diff options
| -rw-r--r-- | 2.6.32/0000_README | 2 | ||||
| -rw-r--r-- | 2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201208062015.patch (renamed from 2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201208011848.patch) | 97 | ||||
| -rw-r--r-- | 3.2.26/0000_README (renamed from 3.2.24/0000_README) | 10 | ||||
| -rw-r--r-- | 3.2.26/1021_linux-3.2.22.patch (renamed from 3.2.24/1021_linux-3.2.22.patch) | 0 | ||||
| -rw-r--r-- | 3.2.26/1022_linux-3.2.23.patch (renamed from 3.2.24/1022_linux-3.2.23.patch) | 0 | ||||
| -rw-r--r-- | 3.2.26/1023_linux-3.2.24.patch (renamed from 3.2.24/1023_linux-3.2.24.patch) | 0 | ||||
| -rw-r--r-- | 3.2.26/1024_linux-3.2.25.patch | 4503 | ||||
| -rw-r--r-- | 3.2.26/1025_linux-3.2.26.patch | 238 | ||||
| -rw-r--r-- | 3.2.26/4420_grsecurity-2.9.1-3.2.26-201208062017.patch (renamed from 3.2.24/4420_grsecurity-2.9.1-3.2.24-201208011849.patch) | 472 | ||||
| -rw-r--r-- | 3.2.26/4430_grsec-remove-localversion-grsec.patch (renamed from 3.2.24/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 3.2.26/4435_grsec-mute-warnings.patch (renamed from 3.2.24/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 3.2.26/4440_grsec-remove-protected-paths.patch (renamed from 3.2.24/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 3.2.26/4450_grsec-kconfig-default-gids.patch (renamed from 3.2.24/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 3.2.26/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 3.2.24/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 3.2.26/4470_disable-compat_vdso.patch (renamed from 3.2.24/4470_disable-compat_vdso.patch) | 0 | ||||
| -rw-r--r-- | 3.5.0/0000_README (renamed from 3.4.7/0000_README) | 2 | ||||
| -rw-r--r-- | 3.5.0/4420_grsecurity-2.9.1-3.5.0-201208062017.patch (renamed from 3.4.7/4420_grsecurity-2.9.1-3.4.7-201208011850.patch) | 8566 | ||||
| -rw-r--r-- | 3.5.0/4430_grsec-remove-localversion-grsec.patch (renamed from 3.4.7/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 3.5.0/4435_grsec-mute-warnings.patch (renamed from 3.4.7/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 3.5.0/4440_grsec-remove-protected-paths.patch (renamed from 3.4.7/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 3.5.0/4450_grsec-kconfig-default-gids.patch (renamed from 3.4.7/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 3.5.0/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 3.4.7/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 3.5.0/4470_disable-compat_vdso.patch (renamed from 3.4.7/4470_disable-compat_vdso.patch) | 0 | ||||
| -rw-r--r-- | 3.5.0/4480_fix-scsi-lpfc-Werror.patch (renamed from 3.4.7/4480_fix-scsi-lpfc-Werror.patch) | 0 |
24 files changed, 9482 insertions, 4408 deletions
diff --git a/2.6.32/0000_README b/2.6.32/0000_README index ae80b1d..80a0bc5 100644 --- a/2.6.32/0000_README +++ b/2.6.32/0000_README @@ -30,7 +30,7 @@ Patch: 1058_linux-2.6.32.59.patch From: http://www.kernel.org Desc: Linux 2.6.32.59 -Patch: 4420_grsecurity-2.9.1-2.6.32.59-201208011848.patch +Patch: 4420_grsecurity-2.9.1-2.6.32.59-201208062015.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201208011848.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201208062015.patch index 4d11792..d00e268 100644 --- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201208011848.patch +++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201208062015.patch @@ -9242,10 +9242,10 @@ index 4d3ff03..e4972ff 100644 err = check_flags(); } diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S -index b31cc54..8d69237 100644 +index b31cc54..afdbea1 100644 --- a/arch/x86/boot/header.S +++ b/arch/x86/boot/header.S -@@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical pointer to +@@ -224,10 +224,14 @@ setup_data: .quad 0 # 64-bit physical pointer to # single linked list of # struct setup_data @@ -9253,7 +9253,14 @@ index b31cc54..8d69237 100644 +pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset) ++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) ++#define VO_INIT_SIZE (VO__end - VO__text - __PAGE_OFFSET - ____LOAD_PHYSICAL_ADDR) ++#else #define VO_INIT_SIZE (VO__end - VO__text) ++#endif + #if ZO_INIT_SIZE > VO_INIT_SIZE + #define INIT_SIZE ZO_INIT_SIZE + #else diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c index cae3feb..ff8ff2a 100644 --- a/arch/x86/boot/memory.c @@ -16923,7 +16930,7 @@ index 5cab48e..b025f9b 100644 /* * After the lock is released, the original page table is restored. diff --git a/arch/x86/kernel/efi_stub_32.S b/arch/x86/kernel/efi_stub_32.S -index fbe66e6..c5c0dd2 100644 +index fbe66e6..eae5e38 100644 --- a/arch/x86/kernel/efi_stub_32.S +++ b/arch/x86/kernel/efi_stub_32.S @@ -6,7 +6,9 @@ @@ -16945,22 +16952,35 @@ index fbe66e6..c5c0dd2 100644 ENTRY(efi_call_phys) /* * 0. The function can only be called in Linux kernel. So CS has been -@@ -36,9 +38,11 @@ ENTRY(efi_call_phys) +@@ -36,10 +38,24 @@ ENTRY(efi_call_phys) * The mapping of lower virtual memory has been created in prelog and * epilog. */ - movl $1f, %edx - subl $__PAGE_OFFSET, %edx - jmp *%edx ++#ifdef CONFIG_PAX_KERNEXEC + movl $(__KERNEXEC_EFI_DS), %edx + mov %edx, %ds + mov %edx, %es + mov %edx, %ss -+ ljmp $(__KERNEXEC_EFI_CS),$1f-__PAGE_OFFSET ++ addl $2f,(1f) ++ ljmp *(1f) ++ ++__INITDATA ++1: .long __LOAD_PHYSICAL_ADDR, __KERNEXEC_EFI_CS ++.previous ++ ++2: ++ subl $2b,(1b) ++#else ++ jmp 1f-__PAGE_OFFSET 1: ++#endif /* -@@ -47,14 +51,8 @@ ENTRY(efi_call_phys) + * 2. Now on the top of stack is the return +@@ -47,14 +63,8 @@ ENTRY(efi_call_phys) * parameter 2, ..., param n. To make things easy, we save the return * address of efi_call_phys in a global variable. */ @@ -16977,7 +16997,7 @@ index fbe66e6..c5c0dd2 100644 /* * 3. Clear PG bit in %CR0. -@@ -73,9 +71,8 @@ ENTRY(efi_call_phys) +@@ -73,9 +83,8 @@ ENTRY(efi_call_phys) /* * 5. Call the physical function. */ @@ -16988,7 +17008,7 @@ index fbe66e6..c5c0dd2 100644 /* * 6. After EFI runtime service returns, control will return to * following instruction. We'd better readjust stack pointer first. -@@ -88,35 +85,32 @@ ENTRY(efi_call_phys) +@@ -88,35 +97,36 @@ ENTRY(efi_call_phys) movl %cr0, %edx orl $0x80000000, %edx movl %edx, %cr0 @@ -17001,12 +17021,16 @@ index fbe66e6..c5c0dd2 100644 */ - movl $1f, %edx - jmp *%edx -+ ljmp $(__KERNEL_CS),$1f+__PAGE_OFFSET - 1: ++#ifdef CONFIG_PAX_KERNEXEC + movl $(__KERNEL_DS), %edx + mov %edx, %ds + mov %edx, %es + mov %edx, %ss ++ ljmp $(__KERNEL_CS),$1f ++#else ++ jmp 1f+__PAGE_OFFSET ++#endif + 1: /* * 9. Balance the stack. And because EAX contain the return value, @@ -89677,7 +89701,7 @@ index 11e5be6..8ff8c91 100644 #endif /* __KERNEL__ */ #endif /* _LINUX_MM_H */ diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h -index 9d12ed5..c5e5ab6 100644 +index 9d12ed5..9d9dab3 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -186,6 +186,8 @@ struct vm_area_struct { @@ -89703,7 +89727,7 @@ index 9d12ed5..c5e5ab6 100644 struct mmu_notifier_mm *mmu_notifier_mm; #endif + -+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_XATTR_PAX_FLAGS) || defined(CONFIG_PAX_HAVE_ACL_FLAGS) || defined(CONFIG_PAX_HOOK_ACL_FLAGS) ++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR) + unsigned long pax_flags; +#endif + @@ -94026,7 +94050,7 @@ index 4bde56f..0cc7962 100644 else new_fs = fs; diff --git a/kernel/futex.c b/kernel/futex.c -index fb98c9f..333faec 100644 +index fb98c9f..f8c336d 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -54,6 +54,7 @@ @@ -94067,16 +94091,45 @@ index fb98c9f..333faec 100644 restart->futex.val = val; restart->futex.time = abs_time->tv64; restart->futex.bitset = bitset; -@@ -2233,6 +2241,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared, +@@ -2192,11 +2200,11 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb, + * @uaddr2: the pi futex we will take prior to returning to user-space + * + * The caller will wait on uaddr and will be requeued by futex_requeue() to +- * uaddr2 which must be PI aware. Normal wakeup will wake on uaddr2 and +- * complete the acquisition of the rt_mutex prior to returning to userspace. +- * This ensures the rt_mutex maintains an owner when it has waiters; without +- * one, the pi logic wouldn't know which task to boost/deboost, if there was a +- * need to. ++ * uaddr2 which must be PI aware and unique from uaddr. Normal wakeup will wake ++ * on uaddr2 and complete the acquisition of the rt_mutex prior to returning to ++ * userspace. This ensures the rt_mutex maintains an owner when it has waiters; ++ * without one, the pi logic would not know which task to boost/deboost, if ++ * there was a need to. + * + * We call schedule in futex_wait_queue_me() when we enqueue and return there + * via the following: +@@ -2233,6 +2241,11 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared, struct futex_q q; int res, ret; + pax_track_stack(); + ++ if (uaddr == uaddr2) ++ return -EINVAL; ++ if (!bitset) return -EINVAL; -@@ -2423,6 +2433,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pid, +@@ -2333,7 +2346,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, int fshared, + * fault, unlock the rt_mutex and return the fault to userspace. + */ + if (ret == -EFAULT) { +- if (rt_mutex_owner(pi_mutex) == current) ++ if (pi_mutex && rt_mutex_owner(pi_mutex) == current) + rt_mutex_unlock(pi_mutex); + } else if (ret == -EINTR) { + /* +@@ -2423,6 +2436,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pid, if (!p) goto err_unlock; ret = -EPERM; @@ -94087,7 +94140,7 @@ index fb98c9f..333faec 100644 pcred = __task_cred(p); if (cred->euid != pcred->euid && cred->euid != pcred->uid && -@@ -2489,7 +2503,7 @@ retry: +@@ -2489,7 +2506,7 @@ retry: */ static inline int fetch_robust_entry(struct robust_list __user **entry, struct robust_list __user * __user *head, @@ -94096,7 +94149,7 @@ index fb98c9f..333faec 100644 { unsigned long uentry; -@@ -2670,6 +2684,7 @@ static int __init futex_init(void) +@@ -2670,6 +2687,7 @@ static int __init futex_init(void) { u32 curval; int i; @@ -94104,7 +94157,7 @@ index fb98c9f..333faec 100644 /* * This will fail and we want it. Some arch implementations do -@@ -2681,7 +2696,10 @@ static int __init futex_init(void) +@@ -2681,7 +2699,10 @@ static int __init futex_init(void) * implementation, the non functional ones will return * -ENOSYS. */ @@ -94722,7 +94775,7 @@ index d4aba4f..02a353f 100644 if (!name) { diff --git a/kernel/module.c b/kernel/module.c -index 4b270e6..2efdb65 100644 +index 4b270e6..5e2eb1b 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -55,6 +55,7 @@ @@ -95336,7 +95389,7 @@ index 4b270e6..2efdb65 100644 "Live"); /* Used by oprofile and other similar tools. */ - seq_printf(m, " 0x%p", mod->module_core); -+ seq_printf(m, " 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw); ++ seq_printf(m, " 0x%pP 0x%pP", mod->module_core_rx, mod->module_core_rw); /* Taints info */ if (mod->taints) @@ -105357,7 +105410,7 @@ index 30b3189..e2e4b55 100644 } diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c -index 8df3477..797ae6d 100644 +index 8df3477..ec49230 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -1298,6 +1298,10 @@ err_proto: @@ -105376,7 +105429,7 @@ index 8df3477..797ae6d 100644 } +#ifdef CONFIG_GRKERNSEC_HIDESYM -+ net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%08lx", atomic_inc_return(&conntrack_cache_id)); ++ net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%08lx", atomic_inc_return_unchecked(&conntrack_cache_id)); +#else net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net); +#endif diff --git a/3.2.24/0000_README b/3.2.26/0000_README index 5b9308c..7e6481a 100644 --- a/3.2.24/0000_README +++ b/3.2.26/0000_README @@ -14,7 +14,15 @@ Patch: 1023_linux-3.2.24.patch From: http://www.kernel.org Desc: Linux 3.2.24 -Patch: 4420_grsecurity-2.9.1-3.2.24-201208011849.patch +Patch: 1024_linux-3.2.25.patch +From: http://www.kernel.org +Desc: Linux 3.2.25 + +Patch: 1025_linux-3.2.26.patch +From: http://www.kernel.org +Desc: Linux 3.2.26 + +Patch: 4420_grsecurity-2.9.1-3.2.26-201208062017.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/3.2.24/1021_linux-3.2.22.patch b/3.2.26/1021_linux-3.2.22.patch index e6ad93a..e6ad93a 100644 --- a/3.2.24/1021_linux-3.2.22.patch +++ b/3.2.26/1021_linux-3.2.22.patch diff --git a/3.2.24/1022_linux-3.2.23.patch b/3.2.26/1022_linux-3.2.23.patch index 3d796d0..3d796d0 100644 --- a/3.2.24/1022_linux-3.2.23.patch +++ b/3.2.26/1022_linux-3.2.23.patch diff --git a/3.2.24/1023_linux-3.2.24.patch b/3.2.26/1023_linux-3.2.24.patch index 4692eb4..4692eb4 100644 --- a/3.2.24/1023_linux-3.2.24.patch +++ b/3.2.26/1023_linux-3.2.24.patch diff --git a/3.2.26/1024_linux-3.2.25.patch b/3.2.26/1024_linux-3.2.25.patch new file mode 100644 index 0000000..e95c213 --- /dev/null +++ b/3.2.26/1024_linux-3.2.25.patch @@ -0,0 +1,4503 @@ +diff --git a/Makefile b/Makefile +index 80bb4fd..e13e4e7 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 2 +-SUBLEVEL = 24 ++SUBLEVEL = 25 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h +index 559da19..578e5a0 100644 +--- a/arch/powerpc/include/asm/reg.h ++++ b/arch/powerpc/include/asm/reg.h +@@ -1016,7 +1016,8 @@ + /* Macros for setting and retrieving special purpose registers */ + #ifndef __ASSEMBLY__ + #define mfmsr() ({unsigned long rval; \ +- asm volatile("mfmsr %0" : "=r" (rval)); rval;}) ++ asm volatile("mfmsr %0" : "=r" (rval) : \ ++ : "memory"); rval;}) + #ifdef CONFIG_PPC_BOOK3S_64 + #define __mtmsrd(v, l) asm volatile("mtmsrd %0," __stringify(l) \ + : : "r" (v) : "memory") +diff --git a/arch/powerpc/kernel/ftrace.c b/arch/powerpc/kernel/ftrace.c +index bf99cfa..6324008 100644 +--- a/arch/powerpc/kernel/ftrace.c ++++ b/arch/powerpc/kernel/ftrace.c +@@ -245,9 +245,9 @@ __ftrace_make_nop(struct module *mod, + + /* + * On PPC32 the trampoline looks like: +- * 0x3d, 0x60, 0x00, 0x00 lis r11,sym@ha +- * 0x39, 0x6b, 0x00, 0x00 addi r11,r11,sym@l +- * 0x7d, 0x69, 0x03, 0xa6 mtctr r11 ++ * 0x3d, 0x80, 0x00, 0x00 lis r12,sym@ha ++ * 0x39, 0x8c, 0x00, 0x00 addi r12,r12,sym@l ++ * 0x7d, 0x89, 0x03, 0xa6 mtctr r12 + * 0x4e, 0x80, 0x04, 0x20 bctr + */ + +@@ -262,9 +262,9 @@ __ftrace_make_nop(struct module *mod, + pr_devel(" %08x %08x ", jmp[0], jmp[1]); + + /* verify that this is what we expect it to be */ +- if (((jmp[0] & 0xffff0000) != 0x3d600000) || +- ((jmp[1] & 0xffff0000) != 0x396b0000) || +- (jmp[2] != 0x7d6903a6) || ++ if (((jmp[0] & 0xffff0000) != 0x3d800000) || ++ ((jmp[1] & 0xffff0000) != 0x398c0000) || ++ (jmp[2] != 0x7d8903a6) || + (jmp[3] != 0x4e800420)) { + printk(KERN_ERR "Not a trampoline\n"); + return -EINVAL; +diff --git a/arch/s390/kernel/processor.c b/arch/s390/kernel/processor.c +index 6e0073e..07c7bf4 100644 +--- a/arch/s390/kernel/processor.c ++++ b/arch/s390/kernel/processor.c +@@ -26,12 +26,14 @@ static DEFINE_PER_CPU(struct cpuid, cpu_id); + void __cpuinit cpu_init(void) + { + struct cpuid *id = &per_cpu(cpu_id, smp_processor_id()); ++ struct s390_idle_data *idle = &__get_cpu_var(s390_idle); + + get_cpu_id(id); + atomic_inc(&init_mm.mm_count); + current->active_mm = &init_mm; + BUG_ON(current->mm); + enter_lazy_tlb(&init_mm, current); ++ memset(idle, 0, sizeof(*idle)); + } + + /* +diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c +index 3ea8728..1df64a8 100644 +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -1020,14 +1020,11 @@ static int __cpuinit smp_cpu_notify(struct notifier_block *self, + unsigned int cpu = (unsigned int)(long)hcpu; + struct cpu *c = &per_cpu(cpu_devices, cpu); + struct sys_device *s = &c->sysdev; +- struct s390_idle_data *idle; + int err = 0; + + switch (action) { + case CPU_ONLINE: + case CPU_ONLINE_FROZEN: +- idle = &per_cpu(s390_idle, cpu); +- memset(idle, 0, sizeof(struct s390_idle_data)); + err = sysfs_create_group(&s->kobj, &cpu_online_attr_group); + break; + case CPU_DEAD: +diff --git a/arch/x86/kernel/microcode_core.c b/arch/x86/kernel/microcode_core.c +index 563a09d..29c95d7 100644 +--- a/arch/x86/kernel/microcode_core.c ++++ b/arch/x86/kernel/microcode_core.c +@@ -297,20 +297,31 @@ static ssize_t reload_store(struct sys_device *dev, + const char *buf, size_t size) + { + unsigned long val; +- int cpu = dev->id; +- int ret = 0; +- char *end; ++ int cpu; ++ ssize_t ret = 0, tmp_ret; + +- val = simple_strtoul(buf, &end, 0); +- if (end == buf) ++ /* allow reload only from the BSP */ ++ if (boot_cpu_data.cpu_index != dev->id) + return -EINVAL; + +- if (val == 1) { +- get_online_cpus(); +- if (cpu_online(cpu)) +- ret = reload_for_cpu(cpu); +- put_online_cpus(); ++ ret = kstrtoul(buf, 0, &val); ++ if (ret) ++ return ret; ++ ++ if (val != 1) ++ return size; ++ ++ get_online_cpus(); ++ for_each_online_cpu(cpu) { ++ tmp_ret = reload_for_cpu(cpu); ++ if (tmp_ret != 0) ++ pr_warn("Error reloading microcode on CPU %d\n", cpu); ++ ++ /* save retval of the first encountered reload error */ ++ if (!ret) ++ ret = tmp_ret; + } ++ put_online_cpus(); + + if (!ret) + ret = size; +diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c +index 6dd8955..0951b81 100644 +--- a/arch/x86/pci/fixup.c ++++ b/arch/x86/pci/fixup.c +@@ -521,3 +521,20 @@ static void sb600_disable_hpet_bar(struct pci_dev *dev) + } + } + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_ATI, 0x4385, sb600_disable_hpet_bar); ++ ++/* ++ * Twinhead H12Y needs us to block out a region otherwise we map devices ++ * there and any access kills the box. ++ * ++ * See: https://bugzilla.kernel.org/show_bug.cgi?id=10231 ++ * ++ * Match off the LPC and svid/sdid (older kernels lose the bridge subvendor) ++ */ ++static void __devinit twinhead_reserve_killing_zone(struct pci_dev *dev) ++{ ++ if (dev->subsystem_vendor == 0x14FF && dev->subsystem_device == 0xA003) { ++ pr_info("Reserving memory on Twinhead H12Y\n"); ++ request_mem_region(0xFFB00000, 0x100000, "twinhead"); ++ } ++} ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x27B9, twinhead_reserve_killing_zone); +diff --git a/block/blk-core.c b/block/blk-core.c +index 15de223..49d9e91 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -607,7 +607,7 @@ EXPORT_SYMBOL(blk_init_allocated_queue); + + int blk_get_queue(struct request_queue *q) + { +- if (likely(!test_bit(QUEUE_FLAG_DEAD, &q->queue_flags))) { ++ if (likely(!blk_queue_dead(q))) { + kobject_get(&q->kobj); + return 0; + } +@@ -754,7 +754,7 @@ static struct request *get_request(struct request_queue *q, int rw_flags, + const bool is_sync = rw_is_sync(rw_flags) != 0; + int may_queue; + +- if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags))) ++ if (unlikely(blk_queue_dead(q))) + return NULL; + + may_queue = elv_may_queue(q, rw_flags); +@@ -874,7 +874,7 @@ static struct request *get_request_wait(struct request_queue *q, int rw_flags, + struct io_context *ioc; + struct request_list *rl = &q->rq; + +- if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags))) ++ if (unlikely(blk_queue_dead(q))) + return NULL; + + prepare_to_wait_exclusive(&rl->wait[is_sync], &wait, +diff --git a/block/blk-exec.c b/block/blk-exec.c +index a1ebceb..6053285 100644 +--- a/block/blk-exec.c ++++ b/block/blk-exec.c +@@ -50,7 +50,7 @@ void blk_execute_rq_nowait(struct request_queue *q, struct gendisk *bd_disk, + { + int where = at_head ? ELEVATOR_INSERT_FRONT : ELEVATOR_INSERT_BACK; + +- if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags))) { ++ if (unlikely(blk_queue_dead(q))) { + rq->errors = -ENXIO; + if (rq->end_io) + rq->end_io(rq, rq->errors); +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index e7f9f65..f0b2ca8 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -425,7 +425,7 @@ queue_attr_show(struct kobject *kobj, struct attribute *attr, char *page) + if (!entry->show) + return -EIO; + mutex_lock(&q->sysfs_lock); +- if (test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)) { ++ if (blk_queue_dead(q)) { + mutex_unlock(&q->sysfs_lock); + return -ENOENT; + } +@@ -447,7 +447,7 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, + + q = container_of(kobj, struct request_queue, kobj); + mutex_lock(&q->sysfs_lock); +- if (test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)) { ++ if (blk_queue_dead(q)) { + mutex_unlock(&q->sysfs_lock); + return -ENOENT; + } +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index 4553245..5eed6a7 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -310,7 +310,7 @@ static struct throtl_grp * throtl_get_tg(struct throtl_data *td) + struct request_queue *q = td->queue; + + /* no throttling for dead queue */ +- if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags))) ++ if (unlikely(blk_queue_dead(q))) + return NULL; + + rcu_read_lock(); +@@ -335,7 +335,7 @@ static struct throtl_grp * throtl_get_tg(struct throtl_data *td) + spin_lock_irq(q->queue_lock); + + /* Make sure @q is still alive */ +- if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags))) { ++ if (unlikely(blk_queue_dead(q))) { + kfree(tg); + return NULL; + } +diff --git a/block/blk.h b/block/blk.h +index 3f6551b..e38691d 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -85,7 +85,7 @@ static inline struct request *__elv_next_request(struct request_queue *q) + q->flush_queue_delayed = 1; + return NULL; + } +- if (test_bit(QUEUE_FLAG_DEAD, &q->queue_flags) || ++ if (unlikely(blk_queue_dead(q)) || + !q->elevator->ops->elevator_dispatch_fn(q, 0)) + return NULL; + } +diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c +index 6512b20..d1fcbc0 100644 +--- a/drivers/acpi/ac.c ++++ b/drivers/acpi/ac.c +@@ -292,7 +292,9 @@ static int acpi_ac_add(struct acpi_device *device) + ac->charger.properties = ac_props; + ac->charger.num_properties = ARRAY_SIZE(ac_props); + ac->charger.get_property = get_ac_property; +- power_supply_register(&ac->device->dev, &ac->charger); ++ result = power_supply_register(&ac->device->dev, &ac->charger); ++ if (result) ++ goto end; + + printk(KERN_INFO PREFIX "%s [%s] (%s)\n", + acpi_device_name(device), acpi_device_bid(device), +diff --git a/drivers/gpu/drm/nouveau/nva3_copy.fuc b/drivers/gpu/drm/nouveau/nva3_copy.fuc +index eaf35f8..d894731 100644 +--- a/drivers/gpu/drm/nouveau/nva3_copy.fuc ++++ b/drivers/gpu/drm/nouveau/nva3_copy.fuc +@@ -118,9 +118,9 @@ dispatch_dma: + // mthd 0x030c-0x0340, various stuff + .b16 0xc3 14 + .b32 ctx_src_address_high ~0x000000ff +-.b32 ctx_src_address_low ~0xfffffff0 ++.b32 ctx_src_address_low ~0xffffffff + .b32 ctx_dst_address_high ~0x000000ff +-.b32 ctx_dst_address_low ~0xfffffff0 ++.b32 ctx_dst_address_low ~0xffffffff + .b32 ctx_src_pitch ~0x0007ffff + .b32 ctx_dst_pitch ~0x0007ffff + .b32 ctx_xcnt ~0x0000ffff +diff --git a/drivers/gpu/drm/nouveau/nva3_copy.fuc.h b/drivers/gpu/drm/nouveau/nva3_copy.fuc.h +index 2731de2..e2a0e88 100644 +--- a/drivers/gpu/drm/nouveau/nva3_copy.fuc.h ++++ b/drivers/gpu/drm/nouveau/nva3_copy.fuc.h +@@ -1,37 +1,72 @@ +-uint32_t nva3_pcopy_data[] = { ++u32 nva3_pcopy_data[] = { ++/* 0x0000: ctx_object */ + 0x00000000, ++/* 0x0004: ctx_dma */ ++/* 0x0004: ctx_dma_query */ + 0x00000000, ++/* 0x0008: ctx_dma_src */ + 0x00000000, ++/* 0x000c: ctx_dma_dst */ + 0x00000000, ++/* 0x0010: ctx_query_address_high */ + 0x00000000, ++/* 0x0014: ctx_query_address_low */ + 0x00000000, ++/* 0x0018: ctx_query_counter */ + 0x00000000, ++/* 0x001c: ctx_src_address_high */ + 0x00000000, ++/* 0x0020: ctx_src_address_low */ + 0x00000000, ++/* 0x0024: ctx_src_pitch */ + 0x00000000, ++/* 0x0028: ctx_src_tile_mode */ + 0x00000000, ++/* 0x002c: ctx_src_xsize */ + 0x00000000, ++/* 0x0030: ctx_src_ysize */ + 0x00000000, ++/* 0x0034: ctx_src_zsize */ + 0x00000000, ++/* 0x0038: ctx_src_zoff */ + 0x00000000, ++/* 0x003c: ctx_src_xoff */ + 0x00000000, ++/* 0x0040: ctx_src_yoff */ + 0x00000000, ++/* 0x0044: ctx_src_cpp */ + 0x00000000, ++/* 0x0048: ctx_dst_address_high */ + 0x00000000, ++/* 0x004c: ctx_dst_address_low */ + 0x00000000, ++/* 0x0050: ctx_dst_pitch */ + 0x00000000, ++/* 0x0054: ctx_dst_tile_mode */ + 0x00000000, ++/* 0x0058: ctx_dst_xsize */ + 0x00000000, ++/* 0x005c: ctx_dst_ysize */ + 0x00000000, ++/* 0x0060: ctx_dst_zsize */ + 0x00000000, ++/* 0x0064: ctx_dst_zoff */ + 0x00000000, ++/* 0x0068: ctx_dst_xoff */ + 0x00000000, ++/* 0x006c: ctx_dst_yoff */ + 0x00000000, ++/* 0x0070: ctx_dst_cpp */ + 0x00000000, ++/* 0x0074: ctx_format */ + 0x00000000, ++/* 0x0078: ctx_swz_const0 */ + 0x00000000, ++/* 0x007c: ctx_swz_const1 */ + 0x00000000, ++/* 0x0080: ctx_xcnt */ + 0x00000000, ++/* 0x0084: ctx_ycnt */ + 0x00000000, + 0x00000000, + 0x00000000, +@@ -63,6 +98,7 @@ uint32_t nva3_pcopy_data[] = { + 0x00000000, + 0x00000000, + 0x00000000, ++/* 0x0100: dispatch_table */ + 0x00010000, + 0x00000000, + 0x00000000, +@@ -73,6 +109,7 @@ uint32_t nva3_pcopy_data[] = { + 0x00010162, + 0x00000000, + 0x00030060, ++/* 0x0128: dispatch_dma */ + 0x00010170, + 0x00000000, + 0x00010170, +@@ -118,11 +155,11 @@ uint32_t nva3_pcopy_data[] = { + 0x0000001c, + 0xffffff00, + 0x00000020, +- 0x0000000f, ++ 0x00000000, + 0x00000048, + 0xffffff00, + 0x0000004c, +- 0x0000000f, ++ 0x00000000, + 0x00000024, + 0xfff80000, + 0x00000050, +@@ -146,7 +183,8 @@ uint32_t nva3_pcopy_data[] = { + 0x00000800, + }; + +-uint32_t nva3_pcopy_code[] = { ++u32 nva3_pcopy_code[] = { ++/* 0x0000: main */ + 0x04fe04bd, + 0x3517f000, + 0xf10010fe, +@@ -158,23 +196,31 @@ uint32_t nva3_pcopy_code[] = { + 0x17f11031, + 0x27f01200, + 0x0012d003, ++/* 0x002f: spin */ + 0xf40031f4, + 0x0ef40028, ++/* 0x0035: ih */ + 0x8001cffd, + 0xf40812c4, + 0x21f4060b, ++/* 0x0041: ih_no_chsw */ + 0x0412c472, + 0xf4060bf4, ++/* 0x004a: ih_no_cmd */ + 0x11c4c321, + 0x4001d00c, ++/* 0x0052: swctx */ + 0x47f101f8, + 0x4bfe7700, + 0x0007fe00, + 0xf00204b9, + 0x01f40643, + 0x0604fa09, ++/* 0x006b: swctx_load */ + 0xfa060ef4, ++/* 0x006e: swctx_done */ + 0x03f80504, ++/* 0x0072: chsw */ + 0x27f100f8, + 0x23cf1400, + 0x1e3fc800, +@@ -183,18 +229,22 @@ uint32_t nva3_pcopy_code[] = { + 0x1e3af052, + 0xf00023d0, + 0x24d00147, ++/* 0x0093: chsw_no_unload */ + 0xcf00f880, + 0x3dc84023, + 0x220bf41e, + 0xf40131f4, + 0x57f05221, + 0x0367f004, ++/* 0x00a8: chsw_load_ctx_dma */ + 0xa07856bc, + 0xb6018068, + 0x87d00884, + 0x0162b600, ++/* 0x00bb: chsw_finish_load */ + 0xf0f018f4, + 0x23d00237, ++/* 0x00c3: dispatch */ + 0xf100f880, + 0xcf190037, + 0x33cf4032, +@@ -202,6 +252,7 @@ uint32_t nva3_pcopy_code[] = { + 0x1024b607, + 0x010057f1, + 0x74bd64bd, ++/* 0x00dc: dispatch_loop */ + 0x58005658, + 0x50b60157, + 0x0446b804, +@@ -211,6 +262,7 @@ uint32_t nva3_pcopy_code[] = { + 0xb60276bb, + 0x57bb0374, + 0xdf0ef400, ++/* 0x0100: dispatch_valid_mthd */ + 0xb60246bb, + 0x45bb0344, + 0x01459800, +@@ -220,31 +272,41 @@ uint32_t nva3_pcopy_code[] = { + 0xb0014658, + 0x1bf40064, + 0x00538009, ++/* 0x0127: dispatch_cmd */ + 0xf4300ef4, + 0x55f90132, + 0xf40c01f4, ++/* 0x0132: dispatch_invalid_bitfield */ + 0x25f0250e, ++/* 0x0135: dispatch_illegal_mthd */ + 0x0125f002, ++/* 0x0138: dispatch_error */ + 0x100047f1, + 0xd00042d0, + 0x27f04043, + 0x0002d040, ++/* 0x0148: hostirq_wait */ + 0xf08002cf, + 0x24b04024, + 0xf71bf400, ++/* 0x0154: dispatch_done */ + 0x1d0027f1, + 0xd00137f0, + 0x00f80023, ++/* 0x0160: cmd_nop */ ++/* 0x0162: cmd_pm_trigger */ + 0x27f100f8, + 0x34bd2200, + 0xd00233f0, + 0x00f80023, ++/* 0x0170: cmd_dma */ + 0x012842b7, + 0xf00145b6, + 0x43801e39, + 0x0040b701, + 0x0644b606, + 0xf80043d0, ++/* 0x0189: cmd_exec_set_format */ + 0xf030f400, + 0xb00001b0, + 0x01b00101, +@@ -256,20 +318,26 @@ uint32_t nva3_pcopy_code[] = { + 0x70b63847, + 0x0232f401, + 0x94bd84bd, ++/* 0x01b4: ncomp_loop */ + 0xb60f4ac4, + 0xb4bd0445, ++/* 0x01bc: bpc_loop */ + 0xf404a430, + 0xa5ff0f18, + 0x00cbbbc0, + 0xf40231f4, ++/* 0x01ce: cmp_c0 */ + 0x1bf4220e, + 0x10c7f00c, + 0xf400cbbb, ++/* 0x01da: cmp_c1 */ + 0xa430160e, + 0x0c18f406, + 0xbb14c7f0, + 0x0ef400cb, ++/* 0x01e9: cmp_zero */ + 0x80c7f107, ++/* 0x01ed: bpc_next */ + 0x01c83800, + 0xb60180b6, + 0xb5b801b0, +@@ -280,6 +348,7 @@ uint32_t nva3_pcopy_code[] = { + 0x98110680, + 0x68fd2008, + 0x0502f400, ++/* 0x0216: dst_xcnt */ + 0x75fd64bd, + 0x1c078000, + 0xf10078fd, +@@ -304,6 +373,7 @@ uint32_t nva3_pcopy_code[] = { + 0x980056d0, + 0x56d01f06, + 0x1030f440, ++/* 0x0276: cmd_exec_set_surface_tiled */ + 0x579800f8, + 0x6879c70a, + 0xb66478c7, +@@ -311,9 +381,11 @@ uint32_t nva3_pcopy_code[] = { + 0x0e76b060, + 0xf0091bf4, + 0x0ef40477, ++/* 0x0291: xtile64 */ + 0x027cf00f, + 0xfd1170b6, + 0x77f00947, ++/* 0x029d: xtileok */ + 0x0f5a9806, + 0xfd115b98, + 0xb7f000ab, +@@ -371,6 +443,7 @@ uint32_t nva3_pcopy_code[] = { + 0x67d00600, + 0x0060b700, + 0x0068d004, ++/* 0x0382: cmd_exec_set_surface_linear */ + 0x6cf000f8, + 0x0260b702, + 0x0864b602, +@@ -381,13 +454,16 @@ uint32_t nva3_pcopy_code[] = { + 0xb70067d0, + 0x98040060, + 0x67d00957, ++/* 0x03ab: cmd_exec_wait */ + 0xf900f800, + 0xf110f900, + 0xb6080007, ++/* 0x03b6: loop */ + 0x01cf0604, + 0x0114f000, + 0xfcfa1bf4, + 0xf800fc10, ++/* 0x03c5: cmd_exec_query */ + 0x0d34c800, + 0xf5701bf4, + 0xf103ab21, +@@ -417,6 +493,7 @@ uint32_t nva3_pcopy_code[] = { + 0x47f10153, + 0x44b60800, + 0x0045d006, ++/* 0x0438: query_counter */ + 0x03ab21f5, + 0x080c47f1, + 0x980644b6, +@@ -439,11 +516,13 @@ uint32_t nva3_pcopy_code[] = { + 0x47f10153, + 0x44b60800, + 0x0045d006, ++/* 0x0492: cmd_exec */ + 0x21f500f8, + 0x3fc803ab, + 0x0e0bf400, + 0x018921f5, + 0x020047f1, ++/* 0x04a7: cmd_exec_no_format */ + 0xf11e0ef4, + 0xb6081067, + 0x77f00664, +@@ -451,19 +530,24 @@ uint32_t nva3_pcopy_code[] = { + 0x981c0780, + 0x67d02007, + 0x4067d000, ++/* 0x04c2: cmd_exec_init_src_surface */ + 0x32f444bd, + 0xc854bd02, + 0x0bf4043f, + 0x8221f50a, + 0x0a0ef403, ++/* 0x04d4: src_tiled */ + 0x027621f5, ++/* 0x04db: cmd_exec_init_dst_surface */ + 0xf40749f0, + 0x57f00231, + 0x083fc82c, + 0xf50a0bf4, + 0xf4038221, ++/* 0x04ee: dst_tiled */ + 0x21f50a0e, + 0x49f00276, ++/* 0x04f5: cmd_exec_kick */ + 0x0057f108, + 0x0654b608, + 0xd0210698, +@@ -473,6 +557,8 @@ uint32_t nva3_pcopy_code[] = { + 0xc80054d0, + 0x0bf40c3f, + 0xc521f507, ++/* 0x0519: cmd_exec_done */ ++/* 0x051b: cmd_wrcache_flush */ + 0xf100f803, + 0xbd220027, + 0x0133f034, +diff --git a/drivers/gpu/drm/nouveau/nvc0_copy.fuc.h b/drivers/gpu/drm/nouveau/nvc0_copy.fuc.h +index 4199038..9e87036 100644 +--- a/drivers/gpu/drm/nouveau/nvc0_copy.fuc.h ++++ b/drivers/gpu/drm/nouveau/nvc0_copy.fuc.h +@@ -1,34 +1,65 @@ +-uint32_t nvc0_pcopy_data[] = { ++u32 nvc0_pcopy_data[] = { ++/* 0x0000: ctx_object */ + 0x00000000, ++/* 0x0004: ctx_query_address_high */ + 0x00000000, ++/* 0x0008: ctx_query_address_low */ + 0x00000000, ++/* 0x000c: ctx_query_counter */ + 0x00000000, ++/* 0x0010: ctx_src_address_high */ + 0x00000000, ++/* 0x0014: ctx_src_address_low */ + 0x00000000, ++/* 0x0018: ctx_src_pitch */ + 0x00000000, ++/* 0x001c: ctx_src_tile_mode */ + 0x00000000, ++/* 0x0020: ctx_src_xsize */ + 0x00000000, ++/* 0x0024: ctx_src_ysize */ + 0x00000000, ++/* 0x0028: ctx_src_zsize */ + 0x00000000, ++/* 0x002c: ctx_src_zoff */ + 0x00000000, ++/* 0x0030: ctx_src_xoff */ + 0x00000000, ++/* 0x0034: ctx_src_yoff */ + 0x00000000, ++/* 0x0038: ctx_src_cpp */ + 0x00000000, ++/* 0x003c: ctx_dst_address_high */ + 0x00000000, ++/* 0x0040: ctx_dst_address_low */ + 0x00000000, ++/* 0x0044: ctx_dst_pitch */ + 0x00000000, ++/* 0x0048: ctx_dst_tile_mode */ + 0x00000000, ++/* 0x004c: ctx_dst_xsize */ + 0x00000000, ++/* 0x0050: ctx_dst_ysize */ + 0x00000000, ++/* 0x0054: ctx_dst_zsize */ + 0x00000000, ++/* 0x0058: ctx_dst_zoff */ + 0x00000000, ++/* 0x005c: ctx_dst_xoff */ + 0x00000000, ++/* 0x0060: ctx_dst_yoff */ + 0x00000000, ++/* 0x0064: ctx_dst_cpp */ + 0x00000000, ++/* 0x0068: ctx_format */ + 0x00000000, ++/* 0x006c: ctx_swz_const0 */ + 0x00000000, ++/* 0x0070: ctx_swz_const1 */ + 0x00000000, ++/* 0x0074: ctx_xcnt */ + 0x00000000, ++/* 0x0078: ctx_ycnt */ + 0x00000000, + 0x00000000, + 0x00000000, +@@ -63,6 +94,7 @@ uint32_t nvc0_pcopy_data[] = { + 0x00000000, + 0x00000000, + 0x00000000, ++/* 0x0100: dispatch_table */ + 0x00010000, + 0x00000000, + 0x00000000, +@@ -111,11 +143,11 @@ uint32_t nvc0_pcopy_data[] = { + 0x00000010, + 0xffffff00, + 0x00000014, +- 0x0000000f, ++ 0x00000000, + 0x0000003c, + 0xffffff00, + 0x00000040, +- 0x0000000f, ++ 0x00000000, + 0x00000018, + 0xfff80000, + 0x00000044, +@@ -139,7 +171,8 @@ uint32_t nvc0_pcopy_data[] = { + 0x00000800, + }; + +-uint32_t nvc0_pcopy_code[] = { ++u32 nvc0_pcopy_code[] = { ++/* 0x0000: main */ + 0x04fe04bd, + 0x3517f000, + 0xf10010fe, +@@ -151,15 +184,20 @@ uint32_t nvc0_pcopy_code[] = { + 0x17f11031, + 0x27f01200, + 0x0012d003, ++/* 0x002f: spin */ + 0xf40031f4, + 0x0ef40028, ++/* 0x0035: ih */ + 0x8001cffd, + 0xf40812c4, + 0x21f4060b, ++/* 0x0041: ih_no_chsw */ + 0x0412c4ca, + 0xf5070bf4, ++/* 0x004b: ih_no_cmd */ + 0xc4010221, + 0x01d00c11, ++/* 0x0053: swctx */ + 0xf101f840, + 0xfe770047, + 0x47f1004b, +@@ -188,8 +226,11 @@ uint32_t nvc0_pcopy_code[] = { + 0xf00204b9, + 0x01f40643, + 0x0604fa09, ++/* 0x00c3: swctx_load */ + 0xfa060ef4, ++/* 0x00c6: swctx_done */ + 0x03f80504, ++/* 0x00ca: chsw */ + 0x27f100f8, + 0x23cf1400, + 0x1e3fc800, +@@ -198,18 +239,22 @@ uint32_t nvc0_pcopy_code[] = { + 0x1e3af053, + 0xf00023d0, + 0x24d00147, ++/* 0x00eb: chsw_no_unload */ + 0xcf00f880, + 0x3dc84023, + 0x090bf41e, + 0xf40131f4, ++/* 0x00fa: chsw_finish_load */ + 0x37f05321, + 0x8023d002, ++/* 0x0102: dispatch */ + 0x37f100f8, + 0x32cf1900, + 0x0033cf40, + 0x07ff24e4, + 0xf11024b6, + 0xbd010057, ++/* 0x011b: dispatch_loop */ + 0x5874bd64, + 0x57580056, + 0x0450b601, +@@ -219,6 +264,7 @@ uint32_t nvc0_pcopy_code[] = { + 0xbb0f08f4, + 0x74b60276, + 0x0057bb03, ++/* 0x013f: dispatch_valid_mthd */ + 0xbbdf0ef4, + 0x44b60246, + 0x0045bb03, +@@ -229,24 +275,33 @@ uint32_t nvc0_pcopy_code[] = { + 0x64b00146, + 0x091bf400, + 0xf4005380, ++/* 0x0166: dispatch_cmd */ + 0x32f4300e, + 0xf455f901, + 0x0ef40c01, ++/* 0x0171: dispatch_invalid_bitfield */ + 0x0225f025, ++/* 0x0174: dispatch_illegal_mthd */ ++/* 0x0177: dispatch_error */ + 0xf10125f0, + 0xd0100047, + 0x43d00042, + 0x4027f040, ++/* 0x0187: hostirq_wait */ + 0xcf0002d0, + 0x24f08002, + 0x0024b040, ++/* 0x0193: dispatch_done */ + 0xf1f71bf4, + 0xf01d0027, + 0x23d00137, ++/* 0x019f: cmd_nop */ + 0xf800f800, ++/* 0x01a1: cmd_pm_trigger */ + 0x0027f100, + 0xf034bd22, + 0x23d00233, ++/* 0x01af: cmd_exec_set_format */ + 0xf400f800, + 0x01b0f030, + 0x0101b000, +@@ -258,20 +313,26 @@ uint32_t nvc0_pcopy_code[] = { + 0x3847c701, + 0xf40170b6, + 0x84bd0232, ++/* 0x01da: ncomp_loop */ + 0x4ac494bd, + 0x0445b60f, ++/* 0x01e2: bpc_loop */ + 0xa430b4bd, + 0x0f18f404, + 0xbbc0a5ff, + 0x31f400cb, + 0x220ef402, ++/* 0x01f4: cmp_c0 */ + 0xf00c1bf4, + 0xcbbb10c7, + 0x160ef400, ++/* 0x0200: cmp_c1 */ + 0xf406a430, + 0xc7f00c18, + 0x00cbbb14, ++/* 0x020f: cmp_zero */ + 0xf1070ef4, ++/* 0x0213: bpc_next */ + 0x380080c7, + 0x80b601c8, + 0x01b0b601, +@@ -283,6 +344,7 @@ uint32_t nvc0_pcopy_code[] = { + 0x1d08980e, + 0xf40068fd, + 0x64bd0502, ++/* 0x023c: dst_xcnt */ + 0x800075fd, + 0x78fd1907, + 0x1057f100, +@@ -307,15 +369,18 @@ uint32_t nvc0_pcopy_code[] = { + 0x1c069800, + 0xf44056d0, + 0x00f81030, ++/* 0x029c: cmd_exec_set_surface_tiled */ + 0xc7075798, + 0x78c76879, + 0x0380b664, + 0xb06077c7, + 0x1bf40e76, + 0x0477f009, ++/* 0x02b7: xtile64 */ + 0xf00f0ef4, + 0x70b6027c, + 0x0947fd11, ++/* 0x02c3: xtileok */ + 0x980677f0, + 0x5b980c5a, + 0x00abfd0e, +@@ -374,6 +439,7 @@ uint32_t nvc0_pcopy_code[] = { + 0xb70067d0, + 0xd0040060, + 0x00f80068, ++/* 0x03a8: cmd_exec_set_surface_linear */ + 0xb7026cf0, + 0xb6020260, + 0x57980864, +@@ -384,12 +450,15 @@ uint32_t nvc0_pcopy_code[] = { + 0x0060b700, + 0x06579804, + 0xf80067d0, ++/* 0x03d1: cmd_exec_wait */ + 0xf900f900, + 0x0007f110, + 0x0604b608, ++/* 0x03dc: loop */ + 0xf00001cf, + 0x1bf40114, + 0xfc10fcfa, ++/* 0x03eb: cmd_exec_query */ + 0xc800f800, + 0x1bf40d34, + 0xd121f570, +@@ -419,6 +488,7 @@ uint32_t nvc0_pcopy_code[] = { + 0x0153f026, + 0x080047f1, + 0xd00644b6, ++/* 0x045e: query_counter */ + 0x21f50045, + 0x47f103d1, + 0x44b6080c, +@@ -442,11 +512,13 @@ uint32_t nvc0_pcopy_code[] = { + 0x080047f1, + 0xd00644b6, + 0x00f80045, ++/* 0x04b8: cmd_exec */ + 0x03d121f5, + 0xf4003fc8, + 0x21f50e0b, + 0x47f101af, + 0x0ef40200, ++/* 0x04cd: cmd_exec_no_format */ + 0x1067f11e, + 0x0664b608, + 0x800177f0, +@@ -454,18 +526,23 @@ uint32_t nvc0_pcopy_code[] = { + 0x1d079819, + 0xd00067d0, + 0x44bd4067, ++/* 0x04e8: cmd_exec_init_src_surface */ + 0xbd0232f4, + 0x043fc854, + 0xf50a0bf4, + 0xf403a821, ++/* 0x04fa: src_tiled */ + 0x21f50a0e, + 0x49f0029c, ++/* 0x0501: cmd_exec_init_dst_surface */ + 0x0231f407, + 0xc82c57f0, + 0x0bf4083f, + 0xa821f50a, + 0x0a0ef403, ++/* 0x0514: dst_tiled */ + 0x029c21f5, ++/* 0x051b: cmd_exec_kick */ + 0xf10849f0, + 0xb6080057, + 0x06980654, +@@ -475,7 +552,9 @@ uint32_t nvc0_pcopy_code[] = { + 0x54d00546, + 0x0c3fc800, + 0xf5070bf4, ++/* 0x053f: cmd_exec_done */ + 0xf803eb21, ++/* 0x0541: cmd_wrcache_flush */ + 0x0027f100, + 0xf034bd22, + 0x23d00133, +diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c +index 552b436..3254d51 100644 +--- a/drivers/gpu/drm/radeon/atombios_dp.c ++++ b/drivers/gpu/drm/radeon/atombios_dp.c +@@ -22,6 +22,7 @@ + * + * Authors: Dave Airlie + * Alex Deucher ++ * Jerome Glisse + */ + #include "drmP.h" + #include "radeon_drm.h" +@@ -634,7 +635,6 @@ static bool radeon_dp_get_link_status(struct radeon_connector *radeon_connector, + ret = radeon_dp_aux_native_read(radeon_connector, DP_LANE0_1_STATUS, + link_status, DP_LINK_STATUS_SIZE, 100); + if (ret <= 0) { +- DRM_ERROR("displayport link status failed\n"); + return false; + } + +@@ -812,8 +812,10 @@ static int radeon_dp_link_train_cr(struct radeon_dp_link_train_info *dp_info) + else + mdelay(dp_info->rd_interval * 4); + +- if (!radeon_dp_get_link_status(dp_info->radeon_connector, dp_info->link_status)) ++ if (!radeon_dp_get_link_status(dp_info->radeon_connector, dp_info->link_status)) { ++ DRM_ERROR("displayport link status failed\n"); + break; ++ } + + if (dp_clock_recovery_ok(dp_info->link_status, dp_info->dp_lane_count)) { + clock_recovery = true; +@@ -875,8 +877,10 @@ static int radeon_dp_link_train_ce(struct radeon_dp_link_train_info *dp_info) + else + mdelay(dp_info->rd_interval * 4); + +- if (!radeon_dp_get_link_status(dp_info->radeon_connector, dp_info->link_status)) ++ if (!radeon_dp_get_link_status(dp_info->radeon_connector, dp_info->link_status)) { ++ DRM_ERROR("displayport link status failed\n"); + break; ++ } + + if (dp_channel_eq_ok(dp_info->link_status, dp_info->dp_lane_count)) { + channel_eq = true; +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c +index 4a4493f..87d494d 100644 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -64,14 +64,33 @@ void radeon_connector_hotplug(struct drm_connector *connector) + + /* just deal with DP (not eDP) here. */ + if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort) { +- int saved_dpms = connector->dpms; +- +- /* Only turn off the display it it's physically disconnected */ +- if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) +- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); +- else if (radeon_dp_needs_link_train(radeon_connector)) +- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); +- connector->dpms = saved_dpms; ++ struct radeon_connector_atom_dig *dig_connector = ++ radeon_connector->con_priv; ++ ++ /* if existing sink type was not DP no need to retrain */ ++ if (dig_connector->dp_sink_type != CONNECTOR_OBJECT_ID_DISPLAYPORT) ++ return; ++ ++ /* first get sink type as it may be reset after (un)plug */ ++ dig_connector->dp_sink_type = radeon_dp_getsinktype(radeon_connector); ++ /* don't do anything if sink is not display port, i.e., ++ * passive dp->(dvi|hdmi) adaptor ++ */ ++ if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) { ++ int saved_dpms = connector->dpms; ++ /* Only turn off the display if it's physically disconnected */ ++ if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) { ++ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); ++ } else if (radeon_dp_needs_link_train(radeon_connector)) { ++ /* set it to OFF so that drm_helper_connector_dpms() ++ * won't return immediately since the current state ++ * is ON at this point. ++ */ ++ connector->dpms = DRM_MODE_DPMS_OFF; ++ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); ++ } ++ connector->dpms = saved_dpms; ++ } + } + } + +diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c +index 986d608..2132109 100644 +--- a/drivers/gpu/drm/radeon/radeon_cursor.c ++++ b/drivers/gpu/drm/radeon/radeon_cursor.c +@@ -257,8 +257,14 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc, + if (!(cursor_end & 0x7f)) + w--; + } +- if (w <= 0) ++ if (w <= 0) { + w = 1; ++ cursor_end = x - xorigin + w; ++ if (!(cursor_end & 0x7f)) { ++ x--; ++ WARN_ON_ONCE(x < 0); ++ } ++ } + } + } + +diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c +index f3ae607..39497c7 100644 +--- a/drivers/gpu/drm/radeon/radeon_object.c ++++ b/drivers/gpu/drm/radeon/radeon_object.c +@@ -117,7 +117,6 @@ int radeon_bo_create(struct radeon_device *rdev, + return -ENOMEM; + } + +-retry: + bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL); + if (bo == NULL) + return -ENOMEM; +@@ -130,6 +129,8 @@ retry: + bo->gem_base.driver_private = NULL; + bo->surface_reg = -1; + INIT_LIST_HEAD(&bo->list); ++ ++retry: + radeon_ttm_placement_from_domain(bo, domain); + /* Kernel allocation are uninterruptible */ + mutex_lock(&rdev->vram_mutex); +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index a1b8caa..0f074e0 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -1865,6 +1865,11 @@ static int device_change_notifier(struct notifier_block *nb, + + iommu_init_device(dev); + ++ if (iommu_pass_through) { ++ attach_device(dev, pt_domain); ++ break; ++ } ++ + domain = domain_for_device(dev); + + /* allocate a protection domain if a device is added */ +@@ -1880,10 +1885,7 @@ static int device_change_notifier(struct notifier_block *nb, + list_add_tail(&dma_domain->list, &iommu_pd_list); + spin_unlock_irqrestore(&iommu_pd_list_lock, flags); + +- if (!iommu_pass_through) +- dev->archdata.dma_ops = &amd_iommu_dma_ops; +- else +- dev->archdata.dma_ops = &nommu_dma_ops; ++ dev->archdata.dma_ops = &amd_iommu_dma_ops; + + break; + case BUS_NOTIFY_DEL_DEVICE: +diff --git a/drivers/media/video/cx25821/cx25821-core.c b/drivers/media/video/cx25821/cx25821-core.c +index a7fa38f..e572ce5 100644 +--- a/drivers/media/video/cx25821/cx25821-core.c ++++ b/drivers/media/video/cx25821/cx25821-core.c +@@ -914,9 +914,6 @@ static int cx25821_dev_setup(struct cx25821_dev *dev) + list_add_tail(&dev->devlist, &cx25821_devlist); + mutex_unlock(&cx25821_devlist_mutex); + +- strcpy(cx25821_boards[UNKNOWN_BOARD].name, "unknown"); +- strcpy(cx25821_boards[CX25821_BOARD].name, "cx25821"); +- + if (dev->pci->device != 0x8210) { + pr_info("%s(): Exiting. Incorrect Hardware device = 0x%02x\n", + __func__, dev->pci->device); +diff --git a/drivers/media/video/cx25821/cx25821.h b/drivers/media/video/cx25821/cx25821.h +index 2d2d009..bf54360 100644 +--- a/drivers/media/video/cx25821/cx25821.h ++++ b/drivers/media/video/cx25821/cx25821.h +@@ -187,7 +187,7 @@ enum port { + }; + + struct cx25821_board { +- char *name; ++ const char *name; + enum port porta; + enum port portb; + enum port portc; +diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c +index 6878a94..83b51b5 100644 +--- a/drivers/mmc/host/sdhci-pci.c ++++ b/drivers/mmc/host/sdhci-pci.c +@@ -148,6 +148,7 @@ static const struct sdhci_pci_fixes sdhci_ene_714 = { + static const struct sdhci_pci_fixes sdhci_cafe = { + .quirks = SDHCI_QUIRK_NO_SIMULT_VDD_AND_POWER | + SDHCI_QUIRK_NO_BUSY_IRQ | ++ SDHCI_QUIRK_BROKEN_CARD_DETECTION | + SDHCI_QUIRK_BROKEN_TIMEOUT_VAL, + }; + +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index 9e61d6b..ed1be8a 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -3770,6 +3770,7 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp) + case RTL_GIGA_MAC_VER_22: + case RTL_GIGA_MAC_VER_23: + case RTL_GIGA_MAC_VER_24: ++ case RTL_GIGA_MAC_VER_34: + RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST); + break; + default: +diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c +index 01dcb1a..727c129 100644 +--- a/drivers/net/wireless/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/mwifiex/cfg80211.c +@@ -545,9 +545,9 @@ mwifiex_dump_station_info(struct mwifiex_private *priv, + + /* + * Bit 0 in tx_htinfo indicates that current Tx rate is 11n rate. Valid +- * MCS index values for us are 0 to 7. ++ * MCS index values for us are 0 to 15. + */ +- if ((priv->tx_htinfo & BIT(0)) && (priv->tx_rate < 8)) { ++ if ((priv->tx_htinfo & BIT(0)) && (priv->tx_rate < 16)) { + sinfo->txrate.mcs = priv->tx_rate; + sinfo->txrate.flags |= RATE_INFO_FLAGS_MCS; + /* 40MHz rate */ +diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c +index 0ffa111..bdf960b 100644 +--- a/drivers/net/wireless/rt2x00/rt2800usb.c ++++ b/drivers/net/wireless/rt2x00/rt2800usb.c +@@ -876,6 +876,7 @@ static struct usb_device_id rt2800usb_device_table[] = { + { USB_DEVICE(0x1482, 0x3c09) }, + /* AirTies */ + { USB_DEVICE(0x1eda, 0x2012) }, ++ { USB_DEVICE(0x1eda, 0x2210) }, + { USB_DEVICE(0x1eda, 0x2310) }, + /* Allwin */ + { USB_DEVICE(0x8516, 0x2070) }, +@@ -945,6 +946,7 @@ static struct usb_device_id rt2800usb_device_table[] = { + /* DVICO */ + { USB_DEVICE(0x0fe9, 0xb307) }, + /* Edimax */ ++ { USB_DEVICE(0x7392, 0x4085) }, + { USB_DEVICE(0x7392, 0x7711) }, + { USB_DEVICE(0x7392, 0x7717) }, + { USB_DEVICE(0x7392, 0x7718) }, +@@ -1020,6 +1022,7 @@ static struct usb_device_id rt2800usb_device_table[] = { + /* Philips */ + { USB_DEVICE(0x0471, 0x200f) }, + /* Planex */ ++ { USB_DEVICE(0x2019, 0x5201) }, + { USB_DEVICE(0x2019, 0xab25) }, + { USB_DEVICE(0x2019, 0xed06) }, + /* Quanta */ +@@ -1088,6 +1091,12 @@ static struct usb_device_id rt2800usb_device_table[] = { + #ifdef CONFIG_RT2800USB_RT33XX + /* Belkin */ + { USB_DEVICE(0x050d, 0x945b) }, ++ /* D-Link */ ++ { USB_DEVICE(0x2001, 0x3c17) }, ++ /* Panasonic */ ++ { USB_DEVICE(0x083a, 0xb511) }, ++ /* Philips */ ++ { USB_DEVICE(0x0471, 0x20dd) }, + /* Ralink */ + { USB_DEVICE(0x148f, 0x3370) }, + { USB_DEVICE(0x148f, 0x8070) }, +@@ -1099,6 +1108,8 @@ static struct usb_device_id rt2800usb_device_table[] = { + { USB_DEVICE(0x8516, 0x3572) }, + /* Askey */ + { USB_DEVICE(0x1690, 0x0744) }, ++ { USB_DEVICE(0x1690, 0x0761) }, ++ { USB_DEVICE(0x1690, 0x0764) }, + /* Cisco */ + { USB_DEVICE(0x167b, 0x4001) }, + /* EnGenius */ +@@ -1113,6 +1124,9 @@ static struct usb_device_id rt2800usb_device_table[] = { + /* Sitecom */ + { USB_DEVICE(0x0df6, 0x0041) }, + { USB_DEVICE(0x0df6, 0x0062) }, ++ { USB_DEVICE(0x0df6, 0x0065) }, ++ { USB_DEVICE(0x0df6, 0x0066) }, ++ { USB_DEVICE(0x0df6, 0x0068) }, + /* Toshiba */ + { USB_DEVICE(0x0930, 0x0a07) }, + /* Zinwell */ +@@ -1122,6 +1136,9 @@ static struct usb_device_id rt2800usb_device_table[] = { + /* Azurewave */ + { USB_DEVICE(0x13d3, 0x3329) }, + { USB_DEVICE(0x13d3, 0x3365) }, ++ /* D-Link */ ++ { USB_DEVICE(0x2001, 0x3c1c) }, ++ { USB_DEVICE(0x2001, 0x3c1d) }, + /* Ralink */ + { USB_DEVICE(0x148f, 0x5370) }, + { USB_DEVICE(0x148f, 0x5372) }, +@@ -1163,13 +1180,8 @@ static struct usb_device_id rt2800usb_device_table[] = { + /* D-Link */ + { USB_DEVICE(0x07d1, 0x3c0b) }, + { USB_DEVICE(0x07d1, 0x3c17) }, +- { USB_DEVICE(0x2001, 0x3c17) }, +- /* Edimax */ +- { USB_DEVICE(0x7392, 0x4085) }, + /* Encore */ + { USB_DEVICE(0x203d, 0x14a1) }, +- /* Fujitsu Stylistic 550 */ +- { USB_DEVICE(0x1690, 0x0761) }, + /* Gemtek */ + { USB_DEVICE(0x15a9, 0x0010) }, + /* Gigabyte */ +@@ -1190,7 +1202,6 @@ static struct usb_device_id rt2800usb_device_table[] = { + { USB_DEVICE(0x05a6, 0x0101) }, + { USB_DEVICE(0x1d4d, 0x0010) }, + /* Planex */ +- { USB_DEVICE(0x2019, 0x5201) }, + { USB_DEVICE(0x2019, 0xab24) }, + /* Qcom */ + { USB_DEVICE(0x18e8, 0x6259) }, +diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/rtlwifi/rtl8192de/phy.c +index 2cf4c5f..de9faa9 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8192de/phy.c ++++ b/drivers/net/wireless/rtlwifi/rtl8192de/phy.c +@@ -3462,21 +3462,21 @@ void rtl92d_phy_config_macphymode_info(struct ieee80211_hw *hw) + switch (rtlhal->macphymode) { + case DUALMAC_SINGLEPHY: + rtlphy->rf_type = RF_2T2R; +- rtlhal->version |= CHIP_92D_SINGLEPHY; ++ rtlhal->version |= RF_TYPE_2T2R; + rtlhal->bandset = BAND_ON_BOTH; + rtlhal->current_bandtype = BAND_ON_2_4G; + break; + + case SINGLEMAC_SINGLEPHY: + rtlphy->rf_type = RF_2T2R; +- rtlhal->version |= CHIP_92D_SINGLEPHY; ++ rtlhal->version |= RF_TYPE_2T2R; + rtlhal->bandset = BAND_ON_BOTH; + rtlhal->current_bandtype = BAND_ON_2_4G; + break; + + case DUALMAC_DUALPHY: + rtlphy->rf_type = RF_1T1R; +- rtlhal->version &= (~CHIP_92D_SINGLEPHY); ++ rtlhal->version &= RF_TYPE_1T1R; + /* Now we let MAC0 run on 5G band. */ + if (rtlhal->interfaceindex == 0) { + rtlhal->bandset = BAND_ON_5G; +diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c +index 351dc0b..ee77a58 100644 +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -287,6 +287,7 @@ static void scsi_host_dev_release(struct device *dev) + struct Scsi_Host *shost = dev_to_shost(dev); + struct device *parent = dev->parent; + struct request_queue *q; ++ void *queuedata; + + scsi_proc_hostdir_rm(shost->hostt); + +@@ -296,9 +297,9 @@ static void scsi_host_dev_release(struct device *dev) + destroy_workqueue(shost->work_q); + q = shost->uspace_req_q; + if (q) { +- kfree(q->queuedata); +- q->queuedata = NULL; +- scsi_free_queue(q); ++ queuedata = q->queuedata; ++ blk_cleanup_queue(q); ++ kfree(queuedata); + } + + scsi_destroy_command_freelist(shost); +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index e48ba4b..dbe3568 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -774,7 +774,7 @@ static struct domain_device *sas_ex_discover_end_dev( + } + + /* See if this phy is part of a wide port */ +-static int sas_ex_join_wide_port(struct domain_device *parent, int phy_id) ++static bool sas_ex_join_wide_port(struct domain_device *parent, int phy_id) + { + struct ex_phy *phy = &parent->ex_dev.ex_phy[phy_id]; + int i; +@@ -790,11 +790,11 @@ static int sas_ex_join_wide_port(struct domain_device *parent, int phy_id) + sas_port_add_phy(ephy->port, phy->phy); + phy->port = ephy->port; + phy->phy_state = PHY_DEVICE_DISCOVERED; +- return 0; ++ return true; + } + } + +- return -ENODEV; ++ return false; + } + + static struct domain_device *sas_ex_discover_expander( +@@ -932,8 +932,7 @@ static int sas_ex_discover_dev(struct domain_device *dev, int phy_id) + return res; + } + +- res = sas_ex_join_wide_port(dev, phy_id); +- if (!res) { ++ if (sas_ex_join_wide_port(dev, phy_id)) { + SAS_DPRINTK("Attaching ex phy%d to wide port %016llx\n", + phy_id, SAS_ADDR(ex_phy->attached_sas_addr)); + return res; +@@ -978,8 +977,7 @@ static int sas_ex_discover_dev(struct domain_device *dev, int phy_id) + if (SAS_ADDR(ex->ex_phy[i].attached_sas_addr) == + SAS_ADDR(child->sas_addr)) { + ex->ex_phy[i].phy_state= PHY_DEVICE_DISCOVERED; +- res = sas_ex_join_wide_port(dev, i); +- if (!res) ++ if (sas_ex_join_wide_port(dev, i)) + SAS_DPRINTK("Attaching ex phy%d to wide port %016llx\n", + i, SAS_ADDR(ex->ex_phy[i].attached_sas_addr)); + +@@ -1849,32 +1847,20 @@ static int sas_discover_new(struct domain_device *dev, int phy_id) + { + struct ex_phy *ex_phy = &dev->ex_dev.ex_phy[phy_id]; + struct domain_device *child; +- bool found = false; +- int res, i; ++ int res; + + SAS_DPRINTK("ex %016llx phy%d new device attached\n", + SAS_ADDR(dev->sas_addr), phy_id); + res = sas_ex_phy_discover(dev, phy_id); + if (res) +- goto out; +- /* to support the wide port inserted */ +- for (i = 0; i < dev->ex_dev.num_phys; i++) { +- struct ex_phy *ex_phy_temp = &dev->ex_dev.ex_phy[i]; +- if (i == phy_id) +- continue; +- if (SAS_ADDR(ex_phy_temp->attached_sas_addr) == +- SAS_ADDR(ex_phy->attached_sas_addr)) { +- found = true; +- break; +- } +- } +- if (found) { +- sas_ex_join_wide_port(dev, phy_id); ++ return res; ++ ++ if (sas_ex_join_wide_port(dev, phy_id)) + return 0; +- } ++ + res = sas_ex_discover_devices(dev, phy_id); +- if (!res) +- goto out; ++ if (res) ++ return res; + list_for_each_entry(child, &dev->ex_dev.children, siblings) { + if (SAS_ADDR(child->sas_addr) == + SAS_ADDR(ex_phy->attached_sas_addr)) { +@@ -1884,7 +1870,6 @@ static int sas_discover_new(struct domain_device *dev, int phy_id) + break; + } + } +-out: + return res; + } + +@@ -1983,9 +1968,7 @@ int sas_ex_revalidate_domain(struct domain_device *port_dev) + struct domain_device *dev = NULL; + + res = sas_find_bcast_dev(port_dev, &dev); +- if (res) +- goto out; +- if (dev) { ++ while (res == 0 && dev) { + struct expander_device *ex = &dev->ex_dev; + int i = 0, phy_id; + +@@ -1997,8 +1980,10 @@ int sas_ex_revalidate_domain(struct domain_device *port_dev) + res = sas_rediscover(dev, phy_id); + i = phy_id + 1; + } while (i < ex->num_phys); ++ ++ dev = NULL; ++ res = sas_find_bcast_dev(port_dev, &dev); + } +-out: + return res; + } + +diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c +index 2aeb2e9..831db24 100644 +--- a/drivers/scsi/scsi.c ++++ b/drivers/scsi/scsi.c +@@ -785,7 +785,13 @@ static void scsi_done(struct scsi_cmnd *cmd) + /* Move this to a header if it becomes more generally useful */ + static struct scsi_driver *scsi_cmd_to_driver(struct scsi_cmnd *cmd) + { +- return *(struct scsi_driver **)cmd->request->rq_disk->private_data; ++ struct scsi_driver **sdp; ++ ++ sdp = (struct scsi_driver **)cmd->request->rq_disk->private_data; ++ if (!sdp) ++ return NULL; ++ ++ return *sdp; + } + + /** +diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c +index dc6131e..456b131 100644 +--- a/drivers/scsi/scsi_error.c ++++ b/drivers/scsi/scsi_error.c +@@ -1673,6 +1673,20 @@ static void scsi_restart_operations(struct Scsi_Host *shost) + * requests are started. + */ + scsi_run_host_queues(shost); ++ ++ /* ++ * if eh is active and host_eh_scheduled is pending we need to re-run ++ * recovery. we do this check after scsi_run_host_queues() to allow ++ * everything pent up since the last eh run a chance to make forward ++ * progress before we sync again. Either we'll immediately re-run ++ * recovery or scsi_device_unbusy() will wake us again when these ++ * pending commands complete. ++ */ ++ spin_lock_irqsave(shost->host_lock, flags); ++ if (shost->host_eh_scheduled) ++ if (scsi_host_set_state(shost, SHOST_RECOVERY)) ++ WARN_ON(scsi_host_set_state(shost, SHOST_CANCEL_RECOVERY)); ++ spin_unlock_irqrestore(shost->host_lock, flags); + } + + /** +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index f0ab58e..6c4b620 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -406,10 +406,6 @@ static void scsi_run_queue(struct request_queue *q) + LIST_HEAD(starved_list); + unsigned long flags; + +- /* if the device is dead, sdev will be NULL, so no queue to run */ +- if (!sdev) +- return; +- + shost = sdev->host; + if (scsi_target(sdev)->single_lun) + scsi_single_lun_run(sdev); +@@ -483,15 +479,26 @@ void scsi_requeue_run_queue(struct work_struct *work) + */ + static void scsi_requeue_command(struct request_queue *q, struct scsi_cmnd *cmd) + { ++ struct scsi_device *sdev = cmd->device; + struct request *req = cmd->request; + unsigned long flags; + ++ /* ++ * We need to hold a reference on the device to avoid the queue being ++ * killed after the unlock and before scsi_run_queue is invoked which ++ * may happen because scsi_unprep_request() puts the command which ++ * releases its reference on the device. ++ */ ++ get_device(&sdev->sdev_gendev); ++ + spin_lock_irqsave(q->queue_lock, flags); + scsi_unprep_request(req); + blk_requeue_request(q, req); + spin_unlock_irqrestore(q->queue_lock, flags); + + scsi_run_queue(q); ++ ++ put_device(&sdev->sdev_gendev); + } + + void scsi_next_command(struct scsi_cmnd *cmd) +@@ -1374,16 +1381,16 @@ static inline int scsi_host_queue_ready(struct request_queue *q, + * may be changed after request stacking drivers call the function, + * regardless of taking lock or not. + * +- * When scsi can't dispatch I/Os anymore and needs to kill I/Os +- * (e.g. !sdev), scsi needs to return 'not busy'. +- * Otherwise, request stacking drivers may hold requests forever. ++ * When scsi can't dispatch I/Os anymore and needs to kill I/Os scsi ++ * needs to return 'not busy'. Otherwise, request stacking drivers ++ * may hold requests forever. + */ + static int scsi_lld_busy(struct request_queue *q) + { + struct scsi_device *sdev = q->queuedata; + struct Scsi_Host *shost; + +- if (!sdev) ++ if (blk_queue_dead(q)) + return 0; + + shost = sdev->host; +@@ -1494,12 +1501,6 @@ static void scsi_request_fn(struct request_queue *q) + struct scsi_cmnd *cmd; + struct request *req; + +- if (!sdev) { +- while ((req = blk_peek_request(q)) != NULL) +- scsi_kill_request(req, q); +- return; +- } +- + if(!get_device(&sdev->sdev_gendev)) + /* We must be tearing the block queue down already */ + return; +@@ -1701,20 +1702,6 @@ struct request_queue *scsi_alloc_queue(struct scsi_device *sdev) + return q; + } + +-void scsi_free_queue(struct request_queue *q) +-{ +- unsigned long flags; +- +- WARN_ON(q->queuedata); +- +- /* cause scsi_request_fn() to kill all non-finished requests */ +- spin_lock_irqsave(q->queue_lock, flags); +- q->request_fn(q); +- spin_unlock_irqrestore(q->queue_lock, flags); +- +- blk_cleanup_queue(q); +-} +- + /* + * Function: scsi_block_requests() + * +diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h +index 5b475d0..d58adca 100644 +--- a/drivers/scsi/scsi_priv.h ++++ b/drivers/scsi/scsi_priv.h +@@ -85,7 +85,6 @@ extern void scsi_next_command(struct scsi_cmnd *cmd); + extern void scsi_io_completion(struct scsi_cmnd *, unsigned int); + extern void scsi_run_host_queues(struct Scsi_Host *shost); + extern struct request_queue *scsi_alloc_queue(struct scsi_device *sdev); +-extern void scsi_free_queue(struct request_queue *q); + extern int scsi_init_queue(void); + extern void scsi_exit_queue(void); + struct request_queue; +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 6e7ea4a..a48b59c 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -1710,6 +1710,9 @@ static void scsi_sysfs_add_devices(struct Scsi_Host *shost) + { + struct scsi_device *sdev; + shost_for_each_device(sdev, shost) { ++ /* target removed before the device could be added */ ++ if (sdev->sdev_state == SDEV_DEL) ++ continue; + if (!scsi_host_scan_allowed(shost) || + scsi_sysfs_add_sdev(sdev) != 0) + __scsi_remove_device(sdev); +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 04c2a27..bb7c482 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -971,11 +971,8 @@ void __scsi_remove_device(struct scsi_device *sdev) + sdev->host->hostt->slave_destroy(sdev); + transport_destroy_device(dev); + +- /* cause the request function to reject all I/O requests */ +- sdev->request_queue->queuedata = NULL; +- + /* Freeing the queue signals to block that we're done */ +- scsi_free_queue(sdev->request_queue); ++ blk_cleanup_queue(sdev->request_queue); + put_device(dev); + } + +@@ -1000,7 +997,6 @@ static void __scsi_remove_target(struct scsi_target *starget) + struct scsi_device *sdev; + + spin_lock_irqsave(shost->host_lock, flags); +- starget->reap_ref++; + restart: + list_for_each_entry(sdev, &shost->__devices, siblings) { + if (sdev->channel != starget->channel || +@@ -1014,14 +1010,6 @@ static void __scsi_remove_target(struct scsi_target *starget) + goto restart; + } + spin_unlock_irqrestore(shost->host_lock, flags); +- scsi_target_reap(starget); +-} +- +-static int __remove_child (struct device * dev, void * data) +-{ +- if (scsi_is_target_device(dev)) +- __scsi_remove_target(to_scsi_target(dev)); +- return 0; + } + + /** +@@ -1034,14 +1022,34 @@ static int __remove_child (struct device * dev, void * data) + */ + void scsi_remove_target(struct device *dev) + { +- if (scsi_is_target_device(dev)) { +- __scsi_remove_target(to_scsi_target(dev)); +- return; ++ struct Scsi_Host *shost = dev_to_shost(dev->parent); ++ struct scsi_target *starget, *found; ++ unsigned long flags; ++ ++ restart: ++ found = NULL; ++ spin_lock_irqsave(shost->host_lock, flags); ++ list_for_each_entry(starget, &shost->__targets, siblings) { ++ if (starget->state == STARGET_DEL) ++ continue; ++ if (starget->dev.parent == dev || &starget->dev == dev) { ++ found = starget; ++ found->reap_ref++; ++ break; ++ } + } ++ spin_unlock_irqrestore(shost->host_lock, flags); + +- get_device(dev); +- device_for_each_child(dev, NULL, __remove_child); +- put_device(dev); ++ if (found) { ++ __scsi_remove_target(found); ++ scsi_target_reap(found); ++ /* in the case where @dev has multiple starget children, ++ * continue removing. ++ * ++ * FIXME: does such a case exist? ++ */ ++ goto restart; ++ } + } + EXPORT_SYMBOL(scsi_remove_target); + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 0842cc7..2ff1255 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -427,19 +427,8 @@ int iscsit_reset_np_thread( + + int iscsit_del_np_comm(struct iscsi_np *np) + { +- if (!np->np_socket) +- return 0; +- +- /* +- * Some network transports allocate their own struct sock->file, +- * see if we need to free any additional allocated resources. +- */ +- if (np->np_flags & NPF_SCTP_STRUCT_FILE) { +- kfree(np->np_socket->file); +- np->np_socket->file = NULL; +- } +- +- sock_release(np->np_socket); ++ if (np->np_socket) ++ sock_release(np->np_socket); + return 0; + } + +@@ -4105,13 +4094,8 @@ int iscsit_close_connection( + kfree(conn->conn_ops); + conn->conn_ops = NULL; + +- if (conn->sock) { +- if (conn->conn_flags & CONNFLAG_SCTP_STRUCT_FILE) { +- kfree(conn->sock->file); +- conn->sock->file = NULL; +- } ++ if (conn->sock) + sock_release(conn->sock); +- } + conn->thread_set = NULL; + + pr_debug("Moving to TARG_CONN_STATE_FREE.\n"); +diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h +index 7da2d6a..0f68197 100644 +--- a/drivers/target/iscsi/iscsi_target_core.h ++++ b/drivers/target/iscsi/iscsi_target_core.h +@@ -224,7 +224,6 @@ enum iscsi_timer_flags_table { + /* Used for struct iscsi_np->np_flags */ + enum np_flags_table { + NPF_IP_NETWORK = 0x00, +- NPF_SCTP_STRUCT_FILE = 0x01 /* Bugfix */ + }; + + /* Used for struct iscsi_np->np_thread_state */ +@@ -511,7 +510,6 @@ struct iscsi_conn { + u16 local_port; + int net_size; + u32 auth_id; +-#define CONNFLAG_SCTP_STRUCT_FILE 0x01 + u32 conn_flags; + /* Used for iscsi_tx_login_rsp() */ + u32 login_itt; +diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c +index bd2adec..2ec5339 100644 +--- a/drivers/target/iscsi/iscsi_target_login.c ++++ b/drivers/target/iscsi/iscsi_target_login.c +@@ -793,22 +793,6 @@ int iscsi_target_setup_login_socket( + } + np->np_socket = sock; + /* +- * The SCTP stack needs struct socket->file. +- */ +- if ((np->np_network_transport == ISCSI_SCTP_TCP) || +- (np->np_network_transport == ISCSI_SCTP_UDP)) { +- if (!sock->file) { +- sock->file = kzalloc(sizeof(struct file), GFP_KERNEL); +- if (!sock->file) { +- pr_err("Unable to allocate struct" +- " file for SCTP\n"); +- ret = -ENOMEM; +- goto fail; +- } +- np->np_flags |= NPF_SCTP_STRUCT_FILE; +- } +- } +- /* + * Setup the np->np_sockaddr from the passed sockaddr setup + * in iscsi_target_configfs.c code.. + */ +@@ -857,21 +841,15 @@ int iscsi_target_setup_login_socket( + + fail: + np->np_socket = NULL; +- if (sock) { +- if (np->np_flags & NPF_SCTP_STRUCT_FILE) { +- kfree(sock->file); +- sock->file = NULL; +- } +- ++ if (sock) + sock_release(sock); +- } + return ret; + } + + static int __iscsi_target_login_thread(struct iscsi_np *np) + { + u8 buffer[ISCSI_HDR_LEN], iscsi_opcode, zero_tsih = 0; +- int err, ret = 0, ip_proto, sock_type, set_sctp_conn_flag, stop; ++ int err, ret = 0, ip_proto, sock_type, stop; + struct iscsi_conn *conn = NULL; + struct iscsi_login *login; + struct iscsi_portal_group *tpg = NULL; +@@ -882,7 +860,6 @@ static int __iscsi_target_login_thread(struct iscsi_np *np) + struct sockaddr_in6 sock_in6; + + flush_signals(current); +- set_sctp_conn_flag = 0; + sock = np->np_socket; + ip_proto = np->np_ip_proto; + sock_type = np->np_sock_type; +@@ -907,35 +884,12 @@ static int __iscsi_target_login_thread(struct iscsi_np *np) + spin_unlock_bh(&np->np_thread_lock); + goto out; + } +- /* +- * The SCTP stack needs struct socket->file. +- */ +- if ((np->np_network_transport == ISCSI_SCTP_TCP) || +- (np->np_network_transport == ISCSI_SCTP_UDP)) { +- if (!new_sock->file) { +- new_sock->file = kzalloc( +- sizeof(struct file), GFP_KERNEL); +- if (!new_sock->file) { +- pr_err("Unable to allocate struct" +- " file for SCTP\n"); +- sock_release(new_sock); +- /* Get another socket */ +- return 1; +- } +- set_sctp_conn_flag = 1; +- } +- } +- + iscsi_start_login_thread_timer(np); + + conn = kzalloc(sizeof(struct iscsi_conn), GFP_KERNEL); + if (!conn) { + pr_err("Could not allocate memory for" + " new connection\n"); +- if (set_sctp_conn_flag) { +- kfree(new_sock->file); +- new_sock->file = NULL; +- } + sock_release(new_sock); + /* Get another socket */ + return 1; +@@ -945,9 +899,6 @@ static int __iscsi_target_login_thread(struct iscsi_np *np) + conn->conn_state = TARG_CONN_STATE_FREE; + conn->sock = new_sock; + +- if (set_sctp_conn_flag) +- conn->conn_flags |= CONNFLAG_SCTP_STRUCT_FILE; +- + pr_debug("Moving to TARG_CONN_STATE_XPT_UP.\n"); + conn->conn_state = TARG_CONN_STATE_XPT_UP; + +@@ -1195,13 +1146,8 @@ old_sess_out: + iscsi_release_param_list(conn->param_list); + conn->param_list = NULL; + } +- if (conn->sock) { +- if (conn->conn_flags & CONNFLAG_SCTP_STRUCT_FILE) { +- kfree(conn->sock->file); +- conn->sock->file = NULL; +- } ++ if (conn->sock) + sock_release(conn->sock); +- } + kfree(conn); + + if (tpg) { +diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c +index 93b9406..717a8d4 100644 +--- a/drivers/target/target_core_cdb.c ++++ b/drivers/target/target_core_cdb.c +@@ -1114,11 +1114,11 @@ int target_emulate_unmap(struct se_task *task) + struct se_cmd *cmd = task->task_se_cmd; + struct se_device *dev = cmd->se_dev; + unsigned char *buf, *ptr = NULL; +- unsigned char *cdb = &cmd->t_task_cdb[0]; + sector_t lba; +- unsigned int size = cmd->data_length, range; +- int ret = 0, offset; +- unsigned short dl, bd_dl; ++ int size = cmd->data_length; ++ u32 range; ++ int ret = 0; ++ int dl, bd_dl; + + if (!dev->transport->do_discard) { + pr_err("UNMAP emulation not supported for: %s\n", +@@ -1127,24 +1127,41 @@ int target_emulate_unmap(struct se_task *task) + return -ENOSYS; + } + +- /* First UNMAP block descriptor starts at 8 byte offset */ +- offset = 8; +- size -= 8; +- dl = get_unaligned_be16(&cdb[0]); +- bd_dl = get_unaligned_be16(&cdb[2]); +- + buf = transport_kmap_data_sg(cmd); + +- ptr = &buf[offset]; +- pr_debug("UNMAP: Sub: %s Using dl: %hu bd_dl: %hu size: %hu" ++ dl = get_unaligned_be16(&buf[0]); ++ bd_dl = get_unaligned_be16(&buf[2]); ++ ++ size = min(size - 8, bd_dl); ++ if (size / 16 > dev->se_sub_dev->se_dev_attrib.max_unmap_block_desc_count) { ++ cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST; ++ ret = -EINVAL; ++ goto err; ++ } ++ ++ /* First UNMAP block descriptor starts at 8 byte offset */ ++ ptr = &buf[8]; ++ pr_debug("UNMAP: Sub: %s Using dl: %u bd_dl: %u size: %u" + " ptr: %p\n", dev->transport->name, dl, bd_dl, size, ptr); + +- while (size) { ++ while (size >= 16) { + lba = get_unaligned_be64(&ptr[0]); + range = get_unaligned_be32(&ptr[8]); + pr_debug("UNMAP: Using lba: %llu and range: %u\n", + (unsigned long long)lba, range); + ++ if (range > dev->se_sub_dev->se_dev_attrib.max_unmap_lba_count) { ++ cmd->scsi_sense_reason = TCM_INVALID_PARAMETER_LIST; ++ ret = -EINVAL; ++ goto err; ++ } ++ ++ if (lba + range > dev->transport->get_blocks(dev) + 1) { ++ cmd->scsi_sense_reason = TCM_ADDRESS_OUT_OF_RANGE; ++ ret = -EINVAL; ++ goto err; ++ } ++ + ret = dev->transport->do_discard(dev, lba, range); + if (ret < 0) { + pr_err("blkdev_issue_discard() failed: %d\n", +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 5660916..94c03d2 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -1820,6 +1820,7 @@ static void transport_generic_request_failure(struct se_cmd *cmd) + case TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE: + case TCM_UNKNOWN_MODE_PAGE: + case TCM_WRITE_PROTECTED: ++ case TCM_ADDRESS_OUT_OF_RANGE: + case TCM_CHECK_CONDITION_ABORT_CMD: + case TCM_CHECK_CONDITION_UNIT_ATTENTION: + case TCM_CHECK_CONDITION_NOT_READY: +@@ -4496,6 +4497,15 @@ int transport_send_check_condition_and_sense( + /* WRITE PROTECTED */ + buffer[offset+SPC_ASC_KEY_OFFSET] = 0x27; + break; ++ case TCM_ADDRESS_OUT_OF_RANGE: ++ /* CURRENT ERROR */ ++ buffer[offset] = 0x70; ++ buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10; ++ /* ILLEGAL REQUEST */ ++ buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST; ++ /* LOGICAL BLOCK ADDRESS OUT OF RANGE */ ++ buffer[offset+SPC_ASC_KEY_OFFSET] = 0x21; ++ break; + case TCM_CHECK_CONDITION_UNIT_ATTENTION: + /* CURRENT ERROR */ + buffer[offset] = 0x70; +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index f6ff837..a9df218 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1555,10 +1555,14 @@ static int processcompl_compat(struct async *as, void __user * __user *arg) + void __user *addr = as->userurb; + unsigned int i; + +- if (as->userbuffer && urb->actual_length) +- if (copy_to_user(as->userbuffer, urb->transfer_buffer, +- urb->actual_length)) ++ if (as->userbuffer && urb->actual_length) { ++ if (urb->number_of_packets > 0) /* Isochronous */ ++ i = urb->transfer_buffer_length; ++ else /* Non-Isoc */ ++ i = urb->actual_length; ++ if (copy_to_user(as->userbuffer, urb->transfer_buffer, i)) + return -EFAULT; ++ } + if (put_user(as->status, &userurb->status)) + return -EFAULT; + if (put_user(urb->actual_length, &userurb->actual_length)) +diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c +index 29c854b..4e1f0aa 100644 +--- a/drivers/usb/gadget/u_ether.c ++++ b/drivers/usb/gadget/u_ether.c +@@ -796,12 +796,6 @@ int gether_setup(struct usb_gadget *g, u8 ethaddr[ETH_ALEN]) + + SET_ETHTOOL_OPS(net, &ops); + +- /* two kinds of host-initiated state changes: +- * - iff DATA transfer is active, carrier is "on" +- * - tx queueing enabled if open *and* carrier is "on" +- */ +- netif_carrier_off(net); +- + dev->gadget = g; + SET_NETDEV_DEV(net, &g->dev); + SET_NETDEV_DEVTYPE(net, &gadget_type); +@@ -815,6 +809,12 @@ int gether_setup(struct usb_gadget *g, u8 ethaddr[ETH_ALEN]) + INFO(dev, "HOST MAC %pM\n", dev->host_mac); + + the_dev = dev; ++ ++ /* two kinds of host-initiated state changes: ++ * - iff DATA transfer is active, carrier is "on" ++ * - tx queueing enabled if open *and* carrier is "on" ++ */ ++ netif_carrier_off(net); + } + + return status; +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 5971c95..d89aac1 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -932,8 +932,12 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0165, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0167, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0326, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) }, +diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c +index 0b39458..03321e5 100644 +--- a/fs/btrfs/async-thread.c ++++ b/fs/btrfs/async-thread.c +@@ -206,10 +206,17 @@ static noinline int run_ordered_completions(struct btrfs_workers *workers, + + work->ordered_func(work); + +- /* now take the lock again and call the freeing code */ ++ /* now take the lock again and drop our item from the list */ + spin_lock(&workers->order_lock); + list_del(&work->order_list); ++ spin_unlock(&workers->order_lock); ++ ++ /* ++ * we don't want to call the ordered free functions ++ * with the lock held though ++ */ + work->ordered_free(work); ++ spin_lock(&workers->order_lock); + } + + spin_unlock(&workers->order_lock); +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index f44b392..6b2a724 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -872,7 +872,8 @@ static int btree_submit_bio_hook(struct inode *inode, int rw, struct bio *bio, + + #ifdef CONFIG_MIGRATION + static int btree_migratepage(struct address_space *mapping, +- struct page *newpage, struct page *page) ++ struct page *newpage, struct page *page, ++ enum migrate_mode mode) + { + /* + * we can't safely write a btree page from here, +@@ -887,7 +888,7 @@ static int btree_migratepage(struct address_space *mapping, + if (page_has_private(page) && + !try_to_release_page(page, GFP_KERNEL)) + return -EAGAIN; +- return migrate_page(mapping, newpage, page); ++ return migrate_page(mapping, newpage, page, mode); + } + #endif + +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 6aa7457..c858a29 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -89,6 +89,32 @@ static struct { + /* Forward declarations */ + static void cifs_readv_complete(struct work_struct *work); + ++#ifdef CONFIG_HIGHMEM ++/* ++ * On arches that have high memory, kmap address space is limited. By ++ * serializing the kmap operations on those arches, we ensure that we don't ++ * end up with a bunch of threads in writeback with partially mapped page ++ * arrays, stuck waiting for kmap to come back. That situation prevents ++ * progress and can deadlock. ++ */ ++static DEFINE_MUTEX(cifs_kmap_mutex); ++ ++static inline void ++cifs_kmap_lock(void) ++{ ++ mutex_lock(&cifs_kmap_mutex); ++} ++ ++static inline void ++cifs_kmap_unlock(void) ++{ ++ mutex_unlock(&cifs_kmap_mutex); ++} ++#else /* !CONFIG_HIGHMEM */ ++#define cifs_kmap_lock() do { ; } while(0) ++#define cifs_kmap_unlock() do { ; } while(0) ++#endif /* CONFIG_HIGHMEM */ ++ + /* Mark as invalid, all open files on tree connections since they + were closed when session to server was lost */ + static void mark_open_files_invalid(struct cifs_tcon *pTcon) +@@ -1540,6 +1566,7 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid) + eof_index = eof ? (eof - 1) >> PAGE_CACHE_SHIFT : 0; + cFYI(1, "eof=%llu eof_index=%lu", eof, eof_index); + ++ cifs_kmap_lock(); + list_for_each_entry_safe(page, tpage, &rdata->pages, lru) { + if (remaining >= PAGE_CACHE_SIZE) { + /* enough data to fill the page */ +@@ -1589,6 +1616,7 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid) + page_cache_release(page); + } + } ++ cifs_kmap_unlock(); + + /* issue the read if we have any iovecs left to fill */ + if (rdata->nr_iov > 1) { +@@ -2171,6 +2199,7 @@ cifs_async_writev(struct cifs_writedata *wdata) + iov[0].iov_base = smb; + + /* marshal up the pages into iov array */ ++ cifs_kmap_lock(); + wdata->bytes = 0; + for (i = 0; i < wdata->nr_pages; i++) { + iov[i + 1].iov_len = min(inode->i_size - +@@ -2179,6 +2208,7 @@ cifs_async_writev(struct cifs_writedata *wdata) + iov[i + 1].iov_base = kmap(wdata->pages[i]); + wdata->bytes += iov[i + 1].iov_len; + } ++ cifs_kmap_unlock(); + + cFYI(1, "async write at %llu %u bytes", wdata->offset, wdata->bytes); + +diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c +index 914bf9e..d6970f7 100644 +--- a/fs/ext4/balloc.c ++++ b/fs/ext4/balloc.c +@@ -557,7 +557,8 @@ ext4_fsblk_t ext4_count_free_clusters(struct super_block *sb) + if (bitmap_bh == NULL) + continue; + +- x = ext4_count_free(bitmap_bh, sb->s_blocksize); ++ x = ext4_count_free(bitmap_bh->b_data, ++ EXT4_BLOCKS_PER_GROUP(sb) / 8); + printk(KERN_DEBUG "group %u: stored = %d, counted = %u\n", + i, ext4_free_group_clusters(sb, gdp), x); + bitmap_count += x; +diff --git a/fs/ext4/bitmap.c b/fs/ext4/bitmap.c +index fa3af81..bbde5d5 100644 +--- a/fs/ext4/bitmap.c ++++ b/fs/ext4/bitmap.c +@@ -11,21 +11,15 @@ + #include <linux/jbd2.h> + #include "ext4.h" + +-#ifdef EXT4FS_DEBUG +- + static const int nibblemap[] = {4, 3, 3, 2, 3, 2, 2, 1, 3, 2, 2, 1, 2, 1, 1, 0}; + +-unsigned int ext4_count_free(struct buffer_head *map, unsigned int numchars) ++unsigned int ext4_count_free(char *bitmap, unsigned int numchars) + { + unsigned int i, sum = 0; + +- if (!map) +- return 0; + for (i = 0; i < numchars; i++) +- sum += nibblemap[map->b_data[i] & 0xf] + +- nibblemap[(map->b_data[i] >> 4) & 0xf]; ++ sum += nibblemap[bitmap[i] & 0xf] + ++ nibblemap[(bitmap[i] >> 4) & 0xf]; + return sum; + } + +-#endif /* EXT4FS_DEBUG */ +- +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 7b1cd5c..8cb184c 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -1123,8 +1123,7 @@ struct ext4_sb_info { + unsigned long s_desc_per_block; /* Number of group descriptors per block */ + ext4_group_t s_groups_count; /* Number of groups in the fs */ + ext4_group_t s_blockfile_groups;/* Groups acceptable for non-extent files */ +- unsigned long s_overhead_last; /* Last calculated overhead */ +- unsigned long s_blocks_last; /* Last seen block count */ ++ unsigned long s_overhead; /* # of fs overhead clusters */ + unsigned int s_cluster_ratio; /* Number of blocks per cluster */ + unsigned int s_cluster_bits; /* log2 of s_cluster_ratio */ + loff_t s_bitmap_maxbytes; /* max bytes for bitmap files */ +@@ -1757,7 +1756,7 @@ struct mmpd_data { + # define NORET_AND noreturn, + + /* bitmap.c */ +-extern unsigned int ext4_count_free(struct buffer_head *, unsigned); ++extern unsigned int ext4_count_free(char *bitmap, unsigned numchars); + + /* balloc.c */ + extern unsigned int ext4_block_group(struct super_block *sb, +@@ -1925,6 +1924,7 @@ extern int ext4_group_extend(struct super_block *sb, + ext4_fsblk_t n_blocks_count); + + /* super.c */ ++extern int ext4_calculate_overhead(struct super_block *sb); + extern void *ext4_kvmalloc(size_t size, gfp_t flags); + extern void *ext4_kvzalloc(size_t size, gfp_t flags); + extern void ext4_kvfree(void *ptr); +diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c +index 8fb6844..6266799 100644 +--- a/fs/ext4/ialloc.c ++++ b/fs/ext4/ialloc.c +@@ -1057,7 +1057,8 @@ unsigned long ext4_count_free_inodes(struct super_block *sb) + if (!bitmap_bh) + continue; + +- x = ext4_count_free(bitmap_bh, EXT4_INODES_PER_GROUP(sb) / 8); ++ x = ext4_count_free(bitmap_bh->b_data, ++ EXT4_INODES_PER_GROUP(sb) / 8); + printk(KERN_DEBUG "group %lu: stored = %d, counted = %lu\n", + (unsigned long) i, ext4_free_inodes_count(sb, gdp), x); + bitmap_count += x; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 3ce7613..8b01f9f 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -277,6 +277,15 @@ void ext4_da_update_reserve_space(struct inode *inode, + used = ei->i_reserved_data_blocks; + } + ++ if (unlikely(ei->i_allocated_meta_blocks > ei->i_reserved_meta_blocks)) { ++ ext4_msg(inode->i_sb, KERN_NOTICE, "%s: ino %lu, allocated %d " ++ "with only %d reserved metadata blocks\n", __func__, ++ inode->i_ino, ei->i_allocated_meta_blocks, ++ ei->i_reserved_meta_blocks); ++ WARN_ON(1); ++ ei->i_allocated_meta_blocks = ei->i_reserved_meta_blocks; ++ } ++ + /* Update per-inode reservations */ + ei->i_reserved_data_blocks -= used; + ei->i_reserved_meta_blocks -= ei->i_allocated_meta_blocks; +@@ -1102,6 +1111,17 @@ static int ext4_da_reserve_space(struct inode *inode, ext4_lblk_t lblock) + struct ext4_inode_info *ei = EXT4_I(inode); + unsigned int md_needed; + int ret; ++ ext4_lblk_t save_last_lblock; ++ int save_len; ++ ++ /* ++ * We will charge metadata quota at writeout time; this saves ++ * us from metadata over-estimation, though we may go over by ++ * a small amount in the end. Here we just reserve for data. ++ */ ++ ret = dquot_reserve_block(inode, EXT4_C2B(sbi, 1)); ++ if (ret) ++ return ret; + + /* + * recalculate the amount of metadata blocks to reserve +@@ -1110,32 +1130,31 @@ static int ext4_da_reserve_space(struct inode *inode, ext4_lblk_t lblock) + */ + repeat: + spin_lock(&ei->i_block_reservation_lock); ++ /* ++ * ext4_calc_metadata_amount() has side effects, which we have ++ * to be prepared undo if we fail to claim space. ++ */ ++ save_len = ei->i_da_metadata_calc_len; ++ save_last_lblock = ei->i_da_metadata_calc_last_lblock; + md_needed = EXT4_NUM_B2C(sbi, + ext4_calc_metadata_amount(inode, lblock)); + trace_ext4_da_reserve_space(inode, md_needed); +- spin_unlock(&ei->i_block_reservation_lock); + + /* +- * We will charge metadata quota at writeout time; this saves +- * us from metadata over-estimation, though we may go over by +- * a small amount in the end. Here we just reserve for data. +- */ +- ret = dquot_reserve_block(inode, EXT4_C2B(sbi, 1)); +- if (ret) +- return ret; +- /* + * We do still charge estimated metadata to the sb though; + * we cannot afford to run out of free blocks. + */ + if (ext4_claim_free_clusters(sbi, md_needed + 1, 0)) { +- dquot_release_reservation_block(inode, EXT4_C2B(sbi, 1)); ++ ei->i_da_metadata_calc_len = save_len; ++ ei->i_da_metadata_calc_last_lblock = save_last_lblock; ++ spin_unlock(&ei->i_block_reservation_lock); + if (ext4_should_retry_alloc(inode->i_sb, &retries)) { + yield(); + goto repeat; + } ++ dquot_release_reservation_block(inode, EXT4_C2B(sbi, 1)); + return -ENOSPC; + } +- spin_lock(&ei->i_block_reservation_lock); + ei->i_reserved_data_blocks++; + ei->i_reserved_meta_blocks += md_needed; + spin_unlock(&ei->i_block_reservation_lock); +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index 996780a..4eac337 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -952,6 +952,11 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input) + &sbi->s_flex_groups[flex_group].free_inodes); + } + ++ /* ++ * Update the fs overhead information ++ */ ++ ext4_calculate_overhead(sb); ++ + ext4_handle_dirty_super(handle, sb); + + exit_journal: +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index a93486e..a071348 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -3083,6 +3083,114 @@ static void ext4_destroy_lazyinit_thread(void) + kthread_stop(ext4_lazyinit_task); + } + ++/* ++ * Note: calculating the overhead so we can be compatible with ++ * historical BSD practice is quite difficult in the face of ++ * clusters/bigalloc. This is because multiple metadata blocks from ++ * different block group can end up in the same allocation cluster. ++ * Calculating the exact overhead in the face of clustered allocation ++ * requires either O(all block bitmaps) in memory or O(number of block ++ * groups**2) in time. We will still calculate the superblock for ++ * older file systems --- and if we come across with a bigalloc file ++ * system with zero in s_overhead_clusters the estimate will be close to ++ * correct especially for very large cluster sizes --- but for newer ++ * file systems, it's better to calculate this figure once at mkfs ++ * time, and store it in the superblock. If the superblock value is ++ * present (even for non-bigalloc file systems), we will use it. ++ */ ++static int count_overhead(struct super_block *sb, ext4_group_t grp, ++ char *buf) ++{ ++ struct ext4_sb_info *sbi = EXT4_SB(sb); ++ struct ext4_group_desc *gdp; ++ ext4_fsblk_t first_block, last_block, b; ++ ext4_group_t i, ngroups = ext4_get_groups_count(sb); ++ int s, j, count = 0; ++ ++ first_block = le32_to_cpu(sbi->s_es->s_first_data_block) + ++ (grp * EXT4_BLOCKS_PER_GROUP(sb)); ++ last_block = first_block + EXT4_BLOCKS_PER_GROUP(sb) - 1; ++ for (i = 0; i < ngroups; i++) { ++ gdp = ext4_get_group_desc(sb, i, NULL); ++ b = ext4_block_bitmap(sb, gdp); ++ if (b >= first_block && b <= last_block) { ++ ext4_set_bit(EXT4_B2C(sbi, b - first_block), buf); ++ count++; ++ } ++ b = ext4_inode_bitmap(sb, gdp); ++ if (b >= first_block && b <= last_block) { ++ ext4_set_bit(EXT4_B2C(sbi, b - first_block), buf); ++ count++; ++ } ++ b = ext4_inode_table(sb, gdp); ++ if (b >= first_block && b + sbi->s_itb_per_group <= last_block) ++ for (j = 0; j < sbi->s_itb_per_group; j++, b++) { ++ int c = EXT4_B2C(sbi, b - first_block); ++ ext4_set_bit(c, buf); ++ count++; ++ } ++ if (i != grp) ++ continue; ++ s = 0; ++ if (ext4_bg_has_super(sb, grp)) { ++ ext4_set_bit(s++, buf); ++ count++; ++ } ++ for (j = ext4_bg_num_gdb(sb, grp); j > 0; j--) { ++ ext4_set_bit(EXT4_B2C(sbi, s++), buf); ++ count++; ++ } ++ } ++ if (!count) ++ return 0; ++ return EXT4_CLUSTERS_PER_GROUP(sb) - ++ ext4_count_free(buf, EXT4_CLUSTERS_PER_GROUP(sb) / 8); ++} ++ ++/* ++ * Compute the overhead and stash it in sbi->s_overhead ++ */ ++int ext4_calculate_overhead(struct super_block *sb) ++{ ++ struct ext4_sb_info *sbi = EXT4_SB(sb); ++ struct ext4_super_block *es = sbi->s_es; ++ ext4_group_t i, ngroups = ext4_get_groups_count(sb); ++ ext4_fsblk_t overhead = 0; ++ char *buf = (char *) get_zeroed_page(GFP_KERNEL); ++ ++ memset(buf, 0, PAGE_SIZE); ++ if (!buf) ++ return -ENOMEM; ++ ++ /* ++ * Compute the overhead (FS structures). This is constant ++ * for a given filesystem unless the number of block groups ++ * changes so we cache the previous value until it does. ++ */ ++ ++ /* ++ * All of the blocks before first_data_block are overhead ++ */ ++ overhead = EXT4_B2C(sbi, le32_to_cpu(es->s_first_data_block)); ++ ++ /* ++ * Add the overhead found in each block group ++ */ ++ for (i = 0; i < ngroups; i++) { ++ int blks; ++ ++ blks = count_overhead(sb, i, buf); ++ overhead += blks; ++ if (blks) ++ memset(buf, 0, PAGE_SIZE); ++ cond_resched(); ++ } ++ sbi->s_overhead = overhead; ++ smp_wmb(); ++ free_page((unsigned long) buf); ++ return 0; ++} ++ + static int ext4_fill_super(struct super_block *sb, void *data, int silent) + { + char *orig_data = kstrdup(data, GFP_KERNEL); +@@ -3695,6 +3803,18 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + + no_journal: + /* ++ * Get the # of file system overhead blocks from the ++ * superblock if present. ++ */ ++ if (es->s_overhead_clusters) ++ sbi->s_overhead = le32_to_cpu(es->s_overhead_clusters); ++ else { ++ ret = ext4_calculate_overhead(sb); ++ if (ret) ++ goto failed_mount_wq; ++ } ++ ++ /* + * The maximum number of concurrent works can be high and + * concurrency isn't really necessary. Limit it to 1. + */ +@@ -4568,67 +4688,21 @@ restore_opts: + return err; + } + +-/* +- * Note: calculating the overhead so we can be compatible with +- * historical BSD practice is quite difficult in the face of +- * clusters/bigalloc. This is because multiple metadata blocks from +- * different block group can end up in the same allocation cluster. +- * Calculating the exact overhead in the face of clustered allocation +- * requires either O(all block bitmaps) in memory or O(number of block +- * groups**2) in time. We will still calculate the superblock for +- * older file systems --- and if we come across with a bigalloc file +- * system with zero in s_overhead_clusters the estimate will be close to +- * correct especially for very large cluster sizes --- but for newer +- * file systems, it's better to calculate this figure once at mkfs +- * time, and store it in the superblock. If the superblock value is +- * present (even for non-bigalloc file systems), we will use it. +- */ + static int ext4_statfs(struct dentry *dentry, struct kstatfs *buf) + { + struct super_block *sb = dentry->d_sb; + struct ext4_sb_info *sbi = EXT4_SB(sb); + struct ext4_super_block *es = sbi->s_es; +- struct ext4_group_desc *gdp; ++ ext4_fsblk_t overhead = 0; + u64 fsid; + s64 bfree; + +- if (test_opt(sb, MINIX_DF)) { +- sbi->s_overhead_last = 0; +- } else if (es->s_overhead_clusters) { +- sbi->s_overhead_last = le32_to_cpu(es->s_overhead_clusters); +- } else if (sbi->s_blocks_last != ext4_blocks_count(es)) { +- ext4_group_t i, ngroups = ext4_get_groups_count(sb); +- ext4_fsblk_t overhead = 0; +- +- /* +- * Compute the overhead (FS structures). This is constant +- * for a given filesystem unless the number of block groups +- * changes so we cache the previous value until it does. +- */ +- +- /* +- * All of the blocks before first_data_block are +- * overhead +- */ +- overhead = EXT4_B2C(sbi, le32_to_cpu(es->s_first_data_block)); +- +- /* +- * Add the overhead found in each block group +- */ +- for (i = 0; i < ngroups; i++) { +- gdp = ext4_get_group_desc(sb, i, NULL); +- overhead += ext4_num_overhead_clusters(sb, i, gdp); +- cond_resched(); +- } +- sbi->s_overhead_last = overhead; +- smp_wmb(); +- sbi->s_blocks_last = ext4_blocks_count(es); +- } ++ if (!test_opt(sb, MINIX_DF)) ++ overhead = sbi->s_overhead; + + buf->f_type = EXT4_SUPER_MAGIC; + buf->f_bsize = sb->s_blocksize; +- buf->f_blocks = (ext4_blocks_count(es) - +- EXT4_C2B(sbi, sbi->s_overhead_last)); ++ buf->f_blocks = ext4_blocks_count(es) - EXT4_C2B(sbi, sbi->s_overhead); + bfree = percpu_counter_sum_positive(&sbi->s_freeclusters_counter) - + percpu_counter_sum_positive(&sbi->s_dirtyclusters_counter); + /* prevent underflow in case that few free space is available */ +diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c +index ebc2f4d..0aa424a 100644 +--- a/fs/hugetlbfs/inode.c ++++ b/fs/hugetlbfs/inode.c +@@ -569,7 +569,8 @@ static int hugetlbfs_set_page_dirty(struct page *page) + } + + static int hugetlbfs_migrate_page(struct address_space *mapping, +- struct page *newpage, struct page *page) ++ struct page *newpage, struct page *page, ++ enum migrate_mode mode) + { + int rc; + +diff --git a/fs/locks.c b/fs/locks.c +index 6a64f15..fcc50ab 100644 +--- a/fs/locks.c ++++ b/fs/locks.c +@@ -308,7 +308,7 @@ static int flock_make_lock(struct file *filp, struct file_lock **lock, + return 0; + } + +-static int assign_type(struct file_lock *fl, int type) ++static int assign_type(struct file_lock *fl, long type) + { + switch (type) { + case F_RDLCK: +@@ -445,7 +445,7 @@ static const struct lock_manager_operations lease_manager_ops = { + /* + * Initialize a lease, use the default lock manager operations + */ +-static int lease_init(struct file *filp, int type, struct file_lock *fl) ++static int lease_init(struct file *filp, long type, struct file_lock *fl) + { + if (assign_type(fl, type) != 0) + return -EINVAL; +@@ -463,7 +463,7 @@ static int lease_init(struct file *filp, int type, struct file_lock *fl) + } + + /* Allocate a file_lock initialised to this type of lease */ +-static struct file_lock *lease_alloc(struct file *filp, int type) ++static struct file_lock *lease_alloc(struct file *filp, long type) + { + struct file_lock *fl = locks_alloc_lock(); + int error = -ENOMEM; +diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h +index 3f4d957..68b3f20 100644 +--- a/fs/nfs/internal.h ++++ b/fs/nfs/internal.h +@@ -330,7 +330,7 @@ void nfs_commit_release_pages(struct nfs_write_data *data); + + #ifdef CONFIG_MIGRATION + extern int nfs_migrate_page(struct address_space *, +- struct page *, struct page *); ++ struct page *, struct page *, enum migrate_mode); + #else + #define nfs_migrate_page NULL + #endif +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index 4efd421..c6e523a 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -1711,7 +1711,7 @@ out_error: + + #ifdef CONFIG_MIGRATION + int nfs_migrate_page(struct address_space *mapping, struct page *newpage, +- struct page *page) ++ struct page *page, enum migrate_mode mode) + { + /* + * If PagePrivate is set, then the page is currently associated with +@@ -1726,7 +1726,7 @@ int nfs_migrate_page(struct address_space *mapping, struct page *newpage, + + nfs_fscache_release_page(page, GFP_KERNEL); + +- return migrate_page(mapping, newpage, page); ++ return migrate_page(mapping, newpage, page, mode); + } + #endif + +diff --git a/fs/udf/super.c b/fs/udf/super.c +index 270e135..516b7f0 100644 +--- a/fs/udf/super.c ++++ b/fs/udf/super.c +@@ -1285,7 +1285,7 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block, + BUG_ON(ident != TAG_IDENT_LVD); + lvd = (struct logicalVolDesc *)bh->b_data; + table_len = le32_to_cpu(lvd->mapTableLength); +- if (sizeof(*lvd) + table_len > sb->s_blocksize) { ++ if (table_len > sb->s_blocksize - sizeof(*lvd)) { + udf_err(sb, "error loading logical volume descriptor: " + "Partition table too long (%u > %lu)\n", table_len, + sb->s_blocksize - sizeof(*lvd)); +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index 0ed1eb0..ff039f0 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -481,6 +481,7 @@ static inline void queue_flag_clear(unsigned int flag, struct request_queue *q) + + #define blk_queue_tagged(q) test_bit(QUEUE_FLAG_QUEUED, &(q)->queue_flags) + #define blk_queue_stopped(q) test_bit(QUEUE_FLAG_STOPPED, &(q)->queue_flags) ++#define blk_queue_dead(q) test_bit(QUEUE_FLAG_DEAD, &(q)->queue_flags) + #define blk_queue_nomerges(q) test_bit(QUEUE_FLAG_NOMERGES, &(q)->queue_flags) + #define blk_queue_noxmerges(q) \ + test_bit(QUEUE_FLAG_NOXMERGES, &(q)->queue_flags) +diff --git a/include/linux/cpu.h b/include/linux/cpu.h +index 6cb60fd..c692acc 100644 +--- a/include/linux/cpu.h ++++ b/include/linux/cpu.h +@@ -66,8 +66,9 @@ enum { + /* migration should happen before other stuff but after perf */ + CPU_PRI_PERF = 20, + CPU_PRI_MIGRATION = 10, +- /* prepare workqueues for other notifiers */ +- CPU_PRI_WORKQUEUE = 5, ++ /* bring up workqueues before normal notifiers and down after */ ++ CPU_PRI_WORKQUEUE_UP = 5, ++ CPU_PRI_WORKQUEUE_DOWN = -5, + }; + + #define CPU_ONLINE 0x0002 /* CPU (unsigned)v is up */ +diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h +index e9eaec5..7a7e5fd 100644 +--- a/include/linux/cpuset.h ++++ b/include/linux/cpuset.h +@@ -89,42 +89,33 @@ extern void rebuild_sched_domains(void); + extern void cpuset_print_task_mems_allowed(struct task_struct *p); + + /* +- * reading current mems_allowed and mempolicy in the fastpath must protected +- * by get_mems_allowed() ++ * get_mems_allowed is required when making decisions involving mems_allowed ++ * such as during page allocation. mems_allowed can be updated in parallel ++ * and depending on the new value an operation can fail potentially causing ++ * process failure. A retry loop with get_mems_allowed and put_mems_allowed ++ * prevents these artificial failures. + */ +-static inline void get_mems_allowed(void) ++static inline unsigned int get_mems_allowed(void) + { +- current->mems_allowed_change_disable++; +- +- /* +- * ensure that reading mems_allowed and mempolicy happens after the +- * update of ->mems_allowed_change_disable. +- * +- * the write-side task finds ->mems_allowed_change_disable is not 0, +- * and knows the read-side task is reading mems_allowed or mempolicy, +- * so it will clear old bits lazily. +- */ +- smp_mb(); ++ return read_seqcount_begin(¤t->mems_allowed_seq); + } + +-static inline void put_mems_allowed(void) ++/* ++ * If this returns false, the operation that took place after get_mems_allowed ++ * may have failed. It is up to the caller to retry the operation if ++ * appropriate. ++ */ ++static inline bool put_mems_allowed(unsigned int seq) + { +- /* +- * ensure that reading mems_allowed and mempolicy before reducing +- * mems_allowed_change_disable. +- * +- * the write-side task will know that the read-side task is still +- * reading mems_allowed or mempolicy, don't clears old bits in the +- * nodemask. +- */ +- smp_mb(); +- --ACCESS_ONCE(current->mems_allowed_change_disable); ++ return !read_seqcount_retry(¤t->mems_allowed_seq, seq); + } + + static inline void set_mems_allowed(nodemask_t nodemask) + { + task_lock(current); ++ write_seqcount_begin(¤t->mems_allowed_seq); + current->mems_allowed = nodemask; ++ write_seqcount_end(¤t->mems_allowed_seq); + task_unlock(current); + } + +@@ -234,12 +225,14 @@ static inline void set_mems_allowed(nodemask_t nodemask) + { + } + +-static inline void get_mems_allowed(void) ++static inline unsigned int get_mems_allowed(void) + { ++ return 0; + } + +-static inline void put_mems_allowed(void) ++static inline bool put_mems_allowed(unsigned int seq) + { ++ return true; + } + + #endif /* !CONFIG_CPUSETS */ +diff --git a/include/linux/fs.h b/include/linux/fs.h +index 43d36b7..29b6353 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -525,6 +525,7 @@ enum positive_aop_returns { + struct page; + struct address_space; + struct writeback_control; ++enum migrate_mode; + + struct iov_iter { + const struct iovec *iov; +@@ -609,9 +610,12 @@ struct address_space_operations { + loff_t offset, unsigned long nr_segs); + int (*get_xip_mem)(struct address_space *, pgoff_t, int, + void **, unsigned long *); +- /* migrate the contents of a page to the specified target */ ++ /* ++ * migrate the contents of a page to the specified target. If sync ++ * is false, it must not block. ++ */ + int (*migratepage) (struct address_space *, +- struct page *, struct page *); ++ struct page *, struct page *, enum migrate_mode); + int (*launder_page) (struct page *); + int (*is_partially_uptodate) (struct page *, read_descriptor_t *, + unsigned long); +@@ -2586,7 +2590,8 @@ extern int generic_check_addressable(unsigned, u64); + + #ifdef CONFIG_MIGRATION + extern int buffer_migrate_page(struct address_space *, +- struct page *, struct page *); ++ struct page *, struct page *, ++ enum migrate_mode); + #else + #define buffer_migrate_page NULL + #endif +diff --git a/include/linux/init_task.h b/include/linux/init_task.h +index 32574ee..df53fdf 100644 +--- a/include/linux/init_task.h ++++ b/include/linux/init_task.h +@@ -30,6 +30,13 @@ extern struct fs_struct init_fs; + #define INIT_THREADGROUP_FORK_LOCK(sig) + #endif + ++#ifdef CONFIG_CPUSETS ++#define INIT_CPUSET_SEQ \ ++ .mems_allowed_seq = SEQCNT_ZERO, ++#else ++#define INIT_CPUSET_SEQ ++#endif ++ + #define INIT_SIGNALS(sig) { \ + .nr_threads = 1, \ + .wait_chldexit = __WAIT_QUEUE_HEAD_INITIALIZER(sig.wait_chldexit),\ +@@ -193,6 +200,7 @@ extern struct cred init_cred; + INIT_FTRACE_GRAPH \ + INIT_TRACE_RECURSION \ + INIT_TASK_RCU_PREEMPT(tsk) \ ++ INIT_CPUSET_SEQ \ + } + + +diff --git a/include/linux/migrate.h b/include/linux/migrate.h +index e39aeec..eaf8674 100644 +--- a/include/linux/migrate.h ++++ b/include/linux/migrate.h +@@ -6,18 +6,31 @@ + + typedef struct page *new_page_t(struct page *, unsigned long private, int **); + ++/* ++ * MIGRATE_ASYNC means never block ++ * MIGRATE_SYNC_LIGHT in the current implementation means to allow blocking ++ * on most operations but not ->writepage as the potential stall time ++ * is too significant ++ * MIGRATE_SYNC will block when migrating pages ++ */ ++enum migrate_mode { ++ MIGRATE_ASYNC, ++ MIGRATE_SYNC_LIGHT, ++ MIGRATE_SYNC, ++}; ++ + #ifdef CONFIG_MIGRATION + #define PAGE_MIGRATION 1 + + extern void putback_lru_pages(struct list_head *l); + extern int migrate_page(struct address_space *, +- struct page *, struct page *); ++ struct page *, struct page *, enum migrate_mode); + extern int migrate_pages(struct list_head *l, new_page_t x, + unsigned long private, bool offlining, +- bool sync); ++ enum migrate_mode mode); + extern int migrate_huge_pages(struct list_head *l, new_page_t x, + unsigned long private, bool offlining, +- bool sync); ++ enum migrate_mode mode); + + extern int fail_migrate_page(struct address_space *, + struct page *, struct page *); +@@ -36,10 +49,10 @@ extern int migrate_huge_page_move_mapping(struct address_space *mapping, + static inline void putback_lru_pages(struct list_head *l) {} + static inline int migrate_pages(struct list_head *l, new_page_t x, + unsigned long private, bool offlining, +- bool sync) { return -ENOSYS; } ++ enum migrate_mode mode) { return -ENOSYS; } + static inline int migrate_huge_pages(struct list_head *l, new_page_t x, + unsigned long private, bool offlining, +- bool sync) { return -ENOSYS; } ++ enum migrate_mode mode) { return -ENOSYS; } + + static inline int migrate_prep(void) { return -ENOSYS; } + static inline int migrate_prep_local(void) { return -ENOSYS; } +diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h +index 905b1e1..25842b6 100644 +--- a/include/linux/mmzone.h ++++ b/include/linux/mmzone.h +@@ -173,6 +173,8 @@ static inline int is_unevictable_lru(enum lru_list l) + #define ISOLATE_CLEAN ((__force isolate_mode_t)0x4) + /* Isolate unmapped file */ + #define ISOLATE_UNMAPPED ((__force isolate_mode_t)0x8) ++/* Isolate for asynchronous migration */ ++#define ISOLATE_ASYNC_MIGRATE ((__force isolate_mode_t)0x10) + + /* LRU Isolation modes. */ + typedef unsigned __bitwise__ isolate_mode_t; +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 5afa2a3..d336c35 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -145,6 +145,7 @@ extern unsigned long this_cpu_load(void); + + + extern void calc_global_load(unsigned long ticks); ++extern void update_cpu_load_nohz(void); + + extern unsigned long get_parent_ip(unsigned long addr); + +@@ -1481,7 +1482,7 @@ struct task_struct { + #endif + #ifdef CONFIG_CPUSETS + nodemask_t mems_allowed; /* Protected by alloc_lock */ +- int mems_allowed_change_disable; ++ seqcount_t mems_allowed_seq; /* Seqence no to catch updates */ + int cpuset_mem_spread_rotor; + int cpuset_slab_spread_rotor; + #endif +diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h +index 94bbec3..6ee550e 100644 +--- a/include/target/target_core_base.h ++++ b/include/target/target_core_base.h +@@ -157,6 +157,7 @@ enum tcm_sense_reason_table { + TCM_CHECK_CONDITION_UNIT_ATTENTION = 0x0e, + TCM_CHECK_CONDITION_NOT_READY = 0x0f, + TCM_RESERVATION_CONFLICT = 0x10, ++ TCM_ADDRESS_OUT_OF_RANGE = 0x11, + }; + + struct se_obj { +diff --git a/kernel/cpuset.c b/kernel/cpuset.c +index 0b1712d..46a1d3c 100644 +--- a/kernel/cpuset.c ++++ b/kernel/cpuset.c +@@ -964,7 +964,6 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk, + { + bool need_loop; + +-repeat: + /* + * Allow tasks that have access to memory reserves because they have + * been OOM killed to get memory anywhere. +@@ -983,45 +982,19 @@ repeat: + */ + need_loop = task_has_mempolicy(tsk) || + !nodes_intersects(*newmems, tsk->mems_allowed); +- nodes_or(tsk->mems_allowed, tsk->mems_allowed, *newmems); +- mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP1); + +- /* +- * ensure checking ->mems_allowed_change_disable after setting all new +- * allowed nodes. +- * +- * the read-side task can see an nodemask with new allowed nodes and +- * old allowed nodes. and if it allocates page when cpuset clears newly +- * disallowed ones continuous, it can see the new allowed bits. +- * +- * And if setting all new allowed nodes is after the checking, setting +- * all new allowed nodes and clearing newly disallowed ones will be done +- * continuous, and the read-side task may find no node to alloc page. +- */ +- smp_mb(); ++ if (need_loop) ++ write_seqcount_begin(&tsk->mems_allowed_seq); + +- /* +- * Allocation of memory is very fast, we needn't sleep when waiting +- * for the read-side. +- */ +- while (need_loop && ACCESS_ONCE(tsk->mems_allowed_change_disable)) { +- task_unlock(tsk); +- if (!task_curr(tsk)) +- yield(); +- goto repeat; +- } +- +- /* +- * ensure checking ->mems_allowed_change_disable before clearing all new +- * disallowed nodes. +- * +- * if clearing newly disallowed bits before the checking, the read-side +- * task may find no node to alloc page. +- */ +- smp_mb(); ++ nodes_or(tsk->mems_allowed, tsk->mems_allowed, *newmems); ++ mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP1); + + mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP2); + tsk->mems_allowed = *newmems; ++ ++ if (need_loop) ++ write_seqcount_end(&tsk->mems_allowed_seq); ++ + task_unlock(tsk); + } + +diff --git a/kernel/fork.c b/kernel/fork.c +index 79ee71f..222457a 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -979,6 +979,9 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk) + #ifdef CONFIG_CGROUPS + init_rwsem(&sig->threadgroup_fork_lock); + #endif ++#ifdef CONFIG_CPUSETS ++ seqcount_init(&tsk->mems_allowed_seq); ++#endif + + sig->oom_adj = current->signal->oom_adj; + sig->oom_score_adj = current->signal->oom_score_adj; +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index 7c0d578..013bd2e 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -367,6 +367,7 @@ int hibernation_snapshot(int platform_mode) + } + + suspend_console(); ++ ftrace_stop(); + pm_restrict_gfp_mask(); + error = dpm_suspend(PMSG_FREEZE); + if (error) +@@ -392,6 +393,7 @@ int hibernation_snapshot(int platform_mode) + if (error || !in_suspend) + pm_restore_gfp_mask(); + ++ ftrace_start(); + resume_console(); + dpm_complete(msg); + +@@ -496,6 +498,7 @@ int hibernation_restore(int platform_mode) + + pm_prepare_console(); + suspend_console(); ++ ftrace_stop(); + pm_restrict_gfp_mask(); + error = dpm_suspend_start(PMSG_QUIESCE); + if (!error) { +@@ -503,6 +506,7 @@ int hibernation_restore(int platform_mode) + dpm_resume_end(PMSG_RECOVER); + } + pm_restore_gfp_mask(); ++ ftrace_start(); + resume_console(); + pm_restore_console(); + return error; +@@ -529,6 +533,7 @@ int hibernation_platform_enter(void) + + entering_platform_hibernation = true; + suspend_console(); ++ ftrace_stop(); + error = dpm_suspend_start(PMSG_HIBERNATE); + if (error) { + if (hibernation_ops->recover) +@@ -572,6 +577,7 @@ int hibernation_platform_enter(void) + Resume_devices: + entering_platform_hibernation = false; + dpm_resume_end(PMSG_RESTORE); ++ ftrace_start(); + resume_console(); + + Close: +diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c +index 4953dc0..af48faa 100644 +--- a/kernel/power/suspend.c ++++ b/kernel/power/suspend.c +@@ -25,6 +25,7 @@ + #include <linux/export.h> + #include <linux/suspend.h> + #include <linux/syscore_ops.h> ++#include <linux/ftrace.h> + #include <trace/events/power.h> + + #include "power.h" +@@ -220,6 +221,7 @@ int suspend_devices_and_enter(suspend_state_t state) + goto Close; + } + suspend_console(); ++ ftrace_stop(); + suspend_test_start(); + error = dpm_suspend_start(PMSG_SUSPEND); + if (error) { +@@ -239,6 +241,7 @@ int suspend_devices_and_enter(suspend_state_t state) + suspend_test_start(); + dpm_resume_end(PMSG_RESUME); + suspend_test_finish("resume devices"); ++ ftrace_start(); + resume_console(); + Close: + if (suspend_ops->end) +diff --git a/kernel/sched.c b/kernel/sched.c +index 52ac69b..9cd8ca7 100644 +--- a/kernel/sched.c ++++ b/kernel/sched.c +@@ -1887,7 +1887,7 @@ static void double_rq_unlock(struct rq *rq1, struct rq *rq2) + + static void update_sysctl(void); + static int get_update_sysctl_factor(void); +-static void update_cpu_load(struct rq *this_rq); ++static void update_idle_cpu_load(struct rq *this_rq); + + static inline void __set_task_cpu(struct task_struct *p, unsigned int cpu) + { +@@ -3855,22 +3855,13 @@ decay_load_missed(unsigned long load, unsigned long missed_updates, int idx) + * scheduler tick (TICK_NSEC). With tickless idle this will not be called + * every tick. We fix it up based on jiffies. + */ +-static void update_cpu_load(struct rq *this_rq) ++static void __update_cpu_load(struct rq *this_rq, unsigned long this_load, ++ unsigned long pending_updates) + { +- unsigned long this_load = this_rq->load.weight; +- unsigned long curr_jiffies = jiffies; +- unsigned long pending_updates; + int i, scale; + + this_rq->nr_load_updates++; + +- /* Avoid repeated calls on same jiffy, when moving in and out of idle */ +- if (curr_jiffies == this_rq->last_load_update_tick) +- return; +- +- pending_updates = curr_jiffies - this_rq->last_load_update_tick; +- this_rq->last_load_update_tick = curr_jiffies; +- + /* Update our load: */ + this_rq->cpu_load[0] = this_load; /* Fasttrack for idx 0 */ + for (i = 1, scale = 2; i < CPU_LOAD_IDX_MAX; i++, scale += scale) { +@@ -3895,9 +3886,78 @@ static void update_cpu_load(struct rq *this_rq) + sched_avg_update(this_rq); + } + ++#ifdef CONFIG_NO_HZ ++/* ++ * There is no sane way to deal with nohz on smp when using jiffies because the ++ * cpu doing the jiffies update might drift wrt the cpu doing the jiffy reading ++ * causing off-by-one errors in observed deltas; {0,2} instead of {1,1}. ++ * ++ * Therefore we cannot use the delta approach from the regular tick since that ++ * would seriously skew the load calculation. However we'll make do for those ++ * updates happening while idle (nohz_idle_balance) or coming out of idle ++ * (tick_nohz_idle_exit). ++ * ++ * This means we might still be one tick off for nohz periods. ++ */ ++ ++/* ++ * Called from nohz_idle_balance() to update the load ratings before doing the ++ * idle balance. ++ */ ++static void update_idle_cpu_load(struct rq *this_rq) ++{ ++ unsigned long curr_jiffies = ACCESS_ONCE(jiffies); ++ unsigned long load = this_rq->load.weight; ++ unsigned long pending_updates; ++ ++ /* ++ * bail if there's load or we're actually up-to-date. ++ */ ++ if (load || curr_jiffies == this_rq->last_load_update_tick) ++ return; ++ ++ pending_updates = curr_jiffies - this_rq->last_load_update_tick; ++ this_rq->last_load_update_tick = curr_jiffies; ++ ++ __update_cpu_load(this_rq, load, pending_updates); ++} ++ ++/* ++ * Called from tick_nohz_idle_exit() -- try and fix up the ticks we missed. ++ */ ++void update_cpu_load_nohz(void) ++{ ++ struct rq *this_rq = this_rq(); ++ unsigned long curr_jiffies = ACCESS_ONCE(jiffies); ++ unsigned long pending_updates; ++ ++ if (curr_jiffies == this_rq->last_load_update_tick) ++ return; ++ ++ raw_spin_lock(&this_rq->lock); ++ pending_updates = curr_jiffies - this_rq->last_load_update_tick; ++ if (pending_updates) { ++ this_rq->last_load_update_tick = curr_jiffies; ++ /* ++ * We were idle, this means load 0, the current load might be ++ * !0 due to remote wakeups and the sort. ++ */ ++ __update_cpu_load(this_rq, 0, pending_updates); ++ } ++ raw_spin_unlock(&this_rq->lock); ++} ++#endif /* CONFIG_NO_HZ */ ++ ++/* ++ * Called from scheduler_tick() ++ */ + static void update_cpu_load_active(struct rq *this_rq) + { +- update_cpu_load(this_rq); ++ /* ++ * See the mess around update_idle_cpu_load() / update_cpu_load_nohz(). ++ */ ++ this_rq->last_load_update_tick = jiffies; ++ __update_cpu_load(this_rq, this_rq->load.weight, 1); + + calc_load_account_active(this_rq); + } +diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c +index 8a39fa3..66e4576 100644 +--- a/kernel/sched_fair.c ++++ b/kernel/sched_fair.c +@@ -4735,7 +4735,7 @@ static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle) + + raw_spin_lock_irq(&this_rq->lock); + update_rq_clock(this_rq); +- update_cpu_load(this_rq); ++ update_idle_cpu_load(this_rq); + raw_spin_unlock_irq(&this_rq->lock); + + rebalance_domains(balance_cpu, CPU_IDLE); +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index 9955ebd..793548c 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -549,6 +549,7 @@ void tick_nohz_restart_sched_tick(void) + /* Update jiffies first */ + select_nohz_load_balancer(0); + tick_do_update_jiffies64(now); ++ update_cpu_load_nohz(); + + #ifndef CONFIG_VIRT_CPU_ACCOUNTING + /* +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 7947e16..a650bee 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -3586,6 +3586,41 @@ static int __devinit workqueue_cpu_callback(struct notifier_block *nfb, + return notifier_from_errno(0); + } + ++/* ++ * Workqueues should be brought up before normal priority CPU notifiers. ++ * This will be registered high priority CPU notifier. ++ */ ++static int __devinit workqueue_cpu_up_callback(struct notifier_block *nfb, ++ unsigned long action, ++ void *hcpu) ++{ ++ switch (action & ~CPU_TASKS_FROZEN) { ++ case CPU_UP_PREPARE: ++ case CPU_UP_CANCELED: ++ case CPU_DOWN_FAILED: ++ case CPU_ONLINE: ++ return workqueue_cpu_callback(nfb, action, hcpu); ++ } ++ return NOTIFY_OK; ++} ++ ++/* ++ * Workqueues should be brought down after normal priority CPU notifiers. ++ * This will be registered as low priority CPU notifier. ++ */ ++static int __devinit workqueue_cpu_down_callback(struct notifier_block *nfb, ++ unsigned long action, ++ void *hcpu) ++{ ++ switch (action & ~CPU_TASKS_FROZEN) { ++ case CPU_DOWN_PREPARE: ++ case CPU_DYING: ++ case CPU_POST_DEAD: ++ return workqueue_cpu_callback(nfb, action, hcpu); ++ } ++ return NOTIFY_OK; ++} ++ + #ifdef CONFIG_SMP + + struct work_for_cpu { +@@ -3779,7 +3814,8 @@ static int __init init_workqueues(void) + unsigned int cpu; + int i; + +- cpu_notifier(workqueue_cpu_callback, CPU_PRI_WORKQUEUE); ++ cpu_notifier(workqueue_cpu_up_callback, CPU_PRI_WORKQUEUE_UP); ++ cpu_notifier(workqueue_cpu_down_callback, CPU_PRI_WORKQUEUE_DOWN); + + /* initialize gcwqs */ + for_each_gcwq_cpu(cpu) { +diff --git a/mm/compaction.c b/mm/compaction.c +index 50f1c60..46973fb 100644 +--- a/mm/compaction.c ++++ b/mm/compaction.c +@@ -372,7 +372,7 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone, + } + + if (!cc->sync) +- mode |= ISOLATE_CLEAN; ++ mode |= ISOLATE_ASYNC_MIGRATE; + + /* Try isolate the page */ + if (__isolate_lru_page(page, mode, 0) != 0) +@@ -577,7 +577,7 @@ static int compact_zone(struct zone *zone, struct compact_control *cc) + nr_migrate = cc->nr_migratepages; + err = migrate_pages(&cc->migratepages, compaction_alloc, + (unsigned long)cc, false, +- cc->sync); ++ cc->sync ? MIGRATE_SYNC_LIGHT : MIGRATE_ASYNC); + update_nr_listpages(cc); + nr_remaining = cc->nr_migratepages; + +diff --git a/mm/filemap.c b/mm/filemap.c +index 03c5b0e..556858c 100644 +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -500,10 +500,13 @@ struct page *__page_cache_alloc(gfp_t gfp) + struct page *page; + + if (cpuset_do_page_mem_spread()) { +- get_mems_allowed(); +- n = cpuset_mem_spread_node(); +- page = alloc_pages_exact_node(n, gfp, 0); +- put_mems_allowed(); ++ unsigned int cpuset_mems_cookie; ++ do { ++ cpuset_mems_cookie = get_mems_allowed(); ++ n = cpuset_mem_spread_node(); ++ page = alloc_pages_exact_node(n, gfp, 0); ++ } while (!put_mems_allowed(cpuset_mems_cookie) && !page); ++ + return page; + } + return alloc_pages(gfp, 0); +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 7c535b0..b1e1bad 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -538,8 +538,10 @@ static struct page *dequeue_huge_page_vma(struct hstate *h, + struct zonelist *zonelist; + struct zone *zone; + struct zoneref *z; ++ unsigned int cpuset_mems_cookie; + +- get_mems_allowed(); ++retry_cpuset: ++ cpuset_mems_cookie = get_mems_allowed(); + zonelist = huge_zonelist(vma, address, + htlb_alloc_mask, &mpol, &nodemask); + /* +@@ -566,10 +568,15 @@ static struct page *dequeue_huge_page_vma(struct hstate *h, + } + } + } +-err: ++ + mpol_cond_put(mpol); +- put_mems_allowed(); ++ if (unlikely(!put_mems_allowed(cpuset_mems_cookie) && !page)) ++ goto retry_cpuset; + return page; ++ ++err: ++ mpol_cond_put(mpol); ++ return NULL; + } + + static void update_and_free_page(struct hstate *h, struct page *page) +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index 06d3479..5bd5bb1 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1427,8 +1427,8 @@ static int soft_offline_huge_page(struct page *page, int flags) + /* Keep page count to indicate a given hugepage is isolated. */ + + list_add(&hpage->lru, &pagelist); +- ret = migrate_huge_pages(&pagelist, new_page, MPOL_MF_MOVE_ALL, 0, +- true); ++ ret = migrate_huge_pages(&pagelist, new_page, MPOL_MF_MOVE_ALL, false, ++ MIGRATE_SYNC); + if (ret) { + struct page *page1, *page2; + list_for_each_entry_safe(page1, page2, &pagelist, lru) +@@ -1557,7 +1557,7 @@ int soft_offline_page(struct page *page, int flags) + page_is_file_cache(page)); + list_add(&page->lru, &pagelist); + ret = migrate_pages(&pagelist, new_page, MPOL_MF_MOVE_ALL, +- 0, true); ++ false, MIGRATE_SYNC); + if (ret) { + putback_lru_pages(&pagelist); + pr_info("soft offline: %#lx: migration failed %d, type %lx\n", +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c +index 2168489..6629faf 100644 +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -809,7 +809,7 @@ do_migrate_range(unsigned long start_pfn, unsigned long end_pfn) + } + /* this function returns # of failed pages */ + ret = migrate_pages(&source, hotremove_migrate_alloc, 0, +- true, true); ++ true, MIGRATE_SYNC); + if (ret) + putback_lru_pages(&source); + } +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index b26aae2..c0007f9 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -942,7 +942,7 @@ static int migrate_to_node(struct mm_struct *mm, int source, int dest, + + if (!list_empty(&pagelist)) { + err = migrate_pages(&pagelist, new_node_page, dest, +- false, true); ++ false, MIGRATE_SYNC); + if (err) + putback_lru_pages(&pagelist); + } +@@ -1843,18 +1843,24 @@ struct page * + alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma, + unsigned long addr, int node) + { +- struct mempolicy *pol = get_vma_policy(current, vma, addr); ++ struct mempolicy *pol; + struct zonelist *zl; + struct page *page; ++ unsigned int cpuset_mems_cookie; ++ ++retry_cpuset: ++ pol = get_vma_policy(current, vma, addr); ++ cpuset_mems_cookie = get_mems_allowed(); + +- get_mems_allowed(); + if (unlikely(pol->mode == MPOL_INTERLEAVE)) { + unsigned nid; + + nid = interleave_nid(pol, vma, addr, PAGE_SHIFT + order); + mpol_cond_put(pol); + page = alloc_page_interleave(gfp, order, nid); +- put_mems_allowed(); ++ if (unlikely(!put_mems_allowed(cpuset_mems_cookie) && !page)) ++ goto retry_cpuset; ++ + return page; + } + zl = policy_zonelist(gfp, pol, node); +@@ -1865,7 +1871,8 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma, + struct page *page = __alloc_pages_nodemask(gfp, order, + zl, policy_nodemask(gfp, pol)); + __mpol_put(pol); +- put_mems_allowed(); ++ if (unlikely(!put_mems_allowed(cpuset_mems_cookie) && !page)) ++ goto retry_cpuset; + return page; + } + /* +@@ -1873,7 +1880,8 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma, + */ + page = __alloc_pages_nodemask(gfp, order, zl, + policy_nodemask(gfp, pol)); +- put_mems_allowed(); ++ if (unlikely(!put_mems_allowed(cpuset_mems_cookie) && !page)) ++ goto retry_cpuset; + return page; + } + +@@ -1900,11 +1908,14 @@ struct page *alloc_pages_current(gfp_t gfp, unsigned order) + { + struct mempolicy *pol = current->mempolicy; + struct page *page; ++ unsigned int cpuset_mems_cookie; + + if (!pol || in_interrupt() || (gfp & __GFP_THISNODE)) + pol = &default_policy; + +- get_mems_allowed(); ++retry_cpuset: ++ cpuset_mems_cookie = get_mems_allowed(); ++ + /* + * No reference counting needed for current->mempolicy + * nor system default_policy +@@ -1915,7 +1926,10 @@ struct page *alloc_pages_current(gfp_t gfp, unsigned order) + page = __alloc_pages_nodemask(gfp, order, + policy_zonelist(gfp, pol, numa_node_id()), + policy_nodemask(gfp, pol)); +- put_mems_allowed(); ++ ++ if (unlikely(!put_mems_allowed(cpuset_mems_cookie) && !page)) ++ goto retry_cpuset; ++ + return page; + } + EXPORT_SYMBOL(alloc_pages_current); +diff --git a/mm/migrate.c b/mm/migrate.c +index 177aca4..180d97f 100644 +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -220,6 +220,56 @@ out: + pte_unmap_unlock(ptep, ptl); + } + ++#ifdef CONFIG_BLOCK ++/* Returns true if all buffers are successfully locked */ ++static bool buffer_migrate_lock_buffers(struct buffer_head *head, ++ enum migrate_mode mode) ++{ ++ struct buffer_head *bh = head; ++ ++ /* Simple case, sync compaction */ ++ if (mode != MIGRATE_ASYNC) { ++ do { ++ get_bh(bh); ++ lock_buffer(bh); ++ bh = bh->b_this_page; ++ ++ } while (bh != head); ++ ++ return true; ++ } ++ ++ /* async case, we cannot block on lock_buffer so use trylock_buffer */ ++ do { ++ get_bh(bh); ++ if (!trylock_buffer(bh)) { ++ /* ++ * We failed to lock the buffer and cannot stall in ++ * async migration. Release the taken locks ++ */ ++ struct buffer_head *failed_bh = bh; ++ put_bh(failed_bh); ++ bh = head; ++ while (bh != failed_bh) { ++ unlock_buffer(bh); ++ put_bh(bh); ++ bh = bh->b_this_page; ++ } ++ return false; ++ } ++ ++ bh = bh->b_this_page; ++ } while (bh != head); ++ return true; ++} ++#else ++static inline bool buffer_migrate_lock_buffers(struct buffer_head *head, ++ enum migrate_mode mode) ++{ ++ return true; ++} ++#endif /* CONFIG_BLOCK */ ++ + /* + * Replace the page in the mapping. + * +@@ -229,7 +279,8 @@ out: + * 3 for pages with a mapping and PagePrivate/PagePrivate2 set. + */ + static int migrate_page_move_mapping(struct address_space *mapping, +- struct page *newpage, struct page *page) ++ struct page *newpage, struct page *page, ++ struct buffer_head *head, enum migrate_mode mode) + { + int expected_count; + void **pslot; +@@ -259,6 +310,20 @@ static int migrate_page_move_mapping(struct address_space *mapping, + } + + /* ++ * In the async migration case of moving a page with buffers, lock the ++ * buffers using trylock before the mapping is moved. If the mapping ++ * was moved, we later failed to lock the buffers and could not move ++ * the mapping back due to an elevated page count, we would have to ++ * block waiting on other references to be dropped. ++ */ ++ if (mode == MIGRATE_ASYNC && head && ++ !buffer_migrate_lock_buffers(head, mode)) { ++ page_unfreeze_refs(page, expected_count); ++ spin_unlock_irq(&mapping->tree_lock); ++ return -EAGAIN; ++ } ++ ++ /* + * Now we know that no one else is looking at the page. + */ + get_page(newpage); /* add cache reference */ +@@ -415,13 +480,14 @@ EXPORT_SYMBOL(fail_migrate_page); + * Pages are locked upon entry and exit. + */ + int migrate_page(struct address_space *mapping, +- struct page *newpage, struct page *page) ++ struct page *newpage, struct page *page, ++ enum migrate_mode mode) + { + int rc; + + BUG_ON(PageWriteback(page)); /* Writeback must be complete */ + +- rc = migrate_page_move_mapping(mapping, newpage, page); ++ rc = migrate_page_move_mapping(mapping, newpage, page, NULL, mode); + + if (rc) + return rc; +@@ -438,28 +504,28 @@ EXPORT_SYMBOL(migrate_page); + * exist. + */ + int buffer_migrate_page(struct address_space *mapping, +- struct page *newpage, struct page *page) ++ struct page *newpage, struct page *page, enum migrate_mode mode) + { + struct buffer_head *bh, *head; + int rc; + + if (!page_has_buffers(page)) +- return migrate_page(mapping, newpage, page); ++ return migrate_page(mapping, newpage, page, mode); + + head = page_buffers(page); + +- rc = migrate_page_move_mapping(mapping, newpage, page); ++ rc = migrate_page_move_mapping(mapping, newpage, page, head, mode); + + if (rc) + return rc; + +- bh = head; +- do { +- get_bh(bh); +- lock_buffer(bh); +- bh = bh->b_this_page; +- +- } while (bh != head); ++ /* ++ * In the async case, migrate_page_move_mapping locked the buffers ++ * with an IRQ-safe spinlock held. In the sync case, the buffers ++ * need to be locked now ++ */ ++ if (mode != MIGRATE_ASYNC) ++ BUG_ON(!buffer_migrate_lock_buffers(head, mode)); + + ClearPagePrivate(page); + set_page_private(newpage, page_private(page)); +@@ -536,10 +602,14 @@ static int writeout(struct address_space *mapping, struct page *page) + * Default handling if a filesystem does not provide a migration function. + */ + static int fallback_migrate_page(struct address_space *mapping, +- struct page *newpage, struct page *page) ++ struct page *newpage, struct page *page, enum migrate_mode mode) + { +- if (PageDirty(page)) ++ if (PageDirty(page)) { ++ /* Only writeback pages in full synchronous migration */ ++ if (mode != MIGRATE_SYNC) ++ return -EBUSY; + return writeout(mapping, page); ++ } + + /* + * Buffers may be managed in a filesystem specific way. +@@ -549,7 +619,7 @@ static int fallback_migrate_page(struct address_space *mapping, + !try_to_release_page(page, GFP_KERNEL)) + return -EAGAIN; + +- return migrate_page(mapping, newpage, page); ++ return migrate_page(mapping, newpage, page, mode); + } + + /* +@@ -564,7 +634,7 @@ static int fallback_migrate_page(struct address_space *mapping, + * == 0 - success + */ + static int move_to_new_page(struct page *newpage, struct page *page, +- int remap_swapcache, bool sync) ++ int remap_swapcache, enum migrate_mode mode) + { + struct address_space *mapping; + int rc; +@@ -585,29 +655,18 @@ static int move_to_new_page(struct page *newpage, struct page *page, + + mapping = page_mapping(page); + if (!mapping) +- rc = migrate_page(mapping, newpage, page); +- else { ++ rc = migrate_page(mapping, newpage, page, mode); ++ else if (mapping->a_ops->migratepage) + /* +- * Do not writeback pages if !sync and migratepage is +- * not pointing to migrate_page() which is nonblocking +- * (swapcache/tmpfs uses migratepage = migrate_page). ++ * Most pages have a mapping and most filesystems provide a ++ * migratepage callback. Anonymous pages are part of swap ++ * space which also has its own migratepage callback. This ++ * is the most common path for page migration. + */ +- if (PageDirty(page) && !sync && +- mapping->a_ops->migratepage != migrate_page) +- rc = -EBUSY; +- else if (mapping->a_ops->migratepage) +- /* +- * Most pages have a mapping and most filesystems +- * should provide a migration function. Anonymous +- * pages are part of swap space which also has its +- * own migration function. This is the most common +- * path for page migration. +- */ +- rc = mapping->a_ops->migratepage(mapping, +- newpage, page); +- else +- rc = fallback_migrate_page(mapping, newpage, page); +- } ++ rc = mapping->a_ops->migratepage(mapping, ++ newpage, page, mode); ++ else ++ rc = fallback_migrate_page(mapping, newpage, page, mode); + + if (rc) { + newpage->mapping = NULL; +@@ -622,7 +681,7 @@ static int move_to_new_page(struct page *newpage, struct page *page, + } + + static int __unmap_and_move(struct page *page, struct page *newpage, +- int force, bool offlining, bool sync) ++ int force, bool offlining, enum migrate_mode mode) + { + int rc = -EAGAIN; + int remap_swapcache = 1; +@@ -631,7 +690,7 @@ static int __unmap_and_move(struct page *page, struct page *newpage, + struct anon_vma *anon_vma = NULL; + + if (!trylock_page(page)) { +- if (!force || !sync) ++ if (!force || mode == MIGRATE_ASYNC) + goto out; + + /* +@@ -677,10 +736,12 @@ static int __unmap_and_move(struct page *page, struct page *newpage, + + if (PageWriteback(page)) { + /* +- * For !sync, there is no point retrying as the retry loop +- * is expected to be too short for PageWriteback to be cleared ++ * Only in the case of a full syncronous migration is it ++ * necessary to wait for PageWriteback. In the async case, ++ * the retry loop is too short and in the sync-light case, ++ * the overhead of stalling is too much + */ +- if (!sync) { ++ if (mode != MIGRATE_SYNC) { + rc = -EBUSY; + goto uncharge; + } +@@ -751,7 +812,7 @@ static int __unmap_and_move(struct page *page, struct page *newpage, + + skip_unmap: + if (!page_mapped(page)) +- rc = move_to_new_page(newpage, page, remap_swapcache, sync); ++ rc = move_to_new_page(newpage, page, remap_swapcache, mode); + + if (rc && remap_swapcache) + remove_migration_ptes(page, page); +@@ -774,7 +835,8 @@ out: + * to the newly allocated page in newpage. + */ + static int unmap_and_move(new_page_t get_new_page, unsigned long private, +- struct page *page, int force, bool offlining, bool sync) ++ struct page *page, int force, bool offlining, ++ enum migrate_mode mode) + { + int rc = 0; + int *result = NULL; +@@ -792,7 +854,7 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private, + if (unlikely(split_huge_page(page))) + goto out; + +- rc = __unmap_and_move(page, newpage, force, offlining, sync); ++ rc = __unmap_and_move(page, newpage, force, offlining, mode); + out: + if (rc != -EAGAIN) { + /* +@@ -840,7 +902,8 @@ out: + */ + static int unmap_and_move_huge_page(new_page_t get_new_page, + unsigned long private, struct page *hpage, +- int force, bool offlining, bool sync) ++ int force, bool offlining, ++ enum migrate_mode mode) + { + int rc = 0; + int *result = NULL; +@@ -853,7 +916,7 @@ static int unmap_and_move_huge_page(new_page_t get_new_page, + rc = -EAGAIN; + + if (!trylock_page(hpage)) { +- if (!force || !sync) ++ if (!force || mode != MIGRATE_SYNC) + goto out; + lock_page(hpage); + } +@@ -864,7 +927,7 @@ static int unmap_and_move_huge_page(new_page_t get_new_page, + try_to_unmap(hpage, TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS); + + if (!page_mapped(hpage)) +- rc = move_to_new_page(new_hpage, hpage, 1, sync); ++ rc = move_to_new_page(new_hpage, hpage, 1, mode); + + if (rc) + remove_migration_ptes(hpage, hpage); +@@ -907,7 +970,7 @@ out: + */ + int migrate_pages(struct list_head *from, + new_page_t get_new_page, unsigned long private, bool offlining, +- bool sync) ++ enum migrate_mode mode) + { + int retry = 1; + int nr_failed = 0; +@@ -928,7 +991,7 @@ int migrate_pages(struct list_head *from, + + rc = unmap_and_move(get_new_page, private, + page, pass > 2, offlining, +- sync); ++ mode); + + switch(rc) { + case -ENOMEM: +@@ -958,7 +1021,7 @@ out: + + int migrate_huge_pages(struct list_head *from, + new_page_t get_new_page, unsigned long private, bool offlining, +- bool sync) ++ enum migrate_mode mode) + { + int retry = 1; + int nr_failed = 0; +@@ -975,7 +1038,7 @@ int migrate_huge_pages(struct list_head *from, + + rc = unmap_and_move_huge_page(get_new_page, + private, page, pass > 2, offlining, +- sync); ++ mode); + + switch(rc) { + case -ENOMEM: +@@ -1104,7 +1167,7 @@ set_status: + err = 0; + if (!list_empty(&pagelist)) { + err = migrate_pages(&pagelist, new_page_node, +- (unsigned long)pm, 0, true); ++ (unsigned long)pm, 0, MIGRATE_SYNC); + if (err) + putback_lru_pages(&pagelist); + } +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 485be89..065dbe8 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1886,14 +1886,20 @@ static struct page * + __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order, + struct zonelist *zonelist, enum zone_type high_zoneidx, + nodemask_t *nodemask, int alloc_flags, struct zone *preferred_zone, +- int migratetype, unsigned long *did_some_progress, +- bool sync_migration) ++ int migratetype, bool sync_migration, ++ bool *deferred_compaction, ++ unsigned long *did_some_progress) + { + struct page *page; + +- if (!order || compaction_deferred(preferred_zone)) ++ if (!order) + return NULL; + ++ if (compaction_deferred(preferred_zone)) { ++ *deferred_compaction = true; ++ return NULL; ++ } ++ + current->flags |= PF_MEMALLOC; + *did_some_progress = try_to_compact_pages(zonelist, order, gfp_mask, + nodemask, sync_migration); +@@ -1921,7 +1927,13 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order, + * but not enough to satisfy watermarks. + */ + count_vm_event(COMPACTFAIL); +- defer_compaction(preferred_zone); ++ ++ /* ++ * As async compaction considers a subset of pageblocks, only ++ * defer if the failure was a sync compaction failure. ++ */ ++ if (sync_migration) ++ defer_compaction(preferred_zone); + + cond_resched(); + } +@@ -1933,8 +1945,9 @@ static inline struct page * + __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order, + struct zonelist *zonelist, enum zone_type high_zoneidx, + nodemask_t *nodemask, int alloc_flags, struct zone *preferred_zone, +- int migratetype, unsigned long *did_some_progress, +- bool sync_migration) ++ int migratetype, bool sync_migration, ++ bool *deferred_compaction, ++ unsigned long *did_some_progress) + { + return NULL; + } +@@ -2084,6 +2097,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, + unsigned long pages_reclaimed = 0; + unsigned long did_some_progress; + bool sync_migration = false; ++ bool deferred_compaction = false; + + /* + * In the slowpath, we sanity check order to avoid ever trying to +@@ -2164,12 +2178,22 @@ rebalance: + zonelist, high_zoneidx, + nodemask, + alloc_flags, preferred_zone, +- migratetype, &did_some_progress, +- sync_migration); ++ migratetype, sync_migration, ++ &deferred_compaction, ++ &did_some_progress); + if (page) + goto got_pg; + sync_migration = true; + ++ /* ++ * If compaction is deferred for high-order allocations, it is because ++ * sync compaction recently failed. In this is the case and the caller ++ * has requested the system not be heavily disrupted, fail the ++ * allocation now instead of entering direct reclaim ++ */ ++ if (deferred_compaction && (gfp_mask & __GFP_NO_KSWAPD)) ++ goto nopage; ++ + /* Try direct reclaim and then allocating */ + page = __alloc_pages_direct_reclaim(gfp_mask, order, + zonelist, high_zoneidx, +@@ -2232,8 +2256,9 @@ rebalance: + zonelist, high_zoneidx, + nodemask, + alloc_flags, preferred_zone, +- migratetype, &did_some_progress, +- sync_migration); ++ migratetype, sync_migration, ++ &deferred_compaction, ++ &did_some_progress); + if (page) + goto got_pg; + } +@@ -2257,8 +2282,9 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order, + { + enum zone_type high_zoneidx = gfp_zone(gfp_mask); + struct zone *preferred_zone; +- struct page *page; ++ struct page *page = NULL; + int migratetype = allocflags_to_migratetype(gfp_mask); ++ unsigned int cpuset_mems_cookie; + + gfp_mask &= gfp_allowed_mask; + +@@ -2277,15 +2303,15 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order, + if (unlikely(!zonelist->_zonerefs->zone)) + return NULL; + +- get_mems_allowed(); ++retry_cpuset: ++ cpuset_mems_cookie = get_mems_allowed(); ++ + /* The preferred zone is used for statistics later */ + first_zones_zonelist(zonelist, high_zoneidx, + nodemask ? : &cpuset_current_mems_allowed, + &preferred_zone); +- if (!preferred_zone) { +- put_mems_allowed(); +- return NULL; +- } ++ if (!preferred_zone) ++ goto out; + + /* First allocation attempt */ + page = get_page_from_freelist(gfp_mask|__GFP_HARDWALL, nodemask, order, +@@ -2295,9 +2321,19 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order, + page = __alloc_pages_slowpath(gfp_mask, order, + zonelist, high_zoneidx, nodemask, + preferred_zone, migratetype); +- put_mems_allowed(); + + trace_mm_page_alloc(page, order, gfp_mask, migratetype); ++ ++out: ++ /* ++ * When updating a task's mems_allowed, it is possible to race with ++ * parallel threads in such a way that an allocation can fail while ++ * the mask is being updated. If a page allocation is about to fail, ++ * check if the cpuset changed during allocation and if so, retry. ++ */ ++ if (unlikely(!put_mems_allowed(cpuset_mems_cookie) && !page)) ++ goto retry_cpuset; ++ + return page; + } + EXPORT_SYMBOL(__alloc_pages_nodemask); +@@ -2521,13 +2557,15 @@ void si_meminfo_node(struct sysinfo *val, int nid) + bool skip_free_areas_node(unsigned int flags, int nid) + { + bool ret = false; ++ unsigned int cpuset_mems_cookie; + + if (!(flags & SHOW_MEM_FILTER_NODES)) + goto out; + +- get_mems_allowed(); +- ret = !node_isset(nid, cpuset_current_mems_allowed); +- put_mems_allowed(); ++ do { ++ cpuset_mems_cookie = get_mems_allowed(); ++ ret = !node_isset(nid, cpuset_current_mems_allowed); ++ } while (!put_mems_allowed(cpuset_mems_cookie)); + out: + return ret; + } +@@ -3407,25 +3445,33 @@ static void setup_zone_migrate_reserve(struct zone *zone) + if (page_to_nid(page) != zone_to_nid(zone)) + continue; + +- /* Blocks with reserved pages will never free, skip them. */ +- block_end_pfn = min(pfn + pageblock_nr_pages, end_pfn); +- if (pageblock_is_reserved(pfn, block_end_pfn)) +- continue; +- + block_migratetype = get_pageblock_migratetype(page); + +- /* If this block is reserved, account for it */ +- if (reserve > 0 && block_migratetype == MIGRATE_RESERVE) { +- reserve--; +- continue; +- } ++ /* Only test what is necessary when the reserves are not met */ ++ if (reserve > 0) { ++ /* ++ * Blocks with reserved pages will never free, skip ++ * them. ++ */ ++ block_end_pfn = min(pfn + pageblock_nr_pages, end_pfn); ++ if (pageblock_is_reserved(pfn, block_end_pfn)) ++ continue; + +- /* Suitable for reserving if this block is movable */ +- if (reserve > 0 && block_migratetype == MIGRATE_MOVABLE) { +- set_pageblock_migratetype(page, MIGRATE_RESERVE); +- move_freepages_block(zone, page, MIGRATE_RESERVE); +- reserve--; +- continue; ++ /* If this block is reserved, account for it */ ++ if (block_migratetype == MIGRATE_RESERVE) { ++ reserve--; ++ continue; ++ } ++ ++ /* Suitable for reserving if this block is movable */ ++ if (block_migratetype == MIGRATE_MOVABLE) { ++ set_pageblock_migratetype(page, ++ MIGRATE_RESERVE); ++ move_freepages_block(zone, page, ++ MIGRATE_RESERVE); ++ reserve--; ++ continue; ++ } + } + + /* +diff --git a/mm/slab.c b/mm/slab.c +index 83311c9a..cd3ab93 100644 +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -3267,12 +3267,10 @@ static void *alternate_node_alloc(struct kmem_cache *cachep, gfp_t flags) + if (in_interrupt() || (flags & __GFP_THISNODE)) + return NULL; + nid_alloc = nid_here = numa_mem_id(); +- get_mems_allowed(); + if (cpuset_do_slab_mem_spread() && (cachep->flags & SLAB_MEM_SPREAD)) + nid_alloc = cpuset_slab_spread_node(); + else if (current->mempolicy) + nid_alloc = slab_node(current->mempolicy); +- put_mems_allowed(); + if (nid_alloc != nid_here) + return ____cache_alloc_node(cachep, flags, nid_alloc); + return NULL; +@@ -3295,14 +3293,17 @@ static void *fallback_alloc(struct kmem_cache *cache, gfp_t flags) + enum zone_type high_zoneidx = gfp_zone(flags); + void *obj = NULL; + int nid; ++ unsigned int cpuset_mems_cookie; + + if (flags & __GFP_THISNODE) + return NULL; + +- get_mems_allowed(); +- zonelist = node_zonelist(slab_node(current->mempolicy), flags); + local_flags = flags & (GFP_CONSTRAINT_MASK|GFP_RECLAIM_MASK); + ++retry_cpuset: ++ cpuset_mems_cookie = get_mems_allowed(); ++ zonelist = node_zonelist(slab_node(current->mempolicy), flags); ++ + retry: + /* + * Look through allowed nodes for objects available +@@ -3355,7 +3356,9 @@ retry: + } + } + } +- put_mems_allowed(); ++ ++ if (unlikely(!put_mems_allowed(cpuset_mems_cookie) && !obj)) ++ goto retry_cpuset; + return obj; + } + +diff --git a/mm/slub.c b/mm/slub.c +index af47188..5710788 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -1582,6 +1582,7 @@ static struct page *get_any_partial(struct kmem_cache *s, gfp_t flags, + struct zone *zone; + enum zone_type high_zoneidx = gfp_zone(flags); + void *object; ++ unsigned int cpuset_mems_cookie; + + /* + * The defrag ratio allows a configuration of the tradeoffs between +@@ -1605,23 +1606,32 @@ static struct page *get_any_partial(struct kmem_cache *s, gfp_t flags, + get_cycles() % 1024 > s->remote_node_defrag_ratio) + return NULL; + +- get_mems_allowed(); +- zonelist = node_zonelist(slab_node(current->mempolicy), flags); +- for_each_zone_zonelist(zone, z, zonelist, high_zoneidx) { +- struct kmem_cache_node *n; +- +- n = get_node(s, zone_to_nid(zone)); +- +- if (n && cpuset_zone_allowed_hardwall(zone, flags) && +- n->nr_partial > s->min_partial) { +- object = get_partial_node(s, n, c); +- if (object) { +- put_mems_allowed(); +- return object; ++ do { ++ cpuset_mems_cookie = get_mems_allowed(); ++ zonelist = node_zonelist(slab_node(current->mempolicy), flags); ++ for_each_zone_zonelist(zone, z, zonelist, high_zoneidx) { ++ struct kmem_cache_node *n; ++ ++ n = get_node(s, zone_to_nid(zone)); ++ ++ if (n && cpuset_zone_allowed_hardwall(zone, flags) && ++ n->nr_partial > s->min_partial) { ++ object = get_partial_node(s, n, c); ++ if (object) { ++ /* ++ * Return the object even if ++ * put_mems_allowed indicated that ++ * the cpuset mems_allowed was ++ * updated in parallel. It's a ++ * harmless race between the alloc ++ * and the cpuset update. ++ */ ++ put_mems_allowed(cpuset_mems_cookie); ++ return object; ++ } + } + } +- } +- put_mems_allowed(); ++ } while (!put_mems_allowed(cpuset_mems_cookie)); + #endif + return NULL; + } +diff --git a/mm/vmscan.c b/mm/vmscan.c +index 8342119..48febd7 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -715,7 +715,13 @@ static enum page_references page_check_references(struct page *page, + */ + SetPageReferenced(page); + +- if (referenced_page) ++ if (referenced_page || referenced_ptes > 1) ++ return PAGEREF_ACTIVATE; ++ ++ /* ++ * Activate file-backed executable pages after first usage. ++ */ ++ if (vm_flags & VM_EXEC) + return PAGEREF_ACTIVATE; + + return PAGEREF_KEEP; +@@ -1061,8 +1067,39 @@ int __isolate_lru_page(struct page *page, isolate_mode_t mode, int file) + + ret = -EBUSY; + +- if ((mode & ISOLATE_CLEAN) && (PageDirty(page) || PageWriteback(page))) +- return ret; ++ /* ++ * To minimise LRU disruption, the caller can indicate that it only ++ * wants to isolate pages it will be able to operate on without ++ * blocking - clean pages for the most part. ++ * ++ * ISOLATE_CLEAN means that only clean pages should be isolated. This ++ * is used by reclaim when it is cannot write to backing storage ++ * ++ * ISOLATE_ASYNC_MIGRATE is used to indicate that it only wants to pages ++ * that it is possible to migrate without blocking ++ */ ++ if (mode & (ISOLATE_CLEAN|ISOLATE_ASYNC_MIGRATE)) { ++ /* All the caller can do on PageWriteback is block */ ++ if (PageWriteback(page)) ++ return ret; ++ ++ if (PageDirty(page)) { ++ struct address_space *mapping; ++ ++ /* ISOLATE_CLEAN means only clean pages */ ++ if (mode & ISOLATE_CLEAN) ++ return ret; ++ ++ /* ++ * Only pages without mappings or that have a ++ * ->migratepage callback are possible to migrate ++ * without blocking ++ */ ++ mapping = page_mapping(page); ++ if (mapping && !mapping->a_ops->migratepage) ++ return ret; ++ } ++ } + + if ((mode & ISOLATE_UNMAPPED) && page_mapped(page)) + return ret; +@@ -1178,7 +1215,7 @@ static unsigned long isolate_lru_pages(unsigned long nr_to_scan, + * anon page which don't already have a swap slot is + * pointless. + */ +- if (nr_swap_pages <= 0 && PageAnon(cursor_page) && ++ if (nr_swap_pages <= 0 && PageSwapBacked(cursor_page) && + !PageSwapCache(cursor_page)) + break; + +@@ -1874,7 +1911,8 @@ static void get_scan_count(struct zone *zone, struct scan_control *sc, + * latencies, so it's better to scan a minimum amount there as + * well. + */ +- if (scanning_global_lru(sc) && current_is_kswapd()) ++ if (scanning_global_lru(sc) && current_is_kswapd() && ++ zone->all_unreclaimable) + force_scan = true; + if (!scanning_global_lru(sc)) + force_scan = true; +@@ -2012,8 +2050,9 @@ static inline bool should_continue_reclaim(struct zone *zone, + * inactive lists are large enough, continue reclaiming + */ + pages_for_compaction = (2UL << sc->order); +- inactive_lru_pages = zone_nr_lru_pages(zone, sc, LRU_INACTIVE_ANON) + +- zone_nr_lru_pages(zone, sc, LRU_INACTIVE_FILE); ++ inactive_lru_pages = zone_nr_lru_pages(zone, sc, LRU_INACTIVE_FILE); ++ if (nr_swap_pages > 0) ++ inactive_lru_pages += zone_nr_lru_pages(zone, sc, LRU_INACTIVE_ANON); + if (sc->nr_reclaimed < pages_for_compaction && + inactive_lru_pages > pages_for_compaction) + return true; +@@ -2088,6 +2127,42 @@ restart: + throttle_vm_writeout(sc->gfp_mask); + } + ++/* Returns true if compaction should go ahead for a high-order request */ ++static inline bool compaction_ready(struct zone *zone, struct scan_control *sc) ++{ ++ unsigned long balance_gap, watermark; ++ bool watermark_ok; ++ ++ /* Do not consider compaction for orders reclaim is meant to satisfy */ ++ if (sc->order <= PAGE_ALLOC_COSTLY_ORDER) ++ return false; ++ ++ /* ++ * Compaction takes time to run and there are potentially other ++ * callers using the pages just freed. Continue reclaiming until ++ * there is a buffer of free pages available to give compaction ++ * a reasonable chance of completing and allocating the page ++ */ ++ balance_gap = min(low_wmark_pages(zone), ++ (zone->present_pages + KSWAPD_ZONE_BALANCE_GAP_RATIO-1) / ++ KSWAPD_ZONE_BALANCE_GAP_RATIO); ++ watermark = high_wmark_pages(zone) + balance_gap + (2UL << sc->order); ++ watermark_ok = zone_watermark_ok_safe(zone, 0, watermark, 0, 0); ++ ++ /* ++ * If compaction is deferred, reclaim up to a point where ++ * compaction will have a chance of success when re-enabled ++ */ ++ if (compaction_deferred(zone)) ++ return watermark_ok; ++ ++ /* If compaction is not ready to start, keep reclaiming */ ++ if (!compaction_suitable(zone, sc->order)) ++ return false; ++ ++ return watermark_ok; ++} ++ + /* + * This is the direct reclaim path, for page-allocating processes. We only + * try to reclaim pages from zones which will satisfy the caller's allocation +@@ -2105,8 +2180,9 @@ restart: + * scan then give up on it. + * + * This function returns true if a zone is being reclaimed for a costly +- * high-order allocation and compaction is either ready to begin or deferred. +- * This indicates to the caller that it should retry the allocation or fail. ++ * high-order allocation and compaction is ready to begin. This indicates to ++ * the caller that it should consider retrying the allocation instead of ++ * further reclaim. + */ + static bool shrink_zones(int priority, struct zonelist *zonelist, + struct scan_control *sc) +@@ -2115,7 +2191,7 @@ static bool shrink_zones(int priority, struct zonelist *zonelist, + struct zone *zone; + unsigned long nr_soft_reclaimed; + unsigned long nr_soft_scanned; +- bool should_abort_reclaim = false; ++ bool aborted_reclaim = false; + + for_each_zone_zonelist_nodemask(zone, z, zonelist, + gfp_zone(sc->gfp_mask), sc->nodemask) { +@@ -2140,10 +2216,8 @@ static bool shrink_zones(int priority, struct zonelist *zonelist, + * noticable problem, like transparent huge page + * allocations. + */ +- if (sc->order > PAGE_ALLOC_COSTLY_ORDER && +- (compaction_suitable(zone, sc->order) || +- compaction_deferred(zone))) { +- should_abort_reclaim = true; ++ if (compaction_ready(zone, sc)) { ++ aborted_reclaim = true; + continue; + } + } +@@ -2165,7 +2239,7 @@ static bool shrink_zones(int priority, struct zonelist *zonelist, + shrink_zone(priority, zone, sc); + } + +- return should_abort_reclaim; ++ return aborted_reclaim; + } + + static bool zone_reclaimable(struct zone *zone) +@@ -2219,8 +2293,8 @@ static unsigned long do_try_to_free_pages(struct zonelist *zonelist, + struct zoneref *z; + struct zone *zone; + unsigned long writeback_threshold; ++ bool aborted_reclaim; + +- get_mems_allowed(); + delayacct_freepages_start(); + + if (scanning_global_lru(sc)) +@@ -2230,8 +2304,7 @@ static unsigned long do_try_to_free_pages(struct zonelist *zonelist, + sc->nr_scanned = 0; + if (!priority) + disable_swap_token(sc->mem_cgroup); +- if (shrink_zones(priority, zonelist, sc)) +- break; ++ aborted_reclaim = shrink_zones(priority, zonelist, sc); + + /* + * Don't shrink slabs when reclaiming memory from +@@ -2285,7 +2358,6 @@ static unsigned long do_try_to_free_pages(struct zonelist *zonelist, + + out: + delayacct_freepages_end(); +- put_mems_allowed(); + + if (sc->nr_reclaimed) + return sc->nr_reclaimed; +@@ -2298,6 +2370,10 @@ out: + if (oom_killer_disabled) + return 0; + ++ /* Aborted reclaim to try compaction? don't OOM, then */ ++ if (aborted_reclaim) ++ return 1; ++ + /* top priority shrink_zones still had more to do? don't OOM, then */ + if (scanning_global_lru(sc) && !all_unreclaimable(zonelist, sc)) + return 1; +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index c505fd5..c119f33 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -868,7 +868,6 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo, + struct hdmi_spec_per_pin *per_pin; + struct hdmi_eld *eld; + struct hdmi_spec_per_cvt *per_cvt = NULL; +- int pinctl; + + /* Validate hinfo */ + pin_idx = hinfo_to_pin_index(spec, hinfo); +@@ -904,11 +903,6 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo, + snd_hda_codec_write(codec, per_pin->pin_nid, 0, + AC_VERB_SET_CONNECT_SEL, + mux_idx); +- pinctl = snd_hda_codec_read(codec, per_pin->pin_nid, 0, +- AC_VERB_GET_PIN_WIDGET_CONTROL, 0); +- snd_hda_codec_write(codec, per_pin->pin_nid, 0, +- AC_VERB_SET_PIN_WIDGET_CONTROL, +- pinctl | PIN_OUT); + snd_hda_spdif_ctls_assign(codec, pin_idx, per_cvt->cvt_nid); + + /* Initially set the converter's capabilities */ +@@ -1147,11 +1141,17 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo, + struct hdmi_spec *spec = codec->spec; + int pin_idx = hinfo_to_pin_index(spec, hinfo); + hda_nid_t pin_nid = spec->pins[pin_idx].pin_nid; ++ int pinctl; + + hdmi_set_channel_count(codec, cvt_nid, substream->runtime->channels); + + hdmi_setup_audio_infoframe(codec, pin_idx, substream); + ++ pinctl = snd_hda_codec_read(codec, pin_nid, 0, ++ AC_VERB_GET_PIN_WIDGET_CONTROL, 0); ++ snd_hda_codec_write(codec, pin_nid, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, pinctl | PIN_OUT); ++ + return hdmi_setup_stream(codec, cvt_nid, pin_nid, stream_tag, format); + } + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 5f096a5..191fd78 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5989,6 +5989,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = { + { .id = 0x10ec0275, .name = "ALC275", .patch = patch_alc269 }, + { .id = 0x10ec0276, .name = "ALC276", .patch = patch_alc269 }, + { .id = 0x10ec0280, .name = "ALC280", .patch = patch_alc269 }, ++ { .id = 0x10ec0282, .name = "ALC282", .patch = patch_alc269 }, + { .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660", + .patch = patch_alc861 }, + { .id = 0x10ec0660, .name = "ALC660-VD", .patch = patch_alc861vd }, +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 90e93bf..0dc441c 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -1381,7 +1381,15 @@ static int dapm_power_widgets(struct snd_soc_dapm_context *dapm, int event) + } + + list_for_each_entry(w, &card->widgets, list) { +- list_del_init(&w->dirty); ++ switch (w->id) { ++ case snd_soc_dapm_pre: ++ case snd_soc_dapm_post: ++ /* These widgets always need to be powered */ ++ break; ++ default: ++ list_del_init(&w->dirty); ++ break; ++ } + + if (w->power) { + d = w->dapm; diff --git a/3.2.26/1025_linux-3.2.26.patch b/3.2.26/1025_linux-3.2.26.patch new file mode 100644 index 0000000..44065b9 --- /dev/null +++ b/3.2.26/1025_linux-3.2.26.patch @@ -0,0 +1,238 @@ +diff --git a/Makefile b/Makefile +index e13e4e7..fa5acc83 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 2 +-SUBLEVEL = 25 ++SUBLEVEL = 26 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index bb3ee36..f7c89e2 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -99,7 +99,6 @@ struct cpuinfo_x86 { + u16 apicid; + u16 initial_apicid; + u16 x86_clflush_size; +-#ifdef CONFIG_SMP + /* number of cores as seen by the OS: */ + u16 booted_cores; + /* Physical processor id: */ +@@ -110,7 +109,6 @@ struct cpuinfo_x86 { + u8 compute_unit_id; + /* Index into per_cpu list: */ + u16 cpu_index; +-#endif + u32 microcode; + } __attribute__((__aligned__(SMP_CACHE_BYTES))); + +diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c +index bae1efe..be16854 100644 +--- a/arch/x86/kernel/amd_nb.c ++++ b/arch/x86/kernel/amd_nb.c +@@ -154,16 +154,14 @@ int amd_get_subcaches(int cpu) + { + struct pci_dev *link = node_to_amd_nb(amd_get_nb_id(cpu))->link; + unsigned int mask; +- int cuid = 0; ++ int cuid; + + if (!amd_nb_has_feature(AMD_NB_L3_PARTITIONING)) + return 0; + + pci_read_config_dword(link, 0x1d4, &mask); + +-#ifdef CONFIG_SMP + cuid = cpu_data(cpu).compute_unit_id; +-#endif + return (mask >> (4 * cuid)) & 0xf; + } + +@@ -172,7 +170,7 @@ int amd_set_subcaches(int cpu, int mask) + static unsigned int reset, ban; + struct amd_northbridge *nb = node_to_amd_nb(amd_get_nb_id(cpu)); + unsigned int reg; +- int cuid = 0; ++ int cuid; + + if (!amd_nb_has_feature(AMD_NB_L3_PARTITIONING) || mask > 0xf) + return -EINVAL; +@@ -190,9 +188,7 @@ int amd_set_subcaches(int cpu, int mask) + pci_write_config_dword(nb->misc, 0x1b8, reg & ~0x180000); + } + +-#ifdef CONFIG_SMP + cuid = cpu_data(cpu).compute_unit_id; +-#endif + mask <<= 4 * cuid; + mask |= (0xf ^ (1 << cuid)) << 26; + +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index 3524e1f..ff8557e 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -148,7 +148,6 @@ static void __cpuinit init_amd_k6(struct cpuinfo_x86 *c) + + static void __cpuinit amd_k7_smp_check(struct cpuinfo_x86 *c) + { +-#ifdef CONFIG_SMP + /* calling is from identify_secondary_cpu() ? */ + if (!c->cpu_index) + return; +@@ -192,7 +191,6 @@ static void __cpuinit amd_k7_smp_check(struct cpuinfo_x86 *c) + + valid_k7: + ; +-#endif + } + + static void __cpuinit init_amd_k7(struct cpuinfo_x86 *c) +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index aa003b1..ca93cc7 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -676,9 +676,7 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c) + if (this_cpu->c_early_init) + this_cpu->c_early_init(c); + +-#ifdef CONFIG_SMP + c->cpu_index = 0; +-#endif + filter_cpuid_features(c, false); + + setup_smep(c); +@@ -764,10 +762,7 @@ static void __cpuinit generic_identify(struct cpuinfo_x86 *c) + c->apicid = c->initial_apicid; + # endif + #endif +- +-#ifdef CONFIG_X86_HT + c->phys_proc_id = c->initial_apicid; +-#endif + } + + setup_smep(c); +diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c +index 5231312..3e6ff6c 100644 +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -181,7 +181,6 @@ static void __cpuinit trap_init_f00f_bug(void) + + static void __cpuinit intel_smp_check(struct cpuinfo_x86 *c) + { +-#ifdef CONFIG_SMP + /* calling is from identify_secondary_cpu() ? */ + if (!c->cpu_index) + return; +@@ -198,7 +197,6 @@ static void __cpuinit intel_smp_check(struct cpuinfo_x86 *c) + WARN_ONCE(1, "WARNING: SMP operation may be unreliable" + "with B stepping processors.\n"); + } +-#endif + } + + static void __cpuinit intel_workarounds(struct cpuinfo_x86 *c) +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index b0f1271..3b67877 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -119,9 +119,7 @@ void mce_setup(struct mce *m) + m->time = get_seconds(); + m->cpuvendor = boot_cpu_data.x86_vendor; + m->cpuid = cpuid_eax(1); +-#ifdef CONFIG_SMP + m->socketid = cpu_data(m->extcpu).phys_proc_id; +-#endif + m->apicid = cpu_data(m->extcpu).initial_apicid; + rdmsrl(MSR_IA32_MCG_CAP, m->mcgcap); + } +diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c +index 445a61c..d4444be 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c ++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c +@@ -65,11 +65,9 @@ struct threshold_bank { + }; + static DEFINE_PER_CPU(struct threshold_bank * [NR_BANKS], threshold_banks); + +-#ifdef CONFIG_SMP + static unsigned char shared_bank[NR_BANKS] = { + 0, 0, 0, 0, 1 + }; +-#endif + + static DEFINE_PER_CPU(unsigned char, bank_map); /* see which banks are on */ + +@@ -227,10 +225,9 @@ void mce_amd_feature_init(struct cpuinfo_x86 *c) + + if (!block) + per_cpu(bank_map, cpu) |= (1 << bank); +-#ifdef CONFIG_SMP ++ + if (shared_bank[bank] && c->cpu_core_id) + break; +-#endif + + memset(&b, 0, sizeof(b)); + b.cpu = cpu; +diff --git a/arch/x86/kernel/cpu/proc.c b/arch/x86/kernel/cpu/proc.c +index 14b2314..8022c66 100644 +--- a/arch/x86/kernel/cpu/proc.c ++++ b/arch/x86/kernel/cpu/proc.c +@@ -64,12 +64,10 @@ static void show_cpuinfo_misc(struct seq_file *m, struct cpuinfo_x86 *c) + static int show_cpuinfo(struct seq_file *m, void *v) + { + struct cpuinfo_x86 *c = v; +- unsigned int cpu = 0; ++ unsigned int cpu; + int i; + +-#ifdef CONFIG_SMP + cpu = c->cpu_index; +-#endif + seq_printf(m, "processor\t: %u\n" + "vendor_id\t: %s\n" + "cpu family\t: %d\n" +diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c +index 18a1293..0db57b5 100644 +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -1609,11 +1609,9 @@ static int sbridge_mce_check_error(struct notifier_block *nb, unsigned long val, + mce->cpuvendor, mce->cpuid, mce->time, + mce->socketid, mce->apicid); + +-#ifdef CONFIG_SMP + /* Only handle if it is the right mc controller */ + if (cpu_data(mce->cpu).phys_proc_id != pvt->sbridge_dev->mc) + return NOTIFY_DONE; +-#endif + + smp_rmb(); + if ((pvt->mce_out + 1) % MCE_LOG_LEN == pvt->mce_in) { +diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c +index 0790c98..19b4412 100644 +--- a/drivers/hwmon/coretemp.c ++++ b/drivers/hwmon/coretemp.c +@@ -57,16 +57,15 @@ MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius"); + #define TOTAL_ATTRS (MAX_CORE_ATTRS + 1) + #define MAX_CORE_DATA (NUM_REAL_CORES + BASE_SYSFS_ATTR_NO) + +-#ifdef CONFIG_SMP + #define TO_PHYS_ID(cpu) cpu_data(cpu).phys_proc_id + #define TO_CORE_ID(cpu) cpu_data(cpu).cpu_core_id ++#define TO_ATTR_NO(cpu) (TO_CORE_ID(cpu) + BASE_SYSFS_ATTR_NO) ++ ++#ifdef CONFIG_SMP + #define for_each_sibling(i, cpu) for_each_cpu(i, cpu_sibling_mask(cpu)) + #else +-#define TO_PHYS_ID(cpu) (cpu) +-#define TO_CORE_ID(cpu) (cpu) + #define for_each_sibling(i, cpu) for (i = 0; false; ) + #endif +-#define TO_ATTR_NO(cpu) (TO_CORE_ID(cpu) + BASE_SYSFS_ATTR_NO) + + /* + * Per-Core Temperature Data diff --git a/3.2.24/4420_grsecurity-2.9.1-3.2.24-201208011849.patch b/3.2.26/4420_grsecurity-2.9.1-3.2.26-201208062017.patch index c4edc06..cb16dab 100644 --- a/3.2.24/4420_grsecurity-2.9.1-3.2.24-201208011849.patch +++ b/3.2.26/4420_grsecurity-2.9.1-3.2.26-201208062017.patch @@ -245,7 +245,7 @@ index 88fd7f5..b318a78 100644 ============================================================== diff --git a/Makefile b/Makefile -index 80bb4fd..964ea28 100644 +index fa5acc83..d3285e9 100644 --- a/Makefile +++ b/Makefile @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -3934,7 +3934,7 @@ index 4aad413..85d86bf 100644 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */ #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */ diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h -index 559da19..7e5835c 100644 +index 578e5a0..2ab6a8a 100644 --- a/arch/powerpc/include/asm/reg.h +++ b/arch/powerpc/include/asm/reg.h @@ -212,6 +212,7 @@ @@ -3959,7 +3959,7 @@ index e30a13d..2b7d994 100644 /* Used in very early kernel initialization. */ extern unsigned long reloc_offset(void); diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h -index 836f231..8403cfb 100644 +index 836f231..39d0b94 100644 --- a/arch/powerpc/include/asm/thread_info.h +++ b/arch/powerpc/include/asm/thread_info.h @@ -104,7 +104,6 @@ static inline struct thread_info *current_thread_info(void) @@ -3988,7 +3988,7 @@ index 836f231..8403cfb 100644 + #define _TIF_SYSCALL_T_OR_A (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \ - _TIF_SECCOMP | _TIF_SYSCALL_TRACEPOINT) -+ _TIF_SECCOMP | _TIF_SYSCALL_TRACEPOINT \ ++ _TIF_SECCOMP | _TIF_SYSCALL_TRACEPOINT | \ + _TIF_GRSEC_SETXID) #define _TIF_USER_WORK_MASK (_TIF_SIGPENDING | _TIF_NEED_RESCHED | \ @@ -8167,10 +8167,10 @@ index 4d3ff03..e4972ff 100644 err = check_flags(); } diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S -index bdb4d45..0476680 100644 +index bdb4d45..77703de 100644 --- a/arch/x86/boot/header.S +++ b/arch/x86/boot/header.S -@@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical pointer to +@@ -224,10 +224,14 @@ setup_data: .quad 0 # 64-bit physical pointer to # single linked list of # struct setup_data @@ -8178,7 +8178,14 @@ index bdb4d45..0476680 100644 +pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset) ++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) ++#define VO_INIT_SIZE (VO__end - VO__text - __PAGE_OFFSET - ____LOAD_PHYSICAL_ADDR) ++#else #define VO_INIT_SIZE (VO__end - VO__text) ++#endif + #if ZO_INIT_SIZE > VO_INIT_SIZE + #define INIT_SIZE ZO_INIT_SIZE + #else diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c index db75d07..8e6d0af 100644 --- a/arch/x86/boot/memory.c @@ -11850,10 +11857,10 @@ index 013286a..8b42f4f 100644 #define pgprot_writecombine pgprot_writecombine extern pgprot_t pgprot_writecombine(pgprot_t prot); diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h -index bb3ee36..781a6b8 100644 +index f7c89e2..07d412d 100644 --- a/arch/x86/include/asm/processor.h +++ b/arch/x86/include/asm/processor.h -@@ -268,7 +268,7 @@ struct tss_struct { +@@ -266,7 +266,7 @@ struct tss_struct { } ____cacheline_aligned; @@ -11862,7 +11869,7 @@ index bb3ee36..781a6b8 100644 /* * Save the original ist values for checking stack pointers during debugging -@@ -861,11 +861,18 @@ static inline void spin_lock_prefetch(const void *x) +@@ -859,11 +859,18 @@ static inline void spin_lock_prefetch(const void *x) */ #define TASK_SIZE PAGE_OFFSET #define TASK_SIZE_MAX TASK_SIZE @@ -11883,7 +11890,7 @@ index bb3ee36..781a6b8 100644 .vm86_info = NULL, \ .sysenter_cs = __KERNEL_CS, \ .io_bitmap_ptr = NULL, \ -@@ -879,7 +886,7 @@ static inline void spin_lock_prefetch(const void *x) +@@ -877,7 +884,7 @@ static inline void spin_lock_prefetch(const void *x) */ #define INIT_TSS { \ .x86_tss = { \ @@ -11892,7 +11899,7 @@ index bb3ee36..781a6b8 100644 .ss0 = __KERNEL_DS, \ .ss1 = __KERNEL_CS, \ .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \ -@@ -890,11 +897,7 @@ static inline void spin_lock_prefetch(const void *x) +@@ -888,11 +895,7 @@ static inline void spin_lock_prefetch(const void *x) extern unsigned long thread_saved_pc(struct task_struct *tsk); #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long)) @@ -11905,7 +11912,7 @@ index bb3ee36..781a6b8 100644 /* * The below -8 is to reserve 8 bytes on top of the ring0 stack. -@@ -909,7 +912,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk); +@@ -907,7 +910,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk); #define task_pt_regs(task) \ ({ \ struct pt_regs *__regs__; \ @@ -11914,7 +11921,7 @@ index bb3ee36..781a6b8 100644 __regs__ - 1; \ }) -@@ -919,13 +922,13 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk); +@@ -917,13 +920,13 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk); /* * User space process size. 47bits minus one guard page. */ @@ -11930,7 +11937,7 @@ index bb3ee36..781a6b8 100644 #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \ IA32_PAGE_OFFSET : TASK_SIZE_MAX) -@@ -936,11 +939,11 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk); +@@ -934,11 +937,11 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk); #define STACK_TOP_MAX TASK_SIZE_MAX #define INIT_THREAD { \ @@ -11944,7 +11951,7 @@ index bb3ee36..781a6b8 100644 } /* -@@ -962,6 +965,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip, +@@ -960,6 +963,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip, */ #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3)) @@ -14126,10 +14133,10 @@ index 25f24dc..4094a7f 100644 obj-y += proc.o capflags.o powerflags.o common.o obj-y += vmware.o hypervisor.o sched.o mshyperv.o diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index 3524e1f..7e3ee04 100644 +index ff8557e..8b1007b 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c -@@ -682,7 +682,7 @@ static unsigned int __cpuinit amd_size_cache(struct cpuinfo_x86 *c, +@@ -680,7 +680,7 @@ static unsigned int __cpuinit amd_size_cache(struct cpuinfo_x86 *c, unsigned int size) { /* AMD errata T13 (order #21922) */ @@ -14139,7 +14146,7 @@ index 3524e1f..7e3ee04 100644 if (c->x86_model == 3 && c->x86_mask == 0) size = 64; diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index aa003b1..47ea638 100644 +index ca93cc7..def63d0 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -84,60 +84,6 @@ static const struct cpu_dev __cpuinitconst default_cpu = { @@ -14212,7 +14219,7 @@ index aa003b1..47ea638 100644 gdt_descr.size = GDT_SIZE - 1; load_gdt(&gdt_descr); /* Reload the per-cpu base */ -@@ -844,6 +790,10 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c) +@@ -839,6 +785,10 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c) /* Filter out anything that depends on CPUID levels we don't have */ filter_cpuid_features(c, true); @@ -14223,7 +14230,7 @@ index aa003b1..47ea638 100644 /* If the model name is still unset, do table lookup. */ if (!c->x86_model_id[0]) { const char *p; -@@ -1024,6 +974,9 @@ static __init int setup_disablecpuid(char *arg) +@@ -1019,6 +969,9 @@ static __init int setup_disablecpuid(char *arg) } __setup("clearcpuid=", setup_disablecpuid); @@ -14233,7 +14240,7 @@ index aa003b1..47ea638 100644 #ifdef CONFIG_X86_64 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table }; -@@ -1039,7 +992,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned = +@@ -1034,7 +987,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned = EXPORT_PER_CPU_SYMBOL(current_task); DEFINE_PER_CPU(unsigned long, kernel_stack) = @@ -14242,7 +14249,7 @@ index aa003b1..47ea638 100644 EXPORT_PER_CPU_SYMBOL(kernel_stack); DEFINE_PER_CPU(char *, irq_stack_ptr) = -@@ -1104,7 +1057,7 @@ struct pt_regs * __cpuinit idle_regs(struct pt_regs *regs) +@@ -1099,7 +1052,7 @@ struct pt_regs * __cpuinit idle_regs(struct pt_regs *regs) { memset(regs, 0, sizeof(struct pt_regs)); regs->fs = __KERNEL_PERCPU; @@ -14251,7 +14258,7 @@ index aa003b1..47ea638 100644 return regs; } -@@ -1159,7 +1112,7 @@ void __cpuinit cpu_init(void) +@@ -1154,7 +1107,7 @@ void __cpuinit cpu_init(void) int i; cpu = stack_smp_processor_id(); @@ -14260,7 +14267,7 @@ index aa003b1..47ea638 100644 oist = &per_cpu(orig_ist, cpu); #ifdef CONFIG_NUMA -@@ -1185,7 +1138,7 @@ void __cpuinit cpu_init(void) +@@ -1180,7 +1133,7 @@ void __cpuinit cpu_init(void) switch_to_new_gdt(cpu); loadsegment(fs, 0); @@ -14269,7 +14276,7 @@ index aa003b1..47ea638 100644 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8); syscall_init(); -@@ -1194,7 +1147,6 @@ void __cpuinit cpu_init(void) +@@ -1189,7 +1142,6 @@ void __cpuinit cpu_init(void) wrmsrl(MSR_KERNEL_GS_BASE, 0); barrier(); @@ -14277,7 +14284,7 @@ index aa003b1..47ea638 100644 if (cpu != 0) enable_x2apic(); -@@ -1248,7 +1200,7 @@ void __cpuinit cpu_init(void) +@@ -1243,7 +1195,7 @@ void __cpuinit cpu_init(void) { int cpu = smp_processor_id(); struct task_struct *curr = current; @@ -14287,7 +14294,7 @@ index aa003b1..47ea638 100644 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) { diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c -index 5231312..a78a987 100644 +index 3e6ff6c..54b4992 100644 --- a/arch/x86/kernel/cpu/intel.c +++ b/arch/x86/kernel/cpu/intel.c @@ -174,7 +174,7 @@ static void __cpuinit trap_init_f00f_bug(void) @@ -14300,7 +14307,7 @@ index 5231312..a78a987 100644 } #endif diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c -index b0f1271..1158227 100644 +index 3b67877..2eab721 100644 --- a/arch/x86/kernel/cpu/mcheck/mce.c +++ b/arch/x86/kernel/cpu/mcheck/mce.c @@ -42,6 +42,7 @@ @@ -14311,7 +14318,7 @@ index b0f1271..1158227 100644 #include "mce-internal.h" -@@ -202,7 +203,7 @@ static void print_mce(struct mce *m) +@@ -200,7 +201,7 @@ static void print_mce(struct mce *m) !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "", m->cs, m->ip); @@ -14320,7 +14327,7 @@ index b0f1271..1158227 100644 print_symbol("{%s}", m->ip); pr_cont("\n"); } -@@ -235,10 +236,10 @@ static void print_mce(struct mce *m) +@@ -233,10 +234,10 @@ static void print_mce(struct mce *m) #define PANIC_TIMEOUT 5 /* 5 seconds */ @@ -14333,7 +14340,7 @@ index b0f1271..1158227 100644 /* Panic in progress. Enable interrupts and wait for final IPI */ static void wait_for_panic(void) -@@ -262,7 +263,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp) +@@ -260,7 +261,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp) /* * Make sure only one CPU runs in machine check panic */ @@ -14342,7 +14349,7 @@ index b0f1271..1158227 100644 wait_for_panic(); barrier(); -@@ -270,7 +271,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp) +@@ -268,7 +269,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp) console_verbose(); } else { /* Don't log too much for fake panic */ @@ -14351,7 +14358,7 @@ index b0f1271..1158227 100644 return; } /* First print corrected ones that are still unlogged */ -@@ -618,7 +619,7 @@ static int mce_timed_out(u64 *t) +@@ -616,7 +617,7 @@ static int mce_timed_out(u64 *t) * might have been modified by someone else. */ rmb(); @@ -14360,7 +14367,7 @@ index b0f1271..1158227 100644 wait_for_panic(); if (!monarch_timeout) goto out; -@@ -1406,7 +1407,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code) +@@ -1404,7 +1405,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code) } /* Call the installed machine check handler for this CPU setup. */ @@ -14369,7 +14376,7 @@ index b0f1271..1158227 100644 unexpected_machine_check; /* -@@ -1429,7 +1430,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) +@@ -1427,7 +1428,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) return; } @@ -14379,7 +14386,7 @@ index b0f1271..1158227 100644 __mcheck_cpu_init_generic(); __mcheck_cpu_init_vendor(c); -@@ -1443,7 +1446,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) +@@ -1441,7 +1444,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) */ static DEFINE_SPINLOCK(mce_chrdev_state_lock); @@ -14388,7 +14395,7 @@ index b0f1271..1158227 100644 static int mce_chrdev_open_exclu; /* already open exclusive? */ static int mce_chrdev_open(struct inode *inode, struct file *file) -@@ -1451,7 +1454,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) +@@ -1449,7 +1452,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) spin_lock(&mce_chrdev_state_lock); if (mce_chrdev_open_exclu || @@ -14397,7 +14404,7 @@ index b0f1271..1158227 100644 spin_unlock(&mce_chrdev_state_lock); return -EBUSY; -@@ -1459,7 +1462,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) +@@ -1457,7 +1460,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) if (file->f_flags & O_EXCL) mce_chrdev_open_exclu = 1; @@ -14406,7 +14413,7 @@ index b0f1271..1158227 100644 spin_unlock(&mce_chrdev_state_lock); -@@ -1470,7 +1473,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file) +@@ -1468,7 +1471,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file) { spin_lock(&mce_chrdev_state_lock); @@ -14415,7 +14422,7 @@ index b0f1271..1158227 100644 mce_chrdev_open_exclu = 0; spin_unlock(&mce_chrdev_state_lock); -@@ -2179,7 +2182,7 @@ struct dentry *mce_get_debugfs_dir(void) +@@ -2177,7 +2180,7 @@ struct dentry *mce_get_debugfs_dir(void) static void mce_reset(void) { cpu_missing = 0; @@ -26642,7 +26649,7 @@ index 40e4469..1ab536e 100644 gdt_descr.size = GDT_SIZE - 1; load_gdt(&gdt_descr); diff --git a/arch/x86/platform/efi/efi_stub_32.S b/arch/x86/platform/efi/efi_stub_32.S -index fbe66e6..c5c0dd2 100644 +index fbe66e6..eae5e38 100644 --- a/arch/x86/platform/efi/efi_stub_32.S +++ b/arch/x86/platform/efi/efi_stub_32.S @@ -6,7 +6,9 @@ @@ -26664,22 +26671,35 @@ index fbe66e6..c5c0dd2 100644 ENTRY(efi_call_phys) /* * 0. The function can only be called in Linux kernel. So CS has been -@@ -36,9 +38,11 @@ ENTRY(efi_call_phys) +@@ -36,10 +38,24 @@ ENTRY(efi_call_phys) * The mapping of lower virtual memory has been created in prelog and * epilog. */ - movl $1f, %edx - subl $__PAGE_OFFSET, %edx - jmp *%edx ++#ifdef CONFIG_PAX_KERNEXEC + movl $(__KERNEXEC_EFI_DS), %edx + mov %edx, %ds + mov %edx, %es + mov %edx, %ss -+ ljmp $(__KERNEXEC_EFI_CS),$1f-__PAGE_OFFSET ++ addl $2f,(1f) ++ ljmp *(1f) ++ ++__INITDATA ++1: .long __LOAD_PHYSICAL_ADDR, __KERNEXEC_EFI_CS ++.previous ++ ++2: ++ subl $2b,(1b) ++#else ++ jmp 1f-__PAGE_OFFSET 1: ++#endif /* -@@ -47,14 +51,8 @@ ENTRY(efi_call_phys) + * 2. Now on the top of stack is the return +@@ -47,14 +63,8 @@ ENTRY(efi_call_phys) * parameter 2, ..., param n. To make things easy, we save the return * address of efi_call_phys in a global variable. */ @@ -26696,7 +26716,7 @@ index fbe66e6..c5c0dd2 100644 /* * 3. Clear PG bit in %CR0. -@@ -73,9 +71,8 @@ ENTRY(efi_call_phys) +@@ -73,9 +83,8 @@ ENTRY(efi_call_phys) /* * 5. Call the physical function. */ @@ -26707,7 +26727,7 @@ index fbe66e6..c5c0dd2 100644 /* * 6. After EFI runtime service returns, control will return to * following instruction. We'd better readjust stack pointer first. -@@ -88,35 +85,32 @@ ENTRY(efi_call_phys) +@@ -88,35 +97,36 @@ ENTRY(efi_call_phys) movl %cr0, %edx orl $0x80000000, %edx movl %edx, %cr0 @@ -26720,12 +26740,16 @@ index fbe66e6..c5c0dd2 100644 */ - movl $1f, %edx - jmp *%edx -+ ljmp $(__KERNEL_CS),$1f+__PAGE_OFFSET - 1: ++#ifdef CONFIG_PAX_KERNEXEC + movl $(__KERNEL_DS), %edx + mov %edx, %ds + mov %edx, %es + mov %edx, %ss ++ ljmp $(__KERNEL_CS),$1f ++#else ++ jmp 1f+__PAGE_OFFSET ++#endif + 1: /* * 9. Balance the stack. And because EAX contain the return value, @@ -30355,7 +30379,7 @@ index b153674..ad2ba9b 100644 PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID) }, diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c -index 18a1293..58a5c6b4c 100644 +index 0db57b5..544e86d 100644 --- a/drivers/edac/sb_edac.c +++ b/drivers/edac/sb_edac.c @@ -367,7 +367,7 @@ static const struct pci_id_table pci_dev_descr_sbridge_table[] = { @@ -34423,33 +34447,6 @@ index 9cde353..8c6a1c3 100644 struct i2c_client i2c_client; u32 i2c_rc; -diff --git a/drivers/media/video/cx25821/cx25821-core.c b/drivers/media/video/cx25821/cx25821-core.c -index a7fa38f..e572ce5 100644 ---- a/drivers/media/video/cx25821/cx25821-core.c -+++ b/drivers/media/video/cx25821/cx25821-core.c -@@ -914,9 +914,6 @@ static int cx25821_dev_setup(struct cx25821_dev *dev) - list_add_tail(&dev->devlist, &cx25821_devlist); - mutex_unlock(&cx25821_devlist_mutex); - -- strcpy(cx25821_boards[UNKNOWN_BOARD].name, "unknown"); -- strcpy(cx25821_boards[CX25821_BOARD].name, "cx25821"); -- - if (dev->pci->device != 0x8210) { - pr_info("%s(): Exiting. Incorrect Hardware device = 0x%02x\n", - __func__, dev->pci->device); -diff --git a/drivers/media/video/cx25821/cx25821.h b/drivers/media/video/cx25821/cx25821.h -index 2d2d009..bf54360 100644 ---- a/drivers/media/video/cx25821/cx25821.h -+++ b/drivers/media/video/cx25821/cx25821.h -@@ -187,7 +187,7 @@ enum port { - }; - - struct cx25821_board { -- char *name; -+ const char *name; - enum port porta; - enum port portb; - enum port portc; diff --git a/drivers/media/video/cx88/cx88-alsa.c b/drivers/media/video/cx88/cx88-alsa.c index 68d1240..46b32eb 100644 --- a/drivers/media/video/cx88/cx88-alsa.c @@ -35154,10 +35151,10 @@ index ba168a7..399925d 100644 st_gdata->list[type]->reserve); /* next 2 required for BT only */ diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c -index 6878a94..fe5c5f1 100644 +index 83b51b5..ec2396c 100644 --- a/drivers/mmc/host/sdhci-pci.c +++ b/drivers/mmc/host/sdhci-pci.c -@@ -673,7 +673,7 @@ static const struct sdhci_pci_fixes sdhci_via = { +@@ -674,7 +674,7 @@ static const struct sdhci_pci_fixes sdhci_via = { .probe = via_probe, }; @@ -35748,7 +35745,7 @@ index 4a518a3..936b334 100644 #define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath) \ ((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next) diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c -index 9e61d6b..852f305 100644 +index ed1be8a..268eb7f 100644 --- a/drivers/net/ethernet/realtek/r8169.c +++ b/drivers/net/ethernet/realtek/r8169.c @@ -702,17 +702,17 @@ struct rtl8169_private { @@ -37064,7 +37061,7 @@ index 546d46b..642fa5b 100644 /* * Queue element to wait for room in request queue. FIFO order is diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c -index 351dc0b..951dc32 100644 +index ee77a58..af9d518 100644 --- a/drivers/scsi/hosts.c +++ b/drivers/scsi/hosts.c @@ -42,7 +42,7 @@ @@ -37076,7 +37073,7 @@ index 351dc0b..951dc32 100644 static void scsi_host_cls_release(struct device *dev) -@@ -357,7 +357,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize) +@@ -358,7 +358,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize) * subtract one because we increment first then return, but we need to * know what the next host number was before increment */ @@ -37726,7 +37723,7 @@ index 4169c8b..a8b896b 100644 ddb_entry->default_relogin_timeout = le16_to_cpu(ddb_entry->fw_ddb_entry.def_timeout); diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c -index 2aeb2e9..46e3925 100644 +index 831db24..aef1598 100644 --- a/drivers/scsi/scsi.c +++ b/drivers/scsi/scsi.c @@ -655,7 +655,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd) @@ -37739,10 +37736,10 @@ index 2aeb2e9..46e3925 100644 /* check if the device is still usable */ if (unlikely(cmd->device->sdev_state == SDEV_DEL)) { diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c -index f0ab58e..6146a3e 100644 +index 6c4b620..78feefb 100644 --- a/drivers/scsi/scsi_lib.c +++ b/drivers/scsi/scsi_lib.c -@@ -1419,7 +1419,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q) +@@ -1426,7 +1426,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q) shost = sdev->host; scsi_init_cmd_errh(cmd); cmd->result = DID_NO_CONNECT << 16; @@ -37751,7 +37748,7 @@ index f0ab58e..6146a3e 100644 /* * SCSI request completion path will do scsi_device_unbusy(), -@@ -1445,9 +1445,9 @@ static void scsi_softirq_done(struct request *rq) +@@ -1452,9 +1452,9 @@ static void scsi_softirq_done(struct request *rq) INIT_LIST_HEAD(&cmd->eh_entry); @@ -37764,7 +37761,7 @@ index f0ab58e..6146a3e 100644 disposition = scsi_decide_disposition(cmd); if (disposition != SUCCESS && diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c -index 04c2a27..9d8bd66 100644 +index bb7c482..7551a95 100644 --- a/drivers/scsi/scsi_sysfs.c +++ b/drivers/scsi/scsi_sysfs.c @@ -660,7 +660,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr, \ @@ -38338,10 +38335,10 @@ index ed147c4..94fc3c6 100644 /* core tmem accessor functions */ diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index 0842cc7..61d886d 100644 +index 2ff1255..fa7cfed 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c -@@ -1362,7 +1362,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf) +@@ -1351,7 +1351,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf) * outstanding_r2ts reaches zero, go ahead and send the delayed * TASK_ABORTED status. */ @@ -38382,7 +38379,7 @@ index 6845228..df77141 100644 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count); diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 5660916..f6dab21 100644 +index 94c03d2..741934e 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -1343,7 +1343,7 @@ struct se_device *transport_add_device_to_core_hba( @@ -38412,7 +38409,7 @@ index 5660916..f6dab21 100644 atomic_read(&cmd->t_task_cdbs_ex_left), atomic_read(&cmd->t_transport_active), atomic_read(&cmd->t_transport_stop), -@@ -2089,9 +2089,9 @@ check_depth: +@@ -2090,9 +2090,9 @@ check_depth: spin_lock_irqsave(&cmd->t_state_lock, flags); task->task_flags |= (TF_ACTIVE | TF_SENT); @@ -38424,7 +38421,7 @@ index 5660916..f6dab21 100644 cmd->t_task_list_num) atomic_set(&cmd->t_transport_sent, 1); -@@ -4297,7 +4297,7 @@ bool transport_wait_for_tasks(struct se_cmd *cmd) +@@ -4298,7 +4298,7 @@ bool transport_wait_for_tasks(struct se_cmd *cmd) atomic_set(&cmd->transport_lun_stop, 0); } if (!atomic_read(&cmd->t_transport_active) || @@ -38433,7 +38430,7 @@ index 5660916..f6dab21 100644 spin_unlock_irqrestore(&cmd->t_state_lock, flags); return false; } -@@ -4546,7 +4546,7 @@ int transport_check_aborted_status(struct se_cmd *cmd, int send_status) +@@ -4556,7 +4556,7 @@ int transport_check_aborted_status(struct se_cmd *cmd, int send_status) { int ret = 0; @@ -38442,7 +38439,7 @@ index 5660916..f6dab21 100644 if (!send_status || (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS)) return 1; -@@ -4583,7 +4583,7 @@ void transport_send_task_abort(struct se_cmd *cmd) +@@ -4593,7 +4593,7 @@ void transport_send_task_abort(struct se_cmd *cmd) */ if (cmd->data_direction == DMA_TO_DEVICE) { if (cmd->se_tfo->write_pending_status(cmd) != 0) { @@ -45487,7 +45484,7 @@ index a203892..4e64db5 100644 } return 1; diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c -index 914bf9e..531c3dd 100644 +index d6970f7..5362903 100644 --- a/fs/ext4/balloc.c +++ b/fs/ext4/balloc.c @@ -436,8 +436,8 @@ static int ext4_has_free_clusters(struct ext4_sb_info *sbi, @@ -45502,10 +45499,10 @@ index 914bf9e..531c3dd 100644 if (free_clusters >= (nclusters + dirty_clusters)) return 1; diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 7b1cd5c..6f5b317 100644 +index 8cb184c..09ff6c4 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h -@@ -1207,19 +1207,19 @@ struct ext4_sb_info { +@@ -1206,19 +1206,19 @@ struct ext4_sb_info { unsigned long s_mb_last_start; /* stats for buddy allocator */ @@ -47271,10 +47268,10 @@ index cfd4959..a780959 100644 kfree(s); } diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c -index ebc2f4d..eb1c5cd 100644 +index 0aa424a..f005659 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c -@@ -896,7 +896,7 @@ static struct file_system_type hugetlbfs_fs_type = { +@@ -897,7 +897,7 @@ static struct file_system_type hugetlbfs_fs_type = { .kill_sb = kill_litter_super, }; @@ -47404,36 +47401,9 @@ index 8392cb8..80d6193 100644 memcpy(c->data, &cookie, 4); c->len=4; diff --git a/fs/locks.c b/fs/locks.c -index 6a64f15..c3dacf2 100644 +index fcc50ab..c3dacf2 100644 --- a/fs/locks.c +++ b/fs/locks.c -@@ -308,7 +308,7 @@ static int flock_make_lock(struct file *filp, struct file_lock **lock, - return 0; - } - --static int assign_type(struct file_lock *fl, int type) -+static int assign_type(struct file_lock *fl, long type) - { - switch (type) { - case F_RDLCK: -@@ -445,7 +445,7 @@ static const struct lock_manager_operations lease_manager_ops = { - /* - * Initialize a lease, use the default lock manager operations - */ --static int lease_init(struct file *filp, int type, struct file_lock *fl) -+static int lease_init(struct file *filp, long type, struct file_lock *fl) - { - if (assign_type(fl, type) != 0) - return -EINVAL; -@@ -463,7 +463,7 @@ static int lease_init(struct file *filp, int type, struct file_lock *fl) - } - - /* Allocate a file_lock initialised to this type of lease */ --static struct file_lock *lease_alloc(struct file *filp, int type) -+static struct file_lock *lease_alloc(struct file *filp, long type) - { - struct file_lock *fl = locks_alloc_lock(); - int error = -ENOMEM; @@ -2075,16 +2075,16 @@ void locks_remove_flock(struct file *filp) return; @@ -61195,10 +61165,10 @@ index fd88a39..8a801b4 100644 }; diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h -index 0ed1eb0..3ab569b 100644 +index ff039f0..cdf89ae 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h -@@ -1315,7 +1315,7 @@ struct block_device_operations { +@@ -1316,7 +1316,7 @@ struct block_device_operations { /* this callback is with swap_lock and sometimes page table lock held */ void (*swap_slot_free_notify) (struct block_device *, unsigned long); struct module *owner; @@ -61499,19 +61469,6 @@ index 320d6c9..066b6d5 100644 +#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x)) #endif /* __LINUX_COMPILER_H */ -diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h -index e9eaec5..bfeb9bb 100644 ---- a/include/linux/cpuset.h -+++ b/include/linux/cpuset.h -@@ -118,7 +118,7 @@ static inline void put_mems_allowed(void) - * nodemask. - */ - smp_mb(); -- --ACCESS_ONCE(current->mems_allowed_change_disable); -+ --ACCESS_ONCE_RW(current->mems_allowed_change_disable); - } - - static inline void set_mems_allowed(nodemask_t nodemask) diff --git a/include/linux/crash_dump.h b/include/linux/crash_dump.h index b936763..48685ee 100644 --- a/include/linux/crash_dump.h @@ -61719,10 +61676,10 @@ index 84ccf8e..2e9b14c 100644 }; diff --git a/include/linux/fs.h b/include/linux/fs.h -index 43d36b7..e5575ee 100644 +index 29b6353..295eed1 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h -@@ -1614,7 +1614,8 @@ struct file_operations { +@@ -1618,7 +1618,8 @@ struct file_operations { int (*setlease)(struct file *, long, struct file_lock **); long (*fallocate)(struct file *file, int mode, loff_t offset, loff_t len); @@ -63088,10 +63045,10 @@ index 9146f39..e19693b 100644 void cleanup_module(void) __attribute__((alias(#exitfn))); diff --git a/include/linux/init_task.h b/include/linux/init_task.h -index 32574ee..00d4ef1 100644 +index df53fdf..3d0b4d3 100644 --- a/include/linux/init_task.h +++ b/include/linux/init_task.h -@@ -128,6 +128,12 @@ extern struct cred init_cred; +@@ -135,6 +135,12 @@ extern struct cred init_cred; #define INIT_TASK_COMM "swapper" @@ -63104,7 +63061,7 @@ index 32574ee..00d4ef1 100644 /* * INIT_TASK is used to set up the first task table, touch at * your own risk!. Base=0, limit=0x1fffff (=2MB) -@@ -166,6 +172,7 @@ extern struct cred init_cred; +@@ -173,6 +179,7 @@ extern struct cred init_cred; RCU_INIT_POINTER(.cred, &init_cred), \ .comm = INIT_TASK_COMM, \ .thread = INIT_THREAD, \ @@ -63520,7 +63477,7 @@ index 4baadd1..293e034 100644 #endif /* __KERNEL__ */ #endif /* _LINUX_MM_H */ diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h -index 5b42f1b..fdf1edb 100644 +index 5b42f1b..9782147 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -253,6 +253,8 @@ struct vm_area_struct { @@ -63546,7 +63503,7 @@ index 5b42f1b..fdf1edb 100644 struct cpumask cpumask_allocation; #endif + -+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_XATTR_PAX_FLAGS) || defined(CONFIG_PAX_HAVE_ACL_FLAGS) || defined(CONFIG_PAX_HOOK_ACL_FLAGS) ++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR) + unsigned long pax_flags; +#endif + @@ -63587,10 +63544,10 @@ index 1d1b1e1..2a13c78 100644 #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \ diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index 905b1e1..d401c76 100644 +index 25842b6..6e42df8 100644 --- a/include/linux/mmzone.h +++ b/include/linux/mmzone.h -@@ -369,7 +369,7 @@ struct zone { +@@ -371,7 +371,7 @@ struct zone { unsigned long flags; /* zone flags, see below */ /* Zone statistics */ @@ -64220,7 +64177,7 @@ index 2148b12..519b820 100644 static inline void anon_vma_merge(struct vm_area_struct *vma, diff --git a/include/linux/sched.h b/include/linux/sched.h -index 5afa2a3..d74a9b4 100644 +index d336c35..796b375 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -101,6 +101,7 @@ struct bio_list; @@ -64231,7 +64188,7 @@ index 5afa2a3..d74a9b4 100644 /* * List of flags we want to share for kernel threads, -@@ -380,10 +381,13 @@ struct user_namespace; +@@ -381,10 +382,13 @@ struct user_namespace; #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN) extern int sysctl_max_map_count; @@ -64245,7 +64202,7 @@ index 5afa2a3..d74a9b4 100644 extern void arch_pick_mmap_layout(struct mm_struct *mm); extern unsigned long arch_get_unmapped_area(struct file *, unsigned long, unsigned long, -@@ -402,6 +406,11 @@ static inline void arch_pick_mmap_layout(struct mm_struct *mm) {} +@@ -403,6 +407,11 @@ static inline void arch_pick_mmap_layout(struct mm_struct *mm) {} extern void set_dumpable(struct mm_struct *mm, int value); extern int get_dumpable(struct mm_struct *mm); @@ -64257,7 +64214,7 @@ index 5afa2a3..d74a9b4 100644 /* mm flags */ /* dumpable bits */ #define MMF_DUMPABLE 0 /* core dump is permitted */ -@@ -629,6 +638,17 @@ struct signal_struct { +@@ -630,6 +639,17 @@ struct signal_struct { #ifdef CONFIG_TASKSTATS struct taskstats *stats; #endif @@ -64275,7 +64232,7 @@ index 5afa2a3..d74a9b4 100644 #ifdef CONFIG_AUDIT unsigned audit_tty; struct tty_audit_buf *tty_audit_buf; -@@ -710,6 +730,11 @@ struct user_struct { +@@ -711,6 +731,11 @@ struct user_struct { struct key *session_keyring; /* UID's default session keyring */ #endif @@ -64287,7 +64244,7 @@ index 5afa2a3..d74a9b4 100644 /* Hash table maintenance information */ struct hlist_node uidhash_node; uid_t uid; -@@ -1337,8 +1362,8 @@ struct task_struct { +@@ -1338,8 +1363,8 @@ struct task_struct { struct list_head thread_group; struct completion *vfork_done; /* for vfork() */ @@ -64298,7 +64255,7 @@ index 5afa2a3..d74a9b4 100644 cputime_t utime, stime, utimescaled, stimescaled; cputime_t gtime; -@@ -1354,13 +1379,6 @@ struct task_struct { +@@ -1355,13 +1380,6 @@ struct task_struct { struct task_cputime cputime_expires; struct list_head cpu_timers[3]; @@ -64312,7 +64269,7 @@ index 5afa2a3..d74a9b4 100644 char comm[TASK_COMM_LEN]; /* executable name excluding path - access with [gs]et_task_comm (which lock it with task_lock()) -@@ -1377,8 +1395,16 @@ struct task_struct { +@@ -1378,8 +1396,16 @@ struct task_struct { #endif /* CPU-specific state of this task */ struct thread_struct thread; @@ -64329,7 +64286,7 @@ index 5afa2a3..d74a9b4 100644 /* open file information */ struct files_struct *files; /* namespaces */ -@@ -1425,6 +1451,11 @@ struct task_struct { +@@ -1426,6 +1452,11 @@ struct task_struct { struct rt_mutex_waiter *pi_blocked_on; #endif @@ -64341,7 +64298,7 @@ index 5afa2a3..d74a9b4 100644 #ifdef CONFIG_DEBUG_MUTEXES /* mutex deadlock detection */ struct mutex_waiter *blocked_on; -@@ -1540,6 +1571,27 @@ struct task_struct { +@@ -1541,6 +1572,27 @@ struct task_struct { unsigned long default_timer_slack_ns; struct list_head *scm_work_list; @@ -64369,7 +64326,7 @@ index 5afa2a3..d74a9b4 100644 #ifdef CONFIG_FUNCTION_GRAPH_TRACER /* Index of current stored address in ret_stack */ int curr_ret_stack; -@@ -1574,6 +1626,51 @@ struct task_struct { +@@ -1575,6 +1627,51 @@ struct task_struct { #endif }; @@ -64421,7 +64378,7 @@ index 5afa2a3..d74a9b4 100644 /* Future-safe accessor for struct task_struct's cpus_allowed. */ #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed) -@@ -2089,7 +2186,9 @@ void yield(void); +@@ -2090,7 +2187,9 @@ void yield(void); extern struct exec_domain default_exec_domain; union thread_union { @@ -64431,7 +64388,7 @@ index 5afa2a3..d74a9b4 100644 unsigned long stack[THREAD_SIZE/sizeof(long)]; }; -@@ -2122,6 +2221,7 @@ extern struct pid_namespace init_pid_ns; +@@ -2123,6 +2222,7 @@ extern struct pid_namespace init_pid_ns; */ extern struct task_struct *find_task_by_vpid(pid_t nr); @@ -64439,7 +64396,7 @@ index 5afa2a3..d74a9b4 100644 extern struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns); -@@ -2243,6 +2343,12 @@ static inline void mmdrop(struct mm_struct * mm) +@@ -2244,6 +2344,12 @@ static inline void mmdrop(struct mm_struct * mm) extern void mmput(struct mm_struct *); /* Grab a reference to a task's mm, if it is not already going away */ extern struct mm_struct *get_task_mm(struct task_struct *task); @@ -64452,7 +64409,7 @@ index 5afa2a3..d74a9b4 100644 /* Remove the current tasks stale references to the old mm_struct */ extern void mm_release(struct task_struct *, struct mm_struct *); /* Allocate a new mm structure and copy contents from tsk->mm */ -@@ -2259,7 +2365,7 @@ extern void __cleanup_sighand(struct sighand_struct *); +@@ -2260,7 +2366,7 @@ extern void __cleanup_sighand(struct sighand_struct *); extern void exit_itimers(struct signal_struct *); extern void flush_itimer_signals(void); @@ -64461,7 +64418,7 @@ index 5afa2a3..d74a9b4 100644 extern void daemonize(const char *, ...); extern int allow_signal(int); -@@ -2424,9 +2530,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p) +@@ -2425,9 +2531,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p) #endif @@ -65827,10 +65784,10 @@ index 444cd6b..3327cc5 100644 const struct firmware *dsp_microcode; const struct firmware *controller_microcode; diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index 94bbec3..3a8c6b0 100644 +index 6ee550e..4793a65 100644 --- a/include/target/target_core_base.h +++ b/include/target/target_core_base.h -@@ -346,7 +346,7 @@ struct t10_reservation_ops { +@@ -347,7 +347,7 @@ struct t10_reservation_ops { int (*t10_seq_non_holder)(struct se_cmd *, unsigned char *, u32); int (*t10_pr_register)(struct se_cmd *); int (*t10_pr_clear)(struct se_cmd *); @@ -65839,7 +65796,7 @@ index 94bbec3..3a8c6b0 100644 struct t10_reservation { /* Reservation effects all target ports */ -@@ -465,8 +465,8 @@ struct se_cmd { +@@ -466,8 +466,8 @@ struct se_cmd { atomic_t t_se_count; atomic_t t_task_cdbs_left; atomic_t t_task_cdbs_ex_left; @@ -65850,7 +65807,7 @@ index 94bbec3..3a8c6b0 100644 atomic_t t_transport_active; atomic_t t_transport_complete; atomic_t t_transport_queue_active; -@@ -705,7 +705,7 @@ struct se_device { +@@ -706,7 +706,7 @@ struct se_device { /* Active commands on this virtual SE device */ atomic_t simple_cmds; atomic_t depth_left; @@ -67372,7 +67329,7 @@ index 5a8a66e..ded4680 100644 { struct signal_struct *sig = current->signal; diff --git a/kernel/fork.c b/kernel/fork.c -index 79ee71f..5662f54 100644 +index 222457a..ecd0db4 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -270,19 +270,24 @@ static struct task_struct *dup_task_struct(struct task_struct *orig) @@ -67654,7 +67611,7 @@ index 79ee71f..5662f54 100644 return 0; } -@@ -1102,6 +1165,9 @@ static struct task_struct *copy_process(unsigned long clone_flags, +@@ -1105,6 +1168,9 @@ static struct task_struct *copy_process(unsigned long clone_flags, DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled); #endif retval = -EAGAIN; @@ -67664,7 +67621,7 @@ index 79ee71f..5662f54 100644 if (atomic_read(&p->real_cred->user->processes) >= task_rlimit(p, RLIMIT_NPROC)) { if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) && -@@ -1318,6 +1384,9 @@ static struct task_struct *copy_process(unsigned long clone_flags, +@@ -1321,6 +1387,9 @@ static struct task_struct *copy_process(unsigned long clone_flags, /* Need tasklist lock for parent etc handling! */ write_lock_irq(&tasklist_lock); @@ -67674,7 +67631,7 @@ index 79ee71f..5662f54 100644 /* CLONE_PARENT re-uses the old parent */ if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) { p->real_parent = current->real_parent; -@@ -1425,6 +1494,8 @@ bad_fork_cleanup_count: +@@ -1428,6 +1497,8 @@ bad_fork_cleanup_count: bad_fork_free: free_task(p); fork_out: @@ -67683,7 +67640,7 @@ index 79ee71f..5662f54 100644 return ERR_PTR(retval); } -@@ -1525,6 +1596,8 @@ long do_fork(unsigned long clone_flags, +@@ -1528,6 +1599,8 @@ long do_fork(unsigned long clone_flags, if (clone_flags & CLONE_PARENT_SETTID) put_user(nr, parent_tidptr); @@ -67692,7 +67649,7 @@ index 79ee71f..5662f54 100644 if (clone_flags & CLONE_VFORK) { p->vfork_done = &vfork; init_completion(&vfork); -@@ -1634,7 +1707,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp) +@@ -1637,7 +1710,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp) return 0; /* don't need lock here; in the worst case we'll do useless copy */ @@ -67701,7 +67658,7 @@ index 79ee71f..5662f54 100644 return 0; *new_fsp = copy_fs_struct(fs); -@@ -1723,7 +1796,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags) +@@ -1726,7 +1799,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags) fs = current->fs; spin_lock(&fs->lock); current->fs = new_fs; @@ -67712,7 +67669,7 @@ index 79ee71f..5662f54 100644 else new_fs = fs; diff --git a/kernel/futex.c b/kernel/futex.c -index 866c9d5..5c5f828 100644 +index 866c9d5..31751ff 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -54,6 +54,7 @@ @@ -67735,7 +67692,43 @@ index 866c9d5..5c5f828 100644 /* * The futex address must be "naturally" aligned. */ -@@ -2721,6 +2727,7 @@ static int __init futex_init(void) +@@ -2231,11 +2237,11 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb, + * @uaddr2: the pi futex we will take prior to returning to user-space + * + * The caller will wait on uaddr and will be requeued by futex_requeue() to +- * uaddr2 which must be PI aware. Normal wakeup will wake on uaddr2 and +- * complete the acquisition of the rt_mutex prior to returning to userspace. +- * This ensures the rt_mutex maintains an owner when it has waiters; without +- * one, the pi logic wouldn't know which task to boost/deboost, if there was a +- * need to. ++ * uaddr2 which must be PI aware and unique from uaddr. Normal wakeup will wake ++ * on uaddr2 and complete the acquisition of the rt_mutex prior to returning to ++ * userspace. This ensures the rt_mutex maintains an owner when it has waiters; ++ * without one, the pi logic would not know which task to boost/deboost, if ++ * there was a need to. + * + * We call schedule in futex_wait_queue_me() when we enqueue and return there + * via the following: +@@ -2272,6 +2278,9 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, + struct futex_q q = futex_q_init; + int res, ret; + ++ if (uaddr == uaddr2) ++ return -EINVAL; ++ + if (!bitset) + return -EINVAL; + +@@ -2370,7 +2379,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, + * fault, unlock the rt_mutex and return the fault to userspace. + */ + if (ret == -EFAULT) { +- if (rt_mutex_owner(pi_mutex) == current) ++ if (pi_mutex && rt_mutex_owner(pi_mutex) == current) + rt_mutex_unlock(pi_mutex); + } else if (ret == -EINTR) { + /* +@@ -2721,6 +2730,7 @@ static int __init futex_init(void) { u32 curval; int i; @@ -67743,7 +67736,7 @@ index 866c9d5..5c5f828 100644 /* * This will fail and we want it. Some arch implementations do -@@ -2732,8 +2739,11 @@ static int __init futex_init(void) +@@ -2732,8 +2742,11 @@ static int __init futex_init(void) * implementation, the non-functional ones will return * -ENOSYS. */ @@ -67829,7 +67822,7 @@ index 66ff710..794bc5a 100644 static int diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c -index 079f1d3..5299c80 100644 +index 079f1d3..d712c9c 100644 --- a/kernel/kallsyms.c +++ b/kernel/kallsyms.c @@ -11,6 +11,9 @@ @@ -67925,22 +67918,15 @@ index 079f1d3..5299c80 100644 /* Some debugging symbols have no name. Ignore them. */ if (!iter->name[0]) return 0; -@@ -515,8 +558,14 @@ static int s_show(struct seq_file *m, void *p) +@@ -515,6 +558,7 @@ static int s_show(struct seq_file *m, void *p) */ type = iter->exported ? toupper(iter->type) : tolower(iter->type); + -+#ifdef CONFIG_GRKERNSEC_HIDESYM -+ seq_printf(m, "%pP %c %s\t[%s]\n", (void *)iter->value, -+ type, iter->name, iter->module_name); -+#else seq_printf(m, "%pK %c %s\t[%s]\n", (void *)iter->value, type, iter->name, iter->module_name); -+#endif } else - seq_printf(m, "%pK %c %s\n", (void *)iter->value, - iter->type, iter->name); -@@ -540,7 +589,7 @@ static int kallsyms_open(struct inode *inode, struct file *file) +@@ -540,7 +584,7 @@ static int kallsyms_open(struct inode *inode, struct file *file) struct kallsym_iter *iter; int ret; @@ -70065,10 +70051,10 @@ index 3d9f31c..7fefc9e 100644 default: diff --git a/kernel/sched.c b/kernel/sched.c -index 52ac69b..b102f7f 100644 +index 9cd8ca7..e73caba 100644 --- a/kernel/sched.c +++ b/kernel/sched.c -@@ -5227,6 +5227,8 @@ int can_nice(const struct task_struct *p, const int nice) +@@ -5287,6 +5287,8 @@ int can_nice(const struct task_struct *p, const int nice) /* convert nice value [19,-20] to rlimit style value [1,40] */ int nice_rlim = 20 - nice; @@ -70077,7 +70063,7 @@ index 52ac69b..b102f7f 100644 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) || capable(CAP_SYS_NICE)); } -@@ -5260,7 +5262,8 @@ SYSCALL_DEFINE1(nice, int, increment) +@@ -5320,7 +5322,8 @@ SYSCALL_DEFINE1(nice, int, increment) if (nice > 19) nice = 19; @@ -70087,7 +70073,7 @@ index 52ac69b..b102f7f 100644 return -EPERM; retval = security_task_setnice(current, nice); -@@ -5417,6 +5420,7 @@ recheck: +@@ -5477,6 +5480,7 @@ recheck: unsigned long rlim_rtprio = task_rlimit(p, RLIMIT_RTPRIO); @@ -70118,7 +70104,7 @@ index 429242f..d7cca82 100644 #ifdef CONFIG_RT_GROUP_SCHED /* diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c -index 8a39fa3..34f3dbc 100644 +index 66e4576..d05c6d5 100644 --- a/kernel/sched_fair.c +++ b/kernel/sched_fair.c @@ -4801,7 +4801,7 @@ static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle) { } @@ -71581,7 +71567,7 @@ index d9df745..e73c2fe 100644 static inline void *ptr_to_indirect(void *ptr) { diff --git a/lib/vsprintf.c b/lib/vsprintf.c -index 993599e..9b1cb1f 100644 +index 993599e..24690ac 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -16,6 +16,9 @@ @@ -71682,7 +71668,7 @@ index 993599e..9b1cb1f 100644 if (spec.field_width == -1) spec.field_width = 2 * sizeof(void *); return string(buf, end, "pK-error", spec); -@@ -897,6 +922,19 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, +@@ -897,6 +922,21 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, ptr = NULL; break; } @@ -71691,8 +71677,10 @@ index 993599e..9b1cb1f 100644 + /* 'P' = approved pointers to copy to userland, + as in the /proc/kallsyms case, as we make it display nothing + for non-root users, and the real contents for root users ++ Also ignore 'K' pointers, since we force their NULLing for non-root users ++ above + */ -+ if (ptr > TASK_SIZE && *fmt != 'P' && is_usercopy_object(buf)) { ++ if (ptr > TASK_SIZE && *fmt != 'P' && *fmt != 'K' && is_usercopy_object(buf)) { + printk(KERN_ALERT "grsec: kernel infoleak detected! Please report this log to spender@grsecurity.net.\n"); + dump_stack(); + ptr = NULL; @@ -71702,7 +71690,7 @@ index 993599e..9b1cb1f 100644 spec.flags |= SMALL; if (spec.field_width == -1) { spec.field_width = 2 * sizeof(void *); -@@ -1608,11 +1646,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf) +@@ -1608,11 +1648,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf) typeof(type) value; \ if (sizeof(type) == 8) { \ args = PTR_ALIGN(args, sizeof(u32)); \ @@ -71717,7 +71705,7 @@ index 993599e..9b1cb1f 100644 } \ args += sizeof(type); \ value; \ -@@ -1675,7 +1713,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf) +@@ -1675,7 +1715,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf) case FORMAT_TYPE_STR: { const char *str_arg = args; args += strlen(str_arg) + 1; @@ -71761,10 +71749,10 @@ index 011b110..fad8776 100644 config NOMMU_INITIAL_TRIM_EXCESS diff --git a/mm/filemap.c b/mm/filemap.c -index 03c5b0e..a01e793 100644 +index 556858c..ec09758 100644 --- a/mm/filemap.c +++ b/mm/filemap.c -@@ -1770,7 +1770,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma) +@@ -1773,7 +1773,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma) struct address_space *mapping = file->f_mapping; if (!mapping->a_ops->readpage) @@ -71773,7 +71761,7 @@ index 03c5b0e..a01e793 100644 file_accessed(file); vma->vm_ops = &generic_file_vm_ops; vma->vm_flags |= VM_CAN_NONLINEAR; -@@ -2176,6 +2176,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i +@@ -2179,6 +2179,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i *pos = i_size_read(inode); if (limit != RLIM_INFINITY) { @@ -71840,10 +71828,10 @@ index 8f005e9..1cb1036 100644 /* if an huge pmd materialized from under us just retry later */ if (unlikely(pmd_trans_huge(*pmd))) diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 7c535b0..1a2d14f 100644 +index b1e1bad..597b8ba 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c -@@ -2435,6 +2435,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2442,6 +2442,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma, return 1; } @@ -71871,7 +71859,7 @@ index 7c535b0..1a2d14f 100644 /* * Hugetlb_cow() should be called with page lock of the original hugepage held. */ -@@ -2537,6 +2558,11 @@ retry_avoidcopy: +@@ -2544,6 +2565,11 @@ retry_avoidcopy: make_huge_pte(vma, new_page, 1)); page_remove_rmap(old_page); hugepage_add_new_anon_rmap(new_page, vma, address); @@ -71883,7 +71871,7 @@ index 7c535b0..1a2d14f 100644 /* Make the old page be freed below */ new_page = old_page; mmu_notifier_invalidate_range_end(mm, -@@ -2688,6 +2714,10 @@ retry: +@@ -2695,6 +2721,10 @@ retry: && (vma->vm_flags & VM_SHARED))); set_huge_pte_at(mm, address, ptep, new_pte); @@ -71894,7 +71882,7 @@ index 7c535b0..1a2d14f 100644 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) { /* Optimization, do the COW without a second fault */ ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page); -@@ -2717,6 +2747,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2724,6 +2754,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, static DEFINE_MUTEX(hugetlb_instantiation_mutex); struct hstate *h = hstate_vma(vma); @@ -71905,7 +71893,7 @@ index 7c535b0..1a2d14f 100644 ptep = huge_pte_offset(mm, address); if (ptep) { entry = huge_ptep_get(ptep); -@@ -2728,6 +2762,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2735,6 +2769,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, VM_FAULT_SET_HINDEX(h - hstates); } @@ -72060,7 +72048,7 @@ index 23d3a6b..e10d35a 100644 if (end == start) goto out; diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index 06d3479..0778eef 100644 +index 5bd5bb1..2da9ddb 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -61,7 +61,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0; @@ -72789,7 +72777,7 @@ index 1b1ca17..e6715dd 100644 * Make sure the vDSO gets into every core dump. * Dumping its contents makes post-mortem fully interpretable later diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index b26aae2..1b0ae04 100644 +index c0007f9..cb6461b 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -640,6 +640,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, @@ -72864,10 +72852,10 @@ index b26aae2..1b0ae04 100644 err = -EPERM; goto out; diff --git a/mm/migrate.c b/mm/migrate.c -index 177aca4..ab3a744 100644 +index 180d97f..c75ef28 100644 --- a/mm/migrate.c +++ b/mm/migrate.c -@@ -1313,6 +1313,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages, +@@ -1376,6 +1376,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages, if (!mm) return -EINVAL; @@ -72882,7 +72870,7 @@ index 177aca4..ab3a744 100644 /* * Check if this process has the right to modify the specified * process. The right exists if the process has administrative -@@ -1322,8 +1330,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages, +@@ -1385,8 +1393,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages, rcu_read_lock(); tcred = __task_cred(task); if (cred->euid != tcred->suid && cred->euid != tcred->uid && @@ -74723,7 +74711,7 @@ index f59e170..34e2a2b 100644 new->vm_region = region; diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 485be89..c059ad3 100644 +index 065dbe8..2a2e9e4 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -341,7 +341,7 @@ out: @@ -74770,7 +74758,7 @@ index 485be89..c059ad3 100644 if (order && (gfp_flags & __GFP_COMP)) prep_compound_page(page, order); -@@ -3357,7 +3369,13 @@ static int pageblock_is_reserved(unsigned long start_pfn, unsigned long end_pfn) +@@ -3395,7 +3407,13 @@ static int pageblock_is_reserved(unsigned long start_pfn, unsigned long end_pfn) unsigned long pfn; for (pfn = start_pfn; pfn < end_pfn; pfn++) { @@ -74996,7 +74984,7 @@ index 7a82174..75d1c8b 100644 return -ENOMEM; diff --git a/mm/slab.c b/mm/slab.c -index 83311c9a..2449631 100644 +index cd3ab93..3f69d65 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -151,7 +151,7 @@ @@ -75123,7 +75111,7 @@ index 83311c9a..2449631 100644 sizes++; names++; } -@@ -4322,10 +4339,10 @@ static int s_show(struct seq_file *m, void *p) +@@ -4325,10 +4342,10 @@ static int s_show(struct seq_file *m, void *p) } /* cpu stats */ { @@ -75138,7 +75126,7 @@ index 83311c9a..2449631 100644 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu", allochit, allocmiss, freehit, freemiss); -@@ -4584,13 +4601,68 @@ static int __init slab_proc_init(void) +@@ -4587,13 +4604,68 @@ static int __init slab_proc_init(void) { proc_create("slabinfo",S_IWUSR|S_IRUSR,NULL,&proc_slabinfo_operations); #ifdef CONFIG_DEBUG_SLAB_LEAK @@ -75556,7 +75544,7 @@ index 8105be4..3c15e57 100644 EXPORT_SYMBOL(kmem_cache_free); diff --git a/mm/slub.c b/mm/slub.c -index af47188..9c2d9c0 100644 +index 5710788..5d74db8 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -208,7 +208,7 @@ struct track { @@ -75577,7 +75565,7 @@ index af47188..9c2d9c0 100644 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid); #ifdef CONFIG_STACKTRACE { -@@ -2562,6 +2562,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x) +@@ -2572,6 +2572,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x) page = virt_to_head_page(x); @@ -75586,7 +75574,7 @@ index af47188..9c2d9c0 100644 slab_free(s, page, x, _RET_IP_); trace_kmem_cache_free(_RET_IP_, x); -@@ -2595,7 +2597,7 @@ static int slub_min_objects; +@@ -2605,7 +2607,7 @@ static int slub_min_objects; * Merge control. If this is set then no merging of slab caches will occur. * (Could be removed. This was introduced to pacify the merge skeptics.) */ @@ -75595,7 +75583,7 @@ index af47188..9c2d9c0 100644 /* * Calculate the order of allocation given an slab object size. -@@ -3045,7 +3047,7 @@ static int kmem_cache_open(struct kmem_cache *s, +@@ -3055,7 +3057,7 @@ static int kmem_cache_open(struct kmem_cache *s, else s->cpu_partial = 30; @@ -75604,7 +75592,7 @@ index af47188..9c2d9c0 100644 #ifdef CONFIG_NUMA s->remote_node_defrag_ratio = 1000; #endif -@@ -3149,8 +3151,7 @@ static inline int kmem_cache_close(struct kmem_cache *s) +@@ -3159,8 +3161,7 @@ static inline int kmem_cache_close(struct kmem_cache *s) void kmem_cache_destroy(struct kmem_cache *s) { down_write(&slub_lock); @@ -75614,7 +75602,7 @@ index af47188..9c2d9c0 100644 list_del(&s->list); up_write(&slub_lock); if (kmem_cache_close(s)) { -@@ -3179,6 +3180,10 @@ static struct kmem_cache *kmem_cache; +@@ -3189,6 +3190,10 @@ static struct kmem_cache *kmem_cache; static struct kmem_cache *kmalloc_dma_caches[SLUB_PAGE_SHIFT]; #endif @@ -75625,7 +75613,7 @@ index af47188..9c2d9c0 100644 static int __init setup_slub_min_order(char *str) { get_option(&str, &slub_min_order); -@@ -3293,6 +3298,13 @@ static struct kmem_cache *get_slab(size_t size, gfp_t flags) +@@ -3303,6 +3308,13 @@ static struct kmem_cache *get_slab(size_t size, gfp_t flags) return kmalloc_dma_caches[index]; #endif @@ -75639,7 +75627,7 @@ index af47188..9c2d9c0 100644 return kmalloc_caches[index]; } -@@ -3361,6 +3373,56 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node) +@@ -3371,6 +3383,56 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node) EXPORT_SYMBOL(__kmalloc_node); #endif @@ -75696,7 +75684,7 @@ index af47188..9c2d9c0 100644 size_t ksize(const void *object) { struct page *page; -@@ -3635,7 +3697,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s) +@@ -3645,7 +3707,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s) int node; list_add(&s->list, &slab_caches); @@ -75705,7 +75693,7 @@ index af47188..9c2d9c0 100644 for_each_node_state(node, N_NORMAL_MEMORY) { struct kmem_cache_node *n = get_node(s, node); -@@ -3752,17 +3814,17 @@ void __init kmem_cache_init(void) +@@ -3762,17 +3824,17 @@ void __init kmem_cache_init(void) /* Caches that are not of the two-to-the-power-of size */ if (KMALLOC_MIN_SIZE <= 32) { @@ -75726,7 +75714,7 @@ index af47188..9c2d9c0 100644 caches++; } -@@ -3804,6 +3866,22 @@ void __init kmem_cache_init(void) +@@ -3814,6 +3876,22 @@ void __init kmem_cache_init(void) } } #endif @@ -75749,7 +75737,7 @@ index af47188..9c2d9c0 100644 printk(KERN_INFO "SLUB: Genslabs=%d, HWalign=%d, Order=%d-%d, MinObjects=%d," " CPUs=%d, Nodes=%d\n", -@@ -3830,7 +3908,7 @@ static int slab_unmergeable(struct kmem_cache *s) +@@ -3840,7 +3918,7 @@ static int slab_unmergeable(struct kmem_cache *s) /* * We may have set a slab to be unmergeable during bootstrap. */ @@ -75758,7 +75746,7 @@ index af47188..9c2d9c0 100644 return 1; return 0; -@@ -3889,7 +3967,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size, +@@ -3899,7 +3977,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size, down_write(&slub_lock); s = find_mergeable(size, align, flags, name, ctor); if (s) { @@ -75767,7 +75755,7 @@ index af47188..9c2d9c0 100644 /* * Adjust the object sizes so that we clear * the complete object on kzalloc. -@@ -3898,7 +3976,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size, +@@ -3908,7 +3986,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size, s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *))); if (sysfs_slab_alias(s, name)) { @@ -75776,7 +75764,7 @@ index af47188..9c2d9c0 100644 goto err; } up_write(&slub_lock); -@@ -4027,7 +4105,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags, +@@ -4037,7 +4115,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags, } #endif @@ -75785,7 +75773,7 @@ index af47188..9c2d9c0 100644 static int count_inuse(struct page *page) { return page->inuse; -@@ -4414,12 +4492,12 @@ static void resiliency_test(void) +@@ -4424,12 +4502,12 @@ static void resiliency_test(void) validate_slab_cache(kmalloc_caches[9]); } #else @@ -75800,7 +75788,7 @@ index af47188..9c2d9c0 100644 enum slab_stat_type { SL_ALL, /* All slabs */ SL_PARTIAL, /* Only partially allocated slabs */ -@@ -4660,7 +4738,7 @@ SLAB_ATTR_RO(ctor); +@@ -4670,7 +4748,7 @@ SLAB_ATTR_RO(ctor); static ssize_t aliases_show(struct kmem_cache *s, char *buf) { @@ -75809,7 +75797,7 @@ index af47188..9c2d9c0 100644 } SLAB_ATTR_RO(aliases); -@@ -5227,6 +5305,7 @@ static char *create_unique_id(struct kmem_cache *s) +@@ -5237,6 +5315,7 @@ static char *create_unique_id(struct kmem_cache *s) return name; } @@ -75817,7 +75805,7 @@ index af47188..9c2d9c0 100644 static int sysfs_slab_add(struct kmem_cache *s) { int err; -@@ -5289,6 +5368,7 @@ static void sysfs_slab_remove(struct kmem_cache *s) +@@ -5299,6 +5378,7 @@ static void sysfs_slab_remove(struct kmem_cache *s) kobject_del(&s->kobj); kobject_put(&s->kobj); } @@ -75825,7 +75813,7 @@ index af47188..9c2d9c0 100644 /* * Need to buffer aliases during bootup until sysfs becomes -@@ -5302,6 +5382,7 @@ struct saved_alias { +@@ -5312,6 +5392,7 @@ struct saved_alias { static struct saved_alias *alias_list; @@ -75833,7 +75821,7 @@ index af47188..9c2d9c0 100644 static int sysfs_slab_alias(struct kmem_cache *s, const char *name) { struct saved_alias *al; -@@ -5324,6 +5405,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name) +@@ -5334,6 +5415,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name) alias_list = al; return 0; } @@ -78634,7 +78622,7 @@ index aa2d720..d8aa111 100644 } diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c -index 1d15193..1062656 100644 +index 1d15193..257c9255 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -1485,6 +1485,10 @@ err_proto: @@ -78653,7 +78641,7 @@ index 1d15193..1062656 100644 } +#ifdef CONFIG_GRKERNSEC_HIDESYM -+ net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%08lx", atomic_inc_return(&conntrack_cache_id)); ++ net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%08lx", atomic_inc_return_unchecked(&conntrack_cache_id)); +#else net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net); +#endif diff --git a/3.2.24/4430_grsec-remove-localversion-grsec.patch b/3.2.26/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/3.2.24/4430_grsec-remove-localversion-grsec.patch +++ b/3.2.26/4430_grsec-remove-localversion-grsec.patch diff --git a/3.2.24/4435_grsec-mute-warnings.patch b/3.2.26/4435_grsec-mute-warnings.patch index e85abd6..e85abd6 100644 --- a/3.2.24/4435_grsec-mute-warnings.patch +++ b/3.2.26/4435_grsec-mute-warnings.patch diff --git a/3.2.24/4440_grsec-remove-protected-paths.patch b/3.2.26/4440_grsec-remove-protected-paths.patch index 637934a..637934a 100644 --- a/3.2.24/4440_grsec-remove-protected-paths.patch +++ b/3.2.26/4440_grsec-remove-protected-paths.patch diff --git a/3.2.24/4450_grsec-kconfig-default-gids.patch b/3.2.26/4450_grsec-kconfig-default-gids.patch index 0ab1250..0ab1250 100644 --- a/3.2.24/4450_grsec-kconfig-default-gids.patch +++ b/3.2.26/4450_grsec-kconfig-default-gids.patch diff --git a/3.2.24/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.26/4465_selinux-avc_audit-log-curr_ip.patch index 48acad7..48acad7 100644 --- a/3.2.24/4465_selinux-avc_audit-log-curr_ip.patch +++ b/3.2.26/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/3.2.24/4470_disable-compat_vdso.patch b/3.2.26/4470_disable-compat_vdso.patch index 4742d01..4742d01 100644 --- a/3.2.24/4470_disable-compat_vdso.patch +++ b/3.2.26/4470_disable-compat_vdso.patch diff --git a/3.4.7/0000_README b/3.5.0/0000_README index fd852d4..257b967 100644 --- a/3.4.7/0000_README +++ b/3.5.0/0000_README @@ -2,7 +2,7 @@ README ----------------------------------------------------------------------------- Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 4420_grsecurity-2.9.1-3.4.7-201208011850.patch +Patch: 4420_grsecurity-2.9.1-3.5.0-201208062017.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/3.4.7/4420_grsecurity-2.9.1-3.4.7-201208011850.patch b/3.5.0/4420_grsecurity-2.9.1-3.5.0-201208062017.patch index 23880cf..6efae83 100644 --- a/3.4.7/4420_grsecurity-2.9.1-3.4.7-201208011850.patch +++ b/3.5.0/4420_grsecurity-2.9.1-3.5.0-201208062017.patch @@ -1,5 +1,5 @@ diff --git a/Documentation/dontdiff b/Documentation/dontdiff -index b4a898f..781c7ad 100644 +index b4a898f..cd023f2 100644 --- a/Documentation/dontdiff +++ b/Documentation/dontdiff @@ -2,9 +2,11 @@ @@ -145,15 +145,16 @@ index b4a898f..781c7ad 100644 mkprep mkregtable mktables -@@ -188,6 +207,7 @@ oui.c* +@@ -188,6 +207,8 @@ oui.c* page-types parse.c parse.h +parse-events* ++pasyms.h patches* pca200e.bin pca200e_ecd.bin2 -@@ -197,6 +217,7 @@ perf-archive +@@ -197,6 +218,7 @@ perf-archive piggyback piggy.gzip piggy.S @@ -161,15 +162,18 @@ index b4a898f..781c7ad 100644 pnmtologo ppc_defs.h* pss_boot.h -@@ -207,6 +228,7 @@ r300_reg_safe.h +@@ -206,7 +228,10 @@ r200_reg_safe.h + r300_reg_safe.h r420_reg_safe.h r600_reg_safe.h ++realmode.lds ++realmode.relocs recordmcount +regdb.c relocs rlim_names.h rn50_reg_safe.h -@@ -216,7 +238,9 @@ series +@@ -216,8 +241,11 @@ series setup setup.bin setup.elf @@ -177,9 +181,11 @@ index b4a898f..781c7ad 100644 sImage +slabinfo sm_tbl* ++sortextable split-include syscalltab.h -@@ -227,6 +251,7 @@ tftpboot.img + tables.c +@@ -227,6 +255,7 @@ tftpboot.img timeconst.h times.h* trix_boot.h @@ -187,7 +193,7 @@ index b4a898f..781c7ad 100644 utsrelease.h* vdso-syms.lds vdso.lds -@@ -238,13 +263,17 @@ vdso32.lds +@@ -238,13 +267,17 @@ vdso32.lds vdso32.so.dbg vdso64.lds vdso64.so.dbg @@ -205,7 +211,7 @@ index b4a898f..781c7ad 100644 vmlinuz voffset.h vsyscall.lds -@@ -252,9 +281,11 @@ vsyscall_32.lds +@@ -252,9 +285,11 @@ vsyscall_32.lds wanxlfw.inc uImage unifdef @@ -218,10 +224,10 @@ index b4a898f..781c7ad 100644 +zconf.lex.c zoffset.h diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index c1601e5..08557ce 100644 +index a92c5eb..7530459 100644 --- a/Documentation/kernel-parameters.txt +++ b/Documentation/kernel-parameters.txt -@@ -2021,6 +2021,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted. +@@ -2051,6 +2051,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted. the specified number of seconds. This is to be used if your oopses keep scrolling off the screen. @@ -236,7 +242,7 @@ index c1601e5..08557ce 100644 pcd. [PARIDE] diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt -index 88fd7f5..b318a78 100644 +index 13d6166..8c235b6 100644 --- a/Documentation/sysctl/fs.txt +++ b/Documentation/sysctl/fs.txt @@ -163,16 +163,22 @@ This value can be used to query and set the core dump mode for setuid @@ -269,10 +275,10 @@ index 88fd7f5..b318a78 100644 ============================================================== diff --git a/Makefile b/Makefile -index e17a98c..e3197fa 100644 +index 4bb09e1..d2e3cb6 100644 --- a/Makefile +++ b/Makefile -@@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ +@@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ HOSTCC = gcc HOSTCXX = g++ @@ -284,7 +290,7 @@ index e17a98c..e3197fa 100644 # Decide whether to build built-in, modular, or both. # Normally, just do built-in. -@@ -407,8 +408,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn --exc +@@ -404,8 +405,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn \ # Rules shared between *config targets and build targets # Basic helpers built in scripts/ @@ -295,7 +301,7 @@ index e17a98c..e3197fa 100644 $(Q)$(MAKE) $(build)=scripts/basic $(Q)rm -f .tmp_quiet_recordmcount -@@ -564,6 +565,60 @@ else +@@ -561,6 +562,60 @@ else KBUILD_CFLAGS += -O2 endif @@ -355,8 +361,8 @@ index e17a98c..e3197fa 100644 + include $(srctree)/arch/$(SRCARCH)/Makefile - ifneq ($(CONFIG_FRAME_WARN),0) -@@ -708,7 +763,7 @@ export mod_strip_cmd + ifdef CONFIG_READABLE_ASM +@@ -715,7 +770,7 @@ export mod_strip_cmd ifeq ($(KBUILD_EXTMOD),) @@ -365,16 +371,16 @@ index e17a98c..e3197fa 100644 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \ $(core-y) $(core-m) $(drivers-y) $(drivers-m) \ -@@ -932,6 +987,8 @@ vmlinux.o: $(modpost-init) $(vmlinux-main) FORCE +@@ -762,6 +817,8 @@ endif # The actual objects are generated when descending, # make sure no implicit rule kicks in -+$(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS) -+$(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS) - $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ; ++$(sort $(vmlinux-deps)): KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS) ++$(sort $(vmlinux-deps)): KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS) + $(sort $(vmlinux-deps)): $(vmlinux-dirs) ; # Handle descending into subdirectories listed in $(vmlinux-dirs) -@@ -941,7 +998,7 @@ $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ; +@@ -771,7 +828,7 @@ $(sort $(vmlinux-deps)): $(vmlinux-dirs) ; # Error messages still appears in the original language PHONY += $(vmlinux-dirs) @@ -383,7 +389,7 @@ index e17a98c..e3197fa 100644 $(Q)$(MAKE) $(build)=$@ # Store (new) KERNELRELASE string in include/config/kernel.release -@@ -985,6 +1042,7 @@ prepare0: archprepare FORCE +@@ -815,6 +872,7 @@ prepare0: archprepare FORCE $(Q)$(MAKE) $(build)=. # All the preparing.. @@ -391,7 +397,7 @@ index e17a98c..e3197fa 100644 prepare: prepare0 # Generate some files -@@ -1092,6 +1150,8 @@ all: modules +@@ -922,6 +980,8 @@ all: modules # using awk while concatenating to the final file. PHONY += modules @@ -400,7 +406,7 @@ index e17a98c..e3197fa 100644 modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order @$(kecho) ' Building modules, stage 2.'; -@@ -1107,7 +1167,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin) +@@ -937,7 +997,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin) # Target to prepare building external modules PHONY += modules_prepare @@ -409,7 +415,7 @@ index e17a98c..e3197fa 100644 # Target to install modules PHONY += modules_install -@@ -1166,7 +1226,7 @@ CLEAN_FILES += vmlinux System.map \ +@@ -994,7 +1054,7 @@ CLEAN_DIRS += $(MODVERDIR) MRPROPER_DIRS += include/config usr/include include/generated \ arch/*/include/generated MRPROPER_FILES += .config .config.old .version .old_version \ @@ -418,7 +424,7 @@ index e17a98c..e3197fa 100644 Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS # clean - Delete most, but leave enough to build external modules -@@ -1204,6 +1264,7 @@ distclean: mrproper +@@ -1032,6 +1092,7 @@ distclean: mrproper \( -name '*.orig' -o -name '*.rej' -o -name '*~' \ -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \ -o -name '.*.rej' \ @@ -426,7 +432,7 @@ index e17a98c..e3197fa 100644 -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \ -type f -print | xargs rm -f -@@ -1364,6 +1425,8 @@ PHONY += $(module-dirs) modules +@@ -1192,6 +1253,8 @@ PHONY += $(module-dirs) modules $(module-dirs): crmodverdir $(objtree)/Module.symvers $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@) @@ -435,7 +441,7 @@ index e17a98c..e3197fa 100644 modules: $(module-dirs) @$(kecho) ' Building modules, stage 2.'; $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost -@@ -1490,17 +1553,21 @@ else +@@ -1326,17 +1389,21 @@ else target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@)) endif @@ -461,7 +467,7 @@ index e17a98c..e3197fa 100644 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) %.symtypes: %.c prepare scripts FORCE $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) -@@ -1510,11 +1577,15 @@ endif +@@ -1346,11 +1413,15 @@ endif $(cmd_crmodverdir) $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ $(build)=$(build-dir) @@ -597,10 +603,10 @@ index 2fd00b7..cfd5069 100644 for (i = 0; i < n; i++) { diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c -index 49ee319..9ee7d14 100644 +index 98a1036..fb54ccf 100644 --- a/arch/alpha/kernel/osf_sys.c +++ b/arch/alpha/kernel/osf_sys.c -@@ -1146,7 +1146,7 @@ arch_get_unmapped_area_1(unsigned long addr, unsigned long len, +@@ -1312,7 +1312,7 @@ arch_get_unmapped_area_1(unsigned long addr, unsigned long len, /* At this point: (!vma || addr < vma->vm_end). */ if (limit - len < addr) return -ENOMEM; @@ -609,7 +615,7 @@ index 49ee319..9ee7d14 100644 return addr; addr = vma->vm_end; vma = vma->vm_next; -@@ -1182,6 +1182,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, +@@ -1348,6 +1348,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, merely specific addresses, but regions of memory -- perhaps this feature should be incorporated into all ports? */ @@ -620,7 +626,7 @@ index 49ee319..9ee7d14 100644 if (addr) { addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit); if (addr != (unsigned long) -ENOMEM) -@@ -1189,8 +1193,8 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, +@@ -1355,8 +1359,8 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, } /* Next, try allocating at TASK_UNMAPPED_BASE. */ @@ -792,7 +798,7 @@ index 5eecab1..609abc0 100644 /* Allow reads even for write-only mappings */ if (!(vma->vm_flags & (VM_READ | VM_WRITE))) diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h -index 68374ba..cff7196 100644 +index c79f61f..9269ea1 100644 --- a/arch/arm/include/asm/atomic.h +++ b/arch/arm/include/asm/atomic.h @@ -17,17 +17,35 @@ @@ -1097,8 +1103,8 @@ index 68374ba..cff7196 100644 + #define ATOMIC64_INIT(i) { (i) } - static inline u64 atomic64_read(atomic64_t *v) -@@ -256,6 +451,19 @@ static inline u64 atomic64_read(atomic64_t *v) + static inline u64 atomic64_read(const atomic64_t *v) +@@ -256,6 +451,19 @@ static inline u64 atomic64_read(const atomic64_t *v) return result; } @@ -1435,7 +1441,7 @@ index 75fe66b..2255c86 100644 /* * Memory returned by kmalloc() may be used for DMA, so we must make diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h -index 1252a26..9dc17b5 100644 +index 004c1bc..d9d6d91 100644 --- a/arch/arm/include/asm/cacheflush.h +++ b/arch/arm/include/asm/cacheflush.h @@ -108,7 +108,7 @@ struct cpu_cache_fns { @@ -1448,7 +1454,7 @@ index 1252a26..9dc17b5 100644 /* * Select the calling method diff --git a/arch/arm/include/asm/cmpxchg.h b/arch/arm/include/asm/cmpxchg.h -index d41d7cb..9bea5e0 100644 +index 7eb18c1..e38b6d2 100644 --- a/arch/arm/include/asm/cmpxchg.h +++ b/arch/arm/include/asm/cmpxchg.h @@ -102,6 +102,8 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, int size @@ -1515,10 +1521,10 @@ index 53426c6..c7baff3 100644 #ifdef CONFIG_OUTER_CACHE diff --git a/arch/arm/include/asm/page.h b/arch/arm/include/asm/page.h -index 5838361..da6e813 100644 +index ecf9019..b71d9a1 100644 --- a/arch/arm/include/asm/page.h +++ b/arch/arm/include/asm/page.h -@@ -123,7 +123,7 @@ struct cpu_user_fns { +@@ -114,7 +114,7 @@ struct cpu_user_fns { void (*cpu_clear_user_highpage)(struct page *page, unsigned long vaddr); void (*cpu_copy_user_highpage)(struct page *to, struct page *from, unsigned long vaddr, struct vm_area_struct *vma); @@ -1552,7 +1558,7 @@ index 943504f..bf8d667 100644 #endif /* CONFIG_ARM_LPAE */ diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h -index 0f04d84..2be5648 100644 +index af7b0bd..6750a8c 100644 --- a/arch/arm/include/asm/thread_info.h +++ b/arch/arm/include/asm/thread_info.h @@ -148,6 +148,12 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *, @@ -1569,15 +1575,15 @@ index 0f04d84..2be5648 100644 #define TIF_USING_IWMMXT 17 #define TIF_MEMDIE 18 /* is terminating due to OOM killer */ @@ -163,9 +169,11 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *, + #define _TIF_POLLING_NRFLAG (1 << TIF_POLLING_NRFLAG) #define _TIF_USING_IWMMXT (1 << TIF_USING_IWMMXT) - #define _TIF_RESTORE_SIGMASK (1 << TIF_RESTORE_SIGMASK) #define _TIF_SECCOMP (1 << TIF_SECCOMP) +#define _TIF_GRSEC_SETXID (1 << TIF_GRSEC_SETXID) /* Checks for any syscall work in entry-common.S */ -#define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT) +#define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \ -+ _TIF_GRSEC_SETXID) ++ _TIF_GRSEC_SETXID) /* * Change these and you break ASM code in entry-common.S @@ -1656,7 +1662,7 @@ index b57c75e..ed2d6b2 100644 EXPORT_SYMBOL(__get_user_1); diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c -index 2b7b017..c380fa2 100644 +index 19c95ea..7160f7c 100644 --- a/arch/arm/kernel/process.c +++ b/arch/arm/kernel/process.c @@ -28,7 +28,6 @@ @@ -1667,7 +1673,7 @@ index 2b7b017..c380fa2 100644 #include <linux/hw_breakpoint.h> #include <linux/cpuidle.h> -@@ -275,9 +274,10 @@ void machine_power_off(void) +@@ -255,9 +254,10 @@ void machine_power_off(void) machine_shutdown(); if (pm_power_off) pm_power_off(); @@ -1679,7 +1685,7 @@ index 2b7b017..c380fa2 100644 { machine_shutdown(); -@@ -519,12 +519,6 @@ unsigned long get_wchan(struct task_struct *p) +@@ -499,12 +499,6 @@ unsigned long get_wchan(struct task_struct *p) return 0; } @@ -1693,10 +1699,10 @@ index 2b7b017..c380fa2 100644 /* * The vectors page is always readable from user space for the diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c -index 9650c14..ae30cdd 100644 +index 14e3826..d832d89 100644 --- a/arch/arm/kernel/ptrace.c +++ b/arch/arm/kernel/ptrace.c -@@ -906,10 +906,19 @@ long arch_ptrace(struct task_struct *child, long request, +@@ -907,10 +907,19 @@ long arch_ptrace(struct task_struct *child, long request, return ret; } @@ -1717,10 +1723,10 @@ index 9650c14..ae30cdd 100644 audit_syscall_exit(regs); else diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c -index ebfac78..cbea9c0 100644 +index e15d83b..8c466dd 100644 --- a/arch/arm/kernel/setup.c +++ b/arch/arm/kernel/setup.c -@@ -111,13 +111,13 @@ struct processor processor __read_mostly; +@@ -112,13 +112,13 @@ struct processor processor __read_mostly; struct cpu_tlb_fns cpu_tlb __read_mostly; #endif #ifdef MULTI_USER @@ -1738,7 +1744,7 @@ index ebfac78..cbea9c0 100644 #endif diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c -index 63d402f..db1d714 100644 +index 3647170..065e1cd 100644 --- a/arch/arm/kernel/traps.c +++ b/arch/arm/kernel/traps.c @@ -264,6 +264,8 @@ static int __die(const char *str, int err, struct thread_info *thread, struct pt @@ -1826,63 +1832,6 @@ index d066df6..df28194 100644 ENDPROC(__copy_to_user_std) .pushsection .fixup,"ax" -diff --git a/arch/arm/lib/uaccess.S b/arch/arm/lib/uaccess.S -index 5c908b1..e712687 100644 ---- a/arch/arm/lib/uaccess.S -+++ b/arch/arm/lib/uaccess.S -@@ -20,7 +20,7 @@ - - #define PAGE_SHIFT 12 - --/* Prototype: int __copy_to_user(void *to, const char *from, size_t n) -+/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n) - * Purpose : copy a block to user memory from kernel memory - * Params : to - user memory - * : from - kernel memory -@@ -40,7 +40,7 @@ USER( TUSER( strgtb) r3, [r0], #1) @ May fault - sub r2, r2, ip - b .Lc2u_dest_aligned - --ENTRY(__copy_to_user) -+ENTRY(___copy_to_user) - stmfd sp!, {r2, r4 - r7, lr} - cmp r2, #4 - blt .Lc2u_not_enough -@@ -278,14 +278,14 @@ USER( TUSER( strgeb) r3, [r0], #1) @ May fault - ldrgtb r3, [r1], #0 - USER( TUSER( strgtb) r3, [r0], #1) @ May fault - b .Lc2u_finished --ENDPROC(__copy_to_user) -+ENDPROC(___copy_to_user) - - .pushsection .fixup,"ax" - .align 0 - 9001: ldmfd sp!, {r0, r4 - r7, pc} - .popsection - --/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n); -+/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n); - * Purpose : copy a block from user memory to kernel memory - * Params : to - kernel memory - * : from - user memory -@@ -304,7 +304,7 @@ USER( TUSER( ldrgtb) r3, [r1], #1) @ May fault - sub r2, r2, ip - b .Lcfu_dest_aligned - --ENTRY(__copy_from_user) -+ENTRY(___copy_from_user) - stmfd sp!, {r0, r2, r4 - r7, lr} - cmp r2, #4 - blt .Lcfu_not_enough -@@ -544,7 +544,7 @@ USER( TUSER( ldrgeb) r3, [r1], #1) @ May fault - USER( TUSER( ldrgtb) r3, [r1], #1) @ May fault - strgtb r3, [r0], #1 - b .Lcfu_finished --ENDPROC(__copy_from_user) -+ENDPROC(___copy_from_user) - - .pushsection .fixup,"ax" - .align 0 diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c index 025f742..8432b08 100644 --- a/arch/arm/lib/uaccess_with_memcpy.c @@ -1897,10 +1846,10 @@ index 025f742..8432b08 100644 /* * This test is stubbed out of the main function above to keep diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c -index 518091c..eae9a76 100644 +index 2c5d0ed..7d9099c 100644 --- a/arch/arm/mach-omap2/board-n8x0.c +++ b/arch/arm/mach-omap2/board-n8x0.c -@@ -596,7 +596,7 @@ static int n8x0_menelaus_late_init(struct device *dev) +@@ -594,7 +594,7 @@ static int n8x0_menelaus_late_init(struct device *dev) } #endif @@ -1910,7 +1859,7 @@ index 518091c..eae9a76 100644 }; diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c -index 5bb4835..4760f68 100644 +index c3bd834..e81ef02 100644 --- a/arch/arm/mm/fault.c +++ b/arch/arm/mm/fault.c @@ -174,6 +174,13 @@ __do_user_fault(struct task_struct *tsk, unsigned long addr, @@ -1961,7 +1910,7 @@ index 5bb4835..4760f68 100644 /* * First Level Translation Fault Handler * -@@ -577,6 +611,20 @@ do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs) +@@ -574,6 +608,20 @@ do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs) const struct fsr_info *inf = ifsr_info + fsr_fs(ifsr); struct siginfo info; @@ -2229,7 +2178,7 @@ index aea2718..3639a60 100644 #endif /* _ASM_ARCH_CACHE_H */ diff --git a/arch/cris/include/arch-v32/arch/cache.h b/arch/cris/include/arch-v32/arch/cache.h -index 1de779f..336fad3 100644 +index 7caf25d..ee65ac5 100644 --- a/arch/cris/include/arch-v32/arch/cache.h +++ b/arch/cris/include/arch-v32/arch/cache.h @@ -1,11 +1,12 @@ @@ -2244,7 +2193,7 @@ index 1de779f..336fad3 100644 #define L1_CACHE_SHIFT 5 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT) - #define __read_mostly __attribute__((__section__(".data.read_mostly"))) + #define __read_mostly __attribute__((__section__(".data..read_mostly"))) diff --git a/arch/frv/include/asm/atomic.h b/arch/frv/include/asm/atomic.h index b86329d..6709906 100644 @@ -2611,7 +2560,7 @@ index 24603be..948052d 100644 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp); } diff --git a/arch/ia64/kernel/sys_ia64.c b/arch/ia64/kernel/sys_ia64.c -index 609d500..7dde2a8 100644 +index d9439ef..b9a4303 100644 --- a/arch/ia64/kernel/sys_ia64.c +++ b/arch/ia64/kernel/sys_ia64.c @@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len @@ -2940,10 +2889,10 @@ index 881d18b..cea38bc 100644 /* diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h -index abb13e8..cd2d702 100644 +index ca97e0e..cd08920 100644 --- a/arch/mips/include/asm/thread_info.h +++ b/arch/mips/include/asm/thread_info.h -@@ -123,6 +123,8 @@ register struct thread_info *__current_thread_info __asm__("$28"); +@@ -111,6 +111,8 @@ register struct thread_info *__current_thread_info __asm__("$28"); #define TIF_32BIT_ADDR 23 /* 32-bit address space (o32/n32) */ #define TIF_FPUBOUND 24 /* thread bound to FPU-full CPU set */ #define TIF_LOAD_WATCH 25 /* If set, load watch registers */ @@ -2952,7 +2901,7 @@ index abb13e8..cd2d702 100644 #define TIF_SYSCALL_TRACE 31 /* syscall trace active */ #ifdef CONFIG_MIPS32_O32 -@@ -146,15 +148,18 @@ register struct thread_info *__current_thread_info __asm__("$28"); +@@ -134,15 +136,18 @@ register struct thread_info *__current_thread_info __asm__("$28"); #define _TIF_32BIT_ADDR (1<<TIF_32BIT_ADDR) #define _TIF_FPUBOUND (1<<TIF_FPUBOUND) #define _TIF_LOAD_WATCH (1<<TIF_LOAD_WATCH) @@ -3030,7 +2979,7 @@ index e9a5fd7..378809a 100644 - return sp & ALMASK; -} diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c -index 7c24c29..e2f1981 100644 +index 4812c6d..2069554 100644 --- a/arch/mips/kernel/ptrace.c +++ b/arch/mips/kernel/ptrace.c @@ -528,6 +528,10 @@ static inline int audit_arch(void) @@ -3046,7 +2995,7 @@ index 7c24c29..e2f1981 100644 * - triggered by current->work.syscall_trace @@ -537,6 +541,11 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs) /* do the secure computing check first */ - secure_computing(regs->regs[2]); + secure_computing_strict(regs->regs[2]); +#ifdef CONFIG_GRKERNSEC_SETXID + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID))) @@ -3394,10 +3343,10 @@ index ee99f23..802b0a1 100644 #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC) #define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX) diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h -index 9ac0660..6ed15c4 100644 +index 4ba2c93..f5e3974 100644 --- a/arch/parisc/include/asm/uaccess.h +++ b/arch/parisc/include/asm/uaccess.h -@@ -252,10 +252,10 @@ static inline unsigned long __must_check copy_from_user(void *to, +@@ -251,10 +251,10 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n) { @@ -3955,7 +3904,7 @@ index 4aad413..85d86bf 100644 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */ #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */ diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h -index 9d7f0fb..a28fe69 100644 +index f0cb7f4..d1296c4 100644 --- a/arch/powerpc/include/asm/reg.h +++ b/arch/powerpc/include/asm/reg.h @@ -212,6 +212,7 @@ @@ -3967,10 +3916,10 @@ index 9d7f0fb..a28fe69 100644 #define DSISR_ISSTORE 0x02000000 /* access was a store */ #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */ diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h -index 4a741c7..c8162227b 100644 +index 68831e9..379c695 100644 --- a/arch/powerpc/include/asm/thread_info.h +++ b/arch/powerpc/include/asm/thread_info.h -@@ -104,12 +104,14 @@ static inline struct thread_info *current_thread_info(void) +@@ -91,12 +91,14 @@ static inline struct thread_info *current_thread_info(void) #define TIF_PERFMON_CTXSW 6 /* perfmon needs ctxsw calls */ #define TIF_SYSCALL_AUDIT 7 /* syscall auditing active */ #define TIF_SINGLESTEP 8 /* singlestepping active */ @@ -3986,21 +3935,20 @@ index 4a741c7..c8162227b 100644 /* as above, but as bit values */ #define _TIF_SYSCALL_TRACE (1<<TIF_SYSCALL_TRACE) -@@ -127,8 +129,11 @@ static inline struct thread_info *current_thread_info(void) +@@ -113,8 +115,10 @@ static inline struct thread_info *current_thread_info(void) + #define _TIF_NOERROR (1<<TIF_NOERROR) #define _TIF_NOTIFY_RESUME (1<<TIF_NOTIFY_RESUME) #define _TIF_SYSCALL_TRACEPOINT (1<<TIF_SYSCALL_TRACEPOINT) - #define _TIF_RUNLATCH (1<<TIF_RUNLATCH) +#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID) -+ #define _TIF_SYSCALL_T_OR_A (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \ - _TIF_SECCOMP | _TIF_SYSCALL_TRACEPOINT) -+ _TIF_SECCOMP | _TIF_SYSCALL_TRACEPOINT \ ++ _TIF_SECCOMP | _TIF_SYSCALL_TRACEPOINT | \ + _TIF_GRSEC_SETXID) #define _TIF_USER_WORK_MASK (_TIF_SIGPENDING | _TIF_NEED_RESCHED | \ _TIF_NOTIFY_RESUME) diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h -index bd0fb84..a42a14b 100644 +index 17bb40c..353c98b 100644 --- a/arch/powerpc/include/asm/uaccess.h +++ b/arch/powerpc/include/asm/uaccess.h @@ -13,6 +13,8 @@ @@ -4012,7 +3960,7 @@ index bd0fb84..a42a14b 100644 /* * The fs value determines whether argument validity checking should be * performed or not. If get_fs() == USER_DS, checking is performed, with -@@ -327,52 +329,6 @@ do { \ +@@ -329,52 +331,6 @@ do { \ extern unsigned long __copy_tofrom_user(void __user *to, const void __user *from, unsigned long size); @@ -4065,7 +4013,7 @@ index bd0fb84..a42a14b 100644 static inline unsigned long __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n) { -@@ -396,6 +352,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to, +@@ -398,6 +354,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to, if (ret == 0) return 0; } @@ -4076,7 +4024,7 @@ index bd0fb84..a42a14b 100644 return __copy_tofrom_user((__force void __user *)to, from, n); } -@@ -422,6 +382,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to, +@@ -424,6 +384,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to, if (ret == 0) return 0; } @@ -4087,7 +4035,7 @@ index bd0fb84..a42a14b 100644 return __copy_tofrom_user(to, (__force const void __user *)from, n); } -@@ -439,6 +403,92 @@ static inline unsigned long __copy_to_user(void __user *to, +@@ -441,6 +405,92 @@ static inline unsigned long __copy_to_user(void __user *to, return __copy_to_user_inatomic(to, from, size); } @@ -4203,10 +4151,10 @@ index 7215cc2..a9730c1 100644 ld r4,_DAR(r1) bl .bad_page_fault diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S -index 8f880bc..c5bd2f3 100644 +index 1c06d29..c2a339b 100644 --- a/arch/powerpc/kernel/exceptions-64s.S +++ b/arch/powerpc/kernel/exceptions-64s.S -@@ -890,10 +890,10 @@ handle_page_fault: +@@ -888,10 +888,10 @@ handle_page_fault: 11: ld r4,_DAR(r1) ld r5,_DSISR(r1) addi r3,r1,STACK_FRAME_OVERHEAD @@ -4252,7 +4200,7 @@ index 2e3200c..72095ce 100644 /* Find this entry, or if that fails, the next avail. entry */ while (entry->jump[0]) { diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c -index 4937c96..70714b7 100644 +index 710f400..d00ebe6 100644 --- a/arch/powerpc/kernel/process.c +++ b/arch/powerpc/kernel/process.c @@ -681,8 +681,8 @@ void show_regs(struct pt_regs * regs) @@ -4266,7 +4214,7 @@ index 4937c96..70714b7 100644 #endif show_stack(current, (unsigned long *) regs->gpr[1]); if (!user_mode(regs)) -@@ -1186,10 +1186,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack) +@@ -1189,10 +1189,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack) newsp = stack[0]; ip = stack[STACK_FRAME_LR_SAVE]; if (!firstframe || ip != lr) { @@ -4279,7 +4227,7 @@ index 4937c96..70714b7 100644 (void *)current->ret_stack[curr_frame].ret); curr_frame--; } -@@ -1209,7 +1209,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack) +@@ -1212,7 +1212,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack) struct pt_regs *regs = (struct pt_regs *) (sp + STACK_FRAME_OVERHEAD); lr = regs->link; @@ -4288,10 +4236,10 @@ index 4937c96..70714b7 100644 regs->trap, (void *)regs->nip, (void *)lr); firstframe = 1; } -@@ -1282,58 +1282,3 @@ void thread_info_cache_init(void) +@@ -1254,58 +1254,3 @@ void __ppc64_runlatch_off(void) + mtspr(SPRN_CTRLT, ctrl); } - - #endif /* THREAD_SHIFT < PAGE_SHIFT */ + #endif /* CONFIG_PPC64 */ - -unsigned long arch_align_stack(unsigned long sp) -{ @@ -4348,10 +4296,10 @@ index 4937c96..70714b7 100644 - return ret; -} diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c -index 8d8e028..c2aeb50 100644 +index c10fc28..c4ef063 100644 --- a/arch/powerpc/kernel/ptrace.c +++ b/arch/powerpc/kernel/ptrace.c -@@ -1702,6 +1702,10 @@ long arch_ptrace(struct task_struct *child, long request, +@@ -1660,6 +1660,10 @@ long arch_ptrace(struct task_struct *child, long request, return ret; } @@ -4362,9 +4310,9 @@ index 8d8e028..c2aeb50 100644 /* * We must return the syscall number to actually look up in the table. * This can be -1L to skip running any syscall at all. -@@ -1712,6 +1716,11 @@ long do_syscall_trace_enter(struct pt_regs *regs) +@@ -1670,6 +1674,11 @@ long do_syscall_trace_enter(struct pt_regs *regs) - secure_computing(regs->gpr[0]); + secure_computing_strict(regs->gpr[0]); +#ifdef CONFIG_GRKERNSEC_SETXID + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID))) @@ -4374,7 +4322,7 @@ index 8d8e028..c2aeb50 100644 if (test_thread_flag(TIF_SYSCALL_TRACE) && tracehook_report_syscall_entry(regs)) /* -@@ -1746,6 +1755,11 @@ void do_syscall_trace_leave(struct pt_regs *regs) +@@ -1704,6 +1713,11 @@ void do_syscall_trace_leave(struct pt_regs *regs) { int step; @@ -4387,10 +4335,10 @@ index 8d8e028..c2aeb50 100644 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c -index 45eb998..0cb36bc 100644 +index 8b4c049..dcd6ef3 100644 --- a/arch/powerpc/kernel/signal_32.c +++ b/arch/powerpc/kernel/signal_32.c -@@ -861,7 +861,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka, +@@ -852,7 +852,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka, /* Save user registers on the stack */ frame = &rt_sf->uc.uc_mcontext; addr = frame; @@ -4400,7 +4348,7 @@ index 45eb998..0cb36bc 100644 goto badframe; regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp; diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c -index 2692efd..6673d2e 100644 +index d183f87..1867f1a 100644 --- a/arch/powerpc/kernel/signal_64.c +++ b/arch/powerpc/kernel/signal_64.c @@ -430,7 +430,7 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info, @@ -4735,7 +4683,7 @@ index 2a30d5a..5e5586f 100644 #define __read_mostly __attribute__((__section__(".data..read_mostly"))) diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h -index c4ee39f..352881b 100644 +index 06151e6..c08cb52 100644 --- a/arch/s390/include/asm/elf.h +++ b/arch/s390/include/asm/elf.h @@ -161,8 +161,14 @@ extern unsigned int vdso_enabled; @@ -4776,10 +4724,10 @@ index c4a93d6..4d2a9b4 100644 #endif /* __ASM_EXEC_H */ diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h -index 8f2cada..43072c1 100644 +index 1f3a79b..44d7f9c 100644 --- a/arch/s390/include/asm/uaccess.h +++ b/arch/s390/include/asm/uaccess.h -@@ -236,6 +236,10 @@ static inline unsigned long __must_check +@@ -241,6 +241,10 @@ static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n) { might_fault(); @@ -4790,7 +4738,7 @@ index 8f2cada..43072c1 100644 if (access_ok(VERIFY_WRITE, to, n)) n = __copy_to_user(to, from, n); return n; -@@ -261,6 +265,9 @@ copy_to_user(void __user *to, const void *from, unsigned long n) +@@ -266,6 +270,9 @@ copy_to_user(void __user *to, const void *from, unsigned long n) static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n) { @@ -4800,7 +4748,7 @@ index 8f2cada..43072c1 100644 if (__builtin_constant_p(n) && (n <= 256)) return uaccess.copy_from_user_small(n, from, to); else -@@ -292,10 +299,14 @@ __compiletime_warning("copy_from_user() buffer size is not provably correct") +@@ -297,10 +304,14 @@ __compiletime_warning("copy_from_user() buffer size is not provably correct") static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n) { @@ -5121,19 +5069,6 @@ index afeb710..d1d1289 100644 bottomup: /* -diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile -index eddcfb3..b117d90 100644 ---- a/arch/sparc/Makefile -+++ b/arch/sparc/Makefile -@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc/oprofile/ - # Export what is needed by arch/sparc/boot/Makefile - export VMLINUX_INIT VMLINUX_MAIN - VMLINUX_INIT := $(head-y) $(init-y) --VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ -+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/ - VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y) - VMLINUX_MAIN += $(drivers-y) $(net-y) - diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h index ce35a1c..2e7b8f9 100644 --- a/arch/sparc/include/asm/atomic_64.h @@ -5325,7 +5260,7 @@ index ce35a1c..2e7b8f9 100644 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0) diff --git a/arch/sparc/include/asm/cache.h b/arch/sparc/include/asm/cache.h -index 69358b5..9d0d492 100644 +index 5bb6991..5c2132e 100644 --- a/arch/sparc/include/asm/cache.h +++ b/arch/sparc/include/asm/cache.h @@ -7,10 +7,12 @@ @@ -5343,7 +5278,7 @@ index 69358b5..9d0d492 100644 #ifdef CONFIG_SPARC32 #define SMP_CACHE_BYTES_SHIFT 5 diff --git a/arch/sparc/include/asm/elf_32.h b/arch/sparc/include/asm/elf_32.h -index 4269ca6..e3da77f 100644 +index 2d4d755..81b6662 100644 --- a/arch/sparc/include/asm/elf_32.h +++ b/arch/sparc/include/asm/elf_32.h @@ -114,6 +114,13 @@ typedef struct { @@ -5379,17 +5314,17 @@ index 7df8b7f..4946269 100644 #define ELF_HWCAP sparc64_elf_hwcap diff --git a/arch/sparc/include/asm/pgalloc_32.h b/arch/sparc/include/asm/pgalloc_32.h -index ca2b344..c6084f89 100644 +index e5b169b46..e90b4fa 100644 --- a/arch/sparc/include/asm/pgalloc_32.h +++ b/arch/sparc/include/asm/pgalloc_32.h -@@ -37,6 +37,7 @@ BTFIXUPDEF_CALL(void, free_pgd_fast, pgd_t *) - BTFIXUPDEF_CALL(void, pgd_set, pgd_t *, pmd_t *) - #define pgd_set(pgdp,pmdp) BTFIXUP_CALL(pgd_set)(pgdp,pmdp) +@@ -46,6 +46,7 @@ static inline void pgd_set(pgd_t * pgdp, pmd_t * pmdp) + } + #define pgd_populate(MM, PGD, PMD) pgd_set(PGD, PMD) +#define pgd_populate_kernel(MM, PGD, PMD) pgd_populate((MM), (PGD), (PMD)) - BTFIXUPDEF_CALL(pmd_t *, pmd_alloc_one, struct mm_struct *, unsigned long) - #define pmd_alloc_one(mm, address) BTFIXUP_CALL(pmd_alloc_one)(mm, address) + static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, + unsigned long address) diff --git a/arch/sparc/include/asm/pgalloc_64.h b/arch/sparc/include/asm/pgalloc_64.h index 40b2d7a..22a665b 100644 --- a/arch/sparc/include/asm/pgalloc_64.h @@ -5403,54 +5338,56 @@ index 40b2d7a..22a665b 100644 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr) { diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h -index 3d71018..48a11c5 100644 +index cbbbed5..0983069 100644 --- a/arch/sparc/include/asm/pgtable_32.h +++ b/arch/sparc/include/asm/pgtable_32.h -@@ -45,6 +45,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd) - BTFIXUPDEF_INT(page_none) - BTFIXUPDEF_INT(page_copy) - BTFIXUPDEF_INT(page_readonly) -+ -+#ifdef CONFIG_PAX_PAGEEXEC -+BTFIXUPDEF_INT(page_shared_noexec) -+BTFIXUPDEF_INT(page_copy_noexec) -+BTFIXUPDEF_INT(page_readonly_noexec) -+#endif -+ - BTFIXUPDEF_INT(page_kernel) - - #define PMD_SHIFT SUN4C_PMD_SHIFT -@@ -66,6 +73,16 @@ extern pgprot_t PAGE_SHARED; - #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy)) - #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly)) - -+#ifdef CONFIG_PAX_PAGEEXEC -+extern pgprot_t PAGE_SHARED_NOEXEC; -+# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec)) -+# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec)) -+#else -+# define PAGE_SHARED_NOEXEC PAGE_SHARED -+# define PAGE_COPY_NOEXEC PAGE_COPY -+# define PAGE_READONLY_NOEXEC PAGE_READONLY -+#endif -+ - extern unsigned long page_kernel; - - #ifdef MODULE +@@ -50,6 +50,9 @@ extern unsigned long calc_highpages(void); + #define PAGE_SHARED SRMMU_PAGE_SHARED + #define PAGE_COPY SRMMU_PAGE_COPY + #define PAGE_READONLY SRMMU_PAGE_RDONLY ++#define PAGE_SHARED_NOEXEC SRMMU_PAGE_SHARED_NOEXEC ++#define PAGE_COPY_NOEXEC SRMMU_PAGE_COPY_NOEXEC ++#define PAGE_READONLY_NOEXEC SRMMU_PAGE_RDONLY_NOEXEC + #define PAGE_KERNEL SRMMU_PAGE_KERNEL + + /* Top-level page directory */ +@@ -61,18 +64,18 @@ extern unsigned long ptr_in_current_pgd; + + /* xwr */ + #define __P000 PAGE_NONE +-#define __P001 PAGE_READONLY +-#define __P010 PAGE_COPY +-#define __P011 PAGE_COPY ++#define __P001 PAGE_READONLY_NOEXEC ++#define __P010 PAGE_COPY_NOEXEC ++#define __P011 PAGE_COPY_NOEXEC + #define __P100 PAGE_READONLY + #define __P101 PAGE_READONLY + #define __P110 PAGE_COPY + #define __P111 PAGE_COPY + + #define __S000 PAGE_NONE +-#define __S001 PAGE_READONLY +-#define __S010 PAGE_SHARED +-#define __S011 PAGE_SHARED ++#define __S001 PAGE_READONLY_NOEXEC ++#define __S010 PAGE_SHARE_NOEXEC ++#define __S011 PAGE_SHARE_NOEXEC + #define __S100 PAGE_READONLY + #define __S101 PAGE_READONLY + #define __S110 PAGE_SHARED diff --git a/arch/sparc/include/asm/pgtsrmmu.h b/arch/sparc/include/asm/pgtsrmmu.h -index f6ae2b2..b03ffc7 100644 +index 79da178..c2eede8 100644 --- a/arch/sparc/include/asm/pgtsrmmu.h +++ b/arch/sparc/include/asm/pgtsrmmu.h -@@ -115,6 +115,13 @@ +@@ -115,6 +115,11 @@ SRMMU_EXEC | SRMMU_REF) #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \ SRMMU_EXEC | SRMMU_REF) + -+#ifdef CONFIG_PAX_PAGEEXEC +#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF) -+#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF) ++#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF) +#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF) -+#endif + #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \ SRMMU_DIRTY | SRMMU_REF) @@ -5557,10 +5494,10 @@ index 9689176..63c18ea 100644 unsigned long mask, tmp1, tmp2, result; diff --git a/arch/sparc/include/asm/thread_info_32.h b/arch/sparc/include/asm/thread_info_32.h -index c2a1080..21ed218 100644 +index e6cd224..3a71793 100644 --- a/arch/sparc/include/asm/thread_info_32.h +++ b/arch/sparc/include/asm/thread_info_32.h -@@ -50,6 +50,8 @@ struct thread_info { +@@ -49,6 +49,8 @@ struct thread_info { unsigned long w_saved; struct restart_block restart_block; @@ -5570,7 +5507,7 @@ index c2a1080..21ed218 100644 /* diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h -index 01d057f..13a7d2f 100644 +index cfa8c38..13f30d3 100644 --- a/arch/sparc/include/asm/thread_info_64.h +++ b/arch/sparc/include/asm/thread_info_64.h @@ -63,6 +63,8 @@ struct thread_info { @@ -5582,7 +5519,7 @@ index 01d057f..13a7d2f 100644 unsigned long fpregs[0] __attribute__ ((aligned(64))); }; -@@ -214,10 +216,11 @@ register struct thread_info *current_thread_info_reg asm("g6"); +@@ -193,10 +195,11 @@ register struct thread_info *current_thread_info_reg asm("g6"); #define TIF_UNALIGNED 5 /* allowed to do unaligned accesses */ /* flag bit 6 is available */ #define TIF_32BIT 7 /* 32-bit binary */ @@ -5595,7 +5532,7 @@ index 01d057f..13a7d2f 100644 /* NOTE: Thread flags >= 12 should be ones we have no interest * in using in assembly, else we can't use the mask as * an immediate value in instructions such as andcc. -@@ -236,12 +239,18 @@ register struct thread_info *current_thread_info_reg asm("g6"); +@@ -215,12 +218,18 @@ register struct thread_info *current_thread_info_reg asm("g6"); #define _TIF_SYSCALL_AUDIT (1<<TIF_SYSCALL_AUDIT) #define _TIF_SYSCALL_TRACEPOINT (1<<TIF_SYSCALL_TRACEPOINT) #define _TIF_POLLING_NRFLAG (1<<TIF_POLLING_NRFLAG) @@ -5615,7 +5552,7 @@ index 01d057f..13a7d2f 100644 * Thread-synchronous status. * diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h -index e88fbe5..96b0ce5 100644 +index 0167d26..9acd8ed 100644 --- a/arch/sparc/include/asm/uaccess.h +++ b/arch/sparc/include/asm/uaccess.h @@ -1,5 +1,13 @@ @@ -5633,10 +5570,10 @@ index e88fbe5..96b0ce5 100644 #include <asm/uaccess_64.h> #else diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h -index 8303ac4..07f333d 100644 +index 53a28dd..50c38c3 100644 --- a/arch/sparc/include/asm/uaccess_32.h +++ b/arch/sparc/include/asm/uaccess_32.h -@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __user *to, const void __user *from, unsig +@@ -250,27 +250,46 @@ extern unsigned long __copy_user(void __user *to, const void __user *from, unsig static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n) { @@ -5688,7 +5625,7 @@ index 8303ac4..07f333d 100644 } diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h -index a1091afb..380228e 100644 +index 7c831d8..d440ca7 100644 --- a/arch/sparc/include/asm/uaccess_64.h +++ b/arch/sparc/include/asm/uaccess_64.h @@ -10,6 +10,7 @@ @@ -5699,7 +5636,7 @@ index a1091afb..380228e 100644 #include <asm/asi.h> #include <asm/spitfire.h> #include <asm-generic/uaccess-unaligned.h> -@@ -212,8 +213,15 @@ extern unsigned long copy_from_user_fixup(void *to, const void __user *from, +@@ -214,8 +215,15 @@ extern unsigned long copy_from_user_fixup(void *to, const void __user *from, static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long size) { @@ -5716,7 +5653,7 @@ index a1091afb..380228e 100644 if (unlikely(ret)) ret = copy_from_user_fixup(to, from, size); -@@ -229,8 +237,15 @@ extern unsigned long copy_to_user_fixup(void __user *to, const void *from, +@@ -231,8 +239,15 @@ extern unsigned long copy_to_user_fixup(void __user *to, const void *from, static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long size) { @@ -5734,7 +5671,7 @@ index a1091afb..380228e 100644 ret = copy_to_user_fixup(to, from, size); return ret; diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile -index cb85458..e063f17 100644 +index 6cf591b..b49e65a 100644 --- a/arch/sparc/kernel/Makefile +++ b/arch/sparc/kernel/Makefile @@ -3,7 +3,7 @@ @@ -5745,21 +5682,12 @@ index cb85458..e063f17 100644 +#ccflags-y := -Werror extra-y := head_$(BITS).o - extra-y += init_task.o + diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c -index efa0754..74b03fe 100644 +index cb36e82..1c1462f 100644 --- a/arch/sparc/kernel/process_32.c +++ b/arch/sparc/kernel/process_32.c -@@ -200,7 +200,7 @@ void __show_backtrace(unsigned long fp) - rw->ins[4], rw->ins[5], - rw->ins[6], - rw->ins[7]); -- printk("%pS\n", (void *) rw->ins[7]); -+ printk("%pA\n", (void *) rw->ins[7]); - rw = (struct reg_window32 *) rw->ins[6]; - } - spin_unlock_irqrestore(&sparc_backtrace_lock, flags); -@@ -267,14 +267,14 @@ void show_regs(struct pt_regs *r) +@@ -126,14 +126,14 @@ void show_regs(struct pt_regs *r) printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n", r->psr, r->pc, r->npc, r->y, print_tainted()); @@ -5776,7 +5704,7 @@ index efa0754..74b03fe 100644 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n", rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3], -@@ -309,7 +309,7 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp) +@@ -168,7 +168,7 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp) rw = (struct reg_window32 *) fp; pc = rw->ins[7]; printk("[%08lx : ", pc); @@ -5825,7 +5753,7 @@ index aff0c72..9067b39 100644 (void *) gp->o7, (void *) gp->i7, diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c -index 6f97c07..b1300ec 100644 +index 484daba..0674139 100644 --- a/arch/sparc/kernel/ptrace_64.c +++ b/arch/sparc/kernel/ptrace_64.c @@ -1057,6 +1057,10 @@ long arch_ptrace(struct task_struct *child, long request, @@ -5841,7 +5769,7 @@ index 6f97c07..b1300ec 100644 int ret = 0; @@ -1064,6 +1068,11 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs) /* do the secure computing check first */ - secure_computing(regs->u_regs[UREG_G1]); + secure_computing_strict(regs->u_regs[UREG_G1]); +#ifdef CONFIG_GRKERNSEC_SETXID + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID))) @@ -5864,11 +5792,11 @@ index 6f97c07..b1300ec 100644 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c -index 42b282f..28ce9f2 100644 +index 0c9b31b..7cb7aee 100644 --- a/arch/sparc/kernel/sys_sparc_32.c +++ b/arch/sparc/kernel/sys_sparc_32.c -@@ -56,7 +56,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi - if (ARCH_SUN4C && len > 0x20000000) +@@ -54,7 +54,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi + if (len > TASK_SIZE - PAGE_SIZE) return -ENOMEM; if (!addr) - addr = TASK_UNMAPPED_BASE; @@ -5876,8 +5804,8 @@ index 42b282f..28ce9f2 100644 if (flags & MAP_SHARED) addr = COLOUR_ALIGN(addr); -@@ -71,7 +71,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi - } +@@ -65,7 +65,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi + /* At this point: (!vmm || addr < vmm->vm_end). */ if (TASK_SIZE - PAGE_SIZE - len < addr) return -ENOMEM; - if (!vmm || addr + len <= vmm->vm_start) @@ -5886,7 +5814,7 @@ index 42b282f..28ce9f2 100644 addr = vmm->vm_end; if (flags & MAP_SHARED) diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c -index 3ee51f1..2ba4913 100644 +index 275f74f..81bf5b8 100644 --- a/arch/sparc/kernel/sys_sparc_64.c +++ b/arch/sparc/kernel/sys_sparc_64.c @@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi @@ -6086,7 +6014,7 @@ index 1d7e274..b39c527 100644 or %g3, %g2, %g3 stx %o0, [%sp + PTREGS_OFF + PT_V9_I0] diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c -index d2de213..6b22bc3 100644 +index a5785ea..405c5f7 100644 --- a/arch/sparc/kernel/traps_32.c +++ b/arch/sparc/kernel/traps_32.c @@ -44,6 +44,8 @@ static void instruction_dump(unsigned long *pc) @@ -6119,7 +6047,7 @@ index d2de213..6b22bc3 100644 } diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c -index c72fdf5..743a344 100644 +index 3b05e66..6ea2917 100644 --- a/arch/sparc/kernel/traps_64.c +++ b/arch/sparc/kernel/traps_64.c @@ -75,7 +75,7 @@ static void dump_tl1_traplog(struct tl1_traplog *p) @@ -6260,10 +6188,10 @@ index c72fdf5..743a344 100644 } EXPORT_SYMBOL(die_if_kernel); diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c -index dae85bc..af1e19d 100644 +index f81d038..e7a4680 100644 --- a/arch/sparc/kernel/unaligned_64.c +++ b/arch/sparc/kernel/unaligned_64.c -@@ -279,7 +279,7 @@ static void log_unaligned(struct pt_regs *regs) +@@ -278,7 +278,7 @@ static void log_unaligned(struct pt_regs *regs) static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5); if (__ratelimit(&ratelimit)) { @@ -6273,7 +6201,7 @@ index dae85bc..af1e19d 100644 } } diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile -index a3fc437..fea9957 100644 +index dff4096..bd9a388 100644 --- a/arch/sparc/lib/Makefile +++ b/arch/sparc/lib/Makefile @@ -2,7 +2,7 @@ @@ -6283,14 +6211,14 @@ index a3fc437..fea9957 100644 -ccflags-y := -Werror +#ccflags-y := -Werror - lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o + lib-$(CONFIG_SPARC32) += ashrdi3.o lib-$(CONFIG_SPARC32) += memcpy.o memset.o diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S -index 59186e0..f747d7a 100644 +index 4d502da..527c48d 100644 --- a/arch/sparc/lib/atomic_64.S +++ b/arch/sparc/lib/atomic_64.S -@@ -18,7 +18,12 @@ - atomic_add: /* %o0 = increment, %o1 = atomic_ptr */ +@@ -17,7 +17,12 @@ + ENTRY(atomic_add) /* %o0 = increment, %o1 = atomic_ptr */ BACKOFF_SETUP(%o2) 1: lduw [%o1], %g1 - add %g1, %o0, %g7 @@ -6303,13 +6231,11 @@ index 59186e0..f747d7a 100644 cas [%o1], %g1, %g7 cmp %g1, %g7 bne,pn %icc, BACKOFF_LABEL(2f, 1b) -@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = atomic_ptr */ +@@ -27,10 +32,28 @@ ENTRY(atomic_add) /* %o0 = increment, %o1 = atomic_ptr */ 2: BACKOFF_SPIN(%o2, %o3, 1b) - .size atomic_add, .-atomic_add + ENDPROC(atomic_add) -+ .globl atomic_add_unchecked -+ .type atomic_add_unchecked,#function -+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */ ++ENTRY(atomic_add_unchecked) /* %o0 = increment, %o1 = atomic_ptr */ + BACKOFF_SETUP(%o2) +1: lduw [%o1], %g1 + add %g1, %o0, %g7 @@ -6320,11 +6246,9 @@ index 59186e0..f747d7a 100644 + retl + nop +2: BACKOFF_SPIN(%o2, %o3, 1b) -+ .size atomic_add_unchecked, .-atomic_add_unchecked ++ENDPROC(atomic_add_unchecked) + - .globl atomic_sub - .type atomic_sub,#function - atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */ + ENTRY(atomic_sub) /* %o0 = decrement, %o1 = atomic_ptr */ BACKOFF_SETUP(%o2) 1: lduw [%o1], %g1 - sub %g1, %o0, %g7 @@ -6337,13 +6261,11 @@ index 59186e0..f747d7a 100644 cas [%o1], %g1, %g7 cmp %g1, %g7 bne,pn %icc, BACKOFF_LABEL(2f, 1b) -@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */ +@@ -40,10 +63,28 @@ ENTRY(atomic_sub) /* %o0 = decrement, %o1 = atomic_ptr */ 2: BACKOFF_SPIN(%o2, %o3, 1b) - .size atomic_sub, .-atomic_sub + ENDPROC(atomic_sub) -+ .globl atomic_sub_unchecked -+ .type atomic_sub_unchecked,#function -+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */ ++ENTRY(atomic_sub_unchecked) /* %o0 = decrement, %o1 = atomic_ptr */ + BACKOFF_SETUP(%o2) +1: lduw [%o1], %g1 + sub %g1, %o0, %g7 @@ -6354,11 +6276,9 @@ index 59186e0..f747d7a 100644 + retl + nop +2: BACKOFF_SPIN(%o2, %o3, 1b) -+ .size atomic_sub_unchecked, .-atomic_sub_unchecked ++ENDPROC(atomic_sub_unchecked) + - .globl atomic_add_ret - .type atomic_add_ret,#function - atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */ + ENTRY(atomic_add_ret) /* %o0 = increment, %o1 = atomic_ptr */ BACKOFF_SETUP(%o2) 1: lduw [%o1], %g1 - add %g1, %o0, %g7 @@ -6371,13 +6291,11 @@ index 59186e0..f747d7a 100644 cas [%o1], %g1, %g7 cmp %g1, %g7 bne,pn %icc, BACKOFF_LABEL(2f, 1b) -@@ -58,12 +103,33 @@ atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */ +@@ -53,10 +94,29 @@ ENTRY(atomic_add_ret) /* %o0 = increment, %o1 = atomic_ptr */ 2: BACKOFF_SPIN(%o2, %o3, 1b) - .size atomic_add_ret, .-atomic_add_ret + ENDPROC(atomic_add_ret) -+ .globl atomic_add_ret_unchecked -+ .type atomic_add_ret_unchecked,#function -+atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */ ++ENTRY(atomic_add_ret_unchecked) /* %o0 = increment, %o1 = atomic_ptr */ + BACKOFF_SETUP(%o2) +1: lduw [%o1], %g1 + addcc %g1, %o0, %g7 @@ -6389,11 +6307,9 @@ index 59186e0..f747d7a 100644 + retl + nop +2: BACKOFF_SPIN(%o2, %o3, 1b) -+ .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked ++ENDPROC(atomic_add_ret_unchecked) + - .globl atomic_sub_ret - .type atomic_sub_ret,#function - atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */ + ENTRY(atomic_sub_ret) /* %o0 = decrement, %o1 = atomic_ptr */ BACKOFF_SETUP(%o2) 1: lduw [%o1], %g1 - sub %g1, %o0, %g7 @@ -6406,8 +6322,8 @@ index 59186e0..f747d7a 100644 cas [%o1], %g1, %g7 cmp %g1, %g7 bne,pn %icc, BACKOFF_LABEL(2f, 1b) -@@ -78,7 +144,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */ - atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */ +@@ -69,7 +129,12 @@ ENDPROC(atomic_sub_ret) + ENTRY(atomic64_add) /* %o0 = increment, %o1 = atomic_ptr */ BACKOFF_SETUP(%o2) 1: ldx [%o1], %g1 - add %g1, %o0, %g7 @@ -6420,13 +6336,11 @@ index 59186e0..f747d7a 100644 casx [%o1], %g1, %g7 cmp %g1, %g7 bne,pn %xcc, BACKOFF_LABEL(2f, 1b) -@@ -88,12 +159,32 @@ atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */ +@@ -79,10 +144,28 @@ ENTRY(atomic64_add) /* %o0 = increment, %o1 = atomic_ptr */ 2: BACKOFF_SPIN(%o2, %o3, 1b) - .size atomic64_add, .-atomic64_add + ENDPROC(atomic64_add) -+ .globl atomic64_add_unchecked -+ .type atomic64_add_unchecked,#function -+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */ ++ENTRY(atomic64_add_unchecked) /* %o0 = increment, %o1 = atomic_ptr */ + BACKOFF_SETUP(%o2) +1: ldx [%o1], %g1 + addcc %g1, %o0, %g7 @@ -6437,11 +6351,9 @@ index 59186e0..f747d7a 100644 + retl + nop +2: BACKOFF_SPIN(%o2, %o3, 1b) -+ .size atomic64_add_unchecked, .-atomic64_add_unchecked ++ENDPROC(atomic64_add_unchecked) + - .globl atomic64_sub - .type atomic64_sub,#function - atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */ + ENTRY(atomic64_sub) /* %o0 = decrement, %o1 = atomic_ptr */ BACKOFF_SETUP(%o2) 1: ldx [%o1], %g1 - sub %g1, %o0, %g7 @@ -6454,13 +6366,11 @@ index 59186e0..f747d7a 100644 casx [%o1], %g1, %g7 cmp %g1, %g7 bne,pn %xcc, BACKOFF_LABEL(2f, 1b) -@@ -103,12 +194,32 @@ atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */ +@@ -92,10 +175,28 @@ ENTRY(atomic64_sub) /* %o0 = decrement, %o1 = atomic_ptr */ 2: BACKOFF_SPIN(%o2, %o3, 1b) - .size atomic64_sub, .-atomic64_sub + ENDPROC(atomic64_sub) -+ .globl atomic64_sub_unchecked -+ .type atomic64_sub_unchecked,#function -+atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */ ++ENTRY(atomic64_sub_unchecked) /* %o0 = decrement, %o1 = atomic_ptr */ + BACKOFF_SETUP(%o2) +1: ldx [%o1], %g1 + subcc %g1, %o0, %g7 @@ -6471,11 +6381,9 @@ index 59186e0..f747d7a 100644 + retl + nop +2: BACKOFF_SPIN(%o2, %o3, 1b) -+ .size atomic64_sub_unchecked, .-atomic64_sub_unchecked ++ENDPROC(atomic64_sub_unchecked) + - .globl atomic64_add_ret - .type atomic64_add_ret,#function - atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */ + ENTRY(atomic64_add_ret) /* %o0 = increment, %o1 = atomic_ptr */ BACKOFF_SETUP(%o2) 1: ldx [%o1], %g1 - add %g1, %o0, %g7 @@ -6488,13 +6396,11 @@ index 59186e0..f747d7a 100644 casx [%o1], %g1, %g7 cmp %g1, %g7 bne,pn %xcc, BACKOFF_LABEL(2f, 1b) -@@ -118,12 +229,33 @@ atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */ +@@ -105,10 +206,29 @@ ENTRY(atomic64_add_ret) /* %o0 = increment, %o1 = atomic_ptr */ 2: BACKOFF_SPIN(%o2, %o3, 1b) - .size atomic64_add_ret, .-atomic64_add_ret + ENDPROC(atomic64_add_ret) -+ .globl atomic64_add_ret_unchecked -+ .type atomic64_add_ret_unchecked,#function -+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */ ++ENTRY(atomic64_add_ret_unchecked) /* %o0 = increment, %o1 = atomic_ptr */ + BACKOFF_SETUP(%o2) +1: ldx [%o1], %g1 + addcc %g1, %o0, %g7 @@ -6506,11 +6412,9 @@ index 59186e0..f747d7a 100644 + retl + nop +2: BACKOFF_SPIN(%o2, %o3, 1b) -+ .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked ++ENDPROC(atomic64_add_ret_unchecked) + - .globl atomic64_sub_ret - .type atomic64_sub_ret,#function - atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */ + ENTRY(atomic64_sub_ret) /* %o0 = decrement, %o1 = atomic_ptr */ BACKOFF_SETUP(%o2) 1: ldx [%o1], %g1 - sub %g1, %o0, %g7 @@ -6524,10 +6428,10 @@ index 59186e0..f747d7a 100644 cmp %g1, %g7 bne,pn %xcc, BACKOFF_LABEL(2f, 1b) diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c -index f73c224..662af10 100644 +index 3b31218..345c609 100644 --- a/arch/sparc/lib/ksyms.c +++ b/arch/sparc/lib/ksyms.c -@@ -136,12 +136,18 @@ EXPORT_SYMBOL(__downgrade_write); +@@ -109,12 +109,18 @@ EXPORT_SYMBOL(__downgrade_write); /* Atomic counter implementation. */ EXPORT_SYMBOL(atomic_add); @@ -6547,7 +6451,7 @@ index f73c224..662af10 100644 /* Atomic bit operations. */ diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile -index 301421c..e2535d1 100644 +index 30c3ecc..736f015 100644 --- a/arch/sparc/mm/Makefile +++ b/arch/sparc/mm/Makefile @@ -2,7 +2,7 @@ @@ -6560,7 +6464,7 @@ index 301421c..e2535d1 100644 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o gup.o obj-y += fault_$(BITS).o diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c -index df3155a..b6e32fa 100644 +index f46cf6b..cc0666bae 100644 --- a/arch/sparc/mm/fault_32.c +++ b/arch/sparc/mm/fault_32.c @@ -21,6 +21,9 @@ @@ -6573,7 +6477,7 @@ index df3155a..b6e32fa 100644 #include <asm/page.h> #include <asm/pgtable.h> -@@ -207,6 +210,277 @@ static unsigned long compute_si_addr(struct pt_regs *regs, int text_fault) +@@ -177,6 +180,277 @@ static unsigned long compute_si_addr(struct pt_regs *regs, int text_fault) return safe_compute_effective_address(regs, insn); } @@ -6851,8 +6755,8 @@ index df3155a..b6e32fa 100644 static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs, int text_fault) { -@@ -282,6 +556,24 @@ good_area: - if(!(vma->vm_flags & VM_WRITE)) +@@ -248,6 +522,24 @@ good_area: + if (!(vma->vm_flags & VM_WRITE)) goto bad_area; } else { + @@ -6874,7 +6778,7 @@ index df3155a..b6e32fa 100644 +#endif + /* Allow reads even for write-only mappings */ - if(!(vma->vm_flags & (VM_READ | VM_EXEC))) + if (!(vma->vm_flags & (VM_READ | VM_EXEC))) goto bad_area; diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c index 1fe0429..8dd5dd5 100644 @@ -7459,62 +7363,6 @@ index 07e1453..0a7d9e9 100644 return addr; } if (mm->get_unmapped_area == arch_get_unmapped_area) -diff --git a/arch/sparc/mm/init_32.c b/arch/sparc/mm/init_32.c -index c5f9021..7591bae 100644 ---- a/arch/sparc/mm/init_32.c -+++ b/arch/sparc/mm/init_32.c -@@ -315,6 +315,9 @@ extern void device_scan(void); - pgprot_t PAGE_SHARED __read_mostly; - EXPORT_SYMBOL(PAGE_SHARED); - -+pgprot_t PAGE_SHARED_NOEXEC __read_mostly; -+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC); -+ - void __init paging_init(void) - { - switch(sparc_cpu_model) { -@@ -343,17 +346,17 @@ void __init paging_init(void) - - /* Initialize the protection map with non-constant, MMU dependent values. */ - protection_map[0] = PAGE_NONE; -- protection_map[1] = PAGE_READONLY; -- protection_map[2] = PAGE_COPY; -- protection_map[3] = PAGE_COPY; -+ protection_map[1] = PAGE_READONLY_NOEXEC; -+ protection_map[2] = PAGE_COPY_NOEXEC; -+ protection_map[3] = PAGE_COPY_NOEXEC; - protection_map[4] = PAGE_READONLY; - protection_map[5] = PAGE_READONLY; - protection_map[6] = PAGE_COPY; - protection_map[7] = PAGE_COPY; - protection_map[8] = PAGE_NONE; -- protection_map[9] = PAGE_READONLY; -- protection_map[10] = PAGE_SHARED; -- protection_map[11] = PAGE_SHARED; -+ protection_map[9] = PAGE_READONLY_NOEXEC; -+ protection_map[10] = PAGE_SHARED_NOEXEC; -+ protection_map[11] = PAGE_SHARED_NOEXEC; - protection_map[12] = PAGE_READONLY; - protection_map[13] = PAGE_READONLY; - protection_map[14] = PAGE_SHARED; -diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c -index cbef74e..c38fead 100644 ---- a/arch/sparc/mm/srmmu.c -+++ b/arch/sparc/mm/srmmu.c -@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void) - PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED); - BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY)); - BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY)); -+ -+#ifdef CONFIG_PAX_PAGEEXEC -+ PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC); -+ BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC)); -+ BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC)); -+#endif -+ - BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL)); - page_kernel = pgprot_val(SRMMU_PAGE_KERNEL); - diff --git a/arch/tile/include/asm/atomic_64.h b/arch/tile/include/asm/atomic_64.h index f4500c6..889656c 100644 --- a/arch/tile/include/asm/atomic_64.h @@ -7555,10 +7403,10 @@ index 392e533..536b092 100644 /* bytes per L2 cache line */ #define L2_CACHE_SHIFT CHIP_L2_LOG_LINE_SIZE() diff --git a/arch/tile/include/asm/uaccess.h b/arch/tile/include/asm/uaccess.h -index ef34d2c..d6ce60c 100644 +index 9ab078a..d6635c2 100644 --- a/arch/tile/include/asm/uaccess.h +++ b/arch/tile/include/asm/uaccess.h -@@ -361,9 +361,9 @@ static inline unsigned long __must_check copy_from_user(void *to, +@@ -403,9 +403,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n) { @@ -7571,7 +7419,7 @@ index ef34d2c..d6ce60c 100644 else copy_from_user_overflow(); diff --git a/arch/um/Makefile b/arch/um/Makefile -index 55c0661..86ad413 100644 +index 0970910..13adb57a 100644 --- a/arch/um/Makefile +++ b/arch/um/Makefile @@ -62,6 +62,10 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -D__KERNEL__,,\ @@ -7644,10 +7492,10 @@ index 0032f92..cd151e0 100644 #ifdef CONFIG_64BIT #define set_pud(pudptr, pudval) set_64bit((u64 *) (pudptr), pud_val(pudval)) diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c -index 2b73ded..804f540 100644 +index ccb9a9d..cc425bb 100644 --- a/arch/um/kernel/process.c +++ b/arch/um/kernel/process.c -@@ -404,22 +404,6 @@ int singlestepping(void * t) +@@ -407,22 +407,6 @@ int singlestepping(void * t) return 2; } @@ -7688,10 +7536,10 @@ index ad8f795..2c7eec6 100644 /* * Memory returned by kmalloc() may be used for DMA, so we must make diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index c9866b0..fe53aef 100644 +index c70684f..698fa4b 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig -@@ -229,7 +229,7 @@ config X86_HT +@@ -218,7 +218,7 @@ config X86_HT config X86_32_LAZY_GS def_bool y @@ -7700,7 +7548,7 @@ index c9866b0..fe53aef 100644 config ARCH_HWEIGHT_CFLAGS string -@@ -1042,7 +1042,7 @@ choice +@@ -1047,7 +1047,7 @@ choice config NOHIGHMEM bool "off" @@ -7709,7 +7557,7 @@ index c9866b0..fe53aef 100644 ---help--- Linux can use up to 64 Gigabytes of physical memory on x86 systems. However, the address space of 32-bit x86 processors is only 4 -@@ -1079,7 +1079,7 @@ config NOHIGHMEM +@@ -1084,7 +1084,7 @@ config NOHIGHMEM config HIGHMEM4G bool "4GB" @@ -7718,7 +7566,7 @@ index c9866b0..fe53aef 100644 ---help--- Select this if you have a 32-bit processor and between 1 and 4 gigabytes of physical RAM. -@@ -1133,7 +1133,7 @@ config PAGE_OFFSET +@@ -1138,7 +1138,7 @@ config PAGE_OFFSET hex default 0xB0000000 if VMSPLIT_3G_OPT default 0x80000000 if VMSPLIT_2G @@ -7727,7 +7575,7 @@ index c9866b0..fe53aef 100644 default 0x40000000 if VMSPLIT_1G default 0xC0000000 depends on X86_32 -@@ -1523,6 +1523,7 @@ config SECCOMP +@@ -1526,6 +1526,7 @@ config SECCOMP config CC_STACKPROTECTOR bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)" @@ -7735,7 +7583,7 @@ index c9866b0..fe53aef 100644 ---help--- This option turns on the -fstack-protector GCC feature. This feature puts, at the beginning of functions, a canary value on -@@ -1580,6 +1581,7 @@ config KEXEC_JUMP +@@ -1583,6 +1584,7 @@ config KEXEC_JUMP config PHYSICAL_START hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP) default "0x1000000" @@ -7743,7 +7591,7 @@ index c9866b0..fe53aef 100644 ---help--- This gives the physical address where the kernel is loaded. -@@ -1643,6 +1645,7 @@ config X86_NEED_RELOCS +@@ -1646,6 +1648,7 @@ config X86_NEED_RELOCS config PHYSICAL_ALIGN hex "Alignment value to which kernel should be aligned" if X86_32 default "0x1000000" @@ -7751,7 +7599,7 @@ index c9866b0..fe53aef 100644 range 0x2000 0x1000000 ---help--- This value puts the alignment restrictions on physical address -@@ -1674,9 +1677,10 @@ config HOTPLUG_CPU +@@ -1677,9 +1680,10 @@ config HOTPLUG_CPU Say N if you want to disable CPU hotplug. config COMPAT_VDSO @@ -7826,7 +7674,7 @@ index e46c214..ab62fd1 100644 Enabling this option turns a certain set of sanity checks for user copy operations into compile time failures. diff --git a/arch/x86/Makefile b/arch/x86/Makefile -index b1c611e..2c1a823 100644 +index 1f25214..39422b3 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -46,6 +46,7 @@ else @@ -7923,10 +7771,10 @@ index e398bb5..3a382ca 100644 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ GCOV_PROFILE := n diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c -index 0cdfc0d..6e79437 100644 +index 4e85f5f..39fa641 100644 --- a/arch/x86/boot/compressed/eboot.c +++ b/arch/x86/boot/compressed/eboot.c -@@ -122,7 +122,6 @@ again: +@@ -142,7 +142,6 @@ again: *addr = max_addr; } @@ -7934,7 +7782,7 @@ index 0cdfc0d..6e79437 100644 efi_call_phys1(sys_table->boottime->free_pool, map); fail: -@@ -186,7 +185,6 @@ static efi_status_t low_alloc(unsigned long size, unsigned long align, +@@ -206,7 +205,6 @@ static efi_status_t low_alloc(unsigned long size, unsigned long align, if (i == map_size / desc_size) status = EFI_NOT_FOUND; @@ -8118,10 +7966,10 @@ index 4d3ff03..e4972ff 100644 err = check_flags(); } diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S -index f1bbeeb..aff09cb 100644 +index efe5acf..22a3784 100644 --- a/arch/x86/boot/header.S +++ b/arch/x86/boot/header.S -@@ -372,7 +372,7 @@ setup_data: .quad 0 # 64-bit physical pointer to +@@ -391,10 +391,14 @@ setup_data: .quad 0 # 64-bit physical pointer to # single linked list of # struct setup_data @@ -8129,7 +7977,14 @@ index f1bbeeb..aff09cb 100644 +pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset) ++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) ++#define VO_INIT_SIZE (VO__end - VO__text - __PAGE_OFFSET - ____LOAD_PHYSICAL_ADDR) ++#else #define VO_INIT_SIZE (VO__end - VO__text) ++#endif + #if ZO_INIT_SIZE > VO_INIT_SIZE + #define INIT_SIZE ZO_INIT_SIZE + #else diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c index db75d07..8e6d0af 100644 --- a/arch/x86/boot/memory.c @@ -8657,10 +8512,10 @@ index 07b3a68..bd2a388 100644 set_fs(KERNEL_DS); has_dumped = 1; diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c -index 4f5bfac..e1ef0d3 100644 +index 673ac9b..7a8c5df 100644 --- a/arch/x86/ia32/ia32_signal.c +++ b/arch/x86/ia32/ia32_signal.c -@@ -168,7 +168,7 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr, +@@ -162,7 +162,7 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr, } seg = get_fs(); set_fs(KERNEL_DS); @@ -8669,7 +8524,7 @@ index 4f5bfac..e1ef0d3 100644 set_fs(seg); if (ret >= 0 && uoss_ptr) { if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t))) -@@ -369,7 +369,7 @@ static int ia32_setup_sigcontext(struct sigcontext_ia32 __user *sc, +@@ -361,7 +361,7 @@ static int ia32_setup_sigcontext(struct sigcontext_ia32 __user *sc, */ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, @@ -8678,7 +8533,7 @@ index 4f5bfac..e1ef0d3 100644 { unsigned long sp; -@@ -390,7 +390,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, +@@ -382,7 +382,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, if (used_math()) { sp = sp - sig_xstate_ia32_size; @@ -8687,7 +8542,7 @@ index 4f5bfac..e1ef0d3 100644 if (save_i387_xstate_ia32(*fpstate) < 0) return (void __user *) -1L; } -@@ -398,7 +398,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, +@@ -390,7 +390,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, sp -= frame_size; /* Align the stack pointer according to the i386 ABI, * i.e. so that on function entry ((sp + 4) & 15) == 0. */ @@ -8696,7 +8551,7 @@ index 4f5bfac..e1ef0d3 100644 return (void __user *) sp; } -@@ -456,7 +456,7 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka, +@@ -448,7 +448,7 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka, * These are actually not used anymore, but left because some * gdb versions depend on them as a marker. */ @@ -8705,7 +8560,7 @@ index 4f5bfac..e1ef0d3 100644 } put_user_catch(err); if (err) -@@ -498,7 +498,7 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info, +@@ -490,7 +490,7 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info, 0xb8, __NR_ia32_rt_sigreturn, 0x80cd, @@ -8714,7 +8569,7 @@ index 4f5bfac..e1ef0d3 100644 }; frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate); -@@ -528,16 +528,18 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info, +@@ -520,16 +520,18 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info, if (ka->sa.sa_flags & SA_RESTORER) restorer = ka->sa.sa_restorer; @@ -8737,13 +8592,13 @@ index 4f5bfac..e1ef0d3 100644 if (err) diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S -index e3e7340..05ed805 100644 +index 20e5f7b..eab8751 100644 --- a/arch/x86/ia32/ia32entry.S +++ b/arch/x86/ia32/ia32entry.S -@@ -13,8 +13,10 @@ - #include <asm/thread_info.h> +@@ -14,8 +14,10 @@ #include <asm/segment.h> #include <asm/irqflags.h> + #include <asm/asm.h> +#include <asm/pgtable.h> #include <linux/linkage.h> #include <linux/err.h> @@ -8751,7 +8606,7 @@ index e3e7340..05ed805 100644 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */ #include <linux/elf-em.h> -@@ -94,6 +96,32 @@ ENTRY(native_irq_enable_sysexit) +@@ -95,6 +97,32 @@ ENTRY(native_irq_enable_sysexit) ENDPROC(native_irq_enable_sysexit) #endif @@ -8784,7 +8639,7 @@ index e3e7340..05ed805 100644 /* * 32bit SYSENTER instruction entry. * -@@ -120,12 +148,6 @@ ENTRY(ia32_sysenter_target) +@@ -121,12 +149,6 @@ ENTRY(ia32_sysenter_target) CFI_REGISTER rsp,rbp SWAPGS_UNSAFE_STACK movq PER_CPU_VAR(kernel_stack), %rsp @@ -8797,7 +8652,7 @@ index e3e7340..05ed805 100644 movl %ebp,%ebp /* zero extension */ pushq_cfi $__USER32_DS /*CFI_REL_OFFSET ss,0*/ -@@ -133,24 +155,39 @@ ENTRY(ia32_sysenter_target) +@@ -134,22 +156,37 @@ ENTRY(ia32_sysenter_target) CFI_REL_OFFSET rsp,0 pushfq_cfi /*CFI_REL_OFFSET rflags,0*/ @@ -8831,9 +8686,7 @@ index e3e7340..05ed805 100644 +#endif + 1: movl (%rbp),%ebp - .section __ex_table,"a" - .quad 1b,ia32_badarg - .previous + _ASM_EXTABLE(1b,ia32_badarg) - orl $TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET) - testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET) + GET_THREAD_INFO(%r11) @@ -8842,7 +8695,7 @@ index e3e7340..05ed805 100644 CFI_REMEMBER_STATE jnz sysenter_tracesys cmpq $(IA32_NR_syscalls-1),%rax -@@ -160,12 +197,15 @@ sysenter_do_call: +@@ -159,12 +196,15 @@ sysenter_do_call: sysenter_dispatch: call *ia32_sys_call_table(,%rax,8) movq %rax,RAX-ARGOFFSET(%rsp) @@ -8860,7 +8713,7 @@ index e3e7340..05ed805 100644 /* clear IF, that popfq doesn't enable interrupts early */ andl $~0x200,EFLAGS-R11(%rsp) movl RIP-R11(%rsp),%edx /* User %eip */ -@@ -191,6 +231,9 @@ sysexit_from_sys_call: +@@ -190,6 +230,9 @@ sysexit_from_sys_call: movl %eax,%esi /* 2nd arg: syscall number */ movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */ call __audit_syscall_entry @@ -8870,7 +8723,7 @@ index e3e7340..05ed805 100644 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */ cmpq $(IA32_NR_syscalls-1),%rax ja ia32_badsys -@@ -202,7 +245,7 @@ sysexit_from_sys_call: +@@ -201,7 +244,7 @@ sysexit_from_sys_call: .endm .macro auditsys_exit exit @@ -8879,7 +8732,7 @@ index e3e7340..05ed805 100644 jnz ia32_ret_from_sys_call TRACE_IRQS_ON sti -@@ -213,11 +256,12 @@ sysexit_from_sys_call: +@@ -212,11 +255,12 @@ sysexit_from_sys_call: 1: setbe %al /* 1 if error, 0 if not */ movzbl %al,%edi /* zero-extend that into %edi */ call __audit_syscall_exit @@ -8893,7 +8746,7 @@ index e3e7340..05ed805 100644 jz \exit CLEAR_RREGS -ARGOFFSET jmp int_with_check -@@ -235,7 +279,7 @@ sysexit_audit: +@@ -234,7 +278,7 @@ sysexit_audit: sysenter_tracesys: #ifdef CONFIG_AUDITSYSCALL @@ -8902,7 +8755,7 @@ index e3e7340..05ed805 100644 jz sysenter_auditsys #endif SAVE_REST -@@ -243,6 +287,9 @@ sysenter_tracesys: +@@ -242,6 +286,9 @@ sysenter_tracesys: movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */ movq %rsp,%rdi /* &pt_regs -> arg1 */ call syscall_trace_enter @@ -8912,7 +8765,7 @@ index e3e7340..05ed805 100644 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */ RESTORE_REST cmpq $(IA32_NR_syscalls-1),%rax -@@ -274,19 +321,20 @@ ENDPROC(ia32_sysenter_target) +@@ -273,19 +320,20 @@ ENDPROC(ia32_sysenter_target) ENTRY(ia32_cstar_target) CFI_STARTPROC32 simple CFI_SIGNAL_FRAME @@ -8935,7 +8788,7 @@ index e3e7340..05ed805 100644 movl %eax,%eax /* zero extension */ movq %rax,ORIG_RAX-ARGOFFSET(%rsp) movq %rcx,RIP-ARGOFFSET(%rsp) -@@ -302,12 +350,19 @@ ENTRY(ia32_cstar_target) +@@ -301,10 +349,17 @@ ENTRY(ia32_cstar_target) /* no need to do an access_ok check here because r8 has been 32bit zero extended */ /* hardware stack frame is complete now */ @@ -8946,9 +8799,7 @@ index e3e7340..05ed805 100644 +#endif + 1: movl (%r8),%r9d - .section __ex_table,"a" - .quad 1b,ia32_badarg - .previous + _ASM_EXTABLE(1b,ia32_badarg) - orl $TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET) - testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET) + GET_THREAD_INFO(%r11) @@ -8957,7 +8808,7 @@ index e3e7340..05ed805 100644 CFI_REMEMBER_STATE jnz cstar_tracesys cmpq $IA32_NR_syscalls-1,%rax -@@ -317,12 +372,15 @@ cstar_do_call: +@@ -314,12 +369,15 @@ cstar_do_call: cstar_dispatch: call *ia32_sys_call_table(,%rax,8) movq %rax,RAX-ARGOFFSET(%rsp) @@ -8975,7 +8826,7 @@ index e3e7340..05ed805 100644 RESTORE_ARGS 0,-ARG_SKIP,0,0,0 movl RIP-ARGOFFSET(%rsp),%ecx CFI_REGISTER rip,rcx -@@ -350,7 +408,7 @@ sysretl_audit: +@@ -347,7 +405,7 @@ sysretl_audit: cstar_tracesys: #ifdef CONFIG_AUDITSYSCALL @@ -8984,7 +8835,7 @@ index e3e7340..05ed805 100644 jz cstar_auditsys #endif xchgl %r9d,%ebp -@@ -359,6 +417,9 @@ cstar_tracesys: +@@ -356,6 +414,9 @@ cstar_tracesys: movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */ movq %rsp,%rdi /* &pt_regs -> arg1 */ call syscall_trace_enter @@ -8994,7 +8845,7 @@ index e3e7340..05ed805 100644 LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */ RESTORE_REST xchgl %ebp,%r9d -@@ -404,19 +465,21 @@ ENTRY(ia32_syscall) +@@ -401,19 +462,21 @@ ENTRY(ia32_syscall) CFI_REL_OFFSET rip,RIP-RIP PARAVIRT_ADJUST_EXCEPTION_FRAME SWAPGS @@ -9023,7 +8874,7 @@ index e3e7340..05ed805 100644 jnz ia32_tracesys cmpq $(IA32_NR_syscalls-1),%rax ja ia32_badsys -@@ -435,6 +498,9 @@ ia32_tracesys: +@@ -432,6 +495,9 @@ ia32_tracesys: movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */ movq %rsp,%rdi /* &pt_regs -> arg1 */ call syscall_trace_enter @@ -9034,7 +8885,7 @@ index e3e7340..05ed805 100644 RESTORE_REST cmpq $(IA32_NR_syscalls-1),%rax diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c -index aec2202..f76174e 100644 +index 4540bec..714d913 100644 --- a/arch/x86/ia32/sys_ia32.c +++ b/arch/x86/ia32/sys_ia32.c @@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long offset_low, @@ -9045,11 +8896,11 @@ index aec2202..f76174e 100644 - typeof(ubuf->st_gid) gid = 0; + typeof(((struct stat64 *)0)->st_uid) uid = 0; + typeof(((struct stat64 *)0)->st_gid) gid = 0; - SET_UID(uid, stat->uid); - SET_GID(gid, stat->gid); + SET_UID(uid, from_kuid_munged(current_user_ns(), stat->uid)); + SET_GID(gid, from_kgid_munged(current_user_ns(), stat->gid)); if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) || -@@ -292,7 +292,7 @@ asmlinkage long sys32_alarm(unsigned int seconds) - return alarm_setitimer(seconds); +@@ -287,7 +287,7 @@ asmlinkage long sys32_sigaction(int sig, struct old_sigaction32 __user *act, + return ret; } -asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int *stat_addr, @@ -9057,7 +8908,7 @@ index aec2202..f76174e 100644 int options) { return compat_sys_wait4(pid, stat_addr, options, NULL); -@@ -313,7 +313,7 @@ asmlinkage long sys32_sched_rr_get_interval(compat_pid_t pid, +@@ -303,7 +303,7 @@ asmlinkage long sys32_sched_rr_get_interval(compat_pid_t pid, mm_segment_t old_fs = get_fs(); set_fs(KERNEL_DS); @@ -9066,7 +8917,7 @@ index aec2202..f76174e 100644 set_fs(old_fs); if (put_compat_timespec(&t, interval)) return -EFAULT; -@@ -329,7 +329,7 @@ asmlinkage long sys32_rt_sigpending(compat_sigset_t __user *set, +@@ -319,7 +319,7 @@ asmlinkage long sys32_rt_sigpending(compat_sigset_t __user *set, mm_segment_t old_fs = get_fs(); set_fs(KERNEL_DS); @@ -9075,7 +8926,7 @@ index aec2202..f76174e 100644 set_fs(old_fs); if (!ret) { switch (_NSIG_WORDS) { -@@ -354,7 +354,7 @@ asmlinkage long sys32_rt_sigqueueinfo(int pid, int sig, +@@ -344,7 +344,7 @@ asmlinkage long sys32_rt_sigqueueinfo(int pid, int sig, if (copy_siginfo_from_user32(&info, uinfo)) return -EFAULT; set_fs(KERNEL_DS); @@ -9084,7 +8935,7 @@ index aec2202..f76174e 100644 set_fs(old_fs); return ret; } -@@ -399,7 +399,7 @@ asmlinkage long sys32_sendfile(int out_fd, int in_fd, +@@ -376,7 +376,7 @@ asmlinkage long sys32_sendfile(int out_fd, int in_fd, return -EFAULT; set_fs(KERNEL_DS); @@ -9157,7 +9008,7 @@ index 49331be..9706065 100644 ".previous" diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h -index d854101..f6ea947 100644 +index eaff479..3025a63 100644 --- a/arch/x86/include/asm/apic.h +++ b/arch/x86/include/asm/apic.h @@ -44,7 +44,7 @@ static inline void generic_apic_probe(void) @@ -9646,7 +9497,7 @@ index 58cb6d4..a4b806c 100644 /* Atomic operations are already serializing on x86 */ #define smp_mb__before_atomic_dec() barrier() diff --git a/arch/x86/include/asm/atomic64_32.h b/arch/x86/include/asm/atomic64_32.h -index 1981199..36b9dfb 100644 +index b154de7..aadebd8 100644 --- a/arch/x86/include/asm/atomic64_32.h +++ b/arch/x86/include/asm/atomic64_32.h @@ -12,6 +12,14 @@ typedef struct { @@ -10132,10 +9983,10 @@ index 0e1cbfc..5623683 100644 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0) diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h -index b97596e..9bd48b06 100644 +index a6983b2..63f48a2 100644 --- a/arch/x86/include/asm/bitops.h +++ b/arch/x86/include/asm/bitops.h -@@ -38,7 +38,7 @@ +@@ -40,7 +40,7 @@ * a mask operation on a byte. */ #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr)) @@ -10145,7 +9996,7 @@ index b97596e..9bd48b06 100644 /** diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h -index 5e1a2ee..c9f9533 100644 +index b13fe63..0dab13a 100644 --- a/arch/x86/include/asm/boot.h +++ b/arch/x86/include/asm/boot.h @@ -11,10 +11,15 @@ @@ -10311,7 +10162,7 @@ index f91e80f..7f9bd27 100644 "4:\n" ".previous\n" diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h -index e95822d..a90010e 100644 +index 8bf1c06..f723dfd 100644 --- a/arch/x86/include/asm/desc.h +++ b/arch/x86/include/asm/desc.h @@ -4,6 +4,7 @@ @@ -10321,8 +10172,8 @@ index e95822d..a90010e 100644 +#include <asm/pgtable.h> #include <linux/smp.h> - -@@ -16,6 +17,7 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in + #include <linux/percpu.h> +@@ -17,6 +18,7 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in desc->type = (info->read_exec_only ^ 1) << 1; desc->type |= info->contents << 2; @@ -10330,7 +10181,7 @@ index e95822d..a90010e 100644 desc->s = 1; desc->dpl = 0x3; -@@ -34,19 +36,14 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in +@@ -35,19 +37,14 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in } extern struct desc_ptr idt_descr; @@ -10354,7 +10205,7 @@ index e95822d..a90010e 100644 } #ifdef CONFIG_X86_64 -@@ -71,8 +68,14 @@ static inline void pack_gate(gate_desc *gate, unsigned char type, +@@ -72,8 +69,14 @@ static inline void pack_gate(gate_desc *gate, unsigned char type, unsigned long base, unsigned dpl, unsigned flags, unsigned short seg) { @@ -10371,7 +10222,7 @@ index e95822d..a90010e 100644 } #endif -@@ -117,12 +120,16 @@ static inline void paravirt_free_ldt(struct desc_struct *ldt, unsigned entries) +@@ -118,12 +121,16 @@ static inline void paravirt_free_ldt(struct desc_struct *ldt, unsigned entries) static inline void native_write_idt_entry(gate_desc *idt, int entry, const gate_desc *gate) { @@ -10388,7 +10239,7 @@ index e95822d..a90010e 100644 } static inline void -@@ -136,7 +143,9 @@ native_write_gdt_entry(struct desc_struct *gdt, int entry, const void *desc, int +@@ -137,7 +144,9 @@ native_write_gdt_entry(struct desc_struct *gdt, int entry, const void *desc, int default: size = sizeof(*gdt); break; } @@ -10398,7 +10249,7 @@ index e95822d..a90010e 100644 } static inline void pack_descriptor(struct desc_struct *desc, unsigned long base, -@@ -209,7 +218,9 @@ static inline void native_set_ldt(const void *addr, unsigned int entries) +@@ -210,7 +219,9 @@ static inline void native_set_ldt(const void *addr, unsigned int entries) static inline void native_load_tr_desc(void) { @@ -10408,7 +10259,7 @@ index e95822d..a90010e 100644 } static inline void native_load_gdt(const struct desc_ptr *dtr) -@@ -246,8 +257,10 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu) +@@ -247,8 +258,10 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu) struct desc_struct *gdt = get_cpu_gdt_table(cpu); unsigned int i; @@ -10419,7 +10270,7 @@ index e95822d..a90010e 100644 } #define _LDT_empty(info) \ -@@ -310,7 +323,7 @@ static inline void set_desc_limit(struct desc_struct *desc, unsigned long limit) +@@ -311,7 +324,7 @@ static inline void set_desc_limit(struct desc_struct *desc, unsigned long limit) } #ifdef CONFIG_X86_64 @@ -10428,7 +10279,7 @@ index e95822d..a90010e 100644 { gate_desc s; -@@ -319,7 +332,7 @@ static inline void set_nmi_gate(int gate, void *addr) +@@ -320,7 +333,7 @@ static inline void set_nmi_gate(int gate, void *addr) } #endif @@ -10437,7 +10288,7 @@ index e95822d..a90010e 100644 unsigned dpl, unsigned ist, unsigned seg) { gate_desc s; -@@ -338,7 +351,7 @@ static inline void _set_gate(int gate, unsigned type, void *addr, +@@ -339,7 +352,7 @@ static inline void _set_gate(int gate, unsigned type, void *addr, * Pentium F0 0F bugfix can have resulted in the mapped * IDT being write-protected. */ @@ -10446,7 +10297,7 @@ index e95822d..a90010e 100644 { BUG_ON((unsigned)n > 0xFF); _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS); -@@ -368,19 +381,19 @@ static inline void alloc_intr_gate(unsigned int n, void *addr) +@@ -369,19 +382,19 @@ static inline void alloc_intr_gate(unsigned int n, void *addr) /* * This routine sets up an interrupt gate at directory privilege level 3. */ @@ -10469,7 +10320,7 @@ index e95822d..a90010e 100644 { BUG_ON((unsigned)n > 0xFF); _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS); -@@ -389,19 +402,31 @@ static inline void set_trap_gate(unsigned int n, void *addr) +@@ -390,19 +403,31 @@ static inline void set_trap_gate(unsigned int n, void *addr) static inline void set_task_gate(unsigned int n, unsigned int gdt_entry) { BUG_ON((unsigned)n > 0xFF); @@ -10615,7 +10466,7 @@ index cc70c1c..d96d011 100644 #endif /* _ASM_X86_EMERGENCY_RESTART_H */ diff --git a/arch/x86/include/asm/fpu-internal.h b/arch/x86/include/asm/fpu-internal.h -index 4fa8815..71b121a 100644 +index 75f4c6d..ee3eb8f 100644 --- a/arch/x86/include/asm/fpu-internal.h +++ b/arch/x86/include/asm/fpu-internal.h @@ -86,6 +86,11 @@ static inline int fxrstor_checking(struct i387_fxsave_struct *fx) @@ -10787,10 +10638,10 @@ index 5478825..839e88c 100644 #define flush_insn_slot(p) do { } while (0) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index e216ba0..453f6ec 100644 +index db7c1f2..92f130a 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h -@@ -679,7 +679,7 @@ struct kvm_x86_ops { +@@ -680,7 +680,7 @@ struct kvm_x86_ops { int (*check_intercept)(struct kvm_vcpu *vcpu, struct x86_instruction_info *info, enum x86_intercept_stage stage); @@ -11009,7 +10860,7 @@ index 5f55e69..e20bfb1 100644 #ifdef CONFIG_SMP diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h -index 6902152..da4283a 100644 +index cdbf367..adb37ac 100644 --- a/arch/x86/include/asm/mmu_context.h +++ b/arch/x86/include/asm/mmu_context.h @@ -24,6 +24,18 @@ void destroy_context(struct mm_struct *mm); @@ -11029,8 +10880,8 @@ index 6902152..da4283a 100644 +#endif + #ifdef CONFIG_SMP - if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK) - percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY); + if (this_cpu_read(cpu_tlbstate.state) == TLBSTATE_OK) + this_cpu_write(cpu_tlbstate.state, TLBSTATE_LAZY); @@ -34,16 +46,30 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next, struct task_struct *tsk) { @@ -11042,10 +10893,10 @@ index 6902152..da4283a 100644 if (likely(prev != next)) { #ifdef CONFIG_SMP +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)) -+ tlbstate = percpu_read(cpu_tlbstate.state); ++ tlbstate = this_cpu_read(cpu_tlbstate.state); +#endif - percpu_write(cpu_tlbstate.state, TLBSTATE_OK); - percpu_write(cpu_tlbstate.active_mm, next); + this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK); + this_cpu_write(cpu_tlbstate.active_mm, next); #endif cpumask_set_cpu(cpu, mm_cpumask(next)); @@ -11099,8 +10950,8 @@ index 6902152..da4283a 100644 +#endif + +#ifdef CONFIG_SMP - percpu_write(cpu_tlbstate.state, TLBSTATE_OK); - BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next); + this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK); + BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next); @@ -64,11 +119,28 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next, * tlb flush IPI delivery. We must reload CR3 @@ -11168,7 +11019,7 @@ index 9eae775..c914fea 100644 + #endif /* _ASM_X86_MODULE_H */ diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h -index 7639dbf..e08a58c 100644 +index 320f7bb..e89f8f8 100644 --- a/arch/x86/include/asm/page_64_types.h +++ b/arch/x86/include/asm/page_64_types.h @@ -56,7 +56,7 @@ void copy_page(void *to, void *from); @@ -11181,7 +11032,7 @@ index 7639dbf..e08a58c 100644 extern unsigned long __phys_addr(unsigned long); #define __phys_reloc_hide(x) (x) diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h -index aa0f913..0c5bc6a 100644 +index 6cbbabf..11b3aed 100644 --- a/arch/x86/include/asm/paravirt.h +++ b/arch/x86/include/asm/paravirt.h @@ -668,6 +668,18 @@ static inline void set_pgd(pgd_t *pgdp, pgd_t pgd) @@ -11234,7 +11085,7 @@ index aa0f913..0c5bc6a 100644 #endif #define INTERRUPT_RETURN \ -@@ -1042,6 +1069,21 @@ extern void default_banner(void); +@@ -1040,6 +1067,21 @@ extern void default_banner(void); PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \ CLBR_NONE, \ jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit)) @@ -11868,7 +11719,7 @@ index 013286a..8b42f4f 100644 #define pgprot_writecombine pgprot_writecombine extern pgprot_t pgprot_writecombine(pgprot_t prot); diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h -index 4fa7dcc..764e33a 100644 +index 39bc577..538233f 100644 --- a/arch/x86/include/asm/processor.h +++ b/arch/x86/include/asm/processor.h @@ -276,7 +276,7 @@ struct tss_struct { @@ -11880,7 +11731,7 @@ index 4fa7dcc..764e33a 100644 /* * Save the original ist values for checking stack pointers during debugging -@@ -807,11 +807,18 @@ static inline void spin_lock_prefetch(const void *x) +@@ -809,11 +809,18 @@ static inline void spin_lock_prefetch(const void *x) */ #define TASK_SIZE PAGE_OFFSET #define TASK_SIZE_MAX TASK_SIZE @@ -11901,7 +11752,7 @@ index 4fa7dcc..764e33a 100644 .vm86_info = NULL, \ .sysenter_cs = __KERNEL_CS, \ .io_bitmap_ptr = NULL, \ -@@ -825,7 +832,7 @@ static inline void spin_lock_prefetch(const void *x) +@@ -827,7 +834,7 @@ static inline void spin_lock_prefetch(const void *x) */ #define INIT_TSS { \ .x86_tss = { \ @@ -11910,7 +11761,7 @@ index 4fa7dcc..764e33a 100644 .ss0 = __KERNEL_DS, \ .ss1 = __KERNEL_CS, \ .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \ -@@ -836,11 +843,7 @@ static inline void spin_lock_prefetch(const void *x) +@@ -838,11 +845,7 @@ static inline void spin_lock_prefetch(const void *x) extern unsigned long thread_saved_pc(struct task_struct *tsk); #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long)) @@ -11923,7 +11774,7 @@ index 4fa7dcc..764e33a 100644 /* * The below -8 is to reserve 8 bytes on top of the ring0 stack. -@@ -855,7 +858,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk); +@@ -857,7 +860,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk); #define task_pt_regs(task) \ ({ \ struct pt_regs *__regs__; \ @@ -11932,7 +11783,7 @@ index 4fa7dcc..764e33a 100644 __regs__ - 1; \ }) -@@ -865,13 +868,13 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk); +@@ -867,13 +870,13 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk); /* * User space process size. 47bits minus one guard page. */ @@ -11948,7 +11799,7 @@ index 4fa7dcc..764e33a 100644 #define TASK_SIZE (test_thread_flag(TIF_ADDR32) ? \ IA32_PAGE_OFFSET : TASK_SIZE_MAX) -@@ -882,11 +885,11 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk); +@@ -884,11 +887,11 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk); #define STACK_TOP_MAX TASK_SIZE_MAX #define INIT_THREAD { \ @@ -11962,7 +11813,7 @@ index 4fa7dcc..764e33a 100644 } /* -@@ -914,6 +917,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip, +@@ -916,6 +919,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip, */ #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3)) @@ -11974,8 +11825,8 @@ index 4fa7dcc..764e33a 100644 /* Get/set a process' ability to use the timestamp counter instruction */ @@ -976,12 +983,12 @@ extern bool cpu_has_amd_erratum(const int *); - - void cpu_idle_wait(void); + #define cpu_has_amd_erratum(x) (false) + #endif /* CONFIG_CPU_SUP_AMD */ -extern unsigned long arch_align_stack(unsigned long sp); +#define arch_align_stack(x) ((x) & ~0xfUL) @@ -12047,6 +11898,19 @@ index dcfde52..dbfea06 100644 #endif } #endif +diff --git a/arch/x86/include/asm/realmode.h b/arch/x86/include/asm/realmode.h +index fce3f4a..3f69f2a 100644 +--- a/arch/x86/include/asm/realmode.h ++++ b/arch/x86/include/asm/realmode.h +@@ -30,7 +30,7 @@ struct real_mode_header { + struct trampoline_header { + #ifdef CONFIG_X86_32 + u32 start; +- u16 gdt_pad; ++ u16 boot_cs; + u16 gdt_limit; + u32 gdt_base; + #else diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h index 92f29706..a79cbbb 100644 --- a/arch/x86/include/asm/reboot.h @@ -12198,7 +12062,7 @@ index 2dbe4a7..ce1db00 100644 #endif /* __KERNEL__ */ diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h -index 1654662..5af4157 100644 +index c48a950..c6d7468 100644 --- a/arch/x86/include/asm/segment.h +++ b/arch/x86/include/asm/segment.h @@ -64,10 +64,15 @@ @@ -12267,7 +12131,7 @@ index 1654662..5af4157 100644 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8) #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8+3) #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8+3) -@@ -263,7 +279,7 @@ static inline unsigned long get_limit(unsigned long segment) +@@ -265,7 +281,7 @@ static inline unsigned long get_limit(unsigned long segment) { unsigned long __limit; asm("lsll %1,%0" : "=r" (__limit) : "r" (segment)); @@ -12277,7 +12141,7 @@ index 1654662..5af4157 100644 #endif /* !__ASSEMBLY__ */ diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h -index 0434c40..1714bf0 100644 +index f483945..64a7851 100644 --- a/arch/x86/include/asm/smp.h +++ b/arch/x86/include/asm/smp.h @@ -36,7 +36,7 @@ DECLARE_PER_CPU(cpumask_var_t, cpu_core_map); @@ -12289,7 +12153,7 @@ index 0434c40..1714bf0 100644 static inline struct cpumask *cpu_sibling_mask(int cpu) { -@@ -77,7 +77,7 @@ struct smp_ops { +@@ -79,7 +79,7 @@ struct smp_ops { void (*send_call_func_ipi)(const struct cpumask *mask); void (*send_call_func_single_ipi)(int cpu); @@ -12298,11 +12162,11 @@ index 0434c40..1714bf0 100644 /* Globals due to paravirt */ extern void set_cpu_sibling_map(int cpu); -@@ -192,14 +192,8 @@ extern unsigned disabled_cpus __cpuinitdata; +@@ -195,14 +195,8 @@ extern unsigned disabled_cpus __cpuinitdata; extern int safe_smp_processor_id(void); #elif defined(CONFIG_X86_64_SMP) --#define raw_smp_processor_id() (percpu_read(cpu_number)) +-#define raw_smp_processor_id() (this_cpu_read(cpu_number)) - -#define stack_smp_processor_id() \ -({ \ @@ -12310,16 +12174,16 @@ index 0434c40..1714bf0 100644 - __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \ - ti->cpu; \ -}) -+#define raw_smp_processor_id() (percpu_read(cpu_number)) ++#define raw_smp_processor_id() (this_cpu_read(cpu_number)) +#define stack_smp_processor_id() raw_smp_processor_id() #define safe_smp_processor_id() smp_processor_id() #endif diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h -index 76bfa2c..12d3fe7 100644 +index b315a33..8849ab0 100644 --- a/arch/x86/include/asm/spinlock.h +++ b/arch/x86/include/asm/spinlock.h -@@ -175,6 +175,14 @@ static inline int arch_write_can_lock(arch_rwlock_t *lock) +@@ -173,6 +173,14 @@ static inline int arch_write_can_lock(arch_rwlock_t *lock) static inline void arch_read_lock(arch_rwlock_t *rw) { asm volatile(LOCK_PREFIX READ_LOCK_SIZE(dec) " (%0)\n\t" @@ -12334,7 +12198,7 @@ index 76bfa2c..12d3fe7 100644 "jns 1f\n" "call __read_lock_failed\n\t" "1:\n" -@@ -184,6 +192,14 @@ static inline void arch_read_lock(arch_rwlock_t *rw) +@@ -182,6 +190,14 @@ static inline void arch_read_lock(arch_rwlock_t *rw) static inline void arch_write_lock(arch_rwlock_t *rw) { asm volatile(LOCK_PREFIX WRITE_LOCK_SUB(%1) "(%0)\n\t" @@ -12349,7 +12213,7 @@ index 76bfa2c..12d3fe7 100644 "jz 1f\n" "call __write_lock_failed\n\t" "1:\n" -@@ -213,13 +229,29 @@ static inline int arch_write_trylock(arch_rwlock_t *lock) +@@ -211,13 +227,29 @@ static inline int arch_write_trylock(arch_rwlock_t *lock) static inline void arch_read_unlock(arch_rwlock_t *rw) { @@ -12382,7 +12246,7 @@ index 76bfa2c..12d3fe7 100644 } diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h -index b5d9533..41655fa 100644 +index 6a99859..03cb807 100644 --- a/arch/x86/include/asm/stackprotector.h +++ b/arch/x86/include/asm/stackprotector.h @@ -47,7 +47,7 @@ @@ -12492,7 +12356,7 @@ index 3fda9db4..4ca1c61 100644 asmlinkage long sys32_sched_rr_get_interval(compat_pid_t, diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h -index ad6df8c..5e0cf6e 100644 +index 89f794f..1422765 100644 --- a/arch/x86/include/asm/thread_info.h +++ b/arch/x86/include/asm/thread_info.h @@ -10,6 +10,7 @@ @@ -12542,7 +12406,7 @@ index ad6df8c..5e0cf6e 100644 #define init_stack (init_thread_union.stack) #else /* !__ASSEMBLY__ */ -@@ -97,6 +91,7 @@ struct thread_info { +@@ -98,6 +92,7 @@ struct thread_info { #define TIF_SYSCALL_TRACEPOINT 28 /* syscall tracepoint instrumentation */ #define TIF_ADDR32 29 /* 32-bit address space on 64 bits */ #define TIF_X32 30 /* 32-bit native x86-64 binary */ @@ -12550,7 +12414,7 @@ index ad6df8c..5e0cf6e 100644 #define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE) #define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME) -@@ -120,16 +115,18 @@ struct thread_info { +@@ -122,16 +117,18 @@ struct thread_info { #define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT) #define _TIF_ADDR32 (1 << TIF_ADDR32) #define _TIF_X32 (1 << TIF_X32) @@ -12571,7 +12435,7 @@ index ad6df8c..5e0cf6e 100644 /* work to do on interrupt/exception return */ #define _TIF_WORK_MASK \ -@@ -139,7 +136,8 @@ struct thread_info { +@@ -141,7 +138,8 @@ struct thread_info { /* work to do on any return to user space */ #define _TIF_ALLWORK_MASK \ @@ -12581,9 +12445,9 @@ index ad6df8c..5e0cf6e 100644 /* Only used for 64 bit */ #define _TIF_DO_NOTIFY_MASK \ -@@ -173,45 +171,40 @@ struct thread_info { - ret; \ - }) +@@ -157,45 +155,40 @@ struct thread_info { + + #define PREEMPT_ACTIVE 0x10000000 -#ifdef CONFIG_X86_32 - @@ -12625,7 +12489,7 @@ index ad6df8c..5e0cf6e 100644 + +static __always_inline struct thread_info *current_thread_info(void) +{ -+ return percpu_read_stable(current_tinfo); ++ return this_cpu_read_stable(current_tinfo); +} +#endif + @@ -12652,14 +12516,14 @@ index ad6df8c..5e0cf6e 100644 /* * macros/functions for gaining access to the thread information structure * preempt_count needs to be 1 initially, until the scheduler is functional. -@@ -219,27 +212,8 @@ static inline struct thread_info *current_thread_info(void) +@@ -203,27 +196,8 @@ static inline struct thread_info *current_thread_info(void) #ifndef __ASSEMBLY__ DECLARE_PER_CPU(unsigned long, kernel_stack); -static inline struct thread_info *current_thread_info(void) -{ - struct thread_info *ti; -- ti = (void *)(percpu_read_stable(kernel_stack) + +- ti = (void *)(this_cpu_read_stable(kernel_stack) + - KERNEL_STACK_OFFSET - THREAD_SIZE); - return ti; -} @@ -12682,10 +12546,10 @@ index ad6df8c..5e0cf6e 100644 #endif #endif /* !X86_32 */ -@@ -285,5 +259,16 @@ extern void arch_task_cache_init(void); - extern void free_thread_info(struct thread_info *ti); +@@ -284,5 +258,12 @@ static inline bool is_ia32_task(void) + extern void arch_task_cache_init(void); extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src); - #define arch_task_cache_init arch_task_cache_init + extern void arch_release_task_struct(struct task_struct *tsk); + +#define __HAVE_THREAD_FUNCTIONS +#define task_thread_info(task) (&(task)->tinfo) @@ -12693,14 +12557,10 @@ index ad6df8c..5e0cf6e 100644 +#define setup_thread_stack(p, org) do {} while (0) +#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1) + -+#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR -+extern struct task_struct *alloc_task_struct_node(int node); -+extern void free_task_struct(struct task_struct *); -+ #endif #endif /* _ASM_X86_THREAD_INFO_H */ diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h -index e054459..14bc8a7 100644 +index e1f3a17..1ab364d 100644 --- a/arch/x86/include/asm/uaccess.h +++ b/arch/x86/include/asm/uaccess.h @@ -7,12 +7,15 @@ @@ -12732,19 +12592,20 @@ index e054459..14bc8a7 100644 #define segment_eq(a, b) ((a).seg == (b).seg) -@@ -76,7 +84,33 @@ +@@ -76,8 +84,33 @@ * checks that the pointer is in the user space range - after calling * this function, memory access functions may still return -EFAULT. */ --#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0)) -+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0)) +-#define access_ok(type, addr, size) \ +- (likely(__range_not_ok(addr, size, user_addr_max()) == 0)) ++#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size, user_addr_max()) == 0)) +#define access_ok(type, addr, size) \ +({ \ + long __size = size; \ + unsigned long __addr = (unsigned long)addr; \ + unsigned long __addr_ao = __addr & PAGE_MASK; \ + unsigned long __end_ao = __addr + __size - 1; \ -+ bool __ret_ao = __range_not_ok(__addr, __size) == 0; \ ++ bool __ret_ao = __range_not_ok(__addr, __size, user_addr_max()) == 0;\ + if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \ + while(__addr_ao <= __end_ao) { \ + char __c_ao; \ @@ -12766,8 +12627,8 @@ index e054459..14bc8a7 100644 +}) /* - * The exception table consists of pairs of addresses: the first is the -@@ -182,12 +216,20 @@ extern int __get_user_bad(void); + * The exception table consists of pairs of addresses relative to the +@@ -188,12 +221,20 @@ extern int __get_user_bad(void); asm volatile("call __put_user_" #size : "=a" (__ret_pu) \ : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx") @@ -12791,7 +12652,7 @@ index e054459..14bc8a7 100644 "3:\n" \ ".section .fixup,\"ax\"\n" \ "4: movl %3,%0\n" \ -@@ -199,8 +241,8 @@ extern int __get_user_bad(void); +@@ -205,8 +246,8 @@ extern int __get_user_bad(void); : "A" (x), "r" (addr), "i" (errret), "0" (err)) #define __put_user_asm_ex_u64(x, addr) \ @@ -12800,9 +12661,9 @@ index e054459..14bc8a7 100644 + asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \ + "2: "__copyuser_seg"movl %%edx,4(%1)\n" \ "3:\n" \ - _ASM_EXTABLE(1b, 2b - 1b) \ - _ASM_EXTABLE(2b, 3b - 2b) \ -@@ -252,7 +294,7 @@ extern void __put_user_8(void); + _ASM_EXTABLE_EX(1b, 2b) \ + _ASM_EXTABLE_EX(2b, 3b) \ +@@ -258,7 +299,7 @@ extern void __put_user_8(void); __typeof__(*(ptr)) __pu_val; \ __chk_user_ptr(ptr); \ might_fault(); \ @@ -12811,7 +12672,7 @@ index e054459..14bc8a7 100644 switch (sizeof(*(ptr))) { \ case 1: \ __put_user_x(1, __pu_val, ptr, __ret_pu); \ -@@ -373,7 +415,7 @@ do { \ +@@ -379,7 +420,7 @@ do { \ } while (0) #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \ @@ -12820,7 +12681,7 @@ index e054459..14bc8a7 100644 "2:\n" \ ".section .fixup,\"ax\"\n" \ "3: mov %3,%0\n" \ -@@ -381,7 +423,7 @@ do { \ +@@ -387,7 +428,7 @@ do { \ " jmp 2b\n" \ ".previous\n" \ _ASM_EXTABLE(1b, 3b) \ @@ -12829,16 +12690,16 @@ index e054459..14bc8a7 100644 : "m" (__m(addr)), "i" (errret), "0" (err)) #define __get_user_size_ex(x, ptr, size) \ -@@ -406,7 +448,7 @@ do { \ +@@ -412,7 +453,7 @@ do { \ } while (0) #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \ - asm volatile("1: mov"itype" %1,%"rtype"0\n" \ + asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\ "2:\n" \ - _ASM_EXTABLE(1b, 2b - 1b) \ + _ASM_EXTABLE_EX(1b, 2b) \ : ltype(x) : "m" (__m(addr))) -@@ -423,13 +465,24 @@ do { \ +@@ -429,13 +470,24 @@ do { \ int __gu_err; \ unsigned long __gu_val; \ __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \ @@ -12865,7 +12726,7 @@ index e054459..14bc8a7 100644 /* * Tell gcc we read from memory instead of writing: this is because -@@ -437,7 +490,7 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -443,7 +495,7 @@ struct __large_struct { unsigned long buf[100]; }; * aliasing issues. */ #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \ @@ -12874,7 +12735,7 @@ index e054459..14bc8a7 100644 "2:\n" \ ".section .fixup,\"ax\"\n" \ "3: mov %3,%0\n" \ -@@ -445,10 +498,10 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -451,10 +503,10 @@ struct __large_struct { unsigned long buf[100]; }; ".previous\n" \ _ASM_EXTABLE(1b, 3b) \ : "=r"(err) \ @@ -12885,9 +12746,9 @@ index e054459..14bc8a7 100644 - asm volatile("1: mov"itype" %"rtype"0,%1\n" \ + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\ "2:\n" \ - _ASM_EXTABLE(1b, 2b - 1b) \ + _ASM_EXTABLE_EX(1b, 2b) \ : : ltype(x), "m" (__m(addr))) -@@ -487,8 +540,12 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -493,8 +545,12 @@ struct __large_struct { unsigned long buf[100]; }; * On error, the variable @x is set to zero. */ @@ -12900,7 +12761,7 @@ index e054459..14bc8a7 100644 /** * __put_user: - Write a simple value into user space, with less checking. -@@ -510,8 +567,12 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -516,8 +572,12 @@ struct __large_struct { unsigned long buf[100]; }; * Returns zero on success, or -EFAULT on error. */ @@ -12913,7 +12774,7 @@ index e054459..14bc8a7 100644 #define __get_user_unaligned __get_user #define __put_user_unaligned __put_user -@@ -529,7 +590,7 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -535,7 +595,7 @@ struct __large_struct { unsigned long buf[100]; }; #define get_user_ex(x, ptr) do { \ unsigned long __gue_val; \ __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \ @@ -12923,7 +12784,7 @@ index e054459..14bc8a7 100644 #ifdef CONFIG_X86_WP_WORKS_OK diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h -index 8084bc7..3d6ec37 100644 +index 576e39b..ccd0a39 100644 --- a/arch/x86/include/asm/uaccess_32.h +++ b/arch/x86/include/asm/uaccess_32.h @@ -11,15 +11,15 @@ @@ -13041,7 +12902,7 @@ index 8084bc7..3d6ec37 100644 extern void copy_from_user_overflow(void) #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS -@@ -199,17 +222,61 @@ extern void copy_from_user_overflow(void) +@@ -199,21 +222,65 @@ extern void copy_from_user_overflow(void) #endif ; @@ -13111,10 +12972,6 @@ index 8084bc7..3d6ec37 100644 return n; } -@@ -230,7 +297,7 @@ static inline unsigned long __must_check copy_from_user(void *to, - #define strlen_user(str) strnlen_user(str, LONG_MAX) - - long strnlen_user(const char __user *str, long n); -unsigned long __must_check clear_user(void __user *mem, unsigned long len); -unsigned long __must_check __clear_user(void __user *mem, unsigned long len); +unsigned long __must_check clear_user(void __user *mem, unsigned long len) __size_overflow(2); @@ -13122,7 +12979,7 @@ index 8084bc7..3d6ec37 100644 #endif /* _ASM_X86_UACCESS_32_H */ diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h -index fcd4b6f..ef04f8f 100644 +index 8e796fb..72fd934 100644 --- a/arch/x86/include/asm/uaccess_64.h +++ b/arch/x86/include/asm/uaccess_64.h @@ -10,6 +10,9 @@ @@ -13467,7 +13324,7 @@ index fcd4b6f..ef04f8f 100644 ret, "q", "", "=r", 8); if (likely(!ret)) __put_user_asm(tmp, (u64 __user *)dst, -@@ -203,47 +304,92 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size) +@@ -203,44 +304,89 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size) return ret; } default: @@ -13486,9 +13343,6 @@ index fcd4b6f..ef04f8f 100644 } } - __must_check long strnlen_user(const char __user *str, long n); - __must_check long __strnlen_user(const char __user *str, long n); - __must_check long strlen_user(const char __user *str); -__must_check unsigned long clear_user(void __user *mem, unsigned long len); -__must_check unsigned long __clear_user(void __user *mem, unsigned long len); +__must_check unsigned long clear_user(void __user *mem, unsigned long len) __size_overflow(2); @@ -13591,8 +13445,21 @@ index bb05228..d763d5b 100644 }) #endif +diff --git a/arch/x86/include/asm/word-at-a-time.h b/arch/x86/include/asm/word-at-a-time.h +index 5b238981..77fdd78 100644 +--- a/arch/x86/include/asm/word-at-a-time.h ++++ b/arch/x86/include/asm/word-at-a-time.h +@@ -11,7 +11,7 @@ + * and shift, for example. + */ + struct word_at_a_time { +- const unsigned long one_bits, high_bits; ++ unsigned long one_bits, high_bits; + }; + + #define WORD_AT_A_TIME_CONSTANTS { REPEAT_BYTE(0x01), REPEAT_BYTE(0x80) } diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h -index 764b66a..ad3cfc8 100644 +index c090af1..7e7bf16 100644 --- a/arch/x86/include/asm/x86_init.h +++ b/arch/x86/include/asm/x86_init.h @@ -29,7 +29,7 @@ struct x86_init_mpparse { @@ -13703,17 +13570,25 @@ index 764b66a..ad3cfc8 100644 struct pci_dev; -@@ -186,7 +186,7 @@ struct x86_msi_ops { +@@ -186,14 +186,14 @@ struct x86_msi_ops { void (*teardown_msi_irq)(unsigned int irq); void (*teardown_msi_irqs)(struct pci_dev *dev); void (*restore_msi_irqs)(struct pci_dev *dev, int irq); -}; +} __no_const; + struct x86_io_apic_ops { + void (*init) (void); + unsigned int (*read) (unsigned int apic, unsigned int reg); + void (*write) (unsigned int apic, unsigned int reg, unsigned int value); + void (*modify)(unsigned int apic, unsigned int reg, unsigned int value); +-}; ++} __no_const; + extern struct x86_init_ops x86_init; extern struct x86_cpuinit_ops x86_cpuinit; diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h -index c6ce245..ffbdab7 100644 +index 8a1b6f9..a29c4e4 100644 --- a/arch/x86/include/asm/xsave.h +++ b/arch/x86/include/asm/xsave.h @@ -65,6 +65,11 @@ static inline int xsave_user(struct xsave_struct __user *buf) @@ -13728,7 +13603,7 @@ index c6ce245..ffbdab7 100644 /* * Clear the xsave header first, so that reserved fields are * initialized to zero. -@@ -96,10 +101,15 @@ static inline int xsave_user(struct xsave_struct __user *buf) +@@ -93,10 +98,15 @@ static inline int xsave_user(struct xsave_struct __user *buf) static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask) { int err; @@ -13745,48 +13620,12 @@ index c6ce245..ffbdab7 100644 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n" "2:\n" ".section .fixup,\"ax\"\n" -diff --git a/arch/x86/kernel/acpi/realmode/Makefile b/arch/x86/kernel/acpi/realmode/Makefile -index 6a564ac..9b1340c 100644 ---- a/arch/x86/kernel/acpi/realmode/Makefile -+++ b/arch/x86/kernel/acpi/realmode/Makefile -@@ -41,6 +41,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os -D_SETUP -D_WAKEUP -D__KERNEL__ \ - $(call cc-option, -fno-stack-protector) \ - $(call cc-option, -mpreferred-stack-boundary=2) - KBUILD_CFLAGS += $(call cc-option, -m32) -+ifdef CONSTIFY_PLUGIN -+KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify -+endif - KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ - GCOV_PROFILE := n - -diff --git a/arch/x86/kernel/acpi/realmode/wakeup.S b/arch/x86/kernel/acpi/realmode/wakeup.S -index b4fd836..4358fe3 100644 ---- a/arch/x86/kernel/acpi/realmode/wakeup.S -+++ b/arch/x86/kernel/acpi/realmode/wakeup.S -@@ -108,6 +108,9 @@ wakeup_code: - /* Do any other stuff... */ - - #ifndef CONFIG_64BIT -+ /* Recheck NX bit overrides (64bit path does this in trampoline */ -+ call verify_cpu -+ - /* This could also be done in C code... */ - movl pmode_cr3, %eax - movl %eax, %cr3 -@@ -131,6 +134,7 @@ wakeup_code: - movl pmode_cr0, %eax - movl %eax, %cr0 - jmp pmode_return -+# include "../../verify_cpu.S" - #else - pushw $0 - pushw trampoline_segment diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c -index 146a49c..1b5338b 100644 +index 95bf99de..de9235c 100644 --- a/arch/x86/kernel/acpi/sleep.c +++ b/arch/x86/kernel/acpi/sleep.c -@@ -98,8 +98,12 @@ int acpi_suspend_lowlevel(void) - header->trampoline_segment = trampoline_address() >> 4; +@@ -73,8 +73,12 @@ int acpi_suspend_lowlevel(void) + #else /* CONFIG_64BIT */ #ifdef CONFIG_SMP stack_start = (unsigned long)temp_stack + sizeof(temp_stack); + @@ -13956,10 +13795,10 @@ index 1f84794..e23f862 100644 } diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c -index edc2448..553e7c5 100644 +index 39a222e..85a7767 100644 --- a/arch/x86/kernel/apic/apic.c +++ b/arch/x86/kernel/apic/apic.c -@@ -184,7 +184,7 @@ int first_system_vector = 0xfe; +@@ -185,7 +185,7 @@ int first_system_vector = 0xfe; /* * Debug level, exported for io_apic.c */ @@ -13968,7 +13807,7 @@ index edc2448..553e7c5 100644 int pic_mode; -@@ -1917,7 +1917,7 @@ void smp_error_interrupt(struct pt_regs *regs) +@@ -1923,7 +1923,7 @@ void smp_error_interrupt(struct pt_regs *regs) apic_write(APIC_ESR, 0); v1 = apic_read(APIC_ESR); ack_APIC_irq(); @@ -13978,21 +13817,10 @@ index edc2448..553e7c5 100644 apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x(%02x)", smp_processor_id(), v0 , v1); diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c -index e88300d..cd5a87a 100644 +index 5f0ff59..f9e01bc 100644 --- a/arch/x86/kernel/apic/io_apic.c +++ b/arch/x86/kernel/apic/io_apic.c -@@ -83,7 +83,9 @@ static struct io_apic_ops io_apic_ops = { - - void __init set_io_apic_ops(const struct io_apic_ops *ops) - { -- io_apic_ops = *ops; -+ pax_open_kernel(); -+ memcpy((void*)&io_apic_ops, ops, sizeof io_apic_ops); -+ pax_close_kernel(); - } - - /* -@@ -1135,7 +1137,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, int slot, int pin, +@@ -1084,7 +1084,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, int slot, int pin, } EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector); @@ -14001,7 +13829,7 @@ index e88300d..cd5a87a 100644 { /* Used to the online set of cpus does not change * during assign_irq_vector. -@@ -1143,7 +1145,7 @@ void lock_vector_lock(void) +@@ -1092,7 +1092,7 @@ void lock_vector_lock(void) raw_spin_lock(&vector_lock); } @@ -14010,7 +13838,7 @@ index e88300d..cd5a87a 100644 { raw_spin_unlock(&vector_lock); } -@@ -2549,7 +2551,7 @@ static void ack_apic_edge(struct irq_data *data) +@@ -2369,7 +2369,7 @@ static void ack_apic_edge(struct irq_data *data) ack_APIC_irq(); } @@ -14018,8 +13846,8 @@ index e88300d..cd5a87a 100644 +atomic_unchecked_t irq_mis_count; #ifdef CONFIG_GENERIC_PENDING_IRQ - static inline bool ioapic_irqd_mask(struct irq_data *data, struct irq_cfg *cfg) -@@ -2667,7 +2669,7 @@ static void ack_apic_level(struct irq_data *data) + static bool io_apic_level_ack_pending(struct irq_cfg *cfg) +@@ -2510,7 +2510,7 @@ static void ack_apic_level(struct irq_data *data) * at the cpu. */ if (!(v & (1 << (i & 0x1f)))) { @@ -14029,7 +13857,7 @@ index e88300d..cd5a87a 100644 eoi_ioapic_irq(irq, cfg); } diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c -index 459e78c..f037006 100644 +index 07b0c0d..1df6f42 100644 --- a/arch/x86/kernel/apm_32.c +++ b/arch/x86/kernel/apm_32.c @@ -410,7 +410,7 @@ static DEFINE_MUTEX(apm_mutex); @@ -14184,7 +14012,7 @@ index 146bb62..ac9c74a 100644 if (c->x86_model == 3 && c->x86_mask == 0) size = 64; diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index cf79302..b1b28ae 100644 +index 6b9333b..4c3083a 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -86,60 +86,6 @@ static const struct cpu_dev __cpuinitconst default_cpu = { @@ -14292,7 +14120,7 @@ index cf79302..b1b28ae 100644 EXPORT_PER_CPU_SYMBOL(kernel_stack); DEFINE_PER_CPU(char *, irq_stack_ptr) = -@@ -1126,7 +1078,7 @@ struct pt_regs * __cpuinit idle_regs(struct pt_regs *regs) +@@ -1132,7 +1084,7 @@ struct pt_regs * __cpuinit idle_regs(struct pt_regs *regs) { memset(regs, 0, sizeof(struct pt_regs)); regs->fs = __KERNEL_PERCPU; @@ -14301,7 +14129,7 @@ index cf79302..b1b28ae 100644 return regs; } -@@ -1181,7 +1133,7 @@ void __cpuinit cpu_init(void) +@@ -1187,7 +1139,7 @@ void __cpuinit cpu_init(void) int i; cpu = stack_smp_processor_id(); @@ -14310,7 +14138,7 @@ index cf79302..b1b28ae 100644 oist = &per_cpu(orig_ist, cpu); #ifdef CONFIG_NUMA -@@ -1207,7 +1159,7 @@ void __cpuinit cpu_init(void) +@@ -1213,7 +1165,7 @@ void __cpuinit cpu_init(void) switch_to_new_gdt(cpu); loadsegment(fs, 0); @@ -14319,7 +14147,7 @@ index cf79302..b1b28ae 100644 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8); syscall_init(); -@@ -1216,7 +1168,6 @@ void __cpuinit cpu_init(void) +@@ -1222,7 +1174,6 @@ void __cpuinit cpu_init(void) wrmsrl(MSR_KERNEL_GS_BASE, 0); barrier(); @@ -14327,7 +14155,7 @@ index cf79302..b1b28ae 100644 if (cpu != 0) enable_x2apic(); -@@ -1272,7 +1223,7 @@ void __cpuinit cpu_init(void) +@@ -1278,7 +1229,7 @@ void __cpuinit cpu_init(void) { int cpu = smp_processor_id(); struct task_struct *curr = current; @@ -14350,7 +14178,7 @@ index 3e6ff6c..54b4992 100644 } #endif diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c -index 61604ae..98250a5 100644 +index da27c5d..569e359 100644 --- a/arch/x86/kernel/cpu/mcheck/mce.c +++ b/arch/x86/kernel/cpu/mcheck/mce.c @@ -42,6 +42,7 @@ @@ -14401,7 +14229,7 @@ index 61604ae..98250a5 100644 return; } /* First print corrected ones that are still unlogged */ -@@ -684,7 +685,7 @@ static int mce_timed_out(u64 *t) +@@ -686,7 +687,7 @@ static int mce_timed_out(u64 *t) * might have been modified by someone else. */ rmb(); @@ -14410,7 +14238,7 @@ index 61604ae..98250a5 100644 wait_for_panic(); if (!monarch_timeout) goto out; -@@ -1535,7 +1536,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code) +@@ -1579,7 +1580,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code) } /* Call the installed machine check handler for this CPU setup. */ @@ -14419,7 +14247,7 @@ index 61604ae..98250a5 100644 unexpected_machine_check; /* -@@ -1558,7 +1559,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) +@@ -1602,7 +1603,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) return; } @@ -14429,7 +14257,7 @@ index 61604ae..98250a5 100644 __mcheck_cpu_init_generic(); __mcheck_cpu_init_vendor(c); -@@ -1572,7 +1575,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) +@@ -1616,7 +1619,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c) */ static DEFINE_SPINLOCK(mce_chrdev_state_lock); @@ -14438,7 +14266,7 @@ index 61604ae..98250a5 100644 static int mce_chrdev_open_exclu; /* already open exclusive? */ static int mce_chrdev_open(struct inode *inode, struct file *file) -@@ -1580,7 +1583,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) +@@ -1624,7 +1627,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) spin_lock(&mce_chrdev_state_lock); if (mce_chrdev_open_exclu || @@ -14447,7 +14275,7 @@ index 61604ae..98250a5 100644 spin_unlock(&mce_chrdev_state_lock); return -EBUSY; -@@ -1588,7 +1591,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) +@@ -1632,7 +1635,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file) if (file->f_flags & O_EXCL) mce_chrdev_open_exclu = 1; @@ -14456,7 +14284,7 @@ index 61604ae..98250a5 100644 spin_unlock(&mce_chrdev_state_lock); -@@ -1599,7 +1602,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file) +@@ -1643,7 +1646,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file) { spin_lock(&mce_chrdev_state_lock); @@ -14465,7 +14293,7 @@ index 61604ae..98250a5 100644 mce_chrdev_open_exclu = 0; spin_unlock(&mce_chrdev_state_lock); -@@ -2324,7 +2327,7 @@ struct dentry *mce_get_debugfs_dir(void) +@@ -2368,7 +2371,7 @@ struct dentry *mce_get_debugfs_dir(void) static void mce_reset(void) { cpu_missing = 0; @@ -14545,10 +14373,10 @@ index df5e41f..816c719 100644 extern int generic_get_free_region(unsigned long base, unsigned long size, int replace_reg); diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c -index bb8e034..fb9020b 100644 +index c4706cf..264b0f7 100644 --- a/arch/x86/kernel/cpu/perf_event.c +++ b/arch/x86/kernel/cpu/perf_event.c -@@ -1835,7 +1835,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs) +@@ -1837,7 +1837,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs) break; perf_callchain_store(entry, frame.return_address); @@ -14609,7 +14437,7 @@ index 37250fe..bf2ec74 100644 .__cr3 = __pa_nodebug(swapper_pg_dir), diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c -index 1b81839..0b4e7b0 100644 +index 571246d..81f335c 100644 --- a/arch/x86/kernel/dumpstack.c +++ b/arch/x86/kernel/dumpstack.c @@ -2,6 +2,9 @@ @@ -14746,7 +14574,7 @@ index 1b81839..0b4e7b0 100644 int __kprobes __die(const char *str, struct pt_regs *regs, long err) @@ -273,7 +277,7 @@ int __kprobes __die(const char *str, struct pt_regs *regs, long err) - show_registers(regs); + show_regs(regs); #ifdef CONFIG_X86_32 - if (user_mode_vm(regs)) { + if (user_mode(regs)) { @@ -14763,7 +14591,7 @@ index 1b81839..0b4e7b0 100644 if (__die(str, regs, err)) diff --git a/arch/x86/kernel/dumpstack_32.c b/arch/x86/kernel/dumpstack_32.c -index 88ec912..e95e935 100644 +index e0b1d78..a8ade5e 100644 --- a/arch/x86/kernel/dumpstack_32.c +++ b/arch/x86/kernel/dumpstack_32.c @@ -38,15 +38,13 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs, @@ -14786,7 +14614,7 @@ index 88ec912..e95e935 100644 if (ops->stack(data, "IRQ") < 0) break; touch_nmi_watchdog(); -@@ -87,7 +85,7 @@ void show_registers(struct pt_regs *regs) +@@ -87,7 +85,7 @@ void show_regs(struct pt_regs *regs) int i; print_modules(); @@ -14795,7 +14623,7 @@ index 88ec912..e95e935 100644 printk(KERN_EMERG "Process %.*s (pid: %d, ti=%p task=%p task.ti=%p)\n", TASK_COMM_LEN, current->comm, task_pid_nr(current), -@@ -96,21 +94,22 @@ void show_registers(struct pt_regs *regs) +@@ -96,21 +94,22 @@ void show_regs(struct pt_regs *regs) * When in-kernel, we also print out the stack and code at the * time of the fault.. */ @@ -14821,7 +14649,7 @@ index 88ec912..e95e935 100644 code_len = code_len - code_prologue + 1; } for (i = 0; i < code_len; i++, ip++) { -@@ -119,7 +118,7 @@ void show_registers(struct pt_regs *regs) +@@ -119,7 +118,7 @@ void show_regs(struct pt_regs *regs) printk(KERN_CONT " Bad EIP value."); break; } @@ -14855,7 +14683,7 @@ index 88ec912..e95e935 100644 +EXPORT_SYMBOL(pax_check_alloca); +#endif diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c -index 17107bd..9623722 100644 +index 791b761..2ab6e33 100644 --- a/arch/x86/kernel/dumpstack_64.c +++ b/arch/x86/kernel/dumpstack_64.c @@ -119,9 +119,9 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs, @@ -14983,10 +14811,10 @@ index 9b9f18b..9fcaa04 100644 #include <asm/processor.h> #include <asm/fcntl.h> diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S -index 7b784f4..db6b628 100644 +index 623f288..0683156 100644 --- a/arch/x86/kernel/entry_32.S +++ b/arch/x86/kernel/entry_32.S -@@ -179,13 +179,146 @@ +@@ -176,13 +176,146 @@ /*CFI_REL_OFFSET gs, PT_GS*/ .endm .macro SET_KERNEL_GS reg @@ -15134,7 +14962,7 @@ index 7b784f4..db6b628 100644 cld PUSH_GS pushl_cfi %fs -@@ -208,7 +341,7 @@ +@@ -205,7 +338,7 @@ CFI_REL_OFFSET ecx, 0 pushl_cfi %ebx CFI_REL_OFFSET ebx, 0 @@ -15143,7 +14971,7 @@ index 7b784f4..db6b628 100644 movl %edx, %ds movl %edx, %es movl $(__KERNEL_PERCPU), %edx -@@ -216,6 +349,15 @@ +@@ -213,6 +346,15 @@ SET_KERNEL_GS %edx .endm @@ -15159,7 +14987,7 @@ index 7b784f4..db6b628 100644 .macro RESTORE_INT_REGS popl_cfi %ebx CFI_RESTORE ebx -@@ -301,7 +443,7 @@ ENTRY(ret_from_fork) +@@ -296,7 +438,7 @@ ENTRY(ret_from_fork) popfl_cfi jmp syscall_exit CFI_ENDPROC @@ -15168,7 +14996,7 @@ index 7b784f4..db6b628 100644 /* * Interrupt exit functions should be protected against kprobes -@@ -335,7 +477,15 @@ resume_userspace_sig: +@@ -329,7 +471,15 @@ ret_from_intr: andl $SEGMENT_RPL_MASK, %eax #endif cmpl $USER_RPL, %eax @@ -15184,7 +15012,7 @@ index 7b784f4..db6b628 100644 ENTRY(resume_userspace) LOCKDEP_SYS_EXIT -@@ -347,8 +497,8 @@ ENTRY(resume_userspace) +@@ -341,8 +491,8 @@ ENTRY(resume_userspace) andl $_TIF_WORK_MASK, %ecx # is there any work to be done on # int/exception return? jne work_pending @@ -15195,7 +15023,7 @@ index 7b784f4..db6b628 100644 #ifdef CONFIG_PREEMPT ENTRY(resume_kernel) -@@ -363,7 +513,7 @@ need_resched: +@@ -357,7 +507,7 @@ need_resched: jz restore_all call preempt_schedule_irq jmp need_resched @@ -15204,7 +15032,7 @@ index 7b784f4..db6b628 100644 #endif CFI_ENDPROC /* -@@ -397,23 +547,34 @@ sysenter_past_esp: +@@ -391,23 +541,34 @@ sysenter_past_esp: /*CFI_REL_OFFSET cs, 0*/ /* * Push current_thread_info()->sysenter_return to the stack. @@ -15240,9 +15068,9 @@ index 7b784f4..db6b628 100644 +#endif + movl %ebp,PT_EBP(%esp) - .section __ex_table,"a" - .align 4 -@@ -436,12 +597,24 @@ sysenter_do_call: + _ASM_EXTABLE(1b,syscall_fault) + +@@ -427,12 +588,24 @@ sysenter_do_call: testl $_TIF_ALLWORK_MASK, %ecx jne sysexit_audit sysenter_exit: @@ -15267,7 +15095,7 @@ index 7b784f4..db6b628 100644 PTGS_TO_GS ENABLE_INTERRUPTS_SYSEXIT -@@ -458,6 +631,9 @@ sysenter_audit: +@@ -449,6 +622,9 @@ sysenter_audit: movl %eax,%edx /* 2nd arg: syscall number */ movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */ call __audit_syscall_entry @@ -15277,7 +15105,7 @@ index 7b784f4..db6b628 100644 pushl_cfi %ebx movl PT_EAX(%esp),%eax /* reload syscall number */ jmp sysenter_do_call -@@ -483,11 +659,17 @@ sysexit_audit: +@@ -474,10 +650,16 @@ sysexit_audit: CFI_ENDPROC .pushsection .fixup,"ax" @@ -15288,16 +15116,15 @@ index 7b784f4..db6b628 100644 + jmp 1b +6: movl $0,PT_ES(%esp) jmp 1b - .section __ex_table,"a" - .align 4 -- .long 1b,2b -+ .long 1b,4b -+ .long 2b,5b -+ .long 3b,6b .popsection +- _ASM_EXTABLE(1b,2b) ++ _ASM_EXTABLE(1b,4b) ++ _ASM_EXTABLE(2b,5b) ++ _ASM_EXTABLE(3b,6b) PTGS_TO_GS_EX ENDPROC(ia32_sysenter_target) -@@ -520,6 +702,15 @@ syscall_exit: + +@@ -509,6 +691,15 @@ syscall_exit: testl $_TIF_ALLWORK_MASK, %ecx # current->work jne syscall_exit_work @@ -15313,7 +15140,7 @@ index 7b784f4..db6b628 100644 restore_all: TRACE_IRQS_IRET restore_all_notrace: -@@ -579,14 +770,34 @@ ldt_ss: +@@ -565,14 +756,34 @@ ldt_ss: * compensating for the offset by changing to the ESPFIX segment with * a base address that matches for the difference. */ @@ -15351,7 +15178,7 @@ index 7b784f4..db6b628 100644 pushl_cfi $__ESPFIX_SS pushl_cfi %eax /* new kernel esp */ /* Disable interrupts, but do not irqtrace this section: we -@@ -615,38 +826,30 @@ work_resched: +@@ -601,35 +812,23 @@ work_resched: movl TI_flags(%ebp), %ecx andl $_TIF_WORK_MASK, %ecx # is there any work to be done other # than syscall tracing? @@ -15371,9 +15198,13 @@ index 7b784f4..db6b628 100644 # vm86-space - TRACE_IRQS_ON - ENABLE_INTERRUPTS(CLBR_NONE) +- movb PT_CS(%esp), %bl +- andb $SEGMENT_RPL_MASK, %bl +- cmpb $USER_RPL, %bl +- jb resume_kernel - xorl %edx, %edx - call do_notify_resume -- jmp resume_userspace_sig +- jmp resume_userspace - ALIGN -work_notifysig_v86: @@ -15387,15 +15218,16 @@ index 7b784f4..db6b628 100644 #endif TRACE_IRQS_ON ENABLE_INTERRUPTS(CLBR_NONE) +@@ -640,7 +839,7 @@ work_notifysig_v86: xorl %edx, %edx call do_notify_resume - jmp resume_userspace_sig + jmp resume_userspace -END(work_pending) +ENDPROC(work_pending) # perform syscall exit tracing ALIGN -@@ -654,11 +857,14 @@ syscall_trace_entry: +@@ -648,11 +847,14 @@ syscall_trace_entry: movl $-ENOSYS,PT_EAX(%esp) movl %esp, %eax call syscall_trace_enter @@ -15411,7 +15243,7 @@ index 7b784f4..db6b628 100644 # perform syscall exit tracing ALIGN -@@ -671,20 +877,24 @@ syscall_exit_work: +@@ -665,20 +867,24 @@ syscall_exit_work: movl %esp, %eax call syscall_trace_leave jmp resume_userspace @@ -15439,7 +15271,7 @@ index 7b784f4..db6b628 100644 CFI_ENDPROC /* * End of kprobes section -@@ -756,6 +966,36 @@ ENTRY(ptregs_clone) +@@ -750,6 +956,36 @@ ENTRY(ptregs_clone) CFI_ENDPROC ENDPROC(ptregs_clone) @@ -15476,7 +15308,7 @@ index 7b784f4..db6b628 100644 .macro FIXUP_ESPFIX_STACK /* * Switch back for ESPFIX stack to the normal zerobased stack -@@ -765,8 +1005,15 @@ ENDPROC(ptregs_clone) +@@ -759,8 +995,15 @@ ENDPROC(ptregs_clone) * normal stack and adjusts ESP with the matching offset. */ /* fixup the stack */ @@ -15494,7 +15326,7 @@ index 7b784f4..db6b628 100644 shl $16, %eax addl %esp, %eax /* the adjusted stack pointer */ pushl_cfi $__KERNEL_DS -@@ -819,7 +1066,7 @@ vector=vector+1 +@@ -813,7 +1056,7 @@ vector=vector+1 .endr 2: jmp common_interrupt .endr @@ -15503,7 +15335,7 @@ index 7b784f4..db6b628 100644 .previous END(interrupt) -@@ -867,7 +1114,7 @@ ENTRY(coprocessor_error) +@@ -861,7 +1104,7 @@ ENTRY(coprocessor_error) pushl_cfi $do_coprocessor_error jmp error_code CFI_ENDPROC @@ -15512,7 +15344,7 @@ index 7b784f4..db6b628 100644 ENTRY(simd_coprocessor_error) RING0_INT_FRAME -@@ -888,7 +1135,7 @@ ENTRY(simd_coprocessor_error) +@@ -882,7 +1125,7 @@ ENTRY(simd_coprocessor_error) #endif jmp error_code CFI_ENDPROC @@ -15521,7 +15353,7 @@ index 7b784f4..db6b628 100644 ENTRY(device_not_available) RING0_INT_FRAME -@@ -896,7 +1143,7 @@ ENTRY(device_not_available) +@@ -890,18 +1133,18 @@ ENTRY(device_not_available) pushl_cfi $do_device_not_available jmp error_code CFI_ENDPROC @@ -15530,10 +15362,8 @@ index 7b784f4..db6b628 100644 #ifdef CONFIG_PARAVIRT ENTRY(native_iret) -@@ -905,12 +1152,12 @@ ENTRY(native_iret) - .align 4 - .long native_iret, iret_exc - .previous + iret + _ASM_EXTABLE(native_iret, iret_exc) -END(native_iret) +ENDPROC(native_iret) @@ -15545,7 +15375,7 @@ index 7b784f4..db6b628 100644 #endif ENTRY(overflow) -@@ -919,7 +1166,7 @@ ENTRY(overflow) +@@ -910,7 +1153,7 @@ ENTRY(overflow) pushl_cfi $do_overflow jmp error_code CFI_ENDPROC @@ -15554,7 +15384,7 @@ index 7b784f4..db6b628 100644 ENTRY(bounds) RING0_INT_FRAME -@@ -927,7 +1174,7 @@ ENTRY(bounds) +@@ -918,7 +1161,7 @@ ENTRY(bounds) pushl_cfi $do_bounds jmp error_code CFI_ENDPROC @@ -15563,7 +15393,7 @@ index 7b784f4..db6b628 100644 ENTRY(invalid_op) RING0_INT_FRAME -@@ -935,7 +1182,7 @@ ENTRY(invalid_op) +@@ -926,7 +1169,7 @@ ENTRY(invalid_op) pushl_cfi $do_invalid_op jmp error_code CFI_ENDPROC @@ -15572,7 +15402,7 @@ index 7b784f4..db6b628 100644 ENTRY(coprocessor_segment_overrun) RING0_INT_FRAME -@@ -943,35 +1190,35 @@ ENTRY(coprocessor_segment_overrun) +@@ -934,35 +1177,35 @@ ENTRY(coprocessor_segment_overrun) pushl_cfi $do_coprocessor_segment_overrun jmp error_code CFI_ENDPROC @@ -15613,7 +15443,7 @@ index 7b784f4..db6b628 100644 ENTRY(divide_error) RING0_INT_FRAME -@@ -979,7 +1226,7 @@ ENTRY(divide_error) +@@ -970,7 +1213,7 @@ ENTRY(divide_error) pushl_cfi $do_divide_error jmp error_code CFI_ENDPROC @@ -15622,7 +15452,7 @@ index 7b784f4..db6b628 100644 #ifdef CONFIG_X86_MCE ENTRY(machine_check) -@@ -988,7 +1235,7 @@ ENTRY(machine_check) +@@ -979,7 +1222,7 @@ ENTRY(machine_check) pushl_cfi machine_check_vector jmp error_code CFI_ENDPROC @@ -15631,7 +15461,7 @@ index 7b784f4..db6b628 100644 #endif ENTRY(spurious_interrupt_bug) -@@ -997,7 +1244,7 @@ ENTRY(spurious_interrupt_bug) +@@ -988,7 +1231,7 @@ ENTRY(spurious_interrupt_bug) pushl_cfi $do_spurious_interrupt_bug jmp error_code CFI_ENDPROC @@ -15640,7 +15470,7 @@ index 7b784f4..db6b628 100644 /* * End of kprobes section */ -@@ -1112,7 +1359,7 @@ BUILD_INTERRUPT3(xen_hvm_callback_vector, XEN_HVM_EVTCHN_CALLBACK, +@@ -1100,7 +1343,7 @@ BUILD_INTERRUPT3(xen_hvm_callback_vector, XEN_HVM_EVTCHN_CALLBACK, ENTRY(mcount) ret @@ -15649,7 +15479,7 @@ index 7b784f4..db6b628 100644 ENTRY(ftrace_caller) cmpl $0, function_trace_stop -@@ -1141,7 +1388,7 @@ ftrace_graph_call: +@@ -1129,7 +1372,7 @@ ftrace_graph_call: .globl ftrace_stub ftrace_stub: ret @@ -15658,7 +15488,7 @@ index 7b784f4..db6b628 100644 #else /* ! CONFIG_DYNAMIC_FTRACE */ -@@ -1177,7 +1424,7 @@ trace: +@@ -1165,7 +1408,7 @@ trace: popl %ecx popl %eax jmp ftrace_stub @@ -15667,7 +15497,7 @@ index 7b784f4..db6b628 100644 #endif /* CONFIG_DYNAMIC_FTRACE */ #endif /* CONFIG_FUNCTION_TRACER */ -@@ -1198,7 +1445,7 @@ ENTRY(ftrace_graph_caller) +@@ -1186,7 +1429,7 @@ ENTRY(ftrace_graph_caller) popl %ecx popl %eax ret @@ -15676,7 +15506,7 @@ index 7b784f4..db6b628 100644 .globl return_to_handler return_to_handler: -@@ -1253,15 +1500,18 @@ error_code: +@@ -1241,15 +1484,18 @@ error_code: movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart REG_TO_PTGS %ecx SET_KERNEL_GS %ecx @@ -15697,7 +15527,7 @@ index 7b784f4..db6b628 100644 /* * Debug traps and NMI can happen at the one SYSENTER instruction -@@ -1303,7 +1553,7 @@ debug_stack_correct: +@@ -1291,7 +1537,7 @@ debug_stack_correct: call do_debug jmp ret_from_exception CFI_ENDPROC @@ -15706,7 +15536,7 @@ index 7b784f4..db6b628 100644 /* * NMI is doubly nasty. It can happen _while_ we're handling -@@ -1340,6 +1590,9 @@ nmi_stack_correct: +@@ -1328,6 +1574,9 @@ nmi_stack_correct: xorl %edx,%edx # zero error code movl %esp,%eax # pt_regs pointer call do_nmi @@ -15716,7 +15546,7 @@ index 7b784f4..db6b628 100644 jmp restore_all_notrace CFI_ENDPROC -@@ -1376,12 +1629,15 @@ nmi_espfix_stack: +@@ -1364,12 +1613,15 @@ nmi_espfix_stack: FIXUP_ESPFIX_STACK # %eax == %esp xorl %edx,%edx # zero error code call do_nmi @@ -15733,7 +15563,7 @@ index 7b784f4..db6b628 100644 ENTRY(int3) RING0_INT_FRAME -@@ -1393,14 +1649,14 @@ ENTRY(int3) +@@ -1381,14 +1633,14 @@ ENTRY(int3) call do_int3 jmp ret_from_exception CFI_ENDPROC @@ -15750,7 +15580,7 @@ index 7b784f4..db6b628 100644 #ifdef CONFIG_KVM_GUEST ENTRY(async_page_fault) -@@ -1408,7 +1664,7 @@ ENTRY(async_page_fault) +@@ -1396,7 +1648,7 @@ ENTRY(async_page_fault) pushl_cfi $do_async_page_fault jmp error_code CFI_ENDPROC @@ -15760,19 +15590,19 @@ index 7b784f4..db6b628 100644 /* diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S -index cdc79b5..4710a75 100644 +index 7d65133..27bce5b 100644 --- a/arch/x86/kernel/entry_64.S +++ b/arch/x86/kernel/entry_64.S -@@ -56,6 +56,8 @@ - #include <asm/ftrace.h> +@@ -57,6 +57,8 @@ #include <asm/percpu.h> + #include <asm/asm.h> #include <linux/err.h> +#include <asm/pgtable.h> +#include <asm/alternative-asm.h> /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */ #include <linux/elf-em.h> -@@ -69,8 +71,9 @@ +@@ -70,8 +72,9 @@ #ifdef CONFIG_FUNCTION_TRACER #ifdef CONFIG_DYNAMIC_FTRACE ENTRY(mcount) @@ -15783,7 +15613,7 @@ index cdc79b5..4710a75 100644 ENTRY(ftrace_caller) cmpl $0, function_trace_stop -@@ -93,8 +96,9 @@ GLOBAL(ftrace_graph_call) +@@ -94,8 +97,9 @@ GLOBAL(ftrace_graph_call) #endif GLOBAL(ftrace_stub) @@ -15794,7 +15624,7 @@ index cdc79b5..4710a75 100644 #else /* ! CONFIG_DYNAMIC_FTRACE */ ENTRY(mcount) -@@ -113,6 +117,7 @@ ENTRY(mcount) +@@ -114,6 +118,7 @@ ENTRY(mcount) #endif GLOBAL(ftrace_stub) @@ -15802,7 +15632,7 @@ index cdc79b5..4710a75 100644 retq trace: -@@ -122,12 +127,13 @@ trace: +@@ -123,12 +128,13 @@ trace: movq 8(%rbp), %rsi subq $MCOUNT_INSN_SIZE, %rdi @@ -15817,7 +15647,7 @@ index cdc79b5..4710a75 100644 #endif /* CONFIG_DYNAMIC_FTRACE */ #endif /* CONFIG_FUNCTION_TRACER */ -@@ -147,8 +153,9 @@ ENTRY(ftrace_graph_caller) +@@ -148,8 +154,9 @@ ENTRY(ftrace_graph_caller) MCOUNT_RESTORE_FRAME @@ -15828,7 +15658,7 @@ index cdc79b5..4710a75 100644 GLOBAL(return_to_handler) subq $24, %rsp -@@ -164,6 +171,7 @@ GLOBAL(return_to_handler) +@@ -165,6 +172,7 @@ GLOBAL(return_to_handler) movq 8(%rsp), %rdx movq (%rsp), %rax addq $24, %rsp @@ -15836,7 +15666,7 @@ index cdc79b5..4710a75 100644 jmp *%rdi #endif -@@ -179,6 +187,282 @@ ENTRY(native_usergs_sysret64) +@@ -180,6 +188,282 @@ ENTRY(native_usergs_sysret64) ENDPROC(native_usergs_sysret64) #endif /* CONFIG_PARAVIRT */ @@ -16119,7 +15949,7 @@ index cdc79b5..4710a75 100644 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET #ifdef CONFIG_TRACE_IRQFLAGS -@@ -232,8 +516,8 @@ ENDPROC(native_usergs_sysret64) +@@ -271,8 +555,8 @@ ENDPROC(native_usergs_sysret64) .endm .macro UNFAKE_STACK_FRAME @@ -16130,7 +15960,7 @@ index cdc79b5..4710a75 100644 .endm /* -@@ -320,7 +604,7 @@ ENDPROC(native_usergs_sysret64) +@@ -359,7 +643,7 @@ ENDPROC(native_usergs_sysret64) movq %rsp, %rsi leaq -RBP(%rsp),%rdi /* arg1 for handler */ @@ -16139,7 +15969,7 @@ index cdc79b5..4710a75 100644 je 1f SWAPGS /* -@@ -355,9 +639,10 @@ ENTRY(save_rest) +@@ -394,9 +678,10 @@ ENTRY(save_rest) movq_cfi r15, R15+16 movq %r11, 8(%rsp) /* return address */ FIXUP_TOP_OF_STACK %r11, 16 @@ -16151,7 +15981,7 @@ index cdc79b5..4710a75 100644 /* save complete stack frame */ .pushsection .kprobes.text, "ax" -@@ -386,9 +671,10 @@ ENTRY(save_paranoid) +@@ -425,9 +710,10 @@ ENTRY(save_paranoid) js 1f /* negative -> in kernel */ SWAPGS xorl %ebx,%ebx @@ -16164,7 +15994,7 @@ index cdc79b5..4710a75 100644 .popsection /* -@@ -410,7 +696,7 @@ ENTRY(ret_from_fork) +@@ -449,7 +735,7 @@ ENTRY(ret_from_fork) RESTORE_REST @@ -16173,7 +16003,7 @@ index cdc79b5..4710a75 100644 jz retint_restore_args testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET -@@ -420,7 +706,7 @@ ENTRY(ret_from_fork) +@@ -459,7 +745,7 @@ ENTRY(ret_from_fork) jmp ret_from_sys_call # go to the SYSRET fastpath CFI_ENDPROC @@ -16182,7 +16012,7 @@ index cdc79b5..4710a75 100644 /* * System call entry. Up to 6 arguments in registers are supported. -@@ -456,7 +742,7 @@ END(ret_from_fork) +@@ -495,7 +781,7 @@ END(ret_from_fork) ENTRY(system_call) CFI_STARTPROC simple CFI_SIGNAL_FRAME @@ -16191,7 +16021,7 @@ index cdc79b5..4710a75 100644 CFI_REGISTER rip,rcx /*CFI_REGISTER rflags,r11*/ SWAPGS_UNSAFE_STACK -@@ -469,16 +755,18 @@ GLOBAL(system_call_after_swapgs) +@@ -508,16 +794,18 @@ GLOBAL(system_call_after_swapgs) movq %rsp,PER_CPU_VAR(old_rsp) movq PER_CPU_VAR(kernel_stack),%rsp @@ -16212,7 +16042,7 @@ index cdc79b5..4710a75 100644 jnz tracesys system_call_fastpath: #if __SYSCALL_MASK == ~0 -@@ -488,7 +776,7 @@ system_call_fastpath: +@@ -527,7 +815,7 @@ system_call_fastpath: cmpl $__NR_syscall_max,%eax #endif ja badsys @@ -16221,7 +16051,7 @@ index cdc79b5..4710a75 100644 call *sys_call_table(,%rax,8) # XXX: rip relative movq %rax,RAX-ARGOFFSET(%rsp) /* -@@ -502,10 +790,13 @@ sysret_check: +@@ -541,10 +829,13 @@ sysret_check: LOCKDEP_SYS_EXIT DISABLE_INTERRUPTS(CLBR_NONE) TRACE_IRQS_OFF @@ -16236,7 +16066,7 @@ index cdc79b5..4710a75 100644 /* * sysretq will re-enable interrupts: */ -@@ -557,14 +848,18 @@ badsys: +@@ -596,14 +887,18 @@ badsys: * jump back to the normal fast path. */ auditsys: @@ -16256,7 +16086,7 @@ index cdc79b5..4710a75 100644 jmp system_call_fastpath /* -@@ -585,7 +880,7 @@ sysret_audit: +@@ -624,7 +919,7 @@ sysret_audit: /* Do syscall tracing */ tracesys: #ifdef CONFIG_AUDITSYSCALL @@ -16265,7 +16095,7 @@ index cdc79b5..4710a75 100644 jz auditsys #endif SAVE_REST -@@ -593,12 +888,16 @@ tracesys: +@@ -632,12 +927,16 @@ tracesys: FIXUP_TOP_OF_STACK %rdi movq %rsp,%rdi call syscall_trace_enter @@ -16282,7 +16112,7 @@ index cdc79b5..4710a75 100644 RESTORE_REST #if __SYSCALL_MASK == ~0 cmpq $__NR_syscall_max,%rax -@@ -607,7 +906,7 @@ tracesys: +@@ -646,7 +945,7 @@ tracesys: cmpl $__NR_syscall_max,%eax #endif ja int_ret_from_sys_call /* RAX(%rsp) set to -ENOSYS above */ @@ -16291,7 +16121,7 @@ index cdc79b5..4710a75 100644 call *sys_call_table(,%rax,8) movq %rax,RAX-ARGOFFSET(%rsp) /* Use IRET because user could have changed frame */ -@@ -628,6 +927,7 @@ GLOBAL(int_with_check) +@@ -667,6 +966,7 @@ GLOBAL(int_with_check) andl %edi,%edx jnz int_careful andl $~TS_COMPAT,TI_status(%rcx) @@ -16299,7 +16129,7 @@ index cdc79b5..4710a75 100644 jmp retint_swapgs /* Either reschedule or signal or syscall exit tracking needed. */ -@@ -674,7 +974,7 @@ int_restore_rest: +@@ -713,7 +1013,7 @@ int_restore_rest: TRACE_IRQS_OFF jmp int_with_check CFI_ENDPROC @@ -16308,7 +16138,7 @@ index cdc79b5..4710a75 100644 /* * Certain special system calls that need to save a complete full stack frame. -@@ -690,7 +990,7 @@ ENTRY(\label) +@@ -729,7 +1029,7 @@ ENTRY(\label) call \func jmp ptregscall_common CFI_ENDPROC @@ -16317,7 +16147,7 @@ index cdc79b5..4710a75 100644 .endm PTREGSCALL stub_clone, sys_clone, %r8 -@@ -708,9 +1008,10 @@ ENTRY(ptregscall_common) +@@ -747,9 +1047,10 @@ ENTRY(ptregscall_common) movq_cfi_restore R12+8, r12 movq_cfi_restore RBP+8, rbp movq_cfi_restore RBX+8, rbx @@ -16329,7 +16159,7 @@ index cdc79b5..4710a75 100644 ENTRY(stub_execve) CFI_STARTPROC -@@ -725,7 +1026,7 @@ ENTRY(stub_execve) +@@ -764,7 +1065,7 @@ ENTRY(stub_execve) RESTORE_REST jmp int_ret_from_sys_call CFI_ENDPROC @@ -16338,7 +16168,7 @@ index cdc79b5..4710a75 100644 /* * sigreturn is special because it needs to restore all registers on return. -@@ -743,7 +1044,7 @@ ENTRY(stub_rt_sigreturn) +@@ -782,7 +1083,7 @@ ENTRY(stub_rt_sigreturn) RESTORE_REST jmp int_ret_from_sys_call CFI_ENDPROC @@ -16347,7 +16177,7 @@ index cdc79b5..4710a75 100644 #ifdef CONFIG_X86_X32_ABI PTREGSCALL stub_x32_sigaltstack, sys32_sigaltstack, %rdx -@@ -812,7 +1113,7 @@ vector=vector+1 +@@ -851,7 +1152,7 @@ vector=vector+1 2: jmp common_interrupt .endr CFI_ENDPROC @@ -16356,7 +16186,7 @@ index cdc79b5..4710a75 100644 .previous END(interrupt) -@@ -832,6 +1133,16 @@ END(interrupt) +@@ -871,6 +1172,16 @@ END(interrupt) subq $ORIG_RAX-RBP, %rsp CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP SAVE_ARGS_IRQ @@ -16373,7 +16203,7 @@ index cdc79b5..4710a75 100644 call \func .endm -@@ -863,7 +1174,7 @@ ret_from_intr: +@@ -902,7 +1213,7 @@ ret_from_intr: exit_intr: GET_THREAD_INFO(%rcx) @@ -16382,7 +16212,7 @@ index cdc79b5..4710a75 100644 je retint_kernel /* Interrupt came from user space */ -@@ -885,12 +1196,15 @@ retint_swapgs: /* return to user-space */ +@@ -924,12 +1235,15 @@ retint_swapgs: /* return to user-space */ * The iretq could re-enable interrupts: */ DISABLE_INTERRUPTS(CLBR_ANY) @@ -16398,7 +16228,7 @@ index cdc79b5..4710a75 100644 /* * The iretq could re-enable interrupts: */ -@@ -979,7 +1293,7 @@ ENTRY(retint_kernel) +@@ -1012,7 +1326,7 @@ ENTRY(retint_kernel) #endif CFI_ENDPROC @@ -16407,7 +16237,7 @@ index cdc79b5..4710a75 100644 /* * End of kprobes section */ -@@ -996,7 +1310,7 @@ ENTRY(\sym) +@@ -1029,7 +1343,7 @@ ENTRY(\sym) interrupt \do_sym jmp ret_from_intr CFI_ENDPROC @@ -16416,7 +16246,7 @@ index cdc79b5..4710a75 100644 .endm #ifdef CONFIG_SMP -@@ -1069,12 +1383,22 @@ ENTRY(\sym) +@@ -1102,12 +1416,22 @@ ENTRY(\sym) CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15 call error_entry DEFAULT_FRAME 0 @@ -16440,7 +16270,7 @@ index cdc79b5..4710a75 100644 .endm .macro paranoidzeroentry sym do_sym -@@ -1086,15 +1410,25 @@ ENTRY(\sym) +@@ -1119,15 +1443,25 @@ ENTRY(\sym) CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15 call save_paranoid TRACE_IRQS_OFF @@ -16468,10 +16298,10 @@ index cdc79b5..4710a75 100644 .macro paranoidzeroentry_ist sym do_sym ist ENTRY(\sym) INTR_FRAME -@@ -1104,14 +1438,30 @@ ENTRY(\sym) +@@ -1137,14 +1471,30 @@ ENTRY(\sym) CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15 call save_paranoid - TRACE_IRQS_OFF + TRACE_IRQS_OFF_DEBUG +#ifdef CONFIG_PAX_MEMORY_UDEREF + testb $3, CS(%rsp) + jnz 1f @@ -16500,7 +16330,7 @@ index cdc79b5..4710a75 100644 .endm .macro errorentry sym do_sym -@@ -1122,13 +1472,23 @@ ENTRY(\sym) +@@ -1155,13 +1505,23 @@ ENTRY(\sym) CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15 call error_entry DEFAULT_FRAME 0 @@ -16525,7 +16355,7 @@ index cdc79b5..4710a75 100644 .endm /* error code is on the stack already */ -@@ -1141,13 +1501,23 @@ ENTRY(\sym) +@@ -1174,13 +1534,23 @@ ENTRY(\sym) call save_paranoid DEFAULT_FRAME 0 TRACE_IRQS_OFF @@ -16550,7 +16380,7 @@ index cdc79b5..4710a75 100644 .endm zeroentry divide_error do_divide_error -@@ -1177,9 +1547,10 @@ gs_change: +@@ -1210,9 +1580,10 @@ gs_change: 2: mfence /* workaround */ SWAPGS popfq_cfi @@ -16560,9 +16390,9 @@ index cdc79b5..4710a75 100644 -END(native_load_gs_index) +ENDPROC(native_load_gs_index) - .section __ex_table,"a" - .align 8 -@@ -1201,13 +1572,14 @@ ENTRY(kernel_thread_helper) + _ASM_EXTABLE(gs_change,bad_gs) + .section .fixup,"ax" +@@ -1231,13 +1602,14 @@ ENTRY(kernel_thread_helper) * Here we are in the child and the registers are set as they were * at kernel_thread() invocation in the parent. */ @@ -16578,7 +16408,7 @@ index cdc79b5..4710a75 100644 /* * execve(). This function needs to use IRET, not SYSRET, to set up all state properly. -@@ -1234,11 +1606,11 @@ ENTRY(kernel_execve) +@@ -1264,11 +1636,11 @@ ENTRY(kernel_execve) RESTORE_REST testq %rax,%rax je int_ret_from_sys_call @@ -16592,7 +16422,7 @@ index cdc79b5..4710a75 100644 /* Call softirq on interrupt stack. Interrupts are off. */ ENTRY(call_softirq) -@@ -1256,9 +1628,10 @@ ENTRY(call_softirq) +@@ -1286,9 +1658,10 @@ ENTRY(call_softirq) CFI_DEF_CFA_REGISTER rsp CFI_ADJUST_CFA_OFFSET -8 decl PER_CPU_VAR(irq_count) @@ -16604,7 +16434,7 @@ index cdc79b5..4710a75 100644 #ifdef CONFIG_XEN zeroentry xen_hypervisor_callback xen_do_hypervisor_callback -@@ -1296,7 +1669,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs) +@@ -1326,7 +1699,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs) decl PER_CPU_VAR(irq_count) jmp error_exit CFI_ENDPROC @@ -16613,7 +16443,7 @@ index cdc79b5..4710a75 100644 /* * Hypervisor uses this for application faults while it executes. -@@ -1355,7 +1728,7 @@ ENTRY(xen_failsafe_callback) +@@ -1385,7 +1758,7 @@ ENTRY(xen_failsafe_callback) SAVE_ALL jmp error_exit CFI_ENDPROC @@ -16622,8 +16452,8 @@ index cdc79b5..4710a75 100644 apicinterrupt XEN_HVM_EVTCHN_CALLBACK \ xen_hvm_callback_vector xen_evtchn_do_upcall -@@ -1404,16 +1777,31 @@ ENTRY(paranoid_exit) - TRACE_IRQS_OFF +@@ -1434,16 +1807,31 @@ ENTRY(paranoid_exit) + TRACE_IRQS_OFF_DEBUG testl %ebx,%ebx /* swapgs needed? */ jnz paranoid_restore - testl $3,CS(%rsp) @@ -16649,13 +16479,13 @@ index cdc79b5..4710a75 100644 jmp irq_return paranoid_restore: + pax_exit_kernel - TRACE_IRQS_IRETQ 0 + TRACE_IRQS_IRETQ_DEBUG 0 RESTORE_ALL 8 + pax_force_retaddr_bts jmp irq_return paranoid_userspace: GET_THREAD_INFO(%rcx) -@@ -1442,7 +1830,7 @@ paranoid_schedule: +@@ -1472,7 +1860,7 @@ paranoid_schedule: TRACE_IRQS_OFF jmp paranoid_userspace CFI_ENDPROC @@ -16664,7 +16494,7 @@ index cdc79b5..4710a75 100644 /* * Exception entry point. This expects an error code/orig_rax on the stack. -@@ -1469,12 +1857,13 @@ ENTRY(error_entry) +@@ -1499,12 +1887,13 @@ ENTRY(error_entry) movq_cfi r14, R14+8 movq_cfi r15, R15+8 xorl %ebx,%ebx @@ -16679,7 +16509,7 @@ index cdc79b5..4710a75 100644 ret /* -@@ -1501,7 +1890,7 @@ bstep_iret: +@@ -1531,7 +1920,7 @@ bstep_iret: movq %rcx,RIP+8(%rsp) jmp error_swapgs CFI_ENDPROC @@ -16688,7 +16518,7 @@ index cdc79b5..4710a75 100644 /* ebx: no swapgs flag (1: don't need swapgs, 0: need it) */ -@@ -1521,7 +1910,7 @@ ENTRY(error_exit) +@@ -1551,7 +1940,7 @@ ENTRY(error_exit) jnz retint_careful jmp retint_swapgs CFI_ENDPROC @@ -16697,7 +16527,7 @@ index cdc79b5..4710a75 100644 /* * Test if a given stack is an NMI stack or not. -@@ -1579,9 +1968,11 @@ ENTRY(nmi) +@@ -1609,9 +1998,11 @@ ENTRY(nmi) * If %cs was not the kernel segment, then the NMI triggered in user * space, which means it is definitely not nested. */ @@ -16710,7 +16540,7 @@ index cdc79b5..4710a75 100644 /* * Check the special variable on the stack to see if NMIs are * executing. -@@ -1728,6 +2119,16 @@ end_repeat_nmi: +@@ -1758,6 +2149,16 @@ end_repeat_nmi: */ call save_paranoid DEFAULT_FRAME 0 @@ -16727,7 +16557,7 @@ index cdc79b5..4710a75 100644 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */ movq %rsp,%rdi movq $-1,%rsi -@@ -1735,21 +2136,32 @@ end_repeat_nmi: +@@ -1765,21 +2166,32 @@ end_repeat_nmi: testl %ebx,%ebx /* swapgs needed? */ jnz nmi_restore nmi_swapgs: @@ -16763,40 +16593,10 @@ index cdc79b5..4710a75 100644 /* * End of kprobes section diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c -index c9a281f..ce2f317 100644 +index c3a7cb4..3ad00dc 100644 --- a/arch/x86/kernel/ftrace.c +++ b/arch/x86/kernel/ftrace.c -@@ -126,7 +126,7 @@ static void *mod_code_ip; /* holds the IP to write to */ - static const void *mod_code_newcode; /* holds the text to write to the IP */ - - static unsigned nmi_wait_count; --static atomic_t nmi_update_count = ATOMIC_INIT(0); -+static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0); - - int ftrace_arch_read_dyn_info(char *buf, int size) - { -@@ -134,7 +134,7 @@ int ftrace_arch_read_dyn_info(char *buf, int size) - - r = snprintf(buf, size, "%u %u", - nmi_wait_count, -- atomic_read(&nmi_update_count)); -+ atomic_read_unchecked(&nmi_update_count)); - return r; - } - -@@ -177,8 +177,10 @@ void ftrace_nmi_enter(void) - - if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) { - smp_rmb(); -+ pax_open_kernel(); - ftrace_mod_code(); -- atomic_inc(&nmi_update_count); -+ pax_close_kernel(); -+ atomic_inc_unchecked(&nmi_update_count); - } - /* Must have previous changes seen before executions */ - smp_mb(); -@@ -271,6 +273,8 @@ ftrace_modify_code(unsigned long ip, unsigned const char *old_code, +@@ -105,6 +105,8 @@ ftrace_modify_code_direct(unsigned long ip, unsigned const char *old_code, { unsigned char replaced[MCOUNT_INSN_SIZE]; @@ -16805,16 +16605,16 @@ index c9a281f..ce2f317 100644 /* * Note: Due to modules and __init, code can * disappear and change, we need to protect against faulting -@@ -327,7 +331,7 @@ int ftrace_update_ftrace_func(ftrace_func_t func) +@@ -212,7 +214,7 @@ int ftrace_update_ftrace_func(ftrace_func_t func) unsigned char old[MCOUNT_INSN_SIZE], *new; int ret; - memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE); + memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE); new = ftrace_call_replace(ip, (unsigned long)func); - ret = ftrace_modify_code(ip, old, new); -@@ -353,6 +357,8 @@ static int ftrace_mod_jmp(unsigned long ip, + /* See comment above by declaration of modifying_ftrace_code */ +@@ -605,6 +607,8 @@ static int ftrace_mod_jmp(unsigned long ip, { unsigned char code[MCOUNT_INSN_SIZE]; @@ -16824,10 +16624,10 @@ index c9a281f..ce2f317 100644 return -EFAULT; diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c -index 51ff186..9e77418 100644 +index c18f59d..9c0c9f6 100644 --- a/arch/x86/kernel/head32.c +++ b/arch/x86/kernel/head32.c -@@ -19,6 +19,7 @@ +@@ -18,6 +18,7 @@ #include <asm/io_apic.h> #include <asm/bios_ebda.h> #include <asm/tlbflush.h> @@ -16835,7 +16635,7 @@ index 51ff186..9e77418 100644 static void __init i386_default_early_setup(void) { -@@ -31,8 +32,7 @@ static void __init i386_default_early_setup(void) +@@ -30,8 +31,7 @@ static void __init i386_default_early_setup(void) void __init i386_start_kernel(void) { @@ -16846,10 +16646,10 @@ index 51ff186..9e77418 100644 #ifdef CONFIG_BLK_DEV_INITRD /* Reserve INITRD */ diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S -index ce0be7c..c41476e 100644 +index d42ab17..cb1b997 100644 --- a/arch/x86/kernel/head_32.S +++ b/arch/x86/kernel/head_32.S -@@ -25,6 +25,12 @@ +@@ -26,6 +26,12 @@ /* Physical address */ #define pa(X) ((X) - __PAGE_OFFSET) @@ -16862,7 +16662,7 @@ index ce0be7c..c41476e 100644 /* * References to members of the new_cpu_data structure. */ -@@ -54,11 +60,7 @@ +@@ -55,11 +61,7 @@ * and small than max_low_pfn, otherwise will waste some page table entries */ @@ -16875,7 +16675,7 @@ index ce0be7c..c41476e 100644 /* Number of possible pages in the lowmem region */ LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT) -@@ -77,6 +79,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_PAGES) * PAGE_SIZE +@@ -78,6 +80,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_PAGES) * PAGE_SIZE RESERVE_BRK(pagetables, INIT_MAP_SIZE) /* @@ -16888,7 +16688,7 @@ index ce0be7c..c41476e 100644 * 32-bit kernel entrypoint; only used by the boot CPU. On entry, * %esi points to the real-mode code as a 32-bit pointer. * CS and DS must be 4 GB flat segments, but we don't depend on -@@ -84,6 +92,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE) +@@ -85,6 +93,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE) * can. */ __HEAD @@ -16902,7 +16702,7 @@ index ce0be7c..c41476e 100644 ENTRY(startup_32) movl pa(stack_start),%ecx -@@ -105,6 +120,57 @@ ENTRY(startup_32) +@@ -106,6 +121,57 @@ ENTRY(startup_32) 2: leal -__PAGE_OFFSET(%ecx),%esp @@ -16960,7 +16760,7 @@ index ce0be7c..c41476e 100644 /* * Clear BSS first so that there are no surprises... */ -@@ -195,8 +261,11 @@ ENTRY(startup_32) +@@ -196,8 +262,11 @@ ENTRY(startup_32) movl %eax, pa(max_pfn_mapped) /* Do early initialization of the fixmap area */ @@ -16974,7 +16774,7 @@ index ce0be7c..c41476e 100644 #else /* Not PAE */ page_pde_offset = (__PAGE_OFFSET >> 20); -@@ -226,8 +295,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20); +@@ -227,8 +296,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20); movl %eax, pa(max_pfn_mapped) /* Do early initialization of the fixmap area */ @@ -16988,7 +16788,7 @@ index ce0be7c..c41476e 100644 #endif #ifdef CONFIG_PARAVIRT -@@ -241,9 +313,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20); +@@ -242,9 +314,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20); cmpl $num_subarch_entries, %eax jae bad_subarch @@ -16999,7 +16799,7 @@ index ce0be7c..c41476e 100644 bad_subarch: WEAK(lguest_entry) -@@ -255,10 +325,10 @@ WEAK(xen_entry) +@@ -256,10 +326,10 @@ WEAK(xen_entry) __INITDATA subarch_entries: @@ -17014,7 +16814,7 @@ index ce0be7c..c41476e 100644 num_subarch_entries = (. - subarch_entries) / 4 .previous #else -@@ -312,6 +382,7 @@ default_entry: +@@ -310,6 +380,7 @@ default_entry: orl %edx,%eax movl %eax,%cr4 @@ -17022,7 +16822,7 @@ index ce0be7c..c41476e 100644 testb $X86_CR4_PAE, %al # check if PAE is enabled jz 6f -@@ -340,6 +411,9 @@ default_entry: +@@ -338,6 +409,9 @@ default_entry: /* Make changes effective */ wrmsr @@ -17032,7 +16832,7 @@ index ce0be7c..c41476e 100644 6: /* -@@ -443,7 +517,7 @@ is386: movl $2,%ecx # set MP +@@ -436,14 +510,20 @@ is386: movl $2,%ecx # set MP 1: movl $(__KERNEL_DS),%eax # reload all the segment registers movl %eax,%ss # after changing gdt. @@ -17041,10 +16841,23 @@ index ce0be7c..c41476e 100644 movl %eax,%ds movl %eax,%es -@@ -457,15 +531,22 @@ is386: movl $2,%ecx # set MP + movl $(__KERNEL_PERCPU), %eax + movl %eax,%fs # set this cpu's percpu + ++#ifdef CONFIG_CC_STACKPROTECTOR + movl $(__KERNEL_STACK_CANARY),%eax ++#elif defined(CONFIG_PAX_MEMORY_UDEREF) ++ movl $(__USER_DS),%eax ++#else ++ xorl %eax,%eax ++#endif + movl %eax,%gs + + xorl %eax,%eax # Clear LDT +@@ -520,8 +600,11 @@ setup_once: + * relocation. Manually set base address in stack canary + * segment descriptor. */ - cmpb $0,ready - jne 1f - movl $gdt_page,%eax + movl $cpu_gdt_table,%eax movl $stack_canary,%ecx @@ -17054,47 +16867,26 @@ index ce0be7c..c41476e 100644 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax) shrl $16, %ecx movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax) - movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax) - 1: --#endif - movl $(__KERNEL_STACK_CANARY),%eax -+#elif defined(CONFIG_PAX_MEMORY_UDEREF) -+ movl $(__USER_DS),%eax -+#else -+ xorl %eax,%eax -+#endif - movl %eax,%gs - - xorl %eax,%eax # Clear LDT -@@ -558,22 +639,22 @@ early_page_fault: - jmp early_fault - - early_fault: -- cld - #ifdef CONFIG_PRINTK +@@ -552,7 +635,7 @@ ENDPROC(early_idt_handlers) + /* This is global to keep gas from relaxing the jumps */ + ENTRY(early_idt_handler) + cld +- cmpl $2,%ss:early_recursion_flag + cmpl $1,%ss:early_recursion_flag -+ je hlt_loop -+ incl %ss:early_recursion_flag -+ cld - pusha - movl $(__KERNEL_DS),%eax - movl %eax,%ds - movl %eax,%es -- cmpl $2,early_recursion_flag -- je hlt_loop -- incl early_recursion_flag - movl %cr2,%eax - pushl %eax - pushl %edx /* trapno */ + je hlt_loop + incl %ss:early_recursion_flag + +@@ -590,8 +673,8 @@ ENTRY(early_idt_handler) + pushl (20+6*4)(%esp) /* trapno */ pushl $fault_msg call printk -+; call dump_stack - #endif -- call dump_stack +-#endif + call dump_stack ++#endif hlt_loop: hlt jmp hlt_loop -@@ -581,8 +662,11 @@ hlt_loop: +@@ -610,8 +693,11 @@ ENDPROC(early_idt_handler) /* This is the default interrupt "handler" :-) */ ALIGN ignore_int: @@ -17107,7 +16899,7 @@ index ce0be7c..c41476e 100644 pushl %eax pushl %ecx pushl %edx -@@ -591,9 +675,6 @@ ignore_int: +@@ -620,9 +706,6 @@ ignore_int: movl $(__KERNEL_DS),%eax movl %eax,%ds movl %eax,%es @@ -17117,7 +16909,7 @@ index ce0be7c..c41476e 100644 pushl 16(%esp) pushl 24(%esp) pushl 32(%esp) -@@ -622,29 +703,43 @@ ENTRY(initial_code) +@@ -656,29 +739,43 @@ ENTRY(setup_once_ref) /* * BSS section */ @@ -17166,7 +16958,7 @@ index ce0be7c..c41476e 100644 ENTRY(initial_page_table) .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */ # if KPMDS == 3 -@@ -663,18 +758,27 @@ ENTRY(initial_page_table) +@@ -697,12 +794,20 @@ ENTRY(initial_page_table) # error "Kernel PMDs should be 1, 2 or 3" # endif .align PAGE_SIZE /* needs to be page-sized too */ @@ -17186,18 +16978,18 @@ index ce0be7c..c41476e 100644 - .long init_thread_union+THREAD_SIZE + .long init_thread_union+THREAD_SIZE-8 -+ready: .byte 0 -+ -+.section .rodata,"a",@progbits - early_recursion_flag: - .long 0 - --ready: .byte 0 -- + __INITRODATA int_msg: - .asciz "Unknown interrupt or fault at: %p %p %p\n" +@@ -730,7 +835,7 @@ fault_msg: + * segment size, and 32-bit linear address value: + */ -@@ -707,7 +811,7 @@ fault_msg: +- .data ++.section .rodata,"a",@progbits + .globl boot_gdt_descr + .globl idt_descr + +@@ -739,7 +844,7 @@ fault_msg: .word 0 # 32 bit align gdt_desc.address boot_gdt_descr: .word __BOOT_DS+7 @@ -17206,7 +16998,7 @@ index ce0be7c..c41476e 100644 .word 0 # 32-bit align idt_desc.address idt_descr: -@@ -718,7 +822,7 @@ idt_descr: +@@ -750,7 +855,7 @@ idt_descr: .word 0 # 32 bit align gdt_desc.address ENTRY(early_gdt_descr) .word GDT_ENTRIES*8-1 @@ -17215,7 +17007,7 @@ index ce0be7c..c41476e 100644 /* * The boot_gdt must mirror the equivalent in setup.S and is -@@ -727,5 +831,65 @@ ENTRY(early_gdt_descr) +@@ -759,5 +864,65 @@ ENTRY(early_gdt_descr) .align L1_CACHE_BYTES ENTRY(boot_gdt) .fill GDT_ENTRY_BOOT_CS,8,0 @@ -17284,19 +17076,19 @@ index ce0be7c..c41476e 100644 + .fill PAGE_SIZE_asm - GDT_SIZE,1,0 + .endr diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S -index 40f4eb3..6d24d9d 100644 +index 94bf9cc..400455a 100644 --- a/arch/x86/kernel/head_64.S +++ b/arch/x86/kernel/head_64.S -@@ -19,6 +19,8 @@ - #include <asm/cache.h> +@@ -20,6 +20,8 @@ #include <asm/processor-flags.h> #include <asm/percpu.h> + #include <asm/nops.h> +#include <asm/cpufeature.h> +#include <asm/alternative-asm.h> #ifdef CONFIG_PARAVIRT #include <asm/asm-offsets.h> -@@ -38,6 +40,12 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET) +@@ -41,6 +43,12 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET) L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET) L4_START_KERNEL = pgd_index(__START_KERNEL_map) L3_START_KERNEL = pud_index(__START_KERNEL_map) @@ -17309,7 +17101,7 @@ index 40f4eb3..6d24d9d 100644 .text __HEAD -@@ -85,35 +93,23 @@ startup_64: +@@ -88,35 +96,23 @@ startup_64: */ addq %rbp, init_level4_pgt + 0(%rip) addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip) @@ -17356,7 +17148,7 @@ index 40f4eb3..6d24d9d 100644 /* * Fixup the kernel text+data virtual addresses. Note that -@@ -160,8 +156,8 @@ ENTRY(secondary_startup_64) +@@ -159,8 +155,8 @@ ENTRY(secondary_startup_64) * after the boot processor executes this code. */ @@ -17367,7 +17159,7 @@ index 40f4eb3..6d24d9d 100644 movq %rax, %cr4 /* Setup early boot stage 4 level pagetables. */ -@@ -183,9 +179,17 @@ ENTRY(secondary_startup_64) +@@ -182,9 +178,17 @@ ENTRY(secondary_startup_64) movl $MSR_EFER, %ecx rdmsr btsl $_EFER_SCE, %eax /* Enable System Call */ @@ -17386,7 +17178,7 @@ index 40f4eb3..6d24d9d 100644 1: wrmsr /* Make changes effective */ /* Setup cr0 */ -@@ -247,6 +251,7 @@ ENTRY(secondary_startup_64) +@@ -246,6 +250,7 @@ ENTRY(secondary_startup_64) * jump. In addition we need to ensure %cs is set so we make this * a far return. */ @@ -17394,41 +17186,40 @@ index 40f4eb3..6d24d9d 100644 movq initial_code(%rip),%rax pushq $0 # fake return address to stop unwinder pushq $__KERNEL_CS # set correct cs -@@ -269,7 +274,7 @@ ENTRY(secondary_startup_64) +@@ -268,7 +273,7 @@ ENTRY(secondary_startup_64) bad_address: jmp bad_address - .section ".init.text","ax" + __INIT - #ifdef CONFIG_EARLY_PRINTK .globl early_idt_handlers early_idt_handlers: -@@ -314,18 +319,23 @@ ENTRY(early_idt_handler) - #endif /* EARLY_PRINTK */ - 1: hlt - jmp 1b + # 104(%rsp) %rflags +@@ -347,11 +352,15 @@ ENTRY(early_idt_handler) + addq $16,%rsp # drop vector number and error code + decl early_recursion_flag(%rip) + INTERRUPT_RETURN + .previous - #ifdef CONFIG_EARLY_PRINTK + __INITDATA + .balign 4 early_recursion_flag: .long 0 + .previous + .section .rodata,"a",@progbits + #ifdef CONFIG_EARLY_PRINTK early_idt_msg: .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n" - early_idt_ripmsg: - .asciz "RIP %s\n" -+ .previous +@@ -360,6 +369,7 @@ early_idt_ripmsg: #endif /* CONFIG_EARLY_PRINTK */ -- .previous + .previous + .section .rodata,"a",@progbits #define NEXT_PAGE(name) \ .balign PAGE_SIZE; \ ENTRY(name) -@@ -338,7 +348,6 @@ ENTRY(name) +@@ -372,7 +382,6 @@ ENTRY(name) i = i + 1 ; \ .endr @@ -17436,7 +17227,7 @@ index 40f4eb3..6d24d9d 100644 /* * This default setting generates an ident mapping at address 0x100000 * and a mapping for the kernel that precisely maps virtual address -@@ -349,13 +358,41 @@ NEXT_PAGE(init_level4_pgt) +@@ -383,13 +392,41 @@ NEXT_PAGE(init_level4_pgt) .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE .org init_level4_pgt + L4_PAGE_OFFSET*8, 0 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE @@ -17478,7 +17269,7 @@ index 40f4eb3..6d24d9d 100644 NEXT_PAGE(level3_kernel_pgt) .fill L3_START_KERNEL,8,0 -@@ -363,20 +400,23 @@ NEXT_PAGE(level3_kernel_pgt) +@@ -397,20 +434,23 @@ NEXT_PAGE(level3_kernel_pgt) .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE @@ -17510,7 +17301,7 @@ index 40f4eb3..6d24d9d 100644 NEXT_PAGE(level2_kernel_pgt) /* -@@ -389,37 +429,59 @@ NEXT_PAGE(level2_kernel_pgt) +@@ -423,37 +463,59 @@ NEXT_PAGE(level2_kernel_pgt) * If you want to increase this then increase MODULES_VADDR * too.) */ @@ -17607,7 +17398,7 @@ index 9c3bd4a..e1d9b35 100644 +EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR); +#endif diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c -index 2d6e649..df6e1af 100644 +index f250431..54097e7 100644 --- a/arch/x86/kernel/i387.c +++ b/arch/x86/kernel/i387.c @@ -59,7 +59,7 @@ static inline bool interrupted_kernel_fpu_idle(void) @@ -17632,28 +17423,6 @@ index 36d1853..bf25736 100644 /* * Theoretically we do not have to handle this IRQ, * but in Linux this does not cause problems and is -diff --git a/arch/x86/kernel/init_task.c b/arch/x86/kernel/init_task.c -index 43e9ccf..44ccf6f 100644 ---- a/arch/x86/kernel/init_task.c -+++ b/arch/x86/kernel/init_task.c -@@ -20,8 +20,7 @@ static struct sighand_struct init_sighand = INIT_SIGHAND(init_sighand); - * way process stacks are handled. This is done by having a special - * "init_task" linker map entry.. - */ --union thread_union init_thread_union __init_task_data = -- { INIT_THREAD_INFO(init_task) }; -+union thread_union init_thread_union __init_task_data; - - /* - * Initial task structure. -@@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task); - * section. Since TSS's are completely CPU-local, we want them - * on exact cacheline boundaries, to eliminate cacheline ping-pong. - */ --DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS; -- -+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS }; -+EXPORT_SYMBOL(init_tss); diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c index 8c96897..be66bfa 100644 --- a/arch/x86/kernel/ioport.c @@ -17740,7 +17509,7 @@ index 3dafc60..aa8e9c4 100644 return sum; } diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c -index 58b7f27..e112d08 100644 +index 344faf8..355f60d 100644 --- a/arch/x86/kernel/irq_32.c +++ b/arch/x86/kernel/irq_32.c @@ -39,7 +39,7 @@ static int check_stack_overflow(void) @@ -17810,7 +17579,7 @@ index 58b7f27..e112d08 100644 return 1; } -@@ -121,29 +125,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq) +@@ -121,29 +125,14 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq) */ void __cpuinit irq_ctx_init(int cpu) { @@ -17820,8 +17589,8 @@ index 58b7f27..e112d08 100644 return; - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu), -- THREAD_FLAGS, -- THREAD_ORDER)); +- THREADINFO_GFP, +- THREAD_SIZE_ORDER)); - memset(&irqctx->tinfo, 0, sizeof(struct thread_info)); - irqctx->tinfo.cpu = cpu; - irqctx->tinfo.preempt_count = HARDIRQ_OFFSET; @@ -17830,19 +17599,22 @@ index 58b7f27..e112d08 100644 - per_cpu(hardirq_ctx, cpu) = irqctx; - - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu), -- THREAD_FLAGS, -- THREAD_ORDER)); +- THREADINFO_GFP, +- THREAD_SIZE_ORDER)); - memset(&irqctx->tinfo, 0, sizeof(struct thread_info)); - irqctx->tinfo.cpu = cpu; - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0); - - per_cpu(softirq_ctx, cpu) = irqctx; -+ per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER)); -+ per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER)); ++ per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREADINFO_GFP, THREAD_SIZE_ORDER)); ++ per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREADINFO_GFP, THREAD_SIZE_ORDER)); ++ ++ printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n", ++ cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu)); printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n", cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu)); -@@ -152,7 +138,6 @@ void __cpuinit irq_ctx_init(int cpu) +@@ -152,7 +141,6 @@ void __cpuinit irq_ctx_init(int cpu) asmlinkage void do_softirq(void) { unsigned long flags; @@ -17850,7 +17622,7 @@ index 58b7f27..e112d08 100644 union irq_ctx *irqctx; u32 *isp; -@@ -162,15 +147,22 @@ asmlinkage void do_softirq(void) +@@ -162,15 +150,22 @@ asmlinkage void do_softirq(void) local_irq_save(flags); if (local_softirq_pending()) { @@ -17877,7 +17649,7 @@ index 58b7f27..e112d08 100644 /* * Shouldn't happen, we returned above if in_interrupt(): */ -@@ -191,7 +183,7 @@ bool handle_irq(unsigned irq, struct pt_regs *regs) +@@ -191,7 +186,7 @@ bool handle_irq(unsigned irq, struct pt_regs *regs) if (unlikely(!desc)) return false; @@ -17913,7 +17685,7 @@ index 1d5d31e..ab846ed 100644 { struct setup_data_node *node = file->private_data; diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c -index 8bfb614..2b3b35f 100644 +index 3f61904..873cea9 100644 --- a/arch/x86/kernel/kgdb.c +++ b/arch/x86/kernel/kgdb.c @@ -127,11 +127,11 @@ char *dbg_get_reg(int regno, void *mem, struct pt_regs *regs) @@ -17991,7 +17763,7 @@ index c5e410e..da6aaf9 100644 insn_buf[0] = RELATIVEJUMP_OPCODE; diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c -index e213fc8..d783ba4 100644 +index e2f751e..dffa2a0 100644 --- a/arch/x86/kernel/kprobes.c +++ b/arch/x86/kernel/kprobes.c @@ -120,8 +120,11 @@ static void __kprobes __synthesize_relative_insn(void *from, void *to, u8 op) @@ -18347,10 +18119,10 @@ index f21fd94..61565cd 100644 if ((s64)val != *(s32 *)loc) goto overflow; diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c -index 32856fa..ce95eaa 100644 +index a0b2f84..875ab81 100644 --- a/arch/x86/kernel/nmi.c +++ b/arch/x86/kernel/nmi.c -@@ -507,6 +507,17 @@ static inline void nmi_nesting_postprocess(void) +@@ -460,6 +460,17 @@ static inline void nmi_nesting_postprocess(void) dotraplinkage notrace __kprobes void do_nmi(struct pt_regs *regs, long error_code) { @@ -18382,7 +18154,7 @@ index 676b8c7..870ba04 100644 .spin_is_locked = __ticket_spin_is_locked, .spin_is_contended = __ticket_spin_is_contended, diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c -index ab13760..01218e0 100644 +index 9ce8859..b49bf51 100644 --- a/arch/x86/kernel/paravirt.c +++ b/arch/x86/kernel/paravirt.c @@ -55,6 +55,9 @@ u64 _paravirt_ident_64(u64 x) @@ -18530,48 +18302,29 @@ index 35ccf75..7a15747 100644 #define DEBUG 1 diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c -index 1d92a5a..7bc8c29 100644 +index 735279e..5008677 100644 --- a/arch/x86/kernel/process.c +++ b/arch/x86/kernel/process.c -@@ -69,16 +69,33 @@ void free_thread_xstate(struct task_struct *tsk) - - void free_thread_info(struct thread_info *ti) - { -- free_thread_xstate(ti->task); - free_pages((unsigned long)ti, THREAD_ORDER); - } +@@ -34,7 +34,8 @@ + * section. Since TSS's are completely CPU-local, we want them + * on exact cacheline boundaries, to eliminate cacheline ping-pong. + */ +-DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS; ++struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS }; ++EXPORT_SYMBOL(init_tss); -+static struct kmem_cache *task_struct_cachep; -+ - void arch_task_cache_init(void) - { -- task_xstate_cachep = -- kmem_cache_create("task_xstate", xstate_size, -+ /* create a slab on which task_structs can be allocated */ -+ task_struct_cachep = -+ kmem_cache_create("task_struct", sizeof(struct task_struct), -+ ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL); -+ -+ task_xstate_cachep = -+ kmem_cache_create("task_xstate", xstate_size, + #ifdef CONFIG_X86_64 + static DEFINE_PER_CPU(unsigned char, is_idle); +@@ -92,7 +93,7 @@ void arch_task_cache_init(void) + task_xstate_cachep = + kmem_cache_create("task_xstate", xstate_size, __alignof__(union thread_xstate), - SLAB_PANIC | SLAB_NOTRACK, NULL); + SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL); -+} -+ -+struct task_struct *alloc_task_struct_node(int node) -+{ -+ return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node); -+} -+ -+void free_task_struct(struct task_struct *task) -+{ -+ free_thread_xstate(task); -+ kmem_cache_free(task_struct_cachep, task); } - /* -@@ -91,7 +108,7 @@ void exit_thread(void) + static inline void drop_fpu(struct task_struct *tsk) +@@ -115,7 +116,7 @@ void exit_thread(void) unsigned long *bp = t->io_bitmap_ptr; if (bp) { @@ -18580,7 +18333,7 @@ index 1d92a5a..7bc8c29 100644 t->io_bitmap_ptr = NULL; clear_thread_flag(TIF_IO_BITMAP); -@@ -127,7 +144,7 @@ void show_regs_common(void) +@@ -147,7 +148,7 @@ void show_regs_common(void) printk(KERN_CONT "\n"); printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s", @@ -18589,7 +18342,7 @@ index 1d92a5a..7bc8c29 100644 init_utsname()->release, (int)strcspn(init_utsname()->version, " "), init_utsname()->version); -@@ -141,6 +158,9 @@ void flush_thread(void) +@@ -161,6 +162,9 @@ void flush_thread(void) { struct task_struct *tsk = current; @@ -18598,8 +18351,8 @@ index 1d92a5a..7bc8c29 100644 +#endif flush_ptrace_hw_breakpoint(tsk); memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array)); - /* -@@ -303,10 +323,10 @@ int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags) + drop_fpu(tsk); +@@ -318,10 +322,10 @@ int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags) regs.di = (unsigned long) arg; #ifdef CONFIG_X86_32 @@ -18613,7 +18366,7 @@ index 1d92a5a..7bc8c29 100644 #else regs.ss = __KERNEL_DS; #endif -@@ -392,7 +412,7 @@ static void __exit_idle(void) +@@ -407,7 +411,7 @@ static void __exit_idle(void) void exit_idle(void) { /* idle loop has pid 0 */ @@ -18622,7 +18375,7 @@ index 1d92a5a..7bc8c29 100644 return; __exit_idle(); } -@@ -501,7 +521,7 @@ bool set_pm_idle_to_default(void) +@@ -516,7 +520,7 @@ bool set_pm_idle_to_default(void) return ret; } @@ -18631,7 +18384,7 @@ index 1d92a5a..7bc8c29 100644 { local_irq_disable(); /* -@@ -743,16 +763,37 @@ static int __init idle_setup(char *str) +@@ -746,16 +750,37 @@ static int __init idle_setup(char *str) } early_param("idle", idle_setup); @@ -18675,12 +18428,12 @@ index 1d92a5a..7bc8c29 100644 + load_sp0(init_tss + smp_processor_id(), thread); + +#ifdef CONFIG_X86_64 -+ percpu_write(kernel_stack, thread->sp0); ++ this_cpu_write(kernel_stack, thread->sp0); +#endif +} +#endif diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c -index ae68473..7b0bb71 100644 +index 516fa18..80bd9e6 100644 --- a/arch/x86/kernel/process_32.c +++ b/arch/x86/kernel/process_32.c @@ -64,6 +64,7 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork"); @@ -18709,7 +18462,7 @@ index ae68473..7b0bb71 100644 show_regs_common(); -@@ -143,13 +143,14 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, +@@ -134,13 +134,14 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, struct task_struct *tsk; int err; @@ -18725,7 +18478,7 @@ index ae68473..7b0bb71 100644 p->thread.ip = (unsigned long) ret_from_fork; -@@ -240,7 +241,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) +@@ -231,7 +232,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) struct thread_struct *prev = &prev_p->thread, *next = &next_p->thread; int cpu = smp_processor_id(); @@ -18734,7 +18487,7 @@ index ae68473..7b0bb71 100644 fpu_switch_t fpu; /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */ -@@ -264,6 +265,10 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) +@@ -255,6 +256,10 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) */ lazy_save_gs(prev->gs); @@ -18745,35 +18498,35 @@ index ae68473..7b0bb71 100644 /* * Load the per-thread Thread-Local Storage descriptor. */ -@@ -294,6 +299,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) +@@ -285,6 +290,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) */ arch_end_context_switch(next_p); -+ percpu_write(current_task, next_p); -+ percpu_write(current_tinfo, &next_p->tinfo); ++ this_cpu_write(current_task, next_p); ++ this_cpu_write(current_tinfo, &next_p->tinfo); + /* * Restore %gs if needed (which is common) */ -@@ -302,8 +310,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) +@@ -293,8 +301,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) switch_fpu_finish(next_p, fpu); -- percpu_write(current_task, next_p); +- this_cpu_write(current_task, next_p); - return prev_p; } -@@ -333,4 +339,3 @@ unsigned long get_wchan(struct task_struct *p) +@@ -324,4 +330,3 @@ unsigned long get_wchan(struct task_struct *p) } while (count++ < 16); return 0; } - diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c -index 43d8b48..c45d566 100644 +index 61cdf7f..797f06a 100644 --- a/arch/x86/kernel/process_64.c +++ b/arch/x86/kernel/process_64.c -@@ -162,8 +162,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, +@@ -153,8 +153,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, struct pt_regs *childregs; struct task_struct *me = current; @@ -18783,7 +18536,7 @@ index 43d8b48..c45d566 100644 *childregs = *regs; childregs->ax = 0; -@@ -175,6 +174,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, +@@ -166,6 +165,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, p->thread.sp = (unsigned long) childregs; p->thread.sp0 = (unsigned long) (childregs+1); p->thread.usersp = me->thread.usersp; @@ -18791,7 +18544,7 @@ index 43d8b48..c45d566 100644 set_tsk_thread_flag(p, TIF_FORK); -@@ -280,7 +280,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) +@@ -271,7 +271,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) struct thread_struct *prev = &prev_p->thread; struct thread_struct *next = &next_p->thread; int cpu = smp_processor_id(); @@ -18800,20 +18553,20 @@ index 43d8b48..c45d566 100644 unsigned fsindex, gsindex; fpu_switch_t fpu; -@@ -362,10 +362,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) - prev->usersp = percpu_read(old_rsp); - percpu_write(old_rsp, next->usersp); - percpu_write(current_task, next_p); -+ percpu_write(current_tinfo, &next_p->tinfo); +@@ -353,10 +353,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p) + prev->usersp = this_cpu_read(old_rsp); + this_cpu_write(old_rsp, next->usersp); + this_cpu_write(current_task, next_p); ++ this_cpu_write(current_tinfo, &next_p->tinfo); -- percpu_write(kernel_stack, +- this_cpu_write(kernel_stack, - (unsigned long)task_stack_page(next_p) + - THREAD_SIZE - KERNEL_STACK_OFFSET); -+ percpu_write(kernel_stack, next->sp0); ++ this_cpu_write(kernel_stack, next->sp0); /* * Now maybe reload the debug registers and handle I/O bitmaps -@@ -434,12 +433,11 @@ unsigned long get_wchan(struct task_struct *p) +@@ -425,12 +424,11 @@ unsigned long get_wchan(struct task_struct *p) if (!p || p == current || p->state == TASK_RUNNING) return 0; stack = (unsigned long)task_stack_page(p); @@ -18829,7 +18582,7 @@ index 43d8b48..c45d566 100644 ip = *(u64 *)(fp+8); if (!in_sched_functions(ip)) diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c -index cf11783..e7ce551 100644 +index c4c6a5c..905f440 100644 --- a/arch/x86/kernel/ptrace.c +++ b/arch/x86/kernel/ptrace.c @@ -824,7 +824,7 @@ long arch_ptrace(struct task_struct *child, long request, @@ -18890,7 +18643,7 @@ index cf11783..e7ce551 100644 /* * If we stepped into a sysenter/syscall insn, it trapped in * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP. -@@ -1506,6 +1515,11 @@ void syscall_trace_leave(struct pt_regs *regs) +@@ -1511,6 +1520,11 @@ void syscall_trace_leave(struct pt_regs *regs) { bool step; @@ -18935,10 +18688,10 @@ index 42eb330..139955c 100644 return ret; diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c -index 3034ee5..7cfbfa6 100644 +index 5de92f1..2732385 100644 --- a/arch/x86/kernel/reboot.c +++ b/arch/x86/kernel/reboot.c -@@ -35,7 +35,7 @@ void (*pm_power_off)(void); +@@ -36,7 +36,7 @@ void (*pm_power_off)(void); EXPORT_SYMBOL(pm_power_off); static const struct desc_ptr no_idt = {}; @@ -18947,18 +18700,16 @@ index 3034ee5..7cfbfa6 100644 enum reboot_type reboot_type = BOOT_ACPI; int reboot_force; -@@ -335,13 +335,17 @@ core_initcall(reboot_init); - extern const unsigned char machine_real_restart_asm[]; - extern const u64 machine_real_restart_gdt[3]; +@@ -157,11 +157,15 @@ static int __init set_bios_reboot(const struct dmi_system_id *d) + return 0; + } -void machine_real_restart(unsigned int type) +__noreturn void machine_real_restart(unsigned int type) { - void *restart_va; - unsigned long restart_pa; -- void (*restart_lowmem)(unsigned int); -+ void (* __noreturn restart_lowmem)(unsigned int); - u64 *lowmem_gdt; +- void (*restart_lowmem)(unsigned int) = (void (*)(unsigned int)) ++ void (* restart_lowmem)(unsigned int) = (void (*)(unsigned int)) + real_mode_header->machine_real_restart_asm; +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)) + struct desc_struct *gdt; @@ -18966,27 +18717,14 @@ index 3034ee5..7cfbfa6 100644 + local_irq_disable(); - /* Write zero to CMOS register number 0x0f, which the BIOS POST -@@ -367,14 +371,14 @@ void machine_real_restart(unsigned int type) - boot)". This seems like a fairly standard thing that gets set by - REBOOT.COM programs, and the previous reset routine did this - too. */ + /* +@@ -189,10 +193,36 @@ void machine_real_restart(unsigned int type) + * boot)". This seems like a fairly standard thing that gets set by + * REBOOT.COM programs, and the previous reset routine did this + * too. */ - *((unsigned short *)0x472) = reboot_mode; + *(unsigned short *)(__va(0x472)) = reboot_mode; - /* Patch the GDT in the low memory trampoline */ - lowmem_gdt = TRAMPOLINE_SYM(machine_real_restart_gdt); - - restart_va = TRAMPOLINE_SYM(machine_real_restart_asm); - restart_pa = virt_to_phys(restart_va); -- restart_lowmem = (void (*)(unsigned int))restart_pa; -+ restart_lowmem = (void *)restart_pa; - - /* GDT[0]: GDT self-pointer */ - lowmem_gdt[0] = -@@ -385,7 +389,33 @@ void machine_real_restart(unsigned int type) - GDT_ENTRY(0x009b, restart_pa, 0xffff); - /* Jump to the identity-mapped low memory code */ + +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)) @@ -19018,7 +18756,7 @@ index 3034ee5..7cfbfa6 100644 } #ifdef CONFIG_APM_MODULE EXPORT_SYMBOL(machine_real_restart); -@@ -564,7 +594,7 @@ void __attribute__((weak)) mach_reboot_fixups(void) +@@ -543,7 +573,7 @@ void __attribute__((weak)) mach_reboot_fixups(void) * try to force a triple fault and then cycle between hitting the keyboard * controller and doing that */ @@ -19027,7 +18765,7 @@ index 3034ee5..7cfbfa6 100644 { int i; int attempt = 0; -@@ -688,13 +718,13 @@ void native_machine_shutdown(void) +@@ -670,13 +700,13 @@ void native_machine_shutdown(void) #endif } @@ -19043,16 +18781,16 @@ index 3034ee5..7cfbfa6 100644 { printk("machine restart\n"); -@@ -703,7 +733,7 @@ static void native_machine_restart(char *__unused) +@@ -685,7 +715,7 @@ static void native_machine_restart(char *__unused) __machine_emergency_restart(0); } -static void native_machine_halt(void) +static __noreturn void native_machine_halt(void) { - /* stop other cpus and apics */ + /* Stop other cpus and apics */ machine_shutdown(); -@@ -714,7 +744,7 @@ static void native_machine_halt(void) +@@ -695,7 +725,7 @@ static void native_machine_halt(void) stop_this_cpu(NULL); } @@ -19061,9 +18799,9 @@ index 3034ee5..7cfbfa6 100644 { if (pm_power_off) { if (!reboot_force) -@@ -723,6 +753,7 @@ static void native_machine_power_off(void) +@@ -704,6 +734,7 @@ static void native_machine_power_off(void) } - /* a fallback in case there is no PM info available */ + /* A fallback in case there is no PM info available */ tboot_shutdown(TB_SHUTDOWN_HALT); + unreachable(); } @@ -19098,10 +18836,10 @@ index 7a6f3b3..bed145d7 100644 1: diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 1a29015..712f324 100644 +index 16be6dc..4686132 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c -@@ -447,7 +447,7 @@ static void __init parse_setup_data(void) +@@ -440,7 +440,7 @@ static void __init parse_setup_data(void) switch (data->type) { case SETUP_E820_EXT: @@ -19110,7 +18848,7 @@ index 1a29015..712f324 100644 break; case SETUP_DTB: add_dtb(pa_data); -@@ -639,7 +639,7 @@ static void __init trim_bios_range(void) +@@ -632,7 +632,7 @@ static void __init trim_bios_range(void) * area (640->1Mb) as ram even though it is not. * take them out. */ @@ -19119,7 +18857,7 @@ index 1a29015..712f324 100644 sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map); } -@@ -763,14 +763,14 @@ void __init setup_arch(char **cmdline_p) +@@ -755,14 +755,14 @@ void __init setup_arch(char **cmdline_p) if (!boot_params.hdr.root_flags) root_mountflags &= ~MS_RDONLY; @@ -19207,10 +18945,10 @@ index 5a98aa2..2f9288d 100644 * Up to this point, the boot CPU has been using .init.data * area. Reload any changed state for the boot CPU. diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c -index 115eac4..c0591d5 100644 +index 21af737..fb45e22 100644 --- a/arch/x86/kernel/signal.c +++ b/arch/x86/kernel/signal.c -@@ -190,7 +190,7 @@ static unsigned long align_sigframe(unsigned long sp) +@@ -191,7 +191,7 @@ static unsigned long align_sigframe(unsigned long sp) * Align the stack pointer according to the i386 ABI, * i.e. so that on function entry ((sp + 4) & 15) == 0. */ @@ -19219,7 +18957,7 @@ index 115eac4..c0591d5 100644 #else /* !CONFIG_X86_32 */ sp = round_down(sp, 16) - 8; #endif -@@ -241,11 +241,11 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, +@@ -242,11 +242,11 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, * Return an always-bogus address instead so we will die with SIGSEGV. */ if (onsigstack && !likely(on_sig_stack(sp))) @@ -19233,7 +18971,7 @@ index 115eac4..c0591d5 100644 return (void __user *)sp; } -@@ -300,9 +300,9 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set, +@@ -301,9 +301,9 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set, } if (current->mm->context.vdso) @@ -19245,7 +18983,7 @@ index 115eac4..c0591d5 100644 if (ka->sa.sa_flags & SA_RESTORER) restorer = ka->sa.sa_restorer; -@@ -316,7 +316,7 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set, +@@ -317,7 +317,7 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set, * reasons and because gdb uses it as a signature to notice * signal handler stack frames. */ @@ -19254,7 +18992,7 @@ index 115eac4..c0591d5 100644 if (err) return -EFAULT; -@@ -370,7 +370,10 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info, +@@ -371,7 +371,10 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info, err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set)); /* Set up to return from userspace. */ @@ -19266,7 +19004,7 @@ index 115eac4..c0591d5 100644 if (ka->sa.sa_flags & SA_RESTORER) restorer = ka->sa.sa_restorer; put_user_ex(restorer, &frame->pretcode); -@@ -382,7 +385,7 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info, +@@ -383,7 +386,7 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info, * reasons and because gdb uses it as a signature to notice * signal handler stack frames. */ @@ -19275,34 +19013,26 @@ index 115eac4..c0591d5 100644 } put_user_catch(err); if (err) -@@ -773,7 +776,7 @@ static void do_signal(struct pt_regs *regs) - * X86_32: vm86 regs switched out by assembly code before reaching - * here, so testing against kernel CS suffices. - */ -- if (!user_mode(regs)) -+ if (!user_mode_novm(regs)) - return; - - signr = get_signal_to_deliver(&info, &ka, regs, NULL); diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c -index 6e1e406..edfb7cb 100644 +index 7bd8a08..2659b5b 100644 --- a/arch/x86/kernel/smpboot.c +++ b/arch/x86/kernel/smpboot.c -@@ -699,17 +699,20 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu) - set_idle_for_cpu(cpu, c_idle.idle); - do_rest: - per_cpu(current_task, cpu) = c_idle.idle; -+ per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo; +@@ -679,6 +679,7 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu, struct task_struct *idle) + idle->thread.sp = (unsigned long) (((struct pt_regs *) + (THREAD_SIZE + task_stack_page(idle))) - 1); + per_cpu(current_task, cpu) = idle; ++ per_cpu(current_tinfo, cpu) = &idle->tinfo; + #ifdef CONFIG_X86_32 /* Stack for startup_32 can be just as for start_secondary onwards */ - irq_ctx_init(cpu); +@@ -686,11 +687,13 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu, struct task_struct *idle) #else - clear_tsk_thread_flag(c_idle.idle, TIF_FORK); + clear_tsk_thread_flag(idle, TIF_FORK); initial_gs = per_cpu_offset(cpu); - per_cpu(kernel_stack, cpu) = -- (unsigned long)task_stack_page(c_idle.idle) - +- (unsigned long)task_stack_page(idle) - - KERNEL_STACK_OFFSET + THREAD_SIZE; -+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE; ++ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE; #endif + + pax_open_kernel(); @@ -19310,9 +19040,9 @@ index 6e1e406..edfb7cb 100644 + pax_close_kernel(); + initial_code = (unsigned long)start_secondary; - stack_start = c_idle.idle->thread.sp; + stack_start = idle->thread.sp; -@@ -851,6 +854,12 @@ int __cpuinit native_cpu_up(unsigned int cpu) +@@ -826,6 +829,12 @@ int __cpuinit native_cpu_up(unsigned int cpu, struct task_struct *tidle) per_cpu(cpu_state, cpu) = CPU_UP_PREPARE; @@ -19322,7 +19052,7 @@ index 6e1e406..edfb7cb 100644 + KERNEL_PGD_PTRS); +#endif + - err = do_boot_cpu(apicid, cpu); + err = do_boot_cpu(apicid, cpu, tidle); if (err) { pr_debug("do_boot_cpu failed %d\n", err); diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c @@ -19736,10 +19466,10 @@ index b4d3c39..82bb73b 100644 return addr; diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c -index 6410744..79758f0 100644 +index f84fe00..93fe08f 100644 --- a/arch/x86/kernel/tboot.c +++ b/arch/x86/kernel/tboot.c -@@ -219,7 +219,7 @@ static int tboot_setup_sleep(void) +@@ -220,7 +220,7 @@ static int tboot_setup_sleep(void) void tboot_shutdown(u32 shutdown_type) { @@ -19748,7 +19478,7 @@ index 6410744..79758f0 100644 if (!tboot_enabled()) return; -@@ -241,7 +241,7 @@ void tboot_shutdown(u32 shutdown_type) +@@ -242,7 +242,7 @@ void tboot_shutdown(u32 shutdown_type) switch_to_tboot_pt(); @@ -19757,7 +19487,7 @@ index 6410744..79758f0 100644 shutdown(); /* should not reach here */ -@@ -299,7 +299,7 @@ static int tboot_sleep(u8 sleep_state, u32 pm1a_control, u32 pm1b_control) +@@ -300,7 +300,7 @@ static int tboot_sleep(u8 sleep_state, u32 pm1a_control, u32 pm1b_control) return 0; } @@ -19766,7 +19496,7 @@ index 6410744..79758f0 100644 static int tboot_wait_for_aps(int num_aps) { -@@ -323,9 +323,9 @@ static int __cpuinit tboot_cpu_callback(struct notifier_block *nfb, +@@ -324,9 +324,9 @@ static int __cpuinit tboot_cpu_callback(struct notifier_block *nfb, { switch (action) { case CPU_DYING: @@ -19778,7 +19508,7 @@ index 6410744..79758f0 100644 return NOTIFY_BAD; break; } -@@ -344,7 +344,7 @@ static __init int tboot_late_init(void) +@@ -345,7 +345,7 @@ static __init int tboot_late_init(void) tboot_create_trampoline(); @@ -19788,10 +19518,10 @@ index 6410744..79758f0 100644 acpi_os_set_prepare_sleep(&tboot_sleep); diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c -index c6eba2b..3303326 100644 +index 24d3c91..d06b473 100644 --- a/arch/x86/kernel/time.c +++ b/arch/x86/kernel/time.c -@@ -31,9 +31,9 @@ unsigned long profile_pc(struct pt_regs *regs) +@@ -30,9 +30,9 @@ unsigned long profile_pc(struct pt_regs *regs) { unsigned long pc = instruction_pointer(regs); @@ -19803,7 +19533,7 @@ index c6eba2b..3303326 100644 #else unsigned long *sp = (unsigned long *)kernel_stack_pointer(regs); -@@ -42,11 +42,17 @@ unsigned long profile_pc(struct pt_regs *regs) +@@ -41,11 +41,17 @@ unsigned long profile_pc(struct pt_regs *regs) * or above a saved flags. Eflags has bits 22-31 zero, * kernel addresses don't. */ @@ -19837,59 +19567,11 @@ index 9d9d2f9..ed344e4 100644 set_tls_desc(p, idx, &info, 1); return 0; -diff --git a/arch/x86/kernel/trampoline_32.S b/arch/x86/kernel/trampoline_32.S -index 451c0a7..e57f551 100644 ---- a/arch/x86/kernel/trampoline_32.S -+++ b/arch/x86/kernel/trampoline_32.S -@@ -32,6 +32,12 @@ - #include <asm/segment.h> - #include <asm/page_types.h> - -+#ifdef CONFIG_PAX_KERNEXEC -+#define ta(X) (X) -+#else -+#define ta(X) ((X) - __PAGE_OFFSET) -+#endif -+ - #ifdef CONFIG_SMP - - .section ".x86_trampoline","a" -@@ -62,7 +68,7 @@ r_base = . - inc %ax # protected mode (PE) bit - lmsw %ax # into protected mode - # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S -- ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET) -+ ljmpl $__BOOT_CS, $ta(startup_32_smp) - - # These need to be in the same 64K segment as the above; - # hence we don't use the boot_gdt_descr defined in head.S -diff --git a/arch/x86/kernel/trampoline_64.S b/arch/x86/kernel/trampoline_64.S -index 09ff517..df19fbff 100644 ---- a/arch/x86/kernel/trampoline_64.S -+++ b/arch/x86/kernel/trampoline_64.S -@@ -90,7 +90,7 @@ startup_32: - movl $__KERNEL_DS, %eax # Initialize the %ds segment register - movl %eax, %ds - -- movl $X86_CR4_PAE, %eax -+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax - movl %eax, %cr4 # Enable PAE mode - - # Setup trampoline 4 level pagetables -@@ -138,7 +138,7 @@ tidt: - # so the kernel can live anywhere - .balign 4 - tgdt: -- .short tgdt_end - tgdt # gdt limit -+ .short tgdt_end - tgdt - 1 # gdt limit - .long tgdt - r_base - .short 0 - .quad 0x00cf9b000000ffff # __KERNEL32_CS diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c -index ff9281f1..30cb4ac 100644 +index 05b31d9..501d3ba 100644 --- a/arch/x86/kernel/traps.c +++ b/arch/x86/kernel/traps.c -@@ -70,12 +70,6 @@ asmlinkage int system_call(void); +@@ -67,12 +67,6 @@ asmlinkage int system_call(void); /* Do we ignore FPU interrupts ? */ char ignore_fpu_irq; @@ -19902,7 +19584,7 @@ index ff9281f1..30cb4ac 100644 #endif DECLARE_BITMAP(used_vectors, NR_VECTORS); -@@ -108,13 +102,13 @@ static inline void preempt_conditional_cli(struct pt_regs *regs) +@@ -105,13 +99,13 @@ static inline void preempt_conditional_cli(struct pt_regs *regs) } static void __kprobes @@ -19918,7 +19600,7 @@ index ff9281f1..30cb4ac 100644 /* * traps 0, 1, 3, 4, and 5 should be forwarded to vm86. * On nmi (interrupt 2), do_trap should not be called. -@@ -125,7 +119,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs, +@@ -122,7 +116,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs, } #endif @@ -19927,7 +19609,7 @@ index ff9281f1..30cb4ac 100644 goto kernel_trap; #ifdef CONFIG_X86_32 -@@ -148,7 +142,7 @@ trap_signal: +@@ -145,7 +139,7 @@ trap_signal: printk_ratelimit()) { printk(KERN_INFO "%s[%d] trap %s ip:%lx sp:%lx error:%lx", @@ -19936,7 +19618,7 @@ index ff9281f1..30cb4ac 100644 regs->ip, regs->sp, error_code); print_vma_addr(" in ", regs->ip); printk("\n"); -@@ -165,8 +159,20 @@ kernel_trap: +@@ -162,8 +156,20 @@ kernel_trap: if (!fixup_exception(regs)) { tsk->thread.error_code = error_code; tsk->thread.trap_nr = trapnr; @@ -19957,7 +19639,7 @@ index ff9281f1..30cb4ac 100644 return; #ifdef CONFIG_X86_32 -@@ -259,14 +265,30 @@ do_general_protection(struct pt_regs *regs, long error_code) +@@ -256,14 +262,30 @@ do_general_protection(struct pt_regs *regs, long error_code) conditional_sti(regs); #ifdef CONFIG_X86_32 @@ -19990,7 +19672,7 @@ index ff9281f1..30cb4ac 100644 tsk->thread.error_code = error_code; tsk->thread.trap_nr = X86_TRAP_GP; -@@ -299,6 +321,13 @@ gp_in_kernel: +@@ -296,6 +318,13 @@ gp_in_kernel: if (notify_die(DIE_GPF, "general protection fault", regs, error_code, X86_TRAP_GP, SIGSEGV) == NOTIFY_STOP) return; @@ -20004,7 +19686,7 @@ index ff9281f1..30cb4ac 100644 die("general protection fault", regs, error_code); } -@@ -425,7 +454,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code) +@@ -431,7 +460,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code) /* It's safe to allow irq's after DR6 has been saved */ preempt_conditional_sti(regs); @@ -20013,7 +19695,7 @@ index ff9281f1..30cb4ac 100644 handle_vm86_trap((struct kernel_vm86_regs *) regs, error_code, X86_TRAP_DB); preempt_conditional_cli(regs); -@@ -440,7 +469,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code) +@@ -446,7 +475,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code) * We already checked v86 mode above, so we can check for kernel mode * by just checking the CPL of CS. */ @@ -20022,7 +19704,7 @@ index ff9281f1..30cb4ac 100644 tsk->thread.debugreg6 &= ~DR_STEP; set_tsk_thread_flag(tsk, TIF_SINGLESTEP); regs->flags &= ~X86_EFLAGS_TF; -@@ -471,7 +500,7 @@ void math_error(struct pt_regs *regs, int error_code, int trapnr) +@@ -477,7 +506,7 @@ void math_error(struct pt_regs *regs, int error_code, int trapnr) return; conditional_sti(regs); @@ -20031,6 +19713,19 @@ index ff9281f1..30cb4ac 100644 { if (!fixup_exception(regs)) { task->thread.error_code = error_code; +diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c +index dc4e910..c9dedab 100644 +--- a/arch/x86/kernel/uprobes.c ++++ b/arch/x86/kernel/uprobes.c +@@ -606,7 +606,7 @@ int arch_uprobe_exception_notify(struct notifier_block *self, unsigned long val, + int ret = NOTIFY_DONE; + + /* We are only interested in userspace traps */ +- if (regs && !user_mode_vm(regs)) ++ if (regs && !user_mode(regs)) + return NOTIFY_DONE; + + switch (val) { diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S index b9242ba..50c5edd 100644 --- a/arch/x86/kernel/verify_cpu.S @@ -20112,7 +19807,7 @@ index 255f58a..5e91150 100644 goto cannot_handle; if ((segoffs >> 16) == BIOSSEG) diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S -index 0f703f1..3b426f3 100644 +index 22a1530..8fbaaad 100644 --- a/arch/x86/kernel/vmlinux.lds.S +++ b/arch/x86/kernel/vmlinux.lds.S @@ -26,6 +26,13 @@ @@ -20312,9 +20007,9 @@ index 0f703f1..3b426f3 100644 + . = ALIGN(PAGE_SIZE); + INIT_DATA_SECTION(16) :init - /* - * Code and data for a variety of lowlevel trampolines, to be -@@ -269,19 +350,12 @@ SECTIONS + .x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) { + __x86_cpu_dev_start = .; +@@ -257,19 +338,12 @@ SECTIONS } . = ALIGN(8); @@ -20335,7 +20030,7 @@ index 0f703f1..3b426f3 100644 PERCPU_SECTION(INTERNODE_CACHE_BYTES) #endif -@@ -300,16 +374,10 @@ SECTIONS +@@ -288,16 +362,10 @@ SECTIONS .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) { __smp_locks = .; *(.smp_locks) @@ -20353,7 +20048,7 @@ index 0f703f1..3b426f3 100644 /* BSS */ . = ALIGN(PAGE_SIZE); .bss : AT(ADDR(.bss) - LOAD_OFFSET) { -@@ -325,6 +393,7 @@ SECTIONS +@@ -313,6 +381,7 @@ SECTIONS __brk_base = .; . += 64 * 1024; /* 64k alignment slop space */ *(.brk_reservation) /* areas brk users have reserved */ @@ -20361,7 +20056,7 @@ index 0f703f1..3b426f3 100644 __brk_limit = .; } -@@ -351,13 +420,12 @@ SECTIONS +@@ -339,13 +408,12 @@ SECTIONS * for the boot processor. */ #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load @@ -20377,7 +20072,7 @@ index 0f703f1..3b426f3 100644 #ifdef CONFIG_SMP diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c -index 7515cf0..331a1a0 100644 +index 5db36ca..2938af9 100644 --- a/arch/x86/kernel/vsyscall_64.c +++ b/arch/x86/kernel/vsyscall_64.c @@ -54,15 +54,13 @@ @@ -20397,16 +20092,7 @@ index 7515cf0..331a1a0 100644 else if (!strcmp("none", str)) vsyscall_mode = NONE; else -@@ -206,7 +204,7 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address) - - tsk = current; - if (seccomp_mode(&tsk->seccomp)) -- do_exit(SIGKILL); -+ do_group_exit(SIGKILL); - - /* - * With a real vsyscall, page faults cause SIGSEGV. We want to -@@ -278,8 +276,7 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address) +@@ -309,8 +307,7 @@ done: return true; sigsegv: @@ -20416,7 +20102,7 @@ index 7515cf0..331a1a0 100644 } /* -@@ -332,10 +329,7 @@ void __init map_vsyscall(void) +@@ -363,10 +360,7 @@ void __init map_vsyscall(void) extern char __vvar_page; unsigned long physaddr_vvar_page = __pa_symbol(&__vvar_page); @@ -20442,10 +20128,10 @@ index 9796c2f..f686fbf 100644 EXPORT_SYMBOL(copy_page); EXPORT_SYMBOL(clear_page); diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c -index e62728e..5fc3a07 100644 +index bd18149..2ea0183 100644 --- a/arch/x86/kernel/xsave.c +++ b/arch/x86/kernel/xsave.c -@@ -131,7 +131,7 @@ int check_for_xstate(struct i387_fxsave_struct __user *buf, +@@ -129,7 +129,7 @@ int check_for_xstate(struct i387_fxsave_struct __user *buf, fx_sw_user->xstate_size > fx_sw_user->extended_size) return -EINVAL; @@ -20454,7 +20140,7 @@ index e62728e..5fc3a07 100644 fx_sw_user->extended_size - FP_XSTATE_MAGIC2_SIZE)); if (err) -@@ -267,7 +267,7 @@ fx_only: +@@ -265,7 +265,7 @@ fx_only: * the other extended state. */ xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE); @@ -20463,7 +20149,7 @@ index e62728e..5fc3a07 100644 } /* -@@ -296,7 +296,7 @@ int restore_i387_xstate(void __user *buf) +@@ -294,7 +294,7 @@ int restore_i387_xstate(void __user *buf) if (use_xsave()) err = restore_user_xstate(buf); else @@ -20473,7 +20159,7 @@ index e62728e..5fc3a07 100644 if (unlikely(err)) { /* diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c -index 9fed5be..18fd595 100644 +index 7df1c6d..9ea7c79 100644 --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -124,15 +124,20 @@ int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu, @@ -20524,10 +20210,10 @@ index 9fed5be..18fd595 100644 out: diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 8375622..b7bca1a 100644 +index f95d242..3b49a90 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c -@@ -252,6 +252,7 @@ struct gprefix { +@@ -256,6 +256,7 @@ struct gprefix { #define ____emulate_2op(ctxt, _op, _x, _y, _suffix, _dsttype) \ do { \ @@ -20535,7 +20221,7 @@ index 8375622..b7bca1a 100644 __asm__ __volatile__ ( \ _PRE_EFLAGS("0", "4", "2") \ _op _suffix " %"_x"3,%1; " \ -@@ -266,8 +267,6 @@ struct gprefix { +@@ -270,8 +271,6 @@ struct gprefix { /* Raw emulation: instruction has two explicit operands. */ #define __emulate_2op_nobyte(ctxt,_op,_wx,_wy,_lx,_ly,_qx,_qy) \ do { \ @@ -20544,7 +20230,7 @@ index 8375622..b7bca1a 100644 switch ((ctxt)->dst.bytes) { \ case 2: \ ____emulate_2op(ctxt,_op,_wx,_wy,"w",u16); \ -@@ -283,7 +282,6 @@ struct gprefix { +@@ -287,7 +286,6 @@ struct gprefix { #define __emulate_2op(ctxt,_op,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \ do { \ @@ -20553,7 +20239,7 @@ index 8375622..b7bca1a 100644 case 1: \ ____emulate_2op(ctxt,_op,_bx,_by,"b",u8); \ diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c -index 8584322..17d5955 100644 +index 93c1574..d6097dc 100644 --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -54,7 +54,7 @@ @@ -20566,7 +20252,7 @@ index 8584322..17d5955 100644 #define APIC_LVT_NUM 6 /* 14 is the version for Xeon and Pentium 8.4.8*/ diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h -index df5a703..63748a7 100644 +index 34f9709..8eca2d5 100644 --- a/arch/x86/kvm/paging_tmpl.h +++ b/arch/x86/kvm/paging_tmpl.h @@ -197,7 +197,7 @@ retry_walk: @@ -20579,10 +20265,10 @@ index df5a703..63748a7 100644 goto error; diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index e334389..6839087 100644 +index f75af40..285b18f 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c -@@ -3509,7 +3509,11 @@ static void reload_tss(struct kvm_vcpu *vcpu) +@@ -3516,7 +3516,11 @@ static void reload_tss(struct kvm_vcpu *vcpu) int cpu = raw_smp_processor_id(); struct svm_cpu_data *sd = per_cpu(svm_data, cpu); @@ -20594,7 +20280,7 @@ index e334389..6839087 100644 load_TR_desc(); } -@@ -3887,6 +3891,10 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) +@@ -3894,6 +3898,10 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) #endif #endif @@ -20606,10 +20292,10 @@ index e334389..6839087 100644 local_irq_disable(); diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 4ff0ab9..2ff68d3 100644 +index 32eb588..19c4fe3 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c -@@ -1303,7 +1303,11 @@ static void reload_tss(void) +@@ -1313,7 +1313,11 @@ static void reload_tss(void) struct desc_struct *descs; descs = (void *)gdt->address; @@ -20621,7 +20307,18 @@ index 4ff0ab9..2ff68d3 100644 load_TR_desc(); } -@@ -2625,8 +2629,11 @@ static __init int hardware_setup(void) +@@ -1475,8 +1479,8 @@ static void __vmx_load_host_state(struct vcpu_vmx *vmx) + * The sysexit path does not restore ds/es, so we must set them to + * a reasonable value ourselves. + */ +- loadsegment(ds, __USER_DS); +- loadsegment(es, __USER_DS); ++ loadsegment(ds, __KERNEL_DS); ++ loadsegment(es, __KERNEL_DS); + #endif + reload_tss(); + #ifdef CONFIG_X86_64 +@@ -2653,8 +2657,11 @@ static __init int hardware_setup(void) if (!cpu_has_vmx_flexpriority()) flexpriority_enabled = 0; @@ -20635,7 +20332,7 @@ index 4ff0ab9..2ff68d3 100644 if (enable_ept && !cpu_has_vmx_ept_2m_page()) kvm_disable_largepages(); -@@ -3642,7 +3649,7 @@ static void vmx_set_constant_host_state(void) +@@ -3680,7 +3687,7 @@ static void vmx_set_constant_host_state(void) vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */ asm("mov $.Lkvm_vmx_return, %0" : "=r"(tmpl)); @@ -20644,7 +20341,7 @@ index 4ff0ab9..2ff68d3 100644 rdmsr(MSR_IA32_SYSENTER_CS, low32, high32); vmcs_write32(HOST_IA32_SYSENTER_CS, low32); -@@ -6180,6 +6187,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) +@@ -6218,6 +6225,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) "jmp .Lkvm_vmx_return \n\t" ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t" ".Lkvm_vmx_return: " @@ -20657,7 +20354,7 @@ index 4ff0ab9..2ff68d3 100644 /* Save guest registers, load host registers, keep flags */ "mov %0, %c[wordsize](%%"R"sp) \n\t" "pop %0 \n\t" -@@ -6228,6 +6241,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) +@@ -6266,6 +6279,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) #endif [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)), [wordsize]"i"(sizeof(ulong)) @@ -20669,11 +20366,10 @@ index 4ff0ab9..2ff68d3 100644 : "cc", "memory" , R"ax", R"bx", R"di", R"si" #ifdef CONFIG_X86_64 -@@ -6256,7 +6274,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) +@@ -6294,6 +6312,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) } } -- asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS)); + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS)); + +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) @@ -20688,7 +20384,7 @@ index 4ff0ab9..2ff68d3 100644 vmx->exit_reason = vmcs_read32(VM_EXIT_REASON); diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 185a2b8..866d2a6 100644 +index be6d549..b0ba2bf 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1357,8 +1357,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data) @@ -20702,7 +20398,7 @@ index 185a2b8..866d2a6 100644 u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64 : kvm->arch.xen_hvm_config.blob_size_32; u32 page_num = data & ~PAGE_MASK; -@@ -2213,6 +2213,8 @@ long kvm_arch_dev_ioctl(struct file *filp, +@@ -2214,6 +2214,8 @@ long kvm_arch_dev_ioctl(struct file *filp, if (n < msr_list.nmsrs) goto out; r = -EFAULT; @@ -20711,7 +20407,7 @@ index 185a2b8..866d2a6 100644 if (copy_to_user(user_msr_list->indices, &msrs_to_save, num_msrs_to_save * sizeof(u32))) goto out; -@@ -2338,7 +2340,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu, +@@ -2339,7 +2341,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu, static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu, struct kvm_interrupt *irq) { @@ -20720,7 +20416,7 @@ index 185a2b8..866d2a6 100644 return -EINVAL; if (irqchip_in_kernel(vcpu->kvm)) return -ENXIO; -@@ -4860,7 +4862,7 @@ static void kvm_set_mmio_spte_mask(void) +@@ -4876,7 +4878,7 @@ static void kvm_set_mmio_spte_mask(void) kvm_mmu_set_mmio_spte_mask(mask); } @@ -21230,20 +20926,20 @@ index f5cc9eb..51fa319 100644 CFI_ENDPROC ENDPROC(atomic64_inc_not_zero_cx8) diff --git a/arch/x86/lib/checksum_32.S b/arch/x86/lib/checksum_32.S -index 78d16a5..fbcf666 100644 +index 2af5df3..62b1a5a 100644 --- a/arch/x86/lib/checksum_32.S +++ b/arch/x86/lib/checksum_32.S -@@ -28,7 +28,8 @@ - #include <linux/linkage.h> +@@ -29,7 +29,8 @@ #include <asm/dwarf2.h> #include <asm/errno.h> + #include <asm/asm.h> - +#include <asm/segment.h> + /* * computes a partial checksum, e.g. for TCP/UDP fragments */ -@@ -296,9 +297,24 @@ unsigned int csum_partial_copy_generic (const char *src, char *dst, +@@ -293,9 +294,24 @@ unsigned int csum_partial_copy_generic (const char *src, char *dst, #define ARGBASE 16 #define FP 12 @@ -21270,7 +20966,7 @@ index 78d16a5..fbcf666 100644 subl $4,%esp CFI_ADJUST_CFA_OFFSET 4 pushl_cfi %edi -@@ -320,7 +336,7 @@ ENTRY(csum_partial_copy_generic) +@@ -317,7 +333,7 @@ ENTRY(csum_partial_copy_generic) jmp 4f SRC(1: movw (%esi), %bx ) addl $2, %esi @@ -21279,7 +20975,7 @@ index 78d16a5..fbcf666 100644 addl $2, %edi addw %bx, %ax adcl $0, %eax -@@ -332,30 +348,30 @@ DST( movw %bx, (%edi) ) +@@ -329,30 +345,30 @@ DST( movw %bx, (%edi) ) SRC(1: movl (%esi), %ebx ) SRC( movl 4(%esi), %edx ) adcl %ebx, %eax @@ -21318,7 +21014,7 @@ index 78d16a5..fbcf666 100644 lea 32(%esi), %esi lea 32(%edi), %edi -@@ -369,7 +385,7 @@ DST( movl %edx, 28(%edi) ) +@@ -366,7 +382,7 @@ DST( movl %edx, 28(%edi) ) shrl $2, %edx # This clears CF SRC(3: movl (%esi), %ebx ) adcl %ebx, %eax @@ -21327,7 +21023,7 @@ index 78d16a5..fbcf666 100644 lea 4(%esi), %esi lea 4(%edi), %edi dec %edx -@@ -381,12 +397,12 @@ DST( movl %ebx, (%edi) ) +@@ -378,12 +394,12 @@ DST( movl %ebx, (%edi) ) jb 5f SRC( movw (%esi), %cx ) leal 2(%esi), %esi @@ -21342,7 +21038,7 @@ index 78d16a5..fbcf666 100644 6: addl %ecx, %eax adcl $0, %eax 7: -@@ -397,7 +413,7 @@ DST( movb %cl, (%edi) ) +@@ -394,7 +410,7 @@ DST( movb %cl, (%edi) ) 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr @@ -21351,7 +21047,7 @@ index 78d16a5..fbcf666 100644 # zero the complete destination - computing the rest # is too much work -@@ -410,11 +426,15 @@ DST( movb %cl, (%edi) ) +@@ -407,11 +423,15 @@ DST( movb %cl, (%edi) ) 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr @@ -21368,7 +21064,7 @@ index 78d16a5..fbcf666 100644 popl_cfi %ebx CFI_RESTORE ebx popl_cfi %esi -@@ -424,26 +444,43 @@ DST( movb %cl, (%edi) ) +@@ -421,26 +441,43 @@ DST( movb %cl, (%edi) ) popl_cfi %ecx # equivalent to addl $4,%esp ret CFI_ENDPROC @@ -21417,7 +21113,7 @@ index 78d16a5..fbcf666 100644 pushl_cfi %ebx CFI_REL_OFFSET ebx, 0 pushl_cfi %edi -@@ -464,7 +501,7 @@ ENTRY(csum_partial_copy_generic) +@@ -461,7 +498,7 @@ ENTRY(csum_partial_copy_generic) subl %ebx, %edi lea -1(%esi),%edx andl $-32,%edx @@ -21426,7 +21122,7 @@ index 78d16a5..fbcf666 100644 testl %esi, %esi jmp *%ebx 1: addl $64,%esi -@@ -485,19 +522,19 @@ ENTRY(csum_partial_copy_generic) +@@ -482,19 +519,19 @@ ENTRY(csum_partial_copy_generic) jb 5f SRC( movw (%esi), %dx ) leal 2(%esi), %esi @@ -21449,7 +21145,7 @@ index 78d16a5..fbcf666 100644 # zero the complete destination (computing the rest is too much work) movl ARGBASE+8(%esp),%edi # dst movl ARGBASE+12(%esp),%ecx # len -@@ -505,10 +542,17 @@ DST( movb %dl, (%edi) ) +@@ -502,10 +539,17 @@ DST( movb %dl, (%edi) ) rep; stosb jmp 7b 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr @@ -21468,7 +21164,7 @@ index 78d16a5..fbcf666 100644 popl_cfi %esi CFI_RESTORE esi popl_cfi %edi -@@ -517,7 +561,7 @@ DST( movb %dl, (%edi) ) +@@ -514,7 +558,7 @@ DST( movb %dl, (%edi) ) CFI_RESTORE ebx ret CFI_ENDPROC @@ -21621,18 +21317,18 @@ index 6b34d04..dccb07f 100644 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */ 2: diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S -index 0248402..821c786 100644 +index 5b2995f..78e7644 100644 --- a/arch/x86/lib/copy_user_64.S +++ b/arch/x86/lib/copy_user_64.S -@@ -16,6 +16,7 @@ - #include <asm/thread_info.h> +@@ -17,6 +17,7 @@ #include <asm/cpufeature.h> #include <asm/alternative-asm.h> + #include <asm/asm.h> +#include <asm/pgtable.h> /* * By placing feature2 after feature1 in altinstructions section, we logically -@@ -29,7 +30,7 @@ +@@ -30,7 +31,7 @@ .byte 0xe9 /* 32bit jump */ .long \orig-1f /* by default jump to orig */ 1: @@ -21641,7 +21337,7 @@ index 0248402..821c786 100644 2: .byte 0xe9 /* near jump with 32bit immediate */ .long \alt1-1b /* offset */ /* or alternatively to alt1 */ 3: .byte 0xe9 /* near jump with 32bit immediate */ -@@ -71,47 +72,20 @@ +@@ -69,47 +70,20 @@ #endif .endm @@ -21692,7 +21388,7 @@ index 0248402..821c786 100644 ret CFI_ENDPROC ENDPROC(bad_from_user) -@@ -141,19 +115,19 @@ ENTRY(copy_user_generic_unrolled) +@@ -139,19 +113,19 @@ ENTRY(copy_user_generic_unrolled) jz 17f 1: movq (%rsi),%r8 2: movq 1*8(%rsi),%r9 @@ -21716,7 +21412,7 @@ index 0248402..821c786 100644 16: movq %r11,7*8(%rdi) leaq 64(%rsi),%rsi leaq 64(%rdi),%rdi -@@ -179,6 +153,7 @@ ENTRY(copy_user_generic_unrolled) +@@ -177,6 +151,7 @@ ENTRY(copy_user_generic_unrolled) decl %ecx jnz 21b 23: xor %eax,%eax @@ -21724,7 +21420,7 @@ index 0248402..821c786 100644 ret .section .fixup,"ax" -@@ -251,6 +226,7 @@ ENTRY(copy_user_generic_string) +@@ -246,6 +221,7 @@ ENTRY(copy_user_generic_string) 3: rep movsb 4: xorl %eax,%eax @@ -21732,7 +21428,7 @@ index 0248402..821c786 100644 ret .section .fixup,"ax" -@@ -287,6 +263,7 @@ ENTRY(copy_user_enhanced_fast_string) +@@ -279,6 +255,7 @@ ENTRY(copy_user_enhanced_fast_string) 1: rep movsb 2: xorl %eax,%eax @@ -21741,10 +21437,10 @@ index 0248402..821c786 100644 .section .fixup,"ax" diff --git a/arch/x86/lib/copy_user_nocache_64.S b/arch/x86/lib/copy_user_nocache_64.S -index cb0c112..e3a6895 100644 +index cacddc7..09d49e4 100644 --- a/arch/x86/lib/copy_user_nocache_64.S +++ b/arch/x86/lib/copy_user_nocache_64.S -@@ -8,12 +8,14 @@ +@@ -8,6 +8,7 @@ #include <linux/linkage.h> #include <asm/dwarf2.h> @@ -21752,14 +21448,15 @@ index cb0c112..e3a6895 100644 #define FIX_ALIGNMENT 1 - #include <asm/current.h> +@@ -15,6 +16,7 @@ #include <asm/asm-offsets.h> #include <asm/thread_info.h> + #include <asm/asm.h> +#include <asm/pgtable.h> .macro ALIGN_DESTINATION #ifdef FIX_ALIGNMENT -@@ -50,6 +52,15 @@ +@@ -48,6 +50,15 @@ */ ENTRY(__copy_user_nocache) CFI_STARTPROC @@ -21775,7 +21472,7 @@ index cb0c112..e3a6895 100644 cmpl $8,%edx jb 20f /* less then 8 bytes, go to byte copy loop */ ALIGN_DESTINATION -@@ -59,19 +70,19 @@ ENTRY(__copy_user_nocache) +@@ -57,19 +68,19 @@ ENTRY(__copy_user_nocache) jz 17f 1: movq (%rsi),%r8 2: movq 1*8(%rsi),%r9 @@ -21799,7 +21496,7 @@ index cb0c112..e3a6895 100644 16: movnti %r11,7*8(%rdi) leaq 64(%rsi),%rsi leaq 64(%rdi),%rdi -@@ -98,6 +109,7 @@ ENTRY(__copy_user_nocache) +@@ -96,6 +107,7 @@ ENTRY(__copy_user_nocache) jnz 21b 23: xorl %eax,%eax sfence @@ -21808,18 +21505,18 @@ index cb0c112..e3a6895 100644 .section .fixup,"ax" diff --git a/arch/x86/lib/csum-copy_64.S b/arch/x86/lib/csum-copy_64.S -index fb903b7..c92b7f7 100644 +index 2419d5f..953ee51 100644 --- a/arch/x86/lib/csum-copy_64.S +++ b/arch/x86/lib/csum-copy_64.S -@@ -8,6 +8,7 @@ - #include <linux/linkage.h> +@@ -9,6 +9,7 @@ #include <asm/dwarf2.h> #include <asm/errno.h> + #include <asm/asm.h> +#include <asm/alternative-asm.h> /* * Checksum copy with exception handling. -@@ -228,6 +229,7 @@ ENTRY(csum_partial_copy_generic) +@@ -220,6 +221,7 @@ ENTRY(csum_partial_copy_generic) CFI_RESTORE rbp addq $7*8, %rsp CFI_ADJUST_CFA_OFFSET -7*8 @@ -21828,7 +21525,7 @@ index fb903b7..c92b7f7 100644 CFI_RESTORE_STATE diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c -index 459b58a..9570bc7 100644 +index 25b7ae8..3b52ccd 100644 --- a/arch/x86/lib/csum-wrappers_64.c +++ b/arch/x86/lib/csum-wrappers_64.c @@ -52,7 +52,13 @@ csum_partial_copy_from_user(const void __user *src, void *dst, @@ -21862,7 +21559,7 @@ index 459b58a..9570bc7 100644 } EXPORT_SYMBOL(csum_partial_copy_to_user); diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S -index 51f1504..ddac4c1 100644 +index b33b1fb..219f389 100644 --- a/arch/x86/lib/getuser.S +++ b/arch/x86/lib/getuser.S @@ -33,15 +33,38 @@ @@ -22663,7 +22360,7 @@ index 69fa106..adda88b 100644 3: CFI_RESTORE_STATE diff --git a/arch/x86/lib/putuser.S b/arch/x86/lib/putuser.S -index 36b0d15..d381858 100644 +index 7f951c8..ebd573a 100644 --- a/arch/x86/lib/putuser.S +++ b/arch/x86/lib/putuser.S @@ -15,7 +15,9 @@ @@ -22937,10 +22634,10 @@ index a63efd6..ccecad8 100644 ret CFI_ENDPROC diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c -index ef2a6a5..3b28862 100644 +index 1781b2f..18e3040 100644 --- a/arch/x86/lib/usercopy_32.c +++ b/arch/x86/lib/usercopy_32.c -@@ -41,10 +41,12 @@ do { \ +@@ -42,10 +42,12 @@ do { \ int __d0; \ might_fault(); \ __asm__ __volatile__( \ @@ -22953,23 +22650,7 @@ index ef2a6a5..3b28862 100644 ".section .fixup,\"ax\"\n" \ "3: lea 0(%2,%0,4),%0\n" \ " jmp 2b\n" \ -@@ -113,6 +115,7 @@ long strnlen_user(const char __user *s, long n) - might_fault(); - - __asm__ __volatile__( -+ __COPYUSER_SET_ES - " testl %0, %0\n" - " jz 3f\n" - " andl %0,%%ecx\n" -@@ -121,6 +124,7 @@ long strnlen_user(const char __user *s, long n) - " subl %%ecx,%0\n" - " addl %0,%%eax\n" - "1:\n" -+ __COPYUSER_RESTORE_ES - ".section .fixup,\"ax\"\n" - "2: xorl %%eax,%%eax\n" - " jmp 1b\n" -@@ -140,7 +144,7 @@ EXPORT_SYMBOL(strnlen_user); +@@ -97,7 +99,7 @@ EXPORT_SYMBOL(__clear_user); #ifdef CONFIG_X86_INTEL_USERCOPY static unsigned long @@ -22978,7 +22659,7 @@ index ef2a6a5..3b28862 100644 { int d0, d1; __asm__ __volatile__( -@@ -152,36 +156,36 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size) +@@ -109,36 +111,36 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size) " .align 2,0x90\n" "3: movl 0(%4), %%eax\n" "4: movl 4(%4), %%edx\n" @@ -23031,7 +22712,7 @@ index ef2a6a5..3b28862 100644 " addl $-64, %0\n" " addl $64, %4\n" " addl $64, %3\n" -@@ -191,10 +195,12 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size) +@@ -148,10 +150,12 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size) " shrl $2, %0\n" " andl $3, %%eax\n" " cld\n" @@ -23044,7 +22725,7 @@ index ef2a6a5..3b28862 100644 ".section .fixup,\"ax\"\n" "101: lea 0(%%eax,%0,4),%0\n" " jmp 100b\n" -@@ -247,46 +253,155 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size) +@@ -201,46 +205,152 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size) } static unsigned long @@ -23107,47 +22788,44 @@ index ef2a6a5..3b28862 100644 + "101: lea 0(%%eax,%0,4),%0\n" + " jmp 100b\n" + ".previous\n" -+ ".section __ex_table,\"a\"\n" -+ " .align 4\n" -+ " .long 1b,100b\n" -+ " .long 2b,100b\n" -+ " .long 3b,100b\n" -+ " .long 4b,100b\n" -+ " .long 5b,100b\n" -+ " .long 6b,100b\n" -+ " .long 7b,100b\n" -+ " .long 8b,100b\n" -+ " .long 9b,100b\n" -+ " .long 10b,100b\n" -+ " .long 11b,100b\n" -+ " .long 12b,100b\n" -+ " .long 13b,100b\n" -+ " .long 14b,100b\n" -+ " .long 15b,100b\n" -+ " .long 16b,100b\n" -+ " .long 17b,100b\n" -+ " .long 18b,100b\n" -+ " .long 19b,100b\n" -+ " .long 20b,100b\n" -+ " .long 21b,100b\n" -+ " .long 22b,100b\n" -+ " .long 23b,100b\n" -+ " .long 24b,100b\n" -+ " .long 25b,100b\n" -+ " .long 26b,100b\n" -+ " .long 27b,100b\n" -+ " .long 28b,100b\n" -+ " .long 29b,100b\n" -+ " .long 30b,100b\n" -+ " .long 31b,100b\n" -+ " .long 32b,100b\n" -+ " .long 33b,100b\n" -+ " .long 34b,100b\n" -+ " .long 35b,100b\n" -+ " .long 36b,100b\n" -+ " .long 37b,100b\n" -+ " .long 99b,101b\n" -+ ".previous" ++ _ASM_EXTABLE(1b,100b) ++ _ASM_EXTABLE(2b,100b) ++ _ASM_EXTABLE(3b,100b) ++ _ASM_EXTABLE(4b,100b) ++ _ASM_EXTABLE(5b,100b) ++ _ASM_EXTABLE(6b,100b) ++ _ASM_EXTABLE(7b,100b) ++ _ASM_EXTABLE(8b,100b) ++ _ASM_EXTABLE(9b,100b) ++ _ASM_EXTABLE(10b,100b) ++ _ASM_EXTABLE(11b,100b) ++ _ASM_EXTABLE(12b,100b) ++ _ASM_EXTABLE(13b,100b) ++ _ASM_EXTABLE(14b,100b) ++ _ASM_EXTABLE(15b,100b) ++ _ASM_EXTABLE(16b,100b) ++ _ASM_EXTABLE(17b,100b) ++ _ASM_EXTABLE(18b,100b) ++ _ASM_EXTABLE(19b,100b) ++ _ASM_EXTABLE(20b,100b) ++ _ASM_EXTABLE(21b,100b) ++ _ASM_EXTABLE(22b,100b) ++ _ASM_EXTABLE(23b,100b) ++ _ASM_EXTABLE(24b,100b) ++ _ASM_EXTABLE(25b,100b) ++ _ASM_EXTABLE(26b,100b) ++ _ASM_EXTABLE(27b,100b) ++ _ASM_EXTABLE(28b,100b) ++ _ASM_EXTABLE(29b,100b) ++ _ASM_EXTABLE(30b,100b) ++ _ASM_EXTABLE(31b,100b) ++ _ASM_EXTABLE(32b,100b) ++ _ASM_EXTABLE(33b,100b) ++ _ASM_EXTABLE(34b,100b) ++ _ASM_EXTABLE(35b,100b) ++ _ASM_EXTABLE(36b,100b) ++ _ASM_EXTABLE(37b,100b) ++ _ASM_EXTABLE(99b,101b) + : "=&c"(size), "=&D" (d0), "=&S" (d1) + : "1"(to), "2"(from), "0"(size) + : "eax", "edx", "memory"); @@ -23218,7 +22896,7 @@ index ef2a6a5..3b28862 100644 " movl %%eax, 56(%3)\n" " movl %%edx, 60(%3)\n" " addl $-64, %0\n" -@@ -298,9 +413,9 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size) +@@ -252,9 +362,9 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size) " shrl $2, %0\n" " andl $3, %%eax\n" " cld\n" @@ -23230,7 +22908,7 @@ index ef2a6a5..3b28862 100644 "8:\n" ".section .fixup,\"ax\"\n" "9: lea 0(%%eax,%0,4),%0\n" -@@ -347,47 +462,49 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size) +@@ -298,47 +408,49 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size) */ static unsigned long __copy_user_zeroing_intel_nocache(void *to, @@ -23298,7 +22976,7 @@ index ef2a6a5..3b28862 100644 " movnti %%eax, 56(%3)\n" " movnti %%edx, 60(%3)\n" " addl $-64, %0\n" -@@ -400,9 +517,9 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to, +@@ -351,9 +463,9 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to, " shrl $2, %0\n" " andl $3, %%eax\n" " cld\n" @@ -23310,7 +22988,7 @@ index ef2a6a5..3b28862 100644 "8:\n" ".section .fixup,\"ax\"\n" "9: lea 0(%%eax,%0,4),%0\n" -@@ -444,47 +561,49 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to, +@@ -392,47 +504,49 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to, } static unsigned long __copy_user_intel_nocache(void *to, @@ -23378,7 +23056,7 @@ index ef2a6a5..3b28862 100644 " movnti %%eax, 56(%3)\n" " movnti %%edx, 60(%3)\n" " addl $-64, %0\n" -@@ -497,9 +616,9 @@ static unsigned long __copy_user_intel_nocache(void *to, +@@ -445,9 +559,9 @@ static unsigned long __copy_user_intel_nocache(void *to, " shrl $2, %0\n" " andl $3, %%eax\n" " cld\n" @@ -23390,7 +23068,7 @@ index ef2a6a5..3b28862 100644 "8:\n" ".section .fixup,\"ax\"\n" "9: lea 0(%%eax,%0,4),%0\n" -@@ -542,32 +661,36 @@ static unsigned long __copy_user_intel_nocache(void *to, +@@ -487,32 +601,36 @@ static unsigned long __copy_user_intel_nocache(void *to, */ unsigned long __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size); @@ -23432,7 +23110,7 @@ index ef2a6a5..3b28862 100644 ".section .fixup,\"ax\"\n" \ "5: addl %3,%0\n" \ " jmp 2b\n" \ -@@ -595,14 +718,14 @@ do { \ +@@ -537,14 +655,14 @@ do { \ " negl %0\n" \ " andl $7,%0\n" \ " subl %0,%3\n" \ @@ -23450,7 +23128,7 @@ index ef2a6a5..3b28862 100644 "2:\n" \ ".section .fixup,\"ax\"\n" \ "5: addl %3,%0\n" \ -@@ -688,9 +811,9 @@ survive: +@@ -627,9 +745,9 @@ survive: } #endif if (movsl_is_ok(to, from, n)) @@ -23462,7 +23140,7 @@ index ef2a6a5..3b28862 100644 return n; } EXPORT_SYMBOL(__copy_to_user_ll); -@@ -710,10 +833,9 @@ unsigned long __copy_from_user_ll_nozero(void *to, const void __user *from, +@@ -649,10 +767,9 @@ unsigned long __copy_from_user_ll_nozero(void *to, const void __user *from, unsigned long n) { if (movsl_is_ok(to, from, n)) @@ -23475,7 +23153,7 @@ index ef2a6a5..3b28862 100644 return n; } EXPORT_SYMBOL(__copy_from_user_ll_nozero); -@@ -740,65 +862,50 @@ unsigned long __copy_from_user_ll_nocache_nozero(void *to, const void __user *fr +@@ -679,65 +796,50 @@ unsigned long __copy_from_user_ll_nocache_nozero(void *to, const void __user *fr if (n > 64 && cpu_has_xmm2) n = __copy_user_intel_nocache(to, from, n); else @@ -23578,7 +23256,7 @@ index ef2a6a5..3b28862 100644 +EXPORT_SYMBOL(set_fs); +#endif diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c -index 0d0326f..6a6155b 100644 +index e5b130b..6690d31 100644 --- a/arch/x86/lib/usercopy_64.c +++ b/arch/x86/lib/usercopy_64.c @@ -16,6 +16,12 @@ unsigned long __clear_user(void __user *addr, unsigned long size) @@ -23594,9 +23272,9 @@ index 0d0326f..6a6155b 100644 /* no memory constraint because it doesn't change any memory gcc knows about */ asm volatile( -@@ -100,12 +106,20 @@ long strlen_user(const char __user *s) +@@ -52,12 +58,20 @@ unsigned long clear_user(void __user *to, unsigned long n) } - EXPORT_SYMBOL(strlen_user); + EXPORT_SYMBOL(clear_user); -unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len) +unsigned long copy_in_user(void __user *to, const void __user *from, unsigned long len) @@ -23620,7 +23298,7 @@ index 0d0326f..6a6155b 100644 } EXPORT_SYMBOL(copy_in_user); -@@ -115,7 +129,7 @@ EXPORT_SYMBOL(copy_in_user); +@@ -67,7 +81,7 @@ EXPORT_SYMBOL(copy_in_user); * it is not necessary to optimize tail handling. */ unsigned long @@ -23629,7 +23307,7 @@ index 0d0326f..6a6155b 100644 { char c; unsigned zero_len; -@@ -132,3 +146,15 @@ copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest) +@@ -84,3 +98,15 @@ copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest) break; return len; } @@ -23646,11 +23324,39 @@ index 0d0326f..6a6155b 100644 +} +EXPORT_SYMBOL(copy_to_user_overflow); diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c -index 1fb85db..8b3540b 100644 +index 903ec1e..833f340 100644 --- a/arch/x86/mm/extable.c +++ b/arch/x86/mm/extable.c -@@ -8,7 +8,7 @@ int fixup_exception(struct pt_regs *regs) - const struct exception_table_entry *fixup; +@@ -6,12 +6,25 @@ + static inline unsigned long + ex_insn_addr(const struct exception_table_entry *x) + { +- return (unsigned long)&x->insn + x->insn; ++//printk(KERN_ERR "fixup %p insn:%x fixup:%x\n", x, x->insn, x->fixup); ++ unsigned long reloc = 0; ++ ++#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32) ++ reloc = ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR; ++#endif ++ ++ return (unsigned long)&x->insn + x->insn + reloc; + } + static inline unsigned long + ex_fixup_addr(const struct exception_table_entry *x) + { +- return (unsigned long)&x->fixup + x->fixup; ++ unsigned long reloc = 0; ++ ++#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32) ++ reloc = ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR; ++#endif ++ ++ return (unsigned long)&x->fixup + x->fixup + reloc; + } + + int fixup_exception(struct pt_regs *regs) +@@ -20,7 +33,7 @@ int fixup_exception(struct pt_regs *regs) + unsigned long new_ip; #ifdef CONFIG_PNPBIOS - if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) { @@ -23658,8 +23364,16 @@ index 1fb85db..8b3540b 100644 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp; extern u32 pnp_bios_is_utter_crap; pnp_bios_is_utter_crap = 1; +@@ -34,6 +47,7 @@ int fixup_exception(struct pt_regs *regs) + #endif + + fixup = search_exception_tables(regs->ip); ++//printk(KERN_ERR "fixup %p %lx\n", fixup, regs->ip); + if (fixup) { + new_ip = ex_fixup_addr(fixup); + diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c -index 3ecfd1a..304d554 100644 +index 76dcd9d..e9dffde 100644 --- a/arch/x86/mm/fault.c +++ b/arch/x86/mm/fault.c @@ -13,11 +13,18 @@ @@ -23843,8 +23557,8 @@ index 3ecfd1a..304d554 100644 pte_t *pte = lookup_address(address, &level); if (pte && pte_present(*pte) && !pte_exec(*pte)) -- printk(nx_warning, current_uid()); -+ printk(nx_warning, current_uid(), current->comm, task_pid_nr(current)); +- printk(nx_warning, from_kuid(&init_user_ns, current_uid())); ++ printk(nx_warning, from_kuid(&init_user_ns, current_uid()), current->comm, task_pid_nr(current)); } +#ifdef CONFIG_PAX_KERNEXEC @@ -24616,7 +24330,7 @@ index f6679a7..8f795a3 100644 } if (mm->get_unmapped_area == arch_get_unmapped_area) diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c -index 4f0cec7..00976ce 100644 +index bc4e9d8..ca4c14b 100644 --- a/arch/x86/mm/init.c +++ b/arch/x86/mm/init.c @@ -16,6 +16,8 @@ @@ -24628,16 +24342,16 @@ index 4f0cec7..00976ce 100644 unsigned long __initdata pgt_buf_start; unsigned long __meminitdata pgt_buf_end; -@@ -32,7 +34,7 @@ int direct_gbpages - static void __init find_early_table_space(unsigned long end, int use_pse, - int use_gbpages) +@@ -38,7 +40,7 @@ struct map_range { + static void __init find_early_table_space(struct map_range *mr, unsigned long end, + int use_pse, int use_gbpages) { - unsigned long puds, pmds, ptes, tables, start = 0, good_end = end; + unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end; phys_addr_t base; puds = (end + PUD_SIZE - 1) >> PUD_SHIFT; -@@ -311,10 +313,37 @@ unsigned long __init_refok init_memory_mapping(unsigned long start, +@@ -317,10 +319,37 @@ unsigned long __init_refok init_memory_mapping(unsigned long start, * Access has to be given to non-kernel-ram areas as well, these contain the PCI * mmio resources as well as potential bios/acpi data regions. */ @@ -24676,7 +24390,7 @@ index 4f0cec7..00976ce 100644 if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) return 0; if (!page_is_ram(pagenr)) -@@ -371,8 +400,116 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end) +@@ -377,8 +406,116 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end) #endif } @@ -25072,7 +24786,7 @@ index 575d86f..4987469 100644 printk(KERN_INFO "Write protecting the kernel text: %luk\n", size >> 10); diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c -index fc18be0..e539653 100644 +index 2b6b4a3..c17210d 100644 --- a/arch/x86/mm/init_64.c +++ b/arch/x86/mm/init_64.c @@ -74,7 +74,7 @@ early_param("gbpages", parse_direct_gbpages_on); @@ -25189,7 +24903,7 @@ index fc18be0..e539653 100644 adr = (void *)(((unsigned long)adr) | left); return adr; -@@ -545,7 +559,7 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end, +@@ -548,7 +562,7 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end, unmap_low_page(pmd); spin_lock(&init_mm.page_table_lock); @@ -25198,7 +24912,7 @@ index fc18be0..e539653 100644 spin_unlock(&init_mm.page_table_lock); } __flush_tlb_all(); -@@ -591,7 +605,7 @@ kernel_physical_mapping_init(unsigned long start, +@@ -594,7 +608,7 @@ kernel_physical_mapping_init(unsigned long start, unmap_low_page(pud); spin_lock(&init_mm.page_table_lock); @@ -25207,7 +24921,7 @@ index fc18be0..e539653 100644 spin_unlock(&init_mm.page_table_lock); pgd_changed = true; } -@@ -683,6 +697,12 @@ void __init mem_init(void) +@@ -686,6 +700,12 @@ void __init mem_init(void) pci_iommu_alloc(); @@ -25220,7 +24934,7 @@ index fc18be0..e539653 100644 /* clear_bss() already clear the empty_zero_page */ reservedpages = 0; -@@ -843,8 +863,8 @@ int kern_addr_valid(unsigned long addr) +@@ -846,8 +866,8 @@ int kern_addr_valid(unsigned long addr) static struct vm_area_struct gate_vma = { .vm_start = VSYSCALL_START, .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE), @@ -25231,7 +24945,7 @@ index fc18be0..e539653 100644 }; struct vm_area_struct *get_gate_vma(struct mm_struct *mm) -@@ -878,7 +898,7 @@ int in_gate_area_no_mm(unsigned long addr) +@@ -881,7 +901,7 @@ int in_gate_area_no_mm(unsigned long addr) const char *arch_vma_name(struct vm_area_struct *vma) { @@ -25257,7 +24971,7 @@ index 7b179b4..6bd1777 100644 return (void *)vaddr; diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c -index be1ef57..55f0160 100644 +index 78fe3f1..8293b6f 100644 --- a/arch/x86/mm/ioremap.c +++ b/arch/x86/mm/ioremap.c @@ -97,7 +97,7 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr, @@ -25444,7 +25158,7 @@ index b008656..773eac2 100644 struct split_state { diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c -index e1ebde3..b1e1db38 100644 +index a718e0d..45efc32 100644 --- a/arch/x86/mm/pageattr.c +++ b/arch/x86/mm/pageattr.c @@ -261,7 +261,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address, @@ -25532,56 +25246,56 @@ index e1ebde3..b1e1db38 100644 static int diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c -index f6ff57b..481690f 100644 +index 3d68ef6..7f69136 100644 --- a/arch/x86/mm/pat.c +++ b/arch/x86/mm/pat.c -@@ -361,7 +361,7 @@ int free_memtype(u64 start, u64 end) +@@ -376,7 +376,7 @@ int free_memtype(u64 start, u64 end) if (!entry) { - printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n", -- current->comm, current->pid, start, end); -+ current->comm, task_pid_nr(current), start, end); + printk(KERN_INFO "%s:%d freeing invalid memtype [mem %#010Lx-%#010Lx]\n", +- current->comm, current->pid, start, end - 1); ++ current->comm, task_pid_nr(current), start, end - 1); return -EINVAL; } -@@ -492,8 +492,8 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size) +@@ -506,8 +506,8 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size) + while (cursor < to) { if (!devmem_is_allowed(pfn)) { - printk(KERN_INFO -- "Program %s tried to access /dev/mem between %Lx->%Lx.\n", -- current->comm, from, to); -+ "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n", -+ current->comm, from, to, cursor); +- printk(KERN_INFO "Program %s tried to access /dev/mem between [mem %#010Lx-%#010Lx]\n", +- current->comm, from, to - 1); ++ printk(KERN_INFO "Program %s tried to access /dev/mem between [mem %#010Lx-%#010Lx] (%#010Lx)\n", ++ current->comm, from, to - 1, cursor); return 0; } cursor += PAGE_SIZE; -@@ -557,7 +557,7 @@ int kernel_map_sync_memtype(u64 base, unsigned long size, unsigned long flags) - printk(KERN_INFO - "%s:%d ioremap_change_attr failed %s " - "for %Lx-%Lx\n", +@@ -570,7 +570,7 @@ int kernel_map_sync_memtype(u64 base, unsigned long size, unsigned long flags) + if (ioremap_change_attr((unsigned long)__va(base), id_sz, flags) < 0) { + printk(KERN_INFO "%s:%d ioremap_change_attr failed %s " + "for [mem %#010Lx-%#010Lx]\n", - current->comm, current->pid, + current->comm, task_pid_nr(current), cattr_name(flags), - base, (unsigned long long)(base + size)); + base, (unsigned long long)(base + size-1)); return -EINVAL; -@@ -593,7 +593,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot, +@@ -605,7 +605,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot, + flags = lookup_memtype(paddr); if (want_flags != flags) { - printk(KERN_WARNING - "%s:%d map pfn RAM range req %s for %Lx-%Lx, got %s\n", + printk(KERN_WARNING "%s:%d map pfn RAM range req %s for [mem %#010Lx-%#010Lx], got %s\n", - current->comm, current->pid, + current->comm, task_pid_nr(current), cattr_name(want_flags), (unsigned long long)paddr, - (unsigned long long)(paddr + size), -@@ -615,7 +615,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot, + (unsigned long long)(paddr + size - 1), +@@ -627,7 +627,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot, free_memtype(paddr, paddr + size); printk(KERN_ERR "%s:%d map pfn expected mapping type %s" - " for %Lx-%Lx, got %s\n", + " for [mem %#010Lx-%#010Lx], got %s\n", - current->comm, current->pid, + current->comm, task_pid_nr(current), cattr_name(want_flags), (unsigned long long)paddr, - (unsigned long long)(paddr + size), + (unsigned long long)(paddr + size - 1), diff --git a/arch/x86/mm/pf_in.c b/arch/x86/mm/pf_in.c index 9f0614d..92ae64a 100644 --- a/arch/x86/mm/pf_in.c @@ -25944,21 +25658,21 @@ index 410531d..0f16030 100644 } diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c -index d6c0418..06a0ad5 100644 +index 5e57e11..64874249 100644 --- a/arch/x86/mm/tlb.c +++ b/arch/x86/mm/tlb.c -@@ -65,7 +65,11 @@ void leave_mm(int cpu) +@@ -66,7 +66,11 @@ void leave_mm(int cpu) BUG(); - cpumask_clear_cpu(cpu, - mm_cpumask(percpu_read(cpu_tlbstate.active_mm))); + if (cpumask_test_cpu(cpu, mm_cpumask(active_mm))) { + cpumask_clear_cpu(cpu, mm_cpumask(active_mm)); + +#ifndef CONFIG_PAX_PER_CPU_PGD - load_cr3(swapper_pg_dir); + load_cr3(swapper_pg_dir); +#endif + + } } EXPORT_SYMBOL_GPL(leave_mm); - diff --git a/arch/x86/net/bpf_jit.S b/arch/x86/net/bpf_jit.S index 877b9a1..a8ecf42 100644 --- a/arch/x86/net/bpf_jit.S @@ -26574,7 +26288,7 @@ index 40e4469..1ab536e 100644 gdt_descr.size = GDT_SIZE - 1; load_gdt(&gdt_descr); diff --git a/arch/x86/platform/efi/efi_stub_32.S b/arch/x86/platform/efi/efi_stub_32.S -index fbe66e6..c5c0dd2 100644 +index fbe66e6..eae5e38 100644 --- a/arch/x86/platform/efi/efi_stub_32.S +++ b/arch/x86/platform/efi/efi_stub_32.S @@ -6,7 +6,9 @@ @@ -26596,22 +26310,35 @@ index fbe66e6..c5c0dd2 100644 ENTRY(efi_call_phys) /* * 0. The function can only be called in Linux kernel. So CS has been -@@ -36,9 +38,11 @@ ENTRY(efi_call_phys) +@@ -36,10 +38,24 @@ ENTRY(efi_call_phys) * The mapping of lower virtual memory has been created in prelog and * epilog. */ - movl $1f, %edx - subl $__PAGE_OFFSET, %edx - jmp *%edx ++#ifdef CONFIG_PAX_KERNEXEC + movl $(__KERNEXEC_EFI_DS), %edx + mov %edx, %ds + mov %edx, %es + mov %edx, %ss -+ ljmp $(__KERNEXEC_EFI_CS),$1f-__PAGE_OFFSET ++ addl $2f,(1f) ++ ljmp *(1f) ++ ++__INITDATA ++1: .long __LOAD_PHYSICAL_ADDR, __KERNEXEC_EFI_CS ++.previous ++ ++2: ++ subl $2b,(1b) ++#else ++ jmp 1f-__PAGE_OFFSET 1: ++#endif /* -@@ -47,14 +51,8 @@ ENTRY(efi_call_phys) + * 2. Now on the top of stack is the return +@@ -47,14 +63,8 @@ ENTRY(efi_call_phys) * parameter 2, ..., param n. To make things easy, we save the return * address of efi_call_phys in a global variable. */ @@ -26628,7 +26355,7 @@ index fbe66e6..c5c0dd2 100644 /* * 3. Clear PG bit in %CR0. -@@ -73,9 +71,8 @@ ENTRY(efi_call_phys) +@@ -73,9 +83,8 @@ ENTRY(efi_call_phys) /* * 5. Call the physical function. */ @@ -26639,7 +26366,7 @@ index fbe66e6..c5c0dd2 100644 /* * 6. After EFI runtime service returns, control will return to * following instruction. We'd better readjust stack pointer first. -@@ -88,35 +85,32 @@ ENTRY(efi_call_phys) +@@ -88,35 +97,36 @@ ENTRY(efi_call_phys) movl %cr0, %edx orl $0x80000000, %edx movl %edx, %cr0 @@ -26652,12 +26379,16 @@ index fbe66e6..c5c0dd2 100644 */ - movl $1f, %edx - jmp *%edx -+ ljmp $(__KERNEL_CS),$1f+__PAGE_OFFSET - 1: ++#ifdef CONFIG_PAX_KERNEXEC + movl $(__KERNEL_DS), %edx + mov %edx, %ds + mov %edx, %es + mov %edx, %ss ++ ljmp $(__KERNEL_CS),$1f ++#else ++ jmp 1f+__PAGE_OFFSET ++#endif + 1: /* * 9. Balance the stack. And because EAX contain the return value, @@ -26753,7 +26484,7 @@ index 4c07cca..2c8427d 100644 ret ENDPROC(efi_call6) diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c -index e31bcd8..f12dc46 100644 +index fd41a92..9c33628 100644 --- a/arch/x86/platform/mrst/mrst.c +++ b/arch/x86/platform/mrst/mrst.c @@ -78,13 +78,15 @@ struct sfi_rtc_table_entry sfi_mrtc_array[SFI_MRTC_MAX]; @@ -26797,8 +26528,97 @@ index 218cdb1..fd55c08 100644 syscall_init(); /* This sets MSR_*STAR and related */ #endif +diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c +index cbca565..35ce1d7 100644 +--- a/arch/x86/realmode/init.c ++++ b/arch/x86/realmode/init.c +@@ -62,7 +62,13 @@ void __init setup_real_mode(void) + __va(real_mode_header->trampoline_header); + + #ifdef CONFIG_X86_32 +- trampoline_header->start = __pa(startup_32_smp); ++ trampoline_header->start = __pa(ktla_ktva(startup_32_smp)); ++ ++#ifdef CONFIG_PAX_KERNEXEC ++ trampoline_header->start -= LOAD_PHYSICAL_ADDR; ++#endif ++ ++ trampoline_header->boot_cs = __BOOT_CS; + trampoline_header->gdt_limit = __BOOT_DS + 7; + trampoline_header->gdt_base = __pa(boot_gdt); + #else +diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile +index 5b84a2d..a004393 100644 +--- a/arch/x86/realmode/rm/Makefile ++++ b/arch/x86/realmode/rm/Makefile +@@ -78,5 +78,8 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -m32 -g -Os -D_SETUP -D__KERNEL__ -D_WAKEUP \ + $(call cc-option, -fno-unit-at-a-time)) \ + $(call cc-option, -fno-stack-protector) \ + $(call cc-option, -mpreferred-stack-boundary=2) ++ifdef CONSTIFY_PLUGIN ++KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify ++endif + KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__ + GCOV_PROFILE := n +diff --git a/arch/x86/realmode/rm/trampoline_32.S b/arch/x86/realmode/rm/trampoline_32.S +index c1b2791..f9e31c7 100644 +--- a/arch/x86/realmode/rm/trampoline_32.S ++++ b/arch/x86/realmode/rm/trampoline_32.S +@@ -25,6 +25,12 @@ + #include <asm/page_types.h> + #include "realmode.h" + ++#ifdef CONFIG_PAX_KERNEXEC ++#define ta(X) (X) ++#else ++#define ta(X) (pa_ ## X) ++#endif ++ + .text + .code16 + +@@ -39,8 +45,6 @@ ENTRY(trampoline_start) + + cli # We should be safe anyway + +- movl tr_start, %eax # where we need to go +- + movl $0xA5A5A5A5, trampoline_status + # write marker for master knows we're running + +@@ -56,7 +60,7 @@ ENTRY(trampoline_start) + movw $1, %dx # protected mode (PE) bit + lmsw %dx # into protected mode + +- ljmpl $__BOOT_CS, $pa_startup_32 ++ ljmpl *(trampoline_header) + + .section ".text32","ax" + .code32 +@@ -67,7 +71,7 @@ ENTRY(startup_32) # note: also used from wakeup_asm.S + .balign 8 + GLOBAL(trampoline_header) + tr_start: .space 4 +- tr_gdt_pad: .space 2 ++ tr_boot_cs: .space 2 + tr_gdt: .space 6 + END(trampoline_header) + +diff --git a/arch/x86/realmode/rm/trampoline_64.S b/arch/x86/realmode/rm/trampoline_64.S +index bb360dc..3e5945f 100644 +--- a/arch/x86/realmode/rm/trampoline_64.S ++++ b/arch/x86/realmode/rm/trampoline_64.S +@@ -107,7 +107,7 @@ ENTRY(startup_32) + wrmsr + + # Enable paging and in turn activate Long Mode +- movl $(X86_CR0_PG | X86_CR0_WP | X86_CR0_PE), %eax ++ movl $(X86_CR0_PG | X86_CR0_PE), %eax + movl %eax, %cr0 + + /* diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c -index b685296..4ac6aaa 100644 +index 5a1847d..deccb30 100644 --- a/arch/x86/tools/relocs.c +++ b/arch/x86/tools/relocs.c @@ -12,10 +12,13 @@ @@ -26815,7 +26635,7 @@ index b685296..4ac6aaa 100644 static unsigned long reloc_count, reloc_idx; static unsigned long *relocs; static unsigned long reloc16_count, reloc16_idx; -@@ -323,9 +326,39 @@ static void read_ehdr(FILE *fp) +@@ -330,9 +333,39 @@ static void read_ehdr(FILE *fp) } } @@ -26856,7 +26676,7 @@ index b685296..4ac6aaa 100644 Elf32_Shdr shdr; secs = calloc(ehdr.e_shnum, sizeof(struct section)); -@@ -360,7 +393,7 @@ static void read_shdrs(FILE *fp) +@@ -367,7 +400,7 @@ static void read_shdrs(FILE *fp) static void read_strtabs(FILE *fp) { @@ -26865,7 +26685,7 @@ index b685296..4ac6aaa 100644 for (i = 0; i < ehdr.e_shnum; i++) { struct section *sec = &secs[i]; if (sec->shdr.sh_type != SHT_STRTAB) { -@@ -385,7 +418,7 @@ static void read_strtabs(FILE *fp) +@@ -392,7 +425,7 @@ static void read_strtabs(FILE *fp) static void read_symtabs(FILE *fp) { @@ -26874,9 +26694,12 @@ index b685296..4ac6aaa 100644 for (i = 0; i < ehdr.e_shnum; i++) { struct section *sec = &secs[i]; if (sec->shdr.sh_type != SHT_SYMTAB) { -@@ -418,7 +451,9 @@ static void read_symtabs(FILE *fp) +@@ -423,9 +456,11 @@ static void read_symtabs(FILE *fp) + } + - static void read_relocs(FILE *fp) +-static void read_relocs(FILE *fp) ++static void read_relocs(FILE *fp, int use_real_mode) { - int i,j; + unsigned int i,j; @@ -26885,14 +26708,14 @@ index b685296..4ac6aaa 100644 for (i = 0; i < ehdr.e_shnum; i++) { struct section *sec = &secs[i]; if (sec->shdr.sh_type != SHT_REL) { -@@ -438,9 +473,22 @@ static void read_relocs(FILE *fp) +@@ -445,9 +480,22 @@ static void read_relocs(FILE *fp) die("Cannot read symbol table: %s\n", strerror(errno)); } + base = 0; + +#ifdef CONFIG_X86_32 -+ for (j = 0; j < ehdr.e_phnum; j++) { ++ for (j = 0; !use_real_mode && j < ehdr.e_phnum; j++) { + if (phdr[j].p_type != PT_LOAD ) + continue; + if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz) @@ -26909,7 +26732,7 @@ index b685296..4ac6aaa 100644 rel->r_info = elf32_to_cpu(rel->r_info); } } -@@ -449,13 +497,13 @@ static void read_relocs(FILE *fp) +@@ -456,13 +504,13 @@ static void read_relocs(FILE *fp) static void print_absolute_symbols(void) { @@ -26925,7 +26748,7 @@ index b685296..4ac6aaa 100644 if (sec->shdr.sh_type != SHT_SYMTAB) { continue; -@@ -482,14 +530,14 @@ static void print_absolute_symbols(void) +@@ -489,14 +537,14 @@ static void print_absolute_symbols(void) static void print_absolute_relocs(void) { @@ -26942,7 +26765,7 @@ index b685296..4ac6aaa 100644 if (sec->shdr.sh_type != SHT_REL) { continue; } -@@ -551,13 +599,13 @@ static void print_absolute_relocs(void) +@@ -558,13 +606,13 @@ static void print_absolute_relocs(void) static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym), int use_real_mode) { @@ -26958,30 +26781,32 @@ index b685296..4ac6aaa 100644 struct section *sec = &secs[i]; if (sec->shdr.sh_type != SHT_REL) { -@@ -581,6 +629,22 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym), +@@ -588,6 +636,24 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym), sym = &sh_symtab[ELF32_R_SYM(rel->r_info)]; r_type = ELF32_R_TYPE(rel->r_info); -+ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */ -+ if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load")) -+ continue; ++ if (!use_real_mode) { ++ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */ ++ if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load")) ++ continue; + +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32) -+ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */ -+ if (!strcmp(sec_name(sym->st_shndx), ".text.end") && !strcmp(sym_name(sym_strtab, sym), "_etext")) -+ continue; -+ if (!strcmp(sec_name(sym->st_shndx), ".init.text")) -+ continue; -+ if (!strcmp(sec_name(sym->st_shndx), ".exit.text")) -+ continue; -+ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR")) -+ continue; ++ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */ ++ if (!strcmp(sec_name(sym->st_shndx), ".text.end") && !strcmp(sym_name(sym_strtab, sym), "_etext")) ++ continue; ++ if (!strcmp(sec_name(sym->st_shndx), ".init.text")) ++ continue; ++ if (!strcmp(sec_name(sym->st_shndx), ".exit.text")) ++ continue; ++ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR")) ++ continue; +#endif ++ } + shn_abs = sym->st_shndx == SHN_ABS; switch (r_type) { -@@ -674,7 +738,7 @@ static int write32(unsigned int v, FILE *f) +@@ -681,7 +747,7 @@ static int write32(unsigned int v, FILE *f) static void emit_relocs(int as_text, int use_real_mode) { @@ -26990,7 +26815,7 @@ index b685296..4ac6aaa 100644 /* Count how many relocations I have and allocate space for them. */ reloc_count = 0; walk_relocs(count_reloc, use_real_mode); -@@ -801,6 +865,7 @@ int main(int argc, char **argv) +@@ -808,10 +874,11 @@ int main(int argc, char **argv) fname, strerror(errno)); } read_ehdr(fp); @@ -26998,6 +26823,11 @@ index b685296..4ac6aaa 100644 read_shdrs(fp); read_strtabs(fp); read_symtabs(fp); +- read_relocs(fp); ++ read_relocs(fp, use_real_mode); + if (show_absolute_syms) { + print_absolute_symbols(); + return 0; diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile index fd14be1..e3c79c0 100644 --- a/arch/x86/vdso/Makefile @@ -27171,10 +27001,10 @@ index 00aaf04..4a26505 100644 -} -__setup("vdso=", vdso_setup); diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index 40edfc3..b4d80ac 100644 +index ff962d4..2bb5e83 100644 --- a/arch/x86/xen/enlighten.c +++ b/arch/x86/xen/enlighten.c -@@ -95,8 +95,6 @@ EXPORT_SYMBOL_GPL(xen_start_info); +@@ -97,8 +97,6 @@ EXPORT_SYMBOL_GPL(xen_start_info); struct shared_info xen_dummy_shared_info; @@ -27183,7 +27013,7 @@ index 40edfc3..b4d80ac 100644 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE); __read_mostly int xen_have_vector_callback; EXPORT_SYMBOL_GPL(xen_have_vector_callback); -@@ -1165,30 +1163,30 @@ static const struct pv_apic_ops xen_apic_ops __initconst = { +@@ -1175,30 +1173,30 @@ static const struct pv_apic_ops xen_apic_ops __initconst = { #endif }; @@ -27221,7 +27051,7 @@ index 40edfc3..b4d80ac 100644 { if (pm_power_off) pm_power_off(); -@@ -1291,7 +1289,17 @@ asmlinkage void __init xen_start_kernel(void) +@@ -1301,7 +1299,17 @@ asmlinkage void __init xen_start_kernel(void) __userpte_alloc_gfp &= ~__GFP_HIGHMEM; /* Work out if we support NX */ @@ -27240,7 +27070,7 @@ index 40edfc3..b4d80ac 100644 xen_setup_features(); -@@ -1322,13 +1330,6 @@ asmlinkage void __init xen_start_kernel(void) +@@ -1332,13 +1340,6 @@ asmlinkage void __init xen_start_kernel(void) machine_ops = xen_machine_ops; @@ -27255,7 +27085,7 @@ index 40edfc3..b4d80ac 100644 #ifdef CONFIG_ACPI_NUMA diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c -index 69f5857..0699dc5 100644 +index 3a73785..0d30df2 100644 --- a/arch/x86/xen/mmu.c +++ b/arch/x86/xen/mmu.c @@ -1738,6 +1738,9 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd, @@ -27280,7 +27110,7 @@ index 69f5857..0699dc5 100644 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO); set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO); -@@ -1964,6 +1971,7 @@ static void __init xen_post_allocator_init(void) +@@ -1940,6 +1947,7 @@ static void __init xen_post_allocator_init(void) pv_mmu_ops.set_pud = xen_set_pud; #if PAGETABLE_LEVELS == 4 pv_mmu_ops.set_pgd = xen_set_pgd; @@ -27288,7 +27118,7 @@ index 69f5857..0699dc5 100644 #endif /* This will work as long as patching hasn't happened yet -@@ -2045,6 +2053,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = { +@@ -2021,6 +2029,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = { .pud_val = PV_CALLEE_SAVE(xen_pud_val), .make_pud = PV_CALLEE_SAVE(xen_make_pud), .set_pgd = xen_set_pgd_hyper, @@ -27297,10 +27127,10 @@ index 69f5857..0699dc5 100644 .alloc_pud = xen_alloc_pmd_init, .release_pud = xen_release_pmd_init, diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c -index 0503c0c..ceb2d16 100644 +index afb250d..627075f 100644 --- a/arch/x86/xen/smp.c +++ b/arch/x86/xen/smp.c -@@ -215,11 +215,6 @@ static void __init xen_smp_prepare_boot_cpu(void) +@@ -231,11 +231,6 @@ static void __init xen_smp_prepare_boot_cpu(void) { BUG_ON(smp_processor_id() != 0); native_smp_prepare_boot_cpu(); @@ -27312,7 +27142,7 @@ index 0503c0c..ceb2d16 100644 xen_filter_cpu_maps(); xen_setup_vcpu_info_placement(); } -@@ -296,12 +291,12 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle) +@@ -302,12 +297,12 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle) gdt = get_cpu_gdt_table(cpu); ctxt->flags = VGCF_IN_KERNEL; @@ -27328,7 +27158,7 @@ index 0503c0c..ceb2d16 100644 #else ctxt->gs_base_kernel = per_cpu_offset(cpu); #endif -@@ -352,13 +347,12 @@ static int __cpuinit xen_cpu_up(unsigned int cpu) +@@ -357,13 +352,12 @@ static int __cpuinit xen_cpu_up(unsigned int cpu, struct task_struct *idle) int rc; per_cpu(current_task, cpu) = idle; @@ -27345,10 +27175,10 @@ index 0503c0c..ceb2d16 100644 xen_setup_runstate_info(cpu); xen_setup_timer(cpu); diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S -index b040b0e..8cc4fe0 100644 +index f9643fc..602e8af 100644 --- a/arch/x86/xen/xen-asm_32.S +++ b/arch/x86/xen/xen-asm_32.S -@@ -83,14 +83,14 @@ ENTRY(xen_iret) +@@ -84,14 +84,14 @@ ENTRY(xen_iret) ESP_OFFSET=4 # bytes pushed onto stack /* @@ -27392,7 +27222,7 @@ index aaa7291..3f77960 100644 mov %rsi,xen_start_info mov $init_thread_union+THREAD_SIZE,%rsp diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h -index b095739..8c17bcd 100644 +index 202d4c1..99b072a 100644 --- a/arch/x86/xen/xen-ops.h +++ b/arch/x86/xen/xen-ops.h @@ -10,8 +10,6 @@ @@ -27574,7 +27404,7 @@ index 6296b40..417c00f 100644 (u8 *) pte, count) < count) { diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c -index 260fa80..e8f3caf 100644 +index 9a87daa..fb17486 100644 --- a/block/scsi_ioctl.c +++ b/block/scsi_ioctl.c @@ -223,8 +223,20 @@ EXPORT_SYMBOL(blk_verify_command); @@ -27776,10 +27606,10 @@ index 0734086..3ad3e4c 100644 /* * Buggy BIOS check diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index d31ee55..8363a8b 100644 +index cece3a4..0845256 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c -@@ -4742,7 +4742,7 @@ void ata_qc_free(struct ata_queued_cmd *qc) +@@ -4743,7 +4743,7 @@ void ata_qc_free(struct ata_queued_cmd *qc) struct ata_port *ap; unsigned int tag; @@ -27788,7 +27618,7 @@ index d31ee55..8363a8b 100644 ap = qc->ap; qc->flags = 0; -@@ -4758,7 +4758,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc) +@@ -4759,7 +4759,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc) struct ata_port *ap; struct ata_link *link; @@ -27797,7 +27627,7 @@ index d31ee55..8363a8b 100644 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE)); ap = qc->ap; link = qc->dev->link; -@@ -5822,6 +5822,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops) +@@ -5823,6 +5823,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops) return; spin_lock(&lock); @@ -27805,7 +27635,7 @@ index d31ee55..8363a8b 100644 for (cur = ops->inherits; cur; cur = cur->inherits) { void **inherit = (void **)cur; -@@ -5835,8 +5836,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops) +@@ -5836,8 +5837,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops) if (IS_ERR(*pp)) *pp = NULL; @@ -27817,7 +27647,7 @@ index d31ee55..8363a8b 100644 } diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c -index 3239517..343b5f6 100644 +index ac6a5be..c7176b1 100644 --- a/drivers/ata/pata_arasan_cf.c +++ b/drivers/ata/pata_arasan_cf.c @@ -862,7 +862,9 @@ static int __devinit arasan_cf_probe(struct platform_device *pdev) @@ -27845,7 +27675,7 @@ index f9b983a..887b9d8 100644 return 0; } diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c -index f8f41e0..1f987dd 100644 +index 89b30f3..7964211 100644 --- a/drivers/atm/ambassador.c +++ b/drivers/atm/ambassador.c @@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev, tx_out * tx) { @@ -28178,7 +28008,7 @@ index b182c2f..1c6fa8a 100644 return 0; } diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c -index 75fd691..2d20b14 100644 +index 7d01c2a..4e3ac01 100644 --- a/drivers/atm/horizon.c +++ b/drivers/atm/horizon.c @@ -1034,7 +1034,7 @@ static void rx_schedule (hrz_dev * dev, int irq) { @@ -28200,7 +28030,7 @@ index 75fd691..2d20b14 100644 // free the skb hrz_kfree_skb (skb); diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c -index 1c05212..c28e200 100644 +index 8974bd2..b856f85 100644 --- a/drivers/atm/idt77252.c +++ b/drivers/atm/idt77252.c @@ -812,7 +812,7 @@ drain_scq(struct idt77252_dev *card, struct vc_map *vc) @@ -28837,7 +28667,7 @@ index abe4e20..83c4727 100644 } diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c -index 8493536..31adee0 100644 +index 765c3a2..771ace6 100644 --- a/drivers/base/devtmpfs.c +++ b/drivers/base/devtmpfs.c @@ -368,7 +368,7 @@ int devtmpfs_mount(const char *mntdir) @@ -28849,30 +28679,11 @@ index 8493536..31adee0 100644 if (err) printk(KERN_INFO "devtmpfs: error mounting %i\n", err); else -diff --git a/drivers/base/node.c b/drivers/base/node.c -index 90aa2a1..af1a177 100644 ---- a/drivers/base/node.c -+++ b/drivers/base/node.c -@@ -592,11 +592,9 @@ static ssize_t print_nodes_state(enum node_states state, char *buf) - { - int n; - -- n = nodelist_scnprintf(buf, PAGE_SIZE, node_states[state]); -- if (n > 0 && PAGE_SIZE > n + 1) { -- *(buf + n++) = '\n'; -- *(buf + n++) = '\0'; -- } -+ n = nodelist_scnprintf(buf, PAGE_SIZE-2, node_states[state]); -+ buf[n++] = '\n'; -+ buf[n] = '\0'; - return n; - } - diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c -index 2a3e581..3d6a73f 100644 +index cbb463b..babe2cf 100644 --- a/drivers/base/power/wakeup.c +++ b/drivers/base/power/wakeup.c -@@ -30,14 +30,14 @@ bool events_check_enabled; +@@ -29,14 +29,14 @@ bool events_check_enabled __read_mostly; * They need to be modified together atomically, so it's better to use one * atomic variable to hold them both. */ @@ -28889,24 +28700,24 @@ index 2a3e581..3d6a73f 100644 *cnt = (comb >> IN_PROGRESS_BITS); *inpr = comb & MAX_IN_PROGRESS; -@@ -379,7 +379,7 @@ static void wakeup_source_activate(struct wakeup_source *ws) - ws->last_time = ktime_get(); +@@ -385,7 +385,7 @@ static void wakeup_source_activate(struct wakeup_source *ws) + ws->start_prevent_time = ws->last_time; /* Increment the counter of events in progress. */ -- atomic_inc(&combined_event_count); -+ atomic_inc_unchecked(&combined_event_count); - } +- cec = atomic_inc_return(&combined_event_count); ++ cec = atomic_inc_return_unchecked(&combined_event_count); - /** -@@ -475,7 +475,7 @@ static void wakeup_source_deactivate(struct wakeup_source *ws) + trace_wakeup_source_activate(ws->name, cec); + } +@@ -511,7 +511,7 @@ static void wakeup_source_deactivate(struct wakeup_source *ws) * Increment the counter of registered wakeup events and decrement the * couter of wakeup events in progress simultaneously. */ -- atomic_add(MAX_IN_PROGRESS, &combined_event_count); -+ atomic_add_unchecked(MAX_IN_PROGRESS, &combined_event_count); - } +- cec = atomic_add_return(MAX_IN_PROGRESS, &combined_event_count); ++ cec = atomic_add_return_unchecked(MAX_IN_PROGRESS, &combined_event_count); + trace_wakeup_source_deactivate(ws->name, cec); - /** + split_counters(&cnt, &inpr); diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c index b0f553b..77b928b 100644 --- a/drivers/block/cciss.c @@ -29181,10 +28992,10 @@ index be73e9d..7fbf140 100644 cmdlist_t *reqQ; cmdlist_t *cmpQ; diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h -index 8d68056..e67050f 100644 +index 02f013a..afeba24 100644 --- a/drivers/block/drbd/drbd_int.h +++ b/drivers/block/drbd/drbd_int.h -@@ -736,7 +736,7 @@ struct drbd_request; +@@ -735,7 +735,7 @@ struct drbd_request; struct drbd_epoch { struct list_head list; unsigned int barrier_nr; @@ -29193,7 +29004,7 @@ index 8d68056..e67050f 100644 atomic_t active; /* increased on every req. added, and dec on every finished. */ unsigned long flags; }; -@@ -1108,7 +1108,7 @@ struct drbd_conf { +@@ -1110,7 +1110,7 @@ struct drbd_conf { void *int_dig_in; void *int_dig_vv; wait_queue_head_t seq_wait; @@ -29202,7 +29013,7 @@ index 8d68056..e67050f 100644 unsigned int peer_seq; spinlock_t peer_seq_lock; unsigned int minor; -@@ -1617,30 +1617,30 @@ static inline int drbd_setsockopt(struct socket *sock, int level, int optname, +@@ -1651,30 +1651,30 @@ static inline int drbd_setsockopt(struct socket *sock, int level, int optname, static inline void drbd_tcp_cork(struct socket *sock) { @@ -29242,10 +29053,10 @@ index 8d68056..e67050f 100644 void drbd_bump_write_ordering(struct drbd_conf *mdev, enum write_ordering_e wo); diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c -index 211fc44..c5116f1 100644 +index 920ede2..cb827ba 100644 --- a/drivers/block/drbd/drbd_main.c +++ b/drivers/block/drbd/drbd_main.c -@@ -2397,7 +2397,7 @@ static int _drbd_send_ack(struct drbd_conf *mdev, enum drbd_packets cmd, +@@ -2555,7 +2555,7 @@ static int _drbd_send_ack(struct drbd_conf *mdev, enum drbd_packets cmd, p.sector = sector; p.block_id = block_id; p.blksize = blksize; @@ -29254,16 +29065,16 @@ index 211fc44..c5116f1 100644 if (!mdev->meta.socket || mdev->state.conn < C_CONNECTED) return false; -@@ -2696,7 +2696,7 @@ int drbd_send_dblock(struct drbd_conf *mdev, struct drbd_request *req) +@@ -2853,7 +2853,7 @@ int drbd_send_dblock(struct drbd_conf *mdev, struct drbd_request *req) + p.sector = cpu_to_be64(req->sector); p.block_id = (unsigned long)req; - p.seq_num = cpu_to_be32(req->seq_num = -- atomic_add_return(1, &mdev->packet_seq)); -+ atomic_add_return_unchecked(1, &mdev->packet_seq)); +- p.seq_num = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq)); ++ p.seq_num = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq)); dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw); -@@ -2981,7 +2981,7 @@ void drbd_init_set_defaults(struct drbd_conf *mdev) +@@ -3138,7 +3138,7 @@ void drbd_init_set_defaults(struct drbd_conf *mdev) atomic_set(&mdev->unacked_cnt, 0); atomic_set(&mdev->local_cnt, 0); atomic_set(&mdev->net_cnt, 0); @@ -29272,7 +29083,7 @@ index 211fc44..c5116f1 100644 atomic_set(&mdev->pp_in_use, 0); atomic_set(&mdev->pp_in_use_by_net, 0); atomic_set(&mdev->rs_sect_in, 0); -@@ -3063,8 +3063,8 @@ void drbd_mdev_cleanup(struct drbd_conf *mdev) +@@ -3220,8 +3220,8 @@ void drbd_mdev_cleanup(struct drbd_conf *mdev) mdev->receiver.t_state); /* no need to lock it, I'm the only thread alive */ @@ -29284,10 +29095,10 @@ index 211fc44..c5116f1 100644 mdev->bm_writ_cnt = mdev->read_cnt = diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c -index 946166e..356b39a 100644 +index 6d4de6a..7b7ad4b 100644 --- a/drivers/block/drbd/drbd_nl.c +++ b/drivers/block/drbd/drbd_nl.c -@@ -2359,7 +2359,7 @@ static void drbd_connector_callback(struct cn_msg *req, struct netlink_skb_parms +@@ -2387,7 +2387,7 @@ static void drbd_connector_callback(struct cn_msg *req, struct netlink_skb_parms module_put(THIS_MODULE); } @@ -29296,7 +29107,7 @@ index 946166e..356b39a 100644 static unsigned short * __tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data, -@@ -2430,7 +2430,7 @@ void drbd_bcast_state(struct drbd_conf *mdev, union drbd_state state) +@@ -2458,7 +2458,7 @@ void drbd_bcast_state(struct drbd_conf *mdev, union drbd_state state) cn_reply->id.idx = CN_IDX_DRBD; cn_reply->id.val = CN_VAL_DRBD; @@ -29305,7 +29116,7 @@ index 946166e..356b39a 100644 cn_reply->ack = 0; /* not used here. */ cn_reply->len = sizeof(struct drbd_nl_cfg_reply) + (int)((char *)tl - (char *)reply->tag_list); -@@ -2462,7 +2462,7 @@ void drbd_bcast_ev_helper(struct drbd_conf *mdev, char *helper_name) +@@ -2490,7 +2490,7 @@ void drbd_bcast_ev_helper(struct drbd_conf *mdev, char *helper_name) cn_reply->id.idx = CN_IDX_DRBD; cn_reply->id.val = CN_VAL_DRBD; @@ -29314,7 +29125,7 @@ index 946166e..356b39a 100644 cn_reply->ack = 0; /* not used here. */ cn_reply->len = sizeof(struct drbd_nl_cfg_reply) + (int)((char *)tl - (char *)reply->tag_list); -@@ -2540,7 +2540,7 @@ void drbd_bcast_ee(struct drbd_conf *mdev, +@@ -2568,7 +2568,7 @@ void drbd_bcast_ee(struct drbd_conf *mdev, cn_reply->id.idx = CN_IDX_DRBD; cn_reply->id.val = CN_VAL_DRBD; @@ -29323,7 +29134,7 @@ index 946166e..356b39a 100644 cn_reply->ack = 0; // not used here. cn_reply->len = sizeof(struct drbd_nl_cfg_reply) + (int)((char*)tl - (char*)reply->tag_list); -@@ -2579,7 +2579,7 @@ void drbd_bcast_sync_progress(struct drbd_conf *mdev) +@@ -2607,7 +2607,7 @@ void drbd_bcast_sync_progress(struct drbd_conf *mdev) cn_reply->id.idx = CN_IDX_DRBD; cn_reply->id.val = CN_VAL_DRBD; @@ -29333,10 +29144,10 @@ index 946166e..356b39a 100644 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) + (int)((char *)tl - (char *)reply->tag_list); diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c -index 43beaca..4a5b1dd 100644 +index ea4836e..272d72a 100644 --- a/drivers/block/drbd/drbd_receiver.c +++ b/drivers/block/drbd/drbd_receiver.c -@@ -894,7 +894,7 @@ retry: +@@ -893,7 +893,7 @@ retry: sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10; sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT; @@ -29344,8 +29155,8 @@ index 43beaca..4a5b1dd 100644 + atomic_set_unchecked(&mdev->packet_seq, 0); mdev->peer_seq = 0; - drbd_thread_start(&mdev->asender); -@@ -985,7 +985,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *mdev, + if (drbd_send_protocol(mdev) == -1) +@@ -994,7 +994,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *mdev, do { next_epoch = NULL; @@ -29354,7 +29165,7 @@ index 43beaca..4a5b1dd 100644 switch (ev & ~EV_CLEANUP) { case EV_PUT: -@@ -1020,7 +1020,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *mdev, +@@ -1030,7 +1030,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *mdev, rv = FE_DESTROYED; } else { epoch->flags = 0; @@ -29363,7 +29174,7 @@ index 43beaca..4a5b1dd 100644 /* atomic_set(&epoch->active, 0); is already zero */ if (rv == FE_STILL_LIVE) rv = FE_RECYCLED; -@@ -1191,14 +1191,14 @@ static int receive_Barrier(struct drbd_conf *mdev, enum drbd_packets cmd, unsign +@@ -1205,14 +1205,14 @@ static int receive_Barrier(struct drbd_conf *mdev, enum drbd_packets cmd, unsign drbd_wait_ee_list_empty(mdev, &mdev->active_ee); drbd_flush(mdev); @@ -29380,7 +29191,7 @@ index 43beaca..4a5b1dd 100644 D_ASSERT(atomic_read(&epoch->active) == 0); D_ASSERT(epoch->flags == 0); -@@ -1210,11 +1210,11 @@ static int receive_Barrier(struct drbd_conf *mdev, enum drbd_packets cmd, unsign +@@ -1224,11 +1224,11 @@ static int receive_Barrier(struct drbd_conf *mdev, enum drbd_packets cmd, unsign } epoch->flags = 0; @@ -29394,7 +29205,7 @@ index 43beaca..4a5b1dd 100644 list_add(&epoch->list, &mdev->current_epoch->list); mdev->current_epoch = epoch; mdev->epochs++; -@@ -1663,7 +1663,7 @@ static int receive_Data(struct drbd_conf *mdev, enum drbd_packets cmd, unsigned +@@ -1695,7 +1695,7 @@ static int receive_Data(struct drbd_conf *mdev, enum drbd_packets cmd, unsigned spin_unlock(&mdev->peer_seq_lock); drbd_send_ack_dp(mdev, P_NEG_ACK, p, data_size); @@ -29403,7 +29214,7 @@ index 43beaca..4a5b1dd 100644 return drbd_drain_block(mdev, data_size); } -@@ -1689,7 +1689,7 @@ static int receive_Data(struct drbd_conf *mdev, enum drbd_packets cmd, unsigned +@@ -1721,7 +1721,7 @@ static int receive_Data(struct drbd_conf *mdev, enum drbd_packets cmd, unsigned spin_lock(&mdev->epoch_lock); e->epoch = mdev->current_epoch; @@ -29412,7 +29223,7 @@ index 43beaca..4a5b1dd 100644 atomic_inc(&e->epoch->active); spin_unlock(&mdev->epoch_lock); -@@ -3885,7 +3885,7 @@ static void drbd_disconnect(struct drbd_conf *mdev) +@@ -3936,7 +3936,7 @@ static void drbd_disconnect(struct drbd_conf *mdev) D_ASSERT(list_empty(&mdev->done_ee)); /* ok, no more ee's on the fly, it is safe to reset the epoch_size */ @@ -29422,7 +29233,7 @@ index 43beaca..4a5b1dd 100644 } diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index bbca966..65e37dd 100644 +index 3bba655..6151b66 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -226,7 +226,7 @@ static int __do_lo_send_write(struct file *file, @@ -29435,7 +29246,7 @@ index bbca966..65e37dd 100644 if (likely(bw == len)) return 0; diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig -index ee94686..3e09ad3 100644 +index ea6f632..eafb192 100644 --- a/drivers/char/Kconfig +++ b/drivers/char/Kconfig @@ -8,7 +8,8 @@ source "drivers/tty/Kconfig" @@ -29576,7 +29387,7 @@ index 47ff7e4..0c7d340 100644 .part_num = MBCS_PART_NUM, .mfg_num = MBCS_MFG_NUM, diff --git a/drivers/char/mem.c b/drivers/char/mem.c -index d6e9d08..0c314bf 100644 +index 67c3371..ba8429d 100644 --- a/drivers/char/mem.c +++ b/drivers/char/mem.c @@ -18,6 +18,7 @@ @@ -29701,7 +29512,7 @@ index d6e9d08..0c314bf 100644 return -EFAULT; buf += sz; p += sz; -@@ -867,6 +914,9 @@ static const struct memdev { +@@ -831,6 +878,9 @@ static const struct memdev { #ifdef CONFIG_CRASH_DUMP [12] = { "oldmem", 0, &oldmem_fops, NULL }, #endif @@ -29724,6 +29535,81 @@ index 9df78e2..01ba9ae 100644 return -EFAULT; *ppos = i; +diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c +index 0a484b4..f48ccd1 100644 +--- a/drivers/char/pcmcia/synclink_cs.c ++++ b/drivers/char/pcmcia/synclink_cs.c +@@ -2340,9 +2340,9 @@ static void mgslpc_close(struct tty_struct *tty, struct file * filp) + + if (debug_level >= DEBUG_LEVEL_INFO) + printk("%s(%d):mgslpc_close(%s) entry, count=%d\n", +- __FILE__,__LINE__, info->device_name, port->count); ++ __FILE__,__LINE__, info->device_name, atomic_read(&port->count)); + +- WARN_ON(!port->count); ++ WARN_ON(!atomic_read(&port->count)); + + if (tty_port_close_start(port, tty, filp) == 0) + goto cleanup; +@@ -2360,7 +2360,7 @@ static void mgslpc_close(struct tty_struct *tty, struct file * filp) + cleanup: + if (debug_level >= DEBUG_LEVEL_INFO) + printk("%s(%d):mgslpc_close(%s) exit, count=%d\n", __FILE__,__LINE__, +- tty->driver->name, port->count); ++ tty->driver->name, atomic_read(&port->count)); + } + + /* Wait until the transmitter is empty. +@@ -2502,7 +2502,7 @@ static int mgslpc_open(struct tty_struct *tty, struct file * filp) + + if (debug_level >= DEBUG_LEVEL_INFO) + printk("%s(%d):mgslpc_open(%s), old ref count = %d\n", +- __FILE__,__LINE__,tty->driver->name, port->count); ++ __FILE__,__LINE__,tty->driver->name, atomic_read(&port->count)); + + /* If port is closing, signal caller to try again */ + if (tty_hung_up_p(filp) || port->flags & ASYNC_CLOSING){ +@@ -2522,11 +2522,11 @@ static int mgslpc_open(struct tty_struct *tty, struct file * filp) + goto cleanup; + } + spin_lock(&port->lock); +- port->count++; ++ atomic_inc(&port->count); + spin_unlock(&port->lock); + spin_unlock_irqrestore(&info->netlock, flags); + +- if (port->count == 1) { ++ if (atomic_read(&port->count) == 1) { + /* 1st open on this device, init hardware */ + retval = startup(info, tty); + if (retval < 0) +@@ -3891,7 +3891,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding, + unsigned short new_crctype; + + /* return error if TTY interface open */ +- if (info->port.count) ++ if (atomic_read(&info->port.count)) + return -EBUSY; + + switch (encoding) +@@ -3994,7 +3994,7 @@ static int hdlcdev_open(struct net_device *dev) + + /* arbitrate between network and tty opens */ + spin_lock_irqsave(&info->netlock, flags); +- if (info->port.count != 0 || info->netcount != 0) { ++ if (atomic_read(&info->port.count) != 0 || info->netcount != 0) { + printk(KERN_WARNING "%s: hdlc_open returning busy\n", dev->name); + spin_unlock_irqrestore(&info->netlock, flags); + return -EBUSY; +@@ -4083,7 +4083,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) + printk("%s:hdlcdev_ioctl(%s)\n",__FILE__,dev->name); + + /* return error if TTY interface open */ +- if (info->port.count) ++ if (atomic_read(&info->port.count)) + return -EBUSY; + + if (cmd != SIOCWANDEV) diff --git a/drivers/char/random.c b/drivers/char/random.c index 4ec04a7..9918387 100644 --- a/drivers/char/random.c @@ -30008,10 +29894,10 @@ index 97f5064..202b6e6 100644 } } diff --git a/drivers/edac/mce_amd.h b/drivers/edac/mce_amd.h -index c6074c5..88a9e2e 100644 +index 8c87a5e..a19cbd7 100644 --- a/drivers/edac/mce_amd.h +++ b/drivers/edac/mce_amd.h -@@ -82,7 +82,7 @@ extern const char * const ii_msgs[]; +@@ -80,7 +80,7 @@ extern const char * const ii_msgs[]; struct amd_decoder_ops { bool (*dc_mce)(u16, u8); bool (*ic_mce)(u16, u8); @@ -30021,10 +29907,10 @@ index c6074c5..88a9e2e 100644 void amd_report_gart_errors(bool); void amd_register_ecc_decoder(void (*f)(int, struct mce *)); diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c -index cc595eb..4ec702a 100644 +index 57ea7f4..789e3c3 100644 --- a/drivers/firewire/core-card.c +++ b/drivers/firewire/core-card.c -@@ -679,7 +679,7 @@ void fw_card_release(struct kref *kref) +@@ -680,7 +680,7 @@ EXPORT_SYMBOL_GPL(fw_card_release); void fw_core_remove_card(struct fw_card *card) { @@ -30034,10 +29920,10 @@ index cc595eb..4ec702a 100644 card->driver->update_phy_reg(card, 4, PHY_LINK_ACTIVE | PHY_CONTENDER, 0); diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c -index 2e6b245..c3857d9 100644 +index 2783f69..9f4b0cc 100644 --- a/drivers/firewire/core-cdev.c +++ b/drivers/firewire/core-cdev.c -@@ -1341,8 +1341,7 @@ static int init_iso_resource(struct client *client, +@@ -1365,8 +1365,7 @@ static int init_iso_resource(struct client *client, int ret; if ((request->channels == 0 && request->bandwidth == 0) || @@ -30048,7 +29934,7 @@ index 2e6b245..c3857d9 100644 r = kmalloc(sizeof(*r), GFP_KERNEL); diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c -index dea2dcc..a4fb978 100644 +index 780708d..ad60a66 100644 --- a/drivers/firewire/core-transaction.c +++ b/drivers/firewire/core-transaction.c @@ -37,6 +37,7 @@ @@ -30060,10 +29946,10 @@ index dea2dcc..a4fb978 100644 #include <asm/byteorder.h> diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h -index 9047f55..e47c7ff 100644 +index 515a42c..5ecf3ba 100644 --- a/drivers/firewire/core.h +++ b/drivers/firewire/core.h -@@ -110,6 +110,7 @@ struct fw_card_driver { +@@ -111,6 +111,7 @@ struct fw_card_driver { int (*stop_iso)(struct fw_iso_context *ctx); }; @@ -30110,7 +29996,7 @@ index 82d5c20..44a7177 100644 return -EINVAL; } diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c -index 8111889..367b253 100644 +index 3252e70..b5314ace 100644 --- a/drivers/gpu/drm/drm_crtc_helper.c +++ b/drivers/gpu/drm/drm_crtc_helper.c @@ -286,7 +286,7 @@ static bool drm_encoder_crtc_ok(struct drm_encoder *encoder, @@ -30123,10 +30009,10 @@ index 8111889..367b253 100644 dev = crtc->dev; diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c -index 6116e3b..c29dd16 100644 +index 8a9d079..606cdd5 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c -@@ -316,7 +316,7 @@ module_exit(drm_core_exit); +@@ -318,7 +318,7 @@ module_exit(drm_core_exit); /** * Copy and IOCTL return string to user space */ @@ -30135,7 +30021,7 @@ index 6116e3b..c29dd16 100644 { int len; -@@ -399,7 +399,7 @@ long drm_ioctl(struct file *filp, +@@ -401,7 +401,7 @@ long drm_ioctl(struct file *filp, return -ENODEV; atomic_inc(&dev->ioctl_count); @@ -30329,7 +30215,7 @@ index 637fcc3..e890b33 100644 if (__put_user(count, &request->count) || __put_user(list, &request->list)) diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c -index cf85155..f2665cb 100644 +index 64a62c6..ceab35e 100644 --- a/drivers/gpu/drm/drm_ioctl.c +++ b/drivers/gpu/drm/drm_ioctl.c @@ -252,7 +252,7 @@ int drm_getstats(struct drm_device *dev, void *data, @@ -30342,7 +30228,7 @@ index cf85155..f2665cb 100644 } diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c -index c79c713..2048588 100644 +index 5211520..c744d85 100644 --- a/drivers/gpu/drm/drm_lock.c +++ b/drivers/gpu/drm/drm_lock.c @@ -90,7 +90,7 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv) @@ -30364,10 +30250,10 @@ index c79c713..2048588 100644 if (drm_lock_free(&master->lock, lock->context)) { /* FIXME: Should really bail out here. */ diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c -index aa454f8..6d38580 100644 +index 21bcd4a..8e074e0 100644 --- a/drivers/gpu/drm/drm_stub.c +++ b/drivers/gpu/drm/drm_stub.c -@@ -512,7 +512,7 @@ void drm_unplug_dev(struct drm_device *dev) +@@ -511,7 +511,7 @@ void drm_unplug_dev(struct drm_device *dev) drm_device_set_unplugged(dev); @@ -30377,10 +30263,10 @@ index aa454f8..6d38580 100644 } mutex_unlock(&drm_global_mutex); diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c -index f920fb5..001c52d 100644 +index fa94391..ed26ec8 100644 --- a/drivers/gpu/drm/i810/i810_dma.c +++ b/drivers/gpu/drm/i810/i810_dma.c -@@ -945,8 +945,8 @@ static int i810_dma_vertex(struct drm_device *dev, void *data, +@@ -943,8 +943,8 @@ static int i810_dma_vertex(struct drm_device *dev, void *data, dma->buflist[vertex->idx], vertex->discard, vertex->used); @@ -30391,7 +30277,7 @@ index f920fb5..001c52d 100644 sarea_priv->last_enqueue = dev_priv->counter - 1; sarea_priv->last_dispatch = (int)hw_status[5]; -@@ -1106,8 +1106,8 @@ static int i810_dma_mc(struct drm_device *dev, void *data, +@@ -1104,8 +1104,8 @@ static int i810_dma_mc(struct drm_device *dev, void *data, i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used, mc->last_render); @@ -30418,10 +30304,10 @@ index c9339f4..f5e1b9d 100644 int front_offset; } drm_i810_private_t; diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c -index e6162a1..b2ff486 100644 +index 5363e9c..59360d1 100644 --- a/drivers/gpu/drm/i915/i915_debugfs.c +++ b/drivers/gpu/drm/i915/i915_debugfs.c -@@ -500,7 +500,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data) +@@ -518,7 +518,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data) I915_READ(GTIMR)); } seq_printf(m, "Interrupts received: %d\n", @@ -30430,20 +30316,11 @@ index e6162a1..b2ff486 100644 for (i = 0; i < I915_NUM_RINGS; i++) { if (IS_GEN6(dev) || IS_GEN7(dev)) { seq_printf(m, "Graphics Interrupt mask (%s): %08x\n", -@@ -1313,7 +1313,7 @@ static int i915_opregion(struct seq_file *m, void *unused) - return ret; - - if (opregion->header) -- seq_write(m, opregion->header, OPREGION_SIZE); -+ seq_write(m, (const void __force_kernel *)opregion->header, OPREGION_SIZE); - - mutex_unlock(&dev->struct_mutex); - diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c -index ba60f3c..e2dff7f 100644 +index 36822b9..b725e1b 100644 --- a/drivers/gpu/drm/i915/i915_dma.c +++ b/drivers/gpu/drm/i915/i915_dma.c -@@ -1178,7 +1178,7 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev) +@@ -1266,7 +1266,7 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev) bool can_switch; spin_lock(&dev->count_lock); @@ -30453,10 +30330,10 @@ index ba60f3c..e2dff7f 100644 return can_switch; } diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h -index 5fabc6c..0b08aa1 100644 +index b0b676a..d107105 100644 --- a/drivers/gpu/drm/i915/i915_drv.h +++ b/drivers/gpu/drm/i915/i915_drv.h -@@ -240,7 +240,7 @@ struct drm_i915_display_funcs { +@@ -268,7 +268,7 @@ struct drm_i915_display_funcs { /* render clock increase/decrease */ /* display clock increase/decrease */ /* pll clock increase/decrease */ @@ -30465,7 +30342,7 @@ index 5fabc6c..0b08aa1 100644 struct intel_device_info { u8 gen; -@@ -350,7 +350,7 @@ typedef struct drm_i915_private { +@@ -386,7 +386,7 @@ typedef struct drm_i915_private { int current_page; int page_flipping; @@ -30474,7 +30351,7 @@ index 5fabc6c..0b08aa1 100644 /* protects the irq masks */ spinlock_t irq_lock; -@@ -937,7 +937,7 @@ struct drm_i915_gem_object { +@@ -985,7 +985,7 @@ struct drm_i915_gem_object { * will be page flipped away on the next vblank. When it * reaches 0, dev_priv->pending_flip_queue will be woken up. */ @@ -30483,8 +30360,8 @@ index 5fabc6c..0b08aa1 100644 }; #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base) -@@ -1359,7 +1359,7 @@ extern int intel_setup_gmbus(struct drm_device *dev); - extern void intel_teardown_gmbus(struct drm_device *dev); +@@ -1434,7 +1434,7 @@ extern struct i2c_adapter *intel_gmbus_get_adapter( + struct drm_i915_private *dev_priv, unsigned port); extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed); extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit); -extern inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter) @@ -30493,7 +30370,7 @@ index 5fabc6c..0b08aa1 100644 return container_of(adapter, struct intel_gmbus, adapter)->force_bit; } diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c -index de43194..a14c4cc 100644 +index 974a9f1..b3ebd45 100644 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c @@ -189,7 +189,7 @@ i915_gem_object_set_to_gpu_domain(struct drm_i915_gem_object *obj, @@ -30505,7 +30382,7 @@ index de43194..a14c4cc 100644 /* The actual obj->write_domain will be updated with * pending_write_domain after we emit the accumulated flush for all -@@ -933,9 +933,9 @@ i915_gem_check_execbuffer(struct drm_i915_gem_execbuffer2 *exec) +@@ -916,9 +916,9 @@ i915_gem_check_execbuffer(struct drm_i915_gem_execbuffer2 *exec) static int validate_exec_list(struct drm_i915_gem_exec_object2 *exec, @@ -30518,59 +30395,113 @@ index de43194..a14c4cc 100644 for (i = 0; i < count; i++) { char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr; diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c -index 26c67a7..8d4cbcb 100644 +index ed3224c..6618589 100644 --- a/drivers/gpu/drm/i915/i915_irq.c +++ b/drivers/gpu/drm/i915/i915_irq.c -@@ -496,7 +496,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS) - u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir; - struct drm_i915_master_private *master_priv; +@@ -433,7 +433,7 @@ static irqreturn_t valleyview_irq_handler(DRM_IRQ_ARGS) + int vblank = 0; + bool blc_event; + +- atomic_inc(&dev_priv->irq_received); ++ atomic_inc_unchecked(&dev_priv->irq_received); + + vblank_status = PIPE_START_VBLANK_INTERRUPT_STATUS | + PIPE_VBLANK_INTERRUPT_STATUS; +@@ -586,7 +586,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS) + irqreturn_t ret = IRQ_NONE; + int i; - atomic_inc(&dev_priv->irq_received); + atomic_inc_unchecked(&dev_priv->irq_received); /* disable master interrupt before clearing iir */ de_ier = I915_READ(DEIER); -@@ -579,7 +579,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS) - struct drm_i915_master_private *master_priv; - u32 bsd_usr_interrupt = GT_BSD_USER_INTERRUPT; +@@ -661,7 +661,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS) + u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir; + u32 hotplug_mask; - atomic_inc(&dev_priv->irq_received); + atomic_inc_unchecked(&dev_priv->irq_received); - if (IS_GEN6(dev)) - bsd_usr_interrupt = GT_GEN6_BSD_USER_INTERRUPT; -@@ -1291,7 +1291,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS) - int ret = IRQ_NONE, pipe; - bool blc_event = false; + /* disable master interrupt before clearing iir */ + de_ier = I915_READ(DEIER); +@@ -1646,7 +1646,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev) + { + drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; + +- atomic_set(&dev_priv->irq_received, 0); ++ atomic_set_unchecked(&dev_priv->irq_received, 0); + + + I915_WRITE(HWSTAM, 0xeffe); +@@ -1673,7 +1673,7 @@ static void valleyview_irq_preinstall(struct drm_device *dev) + drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; + int pipe; + +- atomic_set(&dev_priv->irq_received, 0); ++ atomic_set_unchecked(&dev_priv->irq_received, 0); + + /* VLV magic */ + I915_WRITE(VLV_IMR, 0); +@@ -1969,7 +1969,7 @@ static void i8xx_irq_preinstall(struct drm_device * dev) + drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; + int pipe; + +- atomic_set(&dev_priv->irq_received, 0); ++ atomic_set_unchecked(&dev_priv->irq_received, 0); + + for_each_pipe(pipe) + I915_WRITE(PIPESTAT(pipe), 0); +@@ -2020,7 +2020,7 @@ static irqreturn_t i8xx_irq_handler(DRM_IRQ_ARGS) + I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT | + I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT; - atomic_inc(&dev_priv->irq_received); + atomic_inc_unchecked(&dev_priv->irq_received); - iir = I915_READ(IIR); - -@@ -1802,7 +1802,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev) - { + iir = I915_READ16(IIR); + if (iir == 0) +@@ -2105,7 +2105,7 @@ static void i915_irq_preinstall(struct drm_device * dev) drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; + int pipe; - atomic_set(&dev_priv->irq_received, 0); + atomic_set_unchecked(&dev_priv->irq_received, 0); - INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func); - INIT_WORK(&dev_priv->error_work, i915_error_work_func); -@@ -1979,7 +1979,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev) + if (I915_HAS_HOTPLUG(dev)) { + I915_WRITE(PORT_HOTPLUG_EN, 0); +@@ -2200,7 +2200,7 @@ static irqreturn_t i915_irq_handler(DRM_IRQ_ARGS) + }; + int pipe, ret = IRQ_NONE; + +- atomic_inc(&dev_priv->irq_received); ++ atomic_inc_unchecked(&dev_priv->irq_received); + + iir = I915_READ(IIR); + do { +@@ -2326,7 +2326,7 @@ static void i965_irq_preinstall(struct drm_device * dev) drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private; int pipe; - atomic_set(&dev_priv->irq_received, 0); + atomic_set_unchecked(&dev_priv->irq_received, 0); - INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func); - INIT_WORK(&dev_priv->error_work, i915_error_work_func); + if (I915_HAS_HOTPLUG(dev)) { + I915_WRITE(PORT_HOTPLUG_EN, 0); +@@ -2436,7 +2436,7 @@ static irqreturn_t i965_irq_handler(DRM_IRQ_ARGS) + int irq_received; + int ret = IRQ_NONE, pipe; + +- atomic_inc(&dev_priv->irq_received); ++ atomic_inc_unchecked(&dev_priv->irq_received); + + iir = I915_READ(IIR); + diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index d4d162f..b49a04e 100644 +index a8538ac..4868a05 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c -@@ -2254,7 +2254,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb) +@@ -2000,7 +2000,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb) wait_event(dev_priv->pending_flip_queue, atomic_read(&dev_priv->mm.wedged) || @@ -30579,16 +30510,7 @@ index d4d162f..b49a04e 100644 /* Big Hammer, we also need to ensure that any pending * MI_WAIT_FOR_EVENT inside a user batch buffer on the -@@ -2919,7 +2919,7 @@ static void intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc) - obj = to_intel_framebuffer(crtc->fb)->obj; - dev_priv = crtc->dev->dev_private; - wait_event(dev_priv->pending_flip_queue, -- atomic_read(&obj->pending_flip) == 0); -+ atomic_read_unchecked(&obj->pending_flip) == 0); - } - - static bool intel_crtc_driving_pch(struct drm_crtc *crtc) -@@ -7284,9 +7284,8 @@ static void do_intel_finish_page_flip(struct drm_device *dev, +@@ -5925,9 +5925,8 @@ static void do_intel_finish_page_flip(struct drm_device *dev, obj = work->old_fb_obj; @@ -30600,7 +30522,7 @@ index d4d162f..b49a04e 100644 wake_up(&dev_priv->pending_flip_queue); schedule_work(&work->work); -@@ -7582,7 +7581,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, +@@ -6264,7 +6263,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, /* Block clients from rendering to the new back buffer until * the flip occurs and the object is no longer visible. */ @@ -30609,7 +30531,7 @@ index d4d162f..b49a04e 100644 ret = dev_priv->display.queue_flip(dev, crtc, fb, obj); if (ret) -@@ -7596,7 +7595,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, +@@ -6279,7 +6278,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, return 0; cleanup_pending: @@ -30675,10 +30597,10 @@ index 2581202..f230a8d9 100644 *sequence = cur_fence; diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c -index 0be4a81..7464804 100644 +index 2f11e16..191267e 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c +++ b/drivers/gpu/drm/nouveau/nouveau_bios.c -@@ -5329,7 +5329,7 @@ parse_bit_U_tbl_entry(struct drm_device *dev, struct nvbios *bios, +@@ -5340,7 +5340,7 @@ parse_bit_U_tbl_entry(struct drm_device *dev, struct nvbios *bios, struct bit_table { const char id; int (* const parse_fn)(struct drm_device *, struct nvbios *, struct bit_entry *); @@ -30688,19 +30610,10 @@ index 0be4a81..7464804 100644 #define BIT_TABLE(id, funcid) ((struct bit_table){ id, parse_bit_##funcid##_tbl_entry }) diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h -index 3aef353..0ad1322 100644 +index 8613cb2..ea038e7 100644 --- a/drivers/gpu/drm/nouveau/nouveau_drv.h +++ b/drivers/gpu/drm/nouveau/nouveau_drv.h -@@ -240,7 +240,7 @@ struct nouveau_channel { - struct list_head pending; - uint32_t sequence; - uint32_t sequence_ack; -- atomic_t last_sequence_irq; -+ atomic_unchecked_t last_sequence_irq; - struct nouveau_vma vma; - } fence; - -@@ -321,7 +321,7 @@ struct nouveau_exec_engine { +@@ -302,7 +302,7 @@ struct nouveau_exec_engine { u32 handle, u16 class); void (*set_tile_region)(struct drm_device *dev, int i); void (*tlb_flush)(struct drm_device *, int engine); @@ -30709,7 +30622,7 @@ index 3aef353..0ad1322 100644 struct nouveau_instmem_engine { void *priv; -@@ -343,13 +343,13 @@ struct nouveau_instmem_engine { +@@ -324,13 +324,13 @@ struct nouveau_instmem_engine { struct nouveau_mc_engine { int (*init)(struct drm_device *dev); void (*takedown)(struct drm_device *dev); @@ -30725,7 +30638,7 @@ index 3aef353..0ad1322 100644 struct nouveau_fb_engine { int num_tiles; -@@ -590,7 +590,7 @@ struct nouveau_vram_engine { +@@ -547,7 +547,7 @@ struct nouveau_vram_engine { void (*put)(struct drm_device *, struct nouveau_mem **); bool (*flags_valid)(struct drm_device *, u32 tile_flags); @@ -30734,42 +30647,20 @@ index 3aef353..0ad1322 100644 struct nouveau_engine { struct nouveau_instmem_engine instmem; -@@ -739,7 +739,7 @@ struct drm_nouveau_private { +@@ -695,7 +695,7 @@ struct drm_nouveau_private { struct drm_global_reference mem_global_ref; struct ttm_bo_global_ref bo_global_ref; struct ttm_bo_device bdev; - atomic_t validate_sequence; + atomic_unchecked_t validate_sequence; - } ttm; - - struct { -diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c -index c1dc20f..4df673c 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_fence.c -+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c -@@ -85,7 +85,7 @@ nouveau_fence_update(struct nouveau_channel *chan) - if (USE_REFCNT(dev)) - sequence = nvchan_rd32(chan, 0x48); - else -- sequence = atomic_read(&chan->fence.last_sequence_irq); -+ sequence = atomic_read_unchecked(&chan->fence.last_sequence_irq); - - if (chan->fence.sequence_ack == sequence) - goto out; -@@ -538,7 +538,7 @@ nouveau_fence_channel_init(struct nouveau_channel *chan) - return ret; - } - -- atomic_set(&chan->fence.last_sequence_irq, 0); -+ atomic_set_unchecked(&chan->fence.last_sequence_irq, 0); - return 0; - } - + int (*move)(struct nouveau_channel *, + struct ttm_buffer_object *, + struct ttm_mem_reg *, struct ttm_mem_reg *); diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c -index ed52a6f..484acdc 100644 +index 30f5423..abca136 100644 --- a/drivers/gpu/drm/nouveau/nouveau_gem.c +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c -@@ -314,7 +314,7 @@ validate_init(struct nouveau_channel *chan, struct drm_file *file_priv, +@@ -319,7 +319,7 @@ validate_init(struct nouveau_channel *chan, struct drm_file *file_priv, int trycnt = 0; int ret, i; @@ -30779,10 +30670,10 @@ index ed52a6f..484acdc 100644 if (++trycnt > 100000) { NV_ERROR(dev, "%s failed and gave up.\n", __func__); diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c -index c2a8511..4b996f9 100644 +index 19706f0..f257368 100644 --- a/drivers/gpu/drm/nouveau/nouveau_state.c +++ b/drivers/gpu/drm/nouveau/nouveau_state.c -@@ -588,7 +588,7 @@ static bool nouveau_switcheroo_can_switch(struct pci_dev *pdev) +@@ -490,7 +490,7 @@ static bool nouveau_switcheroo_can_switch(struct pci_dev *pdev) bool can_switch; spin_lock(&dev->count_lock); @@ -30791,21 +30682,8 @@ index c2a8511..4b996f9 100644 spin_unlock(&dev->count_lock); return can_switch; } -diff --git a/drivers/gpu/drm/nouveau/nv04_graph.c b/drivers/gpu/drm/nouveau/nv04_graph.c -index dbdea8e..cd6eeeb 100644 ---- a/drivers/gpu/drm/nouveau/nv04_graph.c -+++ b/drivers/gpu/drm/nouveau/nv04_graph.c -@@ -554,7 +554,7 @@ static int - nv04_graph_mthd_set_ref(struct nouveau_channel *chan, - u32 class, u32 mthd, u32 data) - { -- atomic_set(&chan->fence.last_sequence_irq, data); -+ atomic_set_unchecked(&chan->fence.last_sequence_irq, data); - return 0; - } - diff --git a/drivers/gpu/drm/nouveau/nv50_sor.c b/drivers/gpu/drm/nouveau/nv50_sor.c -index 2746402..c8dc4a4 100644 +index a9514ea..369d511 100644 --- a/drivers/gpu/drm/nouveau/nv50_sor.c +++ b/drivers/gpu/drm/nouveau/nv50_sor.c @@ -304,7 +304,7 @@ nv50_sor_dpms(struct drm_encoder *encoder, int mode) @@ -30818,7 +30696,7 @@ index 2746402..c8dc4a4 100644 .train_set = nv50_sor_dp_train_set, .train_adj = nv50_sor_dp_train_adj diff --git a/drivers/gpu/drm/nouveau/nvd0_display.c b/drivers/gpu/drm/nouveau/nvd0_display.c -index 0247250..d2f6aaf 100644 +index c486d3c..3a7d6f4 100644 --- a/drivers/gpu/drm/nouveau/nvd0_display.c +++ b/drivers/gpu/drm/nouveau/nvd0_display.c @@ -1366,7 +1366,7 @@ nvd0_sor_dpms(struct drm_encoder *encoder, int mode) @@ -30925,19 +30803,10 @@ index 5a82b6b..9e69c73 100644 if (regcomp (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) { diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h -index 138b952..d74f9cb 100644 +index fefcca5..20a5b90 100644 --- a/drivers/gpu/drm/radeon/radeon.h +++ b/drivers/gpu/drm/radeon/radeon.h -@@ -253,7 +253,7 @@ struct radeon_fence_driver { - uint32_t scratch_reg; - uint64_t gpu_addr; - volatile uint32_t *cpu_addr; -- atomic_t seq; -+ atomic_unchecked_t seq; - uint32_t last_seq; - unsigned long last_jiffies; - unsigned long last_timeout; -@@ -753,7 +753,7 @@ struct r600_blit_cp_primitives { +@@ -743,7 +743,7 @@ struct r600_blit_cp_primitives { int x2, int y2); void (*draw_auto)(struct radeon_device *rdev); void (*set_default_state)(struct radeon_device *rdev); @@ -30945,8 +30814,8 @@ index 138b952..d74f9cb 100644 +} __no_const; struct r600_blit { - struct mutex mutex; -@@ -1246,7 +1246,7 @@ struct radeon_asic { + struct radeon_bo *shader_obj; +@@ -1244,7 +1244,7 @@ struct radeon_asic { u32 (*page_flip)(struct radeon_device *rdev, int crtc, u64 crtc_base); void (*post_page_flip)(struct radeon_device *rdev, int crtc); } pflip; @@ -30956,10 +30825,10 @@ index 138b952..d74f9cb 100644 /* * Asic structures diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c -index 5992502..c19c633 100644 +index 066c98b..96ab858 100644 --- a/drivers/gpu/drm/radeon/radeon_device.c +++ b/drivers/gpu/drm/radeon/radeon_device.c -@@ -691,7 +691,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev) +@@ -692,7 +692,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev) bool can_switch; spin_lock(&dev->count_lock); @@ -30981,37 +30850,6 @@ index a1b59ca..86f2d44 100644 int vblank_crtc; uint32_t irq_enable_reg; uint32_t r500_disp_irq_reg; -diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c -index 4bd36a3..e66fe9c 100644 ---- a/drivers/gpu/drm/radeon/radeon_fence.c -+++ b/drivers/gpu/drm/radeon/radeon_fence.c -@@ -70,7 +70,7 @@ int radeon_fence_emit(struct radeon_device *rdev, struct radeon_fence *fence) - write_unlock_irqrestore(&rdev->fence_lock, irq_flags); - return 0; - } -- fence->seq = atomic_add_return(1, &rdev->fence_drv[fence->ring].seq); -+ fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv[fence->ring].seq); - if (!rdev->ring[fence->ring].ready) - /* FIXME: cp is not running assume everythings is done right - * away -@@ -405,7 +405,7 @@ int radeon_fence_driver_start_ring(struct radeon_device *rdev, int ring) - } - rdev->fence_drv[ring].cpu_addr = &rdev->wb.wb[index/4]; - rdev->fence_drv[ring].gpu_addr = rdev->wb.gpu_addr + index; -- radeon_fence_write(rdev, atomic_read(&rdev->fence_drv[ring].seq), ring); -+ radeon_fence_write(rdev, atomic_read_unchecked(&rdev->fence_drv[ring].seq), ring); - rdev->fence_drv[ring].initialized = true; - DRM_INFO("fence driver on ring %d use gpu addr 0x%08Lx and cpu addr 0x%p\n", - ring, rdev->fence_drv[ring].gpu_addr, rdev->fence_drv[ring].cpu_addr); -@@ -418,7 +418,7 @@ static void radeon_fence_driver_init_ring(struct radeon_device *rdev, int ring) - rdev->fence_drv[ring].scratch_reg = -1; - rdev->fence_drv[ring].cpu_addr = NULL; - rdev->fence_drv[ring].gpu_addr = 0; -- atomic_set(&rdev->fence_drv[ring].seq, 0); -+ atomic_set_unchecked(&rdev->fence_drv[ring].seq, 0); - INIT_LIST_HEAD(&rdev->fence_drv[ring].created); - INIT_LIST_HEAD(&rdev->fence_drv[ring].emitted); - INIT_LIST_HEAD(&rdev->fence_drv[ring].signaled); diff --git a/drivers/gpu/drm/radeon/radeon_ioc32.c b/drivers/gpu/drm/radeon/radeon_ioc32.c index 48b7cea..342236f 100644 --- a/drivers/gpu/drm/radeon/radeon_ioc32.c @@ -31072,10 +30910,10 @@ index e8422ae..d22d4a8 100644 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID); diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c -index f493c64..524ab6b 100644 +index c94a225..5795d34 100644 --- a/drivers/gpu/drm/radeon/radeon_ttm.c +++ b/drivers/gpu/drm/radeon/radeon_ttm.c -@@ -843,8 +843,10 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma) +@@ -852,8 +852,10 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma) } if (unlikely(ttm_vm_ops == NULL)) { ttm_vm_ops = vma->vm_ops; @@ -31089,7 +30927,7 @@ index f493c64..524ab6b 100644 vma->vm_ops = &radeon_ttm_vm_ops; return 0; diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c -index f2c3b9d..d5a376b 100644 +index 159b6a4..fa82487 100644 --- a/drivers/gpu/drm/radeon/rs690.c +++ b/drivers/gpu/drm/radeon/rs690.c @@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev, @@ -31306,10 +31144,10 @@ index 8a8725c..afed796 100644 marker = list_first_entry(&queue->head, struct vmw_marker, head); diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 973c238..981f5ed 100644 +index 4c87276..9ecc3c7 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c -@@ -2071,7 +2071,7 @@ static bool hid_ignore(struct hid_device *hdev) +@@ -2151,7 +2151,7 @@ static bool hid_ignore(struct hid_device *hdev) int hid_add_device(struct hid_device *hdev) { @@ -31318,7 +31156,7 @@ index 973c238..981f5ed 100644 int ret; if (WARN_ON(hdev->status & HID_STAT_ADDED)) -@@ -2086,7 +2086,7 @@ int hid_add_device(struct hid_device *hdev) +@@ -2186,7 +2186,7 @@ int hid_add_device(struct hid_device *hdev) /* XXX hack, any other cleaner solution after the driver core * is converted to allow more than 20 bytes as the device name? */ dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus, @@ -31341,10 +31179,10 @@ index eec3291..8ed706b 100644 *off += size; diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c -index b1ec0e2..c295a61 100644 +index 14599e2..711c965 100644 --- a/drivers/hid/usbhid/hiddev.c +++ b/drivers/hid/usbhid/hiddev.c -@@ -624,7 +624,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) +@@ -625,7 +625,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) break; case HIDIOCAPPLICATION: @@ -31369,7 +31207,7 @@ index 4065374..10ed7dc 100644 ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount); if (ret) diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c -index 15956bd..ea34398 100644 +index 86f8885..ab9cb2b 100644 --- a/drivers/hv/hv.c +++ b/drivers/hv/hv.c @@ -132,7 +132,7 @@ static u64 do_hypercall(u64 control, void *input, void *output) @@ -31382,7 +31220,7 @@ index 15956bd..ea34398 100644 __asm__ __volatile__ ("call *%8" : "=d"(hv_status_hi), "=a"(hv_status_lo) : "d" (control_hi), diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h -index 699f0d8..f4f19250 100644 +index b9426a6..677ce34 100644 --- a/drivers/hv/hyperv_vmbus.h +++ b/drivers/hv/hyperv_vmbus.h @@ -555,7 +555,7 @@ enum vmbus_connect_state { @@ -31412,10 +31250,10 @@ index a220e57..428f54d 100644 child_device_obj->device.bus = &hv_bus; child_device_obj->device.parent = &hv_acpi_dev->dev; diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c -index 9140236..ceaef4e 100644 +index 34ad5a2..e2b0ae8 100644 --- a/drivers/hwmon/acpi_power_meter.c +++ b/drivers/hwmon/acpi_power_meter.c -@@ -316,8 +316,6 @@ static ssize_t set_trip(struct device *dev, struct device_attribute *devattr, +@@ -308,8 +308,6 @@ static ssize_t set_trip(struct device *dev, struct device_attribute *devattr, return res; temp /= 1000; @@ -31503,10 +31341,10 @@ index 29015eb..af2d8e9 100644 /* Wrapper access functions for multiplexed SMBus */ static DEFINE_MUTEX(nforce2_lock); diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c -index d7a4833..7fae376 100644 +index 1038c38..eb92f51 100644 --- a/drivers/i2c/i2c-mux.c +++ b/drivers/i2c/i2c-mux.c -@@ -28,7 +28,7 @@ +@@ -30,7 +30,7 @@ /* multiplexer per channel data */ struct i2c_mux_priv { struct i2c_adapter adap; @@ -31514,7 +31352,7 @@ index d7a4833..7fae376 100644 + i2c_algorithm_no_const algo; struct i2c_adapter *parent; - void *mux_dev; /* the mux chip/device */ + void *mux_priv; /* the mux chip/device */ diff --git a/drivers/ide/aec62xx.c b/drivers/ide/aec62xx.c index 57d00ca..0145194 100644 --- a/drivers/ide/aec62xx.c @@ -32271,7 +32109,7 @@ index 176c8f9..2627b62 100644 } } diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c -index 40c8353..946b0e4 100644 +index 57e07c6..56d09d4 100644 --- a/drivers/infiniband/hw/cxgb4/mem.c +++ b/drivers/infiniband/hw/cxgb4/mem.c @@ -122,7 +122,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry, @@ -32283,10 +32121,10 @@ index 40c8353..946b0e4 100644 if (c4iw_fatal_error(rdev)) return -EIO; -@@ -135,7 +135,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry, - &rdev->resource.tpt_fifo_lock); - if (!stag_idx) - return -ENOMEM; +@@ -139,7 +139,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry, + if (rdev->stats.stag.cur > rdev->stats.stag.max) + rdev->stats.stag.max = rdev->stats.stag.cur; + mutex_unlock(&rdev->stats.lock); - *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff); + *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff); } @@ -32428,7 +32266,7 @@ index c438e46..ca30356 100644 extern u32 int_mod_timer_init; extern u32 int_mod_cq_depth_256; diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c -index 71edfbb..15b62ae 100644 +index 020e95c..fbb3450 100644 --- a/drivers/infiniband/hw/nes/nes_cm.c +++ b/drivers/infiniband/hw/nes/nes_cm.c @@ -68,14 +68,14 @@ u32 cm_packets_dropped; @@ -32537,7 +32375,7 @@ index 71edfbb..15b62ae 100644 dev_kfree_skb_any(skb); } break; -@@ -2890,7 +2890,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp) +@@ -2891,7 +2891,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp) if ((cm_id) && (cm_id->event_handler)) { if (issue_disconn) { @@ -32546,7 +32384,7 @@ index 71edfbb..15b62ae 100644 cm_event.event = IW_CM_EVENT_DISCONNECT; cm_event.status = disconn_status; cm_event.local_addr = cm_id->local_addr; -@@ -2912,7 +2912,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp) +@@ -2913,7 +2913,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp) } if (issue_close) { @@ -32555,7 +32393,7 @@ index 71edfbb..15b62ae 100644 nes_disconnect(nesqp, 1); cm_id->provider_data = nesqp; -@@ -3048,7 +3048,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param) +@@ -3049,7 +3049,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param) nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n", nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener); @@ -32564,7 +32402,7 @@ index 71edfbb..15b62ae 100644 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n", netdev_refcnt_read(nesvnic->netdev)); -@@ -3250,7 +3250,7 @@ int nes_reject(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len) +@@ -3251,7 +3251,7 @@ int nes_reject(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len) struct nes_cm_core *cm_core; u8 *start_buff; @@ -32573,7 +32411,7 @@ index 71edfbb..15b62ae 100644 cm_node = (struct nes_cm_node *)cm_id->provider_data; loopback = cm_node->loopbackpartner; cm_core = cm_node->cm_core; -@@ -3310,7 +3310,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param) +@@ -3311,7 +3311,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param) ntohl(cm_id->local_addr.sin_addr.s_addr), ntohs(cm_id->local_addr.sin_port)); @@ -32582,7 +32420,7 @@ index 71edfbb..15b62ae 100644 nesqp->active_conn = 1; /* cache the cm_id in the qp */ -@@ -3416,7 +3416,7 @@ int nes_create_listen(struct iw_cm_id *cm_id, int backlog) +@@ -3421,7 +3421,7 @@ int nes_create_listen(struct iw_cm_id *cm_id, int backlog) g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node); return err; } @@ -32591,7 +32429,7 @@ index 71edfbb..15b62ae 100644 } cm_id->add_ref(cm_id); -@@ -3517,7 +3517,7 @@ static void cm_event_connected(struct nes_cm_event *event) +@@ -3522,7 +3522,7 @@ static void cm_event_connected(struct nes_cm_event *event) if (nesqp->destroyed) return; @@ -32600,7 +32438,7 @@ index 71edfbb..15b62ae 100644 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on" " local port 0x%04X. jiffies = %lu.\n", nesqp->hwqp.qp_id, -@@ -3704,7 +3704,7 @@ static void cm_event_reset(struct nes_cm_event *event) +@@ -3709,7 +3709,7 @@ static void cm_event_reset(struct nes_cm_event *event) cm_id->add_ref(cm_id); ret = cm_id->event_handler(cm_id, &cm_event); @@ -32609,7 +32447,7 @@ index 71edfbb..15b62ae 100644 cm_event.event = IW_CM_EVENT_CLOSE; cm_event.status = 0; cm_event.provider_data = cm_id->provider_data; -@@ -3740,7 +3740,7 @@ static void cm_event_mpa_req(struct nes_cm_event *event) +@@ -3745,7 +3745,7 @@ static void cm_event_mpa_req(struct nes_cm_event *event) return; cm_id = cm_node->cm_id; @@ -32618,7 +32456,7 @@ index 71edfbb..15b62ae 100644 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n", cm_node, cm_id, jiffies); -@@ -3780,7 +3780,7 @@ static void cm_event_mpa_reject(struct nes_cm_event *event) +@@ -3785,7 +3785,7 @@ static void cm_event_mpa_reject(struct nes_cm_event *event) return; cm_id = cm_node->cm_id; @@ -32760,7 +32598,7 @@ index 8b8812d..a5e1133 100644 /* Blow away the connection if it exists. */ diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h -index 6b811e3..f8acf88 100644 +index 7e62f41..4c2b8e2 100644 --- a/drivers/infiniband/hw/qib/qib.h +++ b/drivers/infiniband/hw/qib/qib.h @@ -51,6 +51,7 @@ @@ -32815,7 +32653,7 @@ index 8921c61..f5cd63d 100644 error = device_add(&dev->dev); if (error) diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c -index b8d8611..7a4a04b 100644 +index 04c69af..5f92d00 100644 --- a/drivers/input/joystick/sidewinder.c +++ b/drivers/input/joystick/sidewinder.c @@ -30,6 +30,7 @@ @@ -32827,10 +32665,10 @@ index b8d8611..7a4a04b 100644 #include <linux/input.h> #include <linux/gameport.h> diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c -index 42f7b25..09fcf46 100644 +index 83811e4..0822b90 100644 --- a/drivers/input/joystick/xpad.c +++ b/drivers/input/joystick/xpad.c -@@ -714,7 +714,7 @@ static void xpad_led_set(struct led_classdev *led_cdev, +@@ -726,7 +726,7 @@ static void xpad_led_set(struct led_classdev *led_cdev, static int xpad_led_probe(struct usb_xpad *xpad) { @@ -32839,7 +32677,7 @@ index 42f7b25..09fcf46 100644 long led_no; struct xpad_led *led; struct led_classdev *led_cdev; -@@ -727,7 +727,7 @@ static int xpad_led_probe(struct usb_xpad *xpad) +@@ -739,7 +739,7 @@ static int xpad_led_probe(struct usb_xpad *xpad) if (!led) return -ENOMEM; @@ -32884,7 +32722,7 @@ index d0f7533..fb8215b 100644 serio->dev.release = serio_release_port; serio->dev.groups = serio_device_attr_groups; diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c -index b902794..fc7b85b 100644 +index 38c4bd8..58965d9 100644 --- a/drivers/isdn/capi/capi.c +++ b/drivers/isdn/capi/capi.c @@ -83,8 +83,8 @@ struct capiminor { @@ -32898,7 +32736,7 @@ index b902794..fc7b85b 100644 struct tty_port port; int ttyinstop; -@@ -397,7 +397,7 @@ gen_data_b3_resp_for(struct capiminor *mp, struct sk_buff *skb) +@@ -392,7 +392,7 @@ gen_data_b3_resp_for(struct capiminor *mp, struct sk_buff *skb) capimsg_setu16(s, 2, mp->ap->applid); capimsg_setu8 (s, 4, CAPI_DATA_B3); capimsg_setu8 (s, 5, CAPI_RESP); @@ -32907,7 +32745,7 @@ index b902794..fc7b85b 100644 capimsg_setu32(s, 8, mp->ncci); capimsg_setu16(s, 12, datahandle); } -@@ -518,14 +518,14 @@ static void handle_minor_send(struct capiminor *mp) +@@ -513,14 +513,14 @@ static void handle_minor_send(struct capiminor *mp) mp->outbytes -= len; spin_unlock_bh(&mp->outlock); @@ -32924,6 +32762,34 @@ index b902794..fc7b85b 100644 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */ capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */ capimsg_setu16(skb->data, 16, len); /* Data length */ +diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c +index a6d9fd2..afdb8a3 100644 +--- a/drivers/isdn/gigaset/interface.c ++++ b/drivers/isdn/gigaset/interface.c +@@ -160,9 +160,9 @@ static int if_open(struct tty_struct *tty, struct file *filp) + } + tty->driver_data = cs; + +- ++cs->port.count; ++ atomic_inc(&cs->port.count); + +- if (cs->port.count == 1) { ++ if (atomic_read(&cs->port.count) == 1) { + tty_port_tty_set(&cs->port, tty); + tty->low_latency = 1; + } +@@ -186,9 +186,9 @@ static void if_close(struct tty_struct *tty, struct file *filp) + + if (!cs->connected) + gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */ +- else if (!cs->port.count) ++ else if (!atomic_read(&cs->port.count)) + dev_warn(cs->dev, "%s: device not opened\n", __func__); +- else if (!--cs->port.count) ++ else if (!atomic_dec_return(&cs->port.count)) + tty_port_tty_set(&cs->port, NULL); + + mutex_unlock(&cs->mutex); diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c index 821f7ac..28d4030 100644 --- a/drivers/isdn/hardware/avm/b1.c @@ -32972,6 +32838,71 @@ index d303e65..28bcb7b 100644 typedef struct _diva_os_xdi_adapter { struct list_head link; +diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c +index 7bc5067..fd36232 100644 +--- a/drivers/isdn/i4l/isdn_tty.c ++++ b/drivers/isdn/i4l/isdn_tty.c +@@ -1505,9 +1505,9 @@ isdn_tty_open(struct tty_struct *tty, struct file *filp) + port = &info->port; + #ifdef ISDN_DEBUG_MODEM_OPEN + printk(KERN_DEBUG "isdn_tty_open %s, count = %d\n", tty->name, +- port->count); ++ atomic_read(&port->count)) + #endif +- port->count++; ++ atomic_inc(&port->count); + tty->driver_data = info; + port->tty = tty; + tty->port = port; +@@ -1553,7 +1553,7 @@ isdn_tty_close(struct tty_struct *tty, struct file *filp) + #endif + return; + } +- if ((tty->count == 1) && (port->count != 1)) { ++ if ((tty->count == 1) && (atomic_read(&port->count) != 1)) { + /* + * Uh, oh. tty->count is 1, which means that the tty + * structure will be freed. Info->count should always +@@ -1562,15 +1562,15 @@ isdn_tty_close(struct tty_struct *tty, struct file *filp) + * serial port won't be shutdown. + */ + printk(KERN_ERR "isdn_tty_close: bad port count; tty->count is 1, " +- "info->count is %d\n", port->count); +- port->count = 1; ++ "info->count is %d\n", atomic_read(&port->count)); ++ atomic_set(&port->count, 1); + } +- if (--port->count < 0) { ++ if (atomic_dec_return(&port->count) < 0) { + printk(KERN_ERR "isdn_tty_close: bad port count for ttyi%d: %d\n", +- info->line, port->count); +- port->count = 0; ++ info->line, atomic_read(&port->count)); ++ atomic_set(&port->count, 0); + } +- if (port->count) { ++ if (atomic_read(&port->count)) { + #ifdef ISDN_DEBUG_MODEM_OPEN + printk(KERN_DEBUG "isdn_tty_close after info->count != 0\n"); + #endif +@@ -1624,7 +1624,7 @@ isdn_tty_hangup(struct tty_struct *tty) + if (isdn_tty_paranoia_check(info, tty->name, "isdn_tty_hangup")) + return; + isdn_tty_shutdown(info); +- port->count = 0; ++ atomic_set(&port->count, 0); + port->flags &= ~ASYNC_NORMAL_ACTIVE; + port->tty = NULL; + wake_up_interruptible(&port->open_wait); +@@ -1964,7 +1964,7 @@ isdn_tty_find_icall(int di, int ch, setup_parm *setup) + for (i = 0; i < ISDN_MAX_CHANNELS; i++) { + modem_info *info = &dev->mdm.info[i]; + +- if (info->port.count == 0) ++ if (atomic_read(&info->port.count) == 0) + continue; + if ((info->emu.mdmreg[REG_SI1] & si2bit[si1]) && /* SI1 is matching */ + (info->emu.mdmreg[REG_SI2] == si2)) { /* SI2 is matching */ diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c index e74df7c..03a03ba 100644 --- a/drivers/isdn/icn/icn.c @@ -32985,19 +32916,6 @@ index e74df7c..03a03ba 100644 return -EFAULT; } else memcpy(msg, buf, count); -diff --git a/drivers/leds/leds-mc13783.c b/drivers/leds/leds-mc13783.c -index 8bc4915..4cc6a2e 100644 ---- a/drivers/leds/leds-mc13783.c -+++ b/drivers/leds/leds-mc13783.c -@@ -280,7 +280,7 @@ static int __devinit mc13783_led_probe(struct platform_device *pdev) - return -EINVAL; - } - -- led = kzalloc(sizeof(*led) * pdata->num_leds, GFP_KERNEL); -+ led = kcalloc(pdata->num_leds, sizeof(*led), GFP_KERNEL); - if (led == NULL) { - dev_err(&pdev->dev, "failed to alloc memory\n"); - return -ENOMEM; diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c index b5fdcb7..5b6c59f 100644 --- a/drivers/lguest/core.c @@ -33150,15 +33068,15 @@ index 20e5c2c..9e849a9 100644 .device = PCI_ANY_ID, .subvendor = PCI_ANY_ID, diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c -index 17e2b47..bcbeec4 100644 +index 15dbe03..743fc65 100644 --- a/drivers/md/bitmap.c +++ b/drivers/md/bitmap.c -@@ -1823,7 +1823,7 @@ void bitmap_status(struct seq_file *seq, struct bitmap *bitmap) +@@ -1786,7 +1786,7 @@ void bitmap_status(struct seq_file *seq, struct bitmap *bitmap) chunk_kb ? "KB" : "B"); - if (bitmap->file) { + if (bitmap->storage.file) { seq_printf(seq, ", file: "); -- seq_path(seq, &bitmap->file->f_path, " \t\n"); -+ seq_path(seq, &bitmap->file->f_path, " \t\n\\"); +- seq_path(seq, &bitmap->storage.file->f_path, " \t\n"); ++ seq_path(seq, &bitmap->storage.file->f_path, " \t\n\\"); } seq_printf(seq, "\n"); @@ -33307,7 +33225,7 @@ index 2e227fb..44ead1f 100644 "start=%llu, len=%llu, dev_size=%llu", dm_device_name(ti->table->md), bdevname(bdev, b), diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c -index 737d388..811ad5a 100644 +index 3e2907f..c28851a 100644 --- a/drivers/md/dm-thin-metadata.c +++ b/drivers/md/dm-thin-metadata.c @@ -432,7 +432,7 @@ static int init_pmd(struct dm_pool_metadata *pmd, @@ -33387,7 +33305,7 @@ index e24143c..ce2f21a1 100644 void dm_uevent_add(struct mapped_device *md, struct list_head *elist) diff --git a/drivers/md/md.c b/drivers/md/md.c -index 9ee8ce3..362b519 100644 +index d5ab449..7e9ed7b 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -277,10 +277,10 @@ EXPORT_SYMBOL_GPL(md_trim_bio); @@ -33412,16 +33330,16 @@ index 9ee8ce3..362b519 100644 wake_up(&md_event_waiters); } -@@ -1526,7 +1526,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_ - - rdev->preferred_minor = 0xffff; - rdev->data_offset = le64_to_cpu(sb->data_offset); +@@ -1565,7 +1565,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_ + if ((le32_to_cpu(sb->feature_map) & MD_FEATURE_RESHAPE_ACTIVE) && + (le32_to_cpu(sb->feature_map) & MD_FEATURE_NEW_OFFSET)) + rdev->new_data_offset += (s32)le32_to_cpu(sb->new_offset); - atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read)); + atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read)); rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256; bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1; -@@ -1745,7 +1745,7 @@ static void super_1_sync(struct mddev *mddev, struct md_rdev *rdev) +@@ -1809,7 +1809,7 @@ static void super_1_sync(struct mddev *mddev, struct md_rdev *rdev) else sb->resync_offset = cpu_to_le64(0); @@ -33430,7 +33348,7 @@ index 9ee8ce3..362b519 100644 sb->raid_disks = cpu_to_le32(mddev->raid_disks); sb->size = cpu_to_le64(mddev->dev_sectors); -@@ -2691,7 +2691,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_show, state_store); +@@ -2803,7 +2803,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_show, state_store); static ssize_t errors_show(struct md_rdev *rdev, char *page) { @@ -33439,7 +33357,7 @@ index 9ee8ce3..362b519 100644 } static ssize_t -@@ -2700,7 +2700,7 @@ errors_store(struct md_rdev *rdev, const char *buf, size_t len) +@@ -2812,7 +2812,7 @@ errors_store(struct md_rdev *rdev, const char *buf, size_t len) char *e; unsigned long n = simple_strtoul(buf, &e, 10); if (*buf && (*e == 0 || *e == '\n')) { @@ -33448,7 +33366,7 @@ index 9ee8ce3..362b519 100644 return len; } return -EINVAL; -@@ -3086,8 +3086,8 @@ int md_rdev_init(struct md_rdev *rdev) +@@ -3259,8 +3259,8 @@ int md_rdev_init(struct md_rdev *rdev) rdev->sb_loaded = 0; rdev->bb_page = NULL; atomic_set(&rdev->nr_pending, 0); @@ -33459,7 +33377,7 @@ index 9ee8ce3..362b519 100644 INIT_LIST_HEAD(&rdev->same_set); init_waitqueue_head(&rdev->blocked_wait); -@@ -6748,7 +6748,7 @@ static int md_seq_show(struct seq_file *seq, void *v) +@@ -6997,7 +6997,7 @@ static int md_seq_show(struct seq_file *seq, void *v) spin_unlock(&pers_lock); seq_printf(seq, "\n"); @@ -33468,7 +33386,7 @@ index 9ee8ce3..362b519 100644 return 0; } if (v == (void*)2) { -@@ -6851,7 +6851,7 @@ static int md_seq_open(struct inode *inode, struct file *file) +@@ -7100,7 +7100,7 @@ static int md_seq_open(struct inode *inode, struct file *file) return error; seq = file->private_data; @@ -33477,7 +33395,7 @@ index 9ee8ce3..362b519 100644 return error; } -@@ -6865,7 +6865,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait) +@@ -7114,7 +7114,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait) /* always allow read */ mask = POLLIN | POLLRDNORM; @@ -33486,7 +33404,7 @@ index 9ee8ce3..362b519 100644 mask |= POLLERR | POLLPRI; return mask; } -@@ -6909,7 +6909,7 @@ static int is_mddev_idle(struct mddev *mddev, int init) +@@ -7158,7 +7158,7 @@ static int is_mddev_idle(struct mddev *mddev, int init) struct gendisk *disk = rdev->bdev->bd_contains->bd_disk; curr_events = (int)part_stat_read(&disk->part0, sectors[0]) + (int)part_stat_read(&disk->part0, sectors[1]) - @@ -33496,10 +33414,10 @@ index 9ee8ce3..362b519 100644 * as sync_io is counted when a request starts, and * disk_stats is counted when it completes. diff --git a/drivers/md/md.h b/drivers/md/md.h -index 1c2063c..9639970 100644 +index 7b4a3c3..994ad4f 100644 --- a/drivers/md/md.h +++ b/drivers/md/md.h -@@ -93,13 +93,13 @@ struct md_rdev { +@@ -94,13 +94,13 @@ struct md_rdev { * only maintained for arrays that * support hot removal */ @@ -33515,7 +33433,7 @@ index 1c2063c..9639970 100644 * for reporting to userspace and storing * in superblock. */ -@@ -429,7 +429,7 @@ static inline void rdev_dec_pending(struct md_rdev *rdev, struct mddev *mddev) +@@ -435,7 +435,7 @@ static inline void rdev_dec_pending(struct md_rdev *rdev, struct mddev *mddev) static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors) { @@ -33576,10 +33494,10 @@ index 1cbfc6b..56e1dbb 100644 /*----------------------------------------------------------------*/ diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index d7add9d..68e3dde 100644 +index cacd008..2823610 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c -@@ -1688,7 +1688,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio) +@@ -1685,7 +1685,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio) if (r1_sync_page_io(rdev, sect, s, bio->bi_io_vec[idx].bv_page, READ) != 0) @@ -33588,7 +33506,7 @@ index d7add9d..68e3dde 100644 } sectors -= s; sect += s; -@@ -1908,7 +1908,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk, +@@ -1907,7 +1907,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk, test_bit(In_sync, &rdev->flags)) { if (r1_sync_page_io(rdev, sect, s, conf->tmppage, READ)) { @@ -33598,10 +33516,10 @@ index d7add9d..68e3dde 100644 "md/raid1:%s: read error corrected " "(%d sectors at %llu on %s)\n", diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index a954c95..6e7a21c 100644 +index 8da6282..8ec7103 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c -@@ -1684,7 +1684,7 @@ static void end_sync_read(struct bio *bio, int error) +@@ -1784,7 +1784,7 @@ static void end_sync_read(struct bio *bio, int error) /* The write handler will notice the lack of * R10BIO_Uptodate and record any errors etc */ @@ -33610,7 +33528,7 @@ index a954c95..6e7a21c 100644 &conf->mirrors[d].rdev->corrected_errors); /* for reconstruct, we always reschedule after a read. -@@ -2033,7 +2033,7 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev) +@@ -2133,7 +2133,7 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev) { struct timespec cur_time_mon; unsigned long hours_since_last; @@ -33619,7 +33537,7 @@ index a954c95..6e7a21c 100644 ktime_get_ts(&cur_time_mon); -@@ -2055,9 +2055,9 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev) +@@ -2155,9 +2155,9 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev) * overflowing the shift of read_errors by hours_since_last. */ if (hours_since_last >= 8 * sizeof(read_errors)) @@ -33631,7 +33549,7 @@ index a954c95..6e7a21c 100644 } static int r10_sync_page_io(struct md_rdev *rdev, sector_t sector, -@@ -2111,8 +2111,8 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10 +@@ -2211,8 +2211,8 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10 return; check_decay_read_errors(mddev, rdev); @@ -33642,7 +33560,7 @@ index a954c95..6e7a21c 100644 char b[BDEVNAME_SIZE]; bdevname(rdev->bdev, b); -@@ -2120,7 +2120,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10 +@@ -2220,7 +2220,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10 "md/raid10:%s: %s: Raid device exceeded " "read_error threshold [cur %d:max %d]\n", mdname(mddev), b, @@ -33651,9 +33569,9 @@ index a954c95..6e7a21c 100644 printk(KERN_NOTICE "md/raid10:%s: %s: Failing raid device\n", mdname(mddev), b); -@@ -2271,7 +2271,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10 - (unsigned long long)( - sect + rdev->data_offset), +@@ -2375,7 +2375,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10 + sect + + choose_data_offset(r10_bio, rdev)), bdevname(rdev->bdev, b)); - atomic_add(s, &rdev->corrected_errors); + atomic_add_unchecked(s, &rdev->corrected_errors); @@ -33661,12 +33579,12 @@ index a954c95..6e7a21c 100644 rdev_dec_pending(rdev, mddev); diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 73a5800..2b0e3b1 100644 +index 04348d7..62a4b9b 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c -@@ -1694,18 +1694,18 @@ static void raid5_end_read_request(struct bio * bi, int error) - (unsigned long long)(sh->sector - + rdev->data_offset), +@@ -1736,19 +1736,19 @@ static void raid5_end_read_request(struct bio * bi, int error) + mdname(conf->mddev), STRIPE_SECTORS, + (unsigned long long)s, bdevname(rdev->bdev, b)); - atomic_add(STRIPE_SECTORS, &rdev->corrected_errors); + atomic_add_unchecked(STRIPE_SECTORS, &rdev->corrected_errors); @@ -33680,6 +33598,7 @@ index 73a5800..2b0e3b1 100644 } else { const char *bdn = bdevname(rdev->bdev, b); int retry = 0; + int set_bad = 0; clear_bit(R5_UPTODATE, &sh->dev[i].flags); - atomic_inc(&rdev->read_errors); @@ -33687,20 +33606,20 @@ index 73a5800..2b0e3b1 100644 if (test_bit(R5_ReadRepl, &sh->dev[i].flags)) printk_ratelimited( KERN_WARNING -@@ -1734,7 +1734,7 @@ static void raid5_end_read_request(struct bio * bi, int error) - (unsigned long long)(sh->sector - + rdev->data_offset), +@@ -1776,7 +1776,7 @@ static void raid5_end_read_request(struct bio * bi, int error) + mdname(conf->mddev), + (unsigned long long)s, bdn); -- else if (atomic_read(&rdev->read_errors) -+ else if (atomic_read_unchecked(&rdev->read_errors) +- } else if (atomic_read(&rdev->read_errors) ++ } else if (atomic_read_unchecked(&rdev->read_errors) > conf->max_nr_stripes) printk(KERN_WARNING "md/raid:%s: Too many read errors, failing device %s.\n", diff --git a/drivers/media/dvb/ddbridge/ddbridge-core.c b/drivers/media/dvb/ddbridge/ddbridge-core.c -index d88c4aa..17c80b1 100644 +index 131b938..8572ed1 100644 --- a/drivers/media/dvb/ddbridge/ddbridge-core.c +++ b/drivers/media/dvb/ddbridge/ddbridge-core.c -@@ -1679,7 +1679,7 @@ static struct ddb_info ddb_v6 = { +@@ -1678,7 +1678,7 @@ static struct ddb_info ddb_v6 = { .subvendor = _subvend, .subdevice = _subdev, \ .driver_data = (unsigned long)&_driverdata } @@ -33710,7 +33629,7 @@ index d88c4aa..17c80b1 100644 DDB_ID(DDVID, 0x0003, DDVID, 0x0001, ddb_octopus), DDB_ID(DDVID, 0x0003, DDVID, 0x0002, ddb_octopus_le), diff --git a/drivers/media/dvb/dvb-core/dvb_demux.h b/drivers/media/dvb/dvb-core/dvb_demux.h -index a7d876f..8c21b61 100644 +index fa7188a..04a045e 100644 --- a/drivers/media/dvb/dvb-core/dvb_demux.h +++ b/drivers/media/dvb/dvb-core/dvb_demux.h @@ -73,7 +73,7 @@ struct dvb_demux_feed { @@ -33735,6 +33654,19 @@ index 39eab73..60033e7 100644 struct device *clsdev; int minor; int id; +diff --git a/drivers/media/dvb/dvb-usb/az6007.c b/drivers/media/dvb/dvb-usb/az6007.c +index 4008b9c..ce714f5 100644 +--- a/drivers/media/dvb/dvb-usb/az6007.c ++++ b/drivers/media/dvb/dvb-usb/az6007.c +@@ -590,7 +590,7 @@ static int az6007_read_mac_addr(struct dvb_usb_device *d, u8 mac[6]) + int ret; + + ret = az6007_read(d, AZ6007_READ_DATA, 6, 0, st->data, 6); +- memcpy(mac, st->data, sizeof(mac)); ++ memcpy(mac, st->data, 6); + + if (ret > 0) + deb_info("%s: mac is %02x:%02x:%02x:%02x:%02x:%02x\n", diff --git a/drivers/media/dvb/dvb-usb/cxusb.c b/drivers/media/dvb/dvb-usb/cxusb.c index 3940bb0..fb3952a 100644 --- a/drivers/media/dvb/dvb-usb/cxusb.c @@ -33749,7 +33681,7 @@ index 3940bb0..fb3952a 100644 static int dib7070_set_param_override(struct dvb_frontend *fe) { diff --git a/drivers/media/dvb/dvb-usb/dw2102.c b/drivers/media/dvb/dvb-usb/dw2102.c -index 451c5a7..649f711 100644 +index 9382895..ac8093c 100644 --- a/drivers/media/dvb/dvb-usb/dw2102.c +++ b/drivers/media/dvb/dvb-usb/dw2102.c @@ -95,7 +95,7 @@ struct su3000_state { @@ -33822,33 +33754,6 @@ index 9cde353..8c6a1c3 100644 struct i2c_client i2c_client; u32 i2c_rc; -diff --git a/drivers/media/video/cx25821/cx25821-core.c b/drivers/media/video/cx25821/cx25821-core.c -index 7930ca5..235bf7d 100644 ---- a/drivers/media/video/cx25821/cx25821-core.c -+++ b/drivers/media/video/cx25821/cx25821-core.c -@@ -912,9 +912,6 @@ static int cx25821_dev_setup(struct cx25821_dev *dev) - list_add_tail(&dev->devlist, &cx25821_devlist); - mutex_unlock(&cx25821_devlist_mutex); - -- strcpy(cx25821_boards[UNKNOWN_BOARD].name, "unknown"); -- strcpy(cx25821_boards[CX25821_BOARD].name, "cx25821"); -- - if (dev->pci->device != 0x8210) { - pr_info("%s(): Exiting. Incorrect Hardware device = 0x%02x\n", - __func__, dev->pci->device); -diff --git a/drivers/media/video/cx25821/cx25821.h b/drivers/media/video/cx25821/cx25821.h -index b9aa801..029f293 100644 ---- a/drivers/media/video/cx25821/cx25821.h -+++ b/drivers/media/video/cx25821/cx25821.h -@@ -187,7 +187,7 @@ enum port { - }; - - struct cx25821_board { -- char *name; -+ const char *name; - enum port porta; - enum port portb; - enum port portc; diff --git a/drivers/media/video/cx88/cx88-alsa.c b/drivers/media/video/cx88/cx88-alsa.c index 04bf662..e0ac026 100644 --- a/drivers/media/video/cx88/cx88-alsa.c @@ -33899,7 +33804,7 @@ index 88cf9d9..bbc4b2c 100644 videobuf_queue_dma_contig_init(q, &video_vbq_ops, q->dev, diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h -index 305e6aa..0143317 100644 +index 036952f..80d356d 100644 --- a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h +++ b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h @@ -196,7 +196,7 @@ struct pvr2_hdw { @@ -33934,10 +33839,10 @@ index 02194c0..091733b 100644 .open = timblogiw_open, .release = timblogiw_close, diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c -index a5c591f..db692a3 100644 +index d99db56..a16b959 100644 --- a/drivers/message/fusion/mptbase.c +++ b/drivers/message/fusion/mptbase.c -@@ -6754,8 +6754,13 @@ static int mpt_iocinfo_proc_show(struct seq_file *m, void *v) +@@ -6751,8 +6751,13 @@ static int mpt_iocinfo_proc_show(struct seq_file *m, void *v) seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth); seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize); @@ -34033,7 +33938,7 @@ index 0c3ced7..1fe34ec 100644 return h->info_kbuf; } diff --git a/drivers/message/i2o/i2o_proc.c b/drivers/message/i2o/i2o_proc.c -index 6d115c7..58ff7fd 100644 +index 506c36f..b137580 100644 --- a/drivers/message/i2o/i2o_proc.c +++ b/drivers/message/i2o/i2o_proc.c @@ -255,13 +255,6 @@ static char *scsi_devices[] = { @@ -34050,7 +33955,7 @@ index 6d115c7..58ff7fd 100644 static int i2o_report_query_status(struct seq_file *seq, int block_status, char *group) { -@@ -838,8 +831,7 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v) +@@ -825,8 +818,7 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v) seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id); seq_printf(seq, "%-#8x", ddm_table.module_id); @@ -34060,7 +33965,7 @@ index 6d115c7..58ff7fd 100644 seq_printf(seq, "%9d ", ddm_table.data_size); seq_printf(seq, "%8d", ddm_table.code_size); -@@ -940,8 +932,8 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v) +@@ -927,8 +919,8 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v) seq_printf(seq, "%-#7x", dst->i2o_vendor_id); seq_printf(seq, "%-#8x", dst->module_id); @@ -34071,7 +33976,7 @@ index 6d115c7..58ff7fd 100644 seq_printf(seq, "%8d ", dst->module_size); seq_printf(seq, "%8d ", dst->mpb_size); seq_printf(seq, "0x%04x", dst->module_flags); -@@ -1272,14 +1264,10 @@ static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v) +@@ -1259,14 +1251,10 @@ static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v) seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0])); seq_printf(seq, "Owner TID : %0#5x\n", work16[2]); seq_printf(seq, "Parent TID : %0#5x\n", work16[3]); @@ -34090,7 +33995,7 @@ index 6d115c7..58ff7fd 100644 seq_printf(seq, "Serial number : "); print_serial_number(seq, (u8 *) (work32 + 16), -@@ -1324,10 +1312,8 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v) +@@ -1311,10 +1299,8 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v) } seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid); @@ -34103,7 +34008,7 @@ index 6d115c7..58ff7fd 100644 seq_printf(seq, "Serial number : "); print_serial_number(seq, result.serial_number, sizeof(result) - 36); -@@ -1358,14 +1344,10 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v) +@@ -1345,14 +1331,10 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v) return 0; } @@ -34163,7 +34068,7 @@ index 7ce65f4..e66e9bc 100644 }; diff --git a/drivers/mfd/janz-cmodio.c b/drivers/mfd/janz-cmodio.c -index a9223ed..4127b13 100644 +index 2ea9998..51dabee 100644 --- a/drivers/mfd/janz-cmodio.c +++ b/drivers/mfd/janz-cmodio.c @@ -13,6 +13,7 @@ @@ -34553,7 +34458,7 @@ index a4eb8b5..8c0628f 100644 "ECC needs a full sector write (adr: %lx size %lx)\n", (long) to, (long) len); diff --git a/drivers/mtd/nand/denali.c b/drivers/mtd/nand/denali.c -index a9e57d6..c6d8731 100644 +index 0650aaf..7718762 100644 --- a/drivers/mtd/nand/denali.c +++ b/drivers/mtd/nand/denali.c @@ -26,6 +26,7 @@ @@ -34590,10 +34495,10 @@ index 6762dc4..9956862 100644 MODULE_PARM_DESC(X, desc); #else diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h -index 61a7670..7da6e34 100644 +index efd80bd..21fcff0 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h -@@ -483,7 +483,7 @@ struct bnx2x_rx_mode_obj { +@@ -487,7 +487,7 @@ struct bnx2x_rx_mode_obj { int (*wait_comp)(struct bnx2x *bp, struct bnx2x_rx_mode_ramrod_params *p); @@ -34628,7 +34533,7 @@ index c4e8643..0979484 100644 #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb) diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c -index 18b106c..2b38d36 100644 +index d3cd489..0fd52dd 100644 --- a/drivers/net/ethernet/dec/tulip/de4x5.c +++ b/drivers/net/ethernet/dec/tulip/de4x5.c @@ -5388,7 +5388,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) @@ -34662,8 +34567,21 @@ index ed7d1dc..d426748 100644 "21140 non-MII", "21140 MII PHY", "21142 Serial PHY", +diff --git a/drivers/net/ethernet/dec/tulip/uli526x.c b/drivers/net/ethernet/dec/tulip/uli526x.c +index 75d45f8..3d9c55b 100644 +--- a/drivers/net/ethernet/dec/tulip/uli526x.c ++++ b/drivers/net/ethernet/dec/tulip/uli526x.c +@@ -129,7 +129,7 @@ struct uli526x_board_info { + struct uli_phy_ops { + void (*write)(struct uli526x_board_info *, u8, u8, u16); + u16 (*read)(struct uli526x_board_info *, u8, u8); +- } phy; ++ } __no_const phy; + struct net_device *next_dev; /* next device */ + struct pci_dev *pdev; /* PCI device */ + spinlock_t lock; diff --git a/drivers/net/ethernet/dec/tulip/winbond-840.c b/drivers/net/ethernet/dec/tulip/winbond-840.c -index 2ac6fff..2d127d0 100644 +index 4d1ffca..7c1ec4d 100644 --- a/drivers/net/ethernet/dec/tulip/winbond-840.c +++ b/drivers/net/ethernet/dec/tulip/winbond-840.c @@ -236,7 +236,7 @@ struct pci_id_info { @@ -34676,7 +34594,7 @@ index 2ac6fff..2d127d0 100644 "Winbond W89c840", CanHaveMII | HasBrokenTx | FDXOnNoMII}, { "Winbond W89c840", CanHaveMII | HasBrokenTx}, diff --git a/drivers/net/ethernet/dlink/sundance.c b/drivers/net/ethernet/dlink/sundance.c -index d783f4f..97fa1b0 100644 +index d7bb52a..3b83588 100644 --- a/drivers/net/ethernet/dlink/sundance.c +++ b/drivers/net/ethernet/dlink/sundance.c @@ -218,7 +218,7 @@ enum { @@ -34689,7 +34607,7 @@ index d783f4f..97fa1b0 100644 {"D-Link DFE-550FX 100Mbps Fiber-optics Adapter"}, {"D-Link DFE-580TX 4 port Server Adapter"}, diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c -index 1bbf6b3..430dcd0 100644 +index 501dfa9..aa9ec11 100644 --- a/drivers/net/ethernet/emulex/benet/be_main.c +++ b/drivers/net/ethernet/emulex/benet/be_main.c @@ -403,7 +403,7 @@ static void accumulate_16bit_val(u32 *acc, u16 val) @@ -34728,7 +34646,7 @@ index 829b109..4ae5f6a 100644 #include "ftmac100.h" diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c -index 1637b98..c42f87b 100644 +index 9d71c9c..0e4a0ac 100644 --- a/drivers/net/ethernet/fealnx.c +++ b/drivers/net/ethernet/fealnx.c @@ -150,7 +150,7 @@ struct chip_info { @@ -34741,7 +34659,7 @@ index 1637b98..c42f87b 100644 { "100/10M Ethernet PCI Adapter", HAS_CHIP_XCVR }, { "1000/100/10M Ethernet PCI Adapter", HAS_MII_XCVR }, diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h -index b83897f..b2d970f 100644 +index 6e6fffb..588f361 100644 --- a/drivers/net/ethernet/intel/e1000e/e1000.h +++ b/drivers/net/ethernet/intel/e1000e/e1000.h @@ -181,7 +181,7 @@ struct e1000_info; @@ -34754,18 +34672,18 @@ index b83897f..b2d970f 100644 0x1f) /* pthresh */ diff --git a/drivers/net/ethernet/intel/e1000e/hw.h b/drivers/net/ethernet/intel/e1000e/hw.h -index f82ecf5..7d59ecb 100644 +index ed5b409..ec37828 100644 --- a/drivers/net/ethernet/intel/e1000e/hw.h +++ b/drivers/net/ethernet/intel/e1000e/hw.h -@@ -784,6 +784,7 @@ struct e1000_mac_operations { - void (*config_collision_dist)(struct e1000_hw *); +@@ -797,6 +797,7 @@ struct e1000_mac_operations { + void (*rar_set)(struct e1000_hw *, u8 *, u32); s32 (*read_mac_addr)(struct e1000_hw *); }; +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const; /* * When to use various PHY register access functions: -@@ -824,6 +825,7 @@ struct e1000_phy_operations { +@@ -837,6 +838,7 @@ struct e1000_phy_operations { void (*power_up)(struct e1000_hw *); void (*power_down)(struct e1000_hw *); }; @@ -34773,7 +34691,7 @@ index f82ecf5..7d59ecb 100644 /* Function pointers for the NVM. */ struct e1000_nvm_operations { -@@ -836,9 +838,10 @@ struct e1000_nvm_operations { +@@ -849,9 +851,10 @@ struct e1000_nvm_operations { s32 (*validate)(struct e1000_hw *); s32 (*write)(struct e1000_hw *, u16, u16, u16 *); }; @@ -34785,7 +34703,7 @@ index f82ecf5..7d59ecb 100644 u8 addr[ETH_ALEN]; u8 perm_addr[ETH_ALEN]; -@@ -879,7 +882,7 @@ struct e1000_mac_info { +@@ -892,7 +895,7 @@ struct e1000_mac_info { }; struct e1000_phy_info { @@ -34794,7 +34712,7 @@ index f82ecf5..7d59ecb 100644 enum e1000_phy_type type; -@@ -913,7 +916,7 @@ struct e1000_phy_info { +@@ -926,7 +929,7 @@ struct e1000_phy_info { }; struct e1000_nvm_info { @@ -34804,18 +34722,18 @@ index f82ecf5..7d59ecb 100644 enum e1000_nvm_type type; enum e1000_nvm_override override; diff --git a/drivers/net/ethernet/intel/igb/e1000_hw.h b/drivers/net/ethernet/intel/igb/e1000_hw.h -index f67cbd3..cef9e3d 100644 +index c2a51dc..c2bd262 100644 --- a/drivers/net/ethernet/intel/igb/e1000_hw.h +++ b/drivers/net/ethernet/intel/igb/e1000_hw.h -@@ -314,6 +314,7 @@ struct e1000_mac_operations { - s32 (*read_mac_addr)(struct e1000_hw *); - s32 (*get_speed_and_duplex)(struct e1000_hw *, u16 *, u16 *); +@@ -327,6 +327,7 @@ struct e1000_mac_operations { + void (*release_swfw_sync)(struct e1000_hw *, u16); + }; +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const; struct e1000_phy_operations { s32 (*acquire)(struct e1000_hw *); -@@ -330,6 +331,7 @@ struct e1000_phy_operations { +@@ -343,6 +344,7 @@ struct e1000_phy_operations { s32 (*set_d3_lplu_state)(struct e1000_hw *, bool); s32 (*write_reg)(struct e1000_hw *, u32, u16); }; @@ -34823,15 +34741,15 @@ index f67cbd3..cef9e3d 100644 struct e1000_nvm_operations { s32 (*acquire)(struct e1000_hw *); -@@ -339,6 +341,7 @@ struct e1000_nvm_operations { - s32 (*update)(struct e1000_hw *); +@@ -353,6 +355,7 @@ struct e1000_nvm_operations { s32 (*validate)(struct e1000_hw *); + s32 (*valid_led_default)(struct e1000_hw *, u16 *); }; +typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const; struct e1000_info { s32 (*get_invariants)(struct e1000_hw *); -@@ -350,7 +353,7 @@ struct e1000_info { +@@ -364,7 +367,7 @@ struct e1000_info { extern const struct e1000_info e1000_82575_info; struct e1000_mac_info { @@ -34840,7 +34758,7 @@ index f67cbd3..cef9e3d 100644 u8 addr[6]; u8 perm_addr[6]; -@@ -388,7 +391,7 @@ struct e1000_mac_info { +@@ -402,7 +405,7 @@ struct e1000_mac_info { }; struct e1000_phy_info { @@ -34849,7 +34767,7 @@ index f67cbd3..cef9e3d 100644 enum e1000_phy_type type; -@@ -423,7 +426,7 @@ struct e1000_phy_info { +@@ -437,7 +440,7 @@ struct e1000_phy_info { }; struct e1000_nvm_info { @@ -34858,7 +34776,7 @@ index f67cbd3..cef9e3d 100644 enum e1000_nvm_type type; enum e1000_nvm_override override; -@@ -468,6 +471,7 @@ struct e1000_mbx_operations { +@@ -482,6 +485,7 @@ struct e1000_mbx_operations { s32 (*check_for_ack)(struct e1000_hw *, u16); s32 (*check_for_rst)(struct e1000_hw *, u16); }; @@ -34866,7 +34784,7 @@ index f67cbd3..cef9e3d 100644 struct e1000_mbx_stats { u32 msgs_tx; -@@ -479,7 +483,7 @@ struct e1000_mbx_stats { +@@ -493,7 +497,7 @@ struct e1000_mbx_stats { }; struct e1000_mbx_info { @@ -34908,11 +34826,24 @@ index 57db3c6..aa825fc 100644 struct e1000_mbx_stats stats; u32 timeout; u32 usec_delay; +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c +index dcebd12..c1fe8be 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c +@@ -805,7 +805,7 @@ void ixgbe_ptp_start_cyclecounter(struct ixgbe_adapter *adapter) + /* store the new cycle speed */ + adapter->cycle_speed = cycle_speed; + +- ACCESS_ONCE(adapter->base_incval) = incval; ++ ACCESS_ONCE_RW(adapter->base_incval) = incval; + smp_mb(); + + /* grab the ptp lock */ diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h -index 8636e83..ab9bbc3 100644 +index 204848d..d8aeaec 100644 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h -@@ -2710,6 +2710,7 @@ struct ixgbe_eeprom_operations { +@@ -2791,6 +2791,7 @@ struct ixgbe_eeprom_operations { s32 (*update_checksum)(struct ixgbe_hw *); u16 (*calc_checksum)(struct ixgbe_hw *); }; @@ -34920,15 +34851,15 @@ index 8636e83..ab9bbc3 100644 struct ixgbe_mac_operations { s32 (*init_hw)(struct ixgbe_hw *); -@@ -2773,6 +2774,7 @@ struct ixgbe_mac_operations { - /* Manageability interface */ - s32 (*set_fw_drv_ver)(struct ixgbe_hw *, u8, u8, u8, u8); +@@ -2856,6 +2857,7 @@ struct ixgbe_mac_operations { + s32 (*get_thermal_sensor_data)(struct ixgbe_hw *); + s32 (*init_thermal_sensor_thresh)(struct ixgbe_hw *hw); }; +typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const; struct ixgbe_phy_operations { s32 (*identify)(struct ixgbe_hw *); -@@ -2792,9 +2794,10 @@ struct ixgbe_phy_operations { +@@ -2875,9 +2877,10 @@ struct ixgbe_phy_operations { s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8); s32 (*check_overtemp)(struct ixgbe_hw *); }; @@ -34940,7 +34871,7 @@ index 8636e83..ab9bbc3 100644 enum ixgbe_eeprom_type type; u32 semaphore_delay; u16 word_size; -@@ -2804,7 +2807,7 @@ struct ixgbe_eeprom_info { +@@ -2887,7 +2890,7 @@ struct ixgbe_eeprom_info { #define IXGBE_FLAGS_DOUBLE_RESET_REQUIRED 0x01 struct ixgbe_mac_info { @@ -34949,7 +34880,7 @@ index 8636e83..ab9bbc3 100644 enum ixgbe_mac_type type; u8 addr[ETH_ALEN]; u8 perm_addr[ETH_ALEN]; -@@ -2832,7 +2835,7 @@ struct ixgbe_mac_info { +@@ -2916,7 +2919,7 @@ struct ixgbe_mac_info { }; struct ixgbe_phy_info { @@ -34958,7 +34889,7 @@ index 8636e83..ab9bbc3 100644 struct mdio_if_info mdio; enum ixgbe_phy_type type; u32 id; -@@ -2860,6 +2863,7 @@ struct ixgbe_mbx_operations { +@@ -2944,6 +2947,7 @@ struct ixgbe_mbx_operations { s32 (*check_for_ack)(struct ixgbe_hw *, u16); s32 (*check_for_rst)(struct ixgbe_hw *, u16); }; @@ -34966,7 +34897,7 @@ index 8636e83..ab9bbc3 100644 struct ixgbe_mbx_stats { u32 msgs_tx; -@@ -2871,7 +2875,7 @@ struct ixgbe_mbx_stats { +@@ -2955,7 +2959,7 @@ struct ixgbe_mbx_stats { }; struct ixgbe_mbx_info { @@ -34975,36 +34906,6 @@ index 8636e83..ab9bbc3 100644 struct ixgbe_mbx_stats stats; u32 timeout; u32 usec_delay; -diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -index 307611a..d8e4562 100644 ---- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -@@ -969,8 +969,6 @@ static irqreturn_t ixgbevf_msix_clean_tx(int irq, void *data) - r_idx = find_first_bit(q_vector->txr_idx, adapter->num_tx_queues); - for (i = 0; i < q_vector->txr_count; i++) { - tx_ring = &(adapter->tx_ring[r_idx]); -- tx_ring->total_bytes = 0; -- tx_ring->total_packets = 0; - ixgbevf_clean_tx_irq(adapter, tx_ring); - r_idx = find_next_bit(q_vector->txr_idx, adapter->num_tx_queues, - r_idx + 1); -@@ -994,16 +992,6 @@ static irqreturn_t ixgbevf_msix_clean_rx(int irq, void *data) - struct ixgbe_hw *hw = &adapter->hw; - struct ixgbevf_ring *rx_ring; - int r_idx; -- int i; -- -- r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues); -- for (i = 0; i < q_vector->rxr_count; i++) { -- rx_ring = &(adapter->rx_ring[r_idx]); -- rx_ring->total_bytes = 0; -- rx_ring->total_packets = 0; -- r_idx = find_next_bit(q_vector->rxr_idx, adapter->num_rx_queues, -- r_idx + 1); -- } - - if (!q_vector->rxr_count) - return IRQ_HANDLED; diff --git a/drivers/net/ethernet/intel/ixgbevf/vf.h b/drivers/net/ethernet/intel/ixgbevf/vf.h index 25c951d..cc7cf33 100644 --- a/drivers/net/ethernet/intel/ixgbevf/vf.h @@ -35044,7 +34945,7 @@ index 25c951d..cc7cf33 100644 u32 timeout; u32 udelay; diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c -index 8bb05b4..074796f 100644 +index a0313de..e83a572 100644 --- a/drivers/net/ethernet/mellanox/mlx4/main.c +++ b/drivers/net/ethernet/mellanox/mlx4/main.c @@ -41,6 +41,7 @@ @@ -35082,10 +34983,10 @@ index 4a518a3..936b334 100644 #define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath) \ ((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next) diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c -index 161e045..0bb5b86 100644 +index d7a04e0..76d0431 100644 --- a/drivers/net/ethernet/realtek/r8169.c +++ b/drivers/net/ethernet/realtek/r8169.c -@@ -708,17 +708,17 @@ struct rtl8169_private { +@@ -723,22 +723,22 @@ struct rtl8169_private { struct mdio_ops { void (*write)(void __iomem *, int, int); int (*read)(void __iomem *, int); @@ -35104,13 +35005,19 @@ index 161e045..0bb5b86 100644 - } jumbo_ops; + } __no_const jumbo_ops; + struct csi_ops { + void (*write)(void __iomem *, int, int); + u32 (*read)(void __iomem *, int); +- } csi_ops; ++ } __no_const csi_ops; + int (*set_speed)(struct net_device *, u8 aneg, u16 sp, u8 dpx, u32 adv); int (*get_settings)(struct net_device *, struct ethtool_cmd *); diff --git a/drivers/net/ethernet/sis/sis190.c b/drivers/net/ethernet/sis/sis190.c -index a9deda8..5507c31 100644 +index 4613591..d816601 100644 --- a/drivers/net/ethernet/sis/sis190.c +++ b/drivers/net/ethernet/sis/sis190.c -@@ -1620,7 +1620,7 @@ static int __devinit sis190_get_mac_addr_from_eeprom(struct pci_dev *pdev, +@@ -1618,7 +1618,7 @@ static int __devinit sis190_get_mac_addr_from_eeprom(struct pci_dev *pdev, static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev, struct net_device *dev) { @@ -35134,33 +35041,11 @@ index c07cfe9..81cbf7e 100644 } /* To mask all all interrupts.*/ -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 9bdfaba..3d8f8d4 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -1587,7 +1587,7 @@ static const struct file_operations stmmac_rings_status_fops = { - .open = stmmac_sysfs_ring_open, - .read = seq_read, - .llseek = seq_lseek, -- .release = seq_release, -+ .release = single_release, - }; - - static int stmmac_sysfs_dma_cap_read(struct seq_file *seq, void *v) -@@ -1659,7 +1659,7 @@ static const struct file_operations stmmac_dma_cap_fops = { - .open = stmmac_sysfs_dma_cap_open, - .read = seq_read, - .llseek = seq_lseek, -- .release = seq_release, -+ .release = single_release, - }; - - static int stmmac_init_fs(struct net_device *dev) diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h -index c358245..8c1de63 100644 +index 2857ab0..9a1f9b0 100644 --- a/drivers/net/hyperv/hyperv_net.h +++ b/drivers/net/hyperv/hyperv_net.h -@@ -98,7 +98,7 @@ struct rndis_device { +@@ -99,7 +99,7 @@ struct rndis_device { enum rndis_device_state state; bool link_state; @@ -35170,7 +35055,7 @@ index c358245..8c1de63 100644 spinlock_t request_lock; struct list_head req_list; diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c -index d6be64b..5d97e3b 100644 +index 981ebb1..b34959b 100644 --- a/drivers/net/hyperv/rndis_filter.c +++ b/drivers/net/hyperv/rndis_filter.c @@ -97,7 +97,7 @@ static struct rndis_request *get_rndis_request(struct rndis_device *dev, @@ -35192,7 +35077,7 @@ index d6be64b..5d97e3b 100644 /* Ignore return since this msg is optional. */ rndis_filter_send_request(dev, request); diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c -index 21d7151..8034208 100644 +index 5c05572..389610b 100644 --- a/drivers/net/ppp/ppp_generic.c +++ b/drivers/net/ppp/ppp_generic.c @@ -986,7 +986,6 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) @@ -35213,85 +35098,8 @@ index 21d7151..8034208 100644 break; err = 0; break; -diff --git a/drivers/net/tokenring/abyss.c b/drivers/net/tokenring/abyss.c -index b715e6b..6d2490f 100644 ---- a/drivers/net/tokenring/abyss.c -+++ b/drivers/net/tokenring/abyss.c -@@ -450,10 +450,12 @@ static struct pci_driver abyss_driver = { - - static int __init abyss_init (void) - { -- abyss_netdev_ops = tms380tr_netdev_ops; -+ pax_open_kernel(); -+ memcpy((void *)&abyss_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops)); - -- abyss_netdev_ops.ndo_open = abyss_open; -- abyss_netdev_ops.ndo_stop = abyss_close; -+ *(void **)&abyss_netdev_ops.ndo_open = abyss_open; -+ *(void **)&abyss_netdev_ops.ndo_stop = abyss_close; -+ pax_close_kernel(); - - return pci_register_driver(&abyss_driver); - } -diff --git a/drivers/net/tokenring/madgemc.c b/drivers/net/tokenring/madgemc.c -index 28adcdf..ae82f35 100644 ---- a/drivers/net/tokenring/madgemc.c -+++ b/drivers/net/tokenring/madgemc.c -@@ -742,9 +742,11 @@ static struct mca_driver madgemc_driver = { - - static int __init madgemc_init (void) - { -- madgemc_netdev_ops = tms380tr_netdev_ops; -- madgemc_netdev_ops.ndo_open = madgemc_open; -- madgemc_netdev_ops.ndo_stop = madgemc_close; -+ pax_open_kernel(); -+ memcpy((void *)&madgemc_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops)); -+ *(void **)&madgemc_netdev_ops.ndo_open = madgemc_open; -+ *(void **)&madgemc_netdev_ops.ndo_stop = madgemc_close; -+ pax_close_kernel(); - - return mca_register_driver (&madgemc_driver); - } -diff --git a/drivers/net/tokenring/proteon.c b/drivers/net/tokenring/proteon.c -index 62d90e4..9d84237 100644 ---- a/drivers/net/tokenring/proteon.c -+++ b/drivers/net/tokenring/proteon.c -@@ -352,9 +352,11 @@ static int __init proteon_init(void) - struct platform_device *pdev; - int i, num = 0, err = 0; - -- proteon_netdev_ops = tms380tr_netdev_ops; -- proteon_netdev_ops.ndo_open = proteon_open; -- proteon_netdev_ops.ndo_stop = tms380tr_close; -+ pax_open_kernel(); -+ memcpy((void *)&proteon_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops)); -+ *(void **)&proteon_netdev_ops.ndo_open = proteon_open; -+ *(void **)&proteon_netdev_ops.ndo_stop = tms380tr_close; -+ pax_close_kernel(); - - err = platform_driver_register(&proteon_driver); - if (err) -diff --git a/drivers/net/tokenring/skisa.c b/drivers/net/tokenring/skisa.c -index ee11e93..c8f19c7 100644 ---- a/drivers/net/tokenring/skisa.c -+++ b/drivers/net/tokenring/skisa.c -@@ -362,9 +362,11 @@ static int __init sk_isa_init(void) - struct platform_device *pdev; - int i, num = 0, err = 0; - -- sk_isa_netdev_ops = tms380tr_netdev_ops; -- sk_isa_netdev_ops.ndo_open = sk_isa_open; -- sk_isa_netdev_ops.ndo_stop = tms380tr_close; -+ pax_open_kernel(); -+ memcpy((void *)&sk_isa_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops)); -+ *(void **)&sk_isa_netdev_ops.ndo_open = sk_isa_open; -+ *(void **)&sk_isa_netdev_ops.ndo_stop = tms380tr_close; -+ pax_close_kernel(); - - err = platform_driver_register(&sk_isa_driver); - if (err) diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c -index 2d2a688..35f2372 100644 +index 62f30b4..ff99dfd 100644 --- a/drivers/net/usb/hso.c +++ b/drivers/net/usb/hso.c @@ -71,7 +71,7 @@ @@ -35303,90 +35111,81 @@ index 2d2a688..35f2372 100644 #define MOD_AUTHOR "Option Wireless" #define MOD_DESCRIPTION "USB High Speed Option driver" -@@ -257,7 +257,7 @@ struct hso_serial { - - /* from usb_serial_port */ - struct tty_struct *tty; -- int open_count; -+ local_t open_count; - spinlock_t serial_lock; - - int (*write_data) (struct hso_serial *serial); -@@ -1190,7 +1190,7 @@ static void put_rxbuf_data_and_resubmit_ctrl_urb(struct hso_serial *serial) +@@ -1182,7 +1182,7 @@ static void put_rxbuf_data_and_resubmit_ctrl_urb(struct hso_serial *serial) struct urb *urb; urb = serial->rx_urb[0]; -- if (serial->open_count > 0) { -+ if (local_read(&serial->open_count) > 0) { +- if (serial->port.count > 0) { ++ if (atomic_read(&serial->port.count) > 0) { count = put_rxbuf_data(urb, serial); if (count == -1) return; -@@ -1226,7 +1226,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb) +@@ -1218,7 +1218,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb) DUMP1(urb->transfer_buffer, urb->actual_length); /* Anyone listening? */ -- if (serial->open_count == 0) -+ if (local_read(&serial->open_count) == 0) +- if (serial->port.count == 0) ++ if (atomic_read(&serial->port.count) == 0) return; if (status == 0) { -@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp) - spin_unlock_irq(&serial->serial_lock); +@@ -1300,8 +1300,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp) + tty_port_tty_set(&serial->port, tty); /* check for port already opened, if not set the termios */ -- serial->open_count++; -- if (serial->open_count == 1) { -+ if (local_inc_return(&serial->open_count) == 1) { +- serial->port.count++; +- if (serial->port.count == 1) { ++ if (atomic_inc_return(&serial->port.count) == 1) { serial->rx_state = RX_IDLE; /* Force default termio settings */ _hso_serial_set_termios(tty, NULL); -@@ -1324,7 +1323,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp) +@@ -1313,7 +1312,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp) result = hso_start_serial_device(serial->parent, GFP_KERNEL); if (result) { hso_stop_serial_device(serial->parent); -- serial->open_count--; -+ local_dec(&serial->open_count); +- serial->port.count--; ++ atomic_dec(&serial->port.count); kref_put(&serial->parent->ref, hso_serial_ref_free); } } else { -@@ -1361,10 +1360,10 @@ static void hso_serial_close(struct tty_struct *tty, struct file *filp) +@@ -1350,10 +1349,10 @@ static void hso_serial_close(struct tty_struct *tty, struct file *filp) /* reset the rts and dtr */ /* do the actual close */ -- serial->open_count--; -+ local_dec(&serial->open_count); - -- if (serial->open_count <= 0) { -- serial->open_count = 0; -+ if (local_read(&serial->open_count) <= 0) { -+ local_set(&serial->open_count, 0); - spin_lock_irq(&serial->serial_lock); - if (serial->tty == tty) { - serial->tty->driver_data = NULL; -@@ -1446,7 +1445,7 @@ static void hso_serial_set_termios(struct tty_struct *tty, struct ktermios *old) +- serial->port.count--; ++ atomic_dec(&serial->port.count); + +- if (serial->port.count <= 0) { +- serial->port.count = 0; ++ if (atomic_read(&serial->port.count) <= 0) { ++ atomic_set(&serial->port.count, 0); + tty_port_tty_set(&serial->port, NULL); + if (!usb_gone) + hso_stop_serial_device(serial->parent); +@@ -1429,7 +1428,7 @@ static void hso_serial_set_termios(struct tty_struct *tty, struct ktermios *old) /* the actual setup */ spin_lock_irqsave(&serial->serial_lock, flags); -- if (serial->open_count) -+ if (local_read(&serial->open_count)) +- if (serial->port.count) ++ if (atomic_read(&serial->port.count)) _hso_serial_set_termios(tty, old); else tty->termios = old; -@@ -1905,7 +1904,7 @@ static void intr_callback(struct urb *urb) +@@ -1888,7 +1887,7 @@ static void intr_callback(struct urb *urb) D1("Pending read interrupt on port %d\n", i); spin_lock(&serial->serial_lock); if (serial->rx_state == RX_IDLE && -- serial->open_count > 0) { -+ local_read(&serial->open_count) > 0) { +- serial->port.count > 0) { ++ atomic_read(&serial->port.count) > 0) { /* Setup and send a ctrl req read on * port i */ if (!serial->rx_urb_filled[0]) { -@@ -3098,7 +3097,7 @@ static int hso_resume(struct usb_interface *iface) +@@ -3079,7 +3078,7 @@ static int hso_resume(struct usb_interface *iface) /* Start all serial ports */ for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) { if (serial_table[i] && (serial_table[i]->interface == iface)) { -- if (dev2ser(serial_table[i])->open_count) { -+ if (local_read(&dev2ser(serial_table[i])->open_count)) { +- if (dev2ser(serial_table[i])->port.count) { ++ if (atomic_read(&dev2ser(serial_table[i])->port.count)) { result = hso_start_serial_device(serial_table[i], GFP_NOIO); hso_kick_transmit(dev2ser(serial_table[i])); @@ -35403,10 +35202,10 @@ index 420d69b..74f90a2 100644 struct ath_common; struct ath_bus_ops; diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c -index aa2abaf..5f5152d 100644 +index 8d78253..bebbb68 100644 --- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c +++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c -@@ -183,8 +183,8 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i) +@@ -184,8 +184,8 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i) ads->ds_txstatus6 = ads->ds_txstatus7 = 0; ads->ds_txstatus8 = ads->ds_txstatus9 = 0; @@ -35417,7 +35216,7 @@ index aa2abaf..5f5152d 100644 ctl1 = i->buf_len[0] | (i->is_last ? 0 : AR_TxMore); ctl6 = SM(i->keytype, AR_EncrType); -@@ -198,26 +198,26 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i) +@@ -199,26 +199,26 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i) if ((i->is_first || i->is_last) && i->aggr != AGGR_BUF_MIDDLE && i->aggr != AGGR_BUF_LAST) { @@ -35451,7 +35250,7 @@ index aa2abaf..5f5152d 100644 return; } -@@ -242,7 +242,7 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i) +@@ -243,7 +243,7 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i) break; } @@ -35460,7 +35259,7 @@ index aa2abaf..5f5152d 100644 | (i->flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0) | SM(i->txpower, AR_XmitPower) | (i->flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0) -@@ -252,19 +252,19 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i) +@@ -253,19 +253,19 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i) | (i->flags & ATH9K_TXDESC_RTSENA ? AR_RTSEnable : (i->flags & ATH9K_TXDESC_CTSENA ? AR_CTSEnable : 0)); @@ -35486,7 +35285,7 @@ index aa2abaf..5f5152d 100644 | set11nRateFlags(i->rates, 2) | set11nRateFlags(i->rates, 3) diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c -index a66a13b..0ef399e 100644 +index d9e0824..1a874e7 100644 --- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c +++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c @@ -39,47 +39,47 @@ ar9003_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i) @@ -35608,10 +35407,10 @@ index a66a13b..0ef399e 100644 static u16 ar9003_calc_ptr_chksum(struct ar9003_txc *ads) diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h -index e88f182..4e57f5d 100644 +index b620c55..a76cd49 100644 --- a/drivers/net/wireless/ath/ath9k/hw.h +++ b/drivers/net/wireless/ath/ath9k/hw.h -@@ -614,7 +614,7 @@ struct ath_hw_private_ops { +@@ -609,7 +609,7 @@ struct ath_hw_private_ops { /* ANI */ void (*ani_cache_ini_regs)(struct ath_hw *ah); @@ -35620,7 +35419,7 @@ index e88f182..4e57f5d 100644 /** * struct ath_hw_ops - callbacks used by hardware code and driver code -@@ -644,7 +644,7 @@ struct ath_hw_ops { +@@ -639,7 +639,7 @@ struct ath_hw_ops { void (*antdiv_comb_conf_set)(struct ath_hw *ah, struct ath_hw_antcomb_conf *antconf); @@ -35629,7 +35428,7 @@ index e88f182..4e57f5d 100644 struct ath_nf_limits { s16 max; -@@ -664,7 +664,7 @@ enum ath_cal_list { +@@ -659,7 +659,7 @@ enum ath_cal_list { #define AH_FASTCC 0x4 struct ath_hw { @@ -35667,10 +35466,10 @@ index faec404..a5277f1 100644 D_INFO("*** LOAD DRIVER ***\n"); diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c -index b7ce6a6..5649756 100644 +index a0b7cfd..20b49f7 100644 --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c -@@ -1721,9 +1721,11 @@ static int __init init_mac80211_hwsim(void) +@@ -1752,9 +1752,11 @@ static int __init init_mac80211_hwsim(void) return -EINVAL; if (fake_hw_scan) { @@ -35686,23 +35485,23 @@ index b7ce6a6..5649756 100644 spin_lock_init(&hwsim_radio_lock); diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h -index 35225e9..95e6bf9 100644 +index bd3b0bf..f9db92a 100644 --- a/drivers/net/wireless/mwifiex/main.h +++ b/drivers/net/wireless/mwifiex/main.h -@@ -537,7 +537,7 @@ struct mwifiex_if_ops { - void (*cleanup_mpa_buf) (struct mwifiex_adapter *); - int (*cmdrsp_complete) (struct mwifiex_adapter *, struct sk_buff *); +@@ -567,7 +567,7 @@ struct mwifiex_if_ops { int (*event_complete) (struct mwifiex_adapter *, struct sk_buff *); + int (*data_complete) (struct mwifiex_adapter *, struct sk_buff *); + int (*dnld_fw) (struct mwifiex_adapter *, struct mwifiex_fw_image *); -}; +} __no_const; struct mwifiex_adapter { u8 iface_type; diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c -index d66e298..55b0a89 100644 +index dfcd02a..a42a59d 100644 --- a/drivers/net/wireless/rndis_wlan.c +++ b/drivers/net/wireless/rndis_wlan.c -@@ -1278,7 +1278,7 @@ static int set_rts_threshold(struct usbnet *usbdev, u32 rts_threshold) +@@ -1235,7 +1235,7 @@ static int set_rts_threshold(struct usbnet *usbdev, u32 rts_threshold) netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold); @@ -35712,7 +35511,7 @@ index d66e298..55b0a89 100644 tmp = cpu_to_le32(rts_threshold); diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h -index c264dfa..08ee30e 100644 +index 8f75402..eed109d 100644 --- a/drivers/net/wireless/rt2x00/rt2x00.h +++ b/drivers/net/wireless/rt2x00/rt2x00.h @@ -396,7 +396,7 @@ struct rt2x00_intf { @@ -35725,10 +35524,10 @@ index c264dfa..08ee30e 100644 static inline struct rt2x00_intf* vif_to_intf(struct ieee80211_vif *vif) diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c -index 50f92d5..f3afc41 100644 +index 2fd8301..9767e8c 100644 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c -@@ -229,9 +229,9 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev, +@@ -240,9 +240,9 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev, * sequence counter given by mac80211. */ if (test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags)) @@ -35740,10 +35539,10 @@ index 50f92d5..f3afc41 100644 hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG); hdr->seq_ctrl |= cpu_to_le16(seqno); -diff --git a/drivers/net/wireless/wl1251/wl1251.h b/drivers/net/wireless/wl1251/wl1251.h +diff --git a/drivers/net/wireless/ti/wl1251/wl1251.h b/drivers/net/wireless/ti/wl1251/wl1251.h index 9d8f581..0f6589e 100644 ---- a/drivers/net/wireless/wl1251/wl1251.h -+++ b/drivers/net/wireless/wl1251/wl1251.h +--- a/drivers/net/wireless/ti/wl1251/wl1251.h ++++ b/drivers/net/wireless/ti/wl1251/wl1251.h @@ -266,7 +266,7 @@ struct wl1251_if_operations { void (*reset)(struct wl1251 *wl); void (*enable_irq)(struct wl1251 *wl); @@ -35753,6 +35552,19 @@ index 9d8f581..0f6589e 100644 struct wl1251 { struct ieee80211_hw *hw; +diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h +index 0b3f0b5..62f68bd 100644 +--- a/drivers/net/wireless/ti/wlcore/wlcore.h ++++ b/drivers/net/wireless/ti/wlcore/wlcore.h +@@ -61,7 +61,7 @@ struct wlcore_ops { + struct wl12xx_vif *wlvif); + s8 (*get_pg_ver)(struct wl1271 *wl); + void (*get_mac)(struct wl1271 *wl); +-}; ++} __no_const; + + enum wlcore_partitions { + PART_DOWN, diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c index f34b5b2..b5abb9f 100644 --- a/drivers/oprofile/buffer_sync.c @@ -35944,10 +35756,10 @@ index b500840..d7159d3 100644 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1) diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c -index 5e1ca3c..08082fe 100644 +index 658ac97..05e1b90 100644 --- a/drivers/pci/probe.c +++ b/drivers/pci/probe.c -@@ -215,7 +215,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, +@@ -137,7 +137,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, u16 orig_cmd; struct pci_bus_region region; @@ -35978,7 +35790,7 @@ index 27911b5..5b6db88 100644 &proc_bus_pci_dev_operations); proc_initialized = 1; diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c -index d68c000..f6094ca 100644 +index 8b5610d..a4c22bb 100644 --- a/drivers/platform/x86/thinkpad_acpi.c +++ b/drivers/platform/x86/thinkpad_acpi.c @@ -2094,7 +2094,7 @@ static int hotkey_mask_get(void) @@ -36192,7 +36004,7 @@ index b0ecacb..7c9da2e 100644 /* check if the resource is reserved */ diff --git a/drivers/power/bq27x00_battery.c b/drivers/power/bq27x00_battery.c -index 222ccd8..6275fa5 100644 +index f5d6d37..739f6a9 100644 --- a/drivers/power/bq27x00_battery.c +++ b/drivers/power/bq27x00_battery.c @@ -72,7 +72,7 @@ @@ -36205,10 +36017,10 @@ index 222ccd8..6275fa5 100644 enum bq27x00_chip { BQ27000, BQ27500 }; diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c -index 4c5b053..104263e 100644 +index 8d53174..04c65de 100644 --- a/drivers/regulator/max8660.c +++ b/drivers/regulator/max8660.c -@@ -385,8 +385,10 @@ static int __devinit max8660_probe(struct i2c_client *client, +@@ -333,8 +333,10 @@ static int __devinit max8660_probe(struct i2c_client *client, max8660->shadow_regs[MAX8660_OVER1] = 5; } else { /* Otherwise devices can be toggled via software */ @@ -36222,10 +36034,10 @@ index 4c5b053..104263e 100644 /* diff --git a/drivers/regulator/mc13892-regulator.c b/drivers/regulator/mc13892-regulator.c -index 845aa22..99ec402 100644 +index 970a233..ee1f241 100644 --- a/drivers/regulator/mc13892-regulator.c +++ b/drivers/regulator/mc13892-regulator.c -@@ -574,10 +574,12 @@ static int __devinit mc13892_regulator_probe(struct platform_device *pdev) +@@ -566,10 +566,12 @@ static int __devinit mc13892_regulator_probe(struct platform_device *pdev) } mc13xxx_unlock(mc13892); @@ -36401,19 +36213,19 @@ index a3a056a..b9bbc2f 100644 /* These three are default values which can be overridden */ diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c -index 500e20d..ebd3059 100644 +index 796482b..d08435c 100644 --- a/drivers/scsi/hpsa.c +++ b/drivers/scsi/hpsa.c -@@ -521,7 +521,7 @@ static inline u32 next_command(struct ctlr_info *h) - u32 a; +@@ -536,7 +536,7 @@ static inline u32 next_command(struct ctlr_info *h, u8 q) + unsigned long flags; if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant))) -- return h->access.command_completed(h); -+ return h->access->command_completed(h); +- return h->access.command_completed(h, q); ++ return h->access->command_completed(h, q); - if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) { - a = *(h->reply_pool_head); /* Next cmd in ring buffer */ -@@ -3002,7 +3002,7 @@ static void start_io(struct ctlr_info *h) + if ((rq->head[rq->current_entry] & 1) == rq->wraparound) { + a = rq->head[rq->current_entry]; +@@ -3354,7 +3354,7 @@ static void start_io(struct ctlr_info *h) while (!list_empty(&h->reqQ)) { c = list_entry(h->reqQ.next, struct CommandList, list); /* can't do anything if fifo is full */ @@ -36422,21 +36234,21 @@ index 500e20d..ebd3059 100644 dev_warn(&h->pdev->dev, "fifo full\n"); break; } -@@ -3012,7 +3012,7 @@ static void start_io(struct ctlr_info *h) - h->Qdepth--; +@@ -3376,7 +3376,7 @@ static void start_io(struct ctlr_info *h) /* Tell the controller execute command */ + spin_unlock_irqrestore(&h->lock, flags); - h->access.submit_command(h, c); + h->access->submit_command(h, c); + spin_lock_irqsave(&h->lock, flags); + } + spin_unlock_irqrestore(&h->lock, flags); +@@ -3384,17 +3384,17 @@ static void start_io(struct ctlr_info *h) - /* Put job onto the completed Q */ - addQ(&h->cmpQ, c); -@@ -3021,17 +3021,17 @@ static void start_io(struct ctlr_info *h) - - static inline unsigned long get_next_completion(struct ctlr_info *h) + static inline unsigned long get_next_completion(struct ctlr_info *h, u8 q) { -- return h->access.command_completed(h); -+ return h->access->command_completed(h); +- return h->access.command_completed(h, q); ++ return h->access->command_completed(h, q); } static inline bool interrupt_pending(struct ctlr_info *h) @@ -36452,16 +36264,16 @@ index 500e20d..ebd3059 100644 (h->interrupts_enabled == 0); } -@@ -3930,7 +3930,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h) +@@ -4298,7 +4298,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h) if (prod_index < 0) return -ENODEV; h->product_name = products[prod_index].product_name; - h->access = *(products[prod_index].access); + h->access = products[prod_index].access; - if (hpsa_board_disabled(h->pdev)) { - dev_warn(&h->pdev->dev, "controller appears to be disabled\n"); -@@ -4175,7 +4175,7 @@ static void controller_lockup_detected(struct ctlr_info *h) + pci_disable_link_state(h->pdev, PCIE_LINK_STATE_L0S | + PCIE_LINK_STATE_L1 | PCIE_LINK_STATE_CLKPM); +@@ -4580,7 +4580,7 @@ static void controller_lockup_detected(struct ctlr_info *h) assert_spin_locked(&lockup_detector_lock); remove_ctlr_from_lockup_detector_list(h); @@ -36470,7 +36282,7 @@ index 500e20d..ebd3059 100644 spin_lock_irqsave(&h->lock, flags); h->lockup_detected = readl(h->vaddr + SA5_SCRATCHPAD_OFFSET); spin_unlock_irqrestore(&h->lock, flags); -@@ -4355,7 +4355,7 @@ reinit_after_soft_reset: +@@ -4758,7 +4758,7 @@ reinit_after_soft_reset: } /* make sure the board interrupts are off */ @@ -36479,16 +36291,16 @@ index 500e20d..ebd3059 100644 if (hpsa_request_irq(h, do_hpsa_intr_msi, do_hpsa_intr_intx)) goto clean2; -@@ -4389,7 +4389,7 @@ reinit_after_soft_reset: +@@ -4792,7 +4792,7 @@ reinit_after_soft_reset: * fake ones to scoop up any residual completions. */ spin_lock_irqsave(&h->lock, flags); - h->access.set_intr_mask(h, HPSA_INTR_OFF); + h->access->set_intr_mask(h, HPSA_INTR_OFF); spin_unlock_irqrestore(&h->lock, flags); - free_irq(h->intr[h->intr_mode], h); + free_irqs(h); rc = hpsa_request_irq(h, hpsa_msix_discard_completions, -@@ -4408,9 +4408,9 @@ reinit_after_soft_reset: +@@ -4811,9 +4811,9 @@ reinit_after_soft_reset: dev_info(&h->pdev->dev, "Board READY.\n"); dev_info(&h->pdev->dev, "Waiting for stale completions to drain.\n"); @@ -36500,7 +36312,7 @@ index 500e20d..ebd3059 100644 rc = controller_reset_failed(h->cfgtable); if (rc) -@@ -4431,7 +4431,7 @@ reinit_after_soft_reset: +@@ -4834,7 +4834,7 @@ reinit_after_soft_reset: } /* Turn the interrupts on so we can service requests */ @@ -36509,16 +36321,16 @@ index 500e20d..ebd3059 100644 hpsa_hba_inquiry(h); hpsa_register_scsi(h); /* hook ourselves into SCSI subsystem */ -@@ -4483,7 +4483,7 @@ static void hpsa_shutdown(struct pci_dev *pdev) +@@ -4886,7 +4886,7 @@ static void hpsa_shutdown(struct pci_dev *pdev) * To write all data in the battery backed cache to disks */ hpsa_flush_cache(h); - h->access.set_intr_mask(h, HPSA_INTR_OFF); + h->access->set_intr_mask(h, HPSA_INTR_OFF); - free_irq(h->intr[h->intr_mode], h); - #ifdef CONFIG_PCI_MSI - if (h->msix_vector) -@@ -4657,7 +4657,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h, + hpsa_free_irqs_and_disable_msix(h); + } + +@@ -5055,7 +5055,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h, return; } /* Change the access methods to the performant access methods */ @@ -36528,10 +36340,10 @@ index 500e20d..ebd3059 100644 } diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h -index 7b28d54..952f23a 100644 +index 9816479..c5d4e97 100644 --- a/drivers/scsi/hpsa.h +++ b/drivers/scsi/hpsa.h -@@ -72,7 +72,7 @@ struct ctlr_info { +@@ -79,7 +79,7 @@ struct ctlr_info { unsigned int msix_vector; unsigned int msi_vector; int intr_mode; /* either PERF_MODE_INT or SIMPLE_MODE_INT */ @@ -36691,11 +36503,24 @@ index d109cc3..09f4e7d 100644 .qc_prep = ata_noop_qc_prep, .qc_issue = sas_ata_qc_issue, .qc_fill_rtf = sas_ata_qc_fill_rtf, +diff --git a/drivers/scsi/lpfc/Makefile b/drivers/scsi/lpfc/Makefile +index fe5d396..e93d526 100644 +--- a/drivers/scsi/lpfc/Makefile ++++ b/drivers/scsi/lpfc/Makefile +@@ -22,7 +22,7 @@ + ccflags-$(GCOV) := -fprofile-arcs -ftest-coverage + ccflags-$(GCOV) += -O0 + +-ccflags-y += -Werror ++#ccflags-y += -Werror + + obj-$(CONFIG_SCSI_LPFC) := lpfc.o + diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index 3a1ffdd..8eb7c71 100644 +index e5da6da..c888d48 100644 --- a/drivers/scsi/lpfc/lpfc.h +++ b/drivers/scsi/lpfc/lpfc.h -@@ -413,7 +413,7 @@ struct lpfc_vport { +@@ -416,7 +416,7 @@ struct lpfc_vport { struct dentry *debug_nodelist; struct dentry *vport_debugfs_root; struct lpfc_debugfs_trc *disc_trc; @@ -36704,7 +36529,7 @@ index 3a1ffdd..8eb7c71 100644 #endif uint8_t stat_data_enabled; uint8_t stat_data_blocked; -@@ -826,8 +826,8 @@ struct lpfc_hba { +@@ -830,8 +830,8 @@ struct lpfc_hba { struct timer_list fabric_block_timer; unsigned long bit_flags; #define FABRIC_COMANDS_BLOCKED 0 @@ -36715,7 +36540,7 @@ index 3a1ffdd..8eb7c71 100644 unsigned long last_rsrc_error_time; unsigned long last_ramp_down_time; unsigned long last_ramp_up_time; -@@ -863,7 +863,7 @@ struct lpfc_hba { +@@ -867,7 +867,7 @@ struct lpfc_hba { struct dentry *debug_slow_ring_trc; struct lpfc_debugfs_trc *slow_ring_trc; @@ -36725,7 +36550,7 @@ index 3a1ffdd..8eb7c71 100644 struct dentry *idiag_root; struct dentry *idiag_pci_cfg; diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index af04b0d..8f1a97e 100644 +index 3217d63..c417981 100644 --- a/drivers/scsi/lpfc/lpfc_debugfs.c +++ b/drivers/scsi/lpfc/lpfc_debugfs.c @@ -106,7 +106,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_trc, @@ -36808,10 +36633,10 @@ index af04b0d..8f1a97e 100644 snprintf(name, sizeof(name), "discovery_trace"); vport->debug_disc_trc = diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index 9598fdc..7e9f3d9 100644 +index 411ed48..967f553 100644 --- a/drivers/scsi/lpfc/lpfc_init.c +++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -10266,8 +10266,10 @@ lpfc_init(void) +@@ -10341,8 +10341,10 @@ lpfc_init(void) "misc_register returned with status %d", error); if (lpfc_enable_npiv) { @@ -36825,7 +36650,7 @@ index 9598fdc..7e9f3d9 100644 lpfc_transport_template = fc_attach_transport(&lpfc_transport_functions); diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c -index 88f3a83..686d3fa 100644 +index 66e0906..1620281 100644 --- a/drivers/scsi/lpfc/lpfc_scsi.c +++ b/drivers/scsi/lpfc/lpfc_scsi.c @@ -311,7 +311,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hba *phba) @@ -36855,9 +36680,9 @@ index 88f3a83..686d3fa 100644 + num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err); + num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success); - vports = lpfc_create_vport_work_array(phba); - if (vports != NULL) -@@ -417,8 +417,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba) + /* + * The error and success command counters are global per +@@ -425,8 +425,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba) } } lpfc_destroy_vport_work_array(phba, vports); @@ -36868,7 +36693,7 @@ index 88f3a83..686d3fa 100644 } /** -@@ -452,8 +452,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_hba *phba) +@@ -460,8 +460,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_hba *phba) } } lpfc_destroy_vport_work_array(phba, vports); @@ -36986,11 +36811,33 @@ index e1d150f..6c6df44 100644 /* To indicate add/delete/modify during CCN */ u8 change_detected; +diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c +index 5ab9530..2dd80f7 100644 +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -1855,7 +1855,7 @@ qla24xx_vport_disable(struct fc_vport *fc_vport, bool disable) + return 0; + } + +-struct fc_function_template qla2xxx_transport_functions = { ++fc_function_template_no_const qla2xxx_transport_functions = { + + .show_host_node_name = 1, + .show_host_port_name = 1, +@@ -1902,7 +1902,7 @@ struct fc_function_template qla2xxx_transport_functions = { + .bsg_timeout = qla24xx_bsg_timeout, + }; + +-struct fc_function_template qla2xxx_transport_vport_functions = { ++fc_function_template_no_const qla2xxx_transport_vport_functions = { + + .show_host_node_name = 1, + .show_host_port_name = 1, diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h -index a244303..6015eb7 100644 +index 39007f5..7fafc64 100644 --- a/drivers/scsi/qla2xxx/qla_def.h +++ b/drivers/scsi/qla2xxx/qla_def.h -@@ -2264,7 +2264,7 @@ struct isp_operations { +@@ -2284,7 +2284,7 @@ struct isp_operations { int (*start_scsi) (srb_t *); int (*abort_isp) (struct scsi_qla_host *); int (*iospace_config)(struct qla_hw_data*); @@ -36999,8 +36846,23 @@ index a244303..6015eb7 100644 /* MSI-X Support *************************************************************/ +diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h +index 9eacd2d..d79629c 100644 +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -484,8 +484,8 @@ extern void qla2x00_get_sym_node_name(scsi_qla_host_t *, uint8_t *); + struct device_attribute; + extern struct device_attribute *qla2x00_host_attrs[]; + struct fc_function_template; +-extern struct fc_function_template qla2xxx_transport_functions; +-extern struct fc_function_template qla2xxx_transport_vport_functions; ++extern fc_function_template_no_const qla2xxx_transport_functions; ++extern fc_function_template_no_const qla2xxx_transport_vport_functions; + extern void qla2x00_alloc_sysfs_attr(scsi_qla_host_t *); + extern void qla2x00_free_sysfs_attr(scsi_qla_host_t *); + extern void qla2x00_init_host_attr(scsi_qla_host_t *); diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h -index 7f2492e..5113877 100644 +index 96a5616..eeb185a 100644 --- a/drivers/scsi/qla4xxx/ql4_def.h +++ b/drivers/scsi/qla4xxx/ql4_def.h @@ -268,7 +268,7 @@ struct ddb_entry { @@ -37013,10 +36875,10 @@ index 7f2492e..5113877 100644 uint32_t default_time2wait; /* Default Min time between * relogins (+aens) */ diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c -index ee47820..a83b1f4 100644 +index cd15678..f7e6846 100644 --- a/drivers/scsi/qla4xxx/ql4_os.c +++ b/drivers/scsi/qla4xxx/ql4_os.c -@@ -2551,12 +2551,12 @@ static void qla4xxx_check_relogin_flash_ddb(struct iscsi_cls_session *cls_sess) +@@ -2615,12 +2615,12 @@ static void qla4xxx_check_relogin_flash_ddb(struct iscsi_cls_session *cls_sess) */ if (!iscsi_is_session_online(cls_sess)) { /* Reset retry relogin timer */ @@ -37031,7 +36893,7 @@ index ee47820..a83b1f4 100644 ddb_entry->default_time2wait + 4)); set_bit(DPC_RELOGIN_DEVICE, &ha->dpc_flags); atomic_set(&ddb_entry->retry_relogin_timer, -@@ -4453,7 +4453,7 @@ static void qla4xxx_setup_flash_ddb_entry(struct scsi_qla_host *ha, +@@ -4517,7 +4517,7 @@ static void qla4xxx_setup_flash_ddb_entry(struct scsi_qla_host *ha, atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY); atomic_set(&ddb_entry->relogin_timer, 0); @@ -37041,10 +36903,10 @@ index ee47820..a83b1f4 100644 ddb_entry->default_relogin_timeout = (def_timeout > LOGIN_TOV) && (def_timeout < LOGIN_TOV * 10) ? diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c -index 07322ec..91ccc23 100644 +index bbbc9c9..ce22f77 100644 --- a/drivers/scsi/scsi.c +++ b/drivers/scsi/scsi.c -@@ -655,7 +655,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd) +@@ -659,7 +659,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd) unsigned long timeout; int rtn = 0; @@ -37054,7 +36916,7 @@ index 07322ec..91ccc23 100644 /* check if the device is still usable */ if (unlikely(cmd->device->sdev_state == SDEV_DEL)) { diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c -index 4037fd5..a19fcc7 100644 +index 6dfb978..ddc470e 100644 --- a/drivers/scsi/scsi_lib.c +++ b/drivers/scsi/scsi_lib.c @@ -1415,7 +1415,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q) @@ -37105,7 +36967,7 @@ index 84a1fdf..693b0d6 100644 /* * TODO: need to fixup sg_tablesize, max_segment_size, diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c -index 80fbe2a..efa223b 100644 +index 5797604..289a5b5 100644 --- a/drivers/scsi/scsi_transport_fc.c +++ b/drivers/scsi/scsi_transport_fc.c @@ -498,7 +498,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_class, @@ -37207,10 +37069,10 @@ index 21a045e..ec89e03 100644 transport_setup_device(&rport->dev); diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index eacd46b..e3f4d62 100644 +index 9c5c5f2..8414557 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c -@@ -1077,7 +1077,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) +@@ -1101,7 +1101,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) sdp->disk->disk_name, MKDEV(SCSI_GENERIC_MAJOR, sdp->index), NULL, @@ -37219,29 +37081,11 @@ index eacd46b..e3f4d62 100644 case BLKTRACESTART: return blk_trace_startstop(sdp->device->request_queue, 1); case BLKTRACESTOP: -@@ -2312,7 +2312,7 @@ struct sg_proc_leaf { - const struct file_operations * fops; - }; - --static struct sg_proc_leaf sg_proc_leaf_arr[] = { -+static const struct sg_proc_leaf sg_proc_leaf_arr[] = { - {"allow_dio", &adio_fops}, - {"debug", &debug_fops}, - {"def_reserved_size", &dressz_fops}, -@@ -2332,7 +2332,7 @@ sg_proc_init(void) - if (!sg_proc_sgp) - return 1; - for (k = 0; k < num_leaves; ++k) { -- struct sg_proc_leaf *leaf = &sg_proc_leaf_arr[k]; -+ const struct sg_proc_leaf *leaf = &sg_proc_leaf_arr[k]; - umode_t mask = leaf->fops->write ? S_IRUGO | S_IWUSR : S_IRUGO; - proc_create(leaf->name, mask, sg_proc_sgp, leaf->fops); - } diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index 3d8f662..070f1a5 100644 +index 1041cb8..4a946fa 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c -@@ -1361,7 +1361,7 @@ int spi_bus_unlock(struct spi_master *master) +@@ -1453,7 +1453,7 @@ int spi_bus_unlock(struct spi_master *master) EXPORT_SYMBOL_GPL(spi_bus_unlock); /* portable code must never pass more than 32 bytes */ @@ -37251,7 +37095,7 @@ index 3d8f662..070f1a5 100644 static u8 *buf; diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c -index d91751f..a3a9e36 100644 +index 34afc16..ffe44dd 100644 --- a/drivers/staging/octeon/ethernet-rx.c +++ b/drivers/staging/octeon/ethernet-rx.c @@ -421,11 +421,11 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget) @@ -37283,7 +37127,7 @@ index d91751f..a3a9e36 100644 dev_kfree_skb_irq(skb); } diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c -index 60cba81..71eb239 100644 +index 18f7a79..cc3bc24 100644 --- a/drivers/staging/octeon/ethernet.c +++ b/drivers/staging/octeon/ethernet.c @@ -259,11 +259,11 @@ static struct net_device_stats *cvm_oct_common_get_stats(struct net_device *dev) @@ -37303,7 +37147,7 @@ index 60cba81..71eb239 100644 } diff --git a/drivers/staging/rtl8712/rtl871x_io.h b/drivers/staging/rtl8712/rtl871x_io.h -index d3d8727..f9327bb8 100644 +index dc23395..cf7e9b1 100644 --- a/drivers/staging/rtl8712/rtl871x_io.h +++ b/drivers/staging/rtl8712/rtl871x_io.h @@ -108,7 +108,7 @@ struct _io_ops { @@ -37346,7 +37190,7 @@ index 42cdafe..2769103 100644 ch = synth_buffer_getc(); } diff --git a/drivers/staging/usbip/usbip_common.h b/drivers/staging/usbip/usbip_common.h -index c7b888c..c94be93 100644 +index 5d89c0f..9261317 100644 --- a/drivers/staging/usbip/usbip_common.h +++ b/drivers/staging/usbip/usbip_common.h @@ -289,7 +289,7 @@ struct usbip_device { @@ -37357,7 +37201,7 @@ index c7b888c..c94be93 100644 + } __no_const eh_ops; }; - /* usbip_common.c */ + #define kthread_get_run(threadfn, data, namefmt, ...) \ diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h index 88b3298..3783eee 100644 --- a/drivers/staging/usbip/vhci.h @@ -37372,7 +37216,7 @@ index 88b3298..3783eee 100644 /* * NOTE: diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c -index dca9bf1..80735c9 100644 +index f708cba..2de6d72 100644 --- a/drivers/staging/usbip/vhci_hcd.c +++ b/drivers/staging/usbip/vhci_hcd.c @@ -488,7 +488,7 @@ static void vhci_tx_urb(struct urb *urb) @@ -37403,7 +37247,7 @@ index dca9bf1..80735c9 100644 hcd->power_budget = 0; /* no limit */ diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c -index f5fba732..210a16c 100644 +index f0eaf04..5a82e06 100644 --- a/drivers/staging/usbip/vhci_rx.c +++ b/drivers/staging/usbip/vhci_rx.c @@ -77,7 +77,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev, @@ -37530,24 +37374,11 @@ index 0d4aa82..f7832d4 100644 extern void tmem_register_hostops(struct tmem_hostops *m); /* core tmem accessor functions */ -diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c -index f015839..b15dfc4 100644 ---- a/drivers/target/target_core_tmr.c -+++ b/drivers/target/target_core_tmr.c -@@ -327,7 +327,7 @@ static void core_tmr_drain_task_list( - cmd->se_tfo->get_task_tag(cmd), cmd->pr_res_key, - cmd->t_task_list_num, - atomic_read(&cmd->t_task_cdbs_left), -- atomic_read(&cmd->t_task_cdbs_sent), -+ atomic_read_unchecked(&cmd->t_task_cdbs_sent), - (cmd->transport_state & CMD_T_ACTIVE) != 0, - (cmd->transport_state & CMD_T_STOP) != 0, - (cmd->transport_state & CMD_T_SENT) != 0); diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 443704f..92d3517 100644 +index 634d0f3..efff61f 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c -@@ -1355,7 +1355,7 @@ struct se_device *transport_add_device_to_core_hba( +@@ -1233,7 +1233,7 @@ struct se_device *transport_add_device_to_core_hba( spin_lock_init(&dev->se_port_lock); spin_lock_init(&dev->se_tmr_lock); spin_lock_init(&dev->qf_cmd_lock); @@ -37556,7 +37387,7 @@ index 443704f..92d3517 100644 se_dev_set_default_attribs(dev, dev_limits); -@@ -1542,7 +1542,7 @@ static int transport_check_alloc_task_attr(struct se_cmd *cmd) +@@ -1402,7 +1402,7 @@ static int transport_check_alloc_task_attr(struct se_cmd *cmd) * Used to determine when ORDERED commands should go from * Dormant to Active status. */ @@ -37565,29 +37396,94 @@ index 443704f..92d3517 100644 smp_mb__after_atomic_inc(); pr_debug("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n", cmd->se_ordered_id, cmd->sam_task_attr, -@@ -1956,7 +1956,7 @@ void transport_generic_request_failure(struct se_cmd *cmd) - " CMD_T_ACTIVE: %d CMD_T_STOP: %d CMD_T_SENT: %d\n", - cmd->t_task_list_num, - atomic_read(&cmd->t_task_cdbs_left), -- atomic_read(&cmd->t_task_cdbs_sent), -+ atomic_read_unchecked(&cmd->t_task_cdbs_sent), - atomic_read(&cmd->t_task_cdbs_ex_left), - (cmd->transport_state & CMD_T_ACTIVE) != 0, - (cmd->transport_state & CMD_T_STOP) != 0, -@@ -2216,9 +2216,9 @@ check_depth: - cmd = task->task_se_cmd; - spin_lock_irqsave(&cmd->t_state_lock, flags); - task->task_flags |= (TF_ACTIVE | TF_SENT); -- atomic_inc(&cmd->t_task_cdbs_sent); -+ atomic_inc_unchecked(&cmd->t_task_cdbs_sent); - -- if (atomic_read(&cmd->t_task_cdbs_sent) == -+ if (atomic_read_unchecked(&cmd->t_task_cdbs_sent) == - cmd->t_task_list_num) - cmd->transport_state |= CMD_T_SENT; +diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c +index e61cabd..7617d26 100644 +--- a/drivers/tty/cyclades.c ++++ b/drivers/tty/cyclades.c +@@ -1589,10 +1589,10 @@ static int cy_open(struct tty_struct *tty, struct file *filp) + printk(KERN_DEBUG "cyc:cy_open ttyC%d, count = %d\n", info->line, + info->port.count); + #endif +- info->port.count++; ++ atomic_inc(&info->port.count); + #ifdef CY_DEBUG_COUNT + printk(KERN_DEBUG "cyc:cy_open (%d): incrementing count to %d\n", +- current->pid, info->port.count); ++ current->pid, atomic_read(&info->port.count)); + #endif + + /* +@@ -3987,7 +3987,7 @@ static int cyclades_proc_show(struct seq_file *m, void *v) + for (j = 0; j < cy_card[i].nports; j++) { + info = &cy_card[i].ports[j]; + +- if (info->port.count) { ++ if (atomic_read(&info->port.count)) { + /* XXX is the ldisc num worth this? */ + struct tty_struct *tty; + struct tty_ldisc *ld; +diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c +index 2d691eb..be02ebd 100644 +--- a/drivers/tty/hvc/hvc_console.c ++++ b/drivers/tty/hvc/hvc_console.c +@@ -315,7 +315,7 @@ static int hvc_open(struct tty_struct *tty, struct file * filp) + + spin_lock_irqsave(&hp->port.lock, flags); + /* Check and then increment for fast path open. */ +- if (hp->port.count++ > 0) { ++ if (atomic_inc_return(&hp->port.count) > 1) { + spin_unlock_irqrestore(&hp->port.lock, flags); + hvc_kick(); + return 0; +@@ -366,7 +366,7 @@ static void hvc_close(struct tty_struct *tty, struct file * filp) + + spin_lock_irqsave(&hp->port.lock, flags); + +- if (--hp->port.count == 0) { ++ if (atomic_dec_return(&hp->port.count) == 0) { + spin_unlock_irqrestore(&hp->port.lock, flags); + /* We are done with the tty pointer now. */ + tty_port_tty_set(&hp->port, NULL); +@@ -384,9 +384,9 @@ static void hvc_close(struct tty_struct *tty, struct file * filp) + */ + tty_wait_until_sent_from_close(tty, HVC_CLOSE_WAIT); + } else { +- if (hp->port.count < 0) ++ if (atomic_read(&hp->port.count) < 0) + printk(KERN_ERR "hvc_close %X: oops, count is %d\n", +- hp->vtermno, hp->port.count); ++ hp->vtermno, atomic_read(&hp->port.count)); + spin_unlock_irqrestore(&hp->port.lock, flags); + } + +@@ -412,13 +412,13 @@ static void hvc_hangup(struct tty_struct *tty) + * open->hangup case this can be called after the final close so prevent + * that from happening for now. + */ +- if (hp->port.count <= 0) { ++ if (atomic_read(&hp->port.count) <= 0) { + spin_unlock_irqrestore(&hp->port.lock, flags); + return; + } + +- temp_open_count = hp->port.count; +- hp->port.count = 0; ++ temp_open_count = atomic_read(&hp->port.count); ++ atomic_set(&hp->port.count, 0); + spin_unlock_irqrestore(&hp->port.lock, flags); + tty_port_tty_set(&hp->port, NULL); + +@@ -471,7 +471,7 @@ static int hvc_write(struct tty_struct *tty, const unsigned char *buf, int count + return -EPIPE; + + /* FIXME what's this (unprotected) check for? */ +- if (hp->port.count <= 0) ++ if (atomic_read(&hp->port.count) <= 0) + return -EIO; + spin_lock_irqsave(&hp->lock, flags); diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c -index 3436436..772237b 100644 +index d56788c..12d8f85 100644 --- a/drivers/tty/hvc/hvcs.c +++ b/drivers/tty/hvc/hvcs.c @@ -83,6 +83,7 @@ @@ -37598,102 +37494,93 @@ index 3436436..772237b 100644 /* * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00). -@@ -270,7 +271,7 @@ struct hvcs_struct { - unsigned int index; - - struct tty_struct *tty; -- int open_count; -+ local_t open_count; - - /* - * Used to tell the driver kernel_thread what operations need to take -@@ -422,7 +423,7 @@ static ssize_t hvcs_vterm_state_store(struct device *dev, struct device_attribut +@@ -416,7 +417,7 @@ static ssize_t hvcs_vterm_state_store(struct device *dev, struct device_attribut spin_lock_irqsave(&hvcsd->lock, flags); -- if (hvcsd->open_count > 0) { -+ if (local_read(&hvcsd->open_count) > 0) { +- if (hvcsd->port.count > 0) { ++ if (atomic_read(&hvcsd->port.count) > 0) { spin_unlock_irqrestore(&hvcsd->lock, flags); printk(KERN_INFO "HVCS: vterm state unchanged. " "The hvcs device node is still in use.\n"); -@@ -1138,7 +1139,7 @@ static int hvcs_open(struct tty_struct *tty, struct file *filp) +@@ -1134,7 +1135,7 @@ static int hvcs_open(struct tty_struct *tty, struct file *filp) if ((retval = hvcs_partner_connect(hvcsd))) goto error_release; -- hvcsd->open_count = 1; -+ local_set(&hvcsd->open_count, 1); - hvcsd->tty = tty; +- hvcsd->port.count = 1; ++ atomic_set(&hvcsd->port.count, 1); + hvcsd->port.tty = tty; tty->driver_data = hvcsd; -@@ -1172,7 +1173,7 @@ fast_open: +@@ -1168,7 +1169,7 @@ fast_open: spin_lock_irqsave(&hvcsd->lock, flags); - kref_get(&hvcsd->kref); -- hvcsd->open_count++; -+ local_inc(&hvcsd->open_count); + tty_port_get(&hvcsd->port); +- hvcsd->port.count++; ++ atomic_inc(&hvcsd->port.count); hvcsd->todo_mask |= HVCS_SCHED_READ; spin_unlock_irqrestore(&hvcsd->lock, flags); -@@ -1216,7 +1217,7 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp) +@@ -1212,7 +1213,7 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp) hvcsd = tty->driver_data; spin_lock_irqsave(&hvcsd->lock, flags); -- if (--hvcsd->open_count == 0) { -+ if (local_dec_and_test(&hvcsd->open_count)) { +- if (--hvcsd->port.count == 0) { ++ if (atomic_dec_and_test(&hvcsd->port.count)) { vio_disable_interrupts(hvcsd->vdev); -@@ -1242,10 +1243,10 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp) +@@ -1238,10 +1239,10 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp) free_irq(irq, hvcsd); - kref_put(&hvcsd->kref, destroy_hvcs_struct); + tty_port_put(&hvcsd->port); return; -- } else if (hvcsd->open_count < 0) { -+ } else if (local_read(&hvcsd->open_count) < 0) { +- } else if (hvcsd->port.count < 0) { ++ } else if (atomic_read(&hvcsd->port.count) < 0) { printk(KERN_ERR "HVCS: vty-server@%X open_count: %d" " is missmanaged.\n", -- hvcsd->vdev->unit_address, hvcsd->open_count); -+ hvcsd->vdev->unit_address, local_read(&hvcsd->open_count)); +- hvcsd->vdev->unit_address, hvcsd->port.count); ++ hvcsd->vdev->unit_address, atomic_read(&hvcsd->port.count)); } spin_unlock_irqrestore(&hvcsd->lock, flags); -@@ -1261,7 +1262,7 @@ static void hvcs_hangup(struct tty_struct * tty) +@@ -1257,7 +1258,7 @@ static void hvcs_hangup(struct tty_struct * tty) spin_lock_irqsave(&hvcsd->lock, flags); /* Preserve this so that we know how many kref refs to put */ -- temp_open_count = hvcsd->open_count; -+ temp_open_count = local_read(&hvcsd->open_count); +- temp_open_count = hvcsd->port.count; ++ temp_open_count = atomic_read(&hvcsd->port.count); /* * Don't kref put inside the spinlock because the destruction -@@ -1276,7 +1277,7 @@ static void hvcs_hangup(struct tty_struct * tty) - hvcsd->tty->driver_data = NULL; - hvcsd->tty = NULL; +@@ -1272,7 +1273,7 @@ static void hvcs_hangup(struct tty_struct * tty) + tty->driver_data = NULL; + hvcsd->port.tty = NULL; -- hvcsd->open_count = 0; -+ local_set(&hvcsd->open_count, 0); +- hvcsd->port.count = 0; ++ atomic_set(&hvcsd->port.count, 0); /* This will drop any buffered data on the floor which is OK in a hangup * scenario. */ -@@ -1347,7 +1348,7 @@ static int hvcs_write(struct tty_struct *tty, +@@ -1343,7 +1344,7 @@ static int hvcs_write(struct tty_struct *tty, * the middle of a write operation? This is a crummy place to do this * but we want to keep it all in the spinlock. */ -- if (hvcsd->open_count <= 0) { -+ if (local_read(&hvcsd->open_count) <= 0) { +- if (hvcsd->port.count <= 0) { ++ if (atomic_read(&hvcsd->port.count) <= 0) { spin_unlock_irqrestore(&hvcsd->lock, flags); return -ENODEV; } -@@ -1421,7 +1422,7 @@ static int hvcs_write_room(struct tty_struct *tty) +@@ -1417,7 +1418,7 @@ static int hvcs_write_room(struct tty_struct *tty) { struct hvcs_struct *hvcsd = tty->driver_data; -- if (!hvcsd || hvcsd->open_count <= 0) -+ if (!hvcsd || local_read(&hvcsd->open_count) <= 0) +- if (!hvcsd || hvcsd->port.count <= 0) ++ if (!hvcsd || atomic_read(&hvcsd->port.count) <= 0) return 0; return HVCS_BUFF_LEN - hvcsd->chars_in_buffer; diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c -index 4daf962..b4a2281 100644 +index f8b5fa0..4ba9f89 100644 --- a/drivers/tty/ipwireless/tty.c +++ b/drivers/tty/ipwireless/tty.c @@ -29,6 +29,7 @@ @@ -37704,122 +37591,126 @@ index 4daf962..b4a2281 100644 #include "tty.h" #include "network.h" -@@ -51,7 +52,7 @@ struct ipw_tty { - int tty_type; - struct ipw_network *network; - struct tty_struct *linux_tty; -- int open_count; -+ local_t open_count; - unsigned int control_lines; - struct mutex ipw_tty_mutex; - int tx_bytes_queued; -@@ -117,10 +118,10 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp) +@@ -99,10 +100,10 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp) mutex_unlock(&tty->ipw_tty_mutex); return -ENODEV; } -- if (tty->open_count == 0) -+ if (local_read(&tty->open_count) == 0) +- if (tty->port.count == 0) ++ if (atomic_read(&tty->port.count) == 0) tty->tx_bytes_queued = 0; -- tty->open_count++; -+ local_inc(&tty->open_count); +- tty->port.count++; ++ atomic_inc(&tty->port.count); - tty->linux_tty = linux_tty; + tty->port.tty = linux_tty; linux_tty->driver_data = tty; -@@ -136,9 +137,7 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp) +@@ -118,9 +119,7 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp) static void do_ipw_close(struct ipw_tty *tty) { -- tty->open_count--; +- tty->port.count--; - -- if (tty->open_count == 0) { -+ if (local_dec_return(&tty->open_count) == 0) { - struct tty_struct *linux_tty = tty->linux_tty; +- if (tty->port.count == 0) { ++ if (atomic_dec_return(&tty->port.count) == 0) { + struct tty_struct *linux_tty = tty->port.tty; if (linux_tty != NULL) { -@@ -159,7 +158,7 @@ static void ipw_hangup(struct tty_struct *linux_tty) +@@ -141,7 +140,7 @@ static void ipw_hangup(struct tty_struct *linux_tty) return; mutex_lock(&tty->ipw_tty_mutex); -- if (tty->open_count == 0) { -+ if (local_read(&tty->open_count) == 0) { +- if (tty->port.count == 0) { ++ if (atomic_read(&tty->port.count) == 0) { mutex_unlock(&tty->ipw_tty_mutex); return; } -@@ -188,7 +187,7 @@ void ipwireless_tty_received(struct ipw_tty *tty, unsigned char *data, +@@ -170,7 +169,7 @@ void ipwireless_tty_received(struct ipw_tty *tty, unsigned char *data, return; } -- if (!tty->open_count) { -+ if (!local_read(&tty->open_count)) { +- if (!tty->port.count) { ++ if (!atomic_read(&tty->port.count)) { mutex_unlock(&tty->ipw_tty_mutex); return; } -@@ -230,7 +229,7 @@ static int ipw_write(struct tty_struct *linux_tty, +@@ -212,7 +211,7 @@ static int ipw_write(struct tty_struct *linux_tty, return -ENODEV; mutex_lock(&tty->ipw_tty_mutex); -- if (!tty->open_count) { -+ if (!local_read(&tty->open_count)) { +- if (!tty->port.count) { ++ if (!atomic_read(&tty->port.count)) { mutex_unlock(&tty->ipw_tty_mutex); return -EINVAL; } -@@ -270,7 +269,7 @@ static int ipw_write_room(struct tty_struct *linux_tty) +@@ -252,7 +251,7 @@ static int ipw_write_room(struct tty_struct *linux_tty) if (!tty) return -ENODEV; -- if (!tty->open_count) -+ if (!local_read(&tty->open_count)) +- if (!tty->port.count) ++ if (!atomic_read(&tty->port.count)) return -EINVAL; room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued; -@@ -312,7 +311,7 @@ static int ipw_chars_in_buffer(struct tty_struct *linux_tty) +@@ -294,7 +293,7 @@ static int ipw_chars_in_buffer(struct tty_struct *linux_tty) if (!tty) return 0; -- if (!tty->open_count) -+ if (!local_read(&tty->open_count)) +- if (!tty->port.count) ++ if (!atomic_read(&tty->port.count)) return 0; return tty->tx_bytes_queued; -@@ -393,7 +392,7 @@ static int ipw_tiocmget(struct tty_struct *linux_tty) +@@ -375,7 +374,7 @@ static int ipw_tiocmget(struct tty_struct *linux_tty) if (!tty) return -ENODEV; -- if (!tty->open_count) -+ if (!local_read(&tty->open_count)) +- if (!tty->port.count) ++ if (!atomic_read(&tty->port.count)) return -EINVAL; return get_control_lines(tty); -@@ -409,7 +408,7 @@ ipw_tiocmset(struct tty_struct *linux_tty, +@@ -391,7 +390,7 @@ ipw_tiocmset(struct tty_struct *linux_tty, if (!tty) return -ENODEV; -- if (!tty->open_count) -+ if (!local_read(&tty->open_count)) +- if (!tty->port.count) ++ if (!atomic_read(&tty->port.count)) return -EINVAL; return set_control_lines(tty, set, clear); -@@ -423,7 +422,7 @@ static int ipw_ioctl(struct tty_struct *linux_tty, +@@ -405,7 +404,7 @@ static int ipw_ioctl(struct tty_struct *linux_tty, if (!tty) return -ENODEV; -- if (!tty->open_count) -+ if (!local_read(&tty->open_count)) +- if (!tty->port.count) ++ if (!atomic_read(&tty->port.count)) return -EINVAL; /* FIXME: Exactly how is the tty object locked here .. */ -@@ -572,7 +571,7 @@ void ipwireless_tty_free(struct ipw_tty *tty) - against a parallel ioctl etc */ +@@ -561,7 +560,7 @@ void ipwireless_tty_free(struct ipw_tty *tty) + * are gone */ mutex_lock(&ttyj->ipw_tty_mutex); } -- while (ttyj->open_count) -+ while (local_read(&ttyj->open_count)) +- while (ttyj->port.count) ++ while (atomic_read(&ttyj->port.count)) do_ipw_close(ttyj); ipwireless_disassociate_network_ttys(network, ttyj->channel_idx); +diff --git a/drivers/tty/moxa.c b/drivers/tty/moxa.c +index 324467d..504cc25 100644 +--- a/drivers/tty/moxa.c ++++ b/drivers/tty/moxa.c +@@ -1172,7 +1172,7 @@ static int moxa_open(struct tty_struct *tty, struct file *filp) + } + + ch = &brd->ports[port % MAX_PORTS_PER_BOARD]; +- ch->port.count++; ++ atomic_inc(&ch->port.count); + tty->driver_data = ch; + tty_port_tty_set(&ch->port, tty); + mutex_lock(&ch->port.mutex); diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c -index c43b683..0a88f1c 100644 +index c43b683..4dab83e 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1629,7 +1629,7 @@ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr) @@ -37831,11 +37722,20 @@ index c43b683..0a88f1c 100644 kfree(dlci); return NULL; } +@@ -2895,7 +2895,7 @@ static int gsmtty_open(struct tty_struct *tty, struct file *filp) + if (dlci == NULL) + return -ENOMEM; + port = &dlci->port; +- port->count++; ++ atomic_inc(&port->count); + tty->driver_data = dlci; + dlci_get(dlci); + dlci_get(dlci->gsm->dlci[0]); diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index 94b6eda..15f7cec 100644 +index ee1c268..0e97caf 100644 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c -@@ -2122,6 +2122,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops) +@@ -2123,6 +2123,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops) { *ops = tty_ldisc_N_TTY; ops->owner = NULL; @@ -37845,10 +37745,10 @@ index 94b6eda..15f7cec 100644 } EXPORT_SYMBOL_GPL(n_tty_inherit_ops); diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c -index eeae7fa..177a743 100644 +index 5505ffc..7affff9 100644 --- a/drivers/tty/pty.c +++ b/drivers/tty/pty.c -@@ -707,8 +707,10 @@ static void __init unix98_pty_init(void) +@@ -718,8 +718,10 @@ static void __init unix98_pty_init(void) panic("Couldn't register Unix98 pts driver"); /* Now create the /dev/ptmx special device */ @@ -37860,6 +37760,37 @@ index eeae7fa..177a743 100644 cdev_init(&ptmx_cdev, &ptmx_fops); if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) || +diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c +index 777d5f9..56d67ca 100644 +--- a/drivers/tty/rocket.c ++++ b/drivers/tty/rocket.c +@@ -924,7 +924,7 @@ static int rp_open(struct tty_struct *tty, struct file *filp) + tty->driver_data = info; + tty_port_tty_set(port, tty); + +- if (port->count++ == 0) { ++ if (atomic_inc_return(&port->count) == 1) { + atomic_inc(&rp_num_ports_open); + + #ifdef ROCKET_DEBUG_OPEN +@@ -933,7 +933,7 @@ static int rp_open(struct tty_struct *tty, struct file *filp) + #endif + } + #ifdef ROCKET_DEBUG_OPEN +- printk(KERN_INFO "rp_open ttyR%d, count=%d\n", info->line, info->port.count); ++ printk(KERN_INFO "rp_open ttyR%d, count=%d\n", info->line, atomic-read(&info->port.count)); + #endif + + /* +@@ -1528,7 +1528,7 @@ static void rp_hangup(struct tty_struct *tty) + spin_unlock_irqrestore(&info->port.lock, flags); + return; + } +- if (info->port.count) ++ if (atomic_read(&info->port.count)) + atomic_dec(&rp_num_ports_open); + clear_bit((info->aiop * 8) + info->chan, (void *) &xmit_flags[info->board]); + spin_unlock_irqrestore(&info->port.lock, flags); diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c index 2b42a01..32a2ed3 100644 --- a/drivers/tty/serial/kgdboc.c @@ -37962,6 +37893,435 @@ index 2b42a01..32a2ed3 100644 #ifdef CONFIG_KGDB_SERIAL_CONSOLE /* This is only available if kgdboc is a built in for early debugging */ static int __init kgdboc_early_init(char *opt) +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 246b823..9e0db76 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -1392,7 +1392,7 @@ static void uart_hangup(struct tty_struct *tty) + uart_flush_buffer(tty); + uart_shutdown(tty, state); + spin_lock_irqsave(&port->lock, flags); +- port->count = 0; ++ atomic_set(&port->count, 0); + clear_bit(ASYNCB_NORMAL_ACTIVE, &port->flags); + spin_unlock_irqrestore(&port->lock, flags); + tty_port_tty_set(port, NULL); +@@ -1488,7 +1488,7 @@ static int uart_open(struct tty_struct *tty, struct file *filp) + goto end; + } + +- port->count++; ++ atomic_inc(&port->count); + if (!state->uart_port || state->uart_port->flags & UPF_DEAD) { + retval = -ENXIO; + goto err_dec_count; +@@ -1515,7 +1515,7 @@ static int uart_open(struct tty_struct *tty, struct file *filp) + /* + * Make sure the device is in D0 state. + */ +- if (port->count == 1) ++ if (atomic_read(&port->count) == 1) + uart_change_pm(state, 0); + + /* +@@ -1533,7 +1533,7 @@ static int uart_open(struct tty_struct *tty, struct file *filp) + end: + return retval; + err_dec_count: +- port->count--; ++ atomic_inc(&port->count); + mutex_unlock(&port->mutex); + goto end; + } +diff --git a/drivers/tty/synclink.c b/drivers/tty/synclink.c +index 593d40a..bdc61f3 100644 +--- a/drivers/tty/synclink.c ++++ b/drivers/tty/synclink.c +@@ -3095,7 +3095,7 @@ static void mgsl_close(struct tty_struct *tty, struct file * filp) + + if (debug_level >= DEBUG_LEVEL_INFO) + printk("%s(%d):mgsl_close(%s) entry, count=%d\n", +- __FILE__,__LINE__, info->device_name, info->port.count); ++ __FILE__,__LINE__, info->device_name, atomic_read(&info->port.count)); + + if (tty_port_close_start(&info->port, tty, filp) == 0) + goto cleanup; +@@ -3113,7 +3113,7 @@ static void mgsl_close(struct tty_struct *tty, struct file * filp) + cleanup: + if (debug_level >= DEBUG_LEVEL_INFO) + printk("%s(%d):mgsl_close(%s) exit, count=%d\n", __FILE__,__LINE__, +- tty->driver->name, info->port.count); ++ tty->driver->name, atomic_read(&info->port.count)); + + } /* end of mgsl_close() */ + +@@ -3212,8 +3212,8 @@ static void mgsl_hangup(struct tty_struct *tty) + + mgsl_flush_buffer(tty); + shutdown(info); +- +- info->port.count = 0; ++ ++ atomic_set(&info->port.count, 0); + info->port.flags &= ~ASYNC_NORMAL_ACTIVE; + info->port.tty = NULL; + +@@ -3302,12 +3302,12 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp, + + if (debug_level >= DEBUG_LEVEL_INFO) + printk("%s(%d):block_til_ready before block on %s count=%d\n", +- __FILE__,__LINE__, tty->driver->name, port->count ); ++ __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count)); + + spin_lock_irqsave(&info->irq_spinlock, flags); + if (!tty_hung_up_p(filp)) { + extra_count = true; +- port->count--; ++ atomic_dec(&port->count); + } + spin_unlock_irqrestore(&info->irq_spinlock, flags); + port->blocked_open++; +@@ -3336,7 +3336,7 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp, + + if (debug_level >= DEBUG_LEVEL_INFO) + printk("%s(%d):block_til_ready blocking on %s count=%d\n", +- __FILE__,__LINE__, tty->driver->name, port->count ); ++ __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count)); + + tty_unlock(); + schedule(); +@@ -3348,12 +3348,12 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp, + + /* FIXME: Racy on hangup during close wait */ + if (extra_count) +- port->count++; ++ atomic_inc(&port->count); + port->blocked_open--; + + if (debug_level >= DEBUG_LEVEL_INFO) + printk("%s(%d):block_til_ready after blocking on %s count=%d\n", +- __FILE__,__LINE__, tty->driver->name, port->count ); ++ __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count)); + + if (!retval) + port->flags |= ASYNC_NORMAL_ACTIVE; +@@ -3398,7 +3398,7 @@ static int mgsl_open(struct tty_struct *tty, struct file * filp) + + if (debug_level >= DEBUG_LEVEL_INFO) + printk("%s(%d):mgsl_open(%s), old ref count = %d\n", +- __FILE__,__LINE__,tty->driver->name, info->port.count); ++ __FILE__,__LINE__,tty->driver->name, atomic_read(&info->port.count)); + + /* If port is closing, signal caller to try again */ + if (tty_hung_up_p(filp) || info->port.flags & ASYNC_CLOSING){ +@@ -3417,10 +3417,10 @@ static int mgsl_open(struct tty_struct *tty, struct file * filp) + spin_unlock_irqrestore(&info->netlock, flags); + goto cleanup; + } +- info->port.count++; ++ atomic_inc(&info->port.count); + spin_unlock_irqrestore(&info->netlock, flags); + +- if (info->port.count == 1) { ++ if (atomic_read(&info->port.count) == 1) { + /* 1st open on this device, init hardware */ + retval = startup(info); + if (retval < 0) +@@ -3444,8 +3444,8 @@ cleanup: + if (retval) { + if (tty->count == 1) + info->port.tty = NULL; /* tty layer will release tty struct */ +- if(info->port.count) +- info->port.count--; ++ if (atomic_read(&info->port.count)) ++ atomic_dec(&info->port.count); + } + + return retval; +@@ -7653,7 +7653,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding, + unsigned short new_crctype; + + /* return error if TTY interface open */ +- if (info->port.count) ++ if (atomic_read(&info->port.count)) + return -EBUSY; + + switch (encoding) +@@ -7748,7 +7748,7 @@ static int hdlcdev_open(struct net_device *dev) + + /* arbitrate between network and tty opens */ + spin_lock_irqsave(&info->netlock, flags); +- if (info->port.count != 0 || info->netcount != 0) { ++ if (atomic_read(&info->port.count) != 0 || info->netcount != 0) { + printk(KERN_WARNING "%s: hdlc_open returning busy\n", dev->name); + spin_unlock_irqrestore(&info->netlock, flags); + return -EBUSY; +@@ -7834,7 +7834,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) + printk("%s:hdlcdev_ioctl(%s)\n",__FILE__,dev->name); + + /* return error if TTY interface open */ +- if (info->port.count) ++ if (atomic_read(&info->port.count)) + return -EBUSY; + + if (cmd != SIOCWANDEV) +diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c +index aa1debf..9297a16 100644 +--- a/drivers/tty/synclink_gt.c ++++ b/drivers/tty/synclink_gt.c +@@ -671,7 +671,7 @@ static int open(struct tty_struct *tty, struct file *filp) + tty->driver_data = info; + info->port.tty = tty; + +- DBGINFO(("%s open, old ref count = %d\n", info->device_name, info->port.count)); ++ DBGINFO(("%s open, old ref count = %d\n", info->device_name, atomic_read(&info->port.count))); + + /* If port is closing, signal caller to try again */ + if (tty_hung_up_p(filp) || info->port.flags & ASYNC_CLOSING){ +@@ -692,10 +692,10 @@ static int open(struct tty_struct *tty, struct file *filp) + mutex_unlock(&info->port.mutex); + goto cleanup; + } +- info->port.count++; ++ atomic_inc(&info->port.count); + spin_unlock_irqrestore(&info->netlock, flags); + +- if (info->port.count == 1) { ++ if (atomic_read(&info->port.count) == 1) { + /* 1st open on this device, init hardware */ + retval = startup(info); + if (retval < 0) { +@@ -716,8 +716,8 @@ cleanup: + if (retval) { + if (tty->count == 1) + info->port.tty = NULL; /* tty layer will release tty struct */ +- if(info->port.count) +- info->port.count--; ++ if(atomic_read(&info->port.count)) ++ atomic_dec(&info->port.count); + } + + DBGINFO(("%s open rc=%d\n", info->device_name, retval)); +@@ -730,7 +730,7 @@ static void close(struct tty_struct *tty, struct file *filp) + + if (sanity_check(info, tty->name, "close")) + return; +- DBGINFO(("%s close entry, count=%d\n", info->device_name, info->port.count)); ++ DBGINFO(("%s close entry, count=%d\n", info->device_name, atomic_read(&info->port.count))); + + if (tty_port_close_start(&info->port, tty, filp) == 0) + goto cleanup; +@@ -747,7 +747,7 @@ static void close(struct tty_struct *tty, struct file *filp) + tty_port_close_end(&info->port, tty); + info->port.tty = NULL; + cleanup: +- DBGINFO(("%s close exit, count=%d\n", tty->driver->name, info->port.count)); ++ DBGINFO(("%s close exit, count=%d\n", tty->driver->name, atomic_read(&info->port.count))); + } + + static void hangup(struct tty_struct *tty) +@@ -765,7 +765,7 @@ static void hangup(struct tty_struct *tty) + shutdown(info); + + spin_lock_irqsave(&info->port.lock, flags); +- info->port.count = 0; ++ atomic_set(&info->port.count, 0); + info->port.flags &= ~ASYNC_NORMAL_ACTIVE; + info->port.tty = NULL; + spin_unlock_irqrestore(&info->port.lock, flags); +@@ -1450,7 +1450,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding, + unsigned short new_crctype; + + /* return error if TTY interface open */ +- if (info->port.count) ++ if (atomic_read(&info->port.count)) + return -EBUSY; + + DBGINFO(("%s hdlcdev_attach\n", info->device_name)); +@@ -1545,7 +1545,7 @@ static int hdlcdev_open(struct net_device *dev) + + /* arbitrate between network and tty opens */ + spin_lock_irqsave(&info->netlock, flags); +- if (info->port.count != 0 || info->netcount != 0) { ++ if (atomic_read(&info->port.count) != 0 || info->netcount != 0) { + DBGINFO(("%s hdlc_open busy\n", dev->name)); + spin_unlock_irqrestore(&info->netlock, flags); + return -EBUSY; +@@ -1630,7 +1630,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) + DBGINFO(("%s hdlcdev_ioctl\n", dev->name)); + + /* return error if TTY interface open */ +- if (info->port.count) ++ if (atomic_read(&info->port.count)) + return -EBUSY; + + if (cmd != SIOCWANDEV) +@@ -2419,7 +2419,7 @@ static irqreturn_t slgt_interrupt(int dummy, void *dev_id) + if (port == NULL) + continue; + spin_lock(&port->lock); +- if ((port->port.count || port->netcount) && ++ if ((atomic_read(&port->port.count) || port->netcount) && + port->pending_bh && !port->bh_running && + !port->bh_requested) { + DBGISR(("%s bh queued\n", port->device_name)); +@@ -3308,7 +3308,7 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp, + spin_lock_irqsave(&info->lock, flags); + if (!tty_hung_up_p(filp)) { + extra_count = true; +- port->count--; ++ atomic_dec(&port->count); + } + spin_unlock_irqrestore(&info->lock, flags); + port->blocked_open++; +@@ -3345,7 +3345,7 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp, + remove_wait_queue(&port->open_wait, &wait); + + if (extra_count) +- port->count++; ++ atomic_inc(&port->count); + port->blocked_open--; + + if (!retval) +diff --git a/drivers/tty/synclinkmp.c b/drivers/tty/synclinkmp.c +index a3dddc1..8905ab2 100644 +--- a/drivers/tty/synclinkmp.c ++++ b/drivers/tty/synclinkmp.c +@@ -742,7 +742,7 @@ static int open(struct tty_struct *tty, struct file *filp) + + if (debug_level >= DEBUG_LEVEL_INFO) + printk("%s(%d):%s open(), old ref count = %d\n", +- __FILE__,__LINE__,tty->driver->name, info->port.count); ++ __FILE__,__LINE__,tty->driver->name, atomic_read(&info->port.count)); + + /* If port is closing, signal caller to try again */ + if (tty_hung_up_p(filp) || info->port.flags & ASYNC_CLOSING){ +@@ -761,10 +761,10 @@ static int open(struct tty_struct *tty, struct file *filp) + spin_unlock_irqrestore(&info->netlock, flags); + goto cleanup; + } +- info->port.count++; ++ atomic_inc(&info->port.count); + spin_unlock_irqrestore(&info->netlock, flags); + +- if (info->port.count == 1) { ++ if (atomic_read(&info->port.count) == 1) { + /* 1st open on this device, init hardware */ + retval = startup(info); + if (retval < 0) +@@ -788,8 +788,8 @@ cleanup: + if (retval) { + if (tty->count == 1) + info->port.tty = NULL; /* tty layer will release tty struct */ +- if(info->port.count) +- info->port.count--; ++ if(atomic_read(&info->port.count)) ++ atomic_dec(&info->port.count); + } + + return retval; +@@ -807,7 +807,7 @@ static void close(struct tty_struct *tty, struct file *filp) + + if (debug_level >= DEBUG_LEVEL_INFO) + printk("%s(%d):%s close() entry, count=%d\n", +- __FILE__,__LINE__, info->device_name, info->port.count); ++ __FILE__,__LINE__, info->device_name, atomic_read(&info->port.count)); + + if (tty_port_close_start(&info->port, tty, filp) == 0) + goto cleanup; +@@ -826,7 +826,7 @@ static void close(struct tty_struct *tty, struct file *filp) + cleanup: + if (debug_level >= DEBUG_LEVEL_INFO) + printk("%s(%d):%s close() exit, count=%d\n", __FILE__,__LINE__, +- tty->driver->name, info->port.count); ++ tty->driver->name, atomic_read(&info->port.count)); + } + + /* Called by tty_hangup() when a hangup is signaled. +@@ -849,7 +849,7 @@ static void hangup(struct tty_struct *tty) + shutdown(info); + + spin_lock_irqsave(&info->port.lock, flags); +- info->port.count = 0; ++ atomic_set(&info->port.count, 0); + info->port.flags &= ~ASYNC_NORMAL_ACTIVE; + info->port.tty = NULL; + spin_unlock_irqrestore(&info->port.lock, flags); +@@ -1557,7 +1557,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding, + unsigned short new_crctype; + + /* return error if TTY interface open */ +- if (info->port.count) ++ if (atomic_read(&info->port.count)) + return -EBUSY; + + switch (encoding) +@@ -1652,7 +1652,7 @@ static int hdlcdev_open(struct net_device *dev) + + /* arbitrate between network and tty opens */ + spin_lock_irqsave(&info->netlock, flags); +- if (info->port.count != 0 || info->netcount != 0) { ++ if (atomic_read(&info->port.count) != 0 || info->netcount != 0) { + printk(KERN_WARNING "%s: hdlc_open returning busy\n", dev->name); + spin_unlock_irqrestore(&info->netlock, flags); + return -EBUSY; +@@ -1738,7 +1738,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) + printk("%s:hdlcdev_ioctl(%s)\n",__FILE__,dev->name); + + /* return error if TTY interface open */ +- if (info->port.count) ++ if (atomic_read(&info->port.count)) + return -EBUSY; + + if (cmd != SIOCWANDEV) +@@ -2623,7 +2623,7 @@ static irqreturn_t synclinkmp_interrupt(int dummy, void *dev_id) + * do not request bottom half processing if the + * device is not open in a normal mode. + */ +- if ( port && (port->port.count || port->netcount) && ++ if ( port && (atomic_read(&port->port.count) || port->netcount) && + port->pending_bh && !port->bh_running && + !port->bh_requested ) { + if ( debug_level >= DEBUG_LEVEL_ISR ) +@@ -3321,12 +3321,12 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp, + + if (debug_level >= DEBUG_LEVEL_INFO) + printk("%s(%d):%s block_til_ready() before block, count=%d\n", +- __FILE__,__LINE__, tty->driver->name, port->count ); ++ __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count)); + + spin_lock_irqsave(&info->lock, flags); + if (!tty_hung_up_p(filp)) { + extra_count = true; +- port->count--; ++ atomic_dec(&port->count); + } + spin_unlock_irqrestore(&info->lock, flags); + port->blocked_open++; +@@ -3355,7 +3355,7 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp, + + if (debug_level >= DEBUG_LEVEL_INFO) + printk("%s(%d):%s block_til_ready() count=%d\n", +- __FILE__,__LINE__, tty->driver->name, port->count ); ++ __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count)); + + tty_unlock(); + schedule(); +@@ -3366,12 +3366,12 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp, + remove_wait_queue(&port->open_wait, &wait); + + if (extra_count) +- port->count++; ++ atomic_inc(&port->count); + port->blocked_open--; + + if (debug_level >= DEBUG_LEVEL_INFO) + printk("%s(%d):%s block_til_ready() after, count=%d\n", +- __FILE__,__LINE__, tty->driver->name, port->count ); ++ __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count)); + + if (!retval) + port->flags |= ASYNC_NORMAL_ACTIVE; diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c index 05728894..b9d44c6 100644 --- a/drivers/tty/sysrq.c @@ -37976,10 +38336,10 @@ index 05728894..b9d44c6 100644 if (get_user(c, buf)) diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c -index d939bd7..33d92cd 100644 +index b425c79..08a3f06 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c -@@ -3278,7 +3278,7 @@ EXPORT_SYMBOL_GPL(get_current_tty); +@@ -3283,7 +3283,7 @@ EXPORT_SYMBOL_GPL(get_current_tty); void tty_default_fops(struct file_operations *fops) { @@ -37989,10 +38349,10 @@ index d939bd7..33d92cd 100644 /* diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c -index 24b95db..9c078d0 100644 +index 9911eb6..5abe0e1 100644 --- a/drivers/tty/tty_ldisc.c +++ b/drivers/tty/tty_ldisc.c -@@ -57,7 +57,7 @@ static void put_ldisc(struct tty_ldisc *ld) +@@ -56,7 +56,7 @@ static void put_ldisc(struct tty_ldisc *ld) if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) { struct tty_ldisc_ops *ldo = ld->ops; @@ -38001,7 +38361,7 @@ index 24b95db..9c078d0 100644 module_put(ldo->owner); spin_unlock_irqrestore(&tty_ldisc_lock, flags); -@@ -92,7 +92,7 @@ int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc) +@@ -91,7 +91,7 @@ int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc) spin_lock_irqsave(&tty_ldisc_lock, flags); tty_ldiscs[disc] = new_ldisc; new_ldisc->num = disc; @@ -38010,7 +38370,7 @@ index 24b95db..9c078d0 100644 spin_unlock_irqrestore(&tty_ldisc_lock, flags); return ret; -@@ -120,7 +120,7 @@ int tty_unregister_ldisc(int disc) +@@ -119,7 +119,7 @@ int tty_unregister_ldisc(int disc) return -EINVAL; spin_lock_irqsave(&tty_ldisc_lock, flags); @@ -38019,7 +38379,7 @@ index 24b95db..9c078d0 100644 ret = -EBUSY; else tty_ldiscs[disc] = NULL; -@@ -141,7 +141,7 @@ static struct tty_ldisc_ops *get_ldops(int disc) +@@ -140,7 +140,7 @@ static struct tty_ldisc_ops *get_ldops(int disc) if (ldops) { ret = ERR_PTR(-EAGAIN); if (try_module_get(ldops->owner)) { @@ -38028,7 +38388,7 @@ index 24b95db..9c078d0 100644 ret = ldops; } } -@@ -154,7 +154,7 @@ static void put_ldops(struct tty_ldisc_ops *ldops) +@@ -153,7 +153,7 @@ static void put_ldops(struct tty_ldisc_ops *ldops) unsigned long flags; spin_lock_irqsave(&tty_ldisc_lock, flags); @@ -38037,11 +38397,78 @@ index 24b95db..9c078d0 100644 module_put(ldops->owner); spin_unlock_irqrestore(&tty_ldisc_lock, flags); } +diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c +index bf6e238..d401c04 100644 +--- a/drivers/tty/tty_port.c ++++ b/drivers/tty/tty_port.c +@@ -138,7 +138,7 @@ void tty_port_hangup(struct tty_port *port) + unsigned long flags; + + spin_lock_irqsave(&port->lock, flags); +- port->count = 0; ++ atomic_set(&port->count, 0); + port->flags &= ~ASYNC_NORMAL_ACTIVE; + if (port->tty) { + set_bit(TTY_IO_ERROR, &port->tty->flags); +@@ -264,7 +264,7 @@ int tty_port_block_til_ready(struct tty_port *port, + /* The port lock protects the port counts */ + spin_lock_irqsave(&port->lock, flags); + if (!tty_hung_up_p(filp)) +- port->count--; ++ atomic_dec(&port->count); + port->blocked_open++; + spin_unlock_irqrestore(&port->lock, flags); + +@@ -306,7 +306,7 @@ int tty_port_block_til_ready(struct tty_port *port, + we must not mess that up further */ + spin_lock_irqsave(&port->lock, flags); + if (!tty_hung_up_p(filp)) +- port->count++; ++ atomic_inc(&port->count); + port->blocked_open--; + if (retval == 0) + port->flags |= ASYNC_NORMAL_ACTIVE; +@@ -326,19 +326,19 @@ int tty_port_close_start(struct tty_port *port, + return 0; + } + +- if (tty->count == 1 && port->count != 1) { ++ if (tty->count == 1 && atomic_read(&port->count) != 1) { + printk(KERN_WARNING + "tty_port_close_start: tty->count = 1 port count = %d.\n", +- port->count); +- port->count = 1; ++ atomic_read(&port->count)); ++ atomic_set(&port->count, 1); + } +- if (--port->count < 0) { ++ if (atomic_dec_return(&port->count) < 0) { + printk(KERN_WARNING "tty_port_close_start: count = %d\n", +- port->count); +- port->count = 0; ++ atomic_read(&port->count)); ++ atomic_set(&port->count, 0); + } + +- if (port->count) { ++ if (atomic_read(&port->count)) { + spin_unlock_irqrestore(&port->lock, flags); + if (port->ops->drop) + port->ops->drop(port); +@@ -418,7 +418,7 @@ int tty_port_open(struct tty_port *port, struct tty_struct *tty, + { + spin_lock_irq(&port->lock); + if (!tty_hung_up_p(filp)) +- ++port->count; ++ atomic_inc(&port->count); + spin_unlock_irq(&port->lock); + tty_port_tty_set(port, tty); + diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c -index 3b0c4e3..f98a992 100644 +index 48cc6f2..85584dd 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c -@@ -663,6 +663,16 @@ static void k_spec(struct vc_data *vc, unsigned char value, char up_flag) +@@ -659,6 +659,16 @@ static void k_spec(struct vc_data *vc, unsigned char value, char up_flag) kbd->kbdmode == VC_OFF) && value != KVAL(K_SAK)) return; /* SAK is allowed even in raw mode */ @@ -38058,7 +38485,7 @@ index 3b0c4e3..f98a992 100644 fn_handler[value](vc); } -@@ -1812,9 +1822,6 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, +@@ -1808,9 +1818,6 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry))) return -EFAULT; @@ -38068,7 +38495,7 @@ index 3b0c4e3..f98a992 100644 switch (cmd) { case KDGKBENT: /* Ensure another thread doesn't free it under us */ -@@ -1829,6 +1836,9 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, +@@ -1825,6 +1832,9 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm, spin_unlock_irqrestore(&kbd_event_lock, flags); return put_user(val, &user_kbe->kb_value); case KDSKBENT: @@ -38078,7 +38505,7 @@ index 3b0c4e3..f98a992 100644 if (!perm) return -EPERM; if (!i && v == K_NOSUCHMAP) { -@@ -1919,9 +1929,6 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) +@@ -1915,9 +1925,6 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) int i, j, k; int ret; @@ -38088,7 +38515,7 @@ index 3b0c4e3..f98a992 100644 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL); if (!kbs) { ret = -ENOMEM; -@@ -1955,6 +1962,9 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) +@@ -1951,6 +1958,9 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm) kfree(kbs); return ((p && *p) ? -EOVERFLOW : 0); case KDSKBSENT: @@ -38194,7 +38621,7 @@ index a783d53..cb30d94 100644 ret = uio_get_minor(idev); if (ret) diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c -index 98b89fe..aff824e 100644 +index b7eb86a..36d28af 100644 --- a/drivers/usb/atm/cxacru.c +++ b/drivers/usb/atm/cxacru.c @@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev, @@ -38207,7 +38634,7 @@ index 98b89fe..aff824e 100644 pos += tmp; diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c -index d3448ca..d2864ca 100644 +index ee62b35..b663594 100644 --- a/drivers/usb/atm/usbatm.c +++ b/drivers/usb/atm/usbatm.c @@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char @@ -38272,7 +38699,7 @@ index d3448ca..d2864ca 100644 skb = skb_dequeue(&instance->sndqueue); } -@@ -773,11 +773,11 @@ static int usbatm_atm_proc_read(struct atm_dev *atm_dev, loff_t * pos, char *pag +@@ -770,11 +770,11 @@ static int usbatm_atm_proc_read(struct atm_dev *atm_dev, loff_t * pos, char *pag if (!left--) return sprintf(page, "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n", @@ -38361,6 +38788,122 @@ index 1fc8f12..20647c1 100644 return 0; } +diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c +index 5b3f5ff..6e00893 100644 +--- a/drivers/usb/gadget/u_serial.c ++++ b/drivers/usb/gadget/u_serial.c +@@ -731,9 +731,9 @@ static int gs_open(struct tty_struct *tty, struct file *file) + spin_lock_irq(&port->port_lock); + + /* already open? Great. */ +- if (port->port.count) { ++ if (atomic_read(&port->port.count)) { + status = 0; +- port->port.count++; ++ atomic_inc(&port->port.count); + + /* currently opening/closing? wait ... */ + } else if (port->openclose) { +@@ -792,7 +792,7 @@ static int gs_open(struct tty_struct *tty, struct file *file) + tty->driver_data = port; + port->port.tty = tty; + +- port->port.count = 1; ++ atomic_set(&port->port.count, 1); + port->openclose = false; + + /* if connected, start the I/O stream */ +@@ -834,11 +834,11 @@ static void gs_close(struct tty_struct *tty, struct file *file) + + spin_lock_irq(&port->port_lock); + +- if (port->port.count != 1) { +- if (port->port.count == 0) ++ if (atomic_read(&port->port.count) != 1) { ++ if (atomic_read(&port->port.count) == 0) + WARN_ON(1); + else +- --port->port.count; ++ atomic_dec(&port->port.count); + goto exit; + } + +@@ -848,7 +848,7 @@ static void gs_close(struct tty_struct *tty, struct file *file) + * and sleep if necessary + */ + port->openclose = true; +- port->port.count = 0; ++ atomic_set(&port->port.count, 0); + + gser = port->port_usb; + if (gser && gser->disconnect) +@@ -1152,7 +1152,7 @@ static int gs_closed(struct gs_port *port) + int cond; + + spin_lock_irq(&port->port_lock); +- cond = (port->port.count == 0) && !port->openclose; ++ cond = (atomic_read(&port->port.count) == 0) && !port->openclose; + spin_unlock_irq(&port->port_lock); + return cond; + } +@@ -1265,7 +1265,7 @@ int gserial_connect(struct gserial *gser, u8 port_num) + /* if it's already open, start I/O ... and notify the serial + * protocol about open/close status (connect/disconnect). + */ +- if (port->port.count) { ++ if (atomic_read(&port->port.count)) { + pr_debug("gserial_connect: start ttyGS%d\n", port->port_num); + gs_start_io(port); + if (gser->connect) +@@ -1312,7 +1312,7 @@ void gserial_disconnect(struct gserial *gser) + + port->port_usb = NULL; + gser->ioport = NULL; +- if (port->port.count > 0 || port->openclose) { ++ if (atomic_read(&port->port.count) > 0 || port->openclose) { + wake_up_interruptible(&port->drain_wait); + if (port->port.tty) + tty_hangup(port->port.tty); +@@ -1328,7 +1328,7 @@ void gserial_disconnect(struct gserial *gser) + + /* finally, free any unused/unusable I/O buffers */ + spin_lock_irqsave(&port->port_lock, flags); +- if (port->port.count == 0 && !port->openclose) ++ if (atomic_read(&port->port.count) == 0 && !port->openclose) + gs_buf_free(&port->port_write_buf); + gs_free_requests(gser->out, &port->read_pool, NULL); + gs_free_requests(gser->out, &port->read_queue, NULL); +diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c +index b9cca6d..75c75df 100644 +--- a/drivers/usb/serial/console.c ++++ b/drivers/usb/serial/console.c +@@ -127,7 +127,7 @@ static int usb_console_setup(struct console *co, char *options) + + info->port = port; + +- ++port->port.count; ++ atomic_inc(&port->port.count); + if (!test_bit(ASYNCB_INITIALIZED, &port->port.flags)) { + if (serial->type->set_termios) { + /* +@@ -177,7 +177,7 @@ static int usb_console_setup(struct console *co, char *options) + } + /* Now that any required fake tty operations are completed restore + * the tty port count */ +- --port->port.count; ++ atomic_dec(&port->port.count); + /* The console is special in terms of closing the device so + * indicate this port is now acting as a system console. */ + port->port.console = 1; +@@ -190,7 +190,7 @@ static int usb_console_setup(struct console *co, char *options) + free_tty: + kfree(tty); + reset_open_count: +- port->port.count = 0; ++ atomic_set(&port->port.count, 0); + usb_autopm_put_interface(serial->interface); + error_get_interface: + usb_serial_put(serial); diff --git a/drivers/usb/wusbcore/wa-hc.h b/drivers/usb/wusbcore/wa-hc.h index d6bea3e..60b250e 100644 --- a/drivers/usb/wusbcore/wa-hc.h @@ -38397,10 +38940,10 @@ index 57c01ab..8a05959 100644 /* diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c -index 51e4c1e..9d87e2a 100644 +index 112156f..eb81154 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c -@@ -632,7 +632,7 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m) +@@ -635,7 +635,7 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m) return 0; } @@ -38437,7 +38980,7 @@ index 5c3960d..15cf8fc 100644 goto out1; } diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c -index c6ce416..3b9b642 100644 +index 0dff12a..2ef47b3 100644 --- a/drivers/video/fbmem.c +++ b/drivers/video/fbmem.c @@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, @@ -38458,7 +39001,7 @@ index c6ce416..3b9b642 100644 info->fbops->fb_imageblit(info, image); image->dy -= image->height + 8; } -@@ -1157,7 +1157,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd, +@@ -1166,7 +1166,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd, return -EFAULT; if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES) return -EINVAL; @@ -41270,7 +41813,7 @@ index 3c14e43..eafa544 100644 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 +4 4 4 4 4 4 diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c -index a159b63..4ab532d 100644 +index 8af6414..658c030 100644 --- a/drivers/video/udlfb.c +++ b/drivers/video/udlfb.c @@ -620,11 +620,11 @@ int dlfb_handle_damage(struct dlfb_data *dev, int x, int y, @@ -41586,7 +42129,7 @@ index e56c934..fc22f4b 100644 struct list_head list; }; diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c -index 014c8dd..6f3dfe6 100644 +index 57ccb75..f6d05f8 100644 --- a/fs/9p/vfs_inode.c +++ b/fs/9p/vfs_inode.c @@ -1303,7 +1303,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd) @@ -41599,7 +42142,7 @@ index 014c8dd..6f3dfe6 100644 p9_debug(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name, IS_ERR(s) ? "<error>" : s); diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt -index e95d1b6..3454244 100644 +index 0225742..1cd4732 100644 --- a/fs/Kconfig.binfmt +++ b/fs/Kconfig.binfmt @@ -89,7 +89,7 @@ config HAVE_AOUT @@ -41612,7 +42155,7 @@ index e95d1b6..3454244 100644 A.out (Assembler.OUTput) is a set of formats for libraries and executables used in the earliest versions of UNIX. Linux used diff --git a/fs/aio.c b/fs/aio.c -index e7f2fad..15ad8a4 100644 +index 55c4c76..11aee6f 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -118,7 +118,7 @@ static int aio_setup_ring(struct kioctx *ctx) @@ -41636,14 +42179,14 @@ index e7f2fad..15ad8a4 100644 (struct compat_iovec __user *)kiocb->ki_buf, - kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec, + kiocb->ki_nbytes, 1, &iovstack, - &kiocb->ki_iovec, 1); + &kiocb->ki_iovec); else #endif ret = rw_copy_check_uvector(type, (struct iovec __user *)kiocb->ki_buf, - kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec, + kiocb->ki_nbytes, 1, &iovstack, - &kiocb->ki_iovec, 1); + &kiocb->ki_iovec); if (ret < 0) goto out; @@ -1460,6 +1461,10 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat) @@ -41658,7 +42201,7 @@ index e7f2fad..15ad8a4 100644 kiocb->ki_cur_seg = 0; /* ki_nbytes/left now reflect bytes instead of segs */ diff --git a/fs/attr.c b/fs/attr.c -index d94d1b6..f9bccd6 100644 +index 0da9095..1386693 100644 --- a/fs/attr.c +++ b/fs/attr.c @@ -99,6 +99,7 @@ int inode_newsize_ok(const struct inode *inode, loff_t offset) @@ -41776,7 +42319,7 @@ index d146e18..12d1bd1 100644 fd_offset + ex.a_text); if (error != N_DATADDR(ex)) { diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c -index 16f7354..7cc1e24 100644 +index 1b52956..271266e 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -32,6 +32,7 @@ @@ -41871,7 +42414,7 @@ index 16f7354..7cc1e24 100644 return -EFAULT; return 0; } -@@ -380,10 +399,10 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, +@@ -378,10 +397,10 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, { struct elf_phdr *elf_phdata; struct elf_phdr *eppnt; @@ -41884,7 +42427,7 @@ index 16f7354..7cc1e24 100644 unsigned long total_size; int retval, i, size; -@@ -429,6 +448,11 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, +@@ -427,6 +446,11 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, goto out_close; } @@ -41896,7 +42439,7 @@ index 16f7354..7cc1e24 100644 eppnt = elf_phdata; for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) { if (eppnt->p_type == PT_LOAD) { -@@ -472,8 +496,8 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, +@@ -470,8 +494,8 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, k = load_addr + eppnt->p_vaddr; if (BAD_ADDR(k) || eppnt->p_filesz > eppnt->p_memsz || @@ -41907,7 +42450,7 @@ index 16f7354..7cc1e24 100644 error = -ENOMEM; goto out_close; } -@@ -525,6 +549,311 @@ out: +@@ -523,6 +547,311 @@ out: return error; } @@ -42219,7 +42762,7 @@ index 16f7354..7cc1e24 100644 /* * These are the functions used to load ELF style executables and shared * libraries. There is no binary dependent code anywhere else. -@@ -541,6 +870,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top) +@@ -539,6 +868,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top) { unsigned int random_variable = 0; @@ -42231,7 +42774,7 @@ index 16f7354..7cc1e24 100644 if ((current->flags & PF_RANDOMIZE) && !(current->personality & ADDR_NO_RANDOMIZE)) { random_variable = get_random_int() & STACK_RND_MASK; -@@ -559,7 +893,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) +@@ -557,7 +891,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) unsigned long load_addr = 0, load_bias = 0; int load_addr_set = 0; char * elf_interpreter = NULL; @@ -42240,7 +42783,7 @@ index 16f7354..7cc1e24 100644 struct elf_phdr *elf_ppnt, *elf_phdata; unsigned long elf_bss, elf_brk; int retval, i; -@@ -569,11 +903,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) +@@ -567,11 +901,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) unsigned long start_code, end_code, start_data, end_data; unsigned long reloc_func_desc __maybe_unused = 0; int executable_stack = EXSTACK_DEFAULT; @@ -42253,7 +42796,7 @@ index 16f7354..7cc1e24 100644 loc = kmalloc(sizeof(*loc), GFP_KERNEL); if (!loc) { -@@ -709,11 +1043,81 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) +@@ -707,11 +1041,81 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) goto out_free_dentry; /* OK, This is the point of no return */ @@ -42336,7 +42879,7 @@ index 16f7354..7cc1e24 100644 if (elf_read_implies_exec(loc->elf_ex, executable_stack)) current->personality |= READ_IMPLIES_EXEC; -@@ -804,6 +1208,20 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) +@@ -802,6 +1206,20 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) #else load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr); #endif @@ -42357,7 +42900,7 @@ index 16f7354..7cc1e24 100644 } error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, -@@ -836,9 +1254,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) +@@ -834,9 +1252,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) * allowed task size. Note that p_filesz must always be * <= p_memsz so it is only necessary to check p_memsz. */ @@ -42370,7 +42913,7 @@ index 16f7354..7cc1e24 100644 /* set_brk can never work. Avoid overflows. */ send_sig(SIGKILL, current, 0); retval = -EINVAL; -@@ -877,11 +1295,40 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) +@@ -875,11 +1293,41 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) goto out_free_dentry; } if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) { @@ -42390,18 +42933,19 @@ index 16f7354..7cc1e24 100644 + + start = ELF_PAGEALIGN(elf_brk); + size = PAGE_SIZE + ((pax_get_random_long() & ((1UL << 22) - 1UL)) << 4); -+ down_write(¤t->mm->mmap_sem); ++ down_read(¤t->mm->mmap_sem); + retval = -ENOMEM; + if (!find_vma_intersection(current->mm, start, start + size + PAGE_SIZE)) { + unsigned long prot = PROT_NONE; + ++ up_read(¤t->mm->mmap_sem); + current->mm->brk_gap = PAGE_ALIGN(size) >> PAGE_SHIFT; +// if (current->personality & ADDR_NO_RANDOMIZE) +// prot = PROT_READ; -+ start = do_mmap(NULL, start, size, prot, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, 0); ++ start = vm_mmap(NULL, start, size, prot, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, 0); + retval = IS_ERR_VALUE(start) ? start : 0; -+ } -+ up_write(¤t->mm->mmap_sem); ++ } else ++ up_read(¤t->mm->mmap_sem); + if (retval == 0) + retval = set_brk(start + size, start + size + PAGE_SIZE); + if (retval < 0) { @@ -42414,7 +42958,7 @@ index 16f7354..7cc1e24 100644 if (elf_interpreter) { unsigned long uninitialized_var(interp_map_addr); -@@ -1109,7 +1556,7 @@ static bool always_dump_vma(struct vm_area_struct *vma) +@@ -1107,7 +1555,7 @@ static bool always_dump_vma(struct vm_area_struct *vma) * Decide what to dump of a segment, part, all or none. */ static unsigned long vma_dump_size(struct vm_area_struct *vma, @@ -42423,7 +42967,7 @@ index 16f7354..7cc1e24 100644 { #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type)) -@@ -1146,7 +1593,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma, +@@ -1144,7 +1592,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma, if (vma->vm_file == NULL) return 0; @@ -42432,7 +42976,7 @@ index 16f7354..7cc1e24 100644 goto whole; /* -@@ -1368,9 +1815,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm) +@@ -1366,9 +1814,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm) { elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv; int i = 0; @@ -42444,7 +42988,7 @@ index 16f7354..7cc1e24 100644 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv); } -@@ -1892,14 +2339,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum, +@@ -1890,14 +2338,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum, } static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma, @@ -42461,7 +43005,7 @@ index 16f7354..7cc1e24 100644 return size; } -@@ -1993,7 +2440,7 @@ static int elf_core_dump(struct coredump_params *cprm) +@@ -1991,7 +2439,7 @@ static int elf_core_dump(struct coredump_params *cprm) dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE); @@ -42470,7 +43014,7 @@ index 16f7354..7cc1e24 100644 offset += elf_core_extra_data_size(); e_shoff = offset; -@@ -2007,10 +2454,12 @@ static int elf_core_dump(struct coredump_params *cprm) +@@ -2005,10 +2453,12 @@ static int elf_core_dump(struct coredump_params *cprm) offset = dataoff; size += sizeof(*elf); @@ -42483,7 +43027,7 @@ index 16f7354..7cc1e24 100644 if (size > cprm->limit || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note))) goto end_coredump; -@@ -2024,7 +2473,7 @@ static int elf_core_dump(struct coredump_params *cprm) +@@ -2022,7 +2472,7 @@ static int elf_core_dump(struct coredump_params *cprm) phdr.p_offset = offset; phdr.p_vaddr = vma->vm_start; phdr.p_paddr = 0; @@ -42492,7 +43036,7 @@ index 16f7354..7cc1e24 100644 phdr.p_memsz = vma->vm_end - vma->vm_start; offset += phdr.p_filesz; phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0; -@@ -2035,6 +2484,7 @@ static int elf_core_dump(struct coredump_params *cprm) +@@ -2033,6 +2483,7 @@ static int elf_core_dump(struct coredump_params *cprm) phdr.p_align = ELF_EXEC_PAGESIZE; size += sizeof(phdr); @@ -42500,7 +43044,7 @@ index 16f7354..7cc1e24 100644 if (size > cprm->limit || !dump_write(cprm->file, &phdr, sizeof(phdr))) goto end_coredump; -@@ -2059,7 +2509,7 @@ static int elf_core_dump(struct coredump_params *cprm) +@@ -2057,7 +2508,7 @@ static int elf_core_dump(struct coredump_params *cprm) unsigned long addr; unsigned long end; @@ -42509,7 +43053,7 @@ index 16f7354..7cc1e24 100644 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) { struct page *page; -@@ -2068,6 +2518,7 @@ static int elf_core_dump(struct coredump_params *cprm) +@@ -2066,6 +2517,7 @@ static int elf_core_dump(struct coredump_params *cprm) page = get_dump_page(addr); if (page) { void *kaddr = kmap(page); @@ -42517,7 +43061,7 @@ index 16f7354..7cc1e24 100644 stop = ((size += PAGE_SIZE) > cprm->limit) || !dump_write(cprm->file, kaddr, PAGE_SIZE); -@@ -2085,6 +2536,7 @@ static int elf_core_dump(struct coredump_params *cprm) +@@ -2083,6 +2535,7 @@ static int elf_core_dump(struct coredump_params *cprm) if (e_phnum == PN_XNUM) { size += sizeof(*shdr4extnum); @@ -42525,7 +43069,7 @@ index 16f7354..7cc1e24 100644 if (size > cprm->limit || !dump_write(cprm->file, shdr4extnum, sizeof(*shdr4extnum))) -@@ -2105,6 +2557,97 @@ out: +@@ -2103,6 +2556,97 @@ out: #endif /* CONFIG_ELF_CORE */ @@ -42624,7 +43168,7 @@ index 16f7354..7cc1e24 100644 { register_binfmt(&elf_format); diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c -index 6b2daf9..a70dccb 100644 +index 178cb70..8972997 100644 --- a/fs/binfmt_flat.c +++ b/fs/binfmt_flat.c @@ -562,7 +562,9 @@ static int load_flat_file(struct linux_binprm * bprm, @@ -42632,7 +43176,7 @@ index 6b2daf9..a70dccb 100644 printk("Unable to allocate RAM for process data, errno %d\n", (int)-realdatastart); + down_write(¤t->mm->mmap_sem); - do_munmap(current->mm, textpos, text_len); + vm_munmap(textpos, text_len); + up_write(¤t->mm->mmap_sem); ret = realdatastart; goto err; @@ -42642,8 +43186,8 @@ index 6b2daf9..a70dccb 100644 if (IS_ERR_VALUE(result)) { printk("Unable to read data+bss, errno %d\n", (int)-result); + down_write(¤t->mm->mmap_sem); - do_munmap(current->mm, textpos, text_len); - do_munmap(current->mm, realdatastart, len); + vm_munmap(textpos, text_len); + vm_munmap(realdatastart, len); + up_write(¤t->mm->mmap_sem); ret = result; goto err; @@ -42653,17 +43197,17 @@ index 6b2daf9..a70dccb 100644 if (IS_ERR_VALUE(result)) { printk("Unable to read code+data+bss, errno %d\n",(int)-result); + down_write(¤t->mm->mmap_sem); - do_munmap(current->mm, textpos, text_len + data_len + extra + + vm_munmap(textpos, text_len + data_len + extra + MAX_SHARED_LIBS * sizeof(unsigned long)); + up_write(¤t->mm->mmap_sem); ret = result; goto err; } diff --git a/fs/bio.c b/fs/bio.c -index 84da885..bac1d48 100644 +index 73922ab..16642dd 100644 --- a/fs/bio.c +++ b/fs/bio.c -@@ -838,7 +838,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, +@@ -841,7 +841,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, /* * Overflow, abort */ @@ -42672,7 +43216,7 @@ index 84da885..bac1d48 100644 return ERR_PTR(-EINVAL); nr_pages += end - start; -@@ -972,7 +972,7 @@ static struct bio *__bio_map_user_iov(struct request_queue *q, +@@ -975,7 +975,7 @@ static struct bio *__bio_map_user_iov(struct request_queue *q, /* * Overflow, abort */ @@ -42681,7 +43225,7 @@ index 84da885..bac1d48 100644 return ERR_PTR(-EINVAL); nr_pages += end - start; -@@ -1234,7 +1234,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err) +@@ -1237,7 +1237,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err) const int read = bio_data_dir(bio) == READ; struct bio_map_data *bmd = bio->bi_private; int i; @@ -42691,7 +43235,7 @@ index 84da885..bac1d48 100644 __bio_for_each_segment(bvec, bio, i, 0) { char *addr = page_address(bvec->bv_page); diff --git a/fs/block_dev.c b/fs/block_dev.c -index ba11c30..623d736 100644 +index c2bbe1f..9dfbc23 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -704,7 +704,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole, @@ -42704,10 +43248,10 @@ index ba11c30..623d736 100644 else if (whole->bd_holder != NULL) return false; /* is a partition of a held device */ diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c -index c053e90..e5f1afc 100644 +index da6e936..1598dd0 100644 --- a/fs/btrfs/check-integrity.c +++ b/fs/btrfs/check-integrity.c -@@ -156,7 +156,7 @@ struct btrfsic_block { +@@ -155,7 +155,7 @@ struct btrfsic_block { union { bio_end_io_t *bio; bh_end_io_t *bh; @@ -42717,10 +43261,10 @@ index c053e90..e5f1afc 100644 u64 flush_gen; /* only valid if !never_written */ }; diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c -index 4106264..8157ede 100644 +index 8206b39..06d5654 100644 --- a/fs/btrfs/ctree.c +++ b/fs/btrfs/ctree.c -@@ -513,9 +513,12 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans, +@@ -973,9 +973,12 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans, free_extent_buffer(buf); add_root_to_dirty_list(root); } else { @@ -42737,10 +43281,10 @@ index 4106264..8157ede 100644 WARN_ON(trans->transid != btrfs_header_generation(parent)); diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 0df0d1f..4bdcbfe 100644 +index a7d1921..a32dba2 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c -@@ -7074,7 +7074,7 @@ fail: +@@ -7111,7 +7111,7 @@ fail: return -ENOMEM; } @@ -42749,7 +43293,7 @@ index 0df0d1f..4bdcbfe 100644 struct dentry *dentry, struct kstat *stat) { struct inode *inode = dentry->d_inode; -@@ -7088,6 +7088,14 @@ static int btrfs_getattr(struct vfsmount *mnt, +@@ -7125,6 +7125,14 @@ static int btrfs_getattr(struct vfsmount *mnt, return 0; } @@ -42765,10 +43309,10 @@ index 0df0d1f..4bdcbfe 100644 * If a file is moved, it will inherit the cow and compression flags of the new * directory. diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 14f8e1f..ab8d81f 100644 +index 0e92e57..8b560de 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c -@@ -2882,9 +2882,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg) +@@ -2902,9 +2902,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg) for (i = 0; i < num_types; i++) { struct btrfs_space_info *tmp; @@ -42781,7 +43325,7 @@ index 14f8e1f..ab8d81f 100644 info = NULL; rcu_read_lock(); list_for_each_entry_rcu(tmp, &root->fs_info->space_info, -@@ -2906,15 +2909,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg) +@@ -2926,10 +2929,7 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg) memcpy(dest, &space, sizeof(space)); dest++; space_args.total_spaces++; @@ -42792,12 +43336,6 @@ index 14f8e1f..ab8d81f 100644 } up_read(&info->groups_sem); } - -- user_dest = (struct btrfs_ioctl_space_info *) -+ user_dest = (struct btrfs_ioctl_space_info __user *) - (arg + sizeof(struct btrfs_ioctl_space_args)); - - if (copy_to_user(user_dest, dest_orig, alloc_size)) diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index 646ee21..f020f87 100644 --- a/fs/btrfs/relocation.c @@ -42988,10 +43526,10 @@ index 3e8094b..cb3ff3d 100644 } diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c -index 2704646..c581c91 100644 +index e814052..28dcdf7 100644 --- a/fs/cifs/cifs_debug.c +++ b/fs/cifs/cifs_debug.c -@@ -265,8 +265,8 @@ static ssize_t cifs_stats_proc_write(struct file *file, +@@ -267,8 +267,8 @@ static ssize_t cifs_stats_proc_write(struct file *file, if (c == '1' || c == 'y' || c == 'Y' || c == '0') { #ifdef CONFIG_CIFS_STATS2 @@ -43002,7 +43540,7 @@ index 2704646..c581c91 100644 #endif /* CONFIG_CIFS_STATS2 */ spin_lock(&cifs_tcp_ses_lock); list_for_each(tmp1, &cifs_tcp_ses_list) { -@@ -279,25 +279,25 @@ static ssize_t cifs_stats_proc_write(struct file *file, +@@ -281,25 +281,25 @@ static ssize_t cifs_stats_proc_write(struct file *file, tcon = list_entry(tmp3, struct cifs_tcon, tcon_list); @@ -43047,7 +43585,7 @@ index 2704646..c581c91 100644 } } } -@@ -327,8 +327,8 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v) +@@ -329,8 +329,8 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v) smBufAllocCount.counter, cifs_min_small); #ifdef CONFIG_CIFS_STATS2 seq_printf(m, "Total Large %d Small %d Allocations\n", @@ -43058,7 +43596,7 @@ index 2704646..c581c91 100644 #endif /* CONFIG_CIFS_STATS2 */ seq_printf(m, "Operations (MIDs): %d\n", atomic_read(&midCount)); -@@ -357,41 +357,41 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v) +@@ -359,41 +359,41 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v) if (tcon->need_reconnect) seq_puts(m, "\tDISCONNECTED "); seq_printf(m, "\nSMBs: %d Oplock Breaks: %d", @@ -43121,10 +43659,10 @@ index 2704646..c581c91 100644 } } diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c -index 541ef81..a78deb8 100644 +index 8b6e344..303a662 100644 --- a/fs/cifs/cifsfs.c +++ b/fs/cifs/cifsfs.c -@@ -985,7 +985,7 @@ cifs_init_request_bufs(void) +@@ -994,7 +994,7 @@ cifs_init_request_bufs(void) cifs_req_cachep = kmem_cache_create("cifs_request", CIFSMaxBufSize + MAX_CIFS_HDR_SIZE, 0, @@ -43133,7 +43671,7 @@ index 541ef81..a78deb8 100644 if (cifs_req_cachep == NULL) return -ENOMEM; -@@ -1012,7 +1012,7 @@ cifs_init_request_bufs(void) +@@ -1021,7 +1021,7 @@ cifs_init_request_bufs(void) efficient to alloc 1 per page off the slab compared to 17K (5page) alloc of large cifs buffers even when page debugging is on */ cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq", @@ -43142,7 +43680,7 @@ index 541ef81..a78deb8 100644 NULL); if (cifs_sm_req_cachep == NULL) { mempool_destroy(cifs_req_poolp); -@@ -1097,8 +1097,8 @@ init_cifs(void) +@@ -1106,8 +1106,8 @@ init_cifs(void) atomic_set(&bufAllocCount, 0); atomic_set(&smBufAllocCount, 0); #ifdef CONFIG_CIFS_STATS2 @@ -43154,10 +43692,10 @@ index 541ef81..a78deb8 100644 atomic_set(&midCount, 0); diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h -index 73fea28..b996b84 100644 +index 6df0cbe..eb7ecbb 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h -@@ -439,28 +439,28 @@ struct cifs_tcon { +@@ -491,28 +491,28 @@ struct cifs_tcon { __u16 Flags; /* optional support bits */ enum statusEnum tidStatus; #ifdef CONFIG_CIFS_STATS @@ -43208,7 +43746,7 @@ index 73fea28..b996b84 100644 #ifdef CONFIG_CIFS_STATS2 unsigned long long time_writes; unsigned long long time_reads; -@@ -677,7 +677,7 @@ convert_delimiter(char *path, char delim) +@@ -735,7 +735,7 @@ convert_delimiter(char *path, char delim) } #ifdef CONFIG_CIFS_STATS @@ -43217,7 +43755,7 @@ index 73fea28..b996b84 100644 static inline void cifs_stats_bytes_written(struct cifs_tcon *tcon, unsigned int bytes) -@@ -1036,8 +1036,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnectCount; +@@ -1093,8 +1093,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnectCount; /* Various Debug counters */ GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */ #ifdef CONFIG_CIFS_STATS2 @@ -43242,7 +43780,7 @@ index 6b0e064..94e6c3c 100644 kfree(p); } diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c -index c29d1aa..58018da 100644 +index 557506a..2fd3816 100644 --- a/fs/cifs/misc.c +++ b/fs/cifs/misc.c @@ -156,7 +156,7 @@ cifs_buf_get(void) @@ -43312,7 +43850,7 @@ index 6901578..d402eb5 100644 return hit; diff --git a/fs/compat.c b/fs/compat.c -index f2944ac..62845d2 100644 +index 6161255..512b1a1 100644 --- a/fs/compat.c +++ b/fs/compat.c @@ -490,7 +490,7 @@ compat_sys_io_setup(unsigned nr_reqs, u32 __user *ctx32p) @@ -43360,7 +43898,7 @@ index f2944ac..62845d2 100644 error = vfs_readdir(file, compat_fillonedir, &buf); if (buf.result) -@@ -900,6 +906,7 @@ struct compat_linux_dirent { +@@ -899,6 +905,7 @@ struct compat_linux_dirent { struct compat_getdents_callback { struct compat_linux_dirent __user *current_dir; struct compat_linux_dirent __user *previous; @@ -43368,7 +43906,7 @@ index f2944ac..62845d2 100644 int count; int error; }; -@@ -921,6 +928,10 @@ static int compat_filldir(void *__buf, const char *name, int namlen, +@@ -920,6 +927,10 @@ static int compat_filldir(void *__buf, const char *name, int namlen, buf->error = -EOVERFLOW; return -EOVERFLOW; } @@ -43379,7 +43917,7 @@ index f2944ac..62845d2 100644 dirent = buf->previous; if (dirent) { if (__put_user(offset, &dirent->d_off)) -@@ -968,6 +979,7 @@ asmlinkage long compat_sys_getdents(unsigned int fd, +@@ -966,6 +977,7 @@ asmlinkage long compat_sys_getdents(unsigned int fd, buf.previous = NULL; buf.count = count; buf.error = 0; @@ -43387,7 +43925,7 @@ index f2944ac..62845d2 100644 error = vfs_readdir(file, compat_filldir, &buf); if (error >= 0) -@@ -989,6 +1001,7 @@ out: +@@ -986,6 +998,7 @@ asmlinkage long compat_sys_getdents(unsigned int fd, struct compat_getdents_callback64 { struct linux_dirent64 __user *current_dir; struct linux_dirent64 __user *previous; @@ -43395,7 +43933,7 @@ index f2944ac..62845d2 100644 int count; int error; }; -@@ -1005,6 +1018,10 @@ static int compat_filldir64(void * __buf, const char * name, int namlen, loff_t +@@ -1002,6 +1015,10 @@ static int compat_filldir64(void * __buf, const char * name, int namlen, loff_t buf->error = -EINVAL; /* only used if we fail.. */ if (reclen > buf->count) return -EINVAL; @@ -43406,7 +43944,7 @@ index f2944ac..62845d2 100644 dirent = buf->previous; if (dirent) { -@@ -1056,13 +1073,14 @@ asmlinkage long compat_sys_getdents64(unsigned int fd, +@@ -1052,13 +1069,14 @@ asmlinkage long compat_sys_getdents64(unsigned int fd, buf.previous = NULL; buf.count = count; buf.error = 0; @@ -43511,10 +44049,10 @@ index 7e6c52d..94bc756 100644 /* * We'll have a dentry and an inode for diff --git a/fs/dcache.c b/fs/dcache.c -index b80531c..8ca7e2d 100644 +index 4046904..5e31505 100644 --- a/fs/dcache.c +++ b/fs/dcache.c -@@ -3084,7 +3084,7 @@ void __init vfs_caches_init(unsigned long mempages) +@@ -3154,7 +3154,7 @@ void __init vfs_caches_init(unsigned long mempages) mempages -= reserve; names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0, @@ -43540,28 +44078,19 @@ index b80bc84..0d46d1a 100644 } EXPORT_SYMBOL_GPL(debugfs_create_dir); diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c -index ab35b11..b30af66 100644 +index a07441a..046fc0d 100644 --- a/fs/ecryptfs/inode.c +++ b/fs/ecryptfs/inode.c -@@ -672,7 +672,7 @@ static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf, +@@ -671,7 +671,7 @@ static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf, old_fs = get_fs(); set_fs(get_ds()); rc = lower_dentry->d_inode->i_op->readlink(lower_dentry, - (char __user *)lower_buf, + (char __force_user *)lower_buf, - lower_bufsiz); + PATH_MAX); set_fs(old_fs); if (rc < 0) -@@ -718,7 +718,7 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd) - } - old_fs = get_fs(); - set_fs(get_ds()); -- rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len); -+ rc = dentry->d_inode->i_op->readlink(dentry, (char __force_user *)buf, len); - set_fs(old_fs); - if (rc < 0) { - kfree(buf); -@@ -733,7 +733,7 @@ out: +@@ -703,7 +703,7 @@ out: static void ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr) { @@ -43606,7 +44135,7 @@ index b2a34a1..162fa69 100644 return rc; } diff --git a/fs/exec.c b/fs/exec.c -index 29e5f84..7acfbdb 100644 +index da27b91..5a05624 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -55,6 +55,15 @@ @@ -43705,7 +44234,7 @@ index 29e5f84..7acfbdb 100644 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags); INIT_LIST_HEAD(&vma->anon_vma_chain); -@@ -291,6 +320,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm) +@@ -287,6 +316,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm) mm->stack_vm = mm->total_vm = 1; up_write(&mm->mmap_sem); bprm->p = vma->vm_end - sizeof(void *); @@ -43718,7 +44247,7 @@ index 29e5f84..7acfbdb 100644 return 0; err: up_write(&mm->mmap_sem); -@@ -399,19 +434,7 @@ err: +@@ -395,19 +430,7 @@ err: return err; } @@ -43739,7 +44268,7 @@ index 29e5f84..7acfbdb 100644 { const char __user *native; -@@ -420,14 +443,14 @@ static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr) +@@ -416,14 +439,14 @@ static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr) compat_uptr_t compat; if (get_user(compat, argv.ptr.compat + nr)) @@ -43756,7 +44285,7 @@ index 29e5f84..7acfbdb 100644 return native; } -@@ -446,7 +469,7 @@ static int count(struct user_arg_ptr argv, int max) +@@ -442,7 +465,7 @@ static int count(struct user_arg_ptr argv, int max) if (!p) break; @@ -43765,7 +44294,7 @@ index 29e5f84..7acfbdb 100644 return -EFAULT; if (i++ >= max) -@@ -480,7 +503,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv, +@@ -476,7 +499,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv, ret = -EFAULT; str = get_user_arg_ptr(argv, argc); @@ -43774,7 +44303,7 @@ index 29e5f84..7acfbdb 100644 goto out; len = strnlen_user(str, MAX_ARG_STRLEN); -@@ -562,7 +585,7 @@ int copy_strings_kernel(int argc, const char *const *__argv, +@@ -558,7 +581,7 @@ int copy_strings_kernel(int argc, const char *const *__argv, int r; mm_segment_t oldfs = get_fs(); struct user_arg_ptr argv = { @@ -43783,7 +44312,7 @@ index 29e5f84..7acfbdb 100644 }; set_fs(KERNEL_DS); -@@ -597,7 +620,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift) +@@ -593,7 +616,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift) unsigned long new_end = old_end - shift; struct mmu_gather tlb; @@ -43793,7 +44322,7 @@ index 29e5f84..7acfbdb 100644 /* * ensure there are no vmas between where we want to go -@@ -606,6 +630,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift) +@@ -602,6 +626,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift) if (vma != find_vma(mm, new_start)) return -EFAULT; @@ -43804,7 +44333,7 @@ index 29e5f84..7acfbdb 100644 /* * cover the whole range: [new_start, old_end) */ -@@ -686,10 +714,6 @@ int setup_arg_pages(struct linux_binprm *bprm, +@@ -682,10 +710,6 @@ int setup_arg_pages(struct linux_binprm *bprm, stack_top = arch_align_stack(stack_top); stack_top = PAGE_ALIGN(stack_top); @@ -43815,7 +44344,7 @@ index 29e5f84..7acfbdb 100644 stack_shift = vma->vm_end - stack_top; bprm->p -= stack_shift; -@@ -701,8 +725,28 @@ int setup_arg_pages(struct linux_binprm *bprm, +@@ -697,8 +721,28 @@ int setup_arg_pages(struct linux_binprm *bprm, bprm->exec -= stack_shift; down_write(&mm->mmap_sem); @@ -43844,7 +44373,7 @@ index 29e5f84..7acfbdb 100644 /* * Adjust stack execute permissions; explicitly enable for * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone -@@ -721,13 +765,6 @@ int setup_arg_pages(struct linux_binprm *bprm, +@@ -717,13 +761,6 @@ int setup_arg_pages(struct linux_binprm *bprm, goto out_unlock; BUG_ON(prev != vma); @@ -43858,7 +44387,7 @@ index 29e5f84..7acfbdb 100644 /* mprotect_fixup is overkill to remove the temporary stack flags */ vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP; -@@ -785,6 +822,8 @@ struct file *open_exec(const char *name) +@@ -781,6 +818,8 @@ struct file *open_exec(const char *name) fsnotify_open(file); @@ -43867,7 +44396,7 @@ index 29e5f84..7acfbdb 100644 err = deny_write_access(file); if (err) goto exit; -@@ -808,7 +847,7 @@ int kernel_read(struct file *file, loff_t offset, +@@ -804,7 +843,7 @@ int kernel_read(struct file *file, loff_t offset, old_fs = get_fs(); set_fs(get_ds()); /* The cast to a user pointer is valid due to the set_fs() */ @@ -43876,7 +44405,7 @@ index 29e5f84..7acfbdb 100644 set_fs(old_fs); return result; } -@@ -1254,7 +1293,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm) +@@ -1257,7 +1296,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm) } rcu_read_unlock(); @@ -43885,7 +44414,7 @@ index 29e5f84..7acfbdb 100644 bprm->unsafe |= LSM_UNSAFE_SHARE; } else { res = -EAGAIN; -@@ -1451,6 +1490,28 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs) +@@ -1460,6 +1499,28 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs) EXPORT_SYMBOL(search_binary_handler); @@ -43914,7 +44443,7 @@ index 29e5f84..7acfbdb 100644 /* * sys_execve() executes a new program. */ -@@ -1459,6 +1520,11 @@ static int do_execve_common(const char *filename, +@@ -1468,6 +1529,11 @@ static int do_execve_common(const char *filename, struct user_arg_ptr envp, struct pt_regs *regs) { @@ -43926,7 +44455,7 @@ index 29e5f84..7acfbdb 100644 struct linux_binprm *bprm; struct file *file; struct files_struct *displaced; -@@ -1466,6 +1532,8 @@ static int do_execve_common(const char *filename, +@@ -1475,6 +1541,8 @@ static int do_execve_common(const char *filename, int retval; const struct cred *cred = current_cred(); @@ -43935,7 +44464,7 @@ index 29e5f84..7acfbdb 100644 /* * We move the actual failure in case of RLIMIT_NPROC excess from * set*uid() to execve() because too many poorly written programs -@@ -1506,12 +1574,27 @@ static int do_execve_common(const char *filename, +@@ -1515,12 +1583,27 @@ static int do_execve_common(const char *filename, if (IS_ERR(file)) goto out_unmark; @@ -43963,7 +44492,7 @@ index 29e5f84..7acfbdb 100644 retval = bprm_mm_init(bprm); if (retval) goto out_file; -@@ -1528,24 +1611,65 @@ static int do_execve_common(const char *filename, +@@ -1537,24 +1620,65 @@ static int do_execve_common(const char *filename, if (retval < 0) goto out; @@ -44033,7 +44562,7 @@ index 29e5f84..7acfbdb 100644 current->fs->in_exec = 0; current->in_execve = 0; acct_update_integrals(current); -@@ -1554,6 +1678,14 @@ static int do_execve_common(const char *filename, +@@ -1563,6 +1687,14 @@ static int do_execve_common(const char *filename, put_files_struct(displaced); return retval; @@ -44048,7 +44577,7 @@ index 29e5f84..7acfbdb 100644 out: if (bprm->mm) { acct_arg_size(bprm, 0); -@@ -1627,7 +1759,7 @@ static int expand_corename(struct core_name *cn) +@@ -1636,7 +1768,7 @@ static int expand_corename(struct core_name *cn) { char *old_corename = cn->corename; @@ -44057,7 +44586,7 @@ index 29e5f84..7acfbdb 100644 cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL); if (!cn->corename) { -@@ -1724,7 +1856,7 @@ static int format_corename(struct core_name *cn, long signr) +@@ -1733,7 +1865,7 @@ static int format_corename(struct core_name *cn, long signr) int pid_in_pattern = 0; int err = 0; @@ -44066,7 +44595,7 @@ index 29e5f84..7acfbdb 100644 cn->corename = kmalloc(cn->size, GFP_KERNEL); cn->used = 0; -@@ -1821,6 +1953,250 @@ out: +@@ -1830,6 +1962,250 @@ out: return ispipe; } @@ -44317,7 +44846,7 @@ index 29e5f84..7acfbdb 100644 static int zap_process(struct task_struct *start, int exit_code) { struct task_struct *t; -@@ -1980,17 +2356,17 @@ static void coredump_finish(struct mm_struct *mm) +@@ -2002,17 +2378,17 @@ static void coredump_finish(struct mm_struct *mm) void set_dumpable(struct mm_struct *mm, int value) { switch (value) { @@ -44338,7 +44867,7 @@ index 29e5f84..7acfbdb 100644 set_bit(MMF_DUMP_SECURELY, &mm->flags); smp_wmb(); set_bit(MMF_DUMPABLE, &mm->flags); -@@ -2003,7 +2379,7 @@ static int __get_dumpable(unsigned long mm_flags) +@@ -2025,7 +2401,7 @@ static int __get_dumpable(unsigned long mm_flags) int ret; ret = mm_flags & MMF_DUMPABLE_MASK; @@ -44347,7 +44876,7 @@ index 29e5f84..7acfbdb 100644 } int get_dumpable(struct mm_struct *mm) -@@ -2018,17 +2394,17 @@ static void wait_for_dump_helpers(struct file *file) +@@ -2040,17 +2416,17 @@ static void wait_for_dump_helpers(struct file *file) pipe = file->f_path.dentry->d_inode->i_pipe; pipe_lock(pipe); @@ -44370,7 +44899,7 @@ index 29e5f84..7acfbdb 100644 pipe_unlock(pipe); } -@@ -2089,7 +2465,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) +@@ -2111,7 +2487,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) int retval = 0; int flag = 0; int ispipe; @@ -44380,7 +44909,7 @@ index 29e5f84..7acfbdb 100644 struct coredump_params cprm = { .signr = signr, .regs = regs, -@@ -2104,6 +2481,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) +@@ -2126,6 +2503,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) audit_core_dumps(signr); @@ -44390,7 +44919,7 @@ index 29e5f84..7acfbdb 100644 binfmt = mm->binfmt; if (!binfmt || !binfmt->core_dump) goto fail; -@@ -2114,14 +2494,16 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) +@@ -2136,14 +2516,16 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) if (!cred) goto fail; /* @@ -44406,12 +44935,12 @@ index 29e5f84..7acfbdb 100644 + if (__get_dumpable(cprm.mm_flags) == SUID_DUMPABLE_SAFE) { /* Setuid core dump mode */ flag = O_EXCL; /* Stop rewrite attacks */ - cred->fsuid = 0; /* Dump root private */ + cred->fsuid = GLOBAL_ROOT_UID; /* Dump root private */ + need_nonrelative = true; } retval = coredump_wait(exit_code, &core_state); -@@ -2171,7 +2553,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) +@@ -2193,7 +2575,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) } cprm.limit = RLIM_INFINITY; @@ -44420,7 +44949,7 @@ index 29e5f84..7acfbdb 100644 if (core_pipe_limit && (core_pipe_limit < dump_count)) { printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n", task_tgid_vnr(current), current->comm); -@@ -2198,9 +2580,19 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) +@@ -2220,9 +2602,19 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) } else { struct inode *inode; @@ -44440,7 +44969,7 @@ index 29e5f84..7acfbdb 100644 cprm.file = filp_open(cn.corename, O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag, 0600); -@@ -2241,7 +2633,7 @@ close_fail: +@@ -2263,7 +2655,7 @@ close_fail: filp_close(cprm.file, NULL); fail_dropcount: if (ispipe) @@ -44449,7 +44978,7 @@ index 29e5f84..7acfbdb 100644 fail_unlock: kfree(cn.corename); fail_corename: -@@ -2260,7 +2652,7 @@ fail: +@@ -2282,7 +2674,7 @@ fail: */ int dump_write(struct file *file, const void *addr, int nr) { @@ -44459,55 +44988,59 @@ index 29e5f84..7acfbdb 100644 EXPORT_SYMBOL(dump_write); diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c -index a8cbe1b..fed04cb 100644 +index 1c36139..cf6b350 100644 --- a/fs/ext2/balloc.c +++ b/fs/ext2/balloc.c -@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct ext2_sb_info *sbi) +@@ -1190,10 +1190,10 @@ static int ext2_has_free_blocks(struct ext2_sb_info *sbi) free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter); root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count); - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) && -+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) && - sbi->s_resuid != current_fsuid() && - (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) { ++ if (free_blocks < root_blocks + 1 && + !uid_eq(sbi->s_resuid, current_fsuid()) && + (gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) || +- !in_group_p (sbi->s_resgid))) { ++ !in_group_p (sbi->s_resgid)) && !capable_nolog(CAP_SYS_RESOURCE)) { return 0; + } + return 1; diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c -index baac1b1..1499b62 100644 +index 25cd608..9ed5294 100644 --- a/fs/ext3/balloc.c +++ b/fs/ext3/balloc.c -@@ -1438,9 +1438,10 @@ static int ext3_has_free_blocks(struct ext3_sb_info *sbi, int use_reservation) +@@ -1438,10 +1438,10 @@ static int ext3_has_free_blocks(struct ext3_sb_info *sbi, int use_reservation) free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter); root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count); - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) && + if (free_blocks < root_blocks + 1 && - !use_reservation && sbi->s_resuid != current_fsuid() && -- (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) { -+ (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid)) && -+ !capable_nolog(CAP_SYS_RESOURCE)) { + !use_reservation && !uid_eq(sbi->s_resuid, current_fsuid()) && + (gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) || +- !in_group_p (sbi->s_resgid))) { ++ !in_group_p (sbi->s_resgid)) && !capable_nolog(CAP_SYS_RESOURCE)) { return 0; } return 1; diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c -index 8da837b..ed3835b 100644 +index cee7812..0e8e65c 100644 --- a/fs/ext4/balloc.c +++ b/fs/ext4/balloc.c -@@ -463,8 +463,8 @@ static int ext4_has_free_clusters(struct ext4_sb_info *sbi, +@@ -488,8 +488,8 @@ static int ext4_has_free_clusters(struct ext4_sb_info *sbi, /* Hm, nope. Are (enough) root reserved clusters available? */ - if (sbi->s_resuid == current_fsuid() || - ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) || + if (uid_eq(sbi->s_resuid, current_fsuid()) || + (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) && in_group_p(sbi->s_resgid)) || - capable(CAP_SYS_RESOURCE) || - (flags & EXT4_MB_USE_ROOT_BLOCKS)) { -+ (flags & EXT4_MB_USE_ROOT_BLOCKS) || ++ (flags & EXT4_MB_USE_ROOT_BLOCKS) || + capable_nolog(CAP_SYS_RESOURCE)) { if (free_clusters >= (nclusters + dirty_clusters)) return 1; diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 0e01e90..ae2bd5e 100644 +index cfc4e01..2f3fd3c 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h -@@ -1225,19 +1225,19 @@ struct ext4_sb_info { +@@ -1247,19 +1247,19 @@ struct ext4_sb_info { unsigned long s_mb_last_start; /* stats for buddy allocator */ @@ -44538,7 +45071,7 @@ index 0e01e90..ae2bd5e 100644 /* locality groups */ diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 6b0a57e..1955a44 100644 +index 1cd6994..5799d45 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -1747,7 +1747,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac, @@ -44595,7 +45128,7 @@ index 6b0a57e..1955a44 100644 } free_percpu(sbi->s_locality_groups); -@@ -3045,16 +3045,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac) +@@ -3047,16 +3047,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac) struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb); if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) { @@ -44618,7 +45151,7 @@ index 6b0a57e..1955a44 100644 } if (ac->ac_op == EXT4_MB_HISTORY_ALLOC) -@@ -3458,7 +3458,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) +@@ -3456,7 +3456,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) trace_ext4_mb_new_inode_pa(ac, pa); ext4_mb_use_inode_pa(ac, pa); @@ -44627,7 +45160,7 @@ index 6b0a57e..1955a44 100644 ei = EXT4_I(ac->ac_inode); grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group); -@@ -3518,7 +3518,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac) +@@ -3516,7 +3516,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac) trace_ext4_mb_new_group_pa(ac, pa); ext4_mb_use_group_pa(ac, pa); @@ -44636,7 +45169,7 @@ index 6b0a57e..1955a44 100644 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group); lg = ac->ac_lg; -@@ -3607,7 +3607,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh, +@@ -3605,7 +3605,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh, * from the bitmap and continue. */ } @@ -44645,7 +45178,7 @@ index 6b0a57e..1955a44 100644 return err; } -@@ -3625,7 +3625,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b, +@@ -3623,7 +3623,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b, ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit); BUG_ON(group != e4b->bd_group && pa->pa_len != 0); mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len); @@ -44655,7 +45188,7 @@ index 6b0a57e..1955a44 100644 return 0; diff --git a/fs/fcntl.c b/fs/fcntl.c -index 75e7c1f..1eb3e4d 100644 +index 81b70e6..d9ae6cf 100644 --- a/fs/fcntl.c +++ b/fs/fcntl.c @@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct pid *pid, enum pid_type type, @@ -46266,10 +46799,10 @@ index 7df2b5e..5804aa7 100644 if (!ret) ret = -EPIPE; diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c -index bc43832..0cfe5a6 100644 +index 334e0b1..fc571e8 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c -@@ -1181,7 +1181,7 @@ static char *read_link(struct dentry *dentry) +@@ -1189,7 +1189,7 @@ static char *read_link(struct dentry *dentry) return link; } @@ -46292,7 +46825,7 @@ index a9ba244..d9df391 100644 kfree(s); } diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c -index 001ef01..f7d5f07 100644 +index cc9281b..58996fb 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -920,7 +920,7 @@ static struct file_system_type hugetlbfs_fs_type = { @@ -46305,10 +46838,10 @@ index 001ef01..f7d5f07 100644 static int can_do_hugetlb_shm(void) { diff --git a/fs/inode.c b/fs/inode.c -index 9f4f5fe..6214688 100644 +index c99163b..a11ad40 100644 --- a/fs/inode.c +++ b/fs/inode.c -@@ -860,8 +860,8 @@ unsigned int get_next_ino(void) +@@ -867,8 +867,8 @@ unsigned int get_next_ino(void) #ifdef CONFIG_SMP if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) { @@ -46334,10 +46867,10 @@ index 4a6cf28..d3a29d3 100644 jffs2_prealloc_raw_node_refs(c, jeb, 1); diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c -index 74d9be1..d5dd140 100644 +index 6f4529d..bf12806 100644 --- a/fs/jffs2/wbuf.c +++ b/fs/jffs2/wbuf.c -@@ -1022,7 +1022,8 @@ static const struct jffs2_unknown_node oob_cleanmarker = +@@ -1023,7 +1023,8 @@ static const struct jffs2_unknown_node oob_cleanmarker = { .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK), .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER), @@ -46361,7 +46894,7 @@ index 4a82950..bcaa0cb 100644 if (jfs_inode_cachep == NULL) return -ENOMEM; diff --git a/fs/libfs.c b/fs/libfs.c -index 18d08f5..fe3dc64 100644 +index f86ec27..4734776 100644 --- a/fs/libfs.c +++ b/fs/libfs.c @@ -165,6 +165,9 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir) @@ -46407,7 +46940,7 @@ index 8392cb8..80d6193 100644 memcpy(c->data, &cookie, 4); c->len=4; diff --git a/fs/locks.c b/fs/locks.c -index 6a64f15..c3dacf2 100644 +index fce6238..34e929c 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -308,7 +308,7 @@ static int flock_make_lock(struct file *filp, struct file_lock **lock, @@ -46437,7 +46970,7 @@ index 6a64f15..c3dacf2 100644 { struct file_lock *fl = locks_alloc_lock(); int error = -ENOMEM; -@@ -2075,16 +2075,16 @@ void locks_remove_flock(struct file *filp) +@@ -2076,16 +2076,16 @@ void locks_remove_flock(struct file *filp) return; if (filp->f_op && filp->f_op->flock) { @@ -46459,10 +46992,10 @@ index 6a64f15..c3dacf2 100644 lock_flocks(); diff --git a/fs/namei.c b/fs/namei.c -index c427919..232326c 100644 +index 7d69419..1487852 100644 --- a/fs/namei.c +++ b/fs/namei.c -@@ -278,16 +278,32 @@ int generic_permission(struct inode *inode, int mask) +@@ -265,16 +265,32 @@ int generic_permission(struct inode *inode, int mask) if (ret != -EACCES) return ret; @@ -46474,14 +47007,14 @@ index c427919..232326c 100644 + if (S_ISDIR(inode->i_mode)) { /* DACs are overridable for directories */ -- if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE)) +- if (inode_capable(inode, CAP_DAC_OVERRIDE)) - return 0; if (!(mask & MAY_WRITE)) -- if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH)) -+ if (ns_capable_nolog(inode_userns(inode), CAP_DAC_OVERRIDE) || -+ ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH)) +- if (inode_capable(inode, CAP_DAC_READ_SEARCH)) ++ if (inode_capable_nolog(inode, CAP_DAC_OVERRIDE) || ++ inode_capable(inode, CAP_DAC_READ_SEARCH)) return 0; -+ if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE)) ++ if (inode_capable(inode, CAP_DAC_OVERRIDE)) + return 0; return -EACCES; } @@ -46490,16 +47023,16 @@ index c427919..232326c 100644 + */ + mask &= MAY_READ | MAY_WRITE | MAY_EXEC; + if (mask == MAY_READ) -+ if (ns_capable_nolog(inode_userns(inode), CAP_DAC_OVERRIDE) || -+ ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH)) ++ if (inode_capable_nolog(inode, CAP_DAC_OVERRIDE) || ++ inode_capable(inode, CAP_DAC_READ_SEARCH)) + return 0; + + /* * Read/write DACs are always overridable. * Executable DACs are overridable when there is * at least one exec bit set. -@@ -296,14 +312,6 @@ int generic_permission(struct inode *inode, int mask) - if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE)) +@@ -283,14 +299,6 @@ int generic_permission(struct inode *inode, int mask) + if (inode_capable(inode, CAP_DAC_OVERRIDE)) return 0; - /* @@ -46507,13 +47040,13 @@ index c427919..232326c 100644 - */ - mask &= MAY_READ | MAY_WRITE | MAY_EXEC; - if (mask == MAY_READ) -- if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH)) +- if (inode_capable(inode, CAP_DAC_READ_SEARCH)) - return 0; - return -EACCES; } -@@ -652,11 +660,19 @@ follow_link(struct path *link, struct nameidata *nd, void **p) +@@ -639,11 +647,19 @@ follow_link(struct path *link, struct nameidata *nd, void **p) return error; } @@ -46534,7 +47067,7 @@ index c427919..232326c 100644 error = 0; if (s) error = __vfs_follow_link(nd, s); -@@ -1355,6 +1371,9 @@ static inline int nested_symlink(struct path *path, struct nameidata *nd) +@@ -1386,6 +1402,9 @@ static inline int nested_symlink(struct path *path, struct nameidata *nd) if (!res) res = walk_component(nd, path, &nd->last, nd->last_type, LOOKUP_FOLLOW); @@ -46544,7 +47077,7 @@ index c427919..232326c 100644 put_link(nd, &link, cookie); } while (res > 0); -@@ -1746,6 +1765,9 @@ static int path_lookupat(int dfd, const char *name, +@@ -1779,6 +1798,9 @@ static int path_lookupat(int dfd, const char *name, err = follow_link(&link, nd, &cookie); if (!err) err = lookup_last(nd, &path); @@ -46554,7 +47087,7 @@ index c427919..232326c 100644 put_link(nd, &link, cookie); } } -@@ -1753,6 +1775,21 @@ static int path_lookupat(int dfd, const char *name, +@@ -1786,6 +1808,21 @@ static int path_lookupat(int dfd, const char *name, if (!err) err = complete_walk(nd); @@ -46576,7 +47109,7 @@ index c427919..232326c 100644 if (!err && nd->flags & LOOKUP_DIRECTORY) { if (!nd->inode->i_op->lookup) { path_put(&nd->path); -@@ -1780,6 +1817,15 @@ static int do_path_lookup(int dfd, const char *name, +@@ -1813,6 +1850,15 @@ static int do_path_lookup(int dfd, const char *name, retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd); if (likely(!retval)) { @@ -46592,7 +47125,7 @@ index c427919..232326c 100644 if (unlikely(!audit_dummy_context())) { if (nd->path.dentry && nd->inode) audit_inode(name, nd->path.dentry); -@@ -2126,6 +2172,13 @@ static int may_open(struct path *path, int acc_mode, int flag) +@@ -2155,6 +2201,13 @@ static int may_open(struct path *path, int acc_mode, int flag) if (flag & O_NOATIME && !inode_owner_or_capable(inode)) return -EPERM; @@ -46606,7 +47139,7 @@ index c427919..232326c 100644 return 0; } -@@ -2187,6 +2240,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path, +@@ -2220,6 +2273,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path, error = complete_walk(nd); if (error) return ERR_PTR(error); @@ -46623,7 +47156,7 @@ index c427919..232326c 100644 audit_inode(pathname, nd->path.dentry); if (open_flag & O_CREAT) { error = -EISDIR; -@@ -2197,6 +2260,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path, +@@ -2230,6 +2293,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path, error = complete_walk(nd); if (error) return ERR_PTR(error); @@ -46640,24 +47173,7 @@ index c427919..232326c 100644 audit_inode(pathname, dir); goto ok; } -@@ -2218,6 +2291,16 @@ static struct file *do_last(struct nameidata *nd, struct path *path, - error = complete_walk(nd); - if (error) - return ERR_PTR(error); -+#ifdef CONFIG_GRKERNSEC -+ if (nd->flags & LOOKUP_RCU) { -+ error = -ECHILD; -+ goto exit; -+ } -+#endif -+ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) { -+ error = -ENOENT; -+ goto exit; -+ } - - error = -ENOTDIR; - if (nd->flags & LOOKUP_DIRECTORY) { -@@ -2258,6 +2341,12 @@ static struct file *do_last(struct nameidata *nd, struct path *path, +@@ -2285,6 +2358,12 @@ retry_lookup: /* Negative dentry, just create the file */ if (!dentry->d_inode) { umode_t mode = op->mode; @@ -46670,7 +47186,7 @@ index c427919..232326c 100644 if (!IS_POSIXACL(dir->d_inode)) mode &= ~current_umask(); /* -@@ -2281,6 +2370,8 @@ static struct file *do_last(struct nameidata *nd, struct path *path, +@@ -2308,6 +2387,8 @@ retry_lookup: error = vfs_create(dir->d_inode, dentry, mode, nd); if (error) goto exit_mutex_unlock; @@ -46679,7 +47195,7 @@ index c427919..232326c 100644 mutex_unlock(&dir->d_inode->i_mutex); dput(nd->path.dentry); nd->path.dentry = dentry; -@@ -2290,6 +2381,19 @@ static struct file *do_last(struct nameidata *nd, struct path *path, +@@ -2317,6 +2398,19 @@ retry_lookup: /* * It already exists. */ @@ -46699,7 +47215,24 @@ index c427919..232326c 100644 mutex_unlock(&dir->d_inode->i_mutex); audit_inode(pathname, path->dentry); -@@ -2407,8 +2511,14 @@ static struct file *path_openat(int dfd, const char *pathname, +@@ -2367,6 +2461,16 @@ finish_lookup: + path_put(&save_parent); + return ERR_PTR(error); + } ++#ifdef CONFIG_GRKERNSEC ++ if (nd->flags & LOOKUP_RCU) { ++ error = -ECHILD; ++ goto exit; ++ } ++#endif ++ if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) { ++ error = -ENOENT; ++ goto exit; ++ } + error = -EISDIR; + if ((open_flag & O_CREAT) && S_ISDIR(nd->inode->i_mode)) + goto exit; +@@ -2476,8 +2580,14 @@ static struct file *path_openat(int dfd, const char *pathname, error = follow_link(&link, nd, &cookie); if (unlikely(error)) filp = ERR_PTR(error); @@ -46715,7 +47248,7 @@ index c427919..232326c 100644 put_link(nd, &link, cookie); } out: -@@ -2502,6 +2612,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path +@@ -2577,6 +2687,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path *path = nd.path; return dentry; eexist: @@ -46727,7 +47260,7 @@ index c427919..232326c 100644 dput(dentry); dentry = ERR_PTR(-EEXIST); fail: -@@ -2524,6 +2639,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname, struct pat +@@ -2599,6 +2714,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname, struct pat } EXPORT_SYMBOL(user_path_create); @@ -46748,7 +47281,7 @@ index c427919..232326c 100644 int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) { int error = may_create(dir, dentry); -@@ -2591,6 +2720,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, +@@ -2665,6 +2794,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, error = mnt_want_write(path.mnt); if (error) goto out_dput; @@ -46766,7 +47299,7 @@ index c427919..232326c 100644 error = security_path_mknod(&path, dentry, mode, dev); if (error) goto out_drop_write; -@@ -2608,6 +2748,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, +@@ -2682,6 +2822,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, } out_drop_write: mnt_drop_write(path.mnt); @@ -46776,7 +47309,7 @@ index c427919..232326c 100644 out_dput: dput(dentry); mutex_unlock(&path.dentry->d_inode->i_mutex); -@@ -2661,12 +2804,21 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode) +@@ -2735,12 +2878,21 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode) error = mnt_want_write(path.mnt); if (error) goto out_dput; @@ -46798,7 +47331,7 @@ index c427919..232326c 100644 out_dput: dput(dentry); mutex_unlock(&path.dentry->d_inode->i_mutex); -@@ -2746,6 +2898,8 @@ static long do_rmdir(int dfd, const char __user *pathname) +@@ -2820,6 +2972,8 @@ static long do_rmdir(int dfd, const char __user *pathname) char * name; struct dentry *dentry; struct nameidata nd; @@ -46807,7 +47340,7 @@ index c427919..232326c 100644 error = user_path_parent(dfd, pathname, &nd, &name); if (error) -@@ -2774,6 +2928,15 @@ static long do_rmdir(int dfd, const char __user *pathname) +@@ -2848,6 +3002,15 @@ static long do_rmdir(int dfd, const char __user *pathname) error = -ENOENT; goto exit3; } @@ -46823,7 +47356,7 @@ index c427919..232326c 100644 error = mnt_want_write(nd.path.mnt); if (error) goto exit3; -@@ -2781,6 +2944,8 @@ static long do_rmdir(int dfd, const char __user *pathname) +@@ -2855,6 +3018,8 @@ static long do_rmdir(int dfd, const char __user *pathname) if (error) goto exit4; error = vfs_rmdir(nd.path.dentry->d_inode, dentry); @@ -46832,7 +47365,7 @@ index c427919..232326c 100644 exit4: mnt_drop_write(nd.path.mnt); exit3: -@@ -2843,6 +3008,8 @@ static long do_unlinkat(int dfd, const char __user *pathname) +@@ -2917,6 +3082,8 @@ static long do_unlinkat(int dfd, const char __user *pathname) struct dentry *dentry; struct nameidata nd; struct inode *inode = NULL; @@ -46841,7 +47374,7 @@ index c427919..232326c 100644 error = user_path_parent(dfd, pathname, &nd, &name); if (error) -@@ -2865,6 +3032,16 @@ static long do_unlinkat(int dfd, const char __user *pathname) +@@ -2939,6 +3106,16 @@ static long do_unlinkat(int dfd, const char __user *pathname) if (!inode) goto slashes; ihold(inode); @@ -46858,7 +47391,7 @@ index c427919..232326c 100644 error = mnt_want_write(nd.path.mnt); if (error) goto exit2; -@@ -2872,6 +3049,8 @@ static long do_unlinkat(int dfd, const char __user *pathname) +@@ -2946,6 +3123,8 @@ static long do_unlinkat(int dfd, const char __user *pathname) if (error) goto exit3; error = vfs_unlink(nd.path.dentry->d_inode, dentry); @@ -46867,7 +47400,7 @@ index c427919..232326c 100644 exit3: mnt_drop_write(nd.path.mnt); exit2: -@@ -2947,10 +3126,18 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, +@@ -3021,10 +3200,18 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, error = mnt_want_write(path.mnt); if (error) goto out_dput; @@ -46886,7 +47419,7 @@ index c427919..232326c 100644 out_drop_write: mnt_drop_write(path.mnt); out_dput: -@@ -3025,6 +3212,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, +@@ -3099,6 +3286,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, { struct dentry *new_dentry; struct path old_path, new_path; @@ -46894,7 +47427,7 @@ index c427919..232326c 100644 int how = 0; int error; -@@ -3048,7 +3236,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, +@@ -3122,7 +3310,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, if (error) return error; @@ -46903,7 +47436,7 @@ index c427919..232326c 100644 error = PTR_ERR(new_dentry); if (IS_ERR(new_dentry)) goto out; -@@ -3059,13 +3247,30 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, +@@ -3133,13 +3321,30 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, error = mnt_want_write(new_path.mnt); if (error) goto out_dput; @@ -46934,7 +47467,7 @@ index c427919..232326c 100644 dput(new_dentry); mutex_unlock(&new_path.dentry->d_inode->i_mutex); path_put(&new_path); -@@ -3299,6 +3504,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, +@@ -3373,6 +3578,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, if (new_dentry == trap) goto exit5; @@ -46947,7 +47480,7 @@ index c427919..232326c 100644 error = mnt_want_write(oldnd.path.mnt); if (error) goto exit5; -@@ -3308,6 +3519,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, +@@ -3382,6 +3593,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, goto exit6; error = vfs_rename(old_dir->d_inode, old_dentry, new_dir->d_inode, new_dentry); @@ -46957,7 +47490,7 @@ index c427919..232326c 100644 exit6: mnt_drop_write(oldnd.path.mnt); exit5: -@@ -3333,6 +3547,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna +@@ -3407,6 +3621,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link) { @@ -46966,7 +47499,7 @@ index c427919..232326c 100644 int len; len = PTR_ERR(link); -@@ -3342,7 +3558,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c +@@ -3416,7 +3632,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c len = strlen(link); if (len > (unsigned) buflen) len = buflen; @@ -46983,10 +47516,10 @@ index c427919..232326c 100644 out: return len; diff --git a/fs/namespace.c b/fs/namespace.c -index 4e46539..b28253c 100644 +index 1e4a5fe..a5ce747 100644 --- a/fs/namespace.c +++ b/fs/namespace.c -@@ -1156,6 +1156,9 @@ static int do_umount(struct mount *mnt, int flags) +@@ -1157,6 +1157,9 @@ static int do_umount(struct mount *mnt, int flags) if (!(sb->s_flags & MS_RDONLY)) retval = do_remount_sb(sb, MS_RDONLY, NULL, 0); up_write(&sb->s_umount); @@ -46996,8 +47529,8 @@ index 4e46539..b28253c 100644 return retval; } -@@ -1175,6 +1178,9 @@ static int do_umount(struct mount *mnt, int flags) - br_write_unlock(vfsmount_lock); +@@ -1176,6 +1179,9 @@ static int do_umount(struct mount *mnt, int flags) + br_write_unlock(&vfsmount_lock); up_write(&namespace_sem); release_mounts(&umount_list); + @@ -47006,7 +47539,7 @@ index 4e46539..b28253c 100644 return retval; } -@@ -2176,6 +2182,16 @@ long do_mount(char *dev_name, char *dir_name, char *type_page, +@@ -2177,6 +2183,16 @@ long do_mount(char *dev_name, char *dir_name, char *type_page, MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT | MS_STRICTATIME); @@ -47023,7 +47556,7 @@ index 4e46539..b28253c 100644 if (flags & MS_REMOUNT) retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags, data_page); -@@ -2190,6 +2206,9 @@ long do_mount(char *dev_name, char *dir_name, char *type_page, +@@ -2191,6 +2207,9 @@ long do_mount(char *dev_name, char *dir_name, char *type_page, dev_name, data_page); dput_out: path_put(&path); @@ -47033,7 +47566,7 @@ index 4e46539..b28253c 100644 return retval; } -@@ -2471,6 +2490,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root, +@@ -2472,6 +2491,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root, if (error) goto out2; @@ -47046,7 +47579,7 @@ index 4e46539..b28253c 100644 error = lock_mount(&old); if (error) diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c -index e8bbfa5..864f936 100644 +index f729698..2bac081 100644 --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -152,7 +152,7 @@ static void nfs_zap_caches_locked(struct inode *inode) @@ -47058,7 +47591,7 @@ index e8bbfa5..864f936 100644 if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)) nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE; else -@@ -1005,16 +1005,16 @@ static int nfs_size_need_update(const struct inode *inode, const struct nfs_fatt +@@ -1008,16 +1008,16 @@ static int nfs_size_need_update(const struct inode *inode, const struct nfs_fatt return nfs_size_to_loff_t(fattr->size) > i_size_read(inode); } @@ -47079,7 +47612,7 @@ index e8bbfa5..864f936 100644 void nfs_fattr_init(struct nfs_fattr *fattr) diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c -index 5686661..80a9a3a 100644 +index c8bd9c3..4f83416 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -933,7 +933,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file, @@ -47159,10 +47692,10 @@ index 99e3610..02c1068 100644 "inode 0x%lx or driver bug.", vdir->i_ino); goto err_out; diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c -index 8639169..76697aa 100644 +index 7389d2d..dfd5dbe 100644 --- a/fs/ntfs/file.c +++ b/fs/ntfs/file.c -@@ -2229,6 +2229,6 @@ const struct inode_operations ntfs_file_inode_ops = { +@@ -2231,6 +2231,6 @@ const struct inode_operations ntfs_file_inode_ops = { #endif /* NTFS_RW */ }; @@ -47301,21 +47834,8 @@ index 68f4541..89cfe6a 100644 /* Copy the blockcheck stats from the superblock probe */ osb->osb_ecc_stats = *stats; -diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c -index 5d22872..523db20 100644 ---- a/fs/ocfs2/symlink.c -+++ b/fs/ocfs2/symlink.c -@@ -142,7 +142,7 @@ bail: - - static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie) - { -- char *link = nd_get_link(nd); -+ const char *link = nd_get_link(nd); - if (!IS_ERR(link)) - kfree(link); - } diff --git a/fs/open.c b/fs/open.c -index 3f1108b..822d7f7 100644 +index 1540632..79d7242 100644 --- a/fs/open.c +++ b/fs/open.c @@ -31,6 +31,8 @@ @@ -47338,7 +47858,7 @@ index 3f1108b..822d7f7 100644 if (!error) error = do_truncate(path.dentry, length, 0, NULL); -@@ -358,6 +364,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode) +@@ -359,6 +365,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode) if (__mnt_is_readonly(path.mnt)) res = -EROFS; @@ -47348,7 +47868,7 @@ index 3f1108b..822d7f7 100644 out_path_release: path_put(&path); out: -@@ -384,6 +393,8 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename) +@@ -385,6 +394,8 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename) if (error) goto dput_and_out; @@ -47357,7 +47877,7 @@ index 3f1108b..822d7f7 100644 set_fs_pwd(current->fs, &path); dput_and_out: -@@ -410,6 +421,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd) +@@ -411,6 +422,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd) goto out_putf; error = inode_permission(inode, MAY_EXEC | MAY_CHDIR); @@ -47371,7 +47891,7 @@ index 3f1108b..822d7f7 100644 if (!error) set_fs_pwd(current->fs, &file->f_path); out_putf: -@@ -438,7 +456,13 @@ SYSCALL_DEFINE1(chroot, const char __user *, filename) +@@ -439,7 +457,13 @@ SYSCALL_DEFINE1(chroot, const char __user *, filename) if (error) goto dput_and_out; @@ -47385,7 +47905,7 @@ index 3f1108b..822d7f7 100644 error = 0; dput_and_out: path_put(&path); -@@ -456,6 +480,16 @@ static int chmod_common(struct path *path, umode_t mode) +@@ -457,6 +481,16 @@ static int chmod_common(struct path *path, umode_t mode) if (error) return error; mutex_lock(&inode->i_mutex); @@ -47402,17 +47922,17 @@ index 3f1108b..822d7f7 100644 error = security_path_chmod(path, mode); if (error) goto out_unlock; -@@ -506,6 +540,9 @@ static int chown_common(struct path *path, uid_t user, gid_t group) - int error; - struct iattr newattrs; +@@ -512,6 +546,9 @@ static int chown_common(struct path *path, uid_t user, gid_t group) + uid = make_kuid(current_user_ns(), user); + gid = make_kgid(current_user_ns(), group); + if (!gr_acl_handle_chown(path->dentry, path->mnt)) + return -EACCES; + newattrs.ia_valid = ATTR_CTIME; if (user != (uid_t) -1) { - newattrs.ia_valid |= ATTR_UID; -@@ -987,6 +1024,7 @@ long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode) + if (!uid_valid(uid)) +@@ -1035,6 +1072,7 @@ long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode) } else { fsnotify_open(f); fd_install(fd, f); @@ -47421,7 +47941,7 @@ index 3f1108b..822d7f7 100644 } putname(tmp); diff --git a/fs/pipe.c b/fs/pipe.c -index fec5e4a..f4210f9 100644 +index 49c1065..13b9e12 100644 --- a/fs/pipe.c +++ b/fs/pipe.c @@ -438,9 +438,9 @@ redo: @@ -47466,7 +47986,7 @@ index fec5e4a..f4210f9 100644 } out: mutex_unlock(&inode->i_mutex); -@@ -713,7 +713,7 @@ pipe_poll(struct file *filp, poll_table *wait) +@@ -716,7 +716,7 @@ pipe_poll(struct file *filp, poll_table *wait) mask = 0; if (filp->f_mode & FMODE_READ) { mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0; @@ -47475,7 +47995,7 @@ index fec5e4a..f4210f9 100644 mask |= POLLHUP; } -@@ -723,7 +723,7 @@ pipe_poll(struct file *filp, poll_table *wait) +@@ -726,7 +726,7 @@ pipe_poll(struct file *filp, poll_table *wait) * Most Unices do not set POLLERR for FIFOs but on Linux they * behave exactly like pipes for poll(). */ @@ -47484,7 +48004,7 @@ index fec5e4a..f4210f9 100644 mask |= POLLERR; } -@@ -737,10 +737,10 @@ pipe_release(struct inode *inode, int decr, int decw) +@@ -740,10 +740,10 @@ pipe_release(struct inode *inode, int decr, int decw) mutex_lock(&inode->i_mutex); pipe = inode->i_pipe; @@ -47498,7 +48018,7 @@ index fec5e4a..f4210f9 100644 free_pipe_info(inode); } else { wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP); -@@ -830,7 +830,7 @@ pipe_read_open(struct inode *inode, struct file *filp) +@@ -833,7 +833,7 @@ pipe_read_open(struct inode *inode, struct file *filp) if (inode->i_pipe) { ret = 0; @@ -47507,7 +48027,7 @@ index fec5e4a..f4210f9 100644 } mutex_unlock(&inode->i_mutex); -@@ -847,7 +847,7 @@ pipe_write_open(struct inode *inode, struct file *filp) +@@ -850,7 +850,7 @@ pipe_write_open(struct inode *inode, struct file *filp) if (inode->i_pipe) { ret = 0; @@ -47516,7 +48036,7 @@ index fec5e4a..f4210f9 100644 } mutex_unlock(&inode->i_mutex); -@@ -865,9 +865,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp) +@@ -868,9 +868,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp) if (inode->i_pipe) { ret = 0; if (filp->f_mode & FMODE_READ) @@ -47528,7 +48048,7 @@ index fec5e4a..f4210f9 100644 } mutex_unlock(&inode->i_mutex); -@@ -959,7 +959,7 @@ void free_pipe_info(struct inode *inode) +@@ -962,7 +962,7 @@ void free_pipe_info(struct inode *inode) inode->i_pipe = NULL; } @@ -47537,7 +48057,7 @@ index fec5e4a..f4210f9 100644 /* * pipefs_dname() is called from d_path(). -@@ -989,7 +989,8 @@ static struct inode * get_pipe_inode(void) +@@ -992,7 +992,8 @@ static struct inode * get_pipe_inode(void) goto fail_iput; inode->i_pipe = pipe; @@ -47579,7 +48099,7 @@ index 15af622..0e9f4467 100644 help Various /proc files exist to monitor process memory utilization: diff --git a/fs/proc/array.c b/fs/proc/array.c -index f9bd395..acb7847 100644 +index c1c207c..5179411 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -60,6 +60,7 @@ @@ -47590,7 +48110,7 @@ index f9bd395..acb7847 100644 #include <linux/proc_fs.h> #include <linux/ioport.h> #include <linux/uaccess.h> -@@ -337,6 +338,21 @@ static void task_cpus_allowed(struct seq_file *m, struct task_struct *task) +@@ -346,6 +347,21 @@ static void task_cpus_allowed(struct seq_file *m, struct task_struct *task) seq_putc(m, '\n'); } @@ -47612,7 +48132,7 @@ index f9bd395..acb7847 100644 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns, struct pid *pid, struct task_struct *task) { -@@ -354,9 +370,24 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns, +@@ -363,9 +379,24 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns, task_cpus_allowed(m, task); cpuset_task_status_allowed(m, task); task_context_switch_counts(m, task); @@ -47637,7 +48157,7 @@ index f9bd395..acb7847 100644 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, struct pid *pid, struct task_struct *task, int whole) { -@@ -378,6 +409,13 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, +@@ -387,6 +418,13 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, char tcomm[sizeof(task->comm)]; unsigned long flags; @@ -47651,7 +48171,7 @@ index f9bd395..acb7847 100644 state = *get_task_state(task); vsize = eip = esp = 0; permitted = ptrace_may_access(task, PTRACE_MODE_READ | PTRACE_MODE_NOAUDIT); -@@ -449,6 +487,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, +@@ -458,6 +496,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, gtime = task->gtime; } @@ -47671,9 +48191,9 @@ index f9bd395..acb7847 100644 /* scale priority and nice values from timeslices to -20..20 */ /* to make it look like a "normal" Unix priority/nice value */ priority = task_prio(task); -@@ -485,9 +536,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, +@@ -494,9 +545,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, seq_put_decimal_ull(m, ' ', vsize); - seq_put_decimal_ll(m, ' ', mm ? get_mm_rss(mm) : 0); + seq_put_decimal_ull(m, ' ', mm ? get_mm_rss(mm) : 0); seq_put_decimal_ull(m, ' ', rsslim); +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP + seq_put_decimal_ull(m, ' ', PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0)); @@ -47687,23 +48207,20 @@ index f9bd395..acb7847 100644 seq_put_decimal_ull(m, ' ', esp); seq_put_decimal_ull(m, ' ', eip); /* The signal information here is obsolete. -@@ -508,9 +565,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, - seq_put_decimal_ull(m, ' ', delayacct_blkio_ticks(task)); +@@ -518,7 +575,11 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, seq_put_decimal_ull(m, ' ', cputime_to_clock_t(gtime)); seq_put_decimal_ll(m, ' ', cputime_to_clock_t(cgtime)); + +- if (mm && permitted) { ++ if (mm && permitted +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP -+ seq_put_decimal_ull(m, ' ', PAX_RAND_FLAGS(mm) ? 0 : ((mm && permitted) ? mm->start_data : 0)); -+ seq_put_decimal_ull(m, ' ', PAX_RAND_FLAGS(mm) ? 0 : ((mm && permitted) ? mm->end_data : 0)); -+ seq_put_decimal_ull(m, ' ', PAX_RAND_FLAGS(mm) ? 0 : ((mm && permitted) ? mm->start_brk : 0)); -+#else - seq_put_decimal_ull(m, ' ', (mm && permitted) ? mm->start_data : 0); - seq_put_decimal_ull(m, ' ', (mm && permitted) ? mm->end_data : 0); - seq_put_decimal_ull(m, ' ', (mm && permitted) ? mm->start_brk : 0); ++ && !PAX_RAND_FLAGS(mm) +#endif - seq_putc(m, '\n'); - if (mm) - mmput(mm); -@@ -533,8 +596,15 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns, ++ ) { + seq_put_decimal_ull(m, ' ', mm->start_data); + seq_put_decimal_ull(m, ' ', mm->end_data); + seq_put_decimal_ull(m, ' ', mm->start_brk); +@@ -556,8 +617,15 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns, struct pid *pid, struct task_struct *task) { unsigned long size = 0, resident = 0, shared = 0, text = 0, data = 0; @@ -47720,11 +48237,10 @@ index f9bd395..acb7847 100644 if (mm) { size = task_statm(mm, &shared, &text, &data, &resident); mmput(mm); -@@ -556,3 +626,18 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns, - +@@ -580,6 +648,21 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns, return 0; } -+ + +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR +int proc_pid_ipaddr(struct task_struct *task, char *buffer) +{ @@ -47739,11 +48255,15 @@ index f9bd395..acb7847 100644 + return sprintf(buffer, "%pI4\n", &curr_ip); +} +#endif ++ + #ifdef CONFIG_CHECKPOINT_RESTORE + static struct pid * + get_children_pid(struct inode *inode, struct pid *pid_prev, loff_t pos) diff --git a/fs/proc/base.c b/fs/proc/base.c -index 9fc77b4..4877d08 100644 +index 437195f..cd2210d 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c -@@ -109,6 +109,14 @@ struct pid_entry { +@@ -110,6 +110,14 @@ struct pid_entry { union proc_op op; }; @@ -47758,19 +48278,7 @@ index 9fc77b4..4877d08 100644 #define NOD(NAME, MODE, IOP, FOP, OP) { \ .name = (NAME), \ .len = sizeof(NAME) - 1, \ -@@ -198,11 +206,6 @@ static int proc_root_link(struct dentry *dentry, struct path *path) - return result; - } - --struct mm_struct *mm_for_maps(struct task_struct *task) --{ -- return mm_access(task, PTRACE_MODE_READ); --} -- - static int proc_pid_cmdline(struct task_struct *task, char * buffer) - { - int res = 0; -@@ -213,6 +216,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer) +@@ -209,6 +217,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer) if (!mm->arg_end) goto out_mm; /* Shh! No looking before we're done */ @@ -47780,7 +48288,7 @@ index 9fc77b4..4877d08 100644 len = mm->arg_end - mm->arg_start; if (len > PAGE_SIZE) -@@ -240,12 +246,28 @@ out: +@@ -236,12 +247,28 @@ out: return res; } @@ -47792,8 +48300,7 @@ index 9fc77b4..4877d08 100644 + static int proc_pid_auxv(struct task_struct *task, char *buffer) { -- struct mm_struct *mm = mm_for_maps(task); -+ struct mm_struct *mm = mm_access(task, PTRACE_MODE_READ); + struct mm_struct *mm = mm_access(task, PTRACE_MODE_READ); int res = PTR_ERR(mm); if (mm && !IS_ERR(mm)) { unsigned int nwords = 0; @@ -47810,7 +48317,7 @@ index 9fc77b4..4877d08 100644 do { nwords += 2; } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */ -@@ -259,7 +281,7 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer) +@@ -255,7 +282,7 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer) } @@ -47819,7 +48326,7 @@ index 9fc77b4..4877d08 100644 /* * Provides a wchan file via kallsyms in a proper one-value-per-file format. * Returns the resolved symbol. If that fails, simply return the address. -@@ -298,7 +320,7 @@ static void unlock_trace(struct task_struct *task) +@@ -294,7 +321,7 @@ static void unlock_trace(struct task_struct *task) mutex_unlock(&task->signal->cred_guard_mutex); } @@ -47828,7 +48335,7 @@ index 9fc77b4..4877d08 100644 #define MAX_STACK_TRACE_DEPTH 64 -@@ -489,7 +511,7 @@ static int proc_pid_limits(struct task_struct *task, char *buffer) +@@ -486,7 +513,7 @@ static int proc_pid_limits(struct task_struct *task, char *buffer) return count; } @@ -47837,7 +48344,7 @@ index 9fc77b4..4877d08 100644 static int proc_pid_syscall(struct task_struct *task, char *buffer) { long nr; -@@ -518,7 +540,7 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer) +@@ -515,7 +542,7 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer) /************************************************************************/ /* permission checks */ @@ -47846,7 +48353,7 @@ index 9fc77b4..4877d08 100644 { struct task_struct *task; int allowed = 0; -@@ -528,7 +550,10 @@ static int proc_fd_access_allowed(struct inode *inode) +@@ -525,7 +552,10 @@ static int proc_fd_access_allowed(struct inode *inode) */ task = get_proc_task(inode); if (task) { @@ -47858,7 +48365,7 @@ index 9fc77b4..4877d08 100644 put_task_struct(task); } return allowed; -@@ -566,10 +591,35 @@ static bool has_pid_permissions(struct pid_namespace *pid, +@@ -563,10 +593,35 @@ static bool has_pid_permissions(struct pid_namespace *pid, struct task_struct *task, int hide_pid_min) { @@ -47894,7 +48401,7 @@ index 9fc77b4..4877d08 100644 return ptrace_may_access(task, PTRACE_MODE_READ); } -@@ -587,7 +637,11 @@ static int proc_pid_permission(struct inode *inode, int mask) +@@ -584,7 +639,11 @@ static int proc_pid_permission(struct inode *inode, int mask) put_task_struct(task); if (!has_perms) { @@ -47906,57 +48413,47 @@ index 9fc77b4..4877d08 100644 /* * Let's make getdents(), stat(), and open() * consistent with each other. If a process -@@ -677,7 +731,7 @@ static const struct file_operations proc_single_file_operations = { - .release = single_release, - }; - --static int mem_open(struct inode* inode, struct file* file) -+static int __mem_open(struct inode *inode, struct file *file, unsigned int mode) - { - struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode); - struct mm_struct *mm; -@@ -685,7 +739,12 @@ static int mem_open(struct inode* inode, struct file* file) +@@ -682,6 +741,11 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode) if (!task) return -ESRCH; -- mm = mm_access(task, PTRACE_MODE_ATTACH); + if (gr_acl_handle_procpidmem(task)) { + put_task_struct(task); + return -EPERM; + } + -+ mm = mm_access(task, mode); + mm = mm_access(task, mode); put_task_struct(task); - if (IS_ERR(mm)) -@@ -698,11 +757,24 @@ static int mem_open(struct inode* inode, struct file* file) +@@ -695,16 +759,24 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode) mmput(mm); } -+ file->private_data = mm; -+ +- /* OK to pass negative loff_t, we can catch out-of-range */ +- file->f_mode |= FMODE_UNSIGNED_OFFSET; + file->private_data = mm; + +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP + file->f_version = current->exec_id; +#endif + -+ return 0; -+} -+ -+static int mem_open(struct inode *inode, struct file *file) -+{ + return 0; + } + + static int mem_open(struct inode *inode, struct file *file) + { +- return __mem_open(inode, file, PTRACE_MODE_ATTACH); + int ret; + ret = __mem_open(inode, file, PTRACE_MODE_ATTACH); + - /* OK to pass negative loff_t, we can catch out-of-range */ - file->f_mode |= FMODE_UNSIGNED_OFFSET; -- file->private_data = mm; - -- return 0; ++ /* OK to pass negative loff_t, we can catch out-of-range */ ++ file->f_mode |= FMODE_UNSIGNED_OFFSET; ++ + return ret; } static ssize_t mem_rw(struct file *file, char __user *buf, -@@ -713,6 +785,17 @@ static ssize_t mem_rw(struct file *file, char __user *buf, +@@ -715,6 +787,17 @@ static ssize_t mem_rw(struct file *file, char __user *buf, ssize_t copied; char *page; @@ -47974,53 +48471,23 @@ index 9fc77b4..4877d08 100644 if (!mm) return 0; -@@ -801,42 +884,49 @@ static const struct file_operations proc_mem_operations = { - .release = mem_release, - }; - -+static int environ_open(struct inode *inode, struct file *file) -+{ -+ return __mem_open(inode, file, PTRACE_MODE_READ); -+} -+ - static ssize_t environ_read(struct file *file, char __user *buf, - size_t count, loff_t *ppos) - { -- struct task_struct *task = get_proc_task(file->f_dentry->d_inode); - char *page; - unsigned long src = *ppos; -- int ret = -ESRCH; -- struct mm_struct *mm; -+ int ret = 0; -+ struct mm_struct *mm = file->private_data; +@@ -819,6 +902,13 @@ static ssize_t environ_read(struct file *file, char __user *buf, + if (!mm) + return 0; -- if (!task) -- goto out_no_task; -+ if (!mm) -+ return 0; -+ +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP + if (file->f_version != current->exec_id) { + gr_log_badprocpid("environ"); + return 0; + } +#endif - -- ret = -ENOMEM; ++ page = (char *)__get_free_page(GFP_TEMPORARY); if (!page) -- goto out; -- -- -- mm = mm_for_maps(task); -- ret = PTR_ERR(mm); -- if (!mm || IS_ERR(mm)) -- goto out_free; -+ return -ENOMEM; - - ret = 0; -+ if (!atomic_inc_not_zero(&mm->mm_users)) -+ goto free; + return -ENOMEM; +@@ -827,15 +917,17 @@ static ssize_t environ_read(struct file *file, char __user *buf, + if (!atomic_inc_not_zero(&mm->mm_users)) + goto free; while (count > 0) { - int this_len, retval, max_len; + size_t this_len, max_len; @@ -48033,42 +48500,15 @@ index 9fc77b4..4877d08 100644 - if (this_len <= 0) - break; -+ max_len = min_t(size_t, PAGE_SIZE, count); -+ this_len = min(max_len, this_len); - max_len = (count > PAGE_SIZE) ? PAGE_SIZE : count; - this_len = (this_len > max_len) ? max_len : this_len; -- -- retval = access_process_vm(task, (mm->env_start + src), -+ retval = access_remote_vm(mm, (mm->env_start + src), - page, this_len, 0); - - if (retval <= 0) { -@@ -855,19 +945,18 @@ static ssize_t environ_read(struct file *file, char __user *buf, - count -= retval; - } - *ppos = src; -- - mmput(mm); --out_free: -+ -+free: - free_page((unsigned long) page); --out: -- put_task_struct(task); --out_no_task: - return ret; - } - - static const struct file_operations proc_environ_operations = { -+ .open = environ_open, - .read = environ_read, - .llseek = generic_file_llseek, -+ .release = mem_release, - }; ++ max_len = min_t(size_t, PAGE_SIZE, count); ++ this_len = min(max_len, this_len); - static ssize_t oom_adjust_read(struct file *file, char __user *buf, -@@ -1433,7 +1522,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd) + retval = access_remote_vm(mm, (mm->env_start + src), + page, this_len, 0); +@@ -1433,7 +1525,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd) path_put(&nd->path); /* Are we allowed to snoop on the tasks file descriptors? */ @@ -48077,7 +48517,7 @@ index 9fc77b4..4877d08 100644 goto out; error = PROC_I(inode)->op.proc_get_link(dentry, &nd->path); -@@ -1472,8 +1561,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b +@@ -1472,8 +1564,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b struct path path; /* Are we allowed to snoop on the tasks file descriptors? */ @@ -48098,7 +48538,7 @@ index 9fc77b4..4877d08 100644 error = PROC_I(inode)->op.proc_get_link(dentry, &path); if (error) -@@ -1538,7 +1637,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t +@@ -1538,7 +1640,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t rcu_read_lock(); cred = __task_cred(task); inode->i_uid = cred->euid; @@ -48110,7 +48550,7 @@ index 9fc77b4..4877d08 100644 rcu_read_unlock(); } security_task_to_inode(task, inode); -@@ -1574,10 +1677,19 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat) +@@ -1574,10 +1680,19 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat) return -ENOENT; } if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) || @@ -48130,7 +48570,7 @@ index 9fc77b4..4877d08 100644 } } rcu_read_unlock(); -@@ -1615,11 +1727,20 @@ int pid_revalidate(struct dentry *dentry, struct nameidata *nd) +@@ -1615,11 +1730,20 @@ int pid_revalidate(struct dentry *dentry, struct nameidata *nd) if (task) { if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) || @@ -48150,8 +48590,8 @@ index 9fc77b4..4877d08 100644 +#endif rcu_read_unlock(); } else { - inode->i_uid = 0; -@@ -1737,7 +1858,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info) + inode->i_uid = GLOBAL_ROOT_UID; +@@ -1737,7 +1861,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info) int fd = proc_fd(inode); if (task) { @@ -48161,21 +48601,7 @@ index 9fc77b4..4877d08 100644 put_task_struct(task); } if (files) { -@@ -2025,11 +2147,8 @@ static int map_files_d_revalidate(struct dentry *dentry, struct nameidata *nd) - if (!task) - goto out_notask; - -- if (!ptrace_may_access(task, PTRACE_MODE_READ)) -- goto out; -- -- mm = get_task_mm(task); -- if (!mm) -+ mm = mm_access(task, PTRACE_MODE_READ); -+ if (IS_ERR_OR_NULL(mm)) - goto out; - - if (!dname_to_vma_addr(dentry, &vm_start, &vm_end)) { -@@ -2338,11 +2457,21 @@ static const struct file_operations proc_map_files_operations = { +@@ -2336,11 +2461,21 @@ static const struct file_operations proc_map_files_operations = { */ static int proc_fd_permission(struct inode *inode, int mask) { @@ -48199,7 +48625,7 @@ index 9fc77b4..4877d08 100644 return rv; } -@@ -2452,6 +2581,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir, +@@ -2450,6 +2585,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir, if (!task) goto out_no_task; @@ -48209,7 +48635,7 @@ index 9fc77b4..4877d08 100644 /* * Yes, it does not scale. And it should not. Don't add * new entries into /proc/<tgid>/ without very good reasons. -@@ -2496,6 +2628,9 @@ static int proc_pident_readdir(struct file *filp, +@@ -2494,6 +2632,9 @@ static int proc_pident_readdir(struct file *filp, if (!task) goto out_no_task; @@ -48219,7 +48645,7 @@ index 9fc77b4..4877d08 100644 ret = 0; i = filp->f_pos; switch (i) { -@@ -2766,7 +2901,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd) +@@ -2764,7 +2905,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd) static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie) { @@ -48228,7 +48654,7 @@ index 9fc77b4..4877d08 100644 if (!IS_ERR(s)) __putname(s); } -@@ -2967,7 +3102,7 @@ static const struct pid_entry tgid_base_stuff[] = { +@@ -3033,7 +3174,7 @@ static const struct pid_entry tgid_base_stuff[] = { REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations), #endif REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations), @@ -48237,7 +48663,7 @@ index 9fc77b4..4877d08 100644 INF("syscall", S_IRUGO, proc_pid_syscall), #endif INF("cmdline", S_IRUGO, proc_pid_cmdline), -@@ -2992,10 +3127,10 @@ static const struct pid_entry tgid_base_stuff[] = { +@@ -3058,10 +3199,10 @@ static const struct pid_entry tgid_base_stuff[] = { #ifdef CONFIG_SECURITY DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations), #endif @@ -48250,17 +48676,17 @@ index 9fc77b4..4877d08 100644 ONE("stack", S_IRUGO, proc_pid_stack), #endif #ifdef CONFIG_SCHEDSTATS -@@ -3029,6 +3164,9 @@ static const struct pid_entry tgid_base_stuff[] = { +@@ -3095,6 +3236,9 @@ static const struct pid_entry tgid_base_stuff[] = { #ifdef CONFIG_HARDWALL INF("hardwall", S_IRUGO, proc_pid_hardwall), #endif +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR -+ INF("ipaddr", S_IRUSR, proc_pid_ipaddr), ++ INF("ipaddr", S_IRUSR, proc_pid_ipaddr), +#endif - }; - - static int proc_tgid_base_readdir(struct file * filp, -@@ -3155,7 +3293,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir, + #ifdef CONFIG_USER_NS + REG("uid_map", S_IRUGO|S_IWUSR, proc_uid_map_operations), + REG("gid_map", S_IRUGO|S_IWUSR, proc_gid_map_operations), +@@ -3225,7 +3369,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir, if (!inode) goto out; @@ -48275,7 +48701,7 @@ index 9fc77b4..4877d08 100644 inode->i_op = &proc_tgid_base_inode_operations; inode->i_fop = &proc_tgid_base_operations; inode->i_flags|=S_IMMUTABLE; -@@ -3197,7 +3342,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct +@@ -3267,7 +3418,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct if (!task) goto out; @@ -48287,7 +48713,7 @@ index 9fc77b4..4877d08 100644 put_task_struct(task); out: return result; -@@ -3260,6 +3409,8 @@ static int proc_pid_fill_cache(struct file *filp, void *dirent, filldir_t filldi +@@ -3330,6 +3485,8 @@ static int proc_pid_fill_cache(struct file *filp, void *dirent, filldir_t filldi static int fake_filldir(void *buf, const char *name, int namelen, loff_t offset, u64 ino, unsigned d_type) { @@ -48296,7 +48722,7 @@ index 9fc77b4..4877d08 100644 return 0; } -@@ -3326,7 +3477,7 @@ static const struct pid_entry tid_base_stuff[] = { +@@ -3396,7 +3553,7 @@ static const struct pid_entry tid_base_stuff[] = { REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations), #endif REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations), @@ -48305,7 +48731,7 @@ index 9fc77b4..4877d08 100644 INF("syscall", S_IRUGO, proc_pid_syscall), #endif INF("cmdline", S_IRUGO, proc_pid_cmdline), -@@ -3350,10 +3501,10 @@ static const struct pid_entry tid_base_stuff[] = { +@@ -3423,10 +3580,10 @@ static const struct pid_entry tid_base_stuff[] = { #ifdef CONFIG_SECURITY DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations), #endif @@ -48351,7 +48777,7 @@ index b143471..bb105e5 100644 } module_init(proc_devices_init); diff --git a/fs/proc/inode.c b/fs/proc/inode.c -index 205c922..2ee4c57 100644 +index 7ac817b..abab1a5 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -21,11 +21,17 @@ @@ -48399,19 +48825,10 @@ index 205c922..2ee4c57 100644 if (de->size) inode->i_size = de->size; diff --git a/fs/proc/internal.h b/fs/proc/internal.h -index 5f79bb8..e9ab85d 100644 +index eca4aca..19166b2 100644 --- a/fs/proc/internal.h +++ b/fs/proc/internal.h -@@ -31,8 +31,6 @@ struct vmalloc_info { - unsigned long largest_chunk; - }; - --extern struct mm_struct *mm_for_maps(struct task_struct *); -- - #ifdef CONFIG_MMU - #define VMALLOC_TOTAL (VMALLOC_END - VMALLOC_START) - extern void get_vmalloc_info(struct vmalloc_info *vmi); -@@ -54,6 +52,9 @@ extern int proc_pid_status(struct seq_file *m, struct pid_namespace *ns, +@@ -52,6 +52,9 @@ extern int proc_pid_status(struct seq_file *m, struct pid_namespace *ns, struct pid *pid, struct task_struct *task); extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns, struct pid *pid, struct task_struct *task); @@ -48420,7 +48837,7 @@ index 5f79bb8..e9ab85d 100644 +#endif extern loff_t mem_lseek(struct file *file, loff_t offset, int orig); - extern const struct file_operations proc_pid_maps_operations; + extern const struct file_operations proc_tid_children_operations; diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c index 86c67ee..cdca321 100644 --- a/fs/proc/kcore.c @@ -48532,7 +48949,7 @@ index 06e1cc1..177cd98 100644 rcu_read_lock(); task = pid_task(proc_pid(dir), PIDTYPE_PID); diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c -index 21d836f..bebf3ee 100644 +index 3476bca..cb6d86a 100644 --- a/fs/proc/proc_sysctl.c +++ b/fs/proc/proc_sysctl.c @@ -12,11 +12,15 @@ @@ -48660,7 +49077,7 @@ index 21d836f..bebf3ee 100644 .permission = proc_sys_permission, .setattr = proc_sys_setattr, diff --git a/fs/proc/root.c b/fs/proc/root.c -index eed44bf..abeb499 100644 +index 7c30fce..b3d3aa2 100644 --- a/fs/proc/root.c +++ b/fs/proc/root.c @@ -188,7 +188,15 @@ void __init proc_root_init(void) @@ -48680,7 +49097,7 @@ index eed44bf..abeb499 100644 } diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index 7faaf2a..7793015 100644 +index 4540b8f..1b9772f 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -11,12 +11,19 @@ @@ -48740,15 +49157,6 @@ index 7faaf2a..7793015 100644 } unsigned long task_vsize(struct mm_struct *mm) -@@ -125,7 +149,7 @@ static void *m_start(struct seq_file *m, loff_t *pos) - if (!priv->task) - return ERR_PTR(-ESRCH); - -- mm = mm_for_maps(priv->task); -+ mm = mm_access(priv->task, PTRACE_MODE_READ); - if (!mm || IS_ERR(mm)) - return mm; - down_read(&mm->mmap_sem); @@ -231,13 +255,13 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid) pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT; } @@ -48815,7 +49223,7 @@ index 7faaf2a..7793015 100644 show_map_vma(m, vma, is_pid); if (m->count < m->size) /* vma is copied successfully */ -@@ -482,12 +518,23 @@ static int show_smap(struct seq_file *m, void *v, int is_pid) +@@ -492,12 +528,23 @@ static int show_smap(struct seq_file *m, void *v, int is_pid) .private = &mss, }; @@ -48844,7 +49252,7 @@ index 7faaf2a..7793015 100644 show_map_vma(m, vma, is_pid); seq_printf(m, -@@ -505,7 +552,11 @@ static int show_smap(struct seq_file *m, void *v, int is_pid) +@@ -515,7 +562,11 @@ static int show_smap(struct seq_file *m, void *v, int is_pid) "KernelPageSize: %8lu kB\n" "MMUPageSize: %8lu kB\n" "Locked: %8lu kB\n", @@ -48856,16 +49264,7 @@ index 7faaf2a..7793015 100644 mss.resident >> 10, (unsigned long)(mss.pss >> (10 + PSS_SHIFT)), mss.shared_clean >> 10, -@@ -919,7 +970,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf, - if (!pm.buffer) - goto out_task; - -- mm = mm_for_maps(task); -+ mm = mm_access(task, PTRACE_MODE_READ); - ret = PTR_ERR(mm); - if (!mm || IS_ERR(mm)) - goto out_free; -@@ -1138,6 +1189,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) +@@ -1164,6 +1215,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) int n; char buffer[50]; @@ -48879,7 +49278,7 @@ index 7faaf2a..7793015 100644 if (!mm) return 0; -@@ -1155,11 +1213,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) +@@ -1181,11 +1239,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) mpol_to_str(buffer, sizeof(buffer), pol, 0); mpol_cond_put(pol); @@ -48897,7 +49296,7 @@ index 7faaf2a..7793015 100644 seq_printf(m, " heap"); } else { diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c -index 74fe164..0848f95 100644 +index 1ccfa53..0848f95 100644 --- a/fs/proc/task_nommu.c +++ b/fs/proc/task_nommu.c @@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct mm_struct *mm) @@ -48918,15 +49317,6 @@ index 74fe164..0848f95 100644 } else if (mm) { pid_t tid = vm_is_stack(priv->task, vma, is_pid); -@@ -223,7 +223,7 @@ static void *m_start(struct seq_file *m, loff_t *pos) - if (!priv->task) - return ERR_PTR(-ESRCH); - -- mm = mm_for_maps(priv->task); -+ mm = mm_access(priv->task, PTRACE_MODE_READ); - if (!mm || IS_ERR(mm)) { - put_task_struct(priv->task); - priv->task = NULL; diff --git a/fs/quota/netlink.c b/fs/quota/netlink.c index d67908b..d13f6a6 100644 --- a/fs/quota/netlink.c @@ -48950,7 +49340,7 @@ index d67908b..d13f6a6 100644 if (!msg_head) { printk(KERN_ERR diff --git a/fs/readdir.c b/fs/readdir.c -index cc0a822..43cb195 100644 +index 39e3370..20d446d 100644 --- a/fs/readdir.c +++ b/fs/readdir.c @@ -17,6 +17,7 @@ @@ -48988,7 +49378,7 @@ index cc0a822..43cb195 100644 error = vfs_readdir(file, fillonedir, &buf); if (buf.result) -@@ -142,6 +149,7 @@ struct linux_dirent { +@@ -141,6 +148,7 @@ struct linux_dirent { struct getdents_callback { struct linux_dirent __user * current_dir; struct linux_dirent __user * previous; @@ -48996,7 +49386,7 @@ index cc0a822..43cb195 100644 int count; int error; }; -@@ -163,6 +171,10 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset, +@@ -162,6 +170,10 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset, buf->error = -EOVERFLOW; return -EOVERFLOW; } @@ -49007,7 +49397,7 @@ index cc0a822..43cb195 100644 dirent = buf->previous; if (dirent) { if (__put_user(offset, &dirent->d_off)) -@@ -210,6 +222,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, fd, +@@ -208,6 +220,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, fd, buf.previous = NULL; buf.count = count; buf.error = 0; @@ -49015,7 +49405,7 @@ index cc0a822..43cb195 100644 error = vfs_readdir(file, filldir, &buf); if (error >= 0) -@@ -229,6 +242,7 @@ out: +@@ -226,6 +239,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, fd, struct getdents_callback64 { struct linux_dirent64 __user * current_dir; struct linux_dirent64 __user * previous; @@ -49023,7 +49413,7 @@ index cc0a822..43cb195 100644 int count; int error; }; -@@ -244,6 +258,10 @@ static int filldir64(void * __buf, const char * name, int namlen, loff_t offset, +@@ -241,6 +255,10 @@ static int filldir64(void * __buf, const char * name, int namlen, loff_t offset, buf->error = -EINVAL; /* only used if we fail.. */ if (reclen > buf->count) return -EINVAL; @@ -49034,7 +49424,7 @@ index cc0a822..43cb195 100644 dirent = buf->previous; if (dirent) { if (__put_user(offset, &dirent->d_off)) -@@ -291,6 +309,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd, +@@ -287,6 +305,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd, buf.current_dir = dirent; buf.previous = NULL; @@ -49042,7 +49432,7 @@ index cc0a822..43cb195 100644 buf.count = count; buf.error = 0; -@@ -299,7 +318,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd, +@@ -295,7 +314,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd, error = buf.error; lastdirent = buf.previous; if (lastdirent) { @@ -49078,7 +49468,7 @@ index 2c1ade6..8c59d8d 100644 SF(s_do_balance), SF(s_unneeded_left_neighbor), SF(s_good_search_by_key_reada), SF(s_bmaps), diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h -index a59d271..e12d1cf 100644 +index 33215f5..c5d427a 100644 --- a/fs/reiserfs/reiserfs.h +++ b/fs/reiserfs/reiserfs.h @@ -453,7 +453,7 @@ struct reiserfs_sb_info { @@ -49090,7 +49480,7 @@ index a59d271..e12d1cf 100644 // tree gets re-balanced unsigned long s_properties; /* File system properties. Currently holds on-disk FS format */ -@@ -1973,7 +1973,7 @@ static inline loff_t max_reiserfs_offset(struct inode *inode) +@@ -1978,7 +1978,7 @@ static inline loff_t max_reiserfs_offset(struct inode *inode) #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */ #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter) @@ -49100,7 +49490,7 @@ index a59d271..e12d1cf 100644 #define __fs_changed(gen,s) (gen != get_generation (s)) #define fs_changed(gen,s) \ diff --git a/fs/select.c b/fs/select.c -index 17d33d0..da0bf5c 100644 +index bae3215..06b4707 100644 --- a/fs/select.c +++ b/fs/select.c @@ -20,6 +20,7 @@ @@ -49111,7 +49501,7 @@ index 17d33d0..da0bf5c 100644 #include <linux/personality.h> /* for STICKY_TIMEOUTS */ #include <linux/file.h> #include <linux/fdtable.h> -@@ -833,6 +834,7 @@ int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds, +@@ -831,6 +832,7 @@ int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds, struct poll_list *walk = head; unsigned long todo = nfds; @@ -49187,7 +49577,7 @@ index 0cbd049..64e705c 100644 if (op) { diff --git a/fs/splice.c b/fs/splice.c -index 5cac690..f833a99 100644 +index 7bf08fa..eb35c2f 100644 --- a/fs/splice.c +++ b/fs/splice.c @@ -194,7 +194,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe, @@ -49251,7 +49641,7 @@ index 5cac690..f833a99 100644 return 0; if (sd->flags & SPLICE_F_NONBLOCK) -@@ -1185,7 +1185,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, +@@ -1187,7 +1187,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, * out of the pipe right after the splice_to_pipe(). So set * PIPE_READERS appropriately. */ @@ -49260,7 +49650,7 @@ index 5cac690..f833a99 100644 current->splice_pipe = pipe; } -@@ -1738,9 +1738,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags) +@@ -1740,9 +1740,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags) ret = -ERESTARTSYS; break; } @@ -49272,7 +49662,7 @@ index 5cac690..f833a99 100644 if (flags & SPLICE_F_NONBLOCK) { ret = -EAGAIN; break; -@@ -1772,7 +1772,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags) +@@ -1774,7 +1774,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags) pipe_lock(pipe); while (pipe->nrbufs >= pipe->buffers) { @@ -49281,7 +49671,7 @@ index 5cac690..f833a99 100644 send_sig(SIGPIPE, current, 0); ret = -EPIPE; break; -@@ -1785,9 +1785,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags) +@@ -1787,9 +1787,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags) ret = -ERESTARTSYS; break; } @@ -49293,7 +49683,7 @@ index 5cac690..f833a99 100644 } pipe_unlock(pipe); -@@ -1823,14 +1823,14 @@ retry: +@@ -1825,14 +1825,14 @@ retry: pipe_double_lock(ipipe, opipe); do { @@ -49310,7 +49700,7 @@ index 5cac690..f833a99 100644 break; /* -@@ -1927,7 +1927,7 @@ static int link_pipe(struct pipe_inode_info *ipipe, +@@ -1929,7 +1929,7 @@ static int link_pipe(struct pipe_inode_info *ipipe, pipe_double_lock(ipipe, opipe); do { @@ -49319,7 +49709,7 @@ index 5cac690..f833a99 100644 send_sig(SIGPIPE, current, 0); if (!ret) ret = -EPIPE; -@@ -1972,7 +1972,7 @@ static int link_pipe(struct pipe_inode_info *ipipe, +@@ -1974,7 +1974,7 @@ static int link_pipe(struct pipe_inode_info *ipipe, * return EAGAIN if we have the potential of some data in the * future, otherwise just return 0 */ @@ -49329,10 +49719,10 @@ index 5cac690..f833a99 100644 pipe_unlock(ipipe); diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c -index 35a36d3..23424b2 100644 +index e6bb9b2..d8e3951 100644 --- a/fs/sysfs/dir.c +++ b/fs/sysfs/dir.c -@@ -657,6 +657,18 @@ static int create_dir(struct kobject *kobj, struct sysfs_dirent *parent_sd, +@@ -678,6 +678,18 @@ static int create_dir(struct kobject *kobj, struct sysfs_dirent *parent_sd, struct sysfs_dirent *sd; int rc; @@ -49427,7 +49817,7 @@ index c175b4d..8f36a16 100644 int i; for (i = 0; i < sizeof(struct tag); ++i) diff --git a/fs/utimes.c b/fs/utimes.c -index ba653f3..06ea4b1 100644 +index fa4dbe4..e12d1b9 100644 --- a/fs/utimes.c +++ b/fs/utimes.c @@ -1,6 +1,7 @@ @@ -49452,7 +49842,7 @@ index ba653f3..06ea4b1 100644 error = notify_change(path->dentry, &newattrs); mutex_unlock(&inode->i_mutex); diff --git a/fs/xattr.c b/fs/xattr.c -index 3c8c1cc..a83c398 100644 +index 1d7ac37..23cb9ec 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -316,7 +316,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr); @@ -49496,14 +49886,14 @@ index 3c8c1cc..a83c398 100644 mnt_drop_write(path.mnt); } path_put(&path); -@@ -400,17 +405,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name, - const void __user *,value, size_t, size, int, flags) +@@ -401,17 +406,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name, { + int fput_needed; struct file *f; - struct dentry *dentry; int error = -EBADF; - f = fget(fd); + f = fget_light(fd, &fput_needed); if (!f) return error; - dentry = f->f_path.dentry; @@ -49515,7 +49905,7 @@ index 3c8c1cc..a83c398 100644 + error = setxattr(&f->f_path, name, value, size, flags); mnt_drop_write_file(f); } - fput(f); + fput_light(f, fput_needed); diff --git a/fs/xattr_acl.c b/fs/xattr_acl.c index 69d06b0..c0996e5 100644 --- a/fs/xattr_acl.c @@ -49532,10 +49922,10 @@ index 69d06b0..c0996e5 100644 struct posix_acl *acl; struct posix_acl_entry *acl_e; diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c -index 85e7e32..5344e52 100644 +index 58b815e..595ddee 100644 --- a/fs/xfs/xfs_bmap.c +++ b/fs/xfs/xfs_bmap.c -@@ -190,7 +190,7 @@ xfs_bmap_validate_ret( +@@ -189,7 +189,7 @@ xfs_bmap_validate_ret( int nmap, int ret_nmap); #else @@ -49545,10 +49935,10 @@ index 85e7e32..5344e52 100644 STATIC int diff --git a/fs/xfs/xfs_dir2_sf.c b/fs/xfs/xfs_dir2_sf.c -index 79d05e8..e3e5861 100644 +index 19bf0c5..9f26b02 100644 --- a/fs/xfs/xfs_dir2_sf.c +++ b/fs/xfs/xfs_dir2_sf.c -@@ -852,7 +852,15 @@ xfs_dir2_sf_getdents( +@@ -851,7 +851,15 @@ xfs_dir2_sf_getdents( } ino = xfs_dir2_sfe_get_ino(sfp, sfep); @@ -49566,10 +49956,10 @@ index 79d05e8..e3e5861 100644 *offset = off & 0x7fffffff; return 0; diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c -index 91f8ff5..0ce68f9 100644 +index 3a05a41..320bec6 100644 --- a/fs/xfs/xfs_ioctl.c +++ b/fs/xfs/xfs_ioctl.c -@@ -128,7 +128,7 @@ xfs_find_handle( +@@ -126,7 +126,7 @@ xfs_find_handle( } error = -EFAULT; @@ -49579,10 +49969,10 @@ index 91f8ff5..0ce68f9 100644 goto out_put; diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c -index 3011b87..1ab03e9 100644 +index 1a25fd8..e935581 100644 --- a/fs/xfs/xfs_iops.c +++ b/fs/xfs/xfs_iops.c -@@ -397,7 +397,7 @@ xfs_vn_put_link( +@@ -394,7 +394,7 @@ xfs_vn_put_link( struct nameidata *nd, void *p) { @@ -50584,10 +50974,10 @@ index 0000000..1b9afa9 +endif diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c new file mode 100644 -index 0000000..7a5922f +index 0000000..bda2a91 --- /dev/null +++ b/grsecurity/gracl.c -@@ -0,0 +1,4016 @@ +@@ -0,0 +1,4017 @@ +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/sched.h> @@ -50613,12 +51003,15 @@ index 0000000..7a5922f +#include <linux/stop_machine.h> +#include <linux/fdtable.h> +#include <linux/percpu.h> ++#include <linux/lglock.h> +#include "../fs/mount.h" + +#include <asm/uaccess.h> +#include <asm/errno.h> +#include <asm/mman.h> + ++extern struct lglock vfsmount_lock; ++ +static struct acl_role_db acl_role_set; +static struct name_db name_set; +static struct inodev_db inodev_set; @@ -50682,8 +51075,6 @@ index 0000000..7a5922f +extern void gr_remove_uid(uid_t uid); +extern int gr_find_uid(uid_t uid); + -+DECLARE_BRLOCK(vfsmount_lock); -+ +__inline__ int +gr_acl_is_enabled(void) +{ @@ -50886,9 +51277,9 @@ index 0000000..7a5922f + get_fs_root(reaper->fs, &root); + + write_seqlock(&rename_lock); -+ br_read_lock(vfsmount_lock); ++ br_read_lock(&vfsmount_lock); + res = gen_full_path(&path, &root, buf, buflen); -+ br_read_unlock(vfsmount_lock); ++ br_read_unlock(&vfsmount_lock); + write_sequnlock(&rename_lock); + + path_put(&root); @@ -50900,10 +51291,10 @@ index 0000000..7a5922f +{ + char *ret; + write_seqlock(&rename_lock); -+ br_read_lock(vfsmount_lock); ++ br_read_lock(&vfsmount_lock); + ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()), + PAGE_SIZE); -+ br_read_unlock(vfsmount_lock); ++ br_read_unlock(&vfsmount_lock); + write_sequnlock(&rename_lock); + return ret; +} @@ -50916,7 +51307,7 @@ index 0000000..7a5922f + int buflen; + + write_seqlock(&rename_lock); -+ br_read_lock(vfsmount_lock); ++ br_read_lock(&vfsmount_lock); + buf = per_cpu_ptr(gr_shared_page[0], smp_processor_id()); + ret = __d_real_path(dentry, mnt, buf, PAGE_SIZE - 6); + buflen = (int)(ret - buf); @@ -50924,7 +51315,7 @@ index 0000000..7a5922f + prepend(&ret, &buflen, "/proc", 5); + else + ret = strcpy(buf, "<path too long>"); -+ br_read_unlock(vfsmount_lock); ++ br_read_unlock(&vfsmount_lock); + write_sequnlock(&rename_lock); + return ret; +} @@ -52457,7 +52848,7 @@ index 0000000..7a5922f + struct dentry *parent; + + write_seqlock(&rename_lock); -+ br_read_lock(vfsmount_lock); ++ br_read_lock(&vfsmount_lock); + + if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt || +#ifdef CONFIG_NET @@ -52504,7 +52895,7 @@ index 0000000..7a5922f + if (retval == NULL) + retval = full_lookup(l_dentry, l_mnt, real_root.dentry, subj, &path, checkglob); +out: -+ br_read_unlock(vfsmount_lock); ++ br_read_unlock(&vfsmount_lock); + write_sequnlock(&rename_lock); + + BUG_ON(retval == NULL); @@ -52546,7 +52937,7 @@ index 0000000..7a5922f + struct dentry *parent; + + write_seqlock(&rename_lock); -+ br_read_lock(vfsmount_lock); ++ br_read_lock(&vfsmount_lock); + + for (;;) { + if (dentry == real_root.dentry && mnt == real_root.mnt) @@ -52600,7 +52991,7 @@ index 0000000..7a5922f + read_unlock(&gr_inode_lock); + } +out: -+ br_read_unlock(vfsmount_lock); ++ br_read_unlock(&vfsmount_lock); + write_sequnlock(&rename_lock); + + BUG_ON(retval == NULL); @@ -53746,7 +54137,7 @@ index 0000000..7a5922f + + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS && + gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM && -+ current_uid()) { ++ !uid_eq(current_uid(), GLOBAL_ROOT_UID)) { + error = -EPERM; + goto out; + } @@ -54210,7 +54601,7 @@ index 0000000..7a5922f + tmp = tmp->real_parent; + } + -+ if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) || ++ if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && !uid_eq(current_uid(), GLOBAL_ROOT_UID) && !(gr_status & GR_READY)) || + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) { + read_unlock(&grsec_exec_file_lock); + read_unlock(&tasklist_lock); @@ -54272,7 +54663,7 @@ index 0000000..7a5922f + tmp = tmp->real_parent; + } + -+ if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) || ++ if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && !uid_eq(current_uid(), GLOBAL_ROOT_UID) && !(gr_status & GR_READY)) || + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) { + read_unlock(&tasklist_lock); + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task); @@ -54484,10 +54875,10 @@ index 0000000..7a5922f +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP) + cred = __task_cred(task); +#ifdef CONFIG_GRKERNSEC_PROC_USER -+ if (cred->uid != 0) ++ if (!uid_eq(cred->uid, GLOBAL_ROOT_UID)) + ret = -EACCES; +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP) -+ if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID)) ++ if (!uid_eq(cred->uid, GLOBAL_ROOT_UID) && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID)) + ret = -EACCES; +#endif +#endif @@ -55951,7 +56342,7 @@ index 0000000..39645c9 +} diff --git a/grsecurity/gracl_segv.c b/grsecurity/gracl_segv.c new file mode 100644 -index 0000000..5556be3 +index 0000000..25197e9 --- /dev/null +++ b/grsecurity/gracl_segv.c @@ -0,0 +1,299 @@ @@ -56120,11 +56511,11 @@ index 0000000..5556be3 +static __inline__ int +proc_is_setxid(const struct cred *cred) +{ -+ if (cred->uid != cred->euid || cred->uid != cred->suid || -+ cred->uid != cred->fsuid) ++ if (!uid_eq(cred->uid, cred->euid) || !uid_eq(cred->uid, cred->suid) || ++ !uid_eq(cred->uid, cred->fsuid)) + return 1; -+ if (cred->gid != cred->egid || cred->gid != cred->sgid || -+ cred->gid != cred->fsgid) ++ if (!uid_eq(cred->gid, cred->egid) || !uid_eq(cred->gid, cred->sgid) || ++ !uid_eq(cred->gid, cred->fsgid)) + return 1; + + return 0; @@ -56165,7 +56556,7 @@ index 0000000..5556be3 + time_after(curr->expires, get_seconds())) { + rcu_read_lock(); + cred = __task_cred(task); -+ if (cred->uid && proc_is_setxid(cred)) { ++ if (!uid_eq(cred->uid, GLOBAL_ROOT_UID) && proc_is_setxid(cred)) { + gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max); + spin_lock(&gr_uid_lock); + gr_insert_uid(cred->uid, curr->expires); @@ -56175,7 +56566,7 @@ index 0000000..5556be3 + read_lock(&tasklist_lock); + do_each_thread(tsk2, tsk) { + cred2 = __task_cred(tsk); -+ if (tsk != task && cred2->uid == cred->uid) ++ if (tsk != task && uid_eq(cred2->uid, cred->uid)) + gr_fake_force_sig(SIGKILL, tsk); + } while_each_thread(tsk2, tsk); + read_unlock(&tasklist_lock); @@ -57672,7 +58063,7 @@ index 0000000..05a6015 +} diff --git a/grsecurity/grsec_link.c b/grsecurity/grsec_link.c new file mode 100644 -index 0000000..35a96d1 +index 0000000..551a2e7 --- /dev/null +++ b/grsecurity/grsec_link.c @@ -0,0 +1,59 @@ @@ -57689,8 +58080,8 @@ index 0000000..35a96d1 + + if (grsec_enable_symlinkown && in_group_p(grsec_symlinkown_gid) && + /* ignore root-owned links, e.g. /proc/self */ -+ link_inode->i_uid && -+ link_inode->i_uid != target->i_uid) { ++ !uid_eq(link_inode->i_uid, GLOBAL_ROOT_UID) && ++ !uid_eq(link_inode->i_uid, target->i_uid)) { + gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINKOWNER_MSG, link->dentry, link->mnt, link_inode->i_uid, target->i_uid); + return 1; + } @@ -57707,8 +58098,8 @@ index 0000000..35a96d1 + const struct cred *cred = current_cred(); + + if (grsec_enable_link && S_ISLNK(inode->i_mode) && -+ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) && -+ (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) { ++ (parent->i_mode & S_ISVTX) && !uid_eq(parent->i_uid, inode->i_uid) && ++ (parent->i_mode & S_IWOTH) && !uid_eq(cred->fsuid, inode->i_uid)) { + gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid); + return -EACCES; + } @@ -57724,11 +58115,11 @@ index 0000000..35a96d1 +#ifdef CONFIG_GRKERNSEC_LINK + const struct cred *cred = current_cred(); + -+ if (grsec_enable_link && cred->fsuid != inode->i_uid && ++ if (grsec_enable_link && !uid_eq(cred->fsuid, inode->i_uid) && + (!S_ISREG(mode) || (mode & S_ISUID) || + ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) || + (inode_permission(inode, MAY_READ | MAY_WRITE))) && -+ !capable(CAP_FOWNER) && cred->uid) { ++ !capable(CAP_FOWNER) && !uid_eq(cred->uid, GLOBAL_ROOT_UID)) { + gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to); + return -EPERM; + } @@ -58257,10 +58648,10 @@ index 0000000..f7f29aa +} diff --git a/grsecurity/grsec_sig.c b/grsecurity/grsec_sig.c new file mode 100644 -index 0000000..7a5b2de +index 0000000..b4ac94c --- /dev/null +++ b/grsecurity/grsec_sig.c -@@ -0,0 +1,207 @@ +@@ -0,0 +1,209 @@ +#include <linux/kernel.h> +#include <linux/sched.h> +#include <linux/delay.h> @@ -58351,7 +58742,7 @@ index 0000000..7a5b2de +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags) +{ +#ifdef CONFIG_GRKERNSEC_BRUTE -+ uid_t uid = 0; ++ kuid_t uid = GLOBAL_ROOT_UID; + + if (!grsec_enable_brute) + return; @@ -58365,7 +58756,7 @@ index 0000000..7a5b2de + const struct cred *cred = __task_cred(p), *cred2; + struct task_struct *tsk, *tsk2; + -+ if (!__get_dumpable(mm_flags) && cred->uid) { ++ if (!__get_dumpable(mm_flags) && !uid_eq(cred->uid, GLOBAL_ROOT_UID)) { + struct user_struct *user; + + uid = cred->uid; @@ -58381,7 +58772,7 @@ index 0000000..7a5b2de + + do_each_thread(tsk2, tsk) { + cred2 = __task_cred(tsk); -+ if (tsk != p && cred2->uid == uid) ++ if (tsk != p && uid_eq(cred2->uid, uid)) + gr_fake_force_sig(SIGKILL, tsk); + } while_each_thread(tsk2, tsk); + } @@ -58391,8 +58782,9 @@ index 0000000..7a5b2de + read_unlock(&tasklist_lock); + rcu_read_unlock(); + -+ if (uid) -+ printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60); ++ if (!uid_eq(uid, GLOBAL_ROOT_UID)) ++ printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", ++ from_kuid_munged(&init_user_ns, uid), GR_USER_BAN_TIME / 60); + +#endif + return; @@ -58413,21 +58805,22 @@ index 0000000..7a5b2de + const struct cred *cred; + struct task_struct *tsk, *tsk2; + struct user_struct *user; -+ uid_t uid; ++ kuid_t uid; + + if (in_irq() || in_serving_softirq() || in_nmi()) + panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context"); + + uid = current_uid(); + -+ if (uid == 0) ++ if (uid_eq(uid, GLOBAL_ROOT_UID)) + panic("grsec: halting the system due to suspicious kernel crash caused by root"); + else { + /* kill all the processes of this user, hold a reference + to their creds struct, and prevent them from creating + another process until system reset + */ -+ printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid); ++ printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", ++ from_kuid_munged(&init_user_ns, uid)); + /* we intentionally leak this ref */ + user = get_uid(current->cred->user); + if (user) { @@ -58438,7 +58831,7 @@ index 0000000..7a5b2de + read_lock(&tasklist_lock); + do_each_thread(tsk2, tsk) { + cred = __task_cred(tsk); -+ if (cred->uid == uid) ++ if (uid_eq(cred->uid, uid)) + gr_fake_force_sig(SIGKILL, tsk); + } while_each_thread(tsk2, tsk); + read_unlock(&tasklist_lock); @@ -59362,10 +59755,10 @@ index 0000000..9f7b1ac + return retval; +} diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h -index f1c8ca6..b5c1cc7 100644 +index 9e6e1c6..d47b906 100644 --- a/include/acpi/acpi_bus.h +++ b/include/acpi/acpi_bus.h -@@ -107,7 +107,7 @@ struct acpi_device_ops { +@@ -138,7 +138,7 @@ struct acpi_device_ops { acpi_op_bind bind; acpi_op_unbind unbind; acpi_op_notify notify; @@ -59864,10 +60257,10 @@ index 810431d..0ec4804f 100644 * (puds are folded into pgds so this doesn't get actually called, * but the define is needed for a generic inline function.) diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h -index c7ec2cd..909d125 100644 +index ff4947b..f48183f 100644 --- a/include/asm-generic/pgtable.h +++ b/include/asm-generic/pgtable.h -@@ -531,6 +531,14 @@ static inline int pmd_trans_unstable(pmd_t *pmd) +@@ -530,6 +530,14 @@ static inline int pmd_trans_unstable(pmd_t *pmd) #endif } @@ -59883,7 +60276,7 @@ index c7ec2cd..909d125 100644 #endif /* !__ASSEMBLY__ */ diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h -index 8aeadf6..f1dc019 100644 +index 4e2e1cc..12c266b 100644 --- a/include/asm-generic/vmlinux.lds.h +++ b/include/asm-generic/vmlinux.lds.h @@ -218,6 +218,7 @@ @@ -59918,7 +60311,7 @@ index 8aeadf6..f1dc019 100644 /** * PERCPU_SECTION - define output section for percpu area, simple version diff --git a/include/drm/drmP.h b/include/drm/drmP.h -index dd73104..fde86bd 100644 +index 31ad880..4e79884 100644 --- a/include/drm/drmP.h +++ b/include/drm/drmP.h @@ -72,6 +72,7 @@ @@ -59948,27 +60341,27 @@ index dd73104..fde86bd 100644 struct list_head filelist; diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h -index 37515d1..34fa8b0 100644 +index 7988e55..ec974c9 100644 --- a/include/drm/drm_crtc_helper.h +++ b/include/drm/drm_crtc_helper.h -@@ -74,7 +74,7 @@ struct drm_crtc_helper_funcs { +@@ -81,7 +81,7 @@ struct drm_crtc_helper_funcs { /* disable crtc when not in use - more explicit than dpms off */ void (*disable)(struct drm_crtc *crtc); -}; +} __no_const; - struct drm_encoder_helper_funcs { - void (*dpms)(struct drm_encoder *encoder, int mode); -@@ -95,7 +95,7 @@ struct drm_encoder_helper_funcs { + /** + * drm_encoder_helper_funcs - helper operations for encoders +@@ -109,7 +109,7 @@ struct drm_encoder_helper_funcs { struct drm_connector *connector); /* disable encoder when not in use - more explicit than dpms off */ void (*disable)(struct drm_encoder *encoder); -}; +} __no_const; - struct drm_connector_helper_funcs { - int (*get_modes)(struct drm_connector *connector); + /** + * drm_connector_helper_funcs - helper operations for connectors diff --git a/include/drm/ttm/ttm_memory.h b/include/drm/ttm/ttm_memory.h index d6d1da4..fdd1ac5 100644 --- a/include/drm/ttm/ttm_memory.h @@ -60027,10 +60420,10 @@ index 366422b..1fa7f84 100644 }; diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h -index 4d4ac24..2c3ccce 100644 +index 07954b0..cb2ae71 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h -@@ -1376,7 +1376,7 @@ struct block_device_operations { +@@ -1393,7 +1393,7 @@ struct block_device_operations { /* this callback is with swap_lock and sometimes page table lock held */ void (*swap_slot_free_notify) (struct block_device *, unsigned long); struct module *owner; @@ -60136,15 +60529,16 @@ index 4c57065..4307975 100644 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES))) #endif diff --git a/include/linux/capability.h b/include/linux/capability.h -index 12d52de..b5f7fa7 100644 +index d10b7ed..11390a1 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h -@@ -548,6 +548,8 @@ extern bool has_ns_capability_noaudit(struct task_struct *t, - extern bool capable(int cap); +@@ -553,6 +553,9 @@ extern bool capable(int cap); extern bool ns_capable(struct user_namespace *ns, int cap); extern bool nsown_capable(int cap); + extern bool inode_capable(const struct inode *inode, int cap); +extern bool capable_nolog(int cap); +extern bool ns_capable_nolog(struct user_namespace *ns, int cap); ++extern bool inode_capable_nolog(const struct inode *inode, int cap); /* audit system wants to get cap info from files as well */ extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps); @@ -60331,10 +60725,10 @@ index 923d093..1fef491 100644 #endif /* __LINUX_COMPILER_H */ diff --git a/include/linux/cred.h b/include/linux/cred.h -index adadf71..6af5560 100644 +index ebbed2c..908cc2c 100644 --- a/include/linux/cred.h +++ b/include/linux/cred.h -@@ -207,6 +207,9 @@ static inline void validate_creds_for_do_exit(struct task_struct *tsk) +@@ -208,6 +208,9 @@ static inline void validate_creds_for_do_exit(struct task_struct *tsk) static inline void validate_process_creds(void) { } @@ -60489,10 +60883,10 @@ index 999b4f5..57753b4 100644 #endif diff --git a/include/linux/filter.h b/include/linux/filter.h -index 8eeb205..d59bfa2 100644 +index 82b0135..917914d 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h -@@ -134,6 +134,7 @@ struct sock_fprog { /* Required for SO_ATTACH_FILTER. */ +@@ -146,6 +146,7 @@ struct compat_sock_fprog { struct sk_buff; struct sock; @@ -60500,7 +60894,7 @@ index 8eeb205..d59bfa2 100644 struct sk_filter { -@@ -141,6 +142,9 @@ struct sk_filter +@@ -153,6 +154,9 @@ struct sk_filter unsigned int len; /* Number of filter blocks */ unsigned int (*bpf_func)(const struct sk_buff *skb, const struct sock_filter *filter); @@ -60511,10 +60905,10 @@ index 8eeb205..d59bfa2 100644 struct sock_filter insns[0]; }; diff --git a/include/linux/firewire.h b/include/linux/firewire.h -index cdc9b71..ce69fb5 100644 +index 7edcf10..714d5e8 100644 --- a/include/linux/firewire.h +++ b/include/linux/firewire.h -@@ -413,7 +413,7 @@ struct fw_iso_context { +@@ -430,7 +430,7 @@ struct fw_iso_context { union { fw_iso_callback_t sc; fw_iso_mc_callback_t mc; @@ -60523,11 +60917,24 @@ index cdc9b71..ce69fb5 100644 void *callback_data; }; +diff --git a/include/linux/frontswap.h b/include/linux/frontswap.h +index 0e4e2ee..4ff4312 100644 +--- a/include/linux/frontswap.h ++++ b/include/linux/frontswap.h +@@ -11,7 +11,7 @@ struct frontswap_ops { + int (*load)(unsigned, pgoff_t, struct page *); + void (*invalidate_page)(unsigned, pgoff_t); + void (*invalidate_area)(unsigned); +-}; ++} __no_const; + + extern bool frontswap_enabled; + extern struct frontswap_ops diff --git a/include/linux/fs.h b/include/linux/fs.h -index 25c40b9..1bfd4f4 100644 +index 17fd887..8eebca0 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h -@@ -1634,7 +1634,8 @@ struct file_operations { +@@ -1663,7 +1663,8 @@ struct file_operations { int (*setlease)(struct file *, long, struct file_lock **); long (*fallocate)(struct file *file, int mode, loff_t offset, loff_t len); @@ -60586,7 +60993,7 @@ index a6dfe69..569586df 100644 /* diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h -index 91d0e0a3..035666b 100644 +index 63d966d..cdcb717 100644 --- a/include/linux/fsnotify_backend.h +++ b/include/linux/fsnotify_backend.h @@ -105,6 +105,7 @@ struct fsnotify_ops { @@ -60633,7 +61040,7 @@ index 017a7fb..33a8507 100644 #ifdef CONFIG_BLK_DEV_INTEGRITY struct blk_integrity *integrity; diff --git a/include/linux/gfp.h b/include/linux/gfp.h -index 581e74b..8c34a24 100644 +index 1e49be4..b8a9305 100644 --- a/include/linux/gfp.h +++ b/include/linux/gfp.h @@ -38,6 +38,12 @@ struct vm_area_struct; @@ -61771,10 +62178,10 @@ index 0000000..e7ffaaf + +#endif diff --git a/include/linux/hid.h b/include/linux/hid.h -index 3a95da6..51986f1 100644 +index 449fa38..b37c8cc 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h -@@ -696,7 +696,7 @@ struct hid_ll_driver { +@@ -704,7 +704,7 @@ struct hid_ll_driver { unsigned int code, int value); int (*parse)(struct hid_device *hdev); @@ -61807,10 +62214,10 @@ index d3999b4..1304cb4 100644 unsigned start1, unsigned end1, unsigned start2, unsigned end2) diff --git a/include/linux/i2c.h b/include/linux/i2c.h -index 195d8b3..e20cfab 100644 +index ddfa041..a44cfff 100644 --- a/include/linux/i2c.h +++ b/include/linux/i2c.h -@@ -365,6 +365,7 @@ struct i2c_algorithm { +@@ -366,6 +366,7 @@ struct i2c_algorithm { /* To determine what the adapter supports */ u32 (*functionality) (struct i2c_adapter *); }; @@ -61832,10 +62239,10 @@ index d23c3c2..eb63c81 100644 and pointers */ #endif diff --git a/include/linux/if_team.h b/include/linux/if_team.h -index 58404b0..439ed95 100644 +index 8185f57..7b2d222 100644 --- a/include/linux/if_team.h +++ b/include/linux/if_team.h -@@ -64,6 +64,7 @@ struct team_mode_ops { +@@ -74,6 +74,7 @@ struct team_mode_ops { void (*port_leave)(struct team *team, struct team_port *port); void (*port_change_mac)(struct team *team, struct team_port *port); }; @@ -61843,8 +62250,8 @@ index 58404b0..439ed95 100644 enum team_option_type { TEAM_OPTION_TYPE_U32, -@@ -112,7 +113,7 @@ struct team { - struct list_head option_list; +@@ -136,7 +137,7 @@ struct team { + struct list_head option_inst_list; /* list of option instances */ const struct team_mode *mode; - struct team_mode_ops ops; @@ -61917,7 +62324,7 @@ index 6b95109..bcbdd68 100644 void cleanup_module(void) __attribute__((alias(#exitfn))); diff --git a/include/linux/init_task.h b/include/linux/init_task.h -index e4baff5..83bb175 100644 +index 9e65eff..b131e8b 100644 --- a/include/linux/init_task.h +++ b/include/linux/init_task.h @@ -134,6 +134,12 @@ extern struct cred init_cred; @@ -61955,10 +62362,10 @@ index e6ca56d..8583707 100644 enum { SR_DMAR_FECTL_REG, diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h -index 2aea5d2..0b82f0c 100644 +index e68a8e5..811b9af 100644 --- a/include/linux/interrupt.h +++ b/include/linux/interrupt.h -@@ -439,7 +439,7 @@ enum +@@ -435,7 +435,7 @@ enum /* map softirq index to softirq name. update 'softirq_to_name' in * kernel/softirq.c when adding a new softirq. */ @@ -61967,7 +62374,7 @@ index 2aea5d2..0b82f0c 100644 /* softirq mask and active fields moved to irq_cpustat_t in * asm/hardirq.h to get better cache usage. KAO -@@ -447,12 +447,12 @@ extern char *softirq_to_name[NR_SOFTIRQS]; +@@ -443,12 +443,12 @@ extern char *softirq_to_name[NR_SOFTIRQS]; struct softirq_action { @@ -61983,7 +62390,7 @@ index 2aea5d2..0b82f0c 100644 extern void __raise_softirq_irqoff(unsigned int nr); diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h -index 3875719..4cd454c 100644 +index 6883e19..06992b1 100644 --- a/include/linux/kallsyms.h +++ b/include/linux/kallsyms.h @@ -15,7 +15,8 @@ @@ -61996,7 +62403,7 @@ index 3875719..4cd454c 100644 /* Lookup the address for a symbol. Returns 0 if not found. */ unsigned long kallsyms_lookup_name(const char *name); -@@ -99,6 +100,16 @@ static inline int lookup_symbol_attrs(unsigned long addr, unsigned long *size, u +@@ -106,6 +107,17 @@ static inline int lookup_symbol_attrs(unsigned long addr, unsigned long *size, u /* Stupid that this does nothing, but I didn't create this mess. */ #define __print_symbol(fmt, addr) #endif /*CONFIG_KALLSYMS*/ @@ -62005,6 +62412,7 @@ index 3875719..4cd454c 100644 +extern void __print_symbol(const char *fmt, unsigned long address); +extern int sprint_backtrace(char *buffer, unsigned long address); +extern int sprint_symbol(char *buffer, unsigned long address); ++extern int sprint_symbol_no_offset(char *buffer, unsigned long address); +const char *kallsyms_lookup(unsigned long addr, + unsigned long *symbolsize, + unsigned long *offset, @@ -62045,7 +62453,7 @@ index c4d2fc1..5df9c19 100644 extern struct kgdb_arch arch_kgdb_ops; diff --git a/include/linux/kmod.h b/include/linux/kmod.h -index dd99c32..da06047 100644 +index 5398d58..5883a34 100644 --- a/include/linux/kmod.h +++ b/include/linux/kmod.h @@ -34,6 +34,8 @@ extern char modprobe_path[]; /* for sysctl */ @@ -62071,10 +62479,10 @@ index 9c07dce..a92fa71 100644 if (atomic_sub_and_test((int) count, &kref->refcount)) { release(kref); diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h -index 72cbf08..dd0201d 100644 +index 96c158a..1864db5 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h -@@ -322,7 +322,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu); +@@ -345,7 +345,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu); void vcpu_load(struct kvm_vcpu *vcpu); void vcpu_put(struct kvm_vcpu *vcpu); @@ -62083,7 +62491,7 @@ index 72cbf08..dd0201d 100644 struct module *module); void kvm_exit(void); -@@ -486,7 +486,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu, +@@ -511,7 +511,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu, struct kvm_guest_debug *dbg); int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run); @@ -62105,19 +62513,6 @@ index 6e887c7..4539601 100644 struct ata_port_info { unsigned long flags; -diff --git a/include/linux/mca.h b/include/linux/mca.h -index 3797270..7765ede 100644 ---- a/include/linux/mca.h -+++ b/include/linux/mca.h -@@ -80,7 +80,7 @@ struct mca_bus_accessor_functions { - int region); - void * (*mca_transform_memory)(struct mca_device *, - void *memory); --}; -+} __no_const; - - struct mca_bus { - u64 default_dma_mask; diff --git a/include/linux/memory.h b/include/linux/memory.h index 1ac7f6e..a5794d0 100644 --- a/include/linux/memory.h @@ -62132,10 +62527,10 @@ index 1ac7f6e..a5794d0 100644 /* * Kernel text modification mutex, used for code patching. Users of this lock diff --git a/include/linux/mfd/abx500.h b/include/linux/mfd/abx500.h -index ee96cd5..7823c3a 100644 +index 1318ca6..7521340 100644 --- a/include/linux/mfd/abx500.h +++ b/include/linux/mfd/abx500.h -@@ -455,6 +455,7 @@ struct abx500_ops { +@@ -452,6 +452,7 @@ struct abx500_ops { int (*event_registers_startup_state_get) (struct device *, u8 *); int (*startup_irq_enabled) (struct device *, unsigned int); }; @@ -62157,7 +62552,7 @@ index 9b07725..3d55001 100644 /** * struct ux500_charger - power supply ux500 charger sub class diff --git a/include/linux/mm.h b/include/linux/mm.h -index 74aa71b..4ae97ba 100644 +index b36d08c..410ee7c 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -116,7 +116,14 @@ extern unsigned int kobjsize(const void *objp); @@ -62175,7 +62570,7 @@ index 74aa71b..4ae97ba 100644 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */ #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */ -@@ -1013,34 +1020,6 @@ int set_page_dirty(struct page *page); +@@ -1009,34 +1016,6 @@ int set_page_dirty(struct page *page); int set_page_dirty_lock(struct page *page); int clear_page_dirty_for_io(struct page *page); @@ -62210,7 +62605,7 @@ index 74aa71b..4ae97ba 100644 extern pid_t vm_is_stack(struct task_struct *task, struct vm_area_struct *vma, int in_group); -@@ -1139,6 +1118,15 @@ static inline void sync_mm_rss(struct mm_struct *mm) +@@ -1135,6 +1114,15 @@ static inline void sync_mm_rss(struct mm_struct *mm) } #endif @@ -62226,7 +62621,7 @@ index 74aa71b..4ae97ba 100644 int vma_wants_writenotify(struct vm_area_struct *vma); extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr, -@@ -1157,8 +1145,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, +@@ -1153,8 +1141,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, { return 0; } @@ -62242,7 +62637,7 @@ index 74aa71b..4ae97ba 100644 #endif #ifdef __PAGETABLE_PMD_FOLDED -@@ -1167,8 +1162,15 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud, +@@ -1163,8 +1158,15 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud, { return 0; } @@ -62258,7 +62653,7 @@ index 74aa71b..4ae97ba 100644 #endif int __pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma, -@@ -1186,11 +1188,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a +@@ -1182,11 +1184,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a NULL: pud_offset(pgd, address); } @@ -62282,7 +62677,7 @@ index 74aa71b..4ae97ba 100644 #endif /* CONFIG_MMU && !__ARCH_HAS_4LEVEL_HACK */ #if USE_SPLIT_PTLOCKS -@@ -1400,6 +1414,7 @@ extern unsigned long do_mmap(struct file *, unsigned long, +@@ -1396,6 +1410,7 @@ extern unsigned long do_mmap_pgoff(struct file *, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long); extern int do_munmap(struct mm_struct *, unsigned long, size_t); @@ -62290,7 +62685,7 @@ index 74aa71b..4ae97ba 100644 /* These take the mm semaphore themselves */ extern unsigned long vm_brk(unsigned long, unsigned long); -@@ -1462,6 +1477,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add +@@ -1458,6 +1473,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr, struct vm_area_struct **pprev); @@ -62301,7 +62696,7 @@ index 74aa71b..4ae97ba 100644 /* Look up the first VMA which intersects the interval start_addr..end_addr-1, NULL if none. Assume start_addr < end_addr. */ static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr) -@@ -1490,15 +1509,6 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm, +@@ -1486,15 +1505,6 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm, return vma; } @@ -62317,7 +62712,7 @@ index 74aa71b..4ae97ba 100644 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr); int remap_pfn_range(struct vm_area_struct *, unsigned long addr, unsigned long pfn, unsigned long size, pgprot_t); -@@ -1602,7 +1612,7 @@ extern int unpoison_memory(unsigned long pfn); +@@ -1598,7 +1608,7 @@ extern int unpoison_memory(unsigned long pfn); extern int sysctl_memory_failure_early_kill; extern int sysctl_memory_failure_recovery; extern void shake_page(struct page *p, int access); @@ -62326,7 +62721,7 @@ index 74aa71b..4ae97ba 100644 extern int soft_offline_page(struct page *page, int flags); extern void dump_page(struct page *page); -@@ -1633,5 +1643,11 @@ static inline unsigned int debug_guardpage_minorder(void) { return 0; } +@@ -1629,5 +1639,11 @@ static inline unsigned int debug_guardpage_minorder(void) { return 0; } static inline bool page_is_guard(struct page *page) { return false; } #endif /* CONFIG_DEBUG_PAGEALLOC */ @@ -62339,10 +62734,10 @@ index 74aa71b..4ae97ba 100644 #endif /* __KERNEL__ */ #endif /* _LINUX_MM_H */ diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h -index b35752f..41075a0 100644 +index 704a626..bb0705a 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h -@@ -262,6 +262,8 @@ struct vm_area_struct { +@@ -263,6 +263,8 @@ struct vm_area_struct { #ifdef CONFIG_NUMA struct mempolicy *vm_policy; /* NUMA policy for the VMA */ #endif @@ -62351,7 +62746,7 @@ index b35752f..41075a0 100644 }; struct core_thread { -@@ -336,7 +338,7 @@ struct mm_struct { +@@ -337,7 +339,7 @@ struct mm_struct { unsigned long def_flags; unsigned long nr_ptes; /* Page table pages */ unsigned long start_code, end_code, start_data, end_data; @@ -62360,12 +62755,12 @@ index b35752f..41075a0 100644 unsigned long arg_start, arg_end, env_start, env_end; unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */ -@@ -398,6 +400,24 @@ struct mm_struct { - #ifdef CONFIG_CPUMASK_OFFSTACK +@@ -389,6 +391,24 @@ struct mm_struct { struct cpumask cpumask_allocation; #endif + struct uprobes_state uprobes_state; + -+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_XATTR_PAX_FLAGS) || defined(CONFIG_PAX_HAVE_ACL_FLAGS) || defined(CONFIG_PAX_HOOK_ACL_FLAGS) ++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR) + unsigned long pax_flags; +#endif + @@ -62406,10 +62801,10 @@ index 1d1b1e1..2a13c78 100644 #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \ diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index 5f6806b..49db2b2 100644 +index 68c569f..5f43753 100644 --- a/include/linux/mmzone.h +++ b/include/linux/mmzone.h -@@ -380,7 +380,7 @@ struct zone { +@@ -411,7 +411,7 @@ struct zone { unsigned long flags; /* zone flags, see below */ /* Zone statistics */ @@ -62419,7 +62814,7 @@ index 5f6806b..49db2b2 100644 /* * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h -index 501da4c..ba79bb4 100644 +index 5db9382..50e801d 100644 --- a/include/linux/mod_devicetable.h +++ b/include/linux/mod_devicetable.h @@ -12,7 +12,7 @@ @@ -62437,9 +62832,9 @@ index 501da4c..ba79bb4 100644 -#define HID_ANY_ID (~0) +#define HID_ANY_ID (~0U) + #define HID_BUS_ANY 0xffff + #define HID_GROUP_ANY 0x0000 - struct hid_device_id { - __u16 bus; diff --git a/include/linux/module.h b/include/linux/module.h index fbcafe2..e5d9587 100644 --- a/include/linux/module.h @@ -62568,7 +62963,7 @@ index b2be02e..72d2f78 100644 or 0. */ int apply_relocate(Elf_Shdr *sechdrs, diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h -index 944bc18..042d291 100644 +index d6a5806..7c13347 100644 --- a/include/linux/moduleparam.h +++ b/include/linux/moduleparam.h @@ -286,7 +286,7 @@ static inline void __kernel_param_unlock(void) @@ -62580,7 +62975,7 @@ index 944bc18..042d291 100644 = { len, string }; \ __module_param_call(MODULE_PARAM_PREFIX, name, \ ¶m_ops_string, \ -@@ -424,7 +424,7 @@ extern int param_set_bint(const char *val, const struct kernel_param *kp); +@@ -425,7 +425,7 @@ extern int param_set_bint(const char *val, const struct kernel_param *kp); */ #define module_param_array_named(name, array, type, nump, perm) \ param_check_##type(name, &(array)[0]); \ @@ -62618,18 +63013,18 @@ index ffc0213..2c1f2cb 100644 return nd->saved_names[nd->depth]; } diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 33900a5..2072000 100644 +index d94cb14..e64c951 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h -@@ -1003,6 +1003,7 @@ struct net_device_ops { - int (*ndo_neigh_construct)(struct neighbour *n); - void (*ndo_neigh_destroy)(struct neighbour *n); +@@ -1026,6 +1026,7 @@ struct net_device_ops { + struct net_device *dev, + int idx); }; +typedef struct net_device_ops __no_const net_device_ops_no_const; /* * The DEVICE structure. -@@ -1064,7 +1065,7 @@ struct net_device { +@@ -1087,7 +1088,7 @@ struct net_device { int iflink; struct net_device_stats stats; @@ -62683,7 +63078,7 @@ index a4c5624..79d6d88 100644 /** create a directory */ struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root, diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h -index ddbb6a9..be1680e 100644 +index 45db49f..386788e 100644 --- a/include/linux/perf_event.h +++ b/include/linux/perf_event.h @@ -879,8 +879,8 @@ struct perf_event { @@ -62738,7 +63133,7 @@ index e1ac1ce..0675fed 100644 unsigned int w_counter; struct page *tmp_page; diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h -index 609daae..5392427 100644 +index f271860..6b3bec5 100644 --- a/include/linux/pm_runtime.h +++ b/include/linux/pm_runtime.h @@ -97,7 +97,7 @@ static inline bool pm_runtime_callbacks_present(struct device *dev) @@ -62779,7 +63174,7 @@ index 5a710b9..0b0dab9 100644 /** * preempt_notifier - key for installing preemption notifiers diff --git a/include/linux/printk.h b/include/linux/printk.h -index 0525927..a5388b6 100644 +index 1bec2f7..b66e833 100644 --- a/include/linux/printk.h +++ b/include/linux/printk.h @@ -94,6 +94,8 @@ void early_printk(const char *fmt, ...); @@ -62789,9 +63184,9 @@ index 0525927..a5388b6 100644 +extern int kptr_restrict; + #ifdef CONFIG_PRINTK - asmlinkage __printf(1, 0) - int vprintk(const char *fmt, va_list args); -@@ -117,7 +119,6 @@ extern bool printk_timed_ratelimit(unsigned long *caller_jiffies, + asmlinkage __printf(5, 0) + int vprintk_emit(int facility, int level, +@@ -128,7 +130,6 @@ extern bool printk_timed_ratelimit(unsigned long *caller_jiffies, extern int printk_delay_msec; extern int dmesg_restrict; @@ -62800,7 +63195,7 @@ index 0525927..a5388b6 100644 void log_buf_kexec_setup(void); void __init setup_log_buf(int early); diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h -index 85c5073..51fac8b 100644 +index 3fd2e87..d93a721 100644 --- a/include/linux/proc_fs.h +++ b/include/linux/proc_fs.h @@ -155,6 +155,18 @@ static inline struct proc_dir_entry *proc_create(const char *name, umode_t mode, @@ -62930,10 +63325,10 @@ index 6fdf027..ff72610 100644 #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE) /** diff --git a/include/linux/rio.h b/include/linux/rio.h -index 4d50611..c6858a2 100644 +index a90ebad..fd87b5d 100644 --- a/include/linux/rio.h +++ b/include/linux/rio.h -@@ -315,7 +315,7 @@ struct rio_ops { +@@ -321,7 +321,7 @@ struct rio_ops { int mbox, void *buffer, size_t len); int (*add_inb_buffer)(struct rio_mport *mport, int mbox, void *buf); void *(*get_inb_message)(struct rio_mport *mport, int mbox); @@ -62943,7 +63338,7 @@ index 4d50611..c6858a2 100644 #define RIO_RESOURCE_MEM 0x00000100 #define RIO_RESOURCE_DOORBELL 0x00000200 diff --git a/include/linux/rmap.h b/include/linux/rmap.h -index fd07c45..4676b8e 100644 +index 3fce545..b4fed6e 100644 --- a/include/linux/rmap.h +++ b/include/linux/rmap.h @@ -119,9 +119,9 @@ static inline void anon_vma_unlock(struct anon_vma *anon_vma) @@ -62959,10 +63354,10 @@ index fd07c45..4676b8e 100644 static inline void anon_vma_merge(struct vm_area_struct *vma, struct vm_area_struct *next) diff --git a/include/linux/sched.h b/include/linux/sched.h -index 7b06169..eb46ae3 100644 +index 4a1f493..5812aeb 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h -@@ -100,6 +100,7 @@ struct bio_list; +@@ -101,6 +101,7 @@ struct bio_list; struct fs_struct; struct perf_event_context; struct blk_plug; @@ -62970,7 +63365,7 @@ index 7b06169..eb46ae3 100644 /* * List of flags we want to share for kernel threads, -@@ -382,10 +383,13 @@ struct user_namespace; +@@ -384,10 +385,13 @@ struct user_namespace; #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN) extern int sysctl_max_map_count; @@ -62984,7 +63379,7 @@ index 7b06169..eb46ae3 100644 extern void arch_pick_mmap_layout(struct mm_struct *mm); extern unsigned long arch_get_unmapped_area(struct file *, unsigned long, unsigned long, -@@ -404,6 +408,11 @@ static inline void arch_pick_mmap_layout(struct mm_struct *mm) {} +@@ -406,6 +410,11 @@ static inline void arch_pick_mmap_layout(struct mm_struct *mm) {} extern void set_dumpable(struct mm_struct *mm, int value); extern int get_dumpable(struct mm_struct *mm); @@ -62996,7 +63391,7 @@ index 7b06169..eb46ae3 100644 /* mm flags */ /* dumpable bits */ #define MMF_DUMPABLE 0 /* core dump is permitted */ -@@ -643,6 +652,17 @@ struct signal_struct { +@@ -646,6 +655,17 @@ struct signal_struct { #ifdef CONFIG_TASKSTATS struct taskstats *stats; #endif @@ -63014,7 +63409,7 @@ index 7b06169..eb46ae3 100644 #ifdef CONFIG_AUDIT unsigned audit_tty; struct tty_audit_buf *tty_audit_buf; -@@ -726,6 +746,11 @@ struct user_struct { +@@ -729,6 +749,11 @@ struct user_struct { struct key *session_keyring; /* UID's default session keyring */ #endif @@ -63025,8 +63420,8 @@ index 7b06169..eb46ae3 100644 + /* Hash table maintenance information */ struct hlist_node uidhash_node; - uid_t uid; -@@ -1386,8 +1411,8 @@ struct task_struct { + kuid_t uid; +@@ -1348,8 +1373,8 @@ struct task_struct { struct list_head thread_group; struct completion *vfork_done; /* for vfork() */ @@ -63037,7 +63432,7 @@ index 7b06169..eb46ae3 100644 cputime_t utime, stime, utimescaled, stimescaled; cputime_t gtime; -@@ -1403,13 +1428,6 @@ struct task_struct { +@@ -1365,11 +1390,6 @@ struct task_struct { struct task_cputime cputime_expires; struct list_head cpu_timers[3]; @@ -63046,12 +63441,10 @@ index 7b06169..eb46ae3 100644 - * credentials (COW) */ - const struct cred __rcu *cred; /* effective (overridable) subjective task - * credentials (COW) */ -- struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */ -- char comm[TASK_COMM_LEN]; /* executable name excluding path - access with [gs]et_task_comm (which lock it with task_lock()) -@@ -1426,8 +1444,16 @@ struct task_struct { +@@ -1386,8 +1406,16 @@ struct task_struct { #endif /* CPU-specific state of this task */ struct thread_struct thread; @@ -63068,7 +63461,7 @@ index 7b06169..eb46ae3 100644 /* open file information */ struct files_struct *files; /* namespaces */ -@@ -1469,6 +1495,11 @@ struct task_struct { +@@ -1431,6 +1459,11 @@ struct task_struct { struct rt_mutex_waiter *pi_blocked_on; #endif @@ -63080,7 +63473,7 @@ index 7b06169..eb46ae3 100644 #ifdef CONFIG_DEBUG_MUTEXES /* mutex deadlock detection */ struct mutex_waiter *blocked_on; -@@ -1585,6 +1616,27 @@ struct task_struct { +@@ -1547,6 +1580,27 @@ struct task_struct { unsigned long default_timer_slack_ns; struct list_head *scm_work_list; @@ -63108,7 +63501,7 @@ index 7b06169..eb46ae3 100644 #ifdef CONFIG_FUNCTION_GRAPH_TRACER /* Index of current stored address in ret_stack */ int curr_ret_stack; -@@ -1619,6 +1671,51 @@ struct task_struct { +@@ -1585,6 +1639,51 @@ struct task_struct { #endif }; @@ -63160,7 +63553,7 @@ index 7b06169..eb46ae3 100644 /* Future-safe accessor for struct task_struct's cpus_allowed. */ #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed) -@@ -2146,7 +2243,9 @@ void yield(void); +@@ -2112,7 +2211,9 @@ void yield(void); extern struct exec_domain default_exec_domain; union thread_union { @@ -63170,7 +63563,7 @@ index 7b06169..eb46ae3 100644 unsigned long stack[THREAD_SIZE/sizeof(long)]; }; -@@ -2179,6 +2278,7 @@ extern struct pid_namespace init_pid_ns; +@@ -2145,6 +2246,7 @@ extern struct pid_namespace init_pid_ns; */ extern struct task_struct *find_task_by_vpid(pid_t nr); @@ -63178,7 +63571,7 @@ index 7b06169..eb46ae3 100644 extern struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns); -@@ -2322,7 +2422,7 @@ extern void __cleanup_sighand(struct sighand_struct *); +@@ -2301,7 +2403,7 @@ extern void __cleanup_sighand(struct sighand_struct *); extern void exit_itimers(struct signal_struct *); extern void flush_itimer_signals(void); @@ -63187,7 +63580,7 @@ index 7b06169..eb46ae3 100644 extern void daemonize(const char *, ...); extern int allow_signal(int); -@@ -2523,9 +2623,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p) +@@ -2502,9 +2604,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p) #endif @@ -63214,7 +63607,7 @@ index 899fbb4..1cb4138 100644 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */ diff --git a/include/linux/security.h b/include/linux/security.h -index 673afbb..2b7454b 100644 +index 4e5a73c..a5784a1 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -26,6 +26,7 @@ @@ -63263,10 +63656,10 @@ index 92808b8..c28cac4 100644 /* shm_mode upper byte flags */ diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index c1bae8d..2dbcd31 100644 +index 642cb73..7ff7f9f 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h -@@ -663,7 +663,7 @@ static inline struct skb_shared_hwtstamps *skb_hwtstamps(struct sk_buff *skb) +@@ -680,7 +680,7 @@ static inline struct skb_shared_hwtstamps *skb_hwtstamps(struct sk_buff *skb) */ static inline int skb_queue_empty(const struct sk_buff_head *list) { @@ -63275,7 +63668,7 @@ index c1bae8d..2dbcd31 100644 } /** -@@ -676,7 +676,7 @@ static inline int skb_queue_empty(const struct sk_buff_head *list) +@@ -693,7 +693,7 @@ static inline int skb_queue_empty(const struct sk_buff_head *list) static inline bool skb_queue_is_last(const struct sk_buff_head *list, const struct sk_buff *skb) { @@ -63284,7 +63677,7 @@ index c1bae8d..2dbcd31 100644 } /** -@@ -689,7 +689,7 @@ static inline bool skb_queue_is_last(const struct sk_buff_head *list, +@@ -706,7 +706,7 @@ static inline bool skb_queue_is_last(const struct sk_buff_head *list, static inline bool skb_queue_is_first(const struct sk_buff_head *list, const struct sk_buff *skb) { @@ -63293,7 +63686,7 @@ index c1bae8d..2dbcd31 100644 } /** -@@ -1584,7 +1584,7 @@ static inline int pskb_network_may_pull(struct sk_buff *skb, unsigned int len) +@@ -1605,7 +1605,7 @@ static inline int pskb_network_may_pull(struct sk_buff *skb, unsigned int len) * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8) */ #ifndef NET_SKB_PAD @@ -63303,7 +63696,7 @@ index c1bae8d..2dbcd31 100644 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len); diff --git a/include/linux/slab.h b/include/linux/slab.h -index a595dce..dfab0d2 100644 +index 67d5d94..371d9a7 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -11,12 +11,20 @@ @@ -63360,7 +63753,7 @@ index a595dce..dfab0d2 100644 +static void *kmalloc_array(size_t n, size_t size, gfp_t flags) __size_overflow(1, 2); static inline void *kmalloc_array(size_t n, size_t size, gfp_t flags) { - if (size != 0 && n > ULONG_MAX / size) + if (size != 0 && n > SIZE_MAX / size) @@ -298,7 +312,7 @@ static inline void *kmem_cache_alloc_node(struct kmem_cache *cachep, */ #if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_SLUB) || \ @@ -63635,11 +64028,33 @@ index c34b4c8..a65b67d 100644 extern int proc_dointvec(struct ctl_table *, int, void __user *, size_t *, loff_t *); extern int proc_dointvec_minmax(struct ctl_table *, int, +diff --git a/include/linux/tty.h b/include/linux/tty.h +index 9f47ab5..73da944 100644 +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -225,7 +225,7 @@ struct tty_port { + const struct tty_port_operations *ops; /* Port operations */ + spinlock_t lock; /* Lock protecting tty field */ + int blocked_open; /* Waiting to open */ +- int count; /* Usage count */ ++ atomic_t count; /* Usage count */ + wait_queue_head_t open_wait; /* Open waiters */ + wait_queue_head_t close_wait; /* Close waiters */ + wait_queue_head_t delta_msr_wait; /* Modem status change */ +@@ -525,7 +525,7 @@ extern int tty_port_open(struct tty_port *port, + struct tty_struct *tty, struct file *filp); + static inline int tty_port_users(struct tty_port *port) + { +- return port->count + port->blocked_open; ++ return atomic_read(&port->count) + port->blocked_open; + } + + extern int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc); diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h -index ff7dc08..893e1bd 100644 +index fb79dd8d..07d4773 100644 --- a/include/linux/tty_ldisc.h +++ b/include/linux/tty_ldisc.h -@@ -148,7 +148,7 @@ struct tty_ldisc_ops { +@@ -149,7 +149,7 @@ struct tty_ldisc_ops { struct module *owner; @@ -63649,7 +64064,7 @@ index ff7dc08..893e1bd 100644 struct tty_ldisc { diff --git a/include/linux/types.h b/include/linux/types.h -index 7f480db..175c256 100644 +index 9c1bd53..c2370f6 100644 --- a/include/linux/types.h +++ b/include/linux/types.h @@ -220,10 +220,26 @@ typedef struct { @@ -63924,44 +64339,39 @@ index e5d1220..ef6e406 100644 #include <linux/types.h> diff --git a/include/media/saa7146_vv.h b/include/media/saa7146_vv.h -index 4aeff96..b378cdc 100644 +index 944ecdf..a3994fc 100644 --- a/include/media/saa7146_vv.h +++ b/include/media/saa7146_vv.h -@@ -163,7 +163,7 @@ struct saa7146_ext_vv +@@ -161,8 +161,8 @@ struct saa7146_ext_vv int (*std_callback)(struct saa7146_dev*, struct saa7146_standard *); /* the extension can override this */ -- struct v4l2_ioctl_ops ops; -+ v4l2_ioctl_ops_no_const ops; +- struct v4l2_ioctl_ops vid_ops; +- struct v4l2_ioctl_ops vbi_ops; ++ v4l2_ioctl_ops_no_const vid_ops; ++ v4l2_ioctl_ops_no_const vbi_ops; /* pointer to the saa7146 core ops */ const struct v4l2_ioctl_ops *core_ops; diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h -index 96d2221..2292f89 100644 +index a056e6e..31023a5 100644 --- a/include/media/v4l2-dev.h +++ b/include/media/v4l2-dev.h -@@ -56,7 +56,7 @@ int v4l2_prio_check(struct v4l2_prio_state *global, enum v4l2_priority local); - - - struct v4l2_file_operations { -- struct module *owner; -+ struct module * const owner; - ssize_t (*read) (struct file *, char __user *, size_t, loff_t *); - ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *); - unsigned int (*poll) (struct file *, struct poll_table_struct *); -@@ -71,6 +71,7 @@ struct v4l2_file_operations { +@@ -73,7 +73,8 @@ struct v4l2_file_operations { + int (*mmap) (struct file *, struct vm_area_struct *); int (*open) (struct file *); int (*release) (struct file *); - }; +-}; ++} __do_const; +typedef struct v4l2_file_operations __no_const v4l2_file_operations_no_const; /* * Newer version of video_device, handled by videodev2.c diff --git a/include/media/v4l2-ioctl.h b/include/media/v4l2-ioctl.h -index 3cb939c..f23c6bb 100644 +index d8b76f7..7d5aa18 100644 --- a/include/media/v4l2-ioctl.h +++ b/include/media/v4l2-ioctl.h -@@ -281,7 +281,7 @@ struct v4l2_ioctl_ops { +@@ -287,7 +287,7 @@ struct v4l2_ioctl_ops { long (*vidioc_default) (struct file *file, void *fh, bool valid_prio, int cmd, void *arg); }; @@ -63971,7 +64381,7 @@ index 3cb939c..f23c6bb 100644 /* v4l debugging and diagnostics */ diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h -index 6db8ecf..8c23861 100644 +index 439dadc..1c67e3f 100644 --- a/include/net/caif/caif_hsi.h +++ b/include/net/caif/caif_hsi.h @@ -98,7 +98,7 @@ struct cfhsi_drv { @@ -64049,7 +64459,7 @@ index 2040bff..f4c0733 100644 } diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h -index 10422ef..662570f 100644 +index 78df0866..00e5c9b 100644 --- a/include/net/ip_fib.h +++ b/include/net/ip_fib.h @@ -146,7 +146,7 @@ extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh); @@ -64062,7 +64472,7 @@ index 10422ef..662570f 100644 fib_info_update_nh_saddr((net), &FIB_RES_NH(res))) #define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw) diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h -index 72522f0..2965e05 100644 +index 95374d1..2300e36 100644 --- a/include/net/ip_vs.h +++ b/include/net/ip_vs.h @@ -510,7 +510,7 @@ struct ip_vs_conn { @@ -64077,21 +64487,12 @@ index 72522f0..2965e05 100644 @@ -648,7 +648,7 @@ struct ip_vs_dest { __be16 port; /* port number of the server */ union nf_inet_addr addr; /* IP address of the server */ - volatile unsigned flags; /* dest status flags */ + volatile unsigned int flags; /* dest status flags */ - atomic_t conn_flags; /* flags to copy to conn */ + atomic_unchecked_t conn_flags; /* flags to copy to conn */ atomic_t weight; /* server weight */ atomic_t refcnt; /* reference counter */ -@@ -1356,7 +1356,7 @@ static inline void ip_vs_notrack(struct sk_buff *skb) - struct nf_conn *ct = nf_ct_get(skb, &ctinfo); - - if (!ct || !nf_ct_is_untracked(ct)) { -- nf_reset(skb); -+ nf_conntrack_put(skb->nfct); - skb->nfct = &nf_ct_untracked_get()->ct_general; - skb->nfctinfo = IP_CT_NEW; - nf_conntrack_get(skb->nfct); diff --git a/include/net/irda/ircomm_core.h b/include/net/irda/ircomm_core.h index 69b610a..fe3962c 100644 --- a/include/net/irda/ircomm_core.h @@ -64142,7 +64543,7 @@ index cc7c197..9f2da2a 100644 unsigned int iucv_sock_poll(struct file *file, struct socket *sock, diff --git a/include/net/neighbour.h b/include/net/neighbour.h -index 34c996f..bb3b4d4 100644 +index 6cdfeed..55a0256 100644 --- a/include/net/neighbour.h +++ b/include/net/neighbour.h @@ -123,7 +123,7 @@ struct neigh_ops { @@ -64155,10 +64556,10 @@ index 34c996f..bb3b4d4 100644 struct pneigh_entry { struct pneigh_entry *next; diff --git a/include/net/netlink.h b/include/net/netlink.h -index f394fe5..fd073f9 100644 +index 785f37a..c81dc0c 100644 --- a/include/net/netlink.h +++ b/include/net/netlink.h -@@ -534,7 +534,7 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb) +@@ -520,7 +520,7 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb) static inline void nlmsg_trim(struct sk_buff *skb, const void *mark) { if (mark) @@ -64200,10 +64601,10 @@ index a2ef814..31a8e3f 100644 #define SCTP_DISABLE_DEBUG #define SCTP_ASSERT(expr, str, func) diff --git a/include/net/sock.h b/include/net/sock.h -index 5a0a58a..2e3d4d0 100644 +index 4a45216..7af2578 100644 --- a/include/net/sock.h +++ b/include/net/sock.h -@@ -302,7 +302,7 @@ struct sock { +@@ -303,7 +303,7 @@ struct sock { #ifdef CONFIG_RPS __u32 sk_rxhash; #endif @@ -64212,7 +64613,7 @@ index 5a0a58a..2e3d4d0 100644 int sk_rcvbuf; struct sk_filter __rcu *sk_filter; -@@ -1691,7 +1691,7 @@ static inline void sk_nocaps_add(struct sock *sk, netdev_features_t flags) +@@ -1726,7 +1726,7 @@ static inline void sk_nocaps_add(struct sock *sk, netdev_features_t flags) } static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb, @@ -64222,10 +64623,10 @@ index 5a0a58a..2e3d4d0 100644 { if (skb->ip_summed == CHECKSUM_NONE) { diff --git a/include/net/tcp.h b/include/net/tcp.h -index f75a04d..702cf06 100644 +index e79aa48..9929421 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h -@@ -1425,7 +1425,7 @@ struct tcp_seq_afinfo { +@@ -1459,7 +1459,7 @@ struct tcp_seq_afinfo { char *name; sa_family_t family; const struct file_operations *seq_fops; @@ -64235,7 +64636,7 @@ index f75a04d..702cf06 100644 struct tcp_iter_state { diff --git a/include/net/udp.h b/include/net/udp.h -index 5d606d9..e879f7b 100644 +index 065f379..b661b40 100644 --- a/include/net/udp.h +++ b/include/net/udp.h @@ -244,7 +244,7 @@ struct udp_seq_afinfo { @@ -64248,7 +64649,7 @@ index 5d606d9..e879f7b 100644 struct udp_iter_state { diff --git a/include/net/xfrm.h b/include/net/xfrm.h -index 96239e7..c85b032 100644 +index e0a55df..5890bca07 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -505,7 +505,7 @@ struct xfrm_policy { @@ -64312,15 +64713,16 @@ index ba96988..ecf2eb9 100644 struct device sdev_gendev, sdev_dev; diff --git a/include/scsi/scsi_transport_fc.h b/include/scsi/scsi_transport_fc.h -index 719faf1..d1154d4 100644 +index 719faf1..07b6728 100644 --- a/include/scsi/scsi_transport_fc.h +++ b/include/scsi/scsi_transport_fc.h -@@ -739,7 +739,7 @@ struct fc_function_template { +@@ -739,7 +739,8 @@ struct fc_function_template { unsigned long show_host_system_hostname:1; unsigned long disable_target_scan:1; -}; +} __do_const; ++typedef struct fc_function_template __no_const fc_function_template_no_const; /** @@ -64389,27 +64791,40 @@ index af1b49e..a5d55a5 100644 /* * CSP private data diff --git a/include/sound/soc.h b/include/sound/soc.h -index 2ebf787..0276839 100644 +index c703871..f7fbbbd 100644 --- a/include/sound/soc.h +++ b/include/sound/soc.h -@@ -711,7 +711,7 @@ struct snd_soc_platform_driver { - /* platform IO - used for platform DAPM */ +@@ -757,7 +757,7 @@ struct snd_soc_platform_driver { unsigned int (*read)(struct snd_soc_platform *, unsigned int); int (*write)(struct snd_soc_platform *, unsigned int, unsigned int); + int (*bespoke_trigger)(struct snd_pcm_substream *, int); -}; +} __do_const; struct snd_soc_platform { const char *name; -@@ -887,7 +887,7 @@ struct snd_soc_pcm_runtime { +@@ -949,7 +949,7 @@ struct snd_soc_pcm_runtime { struct snd_soc_dai_link *dai_link; struct mutex pcm_mutex; enum snd_soc_pcm_subclass pcm_subclass; - struct snd_pcm_ops ops; + snd_pcm_ops_no_const ops; - unsigned int complete:1; unsigned int dev_registered:1; + +diff --git a/include/sound/tea575x-tuner.h b/include/sound/tea575x-tuner.h +index 0c3c2fb..d9d9990 100644 +--- a/include/sound/tea575x-tuner.h ++++ b/include/sound/tea575x-tuner.h +@@ -44,7 +44,7 @@ struct snd_tea575x_ops { + + struct snd_tea575x { + struct v4l2_device *v4l2_dev; +- struct v4l2_file_operations fops; ++ v4l2_file_operations_no_const fops; + struct video_device vd; /* video device */ + int radio_nr; /* radio_nr */ + bool tea5759; /* 5759 chip is present */ diff --git a/include/sound/ymfpci.h b/include/sound/ymfpci.h index 4119966..1a4671c 100644 --- a/include/sound/ymfpci.h @@ -64424,10 +64839,10 @@ index 4119966..1a4671c 100644 const struct firmware *dsp_microcode; const struct firmware *controller_microcode; diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index aaccc5f..092d568 100644 +index dc35d86..4725f45 100644 --- a/include/target/target_core_base.h +++ b/include/target/target_core_base.h -@@ -447,7 +447,7 @@ struct t10_reservation_ops { +@@ -440,7 +440,7 @@ struct t10_reservation_ops { int (*t10_seq_non_holder)(struct se_cmd *, unsigned char *, u32); int (*t10_pr_register)(struct se_cmd *); int (*t10_pr_clear)(struct se_cmd *); @@ -64436,16 +64851,7 @@ index aaccc5f..092d568 100644 struct t10_reservation { /* Reservation effects all target ports */ -@@ -576,7 +576,7 @@ struct se_cmd { - atomic_t t_se_count; - atomic_t t_task_cdbs_left; - atomic_t t_task_cdbs_ex_left; -- atomic_t t_task_cdbs_sent; -+ atomic_unchecked_t t_task_cdbs_sent; - unsigned int transport_state; - #define CMD_T_ABORTED (1 << 0) - #define CMD_T_ACTIVE (1 << 1) -@@ -802,7 +802,7 @@ struct se_device { +@@ -779,7 +779,7 @@ struct se_device { spinlock_t stats_lock; /* Active commands on this virtual SE device */ atomic_t simple_cmds; @@ -64567,10 +64973,10 @@ index 0993a22..32ba2fe 100644 void *pmi_pal; u8 *vbe_state_orig; /* diff --git a/init/Kconfig b/init/Kconfig -index 6cfd71d..16006e6 100644 +index d07dcf9..fa47d0e 100644 --- a/init/Kconfig +++ b/init/Kconfig -@@ -790,6 +790,7 @@ endif # CGROUPS +@@ -835,6 +835,7 @@ endif # CGROUPS config CHECKPOINT_RESTORE bool "Checkpoint/restore support" if EXPERT @@ -64578,7 +64984,15 @@ index 6cfd71d..16006e6 100644 default n help Enables additional kernel features in a sake of checkpoint/restore. -@@ -1240,7 +1241,7 @@ config SLUB_DEBUG +@@ -1014,6 +1015,7 @@ config UIDGID_CONVERTED + # Security modules + depends on SECURITY_TOMOYO = n + depends on SECURITY_APPARMOR = n ++ depends on GRKERNSEC = n + + config UIDGID_STRICT_TYPE_CHECKS + bool "Require conversions between uid/gids and their internal representation" +@@ -1401,7 +1403,7 @@ config SLUB_DEBUG config COMPAT_BRK bool "Disable heap randomization" @@ -64587,7 +65001,7 @@ index 6cfd71d..16006e6 100644 help Randomizing heap placement makes heap exploits harder, but it also breaks ancient binaries (including anything libc5 based). -@@ -1423,7 +1424,7 @@ config INIT_ALL_POSSIBLE +@@ -1584,7 +1586,7 @@ config INIT_ALL_POSSIBLE config STOP_MACHINE bool default y @@ -64597,10 +65011,10 @@ index 6cfd71d..16006e6 100644 Need stop_machine() primitive. diff --git a/init/do_mounts.c b/init/do_mounts.c -index 42b0707..c06eef4 100644 +index d3f0aee..c9322f5 100644 --- a/init/do_mounts.c +++ b/init/do_mounts.c -@@ -326,11 +326,11 @@ static void __init get_fs_names(char *page) +@@ -336,11 +336,11 @@ static void __init get_fs_names(char *page) static int __init do_mount_root(char *name, char *fs, int flags, void *data) { struct super_block *s; @@ -64609,12 +65023,12 @@ index 42b0707..c06eef4 100644 if (err) return err; -- sys_chdir((const char __user __force *)"/root"); +- sys_chdir("/root"); + sys_chdir((const char __force_user *)"/root"); s = current->fs->pwd.dentry->d_sb; ROOT_DEV = s->s_dev; printk(KERN_INFO -@@ -450,18 +450,18 @@ void __init change_floppy(char *fmt, ...) +@@ -460,18 +460,18 @@ void __init change_floppy(char *fmt, ...) va_start(args, fmt); vsprintf(buf, fmt, args); va_end(args); @@ -64636,12 +65050,12 @@ index 42b0707..c06eef4 100644 termios.c_lflag |= ICANON; sys_ioctl(fd, TCSETSF, (long)&termios); sys_close(fd); -@@ -555,6 +555,6 @@ void __init prepare_namespace(void) +@@ -565,6 +565,6 @@ void __init prepare_namespace(void) mount_root(); out: devtmpfs_mount("dev"); - sys_mount(".", "/", NULL, MS_MOVE, NULL); -- sys_chroot((const char __user __force *)"."); +- sys_chroot("."); + sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL); + sys_chroot((const char __force_user *)"."); } @@ -64678,10 +65092,10 @@ index f5b978a..69dbfe8 100644 if (!S_ISBLK(stat.st_mode)) return 0; diff --git a/init/do_mounts_initrd.c b/init/do_mounts_initrd.c -index 9047330..de0d1fb 100644 +index 135959a2..28a3f43 100644 --- a/init/do_mounts_initrd.c +++ b/init/do_mounts_initrd.c -@@ -43,13 +43,13 @@ static void __init handle_initrd(void) +@@ -53,13 +53,13 @@ static void __init handle_initrd(void) create_dev("/dev/root.old", Root_RAM0); /* mount initrd on rootfs' /root */ mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY); @@ -64701,7 +65115,7 @@ index 9047330..de0d1fb 100644 /* * In case that a resume from disk is carried out by linuxrc or one of -@@ -66,15 +66,15 @@ static void __init handle_initrd(void) +@@ -76,15 +76,15 @@ static void __init handle_initrd(void) /* move initrd to rootfs' /old */ sys_fchdir(old_fd); @@ -64720,7 +65134,7 @@ index 9047330..de0d1fb 100644 return; } -@@ -82,17 +82,17 @@ static void __init handle_initrd(void) +@@ -92,17 +92,17 @@ static void __init handle_initrd(void) mount_root(); printk(KERN_NOTICE "Trying to move old root to /initrd ... "); @@ -64741,7 +65155,7 @@ index 9047330..de0d1fb 100644 printk(KERN_NOTICE "Trying to free ramdisk memory ... "); if (fd < 0) { error = fd; -@@ -115,11 +115,11 @@ int __init initrd_load(void) +@@ -125,11 +125,11 @@ int __init initrd_load(void) * mounted in the normal path. */ if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) { @@ -64756,10 +65170,10 @@ index 9047330..de0d1fb 100644 return 0; } diff --git a/init/do_mounts_md.c b/init/do_mounts_md.c -index 32c4799..c27ee74 100644 +index 8cb6db5..d729f50 100644 --- a/init/do_mounts_md.c +++ b/init/do_mounts_md.c -@@ -170,7 +170,7 @@ static void __init md_setup_drive(void) +@@ -180,7 +180,7 @@ static void __init md_setup_drive(void) partitioned ? "_d" : "", minor, md_setup_args[ent].device_names); @@ -64768,7 +65182,7 @@ index 32c4799..c27ee74 100644 if (fd < 0) { printk(KERN_ERR "md: open failed - cannot start " "array %s\n", name); -@@ -233,7 +233,7 @@ static void __init md_setup_drive(void) +@@ -243,7 +243,7 @@ static void __init md_setup_drive(void) * array without it */ sys_close(fd); @@ -64777,29 +65191,43 @@ index 32c4799..c27ee74 100644 sys_ioctl(fd, BLKRRPART, 0); } sys_close(fd); -@@ -283,7 +283,7 @@ static void __init autodetect_raid(void) +@@ -293,7 +293,7 @@ static void __init autodetect_raid(void) wait_for_device_probe(); -- fd = sys_open((const char __user __force *) "/dev/md0", 0, 0); +- fd = sys_open("/dev/md0", 0, 0); + fd = sys_open((const char __force_user *) "/dev/md0", 0, 0); if (fd >= 0) { sys_ioctl(fd, RAID_AUTORUN, raid_autopart); sys_close(fd); +diff --git a/init/init_task.c b/init/init_task.c +index 8b2f399..f0797c9 100644 +--- a/init/init_task.c ++++ b/init/init_task.c +@@ -20,5 +20,9 @@ EXPORT_SYMBOL(init_task); + * Initial thread structure. Alignment of this is handled by a special + * linker map entry. + */ ++#ifdef CONFIG_X86 ++union thread_union init_thread_union __init_task_data; ++#else + union thread_union init_thread_union __init_task_data = + { INIT_THREAD_INFO(init_task) }; ++#endif diff --git a/init/initramfs.c b/init/initramfs.c -index 8216c30..25e8e32 100644 +index 84c6bf1..8899338 100644 --- a/init/initramfs.c +++ b/init/initramfs.c -@@ -74,7 +74,7 @@ static void __init free_hash(void) +@@ -84,7 +84,7 @@ static void __init free_hash(void) } } --static long __init do_utime(char __user *filename, time_t mtime) -+static long __init do_utime(__force char __user *filename, time_t mtime) +-static long __init do_utime(char *filename, time_t mtime) ++static long __init do_utime(char __force_user *filename, time_t mtime) { struct timespec t[2]; -@@ -109,7 +109,7 @@ static void __init dir_utime(void) +@@ -119,7 +119,7 @@ static void __init dir_utime(void) struct dir_entry *de, *tmp; list_for_each_entry_safe(de, tmp, &dir_list, list) { list_del(&de->list); @@ -64808,7 +65236,7 @@ index 8216c30..25e8e32 100644 kfree(de->name); kfree(de); } -@@ -271,7 +271,7 @@ static int __init maybe_link(void) +@@ -281,7 +281,7 @@ static int __init maybe_link(void) if (nlink >= 2) { char *old = find_link(major, minor, ino, mode, collected); if (old) @@ -64817,7 +65245,7 @@ index 8216c30..25e8e32 100644 } return 0; } -@@ -280,11 +280,11 @@ static void __init clean_path(char *path, umode_t mode) +@@ -290,11 +290,11 @@ static void __init clean_path(char *path, umode_t mode) { struct stat st; @@ -64832,7 +65260,7 @@ index 8216c30..25e8e32 100644 } } -@@ -305,7 +305,7 @@ static int __init do_name(void) +@@ -315,7 +315,7 @@ static int __init do_name(void) int openflags = O_WRONLY|O_CREAT; if (ml != 1) openflags |= O_TRUNC; @@ -64841,7 +65269,7 @@ index 8216c30..25e8e32 100644 if (wfd >= 0) { sys_fchown(wfd, uid, gid); -@@ -317,17 +317,17 @@ static int __init do_name(void) +@@ -327,17 +327,17 @@ static int __init do_name(void) } } } else if (S_ISDIR(mode)) { @@ -64866,7 +65294,7 @@ index 8216c30..25e8e32 100644 } } return 0; -@@ -336,15 +336,15 @@ static int __init do_name(void) +@@ -346,15 +346,15 @@ static int __init do_name(void) static int __init do_copy(void) { if (count >= body_len) { @@ -64885,7 +65313,7 @@ index 8216c30..25e8e32 100644 body_len -= count; eat(count); return 1; -@@ -355,9 +355,9 @@ static int __init do_symlink(void) +@@ -365,9 +365,9 @@ static int __init do_symlink(void) { collected[N_ALIGN(name_len) + body_len] = '\0'; clean_path(collected, 0); @@ -64899,7 +65327,7 @@ index 8216c30..25e8e32 100644 next_state = Reset; return 0; diff --git a/init/main.c b/init/main.c -index b08c5f7..bf65a52 100644 +index b5cc0a7..5605c91 100644 --- a/init/main.c +++ b/init/main.c @@ -95,6 +95,8 @@ static inline void mark_rodata_ro(void) { } @@ -64991,7 +65419,7 @@ index b08c5f7..bf65a52 100644 return ret; @@ -747,8 +793,14 @@ static void __init do_initcall_level(int level) level, level, - repair_env_string); + &repair_env_string); - for (fn = initcall_levels[level]; fn < initcall_levels[level+1]; fn++) + for (fn = initcall_levels[level]; fn < initcall_levels[level+1]; fn++) { @@ -65046,12 +65474,12 @@ index b08c5f7..bf65a52 100644 * Ok, we have completed the initial bootup, and * we're essentially up and running. Get rid of the diff --git a/ipc/mqueue.c b/ipc/mqueue.c -index 28bd64d..c66b72a 100644 +index 8ce5769..4666884 100644 --- a/ipc/mqueue.c +++ b/ipc/mqueue.c -@@ -156,6 +156,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb, - mq_bytes = (mq_msg_tblsz + - (info->attr.mq_maxmsg * info->attr.mq_msgsize)); +@@ -279,6 +279,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb, + mq_bytes = mq_treesize + (info->attr.mq_maxmsg * + info->attr.mq_msgsize); + gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1); spin_lock(&mq_lock); @@ -65119,7 +65547,7 @@ index 5215a81..cfc0cac 100644 sem_params.flg = semflg; sem_params.u.nsems = nsems; diff --git a/ipc/shm.c b/ipc/shm.c -index 406c5b2..bc66d67 100644 +index 41c1285..cf6404c 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp); @@ -65137,7 +65565,7 @@ index 406c5b2..bc66d67 100644 void shm_init_ns(struct ipc_namespace *ns) { ns->shm_ctlmax = SHMMAX; -@@ -508,6 +516,14 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) +@@ -520,6 +528,14 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) shp->shm_lprid = 0; shp->shm_atim = shp->shm_dtim = 0; shp->shm_ctim = get_seconds(); @@ -65152,7 +65580,7 @@ index 406c5b2..bc66d67 100644 shp->shm_segsz = size; shp->shm_nattch = 0; shp->shm_file = file; -@@ -559,18 +575,19 @@ static inline int shm_more_checks(struct kern_ipc_perm *ipcp, +@@ -571,18 +587,19 @@ static inline int shm_more_checks(struct kern_ipc_perm *ipcp, return 0; } @@ -65177,7 +65605,7 @@ index 406c5b2..bc66d67 100644 shm_params.key = key; shm_params.flg = shmflg; shm_params.u.size = size; -@@ -988,6 +1005,12 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr) +@@ -1000,6 +1017,12 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr) f_mode = FMODE_READ | FMODE_WRITE; } if (shmflg & SHM_EXEC) { @@ -65190,7 +65618,7 @@ index 406c5b2..bc66d67 100644 prot |= PROT_EXEC; acc_mode |= S_IXUGO; } -@@ -1011,9 +1034,21 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr) +@@ -1023,9 +1046,21 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr) if (err) goto out_unlock; @@ -65266,10 +65694,10 @@ index 1c7f2c6..9ba5359 100644 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0, &status_set, sizeof(status_set)); diff --git a/kernel/auditsc.c b/kernel/auditsc.c -index af1de0f..06dfe57 100644 +index 4b96415..d8c16ee 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c -@@ -2288,7 +2288,7 @@ int auditsc_get_stamp(struct audit_context *ctx, +@@ -2289,7 +2289,7 @@ int auditsc_get_stamp(struct audit_context *ctx, } /* global counter which is incremented every time something logs in */ @@ -65278,7 +65706,7 @@ index af1de0f..06dfe57 100644 /** * audit_set_loginuid - set current task's audit_context loginuid -@@ -2312,7 +2312,7 @@ int audit_set_loginuid(uid_t loginuid) +@@ -2313,7 +2313,7 @@ int audit_set_loginuid(uid_t loginuid) return -EPERM; #endif /* CONFIG_AUDIT_LOGINUID_IMMUTABLE */ @@ -65288,7 +65716,7 @@ index af1de0f..06dfe57 100644 struct audit_buffer *ab; diff --git a/kernel/capability.c b/kernel/capability.c -index 3f1adb6..c564db0 100644 +index 493d972..ea17248 100644 --- a/kernel/capability.c +++ b/kernel/capability.c @@ -202,6 +202,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr) @@ -65372,8 +65800,19 @@ index 3f1adb6..c564db0 100644 /** * nsown_capable - Check superior capability to one's own user_ns * @cap: The capability in question +@@ -440,3 +465,10 @@ bool inode_capable(const struct inode *inode, int cap) + + return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid); + } ++ ++bool inode_capable_nolog(const struct inode *inode, int cap) ++{ ++ struct user_namespace *ns = current_user_ns(); ++ ++ return ns_capable_nolog(ns, cap) && kuid_has_mapping(ns, inode->i_uid); ++} diff --git a/kernel/compat.c b/kernel/compat.c -index d2c67aa..a629b2e 100644 +index c28a306..b4d0cf3 100644 --- a/kernel/compat.c +++ b/kernel/compat.c @@ -13,6 +13,7 @@ @@ -65555,26 +65994,27 @@ index 42e8fa0..9e7406b 100644 return -ENOMEM; diff --git a/kernel/cred.c b/kernel/cred.c -index e70683d..27761b6 100644 +index de728ac..e3c267c 100644 --- a/kernel/cred.c +++ b/kernel/cred.c -@@ -205,6 +205,15 @@ void exit_creds(struct task_struct *tsk) - validate_creds(cred); - put_cred(cred); - } +@@ -207,6 +207,16 @@ void exit_creds(struct task_struct *tsk) + validate_creds(cred); + alter_cred_subscribers(cred, -1); + put_cred(cred); + +#ifdef CONFIG_GRKERNSEC_SETXID + cred = (struct cred *) tsk->delayed_cred; -+ if (cred) { ++ if (cred != NULL) { + tsk->delayed_cred = NULL; + validate_creds(cred); ++ alter_cred_subscribers(cred, -1); + put_cred(cred); + } +#endif } /** -@@ -473,7 +482,7 @@ error_put: +@@ -469,7 +479,7 @@ error_put: * Always returns 0 thus allowing this function to be tail-called at the end * of, say, sys_setgid(). */ @@ -65583,16 +66023,16 @@ index e70683d..27761b6 100644 { struct task_struct *task = current; const struct cred *old = task->real_cred; -@@ -492,6 +501,8 @@ int commit_creds(struct cred *new) +@@ -488,6 +498,8 @@ int commit_creds(struct cred *new) get_cred(new); /* we will require a ref for the subj creds too */ + gr_set_role_label(task, new->uid, new->gid); + /* dumpability changes */ - if (old->euid != new->euid || - old->egid != new->egid || -@@ -541,6 +552,101 @@ int commit_creds(struct cred *new) + if (!uid_eq(old->euid, new->euid) || + !gid_eq(old->egid, new->egid) || +@@ -537,6 +549,101 @@ int commit_creds(struct cred *new) put_cred(old); return 0; } @@ -65759,10 +66199,10 @@ index 0557f24..1a00d9a 100644 } EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint); diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c -index 67b847d..93834dd 100644 +index 1f91413..362a0a1 100644 --- a/kernel/debug/kdb/kdb_main.c +++ b/kernel/debug/kdb/kdb_main.c -@@ -1983,7 +1983,7 @@ static int kdb_lsmod(int argc, const char **argv) +@@ -1984,7 +1984,7 @@ static int kdb_lsmod(int argc, const char **argv) list_for_each_entry(mod, kdb_modules, list) { kdb_printf("%-20s%8u 0x%p ", mod->name, @@ -65771,7 +66211,7 @@ index 67b847d..93834dd 100644 #ifdef CONFIG_MODULE_UNLOAD kdb_printf("%4ld ", module_refcount(mod)); #endif -@@ -1993,7 +1993,7 @@ static int kdb_lsmod(int argc, const char **argv) +@@ -1994,7 +1994,7 @@ static int kdb_lsmod(int argc, const char **argv) kdb_printf(" (Loading)"); else kdb_printf(" (Live)"); @@ -65781,7 +66221,7 @@ index 67b847d..93834dd 100644 #ifdef CONFIG_MODULE_UNLOAD { diff --git a/kernel/events/core.c b/kernel/events/core.c -index fd126f8..70b755b 100644 +index d7d71d6..f54b76f 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -181,7 +181,7 @@ int perf_proc_update_handler(struct ctl_table *table, int write, @@ -65793,7 +66233,7 @@ index fd126f8..70b755b 100644 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx, enum event_type_t event_type); -@@ -2659,7 +2659,7 @@ static void __perf_event_read(void *info) +@@ -2663,7 +2663,7 @@ static void __perf_event_read(void *info) static inline u64 perf_event_count(struct perf_event *event) { @@ -65802,7 +66242,7 @@ index fd126f8..70b755b 100644 } static u64 perf_event_read(struct perf_event *event) -@@ -2983,9 +2983,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running) +@@ -2987,9 +2987,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running) mutex_lock(&event->child_mutex); total += perf_event_read(event); *enabled += event->total_time_enabled + @@ -65814,7 +66254,7 @@ index fd126f8..70b755b 100644 list_for_each_entry(child, &event->child_list, child_list) { total += perf_event_read(child); -@@ -3393,10 +3393,10 @@ void perf_event_update_userpage(struct perf_event *event) +@@ -3396,10 +3396,10 @@ void perf_event_update_userpage(struct perf_event *event) userpg->offset -= local64_read(&event->hw.prev_count); userpg->time_enabled = enabled + @@ -65827,7 +66267,7 @@ index fd126f8..70b755b 100644 arch_perf_update_userpage(userpg, now); -@@ -3829,11 +3829,11 @@ static void perf_output_read_one(struct perf_output_handle *handle, +@@ -3832,11 +3832,11 @@ static void perf_output_read_one(struct perf_output_handle *handle, values[n++] = perf_event_count(event); if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) { values[n++] = enabled + @@ -65841,7 +66281,7 @@ index fd126f8..70b755b 100644 } if (read_format & PERF_FORMAT_ID) values[n++] = primary_event_id(event); -@@ -4511,12 +4511,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event) +@@ -4514,12 +4514,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event) * need to add enough zero bytes after the string to handle * the 64bit alignment we do later. */ @@ -65856,7 +66296,7 @@ index fd126f8..70b755b 100644 if (IS_ERR(name)) { name = strncpy(tmp, "//toolong", sizeof(tmp)); goto got_name; -@@ -5929,7 +5929,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, +@@ -5931,7 +5931,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, event->parent = parent_event; event->ns = get_pid_ns(current->nsproxy->pid_ns); @@ -65865,7 +66305,7 @@ index fd126f8..70b755b 100644 event->state = PERF_EVENT_STATE_INACTIVE; -@@ -6491,10 +6491,10 @@ static void sync_child_event(struct perf_event *child_event, +@@ -6493,10 +6493,10 @@ static void sync_child_event(struct perf_event *child_event, /* * Add back the child's count to the parent's count: */ @@ -65880,7 +66320,7 @@ index fd126f8..70b755b 100644 /* diff --git a/kernel/exit.c b/kernel/exit.c -index 9d81012..d7911f1 100644 +index 2f59cc3..ce5b167 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -59,6 +59,10 @@ @@ -65894,7 +66334,7 @@ index 9d81012..d7911f1 100644 static void exit_mm(struct task_struct * tsk); static void __unhash_process(struct task_struct *p, bool group_dead) -@@ -170,6 +174,10 @@ void release_task(struct task_struct * p) +@@ -182,6 +186,10 @@ void release_task(struct task_struct * p) struct task_struct *leader; int zap_leader; repeat: @@ -65905,7 +66345,7 @@ index 9d81012..d7911f1 100644 /* don't need to get the RCU readlock here - the process is dead and * can't be modifying its own credentials. But shut RCU-lockdep up */ rcu_read_lock(); -@@ -382,7 +390,7 @@ int allow_signal(int sig) +@@ -394,7 +402,7 @@ int allow_signal(int sig) * know it'll be handled, so that they don't get converted to * SIGKILL or just silently dropped. */ @@ -65914,7 +66354,7 @@ index 9d81012..d7911f1 100644 recalc_sigpending(); spin_unlock_irq(¤t->sighand->siglock); return 0; -@@ -418,6 +426,17 @@ void daemonize(const char *name, ...) +@@ -430,6 +438,17 @@ void daemonize(const char *name, ...) vsnprintf(current->comm, sizeof(current->comm), name, args); va_end(args); @@ -65932,7 +66372,7 @@ index 9d81012..d7911f1 100644 /* * If we were started as result of loading a module, close all of the * user space pages. We don't need them, and if we didn't close them -@@ -901,6 +920,8 @@ void do_exit(long code) +@@ -907,6 +926,8 @@ void do_exit(long code) struct task_struct *tsk = current; int group_dead; @@ -65941,7 +66381,7 @@ index 9d81012..d7911f1 100644 profile_task_exit(tsk); WARN_ON(blk_needs_flush_plug(tsk)); -@@ -917,7 +938,6 @@ void do_exit(long code) +@@ -923,7 +944,6 @@ void do_exit(long code) * mm_release()->clear_child_tid() from writing to a user-controlled * kernel address. */ @@ -65949,7 +66389,7 @@ index 9d81012..d7911f1 100644 ptrace_event(PTRACE_EVENT_EXIT, code); -@@ -978,6 +998,9 @@ void do_exit(long code) +@@ -985,6 +1005,9 @@ void do_exit(long code) tsk->exit_code = code; taskstats_exit(tsk, group_dead); @@ -65959,7 +66399,7 @@ index 9d81012..d7911f1 100644 exit_mm(tsk); if (group_dead) -@@ -1094,7 +1117,7 @@ SYSCALL_DEFINE1(exit, int, error_code) +@@ -1101,7 +1124,7 @@ SYSCALL_DEFINE1(exit, int, error_code) * Take down every thread in the group. This is called by fatal signals * as well as by sys_exit_group (below). */ @@ -65969,30 +66409,10 @@ index 9d81012..d7911f1 100644 { struct signal_struct *sig = current->signal; diff --git a/kernel/fork.c b/kernel/fork.c -index 8163333..aee97f3 100644 +index f00e319..c212fbc 100644 --- a/kernel/fork.c +++ b/kernel/fork.c -@@ -274,19 +274,24 @@ static struct task_struct *dup_task_struct(struct task_struct *orig) - } - - err = arch_dup_task_struct(tsk, orig); -- if (err) -- goto out; - -+ /* -+ * We defer looking at err, because we will need this setup -+ * for the clean up path to work correctly. -+ */ - tsk->stack = ti; -- - setup_thread_stack(tsk, orig); -+ -+ if (err) -+ goto out; -+ - clear_user_return_notifier(tsk); - clear_tsk_need_resched(tsk); - stackend = end_of_stack(tsk); +@@ -321,7 +321,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig) *stackend = STACK_END_MAGIC; /* for overflow detection */ #ifdef CONFIG_CC_STACKPROTECTOR @@ -66001,7 +66421,7 @@ index 8163333..aee97f3 100644 #endif /* -@@ -310,13 +315,78 @@ out: +@@ -345,13 +345,78 @@ out: } #ifdef CONFIG_MMU @@ -66082,7 +66502,7 @@ index 8163333..aee97f3 100644 down_write(&oldmm->mmap_sem); flush_cache_dup_mm(oldmm); -@@ -328,8 +398,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm) +@@ -363,8 +428,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm) mm->locked_vm = 0; mm->mmap = NULL; mm->mmap_cache = NULL; @@ -66093,7 +66513,7 @@ index 8163333..aee97f3 100644 mm->map_count = 0; cpumask_clear(mm_cpumask(mm)); mm->mm_rb = RB_ROOT; -@@ -345,8 +415,6 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm) +@@ -380,8 +445,6 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm) prev = NULL; for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) { @@ -66102,7 +66522,7 @@ index 8163333..aee97f3 100644 if (mpnt->vm_flags & VM_DONTCOPY) { long pages = vma_pages(mpnt); mm->total_vm -= pages; -@@ -354,54 +422,11 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm) +@@ -389,54 +452,11 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm) -pages); continue; } @@ -66161,9 +66581,13 @@ index 8163333..aee97f3 100644 /* * Link in the new vma and copy the page table entries. -@@ -424,6 +449,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm) +@@ -459,9 +479,34 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm) if (retval) goto out; + +- if (file && uprobe_mmap(tmp)) ++ if (tmp->vm_file && uprobe_mmap(tmp)) + goto out; } + +#ifdef CONFIG_PAX_SEGMEXEC @@ -66193,7 +66617,7 @@ index 8163333..aee97f3 100644 /* a new mm has just been created */ arch_dup_mmap(oldmm, mm); retval = 0; -@@ -432,14 +482,6 @@ out: +@@ -470,14 +515,6 @@ out: flush_tlb_mm(oldmm); up_write(&oldmm->mmap_sem); return retval; @@ -66208,7 +66632,7 @@ index 8163333..aee97f3 100644 } static inline int mm_alloc_pgd(struct mm_struct *mm) -@@ -676,8 +718,8 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode) +@@ -714,8 +751,8 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode) return ERR_PTR(err); mm = get_task_mm(task); @@ -66219,7 +66643,7 @@ index 8163333..aee97f3 100644 mmput(mm); mm = ERR_PTR(-EACCES); } -@@ -899,13 +941,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk) +@@ -936,13 +973,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk) spin_unlock(&fs->lock); return -EAGAIN; } @@ -66235,7 +66659,7 @@ index 8163333..aee97f3 100644 return 0; } -@@ -1172,6 +1215,9 @@ static struct task_struct *copy_process(unsigned long clone_flags, +@@ -1209,6 +1247,9 @@ static struct task_struct *copy_process(unsigned long clone_flags, DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled); #endif retval = -EAGAIN; @@ -66245,7 +66669,7 @@ index 8163333..aee97f3 100644 if (atomic_read(&p->real_cred->user->processes) >= task_rlimit(p, RLIMIT_NPROC)) { if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) && -@@ -1392,6 +1438,9 @@ static struct task_struct *copy_process(unsigned long clone_flags, +@@ -1431,6 +1472,9 @@ static struct task_struct *copy_process(unsigned long clone_flags, /* Need tasklist lock for parent etc handling! */ write_lock_irq(&tasklist_lock); @@ -66255,7 +66679,7 @@ index 8163333..aee97f3 100644 /* CLONE_PARENT re-uses the old parent */ if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) { p->real_parent = current->real_parent; -@@ -1502,6 +1551,8 @@ bad_fork_cleanup_count: +@@ -1541,6 +1585,8 @@ bad_fork_cleanup_count: bad_fork_free: free_task(p); fork_out: @@ -66264,7 +66688,7 @@ index 8163333..aee97f3 100644 return ERR_PTR(retval); } -@@ -1602,6 +1653,8 @@ long do_fork(unsigned long clone_flags, +@@ -1641,6 +1687,8 @@ long do_fork(unsigned long clone_flags, if (clone_flags & CLONE_PARENT_SETTID) put_user(nr, parent_tidptr); @@ -66273,7 +66697,7 @@ index 8163333..aee97f3 100644 if (clone_flags & CLONE_VFORK) { p->vfork_done = &vfork; init_completion(&vfork); -@@ -1700,7 +1753,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp) +@@ -1739,7 +1787,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp) return 0; /* don't need lock here; in the worst case we'll do useless copy */ @@ -66282,7 +66706,7 @@ index 8163333..aee97f3 100644 return 0; *new_fsp = copy_fs_struct(fs); -@@ -1789,7 +1842,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags) +@@ -1828,7 +1876,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags) fs = current->fs; spin_lock(&fs->lock); current->fs = new_fs; @@ -66293,7 +66717,7 @@ index 8163333..aee97f3 100644 else new_fs = fs; diff --git a/kernel/futex.c b/kernel/futex.c -index e2b0fb9..db818ac 100644 +index e2b0fb9..ced552c 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -54,6 +54,7 @@ @@ -66316,7 +66740,43 @@ index e2b0fb9..db818ac 100644 /* * The futex address must be "naturally" aligned. */ -@@ -2711,6 +2717,7 @@ static int __init futex_init(void) +@@ -2231,11 +2237,11 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb, + * @uaddr2: the pi futex we will take prior to returning to user-space + * + * The caller will wait on uaddr and will be requeued by futex_requeue() to +- * uaddr2 which must be PI aware. Normal wakeup will wake on uaddr2 and +- * complete the acquisition of the rt_mutex prior to returning to userspace. +- * This ensures the rt_mutex maintains an owner when it has waiters; without +- * one, the pi logic wouldn't know which task to boost/deboost, if there was a +- * need to. ++ * uaddr2 which must be PI aware and unique from uaddr. Normal wakeup will wake ++ * on uaddr2 and complete the acquisition of the rt_mutex prior to returning to ++ * userspace. This ensures the rt_mutex maintains an owner when it has waiters; ++ * without one, the pi logic would not know which task to boost/deboost, if ++ * there was a need to. + * + * We call schedule in futex_wait_queue_me() when we enqueue and return there + * via the following: +@@ -2272,6 +2278,9 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, + struct futex_q q = futex_q_init; + int res, ret; + ++ if (uaddr == uaddr2) ++ return -EINVAL; ++ + if (!bitset) + return -EINVAL; + +@@ -2370,7 +2379,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, + * fault, unlock the rt_mutex and return the fault to userspace. + */ + if (ret == -EFAULT) { +- if (rt_mutex_owner(pi_mutex) == current) ++ if (pi_mutex && rt_mutex_owner(pi_mutex) == current) + rt_mutex_unlock(pi_mutex); + } else if (ret == -EINTR) { + /* +@@ -2711,6 +2720,7 @@ static int __init futex_init(void) { u32 curval; int i; @@ -66324,7 +66784,7 @@ index e2b0fb9..db818ac 100644 /* * This will fail and we want it. Some arch implementations do -@@ -2722,8 +2729,11 @@ static int __init futex_init(void) +@@ -2722,8 +2732,11 @@ static int __init futex_init(void) * implementation, the non-functional ones will return * -ENOSYS. */ @@ -66410,7 +66870,7 @@ index 4304919..408c4c0 100644 static int diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c -index 079f1d3..4e80e69 100644 +index 2169fee..45c017a 100644 --- a/kernel/kallsyms.c +++ b/kernel/kallsyms.c @@ -11,6 +11,9 @@ @@ -66486,7 +66946,7 @@ index 079f1d3..4e80e69 100644 if (all_var) return is_kernel(addr); -@@ -454,7 +493,6 @@ static unsigned long get_ksymbol_core(struct kallsym_iter *iter) +@@ -470,7 +509,6 @@ static unsigned long get_ksymbol_core(struct kallsym_iter *iter) static void reset_iter(struct kallsym_iter *iter, loff_t new_pos) { @@ -66494,7 +66954,7 @@ index 079f1d3..4e80e69 100644 iter->nameoff = get_symbol_offset(new_pos); iter->pos = new_pos; } -@@ -502,6 +540,11 @@ static int s_show(struct seq_file *m, void *p) +@@ -518,6 +556,11 @@ static int s_show(struct seq_file *m, void *p) { struct kallsym_iter *iter = m->private; @@ -66506,30 +66966,15 @@ index 079f1d3..4e80e69 100644 /* Some debugging symbols have no name. Ignore them. */ if (!iter->name[0]) return 0; -@@ -515,11 +558,22 @@ static int s_show(struct seq_file *m, void *p) +@@ -531,6 +574,7 @@ static int s_show(struct seq_file *m, void *p) */ type = iter->exported ? toupper(iter->type) : tolower(iter->type); + -+#ifdef CONFIG_GRKERNSEC_HIDESYM -+ seq_printf(m, "%pP %c %s\t[%s]\n", (void *)iter->value, -+ type, iter->name, iter->module_name); -+#else seq_printf(m, "%pK %c %s\t[%s]\n", (void *)iter->value, type, iter->name, iter->module_name); -+#endif } else -+#ifdef CONFIG_GRKERNSEC_HIDESYM -+ seq_printf(m, "%pP %c %s\n", (void *)iter->value, -+ iter->type, iter->name); -+#else - seq_printf(m, "%pK %c %s\n", (void *)iter->value, - iter->type, iter->name); -+#endif - return 0; - } - -@@ -540,7 +594,7 @@ static int kallsyms_open(struct inode *inode, struct file *file) +@@ -556,7 +600,7 @@ static int kallsyms_open(struct inode *inode, struct file *file) struct kallsym_iter *iter; int ret; @@ -66553,7 +66998,7 @@ index 4e2e472..cd0c7ae 100644 /* Don't allow clients that don't understand the native diff --git a/kernel/kmod.c b/kernel/kmod.c -index 05698a7..a4c1e3a 100644 +index ff2c7cb..085d7af 100644 --- a/kernel/kmod.c +++ b/kernel/kmod.c @@ -66,7 +66,7 @@ static void free_modprobe_argv(struct subprocess_info *info) @@ -66681,7 +67126,7 @@ index 05698a7..a4c1e3a 100644 EXPORT_SYMBOL(__request_module); #endif /* CONFIG_MODULES */ -@@ -267,7 +320,7 @@ static int wait_for_helper(void *data) +@@ -266,7 +319,7 @@ static int wait_for_helper(void *data) * * Thus the __user pointer cast is valid here. */ @@ -66789,7 +67234,7 @@ index 91c32a0..b2c71c5 100644 if (!name) { diff --git a/kernel/module.c b/kernel/module.c -index 78ac6ec..e87db0e 100644 +index 4edbd9c..165e780 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -58,6 +58,7 @@ @@ -67170,7 +67615,7 @@ index 78ac6ec..e87db0e 100644 mutex_unlock(&module_mutex); } return ret; -@@ -2543,8 +2581,14 @@ static struct module *setup_load_info(struct load_info *info) +@@ -2544,8 +2582,14 @@ static struct module *setup_load_info(struct load_info *info) static int check_modinfo(struct module *mod, struct load_info *info) { const char *modmagic = get_modinfo(info, "vermagic"); @@ -67185,7 +67630,7 @@ index 78ac6ec..e87db0e 100644 /* This is allowed: modprobe --force will invalidate it. */ if (!modmagic) { err = try_to_force_load(mod, "bad vermagic"); -@@ -2567,7 +2611,7 @@ static int check_modinfo(struct module *mod, struct load_info *info) +@@ -2568,7 +2612,7 @@ static int check_modinfo(struct module *mod, struct load_info *info) } /* Set up license info based on the info section */ @@ -67194,7 +67639,7 @@ index 78ac6ec..e87db0e 100644 return 0; } -@@ -2661,7 +2705,7 @@ static int move_module(struct module *mod, struct load_info *info) +@@ -2662,7 +2706,7 @@ static int move_module(struct module *mod, struct load_info *info) void *ptr; /* Do the allocs. */ @@ -67203,7 +67648,7 @@ index 78ac6ec..e87db0e 100644 /* * The pointer to this block is stored in the module structure * which is inside the block. Just mark it as not being a -@@ -2671,23 +2715,50 @@ static int move_module(struct module *mod, struct load_info *info) +@@ -2672,23 +2716,50 @@ static int move_module(struct module *mod, struct load_info *info) if (!ptr) return -ENOMEM; @@ -67262,7 +67707,7 @@ index 78ac6ec..e87db0e 100644 /* Transfer each section which specifies SHF_ALLOC */ pr_debug("final section addresses:\n"); -@@ -2698,16 +2769,45 @@ static int move_module(struct module *mod, struct load_info *info) +@@ -2699,16 +2770,45 @@ static int move_module(struct module *mod, struct load_info *info) if (!(shdr->sh_flags & SHF_ALLOC)) continue; @@ -67315,7 +67760,7 @@ index 78ac6ec..e87db0e 100644 pr_debug("\t0x%lx %s\n", (long)shdr->sh_addr, info->secstrings + shdr->sh_name); } -@@ -2758,12 +2858,12 @@ static void flush_module_icache(const struct module *mod) +@@ -2759,12 +2859,12 @@ static void flush_module_icache(const struct module *mod) * Do it before processing of module parameters, so the module * can provide parameter accessor functions of its own. */ @@ -67334,7 +67779,7 @@ index 78ac6ec..e87db0e 100644 set_fs(old_fs); } -@@ -2833,8 +2933,10 @@ out: +@@ -2834,8 +2934,10 @@ out: static void module_deallocate(struct module *mod, struct load_info *info) { percpu_modfree(mod); @@ -67347,7 +67792,17 @@ index 78ac6ec..e87db0e 100644 } int __weak module_finalize(const Elf_Ehdr *hdr, -@@ -2898,9 +3000,38 @@ static struct module *load_module(void __user *umod, +@@ -2848,7 +2950,9 @@ int __weak module_finalize(const Elf_Ehdr *hdr, + static int post_relocation(struct module *mod, const struct load_info *info) + { + /* Sort exception table now relocations are done. */ ++ pax_open_kernel(); + sort_extable(mod->extable, mod->extable + mod->num_exentries); ++ pax_close_kernel(); + + /* Copy relocated percpu area over. */ + percpu_modcopy(mod, (void *)info->sechdrs[info->index.pcpu].sh_addr, +@@ -2899,9 +3003,38 @@ static struct module *load_module(void __user *umod, if (err) goto free_unload; @@ -67386,7 +67841,7 @@ index 78ac6ec..e87db0e 100644 /* Fix up syms, so that st_value is a pointer to location. */ err = simplify_symbols(mod, &info); if (err < 0) -@@ -2916,13 +3047,6 @@ static struct module *load_module(void __user *umod, +@@ -2917,13 +3050,6 @@ static struct module *load_module(void __user *umod, flush_module_icache(mod); @@ -67400,7 +67855,7 @@ index 78ac6ec..e87db0e 100644 /* Mark state as coming so strong_try_module_get() ignores us. */ mod->state = MODULE_STATE_COMING; -@@ -2980,11 +3104,10 @@ static struct module *load_module(void __user *umod, +@@ -2981,11 +3107,10 @@ static struct module *load_module(void __user *umod, unlock: mutex_unlock(&module_mutex); synchronize_sched(); @@ -67413,7 +67868,7 @@ index 78ac6ec..e87db0e 100644 free_unload: module_unload_free(mod); free_module: -@@ -3025,16 +3148,16 @@ SYSCALL_DEFINE3(init_module, void __user *, umod, +@@ -3026,16 +3151,16 @@ SYSCALL_DEFINE3(init_module, void __user *, umod, MODULE_STATE_COMING, mod); /* Set RO and NX regions for core */ @@ -67438,7 +67893,7 @@ index 78ac6ec..e87db0e 100644 do_mod_ctors(mod); /* Start the module */ -@@ -3080,11 +3203,12 @@ SYSCALL_DEFINE3(init_module, void __user *, umod, +@@ -3081,11 +3206,12 @@ SYSCALL_DEFINE3(init_module, void __user *, umod, mod->strtab = mod->core_strtab; #endif unset_module_init_ro_nx(mod); @@ -67456,7 +67911,7 @@ index 78ac6ec..e87db0e 100644 mutex_unlock(&module_mutex); return 0; -@@ -3115,10 +3239,16 @@ static const char *get_ksymbol(struct module *mod, +@@ -3116,10 +3242,16 @@ static const char *get_ksymbol(struct module *mod, unsigned long nextval; /* At worse, next value is at end of module */ @@ -67476,7 +67931,7 @@ index 78ac6ec..e87db0e 100644 /* Scan for closest preceding symbol, and next symbol. (ELF starts real symbols at 1). */ -@@ -3353,7 +3483,7 @@ static int m_show(struct seq_file *m, void *p) +@@ -3354,7 +3486,7 @@ static int m_show(struct seq_file *m, void *p) char buf[8]; seq_printf(m, "%s %u", @@ -67485,7 +67940,7 @@ index 78ac6ec..e87db0e 100644 print_unload_info(m, mod); /* Informative for users. */ -@@ -3362,7 +3492,7 @@ static int m_show(struct seq_file *m, void *p) +@@ -3363,7 +3495,7 @@ static int m_show(struct seq_file *m, void *p) mod->state == MODULE_STATE_COMING ? "Loading": "Live"); /* Used by oprofile and other similar tools. */ @@ -67494,7 +67949,7 @@ index 78ac6ec..e87db0e 100644 /* Taints info */ if (mod->taints) -@@ -3398,7 +3528,17 @@ static const struct file_operations proc_modules_operations = { +@@ -3399,7 +3531,17 @@ static const struct file_operations proc_modules_operations = { static int __init proc_modules_init(void) { @@ -67512,7 +67967,7 @@ index 78ac6ec..e87db0e 100644 return 0; } module_init(proc_modules_init); -@@ -3457,12 +3597,12 @@ struct module *__module_address(unsigned long addr) +@@ -3458,12 +3600,12 @@ struct module *__module_address(unsigned long addr) { struct module *mod; @@ -67528,7 +67983,7 @@ index 78ac6ec..e87db0e 100644 return mod; return NULL; } -@@ -3496,11 +3636,20 @@ bool is_module_text_address(unsigned long addr) +@@ -3497,11 +3639,20 @@ bool is_module_text_address(unsigned long addr) */ struct module *__module_text_address(unsigned long addr) { @@ -67633,7 +68088,7 @@ index a307cc9..27fd2e9 100644 /* set it to 0 if there are no waiters left: */ diff --git a/kernel/panic.c b/kernel/panic.c -index 9ed023b..4846159 100644 +index d2a5f4e..5edc1d9 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -75,6 +75,14 @@ void panic(const char *fmt, ...) @@ -67671,7 +68126,7 @@ index 9ed023b..4846159 100644 } EXPORT_SYMBOL(__stack_chk_fail); diff --git a/kernel/pid.c b/kernel/pid.c -index 9f08dfa..6765c40 100644 +index e86b291a..e8b0fb5 100644 --- a/kernel/pid.c +++ b/kernel/pid.c @@ -33,6 +33,7 @@ @@ -67913,10 +68368,10 @@ index 19db29f..33b52b6 100644 if (pm_wakeup_pending()) { diff --git a/kernel/printk.c b/kernel/printk.c -index b663c2c..1d6ba7a 100644 +index ac4bc9e..1d2db99 100644 --- a/kernel/printk.c +++ b/kernel/printk.c -@@ -316,6 +316,11 @@ static int check_syslog_permissions(int type, bool from_file) +@@ -781,6 +781,11 @@ static int check_syslog_permissions(int type, bool from_file) if (from_file && type != SYSLOG_ACTION_OPEN) return 0; @@ -67990,10 +68445,10 @@ index 76b8e77..a2930e8 100644 } diff --git a/kernel/ptrace.c b/kernel/ptrace.c -index ee8d49b..bd3d790 100644 +index a232bb5..2a65ef9 100644 --- a/kernel/ptrace.c +++ b/kernel/ptrace.c -@@ -280,7 +280,7 @@ static int ptrace_attach(struct task_struct *task, long request, +@@ -279,7 +279,7 @@ static int ptrace_attach(struct task_struct *task, long request, if (seize) flags |= PT_SEIZED; @@ -68002,7 +68457,7 @@ index ee8d49b..bd3d790 100644 flags |= PT_PTRACE_CAP; task->ptrace = flags; -@@ -487,7 +487,7 @@ int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst +@@ -486,7 +486,7 @@ int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst break; return -EIO; } @@ -68011,7 +68466,7 @@ index ee8d49b..bd3d790 100644 return -EFAULT; copied += retval; src += retval; -@@ -672,7 +672,7 @@ int ptrace_request(struct task_struct *child, long request, +@@ -671,7 +671,7 @@ int ptrace_request(struct task_struct *child, long request, bool seized = child->ptrace & PT_SEIZED; int ret = -EIO; siginfo_t siginfo, *si; @@ -68020,7 +68475,7 @@ index ee8d49b..bd3d790 100644 unsigned long __user *datalp = datavp; unsigned long flags; -@@ -874,14 +874,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr, +@@ -873,14 +873,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr, goto out; } @@ -68043,7 +68498,7 @@ index ee8d49b..bd3d790 100644 goto out_put_task_struct; } -@@ -907,7 +914,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr, +@@ -906,7 +913,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr, copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0); if (copied != sizeof(tmp)) return -EIO; @@ -68052,7 +68507,7 @@ index ee8d49b..bd3d790 100644 } int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr, -@@ -1017,14 +1024,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid, +@@ -1016,14 +1023,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid, goto out; } @@ -68098,10 +68553,10 @@ index 37a5444..eec170a 100644 __rcu_process_callbacks(&rcu_sched_ctrlblk); __rcu_process_callbacks(&rcu_bh_ctrlblk); diff --git a/kernel/rcutiny_plugin.h b/kernel/rcutiny_plugin.h -index 22ecea0..3789898 100644 +index fc31a2d..be2ec04 100644 --- a/kernel/rcutiny_plugin.h +++ b/kernel/rcutiny_plugin.h -@@ -955,7 +955,7 @@ static int rcu_kthread(void *arg) +@@ -939,7 +939,7 @@ static int rcu_kthread(void *arg) have_rcu_kthread_work = morework; local_irq_restore(flags); if (work) @@ -68111,10 +68566,10 @@ index 22ecea0..3789898 100644 } diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c -index a89b381..efdcad8 100644 +index e66b34a..4b8b626 100644 --- a/kernel/rcutorture.c +++ b/kernel/rcutorture.c -@@ -158,12 +158,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_count) = +@@ -163,12 +163,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_count) = { 0 }; static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) = { 0 }; @@ -68130,10 +68585,10 @@ index a89b381..efdcad8 100644 +static atomic_unchecked_t n_rcu_torture_free; +static atomic_unchecked_t n_rcu_torture_mberror; +static atomic_unchecked_t n_rcu_torture_error; + static long n_rcu_torture_barrier_error; static long n_rcu_torture_boost_ktrerror; static long n_rcu_torture_boost_rterror; - static long n_rcu_torture_boost_failure; -@@ -253,11 +253,11 @@ rcu_torture_alloc(void) +@@ -265,11 +265,11 @@ rcu_torture_alloc(void) spin_lock_bh(&rcu_torture_lock); if (list_empty(&rcu_torture_freelist)) { @@ -68147,7 +68602,7 @@ index a89b381..efdcad8 100644 p = rcu_torture_freelist.next; list_del_init(p); spin_unlock_bh(&rcu_torture_lock); -@@ -270,7 +270,7 @@ rcu_torture_alloc(void) +@@ -282,7 +282,7 @@ rcu_torture_alloc(void) static void rcu_torture_free(struct rcu_torture *p) { @@ -68156,7 +68611,7 @@ index a89b381..efdcad8 100644 spin_lock_bh(&rcu_torture_lock); list_add_tail(&p->rtort_free, &rcu_torture_freelist); spin_unlock_bh(&rcu_torture_lock); -@@ -390,7 +390,7 @@ rcu_torture_cb(struct rcu_head *p) +@@ -403,7 +403,7 @@ rcu_torture_cb(struct rcu_head *p) i = rp->rtort_pipe_count; if (i > RCU_TORTURE_PIPE_LEN) i = RCU_TORTURE_PIPE_LEN; @@ -68165,7 +68620,7 @@ index a89b381..efdcad8 100644 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) { rp->rtort_mbtest = 0; rcu_torture_free(rp); -@@ -437,7 +437,7 @@ static void rcu_sync_torture_deferred_free(struct rcu_torture *p) +@@ -451,7 +451,7 @@ static void rcu_sync_torture_deferred_free(struct rcu_torture *p) i = rp->rtort_pipe_count; if (i > RCU_TORTURE_PIPE_LEN) i = RCU_TORTURE_PIPE_LEN; @@ -68174,7 +68629,7 @@ index a89b381..efdcad8 100644 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) { rp->rtort_mbtest = 0; list_del(&rp->rtort_free); -@@ -926,7 +926,7 @@ rcu_torture_writer(void *arg) +@@ -983,7 +983,7 @@ rcu_torture_writer(void *arg) i = old_rp->rtort_pipe_count; if (i > RCU_TORTURE_PIPE_LEN) i = RCU_TORTURE_PIPE_LEN; @@ -68183,7 +68638,7 @@ index a89b381..efdcad8 100644 old_rp->rtort_pipe_count++; cur_ops->deferred_free(old_rp); } -@@ -1007,7 +1007,7 @@ static void rcu_torture_timer(unsigned long unused) +@@ -1064,7 +1064,7 @@ static void rcu_torture_timer(unsigned long unused) } do_trace_rcu_torture_read(cur_ops->name, &p->rtort_rcu); if (p->rtort_mbtest == 0) @@ -68192,7 +68647,7 @@ index a89b381..efdcad8 100644 spin_lock(&rand_lock); cur_ops->read_delay(&rand); n_rcu_torture_timers++; -@@ -1071,7 +1071,7 @@ rcu_torture_reader(void *arg) +@@ -1128,7 +1128,7 @@ rcu_torture_reader(void *arg) } do_trace_rcu_torture_read(cur_ops->name, &p->rtort_rcu); if (p->rtort_mbtest == 0) @@ -68201,7 +68656,7 @@ index a89b381..efdcad8 100644 cur_ops->read_delay(&rand); preempt_disable(); pipe_count = p->rtort_pipe_count; -@@ -1133,10 +1133,10 @@ rcu_torture_printk(char *page) +@@ -1191,10 +1191,10 @@ rcu_torture_printk(char *page) rcu_torture_current, rcu_torture_current_version, list_empty(&rcu_torture_freelist), @@ -68216,25 +68671,24 @@ index a89b381..efdcad8 100644 n_rcu_torture_boost_ktrerror, n_rcu_torture_boost_rterror, n_rcu_torture_boost_failure, -@@ -1146,7 +1146,7 @@ rcu_torture_printk(char *page) - n_online_attempts, - n_offline_successes, - n_offline_attempts); +@@ -1208,14 +1208,14 @@ rcu_torture_printk(char *page) + n_barrier_attempts, + n_rcu_torture_barrier_error); + cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG); - if (atomic_read(&n_rcu_torture_mberror) != 0 || + if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 || + n_rcu_torture_barrier_error != 0 || n_rcu_torture_boost_ktrerror != 0 || n_rcu_torture_boost_rterror != 0 || - n_rcu_torture_boost_failure != 0) -@@ -1154,7 +1154,7 @@ rcu_torture_printk(char *page) - cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG); - if (i > 1) { + n_rcu_torture_boost_failure != 0 || + i > 1) { cnt += sprintf(&page[cnt], "!!! "); - atomic_inc(&n_rcu_torture_error); + atomic_inc_unchecked(&n_rcu_torture_error); WARN_ON_ONCE(1); } cnt += sprintf(&page[cnt], "Reader Pipe: "); -@@ -1168,7 +1168,7 @@ rcu_torture_printk(char *page) +@@ -1229,7 +1229,7 @@ rcu_torture_printk(char *page) cnt += sprintf(&page[cnt], "Free-Block Circulation: "); for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) { cnt += sprintf(&page[cnt], " %d", @@ -68243,16 +68697,16 @@ index a89b381..efdcad8 100644 } cnt += sprintf(&page[cnt], "\n"); if (cur_ops->stats) -@@ -1676,7 +1676,7 @@ rcu_torture_cleanup(void) +@@ -1888,7 +1888,7 @@ rcu_torture_cleanup(void) if (cur_ops->cleanup) cur_ops->cleanup(); -- if (atomic_read(&n_rcu_torture_error)) -+ if (atomic_read_unchecked(&n_rcu_torture_error)) +- if (atomic_read(&n_rcu_torture_error) || n_rcu_torture_barrier_error) ++ if (atomic_read_unchecked(&n_rcu_torture_error) || n_rcu_torture_barrier_error) rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE"); else if (n_online_successes != n_online_attempts || n_offline_successes != n_offline_attempts) -@@ -1744,17 +1744,17 @@ rcu_torture_init(void) +@@ -1958,18 +1958,18 @@ rcu_torture_init(void) rcu_torture_current = NULL; rcu_torture_current_version = 0; @@ -68266,6 +68720,7 @@ index a89b381..efdcad8 100644 + atomic_set_unchecked(&n_rcu_torture_free, 0); + atomic_set_unchecked(&n_rcu_torture_mberror, 0); + atomic_set_unchecked(&n_rcu_torture_error, 0); + n_rcu_torture_barrier_error = 0; n_rcu_torture_boost_ktrerror = 0; n_rcu_torture_boost_rterror = 0; n_rcu_torture_boost_failure = 0; @@ -68277,10 +68732,10 @@ index a89b381..efdcad8 100644 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) { per_cpu(rcu_torture_count, cpu)[i] = 0; diff --git a/kernel/rcutree.c b/kernel/rcutree.c -index d0c5baf..109b2e7 100644 +index 4b97bba..b92c9d2 100644 --- a/kernel/rcutree.c +++ b/kernel/rcutree.c -@@ -357,9 +357,9 @@ static void rcu_idle_enter_common(struct rcu_dynticks *rdtp, long long oldval) +@@ -366,9 +366,9 @@ static void rcu_idle_enter_common(struct rcu_dynticks *rdtp, long long oldval) rcu_prepare_for_idle(smp_processor_id()); /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */ smp_mb__before_atomic_inc(); /* See above. */ @@ -68292,7 +68747,7 @@ index d0c5baf..109b2e7 100644 /* * The idle task is not permitted to enter the idle loop while -@@ -448,10 +448,10 @@ void rcu_irq_exit(void) +@@ -457,10 +457,10 @@ void rcu_irq_exit(void) static void rcu_idle_exit_common(struct rcu_dynticks *rdtp, long long oldval) { smp_mb__before_atomic_inc(); /* Force ordering w/previous sojourn. */ @@ -68305,7 +68760,7 @@ index d0c5baf..109b2e7 100644 rcu_cleanup_after_idle(smp_processor_id()); trace_rcu_dyntick("End", oldval, rdtp->dynticks_nesting); if (!is_idle_task(current)) { -@@ -545,14 +545,14 @@ void rcu_nmi_enter(void) +@@ -554,14 +554,14 @@ void rcu_nmi_enter(void) struct rcu_dynticks *rdtp = &__get_cpu_var(rcu_dynticks); if (rdtp->dynticks_nmi_nesting == 0 && @@ -68323,7 +68778,7 @@ index d0c5baf..109b2e7 100644 } /** -@@ -571,9 +571,9 @@ void rcu_nmi_exit(void) +@@ -580,9 +580,9 @@ void rcu_nmi_exit(void) return; /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */ smp_mb__before_atomic_inc(); /* See above. */ @@ -68335,7 +68790,7 @@ index d0c5baf..109b2e7 100644 } #ifdef CONFIG_PROVE_RCU -@@ -589,7 +589,7 @@ int rcu_is_cpu_idle(void) +@@ -598,7 +598,7 @@ int rcu_is_cpu_idle(void) int ret; preempt_disable(); @@ -68344,7 +68799,7 @@ index d0c5baf..109b2e7 100644 preempt_enable(); return ret; } -@@ -659,7 +659,7 @@ int rcu_is_cpu_rrupt_from_idle(void) +@@ -668,7 +668,7 @@ int rcu_is_cpu_rrupt_from_idle(void) */ static int dyntick_save_progress_counter(struct rcu_data *rdp) { @@ -68353,7 +68808,7 @@ index d0c5baf..109b2e7 100644 return (rdp->dynticks_snap & 0x1) == 0; } -@@ -674,7 +674,7 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp) +@@ -683,7 +683,7 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp) unsigned int curr; unsigned int snap; @@ -68362,7 +68817,7 @@ index d0c5baf..109b2e7 100644 snap = (unsigned int)rdp->dynticks_snap; /* -@@ -704,10 +704,10 @@ static int jiffies_till_stall_check(void) +@@ -713,10 +713,10 @@ static int jiffies_till_stall_check(void) * for CONFIG_RCU_CPU_STALL_TIMEOUT. */ if (till_stall_check < 3) { @@ -68375,7 +68830,7 @@ index d0c5baf..109b2e7 100644 till_stall_check = 300; } return till_stall_check * HZ + RCU_STALL_DELAY_DELTA; -@@ -1766,7 +1766,7 @@ __rcu_process_callbacks(struct rcu_state *rsp, struct rcu_data *rdp) +@@ -1824,7 +1824,7 @@ __rcu_process_callbacks(struct rcu_state *rsp, struct rcu_data *rdp) /* * Do RCU core processing for the current CPU. */ @@ -68384,7 +68839,7 @@ index d0c5baf..109b2e7 100644 { trace_rcu_utilization("Start RCU core"); __rcu_process_callbacks(&rcu_sched_state, -@@ -1949,8 +1949,8 @@ void synchronize_rcu_bh(void) +@@ -2042,8 +2042,8 @@ void synchronize_rcu_bh(void) } EXPORT_SYMBOL_GPL(synchronize_rcu_bh); @@ -68395,7 +68850,7 @@ index d0c5baf..109b2e7 100644 static int synchronize_sched_expedited_cpu_stop(void *data) { -@@ -2011,7 +2011,7 @@ void synchronize_sched_expedited(void) +@@ -2104,7 +2104,7 @@ void synchronize_sched_expedited(void) int firstsnap, s, snap, trycount = 0; /* Note that atomic_inc_return() implies full memory barrier. */ @@ -68404,7 +68859,7 @@ index d0c5baf..109b2e7 100644 get_online_cpus(); WARN_ON_ONCE(cpu_is_offline(raw_smp_processor_id())); -@@ -2033,7 +2033,7 @@ void synchronize_sched_expedited(void) +@@ -2126,7 +2126,7 @@ void synchronize_sched_expedited(void) } /* Check to see if someone else did our work for us. */ @@ -68413,7 +68868,7 @@ index d0c5baf..109b2e7 100644 if (UINT_CMP_GE((unsigned)s, (unsigned)firstsnap)) { smp_mb(); /* ensure test happens before caller kfree */ return; -@@ -2048,7 +2048,7 @@ void synchronize_sched_expedited(void) +@@ -2141,7 +2141,7 @@ void synchronize_sched_expedited(void) * grace period works for us. */ get_online_cpus(); @@ -68422,7 +68877,7 @@ index d0c5baf..109b2e7 100644 smp_mb(); /* ensure read is before try_stop_cpus(). */ } -@@ -2059,12 +2059,12 @@ void synchronize_sched_expedited(void) +@@ -2152,12 +2152,12 @@ void synchronize_sched_expedited(void) * than we did beat us to the punch. */ do { @@ -68437,7 +68892,7 @@ index d0c5baf..109b2e7 100644 put_online_cpus(); } -@@ -2262,7 +2262,7 @@ rcu_boot_init_percpu_data(int cpu, struct rcu_state *rsp) +@@ -2421,7 +2421,7 @@ rcu_boot_init_percpu_data(int cpu, struct rcu_state *rsp) rdp->qlen = 0; rdp->dynticks = &per_cpu(rcu_dynticks, cpu); WARN_ON_ONCE(rdp->dynticks->dynticks_nesting != DYNTICK_TASK_EXIT_IDLE); @@ -68446,7 +68901,7 @@ index d0c5baf..109b2e7 100644 rdp->cpu = cpu; rdp->rsp = rsp; raw_spin_unlock_irqrestore(&rnp->lock, flags); -@@ -2290,8 +2290,8 @@ rcu_init_percpu_data(int cpu, struct rcu_state *rsp, int preemptible) +@@ -2449,8 +2449,8 @@ rcu_init_percpu_data(int cpu, struct rcu_state *rsp, int preemptible) rdp->n_force_qs_snap = rsp->n_force_qs; rdp->blimit = blimit; rdp->dynticks->dynticks_nesting = DYNTICK_TASK_EXIT_IDLE; @@ -68458,20 +68913,20 @@ index d0c5baf..109b2e7 100644 raw_spin_unlock(&rnp->lock); /* irqs remain disabled. */ diff --git a/kernel/rcutree.h b/kernel/rcutree.h -index cdd1be0..5b2efb4 100644 +index 19b61ac..5c60a94 100644 --- a/kernel/rcutree.h +++ b/kernel/rcutree.h -@@ -87,7 +87,7 @@ struct rcu_dynticks { +@@ -83,7 +83,7 @@ struct rcu_dynticks { long long dynticks_nesting; /* Track irq/process nesting level. */ /* Process level is worth LLONG_MAX/2. */ int dynticks_nmi_nesting; /* Track NMI nesting level. */ - atomic_t dynticks; /* Even value for idle, else odd. */ + atomic_unchecked_t dynticks;/* Even value for idle, else odd. */ - }; - - /* RCU's kthread states for tracing. */ + #ifdef CONFIG_RCU_FAST_NO_HZ + int dyntick_drain; /* Prepare-for-idle state variable. */ + unsigned long dyntick_holdoff; diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h -index c023464..7f57225 100644 +index 3e48994..d94f03a 100644 --- a/kernel/rcutree_plugin.h +++ b/kernel/rcutree_plugin.h @@ -909,7 +909,7 @@ void synchronize_rcu_expedited(void) @@ -68484,7 +68939,7 @@ index c023464..7f57225 100644 mutex_unlock(&sync_rcu_preempt_exp_mutex); mb_ret: diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c -index ed459ed..a03c3fa 100644 +index d4bc16d..c234a5c 100644 --- a/kernel/rcutree_trace.c +++ b/kernel/rcutree_trace.c @@ -68,7 +68,7 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp) @@ -68506,7 +68961,7 @@ index ed459ed..a03c3fa 100644 rdp->dynticks->dynticks_nmi_nesting, rdp->dynticks_fqs); diff --git a/kernel/resource.c b/kernel/resource.c -index 7e8ea66..1efd11f 100644 +index e1d2b8e..24820bb 100644 --- a/kernel/resource.c +++ b/kernel/resource.c @@ -141,8 +141,18 @@ static const struct file_operations proc_iomem_operations = { @@ -68645,10 +69100,10 @@ index 0984a21..939f183 100644 #ifdef CONFIG_RT_GROUP_SCHED /* diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 817bf70..9099fb4 100644 +index 468bdd4..b941572 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c -@@ -4038,6 +4038,8 @@ int can_nice(const struct task_struct *p, const int nice) +@@ -4097,6 +4097,8 @@ int can_nice(const struct task_struct *p, const int nice) /* convert nice value [19,-20] to rlimit style value [1,40] */ int nice_rlim = 20 - nice; @@ -68657,7 +69112,7 @@ index 817bf70..9099fb4 100644 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) || capable(CAP_SYS_NICE)); } -@@ -4071,7 +4073,8 @@ SYSCALL_DEFINE1(nice, int, increment) +@@ -4130,7 +4132,8 @@ SYSCALL_DEFINE1(nice, int, increment) if (nice > 19) nice = 19; @@ -68667,7 +69122,7 @@ index 817bf70..9099fb4 100644 return -EPERM; retval = security_task_setnice(current, nice); -@@ -4228,6 +4231,7 @@ recheck: +@@ -4284,6 +4287,7 @@ recheck: unsigned long rlim_rtprio = task_rlimit(p, RLIMIT_RTPRIO); @@ -68676,10 +69131,10 @@ index 817bf70..9099fb4 100644 if (policy != p->policy && !rlim_rtprio) return -EPERM; diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index e955364..eacd2a4 100644 +index c099cc6..06aec4f 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c -@@ -5107,7 +5107,7 @@ static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle) { } +@@ -4846,7 +4846,7 @@ static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle) { } * run_rebalance_domains is triggered when needed from the scheduler tick. * Also triggered for nohz idle balancing (with nohz_balancing_kick set). */ @@ -68689,10 +69144,10 @@ index e955364..eacd2a4 100644 int this_cpu = smp_processor_id(); struct rq *this_rq = cpu_rq(this_cpu); diff --git a/kernel/signal.c b/kernel/signal.c -index 17afcaf..4500b05 100644 +index 6771027..763e51e 100644 --- a/kernel/signal.c +++ b/kernel/signal.c -@@ -47,12 +47,12 @@ static struct kmem_cache *sigqueue_cachep; +@@ -48,12 +48,12 @@ static struct kmem_cache *sigqueue_cachep; int print_fatal_signals __read_mostly; @@ -68707,7 +69162,7 @@ index 17afcaf..4500b05 100644 { /* Is it explicitly or implicitly ignored? */ return handler == SIG_IGN || -@@ -61,7 +61,7 @@ static int sig_handler_ignored(void __user *handler, int sig) +@@ -62,7 +62,7 @@ static int sig_handler_ignored(void __user *handler, int sig) static int sig_task_ignored(struct task_struct *t, int sig, bool force) { @@ -68716,7 +69171,7 @@ index 17afcaf..4500b05 100644 handler = sig_handler(t, sig); -@@ -365,6 +365,9 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t flags, int override_rlimi +@@ -366,6 +366,9 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t flags, int override_rlimi atomic_inc(&user->sigpending); rcu_read_unlock(); @@ -68726,7 +69181,7 @@ index 17afcaf..4500b05 100644 if (override_rlimit || atomic_read(&user->sigpending) <= task_rlimit(t, RLIMIT_SIGPENDING)) { -@@ -489,7 +492,7 @@ flush_signal_handlers(struct task_struct *t, int force_default) +@@ -490,7 +493,7 @@ flush_signal_handlers(struct task_struct *t, int force_default) int unhandled_signal(struct task_struct *tsk, int sig) { @@ -68749,7 +69204,7 @@ index 17afcaf..4500b05 100644 return security_task_kill(t, info, sig, 0); } -@@ -1204,7 +1214,7 @@ __group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p) +@@ -1197,7 +1207,7 @@ __group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p) return send_signal(sig, info, p, 1); } @@ -68758,7 +69213,7 @@ index 17afcaf..4500b05 100644 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t) { return send_signal(sig, info, t, 0); -@@ -1241,6 +1251,7 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t) +@@ -1234,6 +1244,7 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t) unsigned long int flags; int ret, blocked, ignored; struct k_sigaction *action; @@ -68766,7 +69221,7 @@ index 17afcaf..4500b05 100644 spin_lock_irqsave(&t->sighand->siglock, flags); action = &t->sighand->action[sig-1]; -@@ -1255,9 +1266,18 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t) +@@ -1248,9 +1259,18 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t) } if (action->sa.sa_handler == SIG_DFL) t->signal->flags &= ~SIGNAL_UNKILLABLE; @@ -68785,7 +69240,7 @@ index 17afcaf..4500b05 100644 return ret; } -@@ -1324,8 +1344,11 @@ int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p) +@@ -1317,8 +1337,11 @@ int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p) ret = check_kill_permission(sig, info, p); rcu_read_unlock(); @@ -68798,7 +69253,7 @@ index 17afcaf..4500b05 100644 return ret; } -@@ -2840,7 +2863,15 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info) +@@ -2858,7 +2881,15 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info) int error = -ESRCH; rcu_read_lock(); @@ -68816,10 +69271,10 @@ index 17afcaf..4500b05 100644 error = check_kill_permission(sig, info, p); /* diff --git a/kernel/smp.c b/kernel/smp.c -index 2f8b10e..a41bc14 100644 +index d0ae5b2..b87c5a8 100644 --- a/kernel/smp.c +++ b/kernel/smp.c -@@ -580,22 +580,22 @@ int smp_call_function(smp_call_func_t func, void *info, int wait) +@@ -582,22 +582,22 @@ int smp_call_function(smp_call_func_t func, void *info, int wait) } EXPORT_SYMBOL(smp_call_function); @@ -68900,11 +69355,36 @@ index 671f959..91c51cb 100644 { struct tasklet_struct *list; +diff --git a/kernel/srcu.c b/kernel/srcu.c +index 2095be3..9a5b89d 100644 +--- a/kernel/srcu.c ++++ b/kernel/srcu.c +@@ -302,9 +302,9 @@ int __srcu_read_lock(struct srcu_struct *sp) + preempt_disable(); + idx = rcu_dereference_index_check(sp->completed, + rcu_read_lock_sched_held()) & 0x1; +- ACCESS_ONCE(this_cpu_ptr(sp->per_cpu_ref)->c[idx]) += 1; ++ ACCESS_ONCE_RW(this_cpu_ptr(sp->per_cpu_ref)->c[idx]) += 1; + smp_mb(); /* B */ /* Avoid leaking the critical section. */ +- ACCESS_ONCE(this_cpu_ptr(sp->per_cpu_ref)->seq[idx]) += 1; ++ ACCESS_ONCE_RW(this_cpu_ptr(sp->per_cpu_ref)->seq[idx]) += 1; + preempt_enable(); + return idx; + } +@@ -320,7 +320,7 @@ void __srcu_read_unlock(struct srcu_struct *sp, int idx) + { + preempt_disable(); + smp_mb(); /* C */ /* Avoid leaking the critical section. */ +- ACCESS_ONCE(this_cpu_ptr(sp->per_cpu_ref)->c[idx]) -= 1; ++ ACCESS_ONCE_RW(this_cpu_ptr(sp->per_cpu_ref)->c[idx]) -= 1; + preempt_enable(); + } + EXPORT_SYMBOL_GPL(__srcu_read_unlock); diff --git a/kernel/sys.c b/kernel/sys.c -index e7006eb..8fb7c51 100644 +index 2d39a84..f778b49 100644 --- a/kernel/sys.c +++ b/kernel/sys.c -@@ -158,6 +158,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error) +@@ -157,6 +157,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error) error = -EACCES; goto out; } @@ -68917,7 +69397,7 @@ index e7006eb..8fb7c51 100644 no_nice = security_task_setnice(p, niceval); if (no_nice) { error = no_nice; -@@ -581,6 +587,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid) +@@ -594,6 +600,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid) goto error; } @@ -68925,20 +69405,20 @@ index e7006eb..8fb7c51 100644 + goto error; + if (rgid != (gid_t) -1 || - (egid != (gid_t) -1 && egid != old->gid)) + (egid != (gid_t) -1 && !gid_eq(kegid, old->gid))) new->sgid = new->egid; -@@ -610,6 +619,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid) +@@ -629,6 +638,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid) old = current_cred(); retval = -EPERM; + -+ if (gr_check_group_change(gid, gid, gid)) ++ if (gr_check_group_change(kgid, kgid, kgid)) + goto error; + if (nsown_capable(CAP_SETGID)) - new->gid = new->egid = new->sgid = new->fsgid = gid; - else if (gid == old->gid || gid == old->sgid) -@@ -627,7 +640,7 @@ error: + new->gid = new->egid = new->sgid = new->fsgid = kgid; + else if (gid_eq(kgid, old->gid) || gid_eq(kgid, old->sgid)) +@@ -646,7 +659,7 @@ error: /* * change the user struct in a credentials set to match the new UID */ @@ -68947,60 +69427,60 @@ index e7006eb..8fb7c51 100644 { struct user_struct *new_user; -@@ -697,6 +710,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid) +@@ -726,6 +739,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid) goto error; } + if (gr_check_user_change(new->uid, new->euid, -1)) + goto error; + - if (new->uid != old->uid) { + if (!uid_eq(new->uid, old->uid)) { retval = set_user(new); if (retval < 0) -@@ -741,6 +757,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid) +@@ -776,6 +792,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid) old = current_cred(); retval = -EPERM; + -+ if (gr_check_crash_uid(uid)) ++ if (gr_check_crash_uid(kuid)) + goto error; -+ if (gr_check_user_change(uid, uid, uid)) ++ if (gr_check_user_change(kuid, kuid, kuid)) + goto error; + if (nsown_capable(CAP_SETUID)) { - new->suid = new->uid = uid; - if (uid != old->uid) { -@@ -795,6 +817,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid) + new->suid = new->uid = kuid; + if (!uid_eq(kuid, old->uid)) { +@@ -845,6 +867,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid) goto error; } -+ if (gr_check_user_change(ruid, euid, -1)) ++ if (gr_check_user_change(kruid, keuid, -1)) + goto error; + if (ruid != (uid_t) -1) { - new->uid = ruid; - if (ruid != old->uid) { -@@ -859,6 +884,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid) + new->uid = kruid; + if (!uid_eq(kruid, old->uid)) { +@@ -927,6 +952,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid) goto error; } -+ if (gr_check_group_change(rgid, egid, -1)) ++ if (gr_check_group_change(krgid, kegid, -1)) + goto error; + if (rgid != (gid_t) -1) - new->gid = rgid; + new->gid = krgid; if (egid != (gid_t) -1) -@@ -905,6 +933,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid) - old = current_cred(); - old_fsuid = old->fsuid; +@@ -980,6 +1008,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid) + if (!uid_valid(kuid)) + return old_fsuid; -+ if (gr_check_user_change(-1, -1, uid)) ++ if (gr_check_user_change(-1, -1, kuid)) + goto error; + - if (uid == old->uid || uid == old->euid || - uid == old->suid || uid == old->fsuid || - nsown_capable(CAP_SETUID)) { -@@ -915,6 +946,7 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid) + new = prepare_creds(); + if (!new) + return old_fsuid; +@@ -994,6 +1025,7 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid) } } @@ -69008,15 +69488,15 @@ index e7006eb..8fb7c51 100644 abort_creds(new); return old_fsuid; -@@ -941,12 +973,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid) - if (gid == old->gid || gid == old->egid || - gid == old->sgid || gid == old->fsgid || +@@ -1026,12 +1058,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid) + if (gid_eq(kgid, old->gid) || gid_eq(kgid, old->egid) || + gid_eq(kgid, old->sgid) || gid_eq(kgid, old->fsgid) || nsown_capable(CAP_SETGID)) { -+ if (gr_check_group_change(-1, -1, gid)) ++ if (gr_check_group_change(-1, -1, kgid)) + goto error; + - if (gid != old_fsgid) { - new->fsgid = gid; + if (!gid_eq(kgid, old->fsgid)) { + new->fsgid = kgid; goto change_okay; } } @@ -69025,7 +69505,7 @@ index e7006eb..8fb7c51 100644 abort_creds(new); return old_fsgid; -@@ -1198,7 +1234,10 @@ static int override_release(char __user *release, int len) +@@ -1283,7 +1319,10 @@ static int override_release(char __user *release, int len) } v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40; snprintf(buf, len, "2.6.%u%s", v, rest); @@ -69037,7 +69517,7 @@ index e7006eb..8fb7c51 100644 } return ret; } -@@ -1252,19 +1291,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name) +@@ -1337,19 +1376,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name) return -EFAULT; down_read(&uts_sem); @@ -69062,7 +69542,7 @@ index e7006eb..8fb7c51 100644 __OLD_UTS_LEN); error |= __put_user(0, name->machine + __OLD_UTS_LEN); up_read(&uts_sem); -@@ -1847,7 +1886,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, +@@ -2024,7 +2063,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, error = get_dumpable(me->mm); break; case PR_SET_DUMPABLE: @@ -69436,7 +69916,7 @@ index ba744cf..267b7c5 100644 update_vsyscall_tz(); if (firsttime) { diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c -index 8a538c5..def79d4 100644 +index aa27d39..34d221c 100644 --- a/kernel/time/alarmtimer.c +++ b/kernel/time/alarmtimer.c @@ -779,7 +779,7 @@ static int __init alarmtimer_init(void) @@ -69462,7 +69942,7 @@ index f113755..ec24223 100644 cpumask_clear_cpu(cpu, tick_get_broadcast_mask()); tick_broadcast_clear_oneshot(cpu); diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c -index 7c50de8..e29a94d 100644 +index 3447cfa..291806b 100644 --- a/kernel/time/timekeeping.c +++ b/kernel/time/timekeeping.c @@ -14,6 +14,7 @@ @@ -69473,7 +69953,7 @@ index 7c50de8..e29a94d 100644 #include <linux/syscore_ops.h> #include <linux/clocksource.h> #include <linux/jiffies.h> -@@ -388,6 +389,8 @@ int do_settimeofday(const struct timespec *tv) +@@ -387,6 +388,8 @@ int do_settimeofday(const struct timespec *tv) if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC) return -EINVAL; @@ -69600,10 +70080,10 @@ index 0b537f2..9e71eca 100644 return -ENOMEM; return 0; diff --git a/kernel/timer.c b/kernel/timer.c -index a297ffc..5e16b0b 100644 +index 6ec7e7e..cbc448b 100644 --- a/kernel/timer.c +++ b/kernel/timer.c -@@ -1354,7 +1354,7 @@ void update_process_times(int user_tick) +@@ -1362,7 +1362,7 @@ void update_process_times(int user_tick) /* * This function runs timers and the timer-tq in bottom half context. */ @@ -69644,10 +70124,10 @@ index c0bd030..62a1927 100644 ret = -EIO; bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt, diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 0fa92f6..89950b2 100644 +index a008663..d363254 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c -@@ -1800,12 +1800,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec) +@@ -1785,12 +1785,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec) if (unlikely(ftrace_disabled)) return 0; @@ -69667,7 +70147,7 @@ index 0fa92f6..89950b2 100644 } /* -@@ -2917,7 +2922,7 @@ static void ftrace_free_entry_rcu(struct rcu_head *rhp) +@@ -2885,7 +2890,7 @@ static void ftrace_free_entry_rcu(struct rcu_head *rhp) int register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops, @@ -69677,10 +70157,10 @@ index 0fa92f6..89950b2 100644 struct ftrace_func_probe *entry; struct ftrace_page *pg; diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 55e4d4c..8c915ec 100644 +index a7fa070..403bc8d 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c -@@ -4316,10 +4316,9 @@ static const struct file_operations tracing_dyn_info_fops = { +@@ -4421,10 +4421,9 @@ static const struct file_operations tracing_dyn_info_fops = { }; #endif @@ -69692,7 +70172,7 @@ index 55e4d4c..8c915ec 100644 static int once; if (d_tracer) -@@ -4339,10 +4338,9 @@ struct dentry *tracing_init_dentry(void) +@@ -4444,10 +4443,9 @@ struct dentry *tracing_init_dentry(void) return d_tracer; } @@ -69754,46 +70234,6 @@ index 29111da..d190fe2 100644 } } -diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c -index 580a05e..9b31acb 100644 ---- a/kernel/trace/trace_kprobe.c -+++ b/kernel/trace/trace_kprobe.c -@@ -217,7 +217,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs, - long ret; - int maxlen = get_rloc_len(*(u32 *)dest); - u8 *dst = get_rloc_data(dest); -- u8 *src = addr; -+ const u8 __user *src = (const u8 __force_user *)addr; - mm_segment_t old_fs = get_fs(); - if (!maxlen) - return; -@@ -229,7 +229,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs, - pagefault_disable(); - do - ret = __copy_from_user_inatomic(dst++, src++, 1); -- while (dst[-1] && ret == 0 && src - (u8 *)addr < maxlen); -+ while (dst[-1] && ret == 0 && src - (const u8 __force_user *)addr < maxlen); - dst[-1] = '\0'; - pagefault_enable(); - set_fs(old_fs); -@@ -238,7 +238,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs, - ((u8 *)get_rloc_data(dest))[0] = '\0'; - *(u32 *)dest = make_data_rloc(0, get_rloc_offs(*(u32 *)dest)); - } else -- *(u32 *)dest = make_data_rloc(src - (u8 *)addr, -+ *(u32 *)dest = make_data_rloc(src - (const u8 __force_user *)addr, - get_rloc_offs(*(u32 *)dest)); - } - /* Return the length of string -- including null terminal byte */ -@@ -252,7 +252,7 @@ static __kprobes void FETCH_FUNC_NAME(memory, string_size)(struct pt_regs *regs, - set_fs(KERNEL_DS); - pagefault_disable(); - do { -- ret = __copy_from_user_inatomic(&c, (u8 *)addr + len, 1); -+ ret = __copy_from_user_inatomic(&c, (const u8 __force_user *)addr + len, 1); - len++; - } while (c && ret == 0 && len < MAX_STRING_SIZE); - pagefault_enable(); diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c index fd3c8aa..5f324a6 100644 --- a/kernel/trace/trace_mmiotrace.c @@ -69860,42 +70300,11 @@ index d4545f4..a9010a1 100644 return; local_irq_save(flags); -diff --git a/kernel/trace/trace_workqueue.c b/kernel/trace/trace_workqueue.c -index 209b379..7f76423 100644 ---- a/kernel/trace/trace_workqueue.c -+++ b/kernel/trace/trace_workqueue.c -@@ -22,7 +22,7 @@ struct cpu_workqueue_stats { - int cpu; - pid_t pid; - /* Can be inserted from interrupt or user context, need to be atomic */ -- atomic_t inserted; -+ atomic_unchecked_t inserted; - /* - * Don't need to be atomic, works are serialized in a single workqueue thread - * on a single CPU. -@@ -60,7 +60,7 @@ probe_workqueue_insertion(void *ignore, - spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags); - list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) { - if (node->pid == wq_thread->pid) { -- atomic_inc(&node->inserted); -+ atomic_inc_unchecked(&node->inserted); - goto found; - } - } -@@ -210,7 +210,7 @@ static int workqueue_stat_show(struct seq_file *s, void *p) - tsk = get_pid_task(pid, PIDTYPE_PID); - if (tsk) { - seq_printf(s, "%3d %6d %6u %s\n", cws->cpu, -- atomic_read(&cws->inserted), cws->executed, -+ atomic_read_unchecked(&cws->inserted), cws->executed, - tsk->comm); - put_task_struct(tsk); - } diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug -index 6777153..8519f60 100644 +index ff5bdee..3eaeba6 100644 --- a/lib/Kconfig.debug +++ b/lib/Kconfig.debug -@@ -1132,6 +1132,7 @@ config LATENCYTOP +@@ -1165,6 +1165,7 @@ config LATENCYTOP depends on DEBUG_KERNEL depends on STACKTRACE_SUPPORT depends on PROC_FS @@ -69904,10 +70313,10 @@ index 6777153..8519f60 100644 select KALLSYMS select KALLSYMS_ALL diff --git a/lib/bitmap.c b/lib/bitmap.c -index b5a8b6a..a69623c 100644 +index 06fdfa1..97c5c7d 100644 --- a/lib/bitmap.c +++ b/lib/bitmap.c -@@ -421,7 +421,7 @@ int __bitmap_parse(const char *buf, unsigned int buflen, +@@ -422,7 +422,7 @@ int __bitmap_parse(const char *buf, unsigned int buflen, { int c, old_c, totaldigits, ndigits, nchunks, nbits; u32 chunk; @@ -69916,7 +70325,7 @@ index b5a8b6a..a69623c 100644 bitmap_zero(maskp, nmaskbits); -@@ -506,7 +506,7 @@ int bitmap_parse_user(const char __user *ubuf, +@@ -507,7 +507,7 @@ int bitmap_parse_user(const char __user *ubuf, { if (!access_ok(VERIFY_READ, ubuf, ulen)) return -EFAULT; @@ -69957,10 +70366,10 @@ index a28c141..2bd3d95 100644 file = NULL; line = 0; diff --git a/lib/debugobjects.c b/lib/debugobjects.c -index 0ab9ae8..f01ceca 100644 +index d11808c..dc2d6f8 100644 --- a/lib/debugobjects.c +++ b/lib/debugobjects.c -@@ -288,7 +288,7 @@ static void debug_object_is_on_stack(void *addr, int onstack) +@@ -287,7 +287,7 @@ static void debug_object_is_on_stack(void *addr, int onstack) if (limit > 4) return; @@ -69992,7 +70401,7 @@ index 80b9c76..9e32279 100644 EXPORT_SYMBOL(devm_ioport_unmap); diff --git a/lib/dma-debug.c b/lib/dma-debug.c -index 13ef233..5241683 100644 +index 66ce414..6f0a0dd 100644 --- a/lib/dma-debug.c +++ b/lib/dma-debug.c @@ -924,7 +924,7 @@ out: @@ -70005,7 +70414,7 @@ index 13ef233..5241683 100644 "stack [addr=%p]\n", addr); } diff --git a/lib/extable.c b/lib/extable.c -index 4cac81e..63e9b8f 100644 +index 4cac81e..4d66cfc 100644 --- a/lib/extable.c +++ b/lib/extable.c @@ -13,6 +13,7 @@ @@ -70016,17 +70425,6 @@ index 4cac81e..63e9b8f 100644 #ifndef ARCH_HAS_SORT_EXTABLE /* -@@ -36,8 +37,10 @@ static int cmp_ex(const void *a, const void *b) - void sort_extable(struct exception_table_entry *start, - struct exception_table_entry *finish) - { -+ pax_open_kernel(); - sort(start, finish - start, sizeof(struct exception_table_entry), - cmp_ex, NULL); -+ pax_close_kernel(); - } - - #ifdef CONFIG_MODULES diff --git a/lib/inflate.c b/lib/inflate.c index 013a761..c28f3fc 100644 --- a/lib/inflate.c @@ -70077,12 +70475,12 @@ index bd2bea9..6b3c95e 100644 return false; diff --git a/lib/radix-tree.c b/lib/radix-tree.c -index 3ac50dc..240bb7e 100644 +index e796429..6e38f9f 100644 --- a/lib/radix-tree.c +++ b/lib/radix-tree.c -@@ -79,7 +79,7 @@ struct radix_tree_preload { +@@ -92,7 +92,7 @@ struct radix_tree_preload { int nr; - struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH]; + struct radix_tree_node *nodes[RADIX_TREE_PRELOAD_SIZE]; }; -static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, }; +static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads); @@ -70090,7 +70488,7 @@ index 3ac50dc..240bb7e 100644 static inline void *ptr_to_indirect(void *ptr) { diff --git a/lib/vsprintf.c b/lib/vsprintf.c -index abbabec..6779788 100644 +index c3f36d41..5c5aeb5 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -16,6 +16,9 @@ @@ -70103,7 +70501,7 @@ index abbabec..6779788 100644 #include <stdarg.h> #include <linux/module.h> /* for KSYM_SYMBOL_LEN */ #include <linux/types.h> -@@ -433,7 +436,7 @@ char *symbol_string(char *buf, char *end, void *ptr, +@@ -536,7 +539,7 @@ char *symbol_string(char *buf, char *end, void *ptr, char sym[KSYM_SYMBOL_LEN]; if (ext == 'B') sprint_backtrace(sym, value); @@ -70111,8 +70509,8 @@ index abbabec..6779788 100644 + else if (ext != 'f' && ext != 's' && ext != 'a') sprint_symbol(sym, value); else - kallsyms_lookup(value, NULL, NULL, NULL, sym); -@@ -809,7 +812,11 @@ char *netdev_feature_string(char *buf, char *end, const u8 *addr, + sprint_symbol_no_offset(sym, value); +@@ -912,7 +915,11 @@ char *netdev_feature_string(char *buf, char *end, const u8 *addr, return number(buf, end, *(const netdev_features_t *)addr, spec); } @@ -70124,7 +70522,7 @@ index abbabec..6779788 100644 /* * Show a '%p' thing. A kernel extension is that the '%p' is followed -@@ -823,6 +830,8 @@ int kptr_restrict __read_mostly; +@@ -926,6 +933,8 @@ int kptr_restrict __read_mostly; * - 'S' For symbolic direct pointers with offset * - 's' For symbolic direct pointers without offset * - 'B' For backtraced symbolic direct pointers with offset @@ -70133,8 +70531,8 @@ index abbabec..6779788 100644 * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref] * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201] * - 'M' For a 6-byte MAC address, it prints the address in the -@@ -868,12 +877,12 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, - { +@@ -973,12 +982,12 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, + if (!ptr && *fmt != 'K') { /* - * Print (null) with the same width as a pointer so it makes @@ -70142,13 +70540,13 @@ index abbabec..6779788 100644 * tabular output look nice. */ if (spec.field_width == -1) - spec.field_width = 2 * sizeof(void *); + spec.field_width = default_width; - return string(buf, end, "(null)", spec); + return string(buf, end, "(nil)", spec); } switch (*fmt) { -@@ -883,6 +892,13 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, +@@ -988,6 +997,13 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, /* Fallthrough */ case 'S': case 's': @@ -70162,7 +70560,7 @@ index abbabec..6779788 100644 case 'B': return symbol_string(buf, end, ptr, spec, *fmt); case 'R': -@@ -920,12 +936,15 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, +@@ -1025,12 +1041,15 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, va_end(va); return buf; } @@ -70177,9 +70575,9 @@ index abbabec..6779788 100644 + if (kptr_restrict && (in_irq() || in_serving_softirq() || + in_nmi())) { if (spec.field_width == -1) - spec.field_width = 2 * sizeof(void *); + spec.field_width = default_width; return string(buf, end, "pK-error", spec); -@@ -942,6 +961,19 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, +@@ -1047,6 +1066,21 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, } break; } @@ -70188,8 +70586,10 @@ index abbabec..6779788 100644 + /* 'P' = approved pointers to copy to userland, + as in the /proc/kallsyms case, as we make it display nothing + for non-root users, and the real contents for root users ++ Also ignore 'K' pointers, since we force their NULLing for non-root users ++ above + */ -+ if (ptr > TASK_SIZE && *fmt != 'P' && is_usercopy_object(buf)) { ++ if (ptr > TASK_SIZE && *fmt != 'P' && *fmt != 'K' && is_usercopy_object(buf)) { + printk(KERN_ALERT "grsec: kernel infoleak detected! Please report this log to spender@grsecurity.net.\n"); + dump_stack(); + ptr = NULL; @@ -70198,8 +70598,8 @@ index abbabec..6779788 100644 + spec.flags |= SMALL; if (spec.field_width == -1) { - spec.field_width = 2 * sizeof(void *); -@@ -1653,11 +1685,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf) + spec.field_width = default_width; +@@ -1758,11 +1792,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf) typeof(type) value; \ if (sizeof(type) == 8) { \ args = PTR_ALIGN(args, sizeof(u32)); \ @@ -70214,7 +70614,7 @@ index abbabec..6779788 100644 } \ args += sizeof(type); \ value; \ -@@ -1720,7 +1752,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf) +@@ -1825,7 +1859,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf) case FORMAT_TYPE_STR: { const char *str_arg = args; args += strlen(str_arg) + 1; @@ -70231,7 +70631,7 @@ index 0000000..7cd6065 @@ -0,0 +1 @@ +-grsec diff --git a/mm/Kconfig b/mm/Kconfig -index e338407..4210331 100644 +index 82fed4e..979e814 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -247,10 +247,10 @@ config KSM @@ -70258,10 +70658,10 @@ index e338407..4210331 100644 config NOMMU_INITIAL_TRIM_EXCESS diff --git a/mm/filemap.c b/mm/filemap.c -index 79c4b2b..596b417 100644 +index a4a5260..6151dc5 100644 --- a/mm/filemap.c +++ b/mm/filemap.c -@@ -1762,7 +1762,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma) +@@ -1723,7 +1723,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma) struct address_space *mapping = file->f_mapping; if (!mapping->a_ops->readpage) @@ -70270,7 +70670,7 @@ index 79c4b2b..596b417 100644 file_accessed(file); vma->vm_ops = &generic_file_vm_ops; vma->vm_flags |= VM_CAN_NONLINEAR; -@@ -2168,6 +2168,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i +@@ -2064,6 +2064,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i *pos = i_size_read(inode); if (limit != RLIM_INFINITY) { @@ -70324,10 +70724,10 @@ index 57d82c6..e9e0552 100644 set_page_address(page, (void *)vaddr); diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index f0e5306..cb9398e 100644 +index 57c4b93..24b8f59 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c -@@ -733,7 +733,7 @@ out: +@@ -735,7 +735,7 @@ out: * run pte_offset_map on the pmd, if an huge pmd could * materialize from under us from a different thread. */ @@ -70337,10 +70737,10 @@ index f0e5306..cb9398e 100644 /* if an huge pmd materialized from under us just retry later */ if (unlikely(pmd_trans_huge(*pmd))) diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 263e177..3f36aec 100644 +index e198831..38d524f 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c -@@ -2446,6 +2446,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2447,6 +2447,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma, return 1; } @@ -70368,7 +70768,7 @@ index 263e177..3f36aec 100644 /* * Hugetlb_cow() should be called with page lock of the original hugepage held. * Called with hugetlb_instantiation_mutex held and pte_page locked so we -@@ -2558,6 +2579,11 @@ retry_avoidcopy: +@@ -2559,6 +2580,11 @@ retry_avoidcopy: make_huge_pte(vma, new_page, 1)); page_remove_rmap(old_page); hugepage_add_new_anon_rmap(new_page, vma, address); @@ -70380,7 +70780,7 @@ index 263e177..3f36aec 100644 /* Make the old page be freed below */ new_page = old_page; mmu_notifier_invalidate_range_end(mm, -@@ -2712,6 +2738,10 @@ retry: +@@ -2713,6 +2739,10 @@ retry: && (vma->vm_flags & VM_SHARED))); set_huge_pte_at(mm, address, ptep, new_pte); @@ -70391,7 +70791,7 @@ index 263e177..3f36aec 100644 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) { /* Optimization, do the COW without a second fault */ ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page); -@@ -2741,6 +2771,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2742,6 +2772,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, static DEFINE_MUTEX(hugetlb_instantiation_mutex); struct hstate *h = hstate_vma(vma); @@ -70402,7 +70802,7 @@ index 263e177..3f36aec 100644 address &= huge_page_mask(h); ptep = huge_pte_offset(mm, address); -@@ -2754,6 +2788,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2755,6 +2789,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, VM_FAULT_SET_HINDEX(h - hstates); } @@ -70430,7 +70830,7 @@ index 263e177..3f36aec 100644 if (!ptep) return VM_FAULT_OOM; diff --git a/mm/internal.h b/mm/internal.h -index 2189af4..f2ca332 100644 +index 2ba87fb..7f451e2 100644 --- a/mm/internal.h +++ b/mm/internal.h @@ -95,6 +95,7 @@ extern void putback_lru_page(struct page *page); @@ -70477,10 +70877,10 @@ index d53adf9..03a24bf 100644 set_fs(old_fs); diff --git a/mm/madvise.c b/mm/madvise.c -index 55f645c..cde5320 100644 +index 14d260f..b2a80fd 100644 --- a/mm/madvise.c +++ b/mm/madvise.c -@@ -46,6 +46,10 @@ static long madvise_behavior(struct vm_area_struct * vma, +@@ -48,6 +48,10 @@ static long madvise_behavior(struct vm_area_struct * vma, pgoff_t pgoff; unsigned long new_flags = vma->vm_flags; @@ -70491,7 +70891,7 @@ index 55f645c..cde5320 100644 switch (behavior) { case MADV_NORMAL: new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ; -@@ -117,6 +121,13 @@ success: +@@ -119,6 +123,13 @@ success: /* * vm_flags is protected by the mmap_sem held in write mode. */ @@ -70505,7 +70905,7 @@ index 55f645c..cde5320 100644 vma->vm_flags = new_flags; out: -@@ -175,6 +186,11 @@ static long madvise_dontneed(struct vm_area_struct * vma, +@@ -177,6 +188,11 @@ static long madvise_dontneed(struct vm_area_struct * vma, struct vm_area_struct ** prev, unsigned long start, unsigned long end) { @@ -70517,7 +70917,7 @@ index 55f645c..cde5320 100644 *prev = vma; if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP)) return -EINVAL; -@@ -187,6 +203,21 @@ static long madvise_dontneed(struct vm_area_struct * vma, +@@ -189,6 +205,21 @@ static long madvise_dontneed(struct vm_area_struct * vma, zap_page_range(vma, start, end - start, &details); } else zap_page_range(vma, start, end - start, NULL); @@ -70539,7 +70939,7 @@ index 55f645c..cde5320 100644 return 0; } -@@ -394,6 +425,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior) +@@ -393,6 +424,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior) if (end < start) goto out; @@ -70557,7 +70957,7 @@ index 55f645c..cde5320 100644 if (end == start) goto out; diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index 97cc273..6ed703f 100644 +index ab1e714..415de01 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -61,7 +61,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0; @@ -70642,7 +71042,7 @@ index 97cc273..6ed703f 100644 /* keep elevated page count for bad page */ return ret; diff --git a/mm/memory.c b/mm/memory.c -index 6105f47..3363489 100644 +index 2466d12..08be4f6 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -434,8 +434,12 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud, @@ -70671,7 +71071,7 @@ index 6105f47..3363489 100644 } /* -@@ -1597,12 +1604,6 @@ no_page_table: +@@ -1602,12 +1609,6 @@ no_page_table: return page; } @@ -70684,7 +71084,7 @@ index 6105f47..3363489 100644 /** * __get_user_pages() - pin user pages in memory * @tsk: task_struct of target task -@@ -1675,10 +1676,10 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, +@@ -1680,10 +1681,10 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE); i = 0; @@ -70697,7 +71097,7 @@ index 6105f47..3363489 100644 if (!vma && in_gate_area(mm, start)) { unsigned long pg = start & PAGE_MASK; pgd_t *pgd; -@@ -1726,7 +1727,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, +@@ -1731,7 +1732,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, goto next_page; } @@ -70706,7 +71106,7 @@ index 6105f47..3363489 100644 (vma->vm_flags & (VM_IO | VM_PFNMAP)) || !(vm_flags & vma->vm_flags)) return i ? : -EFAULT; -@@ -1753,11 +1754,6 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, +@@ -1758,11 +1759,6 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, int ret; unsigned int fault_flags = 0; @@ -70718,7 +71118,7 @@ index 6105f47..3363489 100644 if (foll_flags & FOLL_WRITE) fault_flags |= FAULT_FLAG_WRITE; if (nonblocking) -@@ -1831,7 +1827,7 @@ next_page: +@@ -1836,7 +1832,7 @@ next_page: start += PAGE_SIZE; nr_pages--; } while (nr_pages && start < vma->vm_end); @@ -70727,7 +71127,7 @@ index 6105f47..3363489 100644 return i; } EXPORT_SYMBOL(__get_user_pages); -@@ -2038,6 +2034,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr, +@@ -2043,6 +2039,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr, page_add_file_rmap(page); set_pte_at(mm, addr, pte, mk_pte(page, prot)); @@ -70738,7 +71138,7 @@ index 6105f47..3363489 100644 retval = 0; pte_unmap_unlock(pte, ptl); return retval; -@@ -2072,10 +2072,22 @@ out: +@@ -2077,10 +2077,22 @@ out: int vm_insert_page(struct vm_area_struct *vma, unsigned long addr, struct page *page) { @@ -70761,7 +71161,7 @@ index 6105f47..3363489 100644 vma->vm_flags |= VM_INSERTPAGE; return insert_page(vma, addr, page, vma->vm_page_prot); } -@@ -2161,6 +2173,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr, +@@ -2166,6 +2178,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr, unsigned long pfn) { BUG_ON(!(vma->vm_flags & VM_MIXEDMAP)); @@ -70769,7 +71169,7 @@ index 6105f47..3363489 100644 if (addr < vma->vm_start || addr >= vma->vm_end) return -EFAULT; -@@ -2368,7 +2381,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud, +@@ -2373,7 +2386,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud, BUG_ON(pud_huge(*pud)); @@ -70780,7 +71180,7 @@ index 6105f47..3363489 100644 if (!pmd) return -ENOMEM; do { -@@ -2388,7 +2403,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd, +@@ -2393,7 +2408,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd, unsigned long next; int err; @@ -70791,7 +71191,7 @@ index 6105f47..3363489 100644 if (!pud) return -ENOMEM; do { -@@ -2476,6 +2493,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo +@@ -2481,6 +2498,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo copy_user_highpage(dst, src, va, vma); } @@ -70978,7 +71378,7 @@ index 6105f47..3363489 100644 /* * This routine handles present pages, when users try to write * to a shared page. It is done by copying the page to a new address -@@ -2687,6 +2884,12 @@ gotten: +@@ -2692,6 +2889,12 @@ gotten: */ page_table = pte_offset_map_lock(mm, pmd, address, &ptl); if (likely(pte_same(*page_table, orig_pte))) { @@ -70991,7 +71391,7 @@ index 6105f47..3363489 100644 if (old_page) { if (!PageAnon(old_page)) { dec_mm_counter_fast(mm, MM_FILEPAGES); -@@ -2738,6 +2941,10 @@ gotten: +@@ -2743,6 +2946,10 @@ gotten: page_remove_rmap(old_page); } @@ -71002,7 +71402,7 @@ index 6105f47..3363489 100644 /* Free the old page.. */ new_page = old_page; ret |= VM_FAULT_WRITE; -@@ -3017,6 +3224,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3022,6 +3229,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma, swap_free(entry); if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page)) try_to_free_swap(page); @@ -71014,7 +71414,7 @@ index 6105f47..3363489 100644 unlock_page(page); if (swapcache) { /* -@@ -3040,6 +3252,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3045,6 +3257,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma, /* No need to invalidate - it was non-present before */ update_mmu_cache(vma, address, page_table); @@ -71026,7 +71426,7 @@ index 6105f47..3363489 100644 unlock: pte_unmap_unlock(page_table, ptl); out: -@@ -3059,40 +3276,6 @@ out_release: +@@ -3064,40 +3281,6 @@ out_release: } /* @@ -71067,7 +71467,7 @@ index 6105f47..3363489 100644 * We enter with non-exclusive mmap_sem (to exclude vma changes, * but allow concurrent faults), and pte mapped but not yet locked. * We return with mmap_sem still held, but pte unmapped and unlocked. -@@ -3101,27 +3284,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3106,27 +3289,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, unsigned long address, pte_t *page_table, pmd_t *pmd, unsigned int flags) { @@ -71100,7 +71500,7 @@ index 6105f47..3363489 100644 if (unlikely(anon_vma_prepare(vma))) goto oom; page = alloc_zeroed_user_highpage_movable(vma, address); -@@ -3140,6 +3319,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3145,6 +3324,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, if (!pte_none(*page_table)) goto release; @@ -71112,7 +71512,7 @@ index 6105f47..3363489 100644 inc_mm_counter_fast(mm, MM_ANONPAGES); page_add_new_anon_rmap(page, vma, address); setpte: -@@ -3147,6 +3331,12 @@ setpte: +@@ -3152,6 +3336,12 @@ setpte: /* No need to invalidate - it was non-present before */ update_mmu_cache(vma, address, page_table); @@ -71125,7 +71525,7 @@ index 6105f47..3363489 100644 unlock: pte_unmap_unlock(page_table, ptl); return 0; -@@ -3290,6 +3480,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3295,6 +3485,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma, */ /* Only go through if we didn't race with anybody else... */ if (likely(pte_same(*page_table, orig_pte))) { @@ -71138,7 +71538,7 @@ index 6105f47..3363489 100644 flush_icache_page(vma, page); entry = mk_pte(page, vma->vm_page_prot); if (flags & FAULT_FLAG_WRITE) -@@ -3309,6 +3505,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3314,6 +3510,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma, /* no need to invalidate: a not-present page won't be cached */ update_mmu_cache(vma, address, page_table); @@ -71153,7 +71553,7 @@ index 6105f47..3363489 100644 } else { if (cow_page) mem_cgroup_uncharge_page(cow_page); -@@ -3462,6 +3666,12 @@ int handle_pte_fault(struct mm_struct *mm, +@@ -3467,6 +3671,12 @@ int handle_pte_fault(struct mm_struct *mm, if (flags & FAULT_FLAG_WRITE) flush_tlb_fix_spurious_fault(vma, address); } @@ -71166,7 +71566,7 @@ index 6105f47..3363489 100644 unlock: pte_unmap_unlock(pte, ptl); return 0; -@@ -3478,6 +3688,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3483,6 +3693,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma, pmd_t *pmd; pte_t *pte; @@ -71177,7 +71577,7 @@ index 6105f47..3363489 100644 __set_current_state(TASK_RUNNING); count_vm_event(PGFAULT); -@@ -3489,6 +3703,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3494,6 +3708,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma, if (unlikely(is_vm_hugetlb_page(vma))) return hugetlb_fault(mm, vma, address, flags); @@ -71209,10 +71609,10 @@ index 6105f47..3363489 100644 + } +#endif + + retry: pgd = pgd_offset(mm, address); pud = pud_alloc(mm, pgd, address); - if (!pud) -@@ -3518,7 +3760,7 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3535,7 +3777,7 @@ retry: * run pte_offset_map on the pmd, if an huge pmd could * materialize from under us from a different thread. */ @@ -71221,7 +71621,7 @@ index 6105f47..3363489 100644 return VM_FAULT_OOM; /* if an huge pmd materialized from under us just retry later */ if (unlikely(pmd_trans_huge(*pmd))) -@@ -3555,6 +3797,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address) +@@ -3572,6 +3814,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address) spin_unlock(&mm->page_table_lock); return 0; } @@ -71245,7 +71645,7 @@ index 6105f47..3363489 100644 #endif /* __PAGETABLE_PUD_FOLDED */ #ifndef __PAGETABLE_PMD_FOLDED -@@ -3585,6 +3844,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address) +@@ -3602,6 +3861,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address) spin_unlock(&mm->page_table_lock); return 0; } @@ -71276,7 +71676,7 @@ index 6105f47..3363489 100644 #endif /* __PAGETABLE_PMD_FOLDED */ int make_pages_present(unsigned long addr, unsigned long end) -@@ -3622,7 +3905,7 @@ static int __init gate_vma_init(void) +@@ -3639,7 +3922,7 @@ static int __init gate_vma_init(void) gate_vma.vm_start = FIXADDR_USER_START; gate_vma.vm_end = FIXADDR_USER_END; gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC; @@ -71286,7 +71686,7 @@ index 6105f47..3363489 100644 return 0; } diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index bf5b485..e44c2cb 100644 +index 1d771e4..f9a6808 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -619,6 +619,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, @@ -71317,7 +71717,7 @@ index bf5b485..e44c2cb 100644 } out: -@@ -1105,6 +1119,17 @@ static long do_mbind(unsigned long start, unsigned long len, +@@ -1125,6 +1139,17 @@ static long do_mbind(unsigned long start, unsigned long len, if (end < start) return -EINVAL; @@ -71335,17 +71735,17 @@ index bf5b485..e44c2cb 100644 if (end == start) return 0; -@@ -1328,8 +1353,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode, +@@ -1348,8 +1373,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode, */ tcred = __task_cred(task); - if (cred->euid != tcred->suid && cred->euid != tcred->uid && -- cred->uid != tcred->suid && cred->uid != tcred->uid && + if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) && +- !uid_eq(cred->uid, tcred->suid) && !uid_eq(cred->uid, tcred->uid) && - !capable(CAP_SYS_NICE)) { -+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) { ++ !uid_eq(cred->uid, tcred->suid) && !capable(CAP_SYS_NICE)) { rcu_read_unlock(); err = -EPERM; goto out_put; -@@ -1360,6 +1384,15 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode, +@@ -1380,6 +1404,15 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode, goto out; } @@ -71448,10 +71848,10 @@ index ef726e8..cd7f1ec 100644 capable(CAP_IPC_LOCK)) ret = do_mlockall(flags); diff --git a/mm/mmap.c b/mm/mmap.c -index 848ef52..d2b586c 100644 +index 3edfcdf..4a27ae9 100644 --- a/mm/mmap.c +++ b/mm/mmap.c -@@ -46,6 +46,16 @@ +@@ -47,6 +47,16 @@ #define arch_rebalance_pgtables(addr, len) (addr) #endif @@ -71468,7 +71868,7 @@ index 848ef52..d2b586c 100644 static void unmap_region(struct mm_struct *mm, struct vm_area_struct *vma, struct vm_area_struct *prev, unsigned long start, unsigned long end); -@@ -71,22 +81,32 @@ static void unmap_region(struct mm_struct *mm, +@@ -72,22 +82,32 @@ static void unmap_region(struct mm_struct *mm, * x: (no) no x: (no) yes x: (no) yes x: (yes) yes * */ @@ -71504,7 +71904,7 @@ index 848ef52..d2b586c 100644 /* * Make sure vm_committed_as in one cacheline and not cacheline shared with * other variables. It can be updated by several CPUs frequently. -@@ -228,6 +248,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma) +@@ -229,6 +249,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma) struct vm_area_struct *next = vma->vm_next; might_sleep(); @@ -71512,7 +71912,7 @@ index 848ef52..d2b586c 100644 if (vma->vm_ops && vma->vm_ops->close) vma->vm_ops->close(vma); if (vma->vm_file) { -@@ -274,6 +295,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) +@@ -275,6 +296,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) * not page aligned -Ram Gupta */ rlim = rlimit(RLIMIT_DATA); @@ -71520,7 +71920,7 @@ index 848ef52..d2b586c 100644 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) + (mm->end_data - mm->start_data) > rlim) goto out; -@@ -690,6 +712,12 @@ static int +@@ -708,6 +730,12 @@ static int can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags, struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff) { @@ -71533,7 +71933,7 @@ index 848ef52..d2b586c 100644 if (is_mergeable_vma(vma, file, vm_flags) && is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) { if (vma->vm_pgoff == vm_pgoff) -@@ -709,6 +737,12 @@ static int +@@ -727,6 +755,12 @@ static int can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags, struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff) { @@ -71546,7 +71946,7 @@ index 848ef52..d2b586c 100644 if (is_mergeable_vma(vma, file, vm_flags) && is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) { pgoff_t vm_pglen; -@@ -751,13 +785,20 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags, +@@ -769,13 +803,20 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags, struct vm_area_struct *vma_merge(struct mm_struct *mm, struct vm_area_struct *prev, unsigned long addr, unsigned long end, unsigned long vm_flags, @@ -71568,7 +71968,7 @@ index 848ef52..d2b586c 100644 /* * We later require that vma->vm_flags == vm_flags, * so this tests vma->vm_flags & VM_SPECIAL, too. -@@ -773,6 +814,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm, +@@ -791,6 +832,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm, if (next && next->vm_end == end) /* cases 6, 7, 8 */ next = next->vm_next; @@ -71584,7 +71984,7 @@ index 848ef52..d2b586c 100644 /* * Can it merge with the predecessor? */ -@@ -792,9 +842,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm, +@@ -810,9 +860,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm, /* cases 1, 6 */ err = vma_adjust(prev, prev->vm_start, next->vm_end, prev->vm_pgoff, NULL); @@ -71610,7 +72010,7 @@ index 848ef52..d2b586c 100644 if (err) return NULL; khugepaged_enter_vma_merge(prev); -@@ -808,12 +873,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm, +@@ -826,12 +891,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm, mpol_equal(policy, vma_policy(next)) && can_vma_merge_before(next, vm_flags, anon_vma, file, pgoff+pglen)) { @@ -71640,7 +72040,7 @@ index 848ef52..d2b586c 100644 if (err) return NULL; khugepaged_enter_vma_merge(area); -@@ -922,14 +1002,11 @@ none: +@@ -940,14 +1020,11 @@ none: void vm_stat_account(struct mm_struct *mm, unsigned long flags, struct file *file, long pages) { @@ -71656,7 +72056,7 @@ index 848ef52..d2b586c 100644 mm->stack_vm += pages; if (flags & (VM_RESERVED|VM_IO)) mm->reserved_vm += pages; -@@ -969,7 +1046,7 @@ static unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, +@@ -985,7 +1062,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, * (the exception is when the underlying filesystem is noexec * mounted, in which case we dont add PROT_EXEC.) */ @@ -71665,7 +72065,7 @@ index 848ef52..d2b586c 100644 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC))) prot |= PROT_EXEC; -@@ -995,7 +1072,7 @@ static unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, +@@ -1011,7 +1088,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, /* Obtain the address to map to. we verify (or select) it and ensure * that it represents a valid section of the address space. */ @@ -71674,7 +72074,7 @@ index 848ef52..d2b586c 100644 if (addr & ~PAGE_MASK) return addr; -@@ -1006,6 +1083,36 @@ static unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, +@@ -1022,6 +1099,36 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) | mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC; @@ -71711,7 +72111,7 @@ index 848ef52..d2b586c 100644 if (flags & MAP_LOCKED) if (!can_do_mlock()) return -EPERM; -@@ -1017,6 +1124,7 @@ static unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, +@@ -1033,6 +1140,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, locked += mm->locked_vm; lock_limit = rlimit(RLIMIT_MEMLOCK); lock_limit >>= PAGE_SHIFT; @@ -71719,9 +72119,9 @@ index 848ef52..d2b586c 100644 if (locked > lock_limit && !capable(CAP_IPC_LOCK)) return -EAGAIN; } -@@ -1087,6 +1195,9 @@ static unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, - if (error) - return error; +@@ -1099,6 +1207,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr, + } + } + if (!gr_acl_handle_mmap(file, prot)) + return -EACCES; @@ -71729,7 +72129,7 @@ index 848ef52..d2b586c 100644 return mmap_region(file, addr, len, flags, vm_flags, pgoff); } -@@ -1192,7 +1303,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma) +@@ -1175,7 +1286,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma) vm_flags_t vm_flags = vma->vm_flags; /* If it was private or non-writable, the write bit is already clear */ @@ -71738,7 +72138,7 @@ index 848ef52..d2b586c 100644 return 0; /* The backer wishes to know when pages are first written to? */ -@@ -1241,14 +1352,24 @@ unsigned long mmap_region(struct file *file, unsigned long addr, +@@ -1224,14 +1335,24 @@ unsigned long mmap_region(struct file *file, unsigned long addr, unsigned long charged = 0; struct inode *inode = file ? file->f_path.dentry->d_inode : NULL; @@ -71765,7 +72165,7 @@ index 848ef52..d2b586c 100644 } /* Check against address space limit. */ -@@ -1297,6 +1418,16 @@ munmap_back: +@@ -1280,6 +1401,16 @@ munmap_back: goto unacct_error; } @@ -71782,7 +72182,7 @@ index 848ef52..d2b586c 100644 vma->vm_mm = mm; vma->vm_start = addr; vma->vm_end = addr + len; -@@ -1321,6 +1452,19 @@ munmap_back: +@@ -1304,6 +1435,19 @@ munmap_back: error = file->f_op->mmap(file, vma); if (error) goto unmap_and_free_vma; @@ -71802,7 +72202,7 @@ index 848ef52..d2b586c 100644 if (vm_flags & VM_EXECUTABLE) added_exe_file_vma(mm); -@@ -1358,6 +1502,11 @@ munmap_back: +@@ -1341,6 +1485,11 @@ munmap_back: vma_link(mm, vma, prev, rb_link, rb_parent); file = vma->vm_file; @@ -71814,7 +72214,7 @@ index 848ef52..d2b586c 100644 /* Once vma denies write, undo our temporary denial count */ if (correct_wcount) atomic_inc(&inode->i_writecount); -@@ -1366,6 +1515,7 @@ out: +@@ -1349,6 +1498,7 @@ out: mm->total_vm += len >> PAGE_SHIFT; vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT); @@ -71822,7 +72222,7 @@ index 848ef52..d2b586c 100644 if (vm_flags & VM_LOCKED) { if (!mlock_vma_pages_range(vma, addr, addr + len)) mm->locked_vm += (len >> PAGE_SHIFT); -@@ -1383,6 +1533,12 @@ unmap_and_free_vma: +@@ -1371,6 +1521,12 @@ unmap_and_free_vma: unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end); charged = 0; free_vma: @@ -71835,7 +72235,7 @@ index 848ef52..d2b586c 100644 kmem_cache_free(vm_area_cachep, vma); unacct_error: if (charged) -@@ -1390,6 +1546,44 @@ unacct_error: +@@ -1378,6 +1534,44 @@ unacct_error: return error; } @@ -71880,7 +72280,7 @@ index 848ef52..d2b586c 100644 /* Get an address range which is currently unmapped. * For shmat() with addr=0. * -@@ -1416,18 +1610,23 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, +@@ -1404,18 +1598,23 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, if (flags & MAP_FIXED) return addr; @@ -71911,7 +72311,7 @@ index 848ef52..d2b586c 100644 } full_search: -@@ -1438,34 +1637,40 @@ full_search: +@@ -1426,34 +1625,40 @@ full_search: * Start a new search - just in case we missed * some holes. */ @@ -71963,7 +72363,7 @@ index 848ef52..d2b586c 100644 mm->free_area_cache = addr; } -@@ -1481,7 +1686,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, +@@ -1469,7 +1674,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, { struct vm_area_struct *vma; struct mm_struct *mm = current->mm; @@ -71972,7 +72372,7 @@ index 848ef52..d2b586c 100644 /* requested length too big for entire address space */ if (len > TASK_SIZE) -@@ -1490,13 +1695,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, +@@ -1478,13 +1683,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, if (flags & MAP_FIXED) return addr; @@ -71995,7 +72395,7 @@ index 848ef52..d2b586c 100644 } /* check if free_area_cache is useful for us */ -@@ -1520,7 +1730,7 @@ try_again: +@@ -1508,7 +1718,7 @@ try_again: * return with success: */ vma = find_vma(mm, addr); @@ -72004,7 +72404,7 @@ index 848ef52..d2b586c 100644 /* remember the address as a hint for next time */ return (mm->free_area_cache = addr); -@@ -1529,8 +1739,8 @@ try_again: +@@ -1517,8 +1727,8 @@ try_again: mm->cached_hole_size = vma->vm_start - addr; /* try just below the current vma->vm_start */ @@ -72015,7 +72415,7 @@ index 848ef52..d2b586c 100644 fail: /* -@@ -1553,13 +1763,21 @@ fail: +@@ -1541,13 +1751,21 @@ fail: * can happen with large stack limits and large mmap() * allocations. */ @@ -72039,7 +72439,7 @@ index 848ef52..d2b586c 100644 mm->cached_hole_size = ~0UL; return addr; -@@ -1568,6 +1786,12 @@ fail: +@@ -1556,6 +1774,12 @@ fail: void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr) { @@ -72052,7 +72452,7 @@ index 848ef52..d2b586c 100644 /* * Is this a new hole at the highest possible address? */ -@@ -1575,8 +1799,10 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr) +@@ -1563,8 +1787,10 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr) mm->free_area_cache = addr; /* dont allow allocations above current base */ @@ -72064,7 +72464,7 @@ index 848ef52..d2b586c 100644 } unsigned long -@@ -1672,6 +1898,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr, +@@ -1663,6 +1889,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr, return vma; } @@ -72093,7 +72493,7 @@ index 848ef52..d2b586c 100644 /* * Verify that the stack growth is acceptable and * update accounting. This is shared with both the -@@ -1688,6 +1936,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns +@@ -1679,6 +1927,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns return -ENOMEM; /* Stack limit test */ @@ -72101,7 +72501,7 @@ index 848ef52..d2b586c 100644 if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur)) return -ENOMEM; -@@ -1698,6 +1947,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns +@@ -1689,6 +1938,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns locked = mm->locked_vm + grow; limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur); limit >>= PAGE_SHIFT; @@ -72109,7 +72509,7 @@ index 848ef52..d2b586c 100644 if (locked > limit && !capable(CAP_IPC_LOCK)) return -ENOMEM; } -@@ -1728,37 +1978,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns +@@ -1719,37 +1969,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns * PA-RISC uses this for its stack; IA64 for its Register Backing Store. * vma is the last one with address > vma->vm_end. Have to extend vma. */ @@ -72167,7 +72567,7 @@ index 848ef52..d2b586c 100644 unsigned long size, grow; size = address - vma->vm_start; -@@ -1773,6 +2034,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address) +@@ -1764,6 +2025,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address) } } } @@ -72176,7 +72576,7 @@ index 848ef52..d2b586c 100644 vma_unlock_anon_vma(vma); khugepaged_enter_vma_merge(vma); return error; -@@ -1786,6 +2049,8 @@ int expand_downwards(struct vm_area_struct *vma, +@@ -1777,6 +2040,8 @@ int expand_downwards(struct vm_area_struct *vma, unsigned long address) { int error; @@ -72185,7 +72585,7 @@ index 848ef52..d2b586c 100644 /* * We must make sure the anon_vma is allocated -@@ -1799,6 +2064,15 @@ int expand_downwards(struct vm_area_struct *vma, +@@ -1790,6 +2055,15 @@ int expand_downwards(struct vm_area_struct *vma, if (error) return error; @@ -72201,7 +72601,7 @@ index 848ef52..d2b586c 100644 vma_lock_anon_vma(vma); /* -@@ -1808,9 +2082,17 @@ int expand_downwards(struct vm_area_struct *vma, +@@ -1799,9 +2073,17 @@ int expand_downwards(struct vm_area_struct *vma, */ /* Somebody else might have raced and expanded it already */ @@ -72220,7 +72620,7 @@ index 848ef52..d2b586c 100644 size = vma->vm_end - address; grow = (vma->vm_start - address) >> PAGE_SHIFT; -@@ -1820,11 +2102,22 @@ int expand_downwards(struct vm_area_struct *vma, +@@ -1811,11 +2093,22 @@ int expand_downwards(struct vm_area_struct *vma, if (!error) { vma->vm_start = address; vma->vm_pgoff -= grow; @@ -72243,7 +72643,7 @@ index 848ef52..d2b586c 100644 khugepaged_enter_vma_merge(vma); return error; } -@@ -1894,6 +2187,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma) +@@ -1887,6 +2180,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma) do { long nrpages = vma_pages(vma); @@ -72254,10 +72654,10 @@ index 848ef52..d2b586c 100644 + } +#endif + + if (vma->vm_flags & VM_ACCOUNT) + nr_accounted += nrpages; mm->total_vm -= nrpages; - vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages); - vma = remove_vma(vma); -@@ -1939,6 +2239,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -1933,6 +2233,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma, insertion_point = (prev ? &prev->vm_next : &mm->mmap); vma->vm_prev = NULL; do { @@ -72274,7 +72674,7 @@ index 848ef52..d2b586c 100644 rb_erase(&vma->vm_rb, &mm->mm_rb); mm->map_count--; tail_vma = vma; -@@ -1967,14 +2277,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma, +@@ -1961,14 +2271,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma, struct vm_area_struct *new; int err = -ENOMEM; @@ -72308,7 +72708,7 @@ index 848ef52..d2b586c 100644 /* most fields are the same, copy all, and then fixup */ *new = *vma; -@@ -1987,6 +2316,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma, +@@ -1981,6 +2310,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma, new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT); } @@ -72331,7 +72731,7 @@ index 848ef52..d2b586c 100644 pol = mpol_dup(vma_policy(vma)); if (IS_ERR(pol)) { err = PTR_ERR(pol); -@@ -2012,6 +2357,42 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma, +@@ -2006,6 +2351,42 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma, else err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new); @@ -72374,7 +72774,7 @@ index 848ef52..d2b586c 100644 /* Success. */ if (!err) return 0; -@@ -2024,10 +2405,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma, +@@ -2018,10 +2399,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma, removed_exe_file_vma(mm); fput(new->vm_file); } @@ -72394,7 +72794,7 @@ index 848ef52..d2b586c 100644 kmem_cache_free(vm_area_cachep, new); out_err: return err; -@@ -2040,6 +2429,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma, +@@ -2034,6 +2423,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma, int split_vma(struct mm_struct *mm, struct vm_area_struct *vma, unsigned long addr, int new_below) { @@ -72410,7 +72810,7 @@ index 848ef52..d2b586c 100644 if (mm->map_count >= sysctl_max_map_count) return -ENOMEM; -@@ -2051,11 +2449,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2045,11 +2443,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma, * work. This now handles partial unmappings. * Jeremy Fitzhardinge <jeremy@goop.org> */ @@ -72441,7 +72841,7 @@ index 848ef52..d2b586c 100644 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start) return -EINVAL; -@@ -2130,6 +2547,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len) +@@ -2124,6 +2541,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len) /* Fix up all other VM information */ remove_vma_list(mm, vma); @@ -72449,8 +72849,8 @@ index 848ef52..d2b586c 100644 + return 0; } - EXPORT_SYMBOL(do_munmap); -@@ -2139,6 +2558,13 @@ int vm_munmap(unsigned long start, size_t len) + +@@ -2132,6 +2551,13 @@ int vm_munmap(unsigned long start, size_t len) int ret; struct mm_struct *mm = current->mm; @@ -72464,7 +72864,7 @@ index 848ef52..d2b586c 100644 down_write(&mm->mmap_sem); ret = do_munmap(mm, start, len); up_write(&mm->mmap_sem); -@@ -2152,16 +2578,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len) +@@ -2145,16 +2571,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len) return vm_munmap(addr, len); } @@ -72481,7 +72881,7 @@ index 848ef52..d2b586c 100644 /* * this is really a simplified "do_mmap". it only handles * anonymous maps. eventually we may be able to do some -@@ -2175,6 +2591,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len) +@@ -2168,6 +2584,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len) struct rb_node ** rb_link, * rb_parent; pgoff_t pgoff = addr >> PAGE_SHIFT; int error; @@ -72489,7 +72889,7 @@ index 848ef52..d2b586c 100644 len = PAGE_ALIGN(len); if (!len) -@@ -2186,16 +2603,30 @@ static unsigned long do_brk(unsigned long addr, unsigned long len) +@@ -2175,16 +2592,30 @@ static unsigned long do_brk(unsigned long addr, unsigned long len) flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags; @@ -72521,7 +72921,7 @@ index 848ef52..d2b586c 100644 locked += mm->locked_vm; lock_limit = rlimit(RLIMIT_MEMLOCK); lock_limit >>= PAGE_SHIFT; -@@ -2212,22 +2643,22 @@ static unsigned long do_brk(unsigned long addr, unsigned long len) +@@ -2201,22 +2632,22 @@ static unsigned long do_brk(unsigned long addr, unsigned long len) /* * Clear old maps. this also does some error checking for us */ @@ -72549,7 +72949,7 @@ index 848ef52..d2b586c 100644 return -ENOMEM; /* Can we just expand an old private anonymous mapping? */ -@@ -2241,7 +2672,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len) +@@ -2230,7 +2661,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len) */ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); if (!vma) { @@ -72558,7 +72958,7 @@ index 848ef52..d2b586c 100644 return -ENOMEM; } -@@ -2255,11 +2686,12 @@ static unsigned long do_brk(unsigned long addr, unsigned long len) +@@ -2244,11 +2675,12 @@ static unsigned long do_brk(unsigned long addr, unsigned long len) vma_link(mm, vma, prev, rb_link, rb_parent); out: perf_event_mmap(vma); @@ -72573,19 +72973,15 @@ index 848ef52..d2b586c 100644 return addr; } -@@ -2315,8 +2747,10 @@ void exit_mmap(struct mm_struct *mm) - * Walk the list again, actually closing and freeing it, - * with preemption enabled, without holding any MM locks. - */ -- while (vma) -+ while (vma) { +@@ -2306,6 +2738,7 @@ void exit_mmap(struct mm_struct *mm) + while (vma) { + if (vma->vm_flags & VM_ACCOUNT) + nr_accounted += vma_pages(vma); + vma->vm_mirror = NULL; vma = remove_vma(vma); -+ } - - BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT); - } -@@ -2330,6 +2764,13 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma) + } + vm_unacct_memory(nr_accounted); +@@ -2322,6 +2755,13 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma) struct vm_area_struct * __vma, * prev; struct rb_node ** rb_link, * rb_parent; @@ -72593,17 +72989,16 @@ index 848ef52..d2b586c 100644 + struct vm_area_struct *vma_m = NULL; +#endif + -+ if (security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1)) ++ if (security_mmap_addr(vma->vm_start)) + return -EPERM; + /* * The vm_pgoff of a purely anonymous vma should be irrelevant * until its first write fault, when page's anon_vma and index -@@ -2352,7 +2793,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma) - if ((vma->vm_flags & VM_ACCOUNT) && - security_vm_enough_memory_mm(mm, vma_pages(vma))) - return -ENOMEM; -+ +@@ -2348,7 +2788,21 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma) + if (vma->vm_file && uprobe_mmap(vma)) + return -EINVAL; + +#ifdef CONFIG_PAX_SEGMEXEC + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) { + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL); @@ -72622,7 +73017,7 @@ index 848ef52..d2b586c 100644 return 0; } -@@ -2371,6 +2827,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, +@@ -2367,6 +2821,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, struct mempolicy *pol; bool faulted_in_anon_vma = true; @@ -72631,7 +73026,7 @@ index 848ef52..d2b586c 100644 /* * If anonymous vma has not yet been faulted, update new pgoff * to match new location, to increase its chance of merging. -@@ -2438,6 +2896,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, +@@ -2438,6 +2894,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, return NULL; } @@ -72671,7 +73066,7 @@ index 848ef52..d2b586c 100644 /* * Return true if the calling process may expand its vm space by the passed * number of pages -@@ -2449,6 +2940,12 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages) +@@ -2449,6 +2938,12 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages) lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT; @@ -72684,7 +73079,7 @@ index 848ef52..d2b586c 100644 if (cur + npages > lim) return 0; return 1; -@@ -2519,6 +3016,22 @@ int install_special_mapping(struct mm_struct *mm, +@@ -2519,6 +3014,22 @@ int install_special_mapping(struct mm_struct *mm, vma->vm_start = addr; vma->vm_end = addr + len; @@ -72939,7 +73334,7 @@ index a409926..8b32e6d 100644 if (nstart < prev->vm_end) diff --git a/mm/mremap.c b/mm/mremap.c -index db8d983..76506cb 100644 +index 21fed20..6822658 100644 --- a/mm/mremap.c +++ b/mm/mremap.c @@ -106,6 +106,12 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd, @@ -72997,16 +73392,16 @@ index db8d983..76506cb 100644 + if (addr + old_len > new_addr && new_addr + new_len > addr) goto out; - ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1); -@@ -440,6 +456,7 @@ unsigned long do_mremap(unsigned long addr, + ret = do_munmap(mm, new_addr, new_len); +@@ -436,6 +452,7 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len, struct vm_area_struct *vma; unsigned long ret = -EINVAL; unsigned long charged = 0; + unsigned long pax_task_size = TASK_SIZE; - if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE)) - goto out; -@@ -458,6 +475,17 @@ unsigned long do_mremap(unsigned long addr, + down_write(¤t->mm->mmap_sem); + +@@ -456,6 +473,17 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len, if (!new_len) goto out; @@ -73024,7 +73419,7 @@ index db8d983..76506cb 100644 if (flags & MREMAP_FIXED) { if (flags & MREMAP_MAYMOVE) ret = mremap_to(addr, old_len, new_addr, new_len); -@@ -507,6 +535,7 @@ unsigned long do_mremap(unsigned long addr, +@@ -505,6 +533,7 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len, addr + new_len); } ret = addr; @@ -73032,11 +73427,10 @@ index db8d983..76506cb 100644 goto out; } } -@@ -533,7 +562,13 @@ unsigned long do_mremap(unsigned long addr, - ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1); - if (ret) +@@ -528,7 +557,12 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len, goto out; -+ + } + + map_flags = vma->vm_flags; ret = move_vma(vma, addr, old_len, new_len, new_addr); + if (!(ret & ~PAGE_MASK)) { @@ -73047,7 +73441,7 @@ index db8d983..76506cb 100644 out: if (ret & ~PAGE_MASK) diff --git a/mm/nommu.c b/mm/nommu.c -index bb8f4f0..40d3e02 100644 +index d4b0c10..ed421b5 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -62,7 +62,6 @@ int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */ @@ -73074,7 +73468,7 @@ index bb8f4f0..40d3e02 100644 * expand a stack to a given address * - not supported under NOMMU conditions */ -@@ -1580,6 +1570,7 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -1551,6 +1541,7 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma, /* most fields are the same, copy all, and then fixup */ *new = *vma; @@ -73083,10 +73477,10 @@ index bb8f4f0..40d3e02 100644 new->vm_region = region; diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 918330f..ae99ae1 100644 +index 4a4f921..eaa5e3a 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c -@@ -335,7 +335,7 @@ out: +@@ -336,7 +336,7 @@ out: * This usage means that zero-order pages may not be compound. */ @@ -73095,7 +73489,7 @@ index 918330f..ae99ae1 100644 { __free_pages_ok(page, compound_order(page)); } -@@ -692,6 +692,10 @@ static bool free_pages_prepare(struct page *page, unsigned int order) +@@ -693,6 +693,10 @@ static bool free_pages_prepare(struct page *page, unsigned int order) int i; int bad = 0; @@ -73106,7 +73500,7 @@ index 918330f..ae99ae1 100644 trace_mm_page_free(page, order); kmemcheck_free_shadow(page, order); -@@ -707,6 +711,12 @@ static bool free_pages_prepare(struct page *page, unsigned int order) +@@ -708,6 +712,12 @@ static bool free_pages_prepare(struct page *page, unsigned int order) debug_check_no_obj_freed(page_address(page), PAGE_SIZE << order); } @@ -73119,7 +73513,7 @@ index 918330f..ae99ae1 100644 arch_free_page(page, order); kernel_map_pages(page, 1 << order, 0); -@@ -830,8 +840,10 @@ static int prep_new_page(struct page *page, int order, gfp_t gfp_flags) +@@ -849,8 +859,10 @@ static int prep_new_page(struct page *page, int order, gfp_t gfp_flags) arch_alloc_page(page, order); kernel_map_pages(page, 1 << order, 1); @@ -73130,7 +73524,7 @@ index 918330f..ae99ae1 100644 if (order && (gfp_flags & __GFP_COMP)) prep_compound_page(page, order); -@@ -3523,7 +3535,13 @@ static int pageblock_is_reserved(unsigned long start_pfn, unsigned long end_pfn) +@@ -3579,7 +3591,13 @@ static int pageblock_is_reserved(unsigned long start_pfn, unsigned long end_pfn) unsigned long pfn; for (pfn = start_pfn; pfn < end_pfn; pfn++) { @@ -73158,7 +73552,7 @@ index bb4be74..a43ea85 100644 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */ diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c -index c20ff48..137702a 100644 +index 926b466..b23df53 100644 --- a/mm/process_vm_access.c +++ b/mm/process_vm_access.c @@ -13,6 +13,7 @@ @@ -73209,7 +73603,7 @@ index c20ff48..137702a 100644 if (!mm || IS_ERR(mm)) { rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; diff --git a/mm/rmap.c b/mm/rmap.c -index 5b5ad58..0f77903 100644 +index 0f3b7cd..c5652b6 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -167,6 +167,10 @@ int anon_vma_prepare(struct vm_area_struct *vma) @@ -73299,7 +73693,7 @@ index 5b5ad58..0f77903 100644 struct anon_vma_chain *avc; struct anon_vma *anon_vma; diff --git a/mm/shmem.c b/mm/shmem.c -index 9d65a02..7c877e7 100644 +index bd10636..5c16d49 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -31,7 +31,7 @@ @@ -73311,7 +73705,7 @@ index 9d65a02..7c877e7 100644 #ifdef CONFIG_SHMEM /* -@@ -74,7 +74,7 @@ static struct vfsmount *shm_mnt; +@@ -75,7 +75,7 @@ static struct vfsmount *shm_mnt; #define BOGO_DIRENT_SIZE 20 /* Symlink up to this size is kmalloc'ed instead of using a swappable page */ @@ -73320,7 +73714,7 @@ index 9d65a02..7c877e7 100644 struct shmem_xattr { struct list_head list; /* anchored by shmem_inode_info->xattr_list */ -@@ -2236,8 +2236,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent) +@@ -2590,8 +2590,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent) int err = -ENOMEM; /* Round up to L1_CACHE_BYTES to resist false sharing */ @@ -73891,7 +74285,7 @@ index 8105be4..3c15e57 100644 EXPORT_SYMBOL(kmem_cache_free); diff --git a/mm/slub.c b/mm/slub.c -index 71de9b5..a93d4a4 100644 +index 8c691fa..ff23a85 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -209,7 +209,7 @@ struct track { @@ -74199,7 +74593,7 @@ index 1b7e22a..3fcd4f3 100644 return pgd; } diff --git a/mm/swap.c b/mm/swap.c -index 5c13f13..f1cfc13 100644 +index 4e7e2ec..0c57830 100644 --- a/mm/swap.c +++ b/mm/swap.c @@ -30,6 +30,7 @@ @@ -74210,7 +74604,7 @@ index 5c13f13..f1cfc13 100644 #include "internal.h" -@@ -70,6 +71,8 @@ static void __put_compound_page(struct page *page) +@@ -72,6 +73,8 @@ static void __put_compound_page(struct page *page) __page_cache_release(page); dtor = get_compound_page_dtor(page); @@ -74220,10 +74614,10 @@ index 5c13f13..f1cfc13 100644 } diff --git a/mm/swapfile.c b/mm/swapfile.c -index 38186d9..bfba6d3 100644 +index 71373d0..11fa7d9 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c -@@ -61,7 +61,7 @@ static DEFINE_MUTEX(swapon_mutex); +@@ -63,7 +63,7 @@ static DEFINE_MUTEX(swapon_mutex); static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait); /* Activity counter to indicate that a swapon or swapoff has occurred */ @@ -74232,7 +74626,7 @@ index 38186d9..bfba6d3 100644 static inline unsigned char swap_count(unsigned char ent) { -@@ -1671,7 +1671,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) +@@ -1663,7 +1663,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) } filp_close(swap_file, NULL); err = 0; @@ -74241,7 +74635,7 @@ index 38186d9..bfba6d3 100644 wake_up_interruptible(&proc_poll_wait); out_dput: -@@ -1687,8 +1687,8 @@ static unsigned swaps_poll(struct file *file, poll_table *wait) +@@ -1679,8 +1679,8 @@ static unsigned swaps_poll(struct file *file, poll_table *wait) poll_wait(file, &proc_poll_wait, wait); @@ -74252,7 +74646,7 @@ index 38186d9..bfba6d3 100644 return POLLIN | POLLRDNORM | POLLERR | POLLPRI; } -@@ -1786,7 +1786,7 @@ static int swaps_open(struct inode *inode, struct file *file) +@@ -1778,7 +1778,7 @@ static int swaps_open(struct inode *inode, struct file *file) return ret; seq = file->private_data; @@ -74261,8 +74655,8 @@ index 38186d9..bfba6d3 100644 return 0; } -@@ -2123,7 +2123,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags) - (p->flags & SWP_DISCARDABLE) ? "D" : ""); +@@ -2120,7 +2120,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags) + (frontswap_map) ? "FS" : ""); mutex_unlock(&swapon_mutex); - atomic_inc(&proc_poll_event); @@ -74271,10 +74665,10 @@ index 38186d9..bfba6d3 100644 if (S_ISREG(inode->i_mode)) diff --git a/mm/util.c b/mm/util.c -index ae962b3..0bba886 100644 +index 8c7265a..c96d884 100644 --- a/mm/util.c +++ b/mm/util.c -@@ -284,6 +284,12 @@ done: +@@ -285,6 +285,12 @@ done: void arch_pick_mmap_layout(struct mm_struct *mm) { mm->mmap_base = TASK_UNMAPPED_BASE; @@ -74288,7 +74682,7 @@ index ae962b3..0bba886 100644 mm->unmap_area = arch_unmap_area; } diff --git a/mm/vmalloc.c b/mm/vmalloc.c -index 1196c77..2e608e8 100644 +index 2aad499..2e608e8 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end) @@ -74487,19 +74881,8 @@ index 1196c77..2e608e8 100644 if ((PAGE_SIZE-1) & (unsigned long)addr) return -EINVAL; -@@ -2376,8 +2443,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets, - return NULL; - } - -- vms = kzalloc(sizeof(vms[0]) * nr_vms, GFP_KERNEL); -- vas = kzalloc(sizeof(vas[0]) * nr_vms, GFP_KERNEL); -+ vms = kcalloc(nr_vms, sizeof(vms[0]), GFP_KERNEL); -+ vas = kcalloc(nr_vms, sizeof(vas[0]), GFP_KERNEL); - if (!vas || !vms) - goto err_free2; - diff --git a/mm/vmstat.c b/mm/vmstat.c -index 7db1b9b..e9f6b07 100644 +index 1bbbbd9..ff35669 100644 --- a/mm/vmstat.c +++ b/mm/vmstat.c @@ -78,7 +78,7 @@ void vm_events_fold_cpu(int cpu) @@ -74529,7 +74912,7 @@ index 7db1b9b..e9f6b07 100644 } #endif -@@ -1208,10 +1208,20 @@ static int __init setup_vmstat(void) +@@ -1211,10 +1211,20 @@ static int __init setup_vmstat(void) start_cpu_timer(cpu); #endif #ifdef CONFIG_PROC_FS @@ -74555,10 +74938,10 @@ index 7db1b9b..e9f6b07 100644 return 0; } diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c -index efea35b..9c8dd0b 100644 +index 9096bcb..43ed7bb 100644 --- a/net/8021q/vlan.c +++ b/net/8021q/vlan.c -@@ -554,8 +554,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg) +@@ -557,8 +557,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg) err = -EPERM; if (!capable(CAP_NET_ADMIN)) break; @@ -74569,7 +74952,7 @@ index efea35b..9c8dd0b 100644 vn = net_generic(net, vlan_net_id); diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c -index fccae26..e7ece2f 100644 +index 6449bae..8c1f454 100644 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@ -425,7 +425,7 @@ static int p9_fd_write(struct p9_client *client, void *v, int len) @@ -74622,7 +75005,7 @@ index 876fbe8..8bbea9f 100644 #undef __HANDLE_ITEM } diff --git a/net/atm/lec.h b/net/atm/lec.h -index dfc0719..47c5322 100644 +index a86aff9..3a0d6f6 100644 --- a/net/atm/lec.h +++ b/net/atm/lec.h @@ -48,7 +48,7 @@ struct lane2_ops { @@ -74687,10 +75070,19 @@ index 23f45ce..c748f1a 100644 #undef __HANDLE_ITEM } diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c -index a6d5d63..1cc6c2b 100644 +index dc53798..dc66333 100644 --- a/net/batman-adv/bat_iv_ogm.c +++ b/net/batman-adv/bat_iv_ogm.c -@@ -539,7 +539,7 @@ static void bat_iv_ogm_schedule(struct hard_iface *hard_iface, +@@ -63,7 +63,7 @@ static int bat_iv_ogm_iface_enable(struct hard_iface *hard_iface) + + /* randomize initial seqno to avoid collision */ + get_random_bytes(&random_seqno, sizeof(random_seqno)); +- atomic_set(&hard_iface->seqno, random_seqno); ++ atomic_set_unchecked(&hard_iface->seqno, random_seqno); + + hard_iface->packet_len = BATMAN_OGM_HLEN; + hard_iface->packet_buff = kmalloc(hard_iface->packet_len, GFP_ATOMIC); +@@ -572,7 +572,7 @@ static void bat_iv_ogm_schedule(struct hard_iface *hard_iface, /* change sequence number to network order */ batman_ogm_packet->seqno = @@ -74699,7 +75091,7 @@ index a6d5d63..1cc6c2b 100644 batman_ogm_packet->ttvn = atomic_read(&bat_priv->ttvn); batman_ogm_packet->tt_crc = htons((uint16_t) -@@ -559,7 +559,7 @@ static void bat_iv_ogm_schedule(struct hard_iface *hard_iface, +@@ -592,7 +592,7 @@ static void bat_iv_ogm_schedule(struct hard_iface *hard_iface, else batman_ogm_packet->gw_flags = NO_FLAGS; @@ -74708,7 +75100,7 @@ index a6d5d63..1cc6c2b 100644 slide_own_bcast_window(hard_iface); bat_iv_ogm_queue_add(bat_priv, hard_iface->packet_buff, -@@ -917,7 +917,7 @@ static void bat_iv_ogm_process(const struct ethhdr *ethhdr, +@@ -956,7 +956,7 @@ static void bat_iv_ogm_process(const struct ethhdr *ethhdr, return; /* could be changed by schedule_own_packet() */ @@ -74718,25 +75110,32 @@ index a6d5d63..1cc6c2b 100644 has_directlink_flag = (batman_ogm_packet->flags & DIRECTLINK ? 1 : 0); diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c -index 3778977..f6a9450 100644 +index dc334fa..766a01a 100644 --- a/net/batman-adv/hard-interface.c +++ b/net/batman-adv/hard-interface.c -@@ -328,8 +328,8 @@ int hardif_enable_interface(struct hard_iface *hard_iface, +@@ -321,7 +321,7 @@ int hardif_enable_interface(struct hard_iface *hard_iface, hard_iface->batman_adv_ptype.dev = hard_iface->net_dev; dev_add_pack(&hard_iface->batman_adv_ptype); -- atomic_set(&hard_iface->seqno, 1); - atomic_set(&hard_iface->frag_seqno, 1); -+ atomic_set_unchecked(&hard_iface->seqno, 1); + atomic_set_unchecked(&hard_iface->frag_seqno, 1); bat_info(hard_iface->soft_iface, "Adding interface: %s\n", hard_iface->net_dev->name); +@@ -444,7 +444,7 @@ static struct hard_iface *hardif_add_interface(struct net_device *net_dev) + * This can't be called via a bat_priv callback because + * we have no bat_priv yet. + */ +- atomic_set(&hard_iface->seqno, 1); ++ atomic_set_unchecked(&hard_iface->seqno, 1); + hard_iface->packet_buff = NULL; + + return hard_iface; diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c -index a5590f4..8d31969 100644 +index a0ec0e4..7beb587 100644 --- a/net/batman-adv/soft-interface.c +++ b/net/batman-adv/soft-interface.c -@@ -645,7 +645,7 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface) +@@ -214,7 +214,7 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface) /* set broadcast sequence number */ bcast_packet->seqno = @@ -74745,7 +75144,7 @@ index a5590f4..8d31969 100644 add_bcast_packet_to_list(bat_priv, skb, 1); -@@ -841,7 +841,7 @@ struct net_device *softif_create(const char *name) +@@ -390,7 +390,7 @@ struct net_device *softif_create(const char *name) atomic_set(&bat_priv->batman_queue_left, BATMAN_QUEUE_LEN); atomic_set(&bat_priv->mesh_state, MESH_INACTIVE); @@ -74755,7 +75154,7 @@ index a5590f4..8d31969 100644 atomic_set(&bat_priv->tt_local_changes, 0); atomic_set(&bat_priv->tt_ogm_append_cnt, 0); diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h -index 302efb5..1590365 100644 +index 61308e8..2e142b2 100644 --- a/net/batman-adv/types.h +++ b/net/batman-adv/types.h @@ -38,8 +38,8 @@ struct hard_iface { @@ -74769,7 +75168,7 @@ index 302efb5..1590365 100644 unsigned char *packet_buff; int packet_len; struct kobject *hardif_obj; -@@ -155,7 +155,7 @@ struct bat_priv { +@@ -163,7 +163,7 @@ struct bat_priv { atomic_t orig_interval; /* uint */ atomic_t hop_penalty; /* uint */ atomic_t log_level; /* uint */ @@ -74779,7 +75178,7 @@ index 302efb5..1590365 100644 atomic_t batman_queue_left; atomic_t ttvn; /* translation table version number */ diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c -index 676f6a6..3b4e668 100644 +index 74175c2..32f8901 100644 --- a/net/batman-adv/unicast.c +++ b/net/batman-adv/unicast.c @@ -264,7 +264,7 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv, @@ -74791,24 +75190,11 @@ index 676f6a6..3b4e668 100644 frag1->seqno = htons(seqno - 1); frag2->seqno = htons(seqno); -diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c -index 5238b6b..c9798ce 100644 ---- a/net/bluetooth/hci_conn.c -+++ b/net/bluetooth/hci_conn.c -@@ -233,7 +233,7 @@ void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16]) - memset(&cp, 0, sizeof(cp)); - - cp.handle = cpu_to_le16(conn->handle); -- memcpy(cp.ltk, ltk, sizeof(ltk)); -+ memcpy(cp.ltk, ltk, sizeof(cp.ltk)); - - hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp); - } diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index 6f9c25b..d19fd66 100644 +index 4554e80..b778671 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c -@@ -2466,8 +2466,10 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, voi +@@ -2798,8 +2798,10 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, voi break; case L2CAP_CONF_RFC: @@ -74821,19 +75207,45 @@ index 6f9c25b..d19fd66 100644 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) && rfc.mode != chan->mode) -@@ -2585,8 +2587,10 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len) +diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c +index d1820ff..d414b0e 100644 +--- a/net/bluetooth/rfcomm/tty.c ++++ b/net/bluetooth/rfcomm/tty.c +@@ -314,7 +314,7 @@ static void rfcomm_dev_del(struct rfcomm_dev *dev) + BUG_ON(test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags)); + + spin_lock_irqsave(&dev->port.lock, flags); +- if (dev->port.count > 0) { ++ if (atomic_read(&dev->port.count) > 0) { + spin_unlock_irqrestore(&dev->port.lock, flags); + return; + } +@@ -669,10 +669,10 @@ static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp) + return -ENODEV; - switch (type) { - case L2CAP_CONF_RFC: -- if (olen == sizeof(rfc)) -- memcpy(&rfc, (void *)val, olen); -+ if (olen != sizeof(rfc)) -+ break; -+ -+ memcpy(&rfc, (void *)val, olen); - goto done; - } + BT_DBG("dev %p dst %s channel %d opened %d", dev, batostr(&dev->dst), +- dev->channel, dev->port.count); ++ dev->channel, atomic_read(&dev->port.count)); + + spin_lock_irqsave(&dev->port.lock, flags); +- if (++dev->port.count > 1) { ++ if (atomic_inc_return(&dev->port.count) > 1) { + spin_unlock_irqrestore(&dev->port.lock, flags); + return 0; } +@@ -737,10 +737,10 @@ static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp) + return; + + BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc, +- dev->port.count); ++ atomic_read(&dev->port.count)); + + spin_lock_irqsave(&dev->port.lock, flags); +- if (!--dev->port.count) { ++ if (!atomic_dec_return(&dev->port.count)) { + spin_unlock_irqrestore(&dev->port.lock, flags); + if (dev->tty_dev->parent) + device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST); diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c index 5fe2ff3..10968b5 100644 --- a/net/bridge/netfilter/ebtables.c @@ -74847,34 +75259,19 @@ index 5fe2ff3..10968b5 100644 BUGPRINT("c2u Didn't work\n"); ret = -EFAULT; break; -diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c -index aa6f716..7bf4c21 100644 ---- a/net/caif/caif_dev.c -+++ b/net/caif/caif_dev.c -@@ -562,9 +562,9 @@ static int __init caif_device_init(void) - - static void __exit caif_device_exit(void) - { -- unregister_pernet_subsys(&caif_net_ops); - unregister_netdevice_notifier(&caif_device_notifier); - dev_remove_pack(&caif_packet_type); -+ unregister_pernet_subsys(&caif_net_ops); - } - - module_init(caif_device_init); diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c -index 5cf5222..6f704ad 100644 +index 047cd0e..461fd28 100644 --- a/net/caif/cfctrl.c +++ b/net/caif/cfctrl.c -@@ -9,6 +9,7 @@ - #include <linux/stddef.h> +@@ -10,6 +10,7 @@ #include <linux/spinlock.h> #include <linux/slab.h> + #include <linux/pkt_sched.h> +#include <linux/sched.h> #include <net/caif/caif_layer.h> #include <net/caif/cfpkt.h> #include <net/caif/cfctrl.h> -@@ -42,8 +43,8 @@ struct cflayer *cfctrl_create(void) +@@ -43,8 +44,8 @@ struct cflayer *cfctrl_create(void) memset(&dev_info, 0, sizeof(dev_info)); dev_info.id = 0xff; cfsrvl_init(&this->serv, 0, &dev_info, false); @@ -74885,7 +75282,7 @@ index 5cf5222..6f704ad 100644 this->serv.layer.receive = cfctrl_recv; sprintf(this->serv.layer.name, "ctrl"); this->serv.layer.ctrlcmd = cfctrl_ctrlcmd; -@@ -129,8 +130,8 @@ static void cfctrl_insert_req(struct cfctrl *ctrl, +@@ -130,8 +131,8 @@ static void cfctrl_insert_req(struct cfctrl *ctrl, struct cfctrl_request_info *req) { spin_lock_bh(&ctrl->info_list_lock); @@ -74896,7 +75293,7 @@ index 5cf5222..6f704ad 100644 list_add_tail(&req->list, &ctrl->list); spin_unlock_bh(&ctrl->info_list_lock); } -@@ -148,7 +149,7 @@ static struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl, +@@ -149,7 +150,7 @@ static struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl, if (p != first) pr_warn("Requests are not received in order\n"); @@ -74906,7 +75303,7 @@ index 5cf5222..6f704ad 100644 list_del(&p->list); goto out; diff --git a/net/can/gw.c b/net/can/gw.c -index 3d79b12..8de85fa 100644 +index b41acf2..3affb3a 100644 --- a/net/can/gw.c +++ b/net/can/gw.c @@ -96,7 +96,7 @@ struct cf_mod { @@ -74919,7 +75316,7 @@ index 3d79b12..8de85fa 100644 diff --git a/net/compat.c b/net/compat.c -index e055708..3f80795 100644 +index 1b96281..a7e6c91 100644 --- a/net/compat.c +++ b/net/compat.c @@ -71,9 +71,9 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg) @@ -74995,7 +75392,7 @@ index e055708..3f80795 100644 int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int); int fdnum = scm->fp->count; struct file **fp = scm->fp->fp; -@@ -372,7 +372,7 @@ static int do_set_sock_timeout(struct socket *sock, int level, +@@ -364,7 +364,7 @@ static int do_set_sock_timeout(struct socket *sock, int level, return -EFAULT; old_fs = get_fs(); set_fs(KERNEL_DS); @@ -75004,7 +75401,7 @@ index e055708..3f80795 100644 set_fs(old_fs); return err; -@@ -433,7 +433,7 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname, +@@ -425,7 +425,7 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname, len = sizeof(ktime); old_fs = get_fs(); set_fs(KERNEL_DS); @@ -75013,7 +75410,7 @@ index e055708..3f80795 100644 set_fs(old_fs); if (!err) { -@@ -576,7 +576,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname, +@@ -568,7 +568,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname, case MCAST_JOIN_GROUP: case MCAST_LEAVE_GROUP: { @@ -75022,7 +75419,7 @@ index e055708..3f80795 100644 struct group_req __user *kgr = compat_alloc_user_space(sizeof(struct group_req)); u32 interface; -@@ -597,7 +597,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname, +@@ -589,7 +589,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname, case MCAST_BLOCK_SOURCE: case MCAST_UNBLOCK_SOURCE: { @@ -75031,7 +75428,7 @@ index e055708..3f80795 100644 struct group_source_req __user *kgsr = compat_alloc_user_space( sizeof(struct group_source_req)); u32 interface; -@@ -618,7 +618,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname, +@@ -610,7 +610,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname, } case MCAST_MSFILTER: { @@ -75040,7 +75437,7 @@ index e055708..3f80795 100644 struct group_filter __user *kgf; u32 interface, fmode, numsrc; -@@ -656,7 +656,7 @@ int compat_mc_getsockopt(struct sock *sock, int level, int optname, +@@ -648,7 +648,7 @@ int compat_mc_getsockopt(struct sock *sock, int level, int optname, char __user *optval, int __user *optlen, int (*getsockopt)(struct sock *, int, int, char __user *, int __user *)) { @@ -75050,7 +75447,7 @@ index e055708..3f80795 100644 int __user *koptlen; u32 interface, fmode, numsrc; diff --git a/net/core/datagram.c b/net/core/datagram.c -index e4fbfd6..6a6ac94 100644 +index ae6acf6..d5c8f66 100644 --- a/net/core/datagram.c +++ b/net/core/datagram.c @@ -290,7 +290,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags) @@ -75063,10 +75460,10 @@ index e4fbfd6..6a6ac94 100644 return err; diff --git a/net/core/dev.c b/net/core/dev.c -index 533c586..f78a55f 100644 +index 1cb0d8a..0427dd9 100644 --- a/net/core/dev.c +++ b/net/core/dev.c -@@ -1136,9 +1136,13 @@ void dev_load(struct net *net, const char *name) +@@ -1135,9 +1135,13 @@ void dev_load(struct net *net, const char *name) if (no_module && capable(CAP_NET_ADMIN)) no_module = request_module("netdev-%s", name); if (no_module && capable(CAP_SYS_MODULE)) { @@ -75074,13 +75471,13 @@ index 533c586..f78a55f 100644 + ___request_module(true, "grsec_modharden_netdev", "%s", name); +#else if (!request_module("%s", name)) - pr_err("Loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s instead.\n", - name); + pr_warn("Loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s instead.\n", + name); +#endif } } EXPORT_SYMBOL(dev_load); -@@ -1602,7 +1606,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb) +@@ -1601,7 +1605,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb) { if (skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY) { if (skb_copy_ubufs(skb, GFP_ATOMIC)) { @@ -75089,7 +75486,7 @@ index 533c586..f78a55f 100644 kfree_skb(skb); return NET_RX_DROP; } -@@ -1612,7 +1616,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb) +@@ -1611,7 +1615,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb) nf_reset(skb); if (unlikely(!is_skb_forwardable(dev, skb))) { @@ -75098,7 +75495,7 @@ index 533c586..f78a55f 100644 kfree_skb(skb); return NET_RX_DROP; } -@@ -2042,7 +2046,7 @@ static int illegal_highdma(struct net_device *dev, struct sk_buff *skb) +@@ -2040,7 +2044,7 @@ static int illegal_highdma(struct net_device *dev, struct sk_buff *skb) struct dev_gso_cb { void (*destructor)(struct sk_buff *skb); @@ -75107,7 +75504,7 @@ index 533c586..f78a55f 100644 #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb) -@@ -2877,7 +2881,7 @@ enqueue: +@@ -2875,7 +2879,7 @@ enqueue: local_irq_restore(flags); @@ -75116,7 +75513,7 @@ index 533c586..f78a55f 100644 kfree_skb(skb); return NET_RX_DROP; } -@@ -2949,7 +2953,7 @@ int netif_rx_ni(struct sk_buff *skb) +@@ -2947,7 +2951,7 @@ int netif_rx_ni(struct sk_buff *skb) } EXPORT_SYMBOL(netif_rx_ni); @@ -75125,7 +75522,7 @@ index 533c586..f78a55f 100644 { struct softnet_data *sd = &__get_cpu_var(softnet_data); -@@ -3237,7 +3241,7 @@ ncls: +@@ -3234,7 +3238,7 @@ ncls: if (pt_prev) { ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev); } else { @@ -75134,7 +75531,7 @@ index 533c586..f78a55f 100644 kfree_skb(skb); /* Jamal, now you will not able to escape explaining * me how you were going to use this. :-) -@@ -3797,7 +3801,7 @@ void netif_napi_del(struct napi_struct *napi) +@@ -3799,7 +3803,7 @@ void netif_napi_del(struct napi_struct *napi) } EXPORT_SYMBOL(netif_napi_del); @@ -75143,7 +75540,7 @@ index 533c586..f78a55f 100644 { struct softnet_data *sd = &__get_cpu_var(softnet_data); unsigned long time_limit = jiffies + 2; -@@ -4267,8 +4271,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v) +@@ -4269,8 +4273,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v) else seq_printf(seq, "%04x", ntohs(pt->type)); @@ -75157,7 +75554,7 @@ index 533c586..f78a55f 100644 } return 0; -@@ -5818,7 +5827,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev, +@@ -5820,7 +5829,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev, } else { netdev_stats_to_stats64(storage, &dev->stats); } @@ -75229,10 +75626,10 @@ index 7e7aeb0..2a998cb 100644 m->msg_iov = iov; diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 90430b7..0032ec0 100644 +index 21318d1..7f105e4 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c -@@ -56,7 +56,7 @@ struct rtnl_link { +@@ -58,7 +58,7 @@ struct rtnl_link { rtnl_doit_func doit; rtnl_dumpit_func dumpit; rtnl_calcit_func calcit; @@ -75282,10 +75679,10 @@ index 611c5ef..88f6d6d 100644 { int new_fd; diff --git a/net/core/sock.c b/net/core/sock.c -index 0f8402e..f0b6338 100644 +index 9e5b71f..66dec30 100644 --- a/net/core/sock.c +++ b/net/core/sock.c -@@ -340,7 +340,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) +@@ -344,7 +344,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) struct sk_buff_head *list = &sk->sk_receive_queue; if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) { @@ -75294,7 +75691,7 @@ index 0f8402e..f0b6338 100644 trace_sock_rcvqueue_full(sk, skb); return -ENOMEM; } -@@ -350,7 +350,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) +@@ -354,7 +354,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) return err; if (!sk_rmem_schedule(sk, skb->truesize)) { @@ -75303,7 +75700,7 @@ index 0f8402e..f0b6338 100644 return -ENOBUFS; } -@@ -370,7 +370,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) +@@ -374,7 +374,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) skb_dst_force(skb); spin_lock_irqsave(&list->lock, flags); @@ -75312,25 +75709,25 @@ index 0f8402e..f0b6338 100644 __skb_queue_tail(list, skb); spin_unlock_irqrestore(&list->lock, flags); -@@ -390,7 +390,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested) +@@ -394,7 +394,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested) skb->dev = NULL; - if (sk_rcvqueues_full(sk, skb)) { + if (sk_rcvqueues_full(sk, skb, sk->sk_rcvbuf)) { - atomic_inc(&sk->sk_drops); + atomic_inc_unchecked(&sk->sk_drops); goto discard_and_relse; } if (nested) -@@ -408,7 +408,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested) +@@ -412,7 +412,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested) mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_); - } else if (sk_add_backlog(sk, skb)) { + } else if (sk_add_backlog(sk, skb, sk->sk_rcvbuf)) { bh_unlock_sock(sk); - atomic_inc(&sk->sk_drops); + atomic_inc_unchecked(&sk->sk_drops); goto discard_and_relse; } -@@ -984,7 +984,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname, +@@ -976,7 +976,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname, if (len > sizeof(peercred)) len = sizeof(peercred); cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred); @@ -75339,7 +75736,7 @@ index 0f8402e..f0b6338 100644 return -EFAULT; goto lenout; } -@@ -997,7 +997,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname, +@@ -989,7 +989,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname, return -ENOTCONN; if (lv < len) return -EINVAL; @@ -75348,7 +75745,7 @@ index 0f8402e..f0b6338 100644 return -EFAULT; goto lenout; } -@@ -1043,7 +1043,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname, +@@ -1035,7 +1035,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname, if (len > lv) len = lv; @@ -75357,7 +75754,7 @@ index 0f8402e..f0b6338 100644 return -EFAULT; lenout: if (put_user(len, optlen)) -@@ -2131,7 +2131,7 @@ void sock_init_data(struct socket *sock, struct sock *sk) +@@ -2124,7 +2124,7 @@ void sock_init_data(struct socket *sock, struct sock *sk) */ smp_wmb(); atomic_set(&sk->sk_refcnt, 1); @@ -75367,7 +75764,7 @@ index 0f8402e..f0b6338 100644 EXPORT_SYMBOL(sock_init_data); diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c -index b9868e1..849f809 100644 +index 5fd1467..8b70900 100644 --- a/net/core/sock_diag.c +++ b/net/core/sock_diag.c @@ -16,20 +16,27 @@ static DEFINE_MUTEX(sock_diag_table_mutex); @@ -75399,7 +75796,7 @@ index b9868e1..849f809 100644 EXPORT_SYMBOL_GPL(sock_diag_save_cookie); diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c -index 02e75d1..9a57a7c 100644 +index a55eecc..dd8428c 100644 --- a/net/decnet/sysctl_net_decnet.c +++ b/net/decnet/sysctl_net_decnet.c @@ -174,7 +174,7 @@ static int dn_node_address_handler(ctl_table *table, int write, @@ -75420,38 +75817,8 @@ index 02e75d1..9a57a7c 100644 return -EFAULT; *lenp = len; -diff --git a/net/econet/Kconfig b/net/econet/Kconfig -index 39a2d29..f39c0fe 100644 ---- a/net/econet/Kconfig -+++ b/net/econet/Kconfig -@@ -4,7 +4,7 @@ - - config ECONET - tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)" -- depends on EXPERIMENTAL && INET -+ depends on EXPERIMENTAL && INET && BROKEN - ---help--- - Econet is a fairly old and slow networking protocol mainly used by - Acorn computers to access file and print servers. It uses native -diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c -index c48adc5..667c1d4 100644 ---- a/net/ipv4/cipso_ipv4.c -+++ b/net/ipv4/cipso_ipv4.c -@@ -1725,8 +1725,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option) - case CIPSO_V4_TAG_LOCAL: - /* This is a non-standard tag that we only allow for - * local connections, so if the incoming interface is -- * not the loopback device drop the packet. */ -- if (!(skb->dev->flags & IFF_LOOPBACK)) { -+ * not the loopback device drop the packet. Further, -+ * there is no legitimate reason for setting this from -+ * userspace so reject it if skb is NULL. */ -+ if (skb == NULL || !(skb->dev->flags & IFF_LOOPBACK)) { - err_offset = opt_iter; - goto validate_return_locked; - } diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c -index cbe3a68..a879b75 100644 +index 3854411..2201a94 100644 --- a/net/ipv4/fib_frontend.c +++ b/net/ipv4/fib_frontend.c @@ -969,12 +969,12 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event, @@ -75479,7 +75846,7 @@ index cbe3a68..a879b75 100644 break; case NETDEV_DOWN: diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c -index 8861f91..ab1e3c1 100644 +index e5b7182..570a90e 100644 --- a/net/ipv4/fib_semantics.c +++ b/net/ipv4/fib_semantics.c @@ -698,7 +698,7 @@ __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh) @@ -75492,7 +75859,7 @@ index 8861f91..ab1e3c1 100644 return nh->nh_saddr; } diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c -index 984ec65..97ac518 100644 +index 7880af9..70f92a3 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -18,12 +18,15 @@ @@ -75536,7 +75903,7 @@ index dfba343..c827d50 100644 secure_ip_id(daddr->addr.a4) : secure_ipv6_id(daddr->addr.a6)); diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c -index 3727e23..517f5df 100644 +index 9dbd3dd..0c59fb2 100644 --- a/net/ipv4/ip_fragment.c +++ b/net/ipv4/ip_fragment.c @@ -318,7 +318,7 @@ static inline int ip_frag_too_far(struct ipq *qp) @@ -75549,10 +75916,10 @@ index 3727e23..517f5df 100644 rc = qp->q.fragments && (end - start) > max; diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c -index 2fd0fba..83fac99 100644 +index 0d11f23..2bb3f64 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c -@@ -1137,7 +1137,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname, +@@ -1142,7 +1142,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname, len = min_t(unsigned int, len, opt->optlen); if (put_user(len, optlen)) return -EFAULT; @@ -75562,7 +75929,7 @@ index 2fd0fba..83fac99 100644 return -EFAULT; return 0; } -@@ -1268,7 +1269,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname, +@@ -1273,7 +1274,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname, if (sk->sk_type != SOCK_STREAM) return -ENOPROTOOPT; @@ -75572,7 +75939,7 @@ index 2fd0fba..83fac99 100644 msg.msg_flags = flags; diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c -index 92ac7e7..13f93d9 100644 +index 67e8a6b..386764d 100644 --- a/net/ipv4/ipconfig.c +++ b/net/ipv4/ipconfig.c @@ -321,7 +321,7 @@ static int __init ic_devinet_ioctl(unsigned int cmd, struct ifreq *arg) @@ -75603,10 +75970,10 @@ index 92ac7e7..13f93d9 100644 return res; } diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c -index 50009c7..5996a9f 100644 +index 2c00e8b..45b3bdd 100644 --- a/net/ipv4/ping.c +++ b/net/ipv4/ping.c -@@ -838,7 +838,7 @@ static void ping_format_sock(struct sock *sp, struct seq_file *f, +@@ -845,7 +845,7 @@ static void ping_format_sock(struct sock *sp, struct seq_file *f, sk_rmem_alloc_get(sp), 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp), atomic_read(&sp->sk_refcnt), sp, @@ -75616,10 +75983,10 @@ index 50009c7..5996a9f 100644 static int ping_seq_show(struct seq_file *seq, void *v) diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c -index bbd604c..4d5469c 100644 +index 4032b81..625143c 100644 --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c -@@ -304,7 +304,7 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb) +@@ -304,7 +304,7 @@ static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb) int raw_rcv(struct sock *sk, struct sk_buff *skb) { if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) { @@ -75677,10 +76044,10 @@ index bbd604c..4d5469c 100644 static int raw_seq_show(struct seq_file *seq, void *v) diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 167ea10..4b15883 100644 +index 98b30d0..cfa3cf7 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c -@@ -312,7 +312,7 @@ static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx, +@@ -313,7 +313,7 @@ static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx, static inline int rt_genid(struct net *net) { @@ -75689,7 +76056,7 @@ index 167ea10..4b15883 100644 } #ifdef CONFIG_PROC_FS -@@ -936,7 +936,7 @@ static void rt_cache_invalidate(struct net *net) +@@ -937,7 +937,7 @@ static void rt_cache_invalidate(struct net *net) unsigned char shuffle; get_random_bytes(&shuffle, sizeof(shuffle)); @@ -75698,7 +76065,7 @@ index 167ea10..4b15883 100644 inetpeer_invalidate_tree(AF_INET); } -@@ -3009,7 +3009,7 @@ static int rt_fill_info(struct net *net, +@@ -3011,7 +3011,7 @@ static int rt_fill_info(struct net *net, error = rt->dst.error; if (peer) { inet_peer_refcheck(rt->peer); @@ -75708,7 +76075,7 @@ index 167ea10..4b15883 100644 ts = peer->tcp_ts; tsage = get_seconds() - peer->tcp_ts_stamp; diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index 0cb86ce..8e7fda8 100644 +index c8d28c4..e40f75a 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -90,6 +90,10 @@ int sysctl_tcp_low_latency __read_mostly; @@ -75722,7 +76089,7 @@ index 0cb86ce..8e7fda8 100644 #ifdef CONFIG_TCP_MD5SIG static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key, __be32 daddr, __be32 saddr, const struct tcphdr *th); -@@ -1641,6 +1645,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb) +@@ -1656,6 +1660,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb) return 0; reset: @@ -75732,7 +76099,7 @@ index 0cb86ce..8e7fda8 100644 tcp_v4_send_reset(rsk, skb); discard: kfree_skb(skb); -@@ -1703,12 +1710,19 @@ int tcp_v4_rcv(struct sk_buff *skb) +@@ -1718,12 +1725,19 @@ int tcp_v4_rcv(struct sk_buff *skb) TCP_SKB_CB(skb)->sacked = 0; sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest); @@ -75755,7 +76122,7 @@ index 0cb86ce..8e7fda8 100644 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) { NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP); -@@ -1758,6 +1772,10 @@ no_tcp_socket: +@@ -1774,6 +1788,10 @@ no_tcp_socket: bad_packet: TCP_INC_STATS_BH(net, TCP_MIB_INERRS); } else { @@ -75766,7 +76133,7 @@ index 0cb86ce..8e7fda8 100644 tcp_v4_send_reset(NULL, skb); } -@@ -2419,7 +2437,11 @@ static void get_openreq4(const struct sock *sk, const struct request_sock *req, +@@ -2386,7 +2404,11 @@ static void get_openreq4(const struct sock *sk, const struct request_sock *req, 0, /* non standard timer */ 0, /* open_requests have no inode */ atomic_read(&sk->sk_refcnt), @@ -75778,7 +76145,7 @@ index 0cb86ce..8e7fda8 100644 len); } -@@ -2469,7 +2491,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len) +@@ -2436,7 +2458,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len) sock_i_uid(sk), icsk->icsk_probes_out, sock_i_ino(sk), @@ -75792,7 +76159,7 @@ index 0cb86ce..8e7fda8 100644 jiffies_to_clock_t(icsk->icsk_rto), jiffies_to_clock_t(icsk->icsk_ack.ato), (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong, -@@ -2497,7 +2524,13 @@ static void get_timewait4_sock(const struct inet_timewait_sock *tw, +@@ -2464,7 +2491,13 @@ static void get_timewait4_sock(const struct inet_timewait_sock *tw, " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n", i, src, srcp, dest, destp, tw->tw_substate, 0, 0, 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0, @@ -75808,7 +76175,7 @@ index 0cb86ce..8e7fda8 100644 #define TMPSZ 150 diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c -index 3cabafb..640525b 100644 +index b85d9fe..4b0eed9 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -27,6 +27,10 @@ @@ -75822,7 +76189,7 @@ index 3cabafb..640525b 100644 int sysctl_tcp_syncookies __read_mostly = 1; EXPORT_SYMBOL(sysctl_tcp_syncookies); -@@ -753,6 +757,10 @@ listen_overflow: +@@ -754,6 +758,10 @@ listen_overflow: embryonic_reset: NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS); @@ -75834,7 +76201,7 @@ index 3cabafb..640525b 100644 req->rsk_ops->send_reset(sk, skb); diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c -index a981cdc..48f4c3a 100644 +index 4526fe6..1a34e43 100644 --- a/net/ipv4/tcp_probe.c +++ b/net/ipv4/tcp_probe.c @@ -204,7 +204,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf, @@ -75847,7 +76214,7 @@ index a981cdc..48f4c3a 100644 cnt += width; } diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c -index 34d4a02..3b57f86 100644 +index e911e6c..d0a9356 100644 --- a/net/ipv4/tcp_timer.c +++ b/net/ipv4/tcp_timer.c @@ -22,6 +22,10 @@ @@ -75876,7 +76243,7 @@ index 34d4a02..3b57f86 100644 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) { /* Has it gone just too far? */ diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index fe14105..0618260 100644 +index eaca736..60488ae 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -87,6 +87,7 @@ @@ -75887,8 +76254,8 @@ index fe14105..0618260 100644 #include <linux/socket.h> #include <linux/sockios.h> #include <linux/igmp.h> -@@ -109,6 +110,10 @@ - #include <trace/events/udp.h> +@@ -110,6 +111,10 @@ + #include <linux/static_key.h> #include "udp_impl.h" +#ifdef CONFIG_GRKERNSEC_BLACKHOLE @@ -75898,7 +76265,7 @@ index fe14105..0618260 100644 struct udp_table udp_table __read_mostly; EXPORT_SYMBOL(udp_table); -@@ -567,6 +572,9 @@ found: +@@ -568,6 +573,9 @@ found: return s; } @@ -75908,7 +76275,7 @@ index fe14105..0618260 100644 /* * This routine is called by the ICMP module when it gets some * sort of error condition. If err < 0 then the socket should -@@ -858,9 +866,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, +@@ -859,9 +867,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, dport = usin->sin_port; if (dport == 0) return -EINVAL; @@ -75927,7 +76294,7 @@ index fe14105..0618260 100644 daddr = inet->inet_daddr; dport = inet->inet_dport; /* Open fast path for connected socket. -@@ -1102,7 +1119,7 @@ static unsigned int first_packet_length(struct sock *sk) +@@ -1103,7 +1120,7 @@ static unsigned int first_packet_length(struct sock *sk) udp_lib_checksum_complete(skb)) { UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, IS_UDPLITE(sk)); @@ -75936,7 +76303,7 @@ index fe14105..0618260 100644 __skb_unlink(skb, rcvq); __skb_queue_tail(&list_kill, skb); } -@@ -1188,6 +1205,10 @@ try_again: +@@ -1189,6 +1206,10 @@ try_again: if (!skb) goto out; @@ -75947,7 +76314,7 @@ index fe14105..0618260 100644 ulen = skb->len - sizeof(struct udphdr); copied = len; if (copied > ulen) -@@ -1489,7 +1510,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) +@@ -1498,7 +1519,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) drop: UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite); @@ -75956,7 +76323,7 @@ index fe14105..0618260 100644 kfree_skb(skb); return -1; } -@@ -1508,7 +1529,7 @@ static void flush_stack(struct sock **stack, unsigned int count, +@@ -1517,7 +1538,7 @@ static void flush_stack(struct sock **stack, unsigned int count, skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC); if (!skb1) { @@ -75965,7 +76332,7 @@ index fe14105..0618260 100644 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk)); UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, -@@ -1677,6 +1698,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, +@@ -1686,6 +1707,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, goto csum_error; UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE); @@ -75975,7 +76342,7 @@ index fe14105..0618260 100644 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0); /* -@@ -2094,8 +2118,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f, +@@ -2104,8 +2128,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f, sk_wmem_alloc_get(sp), sk_rmem_alloc_get(sp), 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp), @@ -75992,10 +76359,10 @@ index fe14105..0618260 100644 int udp4_seq_show(struct seq_file *seq, void *v) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 7d5cb97..c56564f 100644 +index 8f6411c..5767579 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c -@@ -2142,7 +2142,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg) +@@ -2145,7 +2145,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg) p.iph.ihl = 5; p.iph.protocol = IPPROTO_IPV6; p.iph.ttl = 64; @@ -76005,7 +76372,7 @@ index 7d5cb97..c56564f 100644 if (ops->ndo_do_ioctl) { mm_segment_t oldfs = get_fs(); diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c -index 02dd203..e03fcc9 100644 +index e6cee52..cf47476 100644 --- a/net/ipv6/inet6_connection_sock.c +++ b/net/ipv6/inet6_connection_sock.c @@ -178,7 +178,7 @@ void __inet6_csk_dst_store(struct sock *sk, struct dst_entry *dst, @@ -76027,10 +76394,10 @@ index 02dd203..e03fcc9 100644 dst = NULL; } diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c -index 63dd1f8..e7f53ca 100644 +index ba6d13d..6899122 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c -@@ -990,7 +990,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname, +@@ -989,7 +989,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname, if (sk->sk_type != SOCK_STREAM) return -ENOPROTOOPT; @@ -76040,7 +76407,7 @@ index 63dd1f8..e7f53ca 100644 msg.msg_flags = flags; diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c -index 5bddea7..82d9d67 100644 +index 93d6983..8e54c4d 100644 --- a/net/ipv6/raw.c +++ b/net/ipv6/raw.c @@ -377,7 +377,7 @@ static inline int rawv6_rcv_skb(struct sock *sk, struct sk_buff *skb) @@ -76130,7 +76497,7 @@ index 5bddea7..82d9d67 100644 static int raw6_seq_show(struct seq_file *seq, void *v) diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 98256cf..7f16dbd 100644 +index 9df64a5..39875da 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -94,6 +94,10 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk, @@ -76144,7 +76511,7 @@ index 98256cf..7f16dbd 100644 static void tcp_v6_hash(struct sock *sk) { if (sk->sk_state != TCP_CLOSE) { -@@ -1542,6 +1546,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) +@@ -1544,6 +1548,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) return 0; reset: @@ -76154,7 +76521,7 @@ index 98256cf..7f16dbd 100644 tcp_v6_send_reset(sk, skb); discard: if (opt_skb) -@@ -1623,12 +1630,20 @@ static int tcp_v6_rcv(struct sk_buff *skb) +@@ -1625,12 +1632,20 @@ static int tcp_v6_rcv(struct sk_buff *skb) TCP_SKB_CB(skb)->sacked = 0; sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest); @@ -76177,7 +76544,7 @@ index 98256cf..7f16dbd 100644 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) { NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP); -@@ -1676,6 +1691,10 @@ no_tcp_socket: +@@ -1679,6 +1694,10 @@ no_tcp_socket: bad_packet: TCP_INC_STATS_BH(net, TCP_MIB_INERRS); } else { @@ -76188,7 +76555,7 @@ index 98256cf..7f16dbd 100644 tcp_v6_send_reset(NULL, skb); } -@@ -1930,7 +1949,13 @@ static void get_openreq6(struct seq_file *seq, +@@ -1885,7 +1904,13 @@ static void get_openreq6(struct seq_file *seq, uid, 0, /* non standard timer */ 0, /* open_requests have no inode */ @@ -76203,7 +76570,7 @@ index 98256cf..7f16dbd 100644 } static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i) -@@ -1980,7 +2005,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i) +@@ -1935,7 +1960,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i) sock_i_uid(sp), icsk->icsk_probes_out, sock_i_ino(sp), @@ -76217,7 +76584,7 @@ index 98256cf..7f16dbd 100644 jiffies_to_clock_t(icsk->icsk_rto), jiffies_to_clock_t(icsk->icsk_ack.ato), (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong, -@@ -2015,7 +2045,13 @@ static void get_timewait6_sock(struct seq_file *seq, +@@ -1970,7 +2000,13 @@ static void get_timewait6_sock(struct seq_file *seq, dest->s6_addr32[2], dest->s6_addr32[3], destp, tw->tw_substate, 0, 0, 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0, @@ -76233,7 +76600,7 @@ index 98256cf..7f16dbd 100644 static int tcp6_seq_show(struct seq_file *seq, void *v) diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 37b0699..d323408 100644 +index f05099f..ea613f0 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -50,6 +50,10 @@ @@ -76247,44 +76614,35 @@ index 37b0699..d323408 100644 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2) { const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr; -@@ -551,7 +555,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb) - - return 0; +@@ -615,7 +619,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) + return rc; drop: + UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite); - atomic_inc(&sk->sk_drops); + atomic_inc_unchecked(&sk->sk_drops); - drop_no_sk_drops_inc: - UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite); kfree_skb(skb); -@@ -627,7 +631,7 @@ static void flush_stack(struct sock **stack, unsigned int count, - continue; - } - drop: -- atomic_inc(&sk->sk_drops); -+ atomic_inc_unchecked(&sk->sk_drops); - UDP6_INC_STATS_BH(sock_net(sk), - UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk)); - UDP6_INC_STATS_BH(sock_net(sk), -@@ -782,6 +786,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, - UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS, - proto == IPPROTO_UDPLITE); + return -1; + } +@@ -673,7 +677,7 @@ static void flush_stack(struct sock **stack, unsigned int count, + if (likely(skb1 == NULL)) + skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC); + if (!skb1) { +- atomic_inc(&sk->sk_drops); ++ atomic_inc_unchecked(&sk->sk_drops); + UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS, + IS_UDPLITE(sk)); + UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, +@@ -844,6 +848,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + goto discard; + UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE); +#ifdef CONFIG_GRKERNSEC_BLACKHOLE -+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK)) ++ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK)) +#endif - icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0); + icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0); - kfree_skb(skb); -@@ -798,7 +805,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, - if (!sock_owned_by_user(sk)) - udpv6_queue_rcv_skb(sk, skb); - else if (sk_add_backlog(sk, skb)) { -- atomic_inc(&sk->sk_drops); -+ atomic_inc_unchecked(&sk->sk_drops); - bh_unlock_sock(sk); - sock_put(sk); - goto discard; -@@ -1411,8 +1418,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket + kfree_skb(skb); +@@ -1453,8 +1460,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp), @@ -76444,7 +76802,7 @@ index cd6f7a9..e63fe89 100644 write_unlock_bh(&iucv_sk_list.lock); diff --git a/net/key/af_key.c b/net/key/af_key.c -index 7e5d927..cdbb54e 100644 +index 34e4185..8823368 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -3016,10 +3016,10 @@ static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, const struc @@ -76461,7 +76819,7 @@ index 7e5d927..cdbb54e 100644 return res; } diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h -index db8fae5..ff070cd 100644 +index 3f3cd50..d2cf249 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -28,6 +28,7 @@ @@ -76472,7 +76830,7 @@ index db8fae5..ff070cd 100644 #include "key.h" #include "sta_info.h" -@@ -842,7 +843,7 @@ struct ieee80211_local { +@@ -863,7 +864,7 @@ struct ieee80211_local { /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */ spinlock_t queue_stop_reason_lock; @@ -76482,10 +76840,10 @@ index db8fae5..ff070cd 100644 /* number of interfaces with corresponding FIF_ flags */ int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll, diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c -index 48f937e..4ccd7b8 100644 +index 8664111..1d6a065 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c -@@ -222,7 +222,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up) +@@ -328,7 +328,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up) break; } @@ -76494,16 +76852,16 @@ index 48f937e..4ccd7b8 100644 res = drv_start(local); if (res) goto err_del_bss; -@@ -246,7 +246,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up) - memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN); - - if (!is_valid_ether_addr(dev->dev_addr)) { -- if (!local->open_count) -+ if (!local_read(&local->open_count)) - drv_stop(local); - return -EADDRNOTAVAIL; +@@ -371,7 +371,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up) + break; } -@@ -347,7 +347,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up) + +- if (local->monitors == 0 && local->open_count == 0) { ++ if (local->monitors == 0 && local_read(&local->open_count) == 0) { + res = ieee80211_add_virtual_monitor(local); + if (res) + goto err_stop; +@@ -468,7 +468,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up) mutex_unlock(&local->mtx); if (coming_up) @@ -76512,7 +76870,7 @@ index 48f937e..4ccd7b8 100644 if (hw_reconf_flags) ieee80211_hw_config(local, hw_reconf_flags); -@@ -360,7 +360,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up) +@@ -481,7 +481,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up) err_del_interface: drv_remove_interface(local, sdata); err_stop: @@ -76521,7 +76879,7 @@ index 48f937e..4ccd7b8 100644 drv_stop(local); err_del_bss: sdata->bss = NULL; -@@ -491,7 +491,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, +@@ -613,7 +613,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, } if (going_down) @@ -76530,7 +76888,7 @@ index 48f937e..4ccd7b8 100644 switch (sdata->vif.type) { case NL80211_IFTYPE_AP_VLAN: -@@ -562,7 +562,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, +@@ -685,7 +685,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, ieee80211_recalc_ps(local, -1); @@ -76539,11 +76897,20 @@ index 48f937e..4ccd7b8 100644 if (local->ops->napi_poll) napi_disable(&local->napi); ieee80211_clear_tx_pending(local); +@@ -717,7 +717,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, + } + spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); + +- if (local->monitors == local->open_count && local->monitors > 0) ++ if (local->monitors == local_read(&local->open_count) && local->monitors > 0) + ieee80211_add_virtual_monitor(local); + } + diff --git a/net/mac80211/main.c b/net/mac80211/main.c -index 1633648..d45ebfa 100644 +index f5548e9..474a15f 100644 --- a/net/mac80211/main.c +++ b/net/mac80211/main.c -@@ -164,7 +164,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed) +@@ -166,7 +166,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed) local->hw.conf.power_level = power; } @@ -76553,7 +76920,7 @@ index 1633648..d45ebfa 100644 /* * Goal: diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c -index ef8eba1..5c63952 100644 +index af1c4e2..24dbbe3 100644 --- a/net/mac80211/pm.c +++ b/net/mac80211/pm.c @@ -34,7 +34,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan) @@ -76574,8 +76941,8 @@ index ef8eba1..5c63952 100644 if (local->wowlan) { int err = drv_suspend(local, wowlan); if (err < 0) { -@@ -128,7 +128,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan) - } +@@ -132,7 +132,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan) + drv_remove_interface(local, sdata); /* stop hardware - this must stop RX */ - if (local->open_count) @@ -76610,10 +76977,10 @@ index c97a065..ff61928 100644 return p; diff --git a/net/mac80211/util.c b/net/mac80211/util.c -index eb9d7c0..d34b832 100644 +index 8dd4712..19594fa 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c -@@ -1179,7 +1179,7 @@ int ieee80211_reconfig(struct ieee80211_local *local) +@@ -1216,7 +1216,7 @@ int ieee80211_reconfig(struct ieee80211_local *local) } #endif /* everything else happens only if HW was up & running */ @@ -76623,10 +76990,10 @@ index eb9d7c0..d34b832 100644 /* diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig -index 0c6f67e..d02cdfc 100644 +index 209c1ed..39484dc 100644 --- a/net/netfilter/Kconfig +++ b/net/netfilter/Kconfig -@@ -836,6 +836,16 @@ config NETFILTER_XT_MATCH_ESP +@@ -851,6 +851,16 @@ config NETFILTER_XT_MATCH_ESP To compile it as a module, choose M here. If unsure, say N. @@ -76644,10 +77011,10 @@ index 0c6f67e..d02cdfc 100644 tristate '"hashlimit" match support' depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n) diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile -index ca36765..0882e7c 100644 +index 4e7960c..89e48d4 100644 --- a/net/netfilter/Makefile +++ b/net/netfilter/Makefile -@@ -86,6 +86,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o +@@ -87,6 +87,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o obj-$(CONFIG_NETFILTER_XT_MATCH_ECN) += xt_ecn.o obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o @@ -76656,10 +77023,10 @@ index ca36765..0882e7c 100644 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c -index 29fa5ba..8debc79 100644 +index 1548df9..98ad9b4 100644 --- a/net/netfilter/ipvs/ip_vs_conn.c +++ b/net/netfilter/ipvs/ip_vs_conn.c -@@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest) +@@ -557,7 +557,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest) /* Increase the refcnt counter of the dest */ atomic_inc(&dest->refcnt); @@ -76667,8 +77034,8 @@ index 29fa5ba..8debc79 100644 + conn_flags = atomic_read_unchecked(&dest->conn_flags); if (cp->protocol != IPPROTO_UDP) conn_flags &= ~IP_VS_CONN_F_ONE_PACKET; - /* Bind with the destination and its corresponding transmitter */ -@@ -869,7 +869,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p, + flags = cp->flags; +@@ -902,7 +902,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p, atomic_set(&cp->refcnt, 1); atomic_set(&cp->n_control, 0); @@ -76677,7 +77044,7 @@ index 29fa5ba..8debc79 100644 atomic_inc(&ipvs->conn_count); if (flags & IP_VS_CONN_F_NO_CPORT) -@@ -1149,7 +1149,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp) +@@ -1183,7 +1183,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp) /* Don't drop the entry if its number of incoming packets is not located in [0, 8] */ @@ -76687,7 +77054,7 @@ index 29fa5ba..8debc79 100644 if (!todrop_rate[i]) return 0; diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c -index 00bdb1d..6725a48 100644 +index a54b018c..07e0120 100644 --- a/net/netfilter/ipvs/ip_vs_core.c +++ b/net/netfilter/ipvs/ip_vs_core.c @@ -562,7 +562,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb, @@ -76706,10 +77073,10 @@ index 00bdb1d..6725a48 100644 - pkts = atomic_add_return(1, &cp->in_pkts); + pkts = atomic_add_return_unchecked(1, &cp->in_pkts); - if ((ipvs->sync_state & IP_VS_STATE_MASTER) && - cp->protocol == IPPROTO_SCTP) { + if (ipvs->sync_state & IP_VS_STATE_MASTER) + ip_vs_sync_conn(net, cp, pkts); diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c -index f558998..7dfb054 100644 +index 84444dd..86adaa0 100644 --- a/net/netfilter/ipvs/ip_vs_ctl.c +++ b/net/netfilter/ipvs/ip_vs_ctl.c @@ -788,7 +788,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest, @@ -76721,30 +77088,7 @@ index f558998..7dfb054 100644 /* bind the service */ if (!dest->svc) { -@@ -1521,11 +1521,12 @@ static int ip_vs_dst_event(struct notifier_block *this, unsigned long event, - { - struct net_device *dev = ptr; - struct net *net = dev_net(dev); -+ struct netns_ipvs *ipvs = net_ipvs(net); - struct ip_vs_service *svc; - struct ip_vs_dest *dest; - unsigned int idx; - -- if (event != NETDEV_UNREGISTER) -+ if (event != NETDEV_UNREGISTER || !ipvs) - return NOTIFY_DONE; - IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name); - EnterFunction(2); -@@ -1551,7 +1552,7 @@ static int ip_vs_dst_event(struct notifier_block *this, unsigned long event, - } - } - -- list_for_each_entry(dest, &net_ipvs(net)->dest_trash, n_list) { -+ list_for_each_entry(dest, &ipvs->dest_trash, n_list) { - __ip_vs_dev_reset(dest, dev); - } - mutex_unlock(&__ip_vs_mutex); -@@ -2028,7 +2029,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v) +@@ -2074,7 +2074,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v) " %-7s %-6d %-10d %-10d\n", &dest->addr.in6, ntohs(dest->port), @@ -76753,7 +77097,7 @@ index f558998..7dfb054 100644 atomic_read(&dest->weight), atomic_read(&dest->activeconns), atomic_read(&dest->inactconns)); -@@ -2039,7 +2040,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v) +@@ -2085,7 +2085,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v) "%-7s %-6d %-10d %-10d\n", ntohl(dest->addr.ip), ntohs(dest->port), @@ -76762,7 +77106,7 @@ index f558998..7dfb054 100644 atomic_read(&dest->weight), atomic_read(&dest->activeconns), atomic_read(&dest->inactconns)); -@@ -2509,7 +2510,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get, +@@ -2555,7 +2555,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get, entry.addr = dest->addr.ip; entry.port = dest->port; @@ -76771,29 +77115,38 @@ index f558998..7dfb054 100644 entry.weight = atomic_read(&dest->weight); entry.u_threshold = dest->u_threshold; entry.l_threshold = dest->l_threshold; -@@ -3042,7 +3043,7 @@ static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest) - NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port); - - NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD, -- atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK); -+ atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK); - NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight)); - NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold); - NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold); +@@ -3089,7 +3089,7 @@ static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest) + if (nla_put(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr) || + nla_put_u16(skb, IPVS_DEST_ATTR_PORT, dest->port) || + nla_put_u32(skb, IPVS_DEST_ATTR_FWD_METHOD, +- (atomic_read(&dest->conn_flags) & ++ (atomic_read_unchecked(&dest->conn_flags) & + IP_VS_CONN_F_FWD_MASK)) || + nla_put_u32(skb, IPVS_DEST_ATTR_WEIGHT, + atomic_read(&dest->weight)) || diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c -index 8a0d6d6..90ec197 100644 +index effa10c..9058928 100644 --- a/net/netfilter/ipvs/ip_vs_sync.c +++ b/net/netfilter/ipvs/ip_vs_sync.c -@@ -649,7 +649,7 @@ control: - * i.e only increment in_pkts for Templates. - */ - if (cp->flags & IP_VS_CONN_F_TEMPLATE) { -- int pkts = atomic_add_return(1, &cp->in_pkts); -+ int pkts = atomic_add_return_unchecked(1, &cp->in_pkts); - - if (pkts % sysctl_sync_period(ipvs) != 1) - return; -@@ -795,7 +795,7 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param, +@@ -596,7 +596,7 @@ static void ip_vs_sync_conn_v0(struct net *net, struct ip_vs_conn *cp, + cp = cp->control; + if (cp) { + if (cp->flags & IP_VS_CONN_F_TEMPLATE) +- pkts = atomic_add_return(1, &cp->in_pkts); ++ pkts = atomic_add_return_unchecked(1, &cp->in_pkts); + else + pkts = sysctl_sync_threshold(ipvs); + ip_vs_sync_conn(net, cp->control, pkts); +@@ -758,7 +758,7 @@ control: + if (!cp) + return; + if (cp->flags & IP_VS_CONN_F_TEMPLATE) +- pkts = atomic_add_return(1, &cp->in_pkts); ++ pkts = atomic_add_return_unchecked(1, &cp->in_pkts); + else + pkts = sysctl_sync_threshold(ipvs); + goto sloop; +@@ -885,7 +885,7 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param, if (opt) memcpy(&cp->in_seq, opt, sizeof(*opt)); @@ -76825,10 +77178,10 @@ index 7fd66de..e6fb361 100644 } diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c -index 729f157..08edc6c 100644 +index ac3af97..c134c21 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c -@@ -1538,6 +1538,10 @@ err_proto: +@@ -1530,6 +1530,10 @@ err_proto: #define UNCONFIRMED_NULLS_VAL ((1<<30)+0) #define DYING_NULLS_VAL ((1<<30)+1) @@ -76839,12 +77192,12 @@ index 729f157..08edc6c 100644 static int nf_conntrack_init_net(struct net *net) { int ret; -@@ -1551,7 +1555,11 @@ static int nf_conntrack_init_net(struct net *net) +@@ -1543,7 +1547,11 @@ static int nf_conntrack_init_net(struct net *net) goto err_stat; } +#ifdef CONFIG_GRKERNSEC_HIDESYM -+ net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%08lx", atomic_inc_return(&conntrack_cache_id)); ++ net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%08lx", atomic_inc_return_unchecked(&conntrack_cache_id)); +#else net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net); +#endif @@ -76852,7 +77205,7 @@ index 729f157..08edc6c 100644 ret = -ENOMEM; goto err_slabname; diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c -index 66b2c54..c7884e3 100644 +index 3c3cfc0..7a6ea1a 100644 --- a/net/netfilter/nfnetlink_log.c +++ b/net/netfilter/nfnetlink_log.c @@ -70,7 +70,7 @@ struct nfulnl_instance { @@ -76864,15 +77217,15 @@ index 66b2c54..c7884e3 100644 #define INSTANCE_BUCKETS 16 static struct hlist_head instance_table[INSTANCE_BUCKETS]; -@@ -502,7 +502,7 @@ __build_packet_message(struct nfulnl_instance *inst, +@@ -517,7 +517,7 @@ __build_packet_message(struct nfulnl_instance *inst, /* global sequence number */ - if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) - NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL, -- htonl(atomic_inc_return(&global_seq))); -+ htonl(atomic_inc_return_unchecked(&global_seq))); + if ((inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) && + nla_put_be32(inst->skb, NFULA_SEQ_GLOBAL, +- htonl(atomic_inc_return(&global_seq)))) ++ htonl(atomic_inc_return_unchecked(&global_seq)))) + goto nla_put_failure; if (data_len) { - struct nlattr *nla; diff --git a/net/netfilter/xt_gradm.c b/net/netfilter/xt_gradm.c new file mode 100644 index 0000000..6905327 @@ -76965,10 +77318,10 @@ index 4fe4fb4..87a89e5 100644 return 0; } diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index faa48f7..65f7f54 100644 +index b3025a6..d63a537 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c -@@ -741,7 +741,7 @@ static void netlink_overrun(struct sock *sk) +@@ -753,7 +753,7 @@ static void netlink_overrun(struct sock *sk) sk->sk_error_report(sk); } } @@ -76977,7 +77330,7 @@ index faa48f7..65f7f54 100644 } static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid) -@@ -2013,7 +2013,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v) +@@ -2022,7 +2022,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v) sk_wmem_alloc_get(s), nlk->cb, atomic_read(&s->sk_refcnt), @@ -77007,7 +77360,7 @@ index 06592d8..64860f6 100644 *uaddr_len = sizeof(struct sockaddr_ax25); } diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 4f2c0df..f0ff342 100644 +index 0f66174..2f50376 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -1687,7 +1687,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev, @@ -77028,7 +77381,7 @@ index 4f2c0df..f0ff342 100644 spin_unlock(&sk->sk_receive_queue.lock); drop_n_restore: -@@ -3294,7 +3294,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, +@@ -3275,7 +3275,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, case PACKET_HDRLEN: if (len > sizeof(int)) len = sizeof(int); @@ -77037,8 +77390,8 @@ index 4f2c0df..f0ff342 100644 return -EFAULT; switch (val) { case TPACKET_V1: -@@ -3344,7 +3344,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, - +@@ -3314,7 +3314,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, + len = lv; if (put_user(len, optlen)) return -EFAULT; - if (copy_to_user(optval, data, len)) @@ -77047,7 +77400,7 @@ index 4f2c0df..f0ff342 100644 return 0; } diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c -index d65f699..05aa6ce 100644 +index 5a940db..f0b9c12 100644 --- a/net/phonet/af_phonet.c +++ b/net/phonet/af_phonet.c @@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_proto_get(unsigned int protocol) @@ -77069,7 +77422,7 @@ index d65f699..05aa6ce 100644 err = proto_register(pp->prot, 1); diff --git a/net/phonet/pep.c b/net/phonet/pep.c -index 9726fe6..fc4e3a4 100644 +index 576f22c..bc7a71b 100644 --- a/net/phonet/pep.c +++ b/net/phonet/pep.c @@ -388,7 +388,7 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb) @@ -77100,7 +77453,7 @@ index 9726fe6..fc4e3a4 100644 break; } diff --git a/net/phonet/socket.c b/net/phonet/socket.c -index 4c7eff3..59c727f 100644 +index 0acc943..c727611 100644 --- a/net/phonet/socket.c +++ b/net/phonet/socket.c @@ -613,8 +613,13 @@ static int pn_sock_seq_show(struct seq_file *seq, void *v) @@ -77151,7 +77504,7 @@ index e5b65ac..f3b6fb7 100644 if (likely(*recent == gen)) return 0; diff --git a/net/rds/ib.h b/net/rds/ib.h -index edfaaaf..8c89879 100644 +index 8d2b3d5..227ec5b 100644 --- a/net/rds/ib.h +++ b/net/rds/ib.h @@ -128,7 +128,7 @@ struct rds_ib_connection { @@ -77294,7 +77647,7 @@ index 1b4fd68..2234175 100644 set_fs(oldfs); } diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c -index 74c064c..fdec26f 100644 +index 05996d0..5a1dfe0 100644 --- a/net/rxrpc/af_rxrpc.c +++ b/net/rxrpc/af_rxrpc.c @@ -39,7 +39,7 @@ static const struct proto_ops rxrpc_rpc_ops; @@ -77307,7 +77660,7 @@ index 74c064c..fdec26f 100644 /* count of skbs currently in use */ atomic_t rxrpc_n_skbs; diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c -index c3126e8..21facc7 100644 +index e4d9cbc..b229649 100644 --- a/net/rxrpc/ar-ack.c +++ b/net/rxrpc/ar-ack.c @@ -175,7 +175,7 @@ static void rxrpc_resend(struct rxrpc_call *call) @@ -77374,7 +77727,7 @@ index c3126e8..21facc7 100644 send_message_2: diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c -index bf656c2..48f9d27 100644 +index a3bbb36..3341fb9 100644 --- a/net/rxrpc/ar-call.c +++ b/net/rxrpc/ar-call.c @@ -83,7 +83,7 @@ static struct rxrpc_call *rxrpc_alloc_call(gfp_t gfp) @@ -77413,7 +77766,7 @@ index e7ed43a..6afa140 100644 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len); diff --git a/net/rxrpc/ar-input.c b/net/rxrpc/ar-input.c -index 1a2b0633..e8d1382 100644 +index 529572f..c758ca7 100644 --- a/net/rxrpc/ar-input.c +++ b/net/rxrpc/ar-input.c @@ -340,9 +340,9 @@ void rxrpc_fast_process_packet(struct rxrpc_call *call, struct sk_buff *skb) @@ -77429,13 +77782,13 @@ index 1a2b0633..e8d1382 100644 /* request ACK generation for any ACK or DATA packet that requests diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h -index 8e22bd3..f66d1c0 100644 +index a693aca..81e7293 100644 --- a/net/rxrpc/ar-internal.h +++ b/net/rxrpc/ar-internal.h @@ -272,8 +272,8 @@ struct rxrpc_connection { int error; /* error code for local abort */ int debug_id; /* debug ID for printks */ - unsigned call_counter; /* call ID counter */ + unsigned int call_counter; /* call ID counter */ - atomic_t serial; /* packet serial number counter */ - atomic_t hi_serial; /* highest serial number received */ + atomic_unchecked_t serial; /* packet serial number counter */ @@ -77491,7 +77844,7 @@ index 16ae887..d24f12b 100644 sp->hdr.userStatus = 0; sp->hdr.securityIndex = conn->security_ix; diff --git a/net/rxrpc/ar-peer.c b/net/rxrpc/ar-peer.c -index 2754f09..b20e38f 100644 +index bebaa43..2644591 100644 --- a/net/rxrpc/ar-peer.c +++ b/net/rxrpc/ar-peer.c @@ -72,7 +72,7 @@ static struct rxrpc_peer *rxrpc_alloc_peer(struct sockaddr_rxrpc *srx, @@ -77532,7 +77885,7 @@ index 92df566..87ec1bf 100644 if (peer->srx.transport.family == AF_INET) { switch (peer->srx.transport_type) { diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c -index 7635107..4670276 100644 +index f226709..0e735a8 100644 --- a/net/rxrpc/rxkad.c +++ b/net/rxrpc/rxkad.c @@ -610,7 +610,7 @@ static int rxkad_issue_challenge(struct rxrpc_connection *conn) @@ -77553,36 +77906,6 @@ index 7635107..4670276 100644 _proto("Tx RESPONSE %%%u", ntohl(hdr->serial)); ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len); -diff --git a/net/sctp/input.c b/net/sctp/input.c -index 80f71af..be772c0 100644 ---- a/net/sctp/input.c -+++ b/net/sctp/input.c -@@ -736,15 +736,12 @@ static void __sctp_unhash_endpoint(struct sctp_endpoint *ep) - - epb = &ep->base; - -- if (hlist_unhashed(&epb->node)) -- return; -- - epb->hashent = sctp_ep_hashfn(epb->bind_addr.port); - - head = &sctp_ep_hashtable[epb->hashent]; - - sctp_write_lock(&head->lock); -- __hlist_del(&epb->node); -+ hlist_del_init(&epb->node); - sctp_write_unlock(&head->lock); - } - -@@ -825,7 +822,7 @@ static void __sctp_unhash_established(struct sctp_association *asoc) - head = &sctp_assoc_hashtable[epb->hashent]; - - sctp_write_lock(&head->lock); -- __hlist_del(&epb->node); -+ hlist_del_init(&epb->node); - sctp_write_unlock(&head->lock); - } - diff --git a/net/sctp/proc.c b/net/sctp/proc.c index 1e2eee8..ce3967e 100644 --- a/net/sctp/proc.c @@ -77598,38 +77921,10 @@ index 1e2eee8..ce3967e 100644 assoc->assoc_id, assoc->sndbuf_used, diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 92ba71d..9352c05 100644 +index 31c7bfc..bc380ae 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c -@@ -1231,8 +1231,14 @@ out_free: - SCTP_DEBUG_PRINTK("About to exit __sctp_connect() free asoc: %p" - " kaddrs: %p err: %d\n", - asoc, kaddrs, err); -- if (asoc) -+ if (asoc) { -+ /* sctp_primitive_ASSOCIATE may have added this association -+ * To the hash table, try to unhash it, just in case, its a noop -+ * if it wasn't hashed so we're safe -+ */ -+ sctp_unhash_established(asoc); - sctp_association_free(asoc); -+ } - return err; - } - -@@ -1942,8 +1948,10 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk, - goto out_unlock; - - out_free: -- if (new_asoc) -+ if (new_asoc) { -+ sctp_unhash_established(asoc); - sctp_association_free(asoc); -+ } - out_unlock: - sctp_release_sock(sk); - -@@ -4569,7 +4577,7 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len, +@@ -4577,7 +4577,7 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len, addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len; if (space_left < addrlen) return -ENOMEM; @@ -77639,7 +77934,7 @@ index 92ba71d..9352c05 100644 to += addrlen; cnt++; diff --git a/net/socket.c b/net/socket.c -index 851edcd..b786851 100644 +index 6e0ccc0..e3387a27 100644 --- a/net/socket.c +++ b/net/socket.c @@ -88,6 +88,7 @@ @@ -77677,7 +77972,7 @@ index 851edcd..b786851 100644 /* Compatibility. -@@ -1339,6 +1344,16 @@ SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol) +@@ -1338,6 +1343,16 @@ SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol) if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK)) flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK; @@ -77694,7 +77989,7 @@ index 851edcd..b786851 100644 retval = sock_create(family, type, protocol, &sock); if (retval < 0) goto out; -@@ -1451,6 +1466,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen) +@@ -1450,6 +1465,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen) if (sock) { err = move_addr_to_kernel(umyaddr, addrlen, &address); if (err >= 0) { @@ -77709,7 +78004,7 @@ index 851edcd..b786851 100644 err = security_socket_bind(sock, (struct sockaddr *)&address, addrlen); -@@ -1459,6 +1482,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen) +@@ -1458,6 +1481,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen) (struct sockaddr *) &address, addrlen); } @@ -77717,8 +78012,8 @@ index 851edcd..b786851 100644 fput_light(sock->file, fput_needed); } return err; -@@ -1482,10 +1506,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, backlog) - if ((unsigned)backlog > somaxconn) +@@ -1481,10 +1505,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, backlog) + if ((unsigned int)backlog > somaxconn) backlog = somaxconn; + if (gr_handle_sock_server_other(sock->sk)) { @@ -77738,7 +78033,7 @@ index 851edcd..b786851 100644 fput_light(sock->file, fput_needed); } return err; -@@ -1529,6 +1563,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr, +@@ -1528,6 +1562,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr, newsock->type = sock->type; newsock->ops = sock->ops; @@ -77757,7 +78052,7 @@ index 851edcd..b786851 100644 /* * We don't need try_module_get here, as the listening socket (sock) * has the protocol module (sock->ops->owner) held. -@@ -1567,6 +1613,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr, +@@ -1566,6 +1612,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr, fd_install(newfd, newfile); err = newfd; @@ -77766,7 +78061,7 @@ index 851edcd..b786851 100644 out_put: fput_light(sock->file, fput_needed); out: -@@ -1599,6 +1647,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr, +@@ -1598,6 +1646,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr, int, addrlen) { struct socket *sock; @@ -77774,7 +78069,7 @@ index 851edcd..b786851 100644 struct sockaddr_storage address; int err, fput_needed; -@@ -1609,6 +1658,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr, +@@ -1608,6 +1657,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr, if (err < 0) goto out_put; @@ -77792,7 +78087,7 @@ index 851edcd..b786851 100644 err = security_socket_connect(sock, (struct sockaddr *)&address, addrlen); if (err) -@@ -1966,7 +2026,7 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg, +@@ -1962,7 +2022,7 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg, * checking falls down on this. */ if (copy_from_user(ctl_buf, @@ -77801,7 +78096,7 @@ index 851edcd..b786851 100644 ctl_len)) goto out_freectl; msg_sys->msg_control = ctl_buf; -@@ -2136,7 +2196,7 @@ static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg, +@@ -2130,7 +2190,7 @@ static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg, * kernel msghdr to use the kernel address space) */ @@ -78121,10 +78416,10 @@ index 73b428b..5f3f8f3 100644 /* See if we can opportunistically reap SQ WR to make room */ sq_cq_reap(xprt); diff --git a/net/sysctl_net.c b/net/sysctl_net.c -index c3e65ae..f512a2b 100644 +index e3a6e37..be2ea77 100644 --- a/net/sysctl_net.c +++ b/net/sysctl_net.c -@@ -47,7 +47,7 @@ static int net_ctl_permissions(struct ctl_table_root *root, +@@ -43,7 +43,7 @@ static int net_ctl_permissions(struct ctl_table_root *root, struct ctl_table *table) { /* Allow network administrator to have same access as root. */ @@ -78134,10 +78429,10 @@ index c3e65ae..f512a2b 100644 return (mode << 6) | (mode << 3) | mode; } diff --git a/net/tipc/link.c b/net/tipc/link.c -index b4b9b30..5b62131 100644 +index 7a614f4..b14dbd2 100644 --- a/net/tipc/link.c +++ b/net/tipc/link.c -@@ -1203,7 +1203,7 @@ static int link_send_sections_long(struct tipc_port *sender, +@@ -1164,7 +1164,7 @@ static int link_send_sections_long(struct tipc_port *sender, struct tipc_msg fragm_hdr; struct sk_buff *buf, *buf_chain, *prev; u32 fragm_crs, fragm_rest, hsz, sect_rest; @@ -78146,7 +78441,7 @@ index b4b9b30..5b62131 100644 int curr_sect; u32 fragm_no; -@@ -1247,7 +1247,7 @@ again: +@@ -1205,7 +1205,7 @@ again: if (!sect_rest) { sect_rest = msg_sect[++curr_sect].iov_len; @@ -78155,7 +78450,7 @@ index b4b9b30..5b62131 100644 } if (sect_rest < fragm_rest) -@@ -1266,7 +1266,7 @@ error: +@@ -1224,7 +1224,7 @@ error: } } else skb_copy_to_linear_data_offset(buf, fragm_crs, @@ -78165,10 +78460,10 @@ index b4b9b30..5b62131 100644 sect_rest -= sz; fragm_crs += sz; diff --git a/net/tipc/msg.c b/net/tipc/msg.c -index e3afe16..333ea83 100644 +index deea0d2..fa13bd7 100644 --- a/net/tipc/msg.c +++ b/net/tipc/msg.c -@@ -99,7 +99,7 @@ int tipc_msg_build(struct tipc_msg *hdr, struct iovec const *msg_sect, +@@ -98,7 +98,7 @@ int tipc_msg_build(struct tipc_msg *hdr, struct iovec const *msg_sect, msg_sect[cnt].iov_len); else skb_copy_to_linear_data_offset(*buf, pos, @@ -78178,10 +78473,10 @@ index e3afe16..333ea83 100644 pos += msg_sect[cnt].iov_len; } diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c -index b2964e9..fdf2e27 100644 +index f976e9cd..560d055 100644 --- a/net/tipc/subscr.c +++ b/net/tipc/subscr.c -@@ -101,7 +101,7 @@ static void subscr_send_event(struct tipc_subscription *sub, +@@ -96,7 +96,7 @@ static void subscr_send_event(struct tipc_subscription *sub, { struct iovec msg_sect; @@ -78191,10 +78486,10 @@ index b2964e9..fdf2e27 100644 sub->evt.event = htohl(event, sub->swap); diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index d510353..26c8a32 100644 +index 641f2e4..a63f5e1 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c -@@ -779,6 +779,12 @@ static struct sock *unix_find_other(struct net *net, +@@ -780,6 +780,12 @@ static struct sock *unix_find_other(struct net *net, err = -ECONNREFUSED; if (!S_ISSOCK(inode->i_mode)) goto put_fail; @@ -78207,7 +78502,7 @@ index d510353..26c8a32 100644 u = unix_find_socket_byinode(inode); if (!u) goto put_fail; -@@ -799,6 +805,13 @@ static struct sock *unix_find_other(struct net *net, +@@ -800,6 +806,13 @@ static struct sock *unix_find_other(struct net *net, if (u) { struct dentry *dentry; dentry = unix_sk(u)->path.dentry; @@ -78221,7 +78516,7 @@ index d510353..26c8a32 100644 if (dentry) touch_atime(&unix_sk(u)->path); } else -@@ -881,11 +894,18 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) +@@ -882,11 +895,18 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) err = security_path_mknod(&path, dentry, mode, 0); if (err) goto out_mknod_drop_write; @@ -78241,7 +78536,7 @@ index d510353..26c8a32 100644 dput(path.dentry); path.dentry = dentry; diff --git a/net/wireless/core.h b/net/wireless/core.h -index 3ac2dd0..fbe533e 100644 +index 8523f38..79f6091 100644 --- a/net/wireless/core.h +++ b/net/wireless/core.h @@ -27,7 +27,7 @@ struct cfg80211_registered_device { @@ -78254,10 +78549,10 @@ index 3ac2dd0..fbe533e 100644 struct work_struct rfkill_sync; diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c -index af648e0..6185d3a 100644 +index b0eb7aa..7d73e82 100644 --- a/net/wireless/wext-core.c +++ b/net/wireless/wext-core.c -@@ -747,8 +747,7 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd, +@@ -748,8 +748,7 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd, */ /* Support for very large requests */ @@ -78267,7 +78562,7 @@ index af648e0..6185d3a 100644 /* Allow userspace to GET more than max so * we can support any size GET requests. * There is still a limit : -ENOMEM. -@@ -787,22 +786,6 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd, +@@ -788,22 +787,6 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd, } } @@ -78291,10 +78586,10 @@ index af648e0..6185d3a 100644 iwp->length += essid_compat; diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c -index a15d2a0..12142af 100644 +index ccfbd32..9b61cf9f 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c -@@ -299,7 +299,7 @@ static void xfrm_policy_kill(struct xfrm_policy *policy) +@@ -300,7 +300,7 @@ static void xfrm_policy_kill(struct xfrm_policy *policy) { policy->walk.dead = 1; @@ -78303,7 +78598,7 @@ index a15d2a0..12142af 100644 if (del_timer(&policy->timer)) xfrm_pol_put(policy); -@@ -583,7 +583,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl) +@@ -584,7 +584,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl) hlist_add_head(&policy->bydst, chain); xfrm_pol_hold(policy); net->xfrm.policy_count[dir]++; @@ -78312,7 +78607,7 @@ index a15d2a0..12142af 100644 if (delpol) __xfrm_policy_unlink(delpol, dir); policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir); -@@ -1530,7 +1530,7 @@ free_dst: +@@ -1532,7 +1532,7 @@ free_dst: goto out; } @@ -78321,7 +78616,7 @@ index a15d2a0..12142af 100644 xfrm_dst_alloc_copy(void **target, const void *src, int size) { if (!*target) { -@@ -1542,7 +1542,7 @@ xfrm_dst_alloc_copy(void **target, const void *src, int size) +@@ -1544,7 +1544,7 @@ xfrm_dst_alloc_copy(void **target, const void *src, int size) return 0; } @@ -78330,7 +78625,7 @@ index a15d2a0..12142af 100644 xfrm_dst_update_parent(struct dst_entry *dst, const struct xfrm_selector *sel) { #ifdef CONFIG_XFRM_SUB_POLICY -@@ -1554,7 +1554,7 @@ xfrm_dst_update_parent(struct dst_entry *dst, const struct xfrm_selector *sel) +@@ -1556,7 +1556,7 @@ xfrm_dst_update_parent(struct dst_entry *dst, const struct xfrm_selector *sel) #endif } @@ -78339,7 +78634,7 @@ index a15d2a0..12142af 100644 xfrm_dst_update_origin(struct dst_entry *dst, const struct flowi *fl) { #ifdef CONFIG_XFRM_SUB_POLICY -@@ -1648,7 +1648,7 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, +@@ -1650,7 +1650,7 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, xdst->num_pols = num_pols; memcpy(xdst->pols, pols, sizeof(struct xfrm_policy*) * num_pols); @@ -78348,7 +78643,7 @@ index a15d2a0..12142af 100644 return xdst; } -@@ -2348,7 +2348,7 @@ static int xfrm_bundle_ok(struct xfrm_dst *first) +@@ -2350,7 +2350,7 @@ static int xfrm_bundle_ok(struct xfrm_dst *first) if (xdst->xfrm_genid != dst->xfrm->genid) return 0; if (xdst->num_pols > 0 && @@ -78357,7 +78652,7 @@ index a15d2a0..12142af 100644 return 0; mtu = dst_mtu(dst->child); -@@ -2885,7 +2885,7 @@ static int xfrm_policy_migrate(struct xfrm_policy *pol, +@@ -2887,7 +2887,7 @@ static int xfrm_policy_migrate(struct xfrm_policy *pol, sizeof(pol->xfrm_vec[i].saddr)); pol->xfrm_vec[i].encap_family = mp->new_family; /* flush bundles */ @@ -78535,7 +78830,7 @@ index 0000000..008ac1a + [[ "$plugincc" =~ "$2" ]] && echo "$2" +fi diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c -index 44ddaa5..a3119bd 100644 +index 5759751..b170367 100644 --- a/scripts/mod/file2alias.c +++ b/scripts/mod/file2alias.c @@ -128,7 +128,7 @@ static void device_id_check(const char *modname, const char *device_id, @@ -78565,7 +78860,7 @@ index 44ddaa5..a3119bd 100644 id->match_flags = TO_NATIVE(id->match_flags); id->idVendor = TO_NATIVE(id->idVendor); -@@ -501,7 +501,7 @@ static void do_pnp_device_entry(void *symval, unsigned long size, +@@ -504,7 +504,7 @@ static void do_pnp_device_entry(void *symval, unsigned long size, for (i = 0; i < count; i++) { const char *id = (char *)devs[i].id; char acpi_id[sizeof(devs[0].id)]; @@ -78574,7 +78869,7 @@ index 44ddaa5..a3119bd 100644 buf_printf(&mod->dev_table_buf, "MODULE_ALIAS(\"pnp:d%s*\");\n", id); -@@ -531,7 +531,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size, +@@ -534,7 +534,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size, for (j = 0; j < PNP_MAX_DEVICES; j++) { const char *id = (char *)card->devs[j].id; @@ -78583,7 +78878,7 @@ index 44ddaa5..a3119bd 100644 int dup = 0; if (!id[0]) -@@ -557,7 +557,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size, +@@ -560,7 +560,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size, /* add an individual alias for every device entry */ if (!dup) { char acpi_id[sizeof(card->devs[0].id)]; @@ -78592,7 +78887,7 @@ index 44ddaa5..a3119bd 100644 buf_printf(&mod->dev_table_buf, "MODULE_ALIAS(\"pnp:d%s*\");\n", id); -@@ -882,7 +882,7 @@ static void dmi_ascii_filter(char *d, const char *s) +@@ -885,7 +885,7 @@ static void dmi_ascii_filter(char *d, const char *s) static int do_dmi_entry(const char *filename, struct dmi_system_id *id, char *alias) { @@ -78602,10 +78897,10 @@ index 44ddaa5..a3119bd 100644 sprintf(alias, "dmi*"); diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c -index c4e7d15..dad16c1 100644 +index 0f84bb3..2d42035 100644 --- a/scripts/mod/modpost.c +++ b/scripts/mod/modpost.c -@@ -922,6 +922,7 @@ enum mismatch { +@@ -925,6 +925,7 @@ enum mismatch { ANY_INIT_TO_ANY_EXIT, ANY_EXIT_TO_ANY_INIT, EXPORT_TO_INIT_EXIT, @@ -78613,7 +78908,7 @@ index c4e7d15..dad16c1 100644 }; struct sectioncheck { -@@ -1030,6 +1031,12 @@ const struct sectioncheck sectioncheck[] = { +@@ -1033,6 +1034,12 @@ const struct sectioncheck sectioncheck[] = { .tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL }, .mismatch = EXPORT_TO_INIT_EXIT, .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL }, @@ -78626,7 +78921,7 @@ index c4e7d15..dad16c1 100644 } }; -@@ -1152,10 +1159,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr, +@@ -1155,10 +1162,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr, continue; if (ELF_ST_TYPE(sym->st_info) == STT_SECTION) continue; @@ -78639,7 +78934,7 @@ index c4e7d15..dad16c1 100644 if (d < 0) d = addr - sym->st_value; if (d < distance) { -@@ -1434,6 +1441,14 @@ static void report_sec_mismatch(const char *modname, +@@ -1437,6 +1444,14 @@ static void report_sec_mismatch(const char *modname, tosym, prl_to, prl_to, tosym); free(prl_to); break; @@ -78654,7 +78949,7 @@ index c4e7d15..dad16c1 100644 } fprintf(stderr, "\n"); } -@@ -1668,7 +1683,7 @@ static void section_rel(const char *modname, struct elf_info *elf, +@@ -1671,7 +1686,7 @@ static void section_rel(const char *modname, struct elf_info *elf, static void check_sec_ref(struct module *mod, const char *modname, struct elf_info *elf) { @@ -78663,7 +78958,7 @@ index c4e7d15..dad16c1 100644 Elf_Shdr *sechdrs = elf->sechdrs; /* Walk through all sections */ -@@ -1766,7 +1781,7 @@ void __attribute__((format(printf, 2, 3))) buf_printf(struct buffer *buf, +@@ -1769,7 +1784,7 @@ void __attribute__((format(printf, 2, 3))) buf_printf(struct buffer *buf, va_end(ap); } @@ -78672,7 +78967,7 @@ index c4e7d15..dad16c1 100644 { if (buf->size - buf->pos < len) { buf->size += len + SZ; -@@ -1984,7 +1999,7 @@ static void write_if_changed(struct buffer *b, const char *fname) +@@ -1987,7 +2002,7 @@ static void write_if_changed(struct buffer *b, const char *fname) if (fstat(fileno(file), &st) < 0) goto close_write; @@ -78748,7 +79043,7 @@ index 5c11312..72742b5 100644 write_hex_cnt = 0; for (i = 0; i < logo_clutsize; i++) { diff --git a/security/Kconfig b/security/Kconfig -index ccc61f8..0759500 100644 +index e9c6ac7..4349785 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -4,6 +4,876 @@ @@ -79625,10 +79920,10 @@ index ccc61f8..0759500 100644 + +endmenu + - config KEYS - bool "Enable access key retention support" - help -@@ -169,7 +1039,7 @@ config INTEL_TXT + source security/keys/Kconfig + + config SECURITY_DMESG_RESTRICT +@@ -103,7 +973,7 @@ config INTEL_TXT config LSM_MMAP_MIN_ADDR int "Low address space for LSM to protect from user allocation" depends on SECURITY && SECURITY_SELINUX @@ -79638,10 +79933,10 @@ index ccc61f8..0759500 100644 help This is the portion of low virtual memory which should be protected diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c -index ad05d39..afffccb 100644 +index 8ea39aa..8569ac5 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c -@@ -622,7 +622,7 @@ static int apparmor_task_setrlimit(struct task_struct *task, +@@ -614,7 +614,7 @@ static int apparmor_task_setrlimit(struct task_struct *task, return error; } @@ -79651,17 +79946,17 @@ index ad05d39..afffccb 100644 .ptrace_access_check = apparmor_ptrace_access_check, diff --git a/security/commoncap.c b/security/commoncap.c -index 71a166a..851bb3e 100644 +index 6dbae46..f534748 100644 --- a/security/commoncap.c +++ b/security/commoncap.c -@@ -576,6 +576,9 @@ int cap_bprm_secureexec(struct linux_binprm *bprm) - { +@@ -583,6 +583,9 @@ int cap_bprm_secureexec(struct linux_binprm *bprm) const struct cred *cred = current_cred(); + kuid_t root_uid = make_kuid(cred->user_ns, 0); + if (gr_acl_enable_at_secure()) + return 1; + - if (cred->uid != 0) { + if (!uid_eq(cred->uid, root_uid)) { if (bprm->cap_effective) return 1; diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h @@ -79725,7 +80020,7 @@ index 55a6271..ad829c3 100644 hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]); return 0; diff --git a/security/keys/compat.c b/security/keys/compat.c -index 4c48e13..7abdac9 100644 +index c92d42b..341e7ea 100644 --- a/security/keys/compat.c +++ b/security/keys/compat.c @@ -44,7 +44,7 @@ long compat_keyctl_instantiate_key_iov( @@ -79738,10 +80033,10 @@ index 4c48e13..7abdac9 100644 if (iov != iovstack) kfree(iov); diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c -index fb767c6..b9c49c0 100644 +index 0f5b3f0..b8d47c1 100644 --- a/security/keys/keyctl.c +++ b/security/keys/keyctl.c -@@ -935,7 +935,7 @@ static int keyctl_change_reqkey_auth(struct key *key) +@@ -966,7 +966,7 @@ static int keyctl_change_reqkey_auth(struct key *key) /* * Copy the iovec data from userspace */ @@ -79750,7 +80045,7 @@ index fb767c6..b9c49c0 100644 unsigned ioc) { for (; ioc > 0; ioc--) { -@@ -957,7 +957,7 @@ static long copy_from_user_iovec(void *buffer, const struct iovec *iov, +@@ -988,7 +988,7 @@ static long copy_from_user_iovec(void *buffer, const struct iovec *iov, * If successful, 0 will be returned. */ long keyctl_instantiate_key_common(key_serial_t id, @@ -79759,7 +80054,7 @@ index fb767c6..b9c49c0 100644 unsigned ioc, size_t plen, key_serial_t ringid) -@@ -1052,7 +1052,7 @@ long keyctl_instantiate_key(key_serial_t id, +@@ -1083,7 +1083,7 @@ long keyctl_instantiate_key(key_serial_t id, [0].iov_len = plen }; @@ -79768,7 +80063,7 @@ index fb767c6..b9c49c0 100644 } return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid); -@@ -1085,7 +1085,7 @@ long keyctl_instantiate_key_iov(key_serial_t id, +@@ -1116,7 +1116,7 @@ long keyctl_instantiate_key_iov(key_serial_t id, if (ret == 0) goto no_payload_free; @@ -79778,15 +80073,16 @@ index fb767c6..b9c49c0 100644 if (iov != iovstack) kfree(iov); diff --git a/security/keys/keyring.c b/security/keys/keyring.c -index d605f75..2bc6be9 100644 +index 7445875..262834f 100644 --- a/security/keys/keyring.c +++ b/security/keys/keyring.c -@@ -214,15 +214,15 @@ static long keyring_read(const struct key *keyring, +@@ -227,16 +227,16 @@ static long keyring_read(const struct key *keyring, ret = -EFAULT; for (loop = 0; loop < klist->nkeys; loop++) { + key_serial_t serial; - key = klist->keys[loop]; + key = rcu_deref_link_locked(klist, loop, + keyring); + serial = key->serial; tmp = sizeof(key_serial_t); @@ -79821,7 +80117,7 @@ index f728728..6457a0c 100644 /* diff --git a/security/security.c b/security/security.c -index bf619ff..8179030 100644 +index 860aeb3..45765c0 100644 --- a/security/security.c +++ b/security/security.c @@ -20,6 +20,7 @@ @@ -79829,10 +80125,10 @@ index bf619ff..8179030 100644 #include <linux/evm.h> #include <linux/fsnotify.h> +#include <linux/mm.h> - #include <net/flow.h> - - #define MAX_LSM_EVM_XATTR 2 -@@ -28,8 +29,8 @@ + #include <linux/mman.h> + #include <linux/mount.h> + #include <linux/personality.h> +@@ -32,8 +33,8 @@ static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] = CONFIG_DEFAULT_SECURITY; @@ -79843,7 +80139,7 @@ index bf619ff..8179030 100644 .name = "default", }; -@@ -70,7 +71,9 @@ int __init security_init(void) +@@ -74,7 +75,9 @@ int __init security_init(void) void reset_security_ops(void) { @@ -79854,7 +80150,7 @@ index bf619ff..8179030 100644 /* Save user chosen LSM */ diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index d85b793..a164832 100644 +index ffd8900..0b1751b 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -95,8 +95,6 @@ @@ -79866,7 +80162,29 @@ index d85b793..a164832 100644 /* SECMARK reference count */ static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0); -@@ -5520,7 +5518,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer) +@@ -2792,11 +2790,16 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name, + + /* We strip a nul only if it is at the end, otherwise the + * context contains a nul and we should audit that */ +- str = value; +- if (str[size - 1] == '\0') +- audit_size = size - 1; +- else +- audit_size = size; ++ if (value) { ++ str = value; ++ if (str[size - 1] == '\0') ++ audit_size = size - 1; ++ else ++ audit_size = size; ++ } else { ++ str = ""; ++ audit_size = 0; ++ } + ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR); + audit_log_format(ab, "op=setxattr invalid_context="); + audit_log_n_untrustedstring(ab, value, audit_size); +@@ -5506,7 +5509,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer) #endif @@ -79889,10 +80207,10 @@ index c220f31..89fab3f 100644 #else static inline int selinux_xfrm_enabled(void) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c -index 45c32f0..0038be2 100644 +index ee0bb57..57fcd43 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c -@@ -3500,7 +3500,7 @@ static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) +@@ -3432,7 +3432,7 @@ static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) return 0; } @@ -79902,7 +80220,7 @@ index 45c32f0..0038be2 100644 .ptrace_access_check = smack_ptrace_access_check, diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c -index 620d37c..e2ad89b 100644 +index c2d04a5..e6a1aeb 100644 --- a/security/tomoyo/tomoyo.c +++ b/security/tomoyo/tomoyo.c @@ -501,7 +501,7 @@ static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg, @@ -80059,10 +80377,10 @@ index 91cdf94..4085161 100644 if (err < 0) return err; diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c -index 3fe99e6..26952e4 100644 +index 53b5ada..2db94c8 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c -@@ -2770,11 +2770,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream, +@@ -2780,11 +2780,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream, switch (substream->stream) { case SNDRV_PCM_STREAM_PLAYBACK: result = snd_pcm_playback_ioctl1(NULL, substream, cmd, @@ -80211,10 +80529,10 @@ index 3e32bd3..46fc152 100644 struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS]; }; diff --git a/sound/firewire/amdtp.c b/sound/firewire/amdtp.c -index 87657dd..a8268d4 100644 +index ea995af..f1bfa37 100644 --- a/sound/firewire/amdtp.c +++ b/sound/firewire/amdtp.c -@@ -371,7 +371,7 @@ static void queue_out_packet(struct amdtp_out_stream *s, unsigned int cycle) +@@ -389,7 +389,7 @@ static void queue_out_packet(struct amdtp_out_stream *s, unsigned int cycle) ptr = s->pcm_buffer_pointer + data_blocks; if (ptr >= pcm->runtime->buffer_size) ptr -= pcm->runtime->buffer_size; @@ -80223,7 +80541,7 @@ index 87657dd..a8268d4 100644 s->pcm_period_pointer += data_blocks; if (s->pcm_period_pointer >= pcm->runtime->period_size) { -@@ -511,7 +511,7 @@ EXPORT_SYMBOL(amdtp_out_stream_start); +@@ -557,7 +557,7 @@ EXPORT_SYMBOL(amdtp_out_stream_pcm_pointer); */ void amdtp_out_stream_update(struct amdtp_out_stream *s) { @@ -80233,10 +80551,10 @@ index 87657dd..a8268d4 100644 } EXPORT_SYMBOL(amdtp_out_stream_update); diff --git a/sound/firewire/amdtp.h b/sound/firewire/amdtp.h -index 537a9cb..8e8c8e9 100644 +index b680c5e..061b7a0 100644 --- a/sound/firewire/amdtp.h +++ b/sound/firewire/amdtp.h -@@ -146,7 +146,7 @@ static inline void amdtp_out_stream_pcm_prepare(struct amdtp_out_stream *s) +@@ -139,7 +139,7 @@ static inline bool amdtp_out_streaming_error(struct amdtp_out_stream *s) static inline void amdtp_out_stream_pcm_trigger(struct amdtp_out_stream *s, struct snd_pcm_substream *pcm) { @@ -80244,7 +80562,7 @@ index 537a9cb..8e8c8e9 100644 + ACCESS_ONCE_RW(s->pcm) = pcm; } - /** + static inline bool cip_sfc_is_base_44100(enum cip_sfc sfc) diff --git a/sound/firewire/isight.c b/sound/firewire/isight.c index d428ffe..751ef78 100644 --- a/sound/firewire/isight.c @@ -80354,7 +80672,7 @@ index 09d4648..cf234c7 100644 list_add(&s->list, &cs4297a_devs); diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h -index 56b4f74..7cfd41a 100644 +index 2fdaadb..7df8fc6 100644 --- a/sound/pci/hda/hda_codec.h +++ b/sound/pci/hda/hda_codec.h @@ -611,7 +611,7 @@ struct hda_bus_ops { @@ -80366,7 +80684,7 @@ index 56b4f74..7cfd41a 100644 /* template to pass to the bus constructor */ struct hda_bus_template { -@@ -713,6 +713,7 @@ struct hda_codec_ops { +@@ -711,6 +711,7 @@ struct hda_codec_ops { #endif void (*reboot_notify)(struct hda_codec *codec); }; @@ -80374,7 +80692,7 @@ index 56b4f74..7cfd41a 100644 /* record for amp information cache */ struct hda_cache_head { -@@ -743,7 +744,7 @@ struct hda_pcm_ops { +@@ -741,7 +742,7 @@ struct hda_pcm_ops { struct snd_pcm_substream *substream); int (*cleanup)(struct hda_pcm_stream *info, struct hda_codec *codec, struct snd_pcm_substream *substream); @@ -80383,7 +80701,7 @@ index 56b4f74..7cfd41a 100644 /* PCM information for each substream */ struct hda_pcm_stream { -@@ -801,7 +802,7 @@ struct hda_codec { +@@ -799,7 +800,7 @@ struct hda_codec { const char *modelname; /* model name for preset */ /* set by patch */ @@ -80458,40 +80776,6 @@ index a8159b81..5f006a5 100644 chip->card = card; chip->pci = pci; chip->irq = -1; -diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c -index 0ad8dca..7186339 100644 ---- a/sound/soc/soc-pcm.c -+++ b/sound/soc/soc-pcm.c -@@ -641,7 +641,7 @@ int soc_new_pcm(struct snd_soc_pcm_runtime *rtd, int num) - struct snd_soc_platform *platform = rtd->platform; - struct snd_soc_dai *codec_dai = rtd->codec_dai; - struct snd_soc_dai *cpu_dai = rtd->cpu_dai; -- struct snd_pcm_ops *soc_pcm_ops = &rtd->ops; -+ snd_pcm_ops_no_const *soc_pcm_ops = &rtd->ops; - struct snd_pcm *pcm; - char new_name[64]; - int ret = 0, playback = 0, capture = 0; -diff --git a/sound/usb/card.h b/sound/usb/card.h -index da5fa1a..113cd02 100644 ---- a/sound/usb/card.h -+++ b/sound/usb/card.h -@@ -45,6 +45,7 @@ struct snd_urb_ops { - int (*prepare_sync)(struct snd_usb_substream *subs, struct snd_pcm_runtime *runtime, struct urb *u); - int (*retire_sync)(struct snd_usb_substream *subs, struct snd_pcm_runtime *runtime, struct urb *u); - }; -+typedef struct snd_urb_ops __no_const snd_urb_ops_no_const; - - struct snd_usb_substream { - struct snd_usb_stream *stream; -@@ -94,7 +95,7 @@ struct snd_usb_substream { - struct snd_pcm_hw_constraint_list rate_list; /* limited rates */ - spinlock_t lock; - -- struct snd_urb_ops ops; /* callbacks (must be filled at init) */ -+ snd_urb_ops_no_const ops; /* callbacks (must be filled at init) */ - int last_frame_number; /* stored frame number */ - int last_delay; /* stored delay */ - }; diff --git a/tools/gcc/.gitignore b/tools/gcc/.gitignore new file mode 100644 index 0000000..50f2f2f @@ -86280,7 +86564,7 @@ index af0f22f..9a7d479 100644 break; } diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index 9739b53..6d457e3 100644 +index 44ee712..7da730b 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -75,7 +75,7 @@ LIST_HEAD(vm_list); @@ -86292,7 +86576,7 @@ index 9739b53..6d457e3 100644 struct kmem_cache *kvm_vcpu_cache; EXPORT_SYMBOL_GPL(kvm_vcpu_cache); -@@ -2247,7 +2247,7 @@ static void hardware_enable_nolock(void *junk) +@@ -2291,7 +2291,7 @@ static void hardware_enable_nolock(void *junk) if (r) { cpumask_clear_cpu(cpu, cpus_hardware_enabled); @@ -86301,7 +86585,7 @@ index 9739b53..6d457e3 100644 printk(KERN_INFO "kvm: enabling virtualization on " "CPU%d failed\n", cpu); } -@@ -2301,10 +2301,10 @@ static int hardware_enable_all(void) +@@ -2345,10 +2345,10 @@ static int hardware_enable_all(void) kvm_usage_count++; if (kvm_usage_count == 1) { @@ -86314,7 +86598,7 @@ index 9739b53..6d457e3 100644 hardware_disable_all_nolock(); r = -EBUSY; } -@@ -2667,7 +2667,7 @@ static void kvm_sched_out(struct preempt_notifier *pn, +@@ -2709,7 +2709,7 @@ static void kvm_sched_out(struct preempt_notifier *pn, kvm_arch_vcpu_put(vcpu); } @@ -86323,7 +86607,7 @@ index 9739b53..6d457e3 100644 struct module *module) { int r; -@@ -2730,7 +2730,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, +@@ -2772,7 +2772,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, if (!vcpu_align) vcpu_align = __alignof__(struct kvm_vcpu); kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align, @@ -86332,7 +86616,7 @@ index 9739b53..6d457e3 100644 if (!kvm_vcpu_cache) { r = -ENOMEM; goto out_free_3; -@@ -2740,9 +2740,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, +@@ -2782,9 +2782,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, if (r) goto out_free; diff --git a/3.4.7/4430_grsec-remove-localversion-grsec.patch b/3.5.0/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/3.4.7/4430_grsec-remove-localversion-grsec.patch +++ b/3.5.0/4430_grsec-remove-localversion-grsec.patch diff --git a/3.4.7/4435_grsec-mute-warnings.patch b/3.5.0/4435_grsec-mute-warnings.patch index e85abd6..e85abd6 100644 --- a/3.4.7/4435_grsec-mute-warnings.patch +++ b/3.5.0/4435_grsec-mute-warnings.patch diff --git a/3.4.7/4440_grsec-remove-protected-paths.patch b/3.5.0/4440_grsec-remove-protected-paths.patch index 637934a..637934a 100644 --- a/3.4.7/4440_grsec-remove-protected-paths.patch +++ b/3.5.0/4440_grsec-remove-protected-paths.patch diff --git a/3.4.7/4450_grsec-kconfig-default-gids.patch b/3.5.0/4450_grsec-kconfig-default-gids.patch index a2e6f84..a2e6f84 100644 --- a/3.4.7/4450_grsec-kconfig-default-gids.patch +++ b/3.5.0/4450_grsec-kconfig-default-gids.patch diff --git a/3.4.7/4465_selinux-avc_audit-log-curr_ip.patch b/3.5.0/4465_selinux-avc_audit-log-curr_ip.patch index 2548df6..2548df6 100644 --- a/3.4.7/4465_selinux-avc_audit-log-curr_ip.patch +++ b/3.5.0/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/3.4.7/4470_disable-compat_vdso.patch b/3.5.0/4470_disable-compat_vdso.patch index 2a637c1..2a637c1 100644 --- a/3.4.7/4470_disable-compat_vdso.patch +++ b/3.5.0/4470_disable-compat_vdso.patch diff --git a/3.4.7/4480_fix-scsi-lpfc-Werror.patch b/3.5.0/4480_fix-scsi-lpfc-Werror.patch index e5bbb1c..e5bbb1c 100644 --- a/3.4.7/4480_fix-scsi-lpfc-Werror.patch +++ b/3.5.0/4480_fix-scsi-lpfc-Werror.patch |