grsecurity-3.1-4.2.6-20151205191820151205

2 files changed, 689 insertions, 63 deletions

diff --git a/4.2.6/0000_README b/4.2.6/0000_README
index ef0e3e5..ec4db38 100644
--- a/4.2.6/0000_README
+++ b/4.2.6/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.1-4.2.6-201511282239.patch
+Patch:	4420_grsecurity-3.1-4.2.6-201512051918.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/4.2.6/4420_grsecurity-3.1-4.2.6-201511282239.patch b/4.2.6/4420_grsecurity-3.1-4.2.6-201512051918.patch
index 3903e3d..9b88420 100644
--- a/4.2.6/4420_grsecurity-3.1-4.2.6-201511282239.patch
+++ b/4.2.6/4420_grsecurity-3.1-4.2.6-201512051918.patch
@@ -406,7 +406,7 @@ index 6fccb69..60c7c7a 100644
  
  A toggle value indicating if modules are allowed to be loaded
 diff --git a/Makefile b/Makefile
-index 9ef3739..20b7716 100644
+index 9ef3739..df5234b 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -298,7 +298,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -431,7 +431,7 @@ index 9ef3739..20b7716 100644
  	$(Q)$(MAKE) $(build)=scripts/basic
  	$(Q)rm -f .tmp_quiet_recordmcount
  
-@@ -615,6 +617,74 @@ endif
+@@ -615,6 +617,79 @@ endif
  # Tell gcc to never replace conditional load with a non-conditional one
  KBUILD_CFLAGS	+= $(call cc-option,--param=allow-store-data-races=0)
  
@@ -496,6 +496,11 @@ index 9ef3739..20b7716 100644
 +gcc-plugins:
 +ifeq ($(call cc-ifversion, -ge, 0405, y), y)
 +	$(error Your gcc installation does not support plugins.  If the necessary headers for plugin support are missing, they should be installed.  On Debian, apt-get install gcc-<ver>-plugin-dev.  If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.))
++ifeq ($(call cc-ifversion, -ge, 0408, y), y)
++	$(CONFIG_SHELL) -x $(srctree)/scripts/gcc-plugin.sh "$(HOSTCXX)" "$(HOSTCXX)" "$(CC)"
++else
++	$(CONFIG_SHELL) -x $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(HOSTCXX)" "$(CC)"
++endif
 +else
 +	$(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
 +endif
@@ -506,7 +511,7 @@ index 9ef3739..20b7716 100644
  ifdef CONFIG_READABLE_ASM
  # Disable optimizations that make assembler listings hard to read.
  # reorder blocks reorders the control in the function
-@@ -714,7 +784,7 @@ KBUILD_CFLAGS   += $(call cc-option, -gsplit-dwarf, -g)
+@@ -714,7 +789,7 @@ KBUILD_CFLAGS   += $(call cc-option, -gsplit-dwarf, -g)
  else
  KBUILD_CFLAGS	+= -g
  endif
@@ -515,7 +520,7 @@ index 9ef3739..20b7716 100644
  endif
  ifdef CONFIG_DEBUG_INFO_DWARF4
  KBUILD_CFLAGS	+= $(call cc-option, -gdwarf-4,)
-@@ -886,7 +956,7 @@ export mod_sign_cmd
+@@ -886,7 +961,7 @@ export mod_sign_cmd
  
  
  ifeq ($(KBUILD_EXTMOD),)
@@ -524,7 +529,7 @@ index 9ef3739..20b7716 100644
  
  vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
  		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-@@ -936,6 +1006,8 @@ endif
+@@ -936,6 +1011,8 @@ endif
  
  # The actual objects are generated when descending,
  # make sure no implicit rule kicks in
@@ -533,7 +538,7 @@ index 9ef3739..20b7716 100644
  $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
  
  # Handle descending into subdirectories listed in $(vmlinux-dirs)
-@@ -945,7 +1017,7 @@ $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
+@@ -945,7 +1022,7 @@ $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
  # Error messages still appears in the original language
  
  PHONY += $(vmlinux-dirs)
@@ -542,7 +547,7 @@ index 9ef3739..20b7716 100644
  	$(Q)$(MAKE) $(build)=$@
  
  define filechk_kernel.release
-@@ -988,10 +1060,13 @@ prepare1: prepare2 $(version_h) include/generated/utsrelease.h \
+@@ -988,10 +1065,13 @@ prepare1: prepare2 $(version_h) include/generated/utsrelease.h \
  
  archprepare: archheaders archscripts prepare1 scripts_basic
  
@@ -556,7 +561,7 @@ index 9ef3739..20b7716 100644
  prepare: prepare0
  
  # Generate some files
-@@ -1099,6 +1174,8 @@ all: modules
+@@ -1099,6 +1179,8 @@ all: modules
  # using awk while concatenating to the final file.
  
  PHONY += modules
@@ -565,7 +570,7 @@ index 9ef3739..20b7716 100644
  modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
  	$(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
  	@$(kecho) '  Building modules, stage 2.';
-@@ -1114,7 +1191,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
+@@ -1114,7 +1196,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
  
  # Target to prepare building external modules
  PHONY += modules_prepare
@@ -574,7 +579,7 @@ index 9ef3739..20b7716 100644
  
  # Target to install modules
  PHONY += modules_install
-@@ -1180,7 +1257,10 @@ MRPROPER_FILES += .config .config.old .version .old_version \
+@@ -1180,7 +1262,10 @@ MRPROPER_FILES += .config .config.old .version .old_version \
  		  Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS \
  		  signing_key.priv signing_key.x509 x509.genkey		\
  		  extra_certificates signing_key.x509.keyid		\
@@ -586,7 +591,7 @@ index 9ef3739..20b7716 100644
  
  # clean - Delete most, but leave enough to build external modules
  #
-@@ -1219,7 +1299,7 @@ distclean: mrproper
+@@ -1219,7 +1304,7 @@ distclean: mrproper
  	@find $(srctree) $(RCS_FIND_IGNORE) \
  		\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
  		-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
@@ -595,7 +600,7 @@ index 9ef3739..20b7716 100644
  		-type f -print | xargs rm -f
  
  
-@@ -1385,6 +1465,8 @@ PHONY += $(module-dirs) modules
+@@ -1385,6 +1470,8 @@ PHONY += $(module-dirs) modules
  $(module-dirs): crmodverdir $(objtree)/Module.symvers
  	$(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
  
@@ -604,7 +609,7 @@ index 9ef3739..20b7716 100644
  modules: $(module-dirs)
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1525,17 +1607,21 @@ else
+@@ -1525,17 +1612,21 @@ else
          target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
  endif
  
@@ -630,7 +635,7 @@ index 9ef3739..20b7716 100644
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
  %.symtypes: %.c prepare scripts FORCE
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1547,11 +1633,15 @@ endif
+@@ -1547,11 +1638,15 @@ endif
  	$(build)=$(build-dir)
  # Make sure the latest headers are built for Documentation
  Documentation/: headers_install
@@ -22034,7 +22039,7 @@ index cd79194..6a9956f 100644
  }
  
 diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
-index a8df874..43b72d3 100644
+index a8df874..3dcbd7c 100644
 --- a/arch/x86/include/asm/uaccess.h
 +++ b/arch/x86/include/asm/uaccess.h
 @@ -7,6 +7,7 @@
@@ -22215,9 +22220,12 @@ index a8df874..43b72d3 100644
  		     "2:\n"						\
  		     _ASM_EXTABLE_EX(1b, 2b)				\
  		     : ltype(x) : "m" (__m(addr)))
-@@ -409,13 +461,24 @@ do {									\
+@@ -407,15 +459,26 @@ do {									\
+ #define __get_user_nocheck(x, ptr, size)				\
+ ({									\
  	int __gu_err;							\
- 	unsigned long __gu_val;						\
+-	unsigned long __gu_val;						\
++	__inttype(*(ptr)) __gu_val;					\
  	__get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT);	\
 -	(x) = (__force __typeof__(*(ptr)))__gu_val;			\
 +	(x) = (__typeof__(*(ptr)))__gu_val;				\
@@ -41354,6 +41362,47 @@ index 8d2a772..33826c9 100644
  
  	err = pci_request_regions(pdev, name);
  	if (err)
+diff --git a/drivers/crypto/nx/nx-aes-ccm.c b/drivers/crypto/nx/nx-aes-ccm.c
+index e4311ce..a1d0848 100644
+--- a/drivers/crypto/nx/nx-aes-ccm.c
++++ b/drivers/crypto/nx/nx-aes-ccm.c
+@@ -412,7 +412,7 @@ static int ccm_nx_decrypt(struct aead_request   *req,
+ 		processed += to_process;
+ 	} while (processed < nbytes);
+ 
+-	rc = memcmp(csbcpb->cpb.aes_ccm.out_pat_or_mac, priv->oauth_tag,
++	rc = crypto_memneq(csbcpb->cpb.aes_ccm.out_pat_or_mac, priv->oauth_tag,
+ 		    authsize) ? -EBADMSG : 0;
+ out:
+ 	spin_unlock_irqrestore(&nx_ctx->lock, irq_flags);
+diff --git a/drivers/crypto/nx/nx-aes-gcm.c b/drivers/crypto/nx/nx-aes-gcm.c
+index 92c993f..1c478bc 100644
+--- a/drivers/crypto/nx/nx-aes-gcm.c
++++ b/drivers/crypto/nx/nx-aes-gcm.c
+@@ -414,7 +414,7 @@ mac:
+ 			itag, req->src, req->assoclen + nbytes,
+ 			crypto_aead_authsize(crypto_aead_reqtfm(req)),
+ 			SCATTERWALK_FROM_SG);
+-		rc = memcmp(itag, otag,
++		rc = crypto_memneq(itag, otag,
+ 			    crypto_aead_authsize(crypto_aead_reqtfm(req))) ?
+ 		     -EBADMSG : 0;
+ 	}
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 83aca95..4e6d4ea 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -1025,8 +1025,8 @@ static void ipsec_esp_decrypt_swauth_done(struct device *dev,
+ 			icvdata = &edesc->link_tbl[0];
+ 
+ 		sg = sg_last(req->dst, edesc->dst_nents ? : 1);
+-		err = memcmp(icvdata, (char *)sg_virt(sg) + sg->length -
+-			     ctx->authsize, ctx->authsize) ? -EBADMSG : 0;
++		err = crypto_memneq(icvdata, (char *)sg_virt(sg) + sg->length -
++				    ctx->authsize, ctx->authsize) ? -EBADMSG : 0;
+ 	}
+ 
+ 	kfree(edesc);
 diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
 index ca1b362..01cae6a 100644
 --- a/drivers/devfreq/devfreq.c
@@ -47789,7 +47838,7 @@ index 3e32f4e..01e0a7f 100644
  
  void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
 diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 95e7b72..11002b9 100644
+index 95e7b72..3d67ca6 100644
 --- a/drivers/md/md.c
 +++ b/drivers/md/md.c
 @@ -197,10 +197,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev);
@@ -47861,7 +47910,20 @@ index 95e7b72..11002b9 100644
  
  	INIT_LIST_HEAD(&rdev->same_set);
  	init_waitqueue_head(&rdev->blocked_wait);
-@@ -7256,7 +7256,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
+@@ -5723,9 +5723,10 @@ static int get_array_info(struct mddev *mddev, void __user *arg)
+ 	info.patch_version = MD_PATCHLEVEL_VERSION;
+ 	info.ctime         = mddev->ctime;
+ 	info.level         = mddev->level;
+-	info.size          = mddev->dev_sectors / 2;
+-	if (info.size != mddev->dev_sectors / 2) /* overflow */
++	if (2 * (sector_t)INT_MAX < mddev->dev_sectors) /* overflow */
+ 		info.size = -1;
++	else
++		info.size = mddev->dev_sectors / 2;
+ 	info.nr_disks      = nr;
+ 	info.raid_disks    = mddev->raid_disks;
+ 	info.md_minor      = mddev->md_minor;
+@@ -7256,7 +7257,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
  
  		spin_unlock(&pers_lock);
  		seq_printf(seq, "\n");
@@ -47870,7 +47932,7 @@ index 95e7b72..11002b9 100644
  		return 0;
  	}
  	if (v == (void*)2) {
-@@ -7359,7 +7359,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
+@@ -7359,7 +7360,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
  		return error;
  
  	seq = file->private_data;
@@ -47879,7 +47941,7 @@ index 95e7b72..11002b9 100644
  	return error;
  }
  
-@@ -7376,7 +7376,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
+@@ -7376,7 +7377,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
  	/* always allow read */
  	mask = POLLIN | POLLRDNORM;
  
@@ -47888,7 +47950,7 @@ index 95e7b72..11002b9 100644
  		mask |= POLLERR | POLLPRI;
  	return mask;
  }
-@@ -7472,7 +7472,7 @@ static int is_mddev_idle(struct mddev *mddev, int init)
+@@ -7472,7 +7473,7 @@ static int is_mddev_idle(struct mddev *mddev, int init)
  		struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
  		curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
  			      (int)part_stat_read(&disk->part0, sectors[1]) -
@@ -47961,9 +48023,18 @@ index 3e6d115..ffecdeb 100644
  /*----------------------------------------------------------------*/
  
 diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index d10d300..6169233 100644
+index d10d300..dbdcf89 100644
 --- a/drivers/md/raid1.c
 +++ b/drivers/md/raid1.c
+@@ -1095,7 +1095,7 @@ static void make_request(struct mddev *mddev, struct bio * bio)
+ 	struct blk_plug_cb *cb;
+ 	struct raid1_plug_cb *plug = NULL;
+ 	int first_clone;
+-	int sectors_handled;
++	sector_t sectors_handled;
+ 	int max_sectors;
+ 	sector_t start_next_window;
+ 
 @@ -1937,7 +1937,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
  			if (r1_sync_page_io(rdev, sect, s,
  					    bio->bi_io_vec[idx].bv_page,
@@ -51790,6 +51861,45 @@ index 487be20..f4c87bc 100644
  			break;
  		err = 0;
  		break;
+diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
+index 2ed7506..cf82b13 100644
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -568,6 +568,9 @@ static int pppoe_create(struct net *net, struct socket *sock, int kern)
+ 	sk->sk_family		= PF_PPPOX;
+ 	sk->sk_protocol		= PX_PROTO_OE;
+ 
++	INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work,
++		  pppoe_unbind_sock_work);
++
+ 	return 0;
+ }
+ 
+@@ -632,8 +635,6 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
+ 
+ 	lock_sock(sk);
+ 
+-	INIT_WORK(&po->proto.pppoe.padt_work, pppoe_unbind_sock_work);
+-
+ 	error = -EINVAL;
+ 	if (sp->sa_protocol != PX_PROTO_OE)
+ 		goto end;
+@@ -663,8 +664,13 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
+ 			po->pppoe_dev = NULL;
+ 		}
+ 
+-		memset(sk_pppox(po) + 1, 0,
+-		       sizeof(struct pppox_sock) - sizeof(struct sock));
++		po->pppoe_ifindex = 0;
++		memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa));
++		memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay));
++		memset(&po->chan, 0, sizeof(po->chan));
++		po->next = NULL;
++		po->num = 0;
++
+ 		sk->sk_state = PPPOX_NONE;
+ 	}
+ 
 diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
 index 079f7ad..7e59810 100644
 --- a/drivers/net/slip/slhc.c
@@ -52144,6 +52254,28 @@ index 5920c99..ff2e4a5 100644
  };
  
  static void
+diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
+index 5c47b01..cd39025 100644
+--- a/drivers/net/wan/x25_asy.c
++++ b/drivers/net/wan/x25_asy.c
+@@ -549,16 +549,12 @@ static void x25_asy_receive_buf(struct tty_struct *tty,
+ 
+ static int x25_asy_open_tty(struct tty_struct *tty)
+ {
+-	struct x25_asy *sl = tty->disc_data;
++	struct x25_asy *sl;
+ 	int err;
+ 
+ 	if (tty->ops->write == NULL)
+ 		return -EOPNOTSUPP;
+ 
+-	/* First make sure we're not already connected. */
+-	if (sl && sl->magic == X25_ASY_MAGIC)
+-		return -EEXIST;
+-
+ 	/* OK.  Find a free X.25 channel to use. */
+ 	sl = x25_asy_alloc();
+ 	if (sl == NULL)
 diff --git a/drivers/net/wan/z85230.c b/drivers/net/wan/z85230.c
 index 2f0bd69..e46ed7b 100644
 --- a/drivers/net/wan/z85230.c
@@ -56230,8 +56362,68 @@ index 8f1cd19..ba7a8f1 100644
  	INIT_LIST_HEAD(&dev->t10_wwn.t10_vpd_list);
  	spin_lock_init(&dev->t10_wwn.t10_vpd_lock);
  	INIT_LIST_HEAD(&dev->t10_pr.registration_list);
+diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
+index e318ddb..9444c7b 100644
+--- a/drivers/target/target_core_sbc.c
++++ b/drivers/target/target_core_sbc.c
+@@ -339,7 +339,8 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
+ 	return 0;
+ }
+ 
+-static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success)
++static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success,
++					   int *post_ret)
+ {
+ 	unsigned char *buf, *addr;
+ 	struct scatterlist *sg;
+@@ -405,7 +406,8 @@ sbc_execute_rw(struct se_cmd *cmd)
+ 			       cmd->data_direction);
+ }
+ 
+-static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
++static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
++					     int *post_ret)
+ {
+ 	struct se_device *dev = cmd->se_dev;
+ 
+@@ -415,8 +417,10 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
+ 	 * sent to the backend driver.
+ 	 */
+ 	spin_lock_irq(&cmd->t_state_lock);
+-	if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status)
++	if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) {
+ 		cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
++		*post_ret = 1;
++	}
+ 	spin_unlock_irq(&cmd->t_state_lock);
+ 
+ 	/*
+@@ -428,7 +432,8 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
+ 	return TCM_NO_SENSE;
+ }
+ 
+-static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success)
++static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success,
++						 int *post_ret)
+ {
+ 	struct se_device *dev = cmd->se_dev;
+ 	struct scatterlist *write_sg = NULL, *sg;
+@@ -524,11 +529,11 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool succes
+ 
+ 		if (block_size < PAGE_SIZE) {
+ 			sg_set_page(&write_sg[i], m.page, block_size,
+-				    block_size);
++				    m.piter.sg->offset + block_size);
+ 		} else {
+ 			sg_miter_next(&m);
+ 			sg_set_page(&write_sg[i], m.page, block_size,
+-				    0);
++				    m.piter.sg->offset);
+ 		}
+ 		len -= block_size;
+ 		i++;
 diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index ce8574b..98d6199 100644
+index ce8574b..0634ccb 100644
 --- a/drivers/target/target_core_transport.c
 +++ b/drivers/target/target_core_transport.c
 @@ -1181,7 +1181,7 @@ transport_check_alloc_task_attr(struct se_cmd *cmd)
@@ -56243,6 +56435,42 @@ index ce8574b..98d6199 100644
  	pr_debug("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
  			cmd->se_ordered_id, cmd->sam_task_attr,
  			dev->transport->name);
+@@ -1610,7 +1610,7 @@ bool target_stop_cmd(struct se_cmd *cmd, unsigned long *flags)
+ void transport_generic_request_failure(struct se_cmd *cmd,
+ 		sense_reason_t sense_reason)
+ {
+-	int ret = 0;
++	int ret = 0, post_ret = 0;
+ 
+ 	pr_debug("-----[ Storage Engine Exception for cmd: %p ITT: 0x%08llx"
+ 		" CDB: 0x%02x\n", cmd, cmd->tag, cmd->t_task_cdb[0]);
+@@ -1632,7 +1632,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
+ 	 */
+ 	if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
+ 	     cmd->transport_complete_callback)
+-		cmd->transport_complete_callback(cmd, false);
++		cmd->transport_complete_callback(cmd, false, &post_ret);
+ 
+ 	switch (sense_reason) {
+ 	case TCM_NON_EXISTENT_LUN:
+@@ -2027,11 +2027,13 @@ static void target_complete_ok_work(struct work_struct *work)
+ 	 */
+ 	if (cmd->transport_complete_callback) {
+ 		sense_reason_t rc;
++		bool caw = (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE);
++		bool zero_dl = !(cmd->data_length);
++		int post_ret = 0;
+ 
+-		rc = cmd->transport_complete_callback(cmd, true);
+-		if (!rc && !(cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE_POST)) {
+-			if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
+-			    !cmd->data_length)
++		rc = cmd->transport_complete_callback(cmd, true, &post_ret);
++		if (!rc && !post_ret) {
++			if (caw && zero_dl)
+ 				goto queue_rsp;
+ 
+ 			return;
 diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
 index 42c6f71..1c64309 100644
 --- a/drivers/thermal/cpu_cooling.c
@@ -83985,7 +84213,7 @@ index 510413eb..34d9a8c 100644
  	seq_printf(p, "softirq %llu", (unsigned long long)sum_softirq);
  
 diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index ca1e091..a048795 100644
+index ca1e091..12dd9f1 100644
 --- a/fs/proc/task_mmu.c
 +++ b/fs/proc/task_mmu.c
 @@ -13,12 +13,19 @@
@@ -84110,7 +84338,17 @@ index ca1e091..a048795 100644
  	show_map_vma(m, v, is_pid);
  	m_cache_vma(m, v);
  	return 0;
-@@ -620,9 +655,18 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
+@@ -585,6 +620,9 @@ static void show_smap_vma_flags(struct seq_file *m, struct vm_area_struct *vma)
+ 		[ilog2(VM_RAND_READ)]	= "rr",
+ 		[ilog2(VM_DONTCOPY)]	= "dc",
+ 		[ilog2(VM_DONTEXPAND)]	= "de",
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
++		[ilog2(VM_PAGEEXEC)]	= "px",
++#endif
+ 		[ilog2(VM_ACCOUNT)]	= "ac",
+ 		[ilog2(VM_NORESERVE)]	= "nr",
+ 		[ilog2(VM_HUGETLB)]	= "ht",
+@@ -620,9 +658,18 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
  		.private = &mss,
  	};
  
@@ -84131,7 +84369,7 @@ index ca1e091..a048795 100644
  
  	show_map_vma(m, vma, is_pid);
  
-@@ -641,7 +685,11 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
+@@ -641,7 +688,11 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
  		   "KernelPageSize: %8lu kB\n"
  		   "MMUPageSize:    %8lu kB\n"
  		   "Locked:         %8lu kB\n",
@@ -84143,7 +84381,7 @@ index ca1e091..a048795 100644
  		   mss.resident >> 10,
  		   (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
  		   mss.shared_clean  >> 10,
-@@ -1491,6 +1539,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
+@@ -1491,6 +1542,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
  	char buffer[64];
  	int nid;
  
@@ -84157,7 +84395,7 @@ index ca1e091..a048795 100644
  	if (!mm)
  		return 0;
  
-@@ -1505,11 +1560,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
+@@ -1505,11 +1563,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
  		mpol_to_str(buffer, sizeof(buffer), proc_priv->task_mempolicy);
  	}
  
@@ -104300,6 +104538,20 @@ index 343d922..7959cde 100644
  
  int __rtnl_link_register(struct rtnl_link_ops *ops);
  void __rtnl_link_unregister(struct rtnl_link_ops *ops);
+diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
+index 2738f6f..49dda38 100644
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -61,6 +61,9 @@ struct Qdisc {
+ 				      */
+ #define TCQ_F_WARN_NONWC	(1 << 16)
+ #define TCQ_F_CPUSTATS		0x20 /* run using percpu statistics */
++#define TCQ_F_NOPARENT		0x40 /* root of its hierarchy :
++				      * qdisc_tree_decrease_qlen() should stop.
++				      */
+ 	u32			limit;
+ 	const struct Qdisc_ops	*ops;
+ 	struct qdisc_size_table	__rcu *stab;
 diff --git a/include/net/sctp/checksum.h b/include/net/sctp/checksum.h
 index 4a5b9a3..ca27d73 100644
 --- a/include/net/sctp/checksum.h
@@ -104643,9 +104895,18 @@ index 334d0d2..a4327ba 100644
  struct snd_soc_dai_link_component {
  	const char *name;
 diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
-index 17ae2d6..2c06382 100644
+index 17ae2d6..24974e9 100644
 --- a/include/target/target_core_base.h
 +++ b/include/target/target_core_base.h
+@@ -480,7 +480,7 @@ struct se_cmd {
+ 	struct kref		cmd_kref;
+ 	const struct target_core_fabric_ops *se_tfo;
+ 	sense_reason_t		(*execute_cmd)(struct se_cmd *);
+-	sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool);
++	sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool, int *);
+ 	void			*protocol_data;
+ 
+ 	unsigned char		*t_task_cdb;
 @@ -751,7 +751,7 @@ struct se_device {
  	atomic_long_t		write_bytes;
  	/* Active commands on this virtual SE device */
@@ -121145,7 +121406,7 @@ index 0330ab2..4745d2c 100644
  		goto err_reg;
  
 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index 728f5b3..dc51cbe 100644
+index 728f5b3..ab3c61c 100644
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
 @@ -767,7 +767,7 @@ static void tcp_update_pacing_rate(struct sock *sk)
@@ -121174,7 +121435,15 @@ index 728f5b3..dc51cbe 100644
  	if (th->syn) {
  		/* We see SYN without ACK. It is attempt of
  		 * simultaneous connect with crossed SYNs.
-@@ -5653,6 +5654,7 @@ discard:
+@@ -5620,6 +5621,7 @@ discard:
+ 		}
+ 
+ 		tp->rcv_nxt = TCP_SKB_CB(skb)->seq + 1;
++		tp->copied_seq = tp->rcv_nxt;
+ 		tp->rcv_wup = TCP_SKB_CB(skb)->seq + 1;
+ 
+ 		/* RFC1323: The window in SYN & SYN/ACK segments is
+@@ -5653,6 +5655,7 @@ discard:
  		goto discard;
  #endif
  	}
@@ -121182,7 +121451,7 @@ index 728f5b3..dc51cbe 100644
  	/* "fifth, if neither of the SYN or RST bits is set then
  	 * drop the segment and return."
  	 */
-@@ -5699,7 +5701,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -5699,7 +5702,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  			goto discard;
  
  		if (th->syn) {
@@ -121191,7 +121460,7 @@ index 728f5b3..dc51cbe 100644
  				goto discard;
  			if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
  				return 1;
-@@ -6026,7 +6028,7 @@ struct request_sock *inet_reqsk_alloc(const struct request_sock_ops *ops,
+@@ -6026,7 +6029,7 @@ struct request_sock *inet_reqsk_alloc(const struct request_sock_ops *ops,
  
  		kmemcheck_annotate_bitfield(ireq, flags);
  		ireq->opt = NULL;
@@ -124037,8 +124306,92 @@ index f226709..0e735a8 100644
  	_proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
  
  	ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index f06aa01..1a0aa2a 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -253,7 +253,8 @@ int qdisc_set_default(const char *name)
+ }
+ 
+ /* We know handle. Find qdisc among all qdisc's attached to device
+-   (root qdisc, all its children, children of children etc.)
++ * (root qdisc, all its children, children of children etc.)
++ * Note: caller either uses rtnl or rcu_read_lock()
+  */
+ 
+ static struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
+@@ -264,7 +265,7 @@ static struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
+ 	    root->handle == handle)
+ 		return root;
+ 
+-	list_for_each_entry(q, &root->list, list) {
++	list_for_each_entry_rcu(q, &root->list, list) {
+ 		if (q->handle == handle)
+ 			return q;
+ 	}
+@@ -277,15 +278,18 @@ void qdisc_list_add(struct Qdisc *q)
+ 		struct Qdisc *root = qdisc_dev(q)->qdisc;
+ 
+ 		WARN_ON_ONCE(root == &noop_qdisc);
+-		list_add_tail(&q->list, &root->list);
++		ASSERT_RTNL();
++		list_add_tail_rcu(&q->list, &root->list);
+ 	}
+ }
+ EXPORT_SYMBOL(qdisc_list_add);
+ 
+ void qdisc_list_del(struct Qdisc *q)
+ {
+-	if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS))
+-		list_del(&q->list);
++	if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
++		ASSERT_RTNL();
++		list_del_rcu(&q->list);
++	}
+ }
+ EXPORT_SYMBOL(qdisc_list_del);
+ 
+@@ -750,14 +754,18 @@ void qdisc_tree_decrease_qlen(struct Qdisc *sch, unsigned int n)
+ 	if (n == 0)
+ 		return;
+ 	drops = max_t(int, n, 0);
++	rcu_read_lock();
+ 	while ((parentid = sch->parent)) {
+ 		if (TC_H_MAJ(parentid) == TC_H_MAJ(TC_H_INGRESS))
+-			return;
++			break;
+ 
++		if (sch->flags & TCQ_F_NOPARENT)
++			break;
++		/* TODO: perform the search on a per txq basis */
+ 		sch = qdisc_lookup(qdisc_dev(sch), TC_H_MAJ(parentid));
+ 		if (sch == NULL) {
+-			WARN_ON(parentid != TC_H_ROOT);
+-			return;
++			WARN_ON_ONCE(parentid != TC_H_ROOT);
++			break;
+ 		}
+ 		cops = sch->ops->cl_ops;
+ 		if (cops->qlen_notify) {
+@@ -768,6 +776,7 @@ void qdisc_tree_decrease_qlen(struct Qdisc *sch, unsigned int n)
+ 		sch->q.qlen -= n;
+ 		__qdisc_qstats_drop(sch, drops);
+ 	}
++	rcu_read_unlock();
+ }
+ EXPORT_SYMBOL(qdisc_tree_decrease_qlen);
+ 
+@@ -941,7 +950,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
+ 		}
+ 		lockdep_set_class(qdisc_lock(sch), &qdisc_tx_lock);
+ 		if (!netif_is_multiqueue(dev))
+-			sch->flags |= TCQ_F_ONETXQUEUE;
++			sch->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT;
+ 	}
+ 
+ 	sch->handle = handle;
 diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
-index 6efca30..1259f82 100644
+index 6efca30..166495a 100644
 --- a/net/sched/sch_generic.c
 +++ b/net/sched/sch_generic.c
 @@ -349,7 +349,7 @@ void netif_carrier_on(struct net_device *dev)
@@ -124059,6 +124412,59 @@ index 6efca30..1259f82 100644
  		linkwatch_fire_event(dev);
  	}
  }
+@@ -743,7 +743,7 @@ static void attach_one_default_qdisc(struct net_device *dev,
+ 			return;
+ 		}
+ 		if (!netif_is_multiqueue(dev))
+-			qdisc->flags |= TCQ_F_ONETXQUEUE;
++			qdisc->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT;
+ 	}
+ 	dev_queue->qdisc_sleeping = qdisc;
+ }
+diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
+index f3cbaec..3e82f04 100644
+--- a/net/sched/sch_mq.c
++++ b/net/sched/sch_mq.c
+@@ -63,7 +63,7 @@ static int mq_init(struct Qdisc *sch, struct nlattr *opt)
+ 		if (qdisc == NULL)
+ 			goto err;
+ 		priv->qdiscs[ntx] = qdisc;
+-		qdisc->flags |= TCQ_F_ONETXQUEUE;
++		qdisc->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT;
+ 	}
+ 
+ 	sch->flags |= TCQ_F_MQROOT;
+@@ -156,7 +156,7 @@ static int mq_graft(struct Qdisc *sch, unsigned long cl, struct Qdisc *new,
+ 
+ 	*old = dev_graft_qdisc(dev_queue, new);
+ 	if (new)
+-		new->flags |= TCQ_F_ONETXQUEUE;
++		new->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT;
+ 	if (dev->flags & IFF_UP)
+ 		dev_activate(dev);
+ 	return 0;
+diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
+index 3811a74..ad70ecf 100644
+--- a/net/sched/sch_mqprio.c
++++ b/net/sched/sch_mqprio.c
+@@ -132,7 +132,7 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt)
+ 			goto err;
+ 		}
+ 		priv->qdiscs[i] = qdisc;
+-		qdisc->flags |= TCQ_F_ONETXQUEUE;
++		qdisc->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT;
+ 	}
+ 
+ 	/* If the mqprio options indicate that hardware should own
+@@ -209,7 +209,7 @@ static int mqprio_graft(struct Qdisc *sch, unsigned long cl, struct Qdisc *new,
+ 	*old = dev_graft_qdisc(dev_queue, new);
+ 
+ 	if (new)
+-		new->flags |= TCQ_F_ONETXQUEUE;
++		new->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT;
+ 
+ 	if (dev->flags & IFF_UP)
+ 		dev_activate(dev);
 diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
 index e917d27..13e2a4c 100644
 --- a/net/sctp/ipv6.c
@@ -124147,9 +124553,18 @@ index 85e6f03..d41c1ad 100644
  	sctp_generate_t1_cookie_event,
  	sctp_generate_t1_init_event,
 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 17bef01..46f1473 100644
+index 17bef01..eaadf73 100644
 --- a/net/sctp/socket.c
 +++ b/net/sctp/socket.c
+@@ -972,7 +972,7 @@ static int sctp_setsockopt_bindx(struct sock *sk,
+ 		return -EFAULT;
+ 
+ 	/* Alloc space for the address array in kernel memory.  */
+-	kaddrs = kmalloc(addrs_size, GFP_KERNEL);
++	kaddrs = kmalloc(addrs_size, GFP_USER | __GFP_NOWARN);
+ 	if (unlikely(!kaddrs))
+ 		return -ENOMEM;
+ 
 @@ -2194,11 +2194,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
  {
  	struct sctp_association *asoc;
@@ -124228,6 +124643,38 @@ index 17bef01..46f1473 100644
  		if (copy_to_user(to, &temp, addrlen))
  			return -EFAULT;
  		to += addrlen;
+@@ -4928,7 +4941,7 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
+ 	to = optval + offsetof(struct sctp_getaddrs, addrs);
+ 	space_left = len - offsetof(struct sctp_getaddrs, addrs);
+ 
+-	addrs = kmalloc(space_left, GFP_KERNEL);
++	addrs = kmalloc(space_left, GFP_USER | __GFP_NOWARN);
+ 	if (!addrs)
+ 		return -ENOMEM;
+ 
+@@ -7375,6 +7388,13 @@ struct proto sctp_prot = {
+ 
+ #if IS_ENABLED(CONFIG_IPV6)
+ 
++#include <net/transp_v6.h>
++static void sctp_v6_destroy_sock(struct sock *sk)
++{
++	sctp_destroy_sock(sk);
++	inet6_destroy_sock(sk);
++}
++
+ struct proto sctpv6_prot = {
+ 	.name		= "SCTPv6",
+ 	.owner		= THIS_MODULE,
+@@ -7384,7 +7404,7 @@ struct proto sctpv6_prot = {
+ 	.accept		= sctp_accept,
+ 	.ioctl		= sctp_ioctl,
+ 	.init		= sctp_init_sock,
+-	.destroy	= sctp_destroy_sock,
++	.destroy	= sctp_v6_destroy_sock,
+ 	.shutdown	= sctp_shutdown,
+ 	.setsockopt	= sctp_setsockopt,
+ 	.getsockopt	= sctp_getsockopt,
 diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
 index 26d50c5..dfae665 100644
 --- a/net/sctp/sysctl.c
@@ -124936,7 +125383,7 @@ index 350cca3..a108fc5 100644
  	sub->evt.event = htohl(event, sub->swap);
  	sub->evt.found_lower = htohl(found_lower, sub->swap);
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 94f6582..0883e68 100644
+index 94f6582..5c2e78b 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
 @@ -420,6 +420,8 @@ static void unix_release_sock(struct sock *sk, int embrion)
@@ -125080,7 +125527,67 @@ index 94f6582..0883e68 100644
  	init_peercred(ska);
  	init_peercred(skb);
  
-@@ -1565,6 +1613,7 @@ restart:
+@@ -1432,6 +1480,14 @@ static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool sen
+ 	return err;
+ }
+ 
++static bool unix_passcred_enabled(const struct socket *sock,
++				  const struct sock *other)
++{
++	return test_bit(SOCK_PASSCRED, &sock->flags) ||
++	       !other->sk_socket ||
++	       test_bit(SOCK_PASSCRED, &other->sk_socket->flags);
++}
++
+ /*
+  * Some apps rely on write() giving SCM_CREDENTIALS
+  * We include credentials if source or destination socket
+@@ -1442,14 +1498,41 @@ static void maybe_add_creds(struct sk_buff *skb, const struct socket *sock,
+ {
+ 	if (UNIXCB(skb).pid)
+ 		return;
+-	if (test_bit(SOCK_PASSCRED, &sock->flags) ||
+-	    !other->sk_socket ||
+-	    test_bit(SOCK_PASSCRED, &other->sk_socket->flags)) {
++	if (unix_passcred_enabled(sock, other)) {
+ 		UNIXCB(skb).pid  = get_pid(task_tgid(current));
+ 		current_uid_gid(&UNIXCB(skb).uid, &UNIXCB(skb).gid);
+ 	}
+ }
+ 
++static int maybe_init_creds(struct scm_cookie *scm,
++			    struct socket *socket,
++			    const struct sock *other)
++{
++	int err;
++	struct msghdr msg = { .msg_controllen = 0 };
++
++	err = scm_send(socket, &msg, scm, false);
++	if (err)
++		return err;
++
++	if (unix_passcred_enabled(socket, other)) {
++		scm->pid = get_pid(task_tgid(current));
++		current_uid_gid(&scm->creds.uid, &scm->creds.gid);
++	}
++	return err;
++}
++
++static bool unix_skb_scm_eq(struct sk_buff *skb,
++			    struct scm_cookie *scm)
++{
++	const struct unix_skb_parms *u = &UNIXCB(skb);
++
++	return u->pid == scm->pid &&
++	       uid_eq(u->uid, scm->creds.uid) &&
++	       gid_eq(u->gid, scm->creds.gid) &&
++	       unix_secdata_eq(scm, skb);
++}
++
+ /*
+  *	Send AF_UNIX data.
+  */
+@@ -1565,6 +1648,7 @@ restart:
  		unix_state_lock(sk);
  		if (unix_peer(sk) == other) {
  			unix_peer(sk) = NULL;
@@ -125088,7 +125595,73 @@ index 94f6582..0883e68 100644
  			unix_state_unlock(sk);
  
  			unix_dgram_disconnected(sk, other);
-@@ -1798,6 +1847,7 @@ alloc_skb:
+@@ -1739,8 +1823,10 @@ out_err:
+ static ssize_t unix_stream_sendpage(struct socket *socket, struct page *page,
+ 				    int offset, size_t size, int flags)
+ {
+-	int err = 0;
+-	bool send_sigpipe = true;
++	int err;
++	bool send_sigpipe = false;
++	bool init_scm = true;
++	struct scm_cookie scm;
+ 	struct sock *other, *sk = socket->sk;
+ 	struct sk_buff *skb, *newskb = NULL, *tail = NULL;
+ 
+@@ -1758,7 +1844,7 @@ alloc_skb:
+ 		newskb = sock_alloc_send_pskb(sk, 0, 0, flags & MSG_DONTWAIT,
+ 					      &err, 0);
+ 		if (!newskb)
+-			return err;
++			goto err;
+ 	}
+ 
+ 	/* we must acquire readlock as we modify already present
+@@ -1767,12 +1853,12 @@ alloc_skb:
+ 	err = mutex_lock_interruptible(&unix_sk(other)->readlock);
+ 	if (err) {
+ 		err = flags & MSG_DONTWAIT ? -EAGAIN : -ERESTARTSYS;
+-		send_sigpipe = false;
+ 		goto err;
+ 	}
+ 
+ 	if (sk->sk_shutdown & SEND_SHUTDOWN) {
+ 		err = -EPIPE;
++		send_sigpipe = true;
+ 		goto err_unlock;
+ 	}
+ 
+@@ -1781,23 +1867,34 @@ alloc_skb:
+ 	if (sock_flag(other, SOCK_DEAD) ||
+ 	    other->sk_shutdown & RCV_SHUTDOWN) {
+ 		err = -EPIPE;
++		send_sigpipe = true;
+ 		goto err_state_unlock;
+ 	}
+ 
++	if (init_scm) {
++		err = maybe_init_creds(&scm, socket, other);
++		if (err)
++			goto err_state_unlock;
++		init_scm = false;
++	}
++
+ 	skb = skb_peek_tail(&other->sk_receive_queue);
+ 	if (tail && tail == skb) {
+ 		skb = newskb;
+-	} else if (!skb) {
+-		if (newskb)
++	} else if (!skb || !unix_skb_scm_eq(skb, &scm)) {
++		if (newskb) {
+ 			skb = newskb;
+-		else
++		} else {
++			tail = skb;
+ 			goto alloc_skb;
++		}
+ 	} else if (newskb) {
+ 		/* this is fast path, we don't necessarily need to
+ 		 * call to kfree_skb even though with newskb == NULL
  		 * this - does no harm
  		 */
  		consume_skb(newskb);
@@ -125096,12 +125669,15 @@ index 94f6582..0883e68 100644
  	}
  
  	if (skb_append_pagefrags(skb, page, offset, size)) {
-@@ -1810,8 +1860,11 @@ alloc_skb:
+@@ -1810,14 +1907,20 @@ alloc_skb:
  	skb->truesize += size;
  	atomic_add(size, &sk->sk_wmem_alloc);
  
 -	if (newskb)
 +	if (newskb) {
++		err = unix_scm_to_skb(&scm, skb, false);
++		if (err)
++			goto err_state_unlock;
 +		spin_lock(&other->sk_receive_queue.lock);
  		__skb_queue_tail(&other->sk_receive_queue, newskb);
 +		spin_unlock(&other->sk_receive_queue.lock);
@@ -125109,7 +125685,23 @@ index 94f6582..0883e68 100644
  
  	unix_state_unlock(other);
  	mutex_unlock(&unix_sk(other)->readlock);
-@@ -2071,6 +2124,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state)
+ 
+ 	other->sk_data_ready(other);
+-
++	scm_destroy(&scm);
+ 	return size;
+ 
+ err_state_unlock:
+@@ -1828,6 +1931,8 @@ err:
+ 	kfree_skb(newskb);
+ 	if (send_sigpipe && !(flags & MSG_NOSIGNAL))
+ 		send_sig(SIGPIPE, current, 0);
++	if (!init_scm)
++		scm_destroy(&scm);
+ 	return err;
+ }
+ 
+@@ -2071,6 +2176,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state)
  
  	do {
  		int chunk;
@@ -125117,7 +125709,19 @@ index 94f6582..0883e68 100644
  		struct sk_buff *skb, *last;
  
  		unix_state_lock(sk);
-@@ -2151,7 +2205,11 @@ unlock:
+@@ -2130,10 +2236,7 @@ unlock:
+ 
+ 		if (check_creds) {
+ 			/* Never glue messages from different writers */
+-			if ((UNIXCB(skb).pid  != scm.pid) ||
+-			    !uid_eq(UNIXCB(skb).uid, scm.creds.uid) ||
+-			    !gid_eq(UNIXCB(skb).gid, scm.creds.gid) ||
+-			    !unix_secdata_eq(&scm, skb))
++			if (!unix_skb_scm_eq(skb, &scm))
+ 				break;
+ 		} else if (test_bit(SOCK_PASSCRED, &sock->flags)) {
+ 			/* Copy credentials */
+@@ -2151,7 +2254,11 @@ unlock:
  		}
  
  		chunk = min_t(unsigned int, unix_skb_len(skb) - skip, size);
@@ -125129,7 +125733,7 @@ index 94f6582..0883e68 100644
  		if (chunk < 0) {
  			if (copied == 0)
  				copied = -EFAULT;
-@@ -2160,6 +2218,18 @@ unlock:
+@@ -2160,6 +2267,18 @@ unlock:
  		copied += chunk;
  		size -= chunk;
  
@@ -125148,7 +125752,7 @@ index 94f6582..0883e68 100644
  		/* Mark read part of skb as used */
  		if (!(flags & MSG_PEEK)) {
  			UNIXCB(skb).consumed += chunk;
-@@ -2456,7 +2526,6 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
+@@ -2456,7 +2575,6 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
  	other = unix_peer_get(sk);
  	if (other) {
  		if (unix_peer(other) != sk) {
@@ -125156,7 +125760,7 @@ index 94f6582..0883e68 100644
  			if (unix_recvq_full(other))
  				writable = 0;
  		}
-@@ -2556,9 +2625,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2556,9 +2674,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  		seq_puts(seq, "Num       RefCount Protocol Flags    Type St "
  			 "Inode Path\n");
  	else {
@@ -125171,7 +125775,7 @@ index 94f6582..0883e68 100644
  
  		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
  			s,
-@@ -2583,10 +2656,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2583,10 +2705,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  				seq_putc(seq, '@');
  				i++;
  			}
@@ -133195,10 +133799,10 @@ index 0000000..f74d85a
 +targets += size_overflow_hash.h size_overflow_hash_aux.h disable_size_overflow_hash.h
 diff --git a/tools/gcc/size_overflow_plugin/disable_size_overflow_hash.data b/tools/gcc/size_overflow_plugin/disable_size_overflow_hash.data
 new file mode 100644
-index 0000000..8ce9ec1
+index 0000000..07f2628
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/disable_size_overflow_hash.data
-@@ -0,0 +1,12422 @@
+@@ -0,0 +1,12424 @@
 +disable_so_interrupt_pnode_gru_message_queue_desc_4 interrupt_pnode gru_message_queue_desc 0 4 NULL
 +disable_so_bch_btree_insert_fndecl_12 bch_btree_insert fndecl 0 12 NULL
 +disable_so_macvlan_sync_address_fndecl_22 macvlan_sync_address fndecl 0 22 NULL nohasharray
@@ -136504,7 +137108,8 @@ index 0000000..8ce9ec1
 +disable_so_cir_addr_nvt_dev_17619 cir_addr nvt_dev 0 17619 NULL
 +disable_so_plink_timeout_mesh_config_17621 plink_timeout mesh_config 0 17621 NULL
 +disable_so_numaddr_mwl8k_cmd_mac_multicast_adr_17633 numaddr mwl8k_cmd_mac_multicast_adr 0 17633 NULL
-+disable_so_addr_nvbios_extdev_func_17635 addr nvbios_extdev_func 0 17635 NULL nohasharray
++enable_so_last_used_idx_vringh_17635 last_used_idx vringh 0 17635 NULL nohasharray
++disable_so_addr_nvbios_extdev_func_17635 addr nvbios_extdev_func 0 17635 &enable_so_last_used_idx_vringh_17635 nohasharray
 +disable_so_xfs_btree_set_numrecs_fndecl_17635 xfs_btree_set_numrecs fndecl 2 17635 &disable_so_addr_nvbios_extdev_func_17635
 +disable_so_pll_clkdiv_adau1701_17652 pll_clkdiv adau1701 0 17652 NULL
 +disable_so_btree_insert_raw_fndecl_17655 btree_insert_raw fndecl 0-2 17655 NULL
@@ -145621,6 +146226,7 @@ index 0000000..8ce9ec1
 +enable_so_i_size_lo_ext4_inode_40153 i_size_lo ext4_inode 0 40153 NULL
 +enable_so_i_size_high_ext4_inode_18545 i_size_high ext4_inode 0 18545 NULL
 +enable_so_nr_kvm_queued_interrupt_34927 nr kvm_queued_interrupt 0 34927 NULL
++enable_so_last_used_idx_vhost_virtqueue_40059 last_used_idx vhost_virtqueue 0 40059 NULL
 diff --git a/tools/gcc/size_overflow_plugin/generate_size_overflow_hash.sh b/tools/gcc/size_overflow_plugin/generate_size_overflow_hash.sh
 new file mode 100644
 index 0000000..be9724d
@@ -146154,10 +146760,10 @@ index 0000000..cc20d48
 +#endif
 diff --git a/tools/gcc/size_overflow_plugin/intentional_overflow.c b/tools/gcc/size_overflow_plugin/intentional_overflow.c
 new file mode 100644
-index 0000000..3bf5a4e
+index 0000000..7d9135d
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/intentional_overflow.c
-@@ -0,0 +1,1010 @@
+@@ -0,0 +1,1032 @@
 +/*
 + * Copyright 2011-2015 by Emese Revfy <re.emese@gmail.com>
 + * Licensed under the GPL v2, or (at your option) v3
@@ -147119,7 +147725,7 @@ index 0000000..3bf5a4e
 + * _141 = -_140;
 + * _154 = (short unsigned int) _141;
 + * _155 = (size_overflow_type_SI) _154;
-+ * _156 = _154 + _155;
++ * _156 = _154 + _155; // 2x
 + * _157 = (short unsigned int) _156;
 + */
 +static bool is_short_cast_neg(const_tree rhs)
@@ -147145,11 +147751,28 @@ index 0000000..3bf5a4e
 +	return gimple_assign_rhs_code(neg_stmt) == NEGATE_EXPR;
 +}
 +
++static bool check_add_stmt(const_tree node)
++{
++	const_gimple add_stmt;
++	const_tree add_rhs1, add_rhs2;
++
++	if (node == NULL_TREE)
++		return false;
++
++	add_stmt = get_def_stmt(node);
++	if (!add_stmt || !is_gimple_assign(add_stmt) || gimple_assign_rhs_code(add_stmt) != PLUS_EXPR)
++		return false;
++
++	add_rhs1 = gimple_assign_rhs1(add_stmt);
++	add_rhs2 = gimple_assign_rhs2(add_stmt);
++	return is_short_cast_neg(add_rhs1) || is_short_cast_neg(add_rhs2);
++}
++
 +bool neg_short_add_intentional_overflow(gassign *unary_stmt)
 +{
 +	const_tree rhs1, add_rhs1, add_rhs2, cast_rhs;
-+	const_gimple add_stmt;
 +	gimple cast_stmt;
++	const_gimple add_stmt;
 +
 +	rhs1 = gimple_assign_rhs1(unary_stmt);
 +
@@ -147160,13 +147783,18 @@ index 0000000..3bf5a4e
 +	if (GET_MODE_BITSIZE(TYPE_MODE(TREE_TYPE(cast_rhs))) <= GET_MODE_BITSIZE(TYPE_MODE(TREE_TYPE(rhs1))))
 +		return false;
 +
++	// one or two plus expressions
++	if (check_add_stmt(cast_rhs))
++		return true;
++
 +	add_stmt = get_def_stmt(cast_rhs);
-+	if (!add_stmt || !is_gimple_assign(add_stmt) || gimple_assign_rhs_code(add_stmt) != PLUS_EXPR)
++	if (!add_stmt || !is_gimple_assign(add_stmt))
 +		return false;
-+
 +	add_rhs1 = gimple_assign_rhs1(add_stmt);
++	if (check_add_stmt(add_rhs1))
++		return true;
 +	add_rhs2 = gimple_assign_rhs2(add_stmt);
-+	return is_short_cast_neg(add_rhs1) || is_short_cast_neg(add_rhs2);
++	return check_add_stmt(add_rhs2);
 +}
 diff --git a/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c b/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c
 new file mode 100644
@@ -147842,10 +148470,10 @@ index 0000000..fc58e16
 +}
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
 new file mode 100644
-index 0000000..2d4a6ed
+index 0000000..a907202
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,20735 @@
+@@ -0,0 +1,20733 @@
 +enable_so_recv_ctrl_pipe_us_data_0 recv_ctrl_pipe us_data 0 0 NULL
 +enable_so___earlyonly_bootmem_alloc_fndecl_3 __earlyonly_bootmem_alloc fndecl 2-3-4 3 NULL
 +enable_so_size_ttm_mem_reg_8 size ttm_mem_reg 0 8 NULL
@@ -153340,7 +153968,6 @@ index 0000000..2d4a6ed
 +enable_so_min_alloc_order_gen_pool_17628 min_alloc_order gen_pool 0 17628 NULL
 +enable_so_num_peri_pl330_config_17630 num_peri pl330_config 0 17630 NULL
 +enable_so_ctxts_extrabuf_qib_devdata_17634 ctxts_extrabuf qib_devdata 0 17634 NULL
-+enable_so_last_used_idx_vringh_17635 last_used_idx vringh 0 17635 NULL
 +enable_so_video_linelength_sis_video_info_17642 video_linelength sis_video_info 0 17642 NULL
 +enable_so_wl12xx_sdio_raw_read_fndecl_17648 wl12xx_sdio_raw_read fndecl 4 17648 NULL
 +enable_so_buf_len_ceph_none_authorizer_17652 buf_len ceph_none_authorizer 0 17652 NULL nohasharray
@@ -160564,7 +161191,6 @@ index 0000000..2d4a6ed
 +enable_so_memdiff_vardecl_tridentfb_c_40043 memdiff vardecl_tridentfb.c 0 40043 NULL nohasharray
 +enable_so_read_partial_fndecl_40043 read_partial fndecl 2 40043 &enable_so_memdiff_vardecl_tridentfb_c_40043
 +enable_so_add_nested_action_start_fndecl_40044 add_nested_action_start fndecl 0 40044 NULL
-+enable_so_last_used_idx_vhost_virtqueue_40059 last_used_idx vhost_virtqueue 0 40059 NULL
 +enable_so_SyS_listxattr_fndecl_40060 SyS_listxattr fndecl 3 40060 NULL
 +enable_so_smp_execute_task_fndecl_40062 smp_execute_task fndecl 3-5-0 40062 NULL nohasharray
 +enable_so_iwl_dbgfs_disable_power_off_read_fndecl_40062 iwl_dbgfs_disable_power_off_read fndecl 3 40062 &enable_so_smp_execute_task_fndecl_40062
@@ -170424,7 +171050,7 @@ index 0000000..6075e8f
 +
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
 new file mode 100644
-index 0000000..29a5c26
+index 0000000..f1cc040
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
 @@ -0,0 +1,318 @@
@@ -170459,7 +171085,7 @@ index 0000000..29a5c26
 +tree size_overflow_type_TI;
 +
 +static struct plugin_info size_overflow_plugin_info = {
-+	.version	= "20151128",
++	.version	= "20151201",
 +	.help		= "no-size-overflow\tturn off size overflow checking\n",
 +};
 +