relase instead of us.
82976 */
82977 synchronize_srcu(&srcu);
82978
82979diff --git a/mm/mprotect.c b/mm/mprotect.c 82858diff --git a/mm/mprotect.c b/mm/mprotect.c
82980index 94722a4..07d9926 100644 82859index 94722a4..07d9926 100644
82981--- a/mm/mprotect.c 82860--- a/mm/mprotect.c
@@ -87120,6 +86999,24 @@ index 960fd29..d55bf64 100644
87120 86999
87121 hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table); 87000 hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table);
87122 if (hdr == NULL) 87001 if (hdr == NULL)
87002diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
87003index e220207..cdeb839 100644
87004--- a/net/ipv4/tcp.c
87005+++ b/net/ipv4/tcp.c
87006@@ -3383,8 +3383,11 @@ int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *hp,
87007
87008 for (i = 0; i < shi->nr_frags; ++i) {
87009 const struct skb_frag_struct *f = &shi->frags[i];
87010- struct page *page = skb_frag_page(f);
87011- sg_set_page(&sg, page, skb_frag_size(f), f->page_offset);
87012+ unsigned int offset = f->page_offset;
87013+ struct page *page = skb_frag_page(f) + (offset >> PAGE_SHIFT);
87014+
87015+ sg_set_page(&sg, page, skb_frag_size(f),
87016+ offset_in_page(offset));
87017 if (crypto_hash_update(desc, &sg, skb_frag_size(f)))
87018 return 1;
87019 }
87123diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c 87020diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
87124index 13b9c08..d33a8d0 100644 87021index 13b9c08..d33a8d0 100644
87125--- a/net/ipv4/tcp_input.c 87022--- a/net/ipv4/tcp_input.c
@@ -87527,6 +87424,19 @@ index 95d13c7..791fe2f 100644
87527 .kind = "ip6gretap", 87424 .kind = "ip6gretap",
87528 .maxtype = IFLA_GRE_MAX, 87425 .maxtype = IFLA_GRE_MAX,
87529 .policy = ip6gre_policy, 87426 .policy = ip6gre_policy,
87427diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
87428index 155eccf..851fdae 100644
87429--- a/net/ipv6/ip6_output.c
87430+++ b/net/ipv6/ip6_output.c
87431@@ -1147,7 +1147,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
87432 if (WARN_ON(np->cork.opt))
87433 return -EINVAL;
87434
87435- np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
87436+ np->cork.opt = kzalloc(opt->tot_len, sk->sk_allocation);
87437 if (unlikely(np->cork.opt == NULL))
87438 return -ENOBUFS;
87439
87530diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c 87440diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
87531index fff83cb..82d49dd 100644 87441index fff83cb..82d49dd 100644
87532--- a/net/ipv6/ip6_tunnel.c 87442--- a/net/ipv6/ip6_tunnel.c
@@ -88061,6 +87971,19 @@ index 362ba47..66196f4 100644
88061 seq_printf(m, "Max data size: %d\n", self->max_data_size); 87971 seq_printf(m, "Max data size: %d\n", self->max_data_size);
88062 seq_printf(m, "Max header size: %d\n", self->max_header_size); 87972 seq_printf(m, "Max header size: %d\n", self->max_header_size);
88063 87973
87974diff --git a/net/irda/irlap_frame.c b/net/irda/irlap_frame.c
87975index 8c00416..9ea0c93 100644
87976--- a/net/irda/irlap_frame.c
87977+++ b/net/irda/irlap_frame.c
87978@@ -544,7 +544,7 @@ static void irlap_recv_discovery_xid_cmd(struct irlap_cb *self,
87979 /*
87980 * We now have some discovery info to deliver!
87981 */
87982- discovery = kmalloc(sizeof(discovery_t), GFP_ATOMIC);
87983+ discovery = kzalloc(sizeof(discovery_t), GFP_ATOMIC);
87984 if (!discovery) {
87985 IRDA_WARNING("%s: unable to malloc!\n", __func__);
87986 return;
88064diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c 87987diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
88065index 206ce6d..cfb27cd 100644 87988index 206ce6d..cfb27cd 100644
88066--- a/net/iucv/af_iucv.c 87989--- a/net/iucv/af_iucv.c
@@ -88163,7 +88086,7 @@ index 5672533..6738c93 100644
88163 /* number of interfaces with corresponding FIF_ flags */ 88086 /* number of interfaces with corresponding FIF_ flags */
88164 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll, 88087 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
88165diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c 88088diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
88166index d51ca9d..042c35f 100644 88089index 9cbebc2..14879bb 100644
88167--- a/net/mac80211/iface.c 88090--- a/net/mac80211/iface.c
88168+++ b/net/mac80211/iface.c 88091+++ b/net/mac80211/iface.c
88169@@ -495,7 +495,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up) 88092@@ -495,7 +495,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
@@ -89949,7 +89872,7 @@ index d5f35f1..da2680b5 100644
89949 task->tk_action = call_reserve; 89872 task->tk_action = call_reserve;
89950 } 89873 }
89951diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c 89874diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
89952index f8529fc..ce8c643 100644 89875index 5356b12..c0f4c29 100644
89953--- a/net/sunrpc/sched.c 89876--- a/net/sunrpc/sched.c
89954+++ b/net/sunrpc/sched.c 89877+++ b/net/sunrpc/sched.c
89955@@ -261,9 +261,9 @@ static int rpc_wait_bit_killable(void *word) 89878@@ -261,9 +261,9 @@ static int rpc_wait_bit_killable(void *word)
@@ -90413,6 +90336,18 @@ index c8717c1..08539f5 100644
90413 err = handler(dev, info, (union iwreq_data *) iwp, extra); 90336 err = handler(dev, info, (union iwreq_data *) iwp, extra);
90414 90337
90415 iwp->length += essid_compat; 90338 iwp->length += essid_compat;
90339diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
90340index bcfda89..0cf003d 100644
90341--- a/net/xfrm/xfrm_output.c
90342+++ b/net/xfrm/xfrm_output.c
90343@@ -64,6 +64,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
90344
90345 if (unlikely(x->km.state != XFRM_STATE_VALID)) {
90346 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID);
90347+ err = -EINVAL;
90348 goto error;
90349 }
90350
90416diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c 90351diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
90417index 167c67d..3f2ae427 100644 90352index 167c67d..3f2ae427 100644
90418--- a/net/xfrm/xfrm_policy.c 90353--- a/net/xfrm/xfrm_policy.c
diff --git a/main/linux-grsec/ipsec-xfrm-properly-handle-invalid-states-as-an-error.patch b/main/linux-grsec/ipsec-xfrm-properly-handle-invalid-states-as-an-error.patch
deleted file mode 100644
index 7cb0dade7c..0000000000
--- a/main/linux-grsec/ipsec-xfrm-properly-handle-invalid-states-as-an-error.patch
+++ /dev/null
@@ -1,44 +0,0 @@
1From patchwork Wed May 22 11:40:47 2013
2Content-Type: text/plain; charset="utf-8"
3MIME-Version: 1.0
4Content-Transfer-Encoding: 8bit
5Subject: [ipsec] xfrm: properly handle invalid states as an error
6Date: Wed, 22 May 2013 01:40:47 -0000
7From: =?utf-8?q?Timo_Ter=C3=A4s?= <timo.teras@iki.fi>
8X-Patchwork-Id: 245594
9Message-Id: <1369222847-8542-1-git-send-email-timo.teras@iki.fi>
10To: netdev@vger.kernel.org
11Cc: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>,
12 Li RongQing <roy.qing.li@gmail.com>,
13 Steffen Klassert <steffen.klassert@secunet.com>
14
15The error exit path needs err explicitly set. Otherwise it
16returns success and the only caller, xfrm_output_resume(),
17would oops in skb_dst(skb)->ops derefence as skb_dst(skb) is
18NULL.
19
20Bug introduced in commit bb65a9cb (xfrm: removes a superfluous
21check and add a statistic).
22
23Signed-off-by: Timo Teräs <timo.teras@iki.fi>
24Cc: Li RongQing <roy.qing.li@gmail.com>
25Cc: Steffen Klassert <steffen.klassert@secunet.com>
26
27---
28Should go also to 3.9-stable.
29
30 net/xfrm/xfrm_output.c | 1 +
31 1 file changed, 1 insertion(+)
32
33diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
34index bcfda89..0cf003d 100644
35--- a/net/xfrm/xfrm_output.c
36+++ b/net/xfrm/xfrm_output.c
37@@ -64,6 +64,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
38
39 if (unlikely(x->km.state != XFRM_STATE_VALID)) {
40 XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID);
41+ err = -EINVAL;
42 goto error;
43 }
44
diff --git a/main/linux-grsec/kernelconfig.x86 b/main/linux-grsec/kernelconfig.x86
index e7d4331a7f..5774d1f22d 100644
--- a/main/linux-grsec/kernelconfig.x86
+++ b/main/linux-grsec/kernelconfig.x86
@@ -1,6 +1,6 @@
1# 1#
2# Automatically generated file; DO NOT EDIT. 2# Automatically generated file; DO NOT EDIT.
3# Linux/x86 3.9.3 Kernel Configuration 3# Linux/x86 3.9.5 Kernel Configuration
4# 4#
5# CONFIG_64BIT is not set 5# CONFIG_64BIT is not set
6CONFIG_X86_32=y 6CONFIG_X86_32=y
@@ -5522,6 +5522,7 @@ CONFIG_PAX_USERCOPY=y
5522CONFIG_GRKERNSEC_KMEM=y 5522CONFIG_GRKERNSEC_KMEM=y
5523# CONFIG_GRKERNSEC_VM86 is not set 5523# CONFIG_GRKERNSEC_VM86 is not set
5524# CONFIG_GRKERNSEC_IO is not set 5524# CONFIG_GRKERNSEC_IO is not set
5525CONFIG_GRKERNSEC_PERF_HARDEN=y
5525CONFIG_GRKERNSEC_PROC_MEMMAP=y 5526CONFIG_GRKERNSEC_PROC_MEMMAP=y
5526# CONFIG_GRKERNSEC_BRUTE is not set 5527# CONFIG_GRKERNSEC_BRUTE is not set
5527# CONFIG_GRKERNSEC_MODHARDEN is not set 5528# CONFIG_GRKERNSEC_MODHARDEN is not set
diff --git a/main/linux-grsec/kernelconfig.x86_64 b/main/linux-grsec/kernelconfig.x86_64
index 561ab2088a..df9536d19f 100644
--- a/main/linux-grsec/kernelconfig.x86_64
+++ b/main/linux-grsec/kernelconfig.x86_64
@@ -1,6 +1,6 @@
1# 1#
2# Automatically generated file; DO NOT EDIT. 2# Automatically generated file; DO NOT EDIT.
3# Linux/x86 3.9.3 Kernel Configuration 3# Linux/x86 3.9.5 Kernel Configuration
4# 4#
5CONFIG_64BIT=y 5CONFIG_64BIT=y
6CONFIG_X86_64=y 6CONFIG_X86_64=y
@@ -5459,6 +5459,7 @@ CONFIG_PAX_USERCOPY=y
5459CONFIG_GRKERNSEC_KMEM=y 5459CONFIG_GRKERNSEC_KMEM=y
5460# CONFIG_GRKERNSEC_IO is not set 5460# CONFIG_GRKERNSEC_IO is not set
5461CONFIG_GRKERNSEC_JIT_HARDEN=y 5461CONFIG_GRKERNSEC_JIT_HARDEN=y
5462CONFIG_GRKERNSEC_PERF_HARDEN=y
5462CONFIG_GRKERNSEC_PROC_MEMMAP=y 5463CONFIG_GRKERNSEC_PROC_MEMMAP=y
5463# CONFIG_GRKERNSEC_BRUTE is not set 5464# CONFIG_GRKERNSEC_BRUTE is not set
5464# CONFIG_GRKERNSEC_MODHARDEN is not set 5465# CONFIG_GRKERNSEC_MODHARDEN is not set
diff --git a/main/linux-grsec/leds-leds-gpio-reserve-gpio-before-using-it.patch b/main/linux-grsec/leds-leds-gpio-reserve-gpio-before-using-it.patch
deleted file mode 100644
index f7af3b2a07..0000000000
--- a/main/linux-grsec/leds-leds-gpio-reserve-gpio-before-using-it.patch
+++ /dev/null
@@ -1,114 +0,0 @@
1From 37e3042c345024aa5e39a1a28a667a00b75fd6ce Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
3Date: Fri, 17 May 2013 09:31:13 +0300
4Subject: [PATCH] leds: leds-gpio: reserve gpio before using it
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9This reverts commit a99d76f (leds: leds-gpio: use gpio_request_one)
10and commit 2d7c22f (leds: leds-gpio: set devm_gpio_request_one()
11flags param correctly) which was a fix of the first one.
12
13The conversion to devm_gpio_request in commit e3b1d44c (leds:
14leds-gpio: use devm_gpio_request_one) is not reverted.
15
16The problem is that gpio_cansleep() and gpio_get_value_cansleep()
17calls can crash if the gpio is not first reserved. Incidentally this
18same bug existed earlier and was fixed similarly in commit d95cbe61
19(leds: Fix potential leds-gpio oops). But the OOPS is real. It happens
20when GPIOs are provided by module which is not yet loaded.
21
22So this fixes the following BUG during my ALIX boot (3.9.2-vanilla):
23
24BUG: unable to handle kernel NULL pointer dereference at 0000004c
25IP: [<c11287d6>] __gpio_cansleep+0xe/0x1a
26*pde = 00000000
27Oops: 0000 [#1] SMP
28Modules linked in: leds_gpio(+) via_rhine mii cs5535_mfd mfd_core
29geode_rng rng_core geode_aes isofs nls_utf8 nls_cp437 vfat fat
30ata_generic pata_amd pata_cs5536 pata_acpi libata ehci_pci ehci_hcd
31ohci_hcd usb_storage usbcore usb_common sd_mod scsi_mod squashfs loop
32Pid: 881, comm: modprobe Not tainted 3.9.2 #1-Alpine
33EIP: 0060:[<c11287d6>] EFLAGS: 00010282 CPU: 0
34EIP is at __gpio_cansleep+0xe/0x1a
35EAX: 00000000 EBX: cf364018 ECX: c132b8b9 EDX: 00000000
36ESI: c13993a4 EDI: c1399370 EBP: cded9dbc ESP: cded9dbc
37 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
38CR0: 8005003b CR2: 0000004c CR3: 0f0c4000 CR4: 00000090
39DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
40DR6: ffff0ff0 DR7: 00000400
41Process modprobe (pid: 881, ti=cded8000 task=cf094aa0 task.ti=cded8000)
42Stack:
43 cded9de0 d09471cb 00000000 c1399260 cf364014 00000000 c1399260 c1399254
44 d0949014 cded9df4 c118cd59 c1399260 d0949014 d0949014 cded9e08 c118ba47
45 c1399260 d0949014 c1399294 cded9e1c c118bb75 cded9e24 d0949014 00000000
46Call Trace:
47 [<d09471cb>] gpio_led_probe+0xba/0x203 [leds_gpio]
48 [<c118cd59>] platform_drv_probe+0x26/0x48
49 [<c118ba47>] driver_probe_device+0x75/0x15c
50 [<c118bb75>] __driver_attach+0x47/0x63
51 [<c118a727>] bus_for_each_dev+0x3c/0x66
52 [<c118b6f9>] driver_attach+0x14/0x16
53 [<c118bb2e>] ? driver_probe_device+0x15c/0x15c
54 [<c118b3d5>] bus_add_driver+0xbd/0x1bc
55 [<d08b4000>] ? 0xd08b3fff
56 [<d08b4000>] ? 0xd08b3fff
57 [<c118bffc>] driver_register+0x74/0xec
58 [<d08b4000>] ? 0xd08b3fff
59 [<c118c8e8>] platform_driver_register+0x38/0x3a
60 [<d08b400d>] gpio_led_driver_init+0xd/0x1000 [leds_gpio]
61 [<c100116c>] do_one_initcall+0x6b/0x10f
62 [<d08b4000>] ? 0xd08b3fff
63 [<c105e918>] load_module+0x1631/0x1907
64 [<c10975d6>] ? insert_vmalloc_vmlist+0x14/0x43
65 [<c1098d5b>] ? __vmalloc_node_range+0x13e/0x15f
66 [<c105ec50>] sys_init_module+0x62/0x77
67 [<c1257888>] syscall_call+0x7/0xb
68EIP: [<c11287d6>] __gpio_cansleep+0xe/0x1a SS:ESP 0068:cded9dbc
69CR2: 000000000000004c
70 ---[ end trace 5308fb20d2514822 ]---
71
72Signed-off-by: Timo Teräs <timo.teras@iki.f>
73Cc: Jingoo Han <jg1.han@samsung.com>
74Cc: Sachin Kamat <sachin.kamat@linaro.org>
75Cc: Raphael Assenat <raph@8d.com>
76Cc: Trent Piepho <tpiepho@freescale.com>
77Cc: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
78Cc: Arnaud Patard <arnaud.patard@rtp-net.org>
79Cc: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
80---
81 drivers/leds/leds-gpio.c | 9 +++++----
82 1 file changed, 5 insertions(+), 4 deletions(-)
83
84diff --git a/drivers/leds/leds-gpio.c b/drivers/leds/leds-gpio.c
85index a0d931b..b02b679 100644
86--- a/drivers/leds/leds-gpio.c
87+++ b/drivers/leds/leds-gpio.c
88@@ -107,6 +107,10 @@ static int create_gpio_led(const struct gpio_led *template,
89 return 0;
90 }
91
92+ ret = devm_gpio_request(parent, template->gpio, template->name);
93+ if (ret < 0)
94+ return ret;
95+
96 led_dat->cdev.name = template->name;
97 led_dat->cdev.default_trigger = template->default_trigger;
98 led_dat->gpio = template->gpio;
99@@ -126,10 +130,7 @@ static int create_gpio_led(const struct gpio_led *template,
100 if (!template->retain_state_suspended)
101 led_dat->cdev.flags |= LED_CORE_SUSPENDRESUME;
102
103- ret = devm_gpio_request_one(parent, template->gpio,
104- (led_dat->active_low ^ state) ?
105- GPIOF_OUT_INIT_HIGH : GPIOF_OUT_INIT_LOW,
106- template->name);
107+ ret = gpio_direction_output(led_dat->gpio, led_dat->active_low ^ state);
108 if (ret < 0)
109 return ret;
110
111--
1121.8.2.3
113
114
© 2015 Mike Crute