Grsec/PaX: 2.9-2.6.32.57-201202251202 + 2.9-3.2.7-20120225120320120225

15 files changed, 2355 insertions, 512 deletions

diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index d1d1d12..d4a9997 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -22,7 +22,7 @@ Patch:	1056_linux-2.6.32.57.patch
 From:	http://www.kernel.org
 Desc:	Linux 2.6.32.57
 
-Patch:	4420_grsecurity-2.2.2-2.6.32.57-201202131842.patch
+Patch:	4420_grsecurity-2.9-2.6.32.57-201202251202.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/2.6.32/4420_grsecurity-2.2.2-2.6.32.57-201202131842.patch b/2.6.32/4420_grsecurity-2.9-2.6.32.57-201202251202.patch
index 89f6faf..59a7ef3 100644
--- a/2.6.32/4420_grsecurity-2.2.2-2.6.32.57-201202131842.patch
+++ b/2.6.32/4420_grsecurity-2.9-2.6.32.57-201202251202.patch
@@ -401,6 +401,27 @@ index 3377650..76aacb3 100644
  	$(cmd_crmodverdir)
  	$(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1)   \
  	$(build)=$(build-dir) $(@:.ko=.o)
+diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
+index 610dff4..f396854 100644
+--- a/arch/alpha/include/asm/atomic.h
++++ b/arch/alpha/include/asm/atomic.h
+@@ -251,6 +251,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+ #define atomic_dec(v) atomic_sub(1,(v))
+ #define atomic64_dec(v) atomic64_sub(1,(v))
+ 
++#define atomic64_read_unchecked(v)		atomic64_read(v)
++#define atomic64_set_unchecked(v, i)		atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v)		atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v)	atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v)		atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v)		atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v)	atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v)		atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n)	atomic64_cmpxchg((v), (o), (n))
++
+ #define smp_mb__before_atomic_dec()	smp_mb()
+ #define smp_mb__after_atomic_dec()	smp_mb()
+ #define smp_mb__before_atomic_inc()	smp_mb()
 diff --git a/arch/alpha/include/asm/elf.h b/arch/alpha/include/asm/elf.h
 index 5c75c1b..c82f878 100644
 --- a/arch/alpha/include/asm/elf.h
@@ -649,6 +670,33 @@ index 00a31de..2ded0f2 100644
  	} else if (!cause) {
  		/* Allow reads even for write-only mappings */
  		if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index b68faef..6dd1496 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -14,6 +14,7 @@ config ARM
+ 	select SYS_SUPPORTS_APM_EMULATION
+ 	select HAVE_OPROFILE
+ 	select HAVE_ARCH_KGDB
++	select GENERIC_ATOMIC64
+ 	select HAVE_KPROBES if (!XIP_KERNEL)
+ 	select HAVE_KRETPROBES if (HAVE_KPROBES)
+ 	select HAVE_FUNCTION_TRACER if (!XIP_KERNEL)
+diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
+index d0daeab..ff286a8 100644
+--- a/arch/arm/include/asm/atomic.h
++++ b/arch/arm/include/asm/atomic.h
+@@ -15,6 +15,10 @@
+ #include <linux/types.h>
+ #include <asm/system.h>
+ 
++#ifdef CONFIG_GENERIC_ATOMIC64
++#include <asm-generic/atomic64.h>
++#endif
++
+ #define ATOMIC_INIT(i)	{ (i) }
+ 
+ #ifdef __KERNEL__
 diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
 index 6aac3f5..265536b 100644
 --- a/arch/arm/include/asm/elf.h
@@ -1254,6 +1302,27 @@ index 8837be4..b2fb413 100644
  	.enter = bfin_pm_enter,
  	.valid	= bfin_pm_valid,
  };
+diff --git a/arch/frv/include/asm/atomic.h b/arch/frv/include/asm/atomic.h
+index 00a57af..c3ef0cd 100644
+--- a/arch/frv/include/asm/atomic.h
++++ b/arch/frv/include/asm/atomic.h
+@@ -241,6 +241,16 @@ extern uint32_t __xchg_32(uint32_t i, volatile void *v);
+ #define atomic64_cmpxchg(v, old, new)	(__cmpxchg_64(old, new, &(v)->counter))
+ #define atomic64_xchg(v, new)		(__xchg_64(new, &(v)->counter))
+ 
++#define atomic64_read_unchecked(v)		atomic64_read(v)
++#define atomic64_set_unchecked(v, i)		atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v)		atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v)	atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v)		atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v)		atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v)	atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v)		atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n)	atomic64_cmpxchg((v), (o), (n))
++
+ static __inline__ int atomic_add_unless(atomic_t *v, int a, int u)
+ {
+ 	int c, old;
 diff --git a/arch/frv/include/asm/kmap_types.h b/arch/frv/include/asm/kmap_types.h
 index f8e16b2..c73ff79 100644
 --- a/arch/frv/include/asm/kmap_types.h
@@ -1380,6 +1449,27 @@ index 0f15349..26b3429 100644
  #define IA32_GATE_OFFSET	IA32_PAGE_OFFSET
  #define IA32_GATE_END		IA32_PAGE_OFFSET + PAGE_SIZE
  
+diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
+index 88405cb..de5ca5d 100644
+--- a/arch/ia64/include/asm/atomic.h
++++ b/arch/ia64/include/asm/atomic.h
+@@ -210,6 +210,16 @@ atomic64_add_negative (__s64 i, atomic64_t *v)
+ #define atomic64_inc(v)			atomic64_add(1, (v))
+ #define atomic64_dec(v)			atomic64_sub(1, (v))
+ 
++#define atomic64_read_unchecked(v)		atomic64_read(v)
++#define atomic64_set_unchecked(v, i)		atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v)		atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v)	atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v)		atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v)		atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v)	atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v)		atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n)	atomic64_cmpxchg((v), (o), (n))
++
+ /* Atomic operations are already serializing */
+ #define smp_mb__before_atomic_dec()	barrier()
+ #define smp_mb__after_atomic_dec()	barrier()
 diff --git a/arch/ia64/include/asm/dma-mapping.h b/arch/ia64/include/asm/dma-mapping.h
 index 8d3c79c..71b3af6 100644
 --- a/arch/ia64/include/asm/dma-mapping.h
@@ -1904,6 +1994,18 @@ index 82abd15..d95ae5d 100644
  	prefetchw(to);
  	if (access_ok(VERIFY_READ, from, n))
  		__copy_user_zeroing(to,from,n);
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index fd7620f..63d73a6 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -5,6 +5,7 @@ config MIPS
+ 	select HAVE_IDE
+ 	select HAVE_OPROFILE
+ 	select HAVE_ARCH_KGDB
++	select GENERIC_ATOMIC64 if !64BIT
+ 	# Horrible source of confusion.  Die, die, die ...
+ 	select EMBEDDED
+ 	select RTC_LIB if !LEMOTE_FULOONG2E
 diff --git a/arch/mips/Makefile b/arch/mips/Makefile
 index 77f5021..2b1db8a 100644
 --- a/arch/mips/Makefile
@@ -1930,6 +2032,38 @@ index 632f986..fd0378d 100644
  	.valid		= suspend_valid_only_mem,
  	.begin		= db1x_pm_begin,
  	.enter		= db1x_pm_enter,
+diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
+index 09e7128..111035b 100644
+--- a/arch/mips/include/asm/atomic.h
++++ b/arch/mips/include/asm/atomic.h
+@@ -21,6 +21,10 @@
+ #include <asm/war.h>
+ #include <asm/system.h>
+ 
++#ifdef CONFIG_GENERIC_ATOMIC64
++#include <asm-generic/atomic64.h>
++#endif
++
+ #define ATOMIC_INIT(i)    { (i) }
+ 
+ /*
+@@ -782,6 +786,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+  */
+ #define atomic64_add_negative(i, v) (atomic64_add_return(i, (v)) < 0)
+ 
++#define atomic64_read_unchecked(v)		atomic64_read(v)
++#define atomic64_set_unchecked(v, i)		atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v)		atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v)	atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v)		atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v)		atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v)	atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v)		atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n)	atomic64_cmpxchg((v), (o), (n))
++
+ #endif /* CONFIG_64BIT */
+ 
+ /*
 diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
 index 7990694..4e93acf 100644
 --- a/arch/mips/include/asm/elf.h
@@ -2154,6 +2288,27 @@ index e97a7a2..f18f5b0 100644
  /*
   * This routine handles page faults.  It determines the address,
   * and the problem, and then passes it off to one of the appropriate
+diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
+index 8bc9e96..26554f8 100644
+--- a/arch/parisc/include/asm/atomic.h
++++ b/arch/parisc/include/asm/atomic.h
+@@ -336,6 +336,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+ 
+ #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
+ 
++#define atomic64_read_unchecked(v)		atomic64_read(v)
++#define atomic64_set_unchecked(v, i)		atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v)		atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v)	atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v)		atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v)		atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v)	atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v)		atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n)	atomic64_cmpxchg((v), (o), (n))
++
+ #else /* CONFIG_64BIT */
+ 
+ #include <asm-generic/atomic64.h>
 diff --git a/arch/parisc/include/asm/elf.h b/arch/parisc/include/asm/elf.h
 index 9c802eb..0592e41 100644
 --- a/arch/parisc/include/asm/elf.h
@@ -3839,6 +3994,27 @@ index 43c0aca..42c045b 100644
  
  comment "Code generation options"
  
+diff --git a/arch/s390/include/asm/atomic.h b/arch/s390/include/asm/atomic.h
+index ae7c8f9..3f01a0c 100644
+--- a/arch/s390/include/asm/atomic.h
++++ b/arch/s390/include/asm/atomic.h
+@@ -362,6 +362,16 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
+ #define atomic64_dec_and_test(_v)	(atomic64_sub_return(1, _v) == 0)
+ #define atomic64_inc_not_zero(v)	atomic64_add_unless((v), 1, 0)
+ 
++#define atomic64_read_unchecked(v)		atomic64_read(v)
++#define atomic64_set_unchecked(v, i)		atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v)		atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v)	atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v)		atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v)		atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v)	atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v)		atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n)	atomic64_cmpxchg((v), (o), (n))
++
+ #define smp_mb__before_atomic_dec()	smp_mb()
+ #define smp_mb__after_atomic_dec()	smp_mb()
+ #define smp_mb__before_atomic_inc()	smp_mb()
 diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
 index e885442..e3a2817 100644
 --- a/arch/s390/include/asm/elf.h
@@ -4251,6 +4427,18 @@ index afeb710..d1d1289 100644
  
  bottomup:
  	/*
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index 05ef538..dc9c857 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -32,6 +32,7 @@ config SPARC
+ 
+ config SPARC32
+ 	def_bool !64BIT
++	select GENERIC_ATOMIC64
+ 
+ config SPARC64
+ 	def_bool 64BIT
 diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile
 index 113225b..7fd04e7 100644
 --- a/arch/sparc/Makefile
@@ -4264,6 +4452,17 @@ index 113225b..7fd04e7 100644
  VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
  VMLINUX_MAIN += $(drivers-y) $(net-y)
  
+diff --git a/arch/sparc/include/asm/atomic.h b/arch/sparc/include/asm/atomic.h
+index 8ff83d8..4a459c2 100644
+--- a/arch/sparc/include/asm/atomic.h
++++ b/arch/sparc/include/asm/atomic.h
+@@ -4,5 +4,6 @@
+ #include <asm/atomic_64.h>
+ #else
+ #include <asm/atomic_32.h>
++#include <asm-generic/atomic64.h>
+ #endif
+ #endif
 diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
 index f5cc06f..f858d47 100644
 --- a/arch/sparc/include/asm/atomic_64.h
@@ -4543,6 +4742,19 @@ index 9968085..c2106ef 100644
  
  /* This yields a mask that user programs can use to figure out what
     instruction set this cpu supports.  */
+diff --git a/arch/sparc/include/asm/page_32.h b/arch/sparc/include/asm/page_32.h
+index 156707b..aefa786 100644
+--- a/arch/sparc/include/asm/page_32.h
++++ b/arch/sparc/include/asm/page_32.h
+@@ -8,6 +8,8 @@
+ #ifndef _SPARC_PAGE_H
+ #define _SPARC_PAGE_H
+ 
++#include <linux/const.h>
++
+ #define PAGE_SHIFT   12
+ 
+ #ifndef __ASSEMBLY__
 diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h
 index e0cabe7..efd60f1 100644
 --- a/arch/sparc/include/asm/pgtable_32.h
@@ -31418,6 +31630,19 @@ index 1270f64..8495f49 100644
  };
  
  static int memory_open(struct inode *inode, struct file *filp)
+diff --git a/drivers/char/mmtimer.c b/drivers/char/mmtimer.c
+index 918711a..4ffaf5e 100644
+--- a/drivers/char/mmtimer.c
++++ b/drivers/char/mmtimer.c
+@@ -756,7 +756,7 @@ static int sgi_timer_set(struct k_itimer *timr, int flags,
+ 	return err;
+ }
+ 
+-static struct k_clock sgi_clock = {
++static k_clock_no_const sgi_clock = {
+ 	.res = 0,
+ 	.clock_set = sgi_clock_set,
+ 	.clock_get = sgi_clock_get,
 diff --git a/drivers/char/pcmcia/ipwireless/tty.c b/drivers/char/pcmcia/ipwireless/tty.c
 index 674b3ab..a8d1970 100644
 --- a/drivers/char/pcmcia/ipwireless/tty.c
@@ -47928,7 +48153,7 @@ index a5bf577..6d19845 100644
          return hit;
  }
 diff --git a/fs/compat.c b/fs/compat.c
-index d1e2411..b1eda5d 100644
+index d1e2411..c2ef8ed 100644
 --- a/fs/compat.c
 +++ b/fs/compat.c
 @@ -133,8 +133,8 @@ asmlinkage long compat_sys_utimes(char __user *filename, struct compat_timeval _
@@ -48049,7 +48274,18 @@ index d1e2411..b1eda5d 100644
  		goto out;
  	if (!file->f_op)
  		goto out;
-@@ -1463,11 +1481,35 @@ int compat_do_execve(char * filename,
+@@ -1454,6 +1472,10 @@ out:
+ 	return ret;
+ }
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++extern atomic64_unchecked_t global_exec_counter;
++#endif
++
+ /*
+  * compat_do_execve() is mostly a copy of do_execve(), with the exception
+  * that it processes 32 bit argv and envp pointers.
+@@ -1463,11 +1485,35 @@ int compat_do_execve(char * filename,
  	compat_uptr_t __user *envp,
  	struct pt_regs * regs)
  {
@@ -48085,7 +48321,7 @@ index d1e2411..b1eda5d 100644
  
  	retval = unshare_files(&displaced);
  	if (retval)
-@@ -1493,12 +1535,26 @@ int compat_do_execve(char * filename,
+@@ -1493,12 +1539,26 @@ int compat_do_execve(char * filename,
  	if (IS_ERR(file))
  		goto out_unmark;
  
@@ -48112,7 +48348,7 @@ index d1e2411..b1eda5d 100644
  	retval = bprm_mm_init(bprm);
  	if (retval)
  		goto out_file;
-@@ -1528,9 +1584,40 @@ int compat_do_execve(char * filename,
+@@ -1528,11 +1588,45 @@ int compat_do_execve(char * filename,
  	if (retval < 0)
  		goto out;
  
@@ -48153,8 +48389,13 @@ index d1e2411..b1eda5d 100644
 +#endif
  
  	/* execve succeeded */
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++        current->exec_id = atomic64_inc_return_unchecked(&global_exec_counter);
++#endif
  	current->fs->in_exec = 0;
-@@ -1541,6 +1628,14 @@ int compat_do_execve(char * filename,
+ 	current->in_execve = 0;
+ 	acct_update_integrals(current);
+@@ -1541,6 +1635,14 @@ int compat_do_execve(char * filename,
  		put_files_struct(displaced);
  	return retval;
  
@@ -48169,7 +48410,7 @@ index d1e2411..b1eda5d 100644
  out:
  	if (bprm->mm) {
  		acct_arg_size(bprm, 0);
-@@ -1711,6 +1806,8 @@ int compat_core_sys_select(int n, compat_ulong_t __user *inp,
+@@ -1711,6 +1813,8 @@ int compat_core_sys_select(int n, compat_ulong_t __user *inp,
  	struct fdtable *fdt;
  	long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
  
@@ -48178,7 +48419,7 @@ index d1e2411..b1eda5d 100644
  	if (n < 0)
  		goto out_nofds;
  
-@@ -2151,7 +2248,7 @@ asmlinkage long compat_sys_nfsservctl(int cmd,
+@@ -2151,7 +2255,7 @@ asmlinkage long compat_sys_nfsservctl(int cmd,
  	oldfs = get_fs();
  	set_fs(KERNEL_DS);
  	/* The __user pointer casts are valid because of the set_fs() */
@@ -48409,7 +48650,7 @@ index 88ba4d4..073f003 100644
  	if (rc < 0)
  		goto out_free;
 diff --git a/fs/exec.c b/fs/exec.c
-index 86fafc6..47ffa63 100644
+index 86fafc6..6272c0e 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
 @@ -56,12 +56,28 @@
@@ -48463,7 +48704,25 @@ index 86fafc6..47ffa63 100644
  		return NULL;
  
  	if (write) {
-@@ -263,6 +271,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
+@@ -205,6 +213,17 @@ struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+ 		if (size <= ARG_MAX)
+ 			return page;
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		// only allow 1MB for argv+env on suid/sgid binaries
++		// to prevent easy ASLR exhaustion
++		if (((bprm->cred->euid != current_euid()) ||
++		     (bprm->cred->egid != current_egid())) &&
++		    (size > (1024 * 1024))) {
++			put_page(page);
++			return NULL;
++		}
++#endif
++
+ 		/*
+ 		 * Limit to 1/4-th the stack size for the argv+env strings.
+ 		 * This ensures that:
+@@ -263,6 +282,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
  	vma->vm_end = STACK_TOP_MAX;
  	vma->vm_start = vma->vm_end - PAGE_SIZE;
  	vma->vm_flags = VM_STACK_FLAGS;
@@ -48475,7 +48734,7 @@ index 86fafc6..47ffa63 100644
  	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
  
  	err = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
-@@ -276,6 +289,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
+@@ -276,6 +300,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
  	mm->stack_vm = mm->total_vm = 1;
  	up_write(&mm->mmap_sem);
  	bprm->p = vma->vm_end - sizeof(void *);
@@ -48488,7 +48747,7 @@ index 86fafc6..47ffa63 100644
  	return 0;
  err:
  	up_write(&mm->mmap_sem);
-@@ -510,7 +529,7 @@ int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
+@@ -510,7 +540,7 @@ int copy_strings_kernel(int argc,char ** argv, struct linux_binprm *bprm)
  	int r;
  	mm_segment_t oldfs = get_fs();
  	set_fs(KERNEL_DS);
@@ -48497,7 +48756,7 @@ index 86fafc6..47ffa63 100644
  	set_fs(oldfs);
  	return r;
  }
-@@ -540,7 +559,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+@@ -540,7 +570,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
  	unsigned long new_end = old_end - shift;
  	struct mmu_gather *tlb;
  
@@ -48507,7 +48766,7 @@ index 86fafc6..47ffa63 100644
  
  	/*
  	 * ensure there are no vmas between where we want to go
-@@ -549,6 +569,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+@@ -549,6 +580,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
  	if (vma != find_vma(mm, new_start))
  		return -EFAULT;
  
@@ -48518,7 +48777,7 @@ index 86fafc6..47ffa63 100644
  	/*
  	 * cover the whole range: [new_start, old_end)
  	 */
-@@ -630,10 +654,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -630,10 +665,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
  	stack_top = arch_align_stack(stack_top);
  	stack_top = PAGE_ALIGN(stack_top);
  
@@ -48529,7 +48788,7 @@ index 86fafc6..47ffa63 100644
  	stack_shift = vma->vm_end - stack_top;
  
  	bprm->p -= stack_shift;
-@@ -645,6 +665,14 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -645,6 +676,14 @@ int setup_arg_pages(struct linux_binprm *bprm,
  	bprm->exec -= stack_shift;
  
  	down_write(&mm->mmap_sem);
@@ -48544,7 +48803,7 @@ index 86fafc6..47ffa63 100644
  	vm_flags = VM_STACK_FLAGS;
  
  	/*
-@@ -658,19 +686,24 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -658,19 +697,24 @@ int setup_arg_pages(struct linux_binprm *bprm,
  		vm_flags &= ~VM_EXEC;
  	vm_flags |= mm->def_flags;
  
@@ -48576,7 +48835,7 @@ index 86fafc6..47ffa63 100644
  	stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
  	stack_size = vma->vm_end - vma->vm_start;
  	/*
-@@ -744,7 +777,7 @@ int kernel_read(struct file *file, loff_t offset,
+@@ -744,7 +788,7 @@ int kernel_read(struct file *file, loff_t offset,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -48585,7 +48844,7 @@ index 86fafc6..47ffa63 100644
  	set_fs(old_fs);
  	return result;
  }
-@@ -985,6 +1018,21 @@ void set_task_comm(struct task_struct *tsk, char *buf)
+@@ -985,6 +1029,21 @@ void set_task_comm(struct task_struct *tsk, char *buf)
  	perf_event_comm(tsk);
  }
  
@@ -48607,7 +48866,7 @@ index 86fafc6..47ffa63 100644
  int flush_old_exec(struct linux_binprm * bprm)
  {
  	int retval;
-@@ -999,6 +1047,7 @@ int flush_old_exec(struct linux_binprm * bprm)
+@@ -999,6 +1058,7 @@ int flush_old_exec(struct linux_binprm * bprm)
  
  	set_mm_exe_file(bprm->mm, bprm->file);
  
@@ -48615,7 +48874,7 @@ index 86fafc6..47ffa63 100644
  	/*
  	 * Release all of the old mmap stuff
  	 */
-@@ -1023,10 +1072,6 @@ EXPORT_SYMBOL(flush_old_exec);
+@@ -1023,10 +1083,6 @@ EXPORT_SYMBOL(flush_old_exec);
  
  void setup_new_exec(struct linux_binprm * bprm)
  {
@@ -48626,7 +48885,7 @@ index 86fafc6..47ffa63 100644
  	arch_pick_mmap_layout(current->mm);
  
  	/* This is the point of no return */
-@@ -1037,18 +1082,7 @@ void setup_new_exec(struct linux_binprm * bprm)
+@@ -1037,18 +1093,7 @@ void setup_new_exec(struct linux_binprm * bprm)
  	else
  		set_dumpable(current->mm, suid_dumpable);
  
@@ -48646,7 +48905,7 @@ index 86fafc6..47ffa63 100644
  
  	/* Set the new mm task size. We have to do that late because it may
  	 * depend on TIF_32BIT which is only updated in flush_thread() on
-@@ -1152,7 +1186,7 @@ int check_unsafe_exec(struct linux_binprm *bprm)
+@@ -1152,7 +1197,7 @@ int check_unsafe_exec(struct linux_binprm *bprm)
  	}
  	rcu_read_unlock();
  
@@ -48655,7 +48914,7 @@ index 86fafc6..47ffa63 100644
  		bprm->unsafe |= LSM_UNSAFE_SHARE;
  	} else {
  		res = -EAGAIN;
-@@ -1339,6 +1373,10 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+@@ -1339,6 +1384,10 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
  
  EXPORT_SYMBOL(search_binary_handler);
  
@@ -48666,7 +48925,7 @@ index 86fafc6..47ffa63 100644
  /*
   * sys_execve() executes a new program.
   */
-@@ -1347,11 +1385,35 @@ int do_execve(char * filename,
+@@ -1347,11 +1396,35 @@ int do_execve(char * filename,
  	char __user *__user *envp,
  	struct pt_regs * regs)
  {
@@ -48702,7 +48961,7 @@ index 86fafc6..47ffa63 100644
  
  	retval = unshare_files(&displaced);
  	if (retval)
-@@ -1377,12 +1439,27 @@ int do_execve(char * filename,
+@@ -1377,12 +1450,27 @@ int do_execve(char * filename,
  	if (IS_ERR(file))
  		goto out_unmark;
  
@@ -48730,7 +48989,7 @@ index 86fafc6..47ffa63 100644
  	retval = bprm_mm_init(bprm);
  	if (retval)
  		goto out_file;
-@@ -1412,12 +1489,47 @@ int do_execve(char * filename,
+@@ -1412,12 +1500,47 @@ int do_execve(char * filename,
  	if (retval < 0)
  		goto out;
  
@@ -48779,7 +49038,7 @@ index 86fafc6..47ffa63 100644
  	current->fs->in_exec = 0;
  	current->in_execve = 0;
  	acct_update_integrals(current);
-@@ -1426,6 +1538,14 @@ int do_execve(char * filename,
+@@ -1426,6 +1549,14 @@ int do_execve(char * filename,
  		put_files_struct(displaced);
  	return retval;
  
@@ -48794,7 +49053,7 @@ index 86fafc6..47ffa63 100644
  out:
  	if (bprm->mm) {
  		acct_arg_size(bprm, 0);
-@@ -1591,6 +1711,220 @@ out:
+@@ -1591,6 +1722,220 @@ out:
  	return ispipe;
  }
  
@@ -49015,7 +49274,7 @@ index 86fafc6..47ffa63 100644
  static int zap_process(struct task_struct *start)
  {
  	struct task_struct *t;
-@@ -1793,17 +2127,17 @@ static void wait_for_dump_helpers(struct file *file)
+@@ -1793,17 +2138,17 @@ static void wait_for_dump_helpers(struct file *file)
  	pipe = file->f_path.dentry->d_inode->i_pipe;
  
  	pipe_lock(pipe);
@@ -49038,7 +49297,7 @@ index 86fafc6..47ffa63 100644
  	pipe_unlock(pipe);
  
  }
-@@ -1826,10 +2160,13 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -1826,10 +2171,13 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  	char **helper_argv = NULL;
  	int helper_argc = 0;
  	int dump_count = 0;
@@ -49053,7 +49312,7 @@ index 86fafc6..47ffa63 100644
  	binfmt = mm->binfmt;
  	if (!binfmt || !binfmt->core_dump)
  		goto fail;
-@@ -1874,6 +2211,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -1874,6 +2222,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  	 */
  	clear_thread_flag(TIF_SIGPENDING);
  
@@ -49062,7 +49321,7 @@ index 86fafc6..47ffa63 100644
  	/*
  	 * lock_kernel() because format_corename() is controlled by sysctl, which
  	 * uses lock_kernel()
-@@ -1908,7 +2247,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -1908,7 +2258,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  			goto fail_unlock;
  		}
  
@@ -49071,7 +49330,7 @@ index 86fafc6..47ffa63 100644
  		if (core_pipe_limit && (core_pipe_limit < dump_count)) {
  			printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
  			       task_tgid_vnr(current), current->comm);
-@@ -1972,7 +2311,7 @@ close_fail:
+@@ -1972,7 +2322,7 @@ close_fail:
  	filp_close(file, NULL);
  fail_dropcount:
  	if (dump_count)
@@ -49462,7 +49721,7 @@ index a24c58e..53f91ee 100644
  
  	if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
 diff --git a/fs/fs_struct.c b/fs/fs_struct.c
-index eee0590..ef5bc0e 100644
+index eee0590..1181166 100644
 --- a/fs/fs_struct.c
 +++ b/fs/fs_struct.c
 @@ -4,6 +4,7 @@
@@ -49519,7 +49778,14 @@ index eee0590..ef5bc0e 100644
  	write_unlock(&fs->lock);
  	task_unlock(current);
  
-@@ -147,7 +152,7 @@ EXPORT_SYMBOL(current_umask);
+@@ -141,13 +146,13 @@ EXPORT_SYMBOL_GPL(unshare_fs_struct);
+ 
+ int current_umask(void)
+ {
+-	return current->fs->umask;
++	return current->fs->umask | gr_acl_umask();
+ }
+ EXPORT_SYMBOL(current_umask);
  
  /* to be mentioned only in INIT_TASK */
  struct fs_struct init_fs = {
@@ -52304,7 +52570,7 @@ index 9f55be4..a3f8048 100644
  	/* Copy the blockcheck stats from the superblock probe */
  	osb->osb_ecc_stats = *stats;
 diff --git a/fs/open.c b/fs/open.c
-index 4f01e06..091f6c3 100644
+index 4f01e06..2a8057a 100644
 --- a/fs/open.c
 +++ b/fs/open.c
 @@ -275,6 +275,10 @@ static long do_sys_truncate(const char __user *pathname, loff_t length)
@@ -52365,63 +52631,110 @@ index 4f01e06..091f6c3 100644
  	error = 0;
  dput_and_out:
  	path_put(&path);
-@@ -616,12 +638,27 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd, mode_t, mode)
- 	err = mnt_want_write_file(file);
- 	if (err)
- 		goto out_putf;
-+
- 	mutex_lock(&inode->i_mutex);
+@@ -596,66 +618,57 @@ out:
+ 	return error;
+ }
+ 
++static int chmod_common(struct path *path, umode_t mode)
++{
++	struct inode *inode = path->dentry->d_inode;
++	struct iattr newattrs;
++	int error;
 +
-+	if (!gr_acl_handle_fchmod(dentry, file->f_path.mnt, mode)) {
-+		err = -EACCES;
++	error = mnt_want_write(path->mnt);
++	if (error)
++		return error;
++	mutex_lock(&inode->i_mutex);
++	if (!gr_acl_handle_chmod(path->dentry, path->mnt, &mode)) {
++		error = -EACCES;
 +		goto out_unlock;
 +	}
-+
- 	if (mode == (mode_t) -1)
- 		mode = inode->i_mode;
-+
-+	if (gr_handle_chroot_chmod(dentry, file->f_path.mnt, mode)) {
-+		err = -EPERM;
++	if (gr_handle_chroot_chmod(path->dentry, path->mnt, mode)) {
++		error = -EPERM;
 +		goto out_unlock;
 +	}
-+
- 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
- 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
- 	err = notify_change(dentry, &newattrs);
-+
++	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
++	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
++	error = notify_change(path->dentry, &newattrs);
 +out_unlock:
- 	mutex_unlock(&inode->i_mutex);
- 	mnt_drop_write(file->f_path.mnt);
- out_putf:
-@@ -645,12 +682,27 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename, mode_t, mode)
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto dput_and_out;
-+
- 	mutex_lock(&inode->i_mutex);
++	mutex_unlock(&inode->i_mutex);
++	mnt_drop_write(path->mnt);
++	return error;
++}
 +
-+	if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
-+		error = -EACCES;
-+		goto out_unlock;
+ SYSCALL_DEFINE2(fchmod, unsigned int, fd, mode_t, mode)
+ {
+-	struct inode * inode;
+-	struct dentry * dentry;
+ 	struct file * file;
+ 	int err = -EBADF;
+-	struct iattr newattrs;
+ 
+ 	file = fget(fd);
+-	if (!file)
+-		goto out;
+-
+-	dentry = file->f_path.dentry;
+-	inode = dentry->d_inode;
+-
+-	audit_inode(NULL, dentry);
+-
+-	err = mnt_want_write_file(file);
+-	if (err)
+-		goto out_putf;
+-	mutex_lock(&inode->i_mutex);
+-	if (mode == (mode_t) -1)
+-		mode = inode->i_mode;
+-	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
+-	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
+-	err = notify_change(dentry, &newattrs);
+-	mutex_unlock(&inode->i_mutex);
+-	mnt_drop_write(file->f_path.mnt);
+-out_putf:
+-	fput(file);
+-out:
++	if (file) {
++		audit_inode(NULL, file->f_path.dentry);
++		err = chmod_common(&file->f_path, mode);
++		fput(file);
 +	}
-+
- 	if (mode == (mode_t) -1)
- 		mode = inode->i_mode;
-+
-+	if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
-+		error = -EACCES;
-+		goto out_unlock;
+ 	return err;
+ }
+ 
+ SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename, mode_t, mode)
+ {
+ 	struct path path;
+-	struct inode *inode;
+ 	int error;
+-	struct iattr newattrs;
+ 
+ 	error = user_path_at(dfd, filename, LOOKUP_FOLLOW, &path);
+-	if (error)
+-		goto out;
+-	inode = path.dentry->d_inode;
+-
+-	error = mnt_want_write(path.mnt);
+-	if (error)
+-		goto dput_and_out;
+-	mutex_lock(&inode->i_mutex);
+-	if (mode == (mode_t) -1)
+-		mode = inode->i_mode;
+-	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
+-	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
+-	error = notify_change(path.dentry, &newattrs);
+-	mutex_unlock(&inode->i_mutex);
+-	mnt_drop_write(path.mnt);
+-dput_and_out:
+-	path_put(&path);
+-out:
++	if (!error) {
++		error = chmod_common(&path, mode);
++		path_put(&path);
 +	}
-+
- 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
- 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
- 	error = notify_change(path.dentry, &newattrs);
-+
-+out_unlock:
- 	mutex_unlock(&inode->i_mutex);
- 	mnt_drop_write(path.mnt);
- dput_and_out:
-@@ -664,12 +716,15 @@ SYSCALL_DEFINE2(chmod, const char __user *, filename, mode_t, mode)
+ 	return error;
+ }
+ 
+@@ -664,12 +677,15 @@ SYSCALL_DEFINE2(chmod, const char __user *, filename, mode_t, mode)
  	return sys_fchmodat(AT_FDCWD, filename, mode);
  }
  
@@ -52438,7 +52751,7 @@ index 4f01e06..091f6c3 100644
  	newattrs.ia_valid =  ATTR_CTIME;
  	if (user != (uid_t) -1) {
  		newattrs.ia_valid |= ATTR_UID;
-@@ -700,7 +755,7 @@ SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group)
+@@ -700,7 +716,7 @@ SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group)
  	error = mnt_want_write(path.mnt);
  	if (error)
  		goto out_release;
@@ -52447,7 +52760,7 @@ index 4f01e06..091f6c3 100644
  	mnt_drop_write(path.mnt);
  out_release:
  	path_put(&path);
-@@ -725,7 +780,7 @@ SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user,
+@@ -725,7 +741,7 @@ SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user,
  	error = mnt_want_write(path.mnt);
  	if (error)
  		goto out_release;
@@ -52456,7 +52769,7 @@ index 4f01e06..091f6c3 100644
  	mnt_drop_write(path.mnt);
  out_release:
  	path_put(&path);
-@@ -744,7 +799,7 @@ SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group
+@@ -744,7 +760,7 @@ SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group
  	error = mnt_want_write(path.mnt);
  	if (error)
  		goto out_release;
@@ -52465,7 +52778,7 @@ index 4f01e06..091f6c3 100644
  	mnt_drop_write(path.mnt);
  out_release:
  	path_put(&path);
-@@ -767,7 +822,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group)
+@@ -767,7 +783,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group)
  		goto out_fput;
  	dentry = file->f_path.dentry;
  	audit_inode(NULL, dentry);
@@ -52474,7 +52787,7 @@ index 4f01e06..091f6c3 100644
  	mnt_drop_write(file->f_path.mnt);
  out_fput:
  	fput(file);
-@@ -1036,7 +1091,7 @@ long do_sys_open(int dfd, const char __user *filename, int flags, int mode)
+@@ -1036,7 +1052,7 @@ long do_sys_open(int dfd, const char __user *filename, int flags, int mode)
  	if (!IS_ERR(tmp)) {
  		fd = get_unused_fd_flags(flags);
  		if (fd >= 0) {
@@ -52856,7 +53169,7 @@ index c5ef152..24a1b87 100644
 +}
 +#endif
 diff --git a/fs/proc/base.c b/fs/proc/base.c
-index 67f7dc0..67ab883 100644
+index 67f7dc0..a86ad9a 100644
 --- a/fs/proc/base.c
 +++ b/fs/proc/base.c
 @@ -102,6 +102,22 @@ struct pid_entry {
@@ -52979,7 +53292,15 @@ index 67f7dc0..67ab883 100644
  		put_task_struct(task);
  	}
  	return allowed;
-@@ -809,6 +850,8 @@ static int mem_open(struct inode* inode, struct file* file)
+@@ -806,9 +847,16 @@ static const struct file_operations proc_single_file_operations = {
+ static int mem_open(struct inode* inode, struct file* file)
+ {
+ 	file->private_data = (void*)((long)current->self_exec_id);
++
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	file->f_version = current->exec_id;
++#endif
++
  	return 0;
  }
  
@@ -52988,20 +53309,21 @@ index 67f7dc0..67ab883 100644
  static ssize_t mem_read(struct file * file, char __user * buf,
  			size_t count, loff_t *ppos)
  {
-@@ -824,6 +867,12 @@ static ssize_t mem_read(struct file * file, char __user * buf,
- 	if (check_mem_permission(task))
- 		goto out;
+@@ -818,6 +866,13 @@ static ssize_t mem_read(struct file * file, char __user * buf,
+ 	int ret = -ESRCH;
+ 	struct mm_struct *mm;
  
-+	// XXX: temporary workaround
-+	if (!task_dumpable(task) && task == current) {
-+		ret = -EACCES;
-+		goto out;
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	if (file->f_version != current->exec_id) {
++		gr_log_badprocpid("mem");
++		return 0;
 +	}
++#endif
 +
- 	ret = -ENOMEM;
- 	page = (char *)__get_free_page(GFP_TEMPORARY);
- 	if (!page)
-@@ -963,6 +1012,9 @@ static ssize_t environ_read(struct file *file, char __user *buf,
+ 	if (!task)
+ 		goto out_no_task;
+ 
+@@ -963,6 +1018,9 @@ static ssize_t environ_read(struct file *file, char __user *buf,
  	if (!task)
  		goto out_no_task;
  
@@ -53011,7 +53333,7 @@ index 67f7dc0..67ab883 100644
  	if (!ptrace_may_access(task, PTRACE_MODE_READ))
  		goto out;
  
-@@ -1377,7 +1429,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
+@@ -1377,7 +1435,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
  	path_put(&nd->path);
  
  	/* Are we allowed to snoop on the tasks file descriptors? */
@@ -53020,7 +53342,7 @@ index 67f7dc0..67ab883 100644
  		goto out;
  
  	error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
-@@ -1417,8 +1469,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
+@@ -1417,8 +1475,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
  	struct path path;
  
  	/* Are we allowed to snoop on the tasks file descriptors? */
@@ -53041,7 +53363,7 @@ index 67f7dc0..67ab883 100644
  
  	error = PROC_I(inode)->op.proc_get_link(inode, &path);
  	if (error)
-@@ -1483,7 +1545,11 @@ static struct inode *proc_pid_make_inode(struct super_block * sb, struct task_st
+@@ -1483,7 +1551,11 @@ static struct inode *proc_pid_make_inode(struct super_block * sb, struct task_st
  		rcu_read_lock();
  		cred = __task_cred(task);
  		inode->i_uid = cred->euid;
@@ -53053,7 +53375,7 @@ index 67f7dc0..67ab883 100644
  		rcu_read_unlock();
  	}
  	security_task_to_inode(task, inode);
-@@ -1501,6 +1567,9 @@ static int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat
+@@ -1501,6 +1573,9 @@ static int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat
  	struct inode *inode = dentry->d_inode;
  	struct task_struct *task;
  	const struct cred *cred;
@@ -53063,7 +53385,7 @@ index 67f7dc0..67ab883 100644
  
  	generic_fillattr(inode, stat);
  
-@@ -1508,13 +1577,41 @@ static int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat
+@@ -1508,13 +1583,41 @@ static int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat
  	stat->uid = 0;
  	stat->gid = 0;
  	task = pid_task(proc_pid(inode), PIDTYPE_PID);
@@ -53106,7 +53428,7 @@ index 67f7dc0..67ab883 100644
  	}
  	rcu_read_unlock();
  	return 0;
-@@ -1545,11 +1642,20 @@ static int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
+@@ -1545,11 +1648,20 @@ static int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
  
  	if (task) {
  		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
@@ -53127,7 +53449,7 @@ index 67f7dc0..67ab883 100644
  			rcu_read_unlock();
  		} else {
  			inode->i_uid = 0;
-@@ -1670,7 +1776,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
+@@ -1670,7 +1782,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
  	int fd = proc_fd(inode);
  
  	if (task) {
@@ -53137,7 +53459,7 @@ index 67f7dc0..67ab883 100644
  		put_task_struct(task);
  	}
  	if (files) {
-@@ -1922,12 +2029,22 @@ static const struct file_operations proc_fd_operations = {
+@@ -1922,12 +2035,22 @@ static const struct file_operations proc_fd_operations = {
  static int proc_fd_permission(struct inode *inode, int mask)
  {
  	int rv;
@@ -53162,7 +53484,7 @@ index 67f7dc0..67ab883 100644
  	return rv;
  }
  
-@@ -2036,6 +2153,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
+@@ -2036,6 +2159,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
  	if (!task)
  		goto out_no_task;
  
@@ -53172,7 +53494,7 @@ index 67f7dc0..67ab883 100644
  	/*
  	 * Yes, it does not scale. And it should not. Don't add
  	 * new entries into /proc/<tgid>/ without very good reasons.
-@@ -2080,6 +2200,9 @@ static int proc_pident_readdir(struct file *filp,
+@@ -2080,6 +2206,9 @@ static int proc_pident_readdir(struct file *filp,
  	if (!task)
  		goto out_no_task;
  
@@ -53182,7 +53504,7 @@ index 67f7dc0..67ab883 100644
  	ret = 0;
  	i = filp->f_pos;
  	switch (i) {
-@@ -2347,7 +2470,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
+@@ -2347,7 +2476,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
  static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
  				void *cookie)
  {
@@ -53191,7 +53513,7 @@ index 67f7dc0..67ab883 100644
  	if (!IS_ERR(s))
  		__putname(s);
  }
-@@ -2553,7 +2676,7 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2553,7 +2682,7 @@ static const struct pid_entry tgid_base_stuff[] = {
  #ifdef CONFIG_SCHED_DEBUG
  	REG("sched",      S_IRUGO|S_IWUSR, proc_pid_sched_operations),
  #endif
@@ -53200,7 +53522,7 @@ index 67f7dc0..67ab883 100644
  	INF("syscall",    S_IRUGO, proc_pid_syscall),
  #endif
  	INF("cmdline",    S_IRUGO, proc_pid_cmdline),
-@@ -2578,10 +2701,10 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2578,10 +2707,10 @@ static const struct pid_entry tgid_base_stuff[] = {
  #ifdef CONFIG_SECURITY
  	DIR("attr",       S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
  #endif
@@ -53213,7 +53535,7 @@ index 67f7dc0..67ab883 100644
  	ONE("stack",      S_IRUGO, proc_pid_stack),
  #endif
  #ifdef CONFIG_SCHEDSTATS
-@@ -2611,6 +2734,9 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2611,6 +2740,9 @@ static const struct pid_entry tgid_base_stuff[] = {
  #ifdef CONFIG_TASK_IO_ACCOUNTING
  	INF("io",	S_IRUSR, proc_tgid_io_accounting),
  #endif
@@ -53223,7 +53545,7 @@ index 67f7dc0..67ab883 100644
  };
  
  static int proc_tgid_base_readdir(struct file * filp,
-@@ -2735,7 +2861,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
+@@ -2735,7 +2867,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
  	if (!inode)
  		goto out;
  
@@ -53238,7 +53560,7 @@ index 67f7dc0..67ab883 100644
  	inode->i_op = &proc_tgid_base_inode_operations;
  	inode->i_fop = &proc_tgid_base_operations;
  	inode->i_flags|=S_IMMUTABLE;
-@@ -2777,7 +2910,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
+@@ -2777,7 +2916,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
  	if (!task)
  		goto out;
  
@@ -53250,7 +53572,7 @@ index 67f7dc0..67ab883 100644
  	put_task_struct(task);
  out:
  	return result;
-@@ -2842,6 +2979,11 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
+@@ -2842,6 +2985,11 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
  {
  	unsigned int nr;
  	struct task_struct *reaper;
@@ -53262,7 +53584,7 @@ index 67f7dc0..67ab883 100644
  	struct tgid_iter iter;
  	struct pid_namespace *ns;
  
-@@ -2865,8 +3007,27 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
+@@ -2865,8 +3013,27 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
  	for (iter = next_tgid(ns, iter);
  	     iter.task;
  	     iter.tgid += 1, iter = next_tgid(ns, iter)) {
@@ -53291,7 +53613,7 @@ index 67f7dc0..67ab883 100644
  			put_task_struct(iter.task);
  			goto out;
  		}
-@@ -2892,7 +3053,7 @@ static const struct pid_entry tid_base_stuff[] = {
+@@ -2892,7 +3059,7 @@ static const struct pid_entry tid_base_stuff[] = {
  #ifdef CONFIG_SCHED_DEBUG
  	REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
  #endif
@@ -53300,7 +53622,7 @@ index 67f7dc0..67ab883 100644
  	INF("syscall",   S_IRUGO, proc_pid_syscall),
  #endif
  	INF("cmdline",   S_IRUGO, proc_pid_cmdline),
-@@ -2916,10 +3077,10 @@ static const struct pid_entry tid_base_stuff[] = {
+@@ -2916,10 +3083,10 @@ static const struct pid_entry tid_base_stuff[] = {
  #ifdef CONFIG_SECURITY
  	DIR("attr",      S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
  #endif
@@ -54234,10 +54556,18 @@ index fd38ce2..f5381b8 100644
  		return -EINVAL;
  
 diff --git a/fs/seq_file.c b/fs/seq_file.c
-index eae7d9d..12c71e3 100644
+index eae7d9d..4ddabe2 100644
 --- a/fs/seq_file.c
 +++ b/fs/seq_file.c
-@@ -40,6 +40,9 @@ int seq_open(struct file *file, const struct seq_operations *op)
+@@ -9,6 +9,7 @@
+ #include <linux/module.h>
+ #include <linux/seq_file.h>
+ #include <linux/slab.h>
++#include <linux/sched.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/page.h>
+@@ -40,6 +41,9 @@ int seq_open(struct file *file, const struct seq_operations *op)
  	memset(p, 0, sizeof(*p));
  	mutex_init(&p->lock);
  	p->op = op;
@@ -54247,7 +54577,7 @@ index eae7d9d..12c71e3 100644
  
  	/*
  	 * Wrappers around seq_open(e.g. swaps_open) need to be
-@@ -76,7 +79,8 @@ static int traverse(struct seq_file *m, loff_t offset)
+@@ -76,7 +80,8 @@ static int traverse(struct seq_file *m, loff_t offset)
  		return 0;
  	}
  	if (!m->buf) {
@@ -54257,7 +54587,7 @@ index eae7d9d..12c71e3 100644
  		if (!m->buf)
  			return -ENOMEM;
  	}
-@@ -116,7 +120,8 @@ static int traverse(struct seq_file *m, loff_t offset)
+@@ -116,7 +121,8 @@ static int traverse(struct seq_file *m, loff_t offset)
  Eoverflow:
  	m->op->stop(m, p);
  	kfree(m->buf);
@@ -54267,7 +54597,7 @@ index eae7d9d..12c71e3 100644
  	return !m->buf ? -ENOMEM : -EAGAIN;
  }
  
-@@ -169,7 +174,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
+@@ -169,7 +175,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
  	m->version = file->f_version;
  	/* grab buffer if we didn't have one */
  	if (!m->buf) {
@@ -54277,7 +54607,7 @@ index eae7d9d..12c71e3 100644
  		if (!m->buf)
  			goto Enomem;
  	}
-@@ -210,7 +216,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
+@@ -210,7 +217,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
  			goto Fill;
  		m->op->stop(m, p);
  		kfree(m->buf);
@@ -54287,7 +54617,7 @@ index eae7d9d..12c71e3 100644
  		if (!m->buf)
  			goto Enomem;
  		m->count = 0;
-@@ -551,7 +558,7 @@ static void single_stop(struct seq_file *p, void *v)
+@@ -551,7 +559,7 @@ static void single_stop(struct seq_file *p, void *v)
  int single_open(struct file *file, int (*show)(struct seq_file *, void *),
  		void *data)
  {
@@ -54912,10 +55242,10 @@ index 8f32f50..b6a41e8 100644
  		link[pathlen] = '\0';
 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
 new file mode 100644
-index 0000000..9ac9020
+index 0000000..7026cbd
 --- /dev/null
 +++ b/grsecurity/Kconfig
-@@ -0,0 +1,1072 @@
+@@ -0,0 +1,1074 @@
 +#
 +# grecurity configuration
 +#
@@ -55122,7 +55452,7 @@ index 0000000..9ac9020
 +
 +endchoice
 +
-+menu "Address Space Protection"
++menu "Memory Protections"
 +depends on GRKERNSEC
 +
 +config GRKERNSEC_KMEM
@@ -55179,7 +55509,7 @@ index 0000000..9ac9020
 +	  protect your kernel against modification, use the RBAC system.
 +
 +config GRKERNSEC_PROC_MEMMAP
-+	bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
++	bool "Harden ASLR against information leaks and entropy reduction"
 +	default y if (PAX_NOEXEC || PAX_ASLR)
 +	depends on PAX_NOEXEC || PAX_ASLR
 +	help
@@ -55190,9 +55520,11 @@ index 0000000..9ac9020
 +	  dangerous sources of information, this option causes reads of sensitive
 +	  /proc/<pid> entries where the file descriptor was opened in a different
 +	  task than the one performing the read.  Such attempts are logged.
-+	  If you use PaX it is greatly recommended that you say Y here as it
-+	  closes up a hole that makes the full ASLR useless for suid
-+	  binaries.
++	  Finally, this option limits argv/env strings for suid/sgid binaries
++	  to 1MB to prevent a complete exhaustion of the stack entropy provided
++	  by ASLR.
++	  If you use PaX it is essential that you say Y here as it closes up
++	  several holes that make full ASLR useless for suid/sgid binaries.
 +
 +config GRKERNSEC_BRUTE
 +	bool "Deter exploit bruteforcing"
@@ -56034,10 +56366,10 @@ index 0000000..1b9afa9
 +endif
 diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
 new file mode 100644
-index 0000000..78e83d8
+index 0000000..b1c4f4d
 --- /dev/null
 +++ b/grsecurity/gracl.c
-@@ -0,0 +1,4148 @@
+@@ -0,0 +1,4149 @@
 +#include <linux/kernel.h>
 +#include <linux/module.h>
 +#include <linux/sched.h>
@@ -58294,17 +58626,18 @@ index 0000000..78e83d8
 +void
 +gr_copy_label(struct task_struct *tsk)
 +{
++	/* plain copying of fields is already done by dup_task_struct */
 +	tsk->signal->used_accept = 0;
 +	tsk->acl_sp_role = 0;
-+	tsk->acl_role_id = current->acl_role_id;
-+	tsk->acl = current->acl;
-+	tsk->role = current->role;
++	//tsk->acl_role_id = current->acl_role_id;
++	//tsk->acl = current->acl;
++	//tsk->role = current->role;
 +	tsk->signal->curr_ip = current->signal->curr_ip;
 +	tsk->signal->saved_ip = current->signal->saved_ip;
 +	if (current->exec_file)
 +		get_file(current->exec_file);
-+	tsk->exec_file = current->exec_file;
-+	tsk->is_writable = current->is_writable;
++	//tsk->exec_file = current->exec_file;
++	//tsk->is_writable = current->is_writable;
 +	if (unlikely(current->signal->used_accept)) {
 +		current->signal->curr_ip = 0;
 +		current->signal->saved_ip = 0;
@@ -58516,8 +58849,8 @@ index 0000000..78e83d8
 +
 +	/* don't change the role if we're not a privileged process */
 +	if (role && task->role != role &&
-+	    (((role->roletype & GR_ROLE_USER) && gr_acl_is_capable(CAP_SETUID)) ||
-+	     ((role->roletype & GR_ROLE_GROUP) && gr_acl_is_capable(CAP_SETGID))))
++	    (((role->roletype & GR_ROLE_USER) && !gr_acl_is_capable(CAP_SETUID)) ||
++	     ((role->roletype & GR_ROLE_GROUP) && !gr_acl_is_capable(CAP_SETGID))))
 +		return;
 +
 +	/* perform subject lookup in possibly new role
@@ -60406,10 +60739,10 @@ index 0000000..955ddfb
 +
 diff --git a/grsecurity/gracl_fs.c b/grsecurity/gracl_fs.c
 new file mode 100644
-index 0000000..d5f210c
+index 0000000..523e7e8
 --- /dev/null
 +++ b/grsecurity/gracl_fs.c
-@@ -0,0 +1,433 @@
+@@ -0,0 +1,435 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/types.h>
@@ -60420,6 +60753,15 @@ index 0000000..d5f210c
 +#include <linux/grinternal.h>
 +#include <linux/gracl.h>
 +
++umode_t
++gr_acl_umask(void)
++{
++	if (unlikely(!gr_acl_is_enabled()))
++		return 0;
++
++	return current->role->umask;
++}
++
 +__u32
 +gr_acl_handle_hidden_file(const struct dentry * dentry,
 +			  const struct vfsmount * mnt)
@@ -60608,25 +60950,18 @@ index 0000000..d5f210c
 +}
 +
 +__u32
-+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
-+		     mode_t mode)
++gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
++		     umode_t *modeptr)
 +{
++	mode_t mode;
++
++	*modeptr &= ~(mode_t)gr_acl_umask();
++	mode = *modeptr;
++
 +	if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
 +		return 1;
 +
-+	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
-+				   GR_FCHMOD_ACL_MSG);
-+	} else {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
-+	}
-+}
-+
-+__u32
-+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
-+		    mode_t mode)
-+{
-+	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
++	if (unlikely(mode & (S_ISUID | S_ISGID))) {
 +		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
 +				   GR_CHMOD_ACL_MSG);
 +	} else {
@@ -62273,10 +62608,10 @@ index 0000000..197bdd5
 +}
 diff --git a/grsecurity/grsec_disabled.c b/grsecurity/grsec_disabled.c
 new file mode 100644
-index 0000000..b81db5b
+index 0000000..40545bf
 --- /dev/null
 +++ b/grsecurity/grsec_disabled.c
-@@ -0,0 +1,439 @@
+@@ -0,0 +1,437 @@
 +#include <linux/kernel.h>
 +#include <linux/module.h>
 +#include <linux/sched.h>
@@ -62516,15 +62851,8 @@ index 0000000..b81db5b
 +}
 +
 +__u32
-+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
-+		     mode_t mode)
-+{
-+	return 1;
-+}
-+
-+__u32
 +gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
-+		    mode_t mode)
++		    umode_t *mode)
 +{
 +	return 1;
 +}
@@ -62547,6 +62875,11 @@ index 0000000..b81db5b
 +	return;
 +}
 +
++umode_t gr_acl_umask(void)
++{
++	return 0;
++}
++
 +__u32
 +gr_acl_handle_mknod(const struct dentry * new_dentry,
 +		    const struct dentry * parent_dentry,
@@ -66602,10 +66935,10 @@ index 297df45..b6a74ff 100644
  	struct blk_integrity *integrity;
 diff --git a/include/linux/gracl.h b/include/linux/gracl.h
 new file mode 100644
-index 0000000..0dc3943
+index 0000000..af663cf
 --- /dev/null
 +++ b/include/linux/gracl.h
-@@ -0,0 +1,317 @@
+@@ -0,0 +1,319 @@
 +#ifndef GR_ACL_H
 +#define GR_ACL_H
 +
@@ -66617,8 +66950,8 @@ index 0000000..0dc3943
 +
 +/* Major status information */
 +
-+#define GR_VERSION  "grsecurity 2.2.2"
-+#define GRSECURITY_VERSION 0x2202
++#define GR_VERSION  "grsecurity 2.9"
++#define GRSECURITY_VERSION 0x2900
 +
 +enum {
 +	GR_SHUTDOWN = 0,
@@ -66781,6 +67114,8 @@ index 0000000..0dc3943
 +	uid_t *domain_children;
 +	__u16 domain_child_num;
 +
++	mode_t umask;
++
 +	struct acl_subject_label **subj_hash;
 +	__u32 subj_hash_size;
 +};
@@ -67311,10 +67646,10 @@ index 0000000..3826b91
 +#endif
 diff --git a/include/linux/grmsg.h b/include/linux/grmsg.h
 new file mode 100644
-index 0000000..8b9ed56
+index 0000000..f885406
 --- /dev/null
 +++ b/include/linux/grmsg.h
-@@ -0,0 +1,110 @@
+@@ -0,0 +1,109 @@
 +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
 +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
 +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
@@ -67358,7 +67693,6 @@ index 0000000..8b9ed56
 +#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
 +#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
 +#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
-+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
 +#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
 +#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
 +#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
@@ -67427,7 +67761,7 @@ index 0000000..8b9ed56
 +#define GR_BADPROCPID_MSG "denied read of sensitive /proc/pid/%s entry via fd passed across exec by "
 diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
 new file mode 100644
-index 0000000..bb1e366
+index 0000000..c1793ae
 --- /dev/null
 +++ b/include/linux/grsecurity.h
 @@ -0,0 +1,219 @@
@@ -67492,6 +67826,8 @@ index 0000000..bb1e366
 +void gr_handle_ioperm(void);
 +void gr_handle_iopl(void);
 +
++umode_t gr_acl_umask(void);
++
 +int gr_tpe_allow(const struct file *file);
 +
 +void gr_set_chroot_entries(struct task_struct *task, struct path *path);
@@ -67549,10 +67885,8 @@ index 0000000..bb1e366
 +				 const struct vfsmount *mnt);
 +__u32 gr_acl_handle_access(const struct dentry *dentry,
 +				  const struct vfsmount *mnt, const int fmode);
-+__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
-+				  const struct vfsmount *mnt, mode_t mode);
 +__u32 gr_acl_handle_chmod(const struct dentry *dentry,
-+				 const struct vfsmount *mnt, mode_t mode);
++				 const struct vfsmount *mnt, umode_t *mode);
 +__u32 gr_acl_handle_chown(const struct dentry *dentry,
 +				 const struct vfsmount *mnt);
 +__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
@@ -68568,18 +68902,19 @@ index 34066ff..e95d744 100644
  /********** include/linux/timer.h **********/
  /*
 diff --git a/include/linux/posix-timers.h b/include/linux/posix-timers.h
-index 4f71bf4..77ffa64 100644
+index 4f71bf4..cd2f68e 100644
 --- a/include/linux/posix-timers.h
 +++ b/include/linux/posix-timers.h
-@@ -67,7 +67,7 @@ struct k_itimer {
- };
+@@ -82,7 +82,8 @@ struct k_clock {
+ #define TIMER_RETRY 1
+ 	void (*timer_get) (struct k_itimer * timr,
+ 			   struct itimerspec * cur_setting);
+-};
++} __do_const;
++typedef struct k_clock __no_const k_clock_no_const;
+ 
+ void register_posix_clock(const clockid_t clock_id, struct k_clock *new_clock);
  
- struct k_clock {
--	int res;		/* in nanoseconds */
-+	const int res;		/* in nanoseconds */
- 	int (*clock_getres) (const clockid_t which_clock, struct timespec *tp);
- 	int (*clock_set) (const clockid_t which_clock, struct timespec * tp);
- 	int (*clock_get) (const clockid_t which_clock, struct timespec * tp);
 diff --git a/include/linux/preempt.h b/include/linux/preempt.h
 index 72b1a10..13303a9 100644
 --- a/include/linux/preempt.h
@@ -68787,7 +69122,7 @@ index 3392c59..a746428 100644
  #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
  /**
 diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 71849bf..03ceae8 100644
+index 71849bf..2ef383dc3 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
 @@ -101,6 +101,7 @@ struct bio;
@@ -68922,7 +69257,7 @@ index 71849bf..03ceae8 100644
 +#ifdef CONFIG_GRKERNSEC
 +	/* grsecurity */
 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	long long exec_id;
++	u64 exec_id;
 +#endif
 +#ifdef CONFIG_GRKERNSEC_SETXID
 +	const struct cred *delayed_cred;
@@ -69130,7 +69465,7 @@ index d40d23f..d739b08 100644
  
  static inline int security_settime(struct timespec *ts, struct timezone *tz)
 diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
-index 8366d8f..898f3c6 100644
+index 8366d8f..cc5f9d6 100644
 --- a/include/linux/seq_file.h
 +++ b/include/linux/seq_file.h
 @@ -23,6 +23,9 @@ struct seq_file {
@@ -69138,7 +69473,7 @@ index 8366d8f..898f3c6 100644
  	struct mutex lock;
  	const struct seq_operations *op;
 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	long long exec_id;
++	u64 exec_id;
 +#endif
  	void *private;
  };
@@ -71985,7 +72320,7 @@ index 0f8fae3..9344a56 100644
  		get_task_struct(p);
  		read_unlock(&tasklist_lock);
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 4bde56f..a07de53 100644
+index 4bde56f..29a9bab 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -253,7 +253,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
@@ -72083,20 +72418,16 @@ index 4bde56f..a07de53 100644
  
  	retval = copy_creds(p, clone_flags);
  	if (retval < 0)
-@@ -1183,6 +1214,12 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+@@ -1183,6 +1214,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
  			goto bad_fork_free_pid;
  	}
  
 +	gr_copy_label(p);
 +
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	p->exec_id = current->exec_id;
-+#endif
-+
  	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
  	/*
  	 * Clear TID on mm_release()?
-@@ -1333,6 +1370,8 @@ bad_fork_cleanup_count:
+@@ -1333,6 +1366,8 @@ bad_fork_cleanup_count:
  bad_fork_free:
  	free_task(p);
  fork_out:
@@ -72105,7 +72436,7 @@ index 4bde56f..a07de53 100644
  	return ERR_PTR(retval);
  }
  
-@@ -1426,6 +1465,8 @@ long do_fork(unsigned long clone_flags,
+@@ -1426,6 +1461,8 @@ long do_fork(unsigned long clone_flags,
  		if (clone_flags & CLONE_PARENT_SETTID)
  			put_user(nr, parent_tidptr);
  
@@ -72114,7 +72445,7 @@ index 4bde56f..a07de53 100644
  		if (clone_flags & CLONE_VFORK) {
  			p->vfork_done = &vfork;
  			init_completion(&vfork);
-@@ -1558,7 +1599,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1558,7 +1595,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
  		return 0;
  
  	/* don't need lock here; in the worst case we'll do useless copy */
@@ -72123,7 +72454,7 @@ index 4bde56f..a07de53 100644
  		return 0;
  
  	*new_fsp = copy_fs_struct(fs);
-@@ -1681,7 +1722,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -1681,7 +1718,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
  			fs = current->fs;
  			write_lock(&fs->lock);
  			current->fs = new_fs;
@@ -77705,7 +78036,7 @@ index 2d846cf..98134d2 100644
  	    capable(CAP_IPC_LOCK))
  		ret = do_mlockall(flags);
 diff --git a/mm/mmap.c b/mm/mmap.c
-index 4b80cbf..c5ce1df 100644
+index 4b80cbf..cd3731c 100644
 --- a/mm/mmap.c
 +++ b/mm/mmap.c
 @@ -45,6 +45,16 @@
@@ -78332,20 +78663,60 @@ index 4b80cbf..c5ce1df 100644
  }
  
  unsigned long
-@@ -1545,6 +1771,27 @@ out:
- 	return prev ? prev->vm_next : vma;
- }
+@@ -1510,40 +1736,41 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
  
+ EXPORT_SYMBOL(find_vma);
+ 
+-/* Same as find_vma, but also return a pointer to the previous VMA in *pprev. */
++/*
++ * Same as find_vma, but also return a pointer to the previous VMA in *pprev.
++ * Note: pprev is set to NULL when return value is NULL.
++ */
+ struct vm_area_struct *
+ find_vma_prev(struct mm_struct *mm, unsigned long addr,
+ 			struct vm_area_struct **pprev)
+ {
+-	struct vm_area_struct *vma = NULL, *prev = NULL;
+-	struct rb_node *rb_node;
+-	if (!mm)
+-		goto out;
++	struct vm_area_struct *vma;
+ 
+-	/* Guard against addr being lower than the first VMA */
+-	vma = mm->mmap;
++	vma = find_vma(mm, addr);
++	*pprev = vma ? vma->vm_prev : NULL;
++	return vma;
++}
+ 
+-	/* Go through the RB tree quickly. */
+-	rb_node = mm->mm_rb.rb_node;
 +#ifdef CONFIG_PAX_SEGMEXEC
 +struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
 +{
 +	struct vm_area_struct *vma_m;
-+
+ 
+-	while (rb_node) {
+-		struct vm_area_struct *vma_tmp;
+-		vma_tmp = rb_entry(rb_node, struct vm_area_struct, vm_rb);
+-
+-		if (addr < vma_tmp->vm_end) {
+-			rb_node = rb_node->rb_left;
+-		} else {
+-			prev = vma_tmp;
+-			if (!prev->vm_next || (addr < prev->vm_next->vm_end))
+-				break;
+-			rb_node = rb_node->rb_right;
+-		}
 +	BUG_ON(!vma || vma->vm_start >= vma->vm_end);
 +	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
 +		BUG_ON(vma->vm_mirror);
 +		return NULL;
-+	}
+ 	}
+-
+-out:
+-	*pprev = prev;
+-	return prev ? prev->vm_next : vma;
 +	BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
 +	vma_m = vma->vm_mirror;
 +	BUG_ON(!vma_m || vma_m->vm_mirror != vma);
@@ -78354,13 +78725,12 @@ index 4b80cbf..c5ce1df 100644
 +	BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
 +	BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
 +	return vma_m;
-+}
+ }
 +#endif
-+
+ 
  /*
   * Verify that the stack growth is acceptable and
-  * update accounting. This is shared with both the
-@@ -1561,6 +1808,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -1561,6 +1788,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
  		return -ENOMEM;
  
  	/* Stack limit test */
@@ -78368,7 +78738,7 @@ index 4b80cbf..c5ce1df 100644
  	if (size > rlim[RLIMIT_STACK].rlim_cur)
  		return -ENOMEM;
  
-@@ -1570,6 +1818,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -1570,6 +1798,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
  		unsigned long limit;
  		locked = mm->locked_vm + grow;
  		limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
@@ -78376,7 +78746,7 @@ index 4b80cbf..c5ce1df 100644
  		if (locked > limit && !capable(CAP_IPC_LOCK))
  			return -ENOMEM;
  	}
-@@ -1600,37 +1849,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -1600,37 +1829,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
   * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
   * vma is the last one with address > vma->vm_end.  Have to extend vma.
   */
@@ -78434,7 +78804,7 @@ index 4b80cbf..c5ce1df 100644
  		unsigned long size, grow;
  
  		size = address - vma->vm_start;
-@@ -1643,6 +1903,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+@@ -1643,6 +1883,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
  				vma->vm_end = address;
  		}
  	}
@@ -78443,7 +78813,7 @@ index 4b80cbf..c5ce1df 100644
  	anon_vma_unlock(vma);
  	return error;
  }
-@@ -1655,6 +1917,8 @@ static int expand_downwards(struct vm_area_struct *vma,
+@@ -1655,6 +1897,8 @@ static int expand_downwards(struct vm_area_struct *vma,
  				   unsigned long address)
  {
  	int error;
@@ -78452,7 +78822,7 @@ index 4b80cbf..c5ce1df 100644
  
  	/*
  	 * We must make sure the anon_vma is allocated
-@@ -1668,6 +1932,15 @@ static int expand_downwards(struct vm_area_struct *vma,
+@@ -1668,6 +1912,15 @@ static int expand_downwards(struct vm_area_struct *vma,
  	if (error)
  		return error;
  
@@ -78468,7 +78838,7 @@ index 4b80cbf..c5ce1df 100644
  	anon_vma_lock(vma);
  
  	/*
-@@ -1677,9 +1950,17 @@ static int expand_downwards(struct vm_area_struct *vma,
+@@ -1677,9 +1930,17 @@ static int expand_downwards(struct vm_area_struct *vma,
  	 */
  
  	/* Somebody else might have raced and expanded it already */
@@ -78487,7 +78857,7 @@ index 4b80cbf..c5ce1df 100644
  		size = vma->vm_end - address;
  		grow = (vma->vm_start - address) >> PAGE_SHIFT;
  
-@@ -1689,10 +1970,22 @@ static int expand_downwards(struct vm_area_struct *vma,
+@@ -1689,10 +1950,22 @@ static int expand_downwards(struct vm_area_struct *vma,
  			if (!error) {
  				vma->vm_start = address;
  				vma->vm_pgoff -= grow;
@@ -78510,7 +78880,7 @@ index 4b80cbf..c5ce1df 100644
  	return error;
  }
  
-@@ -1768,6 +2061,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -1768,6 +2041,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
  	do {
  		long nrpages = vma_pages(vma);
  
@@ -78524,7 +78894,7 @@ index 4b80cbf..c5ce1df 100644
  		mm->total_vm -= nrpages;
  		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
  		vma = remove_vma(vma);
-@@ -1813,6 +2113,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -1813,6 +2093,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
  	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
  	vma->vm_prev = NULL;
  	do {
@@ -78541,7 +78911,7 @@ index 4b80cbf..c5ce1df 100644
  		rb_erase(&vma->vm_rb, &mm->mm_rb);
  		mm->map_count--;
  		tail_vma = vma;
-@@ -1840,10 +2150,25 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1840,10 +2130,25 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	struct mempolicy *pol;
  	struct vm_area_struct *new;
  
@@ -78567,7 +78937,7 @@ index 4b80cbf..c5ce1df 100644
  	if (mm->map_count >= sysctl_max_map_count)
  		return -ENOMEM;
  
-@@ -1851,6 +2176,16 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1851,6 +2156,16 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	if (!new)
  		return -ENOMEM;
  
@@ -78584,7 +78954,7 @@ index 4b80cbf..c5ce1df 100644
  	/* most fields are the same, copy all, and then fixup */
  	*new = *vma;
  
-@@ -1861,8 +2196,29 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1861,8 +2176,29 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
  	}
  
@@ -78614,7 +78984,7 @@ index 4b80cbf..c5ce1df 100644
  		kmem_cache_free(vm_area_cachep, new);
  		return PTR_ERR(pol);
  	}
-@@ -1883,6 +2239,28 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1883,6 +2219,28 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	else
  		vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
  
@@ -78643,7 +79013,7 @@ index 4b80cbf..c5ce1df 100644
  	return 0;
  }
  
-@@ -1891,11 +2269,30 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1891,11 +2249,30 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
   * work.  This now handles partial unmappings.
   * Jeremy Fitzhardinge <jeremy@goop.org>
   */
@@ -78674,7 +79044,7 @@ index 4b80cbf..c5ce1df 100644
  	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
  		return -EINVAL;
  
-@@ -1959,6 +2356,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+@@ -1959,6 +2336,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
  	/* Fix up all other VM information */
  	remove_vma_list(mm, vma);
  
@@ -78683,7 +79053,7 @@ index 4b80cbf..c5ce1df 100644
  	return 0;
  }
  
-@@ -1971,22 +2370,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+@@ -1971,22 +2350,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
  
  	profile_munmap(addr);
  
@@ -78712,7 +79082,7 @@ index 4b80cbf..c5ce1df 100644
  /*
   *  this is really a simplified "do_mmap".  it only handles
   *  anonymous maps.  eventually we may be able to do some
-@@ -2000,6 +2395,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2000,6 +2375,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	struct rb_node ** rb_link, * rb_parent;
  	pgoff_t pgoff = addr >> PAGE_SHIFT;
  	int error;
@@ -78720,7 +79090,7 @@ index 4b80cbf..c5ce1df 100644
  
  	len = PAGE_ALIGN(len);
  	if (!len)
-@@ -2011,16 +2407,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2011,16 +2387,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  
  	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
  
@@ -78752,7 +79122,7 @@ index 4b80cbf..c5ce1df 100644
  		locked += mm->locked_vm;
  		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
  		lock_limit >>= PAGE_SHIFT;
-@@ -2037,22 +2447,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2037,22 +2427,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	/*
  	 * Clear old maps.  this also does some error checking for us
  	 */
@@ -78779,7 +79149,7 @@ index 4b80cbf..c5ce1df 100644
  		return -ENOMEM;
  
  	/* Can we just expand an old private anonymous mapping? */
-@@ -2066,7 +2476,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2066,7 +2456,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	 */
  	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
  	if (!vma) {
@@ -78788,7 +79158,7 @@ index 4b80cbf..c5ce1df 100644
  		return -ENOMEM;
  	}
  
-@@ -2078,11 +2488,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2078,11 +2468,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	vma->vm_page_prot = vm_get_page_prot(flags);
  	vma_link(mm, vma, prev, rb_link, rb_parent);
  out:
@@ -78803,7 +79173,7 @@ index 4b80cbf..c5ce1df 100644
  	return addr;
  }
  
-@@ -2129,8 +2540,10 @@ void exit_mmap(struct mm_struct *mm)
+@@ -2129,8 +2520,10 @@ void exit_mmap(struct mm_struct *mm)
  	 * Walk the list again, actually closing and freeing it,
  	 * with preemption enabled, without holding any MM locks.
  	 */
@@ -78815,7 +79185,7 @@ index 4b80cbf..c5ce1df 100644
  
  	BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
  }
-@@ -2144,6 +2557,10 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
+@@ -2144,6 +2537,10 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
  	struct vm_area_struct * __vma, * prev;
  	struct rb_node ** rb_link, * rb_parent;
  
@@ -78826,7 +79196,7 @@ index 4b80cbf..c5ce1df 100644
  	/*
  	 * The vm_pgoff of a purely anonymous vma should be irrelevant
  	 * until its first write fault, when page's anon_vma and index
-@@ -2166,7 +2583,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
+@@ -2166,7 +2563,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
  	if ((vma->vm_flags & VM_ACCOUNT) &&
  	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
  		return -ENOMEM;
@@ -78849,7 +79219,7 @@ index 4b80cbf..c5ce1df 100644
  	return 0;
  }
  
-@@ -2184,6 +2616,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2184,6 +2596,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	struct rb_node **rb_link, *rb_parent;
  	struct mempolicy *pol;
  
@@ -78858,7 +79228,7 @@ index 4b80cbf..c5ce1df 100644
  	/*
  	 * If anonymous vma has not yet been faulted, update new pgoff
  	 * to match new location, to increase its chance of merging.
-@@ -2227,6 +2661,35 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2227,6 +2641,35 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	return new_vma;
  }
  
@@ -78894,7 +79264,7 @@ index 4b80cbf..c5ce1df 100644
  /*
   * Return true if the calling process may expand its vm space by the passed
   * number of pages
-@@ -2237,7 +2700,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+@@ -2237,7 +2680,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
  	unsigned long lim;
  
  	lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
@@ -78903,7 +79273,7 @@ index 4b80cbf..c5ce1df 100644
  	if (cur + npages > lim)
  		return 0;
  	return 1;
-@@ -2307,6 +2770,22 @@ int install_special_mapping(struct mm_struct *mm,
+@@ -2307,6 +2750,22 @@ int install_special_mapping(struct mm_struct *mm,
  	vma->vm_start = addr;
  	vma->vm_end = addr + len;
  
@@ -86584,7 +86954,7 @@ index 79633ea..9732e90 100644
  	}
 diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
 new file mode 100644
-index 0000000..b044b80
+index 0000000..29b6b75
 --- /dev/null
 +++ b/tools/gcc/Makefile
 @@ -0,0 +1,21 @@
@@ -86592,9 +86962,9 @@ index 0000000..b044b80
 +#PLUGIN_SOURCE_FILES := pax_plugin.c
 +#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
 +GCCPLUGINS_DIR := $(shell $(CC) -print-file-name=plugin)
-+#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W
++#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W -std=gnu99
 +
-+HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include
++HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include -std=gnu99
 +
 +hostlibs-y := constify_plugin.so
 +hostlibs-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so
@@ -87270,10 +87640,10 @@ index 0000000..a5eabce
 +}
 diff --git a/tools/gcc/kernexec_plugin.c b/tools/gcc/kernexec_plugin.c
 new file mode 100644
-index 0000000..51f747e
+index 0000000..008f159
 --- /dev/null
 +++ b/tools/gcc/kernexec_plugin.c
-@@ -0,0 +1,348 @@
+@@ -0,0 +1,427 @@
 +/*
 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -87321,13 +87691,32 @@ index 0000000..51f747e
 +	.help		= "method=[bts|or]\tinstrumentation method\n"
 +};
 +
++static unsigned int execute_kernexec_reload(void);
 +static unsigned int execute_kernexec_fptr(void);
 +static unsigned int execute_kernexec_retaddr(void);
 +static bool kernexec_cmodel_check(void);
 +
-+static void (*kernexec_instrument_fptr)(gimple_stmt_iterator);
++static void (*kernexec_instrument_fptr)(gimple_stmt_iterator *);
 +static void (*kernexec_instrument_retaddr)(rtx);
 +
++static struct gimple_opt_pass kernexec_reload_pass = {
++	.pass = {
++		.type			= GIMPLE_PASS,
++		.name			= "kernexec_reload",
++		.gate			= kernexec_cmodel_check,
++		.execute		= execute_kernexec_reload,
++		.sub			= NULL,
++		.next			= NULL,
++		.static_pass_number	= 0,
++		.tv_id			= TV_NONE,
++		.properties_required	= 0,
++		.properties_provided	= 0,
++		.properties_destroyed	= 0,
++		.todo_flags_start	= 0,
++		.todo_flags_finish	= TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
++	}
++};
++
 +static struct gimple_opt_pass kernexec_fptr_pass = {
 +	.pass = {
 +		.type			= GIMPLE_PASS,
@@ -87383,15 +87772,66 @@ index 0000000..51f747e
 +}
 +
 +/*
++ * add special KERNEXEC instrumentation: reload %r10 after it has been clobbered
++ */
++static void kernexec_reload_fptr_mask(gimple_stmt_iterator *gsi)
++{
++	gimple asm_movabs_stmt;
++
++	// build asm volatile("movabs $0x8000000000000000, %%r10\n\t" : : : );
++	asm_movabs_stmt = gimple_build_asm_vec("movabs $0x8000000000000000, %%r10\n\t", NULL, NULL, NULL, NULL);
++	gimple_asm_set_volatile(asm_movabs_stmt, true);
++	gsi_insert_after(gsi, asm_movabs_stmt, GSI_CONTINUE_LINKING);
++	update_stmt(asm_movabs_stmt);
++}
++
++/*
++ * find all asm() stmts that clobber r10 and add a reload of r10
++ */
++static unsigned int execute_kernexec_reload(void)
++{
++	basic_block bb;
++
++	// 1. loop through BBs and GIMPLE statements
++	FOR_EACH_BB(bb) {
++		gimple_stmt_iterator gsi;
++
++		for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
++			// gimple match: __asm__ ("" :  :  : "r10");
++			gimple asm_stmt;
++			size_t nclobbers;
++
++			// is it an asm ...
++			asm_stmt = gsi_stmt(gsi);
++			if (gimple_code(asm_stmt) != GIMPLE_ASM)
++				continue;
++
++			// ... clobbering r10
++			nclobbers = gimple_asm_nclobbers(asm_stmt);
++			while (nclobbers--) {
++				tree op = gimple_asm_clobber_op(asm_stmt, nclobbers);
++				if (strcmp(TREE_STRING_POINTER(TREE_VALUE(op)), "r10"))
++					continue;
++				kernexec_reload_fptr_mask(&gsi);
++//print_gimple_stmt(stderr, asm_stmt, 0, TDF_LINENO);
++				break;
++			}
++		}
++	}
++
++	return 0;
++}
++
++/*
 + * add special KERNEXEC instrumentation: force MSB of fptr to 1, which will produce
 + * a non-canonical address from a userland ptr and will just trigger a GPF on dereference
 + */
-+static void kernexec_instrument_fptr_bts(gimple_stmt_iterator gsi)
++static void kernexec_instrument_fptr_bts(gimple_stmt_iterator *gsi)
 +{
 +	gimple assign_intptr, assign_new_fptr, call_stmt;
 +	tree intptr, old_fptr, new_fptr, kernexec_mask;
 +
-+	call_stmt = gsi_stmt(gsi);
++	call_stmt = gsi_stmt(*gsi);
 +	old_fptr = gimple_call_fn(call_stmt);
 +
 +	// create temporary unsigned long variable used for bitops and cast fptr to it
@@ -87399,14 +87839,14 @@ index 0000000..51f747e
 +	add_referenced_var(intptr);
 +	mark_sym_for_renaming(intptr);
 +	assign_intptr = gimple_build_assign(intptr, fold_convert(long_unsigned_type_node, old_fptr));
-+	gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT);
++	gsi_insert_before(gsi, assign_intptr, GSI_SAME_STMT);
 +	update_stmt(assign_intptr);
 +
 +	// apply logical or to temporary unsigned long and bitmask
 +	kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0x8000000000000000LL);
 +//	kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0xffffffff80000000LL);
 +	assign_intptr = gimple_build_assign(intptr, fold_build2(BIT_IOR_EXPR, long_long_unsigned_type_node, intptr, kernexec_mask));
-+	gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT);
++	gsi_insert_before(gsi, assign_intptr, GSI_SAME_STMT);
 +	update_stmt(assign_intptr);
 +
 +	// cast temporary unsigned long back to a temporary fptr variable
@@ -87414,7 +87854,7 @@ index 0000000..51f747e
 +	add_referenced_var(new_fptr);
 +	mark_sym_for_renaming(new_fptr);
 +	assign_new_fptr = gimple_build_assign(new_fptr, fold_convert(TREE_TYPE(old_fptr), intptr));
-+	gsi_insert_before(&gsi, assign_new_fptr, GSI_SAME_STMT);
++	gsi_insert_before(gsi, assign_new_fptr, GSI_SAME_STMT);
 +	update_stmt(assign_new_fptr);
 +
 +	// replace call stmt fn with the new fptr
@@ -87422,14 +87862,14 @@ index 0000000..51f747e
 +	update_stmt(call_stmt);
 +}
 +
-+static void kernexec_instrument_fptr_or(gimple_stmt_iterator gsi)
++static void kernexec_instrument_fptr_or(gimple_stmt_iterator *gsi)
 +{
 +	gimple asm_or_stmt, call_stmt;
 +	tree old_fptr, new_fptr, input, output;
 +	VEC(tree, gc) *inputs = NULL;
 +	VEC(tree, gc) *outputs = NULL;
 +
-+	call_stmt = gsi_stmt(gsi);
++	call_stmt = gsi_stmt(*gsi);
 +	old_fptr = gimple_call_fn(call_stmt);
 +
 +	// create temporary fptr variable
@@ -87446,7 +87886,7 @@ index 0000000..51f747e
 +	VEC_safe_push(tree, gc, outputs, output);
 +	asm_or_stmt = gimple_build_asm_vec("orq %%r10, %0\n\t", inputs, outputs, NULL, NULL);
 +	gimple_asm_set_volatile(asm_or_stmt, true);
-+	gsi_insert_before(&gsi, asm_or_stmt, GSI_SAME_STMT);
++	gsi_insert_before(gsi, asm_or_stmt, GSI_SAME_STMT);
 +	update_stmt(asm_or_stmt);
 +
 +	// replace call stmt fn with the new fptr
@@ -87460,10 +87900,11 @@ index 0000000..51f747e
 +static unsigned int execute_kernexec_fptr(void)
 +{
 +	basic_block bb;
-+	gimple_stmt_iterator gsi;
 +
 +	// 1. loop through BBs and GIMPLE statements
 +	FOR_EACH_BB(bb) {
++		gimple_stmt_iterator gsi;
++
 +		for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
 +			// gimple match: h_1 = get_fptr (); D.2709_3 = h_1 (x_2(D));
 +			tree fn;
@@ -87490,7 +87931,7 @@ index 0000000..51f747e
 +			if (TREE_CODE(fn) != FUNCTION_TYPE)
 +				continue;
 +
-+			kernexec_instrument_fptr(gsi);
++			kernexec_instrument_fptr(&gsi);
 +
 +//debug_tree(gimple_call_fn(call_stmt));
 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
@@ -87572,6 +88013,12 @@ index 0000000..51f747e
 +	const int argc = plugin_info->argc;
 +	const struct plugin_argument * const argv = plugin_info->argv;
 +	int i;
++	struct register_pass_info kernexec_reload_pass_info = {
++		.pass				= &kernexec_reload_pass.pass,
++		.reference_pass_name		= "ssa",
++		.ref_pass_instance_number	= 0,
++		.pos_op 			= PASS_POS_INSERT_AFTER
++	};
 +	struct register_pass_info kernexec_fptr_pass_info = {
 +		.pass				= &kernexec_fptr_pass.pass,
 +		.reference_pass_name		= "ssa",
@@ -87617,6 +88064,8 @@ index 0000000..51f747e
 +	if (!kernexec_instrument_fptr || !kernexec_instrument_retaddr)
 +		error(G_("no instrumentation method was selected via '-fplugin-arg-%s-method'"), plugin_name);
 +
++	if (kernexec_instrument_fptr == kernexec_instrument_fptr_or)
++		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_reload_pass_info);
 +	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_fptr_pass_info);
 +	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_retaddr_pass_info);
 +
@@ -87624,10 +88073,10 @@ index 0000000..51f747e
 +}
 diff --git a/tools/gcc/stackleak_plugin.c b/tools/gcc/stackleak_plugin.c
 new file mode 100644
-index 0000000..d44f37c
+index 0000000..8b61031
 --- /dev/null
 +++ b/tools/gcc/stackleak_plugin.c
-@@ -0,0 +1,291 @@
+@@ -0,0 +1,295 @@
 +/*
 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -87727,7 +88176,7 @@ index 0000000..d44f37c
 +	return track_frame_size >= 0;
 +}
 +
-+static void stackleak_check_alloca(gimple_stmt_iterator gsi)
++static void stackleak_check_alloca(gimple_stmt_iterator *gsi)
 +{
 +	gimple check_alloca;
 +	tree fndecl, fntype, alloca_size;
@@ -87736,12 +88185,12 @@ index 0000000..d44f37c
 +	fntype = build_function_type_list(void_type_node, long_unsigned_type_node, NULL_TREE);
 +	fndecl = build_fn_decl(check_function, fntype);
 +	DECL_ASSEMBLER_NAME(fndecl); // for LTO
-+	alloca_size = gimple_call_arg(gsi_stmt(gsi), 0);
++	alloca_size = gimple_call_arg(gsi_stmt(*gsi), 0);
 +	check_alloca = gimple_build_call(fndecl, 1, alloca_size);
-+	gsi_insert_before(&gsi, check_alloca, GSI_CONTINUE_LINKING);
++	gsi_insert_before(gsi, check_alloca, GSI_SAME_STMT);
 +}
 +
-+static void stackleak_add_instrumentation(gimple_stmt_iterator gsi)
++static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi)
 +{
 +	gimple track_stack;
 +	tree fndecl, fntype;
@@ -87751,7 +88200,7 @@ index 0000000..d44f37c
 +	fndecl = build_fn_decl(track_function, fntype);
 +	DECL_ASSEMBLER_NAME(fndecl); // for LTO
 +	track_stack = gimple_build_call(fndecl, 0);
-+	gsi_insert_after(&gsi, track_stack, GSI_CONTINUE_LINKING);
++	gsi_insert_after(gsi, track_stack, GSI_CONTINUE_LINKING);
 +}
 +
 +#if BUILDING_GCC_VERSION == 4005
@@ -87794,16 +88243,17 @@ index 0000000..d44f37c
 +	// 1. loop through BBs and GIMPLE statements
 +	FOR_EACH_BB(bb) {
 +		gimple_stmt_iterator gsi;
++
 +		for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
 +			// gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
 +			if (!is_alloca(gsi_stmt(gsi)))
 +				continue;
 +
 +			// 2. insert stack overflow check before each __builtin_alloca call
-+			stackleak_check_alloca(gsi);
++			stackleak_check_alloca(&gsi);
 +
 +			// 3. insert track call after each __builtin_alloca call
-+			stackleak_add_instrumentation(gsi);
++			stackleak_add_instrumentation(&gsi);
 +			if (bb == entry_bb)
 +				prologue_instrumented = true;
 +		}
@@ -87811,10 +88261,13 @@ index 0000000..d44f37c
 +
 +	// 4. insert track call at the beginning
 +	if (!prologue_instrumented) {
++		gimple_stmt_iterator gsi;
++
 +		bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
 +		if (dom_info_available_p(CDI_DOMINATORS))
 +			set_immediate_dominator(CDI_DOMINATORS, bb, ENTRY_BLOCK_PTR);
-+		stackleak_add_instrumentation(gsi_start_bb(bb));
++		gsi = gsi_start_bb(bb);
++		stackleak_add_instrumentation(&gsi);
 +	}
 +
 +	return 0;
diff --git a/3.2.6/0000_README b/3.2.7/0000_README
index 0295121..7342063 100644
--- a/3.2.6/0000_README
+++ b/3.2.7/0000_README
@@ -2,7 +2,11 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.2.2-3.2.6-201202131824.patch
+Patch:	1006_linux-3.2.7.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.2.7
+
+Patch:	4420_grsecurity-2.9-3.2.7-201202251203.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.7/1006_linux-3.2.7.patch b/3.2.7/1006_linux-3.2.7.patch
new file mode 100644
index 0000000..08a6ba3
--- /dev/null
+++ b/3.2.7/1006_linux-3.2.7.patch
@@ -0,0 +1,994 @@
+diff --git a/Makefile b/Makefile
+index 47fe496..d1bdc90 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 6
++SUBLEVEL = 7
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
+index 492ade8..d99346e 100644
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -374,7 +374,7 @@ int __init pci_xen_init(void)
+ 
+ int __init pci_xen_hvm_init(void)
+ {
+-	if (!xen_feature(XENFEAT_hvm_pirqs))
++	if (!xen_have_vector_callback || !xen_feature(XENFEAT_hvm_pirqs))
+ 		return 0;
+ 
+ #ifdef CONFIG_ACPI
+diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
+index 88f160b..107f6f7 100644
+--- a/crypto/sha512_generic.c
++++ b/crypto/sha512_generic.c
+@@ -31,11 +31,6 @@ static inline u64 Maj(u64 x, u64 y, u64 z)
+         return (x & y) | (z & (x | y));
+ }
+ 
+-static inline u64 RORu64(u64 x, u64 y)
+-{
+-        return (x >> y) | (x << (64 - y));
+-}
+-
+ static const u64 sha512_K[80] = {
+         0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL, 0xb5c0fbcfec4d3b2fULL,
+         0xe9b5dba58189dbbcULL, 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,
+@@ -66,10 +61,10 @@ static const u64 sha512_K[80] = {
+         0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL,
+ };
+ 
+-#define e0(x)       (RORu64(x,28) ^ RORu64(x,34) ^ RORu64(x,39))
+-#define e1(x)       (RORu64(x,14) ^ RORu64(x,18) ^ RORu64(x,41))
+-#define s0(x)       (RORu64(x, 1) ^ RORu64(x, 8) ^ (x >> 7))
+-#define s1(x)       (RORu64(x,19) ^ RORu64(x,61) ^ (x >> 6))
++#define e0(x)       (ror64(x,28) ^ ror64(x,34) ^ ror64(x,39))
++#define e1(x)       (ror64(x,14) ^ ror64(x,18) ^ ror64(x,41))
++#define s0(x)       (ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7))
++#define s1(x)       (ror64(x,19) ^ ror64(x,61) ^ (x >> 6))
+ 
+ static inline void LOAD_OP(int I, u64 *W, const u8 *input)
+ {
+@@ -78,7 +73,7 @@ static inline void LOAD_OP(int I, u64 *W, const u8 *input)
+ 
+ static inline void BLEND_OP(int I, u64 *W)
+ {
+-	W[I % 16] += s1(W[(I-2) % 16]) + W[(I-7) % 16] + s0(W[(I-15) % 16]);
++	W[I & 15] += s1(W[(I-2) & 15]) + W[(I-7) & 15] + s0(W[(I-15) & 15]);
+ }
+ 
+ static void
+@@ -89,46 +84,42 @@ sha512_transform(u64 *state, const u8 *input)
+ 	int i;
+ 	u64 W[16];
+ 
+-	/* load the input */
+-        for (i = 0; i < 16; i++)
+-                LOAD_OP(i, W, input);
+-
+ 	/* load the state into our registers */
+ 	a=state[0];   b=state[1];   c=state[2];   d=state[3];
+ 	e=state[4];   f=state[5];   g=state[6];   h=state[7];
+ 
+-#define SHA512_0_15(i, a, b, c, d, e, f, g, h)			\
+-	t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[i];	\
+-	t2 = e0(a) + Maj(a, b, c);				\
+-	d += t1;						\
+-	h = t1 + t2
+-
+-#define SHA512_16_79(i, a, b, c, d, e, f, g, h)			\
+-	BLEND_OP(i, W);						\
+-	t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[(i)%16];	\
+-	t2 = e0(a) + Maj(a, b, c);				\
+-	d += t1;						\
+-	h = t1 + t2
+-
+-	for (i = 0; i < 16; i += 8) {
+-		SHA512_0_15(i, a, b, c, d, e, f, g, h);
+-		SHA512_0_15(i + 1, h, a, b, c, d, e, f, g);
+-		SHA512_0_15(i + 2, g, h, a, b, c, d, e, f);
+-		SHA512_0_15(i + 3, f, g, h, a, b, c, d, e);
+-		SHA512_0_15(i + 4, e, f, g, h, a, b, c, d);
+-		SHA512_0_15(i + 5, d, e, f, g, h, a, b, c);
+-		SHA512_0_15(i + 6, c, d, e, f, g, h, a, b);
+-		SHA512_0_15(i + 7, b, c, d, e, f, g, h, a);
+-	}
+-	for (i = 16; i < 80; i += 8) {
+-		SHA512_16_79(i, a, b, c, d, e, f, g, h);
+-		SHA512_16_79(i + 1, h, a, b, c, d, e, f, g);
+-		SHA512_16_79(i + 2, g, h, a, b, c, d, e, f);
+-		SHA512_16_79(i + 3, f, g, h, a, b, c, d, e);
+-		SHA512_16_79(i + 4, e, f, g, h, a, b, c, d);
+-		SHA512_16_79(i + 5, d, e, f, g, h, a, b, c);
+-		SHA512_16_79(i + 6, c, d, e, f, g, h, a, b);
+-		SHA512_16_79(i + 7, b, c, d, e, f, g, h, a);
++	/* now iterate */
++	for (i=0; i<80; i+=8) {
++		if (!(i & 8)) {
++			int j;
++
++			if (i < 16) {
++				/* load the input */
++				for (j = 0; j < 16; j++)
++					LOAD_OP(i + j, W, input);
++			} else {
++				for (j = 0; j < 16; j++) {
++					BLEND_OP(i + j, W);
++				}
++			}
++		}
++
++		t1 = h + e1(e) + Ch(e,f,g) + sha512_K[i  ] + W[(i & 15)];
++		t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
++		t1 = g + e1(d) + Ch(d,e,f) + sha512_K[i+1] + W[(i & 15) + 1];
++		t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
++		t1 = f + e1(c) + Ch(c,d,e) + sha512_K[i+2] + W[(i & 15) + 2];
++		t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
++		t1 = e + e1(b) + Ch(b,c,d) + sha512_K[i+3] + W[(i & 15) + 3];
++		t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
++		t1 = d + e1(a) + Ch(a,b,c) + sha512_K[i+4] + W[(i & 15) + 4];
++		t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
++		t1 = c + e1(h) + Ch(h,a,b) + sha512_K[i+5] + W[(i & 15) + 5];
++		t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
++		t1 = b + e1(g) + Ch(g,h,a) + sha512_K[i+6] + W[(i & 15) + 6];
++		t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
++		t1 = a + e1(f) + Ch(f,g,h) + sha512_K[i+7] + W[(i & 15) + 7];
++		t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
+ 	}
+ 
+ 	state[0] += a; state[1] += b; state[2] += c; state[3] += d;
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index db3b461..94f860c 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -208,17 +208,8 @@ intel_dp_link_clock(uint8_t link_bw)
+  */
+ 
+ static int
+-intel_dp_link_required(struct intel_dp *intel_dp, int pixel_clock, int check_bpp)
++intel_dp_link_required(int pixel_clock, int bpp)
+ {
+-	struct drm_crtc *crtc = intel_dp->base.base.crtc;
+-	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+-	int bpp = 24;
+-
+-	if (check_bpp)
+-		bpp = check_bpp;
+-	else if (intel_crtc)
+-		bpp = intel_crtc->bpp;
+-
+ 	return (pixel_clock * bpp + 9) / 10;
+ }
+ 
+@@ -245,12 +236,11 @@ intel_dp_mode_valid(struct drm_connector *connector,
+ 			return MODE_PANEL;
+ 	}
+ 
+-	mode_rate = intel_dp_link_required(intel_dp, mode->clock, 0);
++	mode_rate = intel_dp_link_required(mode->clock, 24);
+ 	max_rate = intel_dp_max_data_rate(max_link_clock, max_lanes);
+ 
+ 	if (mode_rate > max_rate) {
+-			mode_rate = intel_dp_link_required(intel_dp,
+-							   mode->clock, 18);
++			mode_rate = intel_dp_link_required(mode->clock, 18);
+ 			if (mode_rate > max_rate)
+ 				return MODE_CLOCK_HIGH;
+ 			else
+@@ -683,7 +673,7 @@ intel_dp_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
+ 	int lane_count, clock;
+ 	int max_lane_count = intel_dp_max_lane_count(intel_dp);
+ 	int max_clock = intel_dp_max_link_bw(intel_dp) == DP_LINK_BW_2_7 ? 1 : 0;
+-	int bpp = mode->private_flags & INTEL_MODE_DP_FORCE_6BPC ? 18 : 0;
++	int bpp = mode->private_flags & INTEL_MODE_DP_FORCE_6BPC ? 18 : 24;
+ 	static int bws[2] = { DP_LINK_BW_1_62, DP_LINK_BW_2_7 };
+ 
+ 	if (is_edp(intel_dp) && intel_dp->panel_fixed_mode) {
+@@ -701,7 +691,7 @@ intel_dp_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
+ 		for (clock = 0; clock <= max_clock; clock++) {
+ 			int link_avail = intel_dp_max_data_rate(intel_dp_link_clock(bws[clock]), lane_count);
+ 
+-			if (intel_dp_link_required(intel_dp, mode->clock, bpp)
++			if (intel_dp_link_required(mode->clock, bpp)
+ 					<= link_avail) {
+ 				intel_dp->link_bw = bws[clock];
+ 				intel_dp->lane_count = lane_count;
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index e441911..b83f745 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -694,6 +694,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
+ 	},
+ 	{
+ 		.callback = intel_no_lvds_dmi_callback,
++                .ident = "AOpen i45GMx-I",
++                .matches = {
++                        DMI_MATCH(DMI_BOARD_VENDOR, "AOpen"),
++                        DMI_MATCH(DMI_BOARD_NAME, "i45GMx-I"),
++                },
++        },
++	{
++		.callback = intel_no_lvds_dmi_callback,
+ 		.ident = "Aopen i945GTt-VFA",
+ 		.matches = {
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "AO00001JW"),
+diff --git a/drivers/hwmon/f75375s.c b/drivers/hwmon/f75375s.c
+index 95cbfb3..e4ab491 100644
+--- a/drivers/hwmon/f75375s.c
++++ b/drivers/hwmon/f75375s.c
+@@ -159,7 +159,7 @@ static inline void f75375_write8(struct i2c_client *client, u8 reg,
+ static inline void f75375_write16(struct i2c_client *client, u8 reg,
+ 		u16 value)
+ {
+-	int err = i2c_smbus_write_byte_data(client, reg, (value << 8));
++	int err = i2c_smbus_write_byte_data(client, reg, (value >> 8));
+ 	if (err)
+ 		return;
+ 	i2c_smbus_write_byte_data(client, reg + 1, (value & 0xFF));
+@@ -311,7 +311,7 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
+ 		fanmode  |= (3 << FAN_CTRL_MODE(nr));
+ 		break;
+ 	case 2: /* AUTOMATIC*/
+-		fanmode  |= (2 << FAN_CTRL_MODE(nr));
++		fanmode  |= (1 << FAN_CTRL_MODE(nr));
+ 		break;
+ 	case 3: /* fan speed */
+ 		break;
+diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
+index a7ee502..72bc756 100644
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -965,11 +965,14 @@ static void atmci_start_request(struct atmel_mci *host,
+ 	host->data_status = 0;
+ 
+ 	if (host->need_reset) {
++		iflags = atmci_readl(host, ATMCI_IMR);
++		iflags &= (ATMCI_SDIOIRQA | ATMCI_SDIOIRQB);
+ 		atmci_writel(host, ATMCI_CR, ATMCI_CR_SWRST);
+ 		atmci_writel(host, ATMCI_CR, ATMCI_CR_MCIEN);
+ 		atmci_writel(host, ATMCI_MR, host->mode_reg);
+ 		if (host->caps.has_cfg_reg)
+ 			atmci_writel(host, ATMCI_CFG, host->cfg_reg);
++		atmci_writel(host, ATMCI_IER, iflags);
+ 		host->need_reset = false;
+ 	}
+ 	atmci_writel(host, ATMCI_SDCR, slot->sdc_reg);
+diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
+index 3aaeb08..baf3d42 100644
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -22,7 +22,6 @@
+ #include <linux/ioport.h>
+ #include <linux/module.h>
+ #include <linux/platform_device.h>
+-#include <linux/scatterlist.h>
+ #include <linux/seq_file.h>
+ #include <linux/slab.h>
+ #include <linux/stat.h>
+@@ -502,8 +501,14 @@ static void dw_mci_submit_data(struct dw_mci *host, struct mmc_data *data)
+ 		host->dir_status = DW_MCI_SEND_STATUS;
+ 
+ 	if (dw_mci_submit_data_dma(host, data)) {
++		int flags = SG_MITER_ATOMIC;
++		if (host->data->flags & MMC_DATA_READ)
++			flags |= SG_MITER_TO_SG;
++		else
++			flags |= SG_MITER_FROM_SG;
++
++		sg_miter_start(&host->sg_miter, data->sg, data->sg_len, flags);
+ 		host->sg = data->sg;
+-		host->pio_offset = 0;
+ 		host->part_buf_start = 0;
+ 		host->part_buf_count = 0;
+ 
+@@ -953,6 +958,7 @@ static void dw_mci_tasklet_func(unsigned long priv)
+ 				 * generates a block interrupt, hence setting
+ 				 * the scatter-gather pointer to NULL.
+ 				 */
++				sg_miter_stop(&host->sg_miter);
+ 				host->sg = NULL;
+ 				ctrl = mci_readl(host, CTRL);
+ 				ctrl |= SDMMC_CTRL_FIFO_RESET;
+@@ -1286,54 +1292,44 @@ static void dw_mci_pull_data(struct dw_mci *host, void *buf, int cnt)
+ 
+ static void dw_mci_read_data_pio(struct dw_mci *host)
+ {
+-	struct scatterlist *sg = host->sg;
+-	void *buf = sg_virt(sg);
+-	unsigned int offset = host->pio_offset;
++	struct sg_mapping_iter *sg_miter = &host->sg_miter;
++	void *buf;
++	unsigned int offset;
+ 	struct mmc_data	*data = host->data;
+ 	int shift = host->data_shift;
+ 	u32 status;
+ 	unsigned int nbytes = 0, len;
++	unsigned int remain, fcnt;
+ 
+ 	do {
+-		len = host->part_buf_count +
+-			(SDMMC_GET_FCNT(mci_readl(host, STATUS)) << shift);
+-		if (offset + len <= sg->length) {
++		if (!sg_miter_next(sg_miter))
++			goto done;
++
++		host->sg = sg_miter->__sg;
++		buf = sg_miter->addr;
++		remain = sg_miter->length;
++		offset = 0;
++
++		do {
++			fcnt = (SDMMC_GET_FCNT(mci_readl(host, STATUS))
++					<< shift) + host->part_buf_count;
++			len = min(remain, fcnt);
++			if (!len)
++				break;
+ 			dw_mci_pull_data(host, (void *)(buf + offset), len);
+-
+ 			offset += len;
+ 			nbytes += len;
+-
+-			if (offset == sg->length) {
+-				flush_dcache_page(sg_page(sg));
+-				host->sg = sg = sg_next(sg);
+-				if (!sg)
+-					goto done;
+-
+-				offset = 0;
+-				buf = sg_virt(sg);
+-			}
+-		} else {
+-			unsigned int remaining = sg->length - offset;
+-			dw_mci_pull_data(host, (void *)(buf + offset),
+-					 remaining);
+-			nbytes += remaining;
+-
+-			flush_dcache_page(sg_page(sg));
+-			host->sg = sg = sg_next(sg);
+-			if (!sg)
+-				goto done;
+-
+-			offset = len - remaining;
+-			buf = sg_virt(sg);
+-			dw_mci_pull_data(host, buf, offset);
+-			nbytes += offset;
+-		}
++			remain -= len;
++		} while (remain);
++		sg_miter->consumed = offset;
+ 
+ 		status = mci_readl(host, MINTSTS);
+ 		mci_writel(host, RINTSTS, SDMMC_INT_RXDR);
+ 		if (status & DW_MCI_DATA_ERROR_FLAGS) {
+ 			host->data_status = status;
+ 			data->bytes_xfered += nbytes;
++			sg_miter_stop(sg_miter);
++			host->sg = NULL;
+ 			smp_wmb();
+ 
+ 			set_bit(EVENT_DATA_ERROR, &host->pending_events);
+@@ -1342,65 +1338,66 @@ static void dw_mci_read_data_pio(struct dw_mci *host)
+ 			return;
+ 		}
+ 	} while (status & SDMMC_INT_RXDR); /*if the RXDR is ready read again*/
+-	host->pio_offset = offset;
+ 	data->bytes_xfered += nbytes;
++
++	if (!remain) {
++		if (!sg_miter_next(sg_miter))
++			goto done;
++		sg_miter->consumed = 0;
++	}
++	sg_miter_stop(sg_miter);
+ 	return;
+ 
+ done:
+ 	data->bytes_xfered += nbytes;
++	sg_miter_stop(sg_miter);
++	host->sg = NULL;
+ 	smp_wmb();
+ 	set_bit(EVENT_XFER_COMPLETE, &host->pending_events);
+ }
+ 
+ static void dw_mci_write_data_pio(struct dw_mci *host)
+ {
+-	struct scatterlist *sg = host->sg;
+-	void *buf = sg_virt(sg);
+-	unsigned int offset = host->pio_offset;
++	struct sg_mapping_iter *sg_miter = &host->sg_miter;
++	void *buf;
++	unsigned int offset;
+ 	struct mmc_data	*data = host->data;
+ 	int shift = host->data_shift;
+ 	u32 status;
+ 	unsigned int nbytes = 0, len;
++	unsigned int fifo_depth = host->fifo_depth;
++	unsigned int remain, fcnt;
+ 
+ 	do {
+-		len = ((host->fifo_depth -
+-			SDMMC_GET_FCNT(mci_readl(host, STATUS))) << shift)
+-			- host->part_buf_count;
+-		if (offset + len <= sg->length) {
++		if (!sg_miter_next(sg_miter))
++			goto done;
++
++		host->sg = sg_miter->__sg;
++		buf = sg_miter->addr;
++		remain = sg_miter->length;
++		offset = 0;
++
++		do {
++			fcnt = ((fifo_depth -
++				 SDMMC_GET_FCNT(mci_readl(host, STATUS)))
++					<< shift) - host->part_buf_count;
++			len = min(remain, fcnt);
++			if (!len)
++				break;
+ 			host->push_data(host, (void *)(buf + offset), len);
+-
+ 			offset += len;
+ 			nbytes += len;
+-			if (offset == sg->length) {
+-				host->sg = sg = sg_next(sg);
+-				if (!sg)
+-					goto done;
+-
+-				offset = 0;
+-				buf = sg_virt(sg);
+-			}
+-		} else {
+-			unsigned int remaining = sg->length - offset;
+-
+-			host->push_data(host, (void *)(buf + offset),
+-					remaining);
+-			nbytes += remaining;
+-
+-			host->sg = sg = sg_next(sg);
+-			if (!sg)
+-				goto done;
+-
+-			offset = len - remaining;
+-			buf = sg_virt(sg);
+-			host->push_data(host, (void *)buf, offset);
+-			nbytes += offset;
+-		}
++			remain -= len;
++		} while (remain);
++		sg_miter->consumed = offset;
+ 
+ 		status = mci_readl(host, MINTSTS);
+ 		mci_writel(host, RINTSTS, SDMMC_INT_TXDR);
+ 		if (status & DW_MCI_DATA_ERROR_FLAGS) {
+ 			host->data_status = status;
+ 			data->bytes_xfered += nbytes;
++			sg_miter_stop(sg_miter);
++			host->sg = NULL;
+ 
+ 			smp_wmb();
+ 
+@@ -1410,12 +1407,20 @@ static void dw_mci_write_data_pio(struct dw_mci *host)
+ 			return;
+ 		}
+ 	} while (status & SDMMC_INT_TXDR); /* if TXDR write again */
+-	host->pio_offset = offset;
+ 	data->bytes_xfered += nbytes;
++
++	if (!remain) {
++		if (!sg_miter_next(sg_miter))
++			goto done;
++		sg_miter->consumed = 0;
++	}
++	sg_miter_stop(sg_miter);
+ 	return;
+ 
+ done:
+ 	data->bytes_xfered += nbytes;
++	sg_miter_stop(sg_miter);
++	host->sg = NULL;
+ 	smp_wmb();
+ 	set_bit(EVENT_XFER_COMPLETE, &host->pending_events);
+ }
+@@ -1618,6 +1623,7 @@ static void dw_mci_work_routine_card(struct work_struct *work)
+ 				 * block interrupt, hence setting the
+ 				 * scatter-gather pointer to NULL.
+ 				 */
++				sg_miter_stop(&host->sg_miter);
+ 				host->sg = NULL;
+ 
+ 				ctrl = mci_readl(host, CTRL);
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index ced5444..222954d 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -4965,7 +4965,8 @@ static int igb_find_enabled_vfs(struct igb_adapter *adapter)
+ 	vf_devfn = pdev->devfn + 0x80;
+ 	pvfdev = pci_get_device(hw->vendor_id, device_id, NULL);
+ 	while (pvfdev) {
+-		if (pvfdev->devfn == vf_devfn)
++		if (pvfdev->devfn == vf_devfn &&
++		    (pvfdev->bus->number >= pdev->bus->number))
+ 			vfs_found++;
+ 		vf_devfn += vf_stride;
+ 		pvfdev = pci_get_device(hw->vendor_id,
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+index 00fcd39..e571356 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+@@ -67,7 +67,8 @@ static int ixgbe_find_enabled_vfs(struct ixgbe_adapter *adapter)
+ 	vf_devfn = pdev->devfn + 0x80;
+ 	pvfdev = pci_get_device(IXGBE_INTEL_VENDOR_ID, device_id, NULL);
+ 	while (pvfdev) {
+-		if (pvfdev->devfn == vf_devfn)
++		if (pvfdev->devfn == vf_devfn &&
++		    (pvfdev->bus->number >= pdev->bus->number))
+ 			vfs_found++;
+ 		vf_devfn += 2;
+ 		pvfdev = pci_get_device(IXGBE_INTEL_VENDOR_ID,
+diff --git a/drivers/net/ethernet/toshiba/Kconfig b/drivers/net/ethernet/toshiba/Kconfig
+index 0517647..74acb5c 100644
+--- a/drivers/net/ethernet/toshiba/Kconfig
++++ b/drivers/net/ethernet/toshiba/Kconfig
+@@ -5,7 +5,7 @@
+ config NET_VENDOR_TOSHIBA
+ 	bool "Toshiba devices"
+ 	default y
+-	depends on PCI && (PPC_IBM_CELL_BLADE || PPC_CELLEB) || PPC_PS3
++	depends on PCI && (PPC_IBM_CELL_BLADE || PPC_CELLEB || MIPS) || PPC_PS3
+ 	---help---
+ 	  If you have a network (Ethernet) card belonging to this class, say Y
+ 	  and read the Ethernet-HOWTO, available from
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index 8873c6e..8b0c2ca 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -1034,13 +1034,16 @@ void ath9k_hw_init_global_settings(struct ath_hw *ah)
+ 
+ 	/*
+ 	 * Workaround for early ACK timeouts, add an offset to match the
+-	 * initval's 64us ack timeout value.
++	 * initval's 64us ack timeout value. Use 48us for the CTS timeout.
+ 	 * This was initially only meant to work around an issue with delayed
+ 	 * BA frames in some implementations, but it has been found to fix ACK
+ 	 * timeout issues in other cases as well.
+ 	 */
+-	if (conf->channel && conf->channel->band == IEEE80211_BAND_2GHZ)
++	if (conf->channel && conf->channel->band == IEEE80211_BAND_2GHZ) {
+ 		acktimeout += 64 - sifstime - ah->slottime;
++		ctstimeout += 48 - sifstime - ah->slottime;
++	}
++
+ 
+ 	ath9k_hw_set_sifs_time(ah, sifstime);
+ 	ath9k_hw_setslottime(ah, slottime);
+diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
+index d4c909f..57622e0 100644
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -775,6 +775,11 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc,
+ 		ARRAY_SIZE(ath9k_tpt_blink));
+ #endif
+ 
++	INIT_WORK(&sc->hw_reset_work, ath_reset_work);
++	INIT_WORK(&sc->hw_check_work, ath_hw_check);
++	INIT_WORK(&sc->paprd_work, ath_paprd_calibrate);
++	INIT_DELAYED_WORK(&sc->hw_pll_work, ath_hw_pll_work);
++
+ 	/* Register with mac80211 */
+ 	error = ieee80211_register_hw(hw);
+ 	if (error)
+@@ -793,10 +798,6 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc,
+ 			goto error_world;
+ 	}
+ 
+-	INIT_WORK(&sc->hw_reset_work, ath_reset_work);
+-	INIT_WORK(&sc->hw_check_work, ath_hw_check);
+-	INIT_WORK(&sc->paprd_work, ath_paprd_calibrate);
+-	INIT_DELAYED_WORK(&sc->hw_pll_work, ath_hw_pll_work);
+ 	sc->last_rssi = ATH_RSSI_DUMMY_MARKER;
+ 
+ 	ath_init_leds(sc);
+diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
+index 67b862c..2f3aeac 100644
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -824,6 +824,14 @@ static bool ath9k_rx_accept(struct ath_common *common,
+ 		(ATH9K_RXERR_DECRYPT | ATH9K_RXERR_CRC | ATH9K_RXERR_MIC |
+ 		 ATH9K_RXERR_KEYMISS));
+ 
++	/*
++	 * Key miss events are only relevant for pairwise keys where the
++	 * descriptor does contain a valid key index. This has been observed
++	 * mostly with CCMP encryption.
++	 */
++	if (rx_stats->rs_keyix == ATH9K_RXKEYIX_INVALID)
++		rx_stats->rs_status &= ~ATH9K_RXERR_KEYMISS;
++
+ 	if (!rx_stats->rs_datalen)
+ 		return false;
+         /*
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 63e4be4..720edf5 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -756,10 +756,11 @@ standard_receive3(struct TCP_Server_Info *server, struct mid_q_entry *mid)
+ 		cifs_dump_mem("Bad SMB: ", buf,
+ 			min_t(unsigned int, server->total_read, 48));
+ 
+-	if (mid)
+-		handle_mid(mid, server, smb_buffer, length);
++	if (!mid)
++		return length;
+ 
+-	return length;
++	handle_mid(mid, server, smb_buffer, length);
++	return 0;
+ }
+ 
+ static int
+diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
+index d7eeb9d..e4c3334 100644
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -492,7 +492,7 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
+ {
+ 	int xid;
+ 	int rc = 0; /* to get around spurious gcc warning, set to zero here */
+-	__u32 oplock = 0;
++	__u32 oplock = enable_oplocks ? REQ_OPLOCK : 0;
+ 	__u16 fileHandle = 0;
+ 	bool posix_open = false;
+ 	struct cifs_sb_info *cifs_sb;
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 517f211..54f5786 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -48,14 +48,6 @@ struct wb_writeback_work {
+ };
+ 
+ /*
+- * Include the creation of the trace points after defining the
+- * wb_writeback_work structure so that the definition remains local to this
+- * file.
+- */
+-#define CREATE_TRACE_POINTS
+-#include <trace/events/writeback.h>
+-
+-/*
+  * We don't actually have pdflush, but this one is exported though /proc...
+  */
+ int nr_pdflush_threads;
+@@ -87,6 +79,14 @@ static inline struct inode *wb_inode(struct list_head *head)
+ 	return list_entry(head, struct inode, i_wb_list);
+ }
+ 
++/*
++ * Include the creation of the trace points after defining the
++ * wb_writeback_work structure and inline functions so that the definition
++ * remains local to this file.
++ */
++#define CREATE_TRACE_POINTS
++#include <trace/events/writeback.h>
++
+ /* Wakeup flusher thread or forker thread to fork it. Requires bdi->wb_lock. */
+ static void bdi_wakeup_flusher(struct backing_dev_info *bdi)
+ {
+diff --git a/include/linux/bitops.h b/include/linux/bitops.h
+index a3ef66a..fc8a3ff 100644
+--- a/include/linux/bitops.h
++++ b/include/linux/bitops.h
+@@ -50,6 +50,26 @@ static inline unsigned long hweight_long(unsigned long w)
+ }
+ 
+ /**
++ * rol64 - rotate a 64-bit value left
++ * @word: value to rotate
++ * @shift: bits to roll
++ */
++static inline __u64 rol64(__u64 word, unsigned int shift)
++{
++	return (word << shift) | (word >> (64 - shift));
++}
++
++/**
++ * ror64 - rotate a 64-bit value right
++ * @word: value to rotate
++ * @shift: bits to roll
++ */
++static inline __u64 ror64(__u64 word, unsigned int shift)
++{
++	return (word >> shift) | (word << (64 - shift));
++}
++
++/**
+  * rol32 - rotate a 32-bit value left
+  * @word: value to rotate
+  * @shift: bits to roll
+diff --git a/include/linux/mmc/dw_mmc.h b/include/linux/mmc/dw_mmc.h
+index 6dc9b80..107fcb3 100644
+--- a/include/linux/mmc/dw_mmc.h
++++ b/include/linux/mmc/dw_mmc.h
+@@ -14,6 +14,8 @@
+ #ifndef LINUX_MMC_DW_MMC_H
+ #define LINUX_MMC_DW_MMC_H
+ 
++#include <linux/scatterlist.h>
++
+ #define MAX_MCI_SLOTS	2
+ 
+ enum dw_mci_state {
+@@ -40,7 +42,7 @@ struct mmc_data;
+  * @lock: Spinlock protecting the queue and associated data.
+  * @regs: Pointer to MMIO registers.
+  * @sg: Scatterlist entry currently being processed by PIO code, if any.
+- * @pio_offset: Offset into the current scatterlist entry.
++ * @sg_miter: PIO mapping scatterlist iterator.
+  * @cur_slot: The slot which is currently using the controller.
+  * @mrq: The request currently being processed on @cur_slot,
+  *	or NULL if the controller is idle.
+@@ -115,7 +117,7 @@ struct dw_mci {
+ 	void __iomem		*regs;
+ 
+ 	struct scatterlist	*sg;
+-	unsigned int		pio_offset;
++	struct sg_mapping_iter	sg_miter;
+ 
+ 	struct dw_mci_slot	*cur_slot;
+ 	struct mmc_request	*mrq;
+diff --git a/include/linux/proportions.h b/include/linux/proportions.h
+index ef35bb7..26a8a4e 100644
+--- a/include/linux/proportions.h
++++ b/include/linux/proportions.h
+@@ -81,7 +81,11 @@ void prop_inc_percpu(struct prop_descriptor *pd, struct prop_local_percpu *pl)
+  * Limit the time part in order to ensure there are some bits left for the
+  * cycle counter and fraction multiply.
+  */
++#if BITS_PER_LONG == 32
+ #define PROP_MAX_SHIFT (3*BITS_PER_LONG/4)
++#else
++#define PROP_MAX_SHIFT (BITS_PER_LONG/2)
++#endif
+ 
+ #define PROP_FRAC_SHIFT		(BITS_PER_LONG - PROP_MAX_SHIFT - 1)
+ #define PROP_FRAC_BASE		(1UL << PROP_FRAC_SHIFT)
+diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h
+index 99d1d0d..1f48f14 100644
+--- a/include/trace/events/writeback.h
++++ b/include/trace/events/writeback.h
+@@ -47,7 +47,10 @@ DECLARE_EVENT_CLASS(writeback_work_class,
+ 		__field(int, reason)
+ 	),
+ 	TP_fast_assign(
+-		strncpy(__entry->name, dev_name(bdi->dev), 32);
++		struct device *dev = bdi->dev;
++		if (!dev)
++			dev = default_backing_dev_info.dev;
++		strncpy(__entry->name, dev_name(dev), 32);
+ 		__entry->nr_pages = work->nr_pages;
+ 		__entry->sb_dev = work->sb ? work->sb->s_dev : 0;
+ 		__entry->sync_mode = work->sync_mode;
+@@ -418,7 +421,7 @@ DECLARE_EVENT_CLASS(writeback_single_inode_template,
+ 
+ 	TP_fast_assign(
+ 		strncpy(__entry->name,
+-			dev_name(inode->i_mapping->backing_dev_info->dev), 32);
++			dev_name(inode_to_bdi(inode)->dev), 32);
+ 		__entry->ino		= inode->i_ino;
+ 		__entry->state		= inode->i_state;
+ 		__entry->dirtied_when	= inode->dirtied_when;
+diff --git a/kernel/relay.c b/kernel/relay.c
+index 226fade..b6f803a 100644
+--- a/kernel/relay.c
++++ b/kernel/relay.c
+@@ -164,10 +164,14 @@ depopulate:
+  */
+ static struct rchan_buf *relay_create_buf(struct rchan *chan)
+ {
+-	struct rchan_buf *buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
+-	if (!buf)
++	struct rchan_buf *buf;
++
++	if (chan->n_subbufs > UINT_MAX / sizeof(size_t *))
+ 		return NULL;
+ 
++	buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
++	if (!buf)
++		return NULL;
+ 	buf->padding = kmalloc(chan->n_subbufs * sizeof(size_t *), GFP_KERNEL);
+ 	if (!buf->padding)
+ 		goto free_buf;
+@@ -574,6 +578,8 @@ struct rchan *relay_open(const char *base_filename,
+ 
+ 	if (!(subbuf_size && n_subbufs))
+ 		return NULL;
++	if (subbuf_size > UINT_MAX / n_subbufs)
++		return NULL;
+ 
+ 	chan = kzalloc(sizeof(struct rchan), GFP_KERNEL);
+ 	if (!chan)
+diff --git a/mm/backing-dev.c b/mm/backing-dev.c
+index 71034f4..2b49dd2 100644
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -318,7 +318,7 @@ static void wakeup_timer_fn(unsigned long data)
+ 	if (bdi->wb.task) {
+ 		trace_writeback_wake_thread(bdi);
+ 		wake_up_process(bdi->wb.task);
+-	} else {
++	} else if (bdi->dev) {
+ 		/*
+ 		 * When bdi tasks are inactive for long time, they are killed.
+ 		 * In this case we have to wake-up the forker thread which
+@@ -584,6 +584,8 @@ EXPORT_SYMBOL(bdi_register_dev);
+  */
+ static void bdi_wb_shutdown(struct backing_dev_info *bdi)
+ {
++	struct task_struct *task;
++
+ 	if (!bdi_cap_writeback_dirty(bdi))
+ 		return;
+ 
+@@ -604,9 +606,14 @@ static void bdi_wb_shutdown(struct backing_dev_info *bdi)
+ 	 * unfreeze of the thread before calling kthread_stop(), otherwise
+ 	 * it would never exet if it is currently stuck in the refrigerator.
+ 	 */
+-	if (bdi->wb.task) {
+-		thaw_process(bdi->wb.task);
+-		kthread_stop(bdi->wb.task);
++	spin_lock_bh(&bdi->wb_lock);
++	task = bdi->wb.task;
++	bdi->wb.task = NULL;
++	spin_unlock_bh(&bdi->wb_lock);
++
++	if (task) {
++		thaw_process(task);
++		kthread_stop(task);
+ 	}
+ }
+ 
+@@ -627,7 +634,9 @@ static void bdi_prune_sb(struct backing_dev_info *bdi)
+ 
+ void bdi_unregister(struct backing_dev_info *bdi)
+ {
+-	if (bdi->dev) {
++	struct device *dev = bdi->dev;
++
++	if (dev) {
+ 		bdi_set_min_ratio(bdi, 0);
+ 		trace_writeback_bdi_unregister(bdi);
+ 		bdi_prune_sb(bdi);
+@@ -636,8 +645,12 @@ void bdi_unregister(struct backing_dev_info *bdi)
+ 		if (!bdi_cap_flush_forker(bdi))
+ 			bdi_wb_shutdown(bdi);
+ 		bdi_debug_unregister(bdi);
+-		device_unregister(bdi->dev);
++
++		spin_lock_bh(&bdi->wb_lock);
+ 		bdi->dev = NULL;
++		spin_unlock_bh(&bdi->wb_lock);
++
++		device_unregister(dev);
+ 	}
+ }
+ EXPORT_SYMBOL(bdi_unregister);
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 5c51607..064d20f 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -616,7 +616,7 @@ static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
+ 	index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
+ 						tid_agg_rx->buf_size;
+ 	if (!tid_agg_rx->reorder_buf[index] &&
+-	    tid_agg_rx->stored_mpdu_num > 1) {
++	    tid_agg_rx->stored_mpdu_num) {
+ 		/*
+ 		 * No buffers ready to be released, but check whether any
+ 		 * frames in the reorder buffer have timed out.
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 34e5fcc..9c197d4 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4213,8 +4213,26 @@ enum {
+ 	PINFIX_PB_M5210,
+ 	PINFIX_ACER_ASPIRE_7736,
+ 	PINFIX_ASUS_W90V,
++	ALC889_FIXUP_DAC_ROUTE,
+ };
+ 
++/* Fix the connection of some pins for ALC889:
++ * At least, Acer Aspire 5935 shows the connections to DAC3/4 don't
++ * work correctly (bko#42740)
++ */
++static void alc889_fixup_dac_route(struct hda_codec *codec,
++				   const struct alc_fixup *fix, int action)
++{
++	if (action == ALC_FIXUP_ACT_PRE_PROBE) {
++		hda_nid_t conn1[2] = { 0x0c, 0x0d };
++		hda_nid_t conn2[2] = { 0x0e, 0x0f };
++		snd_hda_override_conn_list(codec, 0x14, 2, conn1);
++		snd_hda_override_conn_list(codec, 0x15, 2, conn1);
++		snd_hda_override_conn_list(codec, 0x18, 2, conn2);
++		snd_hda_override_conn_list(codec, 0x1a, 2, conn2);
++	}
++}
++
+ static const struct alc_fixup alc882_fixups[] = {
+ 	[PINFIX_ABIT_AW9D_MAX] = {
+ 		.type = ALC_FIXUP_PINS,
+@@ -4251,10 +4269,15 @@ static const struct alc_fixup alc882_fixups[] = {
+ 			{ }
+ 		}
+ 	},
++	[ALC889_FIXUP_DAC_ROUTE] = {
++		.type = ALC_FIXUP_FUNC,
++		.v.func = alc889_fixup_dac_route,
++	},
+ };
+ 
+ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1025, 0x0155, "Packard-Bell M5120", PINFIX_PB_M5210),
++	SND_PCI_QUIRK(0x1025, 0x0259, "Acer Aspire 5935", ALC889_FIXUP_DAC_ROUTE),
+ 	SND_PCI_QUIRK(0x1043, 0x1873, "ASUS W90V", PINFIX_ASUS_W90V),
+ 	SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", PINFIX_LENOVO_Y530),
+ 	SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", PINFIX_ABIT_AW9D_MAX),
+diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
+index a0a3f50..1fe1308 100644
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -665,6 +665,9 @@ static void via_auto_init_analog_input(struct hda_codec *codec)
+ 	/* init input-src */
+ 	for (i = 0; i < spec->num_adc_nids; i++) {
+ 		int adc_idx = spec->inputs[spec->cur_mux[i]].adc_idx;
++		/* secondary ADCs must have the unique MUX */
++		if (i > 0 && !spec->mux_nids[i])
++			break;
+ 		if (spec->mux_nids[adc_idx]) {
+ 			int mux_idx = spec->inputs[spec->cur_mux[i]].mux_idx;
+ 			snd_hda_codec_write(codec, spec->mux_nids[adc_idx], 0,
+diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
+index 11718b49..55f48fb 100644
+--- a/sound/pci/intel8x0.c
++++ b/sound/pci/intel8x0.c
+@@ -2102,6 +2102,12 @@ static struct ac97_quirk ac97_quirks[] __devinitdata = {
+ 	},
+ 	{
+ 		.subvendor = 0x161f,
++		.subdevice = 0x202f,
++		.name = "Gateway M520",
++		.type = AC97_TUNE_INV_EAPD
++	},
++	{
++		.subvendor = 0x161f,
+ 		.subdevice = 0x203a,
+ 		.name = "Gateway 4525GZ",		/* AD1981B */
+ 		.type = AC97_TUNE_INV_EAPD
+diff --git a/tools/perf/bench/mem-memcpy-x86-64-asm.S b/tools/perf/bench/mem-memcpy-x86-64-asm.S
+index a57b66e..185a96d 100644
+--- a/tools/perf/bench/mem-memcpy-x86-64-asm.S
++++ b/tools/perf/bench/mem-memcpy-x86-64-asm.S
+@@ -1,2 +1,8 @@
+ 
+ #include "../../../arch/x86/lib/memcpy_64.S"
++/*
++ * We need to provide note.GNU-stack section, saying that we want
++ * NOT executable stack. Otherwise the final linking will assume that
++ * the ELF stack should not be restricted at all and set it RWX.
++ */
++.section .note.GNU-stack,"",@progbits
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index d7915d4..efca198 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -390,6 +390,7 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
+ 
+ 	data->cpu = data->pid = data->tid = -1;
+ 	data->stream_id = data->id = data->time = -1ULL;
++	data->period = 1;
+ 
+ 	if (event->header.type != PERF_RECORD_SAMPLE) {
+ 		if (!sample_id_all)
diff --git a/3.2.6/4420_grsecurity-2.2.2-3.2.6-201202131824.patch b/3.2.7/4420_grsecurity-2.9-3.2.7-201202251203.patch
index 2ac6312..be7621a 100644
--- a/3.2.6/4420_grsecurity-2.2.2-3.2.6-201202131824.patch
+++ b/3.2.7/4420_grsecurity-2.9-3.2.7-201202251203.patch
@@ -186,7 +186,7 @@ index 81c287f..d456d02 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 47fe496..c50bd2a 100644
+index d1bdc90..e95fe1a 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -366,6 +366,27 @@ index 47fe496..c50bd2a 100644
  	$(cmd_crmodverdir)
  	$(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1)   \
  	$(build)=$(build-dir) $(@:.ko=.o)
+diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
+index 640f909..48b6597 100644
+--- a/arch/alpha/include/asm/atomic.h
++++ b/arch/alpha/include/asm/atomic.h
+@@ -250,6 +250,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+ #define atomic_dec(v) atomic_sub(1,(v))
+ #define atomic64_dec(v) atomic64_sub(1,(v))
+ 
++#define atomic64_read_unchecked(v)		atomic64_read(v)
++#define atomic64_set_unchecked(v, i)		atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v)		atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v)	atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v)		atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v)		atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v)	atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v)		atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n)	atomic64_cmpxchg((v), (o), (n))
++
+ #define smp_mb__before_atomic_dec()	smp_mb()
+ #define smp_mb__after_atomic_dec()	smp_mb()
+ #define smp_mb__before_atomic_inc()	smp_mb()
 diff --git a/arch/alpha/include/asm/elf.h b/arch/alpha/include/asm/elf.h
 index da5449e..7418343 100644
 --- a/arch/alpha/include/asm/elf.h
@@ -615,10 +636,21 @@ index fadd5f8..904e73a 100644
  		/* Allow reads even for write-only mappings */
  		if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
 diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
-index 86976d0..8a57797 100644
+index 86976d0..6610950 100644
 --- a/arch/arm/include/asm/atomic.h
 +++ b/arch/arm/include/asm/atomic.h
-@@ -239,6 +239,14 @@ typedef struct {
+@@ -15,6 +15,10 @@
+ #include <linux/types.h>
+ #include <asm/system.h>
+ 
++#ifdef CONFIG_GENERIC_ATOMIC64
++#include <asm-generic/atomic64.h>
++#endif
++
+ #define ATOMIC_INIT(i)	{ (i) }
+ 
+ #ifdef __KERNEL__
+@@ -239,6 +243,14 @@ typedef struct {
  	u64 __aligned(8) counter;
  } atomic64_t;
  
@@ -633,6 +665,23 @@ index 86976d0..8a57797 100644
  #define ATOMIC64_INIT(i) { (i) }
  
  static inline u64 atomic64_read(atomic64_t *v)
+@@ -459,6 +471,16 @@ static inline int atomic64_add_unless(atomic64_t *v, u64 a, u64 u)
+ #define atomic64_dec_and_test(v)	(atomic64_dec_return((v)) == 0)
+ #define atomic64_inc_not_zero(v)	atomic64_add_unless((v), 1LL, 0LL)
+ 
++#define atomic64_read_unchecked(v)		atomic64_read(v)
++#define atomic64_set_unchecked(v, i)		atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v)		atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v)	atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v)		atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v)		atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v)	atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v)		atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n)	atomic64_cmpxchg((v), (o), (n))
++
+ #endif /* !CONFIG_GENERIC_ATOMIC64 */
+ #endif
+ #endif
 diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
 index 0e9ce8d..6ef1e03 100644
 --- a/arch/arm/include/asm/elf.h
@@ -1119,6 +1168,27 @@ index f7040a1..db9f300 100644
  		if (exception_trace && printk_ratelimit())
  			printk("%s%s[%d]: segfault at %08lx pc %08lx "
  			       "sp %08lx ecr %lu\n",
+diff --git a/arch/frv/include/asm/atomic.h b/arch/frv/include/asm/atomic.h
+index 0d8a7d6..d0c9ff5 100644
+--- a/arch/frv/include/asm/atomic.h
++++ b/arch/frv/include/asm/atomic.h
+@@ -241,6 +241,16 @@ extern uint32_t __xchg_32(uint32_t i, volatile void *v);
+ #define atomic64_cmpxchg(v, old, new)	(__cmpxchg_64(old, new, &(v)->counter))
+ #define atomic64_xchg(v, new)		(__xchg_64(new, &(v)->counter))
+ 
++#define atomic64_read_unchecked(v)		atomic64_read(v)
++#define atomic64_set_unchecked(v, i)		atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v)		atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v)	atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v)		atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v)		atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v)	atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v)		atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n)	atomic64_cmpxchg((v), (o), (n))
++
+ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
+ {
+ 	int c, old;
 diff --git a/arch/frv/include/asm/kmap_types.h b/arch/frv/include/asm/kmap_types.h
 index f8e16b2..c73ff79 100644
 --- a/arch/frv/include/asm/kmap_types.h
@@ -1163,6 +1233,27 @@ index 385fd30..6c3d97e 100644
  				goto success;
  			addr = vma->vm_end;
  		}
+diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
+index 3fad89e..3047da5 100644
+--- a/arch/ia64/include/asm/atomic.h
++++ b/arch/ia64/include/asm/atomic.h
+@@ -209,6 +209,16 @@ atomic64_add_negative (__s64 i, atomic64_t *v)
+ #define atomic64_inc(v)			atomic64_add(1, (v))
+ #define atomic64_dec(v)			atomic64_sub(1, (v))
+ 
++#define atomic64_read_unchecked(v)		atomic64_read(v)
++#define atomic64_set_unchecked(v, i)		atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v)		atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v)	atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v)		atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v)		atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v)	atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v)		atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n)	atomic64_cmpxchg((v), (o), (n))
++
+ /* Atomic operations are already serializing */
+ #define smp_mb__before_atomic_dec()	barrier()
+ #define smp_mb__after_atomic_dec()	barrier()
 diff --git a/arch/ia64/include/asm/elf.h b/arch/ia64/include/asm/elf.h
 index b5298eb..67c6e62 100644
 --- a/arch/ia64/include/asm/elf.h
@@ -1502,6 +1593,38 @@ index 82abd15..d95ae5d 100644
  	prefetchw(to);
  	if (access_ok(VERIFY_READ, from, n))
  		__copy_user_zeroing(to,from,n);
+diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
+index 1d93f81..67794d0 100644
+--- a/arch/mips/include/asm/atomic.h
++++ b/arch/mips/include/asm/atomic.h
+@@ -21,6 +21,10 @@
+ #include <asm/war.h>
+ #include <asm/system.h>
+ 
++#ifdef CONFIG_GENERIC_ATOMIC64
++#include <asm-generic/atomic64.h>
++#endif
++
+ #define ATOMIC_INIT(i)    { (i) }
+ 
+ /*
+@@ -765,6 +769,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+  */
+ #define atomic64_add_negative(i, v) (atomic64_add_return(i, (v)) < 0)
+ 
++#define atomic64_read_unchecked(v)		atomic64_read(v)
++#define atomic64_set_unchecked(v, i)		atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v)		atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v)	atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v)		atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v)		atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v)	atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v)		atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n)	atomic64_cmpxchg((v), (o), (n))
++
+ #endif /* CONFIG_64BIT */
+ 
+ /*
 diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
 index 455c0ac..ad65fbe 100644
 --- a/arch/mips/include/asm/elf.h
@@ -1720,6 +1843,27 @@ index 302d779..7d35bf8 100644
 -
 -	return ret;
 -}
+diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
+index 4054b31..a10c105 100644
+--- a/arch/parisc/include/asm/atomic.h
++++ b/arch/parisc/include/asm/atomic.h
+@@ -335,6 +335,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+ 
+ #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
+ 
++#define atomic64_read_unchecked(v)		atomic64_read(v)
++#define atomic64_set_unchecked(v, i)		atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v)		atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v)	atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v)		atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v)		atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v)	atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v)		atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n)	atomic64_cmpxchg((v), (o), (n))
++
+ #endif /* !CONFIG_64BIT */
+ 
+ 
 diff --git a/arch/parisc/include/asm/elf.h b/arch/parisc/include/asm/elf.h
 index 19f6cb1..6c78cf2 100644
 --- a/arch/parisc/include/asm/elf.h
@@ -2082,6 +2226,27 @@ index 18162ce..94de376 100644
  
  	/*
  	 * If for any reason at all we couldn't handle the fault, make
+diff --git a/arch/powerpc/include/asm/atomic.h b/arch/powerpc/include/asm/atomic.h
+index 02e41b5..ec6e26c 100644
+--- a/arch/powerpc/include/asm/atomic.h
++++ b/arch/powerpc/include/asm/atomic.h
+@@ -469,6 +469,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+ 
+ #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
+ 
++#define atomic64_read_unchecked(v)		atomic64_read(v)
++#define atomic64_set_unchecked(v, i)		atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v)		atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v)	atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v)		atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v)		atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v)	atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v)		atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n)	atomic64_cmpxchg((v), (o), (n))
++
+ #endif /* __powerpc64__ */
+ 
+ #endif /* __KERNEL__ */
 diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
 index 3bf9cca..e7457d0 100644
 --- a/arch/powerpc/include/asm/elf.h
@@ -2909,6 +3074,27 @@ index 73709f7..6b90313 100644
  	/* If hint, make sure it matches our alignment restrictions */
  	if (!fixed && addr) {
  		addr = _ALIGN_UP(addr, 1ul << pshift);
+diff --git a/arch/s390/include/asm/atomic.h b/arch/s390/include/asm/atomic.h
+index 8517d2a..d2738d4 100644
+--- a/arch/s390/include/asm/atomic.h
++++ b/arch/s390/include/asm/atomic.h
+@@ -326,6 +326,16 @@ static inline long long atomic64_dec_if_positive(atomic64_t *v)
+ #define atomic64_dec_and_test(_v)	(atomic64_sub_return(1, _v) == 0)
+ #define atomic64_inc_not_zero(v)	atomic64_add_unless((v), 1, 0)
+ 
++#define atomic64_read_unchecked(v)		atomic64_read(v)
++#define atomic64_set_unchecked(v, i)		atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v)		atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v)	atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v)		atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v)		atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v)	atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v)		atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n)	atomic64_cmpxchg((v), (o), (n))
++
+ #define smp_mb__before_atomic_dec()	smp_mb()
+ #define smp_mb__after_atomic_dec()	smp_mb()
+ #define smp_mb__before_atomic_inc()	smp_mb()
 diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
 index 547f1a6..0b22b53 100644
 --- a/arch/s390/include/asm/elf.h
@@ -3260,6 +3446,18 @@ index afeb710..d1d1289 100644
  
  bottomup:
  	/*
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index f92602e..27060b2 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -31,6 +31,7 @@ config SPARC
+ 
+ config SPARC32
+ 	def_bool !64BIT
++	select GENERIC_ATOMIC64
+ 
+ config SPARC64
+ 	def_bool 64BIT
 diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile
 index ad1fb5d..fc5315b 100644
 --- a/arch/sparc/Makefile
@@ -3273,6 +3471,17 @@ index ad1fb5d..fc5315b 100644
  VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
  VMLINUX_MAIN += $(drivers-y) $(net-y)
  
+diff --git a/arch/sparc/include/asm/atomic.h b/arch/sparc/include/asm/atomic.h
+index 8ff83d8..4a459c2 100644
+--- a/arch/sparc/include/asm/atomic.h
++++ b/arch/sparc/include/asm/atomic.h
+@@ -4,5 +4,6 @@
+ #include <asm/atomic_64.h>
+ #else
+ #include <asm/atomic_32.h>
++#include <asm-generic/atomic64.h>
+ #endif
+ #endif
 diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
 index 9f421df..b81fc12 100644
 --- a/arch/sparc/include/asm/atomic_64.h
@@ -3512,6 +3721,19 @@ index 7df8b7f..4946269 100644
  extern unsigned long sparc64_elf_hwcap;
  #define ELF_HWCAP	sparc64_elf_hwcap
  
+diff --git a/arch/sparc/include/asm/page_32.h b/arch/sparc/include/asm/page_32.h
+index 156707b..aefa786 100644
+--- a/arch/sparc/include/asm/page_32.h
++++ b/arch/sparc/include/asm/page_32.h
+@@ -8,6 +8,8 @@
+ #ifndef _SPARC_PAGE_H
+ #define _SPARC_PAGE_H
+ 
++#include <linux/const.h>
++
+ #define PAGE_SHIFT   12
+ 
+ #ifndef __ASSEMBLY__
 diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h
 index a790cc6..091ed94 100644
 --- a/arch/sparc/include/asm/pgtable_32.h
@@ -5487,6 +5709,27 @@ index cbef74e..c38fead 100644
  	BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
  	page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
  
+diff --git a/arch/tile/include/asm/atomic_64.h b/arch/tile/include/asm/atomic_64.h
+index 27fe667..36d474c 100644
+--- a/arch/tile/include/asm/atomic_64.h
++++ b/arch/tile/include/asm/atomic_64.h
+@@ -142,6 +142,16 @@ static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
+ 
+ #define atomic64_inc_not_zero(v)	atomic64_add_unless((v), 1, 0)
+ 
++#define atomic64_read_unchecked(v)		atomic64_read(v)
++#define atomic64_set_unchecked(v, i)		atomic64_set((v), (i))
++#define atomic64_add_unchecked(a, v)		atomic64_add((a), (v))
++#define atomic64_add_return_unchecked(a, v)	atomic64_add_return((a), (v))
++#define atomic64_sub_unchecked(a, v)		atomic64_sub((a), (v))
++#define atomic64_inc_unchecked(v)		atomic64_inc(v)
++#define atomic64_inc_return_unchecked(v)	atomic64_inc_return(v)
++#define atomic64_dec_unchecked(v)		atomic64_dec(v)
++#define atomic64_cmpxchg_unchecked(v, o, n)	atomic64_cmpxchg((v), (o), (n))
++
+ /* Atomic dec and inc don't implement barrier, so provide them if needed. */
+ #define smp_mb__before_atomic_dec()	smp_mb()
+ #define smp_mb__after_atomic_dec()	smp_mb()
 diff --git a/arch/um/Makefile b/arch/um/Makefile
 index 7730af6..cce5b19 100644
 --- a/arch/um/Makefile
@@ -10910,7 +11153,7 @@ index 566e803..b9521e9 100644
  }
  
 diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
-index 1c66d30..23ab77d 100644
+index 1c66d30..e66922c 100644
 --- a/arch/x86/include/asm/uaccess_64.h
 +++ b/arch/x86/include/asm/uaccess_64.h
 @@ -10,6 +10,9 @@
@@ -10939,7 +11182,12 @@ index 1c66d30..23ab77d 100644
  {
  	unsigned ret;
  
-@@ -36,138 +39,222 @@ copy_user_generic(void *to, const void *from, unsigned len)
+@@ -32,142 +35,226 @@ copy_user_generic(void *to, const void *from, unsigned len)
+ 			 ASM_OUTPUT2("=a" (ret), "=D" (to), "=S" (from),
+ 				     "=d" (len)),
+ 			 "1" (to), "2" (from), "3" (len)
+-			 : "memory", "rcx", "r8", "r9", "r10", "r11");
++			 : "memory", "rcx", "r8", "r9", "r11");
  	return ret;
  }
  
@@ -41441,7 +41689,7 @@ index 608c1c3..7d040a8 100644
  	return rc;
  }
 diff --git a/fs/exec.c b/fs/exec.c
-index 3625464..7949233 100644
+index 3625464..04855f9 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
 @@ -55,12 +55,28 @@
@@ -41504,7 +41752,25 @@ index 3625464..7949233 100644
  		return NULL;
  
  	if (write) {
-@@ -274,6 +282,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
+@@ -215,6 +223,17 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+ 		if (size <= ARG_MAX)
+ 			return page;
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		// only allow 1MB for argv+env on suid/sgid binaries
++		// to prevent easy ASLR exhaustion
++		if (((bprm->cred->euid != current_euid()) ||
++		     (bprm->cred->egid != current_egid())) &&
++		    (size > (1024 * 1024))) {
++			put_page(page);
++			return NULL;
++		}
++#endif
++
+ 		/*
+ 		 * Limit to 1/4-th the stack size for the argv+env strings.
+ 		 * This ensures that:
+@@ -274,6 +293,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
  	vma->vm_end = STACK_TOP_MAX;
  	vma->vm_start = vma->vm_end - PAGE_SIZE;
  	vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
@@ -41516,7 +41782,7 @@ index 3625464..7949233 100644
  	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
  	INIT_LIST_HEAD(&vma->anon_vma_chain);
  
-@@ -288,6 +301,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
+@@ -288,6 +312,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
  	mm->stack_vm = mm->total_vm = 1;
  	up_write(&mm->mmap_sem);
  	bprm->p = vma->vm_end - sizeof(void *);
@@ -41529,7 +41795,7 @@ index 3625464..7949233 100644
  	return 0;
  err:
  	up_write(&mm->mmap_sem);
-@@ -396,19 +415,7 @@ err:
+@@ -396,19 +426,7 @@ err:
  	return err;
  }
  
@@ -41550,7 +41816,7 @@ index 3625464..7949233 100644
  {
  	const char __user *native;
  
-@@ -417,14 +424,14 @@ static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
+@@ -417,14 +435,14 @@ static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
  		compat_uptr_t compat;
  
  		if (get_user(compat, argv.ptr.compat + nr))
@@ -41567,7 +41833,7 @@ index 3625464..7949233 100644
  
  	return native;
  }
-@@ -443,7 +450,7 @@ static int count(struct user_arg_ptr argv, int max)
+@@ -443,7 +461,7 @@ static int count(struct user_arg_ptr argv, int max)
  			if (!p)
  				break;
  
@@ -41576,7 +41842,7 @@ index 3625464..7949233 100644
  				return -EFAULT;
  
  			if (i++ >= max)
-@@ -477,7 +484,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
+@@ -477,7 +495,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
  
  		ret = -EFAULT;
  		str = get_user_arg_ptr(argv, argc);
@@ -41585,7 +41851,7 @@ index 3625464..7949233 100644
  			goto out;
  
  		len = strnlen_user(str, MAX_ARG_STRLEN);
-@@ -559,7 +566,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
+@@ -559,7 +577,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
  	int r;
  	mm_segment_t oldfs = get_fs();
  	struct user_arg_ptr argv = {
@@ -41594,7 +41860,7 @@ index 3625464..7949233 100644
  	};
  
  	set_fs(KERNEL_DS);
-@@ -594,7 +601,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+@@ -594,7 +612,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
  	unsigned long new_end = old_end - shift;
  	struct mmu_gather tlb;
  
@@ -41604,7 +41870,7 @@ index 3625464..7949233 100644
  
  	/*
  	 * ensure there are no vmas between where we want to go
-@@ -603,6 +611,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+@@ -603,6 +622,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
  	if (vma != find_vma(mm, new_start))
  		return -EFAULT;
  
@@ -41615,7 +41881,7 @@ index 3625464..7949233 100644
  	/*
  	 * cover the whole range: [new_start, old_end)
  	 */
-@@ -683,10 +695,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -683,10 +706,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
  	stack_top = arch_align_stack(stack_top);
  	stack_top = PAGE_ALIGN(stack_top);
  
@@ -41626,7 +41892,7 @@ index 3625464..7949233 100644
  	stack_shift = vma->vm_end - stack_top;
  
  	bprm->p -= stack_shift;
-@@ -698,8 +706,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -698,8 +717,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
  	bprm->exec -= stack_shift;
  
  	down_write(&mm->mmap_sem);
@@ -41655,7 +41921,7 @@ index 3625464..7949233 100644
  	/*
  	 * Adjust stack execute permissions; explicitly enable for
  	 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
-@@ -718,13 +746,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -718,13 +757,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
  		goto out_unlock;
  	BUG_ON(prev != vma);
  
@@ -41669,7 +41935,7 @@ index 3625464..7949233 100644
  	/* mprotect_fixup is overkill to remove the temporary stack flags */
  	vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
  
-@@ -805,7 +826,7 @@ int kernel_read(struct file *file, loff_t offset,
+@@ -805,7 +837,7 @@ int kernel_read(struct file *file, loff_t offset,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -41678,7 +41944,7 @@ index 3625464..7949233 100644
  	set_fs(old_fs);
  	return result;
  }
-@@ -1067,6 +1088,21 @@ void set_task_comm(struct task_struct *tsk, char *buf)
+@@ -1067,6 +1099,21 @@ void set_task_comm(struct task_struct *tsk, char *buf)
  	perf_event_comm(tsk);
  }
  
@@ -41700,7 +41966,7 @@ index 3625464..7949233 100644
  int flush_old_exec(struct linux_binprm * bprm)
  {
  	int retval;
-@@ -1081,6 +1117,7 @@ int flush_old_exec(struct linux_binprm * bprm)
+@@ -1081,6 +1128,7 @@ int flush_old_exec(struct linux_binprm * bprm)
  
  	set_mm_exe_file(bprm->mm, bprm->file);
  
@@ -41708,7 +41974,7 @@ index 3625464..7949233 100644
  	/*
  	 * Release all of the old mmap stuff
  	 */
-@@ -1112,10 +1149,6 @@ EXPORT_SYMBOL(would_dump);
+@@ -1112,10 +1160,6 @@ EXPORT_SYMBOL(would_dump);
  
  void setup_new_exec(struct linux_binprm * bprm)
  {
@@ -41719,7 +41985,7 @@ index 3625464..7949233 100644
  	arch_pick_mmap_layout(current->mm);
  
  	/* This is the point of no return */
-@@ -1126,18 +1159,7 @@ void setup_new_exec(struct linux_binprm * bprm)
+@@ -1126,18 +1170,7 @@ void setup_new_exec(struct linux_binprm * bprm)
  	else
  		set_dumpable(current->mm, suid_dumpable);
  
@@ -41739,7 +42005,7 @@ index 3625464..7949233 100644
  
  	/* Set the new mm task size. We have to do that late because it may
  	 * depend on TIF_32BIT which is only updated in flush_thread() on
-@@ -1247,7 +1269,7 @@ int check_unsafe_exec(struct linux_binprm *bprm)
+@@ -1247,7 +1280,7 @@ int check_unsafe_exec(struct linux_binprm *bprm)
  	}
  	rcu_read_unlock();
  
@@ -41748,18 +42014,18 @@ index 3625464..7949233 100644
  		bprm->unsafe |= LSM_UNSAFE_SHARE;
  	} else {
  		res = -EAGAIN;
-@@ -1442,6 +1464,10 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+@@ -1442,6 +1475,10 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
  
  EXPORT_SYMBOL(search_binary_handler);
  
 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+atomic64_unchecked_t global_exec_counter = ATOMIC64_INIT(0);
++static atomic64_unchecked_t global_exec_counter = ATOMIC64_INIT(0);
 +#endif
 +
  /*
   * sys_execve() executes a new program.
   */
-@@ -1450,6 +1476,11 @@ static int do_execve_common(const char *filename,
+@@ -1450,6 +1487,11 @@ static int do_execve_common(const char *filename,
  				struct user_arg_ptr envp,
  				struct pt_regs *regs)
  {
@@ -41771,7 +42037,7 @@ index 3625464..7949233 100644
  	struct linux_binprm *bprm;
  	struct file *file;
  	struct files_struct *displaced;
-@@ -1457,6 +1488,8 @@ static int do_execve_common(const char *filename,
+@@ -1457,6 +1499,8 @@ static int do_execve_common(const char *filename,
  	int retval;
  	const struct cred *cred = current_cred();
  
@@ -41780,7 +42046,7 @@ index 3625464..7949233 100644
  	/*
  	 * We move the actual failure in case of RLIMIT_NPROC excess from
  	 * set*uid() to execve() because too many poorly written programs
-@@ -1497,12 +1530,27 @@ static int do_execve_common(const char *filename,
+@@ -1497,12 +1541,27 @@ static int do_execve_common(const char *filename,
  	if (IS_ERR(file))
  		goto out_unmark;
  
@@ -41808,7 +42074,7 @@ index 3625464..7949233 100644
  	retval = bprm_mm_init(bprm);
  	if (retval)
  		goto out_file;
-@@ -1532,11 +1580,46 @@ static int do_execve_common(const char *filename,
+@@ -1532,11 +1591,46 @@ static int do_execve_common(const char *filename,
  	if (retval < 0)
  		goto out;
  
@@ -41856,7 +42122,7 @@ index 3625464..7949233 100644
  	current->fs->in_exec = 0;
  	current->in_execve = 0;
  	acct_update_integrals(current);
-@@ -1545,6 +1628,14 @@ static int do_execve_common(const char *filename,
+@@ -1545,6 +1639,14 @@ static int do_execve_common(const char *filename,
  		put_files_struct(displaced);
  	return retval;
  
@@ -41871,7 +42137,7 @@ index 3625464..7949233 100644
  out:
  	if (bprm->mm) {
  		acct_arg_size(bprm, 0);
-@@ -1618,7 +1709,7 @@ static int expand_corename(struct core_name *cn)
+@@ -1618,7 +1720,7 @@ static int expand_corename(struct core_name *cn)
  {
  	char *old_corename = cn->corename;
  
@@ -41880,7 +42146,7 @@ index 3625464..7949233 100644
  	cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
  
  	if (!cn->corename) {
-@@ -1715,7 +1806,7 @@ static int format_corename(struct core_name *cn, long signr)
+@@ -1715,7 +1817,7 @@ static int format_corename(struct core_name *cn, long signr)
  	int pid_in_pattern = 0;
  	int err = 0;
  
@@ -41889,7 +42155,7 @@ index 3625464..7949233 100644
  	cn->corename = kmalloc(cn->size, GFP_KERNEL);
  	cn->used = 0;
  
-@@ -1812,6 +1903,218 @@ out:
+@@ -1812,6 +1914,218 @@ out:
  	return ispipe;
  }
  
@@ -42108,7 +42374,7 @@ index 3625464..7949233 100644
  static int zap_process(struct task_struct *start, int exit_code)
  {
  	struct task_struct *t;
-@@ -2023,17 +2326,17 @@ static void wait_for_dump_helpers(struct file *file)
+@@ -2023,17 +2337,17 @@ static void wait_for_dump_helpers(struct file *file)
  	pipe = file->f_path.dentry->d_inode->i_pipe;
  
  	pipe_lock(pipe);
@@ -42131,7 +42397,7 @@ index 3625464..7949233 100644
  	pipe_unlock(pipe);
  
  }
-@@ -2094,7 +2397,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2094,7 +2408,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  	int retval = 0;
  	int flag = 0;
  	int ispipe;
@@ -42140,7 +42406,7 @@ index 3625464..7949233 100644
  	struct coredump_params cprm = {
  		.signr = signr,
  		.regs = regs,
-@@ -2109,6 +2412,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2109,6 +2423,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  
  	audit_core_dumps(signr);
  
@@ -42150,7 +42416,7 @@ index 3625464..7949233 100644
  	binfmt = mm->binfmt;
  	if (!binfmt || !binfmt->core_dump)
  		goto fail;
-@@ -2176,7 +2482,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2176,7 +2493,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  		}
  		cprm.limit = RLIM_INFINITY;
  
@@ -42159,7 +42425,7 @@ index 3625464..7949233 100644
  		if (core_pipe_limit && (core_pipe_limit < dump_count)) {
  			printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
  			       task_tgid_vnr(current), current->comm);
-@@ -2203,6 +2509,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
+@@ -2203,6 +2520,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
  	} else {
  		struct inode *inode;
  
@@ -42168,7 +42434,7 @@ index 3625464..7949233 100644
  		if (cprm.limit < binfmt->min_coredump)
  			goto fail_unlock;
  
-@@ -2246,7 +2554,7 @@ close_fail:
+@@ -2246,7 +2565,7 @@ close_fail:
  		filp_close(cprm.file, NULL);
  fail_dropcount:
  	if (ispipe)
@@ -42177,7 +42443,7 @@ index 3625464..7949233 100644
  fail_unlock:
  	kfree(cn.corename);
  fail_corename:
-@@ -2265,7 +2573,7 @@ fail:
+@@ -2265,7 +2584,7 @@ fail:
   */
  int dump_write(struct file *file, const void *addr, int nr)
  {
@@ -42536,7 +42802,7 @@ index 0845f84..7b4ebef 100644
  
  	if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
 diff --git a/fs/fs_struct.c b/fs/fs_struct.c
-index 78b519c..212c0d0 100644
+index 78b519c..a8b4979 100644
 --- a/fs/fs_struct.c
 +++ b/fs/fs_struct.c
 @@ -4,6 +4,7 @@
@@ -42603,7 +42869,14 @@ index 78b519c..212c0d0 100644
  	spin_unlock(&fs->lock);
  	task_unlock(current);
  
-@@ -170,7 +178,7 @@ EXPORT_SYMBOL(current_umask);
+@@ -164,13 +172,13 @@ EXPORT_SYMBOL_GPL(unshare_fs_struct);
+ 
+ int current_umask(void)
+ {
+-	return current->fs->umask;
++	return current->fs->umask | gr_acl_umask();
+ }
+ EXPORT_SYMBOL(current_umask);
  
  /* to be mentioned only in INIT_TASK */
  struct fs_struct init_fs = {
@@ -44967,7 +45240,7 @@ index 5d22872..523db20 100644
  		kfree(link);
  }
 diff --git a/fs/open.c b/fs/open.c
-index 22c41b5..695cb17 100644
+index 22c41b5..78894cf 100644
 --- a/fs/open.c
 +++ b/fs/open.c
 @@ -112,6 +112,10 @@ static long do_sys_truncate(const char __user *pathname, loff_t length)
@@ -45033,7 +45306,7 @@ index 22c41b5..695cb17 100644
  		return error;
  	mutex_lock(&inode->i_mutex);
 +
-+	if (!gr_acl_handle_fchmod(path->dentry, path->mnt, mode)) {
++	if (!gr_acl_handle_chmod(path->dentry, path->mnt, &mode)) {
 +		error = -EACCES;
 +		goto out_unlock;
 +	}
@@ -45394,7 +45667,7 @@ index 3a1dafd..1456746 100644
 +}
 +#endif
 diff --git a/fs/proc/base.c b/fs/proc/base.c
-index 1ace83d..357b933 100644
+index 1ace83d..f5e575d 100644
 --- a/fs/proc/base.c
 +++ b/fs/proc/base.c
 @@ -107,6 +107,22 @@ struct pid_entry {
@@ -45534,7 +45807,18 @@ index 1ace83d..357b933 100644
  		put_task_struct(task);
  	}
  	return allowed;
-@@ -797,6 +815,11 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
+@@ -786,6 +804,10 @@ static int mem_open(struct inode* inode, struct file* file)
+ 	file->f_mode |= FMODE_UNSIGNED_OFFSET;
+ 	file->private_data = mm;
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	file->f_version = current->exec_id;
++#endif
++
+ 	return 0;
+ }
+ 
+@@ -797,6 +819,17 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
  	ssize_t copied;
  	char *page;
  
@@ -45542,11 +45826,17 @@ index 1ace83d..357b933 100644
 +	if (write)
 +		return -EPERM;
 +#endif
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	if (file->f_version != current->exec_id) {
++		gr_log_badprocpid("mem");
++		return 0;
++	}
++#endif
 +
  	if (!mm)
  		return 0;
  
-@@ -897,6 +920,9 @@ static ssize_t environ_read(struct file *file, char __user *buf,
+@@ -897,6 +930,9 @@ static ssize_t environ_read(struct file *file, char __user *buf,
  	if (!task)
  		goto out_no_task;
  
@@ -45556,7 +45846,7 @@ index 1ace83d..357b933 100644
  	ret = -ENOMEM;
  	page = (char *)__get_free_page(GFP_TEMPORARY);
  	if (!page)
-@@ -1519,7 +1545,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
+@@ -1519,7 +1555,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
  	path_put(&nd->path);
  
  	/* Are we allowed to snoop on the tasks file descriptors? */
@@ -45565,7 +45855,7 @@ index 1ace83d..357b933 100644
  		goto out;
  
  	error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
-@@ -1558,8 +1584,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
+@@ -1558,8 +1594,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
  	struct path path;
  
  	/* Are we allowed to snoop on the tasks file descriptors? */
@@ -45586,7 +45876,7 @@ index 1ace83d..357b933 100644
  
  	error = PROC_I(inode)->op.proc_get_link(inode, &path);
  	if (error)
-@@ -1624,7 +1660,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
+@@ -1624,7 +1670,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
  		rcu_read_lock();
  		cred = __task_cred(task);
  		inode->i_uid = cred->euid;
@@ -45598,7 +45888,7 @@ index 1ace83d..357b933 100644
  		rcu_read_unlock();
  	}
  	security_task_to_inode(task, inode);
-@@ -1642,6 +1682,9 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
+@@ -1642,6 +1692,9 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
  	struct inode *inode = dentry->d_inode;
  	struct task_struct *task;
  	const struct cred *cred;
@@ -45608,7 +45898,7 @@ index 1ace83d..357b933 100644
  
  	generic_fillattr(inode, stat);
  
-@@ -1649,13 +1692,41 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
+@@ -1649,13 +1702,41 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
  	stat->uid = 0;
  	stat->gid = 0;
  	task = pid_task(proc_pid(inode), PIDTYPE_PID);
@@ -45651,7 +45941,7 @@ index 1ace83d..357b933 100644
  	}
  	rcu_read_unlock();
  	return 0;
-@@ -1692,11 +1763,20 @@ int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
+@@ -1692,11 +1773,20 @@ int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
  
  	if (task) {
  		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
@@ -45672,7 +45962,7 @@ index 1ace83d..357b933 100644
  			rcu_read_unlock();
  		} else {
  			inode->i_uid = 0;
-@@ -1814,7 +1894,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
+@@ -1814,7 +1904,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
  	int fd = proc_fd(inode);
  
  	if (task) {
@@ -45682,7 +45972,7 @@ index 1ace83d..357b933 100644
  		put_task_struct(task);
  	}
  	if (files) {
-@@ -2082,11 +2163,21 @@ static const struct file_operations proc_fd_operations = {
+@@ -2082,11 +2173,21 @@ static const struct file_operations proc_fd_operations = {
   */
  static int proc_fd_permission(struct inode *inode, int mask)
  {
@@ -45706,7 +45996,7 @@ index 1ace83d..357b933 100644
  	return rv;
  }
  
-@@ -2196,6 +2287,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
+@@ -2196,6 +2297,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
  	if (!task)
  		goto out_no_task;
  
@@ -45716,7 +46006,7 @@ index 1ace83d..357b933 100644
  	/*
  	 * Yes, it does not scale. And it should not. Don't add
  	 * new entries into /proc/<tgid>/ without very good reasons.
-@@ -2240,6 +2334,9 @@ static int proc_pident_readdir(struct file *filp,
+@@ -2240,6 +2344,9 @@ static int proc_pident_readdir(struct file *filp,
  	if (!task)
  		goto out_no_task;
  
@@ -45726,7 +46016,7 @@ index 1ace83d..357b933 100644
  	ret = 0;
  	i = filp->f_pos;
  	switch (i) {
-@@ -2510,7 +2607,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
+@@ -2510,7 +2617,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
  static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
  				void *cookie)
  {
@@ -45735,7 +46025,7 @@ index 1ace83d..357b933 100644
  	if (!IS_ERR(s))
  		__putname(s);
  }
-@@ -2708,7 +2805,7 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2708,7 +2815,7 @@ static const struct pid_entry tgid_base_stuff[] = {
  	REG("autogroup",  S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
  #endif
  	REG("comm",      S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
@@ -45744,7 +46034,7 @@ index 1ace83d..357b933 100644
  	INF("syscall",    S_IRUGO, proc_pid_syscall),
  #endif
  	INF("cmdline",    S_IRUGO, proc_pid_cmdline),
-@@ -2733,10 +2830,10 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2733,10 +2840,10 @@ static const struct pid_entry tgid_base_stuff[] = {
  #ifdef CONFIG_SECURITY
  	DIR("attr",       S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
  #endif
@@ -45757,7 +46047,7 @@ index 1ace83d..357b933 100644
  	ONE("stack",      S_IRUGO, proc_pid_stack),
  #endif
  #ifdef CONFIG_SCHEDSTATS
-@@ -2770,6 +2867,9 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2770,6 +2877,9 @@ static const struct pid_entry tgid_base_stuff[] = {
  #ifdef CONFIG_HARDWALL
  	INF("hardwall",   S_IRUGO, proc_pid_hardwall),
  #endif
@@ -45767,7 +46057,7 @@ index 1ace83d..357b933 100644
  };
  
  static int proc_tgid_base_readdir(struct file * filp,
-@@ -2895,7 +2995,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
+@@ -2895,7 +3005,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
  	if (!inode)
  		goto out;
  
@@ -45782,7 +46072,7 @@ index 1ace83d..357b933 100644
  	inode->i_op = &proc_tgid_base_inode_operations;
  	inode->i_fop = &proc_tgid_base_operations;
  	inode->i_flags|=S_IMMUTABLE;
-@@ -2937,7 +3044,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
+@@ -2937,7 +3054,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
  	if (!task)
  		goto out;
  
@@ -45794,7 +46084,7 @@ index 1ace83d..357b933 100644
  	put_task_struct(task);
  out:
  	return result;
-@@ -3002,6 +3113,11 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
+@@ -3002,6 +3123,11 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
  {
  	unsigned int nr;
  	struct task_struct *reaper;
@@ -45806,7 +46096,7 @@ index 1ace83d..357b933 100644
  	struct tgid_iter iter;
  	struct pid_namespace *ns;
  
-@@ -3025,8 +3141,27 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
+@@ -3025,8 +3151,27 @@ int proc_pid_readdir(struct file * filp, void * dirent, filldir_t filldir)
  	for (iter = next_tgid(ns, iter);
  	     iter.task;
  	     iter.tgid += 1, iter = next_tgid(ns, iter)) {
@@ -45835,7 +46125,7 @@ index 1ace83d..357b933 100644
  			put_task_struct(iter.task);
  			goto out;
  		}
-@@ -3054,7 +3189,7 @@ static const struct pid_entry tid_base_stuff[] = {
+@@ -3054,7 +3199,7 @@ static const struct pid_entry tid_base_stuff[] = {
  	REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
  #endif
  	REG("comm",      S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
@@ -45844,7 +46134,7 @@ index 1ace83d..357b933 100644
  	INF("syscall",   S_IRUGO, proc_pid_syscall),
  #endif
  	INF("cmdline",   S_IRUGO, proc_pid_cmdline),
-@@ -3078,10 +3213,10 @@ static const struct pid_entry tid_base_stuff[] = {
+@@ -3078,10 +3223,10 @@ static const struct pid_entry tid_base_stuff[] = {
  #ifdef CONFIG_SECURITY
  	DIR("attr",      S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
  #endif
@@ -46563,10 +46853,18 @@ index d33418f..2a5345e 100644
  		return -EINVAL;
  
 diff --git a/fs/seq_file.c b/fs/seq_file.c
-index dba43c3..1dfaf14 100644
+index dba43c3..9fb8511 100644
 --- a/fs/seq_file.c
 +++ b/fs/seq_file.c
-@@ -40,6 +40,9 @@ int seq_open(struct file *file, const struct seq_operations *op)
+@@ -9,6 +9,7 @@
+ #include <linux/module.h>
+ #include <linux/seq_file.h>
+ #include <linux/slab.h>
++#include <linux/sched.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/page.h>
+@@ -40,6 +41,9 @@ int seq_open(struct file *file, const struct seq_operations *op)
  	memset(p, 0, sizeof(*p));
  	mutex_init(&p->lock);
  	p->op = op;
@@ -46576,7 +46874,7 @@ index dba43c3..1dfaf14 100644
  
  	/*
  	 * Wrappers around seq_open(e.g. swaps_open) need to be
-@@ -76,7 +79,8 @@ static int traverse(struct seq_file *m, loff_t offset)
+@@ -76,7 +80,8 @@ static int traverse(struct seq_file *m, loff_t offset)
  		return 0;
  	}
  	if (!m->buf) {
@@ -46586,7 +46884,7 @@ index dba43c3..1dfaf14 100644
  		if (!m->buf)
  			return -ENOMEM;
  	}
-@@ -116,7 +120,8 @@ static int traverse(struct seq_file *m, loff_t offset)
+@@ -116,7 +121,8 @@ static int traverse(struct seq_file *m, loff_t offset)
  Eoverflow:
  	m->op->stop(m, p);
  	kfree(m->buf);
@@ -46596,7 +46894,7 @@ index dba43c3..1dfaf14 100644
  	return !m->buf ? -ENOMEM : -EAGAIN;
  }
  
-@@ -169,7 +174,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
+@@ -169,7 +175,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
  	m->version = file->f_version;
  	/* grab buffer if we didn't have one */
  	if (!m->buf) {
@@ -46606,7 +46904,7 @@ index dba43c3..1dfaf14 100644
  		if (!m->buf)
  			goto Enomem;
  	}
-@@ -210,7 +216,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
+@@ -210,7 +217,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
  			goto Fill;
  		m->op->stop(m, p);
  		kfree(m->buf);
@@ -46616,7 +46914,7 @@ index dba43c3..1dfaf14 100644
  		if (!m->buf)
  			goto Enomem;
  		m->count = 0;
-@@ -549,7 +556,7 @@ static void single_stop(struct seq_file *p, void *v)
+@@ -549,7 +557,7 @@ static void single_stop(struct seq_file *p, void *v)
  int single_open(struct file *file, int (*show)(struct seq_file *, void *),
  		void *data)
  {
@@ -47033,10 +47331,10 @@ index 23ce927..e274cc1 100644
  		kfree(s);
 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
 new file mode 100644
-index 0000000..8faa28b
+index 0000000..41df561
 --- /dev/null
 +++ b/grsecurity/Kconfig
-@@ -0,0 +1,1073 @@
+@@ -0,0 +1,1075 @@
 +#
 +# grecurity configuration
 +#
@@ -47243,7 +47541,7 @@ index 0000000..8faa28b
 +
 +endchoice
 +
-+menu "Address Space Protection"
++menu "Memory Protections"
 +depends on GRKERNSEC
 +
 +config GRKERNSEC_KMEM
@@ -47300,7 +47598,7 @@ index 0000000..8faa28b
 +	  protect your kernel against modification, use the RBAC system.
 +
 +config GRKERNSEC_PROC_MEMMAP
-+	bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
++	bool "Harden ASLR against information leaks and entropy reduction"
 +	default y if (PAX_NOEXEC || PAX_ASLR)
 +	depends on PAX_NOEXEC || PAX_ASLR
 +	help
@@ -47311,9 +47609,11 @@ index 0000000..8faa28b
 +	  dangerous sources of information, this option causes reads of sensitive
 +	  /proc/<pid> entries where the file descriptor was opened in a different
 +	  task than the one performing the read.  Such attempts are logged.
-+	  If you use PaX it is greatly recommended that you say Y here as it
-+	  closes up a hole that makes the full ASLR useless for suid
-+	  binaries.
++	  Finally, this option limits argv/env strings for suid/sgid binaries
++	  to 1MB to prevent a complete exhaustion of the stack entropy provided
++	  by ASLR.
++	  If you use PaX it is essential that you say Y here as it closes up
++	  several holes that make full ASLR useless for suid/sgid binaries.
 +
 +config GRKERNSEC_BRUTE
 +	bool "Deter exploit bruteforcing"
@@ -48112,10 +48412,10 @@ index 0000000..8faa28b
 +endmenu
 diff --git a/grsecurity/Makefile b/grsecurity/Makefile
 new file mode 100644
-index 0000000..1b9afa9
+index 0000000..496e60d
 --- /dev/null
 +++ b/grsecurity/Makefile
-@@ -0,0 +1,38 @@
+@@ -0,0 +1,40 @@
 +# grsecurity's ACL system was originally written in 2001 by Michael Dalton
 +# during 2001-2009 it has been completely redesigned by Brad Spengler
 +# into an RBAC system
@@ -48124,7 +48424,9 @@ index 0000000..1b9afa9
 +# are copyright Brad Spengler - Open Source Security, Inc., and released 
 +# under the GPL v2 or higher
 +
++ifndef CONFIG_IA64
 +KBUILD_CFLAGS += -Werror
++endif
 +
 +obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
 +	grsec_mount.o grsec_sig.o grsec_sysctl.o \
@@ -48156,10 +48458,10 @@ index 0000000..1b9afa9
 +endif
 diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
 new file mode 100644
-index 0000000..6e989da
+index 0000000..7715893
 --- /dev/null
 +++ b/grsecurity/gracl.c
-@@ -0,0 +1,4163 @@
+@@ -0,0 +1,4164 @@
 +#include <linux/kernel.h>
 +#include <linux/module.h>
 +#include <linux/sched.h>
@@ -50431,17 +50733,18 @@ index 0000000..6e989da
 +void
 +gr_copy_label(struct task_struct *tsk)
 +{
++	/* plain copying of fields is already done by dup_task_struct */
 +	tsk->signal->used_accept = 0;
 +	tsk->acl_sp_role = 0;
-+	tsk->acl_role_id = current->acl_role_id;
-+	tsk->acl = current->acl;
-+	tsk->role = current->role;
++	//tsk->acl_role_id = current->acl_role_id;
++	//tsk->acl = current->acl;
++	//tsk->role = current->role;
 +	tsk->signal->curr_ip = current->signal->curr_ip;
 +	tsk->signal->saved_ip = current->signal->saved_ip;
 +	if (current->exec_file)
 +		get_file(current->exec_file);
-+	tsk->exec_file = current->exec_file;
-+	tsk->is_writable = current->is_writable;
++	//tsk->exec_file = current->exec_file;
++	//tsk->is_writable = current->is_writable;
 +	if (unlikely(current->signal->used_accept)) {
 +		current->signal->curr_ip = 0;
 +		current->signal->saved_ip = 0;
@@ -50653,8 +50956,8 @@ index 0000000..6e989da
 +
 +	/* don't change the role if we're not a privileged process */
 +	if (role && task->role != role &&
-+	    (((role->roletype & GR_ROLE_USER) && gr_acl_is_capable(CAP_SETUID)) ||
-+	     ((role->roletype & GR_ROLE_GROUP) && gr_acl_is_capable(CAP_SETGID))))
++	    (((role->roletype & GR_ROLE_USER) && !gr_acl_is_capable(CAP_SETUID)) ||
++	     ((role->roletype & GR_ROLE_GROUP) && !gr_acl_is_capable(CAP_SETGID))))
 +		return;
 +
 +	/* perform subject lookup in possibly new role
@@ -52543,10 +52846,10 @@ index 0000000..955ddfb
 +
 diff --git a/grsecurity/gracl_fs.c b/grsecurity/gracl_fs.c
 new file mode 100644
-index 0000000..4eda5c3
+index 0000000..88d0e87
 --- /dev/null
 +++ b/grsecurity/gracl_fs.c
-@@ -0,0 +1,433 @@
+@@ -0,0 +1,435 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/types.h>
@@ -52557,6 +52860,15 @@ index 0000000..4eda5c3
 +#include <linux/grinternal.h>
 +#include <linux/gracl.h>
 +
++umode_t
++gr_acl_umask(void)
++{
++	if (unlikely(!gr_acl_is_enabled()))
++		return 0;
++
++	return current->role->umask;
++}
++
 +__u32
 +gr_acl_handle_hidden_file(const struct dentry * dentry,
 +			  const struct vfsmount * mnt)
@@ -52745,25 +53057,18 @@ index 0000000..4eda5c3
 +}
 +
 +__u32
-+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
-+		     mode_t mode)
++gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
++		     umode_t *modeptr)
 +{
++	umode_t mode;
++
++	*modeptr &= ~gr_acl_umask();
++	mode = *modeptr;
++
 +	if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
 +		return 1;
 +
-+	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
-+				   GR_FCHMOD_ACL_MSG);
-+	} else {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
-+	}
-+}
-+
-+__u32
-+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
-+		    mode_t mode)
-+{
-+	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
++	if (unlikely(mode & (S_ISUID | S_ISGID))) {
 +		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
 +				   GR_CHMOD_ACL_MSG);
 +	} else {
@@ -54389,10 +54694,10 @@ index 0000000..a2dc675
 +}
 diff --git a/grsecurity/grsec_disabled.c b/grsecurity/grsec_disabled.c
 new file mode 100644
-index 0000000..d81a586
+index 0000000..213ad8b
 --- /dev/null
 +++ b/grsecurity/grsec_disabled.c
-@@ -0,0 +1,439 @@
+@@ -0,0 +1,437 @@
 +#include <linux/kernel.h>
 +#include <linux/module.h>
 +#include <linux/sched.h>
@@ -54632,15 +54937,8 @@ index 0000000..d81a586
 +}
 +
 +__u32
-+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
-+		     mode_t mode)
-+{
-+	return 1;
-+}
-+
-+__u32
 +gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
-+		    mode_t mode)
++		    umode_t *mode)
 +{
 +	return 1;
 +}
@@ -54663,6 +54961,11 @@ index 0000000..d81a586
 +	return;
 +}
 +
++umode_t gr_acl_umask(void)
++{
++	return 0;
++}
++
 +__u32
 +gr_acl_handle_mknod(const struct dentry * new_dentry,
 +		    const struct dentry * parent_dentry,
@@ -58245,10 +58548,10 @@ index 6d18f35..ab71e2c 100644
  	struct blk_integrity *integrity;
 diff --git a/include/linux/gracl.h b/include/linux/gracl.h
 new file mode 100644
-index 0000000..0dc3943
+index 0000000..8a130b6
 --- /dev/null
 +++ b/include/linux/gracl.h
-@@ -0,0 +1,317 @@
+@@ -0,0 +1,319 @@
 +#ifndef GR_ACL_H
 +#define GR_ACL_H
 +
@@ -58260,8 +58563,8 @@ index 0000000..0dc3943
 +
 +/* Major status information */
 +
-+#define GR_VERSION  "grsecurity 2.2.2"
-+#define GRSECURITY_VERSION 0x2202
++#define GR_VERSION  "grsecurity 2.9"
++#define GRSECURITY_VERSION 0x2900
 +
 +enum {
 +	GR_SHUTDOWN = 0,
@@ -58424,6 +58727,8 @@ index 0000000..0dc3943
 +	uid_t *domain_children;
 +	__u16 domain_child_num;
 +
++	umode_t umask;
++
 +	struct acl_subject_label **subj_hash;
 +	__u32 subj_hash_size;
 +};
@@ -58956,10 +59261,10 @@ index 0000000..da390f1
 +#endif
 diff --git a/include/linux/grmsg.h b/include/linux/grmsg.h
 new file mode 100644
-index 0000000..8b9ed56
+index 0000000..f885406
 --- /dev/null
 +++ b/include/linux/grmsg.h
-@@ -0,0 +1,110 @@
+@@ -0,0 +1,109 @@
 +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
 +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
 +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
@@ -59003,7 +59308,6 @@ index 0000000..8b9ed56
 +#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
 +#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
 +#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
-+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
 +#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
 +#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
 +#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
@@ -59072,7 +59376,7 @@ index 0000000..8b9ed56
 +#define GR_BADPROCPID_MSG "denied read of sensitive /proc/pid/%s entry via fd passed across exec by "
 diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
 new file mode 100644
-index 0000000..10c8ced
+index 0000000..2ccf677
 --- /dev/null
 +++ b/include/linux/grsecurity.h
 @@ -0,0 +1,229 @@
@@ -59150,6 +59454,8 @@ index 0000000..10c8ced
 +void gr_handle_ioperm(void);
 +void gr_handle_iopl(void);
 +
++umode_t gr_acl_umask(void);
++
 +int gr_tpe_allow(const struct file *file);
 +
 +void gr_set_chroot_entries(struct task_struct *task, struct path *path);
@@ -59204,10 +59510,8 @@ index 0000000..10c8ced
 +				 const struct vfsmount *mnt);
 +__u32 gr_acl_handle_access(const struct dentry *dentry,
 +				  const struct vfsmount *mnt, const int fmode);
-+__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
-+				  const struct vfsmount *mnt, mode_t mode);
 +__u32 gr_acl_handle_chmod(const struct dentry *dentry,
-+				 const struct vfsmount *mnt, mode_t mode);
++				 const struct vfsmount *mnt, umode_t *mode);
 +__u32 gr_acl_handle_chown(const struct dentry *dentry,
 +				 const struct vfsmount *mnt);
 +__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
@@ -60374,7 +60678,7 @@ index 2148b12..519b820 100644
  
  static inline void anon_vma_merge(struct vm_area_struct *vma,
 diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 1c4f3e9..dafcd27 100644
+index 1c4f3e9..b4e4851 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
 @@ -101,6 +101,7 @@ struct bio_list;
@@ -60491,7 +60795,7 @@ index 1c4f3e9..dafcd27 100644
 +#ifdef CONFIG_GRKERNSEC
 +	/* grsecurity */
 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	long long exec_id;
++	u64 exec_id;
 +#endif
 +#ifdef CONFIG_GRKERNSEC_SETXID
 +	const struct cred *delayed_cred;
@@ -60650,7 +60954,7 @@ index e8c619d..e0cbd1c 100644
  
  /* Maximum number of letters for an LSM name string */
 diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
-index 0b69a46..4796016 100644
+index 0b69a46..b2ffa4c 100644
 --- a/include/linux/seq_file.h
 +++ b/include/linux/seq_file.h
 @@ -24,6 +24,9 @@ struct seq_file {
@@ -60658,7 +60962,7 @@ index 0b69a46..4796016 100644
  	const struct seq_operations *op;
  	int poll_event;
 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	long long exec_id;
++	u64 exec_id;
 +#endif
  	void *private;
  };
@@ -63322,7 +63626,7 @@ index e6e01b9..619f837 100644
  
  	if (group_dead)
 diff --git a/kernel/fork.c b/kernel/fork.c
-index da4a6a1..0483b61 100644
+index da4a6a1..0973380 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -280,7 +280,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
@@ -63592,20 +63896,16 @@ index da4a6a1..0483b61 100644
  	if (atomic_read(&p->real_cred->user->processes) >=
  			task_rlimit(p, RLIMIT_NPROC)) {
  		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
-@@ -1256,6 +1317,12 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+@@ -1256,6 +1317,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
  	if (clone_flags & CLONE_THREAD)
  		p->tgid = current->tgid;
  
 +	gr_copy_label(p);
 +
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	p->exec_id = current->exec_id;
-+#endif
-+
  	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
  	/*
  	 * Clear TID on mm_release()?
-@@ -1418,6 +1485,8 @@ bad_fork_cleanup_count:
+@@ -1418,6 +1481,8 @@ bad_fork_cleanup_count:
  bad_fork_free:
  	free_task(p);
  fork_out:
@@ -63614,7 +63914,7 @@ index da4a6a1..0483b61 100644
  	return ERR_PTR(retval);
  }
  
-@@ -1518,6 +1587,8 @@ long do_fork(unsigned long clone_flags,
+@@ -1518,6 +1583,8 @@ long do_fork(unsigned long clone_flags,
  		if (clone_flags & CLONE_PARENT_SETTID)
  			put_user(nr, parent_tidptr);
  
@@ -63623,7 +63923,7 @@ index da4a6a1..0483b61 100644
  		if (clone_flags & CLONE_VFORK) {
  			p->vfork_done = &vfork;
  			init_completion(&vfork);
-@@ -1627,7 +1698,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1627,7 +1694,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
  		return 0;
  
  	/* don't need lock here; in the worst case we'll do useless copy */
@@ -63632,7 +63932,7 @@ index da4a6a1..0483b61 100644
  		return 0;
  
  	*new_fsp = copy_fs_struct(fs);
-@@ -1716,7 +1787,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -1716,7 +1783,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
  			fs = current->fs;
  			spin_lock(&fs->lock);
  			current->fs = new_fs;
@@ -65836,36 +66136,6 @@ index 9feffa4..54058df 100644
  		   rdp->dynticks->dynticks_nesting,
  		   rdp->dynticks->dynticks_nmi_nesting,
  		   rdp->dynticks_fqs);
-diff --git a/kernel/relay.c b/kernel/relay.c
-index 226fade..b6f803a 100644
---- a/kernel/relay.c
-+++ b/kernel/relay.c
-@@ -164,10 +164,14 @@ depopulate:
-  */
- static struct rchan_buf *relay_create_buf(struct rchan *chan)
- {
--	struct rchan_buf *buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
-+	struct rchan_buf *buf;
-+
-+	if (chan->n_subbufs > UINT_MAX / sizeof(size_t *))
-+		return NULL;
-+
-+	buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
- 	if (!buf)
- 		return NULL;
--
- 	buf->padding = kmalloc(chan->n_subbufs * sizeof(size_t *), GFP_KERNEL);
- 	if (!buf->padding)
- 		goto free_buf;
-@@ -574,6 +578,8 @@ struct rchan *relay_open(const char *base_filename,
- 
- 	if (!(subbuf_size && n_subbufs))
- 		return NULL;
-+	if (subbuf_size > UINT_MAX / n_subbufs)
-+		return NULL;
- 
- 	chan = kzalloc(sizeof(struct rchan), GFP_KERNEL);
- 	if (!chan)
 diff --git a/kernel/resource.c b/kernel/resource.c
 index 7640b3a..5879283 100644
 --- a/kernel/resource.c
@@ -68676,7 +68946,7 @@ index 4f4f53b..9511904 100644
  	    capable(CAP_IPC_LOCK))
  		ret = do_mlockall(flags);
 diff --git a/mm/mmap.c b/mm/mmap.c
-index eae90af..51ca80b 100644
+index eae90af..44552cf 100644
 --- a/mm/mmap.c
 +++ b/mm/mmap.c
 @@ -46,6 +46,16 @@
@@ -69301,20 +69571,60 @@ index eae90af..51ca80b 100644
  }
  
  unsigned long
-@@ -1638,6 +1864,28 @@ out:
- 	return prev ? prev->vm_next : vma;
- }
+@@ -1603,40 +1829,42 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
+ 
+ EXPORT_SYMBOL(find_vma);
+ 
+-/* Same as find_vma, but also return a pointer to the previous VMA in *pprev. */
++/*
++ * Same as find_vma, but also return a pointer to the previous VMA in *pprev.
++ * Note: pprev is set to NULL when return value is NULL.
++ */
+ struct vm_area_struct *
+ find_vma_prev(struct mm_struct *mm, unsigned long addr,
+ 			struct vm_area_struct **pprev)
+ {
+-	struct vm_area_struct *vma = NULL, *prev = NULL;
+-	struct rb_node *rb_node;
+-	if (!mm)
+-		goto out;
++	struct vm_area_struct *vma;
+ 
+-	/* Guard against addr being lower than the first VMA */
+-	vma = mm->mmap;
++	vma = find_vma(mm, addr);
++	*pprev = vma ? vma->vm_prev : NULL;
++	return vma;
++}
  
+-	/* Go through the RB tree quickly. */
+-	rb_node = mm->mm_rb.rb_node;
 +#ifdef CONFIG_PAX_SEGMEXEC
 +struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
 +{
 +	struct vm_area_struct *vma_m;
-+
+ 
+-	while (rb_node) {
+-		struct vm_area_struct *vma_tmp;
+-		vma_tmp = rb_entry(rb_node, struct vm_area_struct, vm_rb);
+-
+-		if (addr < vma_tmp->vm_end) {
+-			rb_node = rb_node->rb_left;
+-		} else {
+-			prev = vma_tmp;
+-			if (!prev->vm_next || (addr < prev->vm_next->vm_end))
+-				break;
+-			rb_node = rb_node->rb_right;
+-		}
 +	BUG_ON(!vma || vma->vm_start >= vma->vm_end);
 +	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
 +		BUG_ON(vma->vm_mirror);
 +		return NULL;
-+	}
+ 	}
+-
+-out:
+-	*pprev = prev;
+-	return prev ? prev->vm_next : vma;
 +	BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
 +	vma_m = vma->vm_mirror;
 +	BUG_ON(!vma_m || vma_m->vm_mirror != vma);
@@ -69324,13 +69634,12 @@ index eae90af..51ca80b 100644
 +	BUG_ON(vma->anon_vma != vma_m->anon_vma && vma->anon_vma->root != vma_m->anon_vma->root);
 +	BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
 +	return vma_m;
-+}
+ }
 +#endif
-+
+ 
  /*
   * Verify that the stack growth is acceptable and
-  * update accounting. This is shared with both the
-@@ -1654,6 +1902,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -1654,6 +1882,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
  		return -ENOMEM;
  
  	/* Stack limit test */
@@ -69338,7 +69647,7 @@ index eae90af..51ca80b 100644
  	if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
  		return -ENOMEM;
  
-@@ -1664,6 +1913,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -1664,6 +1893,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
  		locked = mm->locked_vm + grow;
  		limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
  		limit >>= PAGE_SHIFT;
@@ -69346,7 +69655,7 @@ index eae90af..51ca80b 100644
  		if (locked > limit && !capable(CAP_IPC_LOCK))
  			return -ENOMEM;
  	}
-@@ -1694,37 +1944,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -1694,37 +1924,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
   * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
   * vma is the last one with address > vma->vm_end.  Have to extend vma.
   */
@@ -69404,7 +69713,7 @@ index eae90af..51ca80b 100644
  		unsigned long size, grow;
  
  		size = address - vma->vm_start;
-@@ -1739,6 +2000,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+@@ -1739,6 +1980,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
  			}
  		}
  	}
@@ -69413,7 +69722,7 @@ index eae90af..51ca80b 100644
  	vma_unlock_anon_vma(vma);
  	khugepaged_enter_vma_merge(vma);
  	return error;
-@@ -1752,6 +2015,8 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -1752,6 +1995,8 @@ int expand_downwards(struct vm_area_struct *vma,
  				   unsigned long address)
  {
  	int error;
@@ -69422,7 +69731,7 @@ index eae90af..51ca80b 100644
  
  	/*
  	 * We must make sure the anon_vma is allocated
-@@ -1765,6 +2030,15 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -1765,6 +2010,15 @@ int expand_downwards(struct vm_area_struct *vma,
  	if (error)
  		return error;
  
@@ -69438,7 +69747,7 @@ index eae90af..51ca80b 100644
  	vma_lock_anon_vma(vma);
  
  	/*
-@@ -1774,9 +2048,17 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -1774,9 +2028,17 @@ int expand_downwards(struct vm_area_struct *vma,
  	 */
  
  	/* Somebody else might have raced and expanded it already */
@@ -69457,7 +69766,7 @@ index eae90af..51ca80b 100644
  		size = vma->vm_end - address;
  		grow = (vma->vm_start - address) >> PAGE_SHIFT;
  
-@@ -1786,11 +2068,22 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -1786,11 +2048,22 @@ int expand_downwards(struct vm_area_struct *vma,
  			if (!error) {
  				vma->vm_start = address;
  				vma->vm_pgoff -= grow;
@@ -69480,7 +69789,7 @@ index eae90af..51ca80b 100644
  	khugepaged_enter_vma_merge(vma);
  	return error;
  }
-@@ -1860,6 +2153,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -1860,6 +2133,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
  	do {
  		long nrpages = vma_pages(vma);
  
@@ -69494,7 +69803,7 @@ index eae90af..51ca80b 100644
  		mm->total_vm -= nrpages;
  		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
  		vma = remove_vma(vma);
-@@ -1905,6 +2205,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -1905,6 +2185,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
  	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
  	vma->vm_prev = NULL;
  	do {
@@ -69511,7 +69820,7 @@ index eae90af..51ca80b 100644
  		rb_erase(&vma->vm_rb, &mm->mm_rb);
  		mm->map_count--;
  		tail_vma = vma;
-@@ -1933,14 +2243,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1933,14 +2223,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	struct vm_area_struct *new;
  	int err = -ENOMEM;
  
@@ -69545,7 +69854,7 @@ index eae90af..51ca80b 100644
  	/* most fields are the same, copy all, and then fixup */
  	*new = *vma;
  
-@@ -1953,6 +2282,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1953,6 +2262,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
  	}
  
@@ -69568,7 +69877,7 @@ index eae90af..51ca80b 100644
  	pol = mpol_dup(vma_policy(vma));
  	if (IS_ERR(pol)) {
  		err = PTR_ERR(pol);
-@@ -1978,6 +2323,42 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1978,6 +2303,42 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	else
  		err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
  
@@ -69611,7 +69920,7 @@ index eae90af..51ca80b 100644
  	/* Success. */
  	if (!err)
  		return 0;
-@@ -1990,10 +2371,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1990,10 +2351,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  			removed_exe_file_vma(mm);
  		fput(new->vm_file);
  	}
@@ -69631,7 +69940,7 @@ index eae90af..51ca80b 100644
  	kmem_cache_free(vm_area_cachep, new);
   out_err:
  	return err;
-@@ -2006,6 +2395,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2006,6 +2375,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  	      unsigned long addr, int new_below)
  {
@@ -69647,7 +69956,7 @@ index eae90af..51ca80b 100644
  	if (mm->map_count >= sysctl_max_map_count)
  		return -ENOMEM;
  
-@@ -2017,11 +2415,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2017,11 +2395,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
   * work.  This now handles partial unmappings.
   * Jeremy Fitzhardinge <jeremy@goop.org>
   */
@@ -69678,7 +69987,7 @@ index eae90af..51ca80b 100644
  	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
  		return -EINVAL;
  
-@@ -2096,6 +2513,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+@@ -2096,6 +2493,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
  	/* Fix up all other VM information */
  	remove_vma_list(mm, vma);
  
@@ -69687,7 +69996,7 @@ index eae90af..51ca80b 100644
  	return 0;
  }
  
-@@ -2108,22 +2527,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+@@ -2108,22 +2507,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
  
  	profile_munmap(addr);
  
@@ -69716,7 +70025,7 @@ index eae90af..51ca80b 100644
  /*
   *  this is really a simplified "do_mmap".  it only handles
   *  anonymous maps.  eventually we may be able to do some
-@@ -2137,6 +2552,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2137,6 +2532,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	struct rb_node ** rb_link, * rb_parent;
  	pgoff_t pgoff = addr >> PAGE_SHIFT;
  	int error;
@@ -69724,7 +70033,7 @@ index eae90af..51ca80b 100644
  
  	len = PAGE_ALIGN(len);
  	if (!len)
-@@ -2148,16 +2564,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2148,16 +2544,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  
  	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
  
@@ -69756,7 +70065,7 @@ index eae90af..51ca80b 100644
  		locked += mm->locked_vm;
  		lock_limit = rlimit(RLIMIT_MEMLOCK);
  		lock_limit >>= PAGE_SHIFT;
-@@ -2174,22 +2604,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2174,22 +2584,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	/*
  	 * Clear old maps.  this also does some error checking for us
  	 */
@@ -69783,7 +70092,7 @@ index eae90af..51ca80b 100644
  		return -ENOMEM;
  
  	/* Can we just expand an old private anonymous mapping? */
-@@ -2203,7 +2633,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2203,7 +2613,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	 */
  	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
  	if (!vma) {
@@ -69792,7 +70101,7 @@ index eae90af..51ca80b 100644
  		return -ENOMEM;
  	}
  
-@@ -2217,11 +2647,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2217,11 +2627,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	vma_link(mm, vma, prev, rb_link, rb_parent);
  out:
  	perf_event_mmap(vma);
@@ -69807,7 +70116,7 @@ index eae90af..51ca80b 100644
  	return addr;
  }
  
-@@ -2268,8 +2699,10 @@ void exit_mmap(struct mm_struct *mm)
+@@ -2268,8 +2679,10 @@ void exit_mmap(struct mm_struct *mm)
  	 * Walk the list again, actually closing and freeing it,
  	 * with preemption enabled, without holding any MM locks.
  	 */
@@ -69819,7 +70128,7 @@ index eae90af..51ca80b 100644
  
  	BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
  }
-@@ -2283,6 +2716,13 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
+@@ -2283,6 +2696,13 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
  	struct vm_area_struct * __vma, * prev;
  	struct rb_node ** rb_link, * rb_parent;
  
@@ -69833,7 +70142,7 @@ index eae90af..51ca80b 100644
  	/*
  	 * The vm_pgoff of a purely anonymous vma should be irrelevant
  	 * until its first write fault, when page's anon_vma and index
-@@ -2305,7 +2745,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
+@@ -2305,7 +2725,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
  	if ((vma->vm_flags & VM_ACCOUNT) &&
  	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
  		return -ENOMEM;
@@ -69856,7 +70165,7 @@ index eae90af..51ca80b 100644
  	return 0;
  }
  
-@@ -2323,6 +2778,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2323,6 +2758,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	struct rb_node **rb_link, *rb_parent;
  	struct mempolicy *pol;
  
@@ -69865,7 +70174,7 @@ index eae90af..51ca80b 100644
  	/*
  	 * If anonymous vma has not yet been faulted, update new pgoff
  	 * to match new location, to increase its chance of merging.
-@@ -2373,6 +2830,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2373,6 +2810,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	return NULL;
  }
  
@@ -69905,7 +70214,7 @@ index eae90af..51ca80b 100644
  /*
   * Return true if the calling process may expand its vm space by the passed
   * number of pages
-@@ -2383,7 +2873,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+@@ -2383,7 +2853,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
  	unsigned long lim;
  
  	lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
@@ -69914,7 +70223,7 @@ index eae90af..51ca80b 100644
  	if (cur + npages > lim)
  		return 0;
  	return 1;
-@@ -2454,6 +2944,22 @@ int install_special_mapping(struct mm_struct *mm,
+@@ -2454,6 +2924,22 @@ int install_special_mapping(struct mm_struct *mm,
  	vma->vm_start = addr;
  	vma->vm_end = addr + len;
  
@@ -77495,7 +77804,7 @@ index a39edcc..1014050 100644
  };
 diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
 new file mode 100644
-index 0000000..b044b80
+index 0000000..29b6b75
 --- /dev/null
 +++ b/tools/gcc/Makefile
 @@ -0,0 +1,21 @@
@@ -77503,9 +77812,9 @@ index 0000000..b044b80
 +#PLUGIN_SOURCE_FILES := pax_plugin.c
 +#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
 +GCCPLUGINS_DIR := $(shell $(CC) -print-file-name=plugin)
-+#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W
++#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W -std=gnu99
 +
-+HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include
++HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include -std=gnu99
 +
 +hostlibs-y := constify_plugin.so
 +hostlibs-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so
@@ -78181,10 +78490,10 @@ index 0000000..a5eabce
 +}
 diff --git a/tools/gcc/kernexec_plugin.c b/tools/gcc/kernexec_plugin.c
 new file mode 100644
-index 0000000..51f747e
+index 0000000..008f159
 --- /dev/null
 +++ b/tools/gcc/kernexec_plugin.c
-@@ -0,0 +1,348 @@
+@@ -0,0 +1,427 @@
 +/*
 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -78232,13 +78541,32 @@ index 0000000..51f747e
 +	.help		= "method=[bts|or]\tinstrumentation method\n"
 +};
 +
++static unsigned int execute_kernexec_reload(void);
 +static unsigned int execute_kernexec_fptr(void);
 +static unsigned int execute_kernexec_retaddr(void);
 +static bool kernexec_cmodel_check(void);
 +
-+static void (*kernexec_instrument_fptr)(gimple_stmt_iterator);
++static void (*kernexec_instrument_fptr)(gimple_stmt_iterator *);
 +static void (*kernexec_instrument_retaddr)(rtx);
 +
++static struct gimple_opt_pass kernexec_reload_pass = {
++	.pass = {
++		.type			= GIMPLE_PASS,
++		.name			= "kernexec_reload",
++		.gate			= kernexec_cmodel_check,
++		.execute		= execute_kernexec_reload,
++		.sub			= NULL,
++		.next			= NULL,
++		.static_pass_number	= 0,
++		.tv_id			= TV_NONE,
++		.properties_required	= 0,
++		.properties_provided	= 0,
++		.properties_destroyed	= 0,
++		.todo_flags_start	= 0,
++		.todo_flags_finish	= TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
++	}
++};
++
 +static struct gimple_opt_pass kernexec_fptr_pass = {
 +	.pass = {
 +		.type			= GIMPLE_PASS,
@@ -78294,15 +78622,66 @@ index 0000000..51f747e
 +}
 +
 +/*
++ * add special KERNEXEC instrumentation: reload %r10 after it has been clobbered
++ */
++static void kernexec_reload_fptr_mask(gimple_stmt_iterator *gsi)
++{
++	gimple asm_movabs_stmt;
++
++	// build asm volatile("movabs $0x8000000000000000, %%r10\n\t" : : : );
++	asm_movabs_stmt = gimple_build_asm_vec("movabs $0x8000000000000000, %%r10\n\t", NULL, NULL, NULL, NULL);
++	gimple_asm_set_volatile(asm_movabs_stmt, true);
++	gsi_insert_after(gsi, asm_movabs_stmt, GSI_CONTINUE_LINKING);
++	update_stmt(asm_movabs_stmt);
++}
++
++/*
++ * find all asm() stmts that clobber r10 and add a reload of r10
++ */
++static unsigned int execute_kernexec_reload(void)
++{
++	basic_block bb;
++
++	// 1. loop through BBs and GIMPLE statements
++	FOR_EACH_BB(bb) {
++		gimple_stmt_iterator gsi;
++
++		for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
++			// gimple match: __asm__ ("" :  :  : "r10");
++			gimple asm_stmt;
++			size_t nclobbers;
++
++			// is it an asm ...
++			asm_stmt = gsi_stmt(gsi);
++			if (gimple_code(asm_stmt) != GIMPLE_ASM)
++				continue;
++
++			// ... clobbering r10
++			nclobbers = gimple_asm_nclobbers(asm_stmt);
++			while (nclobbers--) {
++				tree op = gimple_asm_clobber_op(asm_stmt, nclobbers);
++				if (strcmp(TREE_STRING_POINTER(TREE_VALUE(op)), "r10"))
++					continue;
++				kernexec_reload_fptr_mask(&gsi);
++//print_gimple_stmt(stderr, asm_stmt, 0, TDF_LINENO);
++				break;
++			}
++		}
++	}
++
++	return 0;
++}
++
++/*
 + * add special KERNEXEC instrumentation: force MSB of fptr to 1, which will produce
 + * a non-canonical address from a userland ptr and will just trigger a GPF on dereference
 + */
-+static void kernexec_instrument_fptr_bts(gimple_stmt_iterator gsi)
++static void kernexec_instrument_fptr_bts(gimple_stmt_iterator *gsi)
 +{
 +	gimple assign_intptr, assign_new_fptr, call_stmt;
 +	tree intptr, old_fptr, new_fptr, kernexec_mask;
 +
-+	call_stmt = gsi_stmt(gsi);
++	call_stmt = gsi_stmt(*gsi);
 +	old_fptr = gimple_call_fn(call_stmt);
 +
 +	// create temporary unsigned long variable used for bitops and cast fptr to it
@@ -78310,14 +78689,14 @@ index 0000000..51f747e
 +	add_referenced_var(intptr);
 +	mark_sym_for_renaming(intptr);
 +	assign_intptr = gimple_build_assign(intptr, fold_convert(long_unsigned_type_node, old_fptr));
-+	gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT);
++	gsi_insert_before(gsi, assign_intptr, GSI_SAME_STMT);
 +	update_stmt(assign_intptr);
 +
 +	// apply logical or to temporary unsigned long and bitmask
 +	kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0x8000000000000000LL);
 +//	kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0xffffffff80000000LL);
 +	assign_intptr = gimple_build_assign(intptr, fold_build2(BIT_IOR_EXPR, long_long_unsigned_type_node, intptr, kernexec_mask));
-+	gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT);
++	gsi_insert_before(gsi, assign_intptr, GSI_SAME_STMT);
 +	update_stmt(assign_intptr);
 +
 +	// cast temporary unsigned long back to a temporary fptr variable
@@ -78325,7 +78704,7 @@ index 0000000..51f747e
 +	add_referenced_var(new_fptr);
 +	mark_sym_for_renaming(new_fptr);
 +	assign_new_fptr = gimple_build_assign(new_fptr, fold_convert(TREE_TYPE(old_fptr), intptr));
-+	gsi_insert_before(&gsi, assign_new_fptr, GSI_SAME_STMT);
++	gsi_insert_before(gsi, assign_new_fptr, GSI_SAME_STMT);
 +	update_stmt(assign_new_fptr);
 +
 +	// replace call stmt fn with the new fptr
@@ -78333,14 +78712,14 @@ index 0000000..51f747e
 +	update_stmt(call_stmt);
 +}
 +
-+static void kernexec_instrument_fptr_or(gimple_stmt_iterator gsi)
++static void kernexec_instrument_fptr_or(gimple_stmt_iterator *gsi)
 +{
 +	gimple asm_or_stmt, call_stmt;
 +	tree old_fptr, new_fptr, input, output;
 +	VEC(tree, gc) *inputs = NULL;
 +	VEC(tree, gc) *outputs = NULL;
 +
-+	call_stmt = gsi_stmt(gsi);
++	call_stmt = gsi_stmt(*gsi);
 +	old_fptr = gimple_call_fn(call_stmt);
 +
 +	// create temporary fptr variable
@@ -78357,7 +78736,7 @@ index 0000000..51f747e
 +	VEC_safe_push(tree, gc, outputs, output);
 +	asm_or_stmt = gimple_build_asm_vec("orq %%r10, %0\n\t", inputs, outputs, NULL, NULL);
 +	gimple_asm_set_volatile(asm_or_stmt, true);
-+	gsi_insert_before(&gsi, asm_or_stmt, GSI_SAME_STMT);
++	gsi_insert_before(gsi, asm_or_stmt, GSI_SAME_STMT);
 +	update_stmt(asm_or_stmt);
 +
 +	// replace call stmt fn with the new fptr
@@ -78371,10 +78750,11 @@ index 0000000..51f747e
 +static unsigned int execute_kernexec_fptr(void)
 +{
 +	basic_block bb;
-+	gimple_stmt_iterator gsi;
 +
 +	// 1. loop through BBs and GIMPLE statements
 +	FOR_EACH_BB(bb) {
++		gimple_stmt_iterator gsi;
++
 +		for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
 +			// gimple match: h_1 = get_fptr (); D.2709_3 = h_1 (x_2(D));
 +			tree fn;
@@ -78401,7 +78781,7 @@ index 0000000..51f747e
 +			if (TREE_CODE(fn) != FUNCTION_TYPE)
 +				continue;
 +
-+			kernexec_instrument_fptr(gsi);
++			kernexec_instrument_fptr(&gsi);
 +
 +//debug_tree(gimple_call_fn(call_stmt));
 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
@@ -78483,6 +78863,12 @@ index 0000000..51f747e
 +	const int argc = plugin_info->argc;
 +	const struct plugin_argument * const argv = plugin_info->argv;
 +	int i;
++	struct register_pass_info kernexec_reload_pass_info = {
++		.pass				= &kernexec_reload_pass.pass,
++		.reference_pass_name		= "ssa",
++		.ref_pass_instance_number	= 0,
++		.pos_op 			= PASS_POS_INSERT_AFTER
++	};
 +	struct register_pass_info kernexec_fptr_pass_info = {
 +		.pass				= &kernexec_fptr_pass.pass,
 +		.reference_pass_name		= "ssa",
@@ -78528,6 +78914,8 @@ index 0000000..51f747e
 +	if (!kernexec_instrument_fptr || !kernexec_instrument_retaddr)
 +		error(G_("no instrumentation method was selected via '-fplugin-arg-%s-method'"), plugin_name);
 +
++	if (kernexec_instrument_fptr == kernexec_instrument_fptr_or)
++		register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_reload_pass_info);
 +	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_fptr_pass_info);
 +	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_retaddr_pass_info);
 +
@@ -78535,10 +78923,10 @@ index 0000000..51f747e
 +}
 diff --git a/tools/gcc/stackleak_plugin.c b/tools/gcc/stackleak_plugin.c
 new file mode 100644
-index 0000000..d44f37c
+index 0000000..8b61031
 --- /dev/null
 +++ b/tools/gcc/stackleak_plugin.c
-@@ -0,0 +1,291 @@
+@@ -0,0 +1,295 @@
 +/*
 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -78638,7 +79026,7 @@ index 0000000..d44f37c
 +	return track_frame_size >= 0;
 +}
 +
-+static void stackleak_check_alloca(gimple_stmt_iterator gsi)
++static void stackleak_check_alloca(gimple_stmt_iterator *gsi)
 +{
 +	gimple check_alloca;
 +	tree fndecl, fntype, alloca_size;
@@ -78647,12 +79035,12 @@ index 0000000..d44f37c
 +	fntype = build_function_type_list(void_type_node, long_unsigned_type_node, NULL_TREE);
 +	fndecl = build_fn_decl(check_function, fntype);
 +	DECL_ASSEMBLER_NAME(fndecl); // for LTO
-+	alloca_size = gimple_call_arg(gsi_stmt(gsi), 0);
++	alloca_size = gimple_call_arg(gsi_stmt(*gsi), 0);
 +	check_alloca = gimple_build_call(fndecl, 1, alloca_size);
-+	gsi_insert_before(&gsi, check_alloca, GSI_CONTINUE_LINKING);
++	gsi_insert_before(gsi, check_alloca, GSI_SAME_STMT);
 +}
 +
-+static void stackleak_add_instrumentation(gimple_stmt_iterator gsi)
++static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi)
 +{
 +	gimple track_stack;
 +	tree fndecl, fntype;
@@ -78662,7 +79050,7 @@ index 0000000..d44f37c
 +	fndecl = build_fn_decl(track_function, fntype);
 +	DECL_ASSEMBLER_NAME(fndecl); // for LTO
 +	track_stack = gimple_build_call(fndecl, 0);
-+	gsi_insert_after(&gsi, track_stack, GSI_CONTINUE_LINKING);
++	gsi_insert_after(gsi, track_stack, GSI_CONTINUE_LINKING);
 +}
 +
 +#if BUILDING_GCC_VERSION == 4005
@@ -78705,16 +79093,17 @@ index 0000000..d44f37c
 +	// 1. loop through BBs and GIMPLE statements
 +	FOR_EACH_BB(bb) {
 +		gimple_stmt_iterator gsi;
++
 +		for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
 +			// gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
 +			if (!is_alloca(gsi_stmt(gsi)))
 +				continue;
 +
 +			// 2. insert stack overflow check before each __builtin_alloca call
-+			stackleak_check_alloca(gsi);
++			stackleak_check_alloca(&gsi);
 +
 +			// 3. insert track call after each __builtin_alloca call
-+			stackleak_add_instrumentation(gsi);
++			stackleak_add_instrumentation(&gsi);
 +			if (bb == entry_bb)
 +				prologue_instrumented = true;
 +		}
@@ -78722,10 +79111,13 @@ index 0000000..d44f37c
 +
 +	// 4. insert track call at the beginning
 +	if (!prologue_instrumented) {
++		gimple_stmt_iterator gsi;
++
 +		bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
 +		if (dom_info_available_p(CDI_DOMINATORS))
 +			set_immediate_dominator(CDI_DOMINATORS, bb, ENTRY_BLOCK_PTR);
-+		stackleak_add_instrumentation(gsi_start_bb(bb));
++		gsi = gsi_start_bb(bb);
++		stackleak_add_instrumentation(&gsi);
 +	}
 +
 +	return 0;
diff --git a/3.2.6/4425_grsec_enable_xtpax.patch b/3.2.7/4425_grsec_enable_xtpax.patch
index 9735ecf..9735ecf 100644
--- a/3.2.6/4425_grsec_enable_xtpax.patch
+++ b/3.2.7/4425_grsec_enable_xtpax.patch
diff --git a/3.2.6/4430_grsec-remove-localversion-grsec.patch b/3.2.7/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.2.6/4430_grsec-remove-localversion-grsec.patch
+++ b/3.2.7/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.6/4435_grsec-mute-warnings.patch b/3.2.7/4435_grsec-mute-warnings.patch
index e85abd6..e85abd6 100644
--- a/3.2.6/4435_grsec-mute-warnings.patch
+++ b/3.2.7/4435_grsec-mute-warnings.patch
diff --git a/3.2.6/4440_grsec-remove-protected-paths.patch b/3.2.7/4440_grsec-remove-protected-paths.patch
index 4afb3e2..4afb3e2 100644
--- a/3.2.6/4440_grsec-remove-protected-paths.patch
+++ b/3.2.7/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.6/4445_grsec-pax-without-grsec.patch b/3.2.7/4445_grsec-pax-without-grsec.patch
index 9992f51..9992f51 100644
--- a/3.2.6/4445_grsec-pax-without-grsec.patch
+++ b/3.2.7/4445_grsec-pax-without-grsec.patch
diff --git a/3.2.6/4450_grsec-kconfig-default-gids.patch b/3.2.7/4450_grsec-kconfig-default-gids.patch
index 0807a4e..0807a4e 100644
--- a/3.2.6/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.7/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.6/4455_grsec-kconfig-gentoo.patch b/3.2.7/4455_grsec-kconfig-gentoo.patch
index 587b7d9..587b7d9 100644
--- a/3.2.6/4455_grsec-kconfig-gentoo.patch
+++ b/3.2.7/4455_grsec-kconfig-gentoo.patch
diff --git a/3.2.6/4460-grsec-kconfig-proc-user.patch b/3.2.7/4460-grsec-kconfig-proc-user.patch
index 72b894a..72b894a 100644
--- a/3.2.6/4460-grsec-kconfig-proc-user.patch
+++ b/3.2.7/4460-grsec-kconfig-proc-user.patch
diff --git a/3.2.6/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.7/4465_selinux-avc_audit-log-curr_ip.patch
index 7c9894c..7c9894c 100644
--- a/3.2.6/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.7/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.6/4470_disable-compat_vdso.patch b/3.2.7/4470_disable-compat_vdso.patch
index 4742d01..4742d01 100644
--- a/3.2.6/4470_disable-compat_vdso.patch
+++ b/3.2.7/4470_disable-compat_vdso.patch