aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorNatanael Copa <ncopa@alpinelinux.org>2013-07-10 08:45:46 +0000
committerNatanael Copa <ncopa@alpinelinux.org>2013-07-25 07:35:17 +0000
commitf234c3d7b77b90f1913c25884a29f2d2779aa6cb (patch)
tree3cec436c550ff507baad0a1618560fab477a06ea
parentdb7164f78513d312fe6acb5c1a76887a54b09f4e (diff)
downloadaports-f234c3d7b77b90f1913c25884a29f2d2779aa6cb.tar.bz2
aports-f234c3d7b77b90f1913c25884a29f2d2779aa6cb.tar.xz
main/linux-grsec: upgrade to 3.9.9 kernel
(cherry picked from commit 53ab941d1b6bf6cfa5230338c818272e01fde51a)
-rw-r--r--main/linux-grsec/APKBUILD18
-rw-r--r--main/linux-grsec/grsecurity-2.9.1-3.9.9-201307050017.patch (renamed from main/linux-grsec/grsecurity-2.9.1-3.9.8-201306302052.patch)706
2 files changed, 360 insertions, 364 deletions
diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 7e148c4015..832099d91f 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -2,12 +2,12 @@
_flavor=grsec
pkgname=linux-${_flavor}
-pkgver=3.9.8
+pkgver=3.9.9
case $pkgver in
*.*.*) _kernver=${pkgver%.*};;
*.*) _kernver=${pkgver};;
esac
-pkgrel=1
+pkgrel=0
pkgdesc="Linux kernel with grsecurity"
url=http://grsecurity.net
depends="mkinitfs linux-firmware"
@@ -17,7 +17,7 @@ _config=${config:-kernelconfig.${CARCH}}
install=
source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz
http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz
- grsecurity-2.9.1-3.9.8-201306302052.patch
+ grsecurity-2.9.1-3.9.9-201307050017.patch
0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch
0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch
@@ -149,8 +149,8 @@ dev() {
}
md5sums="4348c9b6b2eb3144d601e87c19d5d909 linux-3.9.tar.xz
-c5f2166686a913abf550bfed8b77df27 patch-3.9.8.xz
-647f77555169969b4245c62c0fd0f1ab grsecurity-2.9.1-3.9.8-201306302052.patch
+41f350c2fd6aa14414bf39f173a8e6a3 patch-3.9.9.xz
+f3b3db991845d216a1f60921f5fd650e grsecurity-2.9.1-3.9.9-201307050017.patch
a16f11b12381efb3bec79b9bfb329836 0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch
656ae7b10dd2f18dbfa1011041d08d60 0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch
aa454ffb96428586447775c21449e284 0003-ipv4-properly-refresh-rtable-entries-on-pmtu-redirec.patch
@@ -160,8 +160,8 @@ aa454ffb96428586447775c21449e284 0003-ipv4-properly-refresh-rtable-entries-on-p
d89089b3c7eb94dd9f65cf8a357fc36d kernelconfig.x86
eb147f09fef5996a488c247790205cd6 kernelconfig.x86_64"
sha256sums="60bc3e64ee5dc778de2cd7cd7640abf518a4c9d4f31b8ed624e16fad53f54541 linux-3.9.tar.xz
-2eda9068e81269467e3c247f3343a146731fc45284b12b4bc546bc44dbb263e7 patch-3.9.8.xz
-b111346072b7907d3a284f12a08c490cbfe35592537bc59442014c95080c3a33 grsecurity-2.9.1-3.9.8-201306302052.patch
+4ae653db69190a10b842f05c19499a528ae29898e4f2dfbdb420ef5d26112f3b patch-3.9.9.xz
+d864bb3e745101f5a624a2b716a03ec1b5dc31e4b3ddec6c9741426bcbbd1e53 grsecurity-2.9.1-3.9.9-201307050017.patch
6af3757ac36a6cd3cda7b0a71b08143726383b19261294a569ad7f4042c72df3 0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch
dc8e82108615657f1fb9d641efd42255a5761c06edde1b00a41ae0d314d548f0 0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch
0985caa0f3ee8ed0959aeaa4214f5f8057ae8e61d50dcae39194912d31e14892 0003-ipv4-properly-refresh-rtable-entries-on-pmtu-redirec.patch
@@ -171,8 +171,8 @@ fc613ac466610b866b721c41836fd5bfb2d4b75bceb67972dc6369d7f62ff47e 0006-ipv4-use-
de3c17420664ae4e52826c6e602aade0deeae94f72253f85b3e48771491ed5d6 kernelconfig.x86
e1cce320f207cc2ba72b9d154c7060c8cbed52c664319dfd21f24e8956d0bf3e kernelconfig.x86_64"
sha512sums="77fa521f42380409f8ab400c26f7b00e225cb075ef40834bb263325cfdcc3e65aef8511ec2fc2b50bbf4f50e226fb5ab07d7a479aaf09162adbbf318325d0790 linux-3.9.tar.xz
-60b7d694d39faf937e7b732eb3117b8442059c5c8857c9d439eec8a87d5bc185505e64062f5ae02c3512acf5af778caf615c35d3499cb8089a4569c05da65b9c patch-3.9.8.xz
-81912f5c19b8bc891a1ad8ed57bfe91d79c6c301410eb4ef9e58f57caefba2661d9732b306d695e712fd8e7c9b5bbb67659759fade26f4ec853d9cb96d347df9 grsecurity-2.9.1-3.9.8-201306302052.patch
+51fa4e20b23c9900078e90ace0c4cc38e419e5028a88b63443fafa66c07ad28aab77cb0f56ceb9c8416bfde848ceba64e95f608f0f64ab4634386a161cbc7994 patch-3.9.9.xz
+a16dde6d53649aecfa9eb47b969dbc5d147909c48191cc44a666c8f946181688344ac7512330e08fc47c48073010dd4154aac7b572d6301acaf39f5ad6e1b0df grsecurity-2.9.1-3.9.9-201307050017.patch
81e78593288e8b0fd2c03ea9fc1450323887707f087e911f172450a122bc9b591ee83394836789730d951aeec13d0b75a64e1c05f04364abf8f80d883ddc4a02 0001-net-inform-NETDEV_CHANGE-callbacks-which-flags-were-.patch
51ecb15b669f6a82940a13a38939116e003bf5dfd24496771c8279e907b72adcc63d607f0340a2940d757e12ddadb7d45c7af78ae311d284935a6296dbcac00c 0002-arp-flush-arp-cache-on-IFF_NOARP-change.patch
57d0a8bd35d19cf657ded58efe24517d2252aec6984040713ba173a34edb5887ececaa2985076bc6a149eaa57639fd98a042c1c2d226ed4ad8dd5ed0e230717e 0003-ipv4-properly-refresh-rtable-entries-on-pmtu-redirec.patch
diff --git a/main/linux-grsec/grsecurity-2.9.1-3.9.8-201306302052.patch b/main/linux-grsec/grsecurity-2.9.1-3.9.9-201307050017.patch
index 9c80933310..1ae3c82aef 100644
--- a/main/linux-grsec/grsecurity-2.9.1-3.9.8-201306302052.patch
+++ b/main/linux-grsec/grsecurity-2.9.1-3.9.9-201307050017.patch
@@ -263,7 +263,7 @@ index 8ccbf27..afffeb4 100644
pcd. [PARIDE]
diff --git a/Makefile b/Makefile
-index b013cbe..4ca639b 100644
+index 9591325..1457ef3 100644
--- a/Makefile
+++ b/Makefile
@@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -1475,7 +1475,7 @@ index 75fe66b..ba3dee4 100644
#endif
diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
-index e1489c5..d418304 100644
+index 738fcba..7a43500 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -116,7 +116,7 @@ struct cpu_cache_fns {
@@ -2102,7 +2102,7 @@ index cddda1f..ff357f7 100644
/*
* Change these and you break ASM code in entry-common.S
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
-index 7e1f760..752fcb7 100644
+index 7e1f760..510061e 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -18,6 +18,7 @@
@@ -2113,15 +2113,21 @@ index 7e1f760..752fcb7 100644
#define VERIFY_READ 0
#define VERIFY_WRITE 1
-@@ -60,10 +61,34 @@ extern int __put_user_bad(void);
- #define USER_DS TASK_SIZE
- #define get_fs() (current_thread_info()->addr_limit)
+@@ -63,11 +64,35 @@ extern int __put_user_bad(void);
+ static inline void set_fs(mm_segment_t fs)
+ {
+ current_thread_info()->addr_limit = fs;
+- modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_CLIENT : DOMAIN_MANAGER);
++ modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_KERNELCLIENT : DOMAIN_MANAGER);
+ }
+
+ #define segment_eq(a,b) ((a) == (b))
+static inline void pax_open_userland(void)
+{
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (get_fs() == USER_DS) {
++ if (segment_eq(get_fs(), USER_DS) {
+ BUG_ON(test_domain(DOMAIN_USER, DOMAIN_UDEREF));
+ modify_domain(DOMAIN_USER, DOMAIN_UDEREF);
+ }
@@ -2133,7 +2139,7 @@ index 7e1f760..752fcb7 100644
+{
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (get_fs() == USER_DS) {
++ if (segment_eq(get_fs(), USER_DS) {
+ BUG_ON(test_domain(DOMAIN_USER, DOMAIN_NOACCESS));
+ modify_domain(DOMAIN_USER, DOMAIN_NOACCESS);
+ }
@@ -2141,14 +2147,9 @@ index 7e1f760..752fcb7 100644
+
+}
+
- static inline void set_fs(mm_segment_t fs)
- {
- current_thread_info()->addr_limit = fs;
-- modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_CLIENT : DOMAIN_MANAGER);
-+ modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_KERNELCLIENT : DOMAIN_MANAGER);
- }
-
- #define segment_eq(a,b) ((a) == (b))
+ #define __addr_ok(addr) ({ \
+ unsigned long flag; \
+ __asm__("cmp %2, %0; movlo %0, #0" \
@@ -143,8 +168,12 @@ extern int __get_user_4(void *);
#define get_user(x,p) \
@@ -2295,9 +2296,18 @@ index 96ee092..37f1844 100644
#define PSR_ENDIAN_MASK 0x00000200 /* Endianness state mask */
diff --git a/arch/arm/kernel/armksyms.c b/arch/arm/kernel/armksyms.c
-index 60d3b73..d27ee09 100644
+index 60d3b73..e5a0f22 100644
--- a/arch/arm/kernel/armksyms.c
+++ b/arch/arm/kernel/armksyms.c
+@@ -53,7 +53,7 @@ EXPORT_SYMBOL(arm_delay_ops);
+
+ /* networking */
+ EXPORT_SYMBOL(csum_partial);
+-EXPORT_SYMBOL(csum_partial_copy_from_user);
++EXPORT_SYMBOL(__csum_partial_copy_from_user);
+ EXPORT_SYMBOL(csum_partial_copy_nocheck);
+ EXPORT_SYMBOL(__csum_ipv6_magic);
+
@@ -89,9 +89,9 @@ EXPORT_SYMBOL(__memzero);
#ifdef CONFIG_MMU
EXPORT_SYMBOL(copy_page);
@@ -3453,7 +3463,7 @@ index bddce2b..3eb04e2 100644
extern void ux500_cpu_die(unsigned int cpu);
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
-index 4045c49..4e26c79 100644
+index 4045c49..0263c07 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -425,7 +425,7 @@ config CPU_32v5
@@ -3461,7 +3471,7 @@ index 4045c49..4e26c79 100644
config CPU_32v6
bool
- select CPU_USE_DOMAINS if CPU_V6 && MMU
-+ select CPU_USE_DOMAINS if CPU_V6 && MMU && !PAX_KERNEXEC
++ select CPU_USE_DOMAINS if CPU_V6 && MMU && !PAX_KERNEXEC && !PAX_MEMORY_UDEREF
select TLS_REG_EMUL if !CPU_32v6K && !MMU
config CPU_32v6K
@@ -11545,7 +11555,7 @@ index cf1a471..3bc4cf8 100644
err |= copy_siginfo_to_user32(&frame->info, &ksig->info);
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
-index 474dc1b..be7bff5 100644
+index 474dc1b..24aaa3e 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -15,8 +15,10 @@
@@ -11583,11 +11593,11 @@ index 474dc1b..be7bff5 100644
+#endif
+ .endm
+
-+.macro pax_erase_kstack
++ .macro pax_erase_kstack
+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
+ call pax_erase_kstack
+#endif
-+.endm
++ .endm
+
/*
* 32bit SYSENTER instruction entry.
@@ -14091,6 +14101,18 @@ index c0fa356..07a498a 100644
void unregister_nmi_handler(unsigned int, const char *);
+diff --git a/arch/x86/include/asm/page.h b/arch/x86/include/asm/page.h
+index c878924..21f4889 100644
+--- a/arch/x86/include/asm/page.h
++++ b/arch/x86/include/asm/page.h
+@@ -52,6 +52,7 @@ static inline void copy_user_page(void *to, void *from, unsigned long vaddr,
+ __phys_addr_symbol(__phys_reloc_hide((unsigned long)(x)))
+
+ #define __va(x) ((void *)((unsigned long)(x)+PAGE_OFFSET))
++#define __early_va(x) ((void *)((unsigned long)(x)+__START_KERNEL_map - phys_base))
+
+ #define __boot_va(x) __va(x)
+ #define __boot_pa(x) __pa(x)
diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
index 0f1ddee..e2fc3d1 100644
--- a/arch/x86/include/asm/page_64.h
@@ -18228,7 +18250,7 @@ index 9b9f18b..9fcaa04 100644
#include <asm/processor.h>
#include <asm/fcntl.h>
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
-index 8f3e2de..934870f 100644
+index 8f3e2de..caecc4e 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -177,13 +177,153 @@
@@ -18326,11 +18348,11 @@ index 8f3e2de..934870f 100644
+ENDPROC(pax_exit_kernel)
+#endif
+
-+.macro pax_erase_kstack
++ .macro pax_erase_kstack
+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
+ call pax_erase_kstack
+#endif
-+.endm
++ .endm
+
+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
+/*
@@ -18988,7 +19010,7 @@ index 8f3e2de..934870f 100644
/*
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
-index c1d01e6..7f633850 100644
+index c1d01e6..a88cf02 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -59,6 +59,8 @@
@@ -19326,11 +19348,11 @@ index c1d01e6..7f633850 100644
+#endif
+ .endm
+
-+.macro pax_erase_kstack
++ .macro pax_erase_kstack
+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
+ call pax_erase_kstack
+#endif
-+.endm
++ .endm
+
+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
+ENTRY(pax_erase_kstack)
@@ -19900,9 +19922,12 @@ index c1d01e6..7f633850 100644
apicinterrupt HYPERVISOR_CALLBACK_VECTOR \
xen_hvm_callback_vector xen_evtchn_do_upcall
-@@ -1498,16 +1907,31 @@ ENTRY(paranoid_exit)
+@@ -1496,18 +1905,33 @@ ENTRY(paranoid_exit)
+ DEFAULT_FRAME
+ DISABLE_INTERRUPTS(CLBR_NONE)
TRACE_IRQS_OFF_DEBUG
- testl %ebx,%ebx /* swapgs needed? */
+- testl %ebx,%ebx /* swapgs needed? */
++ testl $1,%ebx /* swapgs needed? */
jnz paranoid_restore
- testl $3,CS(%rsp)
+ testb $3,CS(%rsp)
@@ -19966,6 +19991,15 @@ index c1d01e6..7f633850 100644
/* ebx: no swapgs flag (1: don't need swapgs, 0: need it) */
+@@ -1606,7 +2031,7 @@ ENTRY(error_exit)
+ DISABLE_INTERRUPTS(CLBR_NONE)
+ TRACE_IRQS_OFF
+ GET_THREAD_INFO(%rcx)
+- testl %eax,%eax
++ testl $1,%eax
+ jne retint_kernel
+ LOCKDEP_SYS_EXIT_IRQ
+ movl TI_flags(%rcx),%edx
@@ -1615,7 +2040,7 @@ ENTRY(error_exit)
jnz retint_careful
jmp retint_swapgs
@@ -20118,9 +20152,50 @@ index 42a392a..fbbd930 100644
return -EFAULT;
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
-index 8f3201d..aa860bf 100644
+index 8f3201d..6898c0c 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
+@@ -67,12 +67,12 @@ again:
+ pgd = *pgd_p;
+
+ /*
+- * The use of __START_KERNEL_map rather than __PAGE_OFFSET here is
+- * critical -- __PAGE_OFFSET would point us back into the dynamic
++ * The use of __early_va rather than __va here is critical:
++ * __va would point us back into the dynamic
+ * range and we might end up looping forever...
+ */
+ if (pgd)
+- pud_p = (pudval_t *)((pgd & PTE_PFN_MASK) + __START_KERNEL_map - phys_base);
++ pud_p = (pudval_t *)(__early_va(pgd & PTE_PFN_MASK));
+ else {
+ if (next_early_pgt >= EARLY_DYNAMIC_PAGE_TABLES) {
+ reset_early_page_tables();
+@@ -82,13 +82,13 @@ again:
+ pud_p = (pudval_t *)early_dynamic_pgts[next_early_pgt++];
+ for (i = 0; i < PTRS_PER_PUD; i++)
+ pud_p[i] = 0;
+- *pgd_p = (pgdval_t)pud_p - __START_KERNEL_map + phys_base + _KERNPG_TABLE;
++ *pgd_p = (pgdval_t)__pa(pud_p) + _KERNPG_TABLE;
+ }
+ pud_p += pud_index(address);
+ pud = *pud_p;
+
+ if (pud)
+- pmd_p = (pmdval_t *)((pud & PTE_PFN_MASK) + __START_KERNEL_map - phys_base);
++ pmd_p = (pmdval_t *)(__early_va(pud & PTE_PFN_MASK));
+ else {
+ if (next_early_pgt >= EARLY_DYNAMIC_PAGE_TABLES) {
+ reset_early_page_tables();
+@@ -98,7 +98,7 @@ again:
+ pmd_p = (pmdval_t *)early_dynamic_pgts[next_early_pgt++];
+ for (i = 0; i < PTRS_PER_PMD; i++)
+ pmd_p[i] = 0;
+- *pud_p = (pudval_t)pmd_p - __START_KERNEL_map + phys_base + _KERNPG_TABLE;
++ *pud_p = (pudval_t)__pa(pmd_p) + _KERNPG_TABLE;
+ }
+ pmd = (physaddr & PMD_MASK) + early_pmd_flags;
+ pmd_p[pmd_index(address)] = pmd;
@@ -175,7 +175,6 @@ void __init x86_64_start_kernel(char * real_mode_data)
if (console_loglevel == 10)
early_printk("Kernel alive\n");
@@ -20562,7 +20637,7 @@ index 73afd11..d1670f5 100644
+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
+ .endr
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
-index 321d65e..7830f05 100644
+index 321d65e..ad8817d 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -20,6 +20,8 @@
@@ -20587,23 +20662,34 @@ index 321d65e..7830f05 100644
.text
__HEAD
-@@ -89,11 +97,15 @@ startup_64:
+@@ -89,11 +97,23 @@ startup_64:
* Fixup the physical addresses in the page table
*/
addq %rbp, early_level4_pgt + (L4_START_KERNEL*8)(%rip)
++ addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
+ addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
+ addq %rbp, init_level4_pgt + (L4_VMALLOC_END*8)(%rip)
+ addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
++ addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
- addq %rbp, level3_kernel_pgt + (510*8)(%rip)
- addq %rbp, level3_kernel_pgt + (511*8)(%rip)
+- addq %rbp, level3_kernel_pgt + (510*8)(%rip)
+- addq %rbp, level3_kernel_pgt + (511*8)(%rip)
++ addq %rbp, level3_ident_pgt + (0*8)(%rip)
++#ifndef CONFIG_XEN
++ addq %rbp, level3_ident_pgt + (1*8)(%rip)
++#endif
- addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
+- addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
++ addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
++
++ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
++ addq %rbp, level3_kernel_pgt + ((L3_START_KERNEL+1)*8)(%rip)
++
+ addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
/*
* Set up the identity mapping for the switchover. These
-@@ -177,8 +189,8 @@ ENTRY(secondary_startup_64)
+@@ -177,8 +197,8 @@ ENTRY(secondary_startup_64)
movq $(init_level4_pgt - __START_KERNEL_map), %rax
1:
@@ -20614,7 +20700,7 @@ index 321d65e..7830f05 100644
movq %rcx, %cr4
/* Setup early boot stage 4 level pagetables. */
-@@ -199,10 +211,18 @@ ENTRY(secondary_startup_64)
+@@ -199,10 +219,18 @@ ENTRY(secondary_startup_64)
movl $MSR_EFER, %ecx
rdmsr
btsl $_EFER_SCE, %eax /* Enable System Call */
@@ -20634,7 +20720,7 @@ index 321d65e..7830f05 100644
1: wrmsr /* Make changes effective */
/* Setup cr0 */
-@@ -282,6 +302,7 @@ ENTRY(secondary_startup_64)
+@@ -282,6 +310,7 @@ ENTRY(secondary_startup_64)
* REX.W + FF /5 JMP m16:64 Jump far, absolute indirect,
* address given in m16:64.
*/
@@ -20642,7 +20728,7 @@ index 321d65e..7830f05 100644
movq initial_code(%rip),%rax
pushq $0 # fake return address to stop unwinder
pushq $__KERNEL_CS # set correct cs
-@@ -388,7 +409,7 @@ ENTRY(early_idt_handler)
+@@ -388,7 +417,7 @@ ENTRY(early_idt_handler)
call dump_stack
#ifdef CONFIG_KALLSYMS
leaq early_idt_ripmsg(%rip),%rdi
@@ -20651,7 +20737,7 @@ index 321d65e..7830f05 100644
call __print_symbol
#endif
#endif /* EARLY_PRINTK */
-@@ -416,6 +437,7 @@ ENDPROC(early_idt_handler)
+@@ -416,6 +445,7 @@ ENDPROC(early_idt_handler)
early_recursion_flag:
.long 0
@@ -20659,9 +20745,12 @@ index 321d65e..7830f05 100644
#ifdef CONFIG_EARLY_PRINTK
early_idt_msg:
.asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
-@@ -445,27 +467,50 @@ NEXT_PAGE(early_dynamic_pgts)
+@@ -443,29 +473,52 @@ NEXT_PAGE(early_level4_pgt)
+ NEXT_PAGE(early_dynamic_pgts)
+ .fill 512*EARLY_DYNAMIC_PAGE_TABLES,8,0
- .data
+- .data
++ .section .rodata,"a",@progbits
-#ifndef CONFIG_XEN
NEXT_PAGE(init_level4_pgt)
@@ -20718,7 +20807,7 @@ index 321d65e..7830f05 100644
NEXT_PAGE(level3_kernel_pgt)
.fill L3_START_KERNEL,8,0
-@@ -473,6 +518,9 @@ NEXT_PAGE(level3_kernel_pgt)
+@@ -473,6 +526,9 @@ NEXT_PAGE(level3_kernel_pgt)
.quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
.quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
@@ -20728,7 +20817,7 @@ index 321d65e..7830f05 100644
NEXT_PAGE(level2_kernel_pgt)
/*
* 512 MB kernel mapping. We spend a full page on this pagetable
-@@ -488,39 +536,64 @@ NEXT_PAGE(level2_kernel_pgt)
+@@ -488,39 +544,64 @@ NEXT_PAGE(level2_kernel_pgt)
KERNEL_IMAGE_SIZE/PMD_SIZE)
NEXT_PAGE(level2_fixmap_pgt)
@@ -28081,7 +28170,7 @@ index ae1aa71..d9bea75 100644
#endif /*HAVE_ARCH_HUGETLB_UNMAPPED_AREA*/
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index 0c13708..689fe7f 100644
+index 0c13708..ca05f23 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -4,6 +4,7 @@
@@ -28101,7 +28190,23 @@ index 0c13708..689fe7f 100644
#include "mm_internal.h"
-@@ -464,10 +467,40 @@ void __init init_mem_mapping(void)
+@@ -448,7 +451,15 @@ void __init init_mem_mapping(void)
+ early_ioremap_page_table_range_init();
+ #endif
+
++#ifdef CONFIG_PAX_PER_CPU_PGD
++ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
++ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++ KERNEL_PGD_PTRS);
++ load_cr3(get_cpu_pgd(0));
++#else
+ load_cr3(swapper_pg_dir);
++#endif
++
+ __flush_tlb_all();
+
+ early_memtest(0, max_pfn_mapped << PAGE_SHIFT);
+@@ -464,10 +475,40 @@ void __init init_mem_mapping(void)
* Access has to be given to non-kernel-ram areas as well, these contain the PCI
* mmio resources as well as potential bios/acpi data regions.
*/
@@ -28143,7 +28248,7 @@ index 0c13708..689fe7f 100644
if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
return 0;
if (!page_is_ram(pagenr))
-@@ -524,8 +557,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
+@@ -524,8 +565,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
#endif
}
@@ -28262,7 +28367,7 @@ index 0c13708..689fe7f 100644
(unsigned long)(&__init_begin),
(unsigned long)(&__init_end));
diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
-index 2d19001..6a1046c 100644
+index 2d19001..e549d98 100644
--- a/arch/x86/mm/init_32.c
+++ b/arch/x86/mm/init_32.c
@@ -62,33 +62,6 @@ static noinline int do_test_wp_bit(void);
@@ -28476,20 +28581,7 @@ index 2d19001..6a1046c 100644
EXPORT_SYMBOL_GPL(__supported_pte_mask);
/* user-defined highmem size */
-@@ -752,6 +754,12 @@ void __init mem_init(void)
-
- pci_iommu_alloc();
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
-+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ KERNEL_PGD_PTRS);
-+#endif
-+
- #ifdef CONFIG_FLATMEM
- BUG_ON(!mem_map);
- #endif
-@@ -780,7 +788,7 @@ void __init mem_init(void)
+@@ -780,7 +782,7 @@ void __init mem_init(void)
after_bootmem = 1;
codesize = (unsigned long) &_etext - (unsigned long) &_text;
@@ -28498,7 +28590,7 @@ index 2d19001..6a1046c 100644
initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
-@@ -821,10 +829,10 @@ void __init mem_init(void)
+@@ -821,10 +823,10 @@ void __init mem_init(void)
((unsigned long)&__init_end -
(unsigned long)&__init_begin) >> 10,
@@ -28512,7 +28604,7 @@ index 2d19001..6a1046c 100644
((unsigned long)&_etext - (unsigned long)&_text) >> 10);
/*
-@@ -914,6 +922,7 @@ void set_kernel_text_rw(void)
+@@ -914,6 +916,7 @@ void set_kernel_text_rw(void)
if (!kernel_set_to_readonly)
return;
@@ -28520,7 +28612,7 @@ index 2d19001..6a1046c 100644
pr_debug("Set kernel text: %lx - %lx for read write\n",
start, start+size);
-@@ -928,6 +937,7 @@ void set_kernel_text_ro(void)
+@@ -928,6 +931,7 @@ void set_kernel_text_ro(void)
if (!kernel_set_to_readonly)
return;
@@ -28528,7 +28620,7 @@ index 2d19001..6a1046c 100644
pr_debug("Set kernel text: %lx - %lx for read only\n",
start, start+size);
-@@ -956,6 +966,7 @@ void mark_rodata_ro(void)
+@@ -956,6 +960,7 @@ void mark_rodata_ro(void)
unsigned long start = PFN_ALIGN(_text);
unsigned long size = PFN_ALIGN(_etext) - start;
@@ -28537,7 +28629,7 @@ index 2d19001..6a1046c 100644
printk(KERN_INFO "Write protecting the kernel text: %luk\n",
size >> 10);
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
-index 474e28f..647dd12 100644
+index 474e28f..f016b6e 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -150,7 +150,7 @@ early_param("gbpages", parse_direct_gbpages_on);
@@ -28654,20 +28746,7 @@ index 474e28f..647dd12 100644
spin_unlock(&init_mm.page_table_lock);
pgd_changed = true;
}
-@@ -1065,6 +1079,12 @@ void __init mem_init(void)
-
- pci_iommu_alloc();
-
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
-+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+ KERNEL_PGD_PTRS);
-+#endif
-+
- /* clear_bss() already clear the empty_zero_page */
-
- reservedpages = 0;
-@@ -1224,8 +1244,8 @@ int kern_addr_valid(unsigned long addr)
+@@ -1224,8 +1238,8 @@ int kern_addr_valid(unsigned long addr)
static struct vm_area_struct gate_vma = {
.vm_start = VSYSCALL_START,
.vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
@@ -28678,7 +28757,7 @@ index 474e28f..647dd12 100644
};
struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
-@@ -1259,7 +1279,7 @@ int in_gate_area_no_mm(unsigned long addr)
+@@ -1259,7 +1273,7 @@ int in_gate_area_no_mm(unsigned long addr)
const char *arch_vma_name(struct vm_area_struct *vma)
{
@@ -30390,7 +30469,7 @@ index c77b24a..c979855 100644
}
EXPORT_SYMBOL(pcibios_set_irq_routing);
diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
-index 40e4469..1ab536e 100644
+index 40e4469..0592924 100644
--- a/arch/x86/platform/efi/efi_32.c
+++ b/arch/x86/platform/efi/efi_32.c
@@ -44,11 +44,22 @@ void efi_call_phys_prelog(void)
@@ -30416,7 +30495,7 @@ index 40e4469..1ab536e 100644
gdt_descr.address = __pa(get_cpu_gdt_table(0));
gdt_descr.size = GDT_SIZE - 1;
load_gdt(&gdt_descr);
-@@ -58,6 +69,14 @@ void efi_call_phys_epilog(void)
+@@ -58,11 +69,24 @@ void efi_call_phys_epilog(void)
{
struct desc_ptr gdt_descr;
@@ -30431,6 +30510,44 @@ index 40e4469..1ab536e 100644
gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
gdt_descr.size = GDT_SIZE - 1;
load_gdt(&gdt_descr);
+
++#ifdef CONFIG_PAX_PER_CPU_PGD
++ load_cr3(get_cpu_pgd(smp_processor_id()));
++#else
+ load_cr3(swapper_pg_dir);
++#endif
++
+ __flush_tlb_all();
+
+ local_irq_restore(efi_rt_eflags);
+diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
+index 2b20038..eaf558f 100644
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -75,6 +75,11 @@ void __init efi_call_phys_prelog(void)
+ vaddress = (unsigned long)__va(pgd * PGDIR_SIZE);
+ set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), *pgd_offset_k(vaddress));
+ }
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++ load_cr3(swapper_pg_dir);
++#endif
++
+ __flush_tlb_all();
+ }
+
+@@ -88,6 +93,11 @@ void __init efi_call_phys_epilog(void)
+ for (pgd = 0; pgd < n_pgds; pgd++)
+ set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), save_pgd[pgd]);
+ kfree(save_pgd);
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++ load_cr3(get_cpu_pgd(smp_processor_id()));
++#endif
++
+ __flush_tlb_all();
+ local_irq_restore(efi_flags);
+ early_code_mapping_set_exec(0);
diff --git a/arch/x86/platform/efi/efi_stub_32.S b/arch/x86/platform/efi/efi_stub_32.S
index fbe66e6..eae5e38 100644
--- a/arch/x86/platform/efi/efi_stub_32.S
@@ -31988,7 +32105,7 @@ index 34c8216..f56c828 100644
unsigned long timeout_msec)
{
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index cf15aee..e0b7078 100644
+index 8038ee3..a19a6e6 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4792,7 +4792,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
@@ -37624,10 +37741,10 @@ index b972d43..8943713 100644
/**
diff --git a/drivers/iommu/irq_remapping.c b/drivers/iommu/irq_remapping.c
-index 7c11ff3..a2a0457 100644
+index dcfea4e..f4226b2 100644
--- a/drivers/iommu/irq_remapping.c
+++ b/drivers/iommu/irq_remapping.c
-@@ -348,7 +348,7 @@ int setup_hpet_msi_remapped(unsigned int irq, unsigned int id)
+@@ -354,7 +354,7 @@ int setup_hpet_msi_remapped(unsigned int irq, unsigned int id)
void panic_if_irq_remap(const char *msg)
{
if (irq_remapping_enabled)
@@ -37636,7 +37753,7 @@ index 7c11ff3..a2a0457 100644
}
static void ir_ack_apic_edge(struct irq_data *data)
-@@ -369,10 +369,12 @@ static void ir_print_prefix(struct irq_data *data, struct seq_file *p)
+@@ -375,10 +375,12 @@ static void ir_print_prefix(struct irq_data *data, struct seq_file *p)
void irq_remap_modify_chip_defaults(struct irq_chip *chip)
{
@@ -40388,62 +40505,6 @@ index a4fe5f1..6c9e77f 100644
.kind = "vxlan",
.maxtype = IFLA_VXLAN_MAX,
.policy = vxlan_policy,
-diff --git a/drivers/net/wan/dlci.c b/drivers/net/wan/dlci.c
-index 147614e..6a8a382 100644
---- a/drivers/net/wan/dlci.c
-+++ b/drivers/net/wan/dlci.c
-@@ -384,21 +384,37 @@ static int dlci_del(struct dlci_add *dlci)
- struct frad_local *flp;
- struct net_device *master, *slave;
- int err;
-+ bool found = false;
-+
-+ rtnl_lock();
-
- /* validate slave device */
- master = __dev_get_by_name(&init_net, dlci->devname);
-- if (!master)
-- return -ENODEV;
-+ if (!master) {
-+ err = -ENODEV;
-+ goto out;
-+ }
-+
-+ list_for_each_entry(dlp, &dlci_devs, list) {
-+ if (dlp->master == master) {
-+ found = true;
-+ break;
-+ }
-+ }
-+ if (!found) {
-+ err = -ENODEV;
-+ goto out;
-+ }
-
- if (netif_running(master)) {
-- return -EBUSY;
-+ err = -EBUSY;
-+ goto out;
- }
-
- dlp = netdev_priv(master);
- slave = dlp->slave;
- flp = netdev_priv(slave);
-
-- rtnl_lock();
- err = (*flp->deassoc)(slave, master);
- if (!err) {
- list_del(&dlp->list);
-@@ -407,8 +423,8 @@ static int dlci_del(struct dlci_add *dlci)
-
- dev_put(slave);
- }
-+out:
- rtnl_unlock();
--
- return err;
- }
-
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 5ac5f7a..5f82012 100644
--- a/drivers/net/wireless/at76c50x-usb.c
@@ -50560,7 +50621,7 @@ index 6a16053..2155147 100644
return rc;
}
diff --git a/fs/exec.c b/fs/exec.c
-index 6d56ff2..f65b4ca 100644
+index 0d5c76f..3d4585e 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -55,8 +55,20 @@
@@ -50584,7 +50645,7 @@ index 6d56ff2..f65b4ca 100644
#include <asm/mmu_context.h>
#include <asm/tlb.h>
-@@ -66,6 +78,18 @@
+@@ -66,17 +78,32 @@
#include <trace/events/sched.h>
@@ -50603,7 +50664,12 @@ index 6d56ff2..f65b4ca 100644
int suid_dumpable = 0;
static LIST_HEAD(formats);
-@@ -75,8 +99,8 @@ void __register_binfmt(struct linux_binfmt * fmt, int insert)
+ static DEFINE_RWLOCK(binfmt_lock);
+
++extern int gr_process_kernel_exec_ban(void);
++extern int gr_process_suid_exec_ban(const struct linux_binprm *bprm);
++
+ void __register_binfmt(struct linux_binfmt * fmt, int insert)
{
BUG_ON(!fmt);
write_lock(&binfmt_lock);
@@ -50614,7 +50680,7 @@ index 6d56ff2..f65b4ca 100644
write_unlock(&binfmt_lock);
}
-@@ -85,7 +109,7 @@ EXPORT_SYMBOL(__register_binfmt);
+@@ -85,7 +112,7 @@ EXPORT_SYMBOL(__register_binfmt);
void unregister_binfmt(struct linux_binfmt * fmt)
{
write_lock(&binfmt_lock);
@@ -50623,7 +50689,7 @@ index 6d56ff2..f65b4ca 100644
write_unlock(&binfmt_lock);
}
-@@ -180,18 +204,10 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+@@ -180,18 +207,10 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
int write)
{
struct page *page;
@@ -50645,7 +50711,7 @@ index 6d56ff2..f65b4ca 100644
return NULL;
if (write) {
-@@ -207,6 +223,17 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+@@ -207,6 +226,17 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
if (size <= ARG_MAX)
return page;
@@ -50663,7 +50729,7 @@ index 6d56ff2..f65b4ca 100644
/*
* Limit to 1/4-th the stack size for the argv+env strings.
* This ensures that:
-@@ -266,6 +293,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
+@@ -266,6 +296,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
vma->vm_end = STACK_TOP_MAX;
vma->vm_start = vma->vm_end - PAGE_SIZE;
vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
@@ -50675,7 +50741,7 @@ index 6d56ff2..f65b4ca 100644
vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
INIT_LIST_HEAD(&vma->anon_vma_chain);
-@@ -276,6 +308,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
+@@ -276,6 +311,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
mm->stack_vm = mm->total_vm = 1;
up_write(&mm->mmap_sem);
bprm->p = vma->vm_end - sizeof(void *);
@@ -50688,7 +50754,7 @@ index 6d56ff2..f65b4ca 100644
return 0;
err:
up_write(&mm->mmap_sem);
-@@ -396,7 +434,7 @@ struct user_arg_ptr {
+@@ -396,7 +437,7 @@ struct user_arg_ptr {
} ptr;
};
@@ -50697,7 +50763,7 @@ index 6d56ff2..f65b4ca 100644
{
const char __user *native;
-@@ -405,14 +443,14 @@ static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
+@@ -405,14 +446,14 @@ static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
compat_uptr_t compat;
if (get_user(compat, argv.ptr.compat + nr))
@@ -50714,7 +50780,7 @@ index 6d56ff2..f65b4ca 100644
return native;
}
-@@ -431,7 +469,7 @@ static int count(struct user_arg_ptr argv, int max)
+@@ -431,7 +472,7 @@ static int count(struct user_arg_ptr argv, int max)
if (!p)
break;
@@ -50723,7 +50789,7 @@ index 6d56ff2..f65b4ca 100644
return -EFAULT;
if (i >= max)
-@@ -466,7 +504,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
+@@ -466,7 +507,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
ret = -EFAULT;
str = get_user_arg_ptr(argv, argc);
@@ -50732,7 +50798,7 @@ index 6d56ff2..f65b4ca 100644
goto out;
len = strnlen_user(str, MAX_ARG_STRLEN);
-@@ -548,7 +586,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
+@@ -548,7 +589,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
int r;
mm_segment_t oldfs = get_fs();
struct user_arg_ptr argv = {
@@ -50741,7 +50807,7 @@ index 6d56ff2..f65b4ca 100644
};
set_fs(KERNEL_DS);
-@@ -583,7 +621,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+@@ -583,7 +624,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
unsigned long new_end = old_end - shift;
struct mmu_gather tlb;
@@ -50751,7 +50817,7 @@ index 6d56ff2..f65b4ca 100644
/*
* ensure there are no vmas between where we want to go
-@@ -592,6 +631,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+@@ -592,6 +634,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
if (vma != find_vma(mm, new_start))
return -EFAULT;
@@ -50762,7 +50828,7 @@ index 6d56ff2..f65b4ca 100644
/*
* cover the whole range: [new_start, old_end)
*/
-@@ -672,10 +715,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -672,10 +718,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
stack_top = arch_align_stack(stack_top);
stack_top = PAGE_ALIGN(stack_top);
@@ -50773,7 +50839,7 @@ index 6d56ff2..f65b4ca 100644
stack_shift = vma->vm_end - stack_top;
bprm->p -= stack_shift;
-@@ -687,8 +726,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -687,8 +729,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
bprm->exec -= stack_shift;
down_write(&mm->mmap_sem);
@@ -50802,7 +50868,7 @@ index 6d56ff2..f65b4ca 100644
/*
* Adjust stack execute permissions; explicitly enable for
* EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
-@@ -707,13 +766,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -707,13 +769,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
goto out_unlock;
BUG_ON(prev != vma);
@@ -50816,7 +50882,7 @@ index 6d56ff2..f65b4ca 100644
/* mprotect_fixup is overkill to remove the temporary stack flags */
vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
-@@ -737,6 +789,27 @@ int setup_arg_pages(struct linux_binprm *bprm,
+@@ -737,6 +792,27 @@ int setup_arg_pages(struct linux_binprm *bprm,
#endif
current->mm->start_stack = bprm->p;
ret = expand_stack(vma, stack_base);
@@ -50844,7 +50910,7 @@ index 6d56ff2..f65b4ca 100644
if (ret)
ret = -EFAULT;
-@@ -772,6 +845,8 @@ struct file *open_exec(const char *name)
+@@ -772,6 +848,8 @@ struct file *open_exec(const char *name)
fsnotify_open(file);
@@ -50853,7 +50919,7 @@ index 6d56ff2..f65b4ca 100644
err = deny_write_access(file);
if (err)
goto exit;
-@@ -795,7 +870,7 @@ int kernel_read(struct file *file, loff_t offset,
+@@ -795,7 +873,7 @@ int kernel_read(struct file *file, loff_t offset,
old_fs = get_fs();
set_fs(get_ds());
/* The cast to a user pointer is valid due to the set_fs() */
@@ -50862,37 +50928,7 @@ index 6d56ff2..f65b4ca 100644
set_fs(old_fs);
return result;
}
-@@ -1136,13 +1211,6 @@ void setup_new_exec(struct linux_binprm * bprm)
- set_dumpable(current->mm, suid_dumpable);
- }
-
-- /*
-- * Flush performance counters when crossing a
-- * security domain:
-- */
-- if (!get_dumpable(current->mm))
-- perf_event_exit_task(current);
--
- /* An exec changes our domain. We are no longer part of the thread
- group */
-
-@@ -1206,6 +1274,15 @@ void install_exec_creds(struct linux_binprm *bprm)
-
- commit_creds(bprm->cred);
- bprm->cred = NULL;
-+
-+ /*
-+ * Disable monitoring for regular users
-+ * when executing setuid binaries. Must
-+ * wait until new credentials are committed
-+ * by commit_creds() above
-+ */
-+ if (get_dumpable(current->mm) != SUID_DUMP_USER)
-+ perf_event_exit_task(current);
- /*
- * cred_guard_mutex must be held at least to this point to prevent
- * ptrace_attach() from altering our determination of the task's
-@@ -1250,7 +1327,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
+@@ -1252,7 +1330,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
}
rcu_read_unlock();
@@ -50901,7 +50937,7 @@ index 6d56ff2..f65b4ca 100644
bprm->unsafe |= LSM_UNSAFE_SHARE;
} else {
res = -EAGAIN;
-@@ -1450,6 +1527,31 @@ int search_binary_handler(struct linux_binprm *bprm)
+@@ -1452,6 +1530,31 @@ int search_binary_handler(struct linux_binprm *bprm)
EXPORT_SYMBOL(search_binary_handler);
@@ -50933,7 +50969,7 @@ index 6d56ff2..f65b4ca 100644
/*
* sys_execve() executes a new program.
*/
-@@ -1457,6 +1559,11 @@ static int do_execve_common(const char *filename,
+@@ -1459,6 +1562,11 @@ static int do_execve_common(const char *filename,
struct user_arg_ptr argv,
struct user_arg_ptr envp)
{
@@ -50945,7 +50981,7 @@ index 6d56ff2..f65b4ca 100644
struct linux_binprm *bprm;
struct file *file;
struct files_struct *displaced;
-@@ -1464,6 +1571,8 @@ static int do_execve_common(const char *filename,
+@@ -1466,6 +1574,8 @@ static int do_execve_common(const char *filename,
int retval;
const struct cred *cred = current_cred();
@@ -50954,7 +50990,7 @@ index 6d56ff2..f65b4ca 100644
/*
* We move the actual failure in case of RLIMIT_NPROC excess from
* set*uid() to execve() because too many poorly written programs
-@@ -1504,12 +1613,27 @@ static int do_execve_common(const char *filename,
+@@ -1506,12 +1616,22 @@ static int do_execve_common(const char *filename,
if (IS_ERR(file))
goto out_unmark;
@@ -50969,11 +51005,6 @@ index 6d56ff2..f65b4ca 100644
bprm->filename = filename;
bprm->interp = filename;
-+ if (gr_process_user_ban()) {
-+ retval = -EPERM;
-+ goto out_file;
-+ }
-+
+ if (!gr_acl_handle_execve(file->f_path.dentry, file->f_path.mnt)) {
+ retval = -EACCES;
+ goto out_file;
@@ -50982,7 +51013,7 @@ index 6d56ff2..f65b4ca 100644
retval = bprm_mm_init(bprm);
if (retval)
goto out_file;
-@@ -1526,24 +1650,65 @@ static int do_execve_common(const char *filename,
+@@ -1528,24 +1648,70 @@ static int do_execve_common(const char *filename,
if (retval < 0)
goto out;
@@ -51002,6 +51033,11 @@ index 6d56ff2..f65b4ca 100644
+ current->signal->rlim[RLIMIT_STACK].rlim_cur = 8 * 1024 * 1024;
+#endif
+
++ if (gr_process_kernel_exec_ban() || gr_process_suid_exec_ban(bprm)) {
++ retval = -EPERM;
++ goto out_fail;
++ }
++
+ if (!gr_tpe_allow(file)) {
+ retval = -EACCES;
+ goto out_fail;
@@ -51052,7 +51088,7 @@ index 6d56ff2..f65b4ca 100644
current->fs->in_exec = 0;
current->in_execve = 0;
acct_update_integrals(current);
-@@ -1552,6 +1717,14 @@ static int do_execve_common(const char *filename,
+@@ -1554,6 +1720,14 @@ static int do_execve_common(const char *filename,
put_files_struct(displaced);
return retval;
@@ -51067,7 +51103,7 @@ index 6d56ff2..f65b4ca 100644
out:
if (bprm->mm) {
acct_arg_size(bprm, 0);
-@@ -1700,3 +1873,283 @@ asmlinkage long compat_sys_execve(const char __user * filename,
+@@ -1702,3 +1876,283 @@ asmlinkage long compat_sys_execve(const char __user * filename,
return error;
}
#endif
@@ -56788,67 +56824,6 @@ index 69d4889..a810bd4 100644
{
if (sbi->s_bytesex == BYTESEX_PDP)
return PDP_swab((__force __u32)n);
-diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
-index de08c92f..732cd63 100644
---- a/fs/ubifs/dir.c
-+++ b/fs/ubifs/dir.c
-@@ -364,6 +364,24 @@ static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
- */
- return 0;
-
-+ if (file->f_version == 0) {
-+ /*
-+ * The file was seek'ed, which means that @file->private_data
-+ * is now invalid. This may also be just the first
-+ * 'ubifs_readdir()' invocation, in which case
-+ * @file->private_data is NULL, and the below code is
-+ * basically a no-op.
-+ */
-+ kfree(file->private_data);
-+ file->private_data = NULL;
-+ }
-+
-+ /*
-+ * 'generic_file_llseek()' unconditionally sets @file->f_version to
-+ * zero, and we use this for detecting whether the file was seek'ed.
-+ */
-+ file->f_version = 1;
-+
- /* File positions 0 and 1 correspond to "." and ".." */
- if (file->f_pos == 0) {
- ubifs_assert(!file->private_data);
-@@ -438,6 +456,14 @@ static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
- file->f_pos = key_hash_flash(c, &dent->key);
- file->private_data = dent;
- cond_resched();
-+
-+ if (file->f_version == 0)
-+ /*
-+ * The file was seek'ed meanwhile, lets return and start
-+ * reading direntries from the new position on the next
-+ * invocation.
-+ */
-+ return 0;
- }
-
- out:
-@@ -448,15 +474,13 @@ out:
-
- kfree(file->private_data);
- file->private_data = NULL;
-+ /* 2 is a special value indicating that there are no more direntries */
- file->f_pos = 2;
- return 0;
- }
-
--/* If a directory is seeked, we have to free saved readdir() state */
- static loff_t ubifs_dir_llseek(struct file *file, loff_t offset, int whence)
- {
-- kfree(file->private_data);
-- file->private_data = NULL;
- return generic_file_llseek(file, offset, whence);
- }
-
diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
index e18b988..f1d4ad0f 100644
--- a/fs/ubifs/io.c
@@ -57091,10 +57066,10 @@ index ca9ecaa..60100c7 100644
kfree(s);
diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
new file mode 100644
-index 0000000..4fb1dde
+index 0000000..c9c4ac3
--- /dev/null
+++ b/grsecurity/Kconfig
-@@ -0,0 +1,1053 @@
+@@ -0,0 +1,1054 @@
+#
+# grecurity configuration
+#
@@ -57251,8 +57226,9 @@ index 0000000..4fb1dde
+ fork until the administrator is able to assess the situation and
+ restart the daemon.
+ In the suid/sgid case, the attempt is logged, the user has all their
-+ processes terminated, and they are prevented from executing any further
-+ processes for 15 minutes.
++ existing instances of the suid/sgid binary terminated and will
++ be unable to execute any suid/sgid binaries for 15 minutes.
++
+ It is recommended that you also enable signal logging in the auditing
+ section so that logs are generated when a process triggers a suspicious
+ signal.
@@ -58194,7 +58170,7 @@ index 0000000..1b9afa9
+endif
diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
new file mode 100644
-index 0000000..1248ee0
+index 0000000..0d5c602
--- /dev/null
+++ b/grsecurity/gracl.c
@@ -0,0 +1,4073 @@
@@ -60545,7 +60521,7 @@ index 0000000..1248ee0
+ return;
+}
+
-+extern int __gr_process_user_ban(struct user_struct *user);
++extern int gr_process_kernel_setuid_ban(struct user_struct *user);
+
+int
+gr_check_user_change(kuid_t real, kuid_t effective, kuid_t fs)
@@ -60559,7 +60535,7 @@ index 0000000..1248ee0
+ int fsok = 0;
+ uid_t globalreal, globaleffective, globalfs;
+
-+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
++#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT)
+ struct user_struct *user;
+
+ if (!uid_valid(real))
@@ -60573,7 +60549,7 @@ index 0000000..1248ee0
+ if (user == NULL)
+ goto skipit;
+
-+ if (__gr_process_user_ban(user)) {
++ if (gr_process_kernel_setuid_ban(user)) {
+ /* for find_user */
+ free_uid(user);
+ return 1;
@@ -63617,7 +63593,7 @@ index 0000000..39645c9
+}
diff --git a/grsecurity/gracl_segv.c b/grsecurity/gracl_segv.c
new file mode 100644
-index 0000000..4dcc92a
+index 0000000..3c38bfe
--- /dev/null
+++ b/grsecurity/gracl_segv.c
@@ -0,0 +1,305 @@
@@ -63859,7 +63835,7 @@ index 0000000..4dcc92a
+ if (likely(tsk != task)) {
+ // if this thread has the same subject as the one that triggered
+ // RES_CRASH and it's the same binary, kill it
-+ if (tsk->acl == task->acl && tsk->exec_file == task->exec_file)
++ if (tsk->acl == task->acl && gr_is_same_file(tsk->exec_file, task->exec_file))
+ gr_fake_force_sig(SIGKILL, tsk);
+ }
+ } while_each_thread(tsk2, tsk);
@@ -65944,12 +65920,13 @@ index 0000000..f7f29aa
+}
diff --git a/grsecurity/grsec_sig.c b/grsecurity/grsec_sig.c
new file mode 100644
-index 0000000..e09715a
+index 0000000..4e29cc7
--- /dev/null
+++ b/grsecurity/grsec_sig.c
-@@ -0,0 +1,222 @@
+@@ -0,0 +1,246 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
++#include <linux/fs.h>
+#include <linux/delay.h>
+#include <linux/grsecurity.h>
+#include <linux/grinternal.h>
@@ -66049,7 +66026,7 @@ index 0000000..e09715a
+ rcu_read_lock();
+ read_lock(&tasklist_lock);
+ read_lock(&grsec_exec_file_lock);
-+ if (p->real_parent && p->real_parent->exec_file == p->exec_file) {
++ if (p->real_parent && gr_is_same_file(p->real_parent->exec_file, p->exec_file)) {
+ p->real_parent->brute_expires = get_seconds() + GR_DAEMON_BRUTE_TIME;
+ p->real_parent->brute = 1;
+ daemon = 1;
@@ -66066,14 +66043,15 @@ index 0000000..e09715a
+ user = find_user(uid);
+ if (user == NULL)
+ goto unlock;
-+ user->banned = 1;
-+ user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
-+ if (user->ban_expires == ~0UL)
-+ user->ban_expires--;
++ user->suid_banned = 1;
++ user->suid_ban_expires = get_seconds() + GR_USER_BAN_TIME;
++ if (user->suid_ban_expires == ~0UL)
++ user->suid_ban_expires--;
+
++ /* only kill other threads of the same binary, from the same user */
+ do_each_thread(tsk2, tsk) {
+ cred2 = __task_cred(tsk);
-+ if (tsk != p && uid_eq(cred2->uid, uid))
++ if (tsk != p && uid_eq(cred2->uid, uid) && gr_is_same_file(tsk->exec_file, p->exec_file))
+ gr_fake_force_sig(SIGKILL, tsk);
+ } while_each_thread(tsk2, tsk);
+ }
@@ -66084,8 +66062,7 @@ index 0000000..e09715a
+ rcu_read_unlock();
+
+ if (gr_is_global_nonroot(uid))
-+ printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n",
-+ GR_GLOBAL_UID(uid), GR_USER_BAN_TIME / 60);
++ gr_log_fs_int2(GR_DONT_AUDIT, GR_BRUTE_SUID_MSG, p->exec_file->f_path.dentry, p->exec_file->f_path.mnt, GR_GLOBAL_UID(uid), GR_USER_BAN_TIME / 60);
+ else if (daemon)
+ gr_log_noargs(GR_DONT_AUDIT, GR_BRUTE_DAEMON_MSG);
+
@@ -66132,11 +66109,10 @@ index 0000000..e09715a
+ GR_GLOBAL_UID(uid));
+ /* we intentionally leak this ref */
+ user = get_uid(current->cred->user);
-+ if (user) {
-+ user->banned = 1;
-+ user->ban_expires = ~0UL;
-+ }
++ if (user)
++ user->kernel_banned = 1;
+
++ /* kill all processes of this user */
+ read_lock(&tasklist_lock);
+ do_each_thread(tsk2, tsk) {
+ cred = __task_cred(tsk);
@@ -66148,25 +66124,49 @@ index 0000000..e09715a
+#endif
+}
+
-+int __gr_process_user_ban(struct user_struct *user)
++#ifdef CONFIG_GRKERNSEC_BRUTE
++static bool suid_ban_expired(struct user_struct *user)
+{
-+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
-+ if (unlikely(user->banned)) {
-+ if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
-+ user->banned = 0;
-+ user->ban_expires = 0;
-+ free_uid(user);
-+ } else
-+ return -EPERM;
++ if (user->suid_ban_expires != ~0UL && time_after_eq(get_seconds(), user->suid_ban_expires)) {
++ user->suid_banned = 0;
++ user->suid_ban_expires = 0;
++ free_uid(user);
++ return true;
+ }
++
++ return false;
++}
++#endif
++
++int gr_process_kernel_exec_ban(void)
++{
++#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
++ if (unlikely(current->cred->user->kernel_banned))
++ return -EPERM;
++#endif
++ return 0;
++}
++
++int gr_process_kernel_setuid_ban(struct user_struct *user)
++{
++#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
++ if (unlikely(user->kernel_banned))
++ gr_fake_force_sig(SIGKILL, current);
+#endif
+ return 0;
+}
+
-+int gr_process_user_ban(void)
++int gr_process_suid_exec_ban(const struct linux_binprm *bprm)
+{
-+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
-+ return __gr_process_user_ban(current->cred->user);
++#ifdef CONFIG_GRKERNSEC_BRUTE
++ struct user_struct *user = current->cred->user;
++ if (unlikely(user->suid_banned)) {
++ if (suid_ban_expired(user))
++ return 0;
++ /* disallow execution of suid binaries only */
++ else if (!uid_eq(bprm->cred->euid, current->cred->uid))
++ return -EPERM;
++ }
+#endif
+ return 0;
+}
@@ -69201,10 +69201,10 @@ index 0000000..be66033
+#endif
diff --git a/include/linux/grinternal.h b/include/linux/grinternal.h
new file mode 100644
-index 0000000..5402bce
+index 0000000..12994b5
--- /dev/null
+++ b/include/linux/grinternal.h
-@@ -0,0 +1,215 @@
+@@ -0,0 +1,227 @@
+#ifndef __GRINTERNAL_H
+#define __GRINTERNAL_H
+
@@ -69318,6 +69318,18 @@ index 0000000..5402bce
+
+#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
+
++static inline bool gr_is_same_file(const struct file *file1, const struct file *file2)
++{
++ if (file1 && file2) {
++ const struct inode *inode1 = file1->f_path.dentry->d_inode;
++ const struct inode *inode2 = file2->f_path.dentry->d_inode;
++ if (inode1->i_ino == inode2->i_ino && inode1->i_sb->s_dev == inode2->i_sb->s_dev)
++ return true;
++ }
++
++ return false;
++}
++
+#define GR_CHROOT_CAPS {{ \
+ CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
+ CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
@@ -69422,10 +69434,10 @@ index 0000000..5402bce
+#endif
diff --git a/include/linux/grmsg.h b/include/linux/grmsg.h
new file mode 100644
-index 0000000..2bd4c8d
+index 0000000..2f159b5
--- /dev/null
+++ b/include/linux/grmsg.h
-@@ -0,0 +1,111 @@
+@@ -0,0 +1,112 @@
+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
@@ -69537,12 +69549,13 @@ index 0000000..2bd4c8d
+#define GR_BADPROCPID_MSG "denied read of sensitive /proc/pid/%s entry via fd passed across exec by "
+#define GR_SYMLINKOWNER_MSG "denied following symlink %.950s since symlink owner %u does not match target owner %u, by "
+#define GR_BRUTE_DAEMON_MSG "bruteforce prevention initiated for the next 30 minutes or until service restarted, stalling each fork 30 seconds. Please investigate the crash report for "
++#define GR_BRUTE_SUID_MSG "bruteforce prevention initiated due to crash of %.950s against uid %u, banning suid/sgid execs for %u minutes. Please investigate the crash report for "
diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
new file mode 100644
-index 0000000..d7ef0ac
+index 0000000..d957f6d
--- /dev/null
+++ b/include/linux/grsecurity.h
-@@ -0,0 +1,242 @@
+@@ -0,0 +1,241 @@
+#ifndef GR_SECURITY_H
+#define GR_SECURITY_H
+#include <linux/fs.h>
@@ -69567,7 +69580,6 @@ index 0000000..d7ef0ac
+void gr_handle_brute_attach(unsigned long mm_flags);
+void gr_handle_brute_check(void);
+void gr_handle_kernel_exploit(void);
-+int gr_process_user_ban(void);
+
+char gr_roletype_to_char(void);
+
@@ -71444,7 +71456,7 @@ index 6dacb93..6174423 100644
static inline void anon_vma_merge(struct vm_area_struct *vma,
struct vm_area_struct *next)
diff --git a/include/linux/sched.h b/include/linux/sched.h
-index be4e742..7f9d593 100644
+index be4e742..01f1387 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -62,6 +62,7 @@ struct bio_list;
@@ -71501,19 +71513,22 @@ index be4e742..7f9d593 100644
#ifdef CONFIG_AUDIT
unsigned audit_tty;
struct tty_audit_buf *tty_audit_buf;
-@@ -683,6 +707,11 @@ struct user_struct {
+@@ -683,6 +707,14 @@ struct user_struct {
struct key *session_keyring; /* UID's default session keyring */
#endif
-+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
-+ unsigned int banned;
-+ unsigned long ban_expires;
++#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
++ unsigned char kernel_banned;
++#endif
++#ifdef CONFIG_GRKERNSEC_BRUTE
++ unsigned char suid_banned;
++ unsigned long suid_ban_expires;
+#endif
+
/* Hash table maintenance information */
struct hlist_node uidhash_node;
kuid_t uid;
-@@ -1082,7 +1111,7 @@ struct sched_class {
+@@ -1082,7 +1114,7 @@ struct sched_class {
#ifdef CONFIG_FAIR_GROUP_SCHED
void (*task_move_group) (struct task_struct *p, int on_rq);
#endif
@@ -71522,7 +71537,7 @@ index be4e742..7f9d593 100644
struct load_weight {
unsigned long weight, inv_weight;
-@@ -1323,8 +1352,8 @@ struct task_struct {
+@@ -1323,8 +1355,8 @@ struct task_struct {
struct list_head thread_group;
struct completion *vfork_done; /* for vfork() */
@@ -71533,7 +71548,7 @@ index be4e742..7f9d593 100644
cputime_t utime, stime, utimescaled, stimescaled;
cputime_t gtime;
-@@ -1349,11 +1378,6 @@ struct task_struct {
+@@ -1349,11 +1381,6 @@ struct task_struct {
struct task_cputime cputime_expires;
struct list_head cpu_timers[3];
@@ -71545,7 +71560,7 @@ index be4e742..7f9d593 100644
char comm[TASK_COMM_LEN]; /* executable name excluding path
- access with [gs]et_task_comm (which lock
it with task_lock())
-@@ -1370,6 +1394,10 @@ struct task_struct {
+@@ -1370,6 +1397,10 @@ struct task_struct {
#endif
/* CPU-specific state of this task */
struct thread_struct thread;
@@ -71556,7 +71571,7 @@ index be4e742..7f9d593 100644
/* filesystem information */
struct fs_struct *fs;
/* open file information */
-@@ -1443,6 +1471,10 @@ struct task_struct {
+@@ -1443,6 +1474,10 @@ struct task_struct {
gfp_t lockdep_reclaim_gfp;
#endif
@@ -71567,7 +71582,7 @@ index be4e742..7f9d593 100644
/* journalling filesystem info */
void *journal_info;
-@@ -1481,6 +1513,10 @@ struct task_struct {
+@@ -1481,6 +1516,10 @@ struct task_struct {
/* cg_list protected by css_set_lock and tsk->alloc_lock */
struct list_head cg_list;
#endif
@@ -71578,7 +71593,7 @@ index be4e742..7f9d593 100644
#ifdef CONFIG_FUTEX
struct robust_list_head __user *robust_list;
#ifdef CONFIG_COMPAT
-@@ -1577,8 +1613,74 @@ struct task_struct {
+@@ -1577,8 +1616,74 @@ struct task_struct {
#ifdef CONFIG_UPROBES
struct uprobe_task *utask;
#endif
@@ -71653,7 +71668,7 @@ index be4e742..7f9d593 100644
/* Future-safe accessor for struct task_struct's cpus_allowed. */
#define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
-@@ -1637,7 +1739,7 @@ struct pid_namespace;
+@@ -1637,7 +1742,7 @@ struct pid_namespace;
pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
struct pid_namespace *ns);
@@ -71662,7 +71677,7 @@ index be4e742..7f9d593 100644
{
return tsk->pid;
}
-@@ -2073,7 +2175,9 @@ void yield(void);
+@@ -2073,7 +2178,9 @@ void yield(void);
extern struct exec_domain default_exec_domain;
union thread_union {
@@ -71672,7 +71687,7 @@ index be4e742..7f9d593 100644
unsigned long stack[THREAD_SIZE/sizeof(long)];
};
-@@ -2106,6 +2210,7 @@ extern struct pid_namespace init_pid_ns;
+@@ -2106,6 +2213,7 @@ extern struct pid_namespace init_pid_ns;
*/
extern struct task_struct *find_task_by_vpid(pid_t nr);
@@ -71680,7 +71695,7 @@ index be4e742..7f9d593 100644
extern struct task_struct *find_task_by_pid_ns(pid_t nr,
struct pid_namespace *ns);
-@@ -2272,7 +2377,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
+@@ -2272,7 +2380,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
extern void exit_itimers(struct signal_struct *);
extern void flush_itimer_signals(void);
@@ -71689,7 +71704,7 @@ index be4e742..7f9d593 100644
extern int allow_signal(int);
extern int disallow_signal(int);
-@@ -2463,9 +2568,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
+@@ -2463,9 +2571,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
#endif
@@ -82291,7 +82306,7 @@ index 79b7cf7..9944291 100644
capable(CAP_IPC_LOCK))
ret = do_mlockall(flags);
diff --git a/mm/mmap.c b/mm/mmap.c
-index 0dceed8..bfcaf45 100644
+index 0dceed8..a559c2e 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -33,6 +33,7 @@
@@ -82701,7 +82716,7 @@ index 0dceed8..bfcaf45 100644
+unsigned long gr_rand_threadstack_offset(const struct mm_struct *mm, const struct file *filp, unsigned long flags)
+{
+ if ((mm->pax_flags & MF_PAX_RANDMMAP) && !filp && (flags & MAP_STACK))
-+ return (random32() & 0xFF) << PAGE_SHIFT;
++ return ((random32() & 0xFF) + 1) << PAGE_SHIFT;
+
+ return 0;
+}
@@ -85978,20 +85993,10 @@ index 6a93614..1415549 100644
err = -EFAULT;
break;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
-index c5f9cd6..dfc8ec1 100644
+index 04b32e1..dfc8ec1 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
-@@ -2743,6 +2743,9 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
- BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
- conn, code, ident, dlen);
-
-+ if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
-+ return NULL;
-+
- len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
- count = min_t(unsigned int, conn->mtu, len);
-
-@@ -3395,8 +3398,10 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
+@@ -3398,8 +3398,10 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
break;
case L2CAP_CONF_RFC:
@@ -86004,15 +86009,6 @@ index c5f9cd6..dfc8ec1 100644
if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
rfc.mode != chan->mode)
-@@ -4221,7 +4226,7 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn,
- struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
- u16 type, result;
-
-- if (cmd_len != sizeof(*rsp))
-+ if (cmd_len < sizeof(*rsp))
- return -EPROTO;
-
- type = __le16_to_cpu(rsp->type);
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 1bcfb84..dad9f98 100644
--- a/net/bluetooth/l2cap_sock.c
@@ -88850,7 +88846,7 @@ index 843d8c4..cb04fa1 100644
if (local->use_chanctx)
*chandef = local->monitor_chandef;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index 5672533..6738c93 100644
+index 4e74cd6..963b8a1 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -28,6 +28,7 @@
@@ -89008,7 +89004,7 @@ index c97a065..ff61928 100644
return p;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
-index 0f38f43..e53d4a8 100644
+index 1f4b908..c4def45 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1388,7 +1388,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)