aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLeonardo Arena <rnalrd@alpinelinux.org>2014-08-26 09:18:12 +0000
committerLeonardo Arena <rnalrd@alpinelinux.org>2014-08-26 09:18:12 +0000
commitc3855e5a1aa63998254a53fc51c0633cbee02247 (patch)
tree5ccb4ce46962c7c5540242a8e307c786189fcd13
parent403fbc8816946b3ce689ac99dfed32640af650ff (diff)
downloadaports-c3855e5a1aa63998254a53fc51c0633cbee02247.tar.gz
aports-c3855e5a1aa63998254a53fc51c0633cbee02247.tar.bz2
aports-c3855e5a1aa63998254a53fc51c0633cbee02247.tar.xz
main/linux-virt-grsec: upgrade to 3.14.17
-rw-r--r--main/linux-virt-grsec/APKBUILD16
-rw-r--r--main/linux-virt-grsec/grsecurity-3.0-3.14.17-201408260041.patch (renamed from main/linux-virt-grsec/grsecurity-3.0-3.14.16-201408110024.patch)1730
2 files changed, 647 insertions, 1099 deletions
diff --git a/main/linux-virt-grsec/APKBUILD b/main/linux-virt-grsec/APKBUILD
index 09b3e94998..3d969e13c6 100644
--- a/main/linux-virt-grsec/APKBUILD
+++ b/main/linux-virt-grsec/APKBUILD
@@ -3,7 +3,7 @@
_flavor=virt-grsec
pkgname=linux-${_flavor}
-pkgver=3.14.16
+pkgver=3.14.17
case $pkgver in
*.*.*) _kernver=${pkgver%.*};;
*.*) _kernver=${pkgver};;
@@ -18,7 +18,7 @@ _config=${config:-kernelconfig.${CARCH}}
install=
source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz
http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz
- grsecurity-3.0-$pkgver-201408110024.patch
+ grsecurity-3.0-$pkgver-201408260041.patch
fix-memory-map-for-PIE-applications.patch
imx6q-no-unclocked-sleep.patch
@@ -146,22 +146,22 @@ dev() {
}
md5sums="b621207b3f6ecbb67db18b13258f8ea8 linux-3.14.tar.xz
-0c17d6e79e240062a36d4a71a2f7d1f2 patch-3.14.16.xz
-cba8b3e01874c01f982a360cc3aad33f grsecurity-3.0-3.14.16-201408110024.patch
+a9a6539c8df7245c2ab9bfca56f2ef04 patch-3.14.17.xz
+25066c4bc665d172b980d09435f18432 grsecurity-3.0-3.14.17-201408260041.patch
c6a4ae7e8ca6159e1631545515805216 fix-memory-map-for-PIE-applications.patch
1a307fc1d63231bf01d22493a4f14378 imx6q-no-unclocked-sleep.patch
6b30dd8284f37ecc244d556bebf32046 kernelconfig.x86
8df8378d305bdd302b01293ff44e982d kernelconfig.x86_64"
sha256sums="61558aa490855f42b6340d1a1596be47454909629327c49a5e4e10268065dffa linux-3.14.tar.xz
-3d3e79fd9795812f293aa38799c056aaea0f14da8294b31067f7768e9f38db2d patch-3.14.16.xz
-e27fc08381e4937347b426e5f68149a0917dce79ef4f962b106ae158cdb4a619 grsecurity-3.0-3.14.16-201408110024.patch
+50b0e2a6812597b401a417bd1269b5388fdd980b6009d564fff09605100f0df8 patch-3.14.17.xz
+40352c8bd115d91089444670999925e2a383c66c42ae11d94ec295d656772caf grsecurity-3.0-3.14.17-201408260041.patch
500f3577310be52e87b9fecdc2e9c4ca43210fd97d69089f9005d484563f74c7 fix-memory-map-for-PIE-applications.patch
21179fbb22a5b74af0a609350ae1a170e232908572b201d02e791d2ce0a685d3 imx6q-no-unclocked-sleep.patch
5e06e22ca723e50ae9f4bfabdda2e738f7b28cbbfe77b6be295285d6cd75c916 kernelconfig.x86
0ec1e1eb4445bd9751cb98a55afd4a430bed08e8d8c3c0a107d2f14ec5746dd2 kernelconfig.x86_64"
sha512sums="5730d83a7a81134c1e77c0bf89e42dee4f8251ad56c1ac2be20c59e26fdfaa7bea55f277e7af156b637f22e1584914a46089af85039177cb43485089c74ac26e linux-3.14.tar.xz
-3004ce119ee9d6a13c8d1af6c3e1bd96794c89a98e914c0a0d80ff96c2a6f41ed3d2108aa86312d4b08646a38c9b47478c136252418a4964476b624e5e1fae70 patch-3.14.16.xz
-f4a1dec548fb2bb2791d3b4a3e53a4f5f52fef95cd81e4d2dac0749474ff646b51b7f06eb9d83b27c9882e803164f7e60139d9781b144a7eba0819d565cf23b3 grsecurity-3.0-3.14.16-201408110024.patch
+03638215934a08a67e3d92d051b6a341e1874872388de910870021934f11f8ed20502a1afbff89a24f0e14053a02f4e40441e2f9878b099ddd1504159ff19872 patch-3.14.17.xz
+6c54a9f120dd896b595239f984c326933e50ba2e324215fb8e4bb6092cb624771dc301e78424f7be3f1d42c542fda086e5d8fe84cf9e06dc8106d3b16c0a69bd grsecurity-3.0-3.14.17-201408260041.patch
4665c56ae1bbac311f9205d64918e84ee8b01d47d6e2396ff6b8adfb10aada7f7254531ce62e31edbb65c2a54a830f09ad05d314dfcd75d6272f4068945ad7c7 fix-memory-map-for-PIE-applications.patch
87d1ad59732f265a5b0db54490dc1762c14ea4b868e7eb1aedc3ce57b48046de7bbc08cf5cfcf6f1380fa84063b0edb16ba3d5e3c5670be9bbb229275c88b221 imx6q-no-unclocked-sleep.patch
29dc4bbde6052bb16200d87b7137717a053ad3c716a305a51d2b523531f35c1a7e144099f7a251c85849c9117a65ed961262dd314e0832f58750f489aeb1440e kernelconfig.x86
diff --git a/main/linux-virt-grsec/grsecurity-3.0-3.14.16-201408110024.patch b/main/linux-virt-grsec/grsecurity-3.0-3.14.17-201408260041.patch
index cd58a6f54d..c27879a613 100644
--- a/main/linux-virt-grsec/grsecurity-3.0-3.14.16-201408110024.patch
+++ b/main/linux-virt-grsec/grsecurity-3.0-3.14.17-201408260041.patch
@@ -287,7 +287,7 @@ index 7116fda..d8ed6e8 100644
pcd. [PARIDE]
diff --git a/Makefile b/Makefile
-index 8b22e24..7f4d29b 100644
+index 12aac03..33d9e9f 100644
--- a/Makefile
+++ b/Makefile
@@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -9883,142 +9883,6 @@ index 502f632..da1917f 100644
#define __S100 PAGE_READONLY
#define __S101 PAGE_READONLY
#define __S110 PAGE_SHARED
-diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
-index 0f9e945..a949e55 100644
---- a/arch/sparc/include/asm/pgtable_64.h
-+++ b/arch/sparc/include/asm/pgtable_64.h
-@@ -71,6 +71,23 @@
-
- #include <linux/sched.h>
-
-+extern unsigned long sparc64_valid_addr_bitmap[];
-+
-+/* Needs to be defined here and not in linux/mm.h, as it is arch dependent */
-+static inline bool __kern_addr_valid(unsigned long paddr)
-+{
-+ if ((paddr >> MAX_PHYS_ADDRESS_BITS) != 0UL)
-+ return false;
-+ return test_bit(paddr >> ILOG2_4MB, sparc64_valid_addr_bitmap);
-+}
-+
-+static inline bool kern_addr_valid(unsigned long addr)
-+{
-+ unsigned long paddr = __pa(addr);
-+
-+ return __kern_addr_valid(paddr);
-+}
-+
- /* Entries per page directory level. */
- #define PTRS_PER_PTE (1UL << (PAGE_SHIFT-3))
- #define PTRS_PER_PMD (1UL << PMD_BITS)
-@@ -79,9 +96,12 @@
- /* Kernel has a separate 44bit address space. */
- #define FIRST_USER_ADDRESS 0
-
--#define pte_ERROR(e) __builtin_trap()
--#define pmd_ERROR(e) __builtin_trap()
--#define pgd_ERROR(e) __builtin_trap()
-+#define pmd_ERROR(e) \
-+ pr_err("%s:%d: bad pmd %p(%016lx) seen at (%pS)\n", \
-+ __FILE__, __LINE__, &(e), pmd_val(e), __builtin_return_address(0))
-+#define pgd_ERROR(e) \
-+ pr_err("%s:%d: bad pgd %p(%016lx) seen at (%pS)\n", \
-+ __FILE__, __LINE__, &(e), pgd_val(e), __builtin_return_address(0))
-
- #endif /* !(__ASSEMBLY__) */
-
-@@ -633,7 +653,7 @@ static inline unsigned long pmd_large(pmd_t pmd)
- {
- pte_t pte = __pte(pmd_val(pmd));
-
-- return (pte_val(pte) & _PAGE_PMD_HUGE) && pte_present(pte);
-+ return pte_val(pte) & _PAGE_PMD_HUGE;
- }
-
- #ifdef CONFIG_TRANSPARENT_HUGEPAGE
-@@ -719,20 +739,6 @@ static inline pmd_t pmd_mkwrite(pmd_t pmd)
- return __pmd(pte_val(pte));
- }
-
--static inline pmd_t pmd_mknotpresent(pmd_t pmd)
--{
-- unsigned long mask;
--
-- if (tlb_type == hypervisor)
-- mask = _PAGE_PRESENT_4V;
-- else
-- mask = _PAGE_PRESENT_4U;
--
-- pmd_val(pmd) &= ~mask;
--
-- return pmd;
--}
--
- static inline pmd_t pmd_mksplitting(pmd_t pmd)
- {
- pte_t pte = __pte(pmd_val(pmd));
-@@ -757,6 +763,20 @@ static inline int pmd_present(pmd_t pmd)
-
- #define pmd_none(pmd) (!pmd_val(pmd))
-
-+/* pmd_bad() is only called on non-trans-huge PMDs. Our encoding is
-+ * very simple, it's just the physical address. PTE tables are of
-+ * size PAGE_SIZE so make sure the sub-PAGE_SIZE bits are clear and
-+ * the top bits outside of the range of any physical address size we
-+ * support are clear as well. We also validate the physical itself.
-+ */
-+#define pmd_bad(pmd) ((pmd_val(pmd) & ~PAGE_MASK) || \
-+ !__kern_addr_valid(pmd_val(pmd)))
-+
-+#define pud_none(pud) (!pud_val(pud))
-+
-+#define pud_bad(pud) ((pud_val(pud) & ~PAGE_MASK) || \
-+ !__kern_addr_valid(pud_val(pud)))
-+
- #ifdef CONFIG_TRANSPARENT_HUGEPAGE
- extern void set_pmd_at(struct mm_struct *mm, unsigned long addr,
- pmd_t *pmdp, pmd_t pmd);
-@@ -790,10 +810,7 @@ static inline unsigned long __pmd_page(pmd_t pmd)
- #define pud_page_vaddr(pud) \
- ((unsigned long) __va(pud_val(pud)))
- #define pud_page(pud) virt_to_page((void *)pud_page_vaddr(pud))
--#define pmd_bad(pmd) (0)
- #define pmd_clear(pmdp) (pmd_val(*(pmdp)) = 0UL)
--#define pud_none(pud) (!pud_val(pud))
--#define pud_bad(pud) (0)
- #define pud_present(pud) (pud_val(pud) != 0U)
- #define pud_clear(pudp) (pud_val(*(pudp)) = 0UL)
-
-@@ -893,6 +910,10 @@ extern void update_mmu_cache(struct vm_area_struct *, unsigned long, pte_t *);
- extern void update_mmu_cache_pmd(struct vm_area_struct *vma, unsigned long addr,
- pmd_t *pmd);
-
-+#define __HAVE_ARCH_PMDP_INVALIDATE
-+extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
-+ pmd_t *pmdp);
-+
- #define __HAVE_ARCH_PGTABLE_DEPOSIT
- extern void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
- pgtable_t pgtable);
-@@ -919,18 +940,6 @@ extern unsigned long pte_file(pte_t);
- extern pte_t pgoff_to_pte(unsigned long);
- #define PTE_FILE_MAX_BITS (64UL - PAGE_SHIFT - 1UL)
-
--extern unsigned long sparc64_valid_addr_bitmap[];
--
--/* Needs to be defined here and not in linux/mm.h, as it is arch dependent */
--static inline bool kern_addr_valid(unsigned long addr)
--{
-- unsigned long paddr = __pa(addr);
--
-- if ((paddr >> 41UL) != 0UL)
-- return false;
-- return test_bit(paddr >> 22, sparc64_valid_addr_bitmap);
--}
--
- extern int page_in_phys_avail(unsigned long paddr);
-
- /*
diff --git a/arch/sparc/include/asm/pgtsrmmu.h b/arch/sparc/include/asm/pgtsrmmu.h
index 79da178..c2eede8 100644
--- a/arch/sparc/include/asm/pgtsrmmu.h
@@ -10196,20 +10060,6 @@ index a5f01ac..703b554 100644
/*
* Thread-synchronous status.
*
-diff --git a/arch/sparc/include/asm/tsb.h b/arch/sparc/include/asm/tsb.h
-index 2230f80..90916f9 100644
---- a/arch/sparc/include/asm/tsb.h
-+++ b/arch/sparc/include/asm/tsb.h
-@@ -171,7 +171,8 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
- andcc REG1, REG2, %g0; \
- be,pt %xcc, 700f; \
- sethi %hi(4 * 1024 * 1024), REG2; \
-- andn REG1, REG2, REG1; \
-+ brgez,pn REG1, FAIL_LABEL; \
-+ andn REG1, REG2, REG1; \
- and VADDR, REG2, REG2; \
- brlz,pt REG1, PTE_LABEL; \
- or REG1, REG2, REG1; \
diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
index 0167d26..767bb0c 100644
--- a/arch/sparc/include/asm/uaccess.h
@@ -10458,7 +10308,7 @@ index c13c9f2..d572c34 100644
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
-index b085311..6f885f7 100644
+index 8416d7f..f83823c 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -870,8 +870,8 @@ extern unsigned long xcall_flush_dcache_page_cheetah;
@@ -10958,37 +10808,10 @@ index 4ced92f..965eeed 100644
}
EXPORT_SYMBOL(die_if_kernel);
diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
-index 3c1a7cb..9046547 100644
+index 35ab8b6..9046547 100644
--- a/arch/sparc/kernel/unaligned_64.c
+++ b/arch/sparc/kernel/unaligned_64.c
-@@ -166,17 +166,23 @@ static unsigned long *fetch_reg_addr(unsigned int reg, struct pt_regs *regs)
- unsigned long compute_effective_address(struct pt_regs *regs,
- unsigned int insn, unsigned int rd)
- {
-+ int from_kernel = (regs->tstate & TSTATE_PRIV) != 0;
- unsigned int rs1 = (insn >> 14) & 0x1f;
- unsigned int rs2 = insn & 0x1f;
-- int from_kernel = (regs->tstate & TSTATE_PRIV) != 0;
-+ unsigned long addr;
-
- if (insn & 0x2000) {
- maybe_flush_windows(rs1, 0, rd, from_kernel);
-- return (fetch_reg(rs1, regs) + sign_extend_imm13(insn));
-+ addr = (fetch_reg(rs1, regs) + sign_extend_imm13(insn));
- } else {
- maybe_flush_windows(rs1, rs2, rd, from_kernel);
-- return (fetch_reg(rs1, regs) + fetch_reg(rs2, regs));
-+ addr = (fetch_reg(rs1, regs) + fetch_reg(rs2, regs));
- }
-+
-+ if (!from_kernel && test_thread_flag(TIF_32BIT))
-+ addr &= 0xffffffff;
-+
-+ return addr;
- }
-
- /* This is just to make gcc think die_if_kernel does return... */
-@@ -289,7 +295,7 @@ static void log_unaligned(struct pt_regs *regs)
+@@ -295,7 +295,7 @@ static void log_unaligned(struct pt_regs *regs)
static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
if (__ratelimit(&ratelimit)) {
@@ -11578,7 +11401,7 @@ index 59dbd46..1dd7f5e 100644
if (!(vma->vm_flags & (VM_READ | VM_EXEC)))
goto bad_area;
diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
-index 69bb818..3542236 100644
+index 4ced3fc..234f1e4 100644
--- a/arch/sparc/mm/fault_64.c
+++ b/arch/sparc/mm/fault_64.c
@@ -22,6 +22,9 @@
@@ -11600,124 +11423,7 @@ index 69bb818..3542236 100644
printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
dump_stack();
unhandled_fault(regs->tpc, current, regs);
-@@ -96,38 +99,51 @@ static unsigned int get_user_insn(unsigned long tpc)
- pte_t *ptep, pte;
- unsigned long pa;
- u32 insn = 0;
-- unsigned long pstate;
-
-- if (pgd_none(*pgdp))
-- goto outret;
-+ if (pgd_none(*pgdp) || unlikely(pgd_bad(*pgdp)))
-+ goto out;
- pudp = pud_offset(pgdp, tpc);
-- if (pud_none(*pudp))
-- goto outret;
-- pmdp = pmd_offset(pudp, tpc);
-- if (pmd_none(*pmdp))
-- goto outret;
-+ if (pud_none(*pudp) || unlikely(pud_bad(*pudp)))
-+ goto out;
-
- /* This disables preemption for us as well. */
-- __asm__ __volatile__("rdpr %%pstate, %0" : "=r" (pstate));
-- __asm__ __volatile__("wrpr %0, %1, %%pstate"
-- : : "r" (pstate), "i" (PSTATE_IE));
-- ptep = pte_offset_map(pmdp, tpc);
-- pte = *ptep;
-- if (!pte_present(pte))
-- goto out;
-+ local_irq_disable();
-
-- pa = (pte_pfn(pte) << PAGE_SHIFT);
-- pa += (tpc & ~PAGE_MASK);
-+ pmdp = pmd_offset(pudp, tpc);
-+ if (pmd_none(*pmdp) || unlikely(pmd_bad(*pmdp)))
-+ goto out_irq_enable;
-
-- /* Use phys bypass so we don't pollute dtlb/dcache. */
-- __asm__ __volatile__("lduwa [%1] %2, %0"
-- : "=r" (insn)
-- : "r" (pa), "i" (ASI_PHYS_USE_EC));
-+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
-+ if (pmd_trans_huge(*pmdp)) {
-+ if (pmd_trans_splitting(*pmdp))
-+ goto out_irq_enable;
-
-+ pa = pmd_pfn(*pmdp) << PAGE_SHIFT;
-+ pa += tpc & ~HPAGE_MASK;
-+
-+ /* Use phys bypass so we don't pollute dtlb/dcache. */
-+ __asm__ __volatile__("lduwa [%1] %2, %0"
-+ : "=r" (insn)
-+ : "r" (pa), "i" (ASI_PHYS_USE_EC));
-+ } else
-+#endif
-+ {
-+ ptep = pte_offset_map(pmdp, tpc);
-+ pte = *ptep;
-+ if (pte_present(pte)) {
-+ pa = (pte_pfn(pte) << PAGE_SHIFT);
-+ pa += (tpc & ~PAGE_MASK);
-+
-+ /* Use phys bypass so we don't pollute dtlb/dcache. */
-+ __asm__ __volatile__("lduwa [%1] %2, %0"
-+ : "=r" (insn)
-+ : "r" (pa), "i" (ASI_PHYS_USE_EC));
-+ }
-+ pte_unmap(ptep);
-+ }
-+out_irq_enable:
-+ local_irq_enable();
- out:
-- pte_unmap(ptep);
-- __asm__ __volatile__("wrpr %0, 0x0, %%pstate" : : "r" (pstate));
--outret:
- return insn;
- }
-
-@@ -153,7 +169,8 @@ show_signal_msg(struct pt_regs *regs, int sig, int code,
- }
-
- static void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
-- unsigned int insn, int fault_code)
-+ unsigned long fault_addr, unsigned int insn,
-+ int fault_code)
- {
- unsigned long addr;
- siginfo_t info;
-@@ -161,10 +178,18 @@ static void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
- info.si_code = code;
- info.si_signo = sig;
- info.si_errno = 0;
-- if (fault_code & FAULT_CODE_ITLB)
-+ if (fault_code & FAULT_CODE_ITLB) {
- addr = regs->tpc;
-- else
-- addr = compute_effective_address(regs, insn, 0);
-+ } else {
-+ /* If we were able to probe the faulting instruction, use it
-+ * to compute a precise fault address. Otherwise use the fault
-+ * time provided address which may only have page granularity.
-+ */
-+ if (insn)
-+ addr = compute_effective_address(regs, insn, 0);
-+ else
-+ addr = fault_addr;
-+ }
- info.si_addr = (void __user *) addr;
- info.si_trapno = 0;
-
-@@ -239,7 +264,7 @@ static void __kprobes do_kernel_fault(struct pt_regs *regs, int si_code,
- /* The si_code was set to make clear whether
- * this was a SEGV_MAPERR or SEGV_ACCERR fault.
- */
-- do_fault_siginfo(si_code, SIGSEGV, regs, insn, fault_code);
-+ do_fault_siginfo(si_code, SIGSEGV, regs, address, insn, fault_code);
- return;
- }
-
-@@ -271,6 +296,466 @@ static void noinline __kprobes bogus_32bit_fault_address(struct pt_regs *regs,
+@@ -281,6 +284,466 @@ static void noinline __kprobes bogus_32bit_fault_tpc(struct pt_regs *regs)
show_regs(regs);
}
@@ -12184,7 +11890,7 @@ index 69bb818..3542236 100644
asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
{
enum ctx_state prev_state = exception_enter();
-@@ -344,6 +829,29 @@ retry:
+@@ -352,6 +815,29 @@ retry:
if (!vma)
goto bad_area;
@@ -12214,28 +11920,6 @@ index 69bb818..3542236 100644
/* Pure DTLB misses do not tell us whether the fault causing
* load/store/atomic was a write or not, it only says that there
* was no match. So in such a case we (carefully) read the
-@@ -525,7 +1033,7 @@ do_sigbus:
- * Send a sigbus, regardless of whether we were in kernel
- * or user mode.
- */
-- do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, insn, fault_code);
-+ do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, address, insn, fault_code);
-
- /* Kernel mode? Handle exceptions or die */
- if (regs->tstate & TSTATE_PRIV)
-diff --git a/arch/sparc/mm/gup.c b/arch/sparc/mm/gup.c
-index c4d3da6..1aed043 100644
---- a/arch/sparc/mm/gup.c
-+++ b/arch/sparc/mm/gup.c
-@@ -73,7 +73,7 @@ static int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
- struct page *head, *page, *tail;
- int refs;
-
-- if (!pmd_large(pmd))
-+ if (!(pmd_val(pmd) & _PAGE_VALID))
- return 0;
-
- if (write && !pmd_write(pmd))
diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
index d329537..2c3746a 100644
--- a/arch/sparc/mm/hugetlbpage.c
@@ -12343,7 +12027,7 @@ index d329537..2c3746a 100644
pte_t *huge_pte_alloc(struct mm_struct *mm,
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
-index eafbc65..5a8070d 100644
+index 9686224..dfbdb10 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -188,9 +188,9 @@ unsigned long sparc64_kern_sec_context __read_mostly;
@@ -12367,7 +12051,7 @@ index eafbc65..5a8070d 100644
#endif
#ifdef DCACHE_ALIASING_POSSIBLE
-@@ -466,10 +466,10 @@ void mmu_info(struct seq_file *m)
+@@ -470,10 +470,10 @@ void mmu_info(struct seq_file *m)
#ifdef CONFIG_DEBUG_DCFLUSH
seq_printf(m, "DCPageFlushes\t: %d\n",
@@ -12380,67 +12064,6 @@ index eafbc65..5a8070d 100644
#endif /* CONFIG_SMP */
#endif /* CONFIG_DEBUG_DCFLUSH */
}
-diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
-index b12cb5e..b89aba2 100644
---- a/arch/sparc/mm/tlb.c
-+++ b/arch/sparc/mm/tlb.c
-@@ -134,7 +134,7 @@ no_cache_flush:
-
- #ifdef CONFIG_TRANSPARENT_HUGEPAGE
- static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr,
-- pmd_t pmd, bool exec)
-+ pmd_t pmd)
- {
- unsigned long end;
- pte_t *pte;
-@@ -142,8 +142,11 @@ static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr,
- pte = pte_offset_map(&pmd, vaddr);
- end = vaddr + HPAGE_SIZE;
- while (vaddr < end) {
-- if (pte_val(*pte) & _PAGE_VALID)
-+ if (pte_val(*pte) & _PAGE_VALID) {
-+ bool exec = pte_exec(*pte);
-+
- tlb_batch_add_one(mm, vaddr, exec);
-+ }
- pte++;
- vaddr += PAGE_SIZE;
- }
-@@ -177,19 +180,30 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr,
- }
-
- if (!pmd_none(orig)) {
-- pte_t orig_pte = __pte(pmd_val(orig));
-- bool exec = pte_exec(orig_pte);
--
- addr &= HPAGE_MASK;
- if (pmd_trans_huge(orig)) {
-+ pte_t orig_pte = __pte(pmd_val(orig));
-+ bool exec = pte_exec(orig_pte);
-+
- tlb_batch_add_one(mm, addr, exec);
- tlb_batch_add_one(mm, addr + REAL_HPAGE_SIZE, exec);
- } else {
-- tlb_batch_pmd_scan(mm, addr, orig, exec);
-+ tlb_batch_pmd_scan(mm, addr, orig);
- }
- }
- }
-
-+void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
-+ pmd_t *pmdp)
-+{
-+ pmd_t entry = *pmdp;
-+
-+ pmd_val(entry) &= ~_PAGE_VALID;
-+
-+ set_pmd_at(vma->vm_mm, address, pmdp, entry);
-+ flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE);
-+}
-+
- void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
- pgtable_t pgtable)
- {
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index b3692ce..e4517c9 100644
--- a/arch/tile/Kconfig
@@ -39221,28 +38844,10 @@ index 8320abd..ec48108 100644
if (cmd != SIOCWANDEV)
diff --git a/drivers/char/random.c b/drivers/char/random.c
-index 429b75b..a7f4145 100644
+index 429b75b..de805d0 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
-@@ -270,10 +270,17 @@
- /*
- * Configuration information
- */
-+#ifdef CONFIG_GRKERNSEC_RANDNET
-+#define INPUT_POOL_SHIFT 14
-+#define INPUT_POOL_WORDS (1 << (INPUT_POOL_SHIFT-5))
-+#define OUTPUT_POOL_SHIFT 12
-+#define OUTPUT_POOL_WORDS (1 << (OUTPUT_POOL_SHIFT-5))
-+#else
- #define INPUT_POOL_SHIFT 12
- #define INPUT_POOL_WORDS (1 << (INPUT_POOL_SHIFT-5))
- #define OUTPUT_POOL_SHIFT 10
- #define OUTPUT_POOL_WORDS (1 << (OUTPUT_POOL_SHIFT-5))
-+#endif
- #define SEC_XFER_SIZE 512
- #define EXTRACT_SIZE 10
-
-@@ -284,9 +291,6 @@
+@@ -284,9 +284,6 @@
/*
* To allow fractional bits to be tracked, the entropy_count field is
* denominated in units of 1/8th bits.
@@ -39252,27 +38857,7 @@ index 429b75b..a7f4145 100644
*/
#define ENTROPY_SHIFT 3
#define ENTROPY_BITS(r) ((r)->entropy_count >> ENTROPY_SHIFT)
-@@ -361,12 +365,19 @@ static struct poolinfo {
- #define S(x) ilog2(x)+5, (x), (x)*4, (x)*32, (x) << (ENTROPY_SHIFT+5)
- int tap1, tap2, tap3, tap4, tap5;
- } poolinfo_table[] = {
-+#ifdef CONFIG_GRKERNSEC_RANDNET
-+ /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
-+ { S(512), 411, 308, 208, 104, 1 },
-+ /* x^128 + x^104 + x^76 + x^51 + x^25 + x + 1 -- 105 */
-+ { S(128), 104, 76, 51, 25, 1 },
-+#else
- /* was: x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 */
- /* x^128 + x^104 + x^76 + x^51 +x^25 + x + 1 */
- { S(128), 104, 76, 51, 25, 1 },
- /* was: x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 */
- /* x^32 + x^26 + x^19 + x^14 + x^7 + x + 1 */
- { S(32), 26, 19, 14, 7, 1 },
-+#endif
- #if 0
- /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
- { S(2048), 1638, 1231, 819, 411, 1 },
-@@ -433,9 +444,9 @@ struct entropy_store {
+@@ -433,9 +430,9 @@ struct entropy_store {
};
static void push_to_pool(struct work_struct *work);
@@ -39285,7 +38870,7 @@ index 429b75b..a7f4145 100644
static struct entropy_store input_pool = {
.poolinfo = &poolinfo_table[0],
-@@ -524,8 +535,8 @@ static void _mix_pool_bytes(struct entropy_store *r, const void *in,
+@@ -524,8 +521,8 @@ static void _mix_pool_bytes(struct entropy_store *r, const void *in,
input_rotate = (input_rotate + (i ? 7 : 14)) & 31;
}
@@ -39296,7 +38881,7 @@ index 429b75b..a7f4145 100644
smp_wmb();
if (out)
-@@ -632,7 +643,7 @@ retry:
+@@ -632,7 +629,7 @@ retry:
/* The +2 corresponds to the /4 in the denominator */
do {
@@ -39305,7 +38890,7 @@ index 429b75b..a7f4145 100644
unsigned int add =
((pool_size - entropy_count)*anfrac*3) >> s;
-@@ -1151,7 +1162,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
+@@ -1151,7 +1148,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
extract_buf(r, tmp);
i = min_t(int, nbytes, EXTRACT_SIZE);
@@ -39314,7 +38899,7 @@ index 429b75b..a7f4145 100644
ret = -EFAULT;
break;
}
-@@ -1507,7 +1518,7 @@ EXPORT_SYMBOL(generate_random_uuid);
+@@ -1507,7 +1504,7 @@ EXPORT_SYMBOL(generate_random_uuid);
#include <linux/sysctl.h>
static int min_read_thresh = 8, min_write_thresh;
@@ -39323,7 +38908,7 @@ index 429b75b..a7f4145 100644
static int max_write_thresh = INPUT_POOL_WORDS * 32;
static char sysctl_bootid[16];
-@@ -1523,7 +1534,7 @@ static char sysctl_bootid[16];
+@@ -1523,7 +1520,7 @@ static char sysctl_bootid[16];
static int proc_do_uuid(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
{
@@ -39332,7 +38917,7 @@ index 429b75b..a7f4145 100644
unsigned char buf[64], tmp_uuid[16], *uuid;
uuid = table->data;
-@@ -1553,7 +1564,7 @@ static int proc_do_uuid(struct ctl_table *table, int write,
+@@ -1553,7 +1550,7 @@ static int proc_do_uuid(struct ctl_table *table, int write,
static int proc_do_entropy(ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
{
@@ -42080,6 +41665,19 @@ index 6866448..2ad2b34 100644
{
/* copy over all the bus versions */
if (dev->bus && dev->bus->pm) {
+diff --git a/drivers/hid/hid-cherry.c b/drivers/hid/hid-cherry.c
+index 1bdcccc..f745d2c 100644
+--- a/drivers/hid/hid-cherry.c
++++ b/drivers/hid/hid-cherry.c
+@@ -28,7 +28,7 @@
+ static __u8 *ch_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+- if (*rsize >= 17 && rdesc[11] == 0x3c && rdesc[12] == 0x02) {
++ if (*rsize >= 18 && rdesc[11] == 0x3c && rdesc[12] == 0x02) {
+ hid_info(hdev, "fixing up Cherry Cymotion report descriptor\n");
+ rdesc[11] = rdesc[16] = 0xff;
+ rdesc[12] = rdesc[17] = 0x03;
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 7cd42ea..a367c48 100644
--- a/drivers/hid/hid-core.c
@@ -42102,6 +41700,110 @@ index 7cd42ea..a367c48 100644
hid_debug_register(hdev, dev_name(&hdev->dev));
ret = device_add(&hdev->dev);
+diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
+index e776963..b92bf01 100644
+--- a/drivers/hid/hid-kye.c
++++ b/drivers/hid/hid-kye.c
+@@ -300,7 +300,7 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ * - change the button usage range to 4-7 for the extra
+ * buttons
+ */
+- if (*rsize >= 74 &&
++ if (*rsize >= 75 &&
+ rdesc[61] == 0x05 && rdesc[62] == 0x08 &&
+ rdesc[63] == 0x19 && rdesc[64] == 0x08 &&
+ rdesc[65] == 0x29 && rdesc[66] == 0x0f &&
+diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
+index 9fe9d4a..b8207e0 100644
+--- a/drivers/hid/hid-lg.c
++++ b/drivers/hid/hid-lg.c
+@@ -345,14 +345,14 @@ static __u8 *lg_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ struct usb_device_descriptor *udesc;
+ __u16 bcdDevice, rev_maj, rev_min;
+
+- if ((drv_data->quirks & LG_RDESC) && *rsize >= 90 && rdesc[83] == 0x26 &&
++ if ((drv_data->quirks & LG_RDESC) && *rsize >= 91 && rdesc[83] == 0x26 &&
+ rdesc[84] == 0x8c && rdesc[85] == 0x02) {
+ hid_info(hdev,
+ "fixing up Logitech keyboard report descriptor\n");
+ rdesc[84] = rdesc[89] = 0x4d;
+ rdesc[85] = rdesc[90] = 0x10;
+ }
+- if ((drv_data->quirks & LG_RDESC_REL_ABS) && *rsize >= 50 &&
++ if ((drv_data->quirks & LG_RDESC_REL_ABS) && *rsize >= 51 &&
+ rdesc[32] == 0x81 && rdesc[33] == 0x06 &&
+ rdesc[49] == 0x81 && rdesc[50] == 0x06) {
+ hid_info(hdev,
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index f45279c..0b14d32 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -237,13 +237,6 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
+ return;
+ }
+
+- if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
+- (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
+- dev_err(&djrcv_hdev->dev, "%s: invalid device index:%d\n",
+- __func__, dj_report->device_index);
+- return;
+- }
+-
+ if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
+ /* The device is already known. No need to reallocate it. */
+ dbg_hid("%s: device is already known\n", __func__);
+@@ -721,6 +714,12 @@ static int logi_dj_raw_event(struct hid_device *hdev,
+ * device (via hid_input_report() ) and return 1 so hid-core does not do
+ * anything else with it.
+ */
++ if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
++ (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
++ dev_err(&hdev->dev, "%s: invalid device index:%d\n",
++ __func__, dj_report->device_index);
++ return false;
++ }
+
+ spin_lock_irqsave(&djrcv_dev->lock, flags);
+ if (dj_report->report_id == REPORT_ID_DJ_SHORT) {
+diff --git a/drivers/hid/hid-monterey.c b/drivers/hid/hid-monterey.c
+index 9e14c00..25daf28 100644
+--- a/drivers/hid/hid-monterey.c
++++ b/drivers/hid/hid-monterey.c
+@@ -24,7 +24,7 @@
+ static __u8 *mr_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+- if (*rsize >= 30 && rdesc[29] == 0x05 && rdesc[30] == 0x09) {
++ if (*rsize >= 31 && rdesc[29] == 0x05 && rdesc[30] == 0x09) {
+ hid_info(hdev, "fixing up button/consumer in HID report descriptor\n");
+ rdesc[30] = 0x0c;
+ }
+diff --git a/drivers/hid/hid-petalynx.c b/drivers/hid/hid-petalynx.c
+index 736b250..6aca4f2 100644
+--- a/drivers/hid/hid-petalynx.c
++++ b/drivers/hid/hid-petalynx.c
+@@ -25,7 +25,7 @@
+ static __u8 *pl_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+- if (*rsize >= 60 && rdesc[39] == 0x2a && rdesc[40] == 0xf5 &&
++ if (*rsize >= 62 && rdesc[39] == 0x2a && rdesc[40] == 0xf5 &&
+ rdesc[41] == 0x00 && rdesc[59] == 0x26 &&
+ rdesc[60] == 0xf9 && rdesc[61] == 0x00) {
+ hid_info(hdev, "fixing up Petalynx Maxter Remote report descriptor\n");
+diff --git a/drivers/hid/hid-sunplus.c b/drivers/hid/hid-sunplus.c
+index 87fc91e..91072fa 100644
+--- a/drivers/hid/hid-sunplus.c
++++ b/drivers/hid/hid-sunplus.c
+@@ -24,7 +24,7 @@
+ static __u8 *sp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+- if (*rsize >= 107 && rdesc[104] == 0x26 && rdesc[105] == 0x80 &&
++ if (*rsize >= 112 && rdesc[104] == 0x26 && rdesc[105] == 0x80 &&
+ rdesc[106] == 0x03) {
+ hid_info(hdev, "fixing up Sunplus Wireless Desktop report descriptor\n");
+ rdesc[105] = rdesc[110] = 0x03;
diff --git a/drivers/hid/hid-wiimote-debug.c b/drivers/hid/hid-wiimote-debug.c
index c13fb5b..55a3802 100644
--- a/drivers/hid/hid-wiimote-debug.c
@@ -44833,7 +44535,7 @@ index 56e24c0..e1c8e1f 100644
"md/raid1:%s: read error corrected "
"(%d sectors at %llu on %s)\n",
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index cb882aa..9bd076e 100644
+index cb882aa..cb8aeca 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1949,7 +1949,7 @@ static void end_sync_read(struct bio *bio, int error)
@@ -44895,8 +44597,25 @@ index cb882aa..9bd076e 100644
}
rdev_dec_pending(rdev, mddev);
+@@ -2954,6 +2954,7 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr,
+ */
+ if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery)) {
+ end_reshape(conf);
++ close_sync(conf);
+ return 0;
+ }
+
+@@ -4411,7 +4412,7 @@ read_more:
+ read_bio->bi_private = r10_bio;
+ read_bio->bi_end_io = end_sync_read;
+ read_bio->bi_rw = READ;
+- read_bio->bi_flags &= ~(BIO_POOL_MASK - 1);
++ read_bio->bi_flags &= (~0UL << BIO_RESET_BITS);
+ read_bio->bi_flags |= 1 << BIO_UPTODATE;
+ read_bio->bi_vcnt = 0;
+ read_bio->bi_iter.bi_size = 0;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index 16f5c21..522b82e 100644
+index 16f5c21..c5d72c7 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -1707,6 +1707,10 @@ static int grow_one_stripe(struct r5conf *conf, int hash)
@@ -44957,6 +44676,15 @@ index 16f5c21..522b82e 100644
> conf->max_nr_stripes)
printk(KERN_WARNING
"md/raid:%s: Too many read errors, failing device %s.\n",
+@@ -3779,6 +3787,8 @@ static void handle_stripe(struct stripe_head *sh)
+ set_bit(R5_Wantwrite, &dev->flags);
+ if (prexor)
+ continue;
++ if (s.failed > 1)
++ continue;
+ if (!test_bit(R5_Insync, &dev->flags) ||
+ ((i == sh->pd_idx || i == sh->qd_idx) &&
+ s.failed == 0))
diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
index 983db75..ef9248c 100644
--- a/drivers/media/dvb-core/dvbdev.c
@@ -47122,10 +46850,10 @@ index bf0d55e..82bcfbd1 100644
priv = netdev_priv(dev);
priv->phy = phy;
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
-index 5adecc5..aec7730 100644
+index 7f1abb7..6434b33 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
-@@ -991,13 +991,15 @@ static const struct nla_policy macvlan_policy[IFLA_MACVLAN_MAX + 1] = {
+@@ -992,13 +992,15 @@ static const struct nla_policy macvlan_policy[IFLA_MACVLAN_MAX + 1] = {
int macvlan_link_register(struct rtnl_link_ops *ops)
{
/* common fields */
@@ -47148,7 +46876,7 @@ index 5adecc5..aec7730 100644
return rtnl_link_register(ops);
};
-@@ -1051,7 +1053,7 @@ static int macvlan_device_event(struct notifier_block *unused,
+@@ -1052,7 +1054,7 @@ static int macvlan_device_event(struct notifier_block *unused,
return NOTIFY_DONE;
}
@@ -47201,19 +46929,6 @@ index 72ff14b..11d442d 100644
break;
err = 0;
break;
-diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
-index 0180531..1aff970 100644
---- a/drivers/net/ppp/pptp.c
-+++ b/drivers/net/ppp/pptp.c
-@@ -281,7 +281,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
- nf_reset(skb);
-
- skb->ip_summed = CHECKSUM_NONE;
-- ip_select_ident(skb, &rt->dst, NULL);
-+ ip_select_ident(skb, NULL);
- ip_send_check(iph);
-
- ip_local_out(skb);
diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
index 1252d9c..80e660b 100644
--- a/drivers/net/slip/slhc.c
@@ -62177,6 +61892,185 @@ index e846a32..bb06bd0 100644
put_cpu_var(last_ino);
return res;
}
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index 4a9e10e..a9daccb 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -61,7 +61,7 @@ static void isofs_put_super(struct super_block *sb)
+ return;
+ }
+
+-static int isofs_read_inode(struct inode *);
++static int isofs_read_inode(struct inode *, int relocated);
+ static int isofs_statfs (struct dentry *, struct kstatfs *);
+
+ static struct kmem_cache *isofs_inode_cachep;
+@@ -1258,7 +1258,7 @@ out_toomany:
+ goto out;
+ }
+
+-static int isofs_read_inode(struct inode *inode)
++static int isofs_read_inode(struct inode *inode, int relocated)
+ {
+ struct super_block *sb = inode->i_sb;
+ struct isofs_sb_info *sbi = ISOFS_SB(sb);
+@@ -1403,7 +1403,7 @@ static int isofs_read_inode(struct inode *inode)
+ */
+
+ if (!high_sierra) {
+- parse_rock_ridge_inode(de, inode);
++ parse_rock_ridge_inode(de, inode, relocated);
+ /* if we want uid/gid set, override the rock ridge setting */
+ if (sbi->s_uid_set)
+ inode->i_uid = sbi->s_uid;
+@@ -1482,9 +1482,10 @@ static int isofs_iget5_set(struct inode *ino, void *data)
+ * offset that point to the underlying meta-data for the inode. The
+ * code below is otherwise similar to the iget() code in
+ * include/linux/fs.h */
+-struct inode *isofs_iget(struct super_block *sb,
+- unsigned long block,
+- unsigned long offset)
++struct inode *__isofs_iget(struct super_block *sb,
++ unsigned long block,
++ unsigned long offset,
++ int relocated)
+ {
+ unsigned long hashval;
+ struct inode *inode;
+@@ -1506,7 +1507,7 @@ struct inode *isofs_iget(struct super_block *sb,
+ return ERR_PTR(-ENOMEM);
+
+ if (inode->i_state & I_NEW) {
+- ret = isofs_read_inode(inode);
++ ret = isofs_read_inode(inode, relocated);
+ if (ret < 0) {
+ iget_failed(inode);
+ inode = ERR_PTR(ret);
+diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h
+index 9916723..0ac4c1f 100644
+--- a/fs/isofs/isofs.h
++++ b/fs/isofs/isofs.h
+@@ -107,7 +107,7 @@ extern int iso_date(char *, int);
+
+ struct inode; /* To make gcc happy */
+
+-extern int parse_rock_ridge_inode(struct iso_directory_record *, struct inode *);
++extern int parse_rock_ridge_inode(struct iso_directory_record *, struct inode *, int relocated);
+ extern int get_rock_ridge_filename(struct iso_directory_record *, char *, struct inode *);
+ extern int isofs_name_translate(struct iso_directory_record *, char *, struct inode *);
+
+@@ -118,9 +118,24 @@ extern struct dentry *isofs_lookup(struct inode *, struct dentry *, unsigned int
+ extern struct buffer_head *isofs_bread(struct inode *, sector_t);
+ extern int isofs_get_blocks(struct inode *, sector_t, struct buffer_head **, unsigned long);
+
+-extern struct inode *isofs_iget(struct super_block *sb,
+- unsigned long block,
+- unsigned long offset);
++struct inode *__isofs_iget(struct super_block *sb,
++ unsigned long block,
++ unsigned long offset,
++ int relocated);
++
++static inline struct inode *isofs_iget(struct super_block *sb,
++ unsigned long block,
++ unsigned long offset)
++{
++ return __isofs_iget(sb, block, offset, 0);
++}
++
++static inline struct inode *isofs_iget_reloc(struct super_block *sb,
++ unsigned long block,
++ unsigned long offset)
++{
++ return __isofs_iget(sb, block, offset, 1);
++}
+
+ /* Because the inode number is no longer relevant to finding the
+ * underlying meta-data for an inode, we are free to choose a more
+diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
+index c0bf424..f488bba 100644
+--- a/fs/isofs/rock.c
++++ b/fs/isofs/rock.c
+@@ -288,12 +288,16 @@ eio:
+ goto out;
+ }
+
++#define RR_REGARD_XA 1
++#define RR_RELOC_DE 2
++
+ static int
+ parse_rock_ridge_inode_internal(struct iso_directory_record *de,
+- struct inode *inode, int regard_xa)
++ struct inode *inode, int flags)
+ {
+ int symlink_len = 0;
+ int cnt, sig;
++ unsigned int reloc_block;
+ struct inode *reloc;
+ struct rock_ridge *rr;
+ int rootflag;
+@@ -305,7 +309,7 @@ parse_rock_ridge_inode_internal(struct iso_directory_record *de,
+
+ init_rock_state(&rs, inode);
+ setup_rock_ridge(de, inode, &rs);
+- if (regard_xa) {
++ if (flags & RR_REGARD_XA) {
+ rs.chr += 14;
+ rs.len -= 14;
+ if (rs.len < 0)
+@@ -485,12 +489,22 @@ repeat:
+ "relocated directory\n");
+ goto out;
+ case SIG('C', 'L'):
+- ISOFS_I(inode)->i_first_extent =
+- isonum_733(rr->u.CL.location);
+- reloc =
+- isofs_iget(inode->i_sb,
+- ISOFS_I(inode)->i_first_extent,
+- 0);
++ if (flags & RR_RELOC_DE) {
++ printk(KERN_ERR
++ "ISOFS: Recursive directory relocation "
++ "is not supported\n");
++ goto eio;
++ }
++ reloc_block = isonum_733(rr->u.CL.location);
++ if (reloc_block == ISOFS_I(inode)->i_iget5_block &&
++ ISOFS_I(inode)->i_iget5_offset == 0) {
++ printk(KERN_ERR
++ "ISOFS: Directory relocation points to "
++ "itself\n");
++ goto eio;
++ }
++ ISOFS_I(inode)->i_first_extent = reloc_block;
++ reloc = isofs_iget_reloc(inode->i_sb, reloc_block, 0);
+ if (IS_ERR(reloc)) {
+ ret = PTR_ERR(reloc);
+ goto out;
+@@ -637,9 +651,11 @@ static char *get_symlink_chunk(char *rpnt, struct rock_ridge *rr, char *plimit)
+ return rpnt;
+ }
+
+-int parse_rock_ridge_inode(struct iso_directory_record *de, struct inode *inode)
++int parse_rock_ridge_inode(struct iso_directory_record *de, struct inode *inode,
++ int relocated)
+ {
+- int result = parse_rock_ridge_inode_internal(de, inode, 0);
++ int flags = relocated ? RR_RELOC_DE : 0;
++ int result = parse_rock_ridge_inode_internal(de, inode, flags);
+
+ /*
+ * if rockridge flag was reset and we didn't look for attributes
+@@ -647,7 +663,8 @@ int parse_rock_ridge_inode(struct iso_directory_record *de, struct inode *inode)
+ */
+ if ((ISOFS_SB(inode->i_sb)->s_rock_offset == -1)
+ && (ISOFS_SB(inode->i_sb)->s_rock == 2)) {
+- result = parse_rock_ridge_inode_internal(de, inode, 14);
++ result = parse_rock_ridge_inode_internal(de, inode,
++ flags | RR_REGARD_XA);
+ }
+ return result;
+ }
diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
index 4a6cf28..d3a29d3 100644
--- a/fs/jffs2/erase.c
@@ -65877,7 +65771,7 @@ index 467bb1c..cf9d65a 100644
return -EINVAL;
diff --git a/fs/seq_file.c b/fs/seq_file.c
-index 1d641bb..c2f4743 100644
+index 1d641bb..9ca7f61 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -10,6 +10,8 @@
@@ -65970,6 +65864,15 @@ index 1d641bb..c2f4743 100644
int res = -ENOMEM;
if (op) {
+@@ -605,7 +620,7 @@ EXPORT_SYMBOL(single_open);
+ int single_open_size(struct file *file, int (*show)(struct seq_file *, void *),
+ void *data, size_t size)
+ {
+- char *buf = kmalloc(size, GFP_KERNEL);
++ char *buf = kmalloc(size, GFP_KERNEL | GFP_USERCOPY);
+ int ret;
+ if (!buf)
+ return -ENOMEM;
@@ -620,6 +635,17 @@ int single_open_size(struct file *file, int (*show)(struct seq_file *, void *),
}
EXPORT_SYMBOL(single_open_size);
@@ -66526,10 +66429,10 @@ index 78e62cc..eec3706 100644
diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
new file mode 100644
-index 0000000..bfd482c
+index 0000000..27cec32
--- /dev/null
+++ b/grsecurity/Kconfig
-@@ -0,0 +1,1176 @@
+@@ -0,0 +1,1166 @@
+#
+# grecurity configuration
+#
@@ -67462,16 +67365,6 @@ index 0000000..bfd482c
+menu "Network Protections"
+depends on GRKERNSEC
+
-+config GRKERNSEC_RANDNET
-+ bool "Larger entropy pools"
-+ default y if GRKERNSEC_CONFIG_AUTO
-+ help
-+ If you say Y here, the entropy pools used for many features of Linux
-+ and grsecurity will be doubled in size. Since several grsecurity
-+ features use additional randomness, it is recommended that you say Y
-+ here. Saying Y here has a similar effect as modifying
-+ /proc/sys/kernel/random/poolsize.
-+
+config GRKERNSEC_BLACKHOLE
+ bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
+ default y if GRKERNSEC_CONFIG_AUTO
@@ -70564,10 +70457,10 @@ index 0000000..18ffbbd
+}
diff --git a/grsecurity/gracl_cap.c b/grsecurity/gracl_cap.c
new file mode 100644
-index 0000000..bdd51ea
+index 0000000..1a94c11
--- /dev/null
+++ b/grsecurity/gracl_cap.c
-@@ -0,0 +1,110 @@
+@@ -0,0 +1,127 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/sched.h>
@@ -70578,6 +70471,29 @@ index 0000000..bdd51ea
+extern const char *captab_log[];
+extern int captab_log_entries;
+
++int gr_learn_cap(const struct task_struct *task, const struct cred *cred, const int cap)
++{
++ struct acl_subject_label *curracl;
++
++ if (!gr_acl_is_enabled())
++ return 1;
++
++ curracl = task->acl;
++
++ if (curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
++ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
++ task->role->roletype, GR_GLOBAL_UID(cred->uid),
++ GR_GLOBAL_GID(cred->gid), task->exec_file ?
++ gr_to_filename(task->exec_file->f_path.dentry,
++ task->exec_file->f_path.mnt) : curracl->filename,
++ curracl->filename, 0UL,
++ 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
++ return 1;
++ }
++
++ return 0;
++}
++
+int gr_task_acl_is_capable(const struct task_struct *task, const struct cred *cred, const int cap)
+{
+ struct acl_subject_label *curracl;
@@ -70614,19 +70530,13 @@ index 0000000..bdd51ea
+ return 1;
+ }
+
-+ curracl = task->acl;
-+
-+ if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
-+ && cap_raised(cred->cap_effective, cap)) {
-+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
-+ task->role->roletype, GR_GLOBAL_UID(cred->uid),
-+ GR_GLOBAL_GID(cred->gid), task->exec_file ?
-+ gr_to_filename(task->exec_file->f_path.dentry,
-+ task->exec_file->f_path.mnt) : curracl->filename,
-+ curracl->filename, 0UL,
-+ 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
++ /* only learn the capability use if the process has the capability in the
++ general case, the two uses in sys.c of gr_learn_cap are an exception
++ to this rule to ensure any role transition involves what the full-learned
++ policy believes in a privileged process
++ */
++ if (cap_raised(cred->cap_effective, cap) && gr_learn_cap(task, cred, cap))
+ return 1;
-+ }
+
+ if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
@@ -74649,10 +74559,10 @@ index 0000000..baa635c
+}
diff --git a/grsecurity/grsec_disabled.c b/grsecurity/grsec_disabled.c
new file mode 100644
-index 0000000..4d6fce8
+index 0000000..1e028d7
--- /dev/null
+++ b/grsecurity/grsec_disabled.c
-@@ -0,0 +1,433 @@
+@@ -0,0 +1,439 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/sched.h>
@@ -74694,6 +74604,12 @@ index 0000000..4d6fce8
+ return 0;
+}
+
++int
++gr_learn_cap(const struct task_struct *task, const struct cred *cred, const int cap)
++{
++ return 0;
++}
++
+void
+gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
+{
@@ -75088,10 +75004,10 @@ index 0000000..4d6fce8
+#endif
diff --git a/grsecurity/grsec_exec.c b/grsecurity/grsec_exec.c
new file mode 100644
-index 0000000..f35f454
+index 0000000..14638ff
--- /dev/null
+++ b/grsecurity/grsec_exec.c
-@@ -0,0 +1,187 @@
+@@ -0,0 +1,188 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/file.h>
@@ -75226,7 +75142,8 @@ index 0000000..f35f454
+ "CAP_MAC_OVERRIDE",
+ "CAP_MAC_ADMIN",
+ "CAP_SYSLOG",
-+ "CAP_WAKE_ALARM"
++ "CAP_WAKE_ALARM",
++ "CAP_BLOCK_SUSPEND"
+};
+
+int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]);
@@ -77334,10 +77251,10 @@ index 0000000..61b514e
+EXPORT_SYMBOL_GPL(gr_log_timechange);
diff --git a/grsecurity/grsec_tpe.c b/grsecurity/grsec_tpe.c
new file mode 100644
-index 0000000..ee57dcf
+index 0000000..d1953de
--- /dev/null
+++ b/grsecurity/grsec_tpe.c
-@@ -0,0 +1,73 @@
+@@ -0,0 +1,78 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/file.h>
@@ -77351,6 +77268,7 @@ index 0000000..ee57dcf
+{
+#ifdef CONFIG_GRKERNSEC
+ struct inode *inode = file->f_path.dentry->d_parent->d_inode;
++ struct inode *file_inode = file->f_path.dentry->d_inode;
+ const struct cred *cred = current_cred();
+ char *msg = NULL;
+ char *msg2 = NULL;
@@ -77383,6 +77301,8 @@ index 0000000..ee57dcf
+ msg2 = "file in world-writable directory";
+ else if (inode->i_mode & S_IWGRP)
+ msg2 = "file in group-writable directory";
++ else if (file_inode->i_mode & S_IWOTH)
++ msg2 = "file is world-writable";
+
+ if (msg && msg2) {
+ char fullmsg[70] = {0};
@@ -77402,6 +77322,8 @@ index 0000000..ee57dcf
+ msg = "file in world-writable directory";
+ else if (inode->i_mode & S_IWGRP)
+ msg = "file in group-writable directory";
++ else if (file_inode->i_mode & S_IWOTH)
++ msg = "file is world-writable";
+
+ if (msg) {
+ gr_log_str_fs(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, msg, file->f_path.dentry, file->f_path.mnt);
@@ -80455,10 +80377,10 @@ index 0000000..b02ba9d
+#define GR_MSRWRITE_MSG "denied write to CPU MSR by "
diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
new file mode 100644
-index 0000000..b87dd26
+index 0000000..acda855
--- /dev/null
+++ b/include/linux/grsecurity.h
-@@ -0,0 +1,252 @@
+@@ -0,0 +1,254 @@
+#ifndef GR_SECURITY_H
+#define GR_SECURITY_H
+#include <linux/fs.h>
@@ -80498,6 +80420,8 @@ index 0000000..b87dd26
+int gr_check_user_change(kuid_t real, kuid_t effective, kuid_t fs);
+int gr_check_group_change(kgid_t real, kgid_t effective, kgid_t fs);
+
++int gr_learn_cap(const struct task_struct *task, const struct cred *cred, const int cap);
++
+void gr_del_task_from_ip_table(struct task_struct *p);
+
+int gr_pid_is_chrooted(struct task_struct *p);
@@ -84291,52 +84215,20 @@ index c55aeed..b3393f4 100644
/** inet_connection_sock - INET connection oriented sock
*
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
-index 058271b..1af4453 100644
+index 823ec7b..1af4453 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
-@@ -41,14 +41,13 @@ struct inet_peer {
- struct rcu_head gc_rcu;
- };
- /*
-- * Once inet_peer is queued for deletion (refcnt == -1), following fields
-- * are not available: rid, ip_id_count
-+ * Once inet_peer is queued for deletion (refcnt == -1), following field
-+ * is not available: rid
- * We can share memory with rcu_head to help keep inet_peer small.
+@@ -47,7 +47,7 @@ struct inet_peer {
*/
union {
struct {
- atomic_t rid; /* Frag reception counter */
-- atomic_t ip_id_count; /* IP ID for the next packet */
+ atomic_unchecked_t rid; /* Frag reception counter */
};
struct rcu_head rcu;
struct inet_peer *gc_next;
-@@ -165,7 +164,7 @@ bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout);
- void inetpeer_invalidate_tree(struct inet_peer_base *);
-
- /*
-- * temporary check to make sure we dont access rid, ip_id_count, tcp_ts,
-+ * temporary check to make sure we dont access rid, tcp_ts,
- * tcp_ts_stamp if no refcount is taken on inet_peer
- */
- static inline void inet_peer_refcheck(const struct inet_peer *p)
-@@ -173,13 +172,4 @@ static inline void inet_peer_refcheck(const struct inet_peer *p)
- WARN_ON_ONCE(atomic_read(&p->refcnt) <= 0);
- }
-
--
--/* can be called with or without local BH being disabled */
--static inline int inet_getid(struct inet_peer *p, int more)
--{
-- more++;
-- inet_peer_refcheck(p);
-- return atomic_add_return(more, &p->ip_id_count) - more;
--}
--
- #endif /* _NET_INETPEER_H */
diff --git a/include/net/ip.h b/include/net/ip.h
-index 23be0fd..7251808 100644
+index 937f196..7251808 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -214,7 +214,7 @@ static inline void snmp_mib_free(void __percpu *ptr[SNMP_ARRAY_SZ])
@@ -84348,55 +84240,15 @@ index 23be0fd..7251808 100644
static inline int inet_is_reserved_local_port(int port)
{
return test_bit(port, sysctl_local_reserved_ports);
-@@ -297,9 +297,10 @@ static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb)
+@@ -297,7 +297,7 @@ static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb)
}
}
--void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more);
+-u32 ip_idents_reserve(u32 hash, int segs);
+u32 ip_idents_reserve(u32 hash, int segs) __intentional_overflow(-1);
-+void __ip_select_ident(struct iphdr *iph, int segs);
-
--static inline void ip_select_ident(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk)
-+static inline void ip_select_ident_segs(struct sk_buff *skb, struct sock *sk, int segs)
- {
- struct iphdr *iph = ip_hdr(skb);
-
-@@ -309,24 +310,20 @@ static inline void ip_select_ident(struct sk_buff *skb, struct dst_entry *dst, s
- * does not change, they drop every other packet in
- * a TCP stream using header compression.
- */
-- iph->id = (sk && inet_sk(sk)->inet_daddr) ?
-- htons(inet_sk(sk)->inet_id++) : 0;
-- } else
-- __ip_select_ident(iph, dst, 0);
--}
--
--static inline void ip_select_ident_more(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk, int more)
--{
-- struct iphdr *iph = ip_hdr(skb);
--
-- if ((iph->frag_off & htons(IP_DF)) && !skb->local_df) {
- if (sk && inet_sk(sk)->inet_daddr) {
- iph->id = htons(inet_sk(sk)->inet_id);
-- inet_sk(sk)->inet_id += 1 + more;
-- } else
-+ inet_sk(sk)->inet_id += segs;
-+ } else {
- iph->id = 0;
-- } else
-- __ip_select_ident(iph, dst, more);
-+ }
-+ } else {
-+ __ip_select_ident(iph, segs);
-+ }
-+}
-+
-+static inline void ip_select_ident(struct sk_buff *skb, struct sock *sk)
-+{
-+ ip_select_ident_segs(skb, sk, 1);
- }
+ void __ip_select_ident(struct iphdr *iph, int segs);
- /*
+ static inline void ip_select_ident_segs(struct sk_buff *skb, struct sock *sk, int segs)
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 9922093..a1755d6 100644
--- a/include/net/ip_fib.h
@@ -84446,19 +84298,6 @@ index 5679d92..2e7a690 100644
/* ip_vs_est */
struct list_head est_list; /* estimator list */
spinlock_t est_lock;
-diff --git a/include/net/ipv6.h b/include/net/ipv6.h
-index 4f541f1..9ac6578 100644
---- a/include/net/ipv6.h
-+++ b/include/net/ipv6.h
-@@ -660,8 +660,6 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add
- return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
- }
-
--void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
--
- int ip6_dst_hoplimit(struct dst_entry *dst);
-
- /*
diff --git a/include/net/irda/ircomm_tty.h b/include/net/irda/ircomm_tty.h
index 8d4f588..2e37ad2 100644
--- a/include/net/irda/ircomm_tty.h
@@ -84859,19 +84698,6 @@ index 0dfcc92..7967849 100644
/* Structure to track chunk fragments that have been acked, but peer
-diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
-index f257486..3f36d45 100644
---- a/include/net/secure_seq.h
-+++ b/include/net/secure_seq.h
-@@ -3,8 +3,6 @@
-
- #include <linux/types.h>
-
--__u32 secure_ip_id(__be32 daddr);
--__u32 secure_ipv6_id(const __be32 daddr[4]);
- u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
- u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
- __be16 dport);
diff --git a/include/net/sock.h b/include/net/sock.h
index 2f7bc43..530dadc 100644
--- a/include/net/sock.h
@@ -86524,10 +86350,25 @@ index 1191a44..7c81292 100644
+}
+EXPORT_SYMBOL(capable_wrt_inode_uidgid_nolog);
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 0c753dd..dd7d3d6 100644
+index 0c753dd..3ce8cca 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
-@@ -5372,7 +5372,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
+@@ -5190,6 +5190,14 @@ static void cgroup_release_agent(struct work_struct *work)
+ release_list);
+ list_del_init(&cgrp->release_list);
+ raw_spin_unlock(&release_list_lock);
++
++ /*
++ * don't bother calling call_usermodehelper if we haven't
++ * configured a binary to execute
++ */
++ if (cgrp->root->release_agent_path[0] == '\0')
++ goto continue_free;
++
+ pathbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ if (!pathbuf)
+ goto continue_free;
+@@ -5372,7 +5380,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
struct css_set *cset = link->cset;
struct task_struct *task;
int count = 0;
@@ -91154,7 +90995,7 @@ index 490fcbb..1e502c6 100644
.thread_should_run = ksoftirqd_should_run,
.thread_fn = run_ksoftirqd,
diff --git a/kernel/sys.c b/kernel/sys.c
-index c0a58be..784c618 100644
+index c0a58be..95e292b 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -148,6 +148,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
@@ -91170,17 +91011,28 @@ index c0a58be..784c618 100644
no_nice = security_task_setnice(p, niceval);
if (no_nice) {
error = no_nice;
-@@ -351,6 +357,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
+@@ -351,6 +357,20 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
goto error;
}
+ if (gr_check_group_change(new->gid, new->egid, INVALID_GID))
+ goto error;
+
++ if (!gid_eq(new->gid, old->gid)) {
++ /* make sure we generate a learn log for what will
++ end up being a role transition after a full-learning
++ policy is generated
++ CAP_SETGID is required to perform a transition
++ we may not log a CAP_SETGID check above, e.g.
++ in the case where new rgid = old egid
++ */
++ gr_learn_cap(current, new, CAP_SETGID);
++ }
++
if (rgid != (gid_t) -1 ||
(egid != (gid_t) -1 && !gid_eq(kegid, old->gid)))
new->sgid = new->egid;
-@@ -386,6 +395,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
+@@ -386,6 +406,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
old = current_cred();
retval = -EPERM;
@@ -91191,7 +91043,7 @@ index c0a58be..784c618 100644
if (ns_capable(old->user_ns, CAP_SETGID))
new->gid = new->egid = new->sgid = new->fsgid = kgid;
else if (gid_eq(kgid, old->gid) || gid_eq(kgid, old->sgid))
-@@ -403,7 +416,7 @@ error:
+@@ -403,7 +427,7 @@ error:
/*
* change the user struct in a credentials set to match the new UID
*/
@@ -91200,7 +91052,7 @@ index c0a58be..784c618 100644
{
struct user_struct *new_user;
-@@ -483,6 +496,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
+@@ -483,7 +507,18 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
goto error;
}
@@ -91208,9 +91060,18 @@ index c0a58be..784c618 100644
+ goto error;
+
if (!uid_eq(new->uid, old->uid)) {
++ /* make sure we generate a learn log for what will
++ end up being a role transition after a full-learning
++ policy is generated
++ CAP_SETUID is required to perform a transition
++ we may not log a CAP_SETUID check above, e.g.
++ in the case where new ruid = old euid
++ */
++ gr_learn_cap(current, new, CAP_SETUID);
retval = set_user(new);
if (retval < 0)
-@@ -533,6 +549,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
+ goto error;
+@@ -533,6 +568,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
old = current_cred();
retval = -EPERM;
@@ -91223,7 +91084,7 @@ index c0a58be..784c618 100644
if (ns_capable(old->user_ns, CAP_SETUID)) {
new->suid = new->uid = kuid;
if (!uid_eq(kuid, old->uid)) {
-@@ -602,6 +624,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
+@@ -602,6 +643,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
goto error;
}
@@ -91233,7 +91094,7 @@ index c0a58be..784c618 100644
if (ruid != (uid_t) -1) {
new->uid = kruid;
if (!uid_eq(kruid, old->uid)) {
-@@ -684,6 +709,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
+@@ -684,6 +728,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
goto error;
}
@@ -91243,7 +91104,7 @@ index c0a58be..784c618 100644
if (rgid != (gid_t) -1)
new->gid = krgid;
if (egid != (gid_t) -1)
-@@ -745,12 +773,16 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
+@@ -745,12 +792,16 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
uid_eq(kuid, old->suid) || uid_eq(kuid, old->fsuid) ||
ns_capable(old->user_ns, CAP_SETUID)) {
if (!uid_eq(kuid, old->fsuid)) {
@@ -91260,7 +91121,7 @@ index c0a58be..784c618 100644
abort_creds(new);
return old_fsuid;
-@@ -783,12 +815,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
+@@ -783,12 +834,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
if (gid_eq(kgid, old->gid) || gid_eq(kgid, old->egid) ||
gid_eq(kgid, old->sgid) || gid_eq(kgid, old->fsgid) ||
ns_capable(old->user_ns, CAP_SETGID)) {
@@ -91277,7 +91138,7 @@ index c0a58be..784c618 100644
abort_creds(new);
return old_fsgid;
-@@ -1167,19 +1203,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
+@@ -1167,19 +1222,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
return -EFAULT;
down_read(&uts_sem);
@@ -91302,7 +91163,7 @@ index c0a58be..784c618 100644
__OLD_UTS_LEN);
error |= __put_user(0, name->machine + __OLD_UTS_LEN);
up_read(&uts_sem);
-@@ -1381,6 +1417,13 @@ int do_prlimit(struct task_struct *tsk, unsigned int resource,
+@@ -1381,6 +1436,13 @@ int do_prlimit(struct task_struct *tsk, unsigned int resource,
*/
new_rlim->rlim_cur = 1;
}
@@ -94567,7 +94428,7 @@ index b1eb536..091d154 100644
capable(CAP_IPC_LOCK))
ret = do_mlockall(flags);
diff --git a/mm/mmap.c b/mm/mmap.c
-index 20ff0c3..a9eda98 100644
+index 20ff0c3..005dc47 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -36,6 +36,7 @@
@@ -94640,15 +94501,20 @@ index 20ff0c3..a9eda98 100644
if (vma->vm_ops && vma->vm_ops->close)
vma->vm_ops->close(vma);
if (vma->vm_file)
-@@ -290,6 +312,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
+@@ -290,6 +312,12 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
* not page aligned -Ram Gupta
*/
rlim = rlimit(RLIMIT_DATA);
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++ /* force a minimum 16MB brk heap on setuid/setgid binaries */
++ if (rlim < PAGE_SIZE && (get_dumpable(mm) != SUID_DUMP_USER) && gr_is_global_nonroot(current_uid()))
++ rlim = 4096 * PAGE_SIZE;
++#endif
+ gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
(mm->end_data - mm->start_data) > rlim)
goto out;
-@@ -940,6 +963,12 @@ static int
+@@ -940,6 +968,12 @@ static int
can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
{
@@ -94661,7 +94527,7 @@ index 20ff0c3..a9eda98 100644
if (is_mergeable_vma(vma, file, vm_flags) &&
is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
if (vma->vm_pgoff == vm_pgoff)
-@@ -959,6 +988,12 @@ static int
+@@ -959,6 +993,12 @@ static int
can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
{
@@ -94674,7 +94540,7 @@ index 20ff0c3..a9eda98 100644
if (is_mergeable_vma(vma, file, vm_flags) &&
is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
pgoff_t vm_pglen;
-@@ -1001,13 +1036,20 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
+@@ -1001,13 +1041,20 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
struct vm_area_struct *vma_merge(struct mm_struct *mm,
struct vm_area_struct *prev, unsigned long addr,
unsigned long end, unsigned long vm_flags,
@@ -94696,7 +94562,7 @@ index 20ff0c3..a9eda98 100644
/*
* We later require that vma->vm_flags == vm_flags,
* so this tests vma->vm_flags & VM_SPECIAL, too.
-@@ -1023,6 +1065,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+@@ -1023,6 +1070,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
if (next && next->vm_end == end) /* cases 6, 7, 8 */
next = next->vm_next;
@@ -94712,7 +94578,7 @@ index 20ff0c3..a9eda98 100644
/*
* Can it merge with the predecessor?
*/
-@@ -1042,9 +1093,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+@@ -1042,9 +1098,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
/* cases 1, 6 */
err = vma_adjust(prev, prev->vm_start,
next->vm_end, prev->vm_pgoff, NULL);
@@ -94738,7 +94604,7 @@ index 20ff0c3..a9eda98 100644
if (err)
return NULL;
khugepaged_enter_vma_merge(prev);
-@@ -1058,12 +1124,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+@@ -1058,12 +1129,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
mpol_equal(policy, vma_policy(next)) &&
can_vma_merge_before(next, vm_flags,
anon_vma, file, pgoff+pglen)) {
@@ -94768,7 +94634,7 @@ index 20ff0c3..a9eda98 100644
if (err)
return NULL;
khugepaged_enter_vma_merge(area);
-@@ -1172,8 +1253,10 @@ none:
+@@ -1172,8 +1258,10 @@ none:
void vm_stat_account(struct mm_struct *mm, unsigned long flags,
struct file *file, long pages)
{
@@ -94781,7 +94647,7 @@ index 20ff0c3..a9eda98 100644
mm->total_vm += pages;
-@@ -1181,7 +1264,7 @@ void vm_stat_account(struct mm_struct *mm, unsigned long flags,
+@@ -1181,7 +1269,7 @@ void vm_stat_account(struct mm_struct *mm, unsigned long flags,
mm->shared_vm += pages;
if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
mm->exec_vm += pages;
@@ -94790,7 +94656,7 @@ index 20ff0c3..a9eda98 100644
mm->stack_vm += pages;
}
#endif /* CONFIG_PROC_FS */
-@@ -1211,6 +1294,7 @@ static inline int mlock_future_check(struct mm_struct *mm,
+@@ -1211,6 +1299,7 @@ static inline int mlock_future_check(struct mm_struct *mm,
locked += mm->locked_vm;
lock_limit = rlimit(RLIMIT_MEMLOCK);
lock_limit >>= PAGE_SHIFT;
@@ -94798,7 +94664,7 @@ index 20ff0c3..a9eda98 100644
if (locked > lock_limit && !capable(CAP_IPC_LOCK))
return -EAGAIN;
}
-@@ -1237,7 +1321,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1237,7 +1326,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
* (the exception is when the underlying filesystem is noexec
* mounted, in which case we dont add PROT_EXEC.)
*/
@@ -94807,7 +94673,7 @@ index 20ff0c3..a9eda98 100644
if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
prot |= PROT_EXEC;
-@@ -1263,7 +1347,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1263,7 +1352,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
/* Obtain the address to map to. we verify (or select) it and ensure
* that it represents a valid section of the address space.
*/
@@ -94816,7 +94682,7 @@ index 20ff0c3..a9eda98 100644
if (addr & ~PAGE_MASK)
return addr;
-@@ -1274,6 +1358,43 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1274,6 +1363,43 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
@@ -94860,7 +94726,7 @@ index 20ff0c3..a9eda98 100644
if (flags & MAP_LOCKED)
if (!can_do_mlock())
return -EPERM;
-@@ -1361,6 +1482,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1361,6 +1487,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
vm_flags |= VM_NORESERVE;
}
@@ -94870,7 +94736,7 @@ index 20ff0c3..a9eda98 100644
addr = mmap_region(file, addr, len, vm_flags, pgoff);
if (!IS_ERR_VALUE(addr) &&
((vm_flags & VM_LOCKED) ||
-@@ -1454,7 +1578,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
+@@ -1454,7 +1583,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
vm_flags_t vm_flags = vma->vm_flags;
/* If it was private or non-writable, the write bit is already clear */
@@ -94879,7 +94745,7 @@ index 20ff0c3..a9eda98 100644
return 0;
/* The backer wishes to know when pages are first written to? */
-@@ -1500,7 +1624,22 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+@@ -1500,7 +1629,22 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
struct rb_node **rb_link, *rb_parent;
unsigned long charged = 0;
@@ -94902,7 +94768,7 @@ index 20ff0c3..a9eda98 100644
if (!may_expand_vm(mm, len >> PAGE_SHIFT)) {
unsigned long nr_pages;
-@@ -1519,11 +1658,10 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+@@ -1519,11 +1663,10 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
/* Clear old maps */
error = -ENOMEM;
@@ -94915,7 +94781,7 @@ index 20ff0c3..a9eda98 100644
}
/*
-@@ -1554,6 +1692,16 @@ munmap_back:
+@@ -1554,6 +1697,16 @@ munmap_back:
goto unacct_error;
}
@@ -94932,7 +94798,7 @@ index 20ff0c3..a9eda98 100644
vma->vm_mm = mm;
vma->vm_start = addr;
vma->vm_end = addr + len;
-@@ -1573,6 +1721,13 @@ munmap_back:
+@@ -1573,6 +1726,13 @@ munmap_back:
if (error)
goto unmap_and_free_vma;
@@ -94946,7 +94812,7 @@ index 20ff0c3..a9eda98 100644
/* Can addr have changed??
*
* Answer: Yes, several device drivers can do it in their
-@@ -1606,6 +1761,12 @@ munmap_back:
+@@ -1606,6 +1766,12 @@ munmap_back:
}
vma_link(mm, vma, prev, rb_link, rb_parent);
@@ -94959,7 +94825,7 @@ index 20ff0c3..a9eda98 100644
/* Once vma denies write, undo our temporary denial count */
if (vm_flags & VM_DENYWRITE)
allow_write_access(file);
-@@ -1614,6 +1775,7 @@ out:
+@@ -1614,6 +1780,7 @@ out:
perf_event_mmap(vma);
vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
@@ -94967,7 +94833,7 @@ index 20ff0c3..a9eda98 100644
if (vm_flags & VM_LOCKED) {
if (!((vm_flags & VM_SPECIAL) || is_vm_hugetlb_page(vma) ||
vma == get_gate_vma(current->mm)))
-@@ -1646,6 +1808,12 @@ unmap_and_free_vma:
+@@ -1646,6 +1813,12 @@ unmap_and_free_vma:
unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
charged = 0;
free_vma:
@@ -94980,7 +94846,7 @@ index 20ff0c3..a9eda98 100644
kmem_cache_free(vm_area_cachep, vma);
unacct_error:
if (charged)
-@@ -1653,7 +1821,63 @@ unacct_error:
+@@ -1653,7 +1826,63 @@ unacct_error:
return error;
}
@@ -95045,7 +94911,7 @@ index 20ff0c3..a9eda98 100644
{
/*
* We implement the search by looking for an rbtree node that
-@@ -1701,11 +1925,29 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
+@@ -1701,11 +1930,29 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
}
}
@@ -95076,7 +94942,7 @@ index 20ff0c3..a9eda98 100644
if (gap_end >= low_limit && gap_end - gap_start >= length)
goto found;
-@@ -1755,7 +1997,7 @@ found:
+@@ -1755,7 +2002,7 @@ found:
return gap_start;
}
@@ -95085,7 +94951,7 @@ index 20ff0c3..a9eda98 100644
{
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
-@@ -1809,6 +2051,24 @@ check_current:
+@@ -1809,6 +2056,24 @@ check_current:
gap_end = vma->vm_start;
if (gap_end < low_limit)
return -ENOMEM;
@@ -95110,7 +94976,7 @@ index 20ff0c3..a9eda98 100644
if (gap_start <= high_limit && gap_end - gap_start >= length)
goto found;
-@@ -1872,6 +2132,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1872,6 +2137,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
struct vm_unmapped_area_info info;
@@ -95118,7 +94984,7 @@ index 20ff0c3..a9eda98 100644
if (len > TASK_SIZE - mmap_min_addr)
return -ENOMEM;
-@@ -1879,11 +2140,15 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1879,11 +2145,15 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
if (flags & MAP_FIXED)
return addr;
@@ -95135,7 +95001,7 @@ index 20ff0c3..a9eda98 100644
return addr;
}
-@@ -1892,6 +2157,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1892,6 +2162,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
info.low_limit = mm->mmap_base;
info.high_limit = TASK_SIZE;
info.align_mask = 0;
@@ -95143,7 +95009,7 @@ index 20ff0c3..a9eda98 100644
return vm_unmapped_area(&info);
}
#endif
-@@ -1910,6 +2176,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1910,6 +2181,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
struct mm_struct *mm = current->mm;
unsigned long addr = addr0;
struct vm_unmapped_area_info info;
@@ -95151,7 +95017,7 @@ index 20ff0c3..a9eda98 100644
/* requested length too big for entire address space */
if (len > TASK_SIZE - mmap_min_addr)
-@@ -1918,12 +2185,16 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1918,12 +2190,16 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
if (flags & MAP_FIXED)
return addr;
@@ -95169,7 +95035,7 @@ index 20ff0c3..a9eda98 100644
return addr;
}
-@@ -1932,6 +2203,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1932,6 +2208,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
info.low_limit = max(PAGE_SIZE, mmap_min_addr);
info.high_limit = mm->mmap_base;
info.align_mask = 0;
@@ -95177,7 +95043,7 @@ index 20ff0c3..a9eda98 100644
addr = vm_unmapped_area(&info);
/*
-@@ -1944,6 +2216,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1944,6 +2221,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
VM_BUG_ON(addr != -ENOMEM);
info.flags = 0;
info.low_limit = TASK_UNMAPPED_BASE;
@@ -95190,7 +95056,7 @@ index 20ff0c3..a9eda98 100644
info.high_limit = TASK_SIZE;
addr = vm_unmapped_area(&info);
}
-@@ -2045,6 +2323,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
+@@ -2045,6 +2328,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
return vma;
}
@@ -95219,7 +95085,7 @@ index 20ff0c3..a9eda98 100644
/*
* Verify that the stack growth is acceptable and
* update accounting. This is shared with both the
-@@ -2061,6 +2361,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2061,6 +2366,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
return -ENOMEM;
/* Stack limit test */
@@ -95227,7 +95093,7 @@ index 20ff0c3..a9eda98 100644
if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
return -ENOMEM;
-@@ -2071,6 +2372,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2071,6 +2377,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
locked = mm->locked_vm + grow;
limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
limit >>= PAGE_SHIFT;
@@ -95235,7 +95101,7 @@ index 20ff0c3..a9eda98 100644
if (locked > limit && !capable(CAP_IPC_LOCK))
return -ENOMEM;
}
-@@ -2100,37 +2402,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2100,37 +2407,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
* PA-RISC uses this for its stack; IA64 for its Register Backing Store.
* vma is the last one with address > vma->vm_end. Have to extend vma.
*/
@@ -95293,7 +95159,7 @@ index 20ff0c3..a9eda98 100644
unsigned long size, grow;
size = address - vma->vm_start;
-@@ -2165,6 +2478,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+@@ -2165,6 +2483,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
}
}
}
@@ -95302,7 +95168,7 @@ index 20ff0c3..a9eda98 100644
vma_unlock_anon_vma(vma);
khugepaged_enter_vma_merge(vma);
validate_mm(vma->vm_mm);
-@@ -2179,6 +2494,8 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2179,6 +2499,8 @@ int expand_downwards(struct vm_area_struct *vma,
unsigned long address)
{
int error;
@@ -95311,7 +95177,7 @@ index 20ff0c3..a9eda98 100644
/*
* We must make sure the anon_vma is allocated
-@@ -2192,6 +2509,15 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2192,6 +2514,15 @@ int expand_downwards(struct vm_area_struct *vma,
if (error)
return error;
@@ -95327,7 +95193,7 @@ index 20ff0c3..a9eda98 100644
vma_lock_anon_vma(vma);
/*
-@@ -2201,9 +2527,17 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2201,9 +2532,17 @@ int expand_downwards(struct vm_area_struct *vma,
*/
/* Somebody else might have raced and expanded it already */
@@ -95346,7 +95212,7 @@ index 20ff0c3..a9eda98 100644
size = vma->vm_end - address;
grow = (vma->vm_start - address) >> PAGE_SHIFT;
-@@ -2228,13 +2562,27 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2228,13 +2567,27 @@ int expand_downwards(struct vm_area_struct *vma,
vma->vm_pgoff -= grow;
anon_vma_interval_tree_post_update_vma(vma);
vma_gap_update(vma);
@@ -95374,7 +95240,7 @@ index 20ff0c3..a9eda98 100644
khugepaged_enter_vma_merge(vma);
validate_mm(vma->vm_mm);
return error;
-@@ -2332,6 +2680,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2332,6 +2685,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
do {
long nrpages = vma_pages(vma);
@@ -95388,7 +95254,7 @@ index 20ff0c3..a9eda98 100644
if (vma->vm_flags & VM_ACCOUNT)
nr_accounted += nrpages;
vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
-@@ -2376,6 +2731,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2376,6 +2736,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
insertion_point = (prev ? &prev->vm_next : &mm->mmap);
vma->vm_prev = NULL;
do {
@@ -95405,7 +95271,7 @@ index 20ff0c3..a9eda98 100644
vma_rb_erase(vma, &mm->mm_rb);
mm->map_count--;
tail_vma = vma;
-@@ -2401,14 +2766,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2401,14 +2771,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
struct vm_area_struct *new;
int err = -ENOMEM;
@@ -95439,7 +95305,7 @@ index 20ff0c3..a9eda98 100644
/* most fields are the same, copy all, and then fixup */
*new = *vma;
-@@ -2421,6 +2805,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2421,6 +2810,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
}
@@ -95462,7 +95328,7 @@ index 20ff0c3..a9eda98 100644
err = vma_dup_policy(vma, new);
if (err)
goto out_free_vma;
-@@ -2440,6 +2840,38 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2440,6 +2845,38 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
else
err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
@@ -95501,7 +95367,7 @@ index 20ff0c3..a9eda98 100644
/* Success. */
if (!err)
return 0;
-@@ -2449,10 +2881,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2449,10 +2886,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
new->vm_ops->close(new);
if (new->vm_file)
fput(new->vm_file);
@@ -95521,7 +95387,7 @@ index 20ff0c3..a9eda98 100644
kmem_cache_free(vm_area_cachep, new);
out_err:
return err;
-@@ -2465,6 +2905,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2465,6 +2910,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
unsigned long addr, int new_below)
{
@@ -95537,7 +95403,7 @@ index 20ff0c3..a9eda98 100644
if (mm->map_count >= sysctl_max_map_count)
return -ENOMEM;
-@@ -2476,11 +2925,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2476,11 +2930,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
* work. This now handles partial unmappings.
* Jeremy Fitzhardinge <jeremy@goop.org>
*/
@@ -95568,7 +95434,7 @@ index 20ff0c3..a9eda98 100644
if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
return -EINVAL;
-@@ -2555,6 +3023,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+@@ -2555,6 +3028,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
/* Fix up all other VM information */
remove_vma_list(mm, vma);
@@ -95577,7 +95443,7 @@ index 20ff0c3..a9eda98 100644
return 0;
}
-@@ -2563,6 +3033,13 @@ int vm_munmap(unsigned long start, size_t len)
+@@ -2563,6 +3038,13 @@ int vm_munmap(unsigned long start, size_t len)
int ret;
struct mm_struct *mm = current->mm;
@@ -95591,7 +95457,7 @@ index 20ff0c3..a9eda98 100644
down_write(&mm->mmap_sem);
ret = do_munmap(mm, start, len);
up_write(&mm->mmap_sem);
-@@ -2576,16 +3053,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+@@ -2576,16 +3058,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
return vm_munmap(addr, len);
}
@@ -95608,7 +95474,7 @@ index 20ff0c3..a9eda98 100644
/*
* this is really a simplified "do_mmap". it only handles
* anonymous maps. eventually we may be able to do some
-@@ -2599,6 +3066,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2599,6 +3071,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
struct rb_node ** rb_link, * rb_parent;
pgoff_t pgoff = addr >> PAGE_SHIFT;
int error;
@@ -95616,7 +95482,7 @@ index 20ff0c3..a9eda98 100644
len = PAGE_ALIGN(len);
if (!len)
-@@ -2606,10 +3074,24 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2606,10 +3079,24 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
@@ -95641,7 +95507,7 @@ index 20ff0c3..a9eda98 100644
error = mlock_future_check(mm, mm->def_flags, len);
if (error)
return error;
-@@ -2623,21 +3105,20 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2623,21 +3110,20 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
/*
* Clear old maps. this also does some error checking for us
*/
@@ -95666,7 +95532,7 @@ index 20ff0c3..a9eda98 100644
return -ENOMEM;
/* Can we just expand an old private anonymous mapping? */
-@@ -2651,7 +3132,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2651,7 +3137,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
*/
vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
if (!vma) {
@@ -95675,7 +95541,7 @@ index 20ff0c3..a9eda98 100644
return -ENOMEM;
}
-@@ -2665,10 +3146,11 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2665,10 +3151,11 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
vma_link(mm, vma, prev, rb_link, rb_parent);
out:
perf_event_mmap(vma);
@@ -95689,7 +95555,7 @@ index 20ff0c3..a9eda98 100644
return addr;
}
-@@ -2730,6 +3212,7 @@ void exit_mmap(struct mm_struct *mm)
+@@ -2730,6 +3217,7 @@ void exit_mmap(struct mm_struct *mm)
while (vma) {
if (vma->vm_flags & VM_ACCOUNT)
nr_accounted += vma_pages(vma);
@@ -95697,7 +95563,7 @@ index 20ff0c3..a9eda98 100644
vma = remove_vma(vma);
}
vm_unacct_memory(nr_accounted);
-@@ -2747,6 +3230,13 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2747,6 +3235,13 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
struct vm_area_struct *prev;
struct rb_node **rb_link, *rb_parent;
@@ -95711,7 +95577,7 @@ index 20ff0c3..a9eda98 100644
/*
* The vm_pgoff of a purely anonymous vma should be irrelevant
* until its first write fault, when page's anon_vma and index
-@@ -2770,7 +3260,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2770,7 +3265,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
security_vm_enough_memory_mm(mm, vma_pages(vma)))
return -ENOMEM;
@@ -95733,7 +95599,7 @@ index 20ff0c3..a9eda98 100644
return 0;
}
-@@ -2789,6 +3293,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2789,6 +3298,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
struct rb_node **rb_link, *rb_parent;
bool faulted_in_anon_vma = true;
@@ -95742,7 +95608,7 @@ index 20ff0c3..a9eda98 100644
/*
* If anonymous vma has not yet been faulted, update new pgoff
* to match new location, to increase its chance of merging.
-@@ -2853,6 +3359,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2853,6 +3364,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
return NULL;
}
@@ -95782,7 +95648,7 @@ index 20ff0c3..a9eda98 100644
/*
* Return true if the calling process may expand its vm space by the passed
* number of pages
-@@ -2864,6 +3403,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+@@ -2864,6 +3408,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
@@ -95790,7 +95656,7 @@ index 20ff0c3..a9eda98 100644
if (cur + npages > lim)
return 0;
return 1;
-@@ -2934,6 +3474,22 @@ int install_special_mapping(struct mm_struct *mm,
+@@ -2934,6 +3479,22 @@ int install_special_mapping(struct mm_struct *mm,
vma->vm_start = addr;
vma->vm_end = addr + len;
@@ -98413,10 +98279,10 @@ index d074d06..ad3cfcf 100644
if (ogm_packet->flags & BATADV_DIRECTLINK)
has_directlink_flag = true;
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
-index cc1cfd6..7a68e022 100644
+index c46387a..6ad5ef9 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
-@@ -446,7 +446,7 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
+@@ -450,7 +450,7 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
frag_header.packet_type = BATADV_UNICAST_FRAG;
frag_header.version = BATADV_COMPAT_VERSION;
frag_header.ttl = BATADV_TTL;
@@ -98779,7 +98645,7 @@ index 988721a..947846d 100644
switch (ss->ss_family) {
diff --git a/net/compat.c b/net/compat.c
-index f50161f..ab7644e 100644
+index cbc1a2a..ab7644e 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -73,9 +73,9 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
@@ -98795,28 +98661,17 @@ index f50161f..ab7644e 100644
return 0;
}
-@@ -85,21 +85,22 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
- {
- int tot_len;
+@@ -87,7 +87,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
-- if (kern_msg->msg_namelen) {
-+ if (kern_msg->msg_name && kern_msg->msg_namelen) {
+ if (kern_msg->msg_name && kern_msg->msg_namelen) {
if (mode == VERIFY_READ) {
- int err = move_addr_to_kernel(kern_msg->msg_name,
+ int err = move_addr_to_kernel((void __force_user *)kern_msg->msg_name,
kern_msg->msg_namelen,
kern_address);
if (err < 0)
- return err;
- }
-- if (kern_msg->msg_name)
-- kern_msg->msg_name = kern_address;
-- } else
-+ kern_msg->msg_name = kern_address;
-+ } else {
- kern_msg->msg_name = NULL;
-+ kern_msg->msg_namelen = 0;
-+ }
+@@ -100,7 +100,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
+ }
tot_len = iov_from_user_compat_to_kern(kern_iov,
- (struct compat_iovec __user *)kern_msg->msg_iov,
@@ -98824,7 +98679,7 @@ index f50161f..ab7644e 100644
kern_msg->msg_iovlen);
if (tot_len >= 0)
kern_msg->msg_iov = kern_iov;
-@@ -119,20 +120,20 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
+@@ -120,20 +120,20 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
#define CMSG_COMPAT_FIRSTHDR(msg) \
(((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \
@@ -98848,7 +98703,7 @@ index f50161f..ab7644e 100644
msg->msg_controllen)
return NULL;
return (struct compat_cmsghdr __user *)ptr;
-@@ -222,7 +223,7 @@ Efault:
+@@ -223,7 +223,7 @@ Efault:
int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *data)
{
@@ -98857,7 +98712,7 @@ index f50161f..ab7644e 100644
struct compat_cmsghdr cmhdr;
struct compat_timeval ctv;
struct compat_timespec cts[3];
-@@ -278,7 +279,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
+@@ -279,7 +279,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
{
@@ -98866,7 +98721,7 @@ index f50161f..ab7644e 100644
int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
int fdnum = scm->fp->count;
struct file **fp = scm->fp->fp;
-@@ -366,7 +367,7 @@ static int do_set_sock_timeout(struct socket *sock, int level,
+@@ -367,7 +367,7 @@ static int do_set_sock_timeout(struct socket *sock, int level,
return -EFAULT;
old_fs = get_fs();
set_fs(KERNEL_DS);
@@ -98875,7 +98730,7 @@ index f50161f..ab7644e 100644
set_fs(old_fs);
return err;
-@@ -427,7 +428,7 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
+@@ -428,7 +428,7 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
len = sizeof(ktime);
old_fs = get_fs();
set_fs(KERNEL_DS);
@@ -98884,7 +98739,7 @@ index f50161f..ab7644e 100644
set_fs(old_fs);
if (!err) {
-@@ -570,7 +571,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
+@@ -571,7 +571,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
case MCAST_JOIN_GROUP:
case MCAST_LEAVE_GROUP:
{
@@ -98893,7 +98748,7 @@ index f50161f..ab7644e 100644
struct group_req __user *kgr =
compat_alloc_user_space(sizeof(struct group_req));
u32 interface;
-@@ -591,7 +592,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
+@@ -592,7 +592,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
case MCAST_BLOCK_SOURCE:
case MCAST_UNBLOCK_SOURCE:
{
@@ -98902,7 +98757,7 @@ index f50161f..ab7644e 100644
struct group_source_req __user *kgsr = compat_alloc_user_space(
sizeof(struct group_source_req));
u32 interface;
-@@ -612,7 +613,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
+@@ -613,7 +613,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
}
case MCAST_MSFILTER:
{
@@ -98911,7 +98766,7 @@ index f50161f..ab7644e 100644
struct group_filter __user *kgf;
u32 interface, fmode, numsrc;
-@@ -650,7 +651,7 @@ int compat_mc_getsockopt(struct sock *sock, int level, int optname,
+@@ -651,7 +651,7 @@ int compat_mc_getsockopt(struct sock *sock, int level, int optname,
char __user *optval, int __user *optlen,
int (*getsockopt)(struct sock *, int, int, char __user *, int __user *))
{
@@ -98920,7 +98775,7 @@ index f50161f..ab7644e 100644
struct group_filter __user *kgf;
int __user *koptlen;
u32 interface, fmode, numsrc;
-@@ -803,7 +804,7 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
+@@ -804,7 +804,7 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
if (call < SYS_SOCKET || call > SYS_SENDMMSG)
return -EINVAL;
@@ -99145,15 +99000,11 @@ index dfa602c..3103d88 100644
fle->object = flo;
else
diff --git a/net/core/iovec.c b/net/core/iovec.c
-index b618694..cd5f0af 100644
+index 26dc006..89e838e 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
-@@ -39,23 +39,23 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
- {
- int size, ct, err;
-
-- if (m->msg_namelen) {
-+ if (m->msg_name && m->msg_namelen) {
+@@ -42,7 +42,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
+ if (m->msg_name && m->msg_namelen) {
if (mode == VERIFY_READ) {
void __user *namep;
- namep = (void __user __force *) m->msg_name;
@@ -99161,14 +99012,7 @@ index b618694..cd5f0af 100644
err = move_addr_to_kernel(namep, m->msg_namelen,
address);
if (err < 0)
- return err;
- }
-- if (m->msg_name)
-- m->msg_name = address;
-+ m->msg_name = address;
- } else {
- m->msg_name = NULL;
-+ m->msg_namelen = 0;
+@@ -55,7 +55,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
}
size = m->msg_iovlen * sizeof(struct iovec);
@@ -99421,44 +99265,8 @@ index b442e7e..6f5b5a2 100644
i++, cmfptr++)
{
struct socket *sock;
-diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
-index 897da56..ba71212 100644
---- a/net/core/secure_seq.c
-+++ b/net/core/secure_seq.c
-@@ -85,31 +85,6 @@ EXPORT_SYMBOL(secure_ipv6_port_ephemeral);
- #endif
-
- #ifdef CONFIG_INET
--__u32 secure_ip_id(__be32 daddr)
--{
-- u32 hash[MD5_DIGEST_WORDS];
--
-- net_secret_init();
-- hash[0] = (__force __u32) daddr;
-- hash[1] = net_secret[13];
-- hash[2] = net_secret[14];
-- hash[3] = net_secret[15];
--
-- md5_transform(hash, net_secret);
--
-- return hash[0];
--}
--
--__u32 secure_ipv6_id(const __be32 daddr[4])
--{
-- __u32 hash[4];
--
-- net_secret_init();
-- memcpy(hash, daddr, 16);
-- md5_transform(hash, net_secret);
--
-- return hash[0];
--}
-
- __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
- __be16 sport, __be16 dport)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index 7f2e1fc..6206b10 100644
+index 8f6391b..40bc442 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2003,7 +2003,7 @@ EXPORT_SYMBOL(__skb_checksum);
@@ -99921,28 +99729,6 @@ index 9d43468..ffa28cc 100644
return nh->nh_saddr;
}
-diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
-index 9db3b87..0ffcd4d 100644
---- a/net/ipv4/igmp.c
-+++ b/net/ipv4/igmp.c
-@@ -369,7 +369,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
- pip->saddr = fl4.saddr;
- pip->protocol = IPPROTO_IGMP;
- pip->tot_len = 0; /* filled in later */
-- ip_select_ident(skb, &rt->dst, NULL);
-+ ip_select_ident(skb, NULL);
- ((u8 *)&pip[1])[0] = IPOPT_RA;
- ((u8 *)&pip[1])[1] = 4;
- ((u8 *)&pip[1])[2] = 0;
-@@ -714,7 +714,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
- iph->daddr = dst;
- iph->saddr = fl4.saddr;
- iph->protocol = IPPROTO_IGMP;
-- ip_select_ident(skb, &rt->dst, NULL);
-+ ip_select_ident(skb, NULL);
- ((u8 *)&iph[1])[0] = IPOPT_RA;
- ((u8 *)&iph[1])[1] = 4;
- ((u8 *)&iph[1])[2] = 0;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 0d1e2cb..4501a2c 100644
--- a/net/ipv4/inet_connection_sock.c
@@ -99987,47 +99773,14 @@ index 8b9cf27..0d8d592 100644
inet_twsk_deschedule(tw, death_row);
while (twrefcnt) {
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
-index 48f4244..d83ba8a 100644
+index bf2cb4a..d83ba8a 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
-@@ -26,20 +26,7 @@
- * Theory of operations.
- * We keep one entry for each peer IP address. The nodes contains long-living
- * information about the peer which doesn't depend on routes.
-- * At this moment this information consists only of ID field for the next
-- * outgoing IP packet. This field is incremented with each packet as encoded
-- * in inet_getid() function (include/net/inetpeer.h).
-- * At the moment of writing this notes identifier of IP packets is generated
-- * to be unpredictable using this code only for packets subjected
-- * (actually or potentially) to defragmentation. I.e. DF packets less than
-- * PMTU in size when local fragmentation is disabled use a constant ID and do
-- * not use this code (see ip_select_ident() in include/net/ip.h).
- *
-- * Route cache entries hold references to our nodes.
-- * New cache entries get references via lookup by destination IP address in
-- * the avl tree. The reference is grabbed only when it's needed i.e. only
-- * when we try to output IP packet which needs an unpredictable ID (see
-- * __ip_select_ident() in net/ipv4/route.c).
- * Nodes are removed only when reference counter goes to 0.
- * When it's happened the node may be removed when a sufficient amount of
- * time has been passed since its last use. The less-recently-used entry can
-@@ -62,7 +49,6 @@
- * refcnt: atomically against modifications on other CPU;
- * usually under some other lock to prevent node disappearing
- * daddr: unchangeable
-- * ip_id_count: atomic value (no lock needed)
- */
-
- static struct kmem_cache *peer_cachep __read_mostly;
-@@ -496,11 +482,7 @@ relookup:
+@@ -482,7 +482,7 @@ relookup:
if (p) {
p->daddr = *daddr;
atomic_set(&p->refcnt, 1);
- atomic_set(&p->rid, 0);
-- atomic_set(&p->ip_id_count,
-- (daddr->family == AF_INET) ?
-- secure_ip_id(daddr->addr.a4) :
-- secure_ipv6_id(daddr->addr.a6));
+ atomic_set_unchecked(&p->rid, 0);
p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
p->rate_tokens = 0;
@@ -100114,38 +99867,6 @@ index 94213c8..8bdb342 100644
.kind = "gretap",
.maxtype = IFLA_GRE_MAX,
.policy = ipgre_policy,
-diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
-index 73c6b63..ed88d78 100644
---- a/net/ipv4/ip_output.c
-+++ b/net/ipv4/ip_output.c
-@@ -148,7 +148,7 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
- iph->daddr = (opt && opt->opt.srr ? opt->opt.faddr : daddr);
- iph->saddr = saddr;
- iph->protocol = sk->sk_protocol;
-- ip_select_ident(skb, &rt->dst, sk);
-+ ip_select_ident(skb, sk);
-
- if (opt && opt->opt.optlen) {
- iph->ihl += opt->opt.optlen>>2;
-@@ -386,8 +386,7 @@ packet_routed:
- ip_options_build(skb, &inet_opt->opt, inet->inet_daddr, rt, 0);
- }
-
-- ip_select_ident_more(skb, &rt->dst, sk,
-- (skb_shinfo(skb)->gso_segs ?: 1) - 1);
-+ ip_select_ident_segs(skb, sk, skb_shinfo(skb)->gso_segs ?: 1);
-
- skb->priority = sk->sk_priority;
- skb->mark = sk->sk_mark;
-@@ -1338,7 +1337,7 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
- iph->ttl = ttl;
- iph->protocol = sk->sk_protocol;
- ip_copy_addrs(iph, fl4);
-- ip_select_ident(skb, &rt->dst, sk);
-+ ip_select_ident(skb, sk);
-
- if (opt) {
- iph->ihl += opt->optlen>>2;
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 580dd96..9fcef7e 100644
--- a/net/ipv4/ip_sockglue.c
@@ -100169,19 +99890,6 @@ index 580dd96..9fcef7e 100644
msg.msg_controllen = len;
msg.msg_flags = flags;
-diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
-index 8d69626..65b664d 100644
---- a/net/ipv4/ip_tunnel_core.c
-+++ b/net/ipv4/ip_tunnel_core.c
-@@ -74,7 +74,7 @@ int iptunnel_xmit(struct rtable *rt, struct sk_buff *skb,
- iph->daddr = dst;
- iph->saddr = src;
- iph->ttl = ttl;
-- __ip_select_ident(iph, &rt->dst, (skb_shinfo(skb)->gso_segs ?: 1) - 1);
-+ __ip_select_ident(iph, skb_shinfo(skb)->gso_segs ?: 1);
-
- err = ip_local_out(skb);
- if (unlikely(net_xmit_eval(err)))
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index e4a8f76..dd8ad72 100644
--- a/net/ipv4/ip_vti.c
@@ -100257,19 +99965,6 @@ index 62eaa00..29b2dc2 100644
.kind = "ipip",
.maxtype = IFLA_IPTUN_MAX,
.policy = ipip_policy,
-diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
-index 2886357..1149fc2 100644
---- a/net/ipv4/ipmr.c
-+++ b/net/ipv4/ipmr.c
-@@ -1663,7 +1663,7 @@ static void ip_encap(struct sk_buff *skb, __be32 saddr, __be32 daddr)
- iph->protocol = IPPROTO_IPIP;
- iph->ihl = 5;
- iph->tot_len = htons(skb->len);
-- ip_select_ident(skb, skb_dst(skb), NULL);
-+ ip_select_ident(skb, NULL);
- ip_send_check(iph);
-
- memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index f95b6f9..2ee2097 100644
--- a/net/ipv4/netfilter/arp_tables.c
@@ -100453,7 +100148,7 @@ index e21934b..4e7cb58 100644
static int ping_v4_seq_show(struct seq_file *seq, void *v)
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
-index c04518f..d67116b 100644
+index 11c8d81..d67116b 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -311,7 +311,7 @@ static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
@@ -100465,15 +100160,6 @@ index c04518f..d67116b 100644
kfree_skb(skb);
return NET_RX_DROP;
}
-@@ -389,7 +389,7 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,
- iph->check = 0;
- iph->tot_len = htons(length);
- if (!iph->id)
-- ip_select_ident(skb, &rt->dst, NULL);
-+ ip_select_ident(skb, NULL);
-
- iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
- }
@@ -748,16 +748,20 @@ static int raw_init(struct sock *sk)
static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
@@ -100517,18 +100203,10 @@ index c04518f..d67116b 100644
static int raw_seq_show(struct seq_file *seq, void *v)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index 031553f..1f6f4e2 100644
+index ca5a01e..1f6f4e2 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
-@@ -89,6 +89,7 @@
- #include <linux/rcupdate.h>
- #include <linux/times.h>
- #include <linux/slab.h>
-+#include <linux/jhash.h>
- #include <net/dst.h>
- #include <net/net_namespace.h>
- #include <net/protocol.h>
-@@ -233,7 +234,7 @@ static const struct seq_operations rt_cache_seq_ops = {
+@@ -234,7 +234,7 @@ static const struct seq_operations rt_cache_seq_ops = {
static int rt_cache_seq_open(struct inode *inode, struct file *file)
{
@@ -100537,7 +100215,7 @@ index 031553f..1f6f4e2 100644
}
static const struct file_operations rt_cache_seq_fops = {
-@@ -324,7 +325,7 @@ static const struct seq_operations rt_cpu_seq_ops = {
+@@ -325,7 +325,7 @@ static const struct seq_operations rt_cpu_seq_ops = {
static int rt_cpu_seq_open(struct inode *inode, struct file *file)
{
@@ -100546,7 +100224,7 @@ index 031553f..1f6f4e2 100644
}
static const struct file_operations rt_cpu_seq_fops = {
-@@ -362,7 +363,7 @@ static int rt_acct_proc_show(struct seq_file *m, void *v)
+@@ -363,7 +363,7 @@ static int rt_acct_proc_show(struct seq_file *m, void *v)
static int rt_acct_proc_open(struct inode *inode, struct file *file)
{
@@ -100555,78 +100233,25 @@ index 031553f..1f6f4e2 100644
}
static const struct file_operations rt_acct_proc_fops = {
-@@ -462,39 +463,45 @@ static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
- return neigh_create(&arp_tbl, pkey, dev);
- }
+@@ -465,7 +465,7 @@ static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
--/*
-- * Peer allocation may fail only in serious out-of-memory conditions. However
-- * we still can generate some output.
-- * Random ID selection looks a bit dangerous because we have no chances to
-- * select ID being unique in a reasonable period of time.
-- * But broken packet identifier may be better than no packet at all.
-+#define IP_IDENTS_SZ 2048u
-+struct ip_ident_bucket {
+ #define IP_IDENTS_SZ 2048u
+ struct ip_ident_bucket {
+- atomic_t id;
+ atomic_unchecked_t id;
-+ u32 stamp32;
-+};
-+
-+static struct ip_ident_bucket *ip_idents __read_mostly;
-+
-+/* In order to protect privacy, we add a perturbation to identifiers
-+ * if one generator is seldom used. This makes hard for an attacker
-+ * to infer how many packets were sent between two points in time.
- */
--static void ip_select_fb_ident(struct iphdr *iph)
-+u32 ip_idents_reserve(u32 hash, int segs)
- {
-- static DEFINE_SPINLOCK(ip_fb_id_lock);
-- static u32 ip_fallback_id;
-- u32 salt;
-+ struct ip_ident_bucket *bucket = ip_idents + hash % IP_IDENTS_SZ;
-+ u32 old = ACCESS_ONCE(bucket->stamp32);
-+ u32 now = (u32)jiffies;
-+ u32 delta = 0;
-
-- spin_lock_bh(&ip_fb_id_lock);
-- salt = secure_ip_id((__force __be32)ip_fallback_id ^ iph->daddr);
-- iph->id = htons(salt & 0xFFFF);
-- ip_fallback_id = salt;
-- spin_unlock_bh(&ip_fb_id_lock);
-+ if (old != now && cmpxchg(&bucket->stamp32, old, now) == old)
-+ delta = prandom_u32_max(now - old);
-+
-+ return atomic_add_return_unchecked(segs + delta, &bucket->id) - segs;
- }
-+EXPORT_SYMBOL(ip_idents_reserve);
-
--void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more)
-+void __ip_select_ident(struct iphdr *iph, int segs)
- {
-- struct net *net = dev_net(dst->dev);
-- struct inet_peer *peer;
-+ static u32 ip_idents_hashrnd __read_mostly;
-+ u32 hash, id;
+ u32 stamp32;
+ };
-- peer = inet_getpeer_v4(net->ipv4.peers, iph->daddr, 1);
-- if (peer) {
-- iph->id = htons(inet_getid(peer, more));
-- inet_putpeer(peer);
-- return;
-- }
-+ net_get_random_once(&ip_idents_hashrnd, sizeof(ip_idents_hashrnd));
+@@ -485,7 +485,7 @@ u32 ip_idents_reserve(u32 hash, int segs)
+ if (old != now && cmpxchg(&bucket->stamp32, old, now) == old)
+ delta = prandom_u32_max(now - old);
-- ip_select_fb_ident(iph);
-+ hash = jhash_3words((__force u32)iph->daddr,
-+ (__force u32)iph->saddr,
-+ iph->protocol,
-+ ip_idents_hashrnd);
-+ id = ip_idents_reserve(hash, segs);
-+ iph->id = htons(id);
+- return atomic_add_return(segs + delta, &bucket->id) - segs;
++ return atomic_add_return_unchecked(segs + delta, &bucket->id) - segs;
}
- EXPORT_SYMBOL(__ip_select_ident);
+ EXPORT_SYMBOL(ip_idents_reserve);
-@@ -2624,34 +2631,34 @@ static struct ctl_table ipv4_route_flush_table[] = {
+@@ -2631,34 +2631,34 @@ static struct ctl_table ipv4_route_flush_table[] = {
.maxlen = sizeof(int),
.mode = 0200,
.proc_handler = ipv4_sysctl_rtcache_flush,
@@ -100669,7 +100294,7 @@ index 031553f..1f6f4e2 100644
err_dup:
return -ENOMEM;
}
-@@ -2674,8 +2681,8 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
+@@ -2681,8 +2681,8 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
static __net_init int rt_genid_init(struct net *net)
{
@@ -100680,19 +100305,6 @@ index 031553f..1f6f4e2 100644
get_random_bytes(&net->ipv4.dev_addr_genid,
sizeof(net->ipv4.dev_addr_genid));
return 0;
-@@ -2718,6 +2725,12 @@ int __init ip_rt_init(void)
- {
- int rc = 0;
-
-+ ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL);
-+ if (!ip_idents)
-+ panic("IP: failed to allocate ip_idents\n");
-+
-+ prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
-+
- #ifdef CONFIG_IP_ROUTE_CLASSID
- ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct), __alignof__(struct ip_rt_acct));
- if (!ip_rt_acct)
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 44eba05..b36864b 100644
--- a/net/ipv4/sysctl_net_ipv4.c
@@ -100989,33 +100601,6 @@ index 64f0354..a81b39d 100644
if (retransmits_timed_out(sk, retry_until,
syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
/* Has it gone just too far? */
-diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
-index 06cae62..6b1a5fd 100644
---- a/net/ipv4/tcp_vegas.c
-+++ b/net/ipv4/tcp_vegas.c
-@@ -219,7 +219,8 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 acked,
- * This is:
- * (actual rate in segments) * baseRTT
- */
-- target_cwnd = tp->snd_cwnd * vegas->baseRTT / rtt;
-+ target_cwnd = (u64)tp->snd_cwnd * vegas->baseRTT;
-+ do_div(target_cwnd, rtt);
-
- /* Calculate the difference between the window we had,
- * and the window we would like to have. This quantity
-diff --git a/net/ipv4/tcp_veno.c b/net/ipv4/tcp_veno.c
-index 326475a..603ad49 100644
---- a/net/ipv4/tcp_veno.c
-+++ b/net/ipv4/tcp_veno.c
-@@ -145,7 +145,7 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 acked,
-
- rtt = veno->minrtt;
-
-- target_cwnd = (tp->snd_cwnd * veno->basertt);
-+ target_cwnd = (u64)tp->snd_cwnd * veno->basertt;
- target_cwnd <<= V_PARAM_SHIFT;
- do_div(target_cwnd, rtt);
-
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index b25e852..cdc3258 100644
--- a/net/ipv4/udp.c
@@ -101134,24 +100719,6 @@ index b25e852..cdc3258 100644
}
int udp4_seq_show(struct seq_file *seq, void *v)
-diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
-index 31b1815..1f564a1 100644
---- a/net/ipv4/xfrm4_mode_tunnel.c
-+++ b/net/ipv4/xfrm4_mode_tunnel.c
-@@ -117,12 +117,12 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
-
- top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
- 0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF));
-- ip_select_ident(skb, dst->child, NULL);
-
- top_iph->ttl = ip4_dst_hoplimit(dst->child);
-
- top_iph->saddr = x->props.saddr.a4;
- top_iph->daddr = x->id.daddr.a4;
-+ ip_select_ident(skb, NULL);
-
- return 0;
- }
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index e1a6393..f634ce5 100644
--- a/net/ipv4/xfrm4_policy.c
@@ -101365,31 +100932,6 @@ index 2465d18..bc5bf7f 100644
.kind = "ip6gretap",
.maxtype = IFLA_GRE_MAX,
.policy = ip6gre_policy,
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index a62b610..073e5a6 100644
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -537,6 +537,20 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
- skb_copy_secmark(to, from);
- }
-
-+static void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
-+{
-+ static u32 ip6_idents_hashrnd __read_mostly;
-+ u32 hash, id;
-+
-+ net_get_random_once(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd));
-+
-+ hash = __ipv6_addr_jhash(&rt->rt6i_dst.addr, ip6_idents_hashrnd);
-+ hash = __ipv6_addr_jhash(&rt->rt6i_src.addr, hash);
-+
-+ id = ip_idents_reserve(hash, 1);
-+ fhdr->identification = htonl(id);
-+}
-+
- int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
- {
- struct sk_buff *frag;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 9120339..cfdd84f 100644
--- a/net/ipv6/ip6_tunnel.c
@@ -101539,36 +101081,13 @@ index 767ab8d..c5ec70a 100644
return -ENOMEM;
}
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
-index b31a012..ab2f47d 100644
+index 798eb0f..ab2f47d 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
-@@ -7,30 +7,6 @@
+@@ -7,7 +7,6 @@
#include <net/ip6_fib.h>
#include <net/addrconf.h>
--void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
--{
-- static atomic_t ipv6_fragmentation_id;
-- int ident;
--
--#if IS_ENABLED(CONFIG_IPV6)
-- if (rt && !(rt->dst.flags & DST_NOPEER)) {
-- struct inet_peer *peer;
-- struct net *net;
--
-- net = dev_net(rt->dst.dev);
-- peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
-- if (peer) {
-- fhdr->identification = htonl(inet_getid(peer, 0));
-- inet_putpeer(peer);
-- return;
-- }
-- }
--#endif
-- ident = atomic_inc_return(&ipv6_fragmentation_id);
-- fhdr->identification = htonl(ident);
--}
--EXPORT_SYMBOL(ipv6_select_ident);
-
int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
{
@@ -102591,18 +102110,9 @@ index db80126..ef7110e 100644
cp->old_state = cp->state;
/*
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
-index c47444e..e9a86e6 100644
+index 7f0e1cf..e9a86e6 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
-@@ -883,7 +883,7 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
- iph->daddr = cp->daddr.ip;
- iph->saddr = saddr;
- iph->ttl = old_iph->ttl;
-- ip_select_ident(skb, &rt->dst, NULL);
-+ ip_select_ident(skb, NULL);
-
- /* Another hack: avoid icmp_send in ip_fragment */
- skb->local_df = 1;
@@ -1102,7 +1102,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
else
rc = NF_ACCEPT;
@@ -102997,10 +102507,18 @@ index b74aa07..d41926e 100644
*uaddr_len = sizeof(struct sockaddr_ax25);
}
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 48a6a93..0b0496e 100644
+index 48a6a93..d2c096b 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
-@@ -1845,7 +1845,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -635,6 +635,7 @@ static void init_prb_bdqc(struct packet_sock *po,
+ p1->tov_in_jiffies = msecs_to_jiffies(p1->retire_blk_tov);
+ p1->blk_sizeof_priv = req_u->req3.tp_sizeof_priv;
+
++ p1->max_frame_len = p1->kblk_size - BLK_PLUS_PRIV(p1->blk_sizeof_priv);
+ prb_init_ft_ops(p1, req_u);
+ prb_setup_retire_blk_timer(po, tx_ring);
+ prb_open_block(p1, pbd);
+@@ -1845,7 +1846,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
spin_lock(&sk->sk_receive_queue.lock);
po->stats.stats1.tp_packets++;
@@ -103009,7 +102527,7 @@ index 48a6a93..0b0496e 100644
__skb_queue_tail(&sk->sk_receive_queue, skb);
spin_unlock(&sk->sk_receive_queue.lock);
sk->sk_data_ready(sk, skb->len);
-@@ -1854,7 +1854,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1854,7 +1855,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
drop_n_acct:
spin_lock(&sk->sk_receive_queue.lock);
po->stats.stats1.tp_drops++;
@@ -103018,7 +102536,26 @@ index 48a6a93..0b0496e 100644
spin_unlock(&sk->sk_receive_queue.lock);
drop_n_restore:
-@@ -3449,7 +3449,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -1946,6 +1947,18 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ if ((int)snaplen < 0)
+ snaplen = 0;
+ }
++ } else if (unlikely(macoff + snaplen >
++ GET_PBDQC_FROM_RB(&po->rx_ring)->max_frame_len)) {
++ u32 nval;
++
++ nval = GET_PBDQC_FROM_RB(&po->rx_ring)->max_frame_len - macoff;
++ pr_err_once("tpacket_rcv: packet too big, clamped from %u to %u. macoff=%u\n",
++ snaplen, nval, macoff);
++ snaplen = nval;
++ if (unlikely((int)snaplen < 0)) {
++ snaplen = 0;
++ macoff = GET_PBDQC_FROM_RB(&po->rx_ring)->max_frame_len;
++ }
+ }
+ spin_lock(&sk->sk_receive_queue.lock);
+ h.raw = packet_current_rx_frame(po, skb,
+@@ -3449,7 +3462,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
case PACKET_HDRLEN:
if (len > sizeof(int))
len = sizeof(int);
@@ -103027,7 +102564,7 @@ index 48a6a93..0b0496e 100644
return -EFAULT;
switch (val) {
case TPACKET_V1:
-@@ -3495,7 +3495,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3495,7 +3508,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
len = lv;
if (put_user(len, optlen))
return -EFAULT;
@@ -103036,6 +102573,29 @@ index 48a6a93..0b0496e 100644
return -EFAULT;
return 0;
}
+@@ -3779,6 +3792,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ goto out;
+ if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
+ goto out;
++ if (po->tp_version >= TPACKET_V3 &&
++ (int)(req->tp_block_size -
++ BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0)
++ goto out;
+ if (unlikely(req->tp_frame_size < po->tp_hdrlen +
+ po->tp_reserve))
+ goto out;
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index eb9580a..cdddf6a 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -29,6 +29,7 @@ struct tpacket_kbdq_core {
+ char *pkblk_start;
+ char *pkblk_end;
+ int kblk_size;
++ unsigned int max_frame_len;
+ unsigned int knum_blocks;
+ uint64_t knxt_seq_num;
+ char *prev;
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index e774117..900b8b7 100644
--- a/net/phonet/pep.c
@@ -103519,18 +103079,6 @@ index f226709..0e735a8 100644
_proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
-diff --git a/net/sctp/associola.c b/net/sctp/associola.c
-index a4d5701..5d97d8f 100644
---- a/net/sctp/associola.c
-+++ b/net/sctp/associola.c
-@@ -1151,6 +1151,7 @@ void sctp_assoc_update(struct sctp_association *asoc,
- asoc->c = new->c;
- asoc->peer.rwnd = new->peer.rwnd;
- asoc->peer.sack_needed = new->peer.sack_needed;
-+ asoc->peer.auth_capable = new->peer.auth_capable;
- asoc->peer.i = new->peer.i;
- sctp_tsnmap_init(&asoc->peer.tsn_map, SCTP_TSN_MAP_INITIAL,
- asoc->peer.i.initial_tsn, GFP_ATOMIC);
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 2b1738e..a9d0fc9 100644
--- a/net/sctp/ipv6.c