commit: 84816979647ebca555792f0968420bff368915e4
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 7 16:01:44 2015 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Jan 7 16:01:44 2015 +0000
URL:
http://sources.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=84816979
Grsec/PaX: 3.0-{3.2.66,3.14.27,3.18.1}-201501042021
---
3.14.27/0000_README | 2 +-
...4420_grsecurity-3.0-3.14.27-201501042018.patch} | 829 ++++++++++++-
3.18.1/0000_README | 2 +-
... 4420_grsecurity-3.0-3.18.1-201501042021.patch} | 556 +++++++--
3.2.66/0000_README | 2 +-
... 4420_grsecurity-3.0-3.2.66-201501051839.patch} | 1306 ++++++++++++++++----
6 files changed, 2328 insertions(+), 369 deletions(-)
diff --git a/3.14.27/0000_README b/3.14.27/0000_README
index 677dcac..c7d2136 100644
--- a/3.14.27/0000_README
+++ b/3.14.27/0000_README
@@ -2,7 +2,7 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 4420_grsecurity-3.0-3.14.27-201412280859.patch
+Patch: 4420_grsecurity-3.0-3.14.27-201501042018.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.14.27/4420_grsecurity-3.0-3.14.27-201412280859.patch
b/3.14.27/4420_grsecurity-3.0-3.14.27-201501042018.patch
similarity index 99%
rename from 3.14.27/4420_grsecurity-3.0-3.14.27-201412280859.patch
rename to 3.14.27/4420_grsecurity-3.0-3.14.27-201501042018.patch
index 55abedd..c044d35 100644
--- a/3.14.27/4420_grsecurity-3.0-3.14.27-201412280859.patch
+++ b/3.14.27/4420_grsecurity-3.0-3.14.27-201501042018.patch
@@ -23058,7 +23058,7 @@ index c5a9cb9..228d280 100644
/*
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
-index 02553d6..54e9bd5 100644
+index 02553d6..d1fcecb 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -60,6 +60,8 @@
@@ -24015,6 +24015,27 @@ index 02553d6..54e9bd5 100644
/*
* The iretq could re-enable interrupts:
*/
+@@ -1070,15 +1566,15 @@ native_irq_return_ldt:
+ SWAPGS
+ movq PER_CPU_VAR(espfix_waddr),%rdi
+ movq %rax,(0*8)(%rdi) /* RAX */
+- movq (2*8)(%rsp),%rax /* RIP */
++ movq (2*8 + RIP-RIP)(%rsp),%rax /* RIP */
+ movq %rax,(1*8)(%rdi)
+- movq (3*8)(%rsp),%rax /* CS */
++ movq (2*8 + CS-RIP)(%rsp),%rax /* CS */
+ movq %rax,(2*8)(%rdi)
+- movq (4*8)(%rsp),%rax /* RFLAGS */
++ movq (2*8 + EFLAGS-RIP)(%rsp),%rax /* RFLAGS */
+ movq %rax,(3*8)(%rdi)
+- movq (6*8)(%rsp),%rax /* SS */
++ movq (2*8 + SS-RIP)(%rsp),%rax /* SS */
+ movq %rax,(5*8)(%rdi)
+- movq (5*8)(%rsp),%rax /* RSP */
++ movq (2*8 + RSP-RIP)(%rsp),%rax /* RSP */
+ movq %rax,(4*8)(%rdi)
+ andl $0xffff0000,%eax
+ popq_cfi %rdi
@@ -1132,7 +1628,7 @@ ENTRY(retint_kernel)
jmp exit_intr
#endif
@@ -26400,26 +26421,30 @@ index 1b10af8..45bfbec 100644
EXPORT_SYMBOL_GPL(pv_time_ops);
diff --git a/arch/x86/kernel/paravirt_patch_64.c
b/arch/x86/kernel/paravirt_patch_64.c
-index a1da673..2c72d5b 100644
+index a1da673..b6f5831 100644
--- a/arch/x86/kernel/paravirt_patch_64.c
+++ b/arch/x86/kernel/paravirt_patch_64.c
-@@ -9,7 +9,9 @@ DEF_NATIVE(pv_irq_ops, save_fl, "pushfq; popq %rax");
+@@ -9,7 +9,11 @@ DEF_NATIVE(pv_irq_ops, save_fl, "pushfq; popq %rax");
DEF_NATIVE(pv_mmu_ops, read_cr2, "movq %cr2, %rax");
DEF_NATIVE(pv_mmu_ops, read_cr3, "movq %cr3, %rax");
DEF_NATIVE(pv_mmu_ops, write_cr3, "movq %rdi, %cr3");
++
+#ifndef CONFIG_PAX_MEMORY_UDEREF
DEF_NATIVE(pv_mmu_ops, flush_tlb_single, "invlpg (%rdi)");
+#endif
++
DEF_NATIVE(pv_cpu_ops, clts, "clts");
DEF_NATIVE(pv_cpu_ops, wbinvd, "wbinvd");
-@@ -57,7 +59,9 @@ unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
+@@ -57,7 +61,11 @@ unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
PATCH_SITE(pv_mmu_ops, read_cr3);
PATCH_SITE(pv_mmu_ops, write_cr3);
PATCH_SITE(pv_cpu_ops, clts);
++
+#ifndef CONFIG_PAX_MEMORY_UDEREF
PATCH_SITE(pv_mmu_ops, flush_tlb_single);
+#endif
++
PATCH_SITE(pv_cpu_ops, wbinvd);
patch_site:
@@ -27966,7 +27991,7 @@ index 1c113db..287b42e 100644
static int trace_irq_vector_refcount;
static DEFINE_MUTEX(irq_vector_mutex);
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
-index f9d976e..3b48355 100644
+index f9d976e..488b635 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -66,7 +66,7 @@
@@ -28111,7 +28136,16 @@ index f9d976e..3b48355 100644
tsk->thread.error_code = error_code;
tsk->thread.trap_nr = X86_TRAP_GP;
-@@ -410,7 +451,7 @@ struct bad_iret_stack *fixup_bad_iret(struct
bad_iret_stack *s)
+@@ -404,13 +445,16 @@ struct bad_iret_stack *fixup_bad_iret(struct
bad_iret_stack *s)
+ container_of(task_pt_regs(current),
+ struct bad_iret_stack, regs);
+
++ if ((current->thread.sp0 ^ (unsigned long)s) < THREAD_SIZE)
++ new_stack = s;
++
+ /* Copy the IRET target to the new stack. */
+ memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8);
+
/* Copy the remainder of the stack from the current stack. */
memmove(new_stack, s, offsetof(struct bad_iret_stack, regs.ip));
@@ -28120,7 +28154,7 @@ index f9d976e..3b48355 100644
return new_stack;
}
#endif
-@@ -490,7 +531,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs
*regs, long error_code)
+@@ -490,7 +534,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs
*regs, long error_code)
/* It's safe to allow irq's after DR6 has been saved */
preempt_conditional_sti(regs);
@@ -28129,7 +28163,7 @@ index f9d976e..3b48355 100644
handle_vm86_trap((struct kernel_vm86_regs *) regs, error_code,
X86_TRAP_DB);
preempt_conditional_cli(regs);
-@@ -505,7 +546,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs
*regs, long error_code)
+@@ -505,7 +549,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs
*regs, long error_code)
* We already checked v86 mode above, so we can check for kernel mode
* by just checking the CPL of CS.
*/
@@ -28138,7 +28172,7 @@ index f9d976e..3b48355 100644
tsk->thread.debugreg6 &= ~DR_STEP;
set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
regs->flags &= ~X86_EFLAGS_TF;
-@@ -537,7 +578,7 @@ void math_error(struct pt_regs *regs, int error_code, int
trapnr)
+@@ -537,7 +581,7 @@ void math_error(struct pt_regs *regs, int error_code, int
trapnr)
return;
conditional_sti(regs);
@@ -28733,9 +28767,18 @@ index c697625..a032162 100644
out:
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index 38d3751..e6fcffb 100644
+index 38d3751..1702329 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
+@@ -3401,7 +3401,7 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
+ int cr = ctxt->modrm_reg;
+ u64 efer = 0;
+
+- static u64 cr_reserved_bits[] = {
++ static const u64 cr_reserved_bits[] = {
+ 0xffffffff00000000ULL,
+ 0, 0, 0, /* CR3 checked later */
+ CR4_RESERVED_BITS,
@@ -3436,7 +3436,7 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
@@ -53179,7 +53222,7 @@ index 9cd706d..6ff2de7 100644
if (cfg->uart_flags & UPF_CONS_FLOW) {
diff --git a/drivers/tty/serial/serial_core.c
b/drivers/tty/serial/serial_core.c
-index 27b5554..8131d9d 100644
+index 27b5554..3075055 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1451,7 +1451,7 @@ static void uart_hangup(struct tty_struct *tty)
@@ -53214,7 +53257,7 @@ index 27b5554..8131d9d 100644
return retval;
err_dec_count:
- port->count--;
-+ atomic_inc(&port->count);
++ atomic_dec(&port->count);
mutex_unlock(&port->mutex);
goto end;
}
@@ -63644,7 +63687,7 @@ index e846a32..bb06bd0 100644
return res;
}
diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
-index f488bba..bb63254 100644
+index f488bba..735d752 100644
--- a/fs/isofs/rock.c
+++ b/fs/isofs/rock.c
@@ -30,6 +30,7 @@ struct rock_state {
@@ -63674,6 +63717,16 @@ index f488bba..bb63254 100644
bh = sb_bread(rs->inode->i_sb, rs->cont_extent);
if (bh) {
memcpy(rs->buffer, bh->b_data + rs->cont_offset,
+@@ -356,6 +362,9 @@ repeat:
+ rs.cont_size = isonum_733(rr->u.CE.size);
+ break;
+ case SIG('E', 'R'):
++ /* Invalid length of ER tag id? */
++ if (rr->u.ER.len_id + offsetof(struct rock_ridge,
u.ER.data) > rr->len)
++ goto out;
+ ISOFS_SB(inode->i_sb)->s_rock = 1;
+ printk(KERN_DEBUG "ISO 9660 Extensions: ");
+ {
diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
index 4a6cf28..d3a29d3 100644
--- a/fs/jffs2/erase.c
@@ -63716,7 +63769,7 @@ index e2b7483..855bca3 100644
if (jfs_inode_cachep == NULL)
return -ENOMEM;
diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
-index 39c0143..d54fad4 100644
+index 39c0143..829bfe5 100644
--- a/fs/kernfs/dir.c
+++ b/fs/kernfs/dir.c
@@ -28,7 +28,7 @@ DEFINE_MUTEX(kernfs_mutex);
@@ -63728,6 +63781,25 @@ index 39c0143..d54fad4 100644
{
unsigned long hash = init_name_hash();
unsigned int len = strlen(name);
+@@ -729,11 +729,17 @@ static int kernfs_iop_mkdir(struct inode *dir, struct
dentry *dentry,
+ {
+ struct kernfs_node *parent = dir->i_private;
+ struct kernfs_dir_ops *kdops = kernfs_root(parent)->dir_ops;
++ int ret;
+
+ if (!kdops || !kdops->mkdir)
+ return -EPERM;
+
+- return kdops->mkdir(parent, dentry->d_name.name, mode);
++ ret = kdops->mkdir(parent, dentry->d_name.name, mode);
++
++ if (!ret)
++ ret = kernfs_iop_lookup(dir, dentry, 0);
++
++ return ret;
+ }
+
+ static int kernfs_iop_rmdir(struct inode *dir, struct dentry *dentry)
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index d29640b..32d2b6b 100644
--- a/fs/kernfs/file.c
@@ -67904,8 +67976,22 @@ index e18b988..f1d4ad0f 100644
{
int err;
+diff --git a/fs/udf/dir.c b/fs/udf/dir.c
+index a012c51..a7690b4 100644
+--- a/fs/udf/dir.c
++++ b/fs/udf/dir.c
+@@ -167,7 +167,8 @@ static int udf_readdir(struct file *file, struct
dir_context *ctx)
+ continue;
+ }
+
+- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
++ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
++ UDF_NAME_LEN);
+ if (!flen)
+ continue;
+
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
-index 287cd5f..c693331 100644
+index 287cd5f..5252259 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -51,7 +51,6 @@ MODULE_LICENSE("GPL");
@@ -67916,7 +68002,12 @@ index 287cd5f..c693331 100644
static int udf_sync_inode(struct inode *inode);
static int udf_alloc_i_data(struct inode *inode, size_t size);
static sector_t inode_getblk(struct inode *, sector_t, int *, int *);
-@@ -1282,8 +1281,11 @@ static void __udf_read_inode(struct inode *inode)
+@@ -1278,15 +1277,27 @@ update_time:
+ */
+ #define UDF_MAX_ICB_NESTING 1024
+
+-static void __udf_read_inode(struct inode *inode)
++static int udf_read_inode(struct inode *inode)
{
struct buffer_head *bh = NULL;
struct fileEntry *fe;
@@ -67924,11 +68015,43 @@ index 287cd5f..c693331 100644
uint16_t ident;
struct udf_inode_info *iinfo = UDF_I(inode);
+ struct udf_sb_info *sbi = UDF_SB(inode->i_sb);
++ struct kernel_lb_addr *iloc = &iinfo->i_location;
+ unsigned int link_count;
unsigned int indirections = 0;
++ int ret = -EIO;
reread:
-@@ -1316,6 +1318,7 @@ reread:
++ if (iloc->logicalBlockNum >=
++ sbi->s_partmaps[iloc->partitionReferenceNum].s_partition_len) {
++ udf_debug("block=%d, partition=%d out of range\n",
++ iloc->logicalBlockNum, iloc->partitionReferenceNum);
++ return -EIO;
++ }
++
+ /*
+ * Set defaults, but the inode is still incomplete!
+ * Note: get_new_inode() sets the following on a new inode:
+@@ -1299,29 +1310,26 @@ reread:
+ * i_nlink = 1
+ * i_op = NULL;
+ */
+- bh = udf_read_ptagged(inode->i_sb, &iinfo->i_location, 0, &ident);
++ bh = udf_read_ptagged(inode->i_sb, iloc, 0, &ident);
+ if (!bh) {
+ udf_err(inode->i_sb, "(ino %ld) failed !bh\n", inode->i_ino);
+- make_bad_inode(inode);
+- return;
++ return -EIO;
+ }
+
+ if (ident != TAG_IDENT_FE && ident != TAG_IDENT_EFE &&
+ ident != TAG_IDENT_USE) {
+ udf_err(inode->i_sb, "(ino %ld) failed ident=%d\n",
+ inode->i_ino, ident);
+- brelse(bh);
+- make_bad_inode(inode);
+- return;
++ goto out;
}
fe = (struct fileEntry *)bh->b_data;
@@ -67936,9 +68059,41 @@ index 287cd5f..c693331 100644
if (fe->icbTag.strategyType == cpu_to_le16(4096)) {
struct buffer_head *ibh;
-@@ -1353,22 +1356,6 @@ reread:
- make_bad_inode(inode);
- return;
+
+- ibh = udf_read_ptagged(inode->i_sb, &iinfo->i_location, 1,
+- &ident);
++ ibh = udf_read_ptagged(inode->i_sb, iloc, 1, &ident);
+ if (ident == TAG_IDENT_IE && ibh) {
+ struct kernel_lb_addr loc;
+ struct indirectEntry *ie;
+@@ -1330,7 +1338,6 @@ reread:
+ loc = lelb_to_cpu(ie->indirectICB.extLocation);
+
+ if (ie->indirectICB.extLength) {
+- brelse(bh);
+ brelse(ibh);
+ memcpy(&iinfo->i_location, &loc,
+ sizeof(struct kernel_lb_addr));
+@@ -1339,9 +1346,9 @@ reread:
+ "too many ICBs in ICB hierarchy"
+ " (max %d supported)\n",
+ UDF_MAX_ICB_NESTING);
+- make_bad_inode(inode);
+- return;
++ goto out;
+ }
++ brelse(bh);
+ goto reread;
+ }
+ }
+@@ -1349,26 +1356,8 @@ reread:
+ } else if (fe->icbTag.strategyType != cpu_to_le16(4)) {
+ udf_err(inode->i_sb, "unsupported strategy type: %d\n",
+ le16_to_cpu(fe->icbTag.strategyType));
+- brelse(bh);
+- make_bad_inode(inode);
+- return;
++ goto out;
}
- udf_fill_inode(inode, bh);
-
@@ -67959,15 +68114,109 @@ index 287cd5f..c693331 100644
if (fe->icbTag.strategyType == cpu_to_le16(4))
iinfo->i_strat4096 = 0;
else /* if (fe->icbTag.strategyType == cpu_to_le16(4096)) */
-@@ -1558,6 +1545,7 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
+@@ -1385,11 +1374,10 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
+ if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_EFE)) {
+ iinfo->i_efe = 1;
+ iinfo->i_use = 0;
+- if (udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
+- sizeof(struct extendedFileEntry))) {
+- make_bad_inode(inode);
+- return;
+- }
++ ret = udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
++ sizeof(struct extendedFileEntry));
++ if (ret)
++ goto out;
+ memcpy(iinfo->i_ext.i_data,
+ bh->b_data + sizeof(struct extendedFileEntry),
+ inode->i_sb->s_blocksize -
+@@ -1397,11 +1385,10 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
+ } else if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_FE)) {
+ iinfo->i_efe = 0;
+ iinfo->i_use = 0;
+- if (udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
+- sizeof(struct fileEntry))) {
+- make_bad_inode(inode);
+- return;
+- }
++ ret = udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
++ sizeof(struct fileEntry));
++ if (ret)
++ goto out;
+ memcpy(iinfo->i_ext.i_data,
+ bh->b_data + sizeof(struct fileEntry),
+ inode->i_sb->s_blocksize - sizeof(struct fileEntry));
+@@ -1411,18 +1398,18 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
+ iinfo->i_lenAlloc = le32_to_cpu(
+ ((struct unallocSpaceEntry *)bh->b_data)->
+ lengthAllocDescs);
+- if (udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
+- sizeof(struct unallocSpaceEntry))) {
+- make_bad_inode(inode);
+- return;
+- }
++ ret = udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
++ sizeof(struct unallocSpaceEntry));
++ if (ret)
++ goto out;
+ memcpy(iinfo->i_ext.i_data,
+ bh->b_data + sizeof(struct unallocSpaceEntry),
+ inode->i_sb->s_blocksize -
+ sizeof(struct unallocSpaceEntry));
+- return;
++ return 0;
+ }
+
++ ret = -EIO;
+ read_lock(&sbi->s_cred_lock);
+ i_uid_write(inode, le32_to_cpu(fe->uid));
+ if (!uid_valid(inode->i_uid) ||
+@@ -1496,6 +1483,20 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
+ iinfo->i_checkpoint = le32_to_cpu(efe->checkpoint);
+ }
+
++ /* Sanity checks for files in ICB so that we don't get confused later */
++ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
++ /*
++ * For file in ICB data is stored in allocation descriptor
++ * so sizes should match
++ */
++ if (iinfo->i_lenAlloc != inode->i_size)
++ goto out;
++ /* File in ICB has to fit in there... */
++ if (inode->i_size > inode->i_sb->s_blocksize -
++ udf_file_entry_alloc_offset(inode))
++ goto out;
++ }
++
+ switch (fe->icbTag.fileType) {
+ case ICBTAG_FILE_TYPE_DIRECTORY:
+ inode->i_op = &udf_dir_inode_operations;
+@@ -1544,8 +1545,7 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
+ default:
+ udf_err(inode->i_sb, "(ino %ld) failed unknown file type=%d\n",
+ inode->i_ino, fe->icbTag.fileType);
+- make_bad_inode(inode);
+- return;
++ goto out;
+ }
+ if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode)) {
+ struct deviceSpec *dsea =
+@@ -1556,8 +1556,12 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
+ le32_to_cpu(dsea->minorDeviceIdent)));
+ /* Developer ID ??? */
} else
- make_bad_inode(inode);
+- make_bad_inode(inode);
++ goto out;
}
++ ret = 0;
++out:
+ brelse(bh);
++ return ret;
}
static int udf_alloc_i_data(struct inode *inode, size_t size)
-@@ -1671,7 +1659,7 @@ static int udf_update_inode(struct inode *inode, int
do_sync)
+@@ -1671,7 +1675,7 @@ static int udf_update_inode(struct inode *inode, int
do_sync)
FE_PERM_U_DELETE | FE_PERM_U_CHATTR));
fe->permissions = cpu_to_le32(udfperms);
@@ -67976,6 +68225,49 @@ index 287cd5f..c693331 100644
fe->fileLinkCount = cpu_to_le16(inode->i_nlink - 1);
else
fe->fileLinkCount = cpu_to_le16(inode->i_nlink);
+@@ -1837,32 +1841,23 @@ struct inode *udf_iget(struct super_block *sb, struct
kernel_lb_addr *ino)
+ {
+ unsigned long block = udf_get_lb_pblock(sb, ino, 0);
+ struct inode *inode = iget_locked(sb, block);
++ int err;
+
+ if (!inode)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+
+- if (inode->i_state & I_NEW) {
+- memcpy(&UDF_I(inode)->i_location, ino, sizeof(struct
kernel_lb_addr));
+- __udf_read_inode(inode);
+- unlock_new_inode(inode);
+- }
+-
+- if (is_bad_inode(inode))
+- goto out_iput;
++ if (!(inode->i_state & I_NEW))
++ return inode;
+
+- if (ino->logicalBlockNum >= UDF_SB(sb)->
+- s_partmaps[ino->partitionReferenceNum].s_partition_len)
{
+- udf_debug("block=%d, partition=%d out of range\n",
+- ino->logicalBlockNum, ino->partitionReferenceNum);
+- make_bad_inode(inode);
+- goto out_iput;
++ memcpy(&UDF_I(inode)->i_location, ino, sizeof(struct kernel_lb_addr));
++ err = udf_read_inode(inode);
++ if (err < 0) {
++ iget_failed(inode);
++ return ERR_PTR(err);
+ }
++ unlock_new_inode(inode);
+
+ return inode;
+-
+- out_iput:
+- iput(inode);
+- return NULL;
+ }
+
+ int udf_add_aext(struct inode *inode, struct extent_position *epos,
diff --git a/fs/udf/misc.c b/fs/udf/misc.c
index c175b4d..8f36a16 100644
--- a/fs/udf/misc.c
@@ -67989,6 +68281,486 @@ index c175b4d..8f36a16 100644
u8 checksum = 0;
int i;
for (i = 0; i < sizeof(struct tag); ++i)
+diff --git a/fs/udf/namei.c b/fs/udf/namei.c
+index 9737cba..e5ae1c3 100644
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -233,7 +233,8 @@ static struct fileIdentDesc *udf_find_entry(struct inode
*dir,
+ if (!lfi)
+ continue;
+
+- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
++ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
++ UDF_NAME_LEN);
+ if (flen && udf_match(flen, fname, child->len, child->name))
+ goto out_ok;
+ }
+@@ -270,9 +271,8 @@ static struct dentry *udf_lookup(struct inode *dir, struct
dentry *dentry,
+ NULL, 0),
+ };
+ inode = udf_iget(dir->i_sb, lb);
+- if (!inode) {
+- return ERR_PTR(-EACCES);
+- }
++ if (IS_ERR(inode))
++ return inode;
+ } else
+ #endif /* UDF_RECOVERY */
+
+@@ -285,9 +285,8 @@ static struct dentry *udf_lookup(struct inode *dir, struct
dentry *dentry,
+
+ loc = lelb_to_cpu(cfi.icb.extLocation);
+ inode = udf_iget(dir->i_sb, &loc);
+- if (!inode) {
+- return ERR_PTR(-EACCES);
+- }
++ if (IS_ERR(inode))
++ return ERR_CAST(inode);
+ }
+
+ return d_splice_alias(inode, dentry);
+@@ -1221,7 +1220,7 @@ static struct dentry *udf_get_parent(struct dentry
*child)
+ struct udf_fileident_bh fibh;
+
+ if (!udf_find_entry(child->d_inode, &dotdot, &fibh, &cfi))
+- goto out_unlock;
++ return ERR_PTR(-EACCES);
+
+ if (fibh.sbh != fibh.ebh)
+ brelse(fibh.ebh);
+@@ -1229,12 +1228,10 @@ static struct dentry *udf_get_parent(struct dentry
*child)
+
+ tloc = lelb_to_cpu(cfi.icb.extLocation);
+ inode = udf_iget(child->d_inode->i_sb, &tloc);
+- if (!inode)
+- goto out_unlock;
++ if (IS_ERR(inode))
++ return ERR_CAST(inode);
+
+ return d_obtain_alias(inode);
+-out_unlock:
+- return ERR_PTR(-EACCES);
+ }
+
+
+@@ -1251,8 +1248,8 @@ static struct dentry *udf_nfs_get_inode(struct
super_block *sb, u32 block,
+ loc.partitionReferenceNum = partref;
+ inode = udf_iget(sb, &loc);
+
+- if (inode == NULL)
+- return ERR_PTR(-ENOMEM);
++ if (IS_ERR(inode))
++ return ERR_CAST(inode);
+
+ if (generation && inode->i_generation != generation) {
+ iput(inode);
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 3306b9f..a1e0eda 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -956,12 +956,14 @@ struct inode *udf_find_metadata_inode_efe(struct
super_block *sb,
+
+ metadata_fe = udf_iget(sb, &addr);
+
+- if (metadata_fe == NULL)
++ if (IS_ERR(metadata_fe)) {
+ udf_warn(sb, "metadata inode efe not found\n");
+- else if (UDF_I(metadata_fe)->i_alloc_type != ICBTAG_FLAG_AD_SHORT) {
++ return metadata_fe;
++ }
++ if (UDF_I(metadata_fe)->i_alloc_type != ICBTAG_FLAG_AD_SHORT) {
+ udf_warn(sb, "metadata inode efe does not have short allocation
descriptors!\n");
+ iput(metadata_fe);
+- metadata_fe = NULL;
++ return ERR_PTR(-EIO);
+ }
+
+ return metadata_fe;
+@@ -973,6 +975,7 @@ static int udf_load_metadata_files(struct super_block *sb,
int partition)
+ struct udf_part_map *map;
+ struct udf_meta_data *mdata;
+ struct kernel_lb_addr addr;
++ struct inode *fe;
+
+ map = &sbi->s_partmaps[partition];
+ mdata = &map->s_type_specific.s_metadata;
+@@ -981,22 +984,24 @@ static int udf_load_metadata_files(struct super_block
*sb, int partition)
+ udf_debug("Metadata file location: block = %d part = %d\n",
+ mdata->s_meta_file_loc, map->s_partition_num);
+
+- mdata->s_metadata_fe = udf_find_metadata_inode_efe(sb,
+- mdata->s_meta_file_loc, map->s_partition_num);
+-
+- if (mdata->s_metadata_fe == NULL) {
++ fe = udf_find_metadata_inode_efe(sb, mdata->s_meta_file_loc,
++ map->s_partition_num);
++ if (IS_ERR(fe)) {
+ /* mirror file entry */
+ udf_debug("Mirror metadata file location: block = %d part =
%d\n",
+ mdata->s_mirror_file_loc, map->s_partition_num);
+
+- mdata->s_mirror_fe = udf_find_metadata_inode_efe(sb,
+- mdata->s_mirror_file_loc, map->s_partition_num);
++ fe = udf_find_metadata_inode_efe(sb, mdata->s_mirror_file_loc,
++ map->s_partition_num);
+
+- if (mdata->s_mirror_fe == NULL) {
++ if (IS_ERR(fe)) {
+ udf_err(sb, "Both metadata and mirror metadata inode
efe can not found\n");
+- return -EIO;
++ return PTR_ERR(fe);
+ }
+- }
++ mdata->s_mirror_fe = fe;
++ } else
++ mdata->s_metadata_fe = fe;
++
+
+ /*
+ * bitmap file entry
+@@ -1010,15 +1015,16 @@ static int udf_load_metadata_files(struct super_block
*sb, int partition)
+ udf_debug("Bitmap file location: block = %d part = %d\n",
+ addr.logicalBlockNum, addr.partitionReferenceNum);
+
+- mdata->s_bitmap_fe = udf_iget(sb, &addr);
+- if (mdata->s_bitmap_fe == NULL) {
++ fe = udf_iget(sb, &addr);
++ if (IS_ERR(fe)) {
+ if (sb->s_flags & MS_RDONLY)
+ udf_warn(sb, "bitmap inode efe not found but
it's ok since the disc is mounted read-only\n");
+ else {
+ udf_err(sb, "bitmap inode efe not found and
attempted read-write mount\n");
+- return -EIO;
++ return PTR_ERR(fe);
+ }
+- }
++ } else
++ mdata->s_bitmap_fe = fe;
+ }
+
+ udf_debug("udf_load_metadata_files Ok\n");
+@@ -1106,13 +1112,15 @@ static int udf_fill_partdesc_info(struct super_block
*sb,
+ phd->unallocSpaceTable.extPosition),
+ .partitionReferenceNum = p_index,
+ };
++ struct inode *inode;
+
+- map->s_uspace.s_table = udf_iget(sb, &loc);
+- if (!map->s_uspace.s_table) {
++ inode = udf_iget(sb, &loc);
++ if (IS_ERR(inode)) {
+ udf_debug("cannot load unallocSpaceTable (part %d)\n",
+ p_index);
+- return -EIO;
++ return PTR_ERR(inode);
+ }
++ map->s_uspace.s_table = inode;
+ map->s_partition_flags |= UDF_PART_FLAG_UNALLOC_TABLE;
+ udf_debug("unallocSpaceTable (part %d) @ %ld\n",
+ p_index, map->s_uspace.s_table->i_ino);
+@@ -1139,14 +1147,15 @@ static int udf_fill_partdesc_info(struct super_block
*sb,
+ phd->freedSpaceTable.extPosition),
+ .partitionReferenceNum = p_index,
+ };
++ struct inode *inode;
+
+- map->s_fspace.s_table = udf_iget(sb, &loc);
+- if (!map->s_fspace.s_table) {
++ inode = udf_iget(sb, &loc);
++ if (IS_ERR(inode)) {
+ udf_debug("cannot load freedSpaceTable (part %d)\n",
+ p_index);
+- return -EIO;
++ return PTR_ERR(inode);
+ }
+-
++ map->s_fspace.s_table = inode;
+ map->s_partition_flags |= UDF_PART_FLAG_FREED_TABLE;
+ udf_debug("freedSpaceTable (part %d) @ %ld\n",
+ p_index, map->s_fspace.s_table->i_ino);
+@@ -1173,6 +1182,7 @@ static void udf_find_vat_block(struct super_block *sb,
int p_index,
+ struct udf_part_map *map = &sbi->s_partmaps[p_index];
+ sector_t vat_block;
+ struct kernel_lb_addr ino;
++ struct inode *inode;
+
+ /*
+ * VAT file entry is in the last recorded block. Some broken disks have
+@@ -1181,10 +1191,13 @@ static void udf_find_vat_block(struct super_block *sb,
int p_index,
+ ino.partitionReferenceNum = type1_index;
+ for (vat_block = start_block;
+ vat_block >= map->s_partition_root &&
+- vat_block >= start_block - 3 &&
+- !sbi->s_vat_inode; vat_block--) {
++ vat_block >= start_block - 3; vat_block--) {
+ ino.logicalBlockNum = vat_block - map->s_partition_root;
+- sbi->s_vat_inode = udf_iget(sb, &ino);
++ inode = udf_iget(sb, &ino);
++ if (!IS_ERR(inode)) {
++ sbi->s_vat_inode = inode;
++ break;
++ }
+ }
+ }
+
+@@ -2200,10 +2213,10 @@ static int udf_fill_super(struct super_block *sb, void
*options, int silent)
+ /* assign inodes by physical block number */
+ /* perhaps it's not extensible enough, but for now ... */
+ inode = udf_iget(sb, &rootdir);
+- if (!inode) {
++ if (IS_ERR(inode)) {
+ udf_err(sb, "Error in udf_iget, block=%d, partition=%d\n",
+ rootdir.logicalBlockNum, rootdir.partitionReferenceNum);
+- ret = -EIO;
++ ret = PTR_ERR(inode);
+ goto error_out;
+ }
+
+diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c
+index d7c6dbe..0422b7b 100644
+--- a/fs/udf/symlink.c
++++ b/fs/udf/symlink.c
+@@ -30,49 +30,73 @@
+ #include <linux/buffer_head.h>
+ #include "udf_i.h"
+
+-static void udf_pc_to_char(struct super_block *sb, unsigned char *from,
+- int fromlen, unsigned char *to)
++static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
++ int fromlen, unsigned char *to, int tolen)
+ {
+ struct pathComponent *pc;
+ int elen = 0;
++ int comp_len;
+ unsigned char *p = to;
+
++ /* Reserve one byte for terminating \0 */
++ tolen--;
+ while (elen < fromlen) {
+ pc = (struct pathComponent *)(from + elen);
++ elen += sizeof(struct pathComponent);
+ switch (pc->componentType) {
+ case 1:
+ /*
+ * Symlink points to some place which should be agreed
+ * upon between originator and receiver of the media.
Ignore.
+ */
+- if (pc->lengthComponentIdent > 0)
++ if (pc->lengthComponentIdent > 0) {
++ elen += pc->lengthComponentIdent;
+ break;
++ }
+ /* Fall through */
+ case 2:
++ if (tolen == 0)
++ return -ENAMETOOLONG;
+ p = to;
+ *p++ = '/';
++ tolen--;
+ break;
+ case 3:
++ if (tolen < 3)
++ return -ENAMETOOLONG;
+ memcpy(p, "../", 3);
+ p += 3;
++ tolen -= 3;
+ break;
+ case 4:
++ if (tolen < 2)
++ return -ENAMETOOLONG;
+ memcpy(p, "./", 2);
+ p += 2;
++ tolen -= 2;
+ /* that would be . - just ignore */
+ break;
+ case 5:
+- p += udf_get_filename(sb, pc->componentIdent, p,
+- pc->lengthComponentIdent);
++ elen += pc->lengthComponentIdent;
++ if (elen > fromlen)
++ return -EIO;
++ comp_len = udf_get_filename(sb, pc->componentIdent,
++ pc->lengthComponentIdent,
++ p, tolen);
++ p += comp_len;
++ tolen -= comp_len;
++ if (tolen == 0)
++ return -ENAMETOOLONG;
+ *p++ = '/';
++ tolen--;
+ break;
+ }
+- elen += sizeof(struct pathComponent) + pc->lengthComponentIdent;
+ }
+ if (p > to + 1)
+ p[-1] = '\0';
+ else
+ p[0] = '\0';
++ return 0;
+ }
+
+ static int udf_symlink_filler(struct file *file, struct page *page)
+@@ -80,11 +104,17 @@ static int udf_symlink_filler(struct file *file, struct
page *page)
+ struct inode *inode = page->mapping->host;
+ struct buffer_head *bh = NULL;
+ unsigned char *symlink;
+- int err = -EIO;
++ int err;
+ unsigned char *p = kmap(page);
+ struct udf_inode_info *iinfo;
+ uint32_t pos;
+
++ /* We don't support symlinks longer than one block */
++ if (inode->i_size > inode->i_sb->s_blocksize) {
++ err = -ENAMETOOLONG;
++ goto out_unmap;
++ }
++
+ iinfo = UDF_I(inode);
+ pos = udf_block_map(inode, 0);
+
+@@ -94,14 +124,18 @@ static int udf_symlink_filler(struct file *file, struct
page *page)
+ } else {
+ bh = sb_bread(inode->i_sb, pos);
+
+- if (!bh)
+- goto out;
++ if (!bh) {
++ err = -EIO;
++ goto out_unlock_inode;
++ }
+
+ symlink = bh->b_data;
+ }
+
+- udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p);
++ err = udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p, PAGE_SIZE);
+ brelse(bh);
++ if (err)
++ goto out_unlock_inode;
+
+ up_read(&iinfo->i_data_sem);
+ SetPageUptodate(page);
+@@ -109,9 +143,10 @@ static int udf_symlink_filler(struct file *file, struct
page *page)
+ unlock_page(page);
+ return 0;
+
+-out:
++out_unlock_inode:
+ up_read(&iinfo->i_data_sem);
+ SetPageError(page);
++out_unmap:
+ kunmap(page);
+ unlock_page(page);
+ return err;
+diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
+index be7dabb..6b10c98 100644
+--- a/fs/udf/udfdecl.h
++++ b/fs/udf/udfdecl.h
+@@ -143,7 +143,6 @@ extern int udf_expand_file_adinicb(struct inode *);
+ extern struct buffer_head *udf_expand_dir_adinicb(struct inode *, int *, int
*);
+ extern struct buffer_head *udf_bread(struct inode *, int, int, int *);
+ extern int udf_setsize(struct inode *, loff_t);
+-extern void udf_read_inode(struct inode *);
+ extern void udf_evict_inode(struct inode *);
+ extern int udf_write_inode(struct inode *, struct writeback_control *wbc);
+ extern long udf_block_map(struct inode *, sector_t);
+@@ -201,7 +200,8 @@ udf_get_lb_pblock(struct super_block *sb, struct
kernel_lb_addr *loc,
+ }
+
+ /* unicode.c */
+-extern int udf_get_filename(struct super_block *, uint8_t *, uint8_t *, int);
++extern int udf_get_filename(struct super_block *, uint8_t *, int, uint8_t *,
++ int);
+ extern int udf_put_filename(struct super_block *, const uint8_t *, uint8_t *,
+ int);
+ extern int udf_build_ustr(struct ustr *, dstring *, int);
+diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
+index 44b815e..d29c06f 100644
+--- a/fs/udf/unicode.c
++++ b/fs/udf/unicode.c
+@@ -28,7 +28,8 @@
+
+ #include "udf_sb.h"
+
+-static int udf_translate_to_linux(uint8_t *, uint8_t *, int, uint8_t *, int);
++static int udf_translate_to_linux(uint8_t *, int, uint8_t *, int, uint8_t *,
++ int);
+
+ static int udf_char_to_ustr(struct ustr *dest, const uint8_t *src, int strlen)
+ {
+@@ -333,8 +334,8 @@ try_again:
+ return u_len + 1;
+ }
+
+-int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
+- int flen)
++int udf_get_filename(struct super_block *sb, uint8_t *sname, int slen,
++ uint8_t *dname, int dlen)
+ {
+ struct ustr *filename, *unifilename;
+ int len = 0;
+@@ -347,7 +348,7 @@ int udf_get_filename(struct super_block *sb, uint8_t
*sname, uint8_t *dname,
+ if (!unifilename)
+ goto out1;
+
+- if (udf_build_ustr_exact(unifilename, sname, flen))
++ if (udf_build_ustr_exact(unifilename, sname, slen))
+ goto out2;
+
+ if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8)) {
+@@ -366,7 +367,8 @@ int udf_get_filename(struct super_block *sb, uint8_t
*sname, uint8_t *dname,
+ } else
+ goto out2;
+
+- len = udf_translate_to_linux(dname, filename->u_name, filename->u_len,
++ len = udf_translate_to_linux(dname, dlen,
++ filename->u_name, filename->u_len,
+ unifilename->u_name, unifilename->u_len);
+ out2:
+ kfree(unifilename);
+@@ -403,10 +405,12 @@ int udf_put_filename(struct super_block *sb, const
uint8_t *sname,
+ #define EXT_MARK '.'
+ #define CRC_MARK '#'
+ #define EXT_SIZE 5
++/* Number of chars we need to store generated CRC to make filename unique */
++#define CRC_LEN 5
+
+-static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
+- int udfLen, uint8_t *fidName,
+- int fidNameLen)
++static int udf_translate_to_linux(uint8_t *newName, int newLen,
++ uint8_t *udfName, int udfLen,
++ uint8_t *fidName, int fidNameLen)
+ {
+ int index, newIndex = 0, needsCRC = 0;
+ int extIndex = 0, newExtIndex = 0, hasExt = 0;
+@@ -440,7 +444,7 @@ static int udf_translate_to_linux(uint8_t *newName,
uint8_t *udfName,
+ newExtIndex = newIndex;
+ }
+ }
+- if (newIndex < 256)
++ if (newIndex < newLen)
+ newName[newIndex++] = curr;
+ else
+ needsCRC = 1;
+@@ -468,13 +472,13 @@ static int udf_translate_to_linux(uint8_t *newName,
uint8_t *udfName,
+ }
+ ext[localExtIndex++] = curr;
+ }
+- maxFilenameLen = 250 - localExtIndex;
++ maxFilenameLen = newLen - CRC_LEN - localExtIndex;
+ if (newIndex > maxFilenameLen)
+ newIndex = maxFilenameLen;
+ else
+ newIndex = newExtIndex;
+- } else if (newIndex > 250)
+- newIndex = 250;
++ } else if (newIndex > newLen - CRC_LEN)
++ newIndex = newLen - CRC_LEN;
+ newName[newIndex++] = CRC_MARK;
+ valueCRC = crc_itu_t(0, fidName, fidNameLen);
+ newName[newIndex++] = hexChar[(valueCRC & 0xf000) >> 12];
diff --git a/fs/ufs/swab.h b/fs/ufs/swab.h
index 8d974c4..b82f6ec 100644
--- a/fs/ufs/swab.h
@@ -100570,9 +101342,18 @@ index d074d06..ad3cfcf 100644
if (ogm_packet->flags & BATADV_DIRECTLINK)
has_directlink_flag = true;
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
-index c46387a..6ad5ef9 100644
+index c46387a..3b6c10e 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
+@@ -251,7 +251,7 @@ batadv_frag_merge_packets(struct hlist_head *chain, struct
sk_buff *skb)
+ kfree(entry);
+
+ /* Make room for the rest of the fragments. */
+- if (pskb_expand_head(skb_out, 0, size - skb->len, GFP_ATOMIC) < 0) {
++ if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
+ kfree_skb(skb_out);
+ skb_out = NULL;
+ goto free;
@@ -450,7 +450,7 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
frag_header.packet_type = BATADV_UNICAST_FRAG;
frag_header.version = BATADV_COMPAT_VERSION;
diff --git a/3.18.1/0000_README b/3.18.1/0000_README
index 2f3438b..dae7762 100644
--- a/3.18.1/0000_README
+++ b/3.18.1/0000_README
@@ -2,7 +2,7 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 4420_grsecurity-3.0-3.18.1-201412281149.patch
+Patch: 4420_grsecurity-3.0-3.18.1-201501042021.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.18.1/4420_grsecurity-3.0-3.18.1-201412281149.patch
b/3.18.1/4420_grsecurity-3.0-3.18.1-201501042021.patch
similarity index 99%
rename from 3.18.1/4420_grsecurity-3.0-3.18.1-201412281149.patch
rename to 3.18.1/4420_grsecurity-3.0-3.18.1-201501042021.patch
index 9709c10..9090c69 100644
--- a/3.18.1/4420_grsecurity-3.0-3.18.1-201412281149.patch
+++ b/3.18.1/4420_grsecurity-3.0-3.18.1-201501042021.patch
@@ -962,7 +962,7 @@ index 89c4b5c..847a7be 100644
kexec is a system call that implements the ability to shutdown your
current kernel, and to start another kernel. It is like a reboot
diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
-index e22c119..9531fcc 100644
+index e22c119..8fa9957 100644
--- a/arch/arm/include/asm/atomic.h
+++ b/arch/arm/include/asm/atomic.h
@@ -18,17 +18,41 @@
@@ -1007,11 +1007,12 @@ index e22c119..9531fcc 100644
#if __LINUX_ARM_ARCH__ >= 6
-@@ -38,7 +62,25 @@
+@@ -38,26 +62,50 @@
* to ensure that the update happens.
*/
-#define ATOMIC_OP(op, c_op, asm_op) \
+-static inline void atomic_##op(int i, atomic_t *v) \
+#ifdef CONFIG_PAX_REFCOUNT
+#define __OVERFLOW_POST \
+ " bvc 3f\n" \
@@ -1022,20 +1023,24 @@ index e22c119..9531fcc 100644
+" mov %0, %1\n" \
+ "2: " REFCOUNT_TRAP_INSN "\n"\
+ "3:\n"
-+#define __OVERFLOW_EXTABLE \
-+ "4:\n"
++#define __OVERFLOW_EXTABLE \
++ "4:\n" \
+ _ASM_EXTABLE(2b, 4b)
+#else
+#define __OVERFLOW_POST
++#define __OVERFLOW_POST_RETURN
+#define __OVERFLOW_EXTABLE
+#endif
+
+#define __ATOMIC_OP(op, suffix, c_op, asm_op, post_op, extable)
\
- static inline void atomic_##op(int i, atomic_t *v) \
++static inline void atomic_##op##suffix(int i, atomic##suffix##_t *v) \
{ \
unsigned long tmp; \
-@@ -48,15 +90,20 @@ static inline void atomic_##op(int i, atomic_t *v)
\
- __asm__ __volatile__("@ atomic_" #op "\n" \
+ int result; \
+ \
+ prefetchw(&v->counter); \
+- __asm__ __volatile__("@ atomic_" #op "\n" \
++ __asm__ __volatile__("@ atomic_" #op #suffix "\n" \
"1: ldrex %0, [%3]\n" \
" " #asm_op " %0, %0, %4\n" \
+ post_op \
@@ -1050,15 +1055,21 @@ index e22c119..9531fcc 100644
} \
-#define ATOMIC_OP_RETURN(op, c_op, asm_op) \
+-static inline int atomic_##op##_return(int i, atomic_t *v) \
+#define ATOMIC_OP(op, c_op, asm_op) __ATOMIC_OP(op, , c_op, asm_op, , )\
+ __ATOMIC_OP(op, _unchecked, c_op,
asm_op##s, __OVERFLOW_POST, __OVERFLOW_EXTABLE)
+
+#define __ATOMIC_OP_RETURN(op, suffix, c_op, asm_op, post_op, extable)
\
- static inline int atomic_##op##_return(int i, atomic_t *v) \
++static inline int atomic_##op##_return##suffix(int i, atomic##suffix##_t *v)\
{ \
unsigned long tmp; \
-@@ -68,9 +115,11 @@ static inline int atomic_##op##_return(int i, atomic_t *v)
\
- __asm__ __volatile__("@ atomic_" #op "_return\n" \
+ int result; \
+@@ -65,12 +113,14 @@ static inline int atomic_##op##_return(int i, atomic_t
*v) \
+ smp_mb(); \
+ prefetchw(&v->counter); \
+ \
+- __asm__ __volatile__("@ atomic_" #op "_return\n" \
++ __asm__ __volatile__("@ atomic_" #op "_return" #suffix "\n" \
"1: ldrex %0, [%3]\n" \
" " #asm_op " %0, %0, %4\n" \
+ post_op \
@@ -1070,7 +1081,7 @@ index e22c119..9531fcc 100644
: "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) \
: "r" (&v->counter), "Ir" (i) \
: "cc"); \
-@@ -80,6 +129,9 @@ static inline int atomic_##op##_return(int i, atomic_t *v)
\
+@@ -80,6 +130,9 @@ static inline int atomic_##op##_return(int i, atomic_t *v)
\
return result; \
}
@@ -1080,7 +1091,7 @@ index e22c119..9531fcc 100644
static inline int atomic_cmpxchg(atomic_t *ptr, int old, int new)
{
int oldval;
-@@ -115,12 +167,24 @@ static inline int __atomic_add_unless(atomic_t *v, int
a, int u)
+@@ -115,12 +168,24 @@ static inline int __atomic_add_unless(atomic_t *v, int
a, int u)
__asm__ __volatile__ ("@ atomic_add_unless\n"
"1: ldrex %0, [%4]\n"
" teq %0, %5\n"
@@ -1108,7 +1119,7 @@ index e22c119..9531fcc 100644
: "=&r" (oldval), "=&r" (newval), "=&r" (tmp), "+Qo" (v->counter)
: "r" (&v->counter), "r" (u), "r" (a)
: "cc");
-@@ -131,6 +195,28 @@ static inline int __atomic_add_unless(atomic_t *v, int a,
int u)
+@@ -131,14 +196,36 @@ static inline int __atomic_add_unless(atomic_t *v, int
a, int u)
return oldval;
}
@@ -1137,19 +1148,53 @@ index e22c119..9531fcc 100644
#else /* ARM_ARCH_6 */
#ifdef CONFIG_SMP
-@@ -175,6 +261,11 @@ static inline int atomic_cmpxchg(atomic_t *v, int old,
int new)
+ #error SMP not supported on pre-ARMv6 CPUs
+ #endif
+
+-#define ATOMIC_OP(op, c_op, asm_op) \
+-static inline void atomic_##op(int i, atomic_t *v) \
++#define __ATOMIC_OP(op, suffix, c_op, asm_op) \
++static inline void atomic_##op##suffix(int i, atomic##suffix##_t *v) \
+ { \
+ unsigned long flags; \
+ \
+@@ -147,8 +234,11 @@ static inline void atomic_##op(int i, atomic_t *v)
\
+ raw_local_irq_restore(flags); \
+ } \
+
+-#define ATOMIC_OP_RETURN(op, c_op, asm_op) \
+-static inline int atomic_##op##_return(int i, atomic_t *v) \
++#define ATOMIC_OP(op, c_op, asm_op) __ATOMIC_OP(op, , c_op, asm_op) \
++ __ATOMIC_OP(op, _unchecked, c_op, asm_op)
++
++#define __ATOMIC_OP_RETURN(op, suffix, c_op, asm_op) \
++static inline int atomic_##op##_return##suffix(int i, atomic##suffix##_t *v)\
+ { \
+ unsigned long flags; \
+ int val; \
+@@ -161,6 +251,9 @@ static inline int atomic_##op##_return(int i, atomic_t *v)
\
+ return val; \
+ }
+
++#define ATOMIC_OP_RETURN(op, c_op, asm_op) __ATOMIC_OP_RETURN(op, , c_op,
asm_op)\
++ __ATOMIC_OP_RETURN(op, _unchecked,
c_op, asm_op)
++
+ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
+ {
+ int ret;
+@@ -175,6 +268,11 @@ static inline int atomic_cmpxchg(atomic_t *v, int old,
int new)
return ret;
}
+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old,
int new)
+{
-+ return atomic_cmpxchg(v, old, new);
++ return atomic_cmpxchg((atomic_t *)v, old, new);
+}
+
static inline int __atomic_add_unless(atomic_t *v, int a, int u)
{
int c, old;
-@@ -196,16 +287,38 @@ ATOMIC_OPS(sub, -=, sub)
+@@ -196,16 +294,38 @@ ATOMIC_OPS(sub, -=, sub)
#undef ATOMIC_OPS
#undef ATOMIC_OP_RETURN
@@ -1188,7 +1233,7 @@ index e22c119..9531fcc 100644
#define atomic_dec_return(v) (atomic_sub_return(1, v))
#define atomic_sub_and_test(i, v) (atomic_sub_return(i, v) == 0)
-@@ -216,6 +329,14 @@ typedef struct {
+@@ -216,6 +336,14 @@ typedef struct {
long long counter;
} atomic64_t;
@@ -1203,7 +1248,7 @@ index e22c119..9531fcc 100644
#define ATOMIC64_INIT(i) { (i) }
#ifdef CONFIG_ARM_LPAE
-@@ -232,6 +353,19 @@ static inline long long atomic64_read(const atomic64_t *v)
+@@ -232,6 +360,19 @@ static inline long long atomic64_read(const atomic64_t *v)
return result;
}
@@ -1223,7 +1268,7 @@ index e22c119..9531fcc 100644
static inline void atomic64_set(atomic64_t *v, long long i)
{
__asm__ __volatile__("@ atomic64_set\n"
-@@ -240,6 +374,15 @@ static inline void atomic64_set(atomic64_t *v, long long
i)
+@@ -240,6 +381,15 @@ static inline void atomic64_set(atomic64_t *v, long long
i)
: "r" (&v->counter), "r" (i)
);
}
@@ -1239,7 +1284,7 @@ index e22c119..9531fcc 100644
#else
static inline long long atomic64_read(const atomic64_t *v)
{
-@@ -254,6 +397,19 @@ static inline long long atomic64_read(const atomic64_t *v)
+@@ -254,6 +404,19 @@ static inline long long atomic64_read(const atomic64_t *v)
return result;
}
@@ -1259,7 +1304,7 @@ index e22c119..9531fcc 100644
static inline void atomic64_set(atomic64_t *v, long long i)
{
long long tmp;
-@@ -268,29 +424,57 @@ static inline void atomic64_set(atomic64_t *v, long long
i)
+@@ -268,29 +431,57 @@ static inline void atomic64_set(atomic64_t *v, long long
i)
: "r" (&v->counter), "r" (i)
: "cc");
}
@@ -1323,7 +1368,7 @@ index e22c119..9531fcc 100644
{ \
long long result; \
unsigned long tmp; \
-@@ -298,13 +482,15 @@ static inline long long atomic64_##op##_return(long long
i, atomic64_t *v) \
+@@ -298,13 +489,15 @@ static inline long long atomic64_##op##_return(long long
i, atomic64_t *v) \
smp_mb(); \
prefetchw(&v->counter); \
\
@@ -1341,7 +1386,7 @@ index e22c119..9531fcc 100644
: "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) \
: "r" (&v->counter), "r" (i) \
: "cc"); \
-@@ -314,6 +500,9 @@ static inline long long atomic64_##op##_return(long long
i, atomic64_t *v) \
+@@ -314,6 +507,9 @@ static inline long long atomic64_##op##_return(long long
i, atomic64_t *v) \
return result; \
}
@@ -1351,7 +1396,7 @@ index e22c119..9531fcc 100644
#define ATOMIC64_OPS(op, op1, op2) \
ATOMIC64_OP(op, op1, op2) \
ATOMIC64_OP_RETURN(op, op1, op2)
-@@ -323,7 +512,12 @@ ATOMIC64_OPS(sub, subs, sbc)
+@@ -323,7 +519,12 @@ ATOMIC64_OPS(sub, subs, sbc)
#undef ATOMIC64_OPS
#undef ATOMIC64_OP_RETURN
@@ -1364,7 +1409,7 @@ index e22c119..9531fcc 100644
static inline long long atomic64_cmpxchg(atomic64_t *ptr, long long old,
long long new)
-@@ -351,6 +545,31 @@ static inline long long atomic64_cmpxchg(atomic64_t *ptr,
long long old,
+@@ -351,6 +552,31 @@ static inline long long atomic64_cmpxchg(atomic64_t *ptr,
long long old,
return oldval;
}
@@ -1396,7 +1441,7 @@ index e22c119..9531fcc 100644
static inline long long atomic64_xchg(atomic64_t *ptr, long long new)
{
long long result;
-@@ -376,21 +595,35 @@ static inline long long atomic64_xchg(atomic64_t *ptr,
long long new)
+@@ -376,21 +602,35 @@ static inline long long atomic64_xchg(atomic64_t *ptr,
long long new)
static inline long long atomic64_dec_if_positive(atomic64_t *v)
{
long long result;
@@ -1438,7 +1483,7 @@ index e22c119..9531fcc 100644
: "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
: "r" (&v->counter)
: "cc");
-@@ -414,13 +647,25 @@ static inline int atomic64_add_unless(atomic64_t *v,
long long a, long long u)
+@@ -414,13 +654,25 @@ static inline int atomic64_add_unless(atomic64_t *v,
long long a, long long u)
" teq %0, %5\n"
" teqeq %H0, %H5\n"
" moveq %1, #0\n"
@@ -1467,7 +1512,7 @@ index e22c119..9531fcc 100644
: "=&r" (val), "+r" (ret), "=&r" (tmp), "+Qo" (v->counter)
: "r" (&v->counter), "r" (u), "r" (a)
: "cc");
-@@ -433,10 +678,13 @@ static inline int atomic64_add_unless(atomic64_t *v,
long long a, long long u)
+@@ -433,10 +685,13 @@ static inline int atomic64_add_unless(atomic64_t *v,
long long a, long long u)
#define atomic64_add_negative(a, v) (atomic64_add_return((a), (v)) < 0)
#define atomic64_inc(v) atomic64_add(1LL, (v))
@@ -16130,7 +16175,7 @@ index 9863ee3..4a1f8e1 100644
return _PAGE_CACHE_WC;
else if (pg_flags == _PGMT_UC_MINUS)
diff --git a/arch/x86/include/asm/calling.h b/arch/x86/include/asm/calling.h
-index 76659b6..6e0b30a 100644
+index 76659b6..72b8439 100644
--- a/arch/x86/include/asm/calling.h
+++ b/arch/x86/include/asm/calling.h
@@ -82,107 +82,117 @@ For 32-bit we have the following conventions - kernel is
built with
@@ -16257,7 +16302,7 @@ index 76659b6..6e0b30a 100644
.if \skiprax
.else
- movq \offset+72(%rsp), %rax
-+ movq RAX(%rsp), %rax
++ movq ORIG_RAX(%rsp), %rax
.endif
.endm
@@ -23016,7 +23061,7 @@ index 344b63f..ccdac7a 100644
#endif
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
-index c0226ab..b1d8cdd 100644
+index c0226ab..96a8ab7 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -59,6 +59,8 @@
@@ -23686,7 +23731,7 @@ index c0226ab..b1d8cdd 100644
/*
* sysretq will re-enable interrupts:
*/
-@@ -494,11 +963,14 @@ sysret_audit:
+@@ -494,12 +963,15 @@ sysret_audit:
/* Do syscall tracing */
tracesys:
@@ -23696,12 +23741,14 @@ index c0226ab..b1d8cdd 100644
call syscall_trace_enter_phase1
test %rax, %rax
jnz tracesys_phase2 /* if needed, run the slow path */
+- LOAD_ARGS 0 /* else restore clobbered regs */
+
+ pax_erase_kstack
+
- LOAD_ARGS 0 /* else restore clobbered regs */
++ LOAD_ARGS /* else restore clobbered regs */
jmp system_call_fastpath /* and return to the fast path */
+ tracesys_phase2:
@@ -510,12 +982,14 @@ tracesys_phase2:
movq %rax,%rdx
call syscall_trace_enter_phase2
@@ -23894,6 +23941,27 @@ index c0226ab..b1d8cdd 100644
/*
* The iretq could re-enable interrupts:
*/
+@@ -845,15 +1333,15 @@ native_irq_return_ldt:
+ SWAPGS
+ movq PER_CPU_VAR(espfix_waddr),%rdi
+ movq %rax,(0*8)(%rdi) /* RAX */
+- movq (2*8)(%rsp),%rax /* RIP */
++ movq (2*8 + RIP-RIP)(%rsp),%rax /* RIP */
+ movq %rax,(1*8)(%rdi)
+- movq (3*8)(%rsp),%rax /* CS */
++ movq (2*8 + CS-RIP)(%rsp),%rax /* CS */
+ movq %rax,(2*8)(%rdi)
+- movq (4*8)(%rsp),%rax /* RFLAGS */
++ movq (2*8 + EFLAGS-RIP)(%rsp),%rax /* RFLAGS */
+ movq %rax,(3*8)(%rdi)
+- movq (6*8)(%rsp),%rax /* SS */
++ movq (2*8 + SS-RIP)(%rsp),%rax /* SS */
+ movq %rax,(5*8)(%rdi)
+- movq (5*8)(%rsp),%rax /* RSP */
++ movq (2*8 + RSP-RIP)(%rsp),%rax /* RSP */
+ movq %rax,(4*8)(%rdi)
+ andl $0xffff0000,%eax
+ popq_cfi %rdi
@@ -907,7 +1395,7 @@ ENTRY(retint_kernel)
jmp exit_intr
#endif
@@ -26362,26 +26430,30 @@ index 548d25f..f8fb99c 100644
EXPORT_SYMBOL_GPL(pv_time_ops);
diff --git a/arch/x86/kernel/paravirt_patch_64.c
b/arch/x86/kernel/paravirt_patch_64.c
-index a1da673..2c72d5b 100644
+index a1da673..b6f5831 100644
--- a/arch/x86/kernel/paravirt_patch_64.c
+++ b/arch/x86/kernel/paravirt_patch_64.c
-@@ -9,7 +9,9 @@ DEF_NATIVE(pv_irq_ops, save_fl, "pushfq; popq %rax");
+@@ -9,7 +9,11 @@ DEF_NATIVE(pv_irq_ops, save_fl, "pushfq; popq %rax");
DEF_NATIVE(pv_mmu_ops, read_cr2, "movq %cr2, %rax");
DEF_NATIVE(pv_mmu_ops, read_cr3, "movq %cr3, %rax");
DEF_NATIVE(pv_mmu_ops, write_cr3, "movq %rdi, %cr3");
++
+#ifndef CONFIG_PAX_MEMORY_UDEREF
DEF_NATIVE(pv_mmu_ops, flush_tlb_single, "invlpg (%rdi)");
+#endif
++
DEF_NATIVE(pv_cpu_ops, clts, "clts");
DEF_NATIVE(pv_cpu_ops, wbinvd, "wbinvd");
-@@ -57,7 +59,9 @@ unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
+@@ -57,7 +61,11 @@ unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
PATCH_SITE(pv_mmu_ops, read_cr3);
PATCH_SITE(pv_mmu_ops, write_cr3);
PATCH_SITE(pv_cpu_ops, clts);
++
+#ifndef CONFIG_PAX_MEMORY_UDEREF
PATCH_SITE(pv_mmu_ops, flush_tlb_single);
+#endif
++
PATCH_SITE(pv_cpu_ops, wbinvd);
patch_site:
@@ -27898,7 +27970,7 @@ index 1c113db..287b42e 100644
static int trace_irq_vector_refcount;
static DEFINE_MUTEX(irq_vector_mutex);
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
-index de801f2..f189dcf 100644
+index de801f2..4a4c4af 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -67,7 +67,7 @@
@@ -28043,7 +28115,16 @@ index de801f2..f189dcf 100644
tsk->thread.error_code = error_code;
tsk->thread.trap_nr = X86_TRAP_GP;
-@@ -433,7 +474,7 @@ struct bad_iret_stack *fixup_bad_iret(struct
bad_iret_stack *s)
+@@ -427,13 +468,16 @@ struct bad_iret_stack *fixup_bad_iret(struct
bad_iret_stack *s)
+ container_of(task_pt_regs(current),
+ struct bad_iret_stack, regs);
+
++ if ((current->thread.sp0 ^ (unsigned long)s) < THREAD_SIZE)
++ new_stack = s;
++
+ /* Copy the IRET target to the new stack. */
+ memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8);
+
/* Copy the remainder of the stack from the current stack. */
memmove(new_stack, s, offsetof(struct bad_iret_stack, regs.ip));
@@ -28052,7 +28133,7 @@ index de801f2..f189dcf 100644
return new_stack;
}
#endif
-@@ -518,7 +559,7 @@ dotraplinkage void do_debug(struct pt_regs *regs, long
error_code)
+@@ -518,7 +562,7 @@ dotraplinkage void do_debug(struct pt_regs *regs, long
error_code)
/* It's safe to allow irq's after DR6 has been saved */
preempt_conditional_sti(regs);
@@ -28061,7 +28142,7 @@ index de801f2..f189dcf 100644
handle_vm86_trap((struct kernel_vm86_regs *) regs, error_code,
X86_TRAP_DB);
preempt_conditional_cli(regs);
-@@ -533,7 +574,7 @@ dotraplinkage void do_debug(struct pt_regs *regs, long
error_code)
+@@ -533,7 +577,7 @@ dotraplinkage void do_debug(struct pt_regs *regs, long
error_code)
* We already checked v86 mode above, so we can check for kernel mode
* by just checking the CPL of CS.
*/
@@ -28070,7 +28151,7 @@ index de801f2..f189dcf 100644
tsk->thread.debugreg6 &= ~DR_STEP;
set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
regs->flags &= ~X86_EFLAGS_TF;
-@@ -566,7 +607,7 @@ static void math_error(struct pt_regs *regs, int
error_code, int trapnr)
+@@ -566,7 +610,7 @@ static void math_error(struct pt_regs *regs, int
error_code, int trapnr)
return;
conditional_sti(regs);
@@ -28656,9 +28737,18 @@ index 976e3a5..8bb998c 100644
out:
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index 9f8a2fa..565eb4f 100644
+index 9f8a2fa..2df3c3f 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
+@@ -3519,7 +3519,7 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
+ int cr = ctxt->modrm_reg;
+ u64 efer = 0;
+
+- static u64 cr_reserved_bits[] = {
++ static const u64 cr_reserved_bits[] = {
+ 0xffffffff00000000ULL,
+ 0, 0, 0, /* CR3 checked later */
+ CR4_RESERVED_BITS,
@@ -3554,7 +3554,7 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
@@ -34156,7 +34246,7 @@ index 6440221..f84b5c7 100644
+ pax_force_retaddr
ret
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
-index 3f62734..097bf93 100644
+index 3f62734..a57894f 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -13,7 +13,11 @@
@@ -34199,14 +34289,21 @@ index 3f62734..097bf93 100644
prog->bpf_func = (void *)image;
prog->jited = true;
}
-@@ -982,7 +989,6 @@ void bpf_jit_free(struct bpf_prog *fp)
- if (!fp->jited)
- goto free_filter;
+@@ -979,12 +986,8 @@ void bpf_jit_free(struct bpf_prog *fp)
+ unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
+ struct bpf_binary_header *header = (void *)addr;
-- set_memory_rw(addr, header->pages);
- bpf_jit_binary_free(header);
+- if (!fp->jited)
+- goto free_filter;
++ if (fp->jited)
++ bpf_jit_binary_free(header);
- free_filter:
+- set_memory_rw(addr, header->pages);
+- bpf_jit_binary_free(header);
+-
+-free_filter:
+ bpf_prog_unlock_free(fp);
+ }
diff --git a/arch/x86/oprofile/backtrace.c b/arch/x86/oprofile/backtrace.c
index 5d04be5..2beeaa2 100644
--- a/arch/x86/oprofile/backtrace.c
@@ -39186,25 +39283,16 @@ index b0c18ed..1713a80 100644
cpu_notifier_register_begin();
diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
-index f657c57..ada41b6 100644
+index f657c57..31d97ae 100644
--- a/drivers/cpufreq/cpufreq-dt.c
+++ b/drivers/cpufreq/cpufreq-dt.c
-@@ -345,6 +345,7 @@ static int dt_cpufreq_probe(struct platform_device *pdev)
- struct device *cpu_dev;
- struct regulator *cpu_reg;
- struct clk *cpu_clk;
-+ void *fptr;
- int ret;
-
- /*
-@@ -362,7 +363,10 @@ static int dt_cpufreq_probe(struct platform_device *pdev)
+@@ -362,7 +362,9 @@ static int dt_cpufreq_probe(struct platform_device *pdev)
if (!IS_ERR(cpu_reg))
regulator_put(cpu_reg);
- dt_cpufreq_driver.driver_data = dev_get_platdata(&pdev->dev);
-+ fptr = dev_get_platdata(&pdev->dev);
+ pax_open_kernel();
-+ *(void **)&dt_cpufreq_driver.driver_data = fptr;
++ *(void **)&dt_cpufreq_driver.driver_data = dev_get_platdata(&pdev->dev);
+ pax_close_kernel();
ret = cpufreq_register_driver(&dt_cpufreq_driver);
@@ -53107,7 +53195,7 @@ index c78f43a..22b1dab 100644
if (cfg->uart_flags & UPF_CONS_FLOW) {
diff --git a/drivers/tty/serial/serial_core.c
b/drivers/tty/serial/serial_core.c
-index eaeb9a0..2691250 100644
+index eaeb9a0..01a238c 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1339,7 +1339,7 @@ static void uart_close(struct tty_struct *tty, struct
file *filp)
@@ -53142,7 +53230,7 @@ index eaeb9a0..2691250 100644
return retval;
err_dec_count:
- port->count--;
-+ atomic_inc(&port->count);
++ atomic_dec(&port->count);
mutex_unlock(&port->mutex);
goto end;
}
@@ -63473,7 +63561,7 @@ index 26753ba..d19eb34 100644
return res;
}
diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
-index f488bba..bb63254 100644
+index f488bba..735d752 100644
--- a/fs/isofs/rock.c
+++ b/fs/isofs/rock.c
@@ -30,6 +30,7 @@ struct rock_state {
@@ -63503,6 +63591,16 @@ index f488bba..bb63254 100644
bh = sb_bread(rs->inode->i_sb, rs->cont_extent);
if (bh) {
memcpy(rs->buffer, bh->b_data + rs->cont_offset,
+@@ -356,6 +362,9 @@ repeat:
+ rs.cont_size = isonum_733(rr->u.CE.size);
+ break;
+ case SIG('E', 'R'):
++ /* Invalid length of ER tag id? */
++ if (rr->u.ER.len_id + offsetof(struct rock_ridge,
u.ER.data) > rr->len)
++ goto out;
+ ISOFS_SB(inode->i_sb)->s_rock = 1;
+ printk(KERN_DEBUG "ISO 9660 Extensions: ");
+ {
diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
index 4a6cf28..d3a29d3 100644
--- a/fs/jffs2/erase.c
@@ -63545,7 +63643,7 @@ index 93e897e..a863de4 100644
if (jfs_inode_cachep == NULL)
return -ENOMEM;
diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
-index 1c77193..a50091d 100644
+index 1c77193..5cfb7b57 100644
--- a/fs/kernfs/dir.c
+++ b/fs/kernfs/dir.c
@@ -182,7 +182,7 @@ struct kernfs_node *kernfs_get_parent(struct kernfs_node
*kn)
@@ -63557,6 +63655,17 @@ index 1c77193..a50091d 100644
{
unsigned long hash = init_name_hash();
unsigned int len = strlen(name);
+@@ -829,6 +829,10 @@ static int kernfs_iop_mkdir(struct inode *dir, struct
dentry *dentry,
+ ret = scops->mkdir(parent, dentry->d_name.name, mode);
+
+ kernfs_put_active(parent);
++
++ if (!ret)
++ ret = kernfs_iop_lookup(dir, dentry, 0);
++
+ return ret;
+ }
+
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index 4429d6d..9831f52 100644
--- a/fs/kernfs/file.c
@@ -67605,6 +67714,45 @@ index fb08b0c..65fcc7e 100644
{
int err;
+diff --git a/fs/udf/dir.c b/fs/udf/dir.c
+index a012c51..a7690b4 100644
+--- a/fs/udf/dir.c
++++ b/fs/udf/dir.c
+@@ -167,7 +167,8 @@ static int udf_readdir(struct file *file, struct
dir_context *ctx)
+ continue;
+ }
+
+- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
++ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
++ UDF_NAME_LEN);
+ if (!flen)
+ continue;
+
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index c9b4df5..5bc71d9 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -1489,6 +1489,20 @@ reread:
+ }
+ inode->i_generation = iinfo->i_unique;
+
++ /* Sanity checks for files in ICB so that we don't get confused later */
++ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
++ /*
++ * For file in ICB data is stored in allocation descriptor
++ * so sizes should match
++ */
++ if (iinfo->i_lenAlloc != inode->i_size)
++ goto out;
++ /* File in ICB has to fit in there... */
++ if (inode->i_size > inode->i_sb->s_blocksize -
++ udf_file_entry_alloc_offset(inode))
++ goto out;
++ }
++
+ switch (fe->icbTag.fileType) {
+ case ICBTAG_FILE_TYPE_DIRECTORY:
+ inode->i_op = &udf_dir_inode_operations;
diff --git a/fs/udf/misc.c b/fs/udf/misc.c
index c175b4d..8f36a16 100644
--- a/fs/udf/misc.c
@@ -67618,6 +67766,257 @@ index c175b4d..8f36a16 100644
u8 checksum = 0;
int i;
for (i = 0; i < sizeof(struct tag); ++i)
+diff --git a/fs/udf/namei.c b/fs/udf/namei.c
+index c12e260..6ff19b5 100644
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -233,7 +233,8 @@ static struct fileIdentDesc *udf_find_entry(struct inode
*dir,
+ if (!lfi)
+ continue;
+
+- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
++ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
++ UDF_NAME_LEN);
+ if (flen && udf_match(flen, fname, child->len, child->name))
+ goto out_ok;
+ }
+diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c
+index 6fb7945..ac10ca9 100644
+--- a/fs/udf/symlink.c
++++ b/fs/udf/symlink.c
+@@ -30,49 +30,73 @@
+ #include <linux/buffer_head.h>
+ #include "udf_i.h"
+
+-static void udf_pc_to_char(struct super_block *sb, unsigned char *from,
+- int fromlen, unsigned char *to)
++static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
++ int fromlen, unsigned char *to, int tolen)
+ {
+ struct pathComponent *pc;
+ int elen = 0;
++ int comp_len;
+ unsigned char *p = to;
+
++ /* Reserve one byte for terminating \0 */
++ tolen--;
+ while (elen < fromlen) {
+ pc = (struct pathComponent *)(from + elen);
++ elen += sizeof(struct pathComponent);
+ switch (pc->componentType) {
+ case 1:
+ /*
+ * Symlink points to some place which should be agreed
+ * upon between originator and receiver of the media.
Ignore.
+ */
+- if (pc->lengthComponentIdent > 0)
++ if (pc->lengthComponentIdent > 0) {
++ elen += pc->lengthComponentIdent;
+ break;
++ }
+ /* Fall through */
+ case 2:
++ if (tolen == 0)
++ return -ENAMETOOLONG;
+ p = to;
+ *p++ = '/';
++ tolen--;
+ break;
+ case 3:
++ if (tolen < 3)
++ return -ENAMETOOLONG;
+ memcpy(p, "../", 3);
+ p += 3;
++ tolen -= 3;
+ break;
+ case 4:
++ if (tolen < 2)
++ return -ENAMETOOLONG;
+ memcpy(p, "./", 2);
+ p += 2;
++ tolen -= 2;
+ /* that would be . - just ignore */
+ break;
+ case 5:
+- p += udf_get_filename(sb, pc->componentIdent, p,
+- pc->lengthComponentIdent);
++ elen += pc->lengthComponentIdent;
++ if (elen > fromlen)
++ return -EIO;
++ comp_len = udf_get_filename(sb, pc->componentIdent,
++ pc->lengthComponentIdent,
++ p, tolen);
++ p += comp_len;
++ tolen -= comp_len;
++ if (tolen == 0)
++ return -ENAMETOOLONG;
+ *p++ = '/';
++ tolen--;
+ break;
+ }
+- elen += sizeof(struct pathComponent) + pc->lengthComponentIdent;
+ }
+ if (p > to + 1)
+ p[-1] = '\0';
+ else
+ p[0] = '\0';
++ return 0;
+ }
+
+ static int udf_symlink_filler(struct file *file, struct page *page)
+@@ -80,11 +104,17 @@ static int udf_symlink_filler(struct file *file, struct
page *page)
+ struct inode *inode = page->mapping->host;
+ struct buffer_head *bh = NULL;
+ unsigned char *symlink;
+- int err = -EIO;
++ int err;
+ unsigned char *p = kmap(page);
+ struct udf_inode_info *iinfo;
+ uint32_t pos;
+
++ /* We don't support symlinks longer than one block */
++ if (inode->i_size > inode->i_sb->s_blocksize) {
++ err = -ENAMETOOLONG;
++ goto out_unmap;
++ }
++
+ iinfo = UDF_I(inode);
+ pos = udf_block_map(inode, 0);
+
+@@ -94,14 +124,18 @@ static int udf_symlink_filler(struct file *file, struct
page *page)
+ } else {
+ bh = sb_bread(inode->i_sb, pos);
+
+- if (!bh)
+- goto out;
++ if (!bh) {
++ err = -EIO;
++ goto out_unlock_inode;
++ }
+
+ symlink = bh->b_data;
+ }
+
+- udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p);
++ err = udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p, PAGE_SIZE);
+ brelse(bh);
++ if (err)
++ goto out_unlock_inode;
+
+ up_read(&iinfo->i_data_sem);
+ SetPageUptodate(page);
+@@ -109,9 +143,10 @@ static int udf_symlink_filler(struct file *file, struct
page *page)
+ unlock_page(page);
+ return 0;
+
+-out:
++out_unlock_inode:
+ up_read(&iinfo->i_data_sem);
+ SetPageError(page);
++out_unmap:
+ kunmap(page);
+ unlock_page(page);
+ return err;
+diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
+index 1cc3c99..47bb3f5 100644
+--- a/fs/udf/udfdecl.h
++++ b/fs/udf/udfdecl.h
+@@ -211,7 +211,8 @@ udf_get_lb_pblock(struct super_block *sb, struct
kernel_lb_addr *loc,
+ }
+
+ /* unicode.c */
+-extern int udf_get_filename(struct super_block *, uint8_t *, uint8_t *, int);
++extern int udf_get_filename(struct super_block *, uint8_t *, int, uint8_t *,
++ int);
+ extern int udf_put_filename(struct super_block *, const uint8_t *, uint8_t *,
+ int);
+ extern int udf_build_ustr(struct ustr *, dstring *, int);
+diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
+index afd470e..b84fee3 100644
+--- a/fs/udf/unicode.c
++++ b/fs/udf/unicode.c
+@@ -28,7 +28,8 @@
+
+ #include "udf_sb.h"
+
+-static int udf_translate_to_linux(uint8_t *, uint8_t *, int, uint8_t *, int);
++static int udf_translate_to_linux(uint8_t *, int, uint8_t *, int, uint8_t *,
++ int);
+
+ static int udf_char_to_ustr(struct ustr *dest, const uint8_t *src, int strlen)
+ {
+@@ -333,8 +334,8 @@ try_again:
+ return u_len + 1;
+ }
+
+-int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
+- int flen)
++int udf_get_filename(struct super_block *sb, uint8_t *sname, int slen,
++ uint8_t *dname, int dlen)
+ {
+ struct ustr *filename, *unifilename;
+ int len = 0;
+@@ -347,7 +348,7 @@ int udf_get_filename(struct super_block *sb, uint8_t
*sname, uint8_t *dname,
+ if (!unifilename)
+ goto out1;
+
+- if (udf_build_ustr_exact(unifilename, sname, flen))
++ if (udf_build_ustr_exact(unifilename, sname, slen))
+ goto out2;
+
+ if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8)) {
+@@ -366,7 +367,8 @@ int udf_get_filename(struct super_block *sb, uint8_t
*sname, uint8_t *dname,
+ } else
+ goto out2;
+
+- len = udf_translate_to_linux(dname, filename->u_name, filename->u_len,
++ len = udf_translate_to_linux(dname, dlen,
++ filename->u_name, filename->u_len,
+ unifilename->u_name, unifilename->u_len);
+ out2:
+ kfree(unifilename);
+@@ -403,10 +405,12 @@ int udf_put_filename(struct super_block *sb, const
uint8_t *sname,
+ #define EXT_MARK '.'
+ #define CRC_MARK '#'
+ #define EXT_SIZE 5
++/* Number of chars we need to store generated CRC to make filename unique */
++#define CRC_LEN 5
+
+-static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
+- int udfLen, uint8_t *fidName,
+- int fidNameLen)
++static int udf_translate_to_linux(uint8_t *newName, int newLen,
++ uint8_t *udfName, int udfLen,
++ uint8_t *fidName, int fidNameLen)
+ {
+ int index, newIndex = 0, needsCRC = 0;
+ int extIndex = 0, newExtIndex = 0, hasExt = 0;
+@@ -439,7 +443,7 @@ static int udf_translate_to_linux(uint8_t *newName,
uint8_t *udfName,
+ newExtIndex = newIndex;
+ }
+ }
+- if (newIndex < 256)
++ if (newIndex < newLen)
+ newName[newIndex++] = curr;
+ else
+ needsCRC = 1;
+@@ -467,13 +471,13 @@ static int udf_translate_to_linux(uint8_t *newName,
uint8_t *udfName,
+ }
+ ext[localExtIndex++] = curr;
+ }
+- maxFilenameLen = 250 - localExtIndex;
++ maxFilenameLen = newLen - CRC_LEN - localExtIndex;
+ if (newIndex > maxFilenameLen)
+ newIndex = maxFilenameLen;
+ else
+ newIndex = newExtIndex;
+- } else if (newIndex > 250)
+- newIndex = 250;
++ } else if (newIndex > newLen - CRC_LEN)
++ newIndex = newLen - CRC_LEN;
+ newName[newIndex++] = CRC_MARK;
+ valueCRC = crc_itu_t(0, fidName, fidNameLen);
+ newName[newIndex++] = hex_asc_upper_hi(valueCRC >> 8);
diff --git a/fs/ufs/swab.h b/fs/ufs/swab.h
index 8d974c4..b82f6ec 100644
--- a/fs/ufs/swab.h
@@ -87678,10 +88077,10 @@ index e420a0c..38137fa 100644
task->sessionid = sessionid;
task->loginuid = loginuid;
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
-index d6594e4..00348e4 100644
+index d6594e4..597264b 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
-@@ -143,7 +143,7 @@ bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr,
+@@ -143,14 +143,17 @@ bpf_jit_binary_alloc(unsigned int proglen, u8
**image_ptr,
* random section of illegal instructions.
*/
size = round_up(proglen + sizeof(*hdr) + 128, PAGE_SIZE);
@@ -87690,7 +88089,17 @@ index d6594e4..00348e4 100644
if (hdr == NULL)
return NULL;
-@@ -163,7 +163,7 @@ bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr,
+ /* Fill space with illegal/arch-dep instructions. */
+ bpf_fill_ill_insns(hdr, size);
+
++ pax_open_kernel();
+ hdr->pages = size / PAGE_SIZE;
++ pax_close_kernel();
++
+ hole = min_t(unsigned int, size - (proglen + sizeof(*hdr)),
+ PAGE_SIZE - sizeof(*hdr));
+ start = (prandom_u32() % hole) & ~(alignment - 1);
+@@ -163,7 +166,7 @@ bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr,
void bpf_jit_binary_free(struct bpf_binary_header *hdr)
{
@@ -100205,9 +100614,18 @@ index 1e80539..676c37a 100644
if (ogm_packet->flags & BATADV_DIRECTLINK)
has_directlink_flag = true;
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
-index fc1835c..eead856 100644
+index fc1835c..42f2c2f 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
+@@ -251,7 +251,7 @@ batadv_frag_merge_packets(struct hlist_head *chain, struct
sk_buff *skb)
+ kfree(entry);
+
+ /* Make room for the rest of the fragments. */
+- if (pskb_expand_head(skb_out, 0, size - skb->len, GFP_ATOMIC) < 0) {
++ if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
+ kfree_skb(skb_out);
+ skb_out = NULL;
+ goto free;
@@ -450,7 +450,7 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
frag_header.packet_type = BATADV_UNICAST_FRAG;
frag_header.version = BATADV_COMPAT_VERSION;
diff --git a/3.2.66/0000_README b/3.2.66/0000_README
index 96a6e23..d4ad1aa 100644
--- a/3.2.66/0000_README
+++ b/3.2.66/0000_README
@@ -182,7 +182,7 @@ Patch: 1065_linux-3.2.66.patch
From: http://www.kernel.org
Desc: Linux 3.2.66
-Patch: 4420_grsecurity-3.0-3.2.65-201412280855.patch
+Patch: 4420_grsecurity-3.0-3.2.66-201501051839.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.2.66/4420_grsecurity-3.0-3.2.65-201412280855.patch
b/3.2.66/4420_grsecurity-3.0-3.2.66-201501051839.patch
similarity index 99%
rename from 3.2.66/4420_grsecurity-3.0-3.2.65-201412280855.patch
rename to 3.2.66/4420_grsecurity-3.0-3.2.66-201501051839.patch
index ac5d45e..a07d1dd 100644
--- a/3.2.66/4420_grsecurity-3.0-3.2.65-201412280855.patch
+++ b/3.2.66/4420_grsecurity-3.0-3.2.66-201501051839.patch
@@ -278,7 +278,7 @@ index 88fd7f5..b318a78 100644
==============================================================
diff --git a/Makefile b/Makefile
-index 1433109..a4bb56c 100644
+index f08f8bf..f762039 100644
--- a/Makefile
+++ b/Makefile
@@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo
$$BASH; \
@@ -980,7 +980,7 @@ index b7c5d5d..4b0c4ed 100644
9999:
.if \inc == 1
diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
-index 86976d0..269b872 100644
+index 86976d0..15420e6 100644
--- a/arch/arm/include/asm/atomic.h
+++ b/arch/arm/include/asm/atomic.h
@@ -15,6 +15,10 @@
@@ -1000,7 +1000,7 @@ index 86976d0..269b872 100644
#define atomic_read(v) (*(volatile int *)&(v)->counter)
+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
+{
-+ return v->counter;
++ return *(const volatile int *)&v->counter;
+}
#define atomic_set(v,i) (((v)->counter) = (i))
+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
@@ -6467,7 +6467,7 @@ index 0cfece4..2f1a0e5 100644
struct spu_context *ctx = vma->vm_file->private_data;
unsigned long offset = address - vma->vm_start;
diff --git a/arch/powerpc/platforms/cell/spufs/inode.c
b/arch/powerpc/platforms/cell/spufs/inode.c
-index 70ec4e9..3e7a115 100644
+index 941d5cb..1803d9e 100644
--- a/arch/powerpc/platforms/cell/spufs/inode.c
+++ b/arch/powerpc/platforms/cell/spufs/inode.c
@@ -811,6 +811,7 @@ static struct file_system_type spufs_type = {
@@ -7047,7 +7047,7 @@ index 07dd35e..2c6f765 100644
#include <asm-generic/atomic64.h>
diff --git a/arch/sparc/include/asm/atomic_64.h
b/arch/sparc/include/asm/atomic_64.h
-index 9f421df..b81fc12 100644
+index 9f421df..71e4800 100644
--- a/arch/sparc/include/asm/atomic_64.h
+++ b/arch/sparc/include/asm/atomic_64.h
@@ -14,18 +14,40 @@
@@ -7056,12 +7056,12 @@ index 9f421df..b81fc12 100644
#define atomic_read(v) (*(volatile int *)&(v)->counter)
+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
+{
-+ return v->counter;
++ return *(const volatile int *)&v->counter;
+}
#define atomic64_read(v) (*(volatile long *)&(v)->counter)
+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
+{
-+ return v->counter;
++ return *(const volatile long *)&v->counter;
+}
#define atomic_set(v, i) (((v)->counter) = i)
@@ -12220,7 +12220,7 @@ index 20370c6..a2eb9b0 100644
"popl %%ebp\n\t"
"popl %%edi\n\t"
diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
-index 58cb6d4..9503df6 100644
+index 58cb6d4..a8df22ae 100644
--- a/arch/x86/include/asm/atomic.h
+++ b/arch/x86/include/asm/atomic.h
@@ -22,7 +22,18 @@
@@ -12473,6 +12473,15 @@ index 58cb6d4..9503df6 100644
: "+m" (v->counter), "=qm" (c)
: "ir" (i) : "memory");
return c;
+@@ -170,7 +332,7 @@ static inline int atomic_add_negative(int i, atomic_t *v)
+ *
+ * Atomically adds @i to @v and returns @i + @v
+ */
+-static inline int atomic_add_return(int i, atomic_t *v)
++static inline int __intentional_overflow(-1) atomic_add_return(int i,
atomic_t *v)
+ {
+ #ifdef CONFIG_M386
+ int __i;
@@ -179,7 +341,7 @@ static inline int atomic_add_return(int i, atomic_t *v)
goto no_xadd;
#endif
@@ -12482,7 +12491,7 @@ index 58cb6d4..9503df6 100644
#ifdef CONFIG_M386
no_xadd: /* Legacy 386 processor */
-@@ -192,6 +354,34 @@ no_xadd: /* Legacy 386 processor */
+@@ -192,21 +354,58 @@ no_xadd: /* Legacy 386 processor */
}
/**
@@ -12517,7 +12526,13 @@ index 58cb6d4..9503df6 100644
* atomic_sub_return - subtract integer and return
* @v: pointer of type atomic_t
* @i: integer value to subtract
-@@ -204,9 +394,18 @@ static inline int atomic_sub_return(int i, atomic_t *v)
+ *
+ * Atomically subtracts @i from @v and returns @v - @i
+ */
+-static inline int atomic_sub_return(int i, atomic_t *v)
++static inline int __intentional_overflow(-1) atomic_sub_return(int i,
atomic_t *v)
+ {
+ return atomic_add_return(-i, v);
}
#define atomic_inc_return(v) (atomic_add_return(1, v))
@@ -13517,10 +13532,10 @@ index 30d737e..9830a9b 100644
static inline void __user *compat_ptr(compat_uptr_t uptr)
{
diff --git a/arch/x86/include/asm/cpufeature.h
b/arch/x86/include/asm/cpufeature.h
-index a315f1c..540df6a 100644
+index b8a5fe5..fbbe2c2 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
-@@ -197,8 +197,9 @@
+@@ -198,8 +198,9 @@
/* Intel-defined CPU features, CPUID level 0x00000007:0 (ebx), word 9 */
#define X86_FEATURE_FSGSBASE (9*32+ 0) /* {RD/WR}{FS/GS}BASE instructions*/
@@ -13531,7 +13546,7 @@ index a315f1c..540df6a 100644
#if defined(__KERNEL__) && !defined(__ASSEMBLY__)
-@@ -363,7 +364,7 @@ static __always_inline __pure bool __static_cpu_has(u16
bit)
+@@ -364,7 +365,7 @@ static __always_inline __pure bool __static_cpu_has(u16
bit)
".section .discard,\"aw\",@progbits\n"
" .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check
*/
".previous\n"
@@ -17866,10 +17881,10 @@ index 25f24dc..4094a7f 100644
obj-y += proc.o capflags.o powerflags.o common.o
obj-y += vmware.o hypervisor.o sched.o mshyperv.o
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
-index f07becc..b17b101 100644
+index 2d44a28..c33f4c8 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
-@@ -694,7 +694,7 @@ static unsigned int __cpuinit amd_size_cache(struct
cpuinfo_x86 *c,
+@@ -701,7 +701,7 @@ static unsigned int __cpuinit amd_size_cache(struct
cpuinfo_x86 *c,
unsigned int size)
{
/* AMD errata T13 (order #21922) */
@@ -19674,7 +19689,7 @@ index 0fa4f89..40ff646 100644
/*
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
-index 9d28dbac..9d8b7a4 100644
+index 9d28dbac..43bde59 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -56,6 +56,8 @@
@@ -20377,6 +20392,27 @@ index 9d28dbac..9d8b7a4 100644
/*
* The iretq could re-enable interrupts:
*/
+@@ -890,15 +1227,15 @@ native_irq_return_ldt:
+ SWAPGS
+ movq PER_CPU_VAR(espfix_waddr),%rdi
+ movq %rax,(0*8)(%rdi) /* RAX */
+- movq (2*8)(%rsp),%rax /* RIP */
++ movq (2*8 + RIP-RIP)(%rsp),%rax /* RIP */
+ movq %rax,(1*8)(%rdi)
+- movq (3*8)(%rsp),%rax /* CS */
++ movq (2*8 + CS-RIP)(%rsp),%rax /* CS */
+ movq %rax,(2*8)(%rdi)
+- movq (4*8)(%rsp),%rax /* RFLAGS */
++ movq (2*8 + EFLAGS-RIP)(%rsp),%rax /* RFLAGS */
+ movq %rax,(3*8)(%rdi)
+- movq (6*8)(%rsp),%rax /* SS */
++ movq (2*8 + SS-RIP)(%rsp),%rax /* SS */
+ movq %rax,(5*8)(%rdi)
+- movq (5*8)(%rsp),%rax /* RSP */
++ movq (2*8 + RSP-RIP)(%rsp),%rax /* RSP */
+ movq %rax,(4*8)(%rdi)
+ andl $0xffff0000,%eax
+ popq_cfi %rdi
@@ -954,7 +1291,7 @@ ENTRY(retint_kernel)
jmp exit_intr
#endif
@@ -20668,7 +20704,7 @@ index 9d28dbac..9d8b7a4 100644
/*
* End of kprobes section
diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
-index 94d857f..5bce89c 100644
+index 94d857f..6042d8a 100644
--- a/arch/x86/kernel/espfix_64.c
+++ b/arch/x86/kernel/espfix_64.c
@@ -70,8 +70,7 @@ static DEFINE_MUTEX(espfix_init_mutex);
@@ -20681,7 +20717,7 @@ index 94d857f..5bce89c 100644
static unsigned int page_random, slot_random;
-@@ -122,14 +121,17 @@ static void init_espfix_random(void)
+@@ -122,14 +121,16 @@ static void init_espfix_random(void)
void __init init_espfix_bsp(void)
{
pgd_t *pgd_p;
@@ -20696,14 +20732,13 @@ index 94d857f..5bce89c 100644
pgd_populate(&init_mm, pgd_p, (pud_t *)espfix_pud_page);
+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ clone_pgd_range(get_cpu_pgd(0, kernel) + index, swapper_pg_dir + index,
1);
-+ clone_pgd_range(get_cpu_pgd(0, user) + index, swapper_pg_dir + index,
1);
++ clone_pgd_range(get_cpu_pgd(0) + index, swapper_pg_dir + index, 1);
+#endif
+
/* Randomize the locations */
init_espfix_random();
-@@ -197,7 +199,7 @@ void init_espfix_ap(void)
+@@ -197,7 +198,7 @@ void init_espfix_ap(void)
set_pte(&pte_p[n*PTE_STRIDE], pte);
/* Job is done for this CPU and any CPU which shares this page */
@@ -22231,26 +22266,10 @@ index 7da647d..6e9fab5 100644
reset_current_kprobe();
preempt_enable_no_resched();
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
-index a9c2116..1a3dcdb 100644
+index 4b6701e..1a3dcdb 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
-@@ -419,7 +419,14 @@ static void kvm_leave_lazy_mmu(void)
- static void __init paravirt_ops_setup(void)
- {
- pv_info.name = "KVM";
-- pv_info.paravirt_enabled = 1;
-+
-+ /*
-+ * KVM isn't paravirt in the sense of paravirt_enabled. A KVM
-+ * guest kernel works like a bare metal kernel with additional
-+ * features, and paravirt_enabled is about features that are
-+ * missing.
-+ */
-+ pv_info.paravirt_enabled = 0;
-
- if (kvm_para_has_feature(KVM_FEATURE_NOP_IO_DELAY))
- pv_cpu_ops.io_delay = kvm_io_delay;
-@@ -437,6 +444,7 @@ static void __init paravirt_ops_setup(void)
+@@ -444,6 +444,7 @@ static void __init paravirt_ops_setup(void)
pv_mmu_ops.set_pud = kvm_set_pud;
#if PAGETABLE_LEVELS == 4
pv_mmu_ops.set_pgd = kvm_set_pgd;
@@ -22258,7 +22277,7 @@ index a9c2116..1a3dcdb 100644
#endif
#endif
pv_mmu_ops.flush_tlb_user = kvm_flush_tlb;
-@@ -579,7 +587,7 @@ static int __cpuinit kvm_cpu_notify(struct notifier_block
*self,
+@@ -586,7 +587,7 @@ static int __cpuinit kvm_cpu_notify(struct notifier_block
*self,
return NOTIFY_OK;
}
@@ -22267,18 +22286,6 @@ index a9c2116..1a3dcdb 100644
.notifier_call = kvm_cpu_notify,
};
#endif
-diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
-index 44842d7..e90eca0 100644
---- a/arch/x86/kernel/kvmclock.c
-+++ b/arch/x86/kernel/kvmclock.c
-@@ -203,7 +203,6 @@ void __init kvmclock_init(void)
- #endif
- kvm_get_preset_lpj();
- clocksource_register_hz(&kvm_clock, NSEC_PER_SEC);
-- pv_info.paravirt_enabled = 1;
- pv_info.name = "KVM";
-
- if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE_STABLE_BIT))
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index 0a8e65e..288a4b0 100644
--- a/arch/x86/kernel/ldt.c
@@ -24354,25 +24361,13 @@ index dd5fbf4..b7f2232 100644
return pc;
}
diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
-index bcfec2d..36ed955 100644
+index 7af7338..36ed955 100644
--- a/arch/x86/kernel/tls.c
+++ b/arch/x86/kernel/tls.c
-@@ -28,6 +28,37 @@ static int get_free_idx(void)
- return -ESRCH;
- }
+@@ -40,6 +40,22 @@ static bool tls_desc_okay(const struct user_desc *info)
+ if (!info->seg_32bit)
+ return false;
-+static bool tls_desc_okay(const struct user_desc *info)
-+{
-+ if (LDT_empty(info))
-+ return true;
-+
-+ /*
-+ * espfix is required for 16-bit data segments, but espfix
-+ * only works for LDT segments.
-+ */
-+ if (!info->seg_32bit)
-+ return false;
-+
+ /* Only allow data segments in the TLS array. */
+ if (info->contents > 1)
+ return false;
@@ -24389,23 +24384,10 @@ index bcfec2d..36ed955 100644
+ if (info->seg_not_present)
+ return false;
+
-+ return true;
-+}
-+
- static void set_tls_desc(struct task_struct *p, int idx,
- const struct user_desc *info, int n)
- {
-@@ -67,6 +98,9 @@ int do_set_thread_area(struct task_struct *p, int idx,
- if (copy_from_user(&info, u_info, sizeof(info)))
- return -EFAULT;
-
-+ if (!tls_desc_okay(&info))
-+ return -EINVAL;
-+
- if (idx == -1)
- idx = info.entry_number;
+ return true;
+ }
-@@ -85,6 +119,11 @@ int do_set_thread_area(struct task_struct *p, int idx,
+@@ -103,6 +119,11 @@ int do_set_thread_area(struct task_struct *p, int idx,
if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
return -EINVAL;
@@ -24417,15 +24399,7 @@ index bcfec2d..36ed955 100644
set_tls_desc(p, idx, &info, 1);
return 0;
-@@ -197,6 +236,7 @@ int regset_tls_set(struct task_struct *target, const
struct user_regset *regset,
- {
- struct user_desc infobuf[GDT_ENTRY_TLS_ENTRIES];
- const struct user_desc *info;
-+ int i;
-
- if (pos >= GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
- (pos % sizeof(struct user_desc)) != 0 ||
-@@ -205,11 +245,15 @@ int regset_tls_set(struct task_struct *target, const
struct user_regset *regset,
+@@ -224,7 +245,7 @@ int regset_tls_set(struct task_struct *target, const
struct user_regset *regset,
if (kbuf)
info = kbuf;
@@ -24434,14 +24408,6 @@ index bcfec2d..36ed955 100644
return -EFAULT;
else
info = infobuf;
-
-+ for (i = 0; i < count / sizeof(struct user_desc); i++)
-+ if (!tls_desc_okay(info + i))
-+ return -EINVAL;
-+
- set_tls_desc(target,
- GDT_ENTRY_TLS_MIN + (pos / sizeof(struct user_desc)),
- info, count / sizeof(struct user_desc));
diff --git a/arch/x86/kernel/trampoline_32.S b/arch/x86/kernel/trampoline_32.S
index 451c0a7..e57f551 100644
--- a/arch/x86/kernel/trampoline_32.S
@@ -24491,7 +24457,7 @@ index 09ff517..df19fbff 100644
.short 0
.quad 0x00cf9b000000ffff # __KERNEL32_CS
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
-index 2aff347..a6d2a52 100644
+index 2aff347..d83c9a9 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -70,12 +70,6 @@ asmlinkage int system_call(void);
@@ -24621,7 +24587,16 @@ index 2aff347..a6d2a52 100644
die("general protection fault", regs, error_code);
}
-@@ -389,7 +423,7 @@ struct bad_iret_stack *fixup_bad_iret(struct
bad_iret_stack *s)
+@@ -383,13 +417,16 @@ struct bad_iret_stack *fixup_bad_iret(struct
bad_iret_stack *s)
+ container_of(task_pt_regs(current),
+ struct bad_iret_stack, regs);
+
++ if ((current->thread.sp0 ^ (unsigned long)s) < THREAD_SIZE)
++ new_stack = s;
++
+ /* Copy the IRET target to the new stack. */
+ memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8);
+
/* Copy the remainder of the stack from the current stack. */
memmove(new_stack, s, offsetof(struct bad_iret_stack, regs.ip));
@@ -24630,7 +24605,7 @@ index 2aff347..a6d2a52 100644
return new_stack;
}
#endif
-@@ -460,7 +494,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs
*regs, long error_code)
+@@ -460,7 +497,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs
*regs, long error_code)
/* It's safe to allow irq's after DR6 has been saved */
preempt_conditional_sti(regs);
@@ -24639,7 +24614,7 @@ index 2aff347..a6d2a52 100644
handle_vm86_trap((struct kernel_vm86_regs *) regs, error_code,
X86_TRAP_DB);
preempt_conditional_cli(regs);
-@@ -474,7 +508,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs
*regs, long error_code)
+@@ -474,7 +511,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs
*regs, long error_code)
* We already checked v86 mode above, so we can check for kernel mode
* by just checking the CPL of CS.
*/
@@ -24648,7 +24623,7 @@ index 2aff347..a6d2a52 100644
tsk->thread.debugreg6 &= ~DR_STEP;
set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
regs->flags &= ~X86_EFLAGS_TF;
-@@ -504,7 +538,7 @@ void math_error(struct pt_regs *regs, int error_code, int
trapnr)
+@@ -504,7 +541,7 @@ void math_error(struct pt_regs *regs, int error_code, int
trapnr)
return;
conditional_sti(regs);
@@ -24657,7 +24632,7 @@ index 2aff347..a6d2a52 100644
{
if (!fixup_exception(regs)) {
task->thread.error_code = error_code;
-@@ -617,8 +651,8 @@ asmlinkage void __attribute__((weak))
smp_threshold_interrupt(void)
+@@ -617,8 +654,8 @@ asmlinkage void __attribute__((weak))
smp_threshold_interrupt(void)
void __math_state_restore(struct task_struct *tsk)
{
/* We need a safe address that is cheap to find and that is already
@@ -25141,7 +25116,7 @@ index 7110911..069da9c 100644
/*
* Encountered an error while doing the restore from the
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index f0ac042..0ca3004 100644
+index f0ac042..ea3fe9c 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -249,6 +249,7 @@ struct gprefix {
@@ -25179,6 +25154,15 @@ index f0ac042..0ca3004 100644
} while (0)
/* instruction has only one source operand, destination is implicit (e.g.
mul, div, imul, idiv) */
+@@ -3003,7 +3000,7 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
+ int cr = ctxt->modrm_reg;
+ u64 efer = 0;
+
+- static u64 cr_reserved_bits[] = {
++ static const u64 cr_reserved_bits[] = {
+ 0xffffffff00000000ULL,
+ 0, 0, 0, /* CR3 checked later */
+ CR4_RESERVED_BITS,
@@ -3038,7 +3035,7 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt)
ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
@@ -25392,7 +25376,7 @@ index 8831c43..98f1a3e 100644
vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 2d7d0df..2de279c0 100644
+index bb179cc..2de279c0 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -668,6 +668,8 @@ EXPORT_SYMBOL_GPL(kvm_set_cr4);
@@ -25480,15 +25464,6 @@ index 2d7d0df..2de279c0 100644
return -EINVAL;
if (irqchip_in_kernel(vcpu->kvm))
return -ENXIO;
-@@ -4846,7 +4859,7 @@ static int handle_emulation_failure(struct kvm_vcpu
*vcpu)
-
- ++vcpu->stat.insn_emulation_fail;
- trace_kvm_emulate_insn_failed(vcpu);
-- if (!is_guest_mode(vcpu)) {
-+ if (!is_guest_mode(vcpu) && kvm_x86_ops->get_cpl(vcpu) == 0) {
- vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
- vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
- vcpu->run->internal.ndata = 0;
@@ -5209,7 +5222,7 @@ static void kvm_set_mmio_spte_mask(void)
kvm_mmu_set_mmio_spte_mask(mask);
}
@@ -38072,7 +38047,7 @@ index 98723cb..10ca85b 100644
return -EINVAL;
}
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index 3f1799b..7d5796a 100644
+index 09851ce..4ba7573 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -1379,7 +1379,7 @@ int drm_mode_getconnector(struct drm_device *dev, void
*data,
@@ -38113,7 +38088,7 @@ index 3f1799b..7d5796a 100644
if (get_user(out_id, &set_connectors_ptr[i])) {
ret = -EFAULT;
goto out;
-@@ -1846,7 +1846,7 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
+@@ -1856,7 +1856,7 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
fb = obj_to_fb(obj);
num_clips = r->num_clips;
@@ -38122,7 +38097,7 @@ index 3f1799b..7d5796a 100644
if (!num_clips != !clips_ptr) {
ret = -EINVAL;
-@@ -2272,7 +2272,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
+@@ -2282,7 +2282,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
out_resp->flags = property->flags;
if ((out_resp->count_values >= value_count) && value_count) {
@@ -38131,7 +38106,7 @@ index 3f1799b..7d5796a 100644
for (i = 0; i < value_count; i++) {
if (copy_to_user(values_ptr + i, &property->values[i],
sizeof(uint64_t))) {
ret = -EFAULT;
-@@ -2285,7 +2285,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
+@@ -2295,7 +2295,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
if (property->flags & DRM_MODE_PROP_ENUM) {
if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
copied = 0;
@@ -38140,7 +38115,7 @@ index 3f1799b..7d5796a 100644
list_for_each_entry(prop_enum,
&property->enum_blob_list, head) {
if (copy_to_user(&enum_ptr[copied].value,
&prop_enum->value, sizeof(uint64_t))) {
-@@ -2293,7 +2293,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
+@@ -2303,7 +2303,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
goto done;
}
@@ -38149,7 +38124,7 @@ index 3f1799b..7d5796a 100644
&prop_enum->name,
DRM_PROP_NAME_LEN)) {
ret = -EFAULT;
goto done;
-@@ -2308,7 +2308,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
+@@ -2318,7 +2318,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
if ((out_resp->count_enum_blobs >= blob_count) && blob_count) {
copied = 0;
blob_id_ptr = (uint32_t *)(unsigned
long)out_resp->enum_blob_ptr;
@@ -38158,7 +38133,7 @@ index 3f1799b..7d5796a 100644
list_for_each_entry(prop_blob,
&property->enum_blob_list, head) {
if (put_user(prop_blob->base.id, blob_id_ptr +
copied)) {
-@@ -2369,7 +2369,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
+@@ -2379,7 +2379,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
struct drm_mode_get_blob *out_resp = data;
struct drm_property_blob *blob;
int ret = 0;
@@ -38167,7 +38142,7 @@ index 3f1799b..7d5796a 100644
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EINVAL;
-@@ -2383,7 +2383,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
+@@ -2393,7 +2393,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
blob = obj_to_blob(obj);
if (out_resp->length == blob->length) {
@@ -43785,20 +43760,6 @@ index 0564192..75b16f5 100644
NGENE_ID(0x18c3, 0xabc3, ngene_info_cineS2),
NGENE_ID(0x18c3, 0xabc4, ngene_info_cineS2),
NGENE_ID(0x18c3, 0xdb01, ngene_info_satixS2),
-diff --git a/drivers/media/dvb/ttusb-dec/ttusbdecfe.c
b/drivers/media/dvb/ttusb-dec/ttusbdecfe.c
-index 21260aa..852870b 100644
---- a/drivers/media/dvb/ttusb-dec/ttusbdecfe.c
-+++ b/drivers/media/dvb/ttusb-dec/ttusbdecfe.c
-@@ -154,6 +154,9 @@ static int ttusbdecfe_dvbs_diseqc_send_master_cmd(struct
dvb_frontend* fe, struc
- 0x00, 0x00, 0x00, 0x00,
- 0x00, 0x00 };
-
-+ if (cmd->msg_len > sizeof(b) - 4)
-+ return -EINVAL;
-+
- memcpy(&b[4], cmd->msg, cmd->msg_len);
-
- state->config->send_command(fe, 0x72,
diff --git a/drivers/media/radio/radio-cadet.c
b/drivers/media/radio/radio-cadet.c
index 16a089f..1661b11 100644
--- a/drivers/media/radio/radio-cadet.c
@@ -45069,6 +45030,45 @@ index cf95bd8d..f61f675 100644
/* check to see if we are clearing active */
if (!strlen(ifname) || buf[0] == '\n') {
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 1eac27f..ecd3827 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -721,7 +721,7 @@ static int can_newlink(struct net *src_net, struct
net_device *dev,
+ return -EOPNOTSUPP;
+ }
+
+-static struct rtnl_link_ops can_link_ops __read_mostly = {
++static struct rtnl_link_ops can_link_ops = {
+ .kind = "can",
+ .maxtype = IFLA_CAN_MAX,
+ .policy = can_policy,
+diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
+index f93e2d6..f1cbbc2 100644
+--- a/drivers/net/can/vcan.c
++++ b/drivers/net/can/vcan.c
+@@ -154,7 +154,7 @@ static void vcan_setup(struct net_device *dev)
+ dev->destructor = free_netdev;
+ }
+
+-static struct rtnl_link_ops vcan_link_ops __read_mostly = {
++static struct rtnl_link_ops vcan_link_ops = {
+ .kind = "vcan",
+ .setup = vcan_setup,
+ };
+diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
+index 99b1145..54ce102 100644
+--- a/drivers/net/dummy.c
++++ b/drivers/net/dummy.c
+@@ -150,7 +150,7 @@ static int dummy_validate(struct nlattr *tb[], struct
nlattr *data[])
+ return 0;
+ }
+
+-static struct rtnl_link_ops dummy_link_ops __read_mostly = {
++static struct rtnl_link_ops dummy_link_ops = {
+ .kind = "dummy",
+ .setup = dummy_setup,
+ .validate = dummy_validate,
diff --git a/drivers/net/ethernet/8390/ax88796.c
b/drivers/net/ethernet/8390/ax88796.c
index e9f8432..45308e6 100644
--- a/drivers/net/ethernet/8390/ax88796.c
@@ -45704,6 +45704,19 @@ index d4d2bc1..14b8672 100644
};
static int stmmac_init_fs(struct net_device *dev)
+diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
+index 00f1367..bfcb2f6 100644
+--- a/drivers/net/ifb.c
++++ b/drivers/net/ifb.c
+@@ -251,7 +251,7 @@ static int ifb_validate(struct nlattr *tb[], struct nlattr
*data[])
+ return 0;
+ }
+
+-static struct rtnl_link_ops ifb_link_ops __read_mostly = {
++static struct rtnl_link_ops ifb_link_ops = {
+ .kind = "ifb",
+ .priv_size = sizeof(struct ifb_private),
+ .setup = ifb_setup,
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index d0893e4..14b0d44 100644
--- a/drivers/net/loopback.c
@@ -45753,10 +45766,19 @@ index fed39de..8adf3152 100644
};
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
-index b0f9015..edcb1f3 100644
+index 0e6e57e..060e208 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
-@@ -924,7 +924,7 @@ static long macvtap_ioctl(struct file *file, unsigned int
cmd,
+@@ -351,7 +351,7 @@ static void macvtap_setup(struct net_device *dev)
+ dev->tx_queue_len = TUN_READQ_SIZE;
+ }
+
+-static struct rtnl_link_ops macvtap_link_ops __read_mostly = {
++static struct rtnl_link_ops macvtap_link_ops = {
+ .kind = "macvtap",
+ .setup = macvtap_setup,
+ .newlink = macvtap_newlink,
+@@ -927,7 +927,7 @@ static long macvtap_ioctl(struct file *file, unsigned int
cmd,
return -ENOLINK;
ret = 0;
@@ -45765,7 +45787,7 @@ index b0f9015..edcb1f3 100644
put_user(q->flags, &ifr->ifr_flags))
ret = -EFAULT;
dev_put(vlan->dev);
-@@ -1085,7 +1085,7 @@ static int macvtap_device_event(struct notifier_block
*unused,
+@@ -1088,7 +1088,7 @@ static int macvtap_device_event(struct notifier_block
*unused,
return NOTIFY_DONE;
}
@@ -45902,10 +45924,10 @@ index 46db5c5..37c1536 100644
err = platform_driver_register(&sk_isa_driver);
if (err)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index ee1aab0..7d4fd21 100644
+index 2fbbca6..761d265 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
-@@ -186,7 +186,6 @@ static void __tun_detach(struct tun_struct *tun)
+@@ -187,7 +187,6 @@ static void __tun_detach(struct tun_struct *tun)
netif_tx_lock_bh(tun->dev);
netif_carrier_off(tun->dev);
tun->tfile = NULL;
@@ -45913,7 +45935,7 @@ index ee1aab0..7d4fd21 100644
netif_tx_unlock_bh(tun->dev);
/* Drop read queue */
-@@ -359,7 +358,7 @@ static void tun_free_netdev(struct net_device *dev)
+@@ -360,7 +359,7 @@ static void tun_free_netdev(struct net_device *dev)
{
struct tun_struct *tun = netdev_priv(dev);
@@ -45922,7 +45944,16 @@ index ee1aab0..7d4fd21 100644
}
/* Net device open. */
-@@ -983,10 +982,18 @@ static int tun_recvmsg(struct kiocb *iocb, struct socket
*sock,
+@@ -931,7 +930,7 @@ static int tun_validate(struct nlattr *tb[], struct nlattr
*data[])
+ return -EINVAL;
+ }
+
+-static struct rtnl_link_ops tun_link_ops __read_mostly = {
++static struct rtnl_link_ops tun_link_ops = {
+ .kind = DRV_NAME,
+ .priv_size = sizeof(struct tun_struct),
+ .setup = tun_setup,
+@@ -988,10 +987,18 @@ static int tun_recvmsg(struct kiocb *iocb, struct socket
*sock,
return ret;
}
@@ -45941,7 +45972,7 @@ index ee1aab0..7d4fd21 100644
};
static struct proto tun_proto = {
-@@ -1113,10 +1120,11 @@ static int tun_set_iff(struct net *net, struct file
*file, struct ifreq *ifr)
+@@ -1118,10 +1125,11 @@ static int tun_set_iff(struct net *net, struct file
*file, struct ifreq *ifr)
tun->vnet_hdr_sz = sizeof(struct virtio_net_hdr);
err = -ENOMEM;
@@ -45954,7 +45985,7 @@ index ee1aab0..7d4fd21 100644
tun->socket.wq = &tun->wq;
init_waitqueue_head(&tun->wq.wait);
tun->socket.ops = &tun_socket_ops;
-@@ -1177,7 +1185,7 @@ static int tun_set_iff(struct net *net, struct file
*file, struct ifreq *ifr)
+@@ -1182,7 +1190,7 @@ static int tun_set_iff(struct net *net, struct file
*file, struct ifreq *ifr)
return 0;
err_free_sk:
@@ -45963,7 +45994,7 @@ index ee1aab0..7d4fd21 100644
err_free_dev:
free_netdev(dev);
failed:
-@@ -1236,7 +1244,7 @@ static int set_offload(struct tun_struct *tun, unsigned
long arg)
+@@ -1241,7 +1249,7 @@ static int set_offload(struct tun_struct *tun, unsigned
long arg)
}
static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
@@ -45972,7 +46003,7 @@ index ee1aab0..7d4fd21 100644
{
struct tun_file *tfile = file->private_data;
struct tun_struct *tun;
-@@ -1247,6 +1255,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned
int cmd,
+@@ -1252,6 +1260,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned
int cmd,
int vnet_hdr_sz;
int ret;
@@ -57436,7 +57467,7 @@ index b4d2438..0935840 100644
kunmap(page);
if (ret != len)
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
-index 9895400..78a67e7 100644
+index 7903e62..096162e 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -244,7 +244,7 @@ static int ceph_readdir(struct file *filp, void *dirent,
filldir_t filldir)
@@ -57817,7 +57848,7 @@ index 52a820a..1d8ab03 100644
/*
diff --git a/fs/coda/cache.c b/fs/coda/cache.c
-index 6901578..d402eb5 100644
+index 4b2e5cb..67b96bb 100644
--- a/fs/coda/cache.c
+++ b/fs/coda/cache.c
@@ -24,7 +24,7 @@
@@ -58125,7 +58156,7 @@ index 739fb59..5385976 100644
static int __init init_cramfs_fs(void)
{
diff --git a/fs/dcache.c b/fs/dcache.c
-index d322929..9f4b8167 100644
+index 3f65742..9a9eeb5 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -103,11 +103,11 @@ static unsigned int d_hash_shift __read_mostly;
@@ -58144,7 +58175,7 @@ index d322929..9f4b8167 100644
return dentry_hashtable + (hash & D_HASHMASK);
}
-@@ -3057,7 +3057,8 @@ void __init vfs_caches_init(unsigned long mempages)
+@@ -3080,7 +3080,8 @@ void __init vfs_caches_init(unsigned long mempages)
mempages -= reserve;
names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
@@ -58155,7 +58186,7 @@ index d322929..9f4b8167 100644
dcache_init();
inode_init();
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
-index 01951c6b..01de40e 100644
+index 6ac0893..238a21a 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -145,6 +145,7 @@ static struct file_system_type debug_fs_type = {
@@ -61790,7 +61821,7 @@ index 2f9197f..e2f03bf 100644
-/* Actual filesystem name is iso9660, as requested in filesystems.c */
-MODULE_ALIAS("iso9660");
diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
-index ee62cc0..26859de 100644
+index ee62cc0..1780949 100644
--- a/fs/isofs/rock.c
+++ b/fs/isofs/rock.c
@@ -30,6 +30,7 @@ struct rock_state {
@@ -61820,6 +61851,16 @@ index ee62cc0..26859de 100644
bh = sb_bread(rs->inode->i_sb, rs->cont_extent);
if (bh) {
memcpy(rs->buffer, bh->b_data + rs->cont_offset,
+@@ -356,6 +362,9 @@ repeat:
+ rs.cont_size = isonum_733(rr->u.CE.size);
+ break;
+ case SIG('E', 'R'):
++ /* Invalid length of ER tag id? */
++ if (rr->u.ER.len_id + offsetof(struct rock_ridge,
u.ER.data) > rr->len)
++ goto out;
+ ISOFS_SB(inode->i_sb)->s_rock = 1;
+ printk(KERN_DEBUG "ISO 9660 Extensions: ");
+ {
diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
index e513f19..2ab1351 100644
--- a/fs/jffs2/erase.c
@@ -61882,7 +61923,7 @@ index a44eff076..a4bf76a 100644
if (jfs_inode_cachep == NULL)
return -ENOMEM;
diff --git a/fs/libfs.c b/fs/libfs.c
-index f6d411e..e82a08d 100644
+index ce85edf..56ab3c0 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -165,6 +165,9 @@ int dcache_readdir(struct file * filp, void * dirent,
filldir_t filldir)
@@ -61892,7 +61933,7 @@ index f6d411e..e82a08d 100644
+ char d_name[sizeof(next->d_iname)];
+ const unsigned char *name;
+
- next = list_entry(p, struct dentry,
d_u.d_child);
+ next = list_entry(p, struct dentry, d_child);
spin_lock_nested(&next->d_lock,
DENTRY_D_LOCK_NESTED);
if (!simple_positive(next)) {
@@ -174,7 +177,12 @@ int dcache_readdir(struct file * filp, void * dirent,
filldir_t filldir)
@@ -66252,8 +66293,22 @@ index 201bcfc..cee4d16 100644
/*
* Inode slab cache constructor.
+diff --git a/fs/udf/dir.c b/fs/udf/dir.c
+index eb8bfe2..7ab52de 100644
+--- a/fs/udf/dir.c
++++ b/fs/udf/dir.c
+@@ -163,7 +163,8 @@ static int do_udf_readdir(struct inode *dir, struct file
*filp,
+ struct kernel_lb_addr tloc =
lelb_to_cpu(cfi.icb.extLocation);
+
+ iblock = udf_get_lb_pblock(dir->i_sb, &tloc, 0);
+- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
++ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
++ UDF_NAME_LEN);
+ dt_type = DT_UNKNOWN;
+ }
+
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
-index af37ce3..c0346e6 100644
+index a0f6ded..645d7053 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -50,7 +50,6 @@ MODULE_LICENSE("GPL");
@@ -66264,18 +66319,12 @@ index af37ce3..c0346e6 100644
static int udf_sync_inode(struct inode *inode);
static int udf_alloc_i_data(struct inode *inode, size_t size);
static struct buffer_head *inode_getblk(struct inode *, sector_t, int *,
-@@ -1176,13 +1175,25 @@ update_time:
- return 0;
- }
+@@ -1183,15 +1182,28 @@ update_time:
+ */
+ #define UDF_MAX_ICB_NESTING 1024
-+/*
-+ * Maximum length of linked list formed by ICB hierarchy. The chosen number is
-+ * arbitrary - just that we hopefully don't limit any real use of rewritten
-+ * inode on write-once media but avoid looping for too long on corrupted
media.
-+ */
-+#define UDF_MAX_ICB_NESTING 1024
-+
- static void __udf_read_inode(struct inode *inode)
+-static void __udf_read_inode(struct inode *inode)
++static int udf_read_inode(struct inode *inode)
{
struct buffer_head *bh = NULL;
struct fileEntry *fe;
@@ -66283,14 +66332,44 @@ index af37ce3..c0346e6 100644
uint16_t ident;
struct udf_inode_info *iinfo = UDF_I(inode);
+ struct udf_sb_info *sbi = UDF_SB(inode->i_sb);
++ struct kernel_lb_addr *iloc = &iinfo->i_location;
+ unsigned int link_count;
-+ unsigned int indirections = 0;
++
+ unsigned int indirections = 0;
++ int ret = -EIO;
-+reread:
+ reread:
++ if (iloc->logicalBlockNum >=
++ sbi->s_partmaps[iloc->partitionReferenceNum].s_partition_len) {
++ udf_debug("block=%d, partition=%d out of range\n",
++ iloc->logicalBlockNum, iloc->partitionReferenceNum);
++ return -EIO;
++ }
++
/*
* Set defaults, but the inode is still incomplete!
* Note: get_new_inode() sets the following on a new inode:
-@@ -1212,6 +1223,7 @@ static void __udf_read_inode(struct inode *inode)
+@@ -1204,29 +1216,26 @@ reread:
+ * i_nlink = 1
+ * i_op = NULL;
+ */
+- bh = udf_read_ptagged(inode->i_sb, &iinfo->i_location, 0, &ident);
++ bh = udf_read_ptagged(inode->i_sb, iloc, 0, &ident);
+ if (!bh) {
+ udf_err(inode->i_sb, "(ino %ld) failed !bh\n", inode->i_ino);
+- make_bad_inode(inode);
+- return;
++ return -EIO;
+ }
+
+ if (ident != TAG_IDENT_FE && ident != TAG_IDENT_EFE &&
+ ident != TAG_IDENT_USE) {
+ udf_err(inode->i_sb, "(ino %ld) failed ident=%d\n",
+ inode->i_ino, ident);
+- brelse(bh);
+- make_bad_inode(inode);
+- return;
++ goto out;
}
fe = (struct fileEntry *)bh->b_data;
@@ -66298,50 +66377,41 @@ index af37ce3..c0346e6 100644
if (fe->icbTag.strategyType == cpu_to_le16(4096)) {
struct buffer_head *ibh;
-@@ -1219,28 +1231,26 @@ static void __udf_read_inode(struct inode *inode)
- ibh = udf_read_ptagged(inode->i_sb, &iinfo->i_location, 1,
- &ident);
+
+- ibh = udf_read_ptagged(inode->i_sb, &iinfo->i_location, 1,
+- &ident);
++ ibh = udf_read_ptagged(inode->i_sb, iloc, 1, &ident);
if (ident == TAG_IDENT_IE && ibh) {
-- struct buffer_head *nbh = NULL;
struct kernel_lb_addr loc;
struct indirectEntry *ie;
-
- ie = (struct indirectEntry *)ibh->b_data;
+@@ -1235,7 +1244,6 @@ reread:
loc = lelb_to_cpu(ie->indirectICB.extLocation);
-- if (ie->indirectICB.extLength &&
-- (nbh = udf_read_ptagged(inode->i_sb, &loc, 0,
-- &ident))) {
-- if (ident == TAG_IDENT_FE ||
-- ident == TAG_IDENT_EFE) {
-- memcpy(&iinfo->i_location,
-- &loc,
-- sizeof(struct kernel_lb_addr));
-- brelse(bh);
-- brelse(ibh);
-- brelse(nbh);
-- __udf_read_inode(inode);
-+ if (ie->indirectICB.extLength) {
-+ brelse(bh);
-+ brelse(ibh);
-+ memcpy(&iinfo->i_location, &loc,
-+ sizeof(struct kernel_lb_addr));
-+ if (++indirections > UDF_MAX_ICB_NESTING) {
-+ udf_err(inode->i_sb,
-+ "too many ICBs in ICB hierarchy"
-+ " (max %d supported)\n",
-+ UDF_MAX_ICB_NESTING);
-+ make_bad_inode(inode);
- return;
+ if (ie->indirectICB.extLength) {
+- brelse(bh);
+ brelse(ibh);
+ memcpy(&iinfo->i_location, &loc,
+ sizeof(struct kernel_lb_addr));
+@@ -1244,9 +1252,9 @@ reread:
+ "too many ICBs in ICB hierarchy"
+ " (max %d supported)\n",
+ UDF_MAX_ICB_NESTING);
+- make_bad_inode(inode);
+- return;
++ goto out;
}
-- brelse(nbh);
-+ goto reread;
++ brelse(bh);
+ goto reread;
}
}
- brelse(ibh);
-@@ -1251,23 +1261,6 @@ static void __udf_read_inode(struct inode *inode)
- make_bad_inode(inode);
- return;
+@@ -1254,27 +1262,8 @@ reread:
+ } else if (fe->icbTag.strategyType != cpu_to_le16(4)) {
+ udf_err(inode->i_sb, "unsupported strategy type: %d\n",
+ le16_to_cpu(fe->icbTag.strategyType));
+- brelse(bh);
+- make_bad_inode(inode);
+- return;
++ goto out;
}
- udf_fill_inode(inode, bh);
-
@@ -66363,7 +66433,64 @@ index af37ce3..c0346e6 100644
if (fe->icbTag.strategyType == cpu_to_le16(4))
iinfo->i_strat4096 = 0;
else /* if (fe->icbTag.strategyType == cpu_to_le16(4096)) */
-@@ -1371,7 +1364,6 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
+@@ -1291,11 +1280,10 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
+ if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_EFE)) {
+ iinfo->i_efe = 1;
+ iinfo->i_use = 0;
+- if (udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
+- sizeof(struct extendedFileEntry))) {
+- make_bad_inode(inode);
+- return;
+- }
++ ret = udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
++ sizeof(struct extendedFileEntry));
++ if (ret)
++ goto out;
+ memcpy(iinfo->i_ext.i_data,
+ bh->b_data + sizeof(struct extendedFileEntry),
+ inode->i_sb->s_blocksize -
+@@ -1303,11 +1291,10 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
+ } else if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_FE)) {
+ iinfo->i_efe = 0;
+ iinfo->i_use = 0;
+- if (udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
+- sizeof(struct fileEntry))) {
+- make_bad_inode(inode);
+- return;
+- }
++ ret = udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
++ sizeof(struct fileEntry));
++ if (ret)
++ goto out;
+ memcpy(iinfo->i_ext.i_data,
+ bh->b_data + sizeof(struct fileEntry),
+ inode->i_sb->s_blocksize - sizeof(struct fileEntry));
+@@ -1317,18 +1304,18 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
+ iinfo->i_lenAlloc = le32_to_cpu(
+ ((struct unallocSpaceEntry *)bh->b_data)->
+ lengthAllocDescs);
+- if (udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
+- sizeof(struct unallocSpaceEntry))) {
+- make_bad_inode(inode);
+- return;
+- }
++ ret = udf_alloc_i_data(inode, inode->i_sb->s_blocksize -
++ sizeof(struct unallocSpaceEntry));
++ if (ret)
++ goto out;
+ memcpy(iinfo->i_ext.i_data,
+ bh->b_data + sizeof(struct unallocSpaceEntry),
+ inode->i_sb->s_blocksize -
+ sizeof(struct unallocSpaceEntry));
+- return;
++ return 0;
+ }
+
++ ret = -EIO;
+ read_lock(&sbi->s_cred_lock);
+ inode->i_uid = le32_to_cpu(fe->uid);
+ if (inode->i_uid == -1 ||
+@@ -1378,7 +1365,6 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
iinfo->i_unique = le64_to_cpu(fe->uniqueID);
iinfo->i_lenEAttr = le32_to_cpu(fe->lengthExtendedAttr);
iinfo->i_lenAlloc = le32_to_cpu(fe->lengthAllocDescs);
@@ -66371,24 +66498,54 @@ index af37ce3..c0346e6 100644
} else {
inode->i_blocks = le64_to_cpu(efe->logicalBlocksRecorded) <<
(inode->i_sb->s_blocksize_bits - 9);
-@@ -1392,8 +1384,6 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
+@@ -1399,8 +1385,20 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
iinfo->i_unique = le64_to_cpu(efe->uniqueID);
iinfo->i_lenEAttr = le32_to_cpu(efe->lengthExtendedAttr);
iinfo->i_lenAlloc = le32_to_cpu(efe->lengthAllocDescs);
- offset = sizeof(struct extendedFileEntry) +
- iinfo->i_lenEAttr;
++ }
++
++ /* Sanity checks for files in ICB so that we don't get confused later */
++ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
++ /*
++ * For file in ICB data is stored in allocation descriptor
++ * so sizes should match
++ */
++ if (iinfo->i_lenAlloc != inode->i_size)
++ goto out;
++ /* File in ICB has to fit in there... */
++ if (inode->i_size > inode->i_sb->s_blocksize -
++ udf_file_entry_alloc_offset(inode))
++ goto out;
}
switch (fe->icbTag.fileType) {
-@@ -1458,6 +1448,7 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
+@@ -1451,8 +1449,7 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
+ default:
+ udf_err(inode->i_sb, "(ino %ld) failed unknown file type=%d\n",
+ inode->i_ino, fe->icbTag.fileType);
+- make_bad_inode(inode);
+- return;
++ goto out;
+ }
+ if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode)) {
+ struct deviceSpec *dsea =
+@@ -1463,8 +1460,12 @@ static void udf_fill_inode(struct inode *inode, struct
buffer_head *bh)
+ le32_to_cpu(dsea->minorDeviceIdent)));
+ /* Developer ID ??? */
} else
- make_bad_inode(inode);
+- make_bad_inode(inode);
++ goto out;
}
++ ret = 0;
++out:
+ brelse(bh);
++ return ret;
}
static int udf_alloc_i_data(struct inode *inode, size_t size)
-@@ -1570,7 +1561,7 @@ static int udf_update_inode(struct inode *inode, int
do_sync)
+@@ -1577,7 +1578,7 @@ static int udf_update_inode(struct inode *inode, int
do_sync)
FE_PERM_U_DELETE | FE_PERM_U_CHATTR));
fe->permissions = cpu_to_le32(udfperms);
@@ -66397,6 +66554,49 @@ index af37ce3..c0346e6 100644
fe->fileLinkCount = cpu_to_le16(inode->i_nlink - 1);
else
fe->fileLinkCount = cpu_to_le16(inode->i_nlink);
+@@ -1738,32 +1739,23 @@ struct inode *udf_iget(struct super_block *sb, struct
kernel_lb_addr *ino)
+ {
+ unsigned long block = udf_get_lb_pblock(sb, ino, 0);
+ struct inode *inode = iget_locked(sb, block);
++ int err;
+
+ if (!inode)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+
+- if (inode->i_state & I_NEW) {
+- memcpy(&UDF_I(inode)->i_location, ino, sizeof(struct
kernel_lb_addr));
+- __udf_read_inode(inode);
+- unlock_new_inode(inode);
+- }
+-
+- if (is_bad_inode(inode))
+- goto out_iput;
++ if (!(inode->i_state & I_NEW))
++ return inode;
+
+- if (ino->logicalBlockNum >= UDF_SB(sb)->
+- s_partmaps[ino->partitionReferenceNum].s_partition_len)
{
+- udf_debug("block=%d, partition=%d out of range\n",
+- ino->logicalBlockNum, ino->partitionReferenceNum);
+- make_bad_inode(inode);
+- goto out_iput;
++ memcpy(&UDF_I(inode)->i_location, ino, sizeof(struct kernel_lb_addr));
++ err = udf_read_inode(inode);
++ if (err < 0) {
++ iget_failed(inode);
++ return ERR_PTR(err);
+ }
++ unlock_new_inode(inode);
+
+ return inode;
+-
+- out_iput:
+- iput(inode);
+- return NULL;
+ }
+
+ int udf_add_aext(struct inode *inode, struct extent_position *epos,
diff --git a/fs/udf/misc.c b/fs/udf/misc.c
index c175b4d..8f36a16 100644
--- a/fs/udf/misc.c
@@ -66410,8 +66610,81 @@ index c175b4d..8f36a16 100644
u8 checksum = 0;
int i;
for (i = 0; i < sizeof(struct tag); ++i)
+diff --git a/fs/udf/namei.c b/fs/udf/namei.c
+index 71c97fb..d86a93a 100644
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -235,7 +235,8 @@ static struct fileIdentDesc *udf_find_entry(struct inode
*dir,
+ if (!lfi)
+ continue;
+
+- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
++ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
++ UDF_NAME_LEN);
+ if (flen && udf_match(flen, fname, child->len, child->name))
+ goto out_ok;
+ }
+@@ -272,9 +273,8 @@ static struct dentry *udf_lookup(struct inode *dir, struct
dentry *dentry,
+ NULL, 0),
+ };
+ inode = udf_iget(dir->i_sb, lb);
+- if (!inode) {
+- return ERR_PTR(-EACCES);
+- }
++ if (IS_ERR(inode))
++ return inode;
+ } else
+ #endif /* UDF_RECOVERY */
+
+@@ -287,9 +287,8 @@ static struct dentry *udf_lookup(struct inode *dir, struct
dentry *dentry,
+
+ loc = lelb_to_cpu(cfi.icb.extLocation);
+ inode = udf_iget(dir->i_sb, &loc);
+- if (!inode) {
+- return ERR_PTR(-EACCES);
+- }
++ if (IS_ERR(inode))
++ return ERR_CAST(inode);
+ }
+
+ return d_splice_alias(inode, dentry);
+@@ -1211,7 +1210,7 @@ static struct dentry *udf_get_parent(struct dentry
*child)
+ struct udf_fileident_bh fibh;
+
+ if (!udf_find_entry(child->d_inode, &dotdot, &fibh, &cfi))
+- goto out_unlock;
++ return ERR_PTR(-EACCES);
+
+ if (fibh.sbh != fibh.ebh)
+ brelse(fibh.ebh);
+@@ -1219,12 +1218,10 @@ static struct dentry *udf_get_parent(struct dentry
*child)
+
+ tloc = lelb_to_cpu(cfi.icb.extLocation);
+ inode = udf_iget(child->d_inode->i_sb, &tloc);
+- if (!inode)
+- goto out_unlock;
++ if (IS_ERR(inode))
++ return ERR_CAST(inode);
+
+ return d_obtain_alias(inode);
+-out_unlock:
+- return ERR_PTR(-EACCES);
+ }
+
+
+@@ -1241,8 +1238,8 @@ static struct dentry *udf_nfs_get_inode(struct
super_block *sb, u32 block,
+ loc.partitionReferenceNum = partref;
+ inode = udf_iget(sb, &loc);
+
+- if (inode == NULL)
+- return ERR_PTR(-ENOMEM);
++ if (IS_ERR(inode))
++ return ERR_CAST(inode);
+
+ if (generation && inode->i_generation != generation) {
+ iput(inode);
diff --git a/fs/udf/super.c b/fs/udf/super.c
-index f66439e..9af489f 100644
+index f66439e..247cfef 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -116,6 +116,7 @@ static struct file_system_type udf_fstype = {
@@ -66422,6 +66695,419 @@ index f66439e..9af489f 100644
static struct kmem_cache *udf_inode_cachep;
+@@ -838,12 +839,14 @@ struct inode *udf_find_metadata_inode_efe(struct
super_block *sb,
+
+ metadata_fe = udf_iget(sb, &addr);
+
+- if (metadata_fe == NULL)
++ if (IS_ERR(metadata_fe)) {
+ udf_warn(sb, "metadata inode efe not found\n");
+- else if (UDF_I(metadata_fe)->i_alloc_type != ICBTAG_FLAG_AD_SHORT) {
++ return metadata_fe;
++ }
++ if (UDF_I(metadata_fe)->i_alloc_type != ICBTAG_FLAG_AD_SHORT) {
+ udf_warn(sb, "metadata inode efe does not have short allocation
descriptors!\n");
+ iput(metadata_fe);
+- metadata_fe = NULL;
++ return ERR_PTR(-EIO);
+ }
+
+ return metadata_fe;
+@@ -855,6 +858,7 @@ static int udf_load_metadata_files(struct super_block *sb,
int partition)
+ struct udf_part_map *map;
+ struct udf_meta_data *mdata;
+ struct kernel_lb_addr addr;
++ struct inode *fe;
+
+ map = &sbi->s_partmaps[partition];
+ mdata = &map->s_type_specific.s_metadata;
+@@ -863,22 +867,24 @@ static int udf_load_metadata_files(struct super_block
*sb, int partition)
+ udf_debug("Metadata file location: block = %d part = %d\n",
+ mdata->s_meta_file_loc, map->s_partition_num);
+
+- mdata->s_metadata_fe = udf_find_metadata_inode_efe(sb,
+- mdata->s_meta_file_loc, map->s_partition_num);
+-
+- if (mdata->s_metadata_fe == NULL) {
++ fe = udf_find_metadata_inode_efe(sb, mdata->s_meta_file_loc,
++ map->s_partition_num);
++ if (IS_ERR(fe)) {
+ /* mirror file entry */
+ udf_debug("Mirror metadata file location: block = %d part =
%d\n",
+ mdata->s_mirror_file_loc, map->s_partition_num);
+
+- mdata->s_mirror_fe = udf_find_metadata_inode_efe(sb,
+- mdata->s_mirror_file_loc, map->s_partition_num);
++ fe = udf_find_metadata_inode_efe(sb, mdata->s_mirror_file_loc,
++ map->s_partition_num);
+
+- if (mdata->s_mirror_fe == NULL) {
++ if (IS_ERR(fe)) {
+ udf_err(sb, "Both metadata and mirror metadata inode
efe can not found\n");
+- goto error_exit;
++ return PTR_ERR(fe);
+ }
+- }
++ mdata->s_mirror_fe = fe;
++ } else
++ mdata->s_metadata_fe = fe;
++
+
+ /*
+ * bitmap file entry
+@@ -892,24 +898,21 @@ static int udf_load_metadata_files(struct super_block
*sb, int partition)
+ udf_debug("Bitmap file location: block = %d part = %d\n",
+ addr.logicalBlockNum, addr.partitionReferenceNum);
+
+- mdata->s_bitmap_fe = udf_iget(sb, &addr);
+-
+- if (mdata->s_bitmap_fe == NULL) {
++ fe = udf_iget(sb, &addr);
++ if (IS_ERR(fe)) {
+ if (sb->s_flags & MS_RDONLY)
+ udf_warn(sb, "bitmap inode efe not found but
it's ok since the disc is mounted read-only\n");
+ else {
+ udf_err(sb, "bitmap inode efe not found and
attempted read-write mount\n");
+- goto error_exit;
++ return PTR_ERR(fe);
+ }
+- }
++ } else
++ mdata->s_bitmap_fe = fe;
+ }
+
+ udf_debug("udf_load_metadata_files Ok\n");
+
+ return 0;
+-
+-error_exit:
+- return 1;
+ }
+
+ static void udf_load_fileset(struct super_block *sb, struct buffer_head *bh,
+@@ -997,13 +1000,15 @@ static int udf_fill_partdesc_info(struct super_block
*sb,
+ phd->unallocSpaceTable.extPosition),
+ .partitionReferenceNum = p_index,
+ };
++ struct inode *inode;
+
+- map->s_uspace.s_table = udf_iget(sb, &loc);
+- if (!map->s_uspace.s_table) {
++ inode = udf_iget(sb, &loc);
++ if (IS_ERR(inode)) {
+ udf_debug("cannot load unallocSpaceTable (part %d)\n",
+ p_index);
+- return 1;
++ return PTR_ERR(inode);
+ }
++ map->s_uspace.s_table = inode;
+ map->s_partition_flags |= UDF_PART_FLAG_UNALLOC_TABLE;
+ udf_debug("unallocSpaceTable (part %d) @ %ld\n",
+ p_index, map->s_uspace.s_table->i_ino);
+@@ -1032,14 +1037,15 @@ static int udf_fill_partdesc_info(struct super_block
*sb,
+ phd->freedSpaceTable.extPosition),
+ .partitionReferenceNum = p_index,
+ };
++ struct inode *inode;
+
+- map->s_fspace.s_table = udf_iget(sb, &loc);
+- if (!map->s_fspace.s_table) {
++ inode = udf_iget(sb, &loc);
++ if (IS_ERR(inode)) {
+ udf_debug("cannot load freedSpaceTable (part %d)\n",
+ p_index);
+- return 1;
++ return PTR_ERR(inode);
+ }
+-
++ map->s_fspace.s_table = inode;
+ map->s_partition_flags |= UDF_PART_FLAG_FREED_TABLE;
+ udf_debug("freedSpaceTable (part %d) @ %ld\n",
+ p_index, map->s_fspace.s_table->i_ino);
+@@ -1068,6 +1074,7 @@ static void udf_find_vat_block(struct super_block *sb,
int p_index,
+ struct udf_part_map *map = &sbi->s_partmaps[p_index];
+ sector_t vat_block;
+ struct kernel_lb_addr ino;
++ struct inode *inode;
+
+ /*
+ * VAT file entry is in the last recorded block. Some broken disks have
+@@ -1076,10 +1083,13 @@ static void udf_find_vat_block(struct super_block *sb,
int p_index,
+ ino.partitionReferenceNum = type1_index;
+ for (vat_block = start_block;
+ vat_block >= map->s_partition_root &&
+- vat_block >= start_block - 3 &&
+- !sbi->s_vat_inode; vat_block--) {
++ vat_block >= start_block - 3; vat_block--) {
+ ino.logicalBlockNum = vat_block - map->s_partition_root;
+- sbi->s_vat_inode = udf_iget(sb, &ino);
++ inode = udf_iget(sb, &ino);
++ if (!IS_ERR(inode)) {
++ sbi->s_vat_inode = inode;
++ break;
++ }
+ }
+ }
+
+@@ -2058,9 +2068,10 @@ static int udf_fill_super(struct super_block *sb, void
*options, int silent)
+ /* assign inodes by physical block number */
+ /* perhaps it's not extensible enough, but for now ... */
+ inode = udf_iget(sb, &rootdir);
+- if (!inode) {
++ if (IS_ERR(inode)) {
+ udf_err(sb, "Error in udf_iget, block=%d, partition=%d\n",
+ rootdir.logicalBlockNum, rootdir.partitionReferenceNum);
++ ret = PTR_ERR(inode);
+ goto error_out;
+ }
+
+diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c
+index b1d4488..0422b7b 100644
+--- a/fs/udf/symlink.c
++++ b/fs/udf/symlink.c
+@@ -30,43 +30,73 @@
+ #include <linux/buffer_head.h>
+ #include "udf_i.h"
+
+-static void udf_pc_to_char(struct super_block *sb, unsigned char *from,
+- int fromlen, unsigned char *to)
++static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
++ int fromlen, unsigned char *to, int tolen)
+ {
+ struct pathComponent *pc;
+ int elen = 0;
++ int comp_len;
+ unsigned char *p = to;
+
++ /* Reserve one byte for terminating \0 */
++ tolen--;
+ while (elen < fromlen) {
+ pc = (struct pathComponent *)(from + elen);
++ elen += sizeof(struct pathComponent);
+ switch (pc->componentType) {
+ case 1:
+- if (pc->lengthComponentIdent == 0) {
+- p = to;
+- *p++ = '/';
++ /*
++ * Symlink points to some place which should be agreed
++ * upon between originator and receiver of the media.
Ignore.
++ */
++ if (pc->lengthComponentIdent > 0) {
++ elen += pc->lengthComponentIdent;
++ break;
+ }
++ /* Fall through */
++ case 2:
++ if (tolen == 0)
++ return -ENAMETOOLONG;
++ p = to;
++ *p++ = '/';
++ tolen--;
+ break;
+ case 3:
++ if (tolen < 3)
++ return -ENAMETOOLONG;
+ memcpy(p, "../", 3);
+ p += 3;
++ tolen -= 3;
+ break;
+ case 4:
++ if (tolen < 2)
++ return -ENAMETOOLONG;
+ memcpy(p, "./", 2);
+ p += 2;
++ tolen -= 2;
+ /* that would be . - just ignore */
+ break;
+ case 5:
+- p += udf_get_filename(sb, pc->componentIdent, p,
+- pc->lengthComponentIdent);
++ elen += pc->lengthComponentIdent;
++ if (elen > fromlen)
++ return -EIO;
++ comp_len = udf_get_filename(sb, pc->componentIdent,
++ pc->lengthComponentIdent,
++ p, tolen);
++ p += comp_len;
++ tolen -= comp_len;
++ if (tolen == 0)
++ return -ENAMETOOLONG;
+ *p++ = '/';
++ tolen--;
+ break;
+ }
+- elen += sizeof(struct pathComponent) + pc->lengthComponentIdent;
+ }
+ if (p > to + 1)
+ p[-1] = '\0';
+ else
+ p[0] = '\0';
++ return 0;
+ }
+
+ static int udf_symlink_filler(struct file *file, struct page *page)
+@@ -74,11 +104,17 @@ static int udf_symlink_filler(struct file *file, struct
page *page)
+ struct inode *inode = page->mapping->host;
+ struct buffer_head *bh = NULL;
+ unsigned char *symlink;
+- int err = -EIO;
++ int err;
+ unsigned char *p = kmap(page);
+ struct udf_inode_info *iinfo;
+ uint32_t pos;
+
++ /* We don't support symlinks longer than one block */
++ if (inode->i_size > inode->i_sb->s_blocksize) {
++ err = -ENAMETOOLONG;
++ goto out_unmap;
++ }
++
+ iinfo = UDF_I(inode);
+ pos = udf_block_map(inode, 0);
+
+@@ -88,14 +124,18 @@ static int udf_symlink_filler(struct file *file, struct
page *page)
+ } else {
+ bh = sb_bread(inode->i_sb, pos);
+
+- if (!bh)
+- goto out;
++ if (!bh) {
++ err = -EIO;
++ goto out_unlock_inode;
++ }
+
+ symlink = bh->b_data;
+ }
+
+- udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p);
++ err = udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p, PAGE_SIZE);
+ brelse(bh);
++ if (err)
++ goto out_unlock_inode;
+
+ up_read(&iinfo->i_data_sem);
+ SetPageUptodate(page);
+@@ -103,9 +143,10 @@ static int udf_symlink_filler(struct file *file, struct
page *page)
+ unlock_page(page);
+ return 0;
+
+-out:
++out_unlock_inode:
+ up_read(&iinfo->i_data_sem);
+ SetPageError(page);
++out_unmap:
+ kunmap(page);
+ unlock_page(page);
+ return err;
+diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
+index f34e6fc..3156eb1 100644
+--- a/fs/udf/udfdecl.h
++++ b/fs/udf/udfdecl.h
+@@ -149,7 +149,6 @@ extern int udf_expand_file_adinicb(struct inode *);
+ extern struct buffer_head *udf_expand_dir_adinicb(struct inode *, int *, int
*);
+ extern struct buffer_head *udf_bread(struct inode *, int, int, int *);
+ extern int udf_setsize(struct inode *, loff_t);
+-extern void udf_read_inode(struct inode *);
+ extern void udf_evict_inode(struct inode *);
+ extern int udf_write_inode(struct inode *, struct writeback_control *wbc);
+ extern long udf_block_map(struct inode *, sector_t);
+@@ -207,7 +206,8 @@ udf_get_lb_pblock(struct super_block *sb, struct
kernel_lb_addr *loc,
+ }
+
+ /* unicode.c */
+-extern int udf_get_filename(struct super_block *, uint8_t *, uint8_t *, int);
++extern int udf_get_filename(struct super_block *, uint8_t *, int, uint8_t *,
++ int);
+ extern int udf_put_filename(struct super_block *, const uint8_t *, uint8_t *,
+ int);
+ extern int udf_build_ustr(struct ustr *, dstring *, int);
+diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
+index 44b815e..d29c06f 100644
+--- a/fs/udf/unicode.c
++++ b/fs/udf/unicode.c
+@@ -28,7 +28,8 @@
+
+ #include "udf_sb.h"
+
+-static int udf_translate_to_linux(uint8_t *, uint8_t *, int, uint8_t *, int);
++static int udf_translate_to_linux(uint8_t *, int, uint8_t *, int, uint8_t *,
++ int);
+
+ static int udf_char_to_ustr(struct ustr *dest, const uint8_t *src, int strlen)
+ {
+@@ -333,8 +334,8 @@ try_again:
+ return u_len + 1;
+ }
+
+-int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
+- int flen)
++int udf_get_filename(struct super_block *sb, uint8_t *sname, int slen,
++ uint8_t *dname, int dlen)
+ {
+ struct ustr *filename, *unifilename;
+ int len = 0;
+@@ -347,7 +348,7 @@ int udf_get_filename(struct super_block *sb, uint8_t
*sname, uint8_t *dname,
+ if (!unifilename)
+ goto out1;
+
+- if (udf_build_ustr_exact(unifilename, sname, flen))
++ if (udf_build_ustr_exact(unifilename, sname, slen))
+ goto out2;
+
+ if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8)) {
+@@ -366,7 +367,8 @@ int udf_get_filename(struct super_block *sb, uint8_t
*sname, uint8_t *dname,
+ } else
+ goto out2;
+
+- len = udf_translate_to_linux(dname, filename->u_name, filename->u_len,
++ len = udf_translate_to_linux(dname, dlen,
++ filename->u_name, filename->u_len,
+ unifilename->u_name, unifilename->u_len);
+ out2:
+ kfree(unifilename);
+@@ -403,10 +405,12 @@ int udf_put_filename(struct super_block *sb, const
uint8_t *sname,
+ #define EXT_MARK '.'
+ #define CRC_MARK '#'
+ #define EXT_SIZE 5
++/* Number of chars we need to store generated CRC to make filename unique */
++#define CRC_LEN 5
+
+-static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
+- int udfLen, uint8_t *fidName,
+- int fidNameLen)
++static int udf_translate_to_linux(uint8_t *newName, int newLen,
++ uint8_t *udfName, int udfLen,
++ uint8_t *fidName, int fidNameLen)
+ {
+ int index, newIndex = 0, needsCRC = 0;
+ int extIndex = 0, newExtIndex = 0, hasExt = 0;
+@@ -440,7 +444,7 @@ static int udf_translate_to_linux(uint8_t *newName,
uint8_t *udfName,
+ newExtIndex = newIndex;
+ }
+ }
+- if (newIndex < 256)
++ if (newIndex < newLen)
+ newName[newIndex++] = curr;
+ else
+ needsCRC = 1;
+@@ -468,13 +472,13 @@ static int udf_translate_to_linux(uint8_t *newName,
uint8_t *udfName,
+ }
+ ext[localExtIndex++] = curr;
+ }
+- maxFilenameLen = 250 - localExtIndex;
++ maxFilenameLen = newLen - CRC_LEN - localExtIndex;
+ if (newIndex > maxFilenameLen)
+ newIndex = maxFilenameLen;
+ else
+ newIndex = newExtIndex;
+- } else if (newIndex > 250)
+- newIndex = 250;
++ } else if (newIndex > newLen - CRC_LEN)
++ newIndex = newLen - CRC_LEN;
+ newName[newIndex++] = CRC_MARK;
+ valueCRC = crc_itu_t(0, fidName, fidNameLen);
+ newName[newIndex++] = hexChar[(valueCRC & 0xf000) >> 12];
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 3915ade..00fcbf4 100644
--- a/fs/ufs/super.c
@@ -77882,7 +78568,7 @@ index 77ff547..181834f 100644
#define pud_none(pud) 0
#define pud_bad(pud) 0
diff --git a/include/asm-generic/atomic-long.h
b/include/asm-generic/atomic-long.h
-index b7babf0..97f4c4f 100644
+index b7babf0..1e4b4f1 100644
--- a/include/asm-generic/atomic-long.h
+++ b/include/asm-generic/atomic-long.h
@@ -22,6 +22,12 @@
@@ -78143,7 +78829,15 @@ index b7babf0..97f4c4f 100644
static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
{
atomic_t *v = (atomic_t *)l;
-@@ -218,6 +356,16 @@ static inline long atomic_long_add_return(long i,
atomic_long_t *l)
+@@ -211,13 +349,23 @@ static inline int atomic_long_add_negative(long i,
atomic_long_t *l)
+ return atomic_add_negative(i, v);
+ }
+
+-static inline long atomic_long_add_return(long i, atomic_long_t *l)
++static inline long __intentional_overflow(-1) atomic_long_add_return(long i,
atomic_long_t *l)
+ {
+ atomic_t *v = (atomic_t *)l;
+
return (long)atomic_add_return(i, v);
}
@@ -79529,13 +80223,13 @@ index 8acfe31..6ffccd63 100644
return c | 0x20;
}
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
-index 1dfe974..3811bc2 100644
+index 99374de..6388abb 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -142,7 +142,7 @@ struct dentry {
+ struct list_head d_alias; /* inode alias list */
+ struct rcu_head d_rcu;
} d_u;
- struct list_head d_subdirs; /* our children */
- struct list_head d_alias; /* inode alias list */
-};
+} __randomize_layout;
@@ -83406,7 +84100,7 @@ index 9aaf5bf..d5ee2a5 100644
}
diff --git a/include/linux/sched.h b/include/linux/sched.h
-index cb34ff4..df196d4 100644
+index cb34ff4..c086c98 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -101,6 +101,7 @@ struct bio_list;
@@ -83635,6 +84329,15 @@ index cb34ff4..df196d4 100644
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
/* Index of current stored address in ret_stack */
int curr_ret_stack;
+@@ -1560,7 +1633,7 @@ struct task_struct {
+ * Number of functions that haven't been traced
+ * because of depth overrun.
+ */
+- atomic_t trace_overrun;
++ atomic_unchecked_t trace_overrun;
+ /* Pause for the tracing */
+ atomic_t tracing_graph_pause;
+ #endif
@@ -1581,7 +1654,54 @@ struct task_struct {
#ifdef CONFIG_HAVE_HW_BREAKPOINT
atomic_t ptrace_bp_refcnt;
@@ -86024,7 +86727,7 @@ index e6454b6..7a6b6bc 100644
static inline struct page *sk_stream_alloc_page(struct sock *sk)
{
diff --git a/include/net/tcp.h b/include/net/tcp.h
-index 238255b..d91d5ca 100644
+index e90235f..b943bda 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -426,6 +426,25 @@ extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];
@@ -87734,7 +88437,7 @@ index b463871..59495fd 100644
* nsown_capable - Check superior capability to one's own user_ns
* @cap: The capability in question
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index ffcf896..a88b61f 100644
+index eafb6dd..59c908d 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -4755,6 +4755,14 @@ static void cgroup_release_agent(struct work_struct
*work)
@@ -93681,7 +94384,7 @@ index 92cac05..89f0de9 100644
ret = -EIO;
bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index dcbafed..9feb3de 100644
+index dcbafed..bba19b9 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1610,12 +1610,17 @@ ftrace_code_disable(struct module *mod, struct
dyn_ftrace *rec)
@@ -93722,6 +94425,15 @@ index dcbafed..9feb3de 100644
int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
{
return 0;
+@@ -4088,7 +4091,7 @@ static int alloc_retstack_tasklist(struct
ftrace_ret_stack **ret_stack_list)
+
+ if (t->ret_stack == NULL) {
+ atomic_set(&t->tracing_graph_pause, 0);
+- atomic_set(&t->trace_overrun, 0);
++ atomic_set_unchecked(&t->trace_overrun, 0);
+ t->curr_ret_stack = -1;
+ /* Make sure the tasks see the -1 first: */
+ smp_wmb();
@@ -4191,6 +4194,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl,
unsigned long state,
return NOTIFY_DONE;
}
@@ -93741,6 +94453,15 @@ index dcbafed..9feb3de 100644
register_pm_notifier(&ftrace_suspend_notifier);
ftrace_graph_active++;
+@@ -4288,7 +4294,7 @@ static void
+ graph_init_task(struct task_struct *t, struct ftrace_ret_stack *ret_stack)
+ {
+ atomic_set(&t->tracing_graph_pause, 0);
+- atomic_set(&t->trace_overrun, 0);
++ atomic_set_unchecked(&t->trace_overrun, 0);
+ t->ftrace_timestamp = 0;
+ /* make curr_ret_stack visible before we add the ret_stack */
+ smp_wmb();
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index b252661..45b218f 100644
--- a/kernel/trace/ring_buffer.c
@@ -94133,6 +94854,28 @@ index 875fed4..7a76cbb 100644
}
}
+diff --git a/kernel/trace/trace_functions_graph.c
b/kernel/trace/trace_functions_graph.c
+index a7d2a4c..b034c76 100644
+--- a/kernel/trace/trace_functions_graph.c
++++ b/kernel/trace/trace_functions_graph.c
+@@ -108,7 +108,7 @@ ftrace_push_return_trace(unsigned long ret, unsigned long
func, int *depth,
+
+ /* The return trace stack is full */
+ if (current->curr_ret_stack == FTRACE_RETFUNC_DEPTH - 1) {
+- atomic_inc(¤t->trace_overrun);
++ atomic_inc_unchecked(¤t->trace_overrun);
+ return -EBUSY;
+ }
+
+@@ -171,7 +171,7 @@ ftrace_pop_return_trace(struct ftrace_graph_ret *trace,
unsigned long *ret,
+ *ret = current->ret_stack[index].ret;
+ trace->func = current->ret_stack[index].func;
+ trace->calltime = current->ret_stack[index].calltime;
+- trace->overrun = atomic_read(¤t->trace_overrun);
++ trace->overrun = atomic_read_unchecked(¤t->trace_overrun);
+ trace->depth = index;
+ }
+
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 00d527c..7c5b1a3 100644
--- a/kernel/trace/trace_kprobe.c
@@ -96140,7 +96883,7 @@ index 51901b1..79af2f4 100644
/* keep elevated page count for bad page */
return ret;
diff --git a/mm/memory.c b/mm/memory.c
-index 5a7f314..f1012e1 100644
+index 628cadc..4db2e08 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -462,8 +462,12 @@ static inline void free_pmd_range(struct mmu_gather *tlb,
pud_t *pud,
@@ -101038,6 +101781,19 @@ index 963f285..3e3874d 100644
struct vlan_net *vn;
vn = net_generic(net, vlan_net_id);
+diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
+index c705612..8f2e391 100644
+--- a/net/8021q/vlan_netlink.c
++++ b/net/8021q/vlan_netlink.c
+@@ -214,7 +214,7 @@ nla_put_failure:
+ return -EMSGSIZE;
+ }
+
+-struct rtnl_link_ops vlan_link_ops __read_mostly = {
++struct rtnl_link_ops vlan_link_ops = {
+ .kind = "vlan",
+ .maxtype = IFLA_VLAN_MAX,
+ .policy = vlan_policy,
diff --git a/net/9p/client.c b/net/9p/client.c
index 854ca7a..fc1bfc8 100644
--- a/net/9p/client.c
@@ -101584,6 +102340,19 @@ index 398a297..83fc29c 100644
return 0;
/* Okay, we found ICMPv6 header */
+diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
+index 99a48a39..f0638fe 100644
+--- a/net/bridge/br_netlink.c
++++ b/net/bridge/br_netlink.c
+@@ -225,7 +225,7 @@ static int br_dev_newlink(struct net *src_net, struct
net_device *dev,
+ return register_netdevice(dev);
+ }
+
+-struct rtnl_link_ops br_link_ops __read_mostly = {
++struct rtnl_link_ops br_link_ops = {
+ .kind = "bridge",
+ .priv_size = sizeof(struct net_bridge),
+ .setup = br_dev_setup,
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index 5449294..c1d8d99 100644
--- a/net/bridge/netfilter/ebt_ulog.c
@@ -101832,7 +102601,7 @@ index 84efbe4..51d47bc 100644
list_del(&p->list);
goto out;
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
-index 8656909..a2ae45d 100644
+index 8656909..a448555 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -74,7 +74,6 @@ static int chnl_recv_cb(struct cflayer *layr, struct cfpkt
*pkt)
@@ -101905,6 +102674,15 @@ index 8656909..a2ae45d 100644
}
/* Update statistics. */
+@@ -508,7 +515,7 @@ static const struct nla_policy ipcaif_policy[IFLA_CAIF_MAX
+ 1] = {
+ };
+
+
+-static struct rtnl_link_ops ipcaif_link_ops __read_mostly = {
++static struct rtnl_link_ops ipcaif_link_ops = {
+ .kind = "caif",
+ .priv_size = sizeof(struct chnl_net),
+ .setup = ipcaif_net_setup,
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 0ce2ad0..cb92a90 100644
--- a/net/can/af_can.c
@@ -102995,7 +103773,7 @@ index 39a2d29..f39c0fe 100644
Econet is a fairly old and slow networking protocol mainly used by
Acorn computers to access file and print servers. It uses native
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
-index 5d42df2..10638af 100644
+index 5d42df2..e6c3389 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -329,7 +329,7 @@ static int lowpan_header_create(struct sk_buff *skb,
@@ -103007,6 +103785,15 @@ index 5d42df2..10638af 100644
/* replace the top byte with new ECN | DSCP format */
*hc06_ptr = tmp;
hc06_ptr += 4;
+@@ -837,7 +837,7 @@ static void lowpan_dellink(struct net_device *dev, struct
list_head *head)
+ dev_put(real_dev);
+ }
+
+-static struct rtnl_link_ops lowpan_link_ops __read_mostly = {
++static struct rtnl_link_ops lowpan_link_ops = {
+ .kind = "lowpan",
+ .priv_size = sizeof(struct lowpan_dev_info),
+ .setup = lowpan_setup,
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 5d228de..91bdee5 100644
--- a/net/ipv4/af_inet.c
@@ -103241,7 +104028,7 @@ index 92fc5f6..b790d91 100644
break;
case NETDEV_DOWN:
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
-index 76da979..0e9428c 100644
+index 1cdb4a9..b5efed8 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -699,7 +699,7 @@ __be32 fib_info_update_nh_saddr(struct net *net, struct
fib_nh *nh)
@@ -104241,7 +105028,7 @@ index afe6886..297e5fb 100644
/* step 6: check the URG bit */
tcp_urg(sk, skb, th);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index 26eb8e2..14989a5 100644
+index b4e0eb4..4df4e3a 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -87,6 +87,9 @@ int sysctl_tcp_tw_reuse __read_mostly;
@@ -104254,7 +105041,7 @@ index 26eb8e2..14989a5 100644
#ifdef CONFIG_TCP_MD5SIG
static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
-@@ -1636,6 +1639,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1631,6 +1634,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
return 0;
reset:
@@ -104264,7 +105051,7 @@ index 26eb8e2..14989a5 100644
tcp_v4_send_reset(rsk, skb);
discard:
kfree_skb(skb);
-@@ -1698,12 +1704,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
+@@ -1693,12 +1699,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
TCP_SKB_CB(skb)->sacked = 0;
sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
@@ -104287,7 +105074,7 @@ index 26eb8e2..14989a5 100644
if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
-@@ -1753,6 +1766,10 @@ no_tcp_socket:
+@@ -1748,6 +1761,10 @@ no_tcp_socket:
bad_packet:
TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
} else {
@@ -104298,7 +105085,7 @@ index 26eb8e2..14989a5 100644
tcp_v4_send_reset(NULL, skb);
}
-@@ -2413,7 +2430,11 @@ static void get_openreq4(const struct sock *sk, const
struct request_sock *req,
+@@ -2408,7 +2425,11 @@ static void get_openreq4(const struct sock *sk, const
struct request_sock *req,
0, /* non standard timer */
0, /* open_requests have no inode */
atomic_read(&sk->sk_refcnt),
@@ -104310,7 +105097,7 @@ index 26eb8e2..14989a5 100644
len);
}
-@@ -2463,7 +2484,12 @@ static void get_tcp4_sock(struct sock *sk, struct
seq_file *f, int i, int *len)
+@@ -2458,7 +2479,12 @@ static void get_tcp4_sock(struct sock *sk, struct
seq_file *f, int i, int *len)
sock_i_uid(sk),
icsk->icsk_probes_out,
sock_i_ino(sk),
@@ -104324,7 +105111,7 @@ index 26eb8e2..14989a5 100644
jiffies_to_clock_t(icsk->icsk_rto),
jiffies_to_clock_t(icsk->icsk_ack.ato),
(icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
-@@ -2491,7 +2517,13 @@ static void get_timewait4_sock(const struct
inet_timewait_sock *tw,
+@@ -2486,7 +2512,13 @@ static void get_timewait4_sock(const struct
inet_timewait_sock *tw,
" %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n",
i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
@@ -104339,7 +105126,7 @@ index 26eb8e2..14989a5 100644
}
#define TMPSZ 150
-@@ -2662,7 +2694,7 @@ static void __net_exit tcp_sk_exit_batch(struct
list_head *net_exit_list)
+@@ -2657,7 +2689,7 @@ static void __net_exit tcp_sk_exit_batch(struct
list_head *net_exit_list)
inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET);
}
@@ -104349,7 +105136,7 @@ index 26eb8e2..14989a5 100644
.exit = tcp_sk_exit,
.exit_batch = tcp_sk_exit_batch,
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
-index 66363b6..b0654a3 100644
+index 00e1530..47b4f16 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -27,6 +27,10 @@
@@ -104363,7 +105150,7 @@ index 66363b6..b0654a3 100644
int sysctl_tcp_syncookies __read_mostly = 1;
EXPORT_SYMBOL(sysctl_tcp_syncookies);
-@@ -751,6 +755,10 @@ listen_overflow:
+@@ -746,6 +750,10 @@ listen_overflow:
embryonic_reset:
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
@@ -105021,7 +105808,7 @@ index 166a57c..dc4e6b8 100644
struct ctl_table *ipv6_icmp_table;
int err;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 057a9d2..bc870ad 100644
+index 655cc60..c49497a 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -93,6 +93,10 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct
sock *sk,
@@ -105035,7 +105822,7 @@ index 057a9d2..bc870ad 100644
static void tcp_v6_hash(struct sock *sk)
{
if (sk->sk_state != TCP_CLOSE) {
-@@ -1657,6 +1661,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff
*skb)
+@@ -1652,6 +1656,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff
*skb)
return 0;
reset:
@@ -105045,7 +105832,7 @@ index 057a9d2..bc870ad 100644
tcp_v6_send_reset(sk, skb);
discard:
if (opt_skb)
-@@ -1736,12 +1743,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
+@@ -1731,12 +1738,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
TCP_SKB_CB(skb)->sacked = 0;
sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
@@ -105068,7 +105855,7 @@ index 057a9d2..bc870ad 100644
if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
-@@ -1789,6 +1804,10 @@ no_tcp_socket:
+@@ -1784,6 +1799,10 @@ no_tcp_socket:
bad_packet:
TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
} else {
@@ -105079,7 +105866,7 @@ index 057a9d2..bc870ad 100644
tcp_v6_send_reset(NULL, skb);
}
-@@ -2049,7 +2068,13 @@ static void get_openreq6(struct seq_file *seq,
+@@ -2044,7 +2063,13 @@ static void get_openreq6(struct seq_file *seq,
uid,
0, /* non standard timer */
0, /* open_requests have no inode */
@@ -105094,7 +105881,7 @@ index 057a9d2..bc870ad 100644
}
static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
-@@ -2099,7 +2124,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct
sock *sp, int i)
+@@ -2094,7 +2119,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct
sock *sp, int i)
sock_i_uid(sp),
icsk->icsk_probes_out,
sock_i_ino(sp),
@@ -105108,7 +105895,7 @@ index 057a9d2..bc870ad 100644
jiffies_to_clock_t(icsk->icsk_rto),
jiffies_to_clock_t(icsk->icsk_ack.ato),
(icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
-@@ -2134,7 +2164,13 @@ static void get_timewait6_sock(struct seq_file *seq,
+@@ -2129,7 +2159,13 @@ static void get_timewait6_sock(struct seq_file *seq,
dest->s6_addr32[2], dest->s6_addr32[3], destp,
tw->tw_substate, 0, 0,
3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
@@ -107283,19 +108070,6 @@ index 7635107..4670276 100644
_proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
-diff --git a/net/sctp/auth.c b/net/sctp/auth.c
-index 333926d..53d455c 100644
---- a/net/sctp/auth.c
-+++ b/net/sctp/auth.c
-@@ -866,8 +866,6 @@ int sctp_auth_set_key(struct sctp_endpoint *ep,
- list_add(&cur_key->key_list, sh_keys);
-
- cur_key->key = key;
-- sctp_auth_key_hold(key);
--
- return 0;
- nomem:
- if (!replace)
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 0b6a391..febcef2 100644
--- a/net/sctp/ipv6.c
@@ -107406,20 +108180,6 @@ index de35e01..ef925b0 100644
}
static int sctp_v4_protosw_init(void)
-diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
-index d8d4704..c40952c 100644
---- a/net/sctp/sm_make_chunk.c
-+++ b/net/sctp/sm_make_chunk.c
-@@ -2570,6 +2570,9 @@ do_addr_param:
- addr_param = param.v + sizeof(sctp_addip_param_t);
-
- af = sctp_get_af_specific(param_type2af(param.p->type));
-+ if (af == NULL)
-+ break;
-+
- af->from_addr_param(&addr, addr_param,
- htons(asoc->peer.port), 0);
-
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 76388b0..a967f68 100644
--- a/net/sctp/sm_sideeffect.c
