summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAnthony G. Basile <blueness@gentoo.org>2015-11-03 03:24:26 -0500
committerAnthony G. Basile <blueness@gentoo.org>2015-11-03 03:24:26 -0500
commit62e8f25d6636b09b18cb25cb1bb491cc026b5b08 (patch)
treeb5824f76664c66866752e223cdc0e1cc27b223d9
parentgrsecurity-3.1-4.2.5-201510290852 (diff)
downloadhardened-patchset-62e8f25d6636b09b18cb25cb1bb491cc026b5b08.tar.gz
hardened-patchset-62e8f25d6636b09b18cb25cb1bb491cc026b5b08.tar.bz2
hardened-patchset-62e8f25d6636b09b18cb25cb1bb491cc026b5b08.zip
grsecurity-3.1-4.2.5-20151102181420151102
-rw-r--r--4.2.5/0000_README2
-rw-r--r--4.2.5/4420_grsecurity-3.1-4.2.5-201511021814.patch (renamed from 4.2.5/4420_grsecurity-3.1-4.2.5-201510290852.patch)318
2 files changed, 232 insertions, 88 deletions
diff --git a/4.2.5/0000_README b/4.2.5/0000_README
index 0d8d90f..35d5d28 100644
--- a/4.2.5/0000_README
+++ b/4.2.5/0000_README
@@ -2,7 +2,7 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 4420_grsecurity-3.1-4.2.5-201510290852.patch
+Patch: 4420_grsecurity-3.1-4.2.5-201511021814.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/4.2.5/4420_grsecurity-3.1-4.2.5-201510290852.patch b/4.2.5/4420_grsecurity-3.1-4.2.5-201511021814.patch
index db09c8a..52245c5 100644
--- a/4.2.5/4420_grsecurity-3.1-4.2.5-201510290852.patch
+++ b/4.2.5/4420_grsecurity-3.1-4.2.5-201511021814.patch
@@ -25173,7 +25173,7 @@ index d25097c..e2df353 100644
return MXCSR_DEFAULT;
}
diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
-index d14e9ac..f1334f8 100644
+index d14e9ac..13442f0 100644
--- a/arch/x86/kernel/fpu/init.c
+++ b/arch/x86/kernel/fpu/init.c
@@ -42,7 +42,7 @@ static void fpu__init_cpu_generic(void)
@@ -25229,17 +25229,7 @@ index d14e9ac..f1334f8 100644
/*
* Set up the xstate_size based on the legacy FPU context size.
-@@ -300,6 +265,9 @@ static void __init fpu__init_system_ctx_switch(void)
- }
- }
-
-+ /* XXX: Temporarily forcing eager FPU mode */
-+ eagerfpu = ENABLE;
-+
- if (eagerfpu == ENABLE)
- setup_force_cpu_cap(X86_FEATURE_EAGER_FPU);
-
-@@ -331,7 +299,6 @@ void __init fpu__init_system(struct cpuinfo_x86 *c)
+@@ -331,7 +296,6 @@ void __init fpu__init_system(struct cpuinfo_x86 *c)
fpu__init_system_generic();
fpu__init_system_xstate_size_legacy();
fpu__init_system_xstate();
@@ -27814,7 +27804,7 @@ index adf0392..88a7576 100644
dma_generic_free_coherent(dev, size, vaddr, dma_addr, attrs);
}
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
-index c27cad7..47e3f47 100644
+index c27cad7..cc494be 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -15,6 +15,7 @@
@@ -27843,7 +27833,7 @@ index c27cad7..47e3f47 100644
};
EXPORT_PER_CPU_SYMBOL(cpu_tss);
-@@ -75,17 +78,35 @@ void idle_notifier_unregister(struct notifier_block *n)
+@@ -75,17 +78,37 @@ void idle_notifier_unregister(struct notifier_block *n)
EXPORT_SYMBOL_GPL(idle_notifier_unregister);
#endif
@@ -27866,8 +27856,10 @@ index c27cad7..47e3f47 100644
{
- memcpy(dst, src, arch_task_struct_size);
+ *dst = *src;
-
++
+ dst->thread.fpu.state = kmem_cache_alloc_node(fpregs_state_cachep, GFP_KERNEL, tsk_fork_get_node(src));
++ memcpy(dst->thread.fpu.state, src->thread.fpu.state, xstate_size);
+
return fpu__copy(&dst->thread.fpu, &src->thread.fpu);
}
@@ -27880,7 +27872,7 @@ index c27cad7..47e3f47 100644
/*
* Free current thread data structures etc..
*/
-@@ -97,7 +118,7 @@ void exit_thread(void)
+@@ -97,7 +120,7 @@ void exit_thread(void)
struct fpu *fpu = &t->fpu;
if (bp) {
@@ -27889,7 +27881,7 @@ index c27cad7..47e3f47 100644
t->io_bitmap_ptr = NULL;
clear_thread_flag(TIF_IO_BITMAP);
-@@ -117,6 +138,9 @@ void flush_thread(void)
+@@ -117,6 +140,9 @@ void flush_thread(void)
{
struct task_struct *tsk = current;
@@ -27899,7 +27891,7 @@ index c27cad7..47e3f47 100644
flush_ptrace_hw_breakpoint(tsk);
memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
-@@ -258,7 +282,7 @@ static void __exit_idle(void)
+@@ -258,7 +284,7 @@ static void __exit_idle(void)
void exit_idle(void)
{
/* idle loop has pid 0 */
@@ -27908,7 +27900,7 @@ index c27cad7..47e3f47 100644
return;
__exit_idle();
}
-@@ -311,7 +335,7 @@ bool xen_set_default_idle(void)
+@@ -311,7 +337,7 @@ bool xen_set_default_idle(void)
return ret;
}
#endif
@@ -27917,7 +27909,7 @@ index c27cad7..47e3f47 100644
{
local_irq_disable();
/*
-@@ -488,16 +512,40 @@ static int __init idle_setup(char *str)
+@@ -488,16 +514,40 @@ static int __init idle_setup(char *str)
}
early_param("idle", idle_setup);
@@ -49948,9 +49940,18 @@ index e8c96b8..516a96c 100644
Say Y here if you want to support for Freescale FlexCAN.
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
-index aede704..b516b4d 100644
+index aede704..ca734ed 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
+@@ -915,7 +915,7 @@ static int can_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ nla_put(skb, IFLA_CAN_BITTIMING_CONST,
+ sizeof(*priv->bittiming_const), priv->bittiming_const)) ||
+
+- nla_put(skb, IFLA_CAN_CLOCK, sizeof(cm), &priv->clock) ||
++ nla_put(skb, IFLA_CAN_CLOCK, sizeof(priv->clock), &priv->clock) ||
+ nla_put_u32(skb, IFLA_CAN_STATE, state) ||
+ nla_put(skb, IFLA_CAN_CTRLMODE, sizeof(cm), &cm) ||
+ nla_put_u32(skb, IFLA_CAN_RESTART_MS, priv->restart_ms) ||
@@ -961,7 +961,7 @@ static int can_newlink(struct net *src_net, struct net_device *dev,
return -EOPNOTSUPP;
}
@@ -51028,6 +51029,19 @@ index e5ba040..d47531c 100644
smp_mb();
/* need lock to prevent incorrect read while modifying cyclecounter */
+diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+index 0a32020..2177e56 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+@@ -2398,7 +2398,7 @@ int mlx4_multi_func_init(struct mlx4_dev *dev)
+ }
+ }
+
+- memset(&priv->mfunc.master.cmd_eqe, 0, dev->caps.eqe_size);
++ memset(&priv->mfunc.master.cmd_eqe, 0, sizeof(struct mlx4_eqe));
+ priv->mfunc.master.cmd_eqe.type = MLX4_EVENT_TYPE_CMD;
+ INIT_WORK(&priv->mfunc.master.comm_work,
+ mlx4_master_comm_channel);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index c10d98f..72914c6 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -51043,6 +51057,19 @@ index c10d98f..72914c6 100644
netdev_tx_completed_queue(ring->tx_queue, packets, bytes);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
+index 8e81e53..ad8f95d 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
++++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
+@@ -196,7 +196,7 @@ static void slave_event(struct mlx4_dev *dev, u8 slave, struct mlx4_eqe *eqe)
+ return;
+ }
+
+- memcpy(s_eqe, eqe, dev->caps.eqe_size - 1);
++ memcpy(s_eqe, eqe, sizeof(struct mlx4_eqe) - 1);
+ s_eqe->slave_id = slave;
+ /* ensure all information is written before setting the ownersip bit */
+ dma_wmb();
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 40206da..9d94643 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -53012,9 +53039,18 @@ index f66be86..6cbcabb 100644
/**
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
-index 312f23a..d21181c 100644
+index 312f23a..8c8b922 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
+@@ -216,7 +216,7 @@ static ssize_t numa_node_store(struct device *dev,
+ if (ret)
+ return ret;
+
+- if (!node_online(node))
++ if (node >= MAX_NUMNODES || !node_online(node))
+ return -EINVAL;
+
+ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
@@ -1140,7 +1140,7 @@ static int pci_create_attr(struct pci_dev *pdev, int num, int write_combine)
{
/* allocate attribute structure, piggyback attribute name */
@@ -74263,7 +74299,7 @@ index 0000000..43d7c4f
+:1095D00080000A8080000A00800009808000090065
+:00000001FF
diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
-index 2d0cbbd..a6d6149 100644
+index 2d0cbbd..a6d61492 100644
--- a/fs/Kconfig.binfmt
+++ b/fs/Kconfig.binfmt
@@ -103,7 +103,7 @@ config HAVE_AOUT
@@ -81535,8 +81571,35 @@ index e33dab2..cdbdad9 100644
}
}
putname(tmp);
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 84d693d..871fcb6 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -81,11 +81,11 @@ static int ovl_copy_up_data(struct path *old, struct path *new, loff_t len)
+ if (len == 0)
+ return 0;
+
+- old_file = ovl_path_open(old, O_RDONLY);
++ old_file = ovl_path_open(old, O_LARGEFILE | O_RDONLY);
+ if (IS_ERR(old_file))
+ return PTR_ERR(old_file);
+
+- new_file = ovl_path_open(new, O_WRONLY);
++ new_file = ovl_path_open(new, O_LARGEFILE | O_WRONLY);
+ if (IS_ERR(new_file)) {
+ error = PTR_ERR(new_file);
+ goto out_fput;
+@@ -267,7 +267,7 @@ out:
+
+ out_cleanup:
+ ovl_cleanup(wdir, newdentry);
+- goto out;
++ goto out2;
+ }
+
+ /*
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
-index d9da5a4..7ced3c7 100644
+index d9da5a4..f9b5b82 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -346,6 +346,9 @@ struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags)
@@ -81549,8 +81612,18 @@ index d9da5a4..7ced3c7 100644
type = ovl_path_real(dentry, &realpath);
if (ovl_open_need_copy_up(file_flags, type, realpath.dentry)) {
err = ovl_want_write(dentry);
+@@ -363,6 +366,9 @@ struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags)
+ ovl_path_upper(dentry, &realpath);
+ }
+
++ if (realpath.dentry->d_flags & DCACHE_OP_SELECT_INODE)
++ return realpath.dentry->d_op->d_select_inode(realpath.dentry, file_flags);
++
+ return d_backing_inode(realpath.dentry);
+ }
+
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
-index 79073d6..0eb5c27 100644
+index 79073d6..6fc10e4 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -172,7 +172,7 @@ void ovl_path_lower(struct dentry *dentry, struct path *path)
@@ -81562,7 +81635,15 @@ index 79073d6..0eb5c27 100644
}
int ovl_want_write(struct dentry *dentry)
-@@ -879,8 +879,8 @@ static unsigned int ovl_split_lowerdirs(char *str)
+@@ -544,6 +544,7 @@ static void ovl_put_super(struct super_block *sb)
+ mntput(ufs->upper_mnt);
+ for (i = 0; i < ufs->numlower; i++)
+ mntput(ufs->lower_mnt[i]);
++ kfree(ufs->lower_mnt);
+
+ kfree(ufs->config.lowerdir);
+ kfree(ufs->config.upperdir);
+@@ -879,8 +880,8 @@ static unsigned int ovl_split_lowerdirs(char *str)
static int ovl_fill_super(struct super_block *sb, void *data, int silent)
{
@@ -81573,6 +81654,14 @@ index 79073d6..0eb5c27 100644
struct dentry *root_dentry;
struct ovl_entry *oe;
struct ovl_fs *ufs;
+@@ -1048,6 +1049,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+ oe->lowerstack[i].dentry = stack[i].dentry;
+ oe->lowerstack[i].mnt = ufs->lower_mnt[i];
+ }
++ kfree(stack);
+
+ root_dentry->d_fsdata = oe;
+
diff --git a/fs/pipe.c b/fs/pipe.c
index 8865f79..bd2c79b 100644
--- a/fs/pipe.c
@@ -82879,12 +82968,34 @@ index 92e6726..a600d4fa 100644
.priority = 0,
};
diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
-index d3ebf2e..6ad42d1 100644
+index d3ebf2e..abe1823 100644
--- a/fs/proc/meminfo.c
+++ b/fs/proc/meminfo.c
-@@ -194,7 +194,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
- vmi.used >> 10,
- vmi.largest_chunk >> 10
+@@ -27,7 +27,6 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
+ {
+ struct sysinfo i;
+ unsigned long committed;
+- struct vmalloc_info vmi;
+ long cached;
+ long available;
+ unsigned long pagecache;
+@@ -49,8 +48,6 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
+ if (cached < 0)
+ cached = 0;
+
+- get_vmalloc_info(&vmi);
+-
+ for (lru = LRU_BASE; lru < NR_LRU_LISTS; lru++)
+ pages[lru] = global_page_state(NR_LRU_BASE + lru);
+
+@@ -191,10 +188,10 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
+ K(vm_commit_limit()),
+ K(committed),
+ (unsigned long)VMALLOC_TOTAL >> 10,
+- vmi.used >> 10,
+- vmi.largest_chunk >> 10
++ 0ul, // used to be vmalloc 'used'
++ 0ul // used to be vmalloc 'largest_chunk'
#ifdef CONFIG_MEMORY_FAILURE
- , atomic_long_read(&num_poisoned_pages) << (PAGE_SHIFT - 10)
+ , atomic_long_read_unchecked(&num_poisoned_pages) << (PAGE_SHIFT - 10)
@@ -97005,7 +97116,7 @@ index a76c917..63b52db 100644
asmlinkage long compat_sys_lookup_dcookie(u32, u32, char __user *, compat_size_t);
/*
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
-index dfaa7b3..d8bb2a0 100644
+index dfaa7b3..58cebfb 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -116,8 +116,8 @@
@@ -97058,17 +97169,6 @@ index dfaa7b3..d8bb2a0 100644
/*
* Mark a position in code as unreachable. This can be used to
* suppress control flow warnings after asm blocks that transfer
-@@ -237,6 +266,10 @@
- #define KASAN_ABI_VERSION 3
- #endif
-
-+#if GCC_VERSION >= 50000
-+//#define CC_HAVE_BUILTIN_OVERFLOW
-+#endif
-+
- #endif /* gcc version >= 40000 specific checks */
-
- #if !defined(__noclone)
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index e08a6ae..2e5e776 100644
--- a/include/linux/compiler.h
@@ -100708,30 +100808,6 @@ index b2a0f15..4d7da32 100644
/** create a directory */
struct dentry *oprofilefs_mkdir(struct dentry *parent, char const *name);
-diff --git a/include/linux/overflow-arith.h b/include/linux/overflow-arith.h
-new file mode 100644
-index 0000000..e12ccf8
---- /dev/null
-+++ b/include/linux/overflow-arith.h
-@@ -0,0 +1,18 @@
-+#pragma once
-+
-+#include <linux/kernel.h>
-+
-+#ifdef CC_HAVE_BUILTIN_OVERFLOW
-+
-+#define overflow_usub __builtin_usub_overflow
-+
-+#else
-+
-+static inline bool overflow_usub(unsigned int a, unsigned int b,
-+ unsigned int *res)
-+{
-+ *res = a - b;
-+ return *res > a ? true : false;
-+}
-+
-+#endif
diff --git a/include/linux/padata.h b/include/linux/padata.h
index 4386946..f50c615 100644
--- a/include/linux/padata.h
@@ -102802,7 +102878,7 @@ index b483abd..af305ad 100644
#endif
#endif /* _LINUX_VGA_SWITCHEROO_H_ */
diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
-index 0ec5983..d5888bb 100644
+index 0ec5983..66d8171 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -18,6 +18,14 @@ struct vm_area_struct; /* vma defining user mapping in mm_types.h */
@@ -102848,6 +102924,29 @@ index 0ec5983..d5888bb 100644
/*
* Internals. Dont't use..
+@@ -182,22 +195,10 @@ pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms)
+ # endif
+ #endif
+
+-struct vmalloc_info {
+- unsigned long used;
+- unsigned long largest_chunk;
+-};
+-
+ #ifdef CONFIG_MMU
+ #define VMALLOC_TOTAL (VMALLOC_END - VMALLOC_START)
+-extern void get_vmalloc_info(struct vmalloc_info *vmi);
+ #else
+-
+ #define VMALLOC_TOTAL 0UL
+-#define get_vmalloc_info(vmi) \
+-do { \
+- (vmi)->used = 0; \
+- (vmi)->largest_chunk = 0; \
+-} while (0)
+ #endif
+
+ #endif /* _LINUX_VMALLOC_H */
diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
index 82e7db7..f8ce3d0 100644
--- a/include/linux/vmstat.h
@@ -117219,7 +117318,7 @@ index 68ff8a5..40c7a70 100644
if (len > buflen)
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
-index 2faaa29..c816cf4 100644
+index 2faaa29..7ac7a6d 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -40,20 +40,65 @@ struct vfree_deferred {
@@ -117565,6 +117664,59 @@ index 2faaa29..c816cf4 100644
if (v->nr_pages)
seq_printf(m, " pages=%d", v->nr_pages);
+@@ -2688,52 +2844,5 @@ static int __init proc_vmalloc_init(void)
+ }
+ module_init(proc_vmalloc_init);
+
+-void get_vmalloc_info(struct vmalloc_info *vmi)
+-{
+- struct vmap_area *va;
+- unsigned long free_area_size;
+- unsigned long prev_end;
+-
+- vmi->used = 0;
+- vmi->largest_chunk = 0;
+-
+- prev_end = VMALLOC_START;
+-
+- rcu_read_lock();
+-
+- if (list_empty(&vmap_area_list)) {
+- vmi->largest_chunk = VMALLOC_TOTAL;
+- goto out;
+- }
+-
+- list_for_each_entry_rcu(va, &vmap_area_list, list) {
+- unsigned long addr = va->va_start;
+-
+- /*
+- * Some archs keep another range for modules in vmalloc space
+- */
+- if (addr < VMALLOC_START)
+- continue;
+- if (addr >= VMALLOC_END)
+- break;
+-
+- if (va->flags & (VM_LAZY_FREE | VM_LAZY_FREEING))
+- continue;
+-
+- vmi->used += (va->va_end - va->va_start);
+-
+- free_area_size = addr - prev_end;
+- if (vmi->largest_chunk < free_area_size)
+- vmi->largest_chunk = free_area_size;
+-
+- prev_end = va->va_end;
+- }
+-
+- if (VMALLOC_END - prev_end > vmi->largest_chunk)
+- vmi->largest_chunk = VMALLOC_END - prev_end;
+-
+-out:
+- rcu_read_unlock();
+-}
+ #endif
+
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 4f5cd97..9fb715a 100644
--- a/mm/vmstat.c
@@ -120773,29 +120925,18 @@ index 69f4f68..1f97524 100644
.maxtype = IFLA_GRE_MAX,
.policy = ip6gre_policy,
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index d5f7716..b4b3821 100644
+index d5f7716..7da025a 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
-@@ -28,6 +28,7 @@
-
- #include <linux/errno.h>
- #include <linux/kernel.h>
-+#include <linux/overflow-arith.h>
- #include <linux/string.h>
- #include <linux/socket.h>
- #include <linux/net.h>
-@@ -581,7 +582,10 @@ int ip6_fragment(struct sock *sk, struct sk_buff *skb,
+@@ -581,6 +581,8 @@ int ip6_fragment(struct sock *sk, struct sk_buff *skb,
if (np->frag_size)
mtu = np->frag_size;
}
-- mtu -= hlen + sizeof(struct frag_hdr);
-+
-+ if (overflow_usub(mtu, hlen + sizeof(struct frag_hdr), &mtu) ||
-+ mtu <= 7)
++ if (mtu < hlen + sizeof(struct frag_hdr) + 8)
+ goto fail_toobig;
+ mtu -= hlen + sizeof(struct frag_hdr);
frag_id = ipv6_select_ident(net, &ipv6_hdr(skb)->daddr,
- &ipv6_hdr(skb)->saddr);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 2e67b66..b816b34 100644
--- a/net/ipv6/ip6_tunnel.c
@@ -144927,10 +145068,10 @@ index 0000000..37e2e91
+#endif
diff --git a/tools/gcc/size_overflow_plugin/intentional_overflow.c b/tools/gcc/size_overflow_plugin/intentional_overflow.c
new file mode 100644
-index 0000000..f888be6
+index 0000000..62eb578
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/intentional_overflow.c
-@@ -0,0 +1,944 @@
+@@ -0,0 +1,947 @@
+/*
+ * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2, or (at your option) v3
@@ -145138,6 +145279,9 @@ index 0000000..f888be6
+ switch (TREE_CODE(node)) {
+ case COMPONENT_REF:
+ cur_decl = search_field_decl(node);
++ // !!! temporarily ignore bitfield types
++ if (DECL_BIT_FIELD_TYPE(cur_decl))
++ return MARK_YES;
+ if (is_turn_off_intentional_attr(cur_decl))
+ return MARK_TURN_OFF;
+ if (is_end_intentional_intentional_attr(cur_decl))
@@ -169141,7 +169285,7 @@ index 0000000..6075e8f
+
diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
new file mode 100644
-index 0000000..b6d179f
+index 0000000..a82cc026
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
@@ -0,0 +1,318 @@
@@ -169176,7 +169320,7 @@ index 0000000..b6d179f
+tree size_overflow_type_TI;
+
+static struct plugin_info size_overflow_plugin_info = {
-+ .version = "20151026",
++ .version = "20151029",
+ .help = "no-size-overflow\tturn off size overflow checking\n",
+};
+