diff options
| -rw-r--r-- | 4.7.4/0000_README (renamed from 4.7.3/0000_README) | 6 | ||||
| -rw-r--r-- | 4.7.4/1000_linux-4.7.1.patch (renamed from 4.7.3/1000_linux-4.7.1.patch) | 0 | ||||
| -rw-r--r-- | 4.7.4/1001_linux-4.7.2.patch (renamed from 4.7.3/1001_linux-4.7.2.patch) | 0 | ||||
| -rw-r--r-- | 4.7.4/1002_linux-4.7.3.patch (renamed from 4.7.3/1002_linux-4.7.3.patch) | 0 | ||||
| -rw-r--r-- | 4.7.4/1003_linux-4.7.4.patch | 2424 | ||||
| -rw-r--r-- | 4.7.4/4420_grsecurity-3.1-4.7.4-201609152234.patch (renamed from 4.7.3/4420_grsecurity-3.1-4.7.3-201609072139.patch) | 987 | ||||
| -rw-r--r-- | 4.7.4/4425_grsec_remove_EI_PAX.patch (renamed from 4.7.3/4425_grsec_remove_EI_PAX.patch) | 0 | ||||
| -rw-r--r-- | 4.7.4/4427_force_XATTR_PAX_tmpfs.patch (renamed from 4.7.3/4427_force_XATTR_PAX_tmpfs.patch) | 0 | ||||
| -rw-r--r-- | 4.7.4/4430_grsec-remove-localversion-grsec.patch (renamed from 4.7.3/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 4.7.4/4435_grsec-mute-warnings.patch (renamed from 4.7.3/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 4.7.4/4440_grsec-remove-protected-paths.patch (renamed from 4.7.3/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 4.7.4/4450_grsec-kconfig-default-gids.patch (renamed from 4.7.3/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 4.7.4/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 4.7.3/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 4.7.4/4470_disable-compat_vdso.patch (renamed from 4.7.3/4470_disable-compat_vdso.patch) | 0 | ||||
| -rw-r--r-- | 4.7.4/4475_emutramp_default_on.patch (renamed from 4.7.3/4475_emutramp_default_on.patch) | 0 |
15 files changed, 2953 insertions, 464 deletions
diff --git a/4.7.3/0000_README b/4.7.4/0000_README index af5ddba..6374649 100644 --- a/4.7.3/0000_README +++ b/4.7.4/0000_README @@ -14,7 +14,11 @@ Patch: 1002_linux-4.7.3.patch From: http://www.kernel.org Desc: Linux 4.7.3 -Patch: 4420_grsecurity-3.1-4.7.3-201609072139.patch +Patch: 1003_linux-4.7.4.patch +From: http://www.kernel.org +Desc: Linux 4.7.4 + +Patch: 4420_grsecurity-3.1-4.7.4-201609152234.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/4.7.3/1000_linux-4.7.1.patch b/4.7.4/1000_linux-4.7.1.patch index 79c652a..79c652a 100644 --- a/4.7.3/1000_linux-4.7.1.patch +++ b/4.7.4/1000_linux-4.7.1.patch diff --git a/4.7.3/1001_linux-4.7.2.patch b/4.7.4/1001_linux-4.7.2.patch index d0ef798..d0ef798 100644 --- a/4.7.3/1001_linux-4.7.2.patch +++ b/4.7.4/1001_linux-4.7.2.patch diff --git a/4.7.3/1002_linux-4.7.3.patch b/4.7.4/1002_linux-4.7.3.patch index caac684..caac684 100644 --- a/4.7.3/1002_linux-4.7.3.patch +++ b/4.7.4/1002_linux-4.7.3.patch diff --git a/4.7.4/1003_linux-4.7.4.patch b/4.7.4/1003_linux-4.7.4.patch new file mode 100644 index 0000000..af6c1d4 --- /dev/null +++ b/4.7.4/1003_linux-4.7.4.patch @@ -0,0 +1,2424 @@ +diff --git a/Makefile b/Makefile +index 4afff18..ec3bd11 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 7 +-SUBLEVEL = 3 ++SUBLEVEL = 4 + EXTRAVERSION = + NAME = Psychotic Stoned Sheep + +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index 60078a6..b15e1c1 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1597,6 +1597,9 @@ void __init enable_IR_x2apic(void) + unsigned long flags; + int ret, ir_stat; + ++ if (skip_ioapic_setup) ++ return; ++ + ir_stat = irq_remapping_prepare(); + if (ir_stat < 0 && !x2apic_supported()) + return; +diff --git a/block/blk-core.c b/block/blk-core.c +index 2475b1c7..b993f88 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -515,7 +515,9 @@ EXPORT_SYMBOL_GPL(blk_queue_bypass_end); + + void blk_set_queue_dying(struct request_queue *q) + { +- queue_flag_set_unlocked(QUEUE_FLAG_DYING, q); ++ spin_lock_irq(q->queue_lock); ++ queue_flag_set(QUEUE_FLAG_DYING, q); ++ spin_unlock_irq(q->queue_lock); + + if (q->mq_ops) + blk_mq_wake_waiters(q); +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 2613531..bea9344 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -94,9 +94,31 @@ static struct bio *blk_bio_segment_split(struct request_queue *q, + bool do_split = true; + struct bio *new = NULL; + const unsigned max_sectors = get_max_io_size(q, bio); ++ unsigned bvecs = 0; + + bio_for_each_segment(bv, bio, iter) { + /* ++ * With arbitrary bio size, the incoming bio may be very ++ * big. We have to split the bio into small bios so that ++ * each holds at most BIO_MAX_PAGES bvecs because ++ * bio_clone() can fail to allocate big bvecs. ++ * ++ * It should have been better to apply the limit per ++ * request queue in which bio_clone() is involved, ++ * instead of globally. The biggest blocker is the ++ * bio_clone() in bio bounce. ++ * ++ * If bio is splitted by this reason, we should have ++ * allowed to continue bios merging, but don't do ++ * that now for making the change simple. ++ * ++ * TODO: deal with bio bounce's bio_clone() gracefully ++ * and convert the global limit into per-queue limit. ++ */ ++ if (bvecs++ >= BIO_MAX_PAGES) ++ goto split; ++ ++ /* + * If the queue doesn't support SG gaps and adding this + * offset would create a gap, disallow it. + */ +diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c +index 84708a5..b206115 100644 +--- a/drivers/block/floppy.c ++++ b/drivers/block/floppy.c +@@ -3663,11 +3663,6 @@ static int floppy_open(struct block_device *bdev, fmode_t mode) + + opened_bdev[drive] = bdev; + +- if (!(mode & (FMODE_READ|FMODE_WRITE))) { +- res = -EINVAL; +- goto out; +- } +- + res = -ENXIO; + + if (!floppy_track_buffer) { +@@ -3711,20 +3706,21 @@ static int floppy_open(struct block_device *bdev, fmode_t mode) + if (UFDCS->rawcmd == 1) + UFDCS->rawcmd = 2; + +- UDRS->last_checked = 0; +- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); +- check_disk_change(bdev); +- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) +- goto out; +- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) +- goto out; +- +- res = -EROFS; +- +- if ((mode & FMODE_WRITE) && +- !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) +- goto out; +- ++ if (!(mode & FMODE_NDELAY)) { ++ if (mode & (FMODE_READ|FMODE_WRITE)) { ++ UDRS->last_checked = 0; ++ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); ++ check_disk_change(bdev); ++ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) ++ goto out; ++ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) ++ goto out; ++ } ++ res = -EROFS; ++ if ((mode & FMODE_WRITE) && ++ !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) ++ goto out; ++ } + mutex_unlock(&open_lock); + mutex_unlock(&floppy_mutex); + return 0; +diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c +index 0bb44d5..2ee40fd 100644 +--- a/drivers/cpufreq/cpufreq-dt-platdev.c ++++ b/drivers/cpufreq/cpufreq-dt-platdev.c +@@ -74,6 +74,8 @@ static const struct of_device_id machines[] __initconst = { + { .compatible = "ti,omap5", }, + + { .compatible = "xlnx,zynq-7000", }, ++ ++ { } + }; + + static int __init cpufreq_dt_platdev_init(void) +diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c +index 6dc5971..b304421 100644 +--- a/drivers/crypto/caam/caamalg.c ++++ b/drivers/crypto/caam/caamalg.c +@@ -556,7 +556,10 @@ skip_enc: + + /* Read and write assoclen bytes */ + append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ); +- append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ); ++ if (alg->caam.geniv) ++ append_math_add_imm_u32(desc, VARSEQOUTLEN, REG3, IMM, ivsize); ++ else ++ append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ); + + /* Skip assoc data */ + append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF); +@@ -565,6 +568,14 @@ skip_enc: + append_seq_fifo_load(desc, 0, FIFOLD_CLASS_CLASS2 | FIFOLD_TYPE_MSG | + KEY_VLF); + ++ if (alg->caam.geniv) { ++ append_seq_load(desc, ivsize, LDST_CLASS_1_CCB | ++ LDST_SRCDST_BYTE_CONTEXT | ++ (ctx1_iv_off << LDST_OFFSET_SHIFT)); ++ append_move(desc, MOVE_SRC_CLASS1CTX | MOVE_DEST_CLASS2INFIFO | ++ (ctx1_iv_off << MOVE_OFFSET_SHIFT) | ivsize); ++ } ++ + /* Load Counter into CONTEXT1 reg */ + if (is_rfc3686) + append_load_imm_u32(desc, be32_to_cpu(1), LDST_IMM | +@@ -2150,7 +2161,7 @@ static void init_authenc_job(struct aead_request *req, + + init_aead_job(req, edesc, all_contig, encrypt); + +- if (ivsize && (is_rfc3686 || !(alg->caam.geniv && encrypt))) ++ if (ivsize && ((is_rfc3686 && encrypt) || !alg->caam.geniv)) + append_load_as_imm(desc, req->iv, ivsize, + LDST_CLASS_1_CCB | + LDST_SRCDST_BYTE_CONTEXT | +@@ -2537,20 +2548,6 @@ static int aead_decrypt(struct aead_request *req) + return ret; + } + +-static int aead_givdecrypt(struct aead_request *req) +-{ +- struct crypto_aead *aead = crypto_aead_reqtfm(req); +- unsigned int ivsize = crypto_aead_ivsize(aead); +- +- if (req->cryptlen < ivsize) +- return -EINVAL; +- +- req->cryptlen -= ivsize; +- req->assoclen += ivsize; +- +- return aead_decrypt(req); +-} +- + /* + * allocate and map the ablkcipher extended descriptor for ablkcipher + */ +@@ -3210,7 +3207,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = AES_BLOCK_SIZE, + .maxauthsize = MD5_DIGEST_SIZE, + }, +@@ -3256,7 +3253,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = AES_BLOCK_SIZE, + .maxauthsize = SHA1_DIGEST_SIZE, + }, +@@ -3302,7 +3299,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = AES_BLOCK_SIZE, + .maxauthsize = SHA224_DIGEST_SIZE, + }, +@@ -3348,7 +3345,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = AES_BLOCK_SIZE, + .maxauthsize = SHA256_DIGEST_SIZE, + }, +@@ -3394,7 +3391,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = AES_BLOCK_SIZE, + .maxauthsize = SHA384_DIGEST_SIZE, + }, +@@ -3440,7 +3437,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = AES_BLOCK_SIZE, + .maxauthsize = SHA512_DIGEST_SIZE, + }, +@@ -3486,7 +3483,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = DES3_EDE_BLOCK_SIZE, + .maxauthsize = MD5_DIGEST_SIZE, + }, +@@ -3534,7 +3531,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = DES3_EDE_BLOCK_SIZE, + .maxauthsize = SHA1_DIGEST_SIZE, + }, +@@ -3582,7 +3579,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = DES3_EDE_BLOCK_SIZE, + .maxauthsize = SHA224_DIGEST_SIZE, + }, +@@ -3630,7 +3627,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = DES3_EDE_BLOCK_SIZE, + .maxauthsize = SHA256_DIGEST_SIZE, + }, +@@ -3678,7 +3675,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = DES3_EDE_BLOCK_SIZE, + .maxauthsize = SHA384_DIGEST_SIZE, + }, +@@ -3726,7 +3723,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = DES3_EDE_BLOCK_SIZE, + .maxauthsize = SHA512_DIGEST_SIZE, + }, +@@ -3772,7 +3769,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = DES_BLOCK_SIZE, + .maxauthsize = MD5_DIGEST_SIZE, + }, +@@ -3818,7 +3815,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = DES_BLOCK_SIZE, + .maxauthsize = SHA1_DIGEST_SIZE, + }, +@@ -3864,7 +3861,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = DES_BLOCK_SIZE, + .maxauthsize = SHA224_DIGEST_SIZE, + }, +@@ -3910,7 +3907,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = DES_BLOCK_SIZE, + .maxauthsize = SHA256_DIGEST_SIZE, + }, +@@ -3956,7 +3953,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = DES_BLOCK_SIZE, + .maxauthsize = SHA384_DIGEST_SIZE, + }, +@@ -4002,7 +3999,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = DES_BLOCK_SIZE, + .maxauthsize = SHA512_DIGEST_SIZE, + }, +@@ -4051,7 +4048,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = CTR_RFC3686_IV_SIZE, + .maxauthsize = MD5_DIGEST_SIZE, + }, +@@ -4102,7 +4099,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = CTR_RFC3686_IV_SIZE, + .maxauthsize = SHA1_DIGEST_SIZE, + }, +@@ -4153,7 +4150,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = CTR_RFC3686_IV_SIZE, + .maxauthsize = SHA224_DIGEST_SIZE, + }, +@@ -4204,7 +4201,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = CTR_RFC3686_IV_SIZE, + .maxauthsize = SHA256_DIGEST_SIZE, + }, +@@ -4255,7 +4252,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = CTR_RFC3686_IV_SIZE, + .maxauthsize = SHA384_DIGEST_SIZE, + }, +@@ -4306,7 +4303,7 @@ static struct caam_aead_alg driver_aeads[] = { + .setkey = aead_setkey, + .setauthsize = aead_setauthsize, + .encrypt = aead_encrypt, +- .decrypt = aead_givdecrypt, ++ .decrypt = aead_decrypt, + .ivsize = CTR_RFC3686_IV_SIZE, + .maxauthsize = SHA512_DIGEST_SIZE, + }, +diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c +index 9bb99e2..79a05a3 100644 +--- a/drivers/gpu/drm/drm_atomic.c ++++ b/drivers/gpu/drm/drm_atomic.c +@@ -465,7 +465,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc, + val, + -1, + &replaced); +- state->color_mgmt_changed = replaced; ++ state->color_mgmt_changed |= replaced; + return ret; + } else if (property == config->ctm_property) { + ret = drm_atomic_replace_property_blob_from_id(crtc, +@@ -473,7 +473,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc, + val, + sizeof(struct drm_color_ctm), + &replaced); +- state->color_mgmt_changed = replaced; ++ state->color_mgmt_changed |= replaced; + return ret; + } else if (property == config->gamma_lut_property) { + ret = drm_atomic_replace_property_blob_from_id(crtc, +@@ -481,7 +481,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc, + val, + -1, + &replaced); +- state->color_mgmt_changed = replaced; ++ state->color_mgmt_changed |= replaced; + return ret; + } else if (crtc->funcs->atomic_set_property) + return crtc->funcs->atomic_set_property(crtc, state, property, val); +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index 0e3cc66..a5cae1b 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -5312,6 +5312,9 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev, + struct drm_pending_vblank_event *e = NULL; + int ret = -EINVAL; + ++ if (!drm_core_check_feature(dev, DRIVER_MODESET)) ++ return -EINVAL; ++ + if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS || + page_flip->reserved != 0) + return -EINVAL; +diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c +index eb4bb8b..eb515f0 100644 +--- a/drivers/gpu/drm/msm/msm_gem_submit.c ++++ b/drivers/gpu/drm/msm/msm_gem_submit.c +@@ -62,6 +62,14 @@ void msm_gem_submit_free(struct msm_gem_submit *submit) + kfree(submit); + } + ++static inline unsigned long __must_check ++copy_from_user_inatomic(void *to, const void __user *from, unsigned long n) ++{ ++ if (access_ok(VERIFY_READ, from, n)) ++ return __copy_from_user_inatomic(to, from, n); ++ return -EFAULT; ++} ++ + static int submit_lookup_objects(struct msm_gem_submit *submit, + struct drm_msm_gem_submit *args, struct drm_file *file) + { +@@ -69,6 +77,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit, + int ret = 0; + + spin_lock(&file->table_lock); ++ pagefault_disable(); + + for (i = 0; i < args->nr_bos; i++) { + struct drm_msm_gem_submit_bo submit_bo; +@@ -82,10 +91,15 @@ static int submit_lookup_objects(struct msm_gem_submit *submit, + */ + submit->bos[i].flags = 0; + +- ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo)); +- if (ret) { +- ret = -EFAULT; +- goto out_unlock; ++ ret = copy_from_user_inatomic(&submit_bo, userptr, sizeof(submit_bo)); ++ if (unlikely(ret)) { ++ pagefault_enable(); ++ spin_unlock(&file->table_lock); ++ ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo)); ++ if (ret) ++ goto out; ++ spin_lock(&file->table_lock); ++ pagefault_disable(); + } + + if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) { +@@ -125,9 +139,12 @@ static int submit_lookup_objects(struct msm_gem_submit *submit, + } + + out_unlock: +- submit->nr_bos = i; ++ pagefault_enable(); + spin_unlock(&file->table_lock); + ++out: ++ submit->nr_bos = i; ++ + return ret; + } + +diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c +index 259cd6e..17e3454 100644 +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -627,7 +627,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc, + if (radeon_crtc->ss.refdiv) { + radeon_crtc->pll_flags |= RADEON_PLL_USE_REF_DIV; + radeon_crtc->pll_reference_div = radeon_crtc->ss.refdiv; +- if (rdev->family >= CHIP_RV770) ++ if (ASIC_IS_AVIVO(rdev) && ++ rdev->family != CHIP_RS780 && ++ rdev->family != CHIP_RS880) + radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV; + } + } +diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c +index 590b037..0ab76dd 100644 +--- a/drivers/gpu/drm/radeon/radeon_ttm.c ++++ b/drivers/gpu/drm/radeon/radeon_ttm.c +@@ -263,8 +263,8 @@ static int radeon_move_blit(struct ttm_buffer_object *bo, + + rdev = radeon_get_rdev(bo->bdev); + ridx = radeon_copy_ring_index(rdev); +- old_start = old_mem->start << PAGE_SHIFT; +- new_start = new_mem->start << PAGE_SHIFT; ++ old_start = (u64)old_mem->start << PAGE_SHIFT; ++ new_start = (u64)new_mem->start << PAGE_SHIFT; + + switch (old_mem->mem_type) { + case TTM_PL_VRAM: +diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h +index 37cac59..2e24616 100644 +--- a/drivers/gpu/drm/vc4/vc4_drv.h ++++ b/drivers/gpu/drm/vc4/vc4_drv.h +@@ -321,6 +321,15 @@ vc4_first_render_job(struct vc4_dev *vc4) + struct vc4_exec_info, head); + } + ++static inline struct vc4_exec_info * ++vc4_last_render_job(struct vc4_dev *vc4) ++{ ++ if (list_empty(&vc4->render_job_list)) ++ return NULL; ++ return list_last_entry(&vc4->render_job_list, ++ struct vc4_exec_info, head); ++} ++ + /** + * struct vc4_texture_sample_info - saves the offsets into the UBO for texture + * setup parameters. +diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c +index 46899d6..78ab08e 100644 +--- a/drivers/gpu/drm/vc4/vc4_gem.c ++++ b/drivers/gpu/drm/vc4/vc4_gem.c +@@ -574,8 +574,8 @@ vc4_cl_lookup_bos(struct drm_device *dev, + spin_unlock(&file_priv->table_lock); + + fail: +- kfree(handles); +- return 0; ++ drm_free_large(handles); ++ return ret; + } + + static int +diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c +index b0104a34..094bc6a 100644 +--- a/drivers/gpu/drm/vc4/vc4_irq.c ++++ b/drivers/gpu/drm/vc4/vc4_irq.c +@@ -83,8 +83,10 @@ vc4_overflow_mem_work(struct work_struct *work) + + spin_lock_irqsave(&vc4->job_lock, irqflags); + current_exec = vc4_first_bin_job(vc4); ++ if (!current_exec) ++ current_exec = vc4_last_render_job(vc4); + if (current_exec) { +- vc4->overflow_mem->seqno = vc4->finished_seqno + 1; ++ vc4->overflow_mem->seqno = current_exec->seqno; + list_add_tail(&vc4->overflow_mem->unref_head, + ¤t_exec->unref_list); + vc4->overflow_mem = NULL; +diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c +index 70ed1d0..d3ef0fc 100644 +--- a/drivers/irqchip/irq-mips-gic.c ++++ b/drivers/irqchip/irq-mips-gic.c +@@ -713,9 +713,6 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq, + unsigned long flags; + int i; + +- irq_set_chip_and_handler(virq, &gic_level_irq_controller, +- handle_level_irq); +- + spin_lock_irqsave(&gic_lock, flags); + gic_map_to_pin(intr, gic_cpu_pin); + gic_map_to_vpe(intr, mips_cm_vp_id(vpe)); +@@ -732,6 +729,10 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq, + { + if (GIC_HWIRQ_TO_LOCAL(hw) < GIC_NUM_LOCAL_INTRS) + return gic_local_irq_domain_map(d, virq, hw); ++ ++ irq_set_chip_and_handler(virq, &gic_level_irq_controller, ++ handle_level_irq); ++ + return gic_shared_irq_domain_map(d, virq, hw, 0); + } + +@@ -771,11 +772,13 @@ static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq, + hwirq = GIC_SHARED_TO_HWIRQ(base_hwirq + i); + + ret = irq_domain_set_hwirq_and_chip(d, virq + i, hwirq, +- &gic_edge_irq_controller, ++ &gic_level_irq_controller, + NULL); + if (ret) + goto error; + ++ irq_set_handler(virq + i, handle_level_irq); ++ + ret = gic_shared_irq_domain_map(d, virq + i, hwirq, cpu); + if (ret) + goto error; +@@ -890,10 +893,17 @@ void gic_dev_domain_free(struct irq_domain *d, unsigned int virq, + return; + } + ++static void gic_dev_domain_activate(struct irq_domain *domain, ++ struct irq_data *d) ++{ ++ gic_shared_irq_domain_map(domain, d->irq, d->hwirq, 0); ++} ++ + static struct irq_domain_ops gic_dev_domain_ops = { + .xlate = gic_dev_domain_xlate, + .alloc = gic_dev_domain_alloc, + .free = gic_dev_domain_free, ++ .activate = gic_dev_domain_activate, + }; + + static int gic_ipi_domain_xlate(struct irq_domain *d, struct device_node *ctrlr, +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index f5dbb4e..5d3b231 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1818,7 +1818,7 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca) + free = roundup_pow_of_two(ca->sb.nbuckets) >> 10; + + if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) || +- !init_fifo(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) || ++ !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) || + !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) || + !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) || + !init_fifo(&ca->free_inc, free << 2, GFP_KERNEL) || +diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c +index e2fb44c..dc3a854 100644 +--- a/drivers/misc/mei/hw-me.c ++++ b/drivers/misc/mei/hw-me.c +@@ -1263,8 +1263,14 @@ static bool mei_me_fw_type_nm(struct pci_dev *pdev) + static bool mei_me_fw_type_sps(struct pci_dev *pdev) + { + u32 reg; +- /* Read ME FW Status check for SPS Firmware */ +- pci_read_config_dword(pdev, PCI_CFG_HFS_1, ®); ++ unsigned int devfn; ++ ++ /* ++ * Read ME FW Status register to check for SPS Firmware ++ * The SPS FW is only signaled in pci function 0 ++ */ ++ devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0); ++ pci_bus_read_config_dword(pdev->bus, devfn, PCI_CFG_HFS_1, ®); + trace_mei_pci_cfg_read(&pdev->dev, "PCI_CFG_HFS_1", PCI_CFG_HFS_1, reg); + /* if bits [19:16] = 15, running SPS Firmware */ + return (reg & 0xf0000) == 0xf0000; +diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c +index 64e64da..71cea9b 100644 +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -85,8 +85,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = { + + {MEI_PCI_DEVICE(MEI_DEV_ID_SPT, mei_me_pch8_cfg)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_cfg)}, +- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_cfg)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)}, + + {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)}, +diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c +index 83458f7..6dc96c8 100644 +--- a/drivers/scsi/constants.c ++++ b/drivers/scsi/constants.c +@@ -361,8 +361,9 @@ static const char * const snstext[] = { + + /* Get sense key string or NULL if not available */ + const char * +-scsi_sense_key_string(unsigned char key) { +- if (key <= 0xE) ++scsi_sense_key_string(unsigned char key) ++{ ++ if (key < ARRAY_SIZE(snstext)) + return snstext[key]; + return NULL; + } +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 0a4d54a..591e520 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1196,6 +1196,8 @@ static int acm_probe(struct usb_interface *intf, + } + + if (!buflen) { ++ if (!intf->cur_altsetting || !intf->cur_altsetting->endpoint) ++ return -EINVAL; + if (intf->cur_altsetting->endpoint && + intf->cur_altsetting->endpoint->extralen && + intf->cur_altsetting->endpoint->extra) { +@@ -1276,6 +1278,8 @@ next_desc: + data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = call_interface_num)); + control_interface = intf; + } else { ++ if (!intf->cur_altsetting) ++ return -ENODEV; + if (intf->cur_altsetting->desc.bNumEndpoints != 3) { + dev_dbg(&intf->dev,"No union descriptor, giving up\n"); + return -ENODEV; +@@ -1305,15 +1309,22 @@ next_desc: + combined_interfaces = 1; + /* a popular other OS doesn't use it */ + quirks |= NO_CAP_LINE; ++ if (!data_interface->cur_altsetting) ++ return -EINVAL; + if (data_interface->cur_altsetting->desc.bNumEndpoints != 3) { + dev_err(&intf->dev, "This needs exactly 3 endpoints\n"); + return -EINVAL; + } + look_for_collapsed_interface: ++ if (!data_interface->cur_altsetting) ++ return -EINVAL; + for (i = 0; i < 3; i++) { + struct usb_endpoint_descriptor *ep; + ep = &data_interface->cur_altsetting->endpoint[i].desc; + ++ if (!ep) ++ return -ENODEV; ++ + if (usb_endpoint_is_int_in(ep)) + epctrl = ep; + else if (usb_endpoint_is_bulk_out(ep)) +@@ -1332,8 +1343,12 @@ look_for_collapsed_interface: + skip_normal_probe: + + /*workaround for switched interfaces */ ++ if (!data_interface->cur_altsetting) ++ return -EINVAL; + if (data_interface->cur_altsetting->desc.bInterfaceClass + != CDC_DATA_INTERFACE_TYPE) { ++ if (!control_interface->cur_altsetting) ++ return -EINVAL; + if (control_interface->cur_altsetting->desc.bInterfaceClass + == CDC_DATA_INTERFACE_TYPE) { + dev_dbg(&intf->dev, +@@ -1356,6 +1371,7 @@ skip_normal_probe: + + + if (data_interface->cur_altsetting->desc.bNumEndpoints < 2 || ++ !control_interface->cur_altsetting || + control_interface->cur_altsetting->desc.bNumEndpoints == 0) + return -EINVAL; + +@@ -1363,6 +1379,8 @@ skip_normal_probe: + epread = &data_interface->cur_altsetting->endpoint[0].desc; + epwrite = &data_interface->cur_altsetting->endpoint[1].desc; + ++ if (!epctrl || !epread || !epwrite) ++ return -ENODEV; + + /* workaround for switched endpoints */ + if (!usb_endpoint_dir_in(epread)) { +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index 9d6320e..6e29d05 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -88,7 +88,7 @@ struct vhost_scsi_cmd { + struct scatterlist *tvc_prot_sgl; + struct page **tvc_upages; + /* Pointer to response header iovec */ +- struct iovec *tvc_resp_iov; ++ struct iovec tvc_resp_iov; + /* Pointer to vhost_scsi for our device */ + struct vhost_scsi *tvc_vhost; + /* Pointer to vhost_virtqueue for the cmd */ +@@ -547,7 +547,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) + memcpy(v_rsp.sense, cmd->tvc_sense_buf, + se_cmd->scsi_sense_length); + +- iov_iter_init(&iov_iter, READ, cmd->tvc_resp_iov, ++ iov_iter_init(&iov_iter, READ, &cmd->tvc_resp_iov, + cmd->tvc_in_iovs, sizeof(v_rsp)); + ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter); + if (likely(ret == sizeof(v_rsp))) { +@@ -1044,7 +1044,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + } + cmd->tvc_vhost = vs; + cmd->tvc_vq = vq; +- cmd->tvc_resp_iov = &vq->iov[out]; ++ cmd->tvc_resp_iov = vq->iov[out]; + cmd->tvc_in_iovs = in; + + pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n", +diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c +index 7487971..c1010f01 100644 +--- a/drivers/xen/xenbus/xenbus_dev_frontend.c ++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c +@@ -316,7 +316,7 @@ static int xenbus_write_transaction(unsigned msg_type, + rc = -ENOMEM; + goto out; + } +- } else { ++ } else if (msg_type == XS_TRANSACTION_END) { + list_for_each_entry(trans, &u->transactions, list) + if (trans->handle.id == u->u.msg.tx_id) + break; +diff --git a/fs/block_dev.c b/fs/block_dev.c +index 71ccab1..b1495fa 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -659,7 +659,7 @@ static struct dentry *bd_mount(struct file_system_type *fs_type, + { + struct dentry *dent; + dent = mount_pseudo(fs_type, "bdev:", &bdev_sops, NULL, BDEVFS_MAGIC); +- if (dent) ++ if (!IS_ERR(dent)) + dent->d_sb->s_iflags |= SB_I_CGROUPWB; + return dent; + } +diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c +index 0f9961e..f96547f 100644 +--- a/fs/crypto/policy.c ++++ b/fs/crypto/policy.c +@@ -95,10 +95,15 @@ static int create_encryption_context_from_policy(struct inode *inode, + int fscrypt_process_policy(struct inode *inode, + const struct fscrypt_policy *policy) + { ++ if (!inode_owner_or_capable(inode)) ++ return -EACCES; ++ + if (policy->version != 0) + return -EINVAL; + + if (!inode_has_encryption_context(inode)) { ++ if (!S_ISDIR(inode->i_mode)) ++ return -EINVAL; + if (!inode->i_sb->s_cop->empty_dir) + return -EOPNOTSUPP; + if (!inode->i_sb->s_cop->empty_dir(inode)) +diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c +index ad05069..8a9feb3 100644 +--- a/fs/ext4/crypto_policy.c ++++ b/fs/ext4/crypto_policy.c +@@ -102,6 +102,9 @@ static int ext4_create_encryption_context_from_policy( + int ext4_process_policy(const struct ext4_encryption_policy *policy, + struct inode *inode) + { ++ if (!inode_owner_or_capable(inode)) ++ return -EACCES; ++ + if (policy->version != 0) + return -EINVAL; + +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index b747ec0..ea628af 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -51,25 +51,31 @@ static __u32 ext4_inode_csum(struct inode *inode, struct ext4_inode *raw, + struct ext4_inode_info *ei) + { + struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); +- __u16 csum_lo; +- __u16 csum_hi = 0; + __u32 csum; ++ __u16 dummy_csum = 0; ++ int offset = offsetof(struct ext4_inode, i_checksum_lo); ++ unsigned int csum_size = sizeof(dummy_csum); + +- csum_lo = le16_to_cpu(raw->i_checksum_lo); +- raw->i_checksum_lo = 0; +- if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE && +- EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) { +- csum_hi = le16_to_cpu(raw->i_checksum_hi); +- raw->i_checksum_hi = 0; +- } ++ csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw, offset); ++ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, csum_size); ++ offset += csum_size; ++ csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset, ++ EXT4_GOOD_OLD_INODE_SIZE - offset); + +- csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw, +- EXT4_INODE_SIZE(inode->i_sb)); +- +- raw->i_checksum_lo = cpu_to_le16(csum_lo); +- if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE && +- EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) +- raw->i_checksum_hi = cpu_to_le16(csum_hi); ++ if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) { ++ offset = offsetof(struct ext4_inode, i_checksum_hi); ++ csum = ext4_chksum(sbi, csum, (__u8 *)raw + ++ EXT4_GOOD_OLD_INODE_SIZE, ++ offset - EXT4_GOOD_OLD_INODE_SIZE); ++ if (EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) { ++ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, ++ csum_size); ++ offset += csum_size; ++ csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset, ++ EXT4_INODE_SIZE(inode->i_sb) - ++ offset); ++ } ++ } + + return csum; + } +@@ -5460,8 +5466,6 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode) + sbi->s_want_extra_isize, + iloc, handle); + if (ret) { +- ext4_set_inode_state(inode, +- EXT4_STATE_NO_EXPAND); + if (mnt_count != + le16_to_cpu(sbi->s_es->s_mnt_count)) { + ext4_warning(inode->i_sb, +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index ec4c399..5bb46b6 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -420,15 +420,14 @@ static __le32 ext4_dx_csum(struct inode *inode, struct ext4_dir_entry *dirent, + struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); + struct ext4_inode_info *ei = EXT4_I(inode); + __u32 csum; +- __le32 save_csum; + int size; ++ __u32 dummy_csum = 0; ++ int offset = offsetof(struct dx_tail, dt_checksum); + + size = count_offset + (count * sizeof(struct dx_entry)); +- save_csum = t->dt_checksum; +- t->dt_checksum = 0; + csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)dirent, size); +- csum = ext4_chksum(sbi, csum, (__u8 *)t, sizeof(struct dx_tail)); +- t->dt_checksum = save_csum; ++ csum = ext4_chksum(sbi, csum, (__u8 *)t, offset); ++ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, sizeof(dummy_csum)); + + return cpu_to_le32(csum); + } +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 639bd756..d4505f8 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -2068,23 +2068,25 @@ failed: + static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group, + struct ext4_group_desc *gdp) + { +- int offset; ++ int offset = offsetof(struct ext4_group_desc, bg_checksum); + __u16 crc = 0; + __le32 le_group = cpu_to_le32(block_group); + struct ext4_sb_info *sbi = EXT4_SB(sb); + + if (ext4_has_metadata_csum(sbi->s_sb)) { + /* Use new metadata_csum algorithm */ +- __le16 save_csum; + __u32 csum32; ++ __u16 dummy_csum = 0; + +- save_csum = gdp->bg_checksum; +- gdp->bg_checksum = 0; + csum32 = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&le_group, + sizeof(le_group)); +- csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp, +- sbi->s_desc_size); +- gdp->bg_checksum = save_csum; ++ csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp, offset); ++ csum32 = ext4_chksum(sbi, csum32, (__u8 *)&dummy_csum, ++ sizeof(dummy_csum)); ++ offset += sizeof(dummy_csum); ++ if (offset < sbi->s_desc_size) ++ csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp + offset, ++ sbi->s_desc_size - offset); + + crc = csum32 & 0xFFFF; + goto out; +@@ -2094,8 +2096,6 @@ static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group, + if (!ext4_has_feature_gdt_csum(sb)) + return 0; + +- offset = offsetof(struct ext4_group_desc, bg_checksum); +- + crc = crc16(~0, sbi->s_es->s_uuid, sizeof(sbi->s_es->s_uuid)); + crc = crc16(crc, (__u8 *)&le_group, sizeof(le_group)); + crc = crc16(crc, (__u8 *)gdp, offset); +@@ -2131,6 +2131,7 @@ void ext4_group_desc_csum_set(struct super_block *sb, __u32 block_group, + + /* Called at mount-time, super-block is locked */ + static int ext4_check_descriptors(struct super_block *sb, ++ ext4_fsblk_t sb_block, + ext4_group_t *first_not_zeroed) + { + struct ext4_sb_info *sbi = EXT4_SB(sb); +@@ -2161,6 +2162,11 @@ static int ext4_check_descriptors(struct super_block *sb, + grp = i; + + block_bitmap = ext4_block_bitmap(sb, gdp); ++ if (block_bitmap == sb_block) { ++ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " ++ "Block bitmap for group %u overlaps " ++ "superblock", i); ++ } + if (block_bitmap < first_block || block_bitmap > last_block) { + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " + "Block bitmap for group %u not in group " +@@ -2168,6 +2174,11 @@ static int ext4_check_descriptors(struct super_block *sb, + return 0; + } + inode_bitmap = ext4_inode_bitmap(sb, gdp); ++ if (inode_bitmap == sb_block) { ++ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " ++ "Inode bitmap for group %u overlaps " ++ "superblock", i); ++ } + if (inode_bitmap < first_block || inode_bitmap > last_block) { + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " + "Inode bitmap for group %u not in group " +@@ -2175,6 +2186,11 @@ static int ext4_check_descriptors(struct super_block *sb, + return 0; + } + inode_table = ext4_inode_table(sb, gdp); ++ if (inode_table == sb_block) { ++ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " ++ "Inode table for group %u overlaps " ++ "superblock", i); ++ } + if (inode_table < first_block || + inode_table + sbi->s_itb_per_group - 1 > last_block) { + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " +@@ -3677,7 +3693,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + goto failed_mount2; + } + } +- if (!ext4_check_descriptors(sb, &first_not_zeroed)) { ++ if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) { + ext4_msg(sb, KERN_ERR, "group descriptors corrupted!"); + ret = -EFSCORRUPTED; + goto failed_mount2; +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index e79bd32..2eb935c 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -121,17 +121,18 @@ static __le32 ext4_xattr_block_csum(struct inode *inode, + { + struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); + __u32 csum; +- __le32 save_csum; + __le64 dsk_block_nr = cpu_to_le64(block_nr); ++ __u32 dummy_csum = 0; ++ int offset = offsetof(struct ext4_xattr_header, h_checksum); + +- save_csum = hdr->h_checksum; +- hdr->h_checksum = 0; + csum = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&dsk_block_nr, + sizeof(dsk_block_nr)); +- csum = ext4_chksum(sbi, csum, (__u8 *)hdr, +- EXT4_BLOCK_SIZE(inode->i_sb)); ++ csum = ext4_chksum(sbi, csum, (__u8 *)hdr, offset); ++ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, sizeof(dummy_csum)); ++ offset += sizeof(dummy_csum); ++ csum = ext4_chksum(sbi, csum, (__u8 *)hdr + offset, ++ EXT4_BLOCK_SIZE(inode->i_sb) - offset); + +- hdr->h_checksum = save_csum; + return cpu_to_le32(csum); + } + +@@ -1352,15 +1353,19 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, + size_t min_offs, free; + int total_ino; + void *base, *start, *end; +- int extra_isize = 0, error = 0, tried_min_extra_isize = 0; ++ int error = 0, tried_min_extra_isize = 0; + int s_min_extra_isize = le16_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_min_extra_isize); ++ int isize_diff; /* How much do we need to grow i_extra_isize */ + + down_write(&EXT4_I(inode)->xattr_sem); ++ /* ++ * Set EXT4_STATE_NO_EXPAND to avoid recursion when marking inode dirty ++ */ ++ ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND); + retry: +- if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) { +- up_write(&EXT4_I(inode)->xattr_sem); +- return 0; +- } ++ isize_diff = new_extra_isize - EXT4_I(inode)->i_extra_isize; ++ if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) ++ goto out; + + header = IHDR(inode, raw_inode); + entry = IFIRST(header); +@@ -1381,7 +1386,7 @@ retry: + goto cleanup; + + free = ext4_xattr_free_space(last, &min_offs, base, &total_ino); +- if (free >= new_extra_isize) { ++ if (free >= isize_diff) { + entry = IFIRST(header); + ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize + - new_extra_isize, (void *)raw_inode + +@@ -1389,8 +1394,7 @@ retry: + (void *)header, total_ino, + inode->i_sb->s_blocksize); + EXT4_I(inode)->i_extra_isize = new_extra_isize; +- error = 0; +- goto cleanup; ++ goto out; + } + + /* +@@ -1413,7 +1417,7 @@ retry: + end = bh->b_data + bh->b_size; + min_offs = end - base; + free = ext4_xattr_free_space(first, &min_offs, base, NULL); +- if (free < new_extra_isize) { ++ if (free < isize_diff) { + if (!tried_min_extra_isize && s_min_extra_isize) { + tried_min_extra_isize++; + new_extra_isize = s_min_extra_isize; +@@ -1427,7 +1431,7 @@ retry: + free = inode->i_sb->s_blocksize; + } + +- while (new_extra_isize > 0) { ++ while (isize_diff > 0) { + size_t offs, size, entry_size; + struct ext4_xattr_entry *small_entry = NULL; + struct ext4_xattr_info i = { +@@ -1458,7 +1462,7 @@ retry: + EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) + + EXT4_XATTR_LEN(last->e_name_len); + if (total_size <= free && total_size < min_total_size) { +- if (total_size < new_extra_isize) { ++ if (total_size < isize_diff) { + small_entry = last; + } else { + entry = last; +@@ -1513,22 +1517,22 @@ retry: + error = ext4_xattr_ibody_set(handle, inode, &i, is); + if (error) + goto cleanup; ++ total_ino -= entry_size; + + entry = IFIRST(header); +- if (entry_size + EXT4_XATTR_SIZE(size) >= new_extra_isize) +- shift_bytes = new_extra_isize; ++ if (entry_size + EXT4_XATTR_SIZE(size) >= isize_diff) ++ shift_bytes = isize_diff; + else +- shift_bytes = entry_size + size; ++ shift_bytes = entry_size + EXT4_XATTR_SIZE(size); + /* Adjust the offsets and shift the remaining entries ahead */ +- ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize - +- shift_bytes, (void *)raw_inode + +- EXT4_GOOD_OLD_INODE_SIZE + extra_isize + shift_bytes, +- (void *)header, total_ino - entry_size, +- inode->i_sb->s_blocksize); ++ ext4_xattr_shift_entries(entry, -shift_bytes, ++ (void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE + ++ EXT4_I(inode)->i_extra_isize + shift_bytes, ++ (void *)header, total_ino, inode->i_sb->s_blocksize); + +- extra_isize += shift_bytes; +- new_extra_isize -= shift_bytes; +- EXT4_I(inode)->i_extra_isize = extra_isize; ++ isize_diff -= shift_bytes; ++ EXT4_I(inode)->i_extra_isize += shift_bytes; ++ header = IHDR(inode, raw_inode); + + i.name = b_entry_name; + i.value = buffer; +@@ -1550,6 +1554,8 @@ retry: + kfree(bs); + } + brelse(bh); ++out: ++ ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND); + up_write(&EXT4_I(inode)->xattr_sem); + return 0; + +@@ -1561,6 +1567,10 @@ cleanup: + kfree(is); + kfree(bs); + brelse(bh); ++ /* ++ * We deliberately leave EXT4_STATE_NO_EXPAND set here since inode ++ * size expansion failed. ++ */ + up_write(&EXT4_I(inode)->xattr_sem); + return error; + } +diff --git a/fs/namei.c b/fs/namei.c +index 70580ab..9281b2b 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -901,6 +901,7 @@ static inline int may_follow_link(struct nameidata *nd) + { + const struct inode *inode; + const struct inode *parent; ++ kuid_t puid; + + if (!sysctl_protected_symlinks) + return 0; +@@ -916,7 +917,8 @@ static inline int may_follow_link(struct nameidata *nd) + return 0; + + /* Allowed if parent directory and link owner match. */ +- if (uid_eq(parent->i_uid, inode->i_uid)) ++ puid = parent->i_uid; ++ if (uid_valid(puid) && uid_eq(puid, inode->i_uid)) + return 0; + + if (nd->flags & LOOKUP_RCU) +diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c +index 80aa6f1..4133aa7 100644 +--- a/fs/overlayfs/copy_up.c ++++ b/fs/overlayfs/copy_up.c +@@ -80,6 +80,8 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new) + } + + for (name = buf; name < (buf + list_size); name += strlen(name) + 1) { ++ if (ovl_is_private_xattr(name)) ++ continue; + retry: + size = vfs_getxattr(old, name, value, value_size); + if (size == -ERANGE) +diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c +index d1cdc60..ac98a71 100644 +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -231,7 +231,7 @@ static int ovl_readlink(struct dentry *dentry, char __user *buf, int bufsiz) + } + + +-static bool ovl_is_private_xattr(const char *name) ++bool ovl_is_private_xattr(const char *name) + { + return strncmp(name, OVL_XATTR_PRE_NAME, OVL_XATTR_PRE_LEN) == 0; + } +@@ -279,24 +279,27 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size) + { + struct dentry *realdentry = ovl_dentry_real(dentry); + ssize_t res; +- int off; ++ size_t len; ++ char *s; + + res = vfs_listxattr(realdentry, list, size); + if (res <= 0 || size == 0) + return res; + + /* filter out private xattrs */ +- for (off = 0; off < res;) { +- char *s = list + off; +- size_t slen = strlen(s) + 1; ++ for (s = list, len = res; len;) { ++ size_t slen = strnlen(s, len) + 1; + +- BUG_ON(off + slen > res); ++ /* underlying fs providing us with an broken xattr list? */ ++ if (WARN_ON(slen > len)) ++ return -EIO; + ++ len -= slen; + if (ovl_is_private_xattr(s)) { + res -= slen; +- memmove(s, s + slen, res - off); ++ memmove(s, s + slen, len); + } else { +- off += slen; ++ s += slen; + } + } + +diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h +index cfbca53..d8ddc31 100644 +--- a/fs/overlayfs/overlayfs.h ++++ b/fs/overlayfs/overlayfs.h +@@ -168,6 +168,8 @@ int ovl_check_empty_dir(struct dentry *dentry, struct list_head *list); + void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list); + void ovl_cache_free(struct list_head *list); + int ovl_check_d_type_supported(struct path *realpath); ++void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt, ++ struct dentry *dentry, int level); + + /* inode.c */ + int ovl_setattr(struct dentry *dentry, struct iattr *attr); +@@ -180,6 +182,7 @@ ssize_t ovl_getxattr(struct dentry *dentry, struct inode *inode, + ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size); + int ovl_removexattr(struct dentry *dentry, const char *name); + struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags); ++bool ovl_is_private_xattr(const char *name); + + struct inode *ovl_new_inode(struct super_block *sb, umode_t mode, + struct ovl_entry *oe); +diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c +index cf37fc7..f241b4e 100644 +--- a/fs/overlayfs/readdir.c ++++ b/fs/overlayfs/readdir.c +@@ -248,7 +248,7 @@ static inline int ovl_dir_read(struct path *realpath, + err = rdd->err; + } while (!err && rdd->count); + +- if (!err && rdd->first_maybe_whiteout) ++ if (!err && rdd->first_maybe_whiteout && rdd->dentry) + err = ovl_check_whiteouts(realpath->dentry, rdd); + + fput(realfile); +@@ -606,3 +606,64 @@ int ovl_check_d_type_supported(struct path *realpath) + + return rdd.d_type_supported; + } ++ ++static void ovl_workdir_cleanup_recurse(struct path *path, int level) ++{ ++ int err; ++ struct inode *dir = path->dentry->d_inode; ++ LIST_HEAD(list); ++ struct ovl_cache_entry *p; ++ struct ovl_readdir_data rdd = { ++ .ctx.actor = ovl_fill_merge, ++ .dentry = NULL, ++ .list = &list, ++ .root = RB_ROOT, ++ .is_lowest = false, ++ }; ++ ++ err = ovl_dir_read(path, &rdd); ++ if (err) ++ goto out; ++ ++ inode_lock_nested(dir, I_MUTEX_PARENT); ++ list_for_each_entry(p, &list, l_node) { ++ struct dentry *dentry; ++ ++ if (p->name[0] == '.') { ++ if (p->len == 1) ++ continue; ++ if (p->len == 2 && p->name[1] == '.') ++ continue; ++ } ++ dentry = lookup_one_len(p->name, path->dentry, p->len); ++ if (IS_ERR(dentry)) ++ continue; ++ if (dentry->d_inode) ++ ovl_workdir_cleanup(dir, path->mnt, dentry, level); ++ dput(dentry); ++ } ++ inode_unlock(dir); ++out: ++ ovl_cache_free(&list); ++} ++ ++void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt, ++ struct dentry *dentry, int level) ++{ ++ int err; ++ ++ if (!d_is_dir(dentry) || level > 1) { ++ ovl_cleanup(dir, dentry); ++ return; ++ } ++ ++ err = ovl_do_rmdir(dir, dentry); ++ if (err) { ++ struct path path = { .mnt = mnt, .dentry = dentry }; ++ ++ inode_unlock(dir); ++ ovl_workdir_cleanup_recurse(&path, level + 1); ++ inode_lock_nested(dir, I_MUTEX_PARENT); ++ ovl_cleanup(dir, dentry); ++ } ++} +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index 6db75cb..86f2025 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -798,6 +798,10 @@ retry: + struct kstat stat = { + .mode = S_IFDIR | 0, + }; ++ struct iattr attr = { ++ .ia_valid = ATTR_MODE, ++ .ia_mode = stat.mode, ++ }; + + if (work->d_inode) { + err = -EEXIST; +@@ -805,7 +809,7 @@ retry: + goto out_dput; + + retried = true; +- ovl_cleanup(dir, work); ++ ovl_workdir_cleanup(dir, mnt, work, 0); + dput(work); + goto retry; + } +@@ -813,6 +817,21 @@ retry: + err = ovl_create_real(dir, work, &stat, NULL, NULL, true); + if (err) + goto out_dput; ++ ++ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT); ++ if (err && err != -ENODATA && err != -EOPNOTSUPP) ++ goto out_dput; ++ ++ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS); ++ if (err && err != -ENODATA && err != -EOPNOTSUPP) ++ goto out_dput; ++ ++ /* Clear any inherited mode bits */ ++ inode_lock(work->d_inode); ++ err = notify_change(work, &attr, NULL); ++ inode_unlock(work->d_inode); ++ if (err) ++ goto out_dput; + } + out_unlock: + inode_unlock(dir); +diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c +index b45345d..51157da 100644 +--- a/fs/ubifs/tnc_commit.c ++++ b/fs/ubifs/tnc_commit.c +@@ -370,7 +370,7 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt) + + p = c->gap_lebs; + do { +- ubifs_assert(p < c->gap_lebs + sizeof(int) * c->lst.idx_lebs); ++ ubifs_assert(p < c->gap_lebs + c->lst.idx_lebs); + written = layout_leb_in_gaps(c, p); + if (written < 0) { + err = written; +diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c +index b5fc279..c63710f 100644 +--- a/fs/ubifs/xattr.c ++++ b/fs/ubifs/xattr.c +@@ -575,7 +575,8 @@ static int ubifs_xattr_get(const struct xattr_handler *handler, + dbg_gen("xattr '%s', ino %lu ('%pd'), buf size %zd", name, + inode->i_ino, dentry, size); + +- return __ubifs_getxattr(inode, name, buffer, size); ++ name = xattr_full_name(handler, name); ++ return __ubifs_getxattr(inode, name, buffer, size); + } + + static int ubifs_xattr_set(const struct xattr_handler *handler, +@@ -586,6 +587,8 @@ static int ubifs_xattr_set(const struct xattr_handler *handler, + dbg_gen("xattr '%s', host ino %lu ('%pd'), size %zd", + name, inode->i_ino, dentry, size); + ++ name = xattr_full_name(handler, name); ++ + if (value) + return __ubifs_setxattr(inode, name, value, size, flags); + else +diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c +index 12ca867..85bdf3d 100644 +--- a/fs/xfs/libxfs/xfs_sb.c ++++ b/fs/xfs/libxfs/xfs_sb.c +@@ -581,7 +581,8 @@ xfs_sb_verify( + * Only check the in progress field for the primary superblock as + * mkfs.xfs doesn't clear it from secondary superblocks. + */ +- return xfs_mount_validate_sb(mp, &sb, bp->b_bn == XFS_SB_DADDR, ++ return xfs_mount_validate_sb(mp, &sb, ++ bp->b_maps[0].bm_bn == XFS_SB_DADDR, + check_version); + } + +diff --git a/include/linux/capability.h b/include/linux/capability.h +index 00690ff..5f3c63d 100644 +--- a/include/linux/capability.h ++++ b/include/linux/capability.h +@@ -206,6 +206,7 @@ extern bool has_ns_capability_noaudit(struct task_struct *t, + struct user_namespace *ns, int cap); + extern bool capable(int cap); + extern bool ns_capable(struct user_namespace *ns, int cap); ++extern bool ns_capable_noaudit(struct user_namespace *ns, int cap); + #else + static inline bool has_capability(struct task_struct *t, int cap) + { +@@ -233,6 +234,10 @@ static inline bool ns_capable(struct user_namespace *ns, int cap) + { + return true; + } ++static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap) ++{ ++ return true; ++} + #endif /* CONFIG_MULTIUSER */ + extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap); + extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap); +diff --git a/kernel/capability.c b/kernel/capability.c +index 45432b5..00411c8 100644 +--- a/kernel/capability.c ++++ b/kernel/capability.c +@@ -361,6 +361,24 @@ bool has_capability_noaudit(struct task_struct *t, int cap) + return has_ns_capability_noaudit(t, &init_user_ns, cap); + } + ++static bool ns_capable_common(struct user_namespace *ns, int cap, bool audit) ++{ ++ int capable; ++ ++ if (unlikely(!cap_valid(cap))) { ++ pr_crit("capable() called with invalid cap=%u\n", cap); ++ BUG(); ++ } ++ ++ capable = audit ? security_capable(current_cred(), ns, cap) : ++ security_capable_noaudit(current_cred(), ns, cap); ++ if (capable == 0) { ++ current->flags |= PF_SUPERPRIV; ++ return true; ++ } ++ return false; ++} ++ + /** + * ns_capable - Determine if the current task has a superior capability in effect + * @ns: The usernamespace we want the capability in +@@ -374,19 +392,27 @@ bool has_capability_noaudit(struct task_struct *t, int cap) + */ + bool ns_capable(struct user_namespace *ns, int cap) + { +- if (unlikely(!cap_valid(cap))) { +- pr_crit("capable() called with invalid cap=%u\n", cap); +- BUG(); +- } +- +- if (security_capable(current_cred(), ns, cap) == 0) { +- current->flags |= PF_SUPERPRIV; +- return true; +- } +- return false; ++ return ns_capable_common(ns, cap, true); + } + EXPORT_SYMBOL(ns_capable); + ++/** ++ * ns_capable_noaudit - Determine if the current task has a superior capability ++ * (unaudited) in effect ++ * @ns: The usernamespace we want the capability in ++ * @cap: The capability to be tested for ++ * ++ * Return true if the current task has the given superior capability currently ++ * available for use, false if not. ++ * ++ * This sets PF_SUPERPRIV on the task if the capability is available on the ++ * assumption that it's about to be used. ++ */ ++bool ns_capable_noaudit(struct user_namespace *ns, int cap) ++{ ++ return ns_capable_common(ns, cap, false); ++} ++EXPORT_SYMBOL(ns_capable_noaudit); + + /** + * capable - Determine if the current task has a superior capability in effect +diff --git a/kernel/cred.c b/kernel/cred.c +index 0c0cd8a..5f264fb 100644 +--- a/kernel/cred.c ++++ b/kernel/cred.c +@@ -689,6 +689,8 @@ EXPORT_SYMBOL(set_security_override_from_ctx); + */ + int set_create_files_as(struct cred *new, struct inode *inode) + { ++ if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid)) ++ return -EINVAL; + new->fsuid = inode->i_uid; + new->fsgid = inode->i_gid; + return security_kernel_create_files_as(new, inode); +diff --git a/kernel/fork.c b/kernel/fork.c +index 4a7ec0c..aea4f4d 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1406,7 +1406,6 @@ static struct task_struct *copy_process(unsigned long clone_flags, + p->real_start_time = ktime_get_boot_ns(); + p->io_context = NULL; + p->audit_context = NULL; +- threadgroup_change_begin(current); + cgroup_fork(p); + #ifdef CONFIG_NUMA + p->mempolicy = mpol_dup(p->mempolicy); +@@ -1558,6 +1557,7 @@ static struct task_struct *copy_process(unsigned long clone_flags, + INIT_LIST_HEAD(&p->thread_group); + p->task_works = NULL; + ++ threadgroup_change_begin(current); + /* + * Ensure that the cgroup subsystem policies allow the new process to be + * forked. It should be noted the the new process's css_set can be changed +@@ -1658,6 +1658,7 @@ static struct task_struct *copy_process(unsigned long clone_flags, + bad_fork_cancel_cgroup: + cgroup_cancel_fork(p); + bad_fork_free_pid: ++ threadgroup_change_end(current); + if (pid != &init_struct_pid) + free_pid(pid); + bad_fork_cleanup_thread: +@@ -1690,7 +1691,6 @@ bad_fork_cleanup_policy: + mpol_put(p->mempolicy); + bad_fork_cleanup_threadgroup_lock: + #endif +- threadgroup_change_end(current); + delayacct_tsk_free(p); + bad_fork_cleanup_count: + atomic_dec(&p->cred->user->processes); +diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c +index 479d25c..b6c3945 100644 +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -401,7 +401,10 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf) + do { + seq = raw_read_seqcount_latch(&tkf->seq); + tkr = tkf->base + (seq & 0x01); +- now = ktime_to_ns(tkr->base) + timekeeping_get_ns(tkr); ++ now = ktime_to_ns(tkr->base); ++ ++ now += clocksource_delta(tkr->read(tkr->clock), ++ tkr->cycle_last, tkr->mask); + } while (read_seqcount_retry(&tkf->seq, seq)); + + return now; +diff --git a/kernel/time/timekeeping_debug.c b/kernel/time/timekeeping_debug.c +index f6bd652..107310a 100644 +--- a/kernel/time/timekeeping_debug.c ++++ b/kernel/time/timekeeping_debug.c +@@ -23,7 +23,9 @@ + + #include "timekeeping_internal.h" + +-static unsigned int sleep_time_bin[32] = {0}; ++#define NUM_BINS 32 ++ ++static unsigned int sleep_time_bin[NUM_BINS] = {0}; + + static int tk_debug_show_sleep_time(struct seq_file *s, void *data) + { +@@ -69,6 +71,9 @@ late_initcall(tk_debug_sleep_time_init); + + void tk_debug_account_sleep_time(struct timespec64 *t) + { +- sleep_time_bin[fls(t->tv_sec)]++; ++ /* Cap bin index so we don't overflow the array */ ++ int bin = min(fls(t->tv_sec), NUM_BINS-1); ++ ++ sleep_time_bin[bin]++; + } + +diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c +index c094754..f02ab80 100644 +--- a/net/sunrpc/xprtrdma/frwr_ops.c ++++ b/net/sunrpc/xprtrdma/frwr_ops.c +@@ -125,17 +125,16 @@ __frwr_reset_mr(struct rpcrdma_ia *ia, struct rpcrdma_mw *r) + } + + static void +-__frwr_reset_and_unmap(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mw *mw) ++__frwr_reset_and_unmap(struct rpcrdma_mw *mw) + { ++ struct rpcrdma_xprt *r_xprt = mw->mw_xprt; + struct rpcrdma_ia *ia = &r_xprt->rx_ia; +- struct rpcrdma_frmr *f = &mw->frmr; + int rc; + + rc = __frwr_reset_mr(ia, mw); +- ib_dma_unmap_sg(ia->ri_device, f->fr_sg, f->fr_nents, f->fr_dir); ++ ib_dma_unmap_sg(ia->ri_device, mw->mw_sg, mw->mw_nents, mw->mw_dir); + if (rc) + return; +- + rpcrdma_put_mw(r_xprt, mw); + } + +@@ -152,8 +151,7 @@ __frwr_recovery_worker(struct work_struct *work) + struct rpcrdma_mw *r = container_of(work, struct rpcrdma_mw, + mw_work); + +- __frwr_reset_and_unmap(r->mw_xprt, r); +- return; ++ __frwr_reset_and_unmap(r); + } + + /* A broken MR was discovered in a context that can't sleep. +@@ -167,8 +165,7 @@ __frwr_queue_recovery(struct rpcrdma_mw *r) + } + + static int +-__frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, struct ib_device *device, +- unsigned int depth) ++__frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, unsigned int depth) + { + struct rpcrdma_frmr *f = &r->frmr; + int rc; +@@ -177,11 +174,11 @@ __frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, struct ib_device *device, + if (IS_ERR(f->fr_mr)) + goto out_mr_err; + +- f->fr_sg = kcalloc(depth, sizeof(*f->fr_sg), GFP_KERNEL); +- if (!f->fr_sg) ++ r->mw_sg = kcalloc(depth, sizeof(*r->mw_sg), GFP_KERNEL); ++ if (!r->mw_sg) + goto out_list_err; + +- sg_init_table(f->fr_sg, depth); ++ sg_init_table(r->mw_sg, depth); + + init_completion(&f->fr_linv_done); + +@@ -210,7 +207,7 @@ __frwr_release(struct rpcrdma_mw *r) + if (rc) + dprintk("RPC: %s: ib_dereg_mr status %i\n", + __func__, rc); +- kfree(r->frmr.fr_sg); ++ kfree(r->mw_sg); + } + + static int +@@ -350,7 +347,6 @@ static int + frwr_op_init(struct rpcrdma_xprt *r_xprt) + { + struct rpcrdma_buffer *buf = &r_xprt->rx_buf; +- struct ib_device *device = r_xprt->rx_ia.ri_device; + unsigned int depth = r_xprt->rx_ia.ri_max_frmr_depth; + struct ib_pd *pd = r_xprt->rx_ia.ri_pd; + int i; +@@ -372,7 +368,7 @@ frwr_op_init(struct rpcrdma_xprt *r_xprt) + if (!r) + return -ENOMEM; + +- rc = __frwr_init(r, pd, device, depth); ++ rc = __frwr_init(r, pd, depth); + if (rc) { + kfree(r); + return rc; +@@ -386,7 +382,7 @@ frwr_op_init(struct rpcrdma_xprt *r_xprt) + return 0; + } + +-/* Post a FAST_REG Work Request to register a memory region ++/* Post a REG_MR Work Request to register a memory region + * for remote access via RDMA READ or RDMA WRITE. + */ + static int +@@ -394,8 +390,6 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg, + int nsegs, bool writing) + { + struct rpcrdma_ia *ia = &r_xprt->rx_ia; +- struct ib_device *device = ia->ri_device; +- enum dma_data_direction direction = rpcrdma_data_dir(writing); + struct rpcrdma_mr_seg *seg1 = seg; + struct rpcrdma_mw *mw; + struct rpcrdma_frmr *frmr; +@@ -421,15 +415,14 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg, + + if (nsegs > ia->ri_max_frmr_depth) + nsegs = ia->ri_max_frmr_depth; +- + for (i = 0; i < nsegs;) { + if (seg->mr_page) +- sg_set_page(&frmr->fr_sg[i], ++ sg_set_page(&mw->mw_sg[i], + seg->mr_page, + seg->mr_len, + offset_in_page(seg->mr_offset)); + else +- sg_set_buf(&frmr->fr_sg[i], seg->mr_offset, ++ sg_set_buf(&mw->mw_sg[i], seg->mr_offset, + seg->mr_len); + + ++seg; +@@ -440,26 +433,20 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg, + offset_in_page((seg-1)->mr_offset + (seg-1)->mr_len)) + break; + } +- frmr->fr_nents = i; +- frmr->fr_dir = direction; +- +- dma_nents = ib_dma_map_sg(device, frmr->fr_sg, frmr->fr_nents, direction); +- if (!dma_nents) { +- pr_err("RPC: %s: failed to dma map sg %p sg_nents %u\n", +- __func__, frmr->fr_sg, frmr->fr_nents); +- return -ENOMEM; +- } ++ mw->mw_nents = i; ++ mw->mw_dir = rpcrdma_data_dir(writing); + +- n = ib_map_mr_sg(mr, frmr->fr_sg, frmr->fr_nents, NULL, PAGE_SIZE); +- if (unlikely(n != frmr->fr_nents)) { +- pr_err("RPC: %s: failed to map mr %p (%u/%u)\n", +- __func__, frmr->fr_mr, n, frmr->fr_nents); +- rc = n < 0 ? n : -EINVAL; +- goto out_senderr; +- } ++ dma_nents = ib_dma_map_sg(ia->ri_device, ++ mw->mw_sg, mw->mw_nents, mw->mw_dir); ++ if (!dma_nents) ++ goto out_dmamap_err; ++ ++ n = ib_map_mr_sg(mr, mw->mw_sg, mw->mw_nents, NULL, PAGE_SIZE); ++ if (unlikely(n != mw->mw_nents)) ++ goto out_mapmr_err; + + dprintk("RPC: %s: Using frmr %p to map %u segments (%u bytes)\n", +- __func__, mw, frmr->fr_nents, mr->length); ++ __func__, mw, mw->mw_nents, mr->length); + + key = (u8)(mr->rkey & 0x000000FF); + ib_update_fast_reg_key(mr, ++key); +@@ -484,13 +471,25 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg, + seg1->rl_mw = mw; + seg1->mr_rkey = mr->rkey; + seg1->mr_base = mr->iova; +- seg1->mr_nsegs = frmr->fr_nents; ++ seg1->mr_nsegs = mw->mw_nents; + seg1->mr_len = mr->length; + +- return frmr->fr_nents; ++ return mw->mw_nents; ++ ++out_dmamap_err: ++ pr_err("rpcrdma: failed to dma map sg %p sg_nents %u\n", ++ mw->mw_sg, mw->mw_nents); ++ return -ENOMEM; ++ ++out_mapmr_err: ++ pr_err("rpcrdma: failed to map mr %p (%u/%u)\n", ++ frmr->fr_mr, n, mw->mw_nents); ++ rc = n < 0 ? n : -EIO; ++ __frwr_queue_recovery(mw); ++ return rc; + + out_senderr: +- dprintk("RPC: %s: ib_post_send status %i\n", __func__, rc); ++ pr_err("rpcrdma: ib_post_send status %i\n", rc); + __frwr_queue_recovery(mw); + return rc; + } +@@ -582,8 +581,8 @@ unmap: + mw = seg->rl_mw; + seg->rl_mw = NULL; + +- ib_dma_unmap_sg(ia->ri_device, f->fr_sg, f->fr_nents, +- f->fr_dir); ++ ib_dma_unmap_sg(ia->ri_device, ++ mw->mw_sg, mw->mw_nents, mw->mw_dir); + rpcrdma_put_mw(r_xprt, mw); + + i += seg->mr_nsegs; +@@ -630,7 +629,7 @@ frwr_op_unmap_safe(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req, + mw = seg->rl_mw; + + if (sync) +- __frwr_reset_and_unmap(r_xprt, mw); ++ __frwr_reset_and_unmap(mw); + else + __frwr_queue_recovery(mw); + +diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h +index 95cdc66..c53abd1 100644 +--- a/net/sunrpc/xprtrdma/xprt_rdma.h ++++ b/net/sunrpc/xprtrdma/xprt_rdma.h +@@ -221,9 +221,6 @@ enum rpcrdma_frmr_state { + }; + + struct rpcrdma_frmr { +- struct scatterlist *fr_sg; +- int fr_nents; +- enum dma_data_direction fr_dir; + struct ib_mr *fr_mr; + struct ib_cqe fr_cqe; + enum rpcrdma_frmr_state fr_state; +@@ -240,13 +237,16 @@ struct rpcrdma_fmr { + }; + + struct rpcrdma_mw { ++ struct list_head mw_list; ++ struct scatterlist *mw_sg; ++ int mw_nents; ++ enum dma_data_direction mw_dir; + union { + struct rpcrdma_fmr fmr; + struct rpcrdma_frmr frmr; + }; + struct work_struct mw_work; + struct rpcrdma_xprt *mw_xprt; +- struct list_head mw_list; + struct list_head mw_all; + }; + +diff --git a/net/sysctl_net.c b/net/sysctl_net.c +index ed98c1f..46a71c7 100644 +--- a/net/sysctl_net.c ++++ b/net/sysctl_net.c +@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ctl_table_header *head, + kgid_t root_gid = make_kgid(net->user_ns, 0); + + /* Allow network administrator to have same access as root. */ +- if (ns_capable(net->user_ns, CAP_NET_ADMIN) || ++ if (ns_capable_noaudit(net->user_ns, CAP_NET_ADMIN) || + uid_eq(root_uid, current_euid())) { + int mode = (table->mode >> 6) & 7; + return (mode << 6) | (mode << 3) | mode; +diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c +index 705c287..7347fcc 100644 +--- a/security/apparmor/policy.c ++++ b/security/apparmor/policy.c +@@ -766,7 +766,9 @@ struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name) + struct aa_profile *profile; + + rcu_read_lock(); +- profile = aa_get_profile(__find_child(&parent->base.profiles, name)); ++ do { ++ profile = __find_child(&parent->base.profiles, name); ++ } while (profile && !aa_get_profile_not0(profile)); + rcu_read_unlock(); + + /* refcount released by caller */ +diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c +index 795437b..b450a27 100644 +--- a/sound/core/rawmidi.c ++++ b/sound/core/rawmidi.c +@@ -1633,11 +1633,13 @@ static int snd_rawmidi_dev_register(struct snd_device *device) + return -EBUSY; + } + list_add_tail(&rmidi->list, &snd_rawmidi_devices); ++ mutex_unlock(®ister_mutex); + err = snd_register_device(SNDRV_DEVICE_TYPE_RAWMIDI, + rmidi->card, rmidi->device, + &snd_rawmidi_f_ops, rmidi, &rmidi->dev); + if (err < 0) { + rmidi_err(rmidi, "unable to register\n"); ++ mutex_lock(®ister_mutex); + list_del(&rmidi->list); + mutex_unlock(®ister_mutex); + return err; +@@ -1645,6 +1647,7 @@ static int snd_rawmidi_dev_register(struct snd_device *device) + if (rmidi->ops && rmidi->ops->dev_register && + (err = rmidi->ops->dev_register(rmidi)) < 0) { + snd_unregister_device(&rmidi->dev); ++ mutex_lock(®ister_mutex); + list_del(&rmidi->list); + mutex_unlock(®ister_mutex); + return err; +@@ -1677,7 +1680,6 @@ static int snd_rawmidi_dev_register(struct snd_device *device) + } + } + #endif /* CONFIG_SND_OSSEMUL */ +- mutex_unlock(®ister_mutex); + sprintf(name, "midi%d", rmidi->device); + entry = snd_info_create_card_entry(rmidi->card, name, rmidi->card->proc_root); + if (entry) { +diff --git a/sound/core/timer.c b/sound/core/timer.c +index 9a6157e..fc144f4 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -35,6 +35,9 @@ + #include <sound/initval.h> + #include <linux/kmod.h> + ++/* internal flags */ ++#define SNDRV_TIMER_IFLG_PAUSED 0x00010000 ++ + #if IS_ENABLED(CONFIG_SND_HRTIMER) + #define DEFAULT_TIMER_LIMIT 4 + #else +@@ -294,8 +297,21 @@ int snd_timer_open(struct snd_timer_instance **ti, + get_device(&timer->card->card_dev); + timeri->slave_class = tid->dev_sclass; + timeri->slave_id = slave_id; +- if (list_empty(&timer->open_list_head) && timer->hw.open) +- timer->hw.open(timer); ++ ++ if (list_empty(&timer->open_list_head) && timer->hw.open) { ++ int err = timer->hw.open(timer); ++ if (err) { ++ kfree(timeri->owner); ++ kfree(timeri); ++ ++ if (timer->card) ++ put_device(&timer->card->card_dev); ++ module_put(timer->module); ++ mutex_unlock(®ister_mutex); ++ return err; ++ } ++ } ++ + list_add_tail(&timeri->open_list, &timer->open_list_head); + snd_timer_check_master(timeri); + mutex_unlock(®ister_mutex); +@@ -526,6 +542,10 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop) + } + } + timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START); ++ if (stop) ++ timeri->flags &= ~SNDRV_TIMER_IFLG_PAUSED; ++ else ++ timeri->flags |= SNDRV_TIMER_IFLG_PAUSED; + snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : + SNDRV_TIMER_EVENT_CONTINUE); + unlock: +@@ -587,6 +607,10 @@ int snd_timer_stop(struct snd_timer_instance *timeri) + */ + int snd_timer_continue(struct snd_timer_instance *timeri) + { ++ /* timer can continue only after pause */ ++ if (!(timeri->flags & SNDRV_TIMER_IFLG_PAUSED)) ++ return -EINVAL; ++ + if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) + return snd_timer_start_slave(timeri, false); + else +@@ -813,6 +837,7 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid, + timer->tmr_subdevice = tid->subdevice; + if (id) + strlcpy(timer->id, id, sizeof(timer->id)); ++ timer->sticks = 1; + INIT_LIST_HEAD(&timer->device_list); + INIT_LIST_HEAD(&timer->open_list_head); + INIT_LIST_HEAD(&timer->active_list_head); +@@ -1817,6 +1842,9 @@ static int snd_timer_user_continue(struct file *file) + tu = file->private_data; + if (!tu->timeri) + return -EBADFD; ++ /* start timer instead of continue if it's not used before */ ++ if (!(tu->timeri->flags & SNDRV_TIMER_IFLG_PAUSED)) ++ return snd_timer_user_start(file); + tu->timeri->lost = 0; + return (err = snd_timer_continue(tu->timeri)) < 0 ? err : 0; + } +@@ -1958,6 +1986,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, + tu->qused--; + spin_unlock_irq(&tu->qlock); + ++ mutex_lock(&tu->ioctl_lock); + if (tu->tread) { + if (copy_to_user(buffer, &tu->tqueue[qhead], + sizeof(struct snd_timer_tread))) +@@ -1967,6 +1996,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, + sizeof(struct snd_timer_read))) + err = -EFAULT; + } ++ mutex_unlock(&tu->ioctl_lock); + + spin_lock_irq(&tu->qlock); + if (err < 0) +diff --git a/sound/firewire/fireworks/fireworks.h b/sound/firewire/fireworks/fireworks.h +index 03ed352..d73c12b 100644 +--- a/sound/firewire/fireworks/fireworks.h ++++ b/sound/firewire/fireworks/fireworks.h +@@ -108,7 +108,6 @@ struct snd_efw { + u8 *resp_buf; + u8 *pull_ptr; + u8 *push_ptr; +- unsigned int resp_queues; + }; + + int snd_efw_transaction_cmd(struct fw_unit *unit, +diff --git a/sound/firewire/fireworks/fireworks_hwdep.c b/sound/firewire/fireworks/fireworks_hwdep.c +index 33df865..2e1d9a2 100644 +--- a/sound/firewire/fireworks/fireworks_hwdep.c ++++ b/sound/firewire/fireworks/fireworks_hwdep.c +@@ -25,6 +25,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained, + { + unsigned int length, till_end, type; + struct snd_efw_transaction *t; ++ u8 *pull_ptr; + long count = 0; + + if (remained < sizeof(type) + sizeof(struct snd_efw_transaction)) +@@ -38,8 +39,17 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained, + buf += sizeof(type); + + /* write into buffer as many responses as possible */ +- while (efw->resp_queues > 0) { +- t = (struct snd_efw_transaction *)(efw->pull_ptr); ++ spin_lock_irq(&efw->lock); ++ ++ /* ++ * When another task reaches here during this task's access to user ++ * space, it picks up current position in buffer and can read the same ++ * series of responses. ++ */ ++ pull_ptr = efw->pull_ptr; ++ ++ while (efw->push_ptr != pull_ptr) { ++ t = (struct snd_efw_transaction *)(pull_ptr); + length = be32_to_cpu(t->length) * sizeof(__be32); + + /* confirm enough space for this response */ +@@ -49,26 +59,39 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained, + /* copy from ring buffer to user buffer */ + while (length > 0) { + till_end = snd_efw_resp_buf_size - +- (unsigned int)(efw->pull_ptr - efw->resp_buf); ++ (unsigned int)(pull_ptr - efw->resp_buf); + till_end = min_t(unsigned int, length, till_end); + +- if (copy_to_user(buf, efw->pull_ptr, till_end)) ++ spin_unlock_irq(&efw->lock); ++ ++ if (copy_to_user(buf, pull_ptr, till_end)) + return -EFAULT; + +- efw->pull_ptr += till_end; +- if (efw->pull_ptr >= efw->resp_buf + +- snd_efw_resp_buf_size) +- efw->pull_ptr -= snd_efw_resp_buf_size; ++ spin_lock_irq(&efw->lock); ++ ++ pull_ptr += till_end; ++ if (pull_ptr >= efw->resp_buf + snd_efw_resp_buf_size) ++ pull_ptr -= snd_efw_resp_buf_size; + + length -= till_end; + buf += till_end; + count += till_end; + remained -= till_end; + } +- +- efw->resp_queues--; + } + ++ /* ++ * All of tasks can read from the buffer nearly simultaneously, but the ++ * last position for each task is different depending on the length of ++ * given buffer. Here, for simplicity, a position of buffer is set by ++ * the latest task. It's better for a listening application to allow one ++ * thread to read from the buffer. Unless, each task can read different ++ * sequence of responses depending on variation of buffer length. ++ */ ++ efw->pull_ptr = pull_ptr; ++ ++ spin_unlock_irq(&efw->lock); ++ + return count; + } + +@@ -76,14 +99,17 @@ static long + hwdep_read_locked(struct snd_efw *efw, char __user *buf, long count, + loff_t *offset) + { +- union snd_firewire_event event; ++ union snd_firewire_event event = { ++ .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS, ++ }; + +- memset(&event, 0, sizeof(event)); ++ spin_lock_irq(&efw->lock); + +- event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS; + event.lock_status.status = (efw->dev_lock_count > 0); + efw->dev_lock_changed = false; + ++ spin_unlock_irq(&efw->lock); ++ + count = min_t(long, count, sizeof(event.lock_status)); + + if (copy_to_user(buf, &event, count)) +@@ -98,10 +124,15 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, + { + struct snd_efw *efw = hwdep->private_data; + DEFINE_WAIT(wait); ++ bool dev_lock_changed; ++ bool queued; + + spin_lock_irq(&efw->lock); + +- while ((!efw->dev_lock_changed) && (efw->resp_queues == 0)) { ++ dev_lock_changed = efw->dev_lock_changed; ++ queued = efw->push_ptr != efw->pull_ptr; ++ ++ while (!dev_lock_changed && !queued) { + prepare_to_wait(&efw->hwdep_wait, &wait, TASK_INTERRUPTIBLE); + spin_unlock_irq(&efw->lock); + schedule(); +@@ -109,15 +140,17 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, + if (signal_pending(current)) + return -ERESTARTSYS; + spin_lock_irq(&efw->lock); ++ dev_lock_changed = efw->dev_lock_changed; ++ queued = efw->push_ptr != efw->pull_ptr; + } + +- if (efw->dev_lock_changed) ++ spin_unlock_irq(&efw->lock); ++ ++ if (dev_lock_changed) + count = hwdep_read_locked(efw, buf, count, offset); +- else if (efw->resp_queues > 0) ++ else if (queued) + count = hwdep_read_resp_buf(efw, buf, count, offset); + +- spin_unlock_irq(&efw->lock); +- + return count; + } + +@@ -160,7 +193,7 @@ hwdep_poll(struct snd_hwdep *hwdep, struct file *file, poll_table *wait) + poll_wait(file, &efw->hwdep_wait, wait); + + spin_lock_irq(&efw->lock); +- if (efw->dev_lock_changed || (efw->resp_queues > 0)) ++ if (efw->dev_lock_changed || efw->pull_ptr != efw->push_ptr) + events = POLLIN | POLLRDNORM; + else + events = 0; +diff --git a/sound/firewire/fireworks/fireworks_proc.c b/sound/firewire/fireworks/fireworks_proc.c +index 0639dcb..beb0a0f 100644 +--- a/sound/firewire/fireworks/fireworks_proc.c ++++ b/sound/firewire/fireworks/fireworks_proc.c +@@ -188,8 +188,8 @@ proc_read_queues_state(struct snd_info_entry *entry, + else + consumed = (unsigned int)(efw->push_ptr - efw->pull_ptr); + +- snd_iprintf(buffer, "%d %d/%d\n", +- efw->resp_queues, consumed, snd_efw_resp_buf_size); ++ snd_iprintf(buffer, "%d/%d\n", ++ consumed, snd_efw_resp_buf_size); + } + + static void +diff --git a/sound/firewire/fireworks/fireworks_transaction.c b/sound/firewire/fireworks/fireworks_transaction.c +index f550808..36a08ba 100644 +--- a/sound/firewire/fireworks/fireworks_transaction.c ++++ b/sound/firewire/fireworks/fireworks_transaction.c +@@ -121,11 +121,11 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode) + size_t capacity, till_end; + struct snd_efw_transaction *t; + +- spin_lock_irq(&efw->lock); +- + t = (struct snd_efw_transaction *)data; + length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length); + ++ spin_lock_irq(&efw->lock); ++ + if (efw->push_ptr < efw->pull_ptr) + capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr); + else +@@ -155,7 +155,6 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode) + } + + /* for hwdep */ +- efw->resp_queues++; + wake_up(&efw->hwdep_wait); + + *rcode = RCODE_COMPLETE; +diff --git a/sound/firewire/tascam/tascam-hwdep.c b/sound/firewire/tascam/tascam-hwdep.c +index 131267c..106406c 100644 +--- a/sound/firewire/tascam/tascam-hwdep.c ++++ b/sound/firewire/tascam/tascam-hwdep.c +@@ -16,31 +16,14 @@ + + #include "tascam.h" + +-static long hwdep_read_locked(struct snd_tscm *tscm, char __user *buf, +- long count) +-{ +- union snd_firewire_event event; +- +- memset(&event, 0, sizeof(event)); +- +- event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS; +- event.lock_status.status = (tscm->dev_lock_count > 0); +- tscm->dev_lock_changed = false; +- +- count = min_t(long, count, sizeof(event.lock_status)); +- +- if (copy_to_user(buf, &event, count)) +- return -EFAULT; +- +- return count; +-} +- + static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, + loff_t *offset) + { + struct snd_tscm *tscm = hwdep->private_data; + DEFINE_WAIT(wait); +- union snd_firewire_event event; ++ union snd_firewire_event event = { ++ .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS, ++ }; + + spin_lock_irq(&tscm->lock); + +@@ -54,10 +37,16 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count, + spin_lock_irq(&tscm->lock); + } + +- memset(&event, 0, sizeof(event)); +- count = hwdep_read_locked(tscm, buf, count); ++ event.lock_status.status = (tscm->dev_lock_count > 0); ++ tscm->dev_lock_changed = false; ++ + spin_unlock_irq(&tscm->lock); + ++ count = min_t(long, count, sizeof(event.lock_status)); ++ ++ if (copy_to_user(buf, &event, count)) ++ return -EFAULT; ++ + return count; + } + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index f25479b..eaee626 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4840,6 +4840,7 @@ enum { + ALC221_FIXUP_HP_FRONT_MIC, + ALC292_FIXUP_TPT460, + ALC298_FIXUP_SPK_VOLUME, ++ ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -5501,6 +5502,15 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, + }, ++ [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x1b, 0x90170151 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -5545,6 +5555,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), + SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), + SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), ++ SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), + SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), + SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), +@@ -5879,6 +5890,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x12, 0x90a60170}, + {0x14, 0x90170120}, + {0x21, 0x02211030}), ++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell Inspiron 5468", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ++ {0x12, 0x90a60180}, ++ {0x14, 0x90170120}, ++ {0x21, 0x02211030}), + SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC256_STANDARD_PINS), + SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4, +diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c +index 1267e1a..633d54ca 100644 +--- a/sound/soc/atmel/atmel_ssc_dai.c ++++ b/sound/soc/atmel/atmel_ssc_dai.c +@@ -299,8 +299,9 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream, + clk_enable(ssc_p->ssc->clk); + ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk); + +- /* Reset the SSC to keep it at a clean status */ +- ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST)); ++ /* Reset the SSC unless initialized to keep it in a clean state */ ++ if (!ssc_p->initialized) ++ ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST)); + + if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { + dir = 0; +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 6cf1f35..152292e 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1141,6 +1141,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) + case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */ + case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */ + case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */ ++ case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */ + case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */ + case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */ + case USB_ID(0x1de7, 0x0114): /* Phoenix Audio MT202pcs */ diff --git a/4.7.3/4420_grsecurity-3.1-4.7.3-201609072139.patch b/4.7.4/4420_grsecurity-3.1-4.7.4-201609152234.patch index 34c7fa0..84d74fa 100644 --- a/4.7.3/4420_grsecurity-3.1-4.7.3-201609072139.patch +++ b/4.7.4/4420_grsecurity-3.1-4.7.4-201609152234.patch @@ -420,7 +420,7 @@ index a3683ce..5ec8bf4 100644 A toggle value indicating if modules are allowed to be loaded diff --git a/Makefile b/Makefile -index 4afff18..1c6d3b2 100644 +index ec3bd11..35d4d88 100644 --- a/Makefile +++ b/Makefile @@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -956,7 +956,7 @@ index d50430c..01cc53b 100644 # but it is being used too early to link to meaningful stack_chk logic. nossp_flags := $(call cc-option, -fno-stack-protector) diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h -index 9e10c45..2feb375 100644 +index 9e10c45..688ea8b 100644 --- a/arch/arm/include/asm/atomic.h +++ b/arch/arm/include/asm/atomic.h @@ -18,17 +18,41 @@ @@ -1404,15 +1404,14 @@ index 9e10c45..2feb375 100644 static inline long long atomic64_cmpxchg_relaxed(atomic64_t *ptr, long long old, long long new) -@@ -361,6 +555,31 @@ atomic64_cmpxchg_relaxed(atomic64_t *ptr, long long old, long long new) +@@ -361,6 +555,30 @@ atomic64_cmpxchg_relaxed(atomic64_t *ptr, long long old, long long new) return oldval; } #define atomic64_cmpxchg_relaxed atomic64_cmpxchg_relaxed +#define atomic64_cmpxchg_unchecked_relaxed atomic64_cmpxchg_unchecked_relaxed + +static inline long long -+atomic64_cmpxchg_unchecked_relaxed(atomic64_unchecked_t *ptr, long long old, -+ long long new) ++atomic64_cmpxchg_unchecked_relaxed(atomic64_unchecked_t *ptr, long long old, long long new) +{ + long long oldval; + unsigned long res; @@ -1436,7 +1435,7 @@ index 9e10c45..2feb375 100644 static inline long long atomic64_xchg_relaxed(atomic64_t *ptr, long long new) { -@@ -380,26 +599,60 @@ static inline long long atomic64_xchg_relaxed(atomic64_t *ptr, long long new) +@@ -380,26 +598,60 @@ static inline long long atomic64_xchg_relaxed(atomic64_t *ptr, long long new) return result; } @@ -1503,7 +1502,7 @@ index 9e10c45..2feb375 100644 : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter) : "r" (&v->counter) : "cc"); -@@ -423,13 +676,25 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u) +@@ -423,13 +675,25 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u) " teq %0, %5\n" " teqeq %H0, %H5\n" " moveq %1, #0\n" @@ -1532,7 +1531,7 @@ index 9e10c45..2feb375 100644 : "=&r" (val), "+r" (ret), "=&r" (tmp), "+Qo" (v->counter) : "r" (&v->counter), "r" (u), "r" (a) : "cc"); -@@ -442,10 +707,13 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u) +@@ -442,10 +706,13 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u) #define atomic64_add_negative(a, v) (atomic64_add_return((a), (v)) < 0) #define atomic64_inc(v) atomic64_add(1LL, (v)) @@ -1601,20 +1600,28 @@ index 524692f..a8871ec 100644 /* * Fold a partial checksum without adding pseudo headers diff --git a/arch/arm/include/asm/cmpxchg.h b/arch/arm/include/asm/cmpxchg.h -index 97882f9..0cc6ef1 100644 +index 97882f9..ff9d6ac 100644 --- a/arch/arm/include/asm/cmpxchg.h +++ b/arch/arm/include/asm/cmpxchg.h @@ -117,6 +117,10 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, int size (__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), \ sizeof(*(ptr))); \ }) -+#define xchg_unchecked(ptr, x) ({ \ ++#define xchg_unchecked_relaxed(ptr, x) ({ \ + (__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), \ + sizeof(*(ptr))); \ +}) #include <asm-generic/cmpxchg-local.h> +@@ -128,6 +132,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, int size + #endif + + #define xchg xchg_relaxed ++#define xchg_unchecked xchg_unchecked_relaxed + + /* + * cmpxchg_local and cmpxchg64_local are atomic wrt current CPU. Always make diff --git a/arch/arm/include/asm/cpuidle.h b/arch/arm/include/asm/cpuidle.h index baefe1d..29cb35a 100644 --- a/arch/arm/include/asm/cpuidle.h @@ -5041,19 +5048,6 @@ index 2a43012..3409956 100644 } static const char *esr_class_str[] = { -diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c -index c566ec8..3e01953 100644 ---- a/arch/arm64/mm/dma-mapping.c -+++ b/arch/arm64/mm/dma-mapping.c -@@ -132,7 +132,7 @@ static void __dma_free_coherent(struct device *dev, size_t size, - phys_to_page(paddr), - size >> PAGE_SHIFT); - if (!freed) -- swiotlb_free_coherent(dev, size, vaddr, dma_handle); -+ swiotlb_free_coherent(dev, size, vaddr, dma_handle, attrs); - } - - static void *__dma_alloc(struct device *dev, size_t size, diff --git a/arch/avr32/include/asm/cache.h b/arch/avr32/include/asm/cache.h index c3a58a1..78fbf54 100644 --- a/arch/avr32/include/asm/cache.h @@ -5879,19 +5873,6 @@ index ac91939..a1df96d 100644 help kexec is a system call that implements the ability to shutdown your current kernel, and to start another kernel. It is like a reboot -diff --git a/arch/mips/cavium-octeon/dma-octeon.c b/arch/mips/cavium-octeon/dma-octeon.c -index 2cd45f5..d0f4900 100644 ---- a/arch/mips/cavium-octeon/dma-octeon.c -+++ b/arch/mips/cavium-octeon/dma-octeon.c -@@ -191,7 +191,7 @@ static void *octeon_dma_alloc_coherent(struct device *dev, size_t size, - static void octeon_dma_free_coherent(struct device *dev, size_t size, - void *vaddr, dma_addr_t dma_handle, struct dma_attrs *attrs) - { -- swiotlb_free_coherent(dev, size, vaddr, dma_handle); -+ swiotlb_free_coherent(dev, size, vaddr, dma_handle, attrs); - } - - static dma_addr_t octeon_unity_phys_to_dma(struct device *dev, phys_addr_t paddr) diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h index 835b402..347a797 100644 --- a/arch/mips/include/asm/atomic.h @@ -8400,17 +8381,30 @@ index ae0751e..06b108a 100644 2:" : "=&r" (t) diff --git a/arch/powerpc/include/asm/book3s/32/hash.h b/arch/powerpc/include/asm/book3s/32/hash.h -index 880db13..017716c 100644 +index 880db13..bb4ed4a 100644 --- a/arch/powerpc/include/asm/book3s/32/hash.h +++ b/arch/powerpc/include/asm/book3s/32/hash.h @@ -20,6 +20,7 @@ #define _PAGE_HASHPTE 0x002 /* hash_page has made an HPTE for this pte */ #define _PAGE_USER 0x004 /* usermode access allowed */ #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */ -+#define _PAGE_EXEC _PAGE_GUARDED ++#define _PAGE_NX _PAGE_GUARDED #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */ #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */ #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */ +diff --git a/arch/powerpc/include/asm/book3s/32/pgtable.h b/arch/powerpc/include/asm/book3s/32/pgtable.h +index 38b33dc..945d1f1 100644 +--- a/arch/powerpc/include/asm/book3s/32/pgtable.h ++++ b/arch/powerpc/include/asm/book3s/32/pgtable.h +@@ -226,7 +226,7 @@ static inline void huge_ptep_set_wrprotect(struct mm_struct *mm, + static inline void __ptep_set_access_flags(pte_t *ptep, pte_t entry) + { + unsigned long set = pte_val(entry) & +- (_PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_RW | _PAGE_EXEC); ++ (_PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_RW | _PAGE_EXEC | _PAGE_NX); + unsigned long clr = ~pte_val(entry) & _PAGE_RO; + + pte_update(ptep, clr, set); diff --git a/arch/powerpc/include/asm/book3s/64/pgalloc.h b/arch/powerpc/include/asm/book3s/64/pgalloc.h index cd5e7aa..7709061 100644 --- a/arch/powerpc/include/asm/book3s/64/pgalloc.h @@ -8696,6 +8690,73 @@ index ee09e99..7e580ee 100644 #ifndef __ASSEMBLY__ #include <linux/mmdebug.h> #include <linux/mmzone.h> +diff --git a/arch/powerpc/include/asm/pte-common.h b/arch/powerpc/include/asm/pte-common.h +index 2eeaf80..c75d4fb 100644 +--- a/arch/powerpc/include/asm/pte-common.h ++++ b/arch/powerpc/include/asm/pte-common.h +@@ -16,6 +16,9 @@ + #ifndef _PAGE_EXEC + #define _PAGE_EXEC 0 + #endif ++#ifndef _PAGE_NX ++#define _PAGE_NX 0 ++#endif + #ifndef _PAGE_ENDIAN + #define _PAGE_ENDIAN 0 + #endif +@@ -53,13 +56,13 @@ + #define PMD_PAGE_SIZE(pmd) bad_call_to_PMD_PAGE_SIZE() + #endif + #ifndef _PAGE_KERNEL_RO +-#define _PAGE_KERNEL_RO (_PAGE_RO) ++#define _PAGE_KERNEL_RO (_PAGE_RO | _PAGE_NX) + #endif + #ifndef _PAGE_KERNEL_ROX + #define _PAGE_KERNEL_ROX (_PAGE_EXEC | _PAGE_RO) + #endif + #ifndef _PAGE_KERNEL_RW +-#define _PAGE_KERNEL_RW (_PAGE_DIRTY | _PAGE_RW | _PAGE_HWWRITE) ++#define _PAGE_KERNEL_RW (_PAGE_DIRTY | _PAGE_RW | _PAGE_HWWRITE | _PAGE_NX) + #endif + #ifndef _PAGE_KERNEL_RWX + #define _PAGE_KERNEL_RWX (_PAGE_DIRTY | _PAGE_RW | _PAGE_HWWRITE | _PAGE_EXEC) +@@ -142,15 +145,12 @@ static inline bool pte_user(pte_t pte) + * Note due to the way vm flags are laid out, the bits are XWR + */ + #define PAGE_NONE __pgprot(_PAGE_BASE) +-#define PAGE_SHARED __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RW) +-#define PAGE_SHARED_X __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RW | \ +- _PAGE_EXEC) +-#define PAGE_COPY __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO) +-#define PAGE_COPY_X __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO | \ +- _PAGE_EXEC) +-#define PAGE_READONLY __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO) +-#define PAGE_READONLY_X __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO | \ +- _PAGE_EXEC) ++#define PAGE_SHARED __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RW | _PAGE_NX) ++#define PAGE_SHARED_X __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RW | _PAGE_EXEC) ++#define PAGE_COPY __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO | _PAGE_NX) ++#define PAGE_COPY_X __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO | _PAGE_EXEC) ++#define PAGE_READONLY __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO | _PAGE_NX) ++#define PAGE_READONLY_X __pgprot(_PAGE_BASE | _PAGE_USER | _PAGE_RO | _PAGE_EXEC) + + #define __P000 PAGE_NONE + #define __P001 PAGE_READONLY +@@ -171,11 +171,9 @@ static inline bool pte_user(pte_t pte) + #define __S111 PAGE_SHARED_X + + /* Permission masks used for kernel mappings */ +-#define PAGE_KERNEL __pgprot(_PAGE_BASE | _PAGE_KERNEL_RW) +-#define PAGE_KERNEL_NC __pgprot(_PAGE_BASE_NC | _PAGE_KERNEL_RW | \ +- _PAGE_NO_CACHE) +-#define PAGE_KERNEL_NCG __pgprot(_PAGE_BASE_NC | _PAGE_KERNEL_RW | \ +- _PAGE_NO_CACHE | _PAGE_GUARDED) ++#define PAGE_KERNEL __pgprot(_PAGE_BASE | _PAGE_KERNEL_RW | _PAGE_NX) ++#define PAGE_KERNEL_NC __pgprot(_PAGE_BASE_NC | _PAGE_KERNEL_RW | _PAGE_NO_CACHE) ++#define PAGE_KERNEL_NCG __pgprot(_PAGE_BASE_NC | _PAGE_KERNEL_RW | _PAGE_NO_CACHE | _PAGE_GUARDED) + #define PAGE_KERNEL_X __pgprot(_PAGE_BASE | _PAGE_KERNEL_RWX) + #define PAGE_KERNEL_RO __pgprot(_PAGE_BASE | _PAGE_KERNEL_RO) + #define PAGE_KERNEL_ROX __pgprot(_PAGE_BASE | _PAGE_KERNEL_ROX) diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h index a0948f4..ddcf6be 100644 --- a/arch/powerpc/include/asm/reg.h @@ -14648,6 +14709,72 @@ index 50e6847..bf7c2d8 100644 static void cast6_xts_enc(void *ctx, u128 *dst, const u128 *src, le128 *iv) { +diff --git a/arch/x86/crypto/crc32-pclmul_asm.S b/arch/x86/crypto/crc32-pclmul_asm.S +index f247304..b500391 100644 +--- a/arch/x86/crypto/crc32-pclmul_asm.S ++++ b/arch/x86/crypto/crc32-pclmul_asm.S +@@ -102,6 +102,12 @@ + * size_t len, uint crc32) + */ + ++#ifndef __x86_64__ ++__i686_get_pc_thunk_cx: ++ mov (%esp),%ecx ++ ret ++#endif ++ + ENTRY(crc32_pclmul_le_16) /* buffer and buffer size are 16 bytes aligned */ + movdqa (BUF), %xmm1 + movdqa 0x10(BUF), %xmm2 +@@ -113,9 +119,8 @@ ENTRY(crc32_pclmul_le_16) /* buffer and buffer size are 16 bytes aligned */ + add $0x40, BUF + #ifndef __x86_64__ + /* This is for position independent code(-fPIC) support for 32bit */ +- call delta ++ call __i686_get_pc_thunk_cx + delta: +- pop %ecx + #endif + cmp $0x40, LEN + jb less_64 +@@ -123,7 +128,7 @@ delta: + #ifdef __x86_64__ + movdqa .Lconstant_R2R1(%rip), CONSTANT + #else +- movdqa .Lconstant_R2R1 - delta(%ecx), CONSTANT ++ movdqa %cs:.Lconstant_R2R1 - delta (%ecx), CONSTANT + #endif + + loop_64:/* 64 bytes Full cache line folding */ +@@ -172,7 +177,7 @@ less_64:/* Folding cache line into 128bit */ + #ifdef __x86_64__ + movdqa .Lconstant_R4R3(%rip), CONSTANT + #else +- movdqa .Lconstant_R4R3 - delta(%ecx), CONSTANT ++ movdqa %cs:.Lconstant_R4R3 - delta(%ecx), CONSTANT + #endif + prefetchnta (BUF) + +@@ -220,8 +225,8 @@ fold_64: + movdqa .Lconstant_R5(%rip), CONSTANT + movdqa .Lconstant_mask32(%rip), %xmm3 + #else +- movdqa .Lconstant_R5 - delta(%ecx), CONSTANT +- movdqa .Lconstant_mask32 - delta(%ecx), %xmm3 ++ movdqa %cs:.Lconstant_R5 - delta(%ecx), CONSTANT ++ movdqa %cs:.Lconstant_mask32 - delta(%ecx), %xmm3 + #endif + psrldq $0x04, %xmm2 + pand %xmm3, %xmm1 +@@ -232,7 +237,7 @@ fold_64: + #ifdef __x86_64__ + movdqa .Lconstant_RUpoly(%rip), CONSTANT + #else +- movdqa .Lconstant_RUpoly - delta(%ecx), CONSTANT ++ movdqa %cs:.Lconstant_RUpoly - delta(%ecx), CONSTANT + #endif + movdqa %xmm1, %xmm2 + pand %xmm3, %xmm1 diff --git a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S index dc05f010..23c8bfd 100644 --- a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S @@ -23343,6 +23470,27 @@ index 1549caa0..aa9ebe1 100644 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS*8 + 3) #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8 + 3) #define __USER32_DS __USER_DS +diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h +index ac1d5da..6c4be50 100644 +--- a/arch/x86/include/asm/setup.h ++++ b/arch/x86/include/asm/setup.h +@@ -61,6 +61,7 @@ static inline void x86_ce4100_early_setup(void) { } + #ifndef _SETUP + + #include <asm/espfix.h> ++#include <asm/uaccess.h> + #include <linux/kernel.h> + + /* +@@ -76,7 +77,7 @@ static inline bool kaslr_enabled(void) + + static inline unsigned long kaslr_offset(void) + { +- return (unsigned long)&_text - __START_KERNEL; ++ return ktla_ktva((unsigned long)&_text) - __START_KERNEL; + } + + /* diff --git a/arch/x86/include/asm/smap.h b/arch/x86/include/asm/smap.h index db33330..e9521fb 100644 --- a/arch/x86/include/asm/smap.h @@ -23927,7 +24075,7 @@ index c3496619..3f3a7dc 100644 asmlinkage void smp_deferred_error_interrupt(void); #endif diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h -index 2982387..8adcc96 100644 +index 2982387..35d07f4 100644 --- a/arch/x86/include/asm/uaccess.h +++ b/arch/x86/include/asm/uaccess.h @@ -8,6 +8,7 @@ @@ -24130,16 +24278,23 @@ index 2982387..8adcc96 100644 break; \ case 4: \ __get_user_asm_ex(x, ptr, "l", "k", "=r"); \ -@@ -412,7 +464,7 @@ do { \ +@@ -412,9 +464,13 @@ do { \ } while (0) #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \ - asm volatile("1: mov"itype" %1,%"rtype"0\n" \ + asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\ "2:\n" \ - _ASM_EXTABLE_EX(1b, 2b) \ +- _ASM_EXTABLE_EX(1b, 2b) \ ++ ".section .fixup,\"ax\"\n" \ ++ "3:xorl %k0,%k0\n" \ ++ " jmp 2b\n" \ ++ ".previous\n" \ ++ _ASM_EXTABLE_EX(1b, 3b) \ : ltype(x) : "m" (__m(addr))) -@@ -433,13 +485,24 @@ do { \ + + #define __put_user_nocheck(x, ptr, size) \ +@@ -433,13 +489,24 @@ do { \ __uaccess_begin(); \ __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \ __uaccess_end(); \ @@ -24166,7 +24321,7 @@ index 2982387..8adcc96 100644 /* * Tell gcc we read from memory instead of writing: this is because -@@ -447,8 +510,10 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -447,8 +514,10 @@ struct __large_struct { unsigned long buf[100]; }; * aliasing issues. */ #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \ @@ -24178,7 +24333,7 @@ index 2982387..8adcc96 100644 "2:\n" \ ".section .fixup,\"ax\"\n" \ "3: mov %3,%0\n" \ -@@ -456,10 +521,12 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -456,10 +525,12 @@ struct __large_struct { unsigned long buf[100]; }; ".previous\n" \ _ASM_EXTABLE(1b, 3b) \ : "=r"(err) \ @@ -24193,7 +24348,7 @@ index 2982387..8adcc96 100644 "2:\n" \ _ASM_EXTABLE_EX(1b, 2b) \ : : ltype(x), "m" (__m(addr))) -@@ -469,11 +536,13 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -469,11 +540,13 @@ struct __large_struct { unsigned long buf[100]; }; */ #define uaccess_try do { \ current_thread_info()->uaccess_err = 0; \ @@ -24207,7 +24362,7 @@ index 2982387..8adcc96 100644 (err) |= (current_thread_info()->uaccess_err ? -EFAULT : 0); \ } while (0) -@@ -499,8 +568,12 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -499,8 +572,12 @@ struct __large_struct { unsigned long buf[100]; }; * On error, the variable @x is set to zero. */ @@ -24220,7 +24375,7 @@ index 2982387..8adcc96 100644 /** * __put_user: - Write a simple value into user space, with less checking. -@@ -523,8 +596,12 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -523,8 +600,12 @@ struct __large_struct { unsigned long buf[100]; }; * Returns zero on success, or -EFAULT on error. */ @@ -24233,7 +24388,7 @@ index 2982387..8adcc96 100644 #define __get_user_unaligned __get_user #define __put_user_unaligned __put_user -@@ -542,7 +619,7 @@ struct __large_struct { unsigned long buf[100]; }; +@@ -542,7 +623,7 @@ struct __large_struct { unsigned long buf[100]; }; #define get_user_ex(x, ptr) do { \ unsigned long __gue_val; \ __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \ @@ -24242,7 +24397,7 @@ index 2982387..8adcc96 100644 } while (0) #define put_user_try uaccess_try -@@ -560,7 +637,7 @@ extern __must_check long strlen_user(const char __user *str); +@@ -560,7 +641,7 @@ extern __must_check long strlen_user(const char __user *str); extern __must_check long strnlen_user(const char __user *str, long n); unsigned long __must_check clear_user(void __user *mem, unsigned long len); @@ -24251,7 +24406,7 @@ index 2982387..8adcc96 100644 extern void __cmpxchg_wrong_size(void) __compiletime_error("Bad argument size for cmpxchg"); -@@ -568,22 +645,23 @@ extern void __cmpxchg_wrong_size(void) +@@ -568,22 +649,23 @@ extern void __cmpxchg_wrong_size(void) #define __user_atomic_cmpxchg_inatomic(uval, ptr, old, new, size) \ ({ \ int __ret = 0; \ @@ -24280,7 +24435,7 @@ index 2982387..8adcc96 100644 : "i" (-EFAULT), "q" (__new), "1" (__old) \ : "memory" \ ); \ -@@ -592,14 +670,14 @@ extern void __cmpxchg_wrong_size(void) +@@ -592,14 +674,14 @@ extern void __cmpxchg_wrong_size(void) case 2: \ { \ asm volatile("\n" \ @@ -24297,7 +24452,7 @@ index 2982387..8adcc96 100644 : "i" (-EFAULT), "r" (__new), "1" (__old) \ : "memory" \ ); \ -@@ -608,14 +686,14 @@ extern void __cmpxchg_wrong_size(void) +@@ -608,14 +690,14 @@ extern void __cmpxchg_wrong_size(void) case 4: \ { \ asm volatile("\n" \ @@ -24314,7 +24469,7 @@ index 2982387..8adcc96 100644 : "i" (-EFAULT), "r" (__new), "1" (__old) \ : "memory" \ ); \ -@@ -627,14 +705,14 @@ extern void __cmpxchg_wrong_size(void) +@@ -627,14 +709,14 @@ extern void __cmpxchg_wrong_size(void) __cmpxchg_wrong_size(); \ \ asm volatile("\n" \ @@ -24331,7 +24486,7 @@ index 2982387..8adcc96 100644 : "i" (-EFAULT), "r" (__new), "1" (__old) \ : "memory" \ ); \ -@@ -644,6 +722,7 @@ extern void __cmpxchg_wrong_size(void) +@@ -644,6 +726,7 @@ extern void __cmpxchg_wrong_size(void) __cmpxchg_wrong_size(); \ } \ __uaccess_end(); \ @@ -24339,7 +24494,7 @@ index 2982387..8adcc96 100644 *__uval = __old; \ __ret; \ }) -@@ -667,17 +746,6 @@ extern struct movsl_mask { +@@ -667,17 +750,6 @@ extern struct movsl_mask { #define ARCH_HAS_NOCACHE_UACCESS 1 @@ -24357,7 +24512,7 @@ index 2982387..8adcc96 100644 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS # define copy_user_diag __compiletime_error #else -@@ -687,7 +755,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from, +@@ -687,7 +759,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from, extern void copy_user_diag("copy_from_user() buffer size is too small") copy_from_user_overflow(void); extern void copy_user_diag("copy_to_user() buffer size is too small") @@ -24366,7 +24521,7 @@ index 2982387..8adcc96 100644 #undef copy_user_diag -@@ -700,7 +768,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow"); +@@ -700,7 +772,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow"); extern void __compiletime_warning("copy_to_user() buffer size is not provably correct") @@ -24375,7 +24530,7 @@ index 2982387..8adcc96 100644 #define __copy_to_user_overflow(size, count) __copy_to_user_overflow() #else -@@ -715,10 +783,16 @@ __copy_from_user_overflow(int size, unsigned long count) +@@ -715,10 +787,16 @@ __copy_from_user_overflow(int size, unsigned long count) #endif @@ -24393,7 +24548,7 @@ index 2982387..8adcc96 100644 might_fault(); -@@ -742,12 +816,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n) +@@ -742,12 +820,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n) * case, and do only runtime checking for non-constant sizes. */ @@ -24415,7 +24570,7 @@ index 2982387..8adcc96 100644 return n; } -@@ -755,19 +832,20 @@ copy_from_user(void *to, const void __user *from, unsigned long n) +@@ -755,19 +836,20 @@ copy_from_user(void *to, const void __user *from, unsigned long n) static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n) { @@ -25284,7 +25439,7 @@ index 5cb272a..2bcff83 100644 bp_int3_handler = handler; bp_int3_addr = (u8 *)addr + sizeof(int3); diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c -index 60078a6..b9fb105 100644 +index b15e1c1..42cf1f5 100644 --- a/arch/x86/kernel/apic/apic.c +++ b/arch/x86/kernel/apic/apic.c @@ -177,7 +177,7 @@ int first_system_vector = FIRST_SYSTEM_VECTOR; @@ -25296,7 +25451,7 @@ index 60078a6..b9fb105 100644 int pic_mode; -@@ -1878,7 +1878,7 @@ static void __smp_error_interrupt(struct pt_regs *regs) +@@ -1881,7 +1881,7 @@ static void __smp_error_interrupt(struct pt_regs *regs) apic_write(APIC_ESR, 0); v = apic_read(APIC_ESR); ack_APIC_irq(); @@ -29000,7 +29155,7 @@ index 61924222..0e4856e 100644 +ENDPROC(return_to_handler) #endif diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c -index 477ae80..c8e40a3 100644 +index 477ae80..a280c67 100644 --- a/arch/x86/kernel/module.c +++ b/arch/x86/kernel/module.c @@ -76,17 +76,17 @@ static unsigned long int get_module_load_offset(void) @@ -29050,7 +29205,7 @@ index 477ae80..c8e40a3 100644 + return NULL; + + area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END); -+return area ? area->addr : NULL; ++ return area ? area->addr : NULL; +} +EXPORT_SYMBOL(module_alloc_exec); + @@ -29659,19 +29814,6 @@ index f712dfd..0172a75 100644 #define DEBUG 1 -diff --git a/arch/x86/kernel/pci-swiotlb.c b/arch/x86/kernel/pci-swiotlb.c -index 7c577a1..3557b10 100644 ---- a/arch/x86/kernel/pci-swiotlb.c -+++ b/arch/x86/kernel/pci-swiotlb.c -@@ -40,7 +40,7 @@ void x86_swiotlb_free_coherent(struct device *dev, size_t size, - struct dma_attrs *attrs) - { - if (is_swiotlb_buffer(dma_to_phys(dev, dma_addr))) -- swiotlb_free_coherent(dev, size, vaddr, dma_addr); -+ swiotlb_free_coherent(dev, size, vaddr, dma_addr, attrs); - else - dma_generic_free_coherent(dev, size, vaddr, dma_addr, attrs); - } diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c index 96becbb..a18444b 100644 --- a/arch/x86/kernel/process.c @@ -32118,7 +32260,7 @@ index 8326d68..3cc3895 100644 .disabled_by_bios = vmx_disabled_by_bios, .hardware_setup = hardware_setup, diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index fea2c57..19b3e60 100644 +index fea2c57..5c02643 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -1941,8 +1941,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data) @@ -32177,6 +32319,15 @@ index fea2c57..19b3e60 100644 guest_xsave->region, sizeof(struct fxregs_state)); } return 0; +@@ -5728,7 +5730,7 @@ static unsigned long kvm_get_guest_ip(void) + unsigned long ip = 0; + + if (__this_cpu_read(current_vcpu)) +- ip = kvm_rip_read(__this_cpu_read(current_vcpu)); ++ ip = kvm_get_linear_rip(__this_cpu_read(current_vcpu)); + + return ip; + } @@ -6450,6 +6452,7 @@ void kvm_arch_mmu_notifier_invalidate_page(struct kvm *kvm, * exiting to the userspace. Otherwise, the value will be returned to the * userspace. @@ -35069,46 +35220,10 @@ index 99bfb19..237fb1d 100644 } else { walk_pud_level(m, &st, *start, diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c -index 4bb53b8..7e79b52 100644 +index 4bb53b8..0828f20 100644 --- a/arch/x86/mm/extable.c +++ b/arch/x86/mm/extable.c -@@ -1,6 +1,7 @@ - #include <linux/module.h> - #include <asm/uaccess.h> - #include <asm/traps.h> -+#include <asm/boot.h> - - typedef bool (*ex_handler_t)(const struct exception_table_entry *, - struct pt_regs *, int); -@@ -8,12 +9,25 @@ typedef bool (*ex_handler_t)(const struct exception_table_entry *, - static inline unsigned long - ex_fixup_addr(const struct exception_table_entry *x) - { -- return (unsigned long)&x->fixup + x->fixup; -+ unsigned long reloc = 0; -+ -+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) -+ reloc = ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR; -+#endif -+ -+ return (unsigned long)&x->fixup + x->fixup + reloc; - } -+ - static inline ex_handler_t - ex_fixup_handler(const struct exception_table_entry *x) - { -- return (ex_handler_t)((unsigned long)&x->handler + x->handler); -+ unsigned long reloc = 0; -+ -+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) -+ reloc = ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR; -+#endif -+ -+ return (ex_handler_t)((unsigned long)&x->handler + x->handler + reloc); - } - - bool ex_handler_default(const struct exception_table_entry *fixup, -@@ -99,7 +113,7 @@ int fixup_exception(struct pt_regs *regs, int trapnr) +@@ -99,7 +99,7 @@ int fixup_exception(struct pt_regs *regs, int trapnr) ex_handler_t handler; #ifdef CONFIG_PNPBIOS @@ -36982,7 +37097,7 @@ index 9c086c5..421e25b 100644 unsigned long uninitialized_var(pfn_align); int i, nid; diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c -index 7a1f7bb..62a6748 100644 +index 7a1f7bb..5b4b5cc 100644 --- a/arch/x86/mm/pageattr.c +++ b/arch/x86/mm/pageattr.c @@ -258,7 +258,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address, @@ -37093,6 +37208,16 @@ index 7a1f7bb..62a6748 100644 cpa->flags |= CPA_FLUSHTLB; } cpa->numpages = 1; +@@ -1336,7 +1362,8 @@ static int cpa_process_alias(struct cpa_data *cpa) + + static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias) + { +- int ret, numpages = cpa->numpages; ++ int ret; ++ unsigned long numpages = cpa->numpages; + + while (numpages) { + /* diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c index fb0604f..b9e0399 100644 --- a/arch/x86/mm/pat.c @@ -39205,7 +39330,7 @@ index c7b15f3..cc09a65 100644 This is the Linux Xen port. Enabling this will allow the kernel to boot in a paravirtualized environment under the diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index 760789a..dbf5054 100644 +index 760789a..0aef1ec 100644 --- a/arch/x86/xen/enlighten.c +++ b/arch/x86/xen/enlighten.c @@ -131,8 +131,6 @@ EXPORT_SYMBOL_GPL(xen_start_info); @@ -39311,11 +39436,21 @@ index 760789a..dbf5054 100644 pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry; pv_cpu_ops.load_gdt = xen_load_gdt; -@@ -1583,7 +1582,17 @@ asmlinkage __visible void __init xen_start_kernel(void) +@@ -1582,9 +1581,6 @@ asmlinkage __visible void __init xen_start_kernel(void) + */ __userpte_alloc_gfp &= ~__GFP_HIGHMEM; - /* Work out if we support NX */ +- /* Work out if we support NX */ - x86_configure_nx(); +- + /* Get mfn list */ + xen_build_dynamic_phys_to_machine(); + +@@ -1594,6 +1590,19 @@ asmlinkage __visible void __init xen_start_kernel(void) + */ + xen_setup_gdt(0); + ++ /* Work out if we support NX */ +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE) + if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 && + (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) { @@ -39327,9 +39462,10 @@ index 760789a..dbf5054 100644 + wrmsr(MSR_EFER, l, h); + } +#endif ++ + xen_init_irq_ops(); + xen_init_cpuid_mask(); - /* Get mfn list */ - xen_build_dynamic_phys_to_machine(); @@ -1611,13 +1620,6 @@ asmlinkage __visible void __init xen_start_kernel(void) machine_ops = xen_machine_ops; @@ -39426,6 +39562,18 @@ index 6743371..26347de 100644 .alloc_pud = xen_alloc_pmd_init, .release_pud = xen_release_pmd_init, +diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c +index 9466354..b33bb13 100644 +--- a/arch/x86/xen/pmu.c ++++ b/arch/x86/xen/pmu.c +@@ -444,6 +444,7 @@ static unsigned long xen_get_guest_ip(void) + return 0; + } + ++ // TODO: adjust with the segment base + return xenpmu_data->pmu.r.regs.ip; + } + diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c index 719cf29..8a13fd8 100644 --- a/arch/x86/xen/smp.c @@ -42615,7 +42763,7 @@ index 4d87499..1e2bcce 100644 device->rs_last_events = (int)part_stat_read(&disk->part0, sectors[0]) + diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c -index 84708a5..95c0e55 100644 +index b206115..dcb469b 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -961,6 +961,10 @@ static void empty(void) @@ -46312,7 +46460,7 @@ index 207a2cb..666b75a 100644 { struct bochs_device *bochs = diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c -index 0e3cc66..005ade8 100644 +index a5cae1b..2b89b96 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -4285,7 +4285,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev, @@ -48325,7 +48473,7 @@ index 414953c..1b26674 100644 -int radeon_max_kms_ioctl = ARRAY_SIZE(radeon_ioctls_kms); +const int radeon_max_kms_ioctl = ARRAY_SIZE(radeon_ioctls_kms); diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c -index 590b037..2755d23 100644 +index 0ab76dd..62359ea 100644 --- a/drivers/gpu/drm/radeon/radeon_ttm.c +++ b/drivers/gpu/drm/radeon/radeon_ttm.c @@ -970,7 +970,7 @@ void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size) @@ -55020,7 +55168,7 @@ index adbff14..018c2d2 100644 struct cache_stat_collector collector; diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index f5dbb4e..26a4c2e 100644 +index 5d3b231..6a0cbd8 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -241,8 +241,9 @@ static void __write_super(struct cache_sb *sb, struct bio *bio) @@ -75244,7 +75392,7 @@ index ec21d8c..1c2e09c 100644 return _SUCCESS; } diff --git a/drivers/staging/rtl8188eu/include/Hal8188EPhyCfg.h b/drivers/staging/rtl8188eu/include/Hal8188EPhyCfg.h -index 8990748..7727f80 100644 +index 8990748..7727f804 100644 --- a/drivers/staging/rtl8188eu/include/Hal8188EPhyCfg.h +++ b/drivers/staging/rtl8188eu/include/Hal8188EPhyCfg.h @@ -200,17 +200,9 @@ void PHY_GetTxPowerLevel8188E(struct adapter *adapter, u32 *powerlevel); @@ -96960,7 +97108,7 @@ index 2035893..f42edf1 100644 for (i = 0; i < numnote; i++) sz += notesize(notes + i); diff --git a/fs/block_dev.c b/fs/block_dev.c -index 71ccab1..8e55e4e 100644 +index b1495fa..256330e 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -852,7 +852,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole, @@ -100117,59 +100265,6 @@ index d7ccb7f..1b9329a 100644 int ret; eh = ext_inode_hdr(inode); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index b747ec0..ea39d19 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -51,26 +51,32 @@ static __u32 ext4_inode_csum(struct inode *inode, struct ext4_inode *raw, - struct ext4_inode_info *ei) - { - struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); -- __u16 csum_lo; -- __u16 csum_hi = 0; - __u32 csum; -+ __u16 dummy_csum = 0; -+ int offset = offsetof(struct ext4_inode, i_checksum_lo); -+ unsigned int csum_size = sizeof(dummy_csum); - -- csum_lo = le16_to_cpu(raw->i_checksum_lo); -- raw->i_checksum_lo = 0; -- if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE && -- EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) { -- csum_hi = le16_to_cpu(raw->i_checksum_hi); -- raw->i_checksum_hi = 0; -+ csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw, offset); -+ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, csum_size); -+ offset += csum_size; -+ csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset, -+ EXT4_GOOD_OLD_INODE_SIZE - offset); -+ -+ if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) { -+ offset = offsetof(struct ext4_inode, i_checksum_hi); -+ csum = ext4_chksum(sbi, csum, (__u8 *)raw + -+ EXT4_GOOD_OLD_INODE_SIZE, -+ offset - EXT4_GOOD_OLD_INODE_SIZE); -+ if (EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) { -+ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, -+ csum_size); -+ offset += csum_size; -+ csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset, -+ EXT4_INODE_SIZE(inode->i_sb) - -+ offset); -+ } - } - -- csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw, -- EXT4_INODE_SIZE(inode->i_sb)); -- -- raw->i_checksum_lo = cpu_to_le16(csum_lo); -- if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE && -- EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) -- raw->i_checksum_hi = cpu_to_le16(csum_hi); -- - return csum; - } - diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 7f42eda..0150cd7 100644 --- a/fs/ext4/mballoc.c @@ -100287,30 +100382,6 @@ index 7f42eda..0150cd7 100644 trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len); return 0; -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index ec4c399..5bb46b6 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -420,15 +420,14 @@ static __le32 ext4_dx_csum(struct inode *inode, struct ext4_dir_entry *dirent, - struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); - struct ext4_inode_info *ei = EXT4_I(inode); - __u32 csum; -- __le32 save_csum; - int size; -+ __u32 dummy_csum = 0; -+ int offset = offsetof(struct dx_tail, dt_checksum); - - size = count_offset + (count * sizeof(struct dx_entry)); -- save_csum = t->dt_checksum; -- t->dt_checksum = 0; - csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)dirent, size); -- csum = ext4_chksum(sbi, csum, (__u8 *)t, sizeof(struct dx_tail)); -- t->dt_checksum = save_csum; -+ csum = ext4_chksum(sbi, csum, (__u8 *)t, offset); -+ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, sizeof(dummy_csum)); - - return cpu_to_le32(csum); - } diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index cf68100..f96c5c0 100644 --- a/fs/ext4/resize.c @@ -100354,7 +100425,7 @@ index cf68100..f96c5c0 100644 err = ext4_handle_dirty_metadata(handle, NULL, bh); if (unlikely(err)) diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 639bd756..7cbfe75 100644 +index d4505f8..7f73c190 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -1307,7 +1307,7 @@ static ext4_fsblk_t get_sb_block(void **data) @@ -100366,48 +100437,6 @@ index 639bd756..7cbfe75 100644 "Contact linux-ext4@vger.kernel.org if you think we should keep it.\n"; #ifdef CONFIG_QUOTA -@@ -2068,23 +2068,25 @@ failed: - static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group, - struct ext4_group_desc *gdp) - { -- int offset; -+ int offset = offsetof(struct ext4_group_desc, bg_checksum); - __u16 crc = 0; - __le32 le_group = cpu_to_le32(block_group); - struct ext4_sb_info *sbi = EXT4_SB(sb); - - if (ext4_has_metadata_csum(sbi->s_sb)) { - /* Use new metadata_csum algorithm */ -- __le16 save_csum; - __u32 csum32; -+ __u16 dummy_csum = 0; - -- save_csum = gdp->bg_checksum; -- gdp->bg_checksum = 0; - csum32 = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&le_group, - sizeof(le_group)); -- csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp, -- sbi->s_desc_size); -- gdp->bg_checksum = save_csum; -+ csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp, offset); -+ csum32 = ext4_chksum(sbi, csum32, (__u8 *)&dummy_csum, -+ sizeof(dummy_csum)); -+ offset += sizeof(dummy_csum); -+ if (offset < sbi->s_desc_size) -+ csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp + offset, -+ sbi->s_desc_size - offset); - - crc = csum32 & 0xFFFF; - goto out; -@@ -2094,8 +2096,6 @@ static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group, - if (!ext4_has_feature_gdt_csum(sb)) - return 0; - -- offset = offsetof(struct ext4_group_desc, bg_checksum); -- - crc = crc16(~0, sbi->s_es->s_uuid, sizeof(sbi->s_es->s_uuid)); - crc = crc16(crc, (__u8 *)&le_group, sizeof(le_group)); - crc = crc16(crc, (__u8 *)gdp, offset); diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c index 1420a3c..e87523c 100644 --- a/fs/ext4/sysfs.c @@ -100422,35 +100451,10 @@ index 1420a3c..e87523c 100644 static ssize_t session_write_kbytes_show(struct ext4_attr *a, struct ext4_sb_info *sbi, char *buf) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index e79bd32..1a4826d 100644 +index 2eb935c..2fda99e 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c -@@ -121,17 +121,18 @@ static __le32 ext4_xattr_block_csum(struct inode *inode, - { - struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); - __u32 csum; -- __le32 save_csum; - __le64 dsk_block_nr = cpu_to_le64(block_nr); -+ __u32 dummy_csum = 0; -+ int offset = offsetof(struct ext4_xattr_header, h_checksum); - -- save_csum = hdr->h_checksum; -- hdr->h_checksum = 0; - csum = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&dsk_block_nr, - sizeof(dsk_block_nr)); -- csum = ext4_chksum(sbi, csum, (__u8 *)hdr, -- EXT4_BLOCK_SIZE(inode->i_sb)); -+ csum = ext4_chksum(sbi, csum, (__u8 *)hdr, offset); -+ csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, sizeof(dummy_csum)); -+ offset += sizeof(dummy_csum); -+ csum = ext4_chksum(sbi, csum, (__u8 *)hdr + offset, -+ EXT4_BLOCK_SIZE(inode->i_sb) - offset); - -- hdr->h_checksum = save_csum; - return cpu_to_le32(csum); - } - -@@ -417,7 +418,7 @@ static int +@@ -418,7 +418,7 @@ static int ext4_xattr_list_entries(struct dentry *dentry, struct ext4_xattr_entry *entry, char *buffer, size_t buffer_size) { @@ -100459,7 +100463,7 @@ index e79bd32..1a4826d 100644 for (; !IS_LAST_ENTRY(entry); entry = EXT4_XATTR_NEXT(entry)) { const struct xattr_handler *handler = -@@ -438,9 +439,10 @@ ext4_xattr_list_entries(struct dentry *dentry, struct ext4_xattr_entry *entry, +@@ -439,9 +439,10 @@ ext4_xattr_list_entries(struct dentry *dentry, struct ext4_xattr_entry *entry, *buffer++ = 0; } rest -= size; @@ -104199,7 +104203,7 @@ index 14db05d..687f6d8 100644 #define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */ diff --git a/fs/namei.c b/fs/namei.c -index 70580ab..cdede72 100644 +index 9281b2b..657fdb3 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -337,17 +337,32 @@ int generic_permission(struct inode *inode, int mask) @@ -104358,7 +104362,7 @@ index 70580ab..cdede72 100644 if (nd->root.mnt && !(nd->flags & LOOKUP_ROOT)) { path_put(&nd->root); nd->root.mnt = NULL; -@@ -1015,6 +1082,9 @@ const char *get_link(struct nameidata *nd) +@@ -1017,6 +1084,9 @@ const char *get_link(struct nameidata *nd) if (unlikely(error)) return ERR_PTR(error); @@ -104368,7 +104372,7 @@ index 70580ab..cdede72 100644 nd->last_type = LAST_BIND; res = inode->i_link; if (!res) { -@@ -1701,6 +1771,23 @@ static int pick_link(struct nameidata *nd, struct path *link, +@@ -1703,6 +1773,23 @@ static int pick_link(struct nameidata *nd, struct path *link, } } @@ -104392,7 +104396,7 @@ index 70580ab..cdede72 100644 last = nd->stack + nd->depth++; last->link = *link; clear_delayed_call(&last->done); -@@ -1938,7 +2025,7 @@ EXPORT_SYMBOL(hashlen_string); +@@ -1940,7 +2027,7 @@ EXPORT_SYMBOL(hashlen_string); static inline u64 hash_name(const char *name) { unsigned long a = 0, b, x = 0, y = 0, adata, bdata, mask, len; @@ -104401,7 +104405,7 @@ index 70580ab..cdede72 100644 len = -sizeof(unsigned long); do { -@@ -2120,6 +2207,10 @@ static const char *path_init(struct nameidata *nd, unsigned flags) +@@ -2122,6 +2209,10 @@ static const char *path_init(struct nameidata *nd, unsigned flags) nd->last_type = LAST_ROOT; /* if there are only slashes... */ nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT; nd->depth = 0; @@ -104412,7 +104416,7 @@ index 70580ab..cdede72 100644 if (flags & LOOKUP_ROOT) { struct dentry *root = nd->root.dentry; struct inode *inode = root->d_inode; -@@ -2251,6 +2342,14 @@ static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path +@@ -2253,6 +2344,14 @@ static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path if (!err) err = complete_walk(nd); @@ -104427,7 +104431,7 @@ index 70580ab..cdede72 100644 if (!err && nd->flags & LOOKUP_DIRECTORY) if (!d_can_lookup(nd->path.dentry)) err = -ENOTDIR; -@@ -2299,6 +2398,14 @@ static int path_parentat(struct nameidata *nd, unsigned flags, +@@ -2301,6 +2400,14 @@ static int path_parentat(struct nameidata *nd, unsigned flags, err = link_path_walk(s, nd); if (!err) err = complete_walk(nd); @@ -104442,7 +104446,7 @@ index 70580ab..cdede72 100644 if (!err) { *parent = nd->path; nd->path.mnt = NULL; -@@ -2926,6 +3033,13 @@ static int may_open(struct path *path, int acc_mode, int flag) +@@ -2928,6 +3035,13 @@ static int may_open(struct path *path, int acc_mode, int flag) if (flag & O_NOATIME && !inode_owner_or_capable(inode)) return -EPERM; @@ -104456,7 +104460,7 @@ index 70580ab..cdede72 100644 return 0; } -@@ -3165,6 +3279,20 @@ no_open: +@@ -3167,6 +3281,20 @@ no_open: /* Negative dentry, just create the file */ if (!dentry->d_inode && (open_flag & O_CREAT)) { @@ -104477,7 +104481,7 @@ index 70580ab..cdede72 100644 *opened |= FILE_CREATED; audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE); if (!dir_inode->i_op->create) { -@@ -3175,6 +3303,7 @@ no_open: +@@ -3177,6 +3305,7 @@ no_open: open_flag & O_EXCL); if (error) goto out_dput; @@ -104485,7 +104489,7 @@ index 70580ab..cdede72 100644 fsnotify_create(dir_inode, dentry); } if (unlikely(create_error) && !dentry->d_inode) { -@@ -3289,6 +3418,11 @@ static int do_last(struct nameidata *nd, +@@ -3291,6 +3420,11 @@ static int do_last(struct nameidata *nd, goto finish_open_created; } @@ -104497,7 +104501,7 @@ index 70580ab..cdede72 100644 /* * If atomic_open() acquired write access it is dropped now due to * possible mount and symlink following (this might be optimized away if -@@ -3308,6 +3442,13 @@ static int do_last(struct nameidata *nd, +@@ -3310,6 +3444,13 @@ static int do_last(struct nameidata *nd, return -ENOENT; } @@ -104511,7 +104515,7 @@ index 70580ab..cdede72 100644 /* * create/update audit record if it already exists. */ -@@ -3336,6 +3477,21 @@ finish_open: +@@ -3338,6 +3479,21 @@ finish_open: error = complete_walk(nd); if (error) return error; @@ -104533,7 +104537,7 @@ index 70580ab..cdede72 100644 audit_inode(nd->name, nd->path.dentry, 0); error = -EISDIR; if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry)) -@@ -3592,9 +3748,11 @@ static struct dentry *filename_create(int dfd, struct filename *name, +@@ -3594,9 +3750,11 @@ static struct dentry *filename_create(int dfd, struct filename *name, goto unlock; error = -EEXIST; @@ -104547,7 +104551,7 @@ index 70580ab..cdede72 100644 /* * Special case - lookup gave negative, but... we had foo/bar/ * From the vfs_mknod() POV we just have a negative dentry - -@@ -3648,6 +3806,20 @@ inline struct dentry *user_path_create(int dfd, const char __user *pathname, +@@ -3650,6 +3808,20 @@ inline struct dentry *user_path_create(int dfd, const char __user *pathname, } EXPORT_SYMBOL(user_path_create); @@ -104568,7 +104572,7 @@ index 70580ab..cdede72 100644 int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) { int error = may_create(dir, dentry); -@@ -3711,6 +3883,17 @@ retry: +@@ -3713,6 +3885,17 @@ retry: if (!IS_POSIXACL(path.dentry->d_inode)) mode &= ~current_umask(); @@ -104586,7 +104590,7 @@ index 70580ab..cdede72 100644 error = security_path_mknod(&path, dentry, mode, dev); if (error) goto out; -@@ -3728,6 +3911,8 @@ retry: +@@ -3730,6 +3913,8 @@ retry: error = vfs_mknod(path.dentry->d_inode,dentry,mode,0); break; } @@ -104595,7 +104599,7 @@ index 70580ab..cdede72 100644 out: done_path_create(&path, dentry); if (retry_estale(error, lookup_flags)) { -@@ -3782,9 +3967,16 @@ retry: +@@ -3784,9 +3969,16 @@ retry: if (!IS_POSIXACL(path.dentry->d_inode)) mode &= ~current_umask(); @@ -104612,7 +104616,7 @@ index 70580ab..cdede72 100644 done_path_create(&path, dentry); if (retry_estale(error, lookup_flags)) { lookup_flags |= LOOKUP_REVAL; -@@ -3845,6 +4037,8 @@ static long do_rmdir(int dfd, const char __user *pathname) +@@ -3847,6 +4039,8 @@ static long do_rmdir(int dfd, const char __user *pathname) struct path path; struct qstr last; int type; @@ -104621,7 +104625,7 @@ index 70580ab..cdede72 100644 unsigned int lookup_flags = 0; retry: name = user_path_parent(dfd, pathname, -@@ -3877,10 +4071,20 @@ retry: +@@ -3879,10 +4073,20 @@ retry: error = -ENOENT; goto exit3; } @@ -104642,7 +104646,7 @@ index 70580ab..cdede72 100644 exit3: dput(dentry); exit2: -@@ -3975,6 +4179,8 @@ static long do_unlinkat(int dfd, const char __user *pathname) +@@ -3977,6 +4181,8 @@ static long do_unlinkat(int dfd, const char __user *pathname) int type; struct inode *inode = NULL; struct inode *delegated_inode = NULL; @@ -104651,7 +104655,7 @@ index 70580ab..cdede72 100644 unsigned int lookup_flags = 0; retry: name = user_path_parent(dfd, pathname, -@@ -4001,10 +4207,21 @@ retry_deleg: +@@ -4003,10 +4209,21 @@ retry_deleg: if (d_is_negative(dentry)) goto slashes; ihold(inode); @@ -104673,7 +104677,7 @@ index 70580ab..cdede72 100644 exit2: dput(dentry); } -@@ -4093,9 +4310,17 @@ retry: +@@ -4095,9 +4312,17 @@ retry: if (IS_ERR(dentry)) goto out_putname; @@ -104691,7 +104695,7 @@ index 70580ab..cdede72 100644 done_path_create(&path, dentry); if (retry_estale(error, lookup_flags)) { lookup_flags |= LOOKUP_REVAL; -@@ -4199,6 +4424,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, +@@ -4201,6 +4426,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, struct dentry *new_dentry; struct path old_path, new_path; struct inode *delegated_inode = NULL; @@ -104699,7 +104703,7 @@ index 70580ab..cdede72 100644 int how = 0; int error; -@@ -4222,7 +4448,7 @@ retry: +@@ -4224,7 +4450,7 @@ retry: if (error) return error; @@ -104708,7 +104712,7 @@ index 70580ab..cdede72 100644 (how & LOOKUP_REVAL)); error = PTR_ERR(new_dentry); if (IS_ERR(new_dentry)) -@@ -4234,11 +4460,26 @@ retry: +@@ -4236,11 +4462,26 @@ retry: error = may_linkat(&old_path); if (unlikely(error)) goto out_dput; @@ -104735,7 +104739,7 @@ index 70580ab..cdede72 100644 done_path_create(&new_path, new_dentry); if (delegated_inode) { error = break_deleg_wait(&delegated_inode); -@@ -4557,6 +4798,20 @@ retry_deleg: +@@ -4559,6 +4800,20 @@ retry_deleg: if (new_dentry == trap) goto exit5; @@ -104756,7 +104760,7 @@ index 70580ab..cdede72 100644 error = security_path_rename(&old_path, old_dentry, &new_path, new_dentry, flags); if (error) -@@ -4564,6 +4819,9 @@ retry_deleg: +@@ -4566,6 +4821,9 @@ retry_deleg: error = vfs_rename(old_path.dentry->d_inode, old_dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode, flags); @@ -104766,7 +104770,7 @@ index 70580ab..cdede72 100644 exit5: dput(new_dentry); exit4: -@@ -4620,14 +4878,24 @@ EXPORT_SYMBOL(vfs_whiteout); +@@ -4622,14 +4880,24 @@ EXPORT_SYMBOL(vfs_whiteout); int readlink_copy(char __user *buffer, int buflen, const char *link) { @@ -113513,10 +113517,10 @@ index 93ae3cd..6cee098 100644 } putname(tmp); diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c -index 80aa6f1..bf87501 100644 +index 4133aa7..5468804 100644 --- a/fs/overlayfs/copy_up.c +++ b/fs/overlayfs/copy_up.c -@@ -185,7 +185,7 @@ static char *ovl_read_symlink(struct dentry *realdentry) +@@ -187,7 +187,7 @@ static char *ovl_read_symlink(struct dentry *realdentry) set_fs(get_ds()); /* The cast to a user pointer is valid due to the set_fs() */ res = inode->i_op->readlink(realdentry, @@ -113526,10 +113530,10 @@ index 80aa6f1..bf87501 100644 if (res < 0) { free_page((unsigned long) buf); diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c -index d1cdc60..38f2608 100644 +index ac98a71..48f2b72 100644 --- a/fs/overlayfs/inode.c +++ b/fs/overlayfs/inode.c -@@ -360,6 +360,9 @@ struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags) +@@ -363,6 +363,9 @@ struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags) if (d_is_dir(dentry)) return d_backing_inode(dentry); @@ -113540,7 +113544,7 @@ index d1cdc60..38f2608 100644 if (ovl_open_need_copy_up(file_flags, type, realpath.dentry)) { err = ovl_want_write(dentry); diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c -index 6db75cb..b2fe139 100644 +index 86f2025..8a2a0b8 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -196,7 +196,7 @@ void ovl_path_lower(struct dentry *dentry, struct path *path) @@ -113552,7 +113556,7 @@ index 6db75cb..b2fe139 100644 } int ovl_want_write(struct dentry *dentry) -@@ -953,8 +953,8 @@ static unsigned int ovl_split_lowerdirs(char *str) +@@ -972,8 +972,8 @@ static unsigned int ovl_split_lowerdirs(char *str) static int ovl_fill_super(struct super_block *sb, void *data, int silent) { @@ -115396,7 +115400,7 @@ index 510413eb..34d9a8c 100644 seq_printf(p, "softirq %llu", (unsigned long long)sum_softirq); diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index 4648c7f..9f5a541 100644 +index 4648c7f..1cd9ac3 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -15,12 +15,19 @@ @@ -115469,12 +115473,25 @@ index 4648c7f..9f5a541 100644 if (IS_ERR(priv->mm)) { int err = PTR_ERR(priv->mm); -@@ -281,11 +309,11 @@ static int is_stack(struct proc_maps_private *priv, - stack = vma_is_stack_for_task(vma, task); - rcu_read_unlock(); - } -- return stack; -+ return stack || (vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)); +@@ -263,14 +291,15 @@ static int do_maps_open(struct inode *inode, struct file *file, + * Indicate if the VMA is a stack for the given task; for + * /proc/PID/maps that is the stack of the main task. + */ +-static int is_stack(struct proc_maps_private *priv, ++static bool is_stack(struct proc_maps_private *priv, + struct vm_area_struct *vma, int is_pid) + { +- int stack = 0; ++ bool stack = false; + + if (is_pid) { + stack = vma->vm_start <= vma->vm_mm->start_stack && + vma->vm_end >= vma->vm_mm->start_stack; ++ stack |= vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP); + } else { + struct inode *inode = priv->inode; + struct task_struct *task; +@@ -285,7 +314,7 @@ static int is_stack(struct proc_maps_private *priv, } static void @@ -115483,7 +115500,7 @@ index 4648c7f..9f5a541 100644 { struct mm_struct *mm = vma->vm_mm; struct file *file = vma->vm_file; -@@ -304,13 +332,8 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid) +@@ -304,13 +333,8 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid) pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT; } @@ -115499,7 +115516,7 @@ index 4648c7f..9f5a541 100644 seq_setwidth(m, 25 + sizeof(void *) * 6 - 1); seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ", -@@ -320,7 +343,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid) +@@ -320,7 +344,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid) flags & VM_WRITE ? 'w' : '-', flags & VM_EXEC ? 'x' : '-', flags & VM_MAYSHARE ? 's' : 'p', @@ -115508,7 +115525,7 @@ index 4648c7f..9f5a541 100644 MAJOR(dev), MINOR(dev), ino); /* -@@ -329,7 +352,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid) +@@ -329,7 +353,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid) */ if (file) { seq_pad(m, ' '); @@ -115517,7 +115534,7 @@ index 4648c7f..9f5a541 100644 goto done; } -@@ -366,7 +389,20 @@ done: +@@ -366,7 +390,20 @@ done: static int show_map(struct seq_file *m, void *v, int is_pid) { @@ -115539,7 +115556,7 @@ index 4648c7f..9f5a541 100644 m_cache_vma(m, v); return 0; } -@@ -646,6 +682,9 @@ static void show_smap_vma_flags(struct seq_file *m, struct vm_area_struct *vma) +@@ -646,6 +683,9 @@ static void show_smap_vma_flags(struct seq_file *m, struct vm_area_struct *vma) [ilog2(VM_RAND_READ)] = "rr", [ilog2(VM_DONTCOPY)] = "dc", [ilog2(VM_DONTEXPAND)] = "de", @@ -115549,7 +115566,7 @@ index 4648c7f..9f5a541 100644 [ilog2(VM_ACCOUNT)] = "ac", [ilog2(VM_NORESERVE)] = "nr", [ilog2(VM_HUGETLB)] = "ht", -@@ -727,7 +766,14 @@ static int show_smap(struct seq_file *m, void *v, int is_pid) +@@ -727,7 +767,14 @@ static int show_smap(struct seq_file *m, void *v, int is_pid) .mm = vma->vm_mm, .private = &mss, }; @@ -115564,7 +115581,7 @@ index 4648c7f..9f5a541 100644 memset(&mss, 0, sizeof mss); #ifdef CONFIG_SHMEM -@@ -754,10 +800,15 @@ static int show_smap(struct seq_file *m, void *v, int is_pid) +@@ -754,10 +801,15 @@ static int show_smap(struct seq_file *m, void *v, int is_pid) } #endif @@ -115583,7 +115600,7 @@ index 4648c7f..9f5a541 100644 seq_printf(m, "Size: %8lu kB\n" -@@ -777,7 +828,7 @@ static int show_smap(struct seq_file *m, void *v, int is_pid) +@@ -777,7 +829,7 @@ static int show_smap(struct seq_file *m, void *v, int is_pid) "KernelPageSize: %8lu kB\n" "MMUPageSize: %8lu kB\n" "Locked: %8lu kB\n", @@ -115592,7 +115609,7 @@ index 4648c7f..9f5a541 100644 mss.resident >> 10, (unsigned long)(mss.pss >> (10 + PSS_SHIFT)), mss.shared_clean >> 10, -@@ -1433,7 +1484,7 @@ static int pagemap_open(struct inode *inode, struct file *file) +@@ -1433,7 +1485,7 @@ static int pagemap_open(struct inode *inode, struct file *file) { struct mm_struct *mm; @@ -115601,7 +115618,7 @@ index 4648c7f..9f5a541 100644 if (IS_ERR(mm)) return PTR_ERR(mm); file->private_data = mm; -@@ -1636,6 +1687,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) +@@ -1636,6 +1688,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) char buffer[64]; int nid; @@ -115615,7 +115632,7 @@ index 4648c7f..9f5a541 100644 if (!mm) return 0; -@@ -1650,11 +1708,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) +@@ -1650,11 +1709,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) mpol_to_str(buffer, sizeof(buffer), proc_priv->task_mempolicy); } @@ -126381,7 +126398,7 @@ index 0000000..6822208 +} diff --git a/grsecurity/grsec_ipc.c b/grsecurity/grsec_ipc.c new file mode 100644 -index 0000000..1773300 +index 0000000..6a8ed69 --- /dev/null +++ b/grsecurity/grsec_ipc.c @@ -0,0 +1,48 @@ @@ -126426,7 +126443,7 @@ index 0000000..1773300 + orig_granted_mode = 0; + } + if (!(requested_mode & ~granted_mode & 0007) && (requested_mode & ~orig_granted_mode & 0007) && -+ !ns_capable_nolog(ns->user_ns, CAP_IPC_OWNER)) { ++ !ns_capable_noaudit(ns->user_ns, CAP_IPC_OWNER)) { + gr_log_str_int(GR_DONT_AUDIT, GR_IPC_DENIED_MSG, write ? "write" : "read", GR_GLOBAL_UID(ipcp->cuid)); + return 0; + } @@ -128339,7 +128356,7 @@ index 5bdab6b..9ae82fe 100644 #define pud_none(pud) 0 #define pud_bad(pud) 0 diff --git a/include/asm-generic/atomic-long.h b/include/asm-generic/atomic-long.h -index 5e1f345..74a91f8 100644 +index 5e1f345..e3fb6e2 100644 --- a/include/asm-generic/atomic-long.h +++ b/include/asm-generic/atomic-long.h @@ -22,6 +22,12 @@ @@ -128548,7 +128565,7 @@ index 5e1f345..74a91f8 100644 #undef ATOMIC_LONG_INC_DEC_OP -@@ -187,4 +229,59 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u) +@@ -187,4 +229,60 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u) #define atomic_long_inc_not_zero(l) \ ATOMIC_LONG_PFX(_inc_not_zero)((ATOMIC_LONG_PFX(_t) *)(l)) @@ -128596,6 +128613,7 @@ index 5e1f345..74a91f8 100644 +#ifndef atomic_xchg_unchecked +#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i)) +#endif ++ +#define atomic_long_read_unchecked(v) atomic_long_read(v) +#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i)) +#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v)) @@ -129640,10 +129658,10 @@ index 1be04f8..9c2d3e2 100644 #define __ro_after_init __attribute__((__section__(".data..ro_after_init"))) #endif diff --git a/include/linux/capability.h b/include/linux/capability.h -index 00690ff..b9c971b 100644 +index 5f3c63d..b874083 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h -@@ -229,15 +229,28 @@ static inline bool capable(int cap) +@@ -230,6 +230,10 @@ static inline bool capable(int cap) { return true; } @@ -129654,17 +129672,13 @@ index 00690ff..b9c971b 100644 static inline bool ns_capable(struct user_namespace *ns, int cap) { return true; +@@ -240,9 +244,13 @@ static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap) } -+static inline bool ns_capable_nolog(struct user_namespace *ns, int cap) -+{ -+ return true; -+} #endif /* CONFIG_MULTIUSER */ extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap); +extern bool capable_wrt_inode_uidgid_nolog(const struct inode *inode, int cap); extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap); +extern bool capable_nolog(int cap); -+extern bool ns_capable_nolog(struct user_namespace *ns, int cap); /* audit system wants to get cap info from files as well */ extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps); @@ -132307,19 +132321,23 @@ index ba7a9b0..33a0237 100644 extern int register_pppox_proto(int proto_num, const struct pppox_proto *pp); extern void unregister_pppox_proto(int proto_num); diff --git a/include/linux/init.h b/include/linux/init.h -index aedb254..71b67e5 100644 +index aedb254..a398315 100644 --- a/include/linux/init.h +++ b/include/linux/init.h -@@ -39,7 +39,7 @@ +@@ -37,9 +37,11 @@ + * section. + */ ++#define add_init_latent_entropy __latent_entropy ++ /* These are for everybody (although not all archs will actually discard it in modules) */ -#define __init __section(.init.text) __cold notrace -+#define __init __section(.init.text) __cold notrace __latent_entropy ++#define __init __section(.init.text) __cold notrace add_init_latent_entropy #define __initdata __section(.init.data) #define __initconst __constsection(.init.rodata) #define __exitdata __section(.exit.data) -@@ -92,7 +92,7 @@ +@@ -92,7 +94,7 @@ #define __exit __section(.exit.text) __exitused __cold notrace /* Used for MEMORY_HOTPLUG */ @@ -132328,7 +132346,7 @@ index aedb254..71b67e5 100644 #define __meminitdata __section(.meminit.data) #define __meminitconst __constsection(.meminit.rodata) #define __memexit __section(.memexit.text) __exitused __cold notrace -@@ -117,6 +117,12 @@ +@@ -117,6 +119,12 @@ #define __REFDATA .section ".ref.data", "aw" #define __REFCONST .section ".ref.rodata", "a" @@ -132902,6 +132920,33 @@ index 5356f4d..c99970b 100644 /** * list_move - delete from one list and add as another's head * @list: the entry to move +diff --git a/include/linux/llist.h b/include/linux/llist.h +index fd4ca0b..d77d4a8 100644 +--- a/include/linux/llist.h ++++ b/include/linux/llist.h +@@ -168,6 +168,10 @@ static inline struct llist_node *llist_next(struct llist_node *node) + extern bool llist_add_batch(struct llist_node *new_first, + struct llist_node *new_last, + struct llist_head *head); ++ ++extern bool pax_llist_add_batch(struct llist_node *new_first, ++ struct llist_node *new_last, ++ struct llist_head *head); + /** + * llist_add - add a new entry + * @new: new entry to be added +@@ -180,6 +184,11 @@ static inline bool llist_add(struct llist_node *new, struct llist_head *head) + return llist_add_batch(new, new, head); + } + ++static inline bool pax_llist_add(struct llist_node *new, struct llist_head *head) ++{ ++ return pax_llist_add_batch(new, new, head); ++} ++ + /** + * llist_del_all - delete all entries from lock-less list + * @head: the head of lock-less list to delete all entries diff --git a/include/linux/lockd/xdr.h b/include/linux/lockd/xdr.h index d39ed1c..8b5d98f 100644 --- a/include/linux/lockd/xdr.h @@ -133162,7 +133207,7 @@ index 4429d25..ae5ab54 100644 static inline int vma_dup_policy(struct vm_area_struct *src, struct vm_area_struct *dst) diff --git a/include/linux/mm.h b/include/linux/mm.h -index ece042d..d7834bf 100644 +index ece042d..8115afb 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -107,6 +107,7 @@ extern int mmap_rnd_compat_bits __read_mostly; @@ -133228,7 +133273,7 @@ index ece042d..d7834bf 100644 long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, unsigned long start, unsigned long nr_pages, -@@ -1331,39 +1338,11 @@ int clear_page_dirty_for_io(struct page *page); +@@ -1331,40 +1338,12 @@ int clear_page_dirty_for_io(struct page *page); int get_cmdline(struct task_struct *task, char *buffer, int buflen); @@ -133265,9 +133310,11 @@ index ece042d..d7834bf 100644 - !vma_growsup(vma->vm_next, addr); -} - - int vma_is_stack_for_task(struct vm_area_struct *vma, struct task_struct *t); +-int vma_is_stack_for_task(struct vm_area_struct *vma, struct task_struct *t); ++bool vma_is_stack_for_task(struct vm_area_struct *vma, struct task_struct *t); extern unsigned long move_page_tables(struct vm_area_struct *vma, + unsigned long old_addr, struct vm_area_struct *new_vma, @@ -1508,8 +1487,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, { return 0; @@ -136120,20 +136167,6 @@ index 5c3a5f3..84a8bef 100644 } #else -diff --git a/include/linux/swiotlb.h b/include/linux/swiotlb.h -index 017fced..d4a9fc9 100644 ---- a/include/linux/swiotlb.h -+++ b/include/linux/swiotlb.h -@@ -63,7 +63,8 @@ extern void - - extern void - swiotlb_free_coherent(struct device *hwdev, size_t size, -- void *vaddr, dma_addr_t dma_handle); -+ void *vaddr, dma_addr_t dma_handle, -+ struct dma_attrs *attrs); - - extern dma_addr_t swiotlb_map_page(struct device *dev, struct page *page, - unsigned long offset, size_t size, diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h index d022390..80f9811 100644 --- a/include/linux/syscalls.h @@ -139633,7 +139666,7 @@ index 46ecce4..46c1a1a 100644 if (!access_ok(VERIFY_READ, uattr, 1)) return -EFAULT; diff --git a/kernel/capability.c b/kernel/capability.c -index 45432b5..7d860f7 100644 +index 00411c8..aaad585 100644 --- a/kernel/capability.c +++ b/kernel/capability.c @@ -193,6 +193,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr) @@ -139673,51 +139706,34 @@ index 45432b5..7d860f7 100644 } /** -@@ -379,7 +383,7 @@ bool ns_capable(struct user_namespace *ns, int cap) +@@ -370,9 +374,9 @@ static bool ns_capable_common(struct user_namespace *ns, int cap, bool audit) BUG(); } -- if (security_capable(current_cred(), ns, cap) == 0) { -+ if (security_capable(current_cred(), ns, cap) == 0 && gr_is_capable(cap)) { +- capable = audit ? security_capable(current_cred(), ns, cap) : +- security_capable_noaudit(current_cred(), ns, cap); +- if (capable == 0) { ++ capable = audit ? (security_capable(current_cred(), ns, cap) == 0 && gr_is_capable(cap)) : ++ (security_capable_noaudit(current_cred(), ns, cap) == 0 && gr_is_capable_nolog(cap)) ; ++ if (capable) { current->flags |= PF_SUPERPRIV; return true; } -@@ -387,6 +391,20 @@ bool ns_capable(struct user_namespace *ns, int cap) - } - EXPORT_SYMBOL(ns_capable); - -+bool ns_capable_nolog(struct user_namespace *ns, int cap) -+{ -+ if (unlikely(!cap_valid(cap))) { -+ pr_crit("capable_nolog() called with invalid cap=%u\n", cap); -+ BUG(); -+ } -+ -+ if (security_capable_noaudit(current_cred(), ns, cap) == 0 && gr_is_capable_nolog(cap)) { -+ current->flags |= PF_SUPERPRIV; -+ return true; -+ } -+ return false; -+} -+EXPORT_SYMBOL(ns_capable_nolog); - - /** - * capable - Determine if the current task has a superior capability in effect -@@ -403,6 +421,13 @@ bool capable(int cap) +@@ -429,6 +433,13 @@ bool capable(int cap) return ns_capable(&init_user_ns, cap); } EXPORT_SYMBOL(capable); + +bool capable_nolog(int cap) +{ -+ return ns_capable_nolog(&init_user_ns, cap); ++ return ns_capable_noaudit(&init_user_ns, cap); +} +EXPORT_SYMBOL(capable_nolog); + #endif /* CONFIG_MULTIUSER */ /** -@@ -447,3 +472,12 @@ bool capable_wrt_inode_uidgid(const struct inode *inode, int cap) +@@ -473,3 +484,12 @@ bool capable_wrt_inode_uidgid(const struct inode *inode, int cap) kgid_has_mapping(ns, inode->i_gid); } EXPORT_SYMBOL(capable_wrt_inode_uidgid); @@ -139726,7 +139742,7 @@ index 45432b5..7d860f7 100644 +{ + struct user_namespace *ns = current_user_ns(); + -+ return ns_capable_nolog(ns, cap) && kuid_has_mapping(ns, inode->i_uid) && ++ return ns_capable_noaudit(ns, cap) && kuid_has_mapping(ns, inode->i_uid) && + kgid_has_mapping(ns, inode->i_gid); +} +EXPORT_SYMBOL(capable_wrt_inode_uidgid_nolog); @@ -140015,7 +140031,7 @@ index c18b1f1..b9a0132 100644 return -ENOMEM; diff --git a/kernel/cred.c b/kernel/cred.c -index 0c0cd8a..faf7245 100644 +index 5f264fb..8fc856b 100644 --- a/kernel/cred.c +++ b/kernel/cred.c @@ -172,6 +172,15 @@ void exit_creds(struct task_struct *tsk) @@ -140644,8 +140660,45 @@ index 9e6e135..4af378d 100644 if (wo->wo_flags & __WNOTHREAD) break; +diff --git a/kernel/extable.c b/kernel/extable.c +index e820cce..72195de 100644 +--- a/kernel/extable.c ++++ b/kernel/extable.c +@@ -23,6 +23,7 @@ + + #include <asm/sections.h> + #include <asm/uaccess.h> ++#include <asm/setup.h> + + /* + * mutex protecting text section modification (dynamic code patching). +@@ -41,10 +42,22 @@ u32 __initdata __visible main_extable_sort_needed = 1; + /* Sort the kernel's built-in exception table */ + void __init sort_main_extable(void) + { +- if (main_extable_sort_needed && __stop___ex_table > __start___ex_table) { ++ struct exception_table_entry *start = __start___ex_table; ++ ++ if (main_extable_sort_needed && __stop___ex_table > start) { + pr_notice("Sorting __ex_table...\n"); +- sort_extable(__start___ex_table, __stop___ex_table); ++ sort_extable(start, __stop___ex_table); + } ++ ++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) ++ while (start < __stop___ex_table) { ++ start->insn -= kaslr_offset(); ++ start->fixup -= kaslr_offset(); ++ start->handler -= kaslr_offset(); ++ start++; ++ } ++#endif ++ + } + + /* Given an address, look for it in the exception tables. */ diff --git a/kernel/fork.c b/kernel/fork.c -index 4a7ec0c..c49705c 100644 +index aea4f4d..59d599e 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -197,12 +197,55 @@ static void free_thread_stack(unsigned long *stack) @@ -141806,7 +141859,7 @@ index a0f61ef..b6aef3c 100644 seq_printf(m, "%40s %14lu %29s %pS\n", name, stats->contending_point[i], diff --git a/kernel/module.c b/kernel/module.c -index 6458a2f..ebdeb641 100644 +index 6458a2f..3edf977 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -60,6 +60,7 @@ @@ -142747,17 +142800,24 @@ index 6458a2f..ebdeb641 100644 return 0; } module_init(proc_modules_init); -@@ -4118,7 +4328,8 @@ struct module *__module_address(unsigned long addr) +@@ -4118,7 +4328,15 @@ struct module *__module_address(unsigned long addr) { struct module *mod; - if (addr < module_addr_min || addr > module_addr_max) ++#ifdef CONFIG_X86_32 ++ unsigned long vaddr = ktla_ktva(addr); ++ ++ if (module_addr_min_rx <= vaddr && vaddr <= module_addr_max_rx) ++ addr = vaddr; ++#endif ++ + if ((addr < module_addr_min_rx || addr > module_addr_max_rx) && + (addr < module_addr_min_rw || addr > module_addr_max_rw)) return NULL; module_assert_mutex_or_preempt(); -@@ -4161,11 +4372,21 @@ bool is_module_text_address(unsigned long addr) +@@ -4161,11 +4379,21 @@ bool is_module_text_address(unsigned long addr) */ struct module *__module_text_address(unsigned long addr) { @@ -142782,6 +142842,15 @@ index 6458a2f..ebdeb641 100644 mod = NULL; } return mod; +@@ -4195,7 +4423,7 @@ void print_modules(void) + #ifdef CONFIG_MODVERSIONS + /* Generate the signature for all relevant module structures here. + * If these change, we don't want to try to parse the module. */ +-void module_layout(struct module *mod, ++__visible void module_layout(struct module *mod, + struct modversion_info *ver, + struct kernel_param *kp, + struct kernel_symbol *ks, diff --git a/kernel/notifier.c b/kernel/notifier.c index fd2c9ac..6263e05 100644 --- a/kernel/notifier.c @@ -143155,7 +143224,7 @@ index c2199e9..ce5d89c 100644 } diff --git a/kernel/ptrace.c b/kernel/ptrace.c -index d49bfa1..5eb9a32 100644 +index d49bfa1..10a4c38 100644 --- a/kernel/ptrace.c +++ b/kernel/ptrace.c @@ -206,12 +206,32 @@ static int ptrace_check_attach(struct task_struct *child, bool ignore_state) @@ -143217,7 +143286,7 @@ index d49bfa1..5eb9a32 100644 flags |= PT_SEIZED; rcu_read_lock(); - if (ns_capable(__task_cred(task)->user_ns, CAP_SYS_PTRACE)) -+ if (ns_capable_nolog(__task_cred(task)->user_ns, CAP_SYS_PTRACE)) ++ if (ns_capable_noaudit(__task_cred(task)->user_ns, CAP_SYS_PTRACE)) flags |= PT_PTRACE_CAP; rcu_read_unlock(); task->ptrace = flags; @@ -145399,7 +145468,7 @@ index 667b933..1668952 100644 update_vsyscall_tz(); if (firsttime) { diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c -index 479d25c..7c25647 100644 +index b6c3945..373f21e 100644 --- a/kernel/time/timekeeping.c +++ b/kernel/time/timekeeping.c @@ -15,6 +15,7 @@ @@ -145410,7 +145479,7 @@ index 479d25c..7c25647 100644 #include <linux/syscore_ops.h> #include <linux/clocksource.h> #include <linux/jiffies.h> -@@ -1164,6 +1165,8 @@ int do_settimeofday64(const struct timespec64 *ts) +@@ -1167,6 +1168,8 @@ int do_settimeofday64(const struct timespec64 *ts) if (!timespec64_valid_strict(ts)) return -EINVAL; @@ -146859,34 +146928,6 @@ index 51a76af..7caf15b 100644 err_printk(dev, NULL, "DMA-API: device driver maps memory from " "stack [addr=%p]\n", addr); } -diff --git a/lib/extable.c b/lib/extable.c -index 0be02ad5..c2ad286 100644 ---- a/lib/extable.c -+++ b/lib/extable.c -@@ -13,13 +13,22 @@ - #include <linux/init.h> - #include <linux/sort.h> - #include <asm/uaccess.h> -+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) -+#include <asm/boot.h> -+#endif - - #ifndef ARCH_HAS_RELATIVE_EXTABLE - #define ex_to_insn(x) ((x)->insn) - #else - static inline unsigned long ex_to_insn(const struct exception_table_entry *x) - { -- return (unsigned long)&x->insn + x->insn; -+ unsigned long reloc = 0; -+ -+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC) -+ reloc = ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR; -+#endif -+ -+ return (unsigned long)&x->insn + x->insn + reloc; - } - #endif - diff --git a/lib/inflate.c b/lib/inflate.c index 013a761..c28f3fc 100644 --- a/lib/inflate.c @@ -147186,6 +147227,41 @@ index 3859bf6..818741d6 100644 + pax_close_kernel(); +} +EXPORT_SYMBOL(pax_list_del_rcu); +diff --git a/lib/llist.c b/lib/llist.c +index ae5872b..63a9698 100644 +--- a/lib/llist.c ++++ b/lib/llist.c +@@ -25,6 +25,7 @@ + #include <linux/kernel.h> + #include <linux/export.h> + #include <linux/llist.h> ++#include <linux/mm.h> + + + /** +@@ -48,6 +49,22 @@ bool llist_add_batch(struct llist_node *new_first, struct llist_node *new_last, + } + EXPORT_SYMBOL_GPL(llist_add_batch); + ++bool pax_llist_add_batch(struct llist_node *new_first, struct llist_node *new_last, ++ struct llist_head *head) ++{ ++ struct llist_node *first; ++ ++ do { ++ first = ACCESS_ONCE(head->first); ++ pax_open_kernel(); ++ new_last->next = first; ++ pax_close_kernel(); ++ } while (cmpxchg(&head->first, first, new_first) != first); ++ ++ return !first; ++} ++EXPORT_SYMBOL_GPL(pax_llist_add_batch); ++ + /** + * llist_del_first - delete the first entry of lock-less list + * @head: the head for your lock-less list diff --git a/lib/lockref.c b/lib/lockref.c index 5a92189..d77978d 100644 --- a/lib/lockref.c @@ -147469,19 +147545,6 @@ index 2625943..1541382 100644 long align, res = 0; unsigned long c; -diff --git a/lib/swiotlb.c b/lib/swiotlb.c -index 76f29ec..1a5316f 100644 ---- a/lib/swiotlb.c -+++ b/lib/swiotlb.c -@@ -690,7 +690,7 @@ EXPORT_SYMBOL(swiotlb_alloc_coherent); - - void - swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr, -- dma_addr_t dev_addr) -+ dma_addr_t dev_addr, struct dma_attrs *attrs) - { - phys_addr_t paddr = dma_to_phys(hwdev, dev_addr); - diff --git a/lib/usercopy.c b/lib/usercopy.c index 4f5b1dd..7cab418 100644 --- a/lib/usercopy.c @@ -152776,9 +152839,18 @@ index 031713ab..f2c0e55 100644 if (S_ISREG(inode->i_mode)) diff --git a/mm/util.c b/mm/util.c -index 917e0e3..6873e84 100644 +index 917e0e3..1c9f20c 100644 --- a/mm/util.c +++ b/mm/util.c +@@ -230,7 +230,7 @@ void __vma_link_list(struct mm_struct *mm, struct vm_area_struct *vma, + } + + /* Check if the vma is being used as a stack by this task */ +-int vma_is_stack_for_task(struct vm_area_struct *vma, struct task_struct *t) ++bool vma_is_stack_for_task(struct vm_area_struct *vma, struct task_struct *t) + { + return (vma->vm_start <= KSTK_ESP(t) && vma->vm_end >= KSTK_ESP(t)); + } @@ -239,6 +239,12 @@ int vma_is_stack_for_task(struct vm_area_struct *vma, struct task_struct *t) void arch_pick_mmap_layout(struct mm_struct *mm) { @@ -152811,7 +152883,7 @@ index 917e0e3..6873e84 100644 arg_start = mm->arg_start; arg_end = mm->arg_end; diff --git a/mm/vmalloc.c b/mm/vmalloc.c -index e11475c..3650eb9 100644 +index e11475c..eef1387 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -43,20 +43,65 @@ struct vfree_deferred { @@ -153065,7 +153137,7 @@ index e11475c..3650eb9 100644 + return; + if (unlikely(in_interrupt())) { + struct vfree_deferred *p = this_cpu_ptr(&vunmap_deferred); -+ if (llist_add((struct llist_node *)addr, &p->list)) ++ if (pax_llist_add((struct llist_node *)addr, &p->list)) + schedule_work(&p->wq); + } else { + might_sleep(); @@ -162233,19 +162305,6 @@ index dd94401..9540398 100644 /* Wait until SQ WR available if SQ still full */ wait_event(xprt->sc_send_wait, -diff --git a/net/sysctl_net.c b/net/sysctl_net.c -index ed98c1f..f74b659 100644 ---- a/net/sysctl_net.c -+++ b/net/sysctl_net.c -@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ctl_table_header *head, - kgid_t root_gid = make_kgid(net->user_ns, 0); - - /* Allow network administrator to have same access as root. */ -- if (ns_capable(net->user_ns, CAP_NET_ADMIN) || -+ if (ns_capable_nolog(net->user_ns, CAP_NET_ADMIN) || - uid_eq(root_uid, current_euid())) { - int mode = (table->mode >> 6) & 7; - return (mode << 6) | (mode << 3) | mode; diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c index 1fd4647..ebf12ff 100644 --- a/net/tipc/netlink_compat.c @@ -166879,10 +166938,10 @@ index 0000000..7514850 +fi diff --git a/scripts/gcc-plugins/initify_plugin.c b/scripts/gcc-plugins/initify_plugin.c new file mode 100644 -index 0000000..5a01d10 +index 0000000..fd7b918 --- /dev/null +++ b/scripts/gcc-plugins/initify_plugin.c -@@ -0,0 +1,537 @@ +@@ -0,0 +1,538 @@ +/* + * Copyright 2015-2016 by Emese Revfy <re.emese@gmail.com> + * Licensed under the GPL v2, or (at your option) v3 @@ -167063,6 +167122,7 @@ index 0000000..5a01d10 + int fntype_arg_len; + const_tree fndecl = gimple_call_fndecl(stmt); + ++// gcc_assert(DECL_ABSTRACT_ORIGIN(fndecl) == NULL_TREE); + if (DECL_ABSTRACT_ORIGIN(fndecl) != NULL_TREE) + return false; + @@ -185662,10 +185722,10 @@ index 0000000..00c7430 +} diff --git a/scripts/gcc-plugins/size_overflow_plugin/size_overflow_hash.data b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_hash.data new file mode 100644 -index 0000000..9d7e744 +index 0000000..d9ac611 --- /dev/null +++ b/scripts/gcc-plugins/size_overflow_plugin/size_overflow_hash.data -@@ -0,0 +1,22256 @@ +@@ -0,0 +1,22257 @@ +enable_so_recv_ctrl_pipe_us_data_0 recv_ctrl_pipe us_data 0 0 NULL +enable_so___earlyonly_bootmem_alloc_fndecl_3 __earlyonly_bootmem_alloc fndecl 2-3-4 3 NULL +enable_so_v9fs_xattr_get_acl_fndecl_4 v9fs_xattr_get_acl fndecl 5 4 NULL @@ -195481,6 +195541,7 @@ index 0000000..9d7e744 +enable_so_cur_offset_drm_dp_sideband_msg_tx_28655 cur_offset drm_dp_sideband_msg_tx 0 28655 &enable_so_alt_port_num_ib_qp_attr_28655 +enable_so_alloc_size_chunk_28657 alloc_size chunk 0 28657 NULL +enable_so_bfad_iocmd_lunmask_fndecl_28667 bfad_iocmd_lunmask fndecl 0 28667 NULL ++enable_so___frwr_init_fndecl_28674 __frwr_init fndecl 3 28674 NULL +enable_so_x25_create_facilities_fndecl_28684 x25_create_facilities fndecl 0 28684 NULL +enable_so_fill_isoc_urb_fndecl_28690 fill_isoc_urb fndecl 6-5-3 28690 NULL +enable_so_stolen_size_psb_gtt_28693 stolen_size psb_gtt 0 28693 NULL @@ -214381,7 +214442,7 @@ index 7798e16..1079224 100644 int i; if (!capable(CAP_MAC_ADMIN)) diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c -index 705c287..81257f1 100644 +index 7347fcc..b7f3f22 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -298,7 +298,7 @@ static struct aa_namespace *alloc_namespace(const char *prefix, @@ -215021,7 +215082,7 @@ index c61fd50f7..3081340 100644 default: result = -EINVAL; diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c -index 795437b..3650746 100644 +index b450a27..28c8238 100644 --- a/sound/core/rawmidi.c +++ b/sound/core/rawmidi.c @@ -871,9 +871,10 @@ static int snd_rawmidi_control_ioctl(struct snd_card *card, diff --git a/4.7.3/4425_grsec_remove_EI_PAX.patch b/4.7.4/4425_grsec_remove_EI_PAX.patch index ba92792..ba92792 100644 --- a/4.7.3/4425_grsec_remove_EI_PAX.patch +++ b/4.7.4/4425_grsec_remove_EI_PAX.patch diff --git a/4.7.3/4427_force_XATTR_PAX_tmpfs.patch b/4.7.4/4427_force_XATTR_PAX_tmpfs.patch index b4714fc..b4714fc 100644 --- a/4.7.3/4427_force_XATTR_PAX_tmpfs.patch +++ b/4.7.4/4427_force_XATTR_PAX_tmpfs.patch diff --git a/4.7.3/4430_grsec-remove-localversion-grsec.patch b/4.7.4/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/4.7.3/4430_grsec-remove-localversion-grsec.patch +++ b/4.7.4/4430_grsec-remove-localversion-grsec.patch diff --git a/4.7.3/4435_grsec-mute-warnings.patch b/4.7.4/4435_grsec-mute-warnings.patch index 8929222..8929222 100644 --- a/4.7.3/4435_grsec-mute-warnings.patch +++ b/4.7.4/4435_grsec-mute-warnings.patch diff --git a/4.7.3/4440_grsec-remove-protected-paths.patch b/4.7.4/4440_grsec-remove-protected-paths.patch index 741546d..741546d 100644 --- a/4.7.3/4440_grsec-remove-protected-paths.patch +++ b/4.7.4/4440_grsec-remove-protected-paths.patch diff --git a/4.7.3/4450_grsec-kconfig-default-gids.patch b/4.7.4/4450_grsec-kconfig-default-gids.patch index e892c8a..e892c8a 100644 --- a/4.7.3/4450_grsec-kconfig-default-gids.patch +++ b/4.7.4/4450_grsec-kconfig-default-gids.patch diff --git a/4.7.3/4465_selinux-avc_audit-log-curr_ip.patch b/4.7.4/4465_selinux-avc_audit-log-curr_ip.patch index 7248385..7248385 100644 --- a/4.7.3/4465_selinux-avc_audit-log-curr_ip.patch +++ b/4.7.4/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/4.7.3/4470_disable-compat_vdso.patch b/4.7.4/4470_disable-compat_vdso.patch index 0f82d7e..0f82d7e 100644 --- a/4.7.3/4470_disable-compat_vdso.patch +++ b/4.7.4/4470_disable-compat_vdso.patch diff --git a/4.7.3/4475_emutramp_default_on.patch b/4.7.4/4475_emutramp_default_on.patch index 2db58ab..2db58ab 100644 --- a/4.7.3/4475_emutramp_default_on.patch +++ b/4.7.4/4475_emutramp_default_on.patch |