Grsec/PaX: 3.0-{3.2.55,3.13.7}-20140328185820140328

author: Anthony G. Basile <blueness@gentoo.org> 2014-03-29 13:55:05 -0400
committer: Anthony G. Basile <blueness@gentoo.org> 2014-03-29 13:55:05 -0400
commit: c19c10924711f4e252bf33481835766230f57d8e (patch)
tree: 65b2db85d8a29b5fbbfb5c253604bd6b631ddbaf
parent: Grsec/PaX: 3.0-{3.2.55,3.13.6}-201403202349 (diff)
download: hardened-patchset-c19c10924711f4e252bf33481835766230f57d8e.tar.gz
hardened-patchset-c19c10924711f4e252bf33481835766230f57d8e.tar.bz2
hardened-patchset-c19c10924711f4e252bf33481835766230f57d8e.zip
13 files changed, 664 insertions, 381 deletions
diff --git a/3.13.6/0000_README b/3.13.7/0000_README
index 1864b5a..f9125d0 100644
--- a/3.13.6/0000_README
+++ b/3.13.7/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.0-3.13.6-201403202349.patch
+Patch:	4420_grsecurity-3.0-3.13.7-201403281902.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.13.6/4420_grsecurity-3.0-3.13.6-201403202349.patch b/3.13.7/4420_grsecurity-3.0-3.13.7-201403281902.patch
index 521e844..8e4e492 100644
--- a/3.13.6/4420_grsecurity-3.0-3.13.6-201403202349.patch
+++ b/3.13.7/4420_grsecurity-3.0-3.13.7-201403281902.patch
@@ -287,7 +287,7 @@ index b9e9bd8..bf49b92 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index dfe5fec..079642c 100644
+index 9f214b4..8c9c622 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -874,10 +874,10 @@ index 98838a0..b304fb4 100644
  		/* Allow reads even for write-only mappings */
  		if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
 diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
-index c1f1a7e..554b0cd 100644
+index 47085a0..f975a53 100644
 --- a/arch/arm/Kconfig
 +++ b/arch/arm/Kconfig
-@@ -1828,7 +1828,7 @@ config ALIGNMENT_TRAP
+@@ -1830,7 +1830,7 @@ config ALIGNMENT_TRAP
  
  config UACCESS_WITH_MEMCPY
  	bool "Use kernel mem{cpy,set}() for {copy_to,clear}_user()"
@@ -886,7 +886,7 @@ index c1f1a7e..554b0cd 100644
  	default y if CPU_FEROCEON
  	help
  	  Implement faster copy_to_user and clear_user methods for CPU
-@@ -2100,6 +2100,7 @@ config XIP_PHYS_ADDR
+@@ -2102,6 +2102,7 @@ config XIP_PHYS_ADDR
  config KEXEC
  	bool "Kexec system call (EXPERIMENTAL)"
  	depends on (!SMP || PM_SLEEP_SMP)
@@ -8524,7 +8524,7 @@ index 6cff040..74ac5d1 100644
  			    sechdrs, module);
  #endif
 diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
-index 4a96556..dd95f6c 100644
+index ea2f6a3..dbb2be3 100644
 --- a/arch/powerpc/kernel/process.c
 +++ b/arch/powerpc/kernel/process.c
 @@ -888,8 +888,8 @@ void show_regs(struct pt_regs * regs)
@@ -8538,7 +8538,7 @@ index 4a96556..dd95f6c 100644
  #endif
  	show_stack(current, (unsigned long *) regs->gpr[1]);
  	if (!user_mode(regs))
-@@ -1376,10 +1376,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
+@@ -1385,10 +1385,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
  		newsp = stack[0];
  		ip = stack[STACK_FRAME_LR_SAVE];
  		if (!firstframe || ip != lr) {
@@ -8551,7 +8551,7 @@ index 4a96556..dd95f6c 100644
  				       (void *)current->ret_stack[curr_frame].ret);
  				curr_frame--;
  			}
-@@ -1399,7 +1399,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
+@@ -1408,7 +1408,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
  			struct pt_regs *regs = (struct pt_regs *)
  				(sp + STACK_FRAME_OVERHEAD);
  			lr = regs->link;
@@ -8560,7 +8560,7 @@ index 4a96556..dd95f6c 100644
  			       regs->trap, (void *)regs->nip, (void *)lr);
  			firstframe = 1;
  		}
-@@ -1435,58 +1435,3 @@ void notrace __ppc64_runlatch_off(void)
+@@ -1444,58 +1444,3 @@ void notrace __ppc64_runlatch_off(void)
  	mtspr(SPRN_CTRLT, ctrl);
  }
  #endif /* CONFIG_PPC64 */
@@ -10433,7 +10433,7 @@ index beb0b5a..5a153f7 100644
  	}
  }
 diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
-index 87729ff..192f9d8 100644
+index 87729ff..d87fb1f 100644
 --- a/arch/sparc/kernel/syscalls.S
 +++ b/arch/sparc/kernel/syscalls.S
 @@ -52,7 +52,7 @@ sys32_rt_sigreturn:
@@ -10445,7 +10445,7 @@ index 87729ff..192f9d8 100644
  	be,pt	%icc, rtrap
  	 nop
  	call	syscall_trace_leave
-@@ -184,7 +184,7 @@ linux_sparc_syscall32:
+@@ -184,12 +184,13 @@ linux_sparc_syscall32:
  
  	srl	%i3, 0, %o3				! IEU0
  	srl	%i2, 0, %o2				! IEU0	Group
@@ -10454,7 +10454,14 @@ index 87729ff..192f9d8 100644
  	bne,pn	%icc, linux_syscall_trace32		! CTI
  	 mov	%i0, %l5				! IEU1
  5:	call	%l7					! CTI	Group brk forced
-@@ -207,7 +207,7 @@ linux_sparc_syscall:
+ 	 srl	%i5, 0, %o5				! IEU1
+-	ba,a,pt	%xcc, 3f
++	ba,pt	%xcc, 3f
++	 sra	%o0, 0, %o0
+ 
+ 	/* Linux native system calls enter here... */
+ 	.align	32
+@@ -207,7 +208,7 @@ linux_sparc_syscall:
  
  	mov	%i3, %o3				! IEU1
  	mov	%i4, %o4				! IEU0	Group
@@ -10463,7 +10470,13 @@ index 87729ff..192f9d8 100644
  	bne,pn	%icc, linux_syscall_trace		! CTI	Group
  	 mov	%i0, %l5				! IEU0
  2:	call	%l7					! CTI	Group brk forced
-@@ -223,7 +223,7 @@ ret_sys_call:
+@@ -217,13 +218,12 @@ linux_sparc_syscall:
+ 3:	stx	%o0, [%sp + PTREGS_OFF + PT_V9_I0]
+ ret_sys_call:
+ 	ldx	[%sp + PTREGS_OFF + PT_V9_TSTATE], %g3
+-	sra	%o0, 0, %o0
+ 	mov	%ulo(TSTATE_XCARRY | TSTATE_ICARRY), %g2
+ 	sllx	%g2, 32, %g2
  
  	cmp	%o0, -ERESTART_RESTARTBLOCK
  	bgeu,pn	%xcc, 1f
@@ -17545,7 +17558,7 @@ index 81bb91b..9392125 100644
  
  /*
 diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
-index 5ad38ad..71db3f2 100644
+index 5ad38ad..f228861 100644
 --- a/arch/x86/include/asm/pgtable.h
 +++ b/arch/x86/include/asm/pgtable.h
 @@ -45,6 +45,7 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
@@ -17668,7 +17681,30 @@ index 5ad38ad..71db3f2 100644
  #include <linux/mm_types.h>
  #include <linux/mmdebug.h>
  #include <linux/log2.h>
-@@ -580,7 +655,7 @@ static inline unsigned long pud_page_vaddr(pud_t pud)
+@@ -445,20 +520,10 @@ static inline int pte_same(pte_t a, pte_t b)
+ 	return a.pte == b.pte;
+ }
+ 
+-static inline int pteval_present(pteval_t pteval)
+-{
+-	/*
+-	 * Yes Linus, _PAGE_PROTNONE == _PAGE_NUMA. Expressing it this
+-	 * way clearly states that the intent is that protnone and numa
+-	 * hinting ptes are considered present for the purposes of
+-	 * pagetable operations like zapping, protection changes, gup etc.
+-	 */
+-	return pteval & (_PAGE_PRESENT | _PAGE_PROTNONE | _PAGE_NUMA);
+-}
+-
+ static inline int pte_present(pte_t a)
+ {
+-	return pteval_present(pte_flags(a));
++	return pte_flags(a) & (_PAGE_PRESENT | _PAGE_PROTNONE |
++			       _PAGE_NUMA);
+ }
+ 
+ #define pte_accessible pte_accessible
+@@ -580,7 +645,7 @@ static inline unsigned long pud_page_vaddr(pud_t pud)
   * Currently stuck as a macro due to indirect forward reference to
   * linux/mmzone.h's __section_mem_map_addr() definition:
   */
@@ -17677,7 +17713,7 @@ index 5ad38ad..71db3f2 100644
  
  /* Find an entry in the second-level page table.. */
  static inline pmd_t *pmd_offset(pud_t *pud, unsigned long address)
-@@ -620,7 +695,7 @@ static inline unsigned long pgd_page_vaddr(pgd_t pgd)
+@@ -620,7 +685,7 @@ static inline unsigned long pgd_page_vaddr(pgd_t pgd)
   * Currently stuck as a macro due to indirect forward reference to
   * linux/mmzone.h's __section_mem_map_addr() definition:
   */
@@ -17686,7 +17722,7 @@ index 5ad38ad..71db3f2 100644
  
  /* to find an entry in a page-table-directory. */
  static inline unsigned long pud_index(unsigned long address)
-@@ -635,7 +710,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
+@@ -635,7 +700,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
  
  static inline int pgd_bad(pgd_t pgd)
  {
@@ -17695,7 +17731,7 @@ index 5ad38ad..71db3f2 100644
  }
  
  static inline int pgd_none(pgd_t pgd)
-@@ -658,7 +733,12 @@ static inline int pgd_none(pgd_t pgd)
+@@ -658,7 +723,12 @@ static inline int pgd_none(pgd_t pgd)
   * pgd_offset() returns a (pgd_t *)
   * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
   */
@@ -17709,7 +17745,7 @@ index 5ad38ad..71db3f2 100644
  /*
   * a shortcut which implies the use of the kernel's pgd, instead
   * of a process's
-@@ -669,6 +749,23 @@ static inline int pgd_none(pgd_t pgd)
+@@ -669,6 +739,23 @@ static inline int pgd_none(pgd_t pgd)
  #define KERNEL_PGD_BOUNDARY	pgd_index(PAGE_OFFSET)
  #define KERNEL_PGD_PTRS		(PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
  
@@ -17733,7 +17769,7 @@ index 5ad38ad..71db3f2 100644
  #ifndef __ASSEMBLY__
  
  extern int direct_gbpages;
-@@ -835,11 +932,24 @@ static inline void pmdp_set_wrprotect(struct mm_struct *mm,
+@@ -835,11 +922,24 @@ static inline void pmdp_set_wrprotect(struct mm_struct *mm,
   * dst and src can be on the same page, but the range must not overlap,
   * and must not cross a page boundary.
   */
@@ -24004,7 +24040,7 @@ index 85126cc..1bbce17 100644
  	init_level4_pgt[511] = early_level4_pgt[511];
  
 diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
-index 81ba276..30c5411 100644
+index f36bd42..56ee1534 100644
 --- a/arch/x86/kernel/head_32.S
 +++ b/arch/x86/kernel/head_32.S
 @@ -26,6 +26,12 @@
@@ -24227,16 +24263,16 @@ index 81ba276..30c5411 100644
  	movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
  	shrl $16, %ecx
  	movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
-@@ -544,7 +629,7 @@ ENDPROC(early_idt_handlers)
- 	/* This is global to keep gas from relaxing the jumps */
- ENTRY(early_idt_handler)
- 	cld
+@@ -548,7 +633,7 @@ ENTRY(early_idt_handler)
+ 	cmpl $2,(%esp)		# X86_TRAP_NMI
+ 	je is_nmi		# Ignore NMI
+ 
 -	cmpl $2,%ss:early_recursion_flag
 +	cmpl $1,%ss:early_recursion_flag
  	je hlt_loop
  	incl %ss:early_recursion_flag
  
-@@ -582,8 +667,8 @@ ENTRY(early_idt_handler)
+@@ -586,8 +671,8 @@ ENTRY(early_idt_handler)
  	pushl (20+6*4)(%esp)	/* trapno */
  	pushl $fault_msg
  	call printk
@@ -24246,7 +24282,7 @@ index 81ba276..30c5411 100644
  hlt_loop:
  	hlt
  	jmp hlt_loop
-@@ -602,8 +687,11 @@ ENDPROC(early_idt_handler)
+@@ -607,8 +692,11 @@ ENDPROC(early_idt_handler)
  /* This is the default interrupt "handler" :-) */
  	ALIGN
  ignore_int:
@@ -24259,7 +24295,7 @@ index 81ba276..30c5411 100644
  	pushl %eax
  	pushl %ecx
  	pushl %edx
-@@ -612,9 +700,6 @@ ignore_int:
+@@ -617,9 +705,6 @@ ignore_int:
  	movl $(__KERNEL_DS),%eax
  	movl %eax,%ds
  	movl %eax,%es
@@ -24269,7 +24305,7 @@ index 81ba276..30c5411 100644
  	pushl 16(%esp)
  	pushl 24(%esp)
  	pushl 32(%esp)
-@@ -648,29 +733,34 @@ ENTRY(setup_once_ref)
+@@ -653,29 +738,34 @@ ENTRY(setup_once_ref)
  /*
   * BSS section
   */
@@ -24309,7 +24345,7 @@ index 81ba276..30c5411 100644
  ENTRY(initial_page_table)
  	.long	pa(initial_pg_pmd+PGD_IDENT_ATTR),0	/* low identity map */
  # if KPMDS == 3
-@@ -689,12 +779,20 @@ ENTRY(initial_page_table)
+@@ -694,12 +784,20 @@ ENTRY(initial_page_table)
  #  error "Kernel PMDs should be 1, 2 or 3"
  # endif
  	.align PAGE_SIZE		/* needs to be page-sized too */
@@ -24331,7 +24367,7 @@ index 81ba276..30c5411 100644
  
  __INITRODATA
  int_msg:
-@@ -722,7 +820,7 @@ fault_msg:
+@@ -727,7 +825,7 @@ fault_msg:
   * segment size, and 32-bit linear address value:
   */
  
@@ -24340,7 +24376,7 @@ index 81ba276..30c5411 100644
  .globl boot_gdt_descr
  .globl idt_descr
  
-@@ -731,7 +829,7 @@ fault_msg:
+@@ -736,7 +834,7 @@ fault_msg:
  	.word 0				# 32 bit align gdt_desc.address
  boot_gdt_descr:
  	.word __BOOT_DS+7
@@ -24349,7 +24385,7 @@ index 81ba276..30c5411 100644
  
  	.word 0				# 32-bit align idt_desc.address
  idt_descr:
-@@ -742,7 +840,7 @@ idt_descr:
+@@ -747,7 +845,7 @@ idt_descr:
  	.word 0				# 32 bit align gdt_desc.address
  ENTRY(early_gdt_descr)
  	.word GDT_ENTRIES*8-1
@@ -24358,7 +24394,7 @@ index 81ba276..30c5411 100644
  
  /*
   * The boot_gdt must mirror the equivalent in setup.S and is
-@@ -751,5 +849,65 @@ ENTRY(early_gdt_descr)
+@@ -756,5 +854,65 @@ ENTRY(early_gdt_descr)
  	.align L1_CACHE_BYTES
  ENTRY(boot_gdt)
  	.fill GDT_ENTRY_BOOT_CS,8,0
@@ -24427,7 +24463,7 @@ index 81ba276..30c5411 100644
 +	.fill PAGE_SIZE_asm - GDT_SIZE,1,0
 +	.endr
 diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
-index e1aabdb..fee4fee 100644
+index a468c0a..c7dec74 100644
 --- a/arch/x86/kernel/head_64.S
 +++ b/arch/x86/kernel/head_64.S
 @@ -20,6 +20,8 @@
@@ -24519,7 +24555,16 @@ index e1aabdb..fee4fee 100644
  	movq	initial_code(%rip),%rax
  	pushq	$0		# fake return address to stop unwinder
  	pushq	$__KERNEL_CS	# set correct cs
-@@ -388,7 +419,7 @@ ENTRY(early_idt_handler)
+@@ -313,7 +344,7 @@ ENDPROC(start_cpu0)
+ 	.quad	INIT_PER_CPU_VAR(irq_stack_union)
+ 
+ 	GLOBAL(stack_start)
+-	.quad  init_thread_union+THREAD_SIZE-8
++	.quad  init_thread_union+THREAD_SIZE-16
+ 	.word  0
+ 	__FINITDATA
+ 
+@@ -391,7 +422,7 @@ ENTRY(early_idt_handler)
  	call dump_stack
  #ifdef CONFIG_KALLSYMS	
  	leaq early_idt_ripmsg(%rip),%rdi
@@ -24528,7 +24573,7 @@ index e1aabdb..fee4fee 100644
  	call __print_symbol
  #endif
  #endif /* EARLY_PRINTK */
-@@ -416,6 +447,7 @@ ENDPROC(early_idt_handler)
+@@ -420,6 +451,7 @@ ENDPROC(early_idt_handler)
  early_recursion_flag:
  	.long 0
  
@@ -24536,7 +24581,7 @@ index e1aabdb..fee4fee 100644
  #ifdef CONFIG_EARLY_PRINTK
  early_idt_msg:
  	.asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
-@@ -443,29 +475,52 @@ NEXT_PAGE(early_level4_pgt)
+@@ -447,29 +479,52 @@ NEXT_PAGE(early_level4_pgt)
  NEXT_PAGE(early_dynamic_pgts)
  	.fill	512*EARLY_DYNAMIC_PAGE_TABLES,8,0
  
@@ -24598,7 +24643,7 @@ index e1aabdb..fee4fee 100644
  
  NEXT_PAGE(level3_kernel_pgt)
  	.fill	L3_START_KERNEL,8,0
-@@ -473,6 +528,9 @@ NEXT_PAGE(level3_kernel_pgt)
+@@ -477,6 +532,9 @@ NEXT_PAGE(level3_kernel_pgt)
  	.quad	level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
  	.quad	level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
  
@@ -24608,7 +24653,7 @@ index e1aabdb..fee4fee 100644
  NEXT_PAGE(level2_kernel_pgt)
  	/*
  	 * 512 MB kernel mapping. We spend a full page on this pagetable
-@@ -490,28 +548,64 @@ NEXT_PAGE(level2_kernel_pgt)
+@@ -494,28 +552,64 @@ NEXT_PAGE(level2_kernel_pgt)
  NEXT_PAGE(level2_fixmap_pgt)
  	.fill	506,8,0
  	.quad	level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
@@ -24709,7 +24754,7 @@ index 05fd74f..c3548b1 100644
 +EXPORT_SYMBOL(cpu_pgd);
 +#endif
 diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
-index e8368c6..9c1a712 100644
+index d5dd808..b6432cf 100644
 --- a/arch/x86/kernel/i387.c
 +++ b/arch/x86/kernel/i387.c
 @@ -51,7 +51,7 @@ static inline bool interrupted_kernel_fpu_idle(void)
@@ -26496,18 +26541,10 @@ index c8e41e9..64049ef 100644
  /*
   * PCI ids solely used for fixups_table go here
 diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
-index 3fd2c69..16ef367 100644
+index 3fd2c69..a444264 100644
 --- a/arch/x86/kernel/relocate_kernel_64.S
 +++ b/arch/x86/kernel/relocate_kernel_64.S
-@@ -11,6 +11,7 @@
- #include <asm/kexec.h>
- #include <asm/processor-flags.h>
- #include <asm/pgtable_types.h>
-+#include <asm/alternative-asm.h>
- 
- /*
-  * Must be relocatable PIC code callable as a C function
-@@ -96,8 +97,7 @@ relocate_kernel:
+@@ -96,8 +96,7 @@ relocate_kernel:
  
  	/* jump to identity mapped page */
  	addq	$(identity_mapped - relocate_kernel), %r8
@@ -26517,14 +26554,6 @@ index 3fd2c69..16ef367 100644
  
  identity_mapped:
  	/* set return address to 0 if not preserving context */
-@@ -167,6 +167,7 @@ identity_mapped:
- 	xorl	%r14d, %r14d
- 	xorl	%r15d, %r15d
- 
-+	pax_force_retaddr 0, 1
- 	ret
- 
- 1:
 diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
 index cb233bc..23b4879 100644
 --- a/arch/x86/kernel/setup.c
@@ -26810,7 +26839,7 @@ index 7c3a5a6..f0a8961 100644
  	.smp_prepare_cpus	= native_smp_prepare_cpus,
  	.smp_cpus_done		= native_smp_cpus_done,
 diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index 85dc05a..1241266 100644
+index 85dc05a..f8c96f6 100644
 --- a/arch/x86/kernel/smpboot.c
 +++ b/arch/x86/kernel/smpboot.c
 @@ -229,14 +229,18 @@ static void notrace start_secondary(void *unused)
@@ -26838,9 +26867,12 @@ index 85dc05a..1241266 100644
  	/*
  	 * Check TSC synchronization with the BP:
  	 */
-@@ -751,6 +755,7 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
+@@ -749,8 +753,9 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
+ 	alternatives_enable_smp();
+ 
  	idle->thread.sp = (unsigned long) (((struct pt_regs *)
- 			  (THREAD_SIZE +  task_stack_page(idle))) - 1);
+-			  (THREAD_SIZE +  task_stack_page(idle))) - 1);
++			  (THREAD_SIZE - 16 + task_stack_page(idle))) - 1);
  	per_cpu(current_task, cpu) = idle;
 +	per_cpu(current_tinfo, cpu) = &idle->tinfo;
  
@@ -28085,10 +28117,10 @@ index ad75d77..a679d32 100644
  			goto error;
  		walker->ptep_user[walker->level - 1] = ptep_user;
 diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
-index c7168a5..09070fc 100644
+index 532add1..59eb241 100644
 --- a/arch/x86/kvm/svm.c
 +++ b/arch/x86/kvm/svm.c
-@@ -3497,7 +3497,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
+@@ -3495,7 +3495,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
  	int cpu = raw_smp_processor_id();
  
  	struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
@@ -35418,18 +35450,30 @@ index fa6ade7..73da73a5 100644
  
  #ifdef CONFIG_ACPI_NUMA
 diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
-index 3c76c3d..7871755 100644
+index 3c76c3d..7327d91 100644
 --- a/arch/x86/xen/mmu.c
 +++ b/arch/x86/xen/mmu.c
-@@ -379,7 +379,7 @@ static pteval_t pte_mfn_to_pfn(pteval_t val)
+@@ -365,7 +365,7 @@ void xen_ptep_modify_prot_commit(struct mm_struct *mm, unsigned long addr,
+ /* Assume pteval_t is equivalent to all the other *val_t types. */
+ static pteval_t pte_mfn_to_pfn(pteval_t val)
+ {
+-	if (pteval_present(val)) {
++	if (val & _PAGE_PRESENT) {
+ 		unsigned long mfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
+ 		unsigned long pfn = mfn_to_pfn(mfn);
+ 
+@@ -379,9 +379,9 @@ static pteval_t pte_mfn_to_pfn(pteval_t val)
  	return val;
  }
  
 -static pteval_t pte_pfn_to_mfn(pteval_t val)
 +static pteval_t __intentional_overflow(-1) pte_pfn_to_mfn(pteval_t val)
  {
- 	if (pteval_present(val)) {
+-	if (pteval_present(val)) {
++	if (val & _PAGE_PRESENT) {
  		unsigned long pfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
+ 		pteval_t flags = val & PTE_FLAGS_MASK;
+ 		unsigned long mfn;
 @@ -1894,6 +1894,9 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
  	/* L3_k[510] -> level2_kernel_pgt
  	 * L3_i[511] -> level2_fixmap_pgt */
@@ -36085,7 +36129,7 @@ index c482f8c..c832240 100644
  				unsigned long timeout_msec)
  {
 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index 1a3dbd1..dfc6e5c 100644
+index 8cb2522..a815e54 100644
 --- a/drivers/ata/libata-core.c
 +++ b/drivers/ata/libata-core.c
 @@ -98,7 +98,7 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev);
@@ -36097,7 +36141,7 @@ index 1a3dbd1..dfc6e5c 100644
  
  struct ata_force_param {
  	const char	*name;
-@@ -4850,7 +4850,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
+@@ -4851,7 +4851,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
  	struct ata_port *ap;
  	unsigned int tag;
  
@@ -36106,7 +36150,7 @@ index 1a3dbd1..dfc6e5c 100644
  	ap = qc->ap;
  
  	qc->flags = 0;
-@@ -4866,7 +4866,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
+@@ -4867,7 +4867,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
  	struct ata_port *ap;
  	struct ata_link *link;
  
@@ -36115,7 +36159,7 @@ index 1a3dbd1..dfc6e5c 100644
  	WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
  	ap = qc->ap;
  	link = qc->dev->link;
-@@ -5985,6 +5985,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5986,6 +5986,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
  		return;
  
  	spin_lock(&lock);
@@ -36123,7 +36167,7 @@ index 1a3dbd1..dfc6e5c 100644
  
  	for (cur = ops->inherits; cur; cur = cur->inherits) {
  		void **inherit = (void **)cur;
-@@ -5998,8 +5999,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5999,8 +6000,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
  		if (IS_ERR(*pp))
  			*pp = NULL;
  
@@ -36134,7 +36178,7 @@ index 1a3dbd1..dfc6e5c 100644
  	spin_unlock(&lock);
  }
  
-@@ -6192,7 +6194,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
+@@ -6193,7 +6195,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
  
  	/* give ports names and add SCSI hosts */
  	for (i = 0; i < host->n_ports; i++) {
@@ -38821,10 +38865,10 @@ index caf41eb..223d27a 100644
  	default:
  		break;
 diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
-index 8d19f7c..6bc2daa 100644
+index 99a443e..8cb6f02 100644
 --- a/drivers/cpufreq/cpufreq.c
 +++ b/drivers/cpufreq/cpufreq.c
-@@ -1885,7 +1885,7 @@ void cpufreq_unregister_governor(struct cpufreq_governor *governor)
+@@ -1878,7 +1878,7 @@ void cpufreq_unregister_governor(struct cpufreq_governor *governor)
  #endif
  
  	mutex_lock(&cpufreq_governor_mutex);
@@ -38833,7 +38877,7 @@ index 8d19f7c..6bc2daa 100644
  	mutex_unlock(&cpufreq_governor_mutex);
  	return;
  }
-@@ -2115,7 +2115,7 @@ static int cpufreq_cpu_callback(struct notifier_block *nfb,
+@@ -2108,7 +2108,7 @@ static int cpufreq_cpu_callback(struct notifier_block *nfb,
  	return NOTIFY_OK;
  }
  
@@ -38842,7 +38886,7 @@ index 8d19f7c..6bc2daa 100644
  	.notifier_call = cpufreq_cpu_callback,
  };
  
-@@ -2148,8 +2148,11 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
+@@ -2141,8 +2141,11 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
  
  	pr_debug("trying to register driver %s\n", driver_data->name);
  
@@ -38957,10 +39001,10 @@ index 4cf0d28..5830372 100644
  	.priority = 1,
  };
 diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index aa366ec..f34f555 100644
+index b687df8..ae733fc 100644
 --- a/drivers/cpufreq/intel_pstate.c
 +++ b/drivers/cpufreq/intel_pstate.c
-@@ -112,10 +112,10 @@ struct pstate_funcs {
+@@ -123,10 +123,10 @@ struct pstate_funcs {
  struct cpu_defaults {
  	struct pstate_adjust_policy pid_policy;
  	struct pstate_funcs funcs;
@@ -38973,16 +39017,16 @@ index aa366ec..f34f555 100644
  
  struct perf_limits {
  	int no_turbo;
-@@ -462,7 +462,7 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
+@@ -517,7 +517,7 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
  
  	cpu->pstate.current_pstate = pstate;
  
--	pstate_funcs.set(pstate);
-+	pstate_funcs->set(pstate);
+-	pstate_funcs.set(cpu, pstate);
++	pstate_funcs->set(cpu, pstate);
  }
  
  static inline void intel_pstate_pstate_increase(struct cpudata *cpu, int steps)
-@@ -484,9 +484,9 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
+@@ -539,12 +539,12 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
  {
  	sprintf(cpu->name, "Intel 2nd generation core");
  
@@ -38993,9 +39037,14 @@ index aa366ec..f34f555 100644
 +	cpu->pstate.max_pstate = pstate_funcs->get_max();
 +	cpu->pstate.turbo_pstate = pstate_funcs->get_turbo();
  
+-	if (pstate_funcs.get_vid)
+-		pstate_funcs.get_vid(cpu);
++	if (pstate_funcs->get_vid)
++		pstate_funcs->get_vid(cpu);
+ 
  	/*
  	 * goto max pstate so we don't slow up boot if we are built-in if we are
-@@ -750,9 +750,9 @@ static int intel_pstate_msrs_not_valid(void)
+@@ -808,9 +808,9 @@ static int intel_pstate_msrs_not_valid(void)
  	rdmsrl(MSR_IA32_APERF, aperf);
  	rdmsrl(MSR_IA32_MPERF, mperf);
  
@@ -39008,7 +39057,7 @@ index aa366ec..f34f555 100644
  		return -ENODEV;
  
  	rdmsrl(MSR_IA32_APERF, tmp);
-@@ -766,7 +766,7 @@ static int intel_pstate_msrs_not_valid(void)
+@@ -824,7 +824,7 @@ static int intel_pstate_msrs_not_valid(void)
  	return 0;
  }
  
@@ -39017,7 +39066,7 @@ index aa366ec..f34f555 100644
  {
  	pid_params.sample_rate_ms = policy->sample_rate_ms;
  	pid_params.p_gain_pct = policy->p_gain_pct;
-@@ -778,10 +778,7 @@ static void copy_pid_params(struct pstate_adjust_policy *policy)
+@@ -836,11 +836,7 @@ static void copy_pid_params(struct pstate_adjust_policy *policy)
  
  static void copy_cpu_funcs(struct pstate_funcs *funcs)
  {
@@ -39025,6 +39074,7 @@ index aa366ec..f34f555 100644
 -	pstate_funcs.get_min   = funcs->get_min;
 -	pstate_funcs.get_turbo = funcs->get_turbo;
 -	pstate_funcs.set       = funcs->set;
+-	pstate_funcs.get_vid   = funcs->get_vid;
 +	pstate_funcs = funcs;
  }
  
@@ -39492,7 +39542,7 @@ index 57ea7f4..af06b76 100644
  	card->driver->update_phy_reg(card, 4,
  				     PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
 diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
-index de4aa40..49ab1f2 100644
+index 2c6d5e1..a2cca6b 100644
 --- a/drivers/firewire/core-device.c
 +++ b/drivers/firewire/core-device.c
 @@ -253,7 +253,7 @@ EXPORT_SYMBOL(fw_device_enable_phys_dma);
@@ -39681,27 +39731,6 @@ index 9902732..64b62dd 100644
  
  	return -EINVAL;
  }
-diff --git a/drivers/gpu/drm/armada/armada_drv.c b/drivers/gpu/drm/armada/armada_drv.c
-index 62d0ff3..073dbf3 100644
---- a/drivers/gpu/drm/armada/armada_drv.c
-+++ b/drivers/gpu/drm/armada/armada_drv.c
-@@ -68,15 +68,7 @@ void __armada_drm_queue_unref_work(struct drm_device *dev,
- {
- 	struct armada_private *priv = dev->dev_private;
- 
--	/*
--	 * Yes, we really must jump through these hoops just to store a
--	 * _pointer_ to something into the kfifo.  This is utterly insane
--	 * and idiotic, because it kfifo requires the _data_ pointed to by
--	 * the pointer const, not the pointer itself.  Not only that, but
--	 * you have to pass a pointer _to_ the pointer you want stored.
--	 */
--	const struct drm_framebuffer *silly_api_alert = fb;
--	WARN_ON(!kfifo_put(&priv->fb_unref, &silly_api_alert));
-+	WARN_ON(!kfifo_put(&priv->fb_unref, fb));
- 	schedule_work(&priv->fb_unref_work);
- }
- 
 diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
 index d6cf77c..2842146 100644
 --- a/drivers/gpu/drm/drm_crtc.c
@@ -40056,6 +40085,19 @@ index a3ba9a8..ee52ddd 100644
  	unsigned relocs_total = 0;
  	unsigned relocs_max = UINT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
  
+diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
+index d3c3b5b..e79720d 100644
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
+@@ -828,7 +828,7 @@ void i915_gem_suspend_gtt_mappings(struct drm_device *dev)
+ 	dev_priv->gtt.base.clear_range(&dev_priv->gtt.base,
+ 				       dev_priv->gtt.base.start / PAGE_SIZE,
+ 				       dev_priv->gtt.base.total / PAGE_SIZE,
+-				       false);
++				       true);
+ }
+ 
+ void i915_gem_restore_gtt_mappings(struct drm_device *dev)
 diff --git a/drivers/gpu/drm/i915/i915_ioc32.c b/drivers/gpu/drm/i915/i915_ioc32.c
 index 3c59584..500f2e9 100644
 --- a/drivers/gpu/drm/i915/i915_ioc32.c
@@ -40921,10 +40963,10 @@ index 4d20910..6726b6d 100644
  	DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
  
 diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
-index 71245d6..94c556d 100644
+index 84323c9..cf07baf 100644
 --- a/drivers/gpu/drm/radeon/radeon_ttm.c
 +++ b/drivers/gpu/drm/radeon/radeon_ttm.c
-@@ -784,7 +784,7 @@ void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size)
+@@ -787,7 +787,7 @@ void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size)
  	man->size = size >> PAGE_SHIFT;
  }
  
@@ -40933,7 +40975,7 @@ index 71245d6..94c556d 100644
  static const struct vm_operations_struct *ttm_vm_ops = NULL;
  
  static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-@@ -825,8 +825,10 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
+@@ -828,8 +828,10 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
  	}
  	if (unlikely(ttm_vm_ops == NULL)) {
  		ttm_vm_ops = vma->vm_ops;
@@ -40944,7 +40986,7 @@ index 71245d6..94c556d 100644
  	}
  	vma->vm_ops = &radeon_ttm_vm_ops;
  	return 0;
-@@ -855,38 +857,33 @@ static int radeon_mm_dump_table(struct seq_file *m, void *data)
+@@ -858,38 +860,33 @@ static int radeon_mm_dump_table(struct seq_file *m, void *data)
  static int radeon_ttm_debugfs_init(struct radeon_device *rdev)
  {
  #if defined(CONFIG_DEBUG_FS)
@@ -45726,7 +45768,7 @@ index 6a53c15..6e7d1e7 100644
  /**
   * bnx2x_config_rx_mode - Send and RX_MODE ramrod according to the provided parameters.
 diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
-index 5c3835a..d18b952 100644
+index cf9917b..c658558 100644
 --- a/drivers/net/ethernet/broadcom/tg3.h
 +++ b/drivers/net/ethernet/broadcom/tg3.h
 @@ -150,6 +150,7 @@
@@ -45972,7 +46014,7 @@ index c737f0e..32b8682 100644
  	int (*set_speed)(struct net_device *, u8 aneg, u16 sp, u8 dpx, u32 adv);
  	int (*get_settings)(struct net_device *, struct ethtool_cmd *);
 diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
-index 3dd39dc..85efa46 100644
+index a124103..59c74f8 100644
 --- a/drivers/net/ethernet/sfc/ptp.c
 +++ b/drivers/net/ethernet/sfc/ptp.c
 @@ -541,7 +541,7 @@ static int efx_ptp_synchronize(struct efx_nic *efx, unsigned int num_readings)
@@ -46048,10 +46090,10 @@ index bf0d55e..82bcfbd1 100644
  	priv = netdev_priv(dev);
  	priv->phy = phy;
 diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
-index bc8faae..e51e25d 100644
+index d7e2907..1f8bfee 100644
 --- a/drivers/net/macvlan.c
 +++ b/drivers/net/macvlan.c
-@@ -990,13 +990,15 @@ static const struct nla_policy macvlan_policy[IFLA_MACVLAN_MAX + 1] = {
+@@ -993,13 +993,15 @@ static const struct nla_policy macvlan_policy[IFLA_MACVLAN_MAX + 1] = {
  int macvlan_link_register(struct rtnl_link_ops *ops)
  {
  	/* common fields */
@@ -46074,7 +46116,7 @@ index bc8faae..e51e25d 100644
  
  	return rtnl_link_register(ops);
  };
-@@ -1051,7 +1053,7 @@ static int macvlan_device_event(struct notifier_block *unused,
+@@ -1054,7 +1056,7 @@ static int macvlan_device_event(struct notifier_block *unused,
  	return NOTIFY_DONE;
  }
  
@@ -46166,10 +46208,10 @@ index b75ae5b..953c157 100644
  };
  
 diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index ecec802..614f08f 100644
+index 55c9238..ebb6ee5 100644
 --- a/drivers/net/tun.c
 +++ b/drivers/net/tun.c
-@@ -1839,7 +1839,7 @@ unlock:
+@@ -1841,7 +1841,7 @@ unlock:
  }
  
  static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
@@ -46178,7 +46220,7 @@ index ecec802..614f08f 100644
  {
  	struct tun_file *tfile = file->private_data;
  	struct tun_struct *tun;
-@@ -1852,6 +1852,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
+@@ -1854,6 +1854,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
  	unsigned int ifindex;
  	int ret;
  
@@ -48191,10 +48233,10 @@ index 84419af..268ede8 100644
  					&dev_attr_energy_uj.attr;
  	}
 diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
-index 0186c1b..6491409 100644
+index 75dffb79..df850cd 100644
 --- a/drivers/regulator/core.c
 +++ b/drivers/regulator/core.c
-@@ -3369,7 +3369,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
+@@ -3370,7 +3370,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
  {
  	const struct regulation_constraints *constraints = NULL;
  	const struct regulator_init_data *init_data;
@@ -48203,7 +48245,7 @@ index 0186c1b..6491409 100644
  	struct regulator_dev *rdev;
  	struct device *dev;
  	int ret, i;
-@@ -3439,7 +3439,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
+@@ -3440,7 +3440,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
  	rdev->dev.of_node = config->of_node;
  	rdev->dev.parent = dev;
  	dev_set_name(&rdev->dev, "regulator.%d",
@@ -55595,6 +55637,54 @@ index 88714ae..16c2e11 100644
  
  
  static inline u32 get_pll_internal_frequency(u32 ref_freq,
+diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
+index 4c02e2b..2c85267 100644
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -406,12 +406,26 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
+ 			state = BP_EAGAIN;
+ 			break;
+ 		}
+-
+-		pfn = page_to_pfn(page);
+-		frame_list[i] = pfn_to_mfn(pfn);
+-
+ 		scrub_page(page);
+ 
++		frame_list[i] = page_to_pfn(page);
++	}
++
++	/*
++	 * Ensure that ballooned highmem pages don't have kmaps.
++	 *
++	 * Do this before changing the p2m as kmap_flush_unused()
++	 * reads PTEs to obtain pages (and hence needs the original
++	 * p2m entry).
++	 */
++	kmap_flush_unused();
++
++	/* Update direct mapping, invalidate P2M, and add to balloon. */
++	for (i = 0; i < nr_pages; i++) {
++		pfn = frame_list[i];
++		frame_list[i] = pfn_to_mfn(pfn);
++		page = pfn_to_page(pfn);
++
+ #ifdef CONFIG_XEN_HAVE_PVMMU
+ 		/*
+ 		 * Ballooned out frames are effectively replaced with
+@@ -436,11 +450,9 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
+ 		}
+ #endif
+ 
+-		balloon_append(pfn_to_page(pfn));
++		balloon_append(page);
+ 	}
+ 
+-	/* Ensure that ballooned highmem pages don't have kmaps. */
+-	kmap_flush_unused();
+ 	flush_tlb_all();
+ 
+ 	set_xen_guest_handle(reservation.extent_start, frame_list);
 diff --git a/drivers/xen/xenfs/xenstored.c b/drivers/xen/xenfs/xenstored.c
 index fef20db..d28b1ab 100644
 --- a/drivers/xen/xenfs/xenstored.c
@@ -55686,6 +55776,61 @@ index 062a5f6..e5618e0 100644
  		return -EINVAL;
  
  	file = aio_private_file(ctx, nr_pages);
+diff --git a/fs/anon_inodes.c b/fs/anon_inodes.c
+index 2408473..80ef38c 100644
+--- a/fs/anon_inodes.c
++++ b/fs/anon_inodes.c
+@@ -41,19 +41,8 @@ static const struct dentry_operations anon_inodefs_dentry_operations = {
+ static struct dentry *anon_inodefs_mount(struct file_system_type *fs_type,
+ 				int flags, const char *dev_name, void *data)
+ {
+-	struct dentry *root;
+-	root = mount_pseudo(fs_type, "anon_inode:", NULL,
++	return mount_pseudo(fs_type, "anon_inode:", NULL,
+ 			&anon_inodefs_dentry_operations, ANON_INODE_FS_MAGIC);
+-	if (!IS_ERR(root)) {
+-		struct super_block *s = root->d_sb;
+-		anon_inode_inode = alloc_anon_inode(s);
+-		if (IS_ERR(anon_inode_inode)) {
+-			dput(root);
+-			deactivate_locked_super(s);
+-			root = ERR_CAST(anon_inode_inode);
+-		}
+-	}
+-	return root;
+ }
+ 
+ static struct file_system_type anon_inode_fs_type = {
+@@ -175,22 +164,15 @@ EXPORT_SYMBOL_GPL(anon_inode_getfd);
+ 
+ static int __init anon_inode_init(void)
+ {
+-	int error;
+-
+-	error = register_filesystem(&anon_inode_fs_type);
+-	if (error)
+-		goto err_exit;
+ 	anon_inode_mnt = kern_mount(&anon_inode_fs_type);
+-	if (IS_ERR(anon_inode_mnt)) {
+-		error = PTR_ERR(anon_inode_mnt);
+-		goto err_unregister_filesystem;
+-	}
++	if (IS_ERR(anon_inode_mnt))
++		panic("anon_inode_init() kernel mount failed (%ld)\n", PTR_ERR(anon_inode_mnt));
++
++	anon_inode_inode = alloc_anon_inode(anon_inode_mnt->mnt_sb);
++	if (IS_ERR(anon_inode_inode))
++		panic("anon_inode_init() inode allocation failed (%ld)\n", PTR_ERR(anon_inode_inode));
++
+ 	return 0;
+-
+-err_unregister_filesystem:
+-	unregister_filesystem(&anon_inode_fs_type);
+-err_exit:
+-	panic(KERN_ERR "anon_inode_init() failed (%d)\n", error);
+ }
+ 
+ fs_initcall(anon_inode_init);
 diff --git a/fs/attr.c b/fs/attr.c
 index 5d4e59d..fd02418 100644
 --- a/fs/attr.c
@@ -56899,10 +57044,10 @@ index 1e86823..8e34695 100644
  	else if (whole->bd_holder != NULL)
  		return false;	 /* is a partition of a held device */
 diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
-index 316136b..e7a3a50 100644
+index 3de01b4..6547c39 100644
 --- a/fs/btrfs/ctree.c
 +++ b/fs/btrfs/ctree.c
-@@ -1028,9 +1028,12 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+@@ -1217,9 +1217,12 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
  		free_extent_buffer(buf);
  		add_root_to_dirty_list(root);
  	} else {
@@ -58020,7 +58165,7 @@ index bc3fbcd..6031650 100644
  		return 0;
  	while (nr) {
 diff --git a/fs/dcache.c b/fs/dcache.c
-index fdbe230..ba17c1f 100644
+index fdbe230..d852932 100644
 --- a/fs/dcache.c
 +++ b/fs/dcache.c
 @@ -1495,7 +1495,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
@@ -58032,6 +58177,18 @@ index fdbe230..ba17c1f 100644
  		if (!dname) {
  			kmem_cache_free(dentry_cache, dentry); 
  			return NULL;
+@@ -2833,9 +2833,9 @@ static int prepend_name(char **buffer, int *buflen, struct qstr *name)
+ 	u32 dlen = ACCESS_ONCE(name->len);
+ 	char *p;
+ 
+-	if (*buflen < dlen + 1)
+-		return -ENAMETOOLONG;
+ 	*buflen -= dlen + 1;
++	if (*buflen < 0)
++		return -ENAMETOOLONG;
+ 	p = *buffer -= dlen + 1;
+ 	*p++ = '/';
+ 	while (dlen--) {
 @@ -3428,7 +3428,8 @@ void __init vfs_caches_init(unsigned long mempages)
  	mempages -= reserve;
  
@@ -61026,7 +61183,7 @@ index a17458c..e69fb5b 100644
  #define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */
  
 diff --git a/fs/namei.c b/fs/namei.c
-index 3531dee..3177227 100644
+index cfe6608..a24748c 100644
 --- a/fs/namei.c
 +++ b/fs/namei.c
 @@ -319,16 +319,32 @@ int generic_permission(struct inode *inode, int mask)
@@ -61102,7 +61259,57 @@ index 3531dee..3177227 100644
  	nd->last_type = LAST_BIND;
  	*p = dentry->d_inode->i_op->follow_link(dentry, nd);
  	error = PTR_ERR(*p);
-@@ -1582,6 +1596,8 @@ static inline int nested_symlink(struct path *path, struct nameidata *nd)
+@@ -1098,7 +1112,7 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
+ 			return false;
+ 
+ 		if (!d_mountpoint(path->dentry))
+-			break;
++			return true;
+ 
+ 		mounted = __lookup_mnt(path->mnt, path->dentry);
+ 		if (!mounted)
+@@ -1114,20 +1128,7 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
+ 		 */
+ 		*inode = path->dentry->d_inode;
+ 	}
+-	return true;
+-}
+-
+-static void follow_mount_rcu(struct nameidata *nd)
+-{
+-	while (d_mountpoint(nd->path.dentry)) {
+-		struct mount *mounted;
+-		mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
+-		if (!mounted)
+-			break;
+-		nd->path.mnt = &mounted->mnt;
+-		nd->path.dentry = mounted->mnt.mnt_root;
+-		nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
+-	}
++	return read_seqretry(&mount_lock, nd->m_seq);
+ }
+ 
+ static int follow_dotdot_rcu(struct nameidata *nd)
+@@ -1155,7 +1156,17 @@ static int follow_dotdot_rcu(struct nameidata *nd)
+ 			break;
+ 		nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
+ 	}
+-	follow_mount_rcu(nd);
++	while (d_mountpoint(nd->path.dentry)) {
++		struct mount *mounted;
++		mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry);
++		if (!mounted)
++			break;
++		nd->path.mnt = &mounted->mnt;
++		nd->path.dentry = mounted->mnt.mnt_root;
++		nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
++		if (!read_seqretry(&mount_lock, nd->m_seq))
++			goto failed;
++	}
+ 	nd->inode = nd->path.dentry->d_inode;
+ 	return 0;
+ 
+@@ -1582,6 +1593,8 @@ static inline int nested_symlink(struct path *path, struct nameidata *nd)
  		if (res)
  			break;
  		res = walk_component(nd, path, LOOKUP_FOLLOW);
@@ -61111,7 +61318,7 @@ index 3531dee..3177227 100644
  		put_link(nd, &link, cookie);
  	} while (res > 0);
  
-@@ -1655,7 +1671,7 @@ EXPORT_SYMBOL(full_name_hash);
+@@ -1655,7 +1668,7 @@ EXPORT_SYMBOL(full_name_hash);
  static inline unsigned long hash_name(const char *name, unsigned int *hashp)
  {
  	unsigned long a, b, adata, bdata, mask, hash, len;
@@ -61120,7 +61327,7 @@ index 3531dee..3177227 100644
  
  	hash = a = 0;
  	len = -sizeof(unsigned long);
-@@ -1939,6 +1955,8 @@ static int path_lookupat(int dfd, const char *name,
+@@ -1939,6 +1952,8 @@ static int path_lookupat(int dfd, const char *name,
  			if (err)
  				break;
  			err = lookup_last(nd, &path);
@@ -61129,7 +61336,7 @@ index 3531dee..3177227 100644
  			put_link(nd, &link, cookie);
  		}
  	}
-@@ -1946,6 +1964,13 @@ static int path_lookupat(int dfd, const char *name,
+@@ -1946,6 +1961,13 @@ static int path_lookupat(int dfd, const char *name,
  	if (!err)
  		err = complete_walk(nd);
  
@@ -61143,7 +61350,7 @@ index 3531dee..3177227 100644
  	if (!err && nd->flags & LOOKUP_DIRECTORY) {
  		if (!d_is_directory(nd->path.dentry)) {
  			path_put(&nd->path);
-@@ -1973,8 +1998,15 @@ static int filename_lookup(int dfd, struct filename *name,
+@@ -1973,8 +1995,15 @@ static int filename_lookup(int dfd, struct filename *name,
  		retval = path_lookupat(dfd, name->name,
  						flags | LOOKUP_REVAL, nd);
  
@@ -61160,7 +61367,7 @@ index 3531dee..3177227 100644
  	return retval;
  }
  
-@@ -2548,6 +2580,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
+@@ -2548,6 +2577,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
  	if (flag & O_NOATIME && !inode_owner_or_capable(inode))
  		return -EPERM;
  
@@ -61174,7 +61381,7 @@ index 3531dee..3177227 100644
  	return 0;
  }
  
-@@ -2779,7 +2818,7 @@ looked_up:
+@@ -2779,7 +2815,7 @@ looked_up:
   * cleared otherwise prior to returning.
   */
  static int lookup_open(struct nameidata *nd, struct path *path,
@@ -61183,7 +61390,7 @@ index 3531dee..3177227 100644
  			const struct open_flags *op,
  			bool got_write, int *opened)
  {
-@@ -2814,6 +2853,17 @@ static int lookup_open(struct nameidata *nd, struct path *path,
+@@ -2814,6 +2850,17 @@ static int lookup_open(struct nameidata *nd, struct path *path,
  	/* Negative dentry, just create the file */
  	if (!dentry->d_inode && (op->open_flag & O_CREAT)) {
  		umode_t mode = op->mode;
@@ -61201,7 +61408,7 @@ index 3531dee..3177227 100644
  		if (!IS_POSIXACL(dir->d_inode))
  			mode &= ~current_umask();
  		/*
-@@ -2835,6 +2885,8 @@ static int lookup_open(struct nameidata *nd, struct path *path,
+@@ -2835,6 +2882,8 @@ static int lookup_open(struct nameidata *nd, struct path *path,
  				   nd->flags & LOOKUP_EXCL);
  		if (error)
  			goto out_dput;
@@ -61210,7 +61417,7 @@ index 3531dee..3177227 100644
  	}
  out_no_open:
  	path->dentry = dentry;
-@@ -2849,7 +2901,7 @@ out_dput:
+@@ -2849,7 +2898,7 @@ out_dput:
  /*
   * Handle the last step of open()
   */
@@ -61219,7 +61426,7 @@ index 3531dee..3177227 100644
  		   struct file *file, const struct open_flags *op,
  		   int *opened, struct filename *name)
  {
-@@ -2899,6 +2951,15 @@ static int do_last(struct nameidata *nd, struct path *path,
+@@ -2899,6 +2948,15 @@ static int do_last(struct nameidata *nd, struct path *path,
  		if (error)
  			return error;
  
@@ -61235,7 +61442,7 @@ index 3531dee..3177227 100644
  		audit_inode(name, dir, LOOKUP_PARENT);
  		error = -EISDIR;
  		/* trailing slashes? */
-@@ -2918,7 +2979,7 @@ retry_lookup:
+@@ -2918,7 +2976,7 @@ retry_lookup:
  		 */
  	}
  	mutex_lock(&dir->d_inode->i_mutex);
@@ -61244,7 +61451,7 @@ index 3531dee..3177227 100644
  	mutex_unlock(&dir->d_inode->i_mutex);
  
  	if (error <= 0) {
-@@ -2942,11 +3003,28 @@ retry_lookup:
+@@ -2942,11 +3000,28 @@ retry_lookup:
  		goto finish_open_created;
  	}
  
@@ -61274,7 +61481,7 @@ index 3531dee..3177227 100644
  
  	/*
  	 * If atomic_open() acquired write access it is dropped now due to
-@@ -2987,6 +3065,11 @@ finish_lookup:
+@@ -2987,6 +3062,11 @@ finish_lookup:
  			}
  		}
  		BUG_ON(inode != path->dentry->d_inode);
@@ -61286,7 +61493,7 @@ index 3531dee..3177227 100644
  		return 1;
  	}
  
-@@ -2996,7 +3079,6 @@ finish_lookup:
+@@ -2996,7 +3076,6 @@ finish_lookup:
  		save_parent.dentry = nd->path.dentry;
  		save_parent.mnt = mntget(path->mnt);
  		nd->path.dentry = path->dentry;
@@ -61294,7 +61501,7 @@ index 3531dee..3177227 100644
  	}
  	nd->inode = inode;
  	/* Why this, you ask?  _Now_ we might have grown LOOKUP_JUMPED... */
-@@ -3006,7 +3088,18 @@ finish_open:
+@@ -3006,7 +3085,18 @@ finish_open:
  		path_put(&save_parent);
  		return error;
  	}
@@ -61313,7 +61520,7 @@ index 3531dee..3177227 100644
  	error = -EISDIR;
  	if ((open_flag & O_CREAT) &&
  	    (d_is_directory(nd->path.dentry) || d_is_autodir(nd->path.dentry)))
-@@ -3170,7 +3263,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
+@@ -3170,7 +3260,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
  	if (unlikely(error))
  		goto out;
  
@@ -61322,7 +61529,7 @@ index 3531dee..3177227 100644
  	while (unlikely(error > 0)) { /* trailing symlink */
  		struct path link = path;
  		void *cookie;
-@@ -3188,7 +3281,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
+@@ -3188,7 +3278,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
  		error = follow_link(&link, nd, &cookie);
  		if (unlikely(error))
  			break;
@@ -61331,7 +61538,7 @@ index 3531dee..3177227 100644
  		put_link(nd, &link, cookie);
  	}
  out:
-@@ -3288,9 +3381,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname,
+@@ -3288,9 +3378,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname,
  		goto unlock;
  
  	error = -EEXIST;
@@ -61345,7 +61552,7 @@ index 3531dee..3177227 100644
  	/*
  	 * Special case - lookup gave negative, but... we had foo/bar/
  	 * From the vfs_mknod() POV we just have a negative dentry -
-@@ -3342,6 +3437,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname,
+@@ -3342,6 +3434,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname,
  }
  EXPORT_SYMBOL(user_path_create);
  
@@ -61366,7 +61573,7 @@ index 3531dee..3177227 100644
  int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
  {
  	int error = may_create(dir, dentry);
-@@ -3404,6 +3513,17 @@ retry:
+@@ -3404,6 +3510,17 @@ retry:
  
  	if (!IS_POSIXACL(path.dentry->d_inode))
  		mode &= ~current_umask();
@@ -61384,7 +61591,7 @@ index 3531dee..3177227 100644
  	error = security_path_mknod(&path, dentry, mode, dev);
  	if (error)
  		goto out;
-@@ -3420,6 +3540,8 @@ retry:
+@@ -3420,6 +3537,8 @@ retry:
  			break;
  	}
  out:
@@ -61393,7 +61600,7 @@ index 3531dee..3177227 100644
  	done_path_create(&path, dentry);
  	if (retry_estale(error, lookup_flags)) {
  		lookup_flags |= LOOKUP_REVAL;
-@@ -3472,9 +3594,16 @@ retry:
+@@ -3472,9 +3591,16 @@ retry:
  
  	if (!IS_POSIXACL(path.dentry->d_inode))
  		mode &= ~current_umask();
@@ -61410,7 +61617,7 @@ index 3531dee..3177227 100644
  	done_path_create(&path, dentry);
  	if (retry_estale(error, lookup_flags)) {
  		lookup_flags |= LOOKUP_REVAL;
-@@ -3555,6 +3684,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
+@@ -3555,6 +3681,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
  	struct filename *name;
  	struct dentry *dentry;
  	struct nameidata nd;
@@ -61419,7 +61626,7 @@ index 3531dee..3177227 100644
  	unsigned int lookup_flags = 0;
  retry:
  	name = user_path_parent(dfd, pathname, &nd, lookup_flags);
-@@ -3587,10 +3718,21 @@ retry:
+@@ -3587,10 +3715,21 @@ retry:
  		error = -ENOENT;
  		goto exit3;
  	}
@@ -61441,7 +61648,7 @@ index 3531dee..3177227 100644
  exit3:
  	dput(dentry);
  exit2:
-@@ -3680,6 +3822,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+@@ -3680,6 +3819,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
  	struct nameidata nd;
  	struct inode *inode = NULL;
  	struct inode *delegated_inode = NULL;
@@ -61450,7 +61657,7 @@ index 3531dee..3177227 100644
  	unsigned int lookup_flags = 0;
  retry:
  	name = user_path_parent(dfd, pathname, &nd, lookup_flags);
-@@ -3706,10 +3850,22 @@ retry_deleg:
+@@ -3706,10 +3847,22 @@ retry_deleg:
  		if (d_is_negative(dentry))
  			goto slashes;
  		ihold(inode);
@@ -61473,7 +61680,7 @@ index 3531dee..3177227 100644
  exit2:
  		dput(dentry);
  	}
-@@ -3797,9 +3953,17 @@ retry:
+@@ -3797,9 +3950,17 @@ retry:
  	if (IS_ERR(dentry))
  		goto out_putname;
  
@@ -61491,7 +61698,7 @@ index 3531dee..3177227 100644
  	done_path_create(&path, dentry);
  	if (retry_estale(error, lookup_flags)) {
  		lookup_flags |= LOOKUP_REVAL;
-@@ -3902,6 +4066,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -3902,6 +4063,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
  	struct dentry *new_dentry;
  	struct path old_path, new_path;
  	struct inode *delegated_inode = NULL;
@@ -61499,7 +61706,7 @@ index 3531dee..3177227 100644
  	int how = 0;
  	int error;
  
-@@ -3925,7 +4090,7 @@ retry:
+@@ -3925,7 +4087,7 @@ retry:
  	if (error)
  		return error;
  
@@ -61508,7 +61715,7 @@ index 3531dee..3177227 100644
  					(how & LOOKUP_REVAL));
  	error = PTR_ERR(new_dentry);
  	if (IS_ERR(new_dentry))
-@@ -3937,11 +4102,28 @@ retry:
+@@ -3937,11 +4099,28 @@ retry:
  	error = may_linkat(&old_path);
  	if (unlikely(error))
  		goto out_dput;
@@ -61537,7 +61744,7 @@ index 3531dee..3177227 100644
  	done_path_create(&new_path, new_dentry);
  	if (delegated_inode) {
  		error = break_deleg_wait(&delegated_inode);
-@@ -4225,6 +4407,12 @@ retry_deleg:
+@@ -4228,6 +4407,12 @@ retry_deleg:
  	if (new_dentry == trap)
  		goto exit5;
  
@@ -61550,7 +61757,7 @@ index 3531dee..3177227 100644
  	error = security_path_rename(&oldnd.path, old_dentry,
  				     &newnd.path, new_dentry);
  	if (error)
-@@ -4232,6 +4420,9 @@ retry_deleg:
+@@ -4235,6 +4420,9 @@ retry_deleg:
  	error = vfs_rename(old_dir->d_inode, old_dentry,
  				   new_dir->d_inode, new_dentry,
  				   &delegated_inode);
@@ -61560,7 +61767,7 @@ index 3531dee..3177227 100644
  exit5:
  	dput(new_dentry);
  exit4:
-@@ -4268,6 +4459,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
+@@ -4271,6 +4459,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
  
  int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
  {
@@ -61569,7 +61776,7 @@ index 3531dee..3177227 100644
  	int len;
  
  	len = PTR_ERR(link);
-@@ -4277,7 +4470,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
+@@ -4280,7 +4470,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
  	len = strlen(link);
  	if (len > (unsigned) buflen)
  		len = buflen;
@@ -62690,7 +62897,7 @@ index 1bd2077..2f7cfd5 100644
  static struct pid *
  get_children_pid(struct inode *inode, struct pid *pid_prev, loff_t pos)
 diff --git a/fs/proc/base.c b/fs/proc/base.c
-index 03c8d74..68a79e8 100644
+index b59a34b..68a79e8 100644
 --- a/fs/proc/base.c
 +++ b/fs/proc/base.c
 @@ -113,6 +113,14 @@ struct pid_entry {
@@ -62999,15 +63206,7 @@ index 03c8d74..68a79e8 100644
  			rcu_read_unlock();
  		} else {
  			inode->i_uid = GLOBAL_ROOT_UID;
-@@ -1819,6 +1937,7 @@ static int proc_map_files_get_link(struct dentry *dentry, struct path *path)
- 	if (rc)
- 		goto out_mmput;
- 
-+	rc = -ENOENT;
- 	down_read(&mm->mmap_sem);
- 	vma = find_exact_vma(mm, vm_start, vm_end);
- 	if (vma && vma->vm_file) {
-@@ -2172,6 +2291,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
+@@ -2173,6 +2291,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
  	if (!task)
  		goto out_no_task;
  
@@ -63017,7 +63216,7 @@ index 03c8d74..68a79e8 100644
  	/*
  	 * Yes, it does not scale. And it should not. Don't add
  	 * new entries into /proc/<tgid>/ without very good reasons.
-@@ -2202,6 +2324,9 @@ static int proc_pident_readdir(struct file *file, struct dir_context *ctx,
+@@ -2203,6 +2324,9 @@ static int proc_pident_readdir(struct file *file, struct dir_context *ctx,
  	if (!task)
  		return -ENOENT;
  
@@ -63027,7 +63226,7 @@ index 03c8d74..68a79e8 100644
  	if (!dir_emit_dots(file, ctx))
  		goto out;
  
-@@ -2591,7 +2716,7 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2592,7 +2716,7 @@ static const struct pid_entry tgid_base_stuff[] = {
  	REG("autogroup",  S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
  #endif
  	REG("comm",      S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
@@ -63036,7 +63235,7 @@ index 03c8d74..68a79e8 100644
  	INF("syscall",    S_IRUGO, proc_pid_syscall),
  #endif
  	INF("cmdline",    S_IRUGO, proc_pid_cmdline),
-@@ -2616,10 +2741,10 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2617,10 +2741,10 @@ static const struct pid_entry tgid_base_stuff[] = {
  #ifdef CONFIG_SECURITY
  	DIR("attr",       S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
  #endif
@@ -63049,7 +63248,7 @@ index 03c8d74..68a79e8 100644
  	ONE("stack",      S_IRUGO, proc_pid_stack),
  #endif
  #ifdef CONFIG_SCHEDSTATS
-@@ -2653,6 +2778,9 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2654,6 +2778,9 @@ static const struct pid_entry tgid_base_stuff[] = {
  #ifdef CONFIG_HARDWALL
  	INF("hardwall",   S_IRUGO, proc_pid_hardwall),
  #endif
@@ -63059,7 +63258,7 @@ index 03c8d74..68a79e8 100644
  #ifdef CONFIG_USER_NS
  	REG("uid_map",    S_IRUGO|S_IWUSR, proc_uid_map_operations),
  	REG("gid_map",    S_IRUGO|S_IWUSR, proc_gid_map_operations),
-@@ -2783,7 +2911,14 @@ static int proc_pid_instantiate(struct inode *dir,
+@@ -2784,7 +2911,14 @@ static int proc_pid_instantiate(struct inode *dir,
  	if (!inode)
  		goto out;
  
@@ -63074,7 +63273,7 @@ index 03c8d74..68a79e8 100644
  	inode->i_op = &proc_tgid_base_inode_operations;
  	inode->i_fop = &proc_tgid_base_operations;
  	inode->i_flags|=S_IMMUTABLE;
-@@ -2821,7 +2956,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, unsign
+@@ -2822,7 +2956,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, unsign
  	if (!task)
  		goto out;
  
@@ -63086,7 +63285,7 @@ index 03c8d74..68a79e8 100644
  	put_task_struct(task);
  out:
  	return ERR_PTR(result);
-@@ -2927,7 +3066,7 @@ static const struct pid_entry tid_base_stuff[] = {
+@@ -2928,7 +3066,7 @@ static const struct pid_entry tid_base_stuff[] = {
  	REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
  #endif
  	REG("comm",      S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
@@ -63095,7 +63294,7 @@ index 03c8d74..68a79e8 100644
  	INF("syscall",   S_IRUGO, proc_pid_syscall),
  #endif
  	INF("cmdline",   S_IRUGO, proc_pid_cmdline),
-@@ -2954,10 +3093,10 @@ static const struct pid_entry tid_base_stuff[] = {
+@@ -2955,10 +3093,10 @@ static const struct pid_entry tid_base_stuff[] = {
  #ifdef CONFIG_SECURITY
  	DIR("attr",      S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
  #endif
@@ -64963,10 +65162,10 @@ index 104455b..764c512 100644
  		kfree(s);
 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
 new file mode 100644
-index 0000000..031e895
+index 0000000..13b7885
 --- /dev/null
 +++ b/grsecurity/Kconfig
-@@ -0,0 +1,1157 @@
+@@ -0,0 +1,1155 @@
 +#
 +# grecurity configuration
 +#
@@ -64980,18 +65179,16 @@ index 0000000..031e895
 +	help
 +	  If you say Y here, /dev/kmem and /dev/mem won't be allowed to
 +	  be written to or read from to modify or leak the contents of the running
-+	  kernel.  /dev/port will also not be allowed to be opened, and support
-+	  for /dev/cpu/*/msr and kexec will be removed.  If you have module
-+	  support disabled, enabling this will close up six ways that are
-+	  currently used to insert malicious code into the running kernel.
++	  kernel.  /dev/port will also not be allowed to be opened, writing to
++	  /dev/cpu/*/msr will be prevented, and support for kexec will be removed.
++	  If you have module support disabled, enabling this will close up several
++	  ways that are currently used to insert malicious code into the running
++	  kernel.
 +
 +	  Even with this feature enabled, we still highly recommend that
 +	  you use the RBAC system, as it is still possible for an attacker to
 +	  modify the running kernel through other more obscure methods.
 +
-+	  Enabling this feature will prevent the "cpupower" and "powertop" tools
-+	  from working.
-+
 +	  It is highly recommended that you say Y here if you meet all the
 +	  conditions above.
 +
@@ -79641,7 +79838,7 @@ index 9fe426b..8148be6 100644
  static inline int
  vma_dup_policy(struct vm_area_struct *src, struct vm_area_struct *dst)
 diff --git a/include/linux/mm.h b/include/linux/mm.h
-index 9fac6dd..158ca43 100644
+index 0ab5439..2859c61 100644
 --- a/include/linux/mm.h
 +++ b/include/linux/mm.h
 @@ -117,6 +117,11 @@ extern unsigned int kobjsize(const void *objp);
@@ -82990,10 +83187,37 @@ index 2ef3c3e..e02013e 100644
  /**
   * sk_page_frag - return an appropriate page_frag
 diff --git a/include/net/tcp.h b/include/net/tcp.h
-index 70e55d2..c5d8d53 100644
+index 9250d62..10a7f03 100644
 --- a/include/net/tcp.h
 +++ b/include/net/tcp.h
-@@ -540,7 +540,7 @@ void tcp_retransmit_timer(struct sock *sk);
+@@ -480,20 +480,21 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
+ #ifdef CONFIG_SYN_COOKIES
+ #include <linux/ktime.h>
+ 
+-/* Syncookies use a monotonic timer which increments every 64 seconds.
++/* Syncookies use a monotonic timer which increments every 60 seconds.
+  * This counter is used both as a hash input and partially encoded into
+  * the cookie value.  A cookie is only validated further if the delta
+  * between the current counter value and the encoded one is less than this,
+- * i.e. a sent cookie is valid only at most for 128 seconds (or less if
++ * i.e. a sent cookie is valid only at most for 2*60 seconds (or less if
+  * the counter advances immediately after a cookie is generated).
+  */
+ #define MAX_SYNCOOKIE_AGE 2
+ 
+ static inline u32 tcp_cookie_time(void)
+ {
+-	struct timespec now;
+-	getnstimeofday(&now);
+-	return now.tv_sec >> 6; /* 64 seconds granularity */
++	u64 val = get_jiffies_64();
++
++	do_div(val, 60 * HZ);
++	return val;
+ }
+ 
+ u32 __cookie_v4_init_sequence(const struct iphdr *iph, const struct tcphdr *th,
+@@ -540,7 +541,7 @@ void tcp_retransmit_timer(struct sock *sk);
  void tcp_xmit_retransmit_queue(struct sock *);
  void tcp_simple_retransmit(struct sock *);
  int tcp_trim_head(struct sock *, struct sk_buff *, u32);
@@ -83002,7 +83226,7 @@ index 70e55d2..c5d8d53 100644
  
  void tcp_send_probe0(struct sock *);
  void tcp_send_partial(struct sock *);
-@@ -711,8 +711,8 @@ struct tcp_skb_cb {
+@@ -711,8 +712,8 @@ struct tcp_skb_cb {
  		struct inet6_skb_parm	h6;
  #endif
  	} header;	/* For incoming frames		*/
@@ -83013,7 +83237,7 @@ index 70e55d2..c5d8d53 100644
  	__u32		when;		/* used to compute rtt's	*/
  	__u8		tcp_flags;	/* TCP header flags. (tcp[13])	*/
  
-@@ -726,7 +726,7 @@ struct tcp_skb_cb {
+@@ -726,7 +727,7 @@ struct tcp_skb_cb {
  
  	__u8		ip_dsfield;	/* IPv4 tos or IPv6 dsfield	*/
  	/* 1 byte hole */
@@ -84213,7 +84437,7 @@ index b8d4aed..96a4fe8 100644
  		if (u->mq_bytes + mq_bytes < u->mq_bytes ||
  		    u->mq_bytes + mq_bytes > rlimit(RLIMIT_MSGQUEUE)) {
 diff --git a/ipc/msg.c b/ipc/msg.c
-index 558aa91..359e718 100644
+index 52770bf..1c60a6f 100644
 --- a/ipc/msg.c
 +++ b/ipc/msg.c
 @@ -297,18 +297,19 @@ static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg)
@@ -84458,7 +84682,7 @@ index 15ec13a..986322e 100644
  	if (!ab)
  		return;
 diff --git a/kernel/auditsc.c b/kernel/auditsc.c
-index 90594c9..abbeed7 100644
+index ff32843..27fc708 100644
 --- a/kernel/auditsc.c
 +++ b/kernel/auditsc.c
 @@ -1945,7 +1945,7 @@ int auditsc_get_stamp(struct audit_context *ctx,
@@ -84470,7 +84694,7 @@ index 90594c9..abbeed7 100644
  
  static int audit_set_loginuid_perm(kuid_t loginuid)
  {
-@@ -2008,7 +2008,7 @@ int audit_set_loginuid(kuid_t loginuid)
+@@ -2011,7 +2011,7 @@ int audit_set_loginuid(kuid_t loginuid)
  
  	/* are we setting or clearing? */
  	if (uid_valid(loginuid))
@@ -88792,7 +89016,7 @@ index c677510..132bb14 100644
  #else
  static void register_sched_domain_sysctl(void)
 diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
-index e64b079..a46bd34 100644
+index ce501de..1805320 100644
 --- a/kernel/sched/fair.c
 +++ b/kernel/sched/fair.c
 @@ -1652,7 +1652,7 @@ void task_numa_fault(int last_cpupid, int node, int pages, int flags)
@@ -90087,7 +90311,7 @@ index 26dc348..8708ca7 100644
 +	return atomic64_inc_return_unchecked(&trace_counter);
  }
 diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
-index a11800a..3dafde5 100644
+index 2e58196..fdd3d61 100644
 --- a/kernel/trace/trace_events.c
 +++ b/kernel/trace/trace_events.c
 @@ -1681,7 +1681,6 @@ __trace_early_add_new_event(struct ftrace_event_call *call,
@@ -91046,72 +91270,6 @@ index ce682f7..1fb54f9 100644
  	if (err) {
  		bdi_destroy(bdi);
  		return err;
-diff --git a/mm/compaction.c b/mm/compaction.c
-index f58bcd0..b74dc61 100644
---- a/mm/compaction.c
-+++ b/mm/compaction.c
-@@ -251,7 +251,6 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
- {
- 	int nr_scanned = 0, total_isolated = 0;
- 	struct page *cursor, *valid_page = NULL;
--	unsigned long nr_strict_required = end_pfn - blockpfn;
- 	unsigned long flags;
- 	bool locked = false;
- 
-@@ -264,11 +263,12 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
- 
- 		nr_scanned++;
- 		if (!pfn_valid_within(blockpfn))
--			continue;
-+			goto isolate_fail;
-+
- 		if (!valid_page)
- 			valid_page = page;
- 		if (!PageBuddy(page))
--			continue;
-+			goto isolate_fail;
- 
- 		/*
- 		 * The zone lock must be held to isolate freepages.
-@@ -289,12 +289,10 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
- 
- 		/* Recheck this is a buddy page under lock */
- 		if (!PageBuddy(page))
--			continue;
-+			goto isolate_fail;
- 
- 		/* Found a free page, break it into order-0 pages */
- 		isolated = split_free_page(page);
--		if (!isolated && strict)
--			break;
- 		total_isolated += isolated;
- 		for (i = 0; i < isolated; i++) {
- 			list_add(&page->lru, freelist);
-@@ -305,7 +303,15 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
- 		if (isolated) {
- 			blockpfn += isolated - 1;
- 			cursor += isolated - 1;
-+			continue;
- 		}
-+
-+isolate_fail:
-+		if (strict)
-+			break;
-+		else
-+			continue;
-+
- 	}
- 
- 	trace_mm_compaction_isolate_freepages(nr_scanned, total_isolated);
-@@ -315,7 +321,7 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
- 	 * pages requested were isolated. If there were any failures, 0 is
- 	 * returned and CMA will fail.
- 	 */
--	if (strict && nr_strict_required > total_isolated)
-+	if (strict && blockpfn < end_pfn)
- 		total_isolated = 0;
- 
- 	if (locked)
 diff --git a/mm/filemap.c b/mm/filemap.c
 index b7749a9..50d1123 100644
 --- a/mm/filemap.c
@@ -94145,7 +94303,7 @@ index 7106cb1..0805f48 100644
  					unsigned long bg_thresh,
  					unsigned long dirty,
 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 5248fe0..0f693aa 100644
+index 56f268d..4d35ec4 100644
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
 @@ -61,6 +61,7 @@
@@ -96834,7 +96992,7 @@ index b618694..192bbba 100644
  
  	m->msg_iov = iov;
 diff --git a/net/core/neighbour.c b/net/core/neighbour.c
-index 932c6d7..71fd94a 100644
+index 43128dd..e4d4311 100644
 --- a/net/core/neighbour.c
 +++ b/net/core/neighbour.c
 @@ -2775,7 +2775,7 @@ static int proc_unres_qlen(struct ctl_table *ctl, int write,
@@ -97375,10 +97533,10 @@ index 1865fdf..581a595 100644
  	if (flags & MSG_TRUNC)
  		copied = skb->len;
 diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
-index 70011e0..454ca6a 100644
+index e4d96d4..e1651da 100644
 --- a/net/ipv4/af_inet.c
 +++ b/net/ipv4/af_inet.c
-@@ -1683,13 +1683,9 @@ static int __init inet_init(void)
+@@ -1686,13 +1686,9 @@ static int __init inet_init(void)
  
  	BUILD_BUG_ON(sizeof(struct inet_skb_parm) > FIELD_SIZEOF(struct sk_buff, cb));
  
@@ -97393,7 +97551,7 @@ index 70011e0..454ca6a 100644
  
  	rc = proto_register(&udp_prot, 1);
  	if (rc)
-@@ -1796,8 +1792,6 @@ out_unregister_udp_proto:
+@@ -1799,8 +1795,6 @@ out_unregister_udp_proto:
  	proto_unregister(&udp_prot);
  out_unregister_tcp_proto:
  	proto_unregister(&tcp_prot);
@@ -100976,24 +101134,6 @@ index 1a6eef3..17e898f 100644
  	NULL,
  	sctp_generate_t1_cookie_event,
  	sctp_generate_t1_init_event,
-diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
-index a26065b..af7be05 100644
---- a/net/sctp/sm_statefuns.c
-+++ b/net/sctp/sm_statefuns.c
-@@ -759,6 +759,13 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
- 		struct sctp_chunk auth;
- 		sctp_ierror_t ret;
- 
-+		/* Make sure that we and the peer are AUTH capable */
-+		if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) {
-+			kfree_skb(chunk->auth_chunk);
-+			sctp_association_free(new_asoc);
-+			return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
-+		}
-+
- 		/* set-up our fake chunk so that we can process it */
- 		auth.skb = chunk->auth_chunk;
- 		auth.asoc = chunk->asoc;
 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
 index 146b35d..1021a34 100644
 --- a/net/sctp/socket.c
@@ -101756,10 +101896,10 @@ index d38bb45..38d5df5 100644
  
  	sub->evt.event = htohl(event, sub->swap);
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index a427623..387c80b 100644
+index d7c1ac6..b0fc322 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
-@@ -790,6 +790,12 @@ static struct sock *unix_find_other(struct net *net,
+@@ -789,6 +789,12 @@ static struct sock *unix_find_other(struct net *net,
  		err = -ECONNREFUSED;
  		if (!S_ISSOCK(inode->i_mode))
  			goto put_fail;
@@ -101772,7 +101912,7 @@ index a427623..387c80b 100644
  		u = unix_find_socket_byinode(inode);
  		if (!u)
  			goto put_fail;
-@@ -810,6 +816,13 @@ static struct sock *unix_find_other(struct net *net,
+@@ -809,6 +815,13 @@ static struct sock *unix_find_other(struct net *net,
  		if (u) {
  			struct dentry *dentry;
  			dentry = unix_sk(u)->path.dentry;
@@ -101786,7 +101926,7 @@ index a427623..387c80b 100644
  			if (dentry)
  				touch_atime(&unix_sk(u)->path);
  		} else
-@@ -843,12 +856,18 @@ static int unix_mknod(const char *sun_path, umode_t mode, struct path *res)
+@@ -842,12 +855,18 @@ static int unix_mknod(const char *sun_path, umode_t mode, struct path *res)
  	 */
  	err = security_path_mknod(&path, dentry, mode, 0);
  	if (!err) {
@@ -101805,7 +101945,52 @@ index a427623..387c80b 100644
  	done_path_create(&path, dentry);
  	return err;
  }
-@@ -2336,9 +2355,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -1785,8 +1804,11 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 		goto out;
+ 
+ 	err = mutex_lock_interruptible(&u->readlock);
+-	if (err) {
+-		err = sock_intr_errno(sock_rcvtimeo(sk, noblock));
++	if (unlikely(err)) {
++		/* recvmsg() in non blocking mode is supposed to return -EAGAIN
++		 * sk_rcvtimeo is not honored by mutex_lock_interruptible()
++		 */
++		err = noblock ? -EAGAIN : -ERESTARTSYS;
+ 		goto out;
+ 	}
+ 
+@@ -1911,6 +1933,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 	struct unix_sock *u = unix_sk(sk);
+ 	struct sockaddr_un *sunaddr = msg->msg_name;
+ 	int copied = 0;
++	int noblock = flags & MSG_DONTWAIT;
+ 	int check_creds = 0;
+ 	int target;
+ 	int err = 0;
+@@ -1926,7 +1949,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 		goto out;
+ 
+ 	target = sock_rcvlowat(sk, flags&MSG_WAITALL, size);
+-	timeo = sock_rcvtimeo(sk, flags&MSG_DONTWAIT);
++	timeo = sock_rcvtimeo(sk, noblock);
+ 
+ 	/* Lock the socket to prevent queue disordering
+ 	 * while sleeps in memcpy_tomsg
+@@ -1938,8 +1961,11 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 	}
+ 
+ 	err = mutex_lock_interruptible(&u->readlock);
+-	if (err) {
+-		err = sock_intr_errno(timeo);
++	if (unlikely(err)) {
++		/* recvmsg() in non blocking mode is supposed to return -EAGAIN
++		 * sk_rcvtimeo is not honored by mutex_lock_interruptible()
++		 */
++		err = noblock ? -EAGAIN : -ERESTARTSYS;
+ 		goto out;
+ 	}
+ 
+@@ -2335,9 +2361,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  		seq_puts(seq, "Num       RefCount Protocol Flags    Type St "
  			 "Inode Path\n");
  	else {
@@ -101820,7 +102005,7 @@ index a427623..387c80b 100644
  
  		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
  			s,
-@@ -2365,8 +2388,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2364,8 +2394,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  			}
  			for ( ; i < len; i++)
  				seq_putc(seq, u->addr->name->sun_path[i]);
@@ -102359,26 +102544,25 @@ index 078fe1d..fbdb363 100644
  		fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianness? %#x\n",
 diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
 new file mode 100644
-index 0000000..5e0222d
+index 0000000..ed4c19a
 --- /dev/null
 +++ b/scripts/gcc-plugin.sh
-@@ -0,0 +1,17 @@
+@@ -0,0 +1,16 @@
 +#!/bin/bash
-+plugincc=`$1 -E -shared - -o /dev/null -I\`$3 -print-file-name=plugin\`/include 2>&1 <<EOF
-+#include "gcc-plugin.h"
-+#include "tree.h"
-+#include "tm.h"
-+#include "rtl.h"
-+#ifdef ENABLE_BUILD_WITH_CXX
++srctree=$(dirname "$0")
++gccplugins_dir=$("$1" -print-file-name=plugin)
++plugincc=$("$1" -E -shared - -o /dev/null -I${srctree}/../tools/gcc -I${gccplugins_dir}/include 2>&1 <<EOF
++#include "gcc-common.h"
++#if __GNUC__ > 4 || __GNUC_MINOR__ >= 8 || defined(ENABLE_BUILD_WITH_CXX)
 +#warning $2
 +#else
 +#warning $1
 +#endif
-+EOF`
++EOF
++)
 +if [ $? -eq 0 ]
 +then
-+	[[ "$plugincc" =~ "$1" ]] && echo "$1"
-+	[[ "$plugincc" =~ "$2" ]] && echo "$2"
++	( [[ "$plugincc" =~ "$1" ]] && echo "$1" ) || ( [[ "$plugincc" =~ "$2" ]] && echo "$2" )
 +fi
 diff --git a/scripts/headers_install.sh b/scripts/headers_install.sh
 index 5de5660..d3deb89 100644
@@ -106903,10 +107087,10 @@ index 0000000..dd73713
 +}
 diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c
 new file mode 100644
-index 0000000..1a98bed
+index 0000000..c96f80f
 --- /dev/null
 +++ b/tools/gcc/latent_entropy_plugin.c
-@@ -0,0 +1,451 @@
+@@ -0,0 +1,457 @@
 +/*
 + * Copyright 2012-2014 by the PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -106935,7 +107119,7 @@ index 0000000..1a98bed
 +static tree latent_entropy_decl;
 +
 +static struct plugin_info latent_entropy_plugin_info = {
-+	.version	= "201402240545",
++	.version	= "201403042150",
 +	.help		= NULL
 +};
 +
@@ -107107,6 +107291,10 @@ index 0000000..1a98bed
 +
 +static bool gate_latent_entropy(void)
 +{
++	// don't bother with noreturn functions for now
++	if (TREE_THIS_VOLATILE(current_function_decl))
++		return false;
++
 +	return lookup_attribute("latent_entropy", DECL_ATTRIBUTES(current_function_decl)) != NULL_TREE;
 +}
 +
@@ -107231,7 +107419,8 @@ index 0000000..1a98bed
 +	gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
 +	update_stmt(assign);
 +//debug_bb(bb);
-+	bb = bb->next_bb;
++	gcc_assert(single_succ_p(bb));
++	bb = single_succ(bb);
 +
 +	// 3. instrument each BB with an operation on the local entropy variable
 +	while (bb != EXIT_BLOCK_PTR_FOR_FN(cfun)) {
@@ -107241,8 +107430,9 @@ index 0000000..1a98bed
 +	};
 +
 +	// 4. mix local entropy into the global entropy variable
-+	perturb_latent_entropy(EXIT_BLOCK_PTR_FOR_FN(cfun)->prev_bb, local_entropy);
-+//debug_bb(EXIT_BLOCK_PTR_FOR_FN(cfun)->prev_bb);
++	gcc_assert(single_pred_p(EXIT_BLOCK_PTR_FOR_FN(cfun)));
++	perturb_latent_entropy(single_pred(EXIT_BLOCK_PTR_FOR_FN(cfun)), local_entropy);
++//debug_bb(single_pred(EXIT_BLOCK_PTR_FOR_FN(cfun)));
 +	return 0;
 +}
 +
@@ -108276,10 +108466,10 @@ index 0000000..8dafb22
 +}
 diff --git a/tools/gcc/size_overflow_hash.data b/tools/gcc/size_overflow_hash.data
 new file mode 100644
-index 0000000..102f0d6
+index 0000000..9529806
 --- /dev/null
 +++ b/tools/gcc/size_overflow_hash.data
-@@ -0,0 +1,5703 @@
+@@ -0,0 +1,5709 @@
 +intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL
 +ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
 +storvsc_connect_to_vsp_22 storvsc_connect_to_vsp 2 22 NULL
@@ -110005,6 +110195,7 @@ index 0000000..102f0d6
 +lustre_pack_request_19992 lustre_pack_request 0 19992 NULL
 +diva_um_idi_read_20003 diva_um_idi_read 0 20003 NULL
 +lov_stripe_md_size_20009 lov_stripe_md_size 0-1 20009 NULL
++tree_mod_log_eb_move_20011 tree_mod_log_eb_move 5 20011 NULL
 +SYSC_fgetxattr_20027 SYSC_fgetxattr 4 20027 NULL
 +split_scan_timeout_read_20029 split_scan_timeout_read 3 20029 NULL
 +alloc_ieee80211_20063 alloc_ieee80211 1 20063 NULL
@@ -110025,6 +110216,7 @@ index 0000000..102f0d6
 +pvr2_ctrl_value_to_sym_20229 pvr2_ctrl_value_to_sym 5 20229 NULL
 +rose_sendmsg_20249 rose_sendmsg 4 20249 NULL
 +tm6000_i2c_send_regs_20250 tm6000_i2c_send_regs 5 20250 NULL
++btrfs_header_nritems_20296 btrfs_header_nritems 0 20296 NULL
 +r10_sync_page_io_20307 r10_sync_page_io 3 20307 NULL
 +dm_get_reserved_bio_based_ios_20315 dm_get_reserved_bio_based_ios 0 20315 NULL
 +tx_tx_burst_programmed_read_20320 tx_tx_burst_programmed_read 3 20320 NULL
@@ -110134,6 +110326,7 @@ index 0000000..102f0d6
 +alloc_orinocodev_21371 alloc_orinocodev 1 21371 NULL
 +SYSC_rt_sigpending_21379 SYSC_rt_sigpending 2 21379 NULL
 +video_ioctl2_21380 video_ioctl2 2 21380 NULL
++insert_ptr_21386 insert_ptr 6 21386 NULL
 +diva_get_driver_dbg_mask_21399 diva_get_driver_dbg_mask 0 21399 NULL
 +snd_m3_inw_21406 snd_m3_inw 0 21406 NULL
 +snapshot_read_next_21426 snapshot_read_next 0 21426 NULL
@@ -111051,6 +111244,7 @@ index 0000000..102f0d6
 +kobject_add_internal_32133 kobject_add_internal 0 32133 NULL
 +venus_link_32165 venus_link 5 32165 NULL
 +do_writepages_32173 do_writepages 0 32173 NULL
++del_ptr_32197 del_ptr 4 32197 NULL
 +wusb_ccm_mac_32199 wusb_ccm_mac 7 32199 NULL
 +riva_get_cmap_len_32218 riva_get_cmap_len 0 32218 NULL
 +caif_seqpkt_recvmsg_32241 caif_seqpkt_recvmsg 4 32241 NULL
@@ -112416,6 +112610,7 @@ index 0000000..102f0d6
 +posix_acl_fix_xattr_from_user_47793 posix_acl_fix_xattr_from_user 2 47793 NULL
 +W6692_empty_Bfifo_47804 W6692_empty_Bfifo 2 47804 NULL
 +lov_packmd_47810 lov_packmd 0 47810 NULL
++tree_mod_log_insert_move_47823 tree_mod_log_insert_move 5 47823 NULL
 +pinconf_dbg_config_write_47835 pinconf_dbg_config_write 3 47835 NULL
 +KEY_SIZE_47855 KEY_SIZE 0 47855 NULL
 +vhci_read_47878 vhci_read 3 47878 NULL
@@ -113983,6 +114178,7 @@ index 0000000..102f0d6
 +dpcm_state_read_file_65489 dpcm_state_read_file 3 65489 NULL
 +lookup_inline_extent_backref_65493 lookup_inline_extent_backref 9 65493 NULL
 +nvme_trans_standard_inquiry_page_65526 nvme_trans_standard_inquiry_page 4 65526 NULL
++tree_mod_log_eb_copy_65535 tree_mod_log_eb_copy 6 65535 NULL
 diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
 new file mode 100644
 index 0000000..fa0524c
diff --git a/3.13.6/4425_grsec_remove_EI_PAX.patch b/3.13.7/4425_grsec_remove_EI_PAX.patch
index fc51f79..fc51f79 100644
--- a/3.13.6/4425_grsec_remove_EI_PAX.patch
+++ b/3.13.7/4425_grsec_remove_EI_PAX.patch
diff --git a/3.13.6/4427_force_XATTR_PAX_tmpfs.patch b/3.13.7/4427_force_XATTR_PAX_tmpfs.patch
index 23e60cd..23e60cd 100644
--- a/3.13.6/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.13.7/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.13.6/4430_grsec-remove-localversion-grsec.patch b/3.13.7/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.13.6/4430_grsec-remove-localversion-grsec.patch
+++ b/3.13.7/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.13.6/4435_grsec-mute-warnings.patch b/3.13.7/4435_grsec-mute-warnings.patch
index cb51a05..cb51a05 100644
--- a/3.13.6/4435_grsec-mute-warnings.patch
+++ b/3.13.7/4435_grsec-mute-warnings.patch
diff --git a/3.13.6/4440_grsec-remove-protected-paths.patch b/3.13.7/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.13.6/4440_grsec-remove-protected-paths.patch
+++ b/3.13.7/4440_grsec-remove-protected-paths.patch
diff --git a/3.13.6/4450_grsec-kconfig-default-gids.patch b/3.13.7/4450_grsec-kconfig-default-gids.patch
index abff221..abff221 100644
--- a/3.13.6/4450_grsec-kconfig-default-gids.patch
+++ b/3.13.7/4450_grsec-kconfig-default-gids.patch
diff --git a/3.13.6/4465_selinux-avc_audit-log-curr_ip.patch b/3.13.7/4465_selinux-avc_audit-log-curr_ip.patch
index 6caf9de..6caf9de 100644
--- a/3.13.6/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.13.7/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.13.6/4470_disable-compat_vdso.patch b/3.13.7/4470_disable-compat_vdso.patch
index a25c029..a25c029 100644
--- a/3.13.6/4470_disable-compat_vdso.patch
+++ b/3.13.7/4470_disable-compat_vdso.patch
diff --git a/3.13.6/4475_emutramp_default_on.patch b/3.13.7/4475_emutramp_default_on.patch
index a453a5b..a453a5b 100644
--- a/3.13.6/4475_emutramp_default_on.patch
+++ b/3.13.7/4475_emutramp_default_on.patch
diff --git a/3.2.55/0000_README b/3.2.55/0000_README
index a3b6dc5..89a0c5a 100644
--- a/3.2.55/0000_README
+++ b/3.2.55/0000_README
@@ -138,7 +138,7 @@ Patch:	1054_linux-3.2.55.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.55
 
-Patch:	4420_grsecurity-3.0-3.2.55-201403202347.patch
+Patch:	4420_grsecurity-3.0-3.2.55-201403281858.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.55/4420_grsecurity-3.0-3.2.55-201403202347.patch b/3.2.55/4420_grsecurity-3.0-3.2.55-201403281858.patch
index c1f6b08..aabac92 100644
--- a/3.2.55/4420_grsecurity-3.0-3.2.55-201403202347.patch
+++ b/3.2.55/4420_grsecurity-3.0-3.2.55-201403281858.patch
@@ -8035,7 +8035,7 @@ index 5e4252b..379f84f 100644
  		mm->unmap_area = arch_unmap_area_topdown;
  	}
 diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
-index 817187d..1d4541e 100644
+index 817187d..2cc50b0 100644
 --- a/arch/sparc/kernel/syscalls.S
 +++ b/arch/sparc/kernel/syscalls.S
 @@ -62,7 +62,7 @@ sys32_rt_sigreturn:
@@ -8047,7 +8047,7 @@ index 817187d..1d4541e 100644
  	be,pt	%icc, rtrap
  	 nop
  	call	syscall_trace_leave
-@@ -179,7 +179,7 @@ linux_sparc_syscall32:
+@@ -179,12 +179,13 @@ linux_sparc_syscall32:
  
  	srl	%i3, 0, %o3				! IEU0
  	srl	%i2, 0, %o2				! IEU0	Group
@@ -8056,7 +8056,14 @@ index 817187d..1d4541e 100644
  	bne,pn	%icc, linux_syscall_trace32		! CTI
  	 mov	%i0, %l5				! IEU1
  5:	call	%l7					! CTI	Group brk forced
-@@ -202,7 +202,7 @@ linux_sparc_syscall:
+ 	 srl	%i5, 0, %o5				! IEU1
+-	ba,a,pt	%xcc, 3f
++	ba,pt	%xcc, 3f
++	 sra	%o0, 0, %o0
+ 
+ 	/* Linux native system calls enter here... */
+ 	.align	32
+@@ -202,7 +203,7 @@ linux_sparc_syscall:
  
  	mov	%i3, %o3				! IEU1
  	mov	%i4, %o4				! IEU0	Group
@@ -8065,7 +8072,13 @@ index 817187d..1d4541e 100644
  	bne,pn	%icc, linux_syscall_trace		! CTI	Group
  	 mov	%i0, %l5				! IEU0
  2:	call	%l7					! CTI	Group brk forced
-@@ -218,7 +218,7 @@ ret_sys_call:
+@@ -212,13 +213,12 @@ linux_sparc_syscall:
+ 3:	stx	%o0, [%sp + PTREGS_OFF + PT_V9_I0]
+ ret_sys_call:
+ 	ldx	[%sp + PTREGS_OFF + PT_V9_TSTATE], %g3
+-	sra	%o0, 0, %o0
+ 	mov	%ulo(TSTATE_XCARRY | TSTATE_ICARRY), %g2
+ 	sllx	%g2, 32, %g2
  
  	cmp	%o0, -ERESTART_RESTARTBLOCK
  	bgeu,pn	%xcc, 1f
@@ -20624,7 +20637,7 @@ index ce0be7c..1252d68 100644
 +	.fill PAGE_SIZE_asm - GDT_SIZE,1,0
 +	.endr
 diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
-index e11e394..0a8c254 100644
+index e11e394..b4611a6 100644
 --- a/arch/x86/kernel/head_64.S
 +++ b/arch/x86/kernel/head_64.S
 @@ -19,6 +19,8 @@
@@ -20735,7 +20748,15 @@ index e11e394..0a8c254 100644
  	movq	initial_code(%rip),%rax
  	pushq	$0		# fake return address to stop unwinder
  	pushq	$__KERNEL_CS	# set correct cs
-@@ -269,7 +275,7 @@ ENTRY(secondary_startup_64)
+@@ -262,14 +268,14 @@ ENTRY(secondary_startup_64)
+ 	.quad	INIT_PER_CPU_VAR(irq_stack_union)
+ 
+ 	ENTRY(stack_start)
+-	.quad  init_thread_union+THREAD_SIZE-8
++	.quad  init_thread_union+THREAD_SIZE-16
+ 	.word  0
+ 	__FINITDATA
+ 
  bad_address:
  	jmp bad_address
  
@@ -22763,26 +22784,6 @@ index c8e41e9..64049ef 100644
  
  /*
   * PCI ids solely used for fixups_table go here
-diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
-index f2bb9c9..bed145d7 100644
---- a/arch/x86/kernel/relocate_kernel_64.S
-+++ b/arch/x86/kernel/relocate_kernel_64.S
-@@ -11,6 +11,7 @@
- #include <asm/kexec.h>
- #include <asm/processor-flags.h>
- #include <asm/pgtable_types.h>
-+#include <asm/alternative-asm.h>
- 
- /*
-  * Must be relocatable PIC code callable as a C function
-@@ -167,6 +168,7 @@ identity_mapped:
- 	xorq	%r14, %r14
- 	xorq	%r15, %r15
- 
-+	pax_force_retaddr 0, 1
- 	ret
- 
- 1:
 diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
 index b506f41..c954434 100644
 --- a/arch/x86/kernel/setup.c
@@ -23039,9 +23040,18 @@ index 16204dc..0e7d4b7 100644
  	.smp_prepare_cpus	= native_smp_prepare_cpus,
  	.smp_cpus_done		= native_smp_cpus_done,
 diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index 9f548cb..caf76f7 100644
+index 9f548cb..053b7e5 100644
 --- a/arch/x86/kernel/smpboot.c
 +++ b/arch/x86/kernel/smpboot.c
+@@ -692,7 +692,7 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu)
+ 	 */
+ 	if (c_idle.idle) {
+ 		c_idle.idle->thread.sp = (unsigned long) (((struct pt_regs *)
+-			(THREAD_SIZE +  task_stack_page(c_idle.idle))) - 1);
++			(THREAD_SIZE - 16 + task_stack_page(c_idle.idle))) - 1);
+ 		init_idle(c_idle.idle, cpu);
+ 		goto do_rest;
+ 	}
 @@ -709,17 +709,20 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu)
  	set_idle_for_cpu(cpu, c_idle.idle);
  do_rest:
@@ -53047,6 +53057,34 @@ index 8cdd8ea..64197b4 100644
  	kiocb->ki_nr_segs = kiocb->ki_nbytes;
  	kiocb->ki_cur_seg = 0;
  	/* ki_nbytes/left now reflect bytes instead of segs */
+diff --git a/fs/anon_inodes.c b/fs/anon_inodes.c
+index f11e43e..544bdd2 100644
+--- a/fs/anon_inodes.c
++++ b/fs/anon_inodes.c
+@@ -216,13 +216,10 @@ static int __init anon_inode_init(void)
+ {
+ 	int error;
+ 
+-	error = register_filesystem(&anon_inode_fs_type);
+-	if (error)
+-		goto err_exit;
+ 	anon_inode_mnt = kern_mount(&anon_inode_fs_type);
+ 	if (IS_ERR(anon_inode_mnt)) {
+ 		error = PTR_ERR(anon_inode_mnt);
+-		goto err_unregister_filesystem;
++		goto err_exit;
+ 	}
+ 	anon_inode_inode = anon_inode_mkinode();
+ 	if (IS_ERR(anon_inode_inode)) {
+@@ -234,8 +231,6 @@ static int __init anon_inode_init(void)
+ 
+ err_mntput:
+ 	kern_unmount(anon_inode_mnt);
+-err_unregister_filesystem:
+-	unregister_filesystem(&anon_inode_fs_type);
+ err_exit:
+ 	panic(KERN_ERR "anon_inode_init() failed (%d)\n", error);
+ }
 diff --git a/fs/attr.c b/fs/attr.c
 index b8f55c4..4c2b80c 100644
 --- a/fs/attr.c
@@ -63383,10 +63421,10 @@ index 8a89949..6776861 100644
  xfs_init_zones(void)
 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
 new file mode 100644
-index 0000000..9ad8151
+index 0000000..3dd4ae7
 --- /dev/null
 +++ b/grsecurity/Kconfig
-@@ -0,0 +1,1143 @@
+@@ -0,0 +1,1141 @@
 +#
 +# grecurity configuration
 +#
@@ -63400,18 +63438,16 @@ index 0000000..9ad8151
 +	help
 +	  If you say Y here, /dev/kmem and /dev/mem won't be allowed to
 +	  be written to or read from to modify or leak the contents of the running
-+	  kernel.  /dev/port will also not be allowed to be opened, and support
-+	  for /dev/cpu/*/msr and kexec will be removed.  If you have module
-+	  support disabled, enabling this will close up six ways that are
-+	  currently used to insert malicious code into the running kernel.
++	  kernel.  /dev/port will also not be allowed to be opened, writing to
++	  /dev/cpu/*/msr will be prevented, and support for kexec will be removed.
++	  If you have module support disabled, enabling this will close up several
++	  ways that are currently used to insert malicious code into the running
++	  kernel.
 +
 +	  Even with this feature enabled, we still highly recommend that
 +	  you use the RBAC system, as it is still possible for an attacker to
 +	  modify the running kernel through other more obscure methods.
 +
-+	  Enabling this feature will prevent the "cpupower" and "powertop" tools
-+	  from working.
-+
 +	  It is highly recommended that you say Y here if you meet all the
 +	  conditions above.
 +
@@ -82128,35 +82164,36 @@ index e6454b6..cda5eaf 100644
  static inline struct page *sk_stream_alloc_page(struct sock *sk)
  {
 diff --git a/include/net/tcp.h b/include/net/tcp.h
-index fe46019..b2e8119 100644
+index fe46019..ce07abd 100644
 --- a/include/net/tcp.h
 +++ b/include/net/tcp.h
-@@ -433,6 +433,24 @@ extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];
+@@ -433,6 +433,25 @@ extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];
  extern struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, 
  				    struct ip_options *opt);
  #ifdef CONFIG_SYN_COOKIES
 +#include <linux/ktime.h>
 +
-+/* Syncookies use a monotonic timer which increments every 64 seconds.
++/* Syncookies use a monotonic timer which increments every 60 seconds.
 + * This counter is used both as a hash input and partially encoded into
 + * the cookie value.  A cookie is only validated further if the delta
 + * between the current counter value and the encoded one is less than this,
-+ * i.e. a sent cookie is valid only at most for 128 seconds (or less if
++ * i.e. a sent cookie is valid only at most for 2*60 seconds (or less if
 + * the counter advances immediately after a cookie is generated).
 + */
 +#define MAX_SYNCOOKIE_AGE 2
 +
 +static inline u32 tcp_cookie_time(void)
 +{
-+	struct timespec now;
-+	getnstimeofday(&now);
-+	return now.tv_sec >> 6; /* 64 seconds granularity */
++	u64 val = get_jiffies_64();
++
++	do_div(val, 60 * HZ);
++	return val;
 +}
 +
  extern __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, 
  				     __u16 *mss);
  #else
-@@ -470,7 +488,7 @@ extern void tcp_retransmit_timer(struct sock *sk);
+@@ -470,7 +489,7 @@ extern void tcp_retransmit_timer(struct sock *sk);
  extern void tcp_xmit_retransmit_queue(struct sock *);
  extern void tcp_simple_retransmit(struct sock *);
  extern int tcp_trim_head(struct sock *, struct sk_buff *, u32);
@@ -82165,7 +82202,7 @@ index fe46019..b2e8119 100644
  
  extern void tcp_send_probe0(struct sock *);
  extern void tcp_send_partial(struct sock *);
-@@ -633,8 +651,8 @@ struct tcp_skb_cb {
+@@ -633,8 +652,8 @@ struct tcp_skb_cb {
  		struct inet6_skb_parm	h6;
  #endif
  	} header;	/* For incoming frames		*/
@@ -82176,7 +82213,7 @@ index fe46019..b2e8119 100644
  	__u32		when;		/* used to compute rtt's	*/
  	__u8		tcp_flags;	/* TCP header flags. (tcp[13])	*/
  	__u8		sacked;		/* State flags for SACK/FACK.	*/
-@@ -647,7 +665,7 @@ struct tcp_skb_cb {
+@@ -647,7 +666,7 @@ struct tcp_skb_cb {
  #define TCPCB_EVER_RETRANS	0x80	/* Ever retransmitted frame	*/
  #define TCPCB_RETRANS		(TCPCB_SACKED_RETRANS|TCPCB_EVER_RETRANS)
  
@@ -102183,7 +102220,7 @@ index e7ed43a..6afa140 100644
  
  	ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
 diff --git a/net/rxrpc/ar-input.c b/net/rxrpc/ar-input.c
-index 1a2b0633..e8d1382 100644
+index 1a2b0633..e8d1382e 100644
 --- a/net/rxrpc/ar-input.c
 +++ b/net/rxrpc/ar-input.c
 @@ -340,9 +340,9 @@ void rxrpc_fast_process_packet(struct rxrpc_call *call, struct sk_buff *skb)
@@ -103741,7 +103778,7 @@ index 1983717..4d6102c 100644
  
  	sub->evt.event = htohl(event, sub->swap);
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index eddfdec..e20439d 100644
+index eddfdec..9eb64a4 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
 @@ -768,6 +768,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -103790,7 +103827,52 @@ index eddfdec..e20439d 100644
  		mutex_unlock(&path.dentry->d_inode->i_mutex);
  		dput(path.dentry);
  		path.dentry = dentry;
-@@ -2269,9 +2289,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -1771,8 +1791,11 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 		goto out;
+ 
+ 	err = mutex_lock_interruptible(&u->readlock);
+-	if (err) {
+-		err = sock_intr_errno(sock_rcvtimeo(sk, noblock));
++	if (unlikely(err)) {
++		/* recvmsg() in non blocking mode is supposed to return -EAGAIN
++		 * sk_rcvtimeo is not honored by mutex_lock_interruptible()
++		 */
++		err = noblock ? -EAGAIN : -ERESTARTSYS;
+ 		goto out;
+ 	}
+ 
+@@ -1887,6 +1910,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 	struct unix_sock *u = unix_sk(sk);
+ 	struct sockaddr_un *sunaddr = msg->msg_name;
+ 	int copied = 0;
++	int noblock = flags & MSG_DONTWAIT;
+ 	int check_creds = 0;
+ 	int target;
+ 	int err = 0;
+@@ -1901,7 +1925,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 		goto out;
+ 
+ 	target = sock_rcvlowat(sk, flags&MSG_WAITALL, size);
+-	timeo = sock_rcvtimeo(sk, flags&MSG_DONTWAIT);
++	timeo = sock_rcvtimeo(sk, noblock);
+ 
+ 	/* Lock the socket to prevent queue disordering
+ 	 * while sleeps in memcpy_tomsg
+@@ -1913,8 +1937,11 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 	}
+ 
+ 	err = mutex_lock_interruptible(&u->readlock);
+-	if (err) {
+-		err = sock_intr_errno(timeo);
++	if (unlikely(err)) {
++		/* recvmsg() in non blocking mode is supposed to return -EAGAIN
++		 * sk_rcvtimeo is not honored by mutex_lock_interruptible()
++		 */
++		err = noblock ? -EAGAIN : -ERESTARTSYS;
+ 		goto out;
+ 	}
+ 
+@@ -2269,9 +2296,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  		seq_puts(seq, "Num       RefCount Protocol Flags    Type St "
  			 "Inode Path\n");
  	else {
@@ -103805,7 +103887,7 @@ index eddfdec..e20439d 100644
  
  		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
  			s,
-@@ -2298,8 +2322,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2298,8 +2329,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  			}
  			for ( ; i < len; i++)
  				seq_putc(seq, u->addr->name->sun_path[i]);
@@ -104363,26 +104445,25 @@ index cb1f50c..cef2a7c 100644
  		fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
 diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
 new file mode 100644
-index 0000000..5e0222d
+index 0000000..ed4c19a
 --- /dev/null
 +++ b/scripts/gcc-plugin.sh
-@@ -0,0 +1,17 @@
+@@ -0,0 +1,16 @@
 +#!/bin/bash
-+plugincc=`$1 -E -shared - -o /dev/null -I\`$3 -print-file-name=plugin\`/include 2>&1 <<EOF
-+#include "gcc-plugin.h"
-+#include "tree.h"
-+#include "tm.h"
-+#include "rtl.h"
-+#ifdef ENABLE_BUILD_WITH_CXX
++srctree=$(dirname "$0")
++gccplugins_dir=$("$1" -print-file-name=plugin)
++plugincc=$("$1" -E -shared - -o /dev/null -I${srctree}/../tools/gcc -I${gccplugins_dir}/include 2>&1 <<EOF
++#include "gcc-common.h"
++#if __GNUC__ > 4 || __GNUC_MINOR__ >= 8 || defined(ENABLE_BUILD_WITH_CXX)
 +#warning $2
 +#else
 +#warning $1
 +#endif
-+EOF`
++EOF
++)
 +if [ $? -eq 0 ]
 +then
-+	[[ "$plugincc" =~ "$1" ]] && echo "$1"
-+	[[ "$plugincc" =~ "$2" ]] && echo "$2"
++	( [[ "$plugincc" =~ "$1" ]] && echo "$1" ) || ( [[ "$plugincc" =~ "$2" ]] && echo "$2" )
 +fi
 diff --git a/scripts/headers_install.pl b/scripts/headers_install.pl
 index 48462be..3e08f94 100644
@@ -109931,10 +110012,10 @@ index 0000000..dd73713
 +}
 diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c
 new file mode 100644
-index 0000000..1a98bed
+index 0000000..c96f80f
 --- /dev/null
 +++ b/tools/gcc/latent_entropy_plugin.c
-@@ -0,0 +1,451 @@
+@@ -0,0 +1,457 @@
 +/*
 + * Copyright 2012-2014 by the PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -109963,7 +110044,7 @@ index 0000000..1a98bed
 +static tree latent_entropy_decl;
 +
 +static struct plugin_info latent_entropy_plugin_info = {
-+	.version	= "201402240545",
++	.version	= "201403042150",
 +	.help		= NULL
 +};
 +
@@ -110135,6 +110216,10 @@ index 0000000..1a98bed
 +
 +static bool gate_latent_entropy(void)
 +{
++	// don't bother with noreturn functions for now
++	if (TREE_THIS_VOLATILE(current_function_decl))
++		return false;
++
 +	return lookup_attribute("latent_entropy", DECL_ATTRIBUTES(current_function_decl)) != NULL_TREE;
 +}
 +
@@ -110259,7 +110344,8 @@ index 0000000..1a98bed
 +	gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
 +	update_stmt(assign);
 +//debug_bb(bb);
-+	bb = bb->next_bb;
++	gcc_assert(single_succ_p(bb));
++	bb = single_succ(bb);
 +
 +	// 3. instrument each BB with an operation on the local entropy variable
 +	while (bb != EXIT_BLOCK_PTR_FOR_FN(cfun)) {
@@ -110269,8 +110355,9 @@ index 0000000..1a98bed
 +	};
 +
 +	// 4. mix local entropy into the global entropy variable
-+	perturb_latent_entropy(EXIT_BLOCK_PTR_FOR_FN(cfun)->prev_bb, local_entropy);
-+//debug_bb(EXIT_BLOCK_PTR_FOR_FN(cfun)->prev_bb);
++	gcc_assert(single_pred_p(EXIT_BLOCK_PTR_FOR_FN(cfun)));
++	perturb_latent_entropy(single_pred(EXIT_BLOCK_PTR_FOR_FN(cfun)), local_entropy);
++//debug_bb(single_pred(EXIT_BLOCK_PTR_FOR_FN(cfun)));
 +	return 0;
 +}
 +
author	Anthony G. Basile <blueness@gentoo.org>	2014-03-29 13:55:05 -0400
committer	Anthony G. Basile <blueness@gentoo.org>	2014-03-29 13:55:05 -0400
commit	c19c10924711f4e252bf33481835766230f57d8e (patch)
tree	65b2db85d8a29b5fbbfb5c253604bd6b631ddbaf
parent	Grsec/PaX: 3.0-{3.2.55,3.13.6}-201403202349 (diff)
download	hardened-patchset-c19c10924711f4e252bf33481835766230f57d8e.tar.gz hardened-patchset-c19c10924711f4e252bf33481835766230f57d8e.tar.bz2 hardened-patchset-c19c10924711f4e252bf33481835766230f57d8e.zip