main/linux-virt-grsec: upgrade to 3.3.8 kernel

2 files changed, 534 insertions, 384 deletions

diff --git a/testing/linux-virt-grsec/APKBUILD b/testing/linux-virt-grsec/APKBUILD
index 08a58fd329a..d50f478f122 100644
--- a/testing/linux-virt-grsec/APKBUILD
+++ b/testing/linux-virt-grsec/APKBUILD
@@ -2,7 +2,7 @@
 
 _flavor=grsec
 pkgname=linux-virt-${_flavor}
-pkgver=3.3.7
+pkgver=3.3.8
 _kernver=3.3
 pkgrel=3
 pkgdesc="Linux kernel with grsecurity"
@@ -14,8 +14,7 @@ _config=${config:-kernelconfig.${CARCH}}
 install=
 source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz
 	http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz
-	grsecurity-2.9-3.3.7-201205261259.patch
-	pax-out-of-tree-workaround.patch
+	grsecurity-2.9-3.3.8-201206042136.patch
 	xen-xsave.patch
 
 	kernelconfig.x86
@@ -137,8 +136,7 @@ dev() {
 }
 
 md5sums="7133f5a2086a7d7ef97abac610c094f5  linux-3.3.tar.xz
-622a3b43238559aeb778279969631260  patch-3.3.7.xz
-097be38de4ae03e4d9dbec3217b15afb  grsecurity-2.9-3.3.7-201205261259.patch
-1aa70cff67ae2cca7cf1b8be83573eae  pax-out-of-tree-workaround.patch
+e1714b5136a7f4dab1b5d2d7f98e2891  patch-3.3.8.xz
+4a97aa5ad465a5d829e88c8234f75417  grsecurity-2.9-3.3.8-201206042136.patch
 0d095dbf194d5609ad260ecd3f0ab15d  xen-xsave.patch
 db2bba20ed88080a1d78ca5cc26f6ae1  kernelconfig.x86"
diff --git a/testing/linux-virt-grsec/grsecurity-2.9-3.3.7-201205261259.patch b/testing/linux-virt-grsec/grsecurity-2.9-3.3.8-201206042136.patch
index be98c7f60a3..e7f177dc84f 100644
--- a/testing/linux-virt-grsec/grsecurity-2.9-3.3.7-201205261259.patch
+++ b/testing/linux-virt-grsec/grsecurity-2.9-3.3.8-201206042136.patch
@@ -195,7 +195,7 @@ index d99fd9c..8689fef 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 073f74f..b379941 100644
+index db96149..f101728 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -210,17 +210,6 @@ index 073f74f..b379941 100644
  
  # Decide whether to build built-in, modular, or both.
  # Normally, just do built-in.
-@@ -357,8 +358,8 @@ CFLAGS_GCOV	= -fprofile-arcs -ftest-coverage
- 
- # Use LINUXINCLUDE when you must reference the include/ directory.
- # Needed to be compatible with the O= option
--LINUXINCLUDE    := -I$(srctree)/arch/$(hdr-arch)/include \
--                   -Iarch/$(hdr-arch)/include/generated -Iinclude \
-+LINUXINCLUDE    := -isystem arch/$(hdr-arch)/include \
-+                   -isystem arch/$(hdr-arch)/include/generated -isystem include \
-                    $(if $(KBUILD_SRC), -I$(srctree)/include) \
-                    -include $(srctree)/include/linux/kconfig.h
- 
 @@ -407,8 +408,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn --exc
  # Rules shared between *config targets and build targets
  
@@ -323,7 +312,7 @@ index 073f74f..b379941 100644
  prepare: prepare0
  
  # Generate some files
-@@ -1089,6 +1142,8 @@ all: modules
+@@ -1092,6 +1145,8 @@ all: modules
  #	using awk while concatenating to the final file.
  
  PHONY += modules
@@ -332,7 +321,7 @@ index 073f74f..b379941 100644
  modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
  	$(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
  	@$(kecho) '  Building modules, stage 2.';
-@@ -1104,7 +1159,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
+@@ -1107,7 +1162,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
  
  # Target to prepare building external modules
  PHONY += modules_prepare
@@ -341,7 +330,7 @@ index 073f74f..b379941 100644
  
  # Target to install modules
  PHONY += modules_install
-@@ -1201,6 +1256,7 @@ distclean: mrproper
+@@ -1204,6 +1259,7 @@ distclean: mrproper
  		\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
  		-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
  		-o -name '.*.rej' \
@@ -349,7 +338,7 @@ index 073f74f..b379941 100644
  		-o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
  		-type f -print | xargs rm -f
  
-@@ -1361,6 +1417,8 @@ PHONY += $(module-dirs) modules
+@@ -1364,6 +1420,8 @@ PHONY += $(module-dirs) modules
  $(module-dirs): crmodverdir $(objtree)/Module.symvers
  	$(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
  
@@ -358,7 +347,7 @@ index 073f74f..b379941 100644
  modules: $(module-dirs)
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1487,17 +1545,21 @@ else
+@@ -1490,17 +1548,21 @@ else
          target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
  endif
  
@@ -384,7 +373,7 @@ index 073f74f..b379941 100644
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
  %.symtypes: %.c prepare scripts FORCE
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1507,11 +1569,15 @@ endif
+@@ -1510,11 +1572,15 @@ endif
  	$(cmd_crmodverdir)
  	$(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
  	$(build)=$(build-dir)
@@ -1336,7 +1325,7 @@ index 75fe66b..2255c86 100644
  /*
   * Memory returned by kmalloc() may be used for DMA, so we must make
 diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
-index d5d8d5c..ad92c96 100644
+index 1252a26..9dc17b5 100644
 --- a/arch/arm/include/asm/cacheflush.h
 +++ b/arch/arm/include/asm/cacheflush.h
 @@ -108,7 +108,7 @@ struct cpu_cache_fns {
@@ -1655,7 +1644,7 @@ index a255c39..4a19b25 100644
  #endif
  
 diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
-index f84dfe6..13e94f7 100644
+index 504b28a..62f7a7d 100644
 --- a/arch/arm/kernel/traps.c
 +++ b/arch/arm/kernel/traps.c
 @@ -259,6 +259,8 @@ static int __die(const char *str, int err, struct thread_info *thread, struct pt
@@ -7717,7 +7706,7 @@ index e46c214..7c72b55 100644
  	  This option helps catch unintended modifications to loadable
  	  kernel module's text and read-only data. It also prevents execution
 diff --git a/arch/x86/Makefile b/arch/x86/Makefile
-index 209ba12..15140db 100644
+index 015f0c5..b405802 100644
 --- a/arch/x86/Makefile
 +++ b/arch/x86/Makefile
 @@ -46,6 +46,7 @@ else
@@ -7728,7 +7717,7 @@ index 209ba12..15140db 100644
          KBUILD_AFLAGS += -m64
          KBUILD_CFLAGS += -m64
  
-@@ -201,3 +202,12 @@ define archhelp
+@@ -205,3 +206,12 @@ define archhelp
    echo  '                  FDARGS="..."  arguments for the booted kernel'
    echo  '                  FDINITRD=file initrd for the booted kernel'
  endef
@@ -7800,7 +7789,7 @@ index c7093bd..d4247ffe0 100644
  	return diff;
  }
 diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
-index fd55a2f..217b501 100644
+index e398bb5..3a382ca 100644
 --- a/arch/x86/boot/compressed/Makefile
 +++ b/arch/x86/boot/compressed/Makefile
 @@ -14,6 +14,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=small
@@ -7909,201 +7898,6 @@ index 7116dcb..d9ae1d7 100644
  		error("Wrong destination address");
  #endif
  
-diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
-index e77f4e4..17e511f 100644
---- a/arch/x86/boot/compressed/relocs.c
-+++ b/arch/x86/boot/compressed/relocs.c
-@@ -13,8 +13,11 @@
- 
- static void die(char *fmt, ...);
- 
-+#include "../../../../include/generated/autoconf.h"
-+
- #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
- static Elf32_Ehdr ehdr;
-+static Elf32_Phdr *phdr;
- static unsigned long reloc_count, reloc_idx;
- static unsigned long *relocs;
- 
-@@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp)
- 	}
- }
- 
-+static void read_phdrs(FILE *fp)
-+{
-+	unsigned int i;
-+
-+	phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
-+	if (!phdr) {
-+		die("Unable to allocate %d program headers\n",
-+		    ehdr.e_phnum);
-+	}
-+	if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
-+		die("Seek to %d failed: %s\n",
-+			ehdr.e_phoff, strerror(errno));
-+	}
-+	if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
-+		die("Cannot read ELF program headers: %s\n",
-+			strerror(errno));
-+	}
-+	for(i = 0; i < ehdr.e_phnum; i++) {
-+		phdr[i].p_type      = elf32_to_cpu(phdr[i].p_type);
-+		phdr[i].p_offset    = elf32_to_cpu(phdr[i].p_offset);
-+		phdr[i].p_vaddr     = elf32_to_cpu(phdr[i].p_vaddr);
-+		phdr[i].p_paddr     = elf32_to_cpu(phdr[i].p_paddr);
-+		phdr[i].p_filesz    = elf32_to_cpu(phdr[i].p_filesz);
-+		phdr[i].p_memsz     = elf32_to_cpu(phdr[i].p_memsz);
-+		phdr[i].p_flags     = elf32_to_cpu(phdr[i].p_flags);
-+		phdr[i].p_align     = elf32_to_cpu(phdr[i].p_align);
-+	}
-+
-+}
-+
- static void read_shdrs(FILE *fp)
- {
--	int i;
-+	unsigned int i;
- 	Elf32_Shdr shdr;
- 
- 	secs = calloc(ehdr.e_shnum, sizeof(struct section));
-@@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp)
- 
- static void read_strtabs(FILE *fp)
- {
--	int i;
-+	unsigned int i;
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_STRTAB) {
-@@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp)
- 
- static void read_symtabs(FILE *fp)
- {
--	int i,j;
-+	unsigned int i,j;
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_SYMTAB) {
-@@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp)
- 
- static void read_relocs(FILE *fp)
- {
--	int i,j;
-+	unsigned int i,j;
-+	uint32_t base;
-+
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_REL) {
-@@ -385,9 +420,18 @@ static void read_relocs(FILE *fp)
- 			die("Cannot read symbol table: %s\n",
- 				strerror(errno));
- 		}
-+		base = 0;
-+		for (j = 0; j < ehdr.e_phnum; j++) {
-+			if (phdr[j].p_type != PT_LOAD )
-+				continue;
-+			if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
-+				continue;
-+			base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
-+			break;
-+		}
- 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
- 			Elf32_Rel *rel = &sec->reltab[j];
--			rel->r_offset = elf32_to_cpu(rel->r_offset);
-+			rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
- 			rel->r_info   = elf32_to_cpu(rel->r_info);
- 		}
- 	}
-@@ -396,13 +440,13 @@ static void read_relocs(FILE *fp)
- 
- static void print_absolute_symbols(void)
- {
--	int i;
-+	unsigned int i;
- 	printf("Absolute symbols\n");
- 	printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		char *sym_strtab;
--		int j;
-+		unsigned int j;
- 
- 		if (sec->shdr.sh_type != SHT_SYMTAB) {
- 			continue;
-@@ -429,14 +473,14 @@ static void print_absolute_symbols(void)
- 
- static void print_absolute_relocs(void)
- {
--	int i, printed = 0;
-+	unsigned int i, printed = 0;
- 
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		struct section *sec_applies, *sec_symtab;
- 		char *sym_strtab;
- 		Elf32_Sym *sh_symtab;
--		int j;
-+		unsigned int j;
- 		if (sec->shdr.sh_type != SHT_REL) {
- 			continue;
- 		}
-@@ -497,13 +541,13 @@ static void print_absolute_relocs(void)
- 
- static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
- {
--	int i;
-+	unsigned int i;
- 	/* Walk through the relocations */
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		char *sym_strtab;
- 		Elf32_Sym *sh_symtab;
- 		struct section *sec_applies, *sec_symtab;
--		int j;
-+		unsigned int j;
- 		struct section *sec = &secs[i];
- 
- 		if (sec->shdr.sh_type != SHT_REL) {
-@@ -528,6 +572,22 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
- 			    !is_rel_reloc(sym_name(sym_strtab, sym))) {
- 				continue;
- 			}
-+			/* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
-+			if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
-+				continue;
-+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
-+			/* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
-+			if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
-+				continue;
-+#endif
-+
- 			switch (r_type) {
- 			case R_386_NONE:
- 			case R_386_PC32:
-@@ -569,7 +629,7 @@ static int cmp_relocs(const void *va, const void *vb)
- 
- static void emit_relocs(int as_text)
- {
--	int i;
-+	unsigned int i;
- 	/* Count how many relocations I have and allocate space for them. */
- 	reloc_count = 0;
- 	walk_relocs(count_reloc);
-@@ -663,6 +723,7 @@ int main(int argc, char **argv)
- 			fname, strerror(errno));
- 	}
- 	read_ehdr(fp);
-+	read_phdrs(fp);
- 	read_shdrs(fp);
- 	read_strtabs(fp);
- 	read_symtabs(fp);
 diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c
 index 4d3ff03..e4972ff 100644
 --- a/arch/x86/boot/cpucheck.c
@@ -10982,7 +10776,7 @@ index 5f55e69..e20bfb1 100644
  
  #ifdef CONFIG_SMP
 diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
-index 6902152..399f3a2 100644
+index 6902152..da4283a 100644
 --- a/arch/x86/include/asm/mmu_context.h
 +++ b/arch/x86/include/asm/mmu_context.h
 @@ -24,6 +24,18 @@ void destroy_context(struct mm_struct *mm);
@@ -11025,8 +10819,8 @@ index 6902152..399f3a2 100644
  		/* Re-load page tables */
 +#ifdef CONFIG_PAX_PER_CPU_PGD
 +		pax_open_kernel();
-+		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
-+		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
++		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd);
++		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd);
 +		pax_close_kernel();
 +		load_cr3(get_cpu_pgd(cpu));
 +#else
@@ -11065,8 +10859,8 @@ index 6902152..399f3a2 100644
 +
 +#ifdef CONFIG_PAX_PER_CPU_PGD
 +		pax_open_kernel();
-+		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
-+		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
++		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd);
++		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd);
 +		pax_close_kernel();
 +		load_cr3(get_cpu_pgd(cpu));
 +#endif
@@ -11452,7 +11246,7 @@ index effff47..bbb8295 100644
  
  /*
 diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
-index 49afb3f..ed14d07 100644
+index 49afb3f..91a8c63 100644
 --- a/arch/x86/include/asm/pgtable.h
 +++ b/arch/x86/include/asm/pgtable.h
 @@ -44,6 +44,7 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
@@ -11621,13 +11415,13 @@ index 49afb3f..ed14d07 100644
  }
  
 +#ifdef CONFIG_PAX_PER_CPU_PGD
-+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
++extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src);
 +#endif
 +
 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
++extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src);
 +#else
-+static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
++static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src) {}
 +#endif
  
  #include <asm-generic/pgtable.h>
@@ -14357,7 +14151,7 @@ index 3e6ff6c..54b4992 100644
  }
  #endif
 diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
-index 5a11ae2..a1a1c8a 100644
+index dee004f..327a57e 100644
 --- a/arch/x86/kernel/cpu/mcheck/mce.c
 +++ b/arch/x86/kernel/cpu/mcheck/mce.c
 @@ -42,6 +42,7 @@
@@ -14408,7 +14202,7 @@ index 5a11ae2..a1a1c8a 100644
  			return;
  	}
  	/* First print corrected ones that are still unlogged */
-@@ -658,7 +659,7 @@ static int mce_timed_out(u64 *t)
+@@ -666,7 +667,7 @@ static int mce_timed_out(u64 *t)
  	 * might have been modified by someone else.
  	 */
  	rmb();
@@ -14417,7 +14211,7 @@ index 5a11ae2..a1a1c8a 100644
  		wait_for_panic();
  	if (!monarch_timeout)
  		goto out;
-@@ -1446,7 +1447,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
+@@ -1454,7 +1455,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
  }
  
  /* Call the installed machine check handler for this CPU setup. */
@@ -14426,7 +14220,7 @@ index 5a11ae2..a1a1c8a 100644
  						unexpected_machine_check;
  
  /*
-@@ -1469,7 +1470,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
+@@ -1477,7 +1478,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
  		return;
  	}
  
@@ -14436,7 +14230,7 @@ index 5a11ae2..a1a1c8a 100644
  
  	__mcheck_cpu_init_generic();
  	__mcheck_cpu_init_vendor(c);
-@@ -1483,7 +1486,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
+@@ -1491,7 +1494,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
   */
  
  static DEFINE_SPINLOCK(mce_chrdev_state_lock);
@@ -14445,7 +14239,7 @@ index 5a11ae2..a1a1c8a 100644
  static int mce_chrdev_open_exclu;	/* already open exclusive? */
  
  static int mce_chrdev_open(struct inode *inode, struct file *file)
-@@ -1491,7 +1494,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
+@@ -1499,7 +1502,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
  	spin_lock(&mce_chrdev_state_lock);
  
  	if (mce_chrdev_open_exclu ||
@@ -14454,7 +14248,7 @@ index 5a11ae2..a1a1c8a 100644
  		spin_unlock(&mce_chrdev_state_lock);
  
  		return -EBUSY;
-@@ -1499,7 +1502,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
+@@ -1507,7 +1510,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
  
  	if (file->f_flags & O_EXCL)
  		mce_chrdev_open_exclu = 1;
@@ -14463,7 +14257,7 @@ index 5a11ae2..a1a1c8a 100644
  
  	spin_unlock(&mce_chrdev_state_lock);
  
-@@ -1510,7 +1513,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
+@@ -1518,7 +1521,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
  {
  	spin_lock(&mce_chrdev_state_lock);
  
@@ -14472,7 +14266,7 @@ index 5a11ae2..a1a1c8a 100644
  	mce_chrdev_open_exclu = 0;
  
  	spin_unlock(&mce_chrdev_state_lock);
-@@ -2229,7 +2232,7 @@ struct dentry *mce_get_debugfs_dir(void)
+@@ -2237,7 +2240,7 @@ struct dentry *mce_get_debugfs_dir(void)
  static void mce_reset(void)
  {
  	cpu_missing = 0;
@@ -24685,7 +24479,7 @@ index 8ecbb4b..a269cab 100644
  	}
  	if (mm->get_unmapped_area == arch_get_unmapped_area)
 diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index 6cabf65..00139c4 100644
+index 6cabf65..74565da 100644
 --- a/arch/x86/mm/init.c
 +++ b/arch/x86/mm/init.c
 @@ -17,6 +17,8 @@
@@ -24762,7 +24556,7 @@ index 6cabf65..00139c4 100644
 +	}
 +	if (ebda_addr && ebda_size) {
 +		ebda_start = ebda_addr >> PAGE_SHIFT;
-+		ebda_end = min(PAGE_ALIGN(ebda_addr + ebda_size), 0xa0000) >> PAGE_SHIFT;
++		ebda_end = min((unsigned int)PAGE_ALIGN(ebda_addr + ebda_size), (unsigned int)0xa0000) >> PAGE_SHIFT;
 +	} else {
 +		ebda_start = 0x9f000 >> PAGE_SHIFT;
 +		ebda_end = 0xa0000 >> PAGE_SHIFT;
@@ -24780,6 +24574,11 @@ index 6cabf65..00139c4 100644
 +	unsigned long addr, limit;
 +	struct desc_struct d;
 +	int cpu;
++#else
++	pgd_t *pgd;
++	pud_t *pud;
++	pmd_t *pmd;
++	unsigned long addr, end;
 +#endif
 +#endif
 +
@@ -24825,11 +24624,6 @@ index 6cabf65..00139c4 100644
 +#endif
 +
 +#else
-+	pgd_t *pgd;
-+	pud_t *pud;
-+	pmd_t *pmd;
-+	unsigned long addr, end;
-+
 +	/* PaX: make kernel code/rodata read-only, rest non-executable */
 +	for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
 +		pgd = pgd_offset_k(addr);
@@ -25701,10 +25495,10 @@ index 9f0614d..92ae64a 100644
  	p += get_opcode(p, &opcode);
  	for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
 diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
-index 8573b83..7d9628f 100644
+index 8573b83..4f3ed7e 100644
 --- a/arch/x86/mm/pgtable.c
 +++ b/arch/x86/mm/pgtable.c
-@@ -84,10 +84,60 @@ static inline void pgd_list_del(pgd_t *pgd)
+@@ -84,10 +84,64 @@ static inline void pgd_list_del(pgd_t *pgd)
  	list_del(&page->lru);
  }
  
@@ -25713,16 +25507,20 @@ index 8573b83..7d9628f 100644
 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
 +pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
  
-+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
++void __shadow_user_pgds(pgd_t *dst, const pgd_t *src)
 +{
++	unsigned int count = USER_PGD_PTRS;
+ 
 +	while (count--)
 +		*dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
 +}
 +#endif
- 
++
 +#ifdef CONFIG_PAX_PER_CPU_PGD
-+void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
++void __clone_user_pgds(pgd_t *dst, const pgd_t *src)
 +{
++	unsigned int count = USER_PGD_PTRS;
++
 +	while (count--) {
 +		pgd_t pgd;
 +
@@ -25767,7 +25565,7 @@ index 8573b83..7d9628f 100644
  static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
  {
  	BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
-@@ -128,6 +178,7 @@ static void pgd_dtor(pgd_t *pgd)
+@@ -128,6 +182,7 @@ static void pgd_dtor(pgd_t *pgd)
  	pgd_list_del(pgd);
  	spin_unlock(&pgd_lock);
  }
@@ -25775,7 +25573,7 @@ index 8573b83..7d9628f 100644
  
  /*
   * List of all pgd's needed for non-PAE so it can invalidate entries
-@@ -140,7 +191,7 @@ static void pgd_dtor(pgd_t *pgd)
+@@ -140,7 +195,7 @@ static void pgd_dtor(pgd_t *pgd)
   * -- wli
   */
  
@@ -25784,7 +25582,7 @@ index 8573b83..7d9628f 100644
  /*
   * In PAE mode, we need to do a cr3 reload (=tlb flush) when
   * updating the top-level pagetable entries to guarantee the
-@@ -152,7 +203,7 @@ static void pgd_dtor(pgd_t *pgd)
+@@ -152,7 +207,7 @@ static void pgd_dtor(pgd_t *pgd)
   * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
   * and initialize the kernel pmds here.
   */
@@ -25793,7 +25591,7 @@ index 8573b83..7d9628f 100644
  
  void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
  {
-@@ -170,36 +221,38 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
+@@ -170,36 +225,38 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
  	 */
  	flush_tlb_mm(mm);
  }
@@ -25843,7 +25641,7 @@ index 8573b83..7d9628f 100644
  		return -ENOMEM;
  	}
  
-@@ -212,51 +265,55 @@ static int preallocate_pmds(pmd_t *pmds[])
+@@ -212,51 +269,55 @@ static int preallocate_pmds(pmd_t *pmds[])
   * preallocate which never got a corresponding vma will need to be
   * freed manually.
   */
@@ -25916,7 +25714,7 @@ index 8573b83..7d9628f 100644
  
  	pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
  
-@@ -265,11 +322,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
+@@ -265,11 +326,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
  
  	mm->pgd = pgd;
  
@@ -25930,7 +25728,7 @@ index 8573b83..7d9628f 100644
  
  	/*
  	 * Make sure that pre-populating the pmds is atomic with
-@@ -279,14 +336,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
+@@ -279,14 +340,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
  	spin_lock(&pgd_lock);
  
  	pgd_ctor(mm, pgd);
@@ -25948,7 +25746,7 @@ index 8573b83..7d9628f 100644
  out_free_pgd:
  	free_page((unsigned long)pgd);
  out:
-@@ -295,7 +352,7 @@ out:
+@@ -295,7 +356,7 @@ out:
  
  void pgd_free(struct mm_struct *mm, pgd_t *pgd)
  {
@@ -26852,6 +26650,206 @@ index f10c0af..3ec1f95 100644
  
  	syscall_init();				/* This sets MSR_*STAR and related */
  #endif
+diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
+index b685296..5cdc8ad 100644
+--- a/arch/x86/tools/relocs.c
++++ b/arch/x86/tools/relocs.c
+@@ -14,8 +14,16 @@
+ 
+ static void die(char *fmt, ...);
+ 
++#include "../../../include/generated/autoconf.h"
++#ifdef CONFIG_X86_32
++#define __PAGE_OFFSET CONFIG_PAGE_OFFSET
++#else
++#define __PAGE_OFFSET 0
++#endif
++
+ #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+ static Elf32_Ehdr ehdr;
++static Elf32_Phdr *phdr;
+ static unsigned long reloc_count, reloc_idx;
+ static unsigned long *relocs;
+ static unsigned long reloc16_count, reloc16_idx;
+@@ -323,9 +331,39 @@ static void read_ehdr(FILE *fp)
+ 	}
+ }
+ 
++static void read_phdrs(FILE *fp)
++{
++	unsigned int i;
++
++	phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
++	if (!phdr) {
++		die("Unable to allocate %d program headers\n",
++		    ehdr.e_phnum);
++	}
++	if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
++		die("Seek to %d failed: %s\n",
++			ehdr.e_phoff, strerror(errno));
++	}
++	if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
++		die("Cannot read ELF program headers: %s\n",
++			strerror(errno));
++	}
++	for(i = 0; i < ehdr.e_phnum; i++) {
++		phdr[i].p_type      = elf32_to_cpu(phdr[i].p_type);
++		phdr[i].p_offset    = elf32_to_cpu(phdr[i].p_offset);
++		phdr[i].p_vaddr     = elf32_to_cpu(phdr[i].p_vaddr);
++		phdr[i].p_paddr     = elf32_to_cpu(phdr[i].p_paddr);
++		phdr[i].p_filesz    = elf32_to_cpu(phdr[i].p_filesz);
++		phdr[i].p_memsz     = elf32_to_cpu(phdr[i].p_memsz);
++		phdr[i].p_flags     = elf32_to_cpu(phdr[i].p_flags);
++		phdr[i].p_align     = elf32_to_cpu(phdr[i].p_align);
++	}
++
++}
++
+ static void read_shdrs(FILE *fp)
+ {
+-	int i;
++	unsigned int i;
+ 	Elf32_Shdr shdr;
+ 
+ 	secs = calloc(ehdr.e_shnum, sizeof(struct section));
+@@ -360,7 +398,7 @@ static void read_shdrs(FILE *fp)
+ 
+ static void read_strtabs(FILE *fp)
+ {
+-	int i;
++	unsigned int i;
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_STRTAB) {
+@@ -385,7 +423,7 @@ static void read_strtabs(FILE *fp)
+ 
+ static void read_symtabs(FILE *fp)
+ {
+-	int i,j;
++	unsigned int i,j;
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_SYMTAB) {
+@@ -418,7 +456,9 @@ static void read_symtabs(FILE *fp)
+ 
+ static void read_relocs(FILE *fp)
+ {
+-	int i,j;
++	unsigned int i,j;
++	uint32_t base;
++
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_REL) {
+@@ -438,9 +478,18 @@ static void read_relocs(FILE *fp)
+ 			die("Cannot read symbol table: %s\n",
+ 				strerror(errno));
+ 		}
++		base = 0;
++		for (j = 0; j < ehdr.e_phnum; j++) {
++			if (phdr[j].p_type != PT_LOAD )
++				continue;
++			if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
++				continue;
++			base = __PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
++			break;
++		}
+ 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
+ 			Elf32_Rel *rel = &sec->reltab[j];
+-			rel->r_offset = elf32_to_cpu(rel->r_offset);
++			rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
+ 			rel->r_info   = elf32_to_cpu(rel->r_info);
+ 		}
+ 	}
+@@ -449,13 +498,13 @@ static void read_relocs(FILE *fp)
+ 
+ static void print_absolute_symbols(void)
+ {
+-	int i;
++	unsigned int i;
+ 	printf("Absolute symbols\n");
+ 	printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		char *sym_strtab;
+-		int j;
++		unsigned int j;
+ 
+ 		if (sec->shdr.sh_type != SHT_SYMTAB) {
+ 			continue;
+@@ -482,14 +531,14 @@ static void print_absolute_symbols(void)
+ 
+ static void print_absolute_relocs(void)
+ {
+-	int i, printed = 0;
++	unsigned int i, printed = 0;
+ 
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		struct section *sec_applies, *sec_symtab;
+ 		char *sym_strtab;
+ 		Elf32_Sym *sh_symtab;
+-		int j;
++		unsigned int j;
+ 		if (sec->shdr.sh_type != SHT_REL) {
+ 			continue;
+ 		}
+@@ -551,13 +600,13 @@ static void print_absolute_relocs(void)
+ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym),
+ 			int use_real_mode)
+ {
+-	int i;
++	unsigned int i;
+ 	/* Walk through the relocations */
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		char *sym_strtab;
+ 		Elf32_Sym *sh_symtab;
+ 		struct section *sec_applies, *sec_symtab;
+-		int j;
++		unsigned int j;
+ 		struct section *sec = &secs[i];
+ 
+ 		if (sec->shdr.sh_type != SHT_REL) {
+@@ -583,6 +632,22 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym),
+ 
+ 			shn_abs = sym->st_shndx == SHN_ABS;
+ 
++			/* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
++			if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
++				continue;
++
++#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
++			/* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
++			if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
++				continue;
++#endif
++
+ 			switch (r_type) {
+ 			case R_386_NONE:
+ 			case R_386_PC32:
+@@ -674,7 +739,7 @@ static int write32(unsigned int v, FILE *f)
+ 
+ static void emit_relocs(int as_text, int use_real_mode)
+ {
+-	int i;
++	unsigned int i;
+ 	/* Count how many relocations I have and allocate space for them. */
+ 	reloc_count = 0;
+ 	walk_relocs(count_reloc, use_real_mode);
+@@ -801,6 +866,7 @@ int main(int argc, char **argv)
+ 			fname, strerror(errno));
+ 	}
+ 	read_ehdr(fp);
++	read_phdrs(fp);
+ 	read_shdrs(fp);
+ 	read_strtabs(fp);
+ 	read_symtabs(fp);
 diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
 index 5d17950..2253fc9 100644
 --- a/arch/x86/vdso/Makefile
@@ -27025,7 +27023,7 @@ index 153407c..611cba9 100644
 -}
 -__setup("vdso=", vdso_setup);
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 4e517d4..68a48f5 100644
+index 4e517d4..8426127 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
 @@ -86,8 +86,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -27037,7 +27035,18 @@ index 4e517d4..68a48f5 100644
  RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
  __read_mostly int xen_have_vector_callback;
  EXPORT_SYMBOL_GPL(xen_have_vector_callback);
-@@ -1030,30 +1028,30 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
+@@ -982,7 +980,10 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = {
+ 	.wbinvd = native_wbinvd,
+ 
+ 	.read_msr = native_read_msr_safe,
++	.rdmsr_regs = native_rdmsr_safe_regs,
+ 	.write_msr = xen_write_msr_safe,
++	.wrmsr_regs = native_wrmsr_safe_regs,
++
+ 	.read_tsc = native_read_tsc,
+ 	.read_pmc = native_read_pmc,
+ 
+@@ -1030,30 +1031,30 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
  #endif
  };
  
@@ -27075,7 +27084,7 @@ index 4e517d4..68a48f5 100644
  {
  	if (pm_power_off)
  		pm_power_off();
-@@ -1156,7 +1154,17 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1156,7 +1157,17 @@ asmlinkage void __init xen_start_kernel(void)
  	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
  
  	/* Work out if we support NX */
@@ -27094,7 +27103,7 @@ index 4e517d4..68a48f5 100644
  
  	xen_setup_features();
  
-@@ -1187,13 +1195,6 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1187,13 +1198,6 @@ asmlinkage void __init xen_start_kernel(void)
  
  	machine_ops = xen_machine_ops;
  
@@ -28703,6 +28712,25 @@ index 8493536..31adee0 100644
  	if (err)
  		printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
  	else
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 90aa2a1..af1a177 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -592,11 +592,9 @@ static ssize_t print_nodes_state(enum node_states state, char *buf)
+ {
+ 	int n;
+ 
+-	n = nodelist_scnprintf(buf, PAGE_SIZE, node_states[state]);
+-	if (n > 0 && PAGE_SIZE > n + 1) {
+-		*(buf + n++) = '\n';
+-		*(buf + n++) = '\0';
+-	}
++	n = nodelist_scnprintf(buf, PAGE_SIZE-2, node_states[state]);
++	buf[n++] = '\n';
++	buf[n] = '\0';
+ 	return n;
+ }
+ 
 diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
 index caf995f..6f76697 100644
 --- a/drivers/base/power/wakeup.c
@@ -30629,10 +30657,10 @@ index e159e33..cdcc663 100644
  	for (i = 0; i < count; i++) {
  		char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
 diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index 5bd4361..0241a42 100644
+index 307c5e6..a1e4216 100644
 --- a/drivers/gpu/drm/i915/i915_irq.c
 +++ b/drivers/gpu/drm/i915/i915_irq.c
-@@ -475,7 +475,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
+@@ -472,7 +472,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
  	u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir;
  	struct drm_i915_master_private *master_priv;
  
@@ -30641,7 +30669,7 @@ index 5bd4361..0241a42 100644
  
  	/* disable master interrupt before clearing iir  */
  	de_ier = I915_READ(DEIER);
-@@ -566,7 +566,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
+@@ -563,7 +563,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
  	struct drm_i915_master_private *master_priv;
  	u32 bsd_usr_interrupt = GT_BSD_USER_INTERRUPT;
  
@@ -30650,7 +30678,7 @@ index 5bd4361..0241a42 100644
  
  	if (IS_GEN6(dev))
  		bsd_usr_interrupt = GT_GEN6_BSD_USER_INTERRUPT;
-@@ -1231,7 +1231,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
+@@ -1228,7 +1228,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
  	int ret = IRQ_NONE, pipe;
  	bool blc_event = false;
  
@@ -30659,7 +30687,7 @@ index 5bd4361..0241a42 100644
  
  	iir = I915_READ(IIR);
  
-@@ -1743,7 +1743,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
+@@ -1740,7 +1740,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
  {
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  
@@ -30668,7 +30696,7 @@ index 5bd4361..0241a42 100644
  
  	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
  	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
-@@ -1932,7 +1932,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev)
+@@ -1929,7 +1929,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev)
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  	int pipe;
  
@@ -30678,7 +30706,7 @@ index 5bd4361..0241a42 100644
  	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
  	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 2163818..cede019 100644
+index 9ab9b16..e5b1b8d 100644
 --- a/drivers/gpu/drm/i915/intel_display.c
 +++ b/drivers/gpu/drm/i915/intel_display.c
 @@ -2238,7 +2238,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
@@ -31433,6 +31461,19 @@ index 75dbe34..f9204a8 100644
  
  	hid_debug_register(hdev, dev_name(&hdev->dev));
  	ret = device_add(&hdev->dev);
+diff --git a/drivers/hid/hid-wiimote-debug.c b/drivers/hid/hid-wiimote-debug.c
+index 17dabc1..bf248eb 100644
+--- a/drivers/hid/hid-wiimote-debug.c
++++ b/drivers/hid/hid-wiimote-debug.c
+@@ -72,7 +72,7 @@ static ssize_t wiidebug_eeprom_read(struct file *f, char __user *u, size_t s,
+ 	else if (size == 0)
+ 		return -EIO;
+ 
+-	if (copy_to_user(u, buf, size))
++	if (size > sizeof(buf) || copy_to_user(u, buf, size))
+ 		return -EFAULT;
+ 
+ 	*off += size;
 diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
 index b1ec0e2..c295a61 100644
 --- a/drivers/hid/usbhid/hiddev.c
@@ -33203,6 +33244,19 @@ index 1f355bb..43f1fea 100644
  				return -EFAULT;
  		} else
  			memcpy(msg, buf, count);
+diff --git a/drivers/leds/leds-mc13783.c b/drivers/leds/leds-mc13783.c
+index 8bc4915..4cc6a2e 100644
+--- a/drivers/leds/leds-mc13783.c
++++ b/drivers/leds/leds-mc13783.c
+@@ -280,7 +280,7 @@ static int __devinit mc13783_led_probe(struct platform_device *pdev)
+ 		return -EINVAL;
+ 	}
+ 
+-	led = kzalloc(sizeof(*led) * pdata->num_leds, GFP_KERNEL);
++	led = kcalloc(pdata->num_leds, sizeof(*led), GFP_KERNEL);
+ 	if (led == NULL) {
+ 		dev_err(&pdev->dev, "failed to alloc memory\n");
+ 		return -ENOMEM;
 diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
 index b5fdcb7..5b6c59f 100644
 --- a/drivers/lguest/core.c
@@ -33592,7 +33646,7 @@ index b89c548..2af3ce4 100644
  
  void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
 diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 363aaf4..d875264 100644
+index 1ae4327..4ecabb5 100644
 --- a/drivers/md/md.c
 +++ b/drivers/md/md.c
 @@ -277,10 +277,10 @@ EXPORT_SYMBOL_GPL(md_trim_bio);
@@ -34002,7 +34056,7 @@ index 8418c02..8555013 100644
  	NGENE_ID(0x18c3, 0xabc4, ngene_info_cineS2),
  	NGENE_ID(0x18c3, 0xdb01, ngene_info_satixS2),
 diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c
-index 16a089f..ab1667d 100644
+index 16a089f..1661b11 100644
 --- a/drivers/media/radio/radio-cadet.c
 +++ b/drivers/media/radio/radio-cadet.c
 @@ -326,6 +326,8 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
@@ -34014,6 +34068,15 @@ index 16a089f..ab1667d 100644
  	mutex_lock(&dev->lock);
  	if (dev->rdsstat == 0) {
  		dev->rdsstat = 1;
+@@ -347,7 +349,7 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
+ 		readbuf[i++] = dev->rdsbuf[dev->rdsout++];
+ 	mutex_unlock(&dev->lock);
+ 
+-	if (copy_to_user(data, readbuf, i))
++	if (i > sizeof(readbuf) || copy_to_user(data, readbuf, i))
+ 		return -EFAULT;
+ 	return i;
+ }
 diff --git a/drivers/media/video/au0828/au0828.h b/drivers/media/video/au0828/au0828.h
 index 9cde353..8c6a1c3 100644
 --- a/drivers/media/video/au0828/au0828.h
@@ -36545,7 +36608,7 @@ index 351dc0b..951dc32 100644
  
  	/* These three are default values which can be overridden */
 diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
-index b96962c..0c82ec2 100644
+index e640b73..2f68432 100644
 --- a/drivers/scsi/hpsa.c
 +++ b/drivers/scsi/hpsa.c
 @@ -507,7 +507,7 @@ static inline u32 next_command(struct ctlr_info *h)
@@ -36557,7 +36620,7 @@ index b96962c..0c82ec2 100644
  
  	if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
  		a = *(h->reply_pool_head); /* Next cmd in ring buffer */
-@@ -2991,7 +2991,7 @@ static void start_io(struct ctlr_info *h)
+@@ -2987,7 +2987,7 @@ static void start_io(struct ctlr_info *h)
  	while (!list_empty(&h->reqQ)) {
  		c = list_entry(h->reqQ.next, struct CommandList, list);
  		/* can't do anything if fifo is full */
@@ -36566,7 +36629,7 @@ index b96962c..0c82ec2 100644
  			dev_warn(&h->pdev->dev, "fifo full\n");
  			break;
  		}
-@@ -3001,7 +3001,7 @@ static void start_io(struct ctlr_info *h)
+@@ -2997,7 +2997,7 @@ static void start_io(struct ctlr_info *h)
  		h->Qdepth--;
  
  		/* Tell the controller execute command */
@@ -36575,7 +36638,7 @@ index b96962c..0c82ec2 100644
  
  		/* Put job onto the completed Q */
  		addQ(&h->cmpQ, c);
-@@ -3010,17 +3010,17 @@ static void start_io(struct ctlr_info *h)
+@@ -3006,17 +3006,17 @@ static void start_io(struct ctlr_info *h)
  
  static inline unsigned long get_next_completion(struct ctlr_info *h)
  {
@@ -36596,7 +36659,7 @@ index b96962c..0c82ec2 100644
  		(h->interrupts_enabled == 0);
  }
  
-@@ -3919,7 +3919,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h)
+@@ -3915,7 +3915,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h)
  	if (prod_index < 0)
  		return -ENODEV;
  	h->product_name = products[prod_index].product_name;
@@ -36605,7 +36668,7 @@ index b96962c..0c82ec2 100644
  
  	if (hpsa_board_disabled(h->pdev)) {
  		dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
-@@ -4164,7 +4164,7 @@ static void controller_lockup_detected(struct ctlr_info *h)
+@@ -4160,7 +4160,7 @@ static void controller_lockup_detected(struct ctlr_info *h)
  
  	assert_spin_locked(&lockup_detector_lock);
  	remove_ctlr_from_lockup_detector_list(h);
@@ -36614,7 +36677,7 @@ index b96962c..0c82ec2 100644
  	spin_lock_irqsave(&h->lock, flags);
  	h->lockup_detected = readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
  	spin_unlock_irqrestore(&h->lock, flags);
-@@ -4344,7 +4344,7 @@ reinit_after_soft_reset:
+@@ -4340,7 +4340,7 @@ reinit_after_soft_reset:
  	}
  
  	/* make sure the board interrupts are off */
@@ -36623,7 +36686,7 @@ index b96962c..0c82ec2 100644
  
  	if (hpsa_request_irq(h, do_hpsa_intr_msi, do_hpsa_intr_intx))
  		goto clean2;
-@@ -4378,7 +4378,7 @@ reinit_after_soft_reset:
+@@ -4374,7 +4374,7 @@ reinit_after_soft_reset:
  		 * fake ones to scoop up any residual completions.
  		 */
  		spin_lock_irqsave(&h->lock, flags);
@@ -36632,7 +36695,7 @@ index b96962c..0c82ec2 100644
  		spin_unlock_irqrestore(&h->lock, flags);
  		free_irq(h->intr[h->intr_mode], h);
  		rc = hpsa_request_irq(h, hpsa_msix_discard_completions,
-@@ -4397,9 +4397,9 @@ reinit_after_soft_reset:
+@@ -4393,9 +4393,9 @@ reinit_after_soft_reset:
  		dev_info(&h->pdev->dev, "Board READY.\n");
  		dev_info(&h->pdev->dev,
  			"Waiting for stale completions to drain.\n");
@@ -36644,7 +36707,7 @@ index b96962c..0c82ec2 100644
  
  		rc = controller_reset_failed(h->cfgtable);
  		if (rc)
-@@ -4420,7 +4420,7 @@ reinit_after_soft_reset:
+@@ -4416,7 +4416,7 @@ reinit_after_soft_reset:
  	}
  
  	/* Turn the interrupts on so we can service requests */
@@ -36653,7 +36716,7 @@ index b96962c..0c82ec2 100644
  
  	hpsa_hba_inquiry(h);
  	hpsa_register_scsi(h);	/* hook ourselves into SCSI subsystem */
-@@ -4472,7 +4472,7 @@ static void hpsa_shutdown(struct pci_dev *pdev)
+@@ -4468,7 +4468,7 @@ static void hpsa_shutdown(struct pci_dev *pdev)
  	 * To write all data in the battery backed cache to disks
  	 */
  	hpsa_flush_cache(h);
@@ -36662,7 +36725,7 @@ index b96962c..0c82ec2 100644
  	free_irq(h->intr[h->intr_mode], h);
  #ifdef CONFIG_PCI_MSI
  	if (h->msix_vector)
-@@ -4636,7 +4636,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h,
+@@ -4632,7 +4632,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h,
  		return;
  	}
  	/* Change the access methods to the performant access methods */
@@ -41489,7 +41552,7 @@ index 3c14e43..eafa544 100644
 +4 4 4  4 4 4  4 4 4  4 4 4  4 4 4  4 4 4
 +4 4 4  4 4 4
 diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c
-index a40c05e..785c583 100644
+index 5fd95e0..b4a96f8 100644
 --- a/drivers/video/udlfb.c
 +++ b/drivers/video/udlfb.c
 @@ -619,11 +619,11 @@ int dlfb_handle_damage(struct dlfb_data *dev, int x, int y,
@@ -41524,7 +41587,7 @@ index a40c05e..785c583 100644
  		    >> 10)), /* Kcycles */
  		   &dev->cpu_kcycles_used);
  }
-@@ -1368,7 +1368,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev,
+@@ -1371,7 +1371,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev,
  	struct fb_info *fb_info = dev_get_drvdata(fbdev);
  	struct dlfb_data *dev = fb_info->par;
  	return snprintf(buf, PAGE_SIZE, "%u\n",
@@ -41533,7 +41596,7 @@ index a40c05e..785c583 100644
  }
  
  static ssize_t metrics_bytes_identical_show(struct device *fbdev,
-@@ -1376,7 +1376,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev,
+@@ -1379,7 +1379,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev,
  	struct fb_info *fb_info = dev_get_drvdata(fbdev);
  	struct dlfb_data *dev = fb_info->par;
  	return snprintf(buf, PAGE_SIZE, "%u\n",
@@ -41542,7 +41605,7 @@ index a40c05e..785c583 100644
  }
  
  static ssize_t metrics_bytes_sent_show(struct device *fbdev,
-@@ -1384,7 +1384,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev,
+@@ -1387,7 +1387,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev,
  	struct fb_info *fb_info = dev_get_drvdata(fbdev);
  	struct dlfb_data *dev = fb_info->par;
  	return snprintf(buf, PAGE_SIZE, "%u\n",
@@ -41551,7 +41614,7 @@ index a40c05e..785c583 100644
  }
  
  static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
-@@ -1392,7 +1392,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
+@@ -1395,7 +1395,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
  	struct fb_info *fb_info = dev_get_drvdata(fbdev);
  	struct dlfb_data *dev = fb_info->par;
  	return snprintf(buf, PAGE_SIZE, "%u\n",
@@ -41560,7 +41623,7 @@ index a40c05e..785c583 100644
  }
  
  static ssize_t edid_show(
-@@ -1449,10 +1449,10 @@ static ssize_t metrics_reset_store(struct device *fbdev,
+@@ -1452,10 +1452,10 @@ static ssize_t metrics_reset_store(struct device *fbdev,
  	struct fb_info *fb_info = dev_get_drvdata(fbdev);
  	struct dlfb_data *dev = fb_info->par;
  
@@ -41849,7 +41912,7 @@ index e95d1b6..3454244 100644
  	  A.out (Assembler.OUTput) is a set of formats for libraries and
  	  executables used in the earliest versions of UNIX.  Linux used
 diff --git a/fs/aio.c b/fs/aio.c
-index b9d64d8..86cb1d5 100644
+index 3b65ee7..aa6ec34 100644
 --- a/fs/aio.c
 +++ b/fs/aio.c
 @@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx *ctx)
@@ -41861,7 +41924,7 @@ index b9d64d8..86cb1d5 100644
  		return -EINVAL;
  
  	nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
-@@ -1461,22 +1461,27 @@ static ssize_t aio_fsync(struct kiocb *iocb)
+@@ -1461,18 +1461,19 @@ static ssize_t aio_fsync(struct kiocb *iocb)
  static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
  {
  	ssize_t ret;
@@ -41883,11 +41946,15 @@ index b9d64d8..86cb1d5 100644
  				&kiocb->ki_iovec, 1);
  	if (ret < 0)
  		goto out;
+@@ -1481,6 +1482,11 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
+ 	if (ret < 0)
+ 		goto out;
  
 +	if (kiocb->ki_iovec == &iovstack) {
 +		kiocb->ki_inline_vec = iovstack;
 +		kiocb->ki_iovec = &kiocb->ki_inline_vec;
 +	}
++
  	kiocb->ki_nr_segs = kiocb->ki_nbytes;
  	kiocb->ki_cur_seg = 0;
  	/* ki_nbytes/left now reflect bytes instead of segs */
@@ -42934,10 +43001,10 @@ index 1bffbe0..c8c283e 100644
  			goto err;
  		}
 diff --git a/fs/bio.c b/fs/bio.c
-index b980ecd..74800bf 100644
+index 4fc4dbb..d3a5b93 100644
 --- a/fs/bio.c
 +++ b/fs/bio.c
-@@ -833,7 +833,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
+@@ -838,7 +838,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
  		/*
  		 * Overflow, abort
  		 */
@@ -42946,7 +43013,7 @@ index b980ecd..74800bf 100644
  			return ERR_PTR(-EINVAL);
  
  		nr_pages += end - start;
-@@ -1229,7 +1229,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
+@@ -1234,7 +1234,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
  	const int read = bio_data_dir(bio) == READ;
  	struct bio_map_data *bmd = bio->bi_private;
  	int i;
@@ -42956,7 +43023,7 @@ index b980ecd..74800bf 100644
  	__bio_for_each_segment(bvec, bio, i, 0) {
  		char *addr = page_address(bvec->bv_page);
 diff --git a/fs/block_dev.c b/fs/block_dev.c
-index 5e9f198..6bf9b1c 100644
+index 236dd6c..46c6530 100644
 --- a/fs/block_dev.c
 +++ b/fs/block_dev.c
 @@ -703,7 +703,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
@@ -44834,6 +44901,19 @@ index cb990b2..4820141 100644
  	trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
  
  	return 0;
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index f9d948f..8601f4b 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -161,6 +161,8 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size)
+ 	if (flex_gd == NULL)
+ 		goto out3;
+ 
++	if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_flex_group_data))
++		goto out2;
+ 	flex_gd->count = flexbg_size;
+ 
+ 	flex_gd->groups = kmalloc(sizeof(struct ext4_new_group_data) *
 diff --git a/fs/fcntl.c b/fs/fcntl.c
 index 22764c7..86372c9 100644
 --- a/fs/fcntl.c
@@ -60608,7 +60688,7 @@ index 84ccf8e..2e9b14c 100644
  };
  
 diff --git a/include/linux/fs.h b/include/linux/fs.h
-index f4b6e06..d6ba573 100644
+index fd65e0d..7232c62 100644
 --- a/include/linux/fs.h
 +++ b/include/linux/fs.h
 @@ -1628,7 +1628,8 @@ struct file_operations {
@@ -60704,7 +60784,7 @@ index c3da42d..c70e0df 100644
  int trace_set_clr_event(const char *system, const char *event, int set);
  
 diff --git a/include/linux/genhd.h b/include/linux/genhd.h
-index e61d319..0da8505 100644
+index 017a7fb..33a8507 100644
 --- a/include/linux/genhd.h
 +++ b/include/linux/genhd.h
 @@ -185,7 +185,7 @@ struct gendisk {
@@ -62768,6 +62848,27 @@ index 58969b2..ead129b 100644
  
  /**
   * preempt_notifier - key for installing preemption notifiers
+diff --git a/include/linux/printk.h b/include/linux/printk.h
+index f0e22f7..82dd544 100644
+--- a/include/linux/printk.h
++++ b/include/linux/printk.h
+@@ -94,6 +94,8 @@ void early_printk(const char *fmt, ...);
+ extern int printk_needs_cpu(int cpu);
+ extern void printk_tick(void);
+ 
++extern int kptr_restrict;
++
+ #ifdef CONFIG_PRINTK
+ asmlinkage __printf(1, 0)
+ int vprintk(const char *fmt, va_list args);
+@@ -112,7 +114,6 @@ extern bool printk_timed_ratelimit(unsigned long *caller_jiffies,
+ 
+ extern int printk_delay_msec;
+ extern int dmesg_restrict;
+-extern int kptr_restrict;
+ 
+ void log_buf_kexec_setup(void);
+ void __init setup_log_buf(int early);
 diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
 index 85c5073..51fac8b 100644
 --- a/include/linux/proc_fs.h
@@ -64480,10 +64581,10 @@ index 1c09820..7f5ec79 100644
  	TP_ARGS(irq, action, ret),
  
 diff --git a/include/video/udlfb.h b/include/video/udlfb.h
-index c41f308..6918de3 100644
+index f9466fa..f4e2b81 100644
 --- a/include/video/udlfb.h
 +++ b/include/video/udlfb.h
-@@ -52,10 +52,10 @@ struct dlfb_data {
+@@ -53,10 +53,10 @@ struct dlfb_data {
  	u32 pseudo_palette[256];
  	int blank_mode; /*one of FB_BLANK_ */
  	/* blit-only rendering path metrics, exposed through sysfs */
@@ -64834,7 +64935,7 @@ index 8216c30..25e8e32 100644
  	next_state = Reset;
  	return 0;
 diff --git a/init/main.c b/init/main.c
-index ff49a6d..5fa0429 100644
+index 45a7bf5..7ba1b61 100644
 --- a/init/main.c
 +++ b/init/main.c
 @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) { }
@@ -64896,7 +64997,7 @@ index ff49a6d..5fa0429 100644
  static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
  const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
  static const char *panic_later, *panic_param;
-@@ -675,6 +720,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -672,6 +717,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
  {
  	int count = preempt_count();
  	int ret;
@@ -64904,7 +65005,7 @@ index ff49a6d..5fa0429 100644
  
  	if (initcall_debug)
  		ret = do_one_initcall_debug(fn);
-@@ -687,15 +733,15 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -684,15 +730,15 @@ int __init_or_module do_one_initcall(initcall_t fn)
  		sprintf(msgbuf, "error code %d ", ret);
  
  	if (preempt_count() != count) {
@@ -64924,7 +65025,7 @@ index ff49a6d..5fa0429 100644
  	}
  
  	return ret;
-@@ -814,7 +860,7 @@ static int __init kernel_init(void * unused)
+@@ -815,7 +861,7 @@ static int __init kernel_init(void * unused)
  	do_basic_setup();
  
  	/* Open the /dev/console on the rootfs, this should never fail */
@@ -64933,7 +65034,7 @@ index ff49a6d..5fa0429 100644
  		printk(KERN_WARNING "Warning: unable to open an initial console.\n");
  
  	(void) sys_dup(0);
-@@ -827,11 +873,13 @@ static int __init kernel_init(void * unused)
+@@ -828,11 +874,13 @@ static int __init kernel_init(void * unused)
  	if (!ramdisk_execute_command)
  		ramdisk_execute_command = "/init";
  
@@ -65872,7 +65973,7 @@ index 46c8b14..d868958 100644
  {
  	struct signal_struct *sig = current->signal;
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 423d5a4..4608ecf 100644
+index 423d5a4..881923e 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -285,7 +285,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
@@ -65897,7 +65998,7 @@ index 423d5a4..4608ecf 100644
 +
 +	charge = 0;
 +	if (mpnt->vm_flags & VM_ACCOUNT) {
-+		unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
++		unsigned long len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
 +		if (security_vm_enough_memory(len))
 +			goto fail_nomem;
 +		charge = len;
@@ -68891,7 +68992,7 @@ index 888d227..f04b318 100644
  				break;
  			}
 diff --git a/kernel/sysctl.c b/kernel/sysctl.c
-index f03a6ef..5fcc8af 100644
+index f03a6ef..735d95c 100644
 --- a/kernel/sysctl.c
 +++ b/kernel/sysctl.c
 @@ -86,6 +86,13 @@
@@ -68908,7 +69009,18 @@ index f03a6ef..5fcc8af 100644
  
  /* External variables not in a header file. */
  extern int sysctl_overcommit_memory;
-@@ -191,6 +198,7 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
+@@ -165,10 +172,8 @@ static int proc_taint(struct ctl_table *table, int write,
+ 			       void __user *buffer, size_t *lenp, loff_t *ppos);
+ #endif
+ 
+-#ifdef CONFIG_PRINTK
+ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
+ 				void __user *buffer, size_t *lenp, loff_t *ppos);
+-#endif
+ 
+ #ifdef CONFIG_MAGIC_SYSRQ
+ /* Note: sysrq code uses it's own private copy */
+@@ -191,6 +196,7 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
  }
  
  #endif
@@ -68916,7 +69028,7 @@ index f03a6ef..5fcc8af 100644
  
  static struct ctl_table root_table[];
  static struct ctl_table_root sysctl_table_root;
-@@ -220,6 +228,20 @@ extern struct ctl_table epoll_table[];
+@@ -220,6 +226,20 @@ extern struct ctl_table epoll_table[];
  int sysctl_legacy_va_layout;
  #endif
  
@@ -68937,7 +69049,7 @@ index f03a6ef..5fcc8af 100644
  /* The default sysctl tables: */
  
  static struct ctl_table root_table[] = {
-@@ -266,6 +288,22 @@ static int max_extfrag_threshold = 1000;
+@@ -266,6 +286,22 @@ static int max_extfrag_threshold = 1000;
  #endif
  
  static struct ctl_table kern_table[] = {
@@ -68960,7 +69072,7 @@ index f03a6ef..5fcc8af 100644
  	{
  		.procname	= "sched_child_runs_first",
  		.data		= &sysctl_sched_child_runs_first,
-@@ -550,7 +588,7 @@ static struct ctl_table kern_table[] = {
+@@ -550,7 +586,7 @@ static struct ctl_table kern_table[] = {
  		.data		= &modprobe_path,
  		.maxlen		= KMOD_PATH_LEN,
  		.mode		= 0644,
@@ -68969,7 +69081,7 @@ index f03a6ef..5fcc8af 100644
  	},
  	{
  		.procname	= "modules_disabled",
-@@ -717,16 +755,20 @@ static struct ctl_table kern_table[] = {
+@@ -717,16 +753,20 @@ static struct ctl_table kern_table[] = {
  		.extra1		= &zero,
  		.extra2		= &one,
  	},
@@ -68991,7 +69103,7 @@ index f03a6ef..5fcc8af 100644
  	{
  		.procname	= "ngroups_max",
  		.data		= &ngroups_max,
-@@ -1225,6 +1267,13 @@ static struct ctl_table vm_table[] = {
+@@ -1225,6 +1265,13 @@ static struct ctl_table vm_table[] = {
  		.proc_handler	= proc_dointvec_minmax,
  		.extra1		= &zero,
  	},
@@ -69005,7 +69117,7 @@ index f03a6ef..5fcc8af 100644
  #else
  	{
  		.procname	= "nr_trim_pages",
-@@ -1729,6 +1778,17 @@ static int test_perm(int mode, int op)
+@@ -1729,6 +1776,17 @@ static int test_perm(int mode, int op)
  int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
  {
  	int mode;
@@ -69023,7 +69135,7 @@ index f03a6ef..5fcc8af 100644
  
  	if (root->permissions)
  		mode = root->permissions(root, current->nsproxy, table);
-@@ -2133,6 +2193,16 @@ int proc_dostring(struct ctl_table *table, int write,
+@@ -2133,6 +2191,16 @@ int proc_dostring(struct ctl_table *table, int write,
  			       buffer, lenp, ppos);
  }
  
@@ -69040,7 +69152,7 @@ index f03a6ef..5fcc8af 100644
  static size_t proc_skip_spaces(char **buf)
  {
  	size_t ret;
-@@ -2238,6 +2308,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
+@@ -2238,6 +2306,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
  	len = strlen(tmp);
  	if (len > *size)
  		len = *size;
@@ -69049,7 +69161,23 @@ index f03a6ef..5fcc8af 100644
  	if (copy_to_user(*buf, tmp, len))
  		return -EFAULT;
  	*size -= len;
-@@ -2554,8 +2626,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
+@@ -2430,7 +2500,6 @@ static int proc_taint(struct ctl_table *table, int write,
+ 	return err;
+ }
+ 
+-#ifdef CONFIG_PRINTK
+ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
+ 				void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+@@ -2439,7 +2508,6 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
+ 
+ 	return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+ }
+-#endif
+ 
+ struct do_proc_dointvec_minmax_conv_param {
+ 	int *min;
+@@ -2554,8 +2622,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
  			*i = val;
  		} else {
  			val = convdiv * (*i) / convmul;
@@ -69062,7 +69190,7 @@ index f03a6ef..5fcc8af 100644
  			err = proc_put_long(&buffer, &left, val, false);
  			if (err)
  				break;
-@@ -2950,6 +3025,12 @@ int proc_dostring(struct ctl_table *table, int write,
+@@ -2950,6 +3021,12 @@ int proc_dostring(struct ctl_table *table, int write,
  	return -ENOSYS;
  }
  
@@ -69075,7 +69203,7 @@ index f03a6ef..5fcc8af 100644
  int proc_dointvec(struct ctl_table *table, int write,
  		  void __user *buffer, size_t *lenp, loff_t *ppos)
  {
-@@ -3006,6 +3087,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
+@@ -3006,6 +3083,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
  EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
  EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
  EXPORT_SYMBOL(proc_dostring);
@@ -69964,7 +70092,7 @@ index 0000000..7cd6065
 @@ -0,0 +1 @@
 +-grsec
 diff --git a/mm/Kconfig b/mm/Kconfig
-index e338407..49b5b7a 100644
+index e338407..4210331 100644
 --- a/mm/Kconfig
 +++ b/mm/Kconfig
 @@ -247,10 +247,10 @@ config KSM
@@ -69981,6 +70109,15 @@ index e338407..49b5b7a 100644
  	  This is the portion of low virtual memory which should be protected
  	  from userspace allocation.  Keeping a user from writing to low pages
  	  can help reduce the impact of kernel NULL pointer bugs.
+@@ -280,7 +280,7 @@ config MEMORY_FAILURE
+ 
+ config HWPOISON_INJECT
+ 	tristate "HWPoison pages injector"
+-	depends on MEMORY_FAILURE && DEBUG_KERNEL && PROC_FS
++	depends on MEMORY_FAILURE && DEBUG_KERNEL && PROC_FS && !GRKERNSEC
+ 	select PROC_PAGE_MONITOR
+ 
+ config NOMMU_INITIAL_TRIM_EXCESS
 diff --git a/mm/filemap.c b/mm/filemap.c
 index b662757..3081ddd 100644
 --- a/mm/filemap.c
@@ -70061,7 +70198,7 @@ index 8f7fc39..69bf1e9 100644
  	/* if an huge pmd materialized from under us just retry later */
  	if (unlikely(pmd_trans_huge(*pmd)))
 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index fece520..7fad868 100644
+index fece520..e10da7f 100644
 --- a/mm/hugetlb.c
 +++ b/mm/hugetlb.c
 @@ -2146,6 +2146,15 @@ static void hugetlb_vm_op_open(struct vm_area_struct *vma)
@@ -70208,12 +70345,13 @@ index fece520..7fad868 100644
  	}
  
  	/*
-@@ -3009,6 +3076,9 @@ int hugetlb_reserve_pages(struct inode *inode,
+@@ -3009,6 +3076,10 @@ int hugetlb_reserve_pages(struct inode *inode,
  	if (!vma || vma->vm_flags & VM_MAYSHARE)
  		region_add(&inode->i_mapping->private_list, from, to);
  	return 0;
 +out_err:
-+	resv_map_put(vma);
++	if (vma)
++		resv_map_put(vma);
 +	return ret;
  }
  
@@ -71075,10 +71213,10 @@ index 10b4dda..06857f3 100644
  	 * Make sure the vDSO gets into every core dump.
  	 * Dumping its contents makes post-mortem fully interpretable later
 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index 0a37570..2048346 100644
+index a8f97d5..e2ed444 100644
 --- a/mm/mempolicy.c
 +++ b/mm/mempolicy.c
-@@ -640,6 +640,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
+@@ -619,6 +619,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
  	unsigned long vmstart;
  	unsigned long vmend;
  
@@ -71089,15 +71227,15 @@ index 0a37570..2048346 100644
  	vma = find_vma(mm, start);
  	if (!vma || vma->vm_start > start)
  		return -EFAULT;
-@@ -679,6 +683,16 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
- 		err = policy_vma(vma, new_pol);
- 		if (err)
- 			goto out;
+@@ -672,6 +676,16 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
+ 			if (err)
+ 				goto out;
+ 		}
 +
 +#ifdef CONFIG_PAX_SEGMEXEC
 +		vma_m = pax_find_mirror_vma(vma);
-+		if (vma_m) {
-+			err = policy_vma(vma_m, new_pol);
++		if (vma_m && vma_m->vm_ops && vma_m->vm_ops->set_policy) {
++			err = vma_m->vm_ops->set_policy(vma_m, new_pol);
 +			if (err)
 +				goto out;
 +		}
@@ -71106,7 +71244,7 @@ index 0a37570..2048346 100644
  	}
  
   out:
-@@ -1112,6 +1126,17 @@ static long do_mbind(unsigned long start, unsigned long len,
+@@ -1105,6 +1119,17 @@ static long do_mbind(unsigned long start, unsigned long len,
  
  	if (end < start)
  		return -EINVAL;
@@ -71124,7 +71262,7 @@ index 0a37570..2048346 100644
  	if (end == start)
  		return 0;
  
-@@ -1330,6 +1355,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
+@@ -1323,6 +1348,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
  	if (!mm)
  		goto out;
  
@@ -71139,7 +71277,7 @@ index 0a37570..2048346 100644
  	/*
  	 * Check if this process has the right to modify the specified
  	 * process. The right exists if the process has administrative
-@@ -1339,8 +1372,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
+@@ -1332,8 +1365,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
  	rcu_read_lock();
  	tcred = __task_cred(task);
  	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
@@ -73948,7 +74086,7 @@ index 14380e9..e244704 100644
  }
  
 diff --git a/mm/swapfile.c b/mm/swapfile.c
-index f31b29d..8bdcae2 100644
+index 099c209..7db7b6f 100644
 --- a/mm/swapfile.c
 +++ b/mm/swapfile.c
 @@ -61,7 +61,7 @@ static DEFINE_MUTEX(swapon_mutex);
@@ -74016,7 +74154,7 @@ index 136ac4f..f917fa9 100644
  	mm->unmap_area = arch_unmap_area;
  }
 diff --git a/mm/vmalloc.c b/mm/vmalloc.c
-index 86ce9a5..fc9fb61 100644
+index 86ce9a5..550d03c 100644
 --- a/mm/vmalloc.c
 +++ b/mm/vmalloc.c
 @@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
@@ -74215,6 +74353,17 @@ index 86ce9a5..fc9fb61 100644
  	if ((PAGE_SIZE-1) & (unsigned long)addr)
  		return -EINVAL;
  
+@@ -2375,8 +2442,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
+ 		return NULL;
+ 	}
+ 
+-	vms = kzalloc(sizeof(vms[0]) * nr_vms, GFP_KERNEL);
+-	vas = kzalloc(sizeof(vas[0]) * nr_vms, GFP_KERNEL);
++	vms = kcalloc(nr_vms, sizeof(vms[0]), GFP_KERNEL);
++	vas = kcalloc(nr_vms, sizeof(vas[0]), GFP_KERNEL);
+ 	if (!vas || !vms)
+ 		goto err_free2;
+ 
 diff --git a/mm/vmstat.c b/mm/vmstat.c
 index f600557..1459fc8 100644
 --- a/mm/vmstat.c
@@ -78114,28 +78263,6 @@ index 1ac414f..a1c1451 100644
  # Remove .so files from "xxx-objs"
  host-cobjs	:= $(filter-out %.so,$(host-cobjs))
  
-diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
-index 00c368c..bb3f3e9 100644
---- a/scripts/Makefile.lib
-+++ b/scripts/Makefile.lib
-@@ -144,14 +144,14 @@ __a_flags	=                          $(call flags,_a_flags)
- __cpp_flags     =                          $(call flags,_cpp_flags)
- endif
- 
--c_flags        = -Wp,-MD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
-+c_flags        = -Wp,-MD,$(depfile) $(LINUXINCLUDE) $(NOSTDINC_FLAGS)     \
- 		 $(__c_flags) $(modkern_cflags)                           \
- 		 -D"KBUILD_STR(s)=\#s" $(basename_flags) $(modname_flags)
- 
--a_flags        = -Wp,-MD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
-+a_flags        = -Wp,-MD,$(depfile) $(LINUXINCLUDE) $(NOSTDINC_FLAGS)     \
- 		 $(__a_flags) $(modkern_aflags)
- 
--cpp_flags      = -Wp,-MD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
-+cpp_flags      = -Wp,-MD,$(depfile) $(LINUXINCLUDE) $(NOSTDINC_FLAGS)     \
- 		 $(__cpp_flags)
- 
- ld_flags       = $(LDFLAGS) $(ldflags-y)
 diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
 index cb1f50c..cef2a7c 100644
 --- a/scripts/basic/fixdep.c
@@ -80278,10 +80405,10 @@ index 0000000..ee950d0
 +}
 diff --git a/tools/gcc/constify_plugin.c b/tools/gcc/constify_plugin.c
 new file mode 100644
-index 0000000..88a7438
+index 0000000..89b7f56
 --- /dev/null
 +++ b/tools/gcc/constify_plugin.c
-@@ -0,0 +1,303 @@
+@@ -0,0 +1,328 @@
 +/*
 + * Copyright 2011 by Emese Revfy <re.emese@gmail.com>
 + * Copyright 2011 by PaX Team <pageexec@freemail.hu>
@@ -80322,24 +80449,47 @@ index 0000000..88a7438
 +int plugin_is_GPL_compatible;
 +
 +static struct plugin_info const_plugin_info = {
-+	.version	= "201111150100",
++	.version	= "201205300030",
 +	.help		= "no-constify\tturn off constification\n",
 +};
 +
-+static void constify_type(tree type);
-+static bool walk_struct(tree node);
++static void deconstify_tree(tree node);
 +
-+static tree deconstify_type(tree old_type)
++static void deconstify_type(tree type)
 +{
-+	tree new_type, field;
++	tree field;
++
++	for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
++		tree type = TREE_TYPE(field);
++
++		if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
++			continue;
++		if (!TYPE_READONLY(type))
++			continue;
++
++		deconstify_tree(field);
++	}
++	TYPE_READONLY(type) = 0;
++	C_TYPE_FIELDS_READONLY(type) = 0;
++}
++
++static void deconstify_tree(tree node)
++{
++	tree old_type, new_type, field;
++
++	old_type = TREE_TYPE(node);
++
++	gcc_assert(TYPE_READONLY(old_type) && (TYPE_QUALS(old_type) & TYPE_QUAL_CONST));
 +
 +	new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
 +	TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
 +	for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
 +		DECL_FIELD_CONTEXT(field) = new_type;
-+	TYPE_READONLY(new_type) = 0;
-+	C_TYPE_FIELDS_READONLY(new_type) = 0;
-+	return new_type;
++
++	deconstify_type(new_type);
++
++	TREE_READONLY(node) = 0;
++	TREE_TYPE(node) = new_type;
 +}
 +
 +static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
@@ -80383,14 +80533,19 @@ index 0000000..88a7438
 +	}
 +
 +	if (TREE_CODE(*node) == TYPE_DECL) {
-+		TREE_TYPE(*node) = deconstify_type(type);
-+		TREE_READONLY(*node) = 0;
++		deconstify_tree(*node);
 +		return NULL_TREE;
 +	}
 +
 +	return NULL_TREE;
 +}
 +
++static void constify_type(tree type)
++{
++	TYPE_READONLY(type) = 1;
++	C_TYPE_FIELDS_READONLY(type) = 1;
++}
++
 +static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
 +{
 +	*no_add_attrs = true;
@@ -80441,12 +80596,6 @@ index 0000000..88a7438
 +	register_attribute(&do_const_attr);
 +}
 +
-+static void constify_type(tree type)
-+{
-+	TYPE_READONLY(type) = 1;
-+	C_TYPE_FIELDS_READONLY(type) = 1;
-+}
-+
 +static bool is_fptr(tree field)
 +{
 +	tree ptr = TREE_TYPE(field);
@@ -80461,11 +80610,14 @@ index 0000000..88a7438
 +{
 +	tree field;
 +
-+	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node)))
++	if (TYPE_FIELDS(node) == NULL_TREE)
 +		return false;
 +
-+	if (TYPE_FIELDS(node) == NULL_TREE)
++	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node))) {
++		gcc_assert(!TYPE_READONLY(node));
++		deconstify_type(node);
 +		return false;
++	}
 +
 +	for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
 +		tree type = TREE_TYPE(field);
@@ -95132,7 +95284,7 @@ index 0000000..ce7366b
 +};
 diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
 new file mode 100644
-index 0000000..4154daf
+index 0000000..92b8ee6
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin.c
 @@ -0,0 +1,1188 @@
@@ -95358,7 +95510,7 @@ index 0000000..4154daf
 +	const char *curfunc = NAME(func);
 +
 +	new_hash = get_hash_num(curfunc, filename, 0);
-+	inform(loc, "Function %s is missing from the size_overflow hash table +%s+%d+%u+%s+", curfunc, curfunc, argnum, new_hash, filename);
++//	inform(loc, "Function %s is missing from the size_overflow hash table +%s+%d+%u+%s+", curfunc, curfunc, argnum, new_hash, filename);
 +}
 +
 +static void check_missing_attribute(tree arg)