]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blob - test/changelog-test.txt
23075a74f96b4824412b37da13f3398b787bdfcf
[thirdparty/grsecurity-scrape.git] / test / changelog-test.txt
1 commit c3f2cc8921a08fff1fbad9127dd7a30c4a953e88
2 Author: Brad Spengler <spender@grsecurity.net>
3 Date: Sat Nov 21 18:36:58 2015 -0500
4
5 Fix gcc 5.x compilation, reported by Arnaud and coldhak
6
7 tools/gcc/gcc-common.h | 2 +-
8 1 files changed, 1 insertions(+), 1 deletions(-)
9
10 commit f0ea1bc982c60c1c39d0f95d9f3db0ec799387ca
11 Merge: 3929e88 c692401
12 Author: Brad Spengler <spender@grsecurity.net>
13 Date: Sat Nov 21 15:41:38 2015 -0500
14
15 Merge branch 'pax-test' into grsec-test
16
17 commit c69240179ca6ff101670f4859bb0e9a9deb85359
18 Author: Brad Spengler <spender@grsecurity.net>
19 Date: Sat Nov 21 15:41:06 2015 -0500
20
21 Update to pax-linux-4.2.6-test22.patch:
22 - made the previous READ_ONCE/WRITE_ONCE fix compatible with gcc PR 58145
23
24 include/linux/compiler.h | 11 +++++++----
25 1 files changed, 7 insertions(+), 4 deletions(-)
26
27 commit 3929e882e451b177af1a615858f0a96a7cd734b1
28 Author: Brad Spengler <spender@grsecurity.net>
29 Date: Sat Nov 21 13:14:25 2015 -0500
30
31 remove disable_kill option entirely for the final 4.2 release
32
33 fs/exec.c | 11 -----------
34 security/Kconfig | 5 -----
35 2 files changed, 0 insertions(+), 16 deletions(-)
36
37 commit 91633d0eebc41553ea77b5fa7559aa806a60008c
38 Author: Brad Spengler <spender@grsecurity.net>
39 Date: Sat Nov 21 07:38:10 2015 -0500
40
41 compile fix
42
43 net/unix/af_unix.c | 1 +
44 1 files changed, 1 insertions(+), 0 deletions(-)
45
46 commit 0afc2f69e7f948995522f6e1dbb957ed84abd9b9
47 Author: Brad Spengler <spender@grsecurity.net>
48 Date: Sat Nov 21 07:14:43 2015 -0500
49
50 Revert previous AF_UNIX fix:
51 http://www.spinics.net/lists/netdev/msg318826.html
52 and apply new one by Jason Baron:
53 https://lkml.org/lkml/2015/9/29/825
54
55 include/net/af_unix.h | 1 +
56 net/unix/af_unix.c | 36 ++++++++++++++++++++++++++++++------
57 2 files changed, 31 insertions(+), 6 deletions(-)
58
59 commit 0a3eec2b3d110042af4e0a9f1e87458262fce1eb
60 Merge: 917a60c 8fd74af
61 Author: Brad Spengler <spender@grsecurity.net>
62 Date: Sat Nov 21 06:50:33 2015 -0500
63
64 Merge branch 'pax-test' into grsec-test
65
66 commit 8fd74afe08ee45516a9daf2593f31c176516cb55
67 Author: Brad Spengler <spender@grsecurity.net>
68 Date: Sat Nov 21 06:49:57 2015 -0500
69
70 Update to pax-linux-4.2.6-test21.patch:
71 - fixed a size overflow plugin bug that could cause a compiler error
72 - Emese fixed a size overflow false positive in xfrm4_mode_tunnel_input, reported by Arnaud <arnaud@drno.eu>
73 - updated gcc-common.h to support gcc-6
74 - fixed some undefined behaviour in READ_ONCE/WRITE_ONCE
75
76 include/linux/compiler.h | 38 +++----------------
77 tools/gcc/gcc-common.h | 39 ++++++++++++++++----
78 tools/gcc/initify_plugin.c | 4 +-
79 .../disable_size_overflow_hash.data | 7 +++-
80 .../size_overflow_plugin/intentional_overflow.c | 2 +-
81 .../size_overflow_plugin/size_overflow_hash.data | 9 +----
82 .../size_overflow_plugin/size_overflow_transform.c | 4 +-
83 7 files changed, 50 insertions(+), 53 deletions(-)
84
85 commit 917a60c749d80121229a1752874ff8a606778fc5
86 Merge: 76fc822 77d474f
87 Author: Brad Spengler <spender@grsecurity.net>
88 Date: Wed Nov 18 19:58:31 2015 -0500
89
90 Merge branch 'pax-test' into grsec-test
91
92 commit 77d474f0bcb2e5acafc78c66c456d1aebaac14b3
93 Author: Brad Spengler <spender@grsecurity.net>
94 Date: Wed Nov 18 19:58:08 2015 -0500
95
96 Update to pax-linux-4.2.6-test20.patch:
97 - constified some vdso/vsyscall related code/data
98
99 arch/x86/entry/vdso/vdso2c.h | 4 ++--
100 arch/x86/entry/vsyscall/vsyscall_emu_64.S | 2 +-
101 arch/x86/mm/ioremap.c | 2 +-
102 mm/debug.c | 3 +++
103 4 files changed, 7 insertions(+), 4 deletions(-)
104
105 commit 76fc8223b2e6b6c950702adfdb055dd5da90657c
106 Author: Brad Spengler <spender@grsecurity.net>
107 Date: Wed Nov 18 17:40:27 2015 -0500
108
109 Allow processes with CAP_SYS_PTRACE to ignore /proc/pid restrictions,
110 as reported by Andrew
111
112 fs/proc/base.c | 2 +-
113 1 files changed, 1 insertions(+), 1 deletions(-)
114
115 commit 708c2e025f8a05b76f319cfa5fa624d37d8ef6f3
116 Author: Brad Spengler <spender@grsecurity.net>
117 Date: Tue Nov 17 18:43:24 2015 -0500
118
119 Fix multiple character encodings in patch, reported by IooNag on the forums
120
121 grsecurity/Makefile | 2 +-
122 net/netfilter/xt_gradm.c | 2 +-
123 2 files changed, 2 insertions(+), 2 deletions(-)
124
125 commit d1f7534df8687fd05858fd45805b1185eafe38a7
126 Author: Hannes Frederic Sowa <hannes@stressinduktion.org>
127 Date: Tue Nov 17 15:10:59 2015 +0100
128
129 af_unix: take receive queue lock while appending new skb
130
131 While possibly in future we don't necessarily need to use
132 sk_buff_head.lock this is a rather larger change, as it affects the
133 af_unix fd garbage collector, diag and socket cleanups. This is too much
134 for a stable patch.
135
136 For the time being grab sk_buff_head.lock without disabling bh and irqs,
137 so don't use locked skb_queue_tail.
138
139 Fixes: 869e7c62486e ("net: af_unix: implement stream sendpage support")
140 Cc: Eric Dumazet <edumazet@google.com>
141 Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
142 Reported-by: Eric Dumazet <edumazet@google.com>
143 Acked-by: Eric Dumazet <edumazet@google.com>
144 Signed-off-by: David S. Miller <davem@davemloft.net>
145
146 net/unix/af_unix.c | 5 ++++-
147 1 files changed, 4 insertions(+), 1 deletions(-)
148
149 commit 0df914e7a66a4807bac7762ab33ba3020944ef6b
150 Author: Hannes Frederic Sowa <hannes@stressinduktion.org>
151 Date: Mon Nov 16 16:25:56 2015 +0100
152
153 af_unix: don't append consumed skbs to sk_receive_queue
154
155 In case multiple writes to a unix stream socket race we could end up in a
156 situation where we pre-allocate a new skb for use in unix_stream_sendpage
157 but have to free it again in the locked section because another skb
158 has been appended meanwhile, which we must use. Accidentally we didn't
159 clear the pointer after consuming it and so we touched freed memory
160 while appending it to the sk_receive_queue. So, clear the pointer after
161 consuming the skb.
162
163 This bug has been found with syzkaller
164 (http://github.com/google/syzkaller) by Dmitry Vyukov.
165
166 Fixes: 869e7c62486e ("net: af_unix: implement stream sendpage support")
167 Reported-by: Dmitry Vyukov <dvyukov@google.com>
168 Cc: Dmitry Vyukov <dvyukov@google.com>
169 Cc: Eric Dumazet <eric.dumazet@gmail.com>
170 Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
171 Acked-by: Eric Dumazet <edumazet@google.com>
172 Signed-off-by: David S. Miller <davem@davemloft.net>
173
174 net/unix/af_unix.c | 1 +
175 1 files changed, 1 insertions(+), 0 deletions(-)
176
177 commit ac8466abcd0ae871cd38d868e1a4e903b92ffc48
178 Author: Jason A. Donenfeld <Jason@zx2c4.com>
179 Date: Thu Nov 12 17:35:58 2015 +0100
180
181 ip_tunnel: disable preemption when updating per-cpu tstats
182
183 Drivers like vxlan use the recently introduced
184 udp_tunnel_xmit_skb/udp_tunnel6_xmit_skb APIs. udp_tunnel6_xmit_skb
185 makes use of ip6tunnel_xmit, and ip6tunnel_xmit, after sending the
186 packet, updates the struct stats using the usual
187 u64_stats_update_begin/end calls on this_cpu_ptr(dev->tstats).
188 udp_tunnel_xmit_skb makes use of iptunnel_xmit, which doesn't touch
189 tstats, so drivers like vxlan, immediately after, call
190 iptunnel_xmit_stats, which does the same thing - calls
191 u64_stats_update_begin/end on this_cpu_ptr(dev->tstats).
192
193 While vxlan is probably fine (I don't know?), calling a similar function
194 from, say, an unbound workqueue, on a fully preemptable kernel causes
195 real issues:
196
197 [ 188.434537] BUG: using smp_processor_id() in preemptible [00000000] code: kworker/u8:0/6
198 [ 188.435579] caller is debug_smp_processor_id+0x17/0x20
199 [ 188.435583] CPU: 0 PID: 6 Comm: kworker/u8:0 Not tainted 4.2.6 #2
200 [ 188.435607] Call Trace:
201 [ 188.435611] [<ffffffff8234e936>] dump_stack+0x4f/0x7b
202 [ 188.435615] [<ffffffff81915f3d>] check_preemption_disabled+0x19d/0x1c0
203 [ 188.435619] [<ffffffff81915f77>] debug_smp_processor_id+0x17/0x20
204
205 The solution would be to protect the whole
206 this_cpu_ptr(dev->tstats)/u64_stats_update_begin/end blocks with
207 disabling preemption and then reenabling it.
208
209 Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
210 Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
211 Signed-off-by: David S. Miller <davem@davemloft.net>
212
213 include/net/ip6_tunnel.h | 3 ++-
214 include/net/ip_tunnels.h | 3 ++-
215 2 files changed, 4 insertions(+), 2 deletions(-)
216
217 commit 44665148f06b73ea0c253a1a34d15689674d7421
218 Author: Mathias Krause <minipli@googlemail.com>
219 Date: Fri Nov 6 16:30:38 2015 -0800
220
221 printk: prevent userland from spoofing kernel messages
222
223 The following statement of ABI/testing/dev-kmsg is not quite right:
224
225 It is not possible to inject messages from userspace with the
226 facility number LOG_KERN (0), to make sure that the origin of the
227 messages can always be reliably determined.
228
229 Userland actually can inject messages with a facility of 0 by abusing the
230 fact that the facility is stored in a u8 data type. By using a facility
231 which is a multiple of 256 the assignment of msg->facility in log_store()
232 implicitly truncates it to 0, i.e. LOG_KERN, allowing users of /dev/kmsg
233 to spoof kernel messages as shown below:
234
235 The following call...
236 # printf '<%d>Kernel panic - not syncing: beer empty\n' 0 >/dev/kmsg
237 ...leads to the following log entry (dmesg -x | tail -n 1):
238 user :emerg : [ 66.137758] Kernel panic - not syncing: beer empty
239
240 However, this call...
241 # printf '<%d>Kernel panic - not syncing: beer empty\n' 0x800 >/dev/kmsg
242 ...leads to the slightly different log entry (note the kernel facility):
243 kern :emerg : [ 74.177343] Kernel panic - not syncing: beer empty
244
245 Fix that by limiting the user provided facility to 8 bit right from the
246 beginning and catch the truncation early.
247
248 Fixes: 7ff9554bb578 ("printk: convert byte-buffer to variable-length...")
249 Signed-off-by: Mathias Krause <minipli@googlemail.com>
250 Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
251 Cc: Petr Mladek <pmladek@suse.cz>
252 Cc: Alex Elder <elder@linaro.org>
253 Cc: Joe Perches <joe@perches.com>
254 Cc: Kay Sievers <kay@vrfy.org>
255 Cc: <stable@vger.kernel.org>
256 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
257 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
258
259 kernel/printk/printk.c | 13 ++++++++-----
260 1 files changed, 8 insertions(+), 5 deletions(-)
261
262 commit bef8fb168317597f02c00ab4075ff094dcdfd2c6
263 Author: Borislav Petkov <bp@suse.de>
264 Date: Thu Nov 5 16:57:56 2015 +0100
265
266 x86/cpu: Call verify_cpu() after having entered long mode too
267
268 When we get loaded by a 64-bit bootloader, kernel entry point is
269 startup_64 in head_64.S. We don't trust any and all bootloaders because
270 some will fiddle with CPU configuration so we go ahead and massage each
271 CPU into sanity again.
272
273 For example, some dell BIOSes have this XD disable feature which set
274 IA32_MISC_ENABLE[34] and disable NX. This might be some dumb workaround
275 for other OSes but Linux sure doesn't need it.
276
277 A similar thing is present in the Surface 3 firmware - see
278 https://bugzilla.kernel.org/show_bug.cgi?id=106051 - which sets this bit
279 only on the BSP:
280
281 # rdmsr -a 0x1a0
282 400850089
283 850089
284 850089
285 850089
286
287 I know, right?!
288
289 There's not even an off switch in there.
290
291 So fix all those cases by sanitizing the 64-bit entry point too. For
292 that, make verify_cpu() callable in 64-bit mode also.
293
294 Requested-and-debugged-by: "H. Peter Anvin" <hpa@zytor.com>
295 Reported-and-tested-by: Bastien Nocera <bugzilla@hadess.net>
296 Signed-off-by: Borislav Petkov <bp@suse.de>
297 Cc: Matt Fleming <matt@codeblueprint.co.uk>
298 Cc: Peter Zijlstra <peterz@infradead.org>
299 Cc: stable@vger.kernel.org
300 Link: http://lkml.kernel.org/r/1446739076-21303-1-git-send-email-bp@alien8.de
301 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
302
303 Conflicts:
304
305 arch/x86/kernel/head_64.S
306
307 arch/x86/kernel/head_64.S | 9 +++++++++
308 arch/x86/kernel/verify_cpu.S | 12 +++++++-----
309 2 files changed, 16 insertions(+), 5 deletions(-)
310
311 commit 9cb084208a9589a6a5be01d2b7df88843f4b01a4
312 Author: Hannes Frederic Sowa <hannes@stressinduktion.org>
313 Date: Tue Nov 10 16:23:15 2015 +0100
314
315 af-unix: fix use-after-free with concurrent readers while splicing
316
317 During splicing an af-unix socket to a pipe we have to drop all
318 af-unix socket locks. While doing so we allow another reader to enter
319 unix_stream_read_generic which can read, copy and finally free another
320 skb. If exactly this skb is just in process of being spliced we get a
321 use-after-free report by kasan.
322
323 First, we must make sure to not have a free while the skb is used during
324 the splice operation. We simply increment its use counter before unlocking
325 the reader lock.
326
327 Stream sockets have the nice characteristic that we don't care about
328 zero length writes and they never reach the peer socket's queue. That
329 said, we can take the UNIXCB.consumed field as the indicator if the
330 skb was already freed from the socket's receive queue. If the skb was
331 fully consumed after we locked the reader side again we know it has been
332 dropped by a second reader. We indicate a short read to user space and
333 abort the current splice operation.
334
335 This bug has been found with syzkaller
336 (http://github.com/google/syzkaller) by Dmitry Vyukov.
337
338 Fixes: 2b514574f7e8 ("net: af_unix: implement splice for stream af_unix sockets")
339 Reported-by: Dmitry Vyukov <dvyukov@google.com>
340 Cc: Dmitry Vyukov <dvyukov@google.com>
341 Cc: Eric Dumazet <eric.dumazet@gmail.com>
342 Acked-by: Eric Dumazet <edumazet@google.com>
343 Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
344 Signed-off-by: David S. Miller <davem@davemloft.net>
345
346 net/unix/af_unix.c | 18 ++++++++++++++++++
347 1 files changed, 18 insertions(+), 0 deletions(-)
348
349 commit 4e75d2b7d6546add44f0951e78410b131a1e660d
350 Author: Brad Spengler <spender@grsecurity.net>
351 Date: Sat Nov 14 15:08:46 2015 -0500
352
353 switch the default for SIZE_OVERFLOW_KILL to n, later we'll remove
354 the option entirely
355 Distros should make sure their users report all overflows printed to the
356 kernel logs so the underlying issues can be fixed
357
358 security/Kconfig | 2 +-
359 1 files changed, 1 insertions(+), 1 deletions(-)
360
361 commit 2e37eb35e0f1ba5a0feac5264a7b24d89376d0a2
362 Author: Brad Spengler <spender@grsecurity.net>
363 Date: Sat Nov 14 15:07:51 2015 -0500
364
365 Resync with PaX
366
367 fs/btrfs/inode.c | 12 ++++++++++++
368 1 files changed, 12 insertions(+), 0 deletions(-)
369
370 commit 2f63d2552f38c700902d17bf9b591d82f39a3fb5
371 Merge: 5e0ec21 823b1bc
372 Author: Brad Spengler <spender@grsecurity.net>
373 Date: Sat Nov 14 14:29:16 2015 -0500
374
375 Merge branch 'pax-test' into grsec-test
376
377 commit 823b1bc5a8e670f7ddfa98ee0d83762bffab28fb
378 Author: Brad Spengler <spender@grsecurity.net>
379 Date: Sat Nov 14 14:28:35 2015 -0500
380
381 Update to pax-linux-4.2.6-test19.patch:
382 - David Sterba updated the fix for one of the previous btrfs problems
383 - Emese and Rasmus Villemoes <linux@rasmusvillemoes.dk> fixed a few bugs in the initify plugin
384 - fixed debian package generation to support building out-of-tree modules with plugins, reported by Elie Roudninski <elie.roudninski@gmail.com>
385
386 fs/btrfs/delayed-inode.c | 3 +-
387 fs/btrfs/delayed-inode.h | 2 +-
388 fs/btrfs/inode.c | 2 +-
389 scripts/package/builddeb | 2 +-
390 tools/gcc/initify_plugin.c | 264 ++++++++++++++++++++++++++++++--------------
391 5 files changed, 188 insertions(+), 85 deletions(-)
392
393 commit 5e0ec21349bb3aeead0701ef51df3086ad377979
394 Author: Brad Spengler <spender@grsecurity.net>
395 Date: Thu Nov 12 19:54:21 2015 -0500
396
397 Revert https://patchwork.kernel.org/patch/7585611/ for now as it's been reported
398 to cause userland hangs, similar to previous bugs seen in the past
399
400 fs/btrfs/inode.c | 12 ------------
401 1 files changed, 0 insertions(+), 12 deletions(-)
402
403 commit 65402b5a6125cc95c3223a0da8f2817e13bf18ec
404 Author: françois romieu <romieu@fr.zoreil.com>
405 Date: Wed Nov 11 23:35:18 2015 +0100
406
407 r8169: fix kasan reported skb use-after-free.
408
409 Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
410 Reported-by: Dave Jones <davej@codemonkey.org.uk>
411 Fixes: d7d2d89d4b0af ("r8169: Add software counter for multicast packages")
412 Acked-by: Eric Dumazet <edumazet@google.com>
413 Acked-by: Corinna Vinschen <vinschen@redhat.com>
414 Signed-off-by: David S. Miller <davem@davemloft.net>
415
416 drivers/net/ethernet/realtek/r8169.c | 3 +++
417 1 files changed, 3 insertions(+), 0 deletions(-)
418
419 commit bbfcbb7b1e086062aa17358927e14e394830b8a3
420 Author: Anthony Lineham <anthony.lineham@alliedtelesis.co.nz>
421 Date: Thu Oct 22 11:17:03 2015 +1300
422
423 netfilter: Fix removal of GRE expectation entries created by PPTP
424
425 The uninitialized tuple structure caused incorrect hash calculation
426 and the lookup failed.
427
428 Link: https://bugzilla.kernel.org/show_bug.cgi?id=106441
429 Signed-off-by: Anthony Lineham <anthony.lineham@alliedtelesis.co.nz>
430 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
431
432 net/ipv4/netfilter/nf_nat_pptp.c | 2 +-
433 1 files changed, 1 insertions(+), 1 deletions(-)
434
435 commit d7cb19f37a91603021e2bed6417766ecca315bd0
436 Author: Paolo Bonzini <pbonzini@redhat.com>
437 Date: Tue Nov 10 09:14:39 2015 +0100
438
439 KVM: svm: unconditionally intercept #DB
440
441 This is needed to avoid the possibility that the guest triggers
442 an infinite stream of #DB exceptions (CVE-2015-8104).
443
444 VMX is not affected: because it does not save DR6 in the VMCS,
445 it already intercepts #DB unconditionally.
446
447 Reported-by: Jan Beulich <jbeulich@suse.com>
448 Cc: stable@vger.kernel.org
449 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
450
451 arch/x86/kvm/svm.c | 14 +++-----------
452 1 files changed, 3 insertions(+), 11 deletions(-)
453
454 commit 5b241ac6551e1675e1cbbc4a74fa1c698ada28f4
455 Author: Eric Northup <digitaleric@google.com>
456 Date: Tue Nov 3 18:03:53 2015 +0100
457
458 KVM: x86: work around infinite loop in microcode when #AC is delivered
459
460 It was found that a guest can DoS a host by triggering an infinite
461 stream of "alignment check" (#AC) exceptions. This causes the
462 microcode to enter an infinite loop where the core never receives
463 another interrupt. The host kernel panics pretty quickly due to the
464 effects (CVE-2015-5307).
465
466 Signed-off-by: Eric Northup <digitaleric@google.com>
467 Cc: stable@vger.kernel.org
468 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
469
470 arch/x86/include/uapi/asm/svm.h | 1 +
471 arch/x86/kvm/svm.c | 8 ++++++++
472 arch/x86/kvm/vmx.c | 5 ++++-
473 3 files changed, 13 insertions(+), 1 deletions(-)
474
475 commit 6113725aaaf6626522b93732f29dd36370695a89
476 Author: Daniel Borkmann <daniel@iogearbox.net>
477 Date: Thu Nov 5 00:01:51 2015 +0100
478
479 debugfs: fix refcount imbalance in start_creating
480
481 In debugfs' start_creating(), we pin the file system to safely access
482 its root. When we failed to create a file, we unpin the file system via
483 failed_creating() to release the mount count and eventually the reference
484 of the vfsmount.
485
486 However, when we run into an error during lookup_one_len() when still
487 in start_creating(), we only release the parent's mutex but not so the
488 reference on the mount. Looks like it was done in the past, but after
489 splitting portions of __create_file() into start_creating() and
490 end_creating() via 190afd81e4a5 ("debugfs: split the beginning and the
491 end of __create_file() off"), this seemed missed. Noticed during code
492 review.
493
494 Fixes: 190afd81e4a5 ("debugfs: split the beginning and the end of __create_file() off")
495 Cc: stable@vger.kernel.org # v4.0+
496 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
497 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
498
499 fs/debugfs/inode.c | 6 +++++-
500 1 files changed, 5 insertions(+), 1 deletions(-)
501
502 commit e91f8a6717837a8a64b6e86317a1373ec9cd6c04
503 Author: Maciej W. Rozycki <macro@imgtec.com>
504 Date: Mon Oct 26 15:48:19 2015 +0000
505
506 binfmt_elf: Don't clobber passed executable's file header
507
508 Do not clobber the buffer space passed from `search_binary_handler' and
509 originally preloaded by `prepare_binprm' with the executable's file
510 header by overwriting it with its interpreter's file header. Instead
511 keep the buffer space intact and directly use the data structure locally
512 allocated for the interpreter's file header, fixing a bug introduced in
513 2.1.14 with loadable module support (linux-mips.org commit beb11695
514 [Import of Linux/MIPS 2.1.14], predating kernel.org repo's history).
515 Adjust the amount of data read from the interpreter's file accordingly.
516
517 This was not an issue before loadable module support, because back then
518 `load_elf_binary' was executed only once for a given ELF executable,
519 whether the function succeeded or failed.
520
521 With loadable module support supported and enabled, upon a failure of
522 `load_elf_binary' -- which may for example be caused by architecture
523 code rejecting an executable due to a missing hardware feature requested
524 in the file header -- a module load is attempted and then the function
525 reexecuted by `search_binary_handler'. With the executable's file
526 header replaced with its interpreter's file header the executable can
527 then be erroneously accepted in this subsequent attempt.
528
529 Cc: stable@vger.kernel.org # all the way back
530 Signed-off-by: Maciej W. Rozycki <macro@imgtec.com>
531 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
532
533 fs/binfmt_elf.c | 10 +++++-----
534 1 files changed, 5 insertions(+), 5 deletions(-)
535
536 commit 9c49029fe4cb9a52cb174aebfd5946a9d26b9956
537 Merge: 5482e7e 7033393
538 Author: Brad Spengler <spender@grsecurity.net>
539 Date: Mon Nov 9 19:51:58 2015 -0500
540
541 Merge branch 'pax-test' into grsec-test
542
543 commit 70333935932c9f3eb333a354dd760b4233efcc37
544 Author: Brad Spengler <spender@grsecurity.net>
545 Date: Mon Nov 9 19:51:19 2015 -0500
546
547 Update to pax-linux-4.2.6-test18.patch:
548 - cleaned up the last of the FPU changes, by spender
549 - fixed a few KERNEXEC regressions (backported from 4.3)
550 - Emese fixed a few size overflow false positives in kvm, reported by Christian Roessner (https://bugs.gentoo.org/show_bug.cgi?id=558138#c23)
551 - David Sterba fixed a few integer overflows in btrfs caught by the size overflow plugin (https://patchwork.kernel.org/patch/7585611/ and https://patchwork.kernel.org/patch/7582351/), reported by Victor, Stebalien and alan.d (https://forums.grsecurity.net/viewtopic.php?f=1&t=4284)
552
553 arch/x86/include/asm/fpu/internal.h | 2 +-
554 arch/x86/include/asm/fpu/types.h | 1 -
555 arch/x86/kernel/apic/apic.c | 4 ++-
556 arch/x86/kernel/fpu/init.c | 36 --------------------
557 arch/x86/kernel/process_64.c | 6 +--
558 arch/x86/kernel/vsmp_64.c | 13 +++++--
559 drivers/acpi/video_detect.c | 2 +-
560 drivers/lguest/core.c | 2 +-
561 fs/btrfs/file.c | 10 ++++--
562 fs/btrfs/inode.c | 12 ++++++
563 .../disable_size_overflow_hash.data | 5 ++-
564 .../size_overflow_plugin/size_overflow_hash.data | 7 +---
565 12 files changed, 42 insertions(+), 58 deletions(-)
566
567 commit 5482e7eb4ba3c5cc90472ccdb1bfe2cec64413e2
568 Merge: 81e2642 682ba19
569 Author: Brad Spengler <spender@grsecurity.net>
570 Date: Mon Nov 9 18:19:48 2015 -0500
571
572 Merge branch 'pax-test' into grsec-test
573
574 Conflicts:
575 drivers/pci/pci-sysfs.c
576
577 commit 682ba19ce305f501c9bc5c42a76f2c7442aa22fc
578 Merge: 7755256 1c02865
579 Author: Brad Spengler <spender@grsecurity.net>
580 Date: Mon Nov 9 18:18:24 2015 -0500
581
582 Merge branch 'linux-4.2.y' into pax-test
583
584 commit 81e26429b7a36f0c75de3ab42754256720c0a159
585 Author: Brad Spengler <spender@grsecurity.net>
586 Date: Mon Nov 9 07:37:30 2015 -0500
587
588 btrfs: fix signed overflow in btrfs_sync_file
589
590 The calculation of range length in btrfs_sync_file leads to signed
591 overflow. This was caught by PaX gcc SIZE_OVERFLOW plugin.
592
593 https://forums.grsecurity.net/viewtopic.php?f=1&t=4284
594
595 The fsync call passes 0 and LLONG_MAX, the range length does not fit to
596 loff_t and overflows, but the value is converted to u64 so it silently
597 works as expected.
598
599 The minimal fix is a typecast to u64, switching functions to take
600 (start, end) instead of (start, len) would be more intrusive.
601
602 Coccinelle script found that there's one more opencoded calculation of
603 the length.
604
605 <smpl>
606 @@
607 loff_t start, end;
608 @@
609 * end - start
610 </smpl>
611
612 CC: stable@vger.kernel.org
613 Signed-off-by: David Sterba <dsterba@suse.com>
614
615 fs/btrfs/file.c | 10 +++++++---
616 1 files changed, 7 insertions(+), 3 deletions(-)
617
618 commit 07fd498a96e2d589ad743851c0dec482a92e0429
619 Author: Brad Spengler <spender@grsecurity.net>
620 Date: Sun Nov 8 17:04:31 2015 -0500
621
622 Fix an upstream type confusion bug exposed by RANDSTRUCT:
623 at the beginning of each sem_array/shmid_kernel/msg_queue
624 struct is an kern_ipc_perm struct. Unlike every other place in the
625 kernel where some field must be at an explicit location, there's
626 no documentation at all that the kern_ipc_perm must be at the beginning
627 of these structs. Previously, shmid_kernel and kern_ipc_perm were both
628 randomized with RANDSTRUCT. The problem arises due to the show() handler
629 for /proc for msg/sem/shm -- what it is provided is a pointer to
630 a kern_ipc_perm struct (as a void *) which each show() handler then
631 assumes can be implicitly cast to its own particular struct type without
632 any kind of container_of being performed. Fix this by doing the proper
633 type conversions for each via container_of, and randomize the sem and msg
634 structs while we're at it.
635
636 include/linux/msg.h | 2 +-
637 include/linux/sem.h | 2 +-
638 ipc/msg.c | 3 ++-
639 ipc/sem.c | 3 ++-
640 ipc/shm.c | 3 ++-
641 5 files changed, 8 insertions(+), 5 deletions(-)
642
643 commit 6591e1a526c544936975cd3515d8def09e8026f0
644 Author: Brad Spengler <spender@grsecurity.net>
645 Date: Tue Nov 3 19:36:05 2015 -0500
646
647 Properly fix the PCI sysfs node check that was recently improperly fixed
648 upstream (it's under CAP_SYS_ADMIN so it's not really serious)
649 Reported by Mathias Krause
650
651 drivers/pci/pci-sysfs.c | 2 +-
652 1 files changed, 1 insertions(+), 1 deletions(-)
653
654 commit ece03d4d07f29634687b2ea5edb7cab23888cff3
655 Merge: 715e674 7755256
656 Author: Brad Spengler <spender@grsecurity.net>
657 Date: Mon Nov 2 21:32:10 2015 -0500
658
659 Merge branch 'pax-test' into grsec-test
660
661 commit 775525660a6353feb261ad6232f6acbc23826bf4
662 Author: Brad Spengler <spender@grsecurity.net>
663 Date: Mon Nov 2 21:31:21 2015 -0500
664
665 Update to pax-linux-4.2.5-test17.patch:
666 - Emese fixed a bunch of size overflow reports:
667 - https://forums.grsecurity.net/viewtopic.php?f=3&t=4290
668 - https://forums.grsecurity.net/viewtopic.php?f=3&t=4291
669 - https://forums.grsecurity.net/viewtopic.php?f=3&t=4288
670 - https://forums.grsecurity.net/viewtopic.php?f=3&t=4285
671 - https://forums.grsecurity.net/viewtopic.php?f=3&t=4283
672 - https://forums.grsecurity.net/viewtopic.php?f=3&t=4287
673 - https://forums.grsecurity.net/viewtopic.php?f=3&t=4289
674 - https://bugs.archlinux.org/task/46798
675 - fixed the x86 fpu code some more, reported by spender and others (https://bugs.gentoo.org/show_bug.cgi?id=563804, https://bugs.archlinux.org/task/46764)
676
677 arch/x86/include/asm/fpu/internal.h | 4 +-
678 arch/x86/kernel/fpu/core.c | 2 +-
679 arch/x86/kernel/process.c | 3 +-
680 arch/x86/kernel/process_64.c | 6 +-
681 drivers/usb/class/cdc-acm.h | 2 +-
682 drivers/video/console/fbcon.c | 2 +-
683 fs/dlm/lowcomms.c | 2 +-
684 include/linux/usb.h | 8 +-
685 .../disable_size_overflow_hash.data | 15 +-
686 .../size_overflow_plugin/intentional_overflow.c | 3 +
687 .../size_overflow_plugin/size_overflow_hash.data | 373 ++++++++++++++++----
688 tools/gcc/size_overflow_plugin/size_overflow_ipa.c | 3 +-
689 .../size_overflow_plugin/size_overflow_plugin.c | 2 +-
690 13 files changed, 329 insertions(+), 96 deletions(-)
691
692 commit 715e674a838f08748044bce459380762e9c1cd29
693 Author: Sasha Levin <sasha.levin@oracle.com>
694 Date: Wed Oct 7 11:03:28 2015 -0500
695
696 PCI: Prevent out of bounds access in numa_node override
697
698 63692df103e9 ("PCI: Allow numa_node override via sysfs") didn't check that
699 the numa node provided by userspace is valid. Passing a node number too
700 high would attempt to access invalid memory and trigger a kernel panic.
701
702 Fixes: 63692df103e9 ("PCI: Allow numa_node override via sysfs")
703 Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
704 Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
705 CC: stable@vger.kernel.org # v3.19+
706
707 drivers/pci/pci-sysfs.c | 2 +-
708 1 files changed, 1 insertions(+), 1 deletions(-)
709
710 commit 6abe1bb892fe394df80dd4267a8bd2874d537e4e
711 Author: David Howells <dhowells@redhat.com>
712 Date: Fri Sep 18 11:45:12 2015 +0100
713
714 ovl: use O_LARGEFILE in ovl_copy_up()
715
716 Open the lower file with O_LARGEFILE in ovl_copy_up().
717
718 Pass O_LARGEFILE unconditionally in ovl_copy_up_data() as it's purely for
719 catching 32-bit userspace dealing with a file large enough that it'll be
720 mishandled if the application isn't aware that there might be an integer
721 overflow. Inside the kernel, there shouldn't be any problems.
722
723 Reported-by: Ulrich Obergfell <uobergfe@redhat.com>
724 Signed-off-by: David Howells <dhowells@redhat.com>
725 Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
726 Cc: <stable@vger.kernel.org> # v3.18+
727
728 fs/overlayfs/copy_up.c | 4 ++--
729 1 files changed, 2 insertions(+), 2 deletions(-)
730
731 commit bf5e23398e4a82e28fe0801337a4b78ca951a1d9
732 Author: David Howells <dhowells@redhat.com>
733 Date: Fri Sep 18 11:45:22 2015 +0100
734
735 ovl: fix dentry reference leak
736
737 In ovl_copy_up_locked(), newdentry is leaked if the function exits through
738 out_cleanup as this just to out after calling ovl_cleanup() - which doesn't
739 actually release the ref on newdentry.
740
741 The out_cleanup segment should instead exit through out2 as certainly
742 newdentry leaks - and possibly upper does also, though this isn't caught
743 given the catch of newdentry.
744
745 Without this fix, something like the following is seen:
746
747 BUG: Dentry ffff880023e9eb20{i=f861,n=#ffff880023e82d90} still in use (1) [unmount of tmpfs tmpfs]
748 BUG: Dentry ffff880023ece640{i=0,n=bigfile} still in use (1) [unmount of tmpfs tmpfs]
749
750 when unmounting the upper layer after an error occurred in copyup.
751
752 An error can be induced by creating a big file in a lower layer with
753 something like:
754
755 dd if=/dev/zero of=/lower/a/bigfile bs=65536 count=1 seek=$((0xf000))
756
757 to create a large file (4.1G). Overlay an upper layer that is too small
758 (on tmpfs might do) and then induce a copy up by opening it writably.
759
760 Reported-by: Ulrich Obergfell <uobergfe@redhat.com>
761 Signed-off-by: David Howells <dhowells@redhat.com>
762 Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
763 Cc: <stable@vger.kernel.org> # v3.18+
764
765 fs/overlayfs/copy_up.c | 2 +-
766 1 files changed, 1 insertions(+), 1 deletions(-)
767
768 commit da93976d3355abae09d9fd6a68e7dea77ed619d1
769 Author: Miklos Szeredi <miklos@szeredi.hu>
770 Date: Mon Oct 12 15:56:20 2015 +0200
771
772 ovl: fix open in stacked overlay
773
774 If two overlayfs filesystems are stacked on top of each other, then we need
775 recursion in ovl_d_select_inode().
776
777 I guess d_backing_inode() is supposed to do that. But currently it doesn't
778 and that functionality is open coded in vfs_open(). This is now copied
779 into ovl_d_select_inode() to fix this regression.
780
781 Reported-by: Alban Crequy <alban.crequy@gmail.com>
782 Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
783 Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay...")
784 Cc: David Howells <dhowells@redhat.com>
785 Cc: <stable@vger.kernel.org> # v4.2+
786
787 fs/overlayfs/inode.c | 3 +++
788 1 files changed, 3 insertions(+), 0 deletions(-)
789
790 commit 0ddd9cf6149717882b81c946149bf55332d763ae
791 Author: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
792 Date: Mon Aug 24 15:57:18 2015 +0300
793
794 ovl: free stack of paths in ovl_fill_super
795
796 This fixes small memory leak after mount.
797
798 Kmemleak report:
799
800 unreferenced object 0xffff88003683fe00 (size 16):
801 comm "mount", pid 2029, jiffies 4294909563 (age 33.380s)
802 hex dump (first 16 bytes):
803 20 27 1f bb 00 88 ff ff 40 4b 0f 36 02 88 ff ff '......@K.6....
804 backtrace:
805 [<ffffffff811f8cd4>] create_object+0x124/0x2c0
806 [<ffffffff817a059b>] kmemleak_alloc+0x7b/0xc0
807 [<ffffffff811dffe6>] __kmalloc+0x106/0x340
808 [<ffffffffa01b7a29>] ovl_fill_super+0x389/0x9a0 [overlay]
809 [<ffffffff81200ac4>] mount_nodev+0x54/0xa0
810 [<ffffffffa01b7118>] ovl_mount+0x18/0x20 [overlay]
811 [<ffffffff81201ab3>] mount_fs+0x43/0x170
812 [<ffffffff81220d34>] vfs_kern_mount+0x74/0x170
813 [<ffffffff812233ad>] do_mount+0x22d/0xdf0
814 [<ffffffff812242cb>] SyS_mount+0x7b/0xc0
815 [<ffffffff817b6bee>] entry_SYSCALL_64_fastpath+0x12/0x76
816 [<ffffffffffffffff>] 0xffffffffffffffff
817
818 Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
819 Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
820 Fixes: a78d9f0d5d5c ("ovl: support multiple lower layers")
821 Cc: <stable@vger.kernel.org> # v4.0+
822
823 fs/overlayfs/super.c | 1 +
824 1 files changed, 1 insertions(+), 0 deletions(-)
825
826 commit b86575c9973b9ad55d659fd8a6be8f864435ad0e
827 Author: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
828 Date: Mon Aug 24 15:57:19 2015 +0300
829
830 ovl: free lower_mnt array in ovl_put_super
831
832 This fixes memory leak after umount.
833
834 Kmemleak report:
835
836 unreferenced object 0xffff8800ba791010 (size 8):
837 comm "mount", pid 2394, jiffies 4294996294 (age 53.920s)
838 hex dump (first 8 bytes):
839 20 1c 13 02 00 88 ff ff .......
840 backtrace:
841 [<ffffffff811f8cd4>] create_object+0x124/0x2c0
842 [<ffffffff817a059b>] kmemleak_alloc+0x7b/0xc0
843 [<ffffffff811dffe6>] __kmalloc+0x106/0x340
844 [<ffffffffa0152bfc>] ovl_fill_super+0x55c/0x9b0 [overlay]
845 [<ffffffff81200ac4>] mount_nodev+0x54/0xa0
846 [<ffffffffa0152118>] ovl_mount+0x18/0x20 [overlay]
847 [<ffffffff81201ab3>] mount_fs+0x43/0x170
848 [<ffffffff81220d34>] vfs_kern_mount+0x74/0x170
849 [<ffffffff812233ad>] do_mount+0x22d/0xdf0
850 [<ffffffff812242cb>] SyS_mount+0x7b/0xc0
851 [<ffffffff817b6bee>] entry_SYSCALL_64_fastpath+0x12/0x76
852 [<ffffffffffffffff>] 0xffffffffffffffff
853
854 Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
855 Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
856 Fixes: dd662667e6d3 ("ovl: add mutli-layer infrastructure")
857 Cc: <stable@vger.kernel.org> # v4.0+
858
859 fs/overlayfs/super.c | 1 +
860 1 files changed, 1 insertions(+), 0 deletions(-)
861
862 commit 9f49b5376fae99cd590d13726e2633bc0a53b6db
863 Author: Linus Torvalds <torvalds@linux-foundation.org>
864 Date: Sun Nov 1 17:09:15 2015 -0800
865
866 mm: get rid of 'vmalloc_info' from /proc/meminfo
867
868 It turns out that at least some versions of glibc end up reading
869 /proc/meminfo at every single startup, because glibc wants to know the
870 amount of memory the machine has. And while that's arguably insane,
871 it's just how things are.
872
873 And it turns out that it's not all that expensive most of the time, but
874 the vmalloc information statistics (amount of virtual memory used in the
875 vmalloc space, and the biggest remaining chunk) can be rather expensive
876 to compute.
877
878 The 'get_vmalloc_info()' function actually showed up on my profiles as
879 4% of the CPU usage of "make test" in the git source repository, because
880 the git tests are lots of very short-lived shell-scripts etc.
881
882 It turns out that apparently this same silly vmalloc info gathering
883 shows up on the facebook servers too, according to Dave Jones. So it's
884 not just "make test" for git.
885
886 We had two patches to just cache the information (one by me, one by
887 Ingo) to mitigate this issue, but the whole vmalloc information of of
888 rather dubious value to begin with, and people who *actually* want to
889 know what the situation is wrt the vmalloc area should just look at the
890 much more complete /proc/vmallocinfo instead.
891
892 In fact, according to my testing - and perhaps more importantly,
893 according to that big search engine in the sky: Google - there is
894 nothing out there that actually cares about those two expensive fields:
895 VmallocUsed and VmallocChunk.
896
897 So let's try to just remove them entirely. Actually, this just removes
898 the computation and reports the numbers as zero for now, just to try to
899 be minimally intrusive.
900
901 If this breaks anything, we'll obviously have to re-introduce the code
902 to compute this all and add the caching patches on top. But if given
903 the option, I'd really prefer to just remove this bad idea entirely
904 rather than add even more code to work around our historical mistake
905 that likely nobody really cares about.
906
907 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
908
909 fs/proc/meminfo.c | 7 ++-----
910 include/linux/vmalloc.h | 12 ------------
911 mm/vmalloc.c | 47 -----------------------------------------------
912 3 files changed, 2 insertions(+), 64 deletions(-)
913
914 commit 66425129a550275398f886498d957284539bb331
915 Author: Marek Vasut <marex@denx.de>
916 Date: Fri Oct 30 13:48:19 2015 +0100
917
918 can: Use correct type in sizeof() in nla_put()
919
920 The sizeof() is invoked on an incorrect variable, likely due to some
921 copy-paste error, and this might result in memory corruption. Fix this.
922
923 Signed-off-by: Marek Vasut <marex@denx.de>
924 Cc: Wolfgang Grandegger <wg@grandegger.com>
925 Cc: netdev@vger.kernel.org
926 Cc: linux-stable <stable@vger.kernel.org>
927 Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
928
929 drivers/net/can/dev.c | 2 +-
930 1 files changed, 1 insertions(+), 1 deletions(-)
931
932 commit 8c8e802a86f8faf2519710db043339e1cc953bc4
933 Author: Brad Spengler <spender@grsecurity.net>
934 Date: Mon Nov 2 17:20:52 2015 -0500
935
936 Fix the FPU code properly by copying the dynamically-sized FPU state on
937 each clone of the task struct, making it equivalent to the new FPU-in-task-struct code
938
939 Fix is from the PaX Team
940
941 arch/x86/kernel/process.c | 2 ++
942 1 files changed, 2 insertions(+), 0 deletions(-)
943
944 commit 036bc2e2231c76f7eb470bfef67b6bc26187aeae
945 Author: Brad Spengler <spender@grsecurity.net>
946 Date: Mon Nov 2 17:19:43 2015 -0500
947
948 Revert the forced eagerfpu since it's now fixed properly
949
950 arch/x86/kernel/fpu/init.c | 3 ---
951 1 files changed, 0 insertions(+), 3 deletions(-)
952
953 commit a08ab82bcf321704f6a228c7924b860510c6d610
954 Author: Carol L Soto <clsoto@linux.vnet.ibm.com>
955 Date: Tue Oct 27 17:36:20 2015 +0200
956
957 net/mlx4: Copy/set only sizeof struct mlx4_eqe bytes
958
959 When doing memcpy/memset of EQEs, we should use sizeof struct
960 mlx4_eqe as the base size and not caps.eqe_size which could be bigger.
961
962 If caps.eqe_size is bigger than the struct mlx4_eqe then we corrupt
963 data in the master context.
964
965 When using a 64 byte stride, the memcpy copied over 63 bytes to the
966 slave_eq structure. This resulted in copying over the entire eqe of
967 interest, including its ownership bit -- and also 31 bytes of garbage
968 into the next WQE in the slave EQ -- which did NOT include the ownership
969 bit (and therefore had no impact).
970
971 However, once the stride is increased to 128, we are overwriting the
972 ownership bits of *three* eqes in the slave_eq struct. This results
973 in an incorrect ownership bit for those eqes, which causes the eq to
974 seem to be full. The issue therefore surfaced only once 128-byte EQEs
975 started being used in SRIOV and (overarchitectures that have 128/256
976 byte cache-lines such as PPC) - e.g after commit 77507aa249ae
977 "net/mlx4_core: Enable CQE/EQE stride support".
978
979 Fixes: 08ff32352d6f ('mlx4: 64-byte CQE/EQE support')
980 Signed-off-by: Carol L Soto <clsoto@linux.vnet.ibm.com>
981 Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
982 Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
983 Signed-off-by: David S. Miller <davem@davemloft.net>
984
985 drivers/net/ethernet/mellanox/mlx4/cmd.c | 2 +-
986 drivers/net/ethernet/mellanox/mlx4/eq.c | 2 +-
987 2 files changed, 2 insertions(+), 2 deletions(-)
988
989 commit 811ab3b52935612def289efa5e9e2aa973f16f26
990 Author: Hannes Frederic Sowa <hannes@stressinduktion.org>
991 Date: Wed Oct 28 13:21:04 2015 +0100
992
993 ipv6: protect mtu calculation of wrap-around and infinite loop by rounding issues
994
995 Raw sockets with hdrincl enabled can insert ipv6 extension headers
996 right into the data stream. In case we need to fragment those packets,
997 we reparse the options header to find the place where we can insert
998 the fragment header. If the extension headers exceed the link's MTU we
999 actually cannot make progress in such a case.
1000
1001 Instead of ending up in broken arithmetic or rounding towards 0 and
1002 entering an endless loop in ip6_fragment, just prevent those cases by
1003 aborting early and signal -EMSGSIZE to user space.
1004
1005 This is the second version of the patch which doesn't use the
1006 overflow_usub function, which got reverted for now.
1007
1008 Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
1009 Cc: Linus Torvalds <torvalds@linux-foundation.org>
1010 Reported-by: Dmitry Vyukov <dvyukov@google.com>
1011 Cc: Dmitry Vyukov <dvyukov@google.com>
1012 Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
1013 Signed-off-by: David S. Miller <davem@davemloft.net>
1014
1015 net/ipv6/ip6_output.c | 2 ++
1016 1 files changed, 2 insertions(+), 0 deletions(-)
1017
1018 commit f074980442c7c3ff4a75c711ff18204dfb4131b8
1019 Author: Brad Spengler <spender@grsecurity.net>
1020 Date: Thu Oct 29 18:19:02 2015 -0400
1021
1022 Revert "ipv6: protect mtu calculation of wrap-around and infinite loop by rounding issues"
1023
1024 This reverts commit 18d5034650b637ec479f41d98e3912398b3e3efc.
1025
1026 net/ipv6/ip6_output.c | 6 +-----
1027 1 files changed, 1 insertions(+), 5 deletions(-)
1028
1029 commit 53e629c2d13ed09f4c889925482606f82a65bd1d
1030 Author: Brad Spengler <spender@grsecurity.net>
1031 Date: Thu Oct 29 18:18:55 2015 -0400
1032
1033 Revert "overflow-arith: begin to add support for overflow builtin functions"
1034
1035 This reverts commit cfd0008de8db38841f7f06b979482900994717b9.
1036
1037 Conflicts:
1038
1039 include/linux/compiler-gcc.h
1040
1041 include/linux/compiler-gcc.h | 4 ----
1042 include/linux/overflow-arith.h | 18 ------------------
1043 2 files changed, 0 insertions(+), 22 deletions(-)
1044
1045 commit 225122602b5b7fd58ec5c2a4a1a4a9a29fe7a02a
1046 Author: Brad Spengler <spender@grsecurity.net>
1047 Date: Thu Oct 29 09:00:11 2015 -0400
1048
1049 Update size_overflow plugin
1050
1051 .../size_overflow_plugin/intentional_overflow.c | 3 +++
1052 .../size_overflow_plugin/size_overflow_plugin.c | 2 +-
1053 2 files changed, 4 insertions(+), 1 deletions(-)
1054
1055 commit 2bf85cb1c3df45d59d8b59aeacf63cbbee360175
1056 Author: Brad Spengler <spender@grsecurity.net>
1057 Date: Thu Oct 29 08:52:07 2015 -0400
1058
1059 Temporarily disable the builtin_overflow again as the kernexec plugin also has problems with it
1060
1061 include/linux/compiler-gcc.h | 2 +-
1062 1 files changed, 1 insertions(+), 1 deletions(-)
1063
1064 commit a41c8c4d880b6005e874bf5440e24713da8483cd
1065 Author: Brad Spengler <spender@grsecurity.net>
1066 Date: Wed Oct 28 19:28:30 2015 -0400
1067
1068 temporarily work around issue with the dynamic FPU state and lazy FPU mode
1069 upstream configures FPU mode based on the eagerfpu variable before it's ever actually
1070 set by the commandline parser (so eagerfpu= on the commandline has no effect)
1071
1072 arch/x86/kernel/fpu/init.c | 3 +++
1073 1 files changed, 3 insertions(+), 0 deletions(-)
1074
1075 commit 8452f9d5cfabda9228496050a16bc8728c0ebbb7
1076 Author: Brad Spengler <spender@grsecurity.net>
1077 Date: Wed Oct 28 19:25:55 2015 -0400
1078
1079 Remove/reorder some code due to the reverting of the FPU-state-in-task_struct code
1080
1081 arch/x86/include/asm/fpu/types.h | 69 ++++++++++++++++++--------------------
1082 arch/x86/include/asm/processor.h | 10 ++----
1083 arch/x86/kernel/fpu/init.c | 20 -----------
1084 include/linux/sched.h | 4 +-
1085 4 files changed, 38 insertions(+), 65 deletions(-)
1086
1087 commit c2127bd4215f8f02a1391bef3bde55d0bb1c19bc
1088 Author: Brad Spengler <spender@grsecurity.net>
1089 Date: Tue Oct 27 23:38:11 2015 -0400
1090
1091 fix typo
1092
1093 tools/gcc/size_overflow_plugin/size_overflow_ipa.c | 2 +-
1094 1 files changed, 1 insertions(+), 1 deletions(-)
1095
1096 commit c588def7b5713c31fef2b848bfebf0d727791b82
1097 Author: Brad Spengler <spender@grsecurity.net>
1098 Date: Tue Oct 27 21:09:04 2015 -0400
1099
1100 remove the PAGE_SIZE padding from fpregs_state since it's not included as part
1101 of the task struct
1102
1103 arch/x86/include/asm/fpu/types.h | 1 -
1104 1 files changed, 0 insertions(+), 1 deletions(-)
1105
1106 commit 3bd1e5915353fee1f347577f0e80d925910695f9
1107 Author: Herbert Xu <herbert@gondor.apana.org.au>
1108 Date: Mon Oct 19 18:23:57 2015 +0800
1109
1110 crypto: api - Only abort operations on fatal signal
1111
1112 Currently a number of Crypto API operations may fail when a signal
1113 occurs. This causes nasty problems as the caller of those operations
1114 are often not in a good position to restart the operation.
1115
1116 In fact there is currently no need for those operations to be
1117 interrupted by user signals at all. All we need is for them to
1118 be killable.
1119
1120 This patch replaces the relevant calls of signal_pending with
1121 fatal_signal_pending, and wait_for_completion_interruptible with
1122 wait_for_completion_killable, respectively.
1123
1124 Cc: stable@vger.kernel.org
1125 Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
1126
1127 crypto/ablkcipher.c | 2 +-
1128 crypto/algapi.c | 2 +-
1129 crypto/api.c | 6 +++---
1130 crypto/crypto_user.c | 2 +-
1131 4 files changed, 6 insertions(+), 6 deletions(-)
1132
1133 commit 2b278f02de77bd3d0ffb4c64bc56b702d4e27e49
1134 Author: Brad Spengler <spender@grsecurity.net>
1135 Date: Tue Oct 27 18:02:42 2015 -0400
1136
1137 Update a comment
1138
1139 arch/x86/include/asm/fpu/internal.h | 2 +-
1140 1 files changed, 1 insertions(+), 1 deletions(-)
1141
1142 commit 66cbab70d87485c22946485bfd375c3e88140213
1143 Merge: cad84c5 8610c94
1144 Author: Brad Spengler <spender@grsecurity.net>
1145 Date: Tue Oct 27 07:44:23 2015 -0400
1146
1147 Merge branch 'pax-test' into grsec-test
1148
1149 commit 8610c949a76ac2a09b334f41c35cb8e7a04a0ce8
1150 Merge: a851b41 f69d603
1151 Author: Brad Spengler <spender@grsecurity.net>
1152 Date: Tue Oct 27 07:44:14 2015 -0400
1153
1154 Merge branch 'linux-4.2.y' into pax-test
1155
1156 commit cad84c52f547c8ba47ddcf39d1f260f55350f0c2
1157 Author: Brad Spengler <spender@grsecurity.net>
1158 Date: Mon Oct 26 07:33:21 2015 -0400
1159
1160 re-enable builtin_overflow support
1161
1162 include/linux/compiler-gcc.h | 3 +--
1163 1 files changed, 1 insertions(+), 2 deletions(-)
1164
1165 commit 6e281aebbf456c27ce530055d5668bc5829c02a8
1166 Author: Brad Spengler <spender@grsecurity.net>
1167 Date: Mon Oct 26 07:32:15 2015 -0400
1168
1169 Update the size_overflow plugin from Emese to fix the ICE on builtin_overflow use
1170
1171 tools/gcc/size_overflow_plugin/size_overflow_ipa.c | 3 ++-
1172 .../size_overflow_plugin/size_overflow_plugin.c | 2 +-
1173 2 files changed, 3 insertions(+), 2 deletions(-)
1174
1175 commit 75ed97df02fc6eb862df511da6ca690de3d0f15c
1176 Author: Brad Spengler <spender@grsecurity.net>
1177 Date: Mon Oct 26 07:17:00 2015 -0400
1178
1179 Fix from Emese for a size_overflow report in the fbcon code on the
1180 'softback_lines' global variable
1181
1182 drivers/video/console/fbcon.c | 2 +-
1183 1 files changed, 1 insertions(+), 1 deletions(-)
1184
1185 commit b088cabd42c6fe825baa27f40ab450ad75e571d3
1186 Author: Brad Spengler <spender@grsecurity.net>
1187 Date: Sun Oct 25 18:09:55 2015 -0400
1188
1189 Temporarily work around an ICE on GCC >= 5 reported by Daniel Micay due to
1190 backporting of __builtin_usub_overflow
1191
1192 include/linux/compiler-gcc.h | 3 ++-
1193 1 files changed, 2 insertions(+), 1 deletions(-)
1194
1195 commit ba858f46865c6751af3ddba03b176e4d5ecf85c1
1196 Author: Brad Spengler <spender@grsecurity.net>
1197 Date: Sun Oct 25 17:59:17 2015 -0400
1198
1199 Update size_overflow hash table
1200
1201 .../disable_size_overflow_hash.data | 7 +++++++
1202 .../size_overflow_plugin/size_overflow_hash.data | 9 +--------
1203 2 files changed, 8 insertions(+), 8 deletions(-)
1204
1205 commit ba803bceaea0283b38e91c1d3176bf0671786269
1206 Author: Brad Spengler <spender@grsecurity.net>
1207 Date: Sun Oct 25 15:31:17 2015 -0400
1208
1209 Fix oversight in pipacs' removal of FPU state from the task struct:
1210 fpu_copy was performing an OOB copy starting from the address of the 'state'
1211 pointer in the fpu struct instead of starting from the address pointed
1212 to by the state pointer. Reported at:
1213 https://bugs.archlinux.org/task/46764
1214
1215 arch/x86/include/asm/fpu/internal.h | 4 ++--
1216 arch/x86/kernel/fpu/core.c | 2 +-
1217 2 files changed, 3 insertions(+), 3 deletions(-)
1218
1219 commit 26e7d31c5b5c970c50297d2b8be165e9c9ab9d83
1220 Merge: 85d8735 a851b41
1221 Author: Brad Spengler <spender@grsecurity.net>
1222 Date: Sun Oct 25 13:39:21 2015 -0400
1223
1224 Merge branch 'pax-test' into grsec-test
1225
1226 commit a851b41415a0402d76f10712b6950ddff3872a22
1227 Author: Brad Spengler <spender@grsecurity.net>
1228 Date: Sun Oct 25 13:38:25 2015 -0400
1229
1230 Update to latest size_overflow plugin release:
1231 Temporarily ignore bitfield types: https://bugs.archlinux.org/task/46798
1232 Use SI or wider type for the size_overflow type: https://forums.grsecurity.net/viewtopic.php?t=4293&p=15655#p15655
1233
1234 .../size_overflow_plugin/intentional_overflow.c | 3 +++
1235 .../size_overflow_plugin/size_overflow_plugin.c | 2 +-
1236 .../size_overflow_plugin/size_overflow_transform.c | 7 +++++++
1237 .../size_overflow_transform_core.c | 2 --
1238 4 files changed, 11 insertions(+), 3 deletions(-)
1239
1240 commit 85d8735a1d1190e3ad2e3f032ae88f811090fdfc
1241 Author: Brad Spengler <spender@grsecurity.net>
1242 Date: Sun Oct 25 13:01:32 2015 -0400
1243
1244 fpu doesn't live on the task_struct with PaX, so don't even bother computing some task_size
1245 variable that isn't used for anything
1246
1247 arch/x86/kernel/fpu/init.c | 14 --------------
1248 1 files changed, 0 insertions(+), 14 deletions(-)
1249
1250 commit cfd0008de8db38841f7f06b979482900994717b9
1251 Author: Hannes Frederic Sowa <hannes@stressinduktion.org>
1252 Date: Fri Oct 16 11:32:42 2015 +0200
1253
1254 overflow-arith: begin to add support for overflow builtin functions
1255
1256 The idea of the overflow-arith.h header is to collect overflow checking
1257 functions in one central place.
1258
1259 If gcc compiler supports the __builtin_overflow_* builtins we use them
1260 because they might give better performance, otherwise the code falls
1261 back to normal overflow checking functions.
1262
1263 The builtin_overflow functions are supported by gcc-5 and clang. The
1264 matter of supporting clang is to just provide a corresponding
1265 CC_HAVE_BUILTIN_OVERFLOW, because the specific overflow checking builtins
1266 don't differ between gcc and clang.
1267
1268 I just provide overflow_usub function here as I intend this to get merged
1269 into net, more functions will definitely follow as they are needed.
1270
1271 Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
1272 Signed-off-by: David S. Miller <davem@davemloft.net>
1273
1274 include/linux/compiler-gcc.h | 4 ++++
1275 include/linux/overflow-arith.h | 18 ++++++++++++++++++
1276 2 files changed, 22 insertions(+), 0 deletions(-)
1277
1278 commit 18d5034650b637ec479f41d98e3912398b3e3efc
1279 Author: Hannes Frederic Sowa <hannes@stressinduktion.org>
1280 Date: Fri Oct 16 11:32:43 2015 +0200
1281
1282 ipv6: protect mtu calculation of wrap-around and infinite loop by rounding issues
1283
1284 Raw sockets with hdrincl enabled can insert ipv6 extension headers
1285 right into the data stream. In case we need to fragment those packets,
1286 we reparse the options header to find the place where we can insert
1287 the fragment header. If the extension headers exceed the link's MTU we
1288 actually cannot make progress in such a case.
1289
1290 Instead of ending up in broken arithmetic or rounding towards 0 and
1291 entering an endless loop in ip6_fragment, just prevent those cases by
1292 aborting early and signal -EMSGSIZE to user space.
1293
1294 Reported-by: Dmitry Vyukov <dvyukov@google.com>
1295 Cc: Dmitry Vyukov <dvyukov@google.com>
1296 Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
1297 Signed-off-by: David S. Miller <davem@davemloft.net>
1298
1299 net/ipv6/ip6_output.c | 6 +++++-
1300 1 files changed, 5 insertions(+), 1 deletions(-)
1301
1302 commit 0e1d1c0f1981b4049a70d23dce4c69daf19f020b
1303 Merge: c81314c 9470e78
1304 Author: Brad Spengler <spender@grsecurity.net>
1305 Date: Sun Oct 25 11:51:44 2015 -0400
1306
1307 Merge branch 'pax-test' into grsec-test
1308
1309 commit 9470e7893a9a1bf15f9b7d412dc09bebb59105e8
1310 Author: Brad Spengler <spender@grsecurity.net>
1311 Date: Sun Oct 25 11:50:54 2015 -0400
1312
1313 Temporary squelching of overflow warning on skb_transport_offset(), will be fixed properly after H2HC
1314
1315 include/linux/skbuff.h | 2 +-
1316 1 files changed, 1 insertions(+), 1 deletions(-)
1317
1318 commit c81314ce278e9cfa3322881a6133c2c7e53b9430
1319 Author: Brad Spengler <spender@grsecurity.net>
1320 Date: Sat Oct 24 23:13:36 2015 -0400
1321
1322 Update recordmcount/fixdep paths in RPM spec, from Andrew
1323
1324 scripts/package/mkspec | 4 ++--
1325 1 files changed, 2 insertions(+), 2 deletions(-)
1326
1327 commit 798e4296bd55778b5e77f1db69c1bb972419590f
1328 Author: Brad Spengler <spender@grsecurity.net>
1329 Date: Sat Oct 24 23:11:22 2015 -0400
1330
1331 Update size_overflow hash table
1332
1333 .../disable_size_overflow_hash.data | 3 +++
1334 .../size_overflow_plugin/size_overflow_hash.data | 5 +----
1335 2 files changed, 4 insertions(+), 4 deletions(-)
1336
1337 commit d9ef04f20fc634595883d1c1950c32a8fe04df22
1338 Author: Brad Spengler <spender@grsecurity.net>
1339 Date: Sat Oct 24 08:27:29 2015 -0400
1340
1341 Fix from Emese for https://forums.grsecurity.net/viewtopic.php?f=3&t=4291
1342
1343 drivers/usb/class/cdc-acm.h | 2 +-
1344 include/linux/usb.h | 8 ++++----
1345 2 files changed, 5 insertions(+), 5 deletions(-)
1346
1347 commit eea46f1d247f5f63e3762da91a41cba76567800f
1348 Author: Brad Spengler <spender@grsecurity.net>
1349 Date: Fri Oct 23 18:24:57 2015 -0400
1350
1351 Update size_overflow hash tables
1352
1353 .../disable_size_overflow_hash.data | 5 ++++-
1354 .../size_overflow_plugin/size_overflow_hash.data | 5 +----
1355 2 files changed, 5 insertions(+), 5 deletions(-)
1356
1357 commit 8f521b864bd7428f3ad42613416c106d1d619c4d
1358 Merge: 26adf00 285f0d1
1359 Author: Brad Spengler <spender@grsecurity.net>
1360 Date: Thu Oct 22 19:41:57 2015 -0400
1361
1362 Merge branch 'pax-test' into grsec-test
1363
1364 Conflicts:
1365 drivers/gpu/drm/drm_lock.c
1366
1367 commit 285f0d1cda31b45ee217b90861677c032cb6550b
1368 Merge: d6dc25f 190bd21
1369 Author: Brad Spengler <spender@grsecurity.net>
1370 Date: Thu Oct 22 19:40:34 2015 -0400
1371
1372 Merge branch 'linux-4.2.y' into pax-test
1373
1374 Conflicts:
1375 arch/x86/kernel/process_64.c
1376
1377 commit 26adf00caf8f4ebf155422082d4e8b8e4eb60eef
1378 Author: Eric W. Biederman <ebiederm@xmission.com>
1379 Date: Sat Aug 15 13:36:12 2015 -0500
1380
1381 dcache: Handle escaped paths in prepend_path
1382
1383 A rename can result in a dentry that by walking up d_parent
1384 will never reach it's mnt_root. For lack of a better term
1385 I call this an escaped path.
1386
1387 prepend_path is called by four different functions __d_path,
1388 d_absolute_path, d_path, and getcwd.
1389
1390 __d_path only wants to see paths are connected to the root it passes
1391 in. So __d_path needs prepend_path to return an error.
1392
1393 d_absolute_path similarly wants to see paths that are connected to
1394 some root. Escaped paths are not connected to any mnt_root so
1395 d_absolute_path needs prepend_path to return an error greater
1396 than 1. So escaped paths will be treated like paths on lazily
1397 unmounted mounts.
1398
1399 getcwd needs to prepend "(unreachable)" so getcwd also needs
1400 prepend_path to return an error.
1401
1402 d_path is the interesting hold out. d_path just wants to print
1403 something, and does not care about the weird cases. Which raises
1404 the question what should be printed?
1405
1406 Given that <escaped_path>/<anything> should result in -ENOENT I
1407 believe it is desirable for escaped paths to be printed as empty
1408 paths. As there are not really any meaninful path components when
1409 considered from the perspective of a mount tree.
1410
1411 So tweak prepend_path to return an empty path with an new error
1412 code of 3 when it encounters an escaped path.
1413
1414 Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
1415 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
1416
1417 fs/dcache.c | 7 +++++++
1418 1 files changed, 7 insertions(+), 0 deletions(-)
1419
1420 commit d402147a7689356c29bfd46a7cfa6594e517ab95
1421 Author: Salva Peiró <speirofr@gmail.com>
1422 Date: Wed Oct 14 17:48:02 2015 +0200
1423
1424 staging/dgnc: fix info leak in ioctl
1425
1426 The dgnc_mgmt_ioctl() code fails to initialize the 16 _reserved bytes of
1427 struct digi_dinfo after the ->dinfo_nboards member. Add an explicit
1428 memset(0) before filling the structure to avoid the info leak.
1429
1430 Signed-off-by: Salva Peiró <speirofr@gmail.com>
1431 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1432
1433 drivers/staging/dgnc/dgnc_mgmt.c | 1 +
1434 1 files changed, 1 insertions(+), 0 deletions(-)
1435
1436 commit bafc510c4fb4e8a5e69531fdc3a733e58c4bbdbf
1437 Author: Salva Peiró <speirofr@gmail.com>
1438 Date: Wed Oct 7 07:09:26 2015 -0300
1439
1440 [media] media/vivid-osd: fix info leak in ioctl
1441
1442 The vivid_fb_ioctl() code fails to initialize the 16 _reserved bytes of
1443 struct fb_vblank after the ->hcount member. Add an explicit
1444 memset(0) before filling the structure to avoid the info leak.
1445
1446 Signed-off-by: Salva Peiró <speirofr@gmail.com>
1447 Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
1448 Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
1449
1450 drivers/media/platform/vivid/vivid-osd.c | 1 +
1451 1 files changed, 1 insertions(+), 0 deletions(-)
1452
1453 commit 980a903796ae06366fd5acbcd179ee2dc57fbabf
1454 Author: David Howells <dhowells@redhat.com>
1455 Date: Mon Oct 19 11:20:28 2015 +0100
1456
1457 KEYS: Don't permit request_key() to construct a new keyring
1458
1459 If request_key() is used to find a keyring, only do the search part - don't
1460 do the construction part if the keyring was not found by the search. We
1461 don't really want keyrings in the negative instantiated state since the
1462 rejected/negative instantiation error value in the payload is unioned with
1463 keyring metadata.
1464
1465 Now the kernel gives an error:
1466
1467 request_key("keyring", "#selinux,bdekeyring", "keyring", KEY_SPEC_USER_SESSION_KEYRING) = -1 EPERM (Operation not permitted)
1468
1469 Signed-off-by: David Howells <dhowells@redhat.com>
1470
1471 security/keys/request_key.c | 3 +++
1472 1 files changed, 3 insertions(+), 0 deletions(-)
1473
1474 commit f705c157ed6f8a9c4c0cf552fd5f054d9d500550
1475 Author: Dan Carpenter <dan.carpenter@oracle.com>
1476 Date: Mon Oct 19 13:16:49 2015 +0300
1477
1478 irda: precedence bug in irlmp_seq_hb_idx()
1479
1480 This is decrementing the pointer, instead of the value stored in the
1481 pointer. KASan detects it as an out of bounds reference.
1482
1483 Reported-by: "Berry Cheng 程君(成淼)" <chengmiao.cj@alibaba-inc.com>
1484 Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
1485 Signed-off-by: David S. Miller <davem@davemloft.net>
1486
1487 net/irda/irlmp.c | 2 +-
1488 1 files changed, 1 insertions(+), 1 deletions(-)
1489
1490 commit 4a110451298bfce895ed224e6bbd9201d8605b2b
1491 Author: Brad Spengler <spender@grsecurity.net>
1492 Date: Tue Oct 20 19:25:13 2015 -0400
1493
1494 Ratelimit the dump_stack as well, both to 15s with a burst of 3, enough not to completely
1495 flood syslog
1496
1497 fs/exec.c | 11 +++++++++--
1498 1 files changed, 9 insertions(+), 2 deletions(-)
1499
1500 commit 183fc2ae7d90e077fd27623998d82916260a2223
1501 Merge: a240939 d6dc25f
1502 Author: Brad Spengler <spender@grsecurity.net>
1503 Date: Tue Oct 20 19:16:04 2015 -0400
1504
1505 Merge branch 'pax-test' into grsec-test
1506
1507 Conflicts:
1508 tools/gcc/size_overflow_plugin/size_overflow_plugin.c
1509
1510 commit d6dc25f193a832e08d8e7cf097d7f70b3dc24776
1511 Author: Brad Spengler <spender@grsecurity.net>
1512 Date: Tue Oct 20 19:14:41 2015 -0400
1513
1514 Update to pax-linux-4.2.3-test16.patch:
1515 - fixed undefined integer shift in proc_do_submiturb, reported by Arnaud <arnaud@drno.eu>
1516 - fixed integer underflow in scm_detach_fds (similar to 1ac70e7ad24a88710cf9b6d7ababaefa2b575df0 upstream), reported by kdave (https://forums.grsecurity.net/viewtopic.php?f=1&t=4286)
1517 - Emese added a temporary workaround for miscompiling the ath10k driver, reported by victor
1518 - Emese fixed a false positive that affected the iwlwifi driver among others, reported by victor
1519 - Emese disabled size overflow checking in acpi_ex_do_math_op and on acpi_object_integer, reported by xxterry1xx and rfnx (https://forums.grsecurity.net/viewtopic.php?f=3&t=4287)
1520
1521 drivers/net/wireless/ath/ath10k/ce.c | 2 +-
1522 drivers/usb/core/devio.c | 2 +-
1523 fs/dlm/lowcomms.c | 2 +-
1524 net/core/scm.c | 6 ++-
1525 .../disable_size_overflow_hash.data | 4 +-
1526 .../size_overflow_plugin/intentional_overflow.c | 44 --------------------
1527 tools/gcc/size_overflow_plugin/size_overflow.h | 1 -
1528 .../size_overflow_plugin/size_overflow_hash.data | 4 +-
1529 .../size_overflow_plugin/size_overflow_plugin.c | 4 +-
1530 .../size_overflow_plugin/size_overflow_transform.c | 3 -
1531 .../size_overflow_transform_core.c | 6 +++
1532 11 files changed, 19 insertions(+), 59 deletions(-)
1533
1534 commit a2409394c2b0d97a9f02bf62ca4c0254602e58a6
1535 Author: Brad Spengler <spender@grsecurity.net>
1536 Date: Tue Oct 20 08:58:25 2015 -0400
1537
1538 set default to y
1539
1540 security/Kconfig | 1 +
1541 1 files changed, 1 insertions(+), 0 deletions(-)
1542
1543 commit 3abe24117389419654da44adc87a9a03ad7e3f38
1544 Author: Brad Spengler <spender@grsecurity.net>
1545 Date: Tue Oct 20 08:08:32 2015 -0400
1546
1547 Add a new config option from Emese to allow SIZE_OVERFLOW to be enabled
1548 while having it not kill the userland process in an overflow condition.
1549 This will help us obtain reports over the next few weeks while not making
1550 some percentage of users' machines unusable.
1551
1552 To enable this option, set CONFIG_PAX_SIZE_OVERFLOW_DISABLE_KILL=y in .config
1553
1554 fs/exec.c | 5 +++++
1555 security/Kconfig | 4 ++++
1556 .../size_overflow_plugin/size_overflow_plugin.c | 4 ++--
1557 3 files changed, 11 insertions(+), 2 deletions(-)
1558
1559 commit bcae982f720ce0b3463a81f2b72a4807cb89048b
1560 Merge: 0e55d80 128d3a5
1561 Author: Brad Spengler <spender@grsecurity.net>
1562 Date: Mon Oct 19 18:56:09 2015 -0400
1563
1564 Merge branch 'pax-test' into grsec-test
1565
1566 commit 128d3a5452ab001b29235b05eb0be3334fff3998
1567 Author: Brad Spengler <spender@grsecurity.net>
1568 Date: Mon Oct 19 18:55:37 2015 -0400
1569
1570 Update to pax-linux-4.2.3-test14.patch:
1571 - Emese fixed a false positive size overflow report, reported by gus (https://forums.grsecurity.net/viewtopic.php?t=4280)
1572 - fixed an integer sign mixup in usb_stor_invoke_transport, reported by Arnaud <arnaud@drno.eu>
1573
1574 drivers/usb/storage/transport.c | 2 +-
1575 .../size_overflow_plugin/size_overflow_plugin.c | 2 +-
1576 .../size_overflow_plugin/size_overflow_transform.c | 15 +++-
1577 .../size_overflow_transform_core.c | 90 ++++++++++++++-----
1578 4 files changed, 81 insertions(+), 28 deletions(-)
1579
1580 commit 0e55d80a65998266cab71804131a072fcc8ee558
1581 Merge: a61fd15 9c4310f
1582 Author: Brad Spengler <spender@grsecurity.net>
1583 Date: Sat Oct 17 23:15:36 2015 -0400
1584
1585 Merge branch 'pax-test' into grsec-test
1586
1587 commit 9c4310fdb2d19f83affc62eb2698d3763ce8c36b
1588 Author: Brad Spengler <spender@grsecurity.net>
1589 Date: Sat Oct 17 23:15:13 2015 -0400
1590
1591 Update to pax-linux-4.2.3-test14.patch:
1592 - reverted some page table hardening that caused too much slowdown under virtualization, reported by quasar366 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4275)
1593
1594 arch/x86/include/asm/pgtable-2level.h | 18 ++----------------
1595 arch/x86/include/asm/pgtable-3level.h | 10 ----------
1596 arch/x86/include/asm/pgtable_32.h | 2 ++
1597 arch/x86/include/asm/pgtable_64.h | 18 ++----------------
1598 arch/x86/mm/highmem_32.c | 2 ++
1599 arch/x86/mm/init_64.c | 2 ++
1600 arch/x86/mm/iomap_32.c | 4 ++++
1601 arch/x86/mm/pageattr.c | 4 ++++
1602 arch/x86/mm/pgtable.c | 2 ++
1603 arch/x86/mm/pgtable_32.c | 3 +++
1604 mm/highmem.c | 5 +++++
1605 mm/vmalloc.c | 7 +++++++
1606 12 files changed, 35 insertions(+), 42 deletions(-)
1607
1608 commit a61fd152e87bd3ed91194b07f6b1fcbcd165093b
1609 Merge: 00f1afa db7a8e5
1610 Author: Brad Spengler <spender@grsecurity.net>
1611 Date: Sat Oct 17 18:33:48 2015 -0400
1612
1613 Merge branch 'pax-test' into grsec-test
1614
1615 commit db7a8e5c284179889014b5929a40298e1b228fbc
1616 Author: Brad Spengler <spender@grsecurity.net>
1617 Date: Sat Oct 17 18:33:22 2015 -0400
1618
1619 Update to pax-linux-4.2.3-test13.patch:
1620 - Emese worked around a sign mixup with wiphy.rts_threshold, reported by gus (https://forums.grsecurity.net/viewtopic.php?f=3&t=4278)
1621
1622 .../disable_size_overflow_hash.data | 2 ++
1623 .../size_overflow_plugin/size_overflow_hash.data | 2 --
1624 2 files changed, 2 insertions(+), 2 deletions(-)
1625
1626 commit 00f1afa694317365e9bd6dc77d2e3e96ae3a68ec
1627 Merge: 7098385 57dc21d
1628 Author: Brad Spengler <spender@grsecurity.net>
1629 Date: Sat Oct 17 11:04:56 2015 -0400
1630
1631 Merge branch 'pax-test' into grsec-test
1632
1633 commit 57dc21d203a9fa1312a4abc608da5b3644d29078
1634 Author: Brad Spengler <spender@grsecurity.net>
1635 Date: Sat Oct 17 11:04:34 2015 -0400
1636
1637 Update to pax-linux-4.2.3-test12.patch:
1638 - removed size_overflow_hash.data.prev that was left behind by accident
1639 - Emese fixed a false positive overflow report in the megaraid driver due to a gcc limitation, reported by vortex (https://forums.grsecurity.net/viewtopic.php?f=3&t=4277)
1640
1641 drivers/scsi/megaraid/megaraid_sas.h | 2 +-
1642 1 files changed, 1 insertions(+), 1 deletions(-)
1643
1644 commit 7098385851c43dea6692508c71cd5fbcce3187b2
1645 Merge: bc6d23e 78b0f64
1646 Author: Brad Spengler <spender@grsecurity.net>
1647 Date: Fri Oct 16 17:45:06 2015 -0400
1648
1649 Merge branch 'pax-test' into grsec-test
1650
1651 Conflicts:
1652 tools/gcc/size_overflow_plugin/intentional_overflow.c
1653
1654 commit 78b0f643d8d2b870e8ad5df075d4ab79befa4266
1655 Author: Brad Spengler <spender@grsecurity.net>
1656 Date: Fri Oct 16 17:44:18 2015 -0400
1657
1658 Update to pax-linux-4.2.3-test11.patch:
1659 - Emese fixed a few false positives caused by error codes
1660 - simplified the switch_mm code on x86 a bit
1661
1662 arch/x86/include/asm/mmu_context.h | 118 +++++--------
1663 include/drm/drm_mm.h | 2 +-
1664 .../size_overflow_plugin/intentional_overflow.c | 11 +-
1665 tools/gcc/size_overflow_plugin/size_overflow.h | 19 ++-
1666 .../size_overflow_plugin/size_overflow_plugin.c | 2 +-
1667 .../size_overflow_plugin/size_overflow_transform.c | 178 +++++++++-----------
1668 .../size_overflow_transform_core.c | 31 ++--
1669 7 files changed, 169 insertions(+), 192 deletions(-)
1670
1671 commit bc6d23e3408e389f8a96134f6bc915e9fc8b370b
1672 Author: Brad Spengler <spender@grsecurity.net>
1673 Date: Fri Oct 16 17:28:54 2015 -0400
1674
1675 Update rpm devel spec, thanks to Andrew
1676
1677 scripts/package/mkspec | 3 +++
1678 1 files changed, 3 insertions(+), 0 deletions(-)
1679
1680 commit b3f30cb9207a72a6aa4a78f23f8c5353be0bb27b
1681 Author: Brad Spengler <spender@grsecurity.net>
1682 Date: Thu Oct 15 20:10:56 2015 -0400
1683
1684 disable tracing support with GRKERNSEC_KMEM (it forces debugfs support on)
1685
1686 kernel/trace/Kconfig | 2 +-
1687 1 files changed, 1 insertions(+), 1 deletions(-)
1688
1689 commit 82a0c12587f14add438ddf3b558e2278fcb7a387
1690 Author: Brad Spengler <spender@grsecurity.net>
1691 Date: Thu Oct 15 19:19:43 2015 -0400
1692
1693 Force DEBUG_FS off the hard way, since 'select' can cause it to be
1694 inadvertently enabled. Add a backup check that fails the build if
1695 GRKERNSEC_KMEM is enabled with DEBUG_FS
1696 Ditto for PROC_PAGE_MONITOR
1697
1698 arch/arc/Kconfig | 1 +
1699 arch/arm/Kconfig.debug | 1 +
1700 arch/arm64/Kconfig.debug | 1 +
1701 arch/blackfin/Kconfig.debug | 1 +
1702 arch/s390/Kconfig.debug | 1 +
1703 arch/x86/Kconfig.debug | 2 ++
1704 drivers/iommu/Kconfig | 1 +
1705 drivers/md/bcache/Kconfig | 1 +
1706 drivers/net/wireless/ath/ath9k/Kconfig | 1 -
1707 include/linux/grsecurity.h | 6 ++++++
1708 init/Kconfig | 1 +
1709 kernel/trace/Kconfig | 2 ++
1710 lib/Kconfig.debug | 6 +++++-
1711 mm/Kconfig | 3 +++
1712 net/sunrpc/Kconfig | 1 +
1713 15 files changed, 27 insertions(+), 2 deletions(-)
1714
1715 commit 1b6f8fc8b8100292647638c713326776a0865705
1716 Author: Brad Spengler <spender@grsecurity.net>
1717 Date: Thu Oct 15 17:58:59 2015 -0400
1718
1719 Force DEBUG_FS off in the kernel config, even having it present is a security
1720 risk
1721
1722 Conflicts:
1723
1724 lib/Kconfig.debug
1725
1726 lib/Kconfig.debug | 1 +
1727 1 files changed, 1 insertions(+), 0 deletions(-)
1728
1729 commit 21057fc30571f96aa46acf8922417311905d0f2b
1730 Author: Brad Spengler <spender@grsecurity.net>
1731 Date: Thu Oct 15 08:15:33 2015 -0400
1732
1733 Backport fix from: https://patchwork.kernel.org/patch/6853351/
1734 The debug_read_tlb() uses the sprintf() functions directly on the buffer
1735 allocated by buf = kmalloc(count), without taking into account the size
1736 of the buffer, with the consequence corrupting the heap, depending on
1737 the count requested by the user.
1738
1739 The patch fixes the issue replacing sprintf() by seq_printf().
1740
1741 Signed-off-by: Salva Peiró <speirofr@gmail.com>
1742
1743 drivers/iommu/omap-iommu-debug.c | 26 +++++++-------------------
1744 drivers/iommu/omap-iommu.c | 28 +++++++++++-----------------
1745 drivers/iommu/omap-iommu.h | 3 +--
1746 3 files changed, 19 insertions(+), 38 deletions(-)
1747
1748 commit ba936d19274485bad900a69d679878a50faa50aa
1749 Author: Joe Perches <joe@perches.com>
1750 Date: Wed Oct 14 01:09:40 2015 -0700
1751
1752 ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings
1753
1754 It seems that kernel memory can leak into userspace by a
1755 kmalloc, ethtool_get_strings, then copy_to_user sequence.
1756
1757 Avoid this by using kcalloc to zero fill the copied buffer.
1758
1759 Signed-off-by: Joe Perches <joe@perches.com>
1760 Acked-by: Ben Hutchings <ben@decadent.org.uk>
1761 Signed-off-by: David S. Miller <davem@davemloft.net>
1762
1763 net/core/ethtool.c | 2 +-
1764 1 files changed, 1 insertions(+), 1 deletions(-)
1765
1766 commit bae0a8209962cede6a0d486cf2414cac1747f91b
1767 Author: Brad Spengler <spender@grsecurity.net>
1768 Date: Wed Oct 14 19:54:27 2015 -0400
1769
1770 Update size_overflow hash table
1771
1772 .../size_overflow_plugin/size_overflow_hash.data | 53 +++++++++++++++++--
1773 1 files changed, 47 insertions(+), 6 deletions(-)
1774
1775 commit 1d840cc98b8f9b62d3c906ae24385f79c9131e29
1776 Author: Brad Spengler <spender@grsecurity.net>
1777 Date: Wed Oct 14 19:50:48 2015 -0400
1778
1779 Update size_overflow hash table
1780
1781 .../size_overflow_plugin/size_overflow_hash.data | 1 +
1782 1 files changed, 1 insertions(+), 0 deletions(-)
1783
1784 commit fca9b7af6aebd1d80f364d6d849470e917919004
1785 Author: Brad Spengler <spender@grsecurity.net>
1786 Date: Wed Oct 14 19:47:21 2015 -0400
1787
1788 Update size_overflow hash table
1789
1790 .../size_overflow_plugin/size_overflow_hash.data | 300 ++++++++++++++++----
1791 1 files changed, 244 insertions(+), 56 deletions(-)
1792
1793 commit 07cadc277ba83222698c99091c7da2c28275981f
1794 Author: Brad Spengler <spender@grsecurity.net>
1795 Date: Wed Oct 14 19:39:44 2015 -0400
1796
1797 squelch some informational messages only used by Emese
1798
1799 .../size_overflow_plugin/intentional_overflow.c | 6 +++---
1800 1 files changed, 3 insertions(+), 3 deletions(-)
1801
1802 commit 77eeeac20bde1e0ebd72efe0f7b5c52786411bc7
1803 Author: Brad Spengler <spender@grsecurity.net>
1804 Date: Wed Oct 14 19:15:56 2015 -0400
1805
1806 Re-enable size_overflow
1807
1808 security/Kconfig | 1 -
1809 1 files changed, 0 insertions(+), 1 deletions(-)
1810
1811 commit cb8efa1fd63be1bbcf5e585396cc0ed562d0c624
1812 Merge: 913cbf6 4c48a7f
1813 Author: Brad Spengler <spender@grsecurity.net>
1814 Date: Wed Oct 14 17:14:42 2015 -0400
1815
1816 Merge branch 'pax-test' into grsec-test
1817
1818 Conflicts:
1819 tools/gcc/size_overflow_plugin/size_overflow_hash.data
1820
1821 commit 4c48a7fc8df9310f994708b42fe1102a2943917c
1822 Author: Brad Spengler <spender@grsecurity.net>
1823 Date: Wed Oct 14 17:12:54 2015 -0400
1824
1825 Update to pax-linux-4.2.3-test10.patch:
1826 - fixed accidentally dropped csum_partial_copy_generic_to_user entry point for pre-P6 i386 configs, by minipli
1827 - Emese fixed a bunch of false positives with the size overflow plugin, let's see how it goes in the real world :)
1828
1829 arch/x86/include/asm/processor.h | 2 +-
1830 arch/x86/include/asm/ptrace.h | 8 +-
1831 arch/x86/lib/checksum_32.S | 2 +
1832 arch/x86/xen/mmu.c | 2 +-
1833 drivers/ata/libahci.c | 2 +-
1834 drivers/i2c/busses/i2c-diolan-u2c.c | 2 +-
1835 drivers/oprofile/oprofile_files.c | 2 +-
1836 drivers/spi/spidev.c | 2 +-
1837 drivers/tty/n_tty.c | 2 +-
1838 drivers/usb/core/message.c | 6 +-
1839 fs/binfmt_elf.c | 2 +-
1840 fs/ubifs/io.c | 2 +-
1841 include/drm/drm_mm.h | 2 +-
1842 include/linux/completion.h | 12 +-
1843 include/linux/jiffies.h | 10 +-
1844 include/linux/kernel.h | 2 +-
1845 include/linux/mm.h | 2 +-
1846 include/linux/random.h | 4 +-
1847 include/linux/sched.h | 2 +-
1848 include/linux/usb.h | 2 +-
1849 kernel/sched/completion.c | 6 +-
1850 kernel/time/timer.c | 2 +-
1851 lib/bitmap.c | 2 +-
1852 mm/internal.h | 2 +-
1853 net/sunrpc/svcauth_unix.c | 2 +-
1854 .../disable_size_overflow_hash.data |22980 +++++++++++---------
1855 .../insert_size_overflow_asm.c | 7 +
1856 .../size_overflow_plugin/intentional_overflow.c | 10 +-
1857 tools/gcc/size_overflow_plugin/size_overflow.h | 29 +-
1858 .../gcc/size_overflow_plugin/size_overflow_debug.c | 20 +-
1859 .../size_overflow_plugin/size_overflow_hash.data |14092 ++++++++----
1860 tools/gcc/size_overflow_plugin/size_overflow_ipa.c | 252 +-
1861 .../size_overflow_plugin/size_overflow_plugin.c | 2 +-
1862 .../size_overflow_plugin_hash.c | 13 +-
1863 .../size_overflow_plugin/size_overflow_transform.c | 205 +-
1864 .../size_overflow_transform_core.c | 4 +-
1865 36 files changed, 21958 insertions(+), 15740 deletions(-)
1866
1867 commit 913cbf6a23fcad570b776b1a5a71242b909c5c99
1868 Author: Dave Kleikamp <dave.kleikamp@oracle.com>
1869 Date: Mon Oct 5 10:08:51 2015 -0500
1870
1871 crypto: sparc - initialize blkcipher.ivsize
1872
1873 Some of the crypto algorithms write to the initialization vector,
1874 but no space has been allocated for it. This clobbers adjacent memory.
1875
1876 Cc: stable@vger.kernel.org
1877 Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
1878 Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
1879
1880 arch/sparc/crypto/aes_glue.c | 2 ++
1881 arch/sparc/crypto/camellia_glue.c | 1 +
1882 arch/sparc/crypto/des_glue.c | 2 ++
1883 3 files changed, 5 insertions(+), 0 deletions(-)
1884
1885 commit 7af7ad1e287067b7ea659dc0dd3e2e355588e246
1886 Author: Brad Spengler <spender@grsecurity.net>
1887 Date: Tue Oct 13 08:03:51 2015 -0400
1888
1889 Apply fix by Tejun Heo for upstream bug reported on the forums by Fuxino:
1890 https://forums.grsecurity.net/viewtopic.php?f=3&t=4276#p15570
1891
1892 Probably made more easily reproducible via SANITIZE, but we won't know for
1893 sure without a full oops report.
1894
1895 For some reason even though this patch was marked for 4.2+ stable over a month
1896 ago, it still hasn't hit Greg's tree.
1897
1898 block/blk-cgroup.c | 3 +++
1899 1 files changed, 3 insertions(+), 0 deletions(-)
1900
1901 commit 8e1f29f9e1af36f71d12213ea6530eb77014c00c
1902 Author: Dmitry Vyukov <dvyukov@google.com>
1903 Date: Thu Sep 17 17:17:10 2015 +0200
1904
1905 tty: fix data race on tty_buffer.commit
1906
1907 Race on buffer data happens when newly committed data is
1908 picked up by an old flush work in the following scenario:
1909 __tty_buffer_request_room does a plain write of tail->commit,
1910 no barriers were executed before that.
1911 At this point flush_to_ldisc reads this new value of commit,
1912 and reads buffer data, no barriers in between.
1913 The committed buffer data is not necessary visible to flush_to_ldisc.
1914
1915 Similar bug happens when tty_schedule_flip commits data.
1916
1917 Update commit with smp_store_release and read commit with
1918 smp_load_acquire, as it is commit that signals data readiness.
1919 This is orthogonal to the existing synchronization on tty_buffer.next,
1920 which is required to not dismiss a buffer with unconsumed data.
1921
1922 The data race was found with KernelThreadSanitizer (KTSAN).
1923
1924 Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
1925 Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
1926 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1927
1928 drivers/tty/tty_buffer.c | 15 ++++++++++++---
1929 1 files changed, 12 insertions(+), 3 deletions(-)
1930
1931 commit d62db216e7182e24317596471c1a3a2a9fb9d1f5
1932 Author: Peter Hurley <peter@hurleysoftware.com>
1933 Date: Sun Jul 12 20:50:49 2015 -0400
1934
1935 tty: Replace smp_rmb/smp_wmb with smp_load_acquire/smp_store_release
1936
1937 Clarify flip buffer producer/consumer operation; the use of
1938 smp_load_acquire() and smp_store_release() more clearly indicates
1939 which memory access requires a barrier.
1940
1941 Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
1942 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1943
1944 drivers/tty/tty_buffer.c | 10 ++++------
1945 1 files changed, 4 insertions(+), 6 deletions(-)
1946
1947 commit c6bbe8a6097f869b6a3d3c40d456727180573dd9
1948 Author: Kosuke Tatsukawa <tatsu@ab.jp.nec.com>
1949 Date: Fri Oct 2 08:27:05 2015 +0000
1950
1951 tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c
1952
1953 My colleague ran into a program stall on a x86_64 server, where
1954 n_tty_read() was waiting for data even if there was data in the buffer
1955 in the pty. kernel stack for the stuck process looks like below.
1956 #0 [ffff88303d107b58] __schedule at ffffffff815c4b20
1957 #1 [ffff88303d107bd0] schedule at ffffffff815c513e
1958 #2 [ffff88303d107bf0] schedule_timeout at ffffffff815c7818
1959 #3 [ffff88303d107ca0] wait_woken at ffffffff81096bd2
1960 #4 [ffff88303d107ce0] n_tty_read at ffffffff8136fa23
1961 #5 [ffff88303d107dd0] tty_read at ffffffff81368013
1962 #6 [ffff88303d107e20] __vfs_read at ffffffff811a3704
1963 #7 [ffff88303d107ec0] vfs_read at ffffffff811a3a57
1964 #8 [ffff88303d107f00] sys_read at ffffffff811a4306
1965 #9 [ffff88303d107f50] entry_SYSCALL_64_fastpath at ffffffff815c86d7
1966
1967 There seems to be two problems causing this issue.
1968
1969 First, in drivers/tty/n_tty.c, __receive_buf() stores the data and
1970 updates ldata->commit_head using smp_store_release() and then checks
1971 the wait queue using waitqueue_active(). However, since there is no
1972 memory barrier, __receive_buf() could return without calling
1973 wake_up_interactive_poll(), and at the same time, n_tty_read() could
1974 start to wait in wait_woken() as in the following chart.
1975
1976 __receive_buf() n_tty_read()
1977 ------------------------------------------------------------------------
1978 if (waitqueue_active(&tty->read_wait))
1979 /* Memory operations issued after the
1980 RELEASE may be completed before the
1981 RELEASE operation has completed */
1982 add_wait_queue(&tty->read_wait, &wait);
1983 ...
1984 if (!input_available_p(tty, 0)) {
1985 smp_store_release(&ldata->commit_head,
1986 ldata->read_head);
1987 ...
1988 timeout = wait_woken(&wait,
1989 TASK_INTERRUPTIBLE, timeout);
1990 ------------------------------------------------------------------------
1991
1992 The second problem is that n_tty_read() also lacks a memory barrier
1993 call and could also cause __receive_buf() to return without calling
1994 wake_up_interactive_poll(), and n_tty_read() to wait in wait_woken()
1995 as in the chart below.
1996
1997 __receive_buf() n_tty_read()
1998 ------------------------------------------------------------------------
1999 spin_lock_irqsave(&q->lock, flags);
2000 /* from add_wait_queue() */
2001 ...
2002 if (!input_available_p(tty, 0)) {
2003 /* Memory operations issued after the
2004 RELEASE may be completed before the
2005 RELEASE operation has completed */
2006 smp_store_release(&ldata->commit_head,
2007 ldata->read_head);
2008 if (waitqueue_active(&tty->read_wait))
2009 __add_wait_queue(q, wait);
2010 spin_unlock_irqrestore(&q->lock,flags);
2011 /* from add_wait_queue() */
2012 ...
2013 timeout = wait_woken(&wait,
2014 TASK_INTERRUPTIBLE, timeout);
2015 ------------------------------------------------------------------------
2016
2017 There are also other places in drivers/tty/n_tty.c which have similar
2018 calls to waitqueue_active(), so instead of adding many memory barrier
2019 calls, this patch simply removes the call to waitqueue_active(),
2020 leaving just wake_up*() behind.
2021
2022 This fixes both problems because, even though the memory access before
2023 or after the spinlocks in both wake_up*() and add_wait_queue() can
2024 sneak into the critical section, it cannot go past it and the critical
2025 section assures that they will be serialized (please see "INTER-CPU
2026 ACQUIRING BARRIER EFFECTS" in Documentation/memory-barriers.txt for a
2027 better explanation). Moreover, the resulting code is much simpler.
2028
2029 Latency measurement using a ping-pong test over a pty doesn't show any
2030 visible performance drop.
2031
2032 Signed-off-by: Kosuke Tatsukawa <tatsu@ab.jp.nec.com>
2033 Cc: stable@vger.kernel.org
2034 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2035
2036 drivers/tty/n_tty.c | 15 +++++----------
2037 1 files changed, 5 insertions(+), 10 deletions(-)
2038
2039 commit 3af2011ac1a085a3e8c57ca3a840aec393b37db3
2040 Author: Dmitry Vyukov <dvyukov@google.com>
2041 Date: Thu Sep 17 17:17:08 2015 +0200
2042
2043 tty: fix data race in flush_to_ldisc
2044
2045 flush_to_ldisc reads port->itty and checks that it is not NULL,
2046 concurrently release_tty sets port->itty to NULL. It is possible
2047 that flush_to_ldisc loads port->itty once, ensures that it is
2048 not NULL, but then reloads it again and uses. The second load
2049 can already return NULL, which will cause a crash.
2050
2051 Use READ_ONCE to read port->itty.
2052
2053 The data race was found with KernelThreadSanitizer (KTSAN).
2054
2055 Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
2056 Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
2057 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2058
2059 drivers/tty/tty_buffer.c | 2 +-
2060 1 files changed, 1 insertions(+), 1 deletions(-)
2061
2062 commit 4a433f384b0a5b7e39f969ee8df89c56537d078d
2063 Author: Dmitry Vyukov <dvyukov@google.com>
2064 Date: Thu Sep 17 17:17:09 2015 +0200
2065
2066 tty: fix data race in tty_buffer_flush
2067
2068 tty_buffer_flush frees not acquired buffers.
2069 As the result, for example, read of b->size in tty_buffer_free
2070 can return garbage value which will lead to a huge buffer
2071 hanging in the freelist. This is just the benignest
2072 manifestation of freeing of a not acquired object.
2073 If the object is passed to kfree, heap can be corrupted.
2074
2075 Acquire visibility over the buffer before freeing it.
2076
2077 The data race was found with KernelThreadSanitizer (KTSAN).
2078
2079 Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
2080 Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
2081 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2082
2083 drivers/tty/tty_buffer.c | 5 ++++-
2084 1 files changed, 4 insertions(+), 1 deletions(-)
2085
2086 commit 1477c439d65debf45ac3164a1615504131fad1ff
2087 Author: Jann Horn <jann@thejh.net>
2088 Date: Sun Oct 4 19:29:12 2015 +0200
2089
2090 drivers/tty: require read access for controlling terminal
2091
2092 This is mostly a hardening fix, given that write-only access to other
2093 users' ttys is usually only given through setgid tty executables.
2094
2095 Signed-off-by: Jann Horn <jann@thejh.net>
2096 Cc: stable@vger.kernel.org
2097 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2098
2099 drivers/tty/tty_io.c | 31 +++++++++++++++++++++++++++----
2100 1 files changed, 27 insertions(+), 4 deletions(-)
2101
2102 commit c2d51348729aa244b827216715db7734daf07155
2103 Author: Brad Spengler <spender@grsecurity.net>
2104 Date: Mon Oct 12 07:19:03 2015 -0400
2105
2106 Don't auto-enable UDEREF on x64 with a VirtualBox host
2107
2108 Conflicts:
2109
2110 security/Kconfig
2111
2112 security/Kconfig | 2 +-
2113 1 files changed, 1 insertions(+), 1 deletions(-)
2114
2115 commit 45ff0fe97624b7133be6f0280ab8fda4610b7937
2116 Merge: ca6828e 1c527d2
2117 Author: Brad Spengler <spender@grsecurity.net>
2118 Date: Sun Oct 11 17:17:58 2015 -0400
2119
2120 Merge branch 'pax-test' into grsec-test
2121
2122 Conflicts:
2123 arch/x86/mm/pgtable.c
2124
2125 commit 1c527d25ad2ece4cdb4723047625d96b942a3b91
2126 Author: Brad Spengler <spender@grsecurity.net>
2127 Date: Sun Oct 11 17:16:49 2015 -0400
2128
2129 Update to pax-linux-4.2.3-test9.patch:
2130 - really fixed vsyscall/pvclock regression caused by the recent page table hardening, reported by kamil (https://forums.grsecurity.net/viewtopic.php?f=3&t=4272) and quasar366 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4275)
2131 - fixed a compilation error caused by the above regression, reported by spender
2132 - fixed an arm compilation error, reported by Emese
2133
2134 arch/arm/kernel/module-plts.c | 7 +------
2135 arch/x86/mm/pgtable.c | 21 +++++++++++++++++++--
2136 2 files changed, 20 insertions(+), 8 deletions(-)
2137
2138 commit ca6828e73b10b4a7537b16a37c2c0280523171e1
2139 Author: Trond Myklebust <trond.myklebust@primarydata.com>
2140 Date: Fri Oct 9 13:44:34 2015 -0400
2141
2142 namei: results of d_is_negative() should be checked after dentry revalidation
2143
2144 Leandro Awa writes:
2145 "After switching to version 4.1.6, our parallelized and distributed
2146 workflows now fail consistently with errors of the form:
2147
2148 T34: ./regex.c:39:22: error: config.h: No such file or directory
2149
2150 From our 'git bisect' testing, the following commit appears to be the
2151 possible cause of the behavior we've been seeing: commit 766c4cbfacd8"
2152
2153 Al Viro says:
2154 "What happens is that 766c4cbfacd8 got the things subtly wrong.
2155
2156 We used to treat d_is_negative() after lookup_fast() as "fall with
2157 ENOENT". That was wrong - checking ->d_flags outside of ->d_seq
2158 protection is unreliable and failing with hard error on what should've
2159 fallen back to non-RCU pathname resolution is a bug.
2160
2161 Unfortunately, we'd pulled the test too far up and ran afoul of
2162 another kind of staleness. The dentry might have been absolutely
2163 stable from the RCU point of view (and we might be on UP, etc), but
2164 stale from the remote fs point of view. If ->d_revalidate() returns
2165 "it's actually stale", dentry gets thrown away and the original code
2166 wouldn't even have looked at its ->d_flags.
2167
2168 What we need is to check ->d_flags where 766c4cbfacd8 does (prior to
2169 ->d_seq validation) but only use the result in cases where we do not
2170 discard this dentry outright"
2171
2172 Reported-by: Leandro Awa <lawa@nvidia.com>
2173 Link: https://bugzilla.kernel.org/show_bug.cgi?id=104911
2174 Fixes: 766c4cbfacd8 ("namei: d_is_negative() should be checked...")
2175 Tested-by: Leandro Awa <lawa@nvidia.com>
2176 Cc: stable@vger.kernel.org # v4.1+
2177 Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
2178 Acked-by: Al Viro <viro@zeniv.linux.org.uk>
2179 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2180
2181 fs/namei.c | 8 ++++++--
2182 1 files changed, 6 insertions(+), 2 deletions(-)
2183
2184 commit c0181260ce096a814637ad60e45a64c94840fffa
2185 Author: Matt Fleming <matt.fleming@intel.com>
2186 Date: Fri Sep 25 23:02:18 2015 +0100
2187
2188 x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down
2189
2190 Beginning with UEFI v2.5 EFI_PROPERTIES_TABLE was introduced
2191 that signals that the firmware PE/COFF loader supports splitting
2192 code and data sections of PE/COFF images into separate EFI
2193 memory map entries. This allows the kernel to map those regions
2194 with strict memory protections, e.g. EFI_MEMORY_RO for code,
2195 EFI_MEMORY_XP for data, etc.
2196
2197 Unfortunately, an unwritten requirement of this new feature is
2198 that the regions need to be mapped with the same offsets
2199 relative to each other as observed in the EFI memory map. If
2200 this is not done crashes like this may occur,
2201
2202 BUG: unable to handle kernel paging request at fffffffefe6086dd
2203 IP: [<fffffffefe6086dd>] 0xfffffffefe6086dd
2204 Call Trace:
2205 [<ffffffff8104c90e>] efi_call+0x7e/0x100
2206 [<ffffffff81602091>] ? virt_efi_set_variable+0x61/0x90
2207 [<ffffffff8104c583>] efi_delete_dummy_variable+0x63/0x70
2208 [<ffffffff81f4e4aa>] efi_enter_virtual_mode+0x383/0x392
2209 [<ffffffff81f37e1b>] start_kernel+0x38a/0x417
2210 [<ffffffff81f37495>] x86_64_start_reservations+0x2a/0x2c
2211 [<ffffffff81f37582>] x86_64_start_kernel+0xeb/0xef
2212
2213 Here 0xfffffffefe6086dd refers to an address the firmware
2214 expects to be mapped but which the OS never claimed was mapped.
2215 The issue is that included in these regions are relative
2216 addresses to other regions which were emitted by the firmware
2217 toolchain before the "splitting" of sections occurred at
2218 runtime.
2219
2220 Needless to say, we don't satisfy this unwritten requirement on
2221 x86_64 and instead map the EFI memory map entries in reverse
2222 order. The above crash is almost certainly triggerable with any
2223 kernel newer than v3.13 because that's when we rewrote the EFI
2224 runtime region mapping code, in commit d2f7cbe7b26a ("x86/efi:
2225 Runtime services virtual mapping"). For kernel versions before
2226 v3.13 things may work by pure luck depending on the
2227 fragmentation of the kernel virtual address space at the time we
2228 map the EFI regions.
2229
2230 Instead of mapping the EFI memory map entries in reverse order,
2231 where entry N has a higher virtual address than entry N+1, map
2232 them in the same order as they appear in the EFI memory map to
2233 preserve this relative offset between regions.
2234
2235 This patch has been kept as small as possible with the intention
2236 that it should be applied aggressively to stable and
2237 distribution kernels. It is very much a bugfix rather than
2238 support for a new feature, since when EFI_PROPERTIES_TABLE is
2239 enabled we must map things as outlined above to even boot - we
2240 have no way of asking the firmware not to split the code/data
2241 regions.
2242
2243 In fact, this patch doesn't even make use of the more strict
2244 memory protections available in UEFI v2.5. That will come later.
2245
2246 Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
2247 Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
2248 Signed-off-by: Matt Fleming <matt.fleming@intel.com>
2249 Cc: <stable@vger.kernel.org>
2250 Cc: Borislav Petkov <bp@suse.de>
2251 Cc: Chun-Yi <jlee@suse.com>
2252 Cc: Dave Young <dyoung@redhat.com>
2253 Cc: H. Peter Anvin <hpa@zytor.com>
2254 Cc: James Bottomley <JBottomley@Odin.com>
2255 Cc: Lee, Chun-Yi <jlee@suse.com>
2256 Cc: Leif Lindholm <leif.lindholm@linaro.org>
2257 Cc: Linus Torvalds <torvalds@linux-foundation.org>
2258 Cc: Matthew Garrett <mjg59@srcf.ucam.org>
2259 Cc: Mike Galbraith <efault@gmx.de>
2260 Cc: Peter Jones <pjones@redhat.com>
2261 Cc: Peter Zijlstra <peterz@infradead.org>
2262 Cc: Thomas Gleixner <tglx@linutronix.de>
2263 Cc: linux-kernel@vger.kernel.org
2264 Link: http://lkml.kernel.org/r/1443218539-7610-2-git-send-email-matt@codeblueprint.co.uk
2265 Signed-off-by: Ingo Molnar <mingo@kernel.org>
2266
2267 arch/x86/platform/efi/efi.c | 67 ++++++++++++++++++++++++++++++++++++++++++-
2268 1 files changed, 66 insertions(+), 1 deletions(-)
2269
2270 commit 9377caab146791c8c587da3750d6eddcd01bdfba
2271 Author: Ard Biesheuvel <ard.biesheuvel@linaro.org>
2272 Date: Fri Sep 25 23:02:19 2015 +0100
2273
2274 arm64/efi: Fix boot crash by not padding between EFI_MEMORY_RUNTIME regions
2275
2276 The new Properties Table feature introduced in UEFIv2.5 may
2277 split memory regions that cover PE/COFF memory images into
2278 separate code and data regions. Since these regions only differ
2279 in the type (runtime code vs runtime data) and the permission
2280 bits, but not in the memory type attributes (UC/WC/WT/WB), the
2281 spec does not require them to be aligned to 64 KB.
2282
2283 Since the relative offset of PE/COFF .text and .data segments
2284 cannot be changed on the fly, this means that we can no longer
2285 pad out those regions to be mappable using 64 KB pages.
2286 Unfortunately, there is no annotation in the UEFI memory map
2287 that identifies data regions that were split off from a code
2288 region, so we must apply this logic to all adjacent runtime
2289 regions whose attributes only differ in the permission bits.
2290
2291 So instead of rounding each memory region to 64 KB alignment at
2292 both ends, only round down regions that are not directly
2293 preceded by another runtime region with the same type
2294 attributes. Since the UEFI spec does not mandate that the memory
2295 map be sorted, this means we also need to sort it first.
2296
2297 Note that this change will result in all EFI_MEMORY_RUNTIME
2298 regions whose start addresses are not aligned to the OS page
2299 size to be mapped with executable permissions (i.e., on kernels
2300 compiled with 64 KB pages). However, since these mappings are
2301 only active during the time that UEFI Runtime Services are being
2302 invoked, the window for abuse is rather small.
2303
2304 Tested-by: Mark Salter <msalter@redhat.com>
2305 Tested-by: Mark Rutland <mark.rutland@arm.com> [UEFI 2.4 only]
2306 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
2307 Signed-off-by: Matt Fleming <matt.fleming@intel.com>
2308 Reviewed-by: Mark Salter <msalter@redhat.com>
2309 Reviewed-by: Mark Rutland <mark.rutland@arm.com>
2310 Cc: <stable@vger.kernel.org> # v4.0+
2311 Cc: Catalin Marinas <catalin.marinas@arm.com>
2312 Cc: Leif Lindholm <leif.lindholm@linaro.org>
2313 Cc: Linus Torvalds <torvalds@linux-foundation.org>
2314 Cc: Mike Galbraith <efault@gmx.de>
2315 Cc: Peter Zijlstra <peterz@infradead.org>
2316 Cc: Thomas Gleixner <tglx@linutronix.de>
2317 Cc: Will Deacon <will.deacon@arm.com>
2318 Cc: linux-kernel@vger.kernel.org
2319 Link: http://lkml.kernel.org/r/1443218539-7610-3-git-send-email-matt@codeblueprint.co.uk
2320 Signed-off-by: Ingo Molnar <mingo@kernel.org>
2321
2322 arch/arm64/kernel/efi.c | 3 +-
2323 drivers/firmware/efi/libstub/arm-stub.c | 88 +++++++++++++++++++++++++-----
2324 2 files changed, 75 insertions(+), 16 deletions(-)
2325
2326 commit 189124f1e733622c44d72060832af3c68d7ee8bc
2327 Author: Ralf Baechle <ralf@linux-mips.org>
2328 Date: Fri Oct 2 09:48:57 2015 +0200
2329
2330 MIPS: BPF: Fix load delay slots.
2331
2332 The entire bpf_jit_asm.S is written in noreorder mode because "we know
2333 better" according to a comment. This also prevented the assembler from
2334 throwing in the required NOPs for MIPS I processors which have no
2335 load-use interlock, thus the load's consumer might end up using the
2336 old value of the register from prior to the load.
2337
2338 Fixed by putting the assembler in reorder mode for just the affected
2339 load instructions. This is not enough for gas to actually try to be
2340 clever by looking at the next instruction and inserting a nop only
2341 when needed but as the comment said "we know better", so getting gas
2342 to unconditionally emit a NOP is just right in this case and prevents
2343 adding further ifdefery.
2344
2345 Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
2346
2347 arch/mips/net/bpf_jit_asm.S | 4 ++++
2348 1 files changed, 4 insertions(+), 0 deletions(-)
2349
2350 commit b4b012d6599fbc3c6e81f0a03cd59eb9f0095ed8
2351 Author: Lee, Chun-Yi <joeyli.kernel@gmail.com>
2352 Date: Tue Sep 29 20:58:57 2015 +0800
2353
2354 x86/kexec: Fix kexec crash in syscall kexec_file_load()
2355
2356 The original bug is a page fault crash that sometimes happens
2357 on big machines when preparing ELF headers:
2358
2359 BUG: unable to handle kernel paging request at ffffc90613fc9000
2360 IP: [<ffffffff8103d645>] prepare_elf64_ram_headers_callback+0x165/0x260
2361
2362 The bug is caused by us under-counting the number of memory ranges
2363 and subsequently not allocating enough ELF header space for them.
2364 The bug is typically masked on smaller systems, because the ELF header
2365 allocation is rounded up to the next page.
2366
2367 This patch modifies the code in fill_up_crash_elf_data() by using
2368 walk_system_ram_res() instead of walk_system_ram_range() to correctly
2369 count the max number of crash memory ranges. That's because the
2370 walk_system_ram_range() filters out small memory regions that
2371 reside in the same page, but walk_system_ram_res() does not.
2372
2373 Here's how I found the bug:
2374
2375 After tracing prepare_elf64_headers() and prepare_elf64_ram_headers_callback(),
2376 the code uses walk_system_ram_res() to fill-in crash memory regions information
2377 to the program header, so it counts those small memory regions that
2378 reside in a page area.
2379
2380 But, when the kernel was using walk_system_ram_range() in
2381 fill_up_crash_elf_data() to count the number of crash memory regions,
2382 it filters out small regions.
2383
2384 I printed those small memory regions, for example:
2385
2386 kexec: Get nr_ram ranges. vaddr=0xffff880077592258 paddr=0x77592258, sz=0xdc0
2387
2388 Based on the code in walk_system_ram_range(), this memory region
2389 will be filtered out:
2390
2391 pfn = (0x77592258 + 0x1000 - 1) >> 12 = 0x77593
2392 end_pfn = (0x77592258 + 0xfc0 -1 + 1) >> 12 = 0x77593
2393 end_pfn - pfn = 0x77593 - 0x77593 = 0 <=== if (end_pfn > pfn) is FALSE
2394
2395 So, the max_nr_ranges that's counted by the kernel doesn't include
2396 small memory regions - causing us to under-allocate the required space.
2397 That causes the page fault crash that happens in a later code path
2398 when preparing ELF headers.
2399
2400 This bug is not easy to reproduce on small machines that have few
2401 CPUs, because the allocated page aligned ELF buffer has more free
2402 space to cover those small memory regions' PT_LOAD headers.
2403
2404 Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
2405 Cc: Andy Lutomirski <luto@kernel.org>
2406 Cc: Baoquan He <bhe@redhat.com>
2407 Cc: Jiang Liu <jiang.liu@linux.intel.com>
2408 Cc: Linus Torvalds <torvalds@linux-foundation.org>
2409 Cc: Mike Galbraith <efault@gmx.de>
2410 Cc: Peter Zijlstra <peterz@infradead.org>
2411 Cc: Stephen Rothwell <sfr@canb.auug.org.au>
2412 Cc: Takashi Iwai <tiwai@suse.de>
2413 Cc: Thomas Gleixner <tglx@linutronix.de>
2414 Cc: Viresh Kumar <viresh.kumar@linaro.org>
2415 Cc: Vivek Goyal <vgoyal@redhat.com>
2416 Cc: kexec@lists.infradead.org
2417 Cc: linux-kernel@vger.kernel.org
2418 Cc: <stable@vger.kernel.org>
2419 Link: http://lkml.kernel.org/r/1443531537-29436-1-git-send-email-jlee@suse.com
2420 Signed-off-by: Ingo Molnar <mingo@kernel.org>
2421
2422 arch/x86/kernel/crash.c | 7 +++----
2423 1 files changed, 3 insertions(+), 4 deletions(-)
2424
2425 commit bf91f1e0162bdd27ebd1411090a81fd9188daa4f
2426 Author: Elad Raz <eladr@mellanox.com>
2427 Date: Sat Aug 22 08:44:11 2015 +0300
2428
2429 netfilter: ipset: Fixing unnamed union init
2430
2431 In continue to proposed Vinson Lee's post [1], this patch fixes compilation
2432 issues founded at gcc 4.4.7. The initialization of .cidr field of unnamed
2433 unions causes compilation error in gcc 4.4.x.
2434
2435 References
2436
2437 Visible links
2438 [1] https://lkml.org/lkml/2015/7/5/74
2439
2440 Signed-off-by: Elad Raz <eladr@mellanox.com>
2441 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2442
2443 net/netfilter/ipset/ip_set_hash_netnet.c | 20 ++++++++++++++++++--
2444 net/netfilter/ipset/ip_set_hash_netportnet.c | 20 ++++++++++++++++++--
2445 2 files changed, 36 insertions(+), 4 deletions(-)
2446
2447 commit fed13a5012b8d7e87a6f9efa2e40e0be28eaecd9
2448 Author: Brad Spengler <spender@grsecurity.net>
2449 Date: Fri Oct 9 23:12:43 2015 -0400
2450
2451 compile fix
2452
2453 arch/x86/mm/pgtable.c | 2 ++
2454 1 files changed, 2 insertions(+), 0 deletions(-)
2455
2456 commit 58edc15a668a6dd90b3f66abc84b509f8fba7505
2457 Author: Daniel Borkmann <daniel@iogearbox.net>
2458 Date: Mon Aug 31 19:11:02 2015 +0200
2459
2460 netfilter: conntrack: use nf_ct_tmpl_free in CT/synproxy error paths
2461
2462 Commit 0838aa7fcfcd ("netfilter: fix netns dependencies with conntrack
2463 templates") migrated templates to the new allocator api, but forgot to
2464 update error paths for them in CT and synproxy to use nf_ct_tmpl_free()
2465 instead of nf_conntrack_free().
2466
2467 Due to that, memory is being freed into the wrong kmemcache, but also
2468 we drop the per net reference count of ct objects causing an imbalance.
2469
2470 In Brad's case, this leads to a wrap-around of net->ct.count and thus
2471 lets __nf_conntrack_alloc() refuse to create a new ct object:
2472
2473 [ 10.340913] xt_addrtype: ipv6 does not support BROADCAST matching
2474 [ 10.810168] nf_conntrack: table full, dropping packet
2475 [ 11.917416] r8169 0000:07:00.0 eth0: link up
2476 [ 11.917438] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
2477 [ 12.815902] nf_conntrack: table full, dropping packet
2478 [ 15.688561] nf_conntrack: table full, dropping packet
2479 [ 15.689365] nf_conntrack: table full, dropping packet
2480 [ 15.690169] nf_conntrack: table full, dropping packet
2481 [ 15.690967] nf_conntrack: table full, dropping packet
2482 [...]
2483
2484 With slab debugging, it also reports the wrong kmemcache (kmalloc-512 vs.
2485 nf_conntrack_ffffffff81ce75c0) and reports poison overwrites, etc. Thus,
2486 to fix the problem, export and use nf_ct_tmpl_free() instead.
2487
2488 Fixes: 0838aa7fcfcd ("netfilter: fix netns dependencies with conntrack templates")
2489 Reported-by: Brad Jackson <bjackson0971@gmail.com>
2490 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2491 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2492
2493 include/net/netfilter/nf_conntrack.h | 1 +
2494 net/netfilter/nf_conntrack_core.c | 3 ++-
2495 net/netfilter/nf_synproxy_core.c | 2 +-
2496 net/netfilter/xt_CT.c | 2 +-
2497 4 files changed, 5 insertions(+), 3 deletions(-)
2498
2499 commit 37d26e44573aaa9c3b1f0c36ec9d4bddc008fc03
2500 Author: Brad Spengler <spender@grsecurity.net>
2501 Date: Fri Oct 9 18:22:54 2015 -0400
2502
2503 Fix BUG() in scatterwalk_map_and_copy caused by virt_to_page being
2504 called on the KSTACKOVERFLOW's vmalloc'd stack. Thanks to
2505 Yves-Alexis Perez for the report
2506
2507 crypto/scatterwalk.c | 10 ++++++++--
2508 1 files changed, 8 insertions(+), 2 deletions(-)
2509
2510 commit 8137d53d2b60023587a48004f0b67946ed6db4a8
2511 Merge: 147420b a9c991f
2512 Author: Brad Spengler <spender@grsecurity.net>
2513 Date: Fri Oct 9 18:20:32 2015 -0400
2514
2515 Merge branch 'pax-test' into grsec-test
2516
2517 commit a9c991f727bb8daf15838296e301683791c17071
2518 Author: Brad Spengler <spender@grsecurity.net>
2519 Date: Fri Oct 9 18:20:07 2015 -0400
2520
2521 Update to pax-linux-4.2.3-test8.patch:
2522 - fixed vsyscall/pvclock regression caused by the recent page table hardening, reported by kamil (https://forums.grsecurity.net/viewtopic.php?f=3&t=4272)
2523
2524 arch/x86/kernel/espfix_64.c | 4 +---
2525 arch/x86/kernel/kvmclock.c | 20 ++++++--------------
2526 arch/x86/mm/highmem_32.c | 2 ++
2527 arch/x86/mm/pgtable.c | 33 +++++++++++++++++++++++++++++++++
2528 4 files changed, 42 insertions(+), 17 deletions(-)
2529
2530 commit 147420b0f00c7f20f354e1dfa460b904a3af432b
2531 Author: Brad Spengler <spender@grsecurity.net>
2532 Date: Fri Oct 9 08:54:24 2015 -0400
2533
2534 Properly fix the bug reported at:
2535 https://code.google.com/p/android/issues/detail?id=187973
2536
2537 drivers/net/slip/slhc.c | 3 +++
2538 1 files changed, 3 insertions(+), 0 deletions(-)
2539
2540 commit 4918a68ea80e1185ec8f3a94d3a2210552ed0bb5
2541 Merge: 4e736d9 7e02f35
2542 Author: Brad Spengler <spender@grsecurity.net>
2543 Date: Wed Oct 7 20:57:21 2015 -0400
2544
2545 Merge branch 'pax-test' into grsec-test
2546
2547 Conflicts:
2548 arch/x86/kernel/espfix_64.c
2549
2550 commit 7e02f35880fd6bdb2f4e7ba07a13d6df1d121008
2551 Author: Brad Spengler <spender@grsecurity.net>
2552 Date: Wed Oct 7 20:54:36 2015 -0400
2553
2554 Update to pax-linux-4.2.3-test7.patch:
2555 - backported vanilla commits b763ec17ac762470eec5be8ebcc43e4f8b2c2b82 and 176fc2d5770a0990eebff903ba680d2edd32e718
2556 - constified a few more page tables for ESPFIX/amd64
2557 - fixed xen and the recently added level1_modules_pgt page tables on amd64
2558
2559 arch/x86/include/asm/pgtable_64.h | 1 +
2560 arch/x86/kernel/espfix_64.c | 35 +++++++++++++++++++++++----------
2561 arch/x86/xen/mmu.c | 4 +++
2562 drivers/base/regmap/regmap-debugfs.c | 14 +++++-------
2563 4 files changed, 35 insertions(+), 19 deletions(-)
2564
2565 commit 4e736d9e568f6cc0d08dfe7519abf9a5d58a5418
2566 Author: Robin Murphy <robin.murphy@arm.com>
2567 Date: Thu Oct 1 15:37:19 2015 -0700
2568
2569 dmapool: fix overflow condition in pool_find_page()
2570
2571 If a DMA pool lies at the very top of the dma_addr_t range (as may
2572 happen with an IOMMU involved), the calculated end address of the pool
2573 wraps around to zero, and page lookup always fails.
2574
2575 Tweak the relevant calculation to be overflow-proof.
2576
2577 Signed-off-by: Robin Murphy <robin.murphy@arm.com>
2578 Cc: Arnd Bergmann <arnd@arndb.de>
2579 Cc: Marek Szyprowski <m.szyprowski@samsung.com>
2580 Cc: Sumit Semwal <sumit.semwal@linaro.org>
2581 Cc: Sakari Ailus <sakari.ailus@iki.fi>
2582 Cc: Russell King <rmk+kernel@arm.linux.org.uk>
2583 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2584 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2585
2586 mm/dmapool.c | 2 +-
2587 1 files changed, 1 insertions(+), 1 deletions(-)
2588
2589 commit 96a101a9b4208a6e5f2a0db7599881142e70ba43
2590 Author: Greg Thelen <gthelen@google.com>
2591 Date: Thu Oct 1 15:37:05 2015 -0700
2592
2593 memcg: make mem_cgroup_read_stat() unsigned
2594
2595 mem_cgroup_read_stat() returns a page count by summing per cpu page
2596 counters. The summing is racy wrt. updates, so a transient negative
2597 sum is possible. Callers don't want negative values:
2598
2599 - mem_cgroup_wb_stats() doesn't want negative nr_dirty or nr_writeback.
2600 This could confuse dirty throttling.
2601
2602 - oom reports and memory.stat shouldn't show confusing negative usage.
2603
2604 - tree_usage() already avoids negatives.
2605
2606 Avoid returning negative page counts from mem_cgroup_read_stat() and
2607 convert it to unsigned.
2608
2609 [akpm@linux-foundation.org: fix old typo while we're in there]
2610 Signed-off-by: Greg Thelen <gthelen@google.com>
2611 Cc: Johannes Weiner <hannes@cmpxchg.org>
2612 Acked-by: Michal Hocko <mhocko@suse.com>
2613 Cc: <stable@vger.kernel.org> [4.2+]
2614 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2615 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2616
2617 mm/memcontrol.c | 30 ++++++++++++++++++------------
2618 1 files changed, 18 insertions(+), 12 deletions(-)
2619
2620 commit b7808c46650d5f4c09f071566de991af36eb9d37
2621 Author: Daniel Borkmann <daniel@iogearbox.net>
2622 Date: Fri Oct 2 12:06:03 2015 +0200
2623
2624 bpf: fix panic in SO_GET_FILTER with native ebpf programs
2625
2626 When sockets have a native eBPF program attached through
2627 setsockopt(sk, SOL_SOCKET, SO_ATTACH_BPF, ...), and then try to
2628 dump these over getsockopt(sk, SOL_SOCKET, SO_GET_FILTER, ...),
2629 the following panic appears:
2630
2631 [49904.178642] BUG: unable to handle kernel NULL pointer dereference at (null)
2632 [49904.178762] IP: [<ffffffff81610fd9>] sk_get_filter+0x39/0x90
2633 [49904.182000] PGD 86fc9067 PUD 531a1067 PMD 0
2634 [49904.185196] Oops: 0000 [#1] SMP
2635 [...]
2636 [49904.224677] Call Trace:
2637 [49904.226090] [<ffffffff815e3d49>] sock_getsockopt+0x319/0x740
2638 [49904.227535] [<ffffffff812f59e3>] ? sock_has_perm+0x63/0x70
2639 [49904.228953] [<ffffffff815e2fc8>] ? release_sock+0x108/0x150
2640 [49904.230380] [<ffffffff812f5a43>] ? selinux_socket_getsockopt+0x23/0x30
2641 [49904.231788] [<ffffffff815dff36>] SyS_getsockopt+0xa6/0xc0
2642 [49904.233267] [<ffffffff8171b9ae>] entry_SYSCALL_64_fastpath+0x12/0x71
2643
2644 The underlying issue is the very same as in commit b382c0865600
2645 ("sock, diag: fix panic in sock_diag_put_filterinfo"), that is,
2646 native eBPF programs don't store an original program since this
2647 is only needed in cBPF ones.
2648
2649 However, sk_get_filter() wasn't updated to test for this at the
2650 time when eBPF could be attached. Just throw an error to the user
2651 to indicate that eBPF cannot be dumped over this interface.
2652 That way, it can also be known that a program _is_ attached (as
2653 opposed to just return 0), and a different (future) method needs
2654 to be consulted for a dump.
2655
2656 Fixes: 89aa075832b0 ("net: sock: allow eBPF programs to be attached to sockets")
2657 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2658 Acked-by: Alexei Starovoitov <ast@plumgrid.com>
2659 Signed-off-by: David S. Miller <davem@davemloft.net>
2660
2661 net/core/filter.c | 6 +++++-
2662 1 files changed, 5 insertions(+), 1 deletions(-)
2663
2664 commit 40853c884afb5fc2dcb9f7fc34ef446162566fcc
2665 Author: Steve French <smfrench@gmail.com>
2666 Date: Mon Sep 28 17:21:07 2015 -0500
2667
2668 [SMB3] Do not fall back to SMBWriteX in set_file_size error cases
2669
2670 The error paths in set_file_size for cifs and smb3 are incorrect.
2671
2672 In the unlikely event that a server did not support set file info
2673 of the file size, the code incorrectly falls back to trying SMBWriteX
2674 (note that only the original core SMB Write, used for example by DOS,
2675 can set the file size this way - this actually does not work for the more
2676 recent SMBWriteX). The idea was since the old DOS SMB Write could set
2677 the file size if you write zero bytes at that offset then use that if
2678 server rejects the normal set file info call.
2679
2680 Fortunately the SMBWriteX will never be sent on the wire (except when
2681 file size is zero) since the length and offset fields were reversed
2682 in the two places in this function that call SMBWriteX causing
2683 the fall back path to return an error. It is also important to never call
2684 an SMB request from an SMB2/sMB3 session (which theoretically would
2685 be possible, and can cause a brief session drop, although the client
2686 recovers) so this should be fixed. In practice this path does not happen
2687 with modern servers but the error fall back to SMBWriteX is clearly wrong.
2688
2689 Removing the calls to SMBWriteX in the error paths in cifs_set_file_size
2690
2691 Pointed out by PaX/grsecurity team
2692
2693 Signed-off-by: Steve French <steve.french@primarydata.com>
2694 Reported-by: PaX Team <pageexec@freemail.hu>
2695 CC: Emese Revfy <re.emese@gmail.com>
2696 CC: Brad Spengler <spender@grsecurity.net>
2697 CC: Stable <stable@vger.kernel.org>
2698
2699 fs/cifs/inode.c | 34 ----------------------------------
2700 1 files changed, 0 insertions(+), 34 deletions(-)
2701
2702 commit f5fad97c967a08f4a89513969598b1d3c8232a38
2703 Author: Brad Spengler <spender@grsecurity.net>
2704 Date: Wed Oct 7 18:22:40 2015 -0400
2705
2706 Initial import of grsecurity for Linux 4.2.3
2707 Note that size_overflow is currently marked BROKEN
2708
2709 Documentation/dontdiff | 2 +
2710 Documentation/kernel-parameters.txt | 7 +
2711 Documentation/sysctl/kernel.txt | 15 +
2712 Makefile | 18 +-
2713 arch/alpha/include/asm/cache.h | 4 +-
2714 arch/alpha/kernel/osf_sys.c | 12 +-
2715 arch/arm/Kconfig | 1 +
2716 arch/arm/include/asm/thread_info.h | 9 +-
2717 arch/arm/kernel/process.c | 4 +-
2718 arch/arm/kernel/ptrace.c | 9 +
2719 arch/arm/kernel/traps.c | 7 +-
2720 arch/arm/mm/Kconfig | 2 +-
2721 arch/arm/mm/fault.c | 40 +-
2722 arch/arm/mm/mmap.c | 8 +-
2723 arch/arm/net/bpf_jit_32.c | 51 +-
2724 arch/avr32/include/asm/cache.h | 4 +-
2725 arch/blackfin/include/asm/cache.h | 3 +-
2726 arch/cris/include/arch-v10/arch/cache.h | 3 +-
2727 arch/cris/include/arch-v32/arch/cache.h | 3 +-
2728 arch/frv/include/asm/cache.h | 3 +-
2729 arch/frv/mm/elf-fdpic.c | 4 +-
2730 arch/hexagon/include/asm/cache.h | 6 +-
2731 arch/ia64/Kconfig | 1 +
2732 arch/ia64/include/asm/cache.h | 3 +-
2733 arch/ia64/kernel/sys_ia64.c | 2 +
2734 arch/ia64/mm/hugetlbpage.c | 2 +
2735 arch/m32r/include/asm/cache.h | 4 +-
2736 arch/m68k/include/asm/cache.h | 4 +-
2737 arch/metag/mm/hugetlbpage.c | 1 +
2738 arch/microblaze/include/asm/cache.h | 3 +-
2739 arch/mips/Kconfig | 1 +
2740 arch/mips/include/asm/cache.h | 3 +-
2741 arch/mips/include/asm/thread_info.h | 11 +-
2742 arch/mips/kernel/irq.c | 3 +
2743 arch/mips/kernel/ptrace.c | 9 +
2744 arch/mips/mm/mmap.c | 4 +-
2745 arch/mn10300/proc-mn103e010/include/proc/cache.h | 4 +-
2746 arch/mn10300/proc-mn2ws0050/include/proc/cache.h | 4 +-
2747 arch/openrisc/include/asm/cache.h | 4 +-
2748 arch/parisc/include/asm/cache.h | 5 +-
2749 arch/parisc/kernel/sys_parisc.c | 4 +
2750 arch/powerpc/Kconfig | 1 +
2751 arch/powerpc/include/asm/cache.h | 3 +-
2752 arch/powerpc/include/asm/thread_info.h | 5 +-
2753 arch/powerpc/kernel/Makefile | 2 +
2754 arch/powerpc/kernel/irq.c | 3 +
2755 arch/powerpc/kernel/process.c | 10 +-
2756 arch/powerpc/kernel/ptrace.c | 14 +
2757 arch/powerpc/kernel/traps.c | 5 +
2758 arch/powerpc/mm/slice.c | 2 +-
2759 arch/s390/include/asm/cache.h | 4 +-
2760 arch/score/include/asm/cache.h | 4 +-
2761 arch/sh/include/asm/cache.h | 3 +-
2762 arch/sh/mm/mmap.c | 6 +-
2763 arch/sparc/include/asm/cache.h | 4 +-
2764 arch/sparc/include/asm/pgalloc_64.h | 1 +
2765 arch/sparc/include/asm/thread_info_64.h | 8 +-
2766 arch/sparc/kernel/process_32.c | 6 +-
2767 arch/sparc/kernel/process_64.c | 8 +-
2768 arch/sparc/kernel/ptrace_64.c | 14 +
2769 arch/sparc/kernel/sys_sparc_64.c | 8 +-
2770 arch/sparc/kernel/syscalls.S | 8 +-
2771 arch/sparc/kernel/traps_32.c | 8 +-
2772 arch/sparc/kernel/traps_64.c | 28 +-
2773 arch/sparc/kernel/unaligned_64.c | 2 +-
2774 arch/sparc/mm/fault_64.c | 2 +-
2775 arch/sparc/mm/hugetlbpage.c | 15 +-
2776 arch/tile/Kconfig | 1 +
2777 arch/tile/include/asm/cache.h | 3 +-
2778 arch/tile/mm/hugetlbpage.c | 2 +
2779 arch/um/include/asm/cache.h | 3 +-
2780 arch/unicore32/include/asm/cache.h | 6 +-
2781 arch/x86/Kconfig | 21 +
2782 arch/x86/entry/entry_32.S | 2 +-
2783 arch/x86/entry/entry_64.S | 2 +-
2784 arch/x86/ia32/ia32_aout.c | 2 +
2785 arch/x86/include/asm/floppy.h | 20 +-
2786 arch/x86/include/asm/io.h | 2 +-
2787 arch/x86/include/asm/page.h | 12 +-
2788 arch/x86/include/asm/paravirt_types.h | 23 +-
2789 arch/x86/include/asm/processor.h | 2 +-
2790 arch/x86/include/asm/thread_info.h | 8 +-
2791 arch/x86/kernel/dumpstack.c | 10 +-
2792 arch/x86/kernel/dumpstack_32.c | 2 +-
2793 arch/x86/kernel/dumpstack_64.c | 2 +-
2794 arch/x86/kernel/espfix_64.c | 2 +-
2795 arch/x86/kernel/fpu/init.c | 4 +-
2796 arch/x86/kernel/ioport.c | 13 +
2797 arch/x86/kernel/irq_32.c | 3 +
2798 arch/x86/kernel/irq_64.c | 4 +
2799 arch/x86/kernel/ldt.c | 18 +
2800 arch/x86/kernel/msr.c | 10 +
2801 arch/x86/kernel/ptrace.c | 28 +
2802 arch/x86/kernel/signal.c | 9 +-
2803 arch/x86/kernel/sys_i386_32.c | 9 +-
2804 arch/x86/kernel/sys_x86_64.c | 8 +-
2805 arch/x86/kernel/traps.c | 5 +
2806 arch/x86/kernel/verify_cpu.S | 1 +
2807 arch/x86/kernel/vm86_32.c | 16 +
2808 arch/x86/mm/fault.c | 12 +-
2809 arch/x86/mm/hugetlbpage.c | 15 +-
2810 arch/x86/mm/init.c | 66 +-
2811 arch/x86/mm/init_32.c | 6 +-
2812 arch/x86/net/bpf_jit_comp.c | 4 +
2813 arch/x86/platform/efi/efi_64.c | 2 +-
2814 arch/x86/xen/Kconfig | 1 +
2815 arch/xtensa/variants/dc232b/include/variant/core.h | 2 +-
2816 arch/xtensa/variants/fsf/include/variant/core.h | 3 +-
2817 drivers/acpi/acpica/hwxfsleep.c | 11 +-
2818 drivers/acpi/custom_method.c | 4 +
2819 drivers/block/cciss.h | 30 +-
2820 drivers/block/smart1,2.h | 40 +-
2821 drivers/cdrom/cdrom.c | 2 +-
2822 drivers/char/Kconfig | 4 +-
2823 drivers/char/genrtc.c | 1 +
2824 drivers/char/mem.c | 17 +
2825 drivers/char/random.c | 5 +-
2826 drivers/cpufreq/sparc-us3-cpufreq.c | 2 -
2827 drivers/firewire/ohci.c | 4 +
2828 drivers/gpu/drm/drm_context.c | 50 +-
2829 drivers/gpu/drm/drm_drv.c | 11 +-
2830 drivers/gpu/drm/drm_lock.c | 18 +-
2831 drivers/gpu/drm/i915/i915_dma.c | 2 +
2832 drivers/gpu/drm/nouveau/nouveau_drm.c | 3 +-
2833 drivers/gpu/drm/nouveau/nouveau_ttm.c | 30 +-
2834 drivers/gpu/drm/ttm/ttm_bo_manager.c | 10 +-
2835 drivers/gpu/drm/virtio/virtgpu_ttm.c | 10 +-
2836 drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 10 +-
2837 drivers/hid/hid-wiimote-debug.c | 2 +-
2838 drivers/infiniband/hw/nes/nes_cm.c | 22 +-
2839 drivers/iommu/amd_iommu.c | 14 +-
2840 drivers/isdn/gigaset/bas-gigaset.c | 32 +-
2841 drivers/isdn/gigaset/ser-gigaset.c | 32 +-
2842 drivers/isdn/gigaset/usb-gigaset.c | 32 +-
2843 drivers/isdn/i4l/isdn_concap.c | 6 +-
2844 drivers/isdn/i4l/isdn_x25iface.c | 16 +-
2845 drivers/md/raid5.c | 8 +
2846 drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +-
2847 drivers/media/radio/radio-cadet.c | 5 +-
2848 drivers/media/usb/dvb-usb/cinergyT2-core.c | 91 +-
2849 drivers/media/usb/dvb-usb/cinergyT2-fe.c | 182 +-
2850 drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 37 +-
2851 drivers/media/usb/dvb-usb/technisat-usb2.c | 75 +-
2852 drivers/message/fusion/mptbase.c | 9 +
2853 drivers/misc/sgi-xp/xp_main.c | 12 +-
2854 drivers/net/ethernet/brocade/bna/bna_enet.c | 8 +-
2855 drivers/net/wan/lmc/lmc_media.c | 97 +-
2856 drivers/net/wan/z85230.c | 24 +-
2857 drivers/net/wireless/zd1211rw/zd_usb.c | 2 +-
2858 drivers/pci/proc.c | 9 +
2859 drivers/platform/x86/asus-wmi.c | 12 +
2860 drivers/rtc/rtc-dev.c | 3 +
2861 drivers/scsi/bfa/bfa_fcs.c | 19 +-
2862 drivers/scsi/bfa/bfa_fcs_lport.c | 29 +-
2863 drivers/scsi/bfa/bfa_modules.h | 12 +-
2864 drivers/scsi/hpsa.h | 40 +-
2865 drivers/staging/lustre/lustre/ldlm/ldlm_flock.c | 2 +-
2866 drivers/staging/lustre/lustre/libcfs/module.c | 10 +-
2867 drivers/staging/sm750fb/sm750.c | 3 +
2868 drivers/tty/serial/uartlite.c | 4 +-
2869 drivers/tty/sysrq.c | 2 +-
2870 drivers/tty/vt/keyboard.c | 22 +-
2871 drivers/uio/uio.c | 6 +-
2872 drivers/usb/core/hub.c | 5 +
2873 drivers/usb/gadget/function/f_uac1.c | 1 +
2874 drivers/usb/gadget/function/u_uac1.c | 1 +
2875 drivers/usb/host/hwa-hc.c | 9 +-
2876 drivers/usb/usbip/vhci_sysfs.c | 2 +-
2877 drivers/video/fbdev/arcfb.c | 2 +-
2878 drivers/video/fbdev/matrox/matroxfb_DAC1064.c | 10 +-
2879 drivers/video/fbdev/matrox/matroxfb_Ti3026.c | 5 +-
2880 drivers/video/fbdev/sh_mobile_lcdcfb.c | 6 +-
2881 drivers/video/logo/logo_linux_clut224.ppm | 2720 ++++-----
2882 drivers/xen/xenfs/xenstored.c | 5 +
2883 firmware/Makefile | 2 +
2884 firmware/WHENCE | 20 +-
2885 firmware/bnx2/bnx2-mips-06-6.2.3.fw.ihex | 5804 +++++++++++++++++
2886 firmware/bnx2/bnx2-mips-09-6.2.1b.fw.ihex | 6496 ++++++++++++++++++++
2887 fs/attr.c | 1 +
2888 fs/autofs4/waitq.c | 9 +
2889 fs/binfmt_aout.c | 7 +
2890 fs/binfmt_elf.c | 40 +-
2891 fs/compat.c | 20 +-
2892 fs/coredump.c | 17 +-
2893 fs/dcache.c | 3 +
2894 fs/debugfs/inode.c | 11 +-
2895 fs/exec.c | 218 +-
2896 fs/ext2/balloc.c | 4 +-
2897 fs/ext2/super.c | 8 +-
2898 fs/ext3/balloc.c | 4 +-
2899 fs/ext3/super.c | 8 +-
2900 fs/ext4/balloc.c | 4 +-
2901 fs/fcntl.c | 4 +
2902 fs/fhandle.c | 3 +-
2903 fs/file.c | 4 +
2904 fs/filesystems.c | 4 +
2905 fs/fs_struct.c | 20 +-
2906 fs/hugetlbfs/inode.c | 5 +-
2907 fs/inode.c | 8 +-
2908 fs/kernfs/dir.c | 6 +
2909 fs/mount.h | 4 +-
2910 fs/namei.c | 285 +-
2911 fs/namespace.c | 24 +
2912 fs/nfsd/nfscache.c | 2 +-
2913 fs/open.c | 38 +
2914 fs/overlayfs/inode.c | 3 +
2915 fs/overlayfs/super.c | 6 +-
2916 fs/pipe.c | 2 +-
2917 fs/posix_acl.c | 15 +-
2918 fs/proc/Kconfig | 10 +-
2919 fs/proc/array.c | 66 +-
2920 fs/proc/base.c | 168 +-
2921 fs/proc/cmdline.c | 4 +
2922 fs/proc/devices.c | 4 +
2923 fs/proc/fd.c | 17 +-
2924 fs/proc/generic.c | 64 +
2925 fs/proc/inode.c | 17 +
2926 fs/proc/internal.h | 11 +-
2927 fs/proc/interrupts.c | 4 +
2928 fs/proc/kcore.c | 3 +
2929 fs/proc/proc_net.c | 31 +
2930 fs/proc/proc_sysctl.c | 52 +-
2931 fs/proc/root.c | 8 +
2932 fs/proc/stat.c | 69 +-
2933 fs/proc/task_mmu.c | 66 +-
2934 fs/readdir.c | 19 +
2935 fs/reiserfs/item_ops.c | 24 +-
2936 fs/reiserfs/super.c | 4 +
2937 fs/select.c | 2 +
2938 fs/seq_file.c | 30 +-
2939 fs/stat.c | 20 +-
2940 fs/sysfs/dir.c | 30 +-
2941 fs/utimes.c | 7 +
2942 fs/xattr.c | 26 +-
2943 grsecurity/Kconfig | 1182 ++++
2944 grsecurity/Makefile | 54 +
2945 grsecurity/gracl.c | 2757 +++++++++
2946 grsecurity/gracl_alloc.c | 105 +
2947 grsecurity/gracl_cap.c | 127 +
2948 grsecurity/gracl_compat.c | 269 +
2949 grsecurity/gracl_fs.c | 448 ++
2950 grsecurity/gracl_ip.c | 386 ++
2951 grsecurity/gracl_learn.c | 207 +
2952 grsecurity/gracl_policy.c | 1786 ++++++
2953 grsecurity/gracl_res.c | 68 +
2954 grsecurity/gracl_segv.c | 304 +
2955 grsecurity/gracl_shm.c | 40 +
2956 grsecurity/grsec_chdir.c | 19 +
2957 grsecurity/grsec_chroot.c | 467 ++
2958 grsecurity/grsec_disabled.c | 445 ++
2959 grsecurity/grsec_exec.c | 189 +
2960 grsecurity/grsec_fifo.c | 26 +
2961 grsecurity/grsec_fork.c | 23 +
2962 grsecurity/grsec_init.c | 290 +
2963 grsecurity/grsec_ipc.c | 48 +
2964 grsecurity/grsec_link.c | 65 +
2965 grsecurity/grsec_log.c | 340 +
2966 grsecurity/grsec_mem.c | 48 +
2967 grsecurity/grsec_mount.c | 65 +
2968 grsecurity/grsec_pax.c | 47 +
2969 grsecurity/grsec_proc.c | 20 +
2970 grsecurity/grsec_ptrace.c | 30 +
2971 grsecurity/grsec_sig.c | 236 +
2972 grsecurity/grsec_sock.c | 244 +
2973 grsecurity/grsec_sysctl.c | 488 ++
2974 grsecurity/grsec_time.c | 16 +
2975 grsecurity/grsec_tpe.c | 78 +
2976 grsecurity/grsec_usb.c | 15 +
2977 grsecurity/grsum.c | 64 +
2978 include/drm/drmP.h | 23 +-
2979 include/linux/binfmts.h | 5 +-
2980 include/linux/capability.h | 13 +
2981 include/linux/compiler-gcc.h | 5 +
2982 include/linux/compiler.h | 8 +
2983 include/linux/cred.h | 8 +-
2984 include/linux/dcache.h | 5 +-
2985 include/linux/fs.h | 24 +-
2986 include/linux/fs_struct.h | 2 +-
2987 include/linux/fsnotify.h | 6 +
2988 include/linux/gracl.h | 342 +
2989 include/linux/gracl_compat.h | 156 +
2990 include/linux/gralloc.h | 9 +
2991 include/linux/grdefs.h | 140 +
2992 include/linux/grinternal.h | 230 +
2993 include/linux/grmsg.h | 118 +
2994 include/linux/grsecurity.h | 249 +
2995 include/linux/grsock.h | 19 +
2996 include/linux/ipc.h | 2 +-
2997 include/linux/ipc_namespace.h | 2 +-
2998 include/linux/kallsyms.h | 18 +-
2999 include/linux/kmod.h | 5 +
3000 include/linux/kobject.h | 2 +-
3001 include/linux/lsm_hooks.h | 4 +-
3002 include/linux/mm.h | 12 +
3003 include/linux/mm_types.h | 4 +-
3004 include/linux/module.h | 5 +-
3005 include/linux/mount.h | 2 +-
3006 include/linux/netfilter/xt_gradm.h | 9 +
3007 include/linux/path.h | 4 +-
3008 include/linux/perf_event.h | 13 +-
3009 include/linux/pid_namespace.h | 2 +-
3010 include/linux/printk.h | 2 +-
3011 include/linux/proc_fs.h | 22 +-
3012 include/linux/proc_ns.h | 2 +-
3013 include/linux/random.h | 2 +-
3014 include/linux/rbtree_augmented.h | 4 +-
3015 include/linux/scatterlist.h | 12 +-
3016 include/linux/sched.h | 110 +-
3017 include/linux/security.h | 3 +-
3018 include/linux/seq_file.h | 5 +
3019 include/linux/shm.h | 6 +-
3020 include/linux/skbuff.h | 3 +
3021 include/linux/slab.h | 9 -
3022 include/linux/sysctl.h | 8 +-
3023 include/linux/thread_info.h | 6 +-
3024 include/linux/tty.h | 2 +-
3025 include/linux/tty_driver.h | 4 +-
3026 include/linux/uidgid.h | 5 +
3027 include/linux/user_namespace.h | 2 +-
3028 include/linux/utsname.h | 2 +-
3029 include/linux/vermagic.h | 16 +-
3030 include/linux/vmalloc.h | 8 +
3031 include/net/af_unix.h | 2 +-
3032 include/net/ip.h | 2 +-
3033 include/net/neighbour.h | 2 +-
3034 include/net/net_namespace.h | 2 +-
3035 include/net/sock.h | 2 +-
3036 include/trace/events/fs.h | 53 +
3037 include/uapi/drm/i915_drm.h | 1 +
3038 include/uapi/linux/personality.h | 1 +
3039 init/Kconfig | 3 +-
3040 init/main.c | 35 +-
3041 ipc/mqueue.c | 1 +
3042 ipc/msg.c | 14 +-
3043 ipc/shm.c | 36 +-
3044 ipc/util.c | 14 +-
3045 kernel/auditsc.c | 2 +-
3046 kernel/bpf/syscall.c | 8 +-
3047 kernel/capability.c | 41 +-
3048 kernel/cgroup.c | 5 +-
3049 kernel/compat.c | 1 +
3050 kernel/configs.c | 11 +
3051 kernel/cred.c | 112 +-
3052 kernel/events/core.c | 14 +-
3053 kernel/exit.c | 10 +-
3054 kernel/fork.c | 86 +-
3055 kernel/futex.c | 4 +-
3056 kernel/kallsyms.c | 9 +
3057 kernel/kcmp.c | 4 +
3058 kernel/kexec.c | 2 +-
3059 kernel/kmod.c | 95 +-
3060 kernel/kprobes.c | 7 +-
3061 kernel/ksysfs.c | 2 +
3062 kernel/locking/lockdep_proc.c | 10 +-
3063 kernel/module.c | 108 +-
3064 kernel/panic.c | 4 +-
3065 kernel/pid.c | 19 +-
3066 kernel/power/Kconfig | 2 +
3067 kernel/printk/printk.c | 7 +-
3068 kernel/ptrace.c | 20 +-
3069 kernel/resource.c | 10 +
3070 kernel/sched/core.c | 11 +-
3071 kernel/signal.c | 37 +-
3072 kernel/sys.c | 64 +-
3073 kernel/sysctl.c | 180 +-
3074 kernel/taskstats.c | 6 +
3075 kernel/time/posix-timers.c | 8 +
3076 kernel/time/time.c | 5 +
3077 kernel/time/timekeeping.c | 3 +
3078 kernel/time/timer_list.c | 13 +-
3079 kernel/time/timer_stats.c | 10 +-
3080 kernel/trace/trace_syscalls.c | 8 +
3081 kernel/user_namespace.c | 15 +
3082 lib/Kconfig.debug | 7 +-
3083 lib/is_single_threaded.c | 3 +
3084 lib/list_debug.c | 65 +-
3085 lib/nlattr.c | 2 +
3086 lib/rbtree.c | 4 +-
3087 lib/vsprintf.c | 39 +-
3088 localversion-grsec | 1 +
3089 mm/Kconfig | 5 +-
3090 mm/Kconfig.debug | 1 +
3091 mm/filemap.c | 1 +
3092 mm/hugetlb.c | 8 +
3093 mm/kmemleak.c | 4 +-
3094 mm/memory.c | 2 +-
3095 mm/mempolicy.c | 12 +-
3096 mm/migrate.c | 3 +-
3097 mm/mlock.c | 6 +-
3098 mm/mmap.c | 93 +-
3099 mm/mprotect.c | 8 +
3100 mm/page_alloc.c | 2 +-
3101 mm/process_vm_access.c | 6 +
3102 mm/shmem.c | 2 +-
3103 mm/slab.c | 27 +-
3104 mm/slab_common.c | 2 +-
3105 mm/slob.c | 12 +
3106 mm/slub.c | 33 +-
3107 mm/util.c | 3 +
3108 mm/vmalloc.c | 80 +-
3109 mm/vmstat.c | 29 +-
3110 net/appletalk/atalk_proc.c | 2 +-
3111 net/atm/lec.c | 6 +-
3112 net/atm/mpoa_caches.c | 42 +-
3113 net/can/bcm.c | 2 +-
3114 net/can/proc.c | 2 +-
3115 net/core/dev_ioctl.c | 7 +-
3116 net/core/filter.c | 8 +-
3117 net/core/net-procfs.c | 17 +-
3118 net/core/pktgen.c | 2 +-
3119 net/core/sock.c | 3 +-
3120 net/core/sysctl_net_core.c | 2 +-
3121 net/decnet/dn_dev.c | 2 +-
3122 net/ipv4/devinet.c | 6 +-
3123 net/ipv4/inet_hashtables.c | 5 +
3124 net/ipv4/ip_input.c | 7 +
3125 net/ipv4/ip_sockglue.c | 3 +-
3126 net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +-
3127 net/ipv4/route.c | 6 +-
3128 net/ipv4/tcp_input.c | 4 +-
3129 net/ipv4/tcp_ipv4.c | 24 +-
3130 net/ipv4/tcp_minisocks.c | 9 +-
3131 net/ipv4/tcp_timer.c | 11 +
3132 net/ipv4/udp.c | 24 +
3133 net/ipv6/addrconf.c | 13 +-
3134 net/ipv6/proc.c | 2 +-
3135 net/ipv6/tcp_ipv6.c | 23 +-
3136 net/ipv6/udp.c | 7 +
3137 net/ipx/ipx_proc.c | 2 +-
3138 net/irda/irproc.c | 2 +-
3139 net/llc/llc_proc.c | 2 +-
3140 net/netfilter/Kconfig | 10 +
3141 net/netfilter/Makefile | 1 +
3142 net/netfilter/nf_conntrack_core.c | 8 +
3143 net/netfilter/xt_gradm.c | 51 +
3144 net/netfilter/xt_hashlimit.c | 4 +-
3145 net/netfilter/xt_recent.c | 2 +-
3146 net/socket.c | 71 +-
3147 net/sunrpc/cache.c | 2 +-
3148 net/sunrpc/stats.c | 2 +-
3149 net/sysctl_net.c | 2 +-
3150 net/unix/af_unix.c | 52 +-
3151 net/vmw_vsock/vmci_transport_notify.c | 30 +-
3152 net/vmw_vsock/vmci_transport_notify_qstate.c | 30 +-
3153 net/x25/sysctl_net_x25.c | 2 +-
3154 net/x25/x25_proc.c | 2 +-
3155 scripts/package/Makefile | 2 +-
3156 scripts/package/mkspec | 38 +-
3157 security/Kconfig | 370 +-
3158 security/apparmor/file.c | 4 +-
3159 security/apparmor/lsm.c | 8 +-
3160 security/commoncap.c | 29 +
3161 security/min_addr.c | 2 +
3162 security/tomoyo/file.c | 12 +-
3163 security/tomoyo/mount.c | 4 +
3164 security/tomoyo/tomoyo.c | 20 +-
3165 security/yama/Kconfig | 2 +-
3166 sound/synth/emux/emux_seq.c | 14 +-
3167 sound/usb/line6/driver.c | 40 +-
3168 sound/usb/line6/toneport.c | 12 +-
3169 tools/gcc/.gitignore | 1 +
3170 tools/gcc/Makefile | 12 +
3171 tools/gcc/gen-random-seed.sh | 8 +
3172 tools/gcc/randomize_layout_plugin.c | 930 +++
3173 tools/gcc/size_overflow_plugin/.gitignore | 1 +
3174 .../size_overflow_plugin/size_overflow_hash.data | 320 +-
3175 466 files changed, 32295 insertions(+), 2907 deletions(-)
3176
3177 commit fc19197ab5a42069863a7d88f1d41eb687697fe9
3178 Author: Brad Spengler <spender@grsecurity.net>
3179 Date: Sun Oct 4 20:43:51 2015 -0400
3180
3181 Update to pax-linux-4.2.3-test6.patch:
3182 - fixed a KERNEXEC/x86 and early ioremap regression, reported by spender
3183 - sanitized a few more top level page table entries on amd64
3184
3185 arch/x86/kernel/espfix_64.c | 2 +-
3186 arch/x86/kernel/head_64.S | 8 ++++----
3187 arch/x86/mm/ioremap.c | 6 +++++-
3188 3 files changed, 10 insertions(+), 6 deletions(-)
3189
3190 commit 23ac5415b9ef394e10b1516d3b314c742c6a3e59
3191 Author: Brad Spengler <spender@grsecurity.net>
3192 Date: Sun Oct 4 17:47:37 2015 -0400
3193
3194 Resync with pax-linux-4.2.3-test5.patch
3195
3196 arch/x86/include/asm/pgtable-2level.h | 20 ++++++++++++++++----
3197 arch/x86/include/asm/pgtable-3level.h | 8 ++++++++
3198 arch/x86/include/asm/pgtable_32.h | 2 --
3199 arch/x86/include/asm/pgtable_64.h | 20 ++++++++++++++++----
3200 arch/x86/mm/highmem_32.c | 2 --
3201 arch/x86/mm/init_64.c | 2 --
3202 arch/x86/mm/iomap_32.c | 4 ----
3203 arch/x86/mm/ioremap.c | 2 +-
3204 arch/x86/mm/pgtable.c | 2 --
3205 arch/x86/mm/pgtable_32.c | 3 ---
3206 mm/highmem.c | 6 +-----
3207 mm/vmalloc.c | 12 +-----------
3208 .../size_overflow_plugin/size_overflow_hash.data | 2 --
3209 13 files changed, 43 insertions(+), 42 deletions(-)
3210
3211 commit 25f4bed80f0d87783793a70d6c20080031a1fd38
3212 Author: Brad Spengler <spender@grsecurity.net>
3213 Date: Sun Oct 4 13:06:32 2015 -0400
3214
3215 Update to pax-linux-4.2.3-test5.patch:
3216 - forward port to 4.2.3
3217 - fixed integer sign conversion errors caused by ieee80211_tx_rate_control.max_rate_idx, caught by the size overflow plugin
3218 - fixed a bug in try_preserve_large_page that caused unnecessary large page split ups
3219 - increased the number of statically allocated kernel page tables under KERNEXEC/amd64
3220
3221 arch/x86/include/asm/pgtable-2level.h | 2 ++
3222 arch/x86/include/asm/pgtable-3level.h | 5 +++++
3223 arch/x86/include/asm/pgtable_64.h | 2 ++
3224 arch/x86/kernel/cpu/bugs_64.c | 2 ++
3225 arch/x86/kernel/head_64.S | 28 +++++++++++++++++++++++-----
3226 arch/x86/kernel/vmlinux.lds.S | 8 +++++++-
3227 arch/x86/mm/init.c | 18 ++++++++++++++----
3228 arch/x86/mm/ioremap.c | 8 ++++++--
3229 arch/x86/mm/pageattr.c | 5 ++---
3230 arch/x86/mm/pgtable.c | 2 ++
3231 include/asm-generic/sections.h | 1 +
3232 include/asm-generic/vmlinux.lds.h | 2 ++
3233 include/net/mac80211.h | 2 +-
3234 mm/vmalloc.c | 7 ++++++-
3235 14 files changed, 75 insertions(+), 17 deletions(-)
3236
3237 commit a2dce7cb2e3c389b7ef6c76c15ccdbf506007ddd
3238 Merge: d113ff6 fcba09f
3239 Author: Brad Spengler <spender@grsecurity.net>
3240 Date: Sat Oct 3 09:12:31 2015 -0400
3241
3242 Merge branch 'linux-4.2.y' into pax-test
3243
3244 commit d113ff6e7835e89e2b954503b1a100750ddb43c7
3245 Author: Brad Spengler <spender@grsecurity.net>
3246 Date: Thu Oct 1 21:34:12 2015 -0400
3247
3248 Update to pax-linux-4.2.2-test5.patch:
3249 - fixed a RANDKSTACK regression, reported by spender
3250 - fixed some more compiler warnings due to the ktla_ktva changes, reported by spender
3251
3252 arch/x86/entry/entry_64.S | 2 ++
3253 arch/x86/kernel/process.c | 1 +
3254 drivers/hv/hv.c | 2 +-
3255 drivers/lguest/x86/core.c | 4 ++--
3256 drivers/misc/kgdbts.c | 4 ++--
3257 drivers/video/fbdev/uvesafb.c | 4 ++--
3258 fs/binfmt_elf_fdpic.c | 2 +-
3259 7 files changed, 11 insertions(+), 8 deletions(-)
3260
3261 commit 149e32a4dddfae46e2490f011870cd4492ca946c
3262 Author: Brad Spengler <spender@grsecurity.net>
3263 Date: Tue Sep 29 16:31:50 2015 -0400
3264
3265 Update to pax-linux-4.2.2-test4.patch:
3266 - fixed a few compiler warnings caused by the recently reworked ktla_ktva/ktva_ktla functions, reported by spender
3267 - Emese fixed a size overflow false positive in the IDE driver, reported by spender
3268
3269 arch/x86/lib/insn.c | 2 +-
3270 drivers/ide/ide-disk.c | 2 +-
3271 drivers/video/fbdev/vesafb.c | 4 ++--
3272 fs/binfmt_elf.c | 2 +-
3273 .../size_overflow_plugin/size_overflow_plugin.c | 4 ++--
3274 .../size_overflow_transform_core.c | 11 +++++------
3275 6 files changed, 12 insertions(+), 13 deletions(-)
3276
3277 commit 02c41b848fbaddf82ce98690b23d3d85a94d55fe
3278 Merge: b8b2f5b 7659db3
3279 Author: Brad Spengler <spender@grsecurity.net>
3280 Date: Tue Sep 29 15:50:40 2015 -0400
3281
3282 Merge branch 'linux-4.2.y' into pax-test
3283
3284 Conflicts:
3285 fs/nfs/inode.c
3286
3287 commit b8b2f5bc93ced0ca9a8366d0f3fa09abd1ca7ac6
3288 Author: Brad Spengler <spender@grsecurity.net>
3289 Date: Tue Sep 29 09:13:54 2015 -0400
3290
3291 Initial import of pax-linux-4.2.1-test3.patch
3292
3293 Documentation/dontdiff | 47 +-
3294 Documentation/kbuild/makefiles.txt | 39 +-
3295 Documentation/kernel-parameters.txt | 28 +
3296 Makefile | 108 +-
3297 arch/alpha/include/asm/atomic.h | 10 +
3298 arch/alpha/include/asm/elf.h | 7 +
3299 arch/alpha/include/asm/pgalloc.h | 6 +
3300 arch/alpha/include/asm/pgtable.h | 11 +
3301 arch/alpha/kernel/module.c | 2 +-
3302 arch/alpha/kernel/osf_sys.c | 8 +-
3303 arch/alpha/mm/fault.c | 141 +-
3304 arch/arm/Kconfig | 2 +-
3305 arch/arm/include/asm/atomic.h | 319 +-
3306 arch/arm/include/asm/barrier.h | 2 +-
3307 arch/arm/include/asm/cache.h | 5 +-
3308 arch/arm/include/asm/cacheflush.h | 2 +-
3309 arch/arm/include/asm/checksum.h | 14 +-
3310 arch/arm/include/asm/cmpxchg.h | 4 +
3311 arch/arm/include/asm/cpuidle.h | 2 +-
3312 arch/arm/include/asm/domain.h | 33 +-
3313 arch/arm/include/asm/elf.h | 9 +-
3314 arch/arm/include/asm/fncpy.h | 2 +
3315 arch/arm/include/asm/futex.h | 10 +
3316 arch/arm/include/asm/kmap_types.h | 2 +-
3317 arch/arm/include/asm/mach/dma.h | 2 +-
3318 arch/arm/include/asm/mach/map.h | 16 +-
3319 arch/arm/include/asm/outercache.h | 2 +-
3320 arch/arm/include/asm/page.h | 3 +-
3321 arch/arm/include/asm/pgalloc.h | 20 +
3322 arch/arm/include/asm/pgtable-2level-hwdef.h | 4 +-
3323 arch/arm/include/asm/pgtable-2level.h | 3 +
3324 arch/arm/include/asm/pgtable-3level.h | 3 +
3325 arch/arm/include/asm/pgtable.h | 54 +-
3326 arch/arm/include/asm/psci.h | 2 +-
3327 arch/arm/include/asm/smp.h | 2 +-
3328 arch/arm/include/asm/thread_info.h | 6 +-
3329 arch/arm/include/asm/tls.h | 3 +
3330 arch/arm/include/asm/uaccess.h | 100 +-
3331 arch/arm/include/uapi/asm/ptrace.h | 2 +-
3332 arch/arm/kernel/armksyms.c | 8 +-
3333 arch/arm/kernel/cpuidle.c | 2 +-
3334 arch/arm/kernel/entry-armv.S | 110 +-
3335 arch/arm/kernel/entry-common.S | 40 +-
3336 arch/arm/kernel/entry-header.S | 60 +
3337 arch/arm/kernel/fiq.c | 3 +
3338 arch/arm/kernel/head.S | 2 +-
3339 arch/arm/kernel/module.c | 38 +-
3340 arch/arm/kernel/patch.c | 2 +
3341 arch/arm/kernel/process.c | 90 +-
3342 arch/arm/kernel/psci.c | 2 +-
3343 arch/arm/kernel/reboot.c | 1 +
3344 arch/arm/kernel/setup.c | 20 +-
3345 arch/arm/kernel/signal.c | 35 +-
3346 arch/arm/kernel/smp.c | 2 +-
3347 arch/arm/kernel/tcm.c | 4 +-
3348 arch/arm/kernel/traps.c | 6 +-
3349 arch/arm/kernel/vmlinux.lds.S | 6 +-
3350 arch/arm/kvm/arm.c | 10 +-
3351 arch/arm/lib/clear_user.S | 6 +-
3352 arch/arm/lib/copy_from_user.S | 6 +-
3353 arch/arm/lib/copy_page.S | 1 +
3354 arch/arm/lib/copy_to_user.S | 6 +-
3355 arch/arm/lib/csumpartialcopyuser.S | 4 +-
3356 arch/arm/lib/delay.c | 2 +-
3357 arch/arm/lib/uaccess_with_memcpy.c | 8 +-
3358 arch/arm/mach-exynos/suspend.c | 6 +-
3359 arch/arm/mach-mvebu/coherency.c | 4 +-
3360 arch/arm/mach-omap2/board-n8x0.c | 2 +-
3361 arch/arm/mach-omap2/omap-mpuss-lowpower.c | 4 +-
3362 arch/arm/mach-omap2/omap-smp.c | 1 +
3363 arch/arm/mach-omap2/omap-wakeupgen.c | 2 +-
3364 arch/arm/mach-omap2/omap_device.c | 4 +-
3365 arch/arm/mach-omap2/omap_device.h | 4 +-
3366 arch/arm/mach-omap2/omap_hwmod.c | 4 +-
3367 arch/arm/mach-omap2/powerdomains43xx_data.c | 5 +-
3368 arch/arm/mach-omap2/wd_timer.c | 6 +-
3369 arch/arm/mach-shmobile/platsmp-apmu.c | 5 +-
3370 arch/arm/mach-shmobile/pm-r8a7740.c | 5 +-
3371 arch/arm/mach-shmobile/pm-sh73a0.c | 5 +-
3372 arch/arm/mach-tegra/cpuidle-tegra20.c | 2 +-
3373 arch/arm/mach-tegra/irq.c | 1 +
3374 arch/arm/mach-ux500/pm.c | 1 +
3375 arch/arm/mach-zynq/platsmp.c | 1 +
3376 arch/arm/mm/Kconfig | 6 +-
3377 arch/arm/mm/alignment.c | 8 +
3378 arch/arm/mm/cache-l2x0.c | 2 +-
3379 arch/arm/mm/context.c | 10 +-
3380 arch/arm/mm/fault.c | 146 +
3381 arch/arm/mm/fault.h | 12 +
3382 arch/arm/mm/init.c | 39 +
3383 arch/arm/mm/ioremap.c | 4 +-
3384 arch/arm/mm/mmap.c | 30 +-
3385 arch/arm/mm/mmu.c | 182 +-
3386 arch/arm/net/bpf_jit_32.c | 3 +
3387 arch/arm/plat-iop/setup.c | 2 +-
3388 arch/arm/plat-omap/sram.c | 2 +
3389 arch/arm64/include/asm/atomic.h | 10 +
3390 arch/arm64/include/asm/barrier.h | 2 +-
3391 arch/arm64/include/asm/percpu.h | 8 +-
3392 arch/arm64/include/asm/pgalloc.h | 5 +
3393 arch/arm64/include/asm/uaccess.h | 1 +
3394 arch/arm64/mm/dma-mapping.c | 2 +-
3395 arch/avr32/include/asm/elf.h | 8 +-
3396 arch/avr32/include/asm/kmap_types.h | 4 +-
3397 arch/avr32/mm/fault.c | 27 +
3398 arch/frv/include/asm/atomic.h | 10 +
3399 arch/frv/include/asm/kmap_types.h | 2 +-
3400 arch/frv/mm/elf-fdpic.c | 3 +-
3401 arch/ia64/Makefile | 1 +
3402 arch/ia64/include/asm/atomic.h | 10 +
3403 arch/ia64/include/asm/barrier.h | 2 +-
3404 arch/ia64/include/asm/elf.h | 7 +
3405 arch/ia64/include/asm/pgalloc.h | 12 +
3406 arch/ia64/include/asm/pgtable.h | 13 +-
3407 arch/ia64/include/asm/spinlock.h | 2 +-
3408 arch/ia64/include/asm/uaccess.h | 27 +-
3409 arch/ia64/kernel/module.c | 45 +-
3410 arch/ia64/kernel/palinfo.c | 2 +-
3411 arch/ia64/kernel/sys_ia64.c | 7 +
3412 arch/ia64/kernel/vmlinux.lds.S | 2 +-
3413 arch/ia64/mm/fault.c | 32 +-
3414 arch/ia64/mm/init.c | 15 +-
3415 arch/m32r/lib/usercopy.c | 6 +
3416 arch/metag/include/asm/barrier.h | 2 +-
3417 arch/mips/cavium-octeon/dma-octeon.c | 2 +-
3418 arch/mips/include/asm/atomic.h | 355 +-
3419 arch/mips/include/asm/barrier.h | 2 +-
3420 arch/mips/include/asm/elf.h | 7 +
3421 arch/mips/include/asm/exec.h | 2 +-
3422 arch/mips/include/asm/hw_irq.h | 2 +-
3423 arch/mips/include/asm/local.h | 57 +
3424 arch/mips/include/asm/page.h | 2 +-
3425 arch/mips/include/asm/pgalloc.h | 5 +
3426 arch/mips/include/asm/pgtable.h | 3 +
3427 arch/mips/include/asm/uaccess.h | 1 +
3428 arch/mips/kernel/binfmt_elfn32.c | 7 +
3429 arch/mips/kernel/binfmt_elfo32.c | 7 +
3430 arch/mips/kernel/i8259.c | 2 +-
3431 arch/mips/kernel/irq-gt641xx.c | 2 +-
3432 arch/mips/kernel/irq.c | 6 +-
3433 arch/mips/kernel/pm-cps.c | 2 +-
3434 arch/mips/kernel/process.c | 12 -
3435 arch/mips/kernel/sync-r4k.c | 24 +-
3436 arch/mips/kernel/traps.c | 13 +-
3437 arch/mips/kvm/mips.c | 2 +-
3438 arch/mips/mm/fault.c | 25 +
3439 arch/mips/mm/mmap.c | 51 +-
3440 arch/mips/sgi-ip27/ip27-nmi.c | 6 +-
3441 arch/mips/sni/rm200.c | 2 +-
3442 arch/mips/vr41xx/common/icu.c | 2 +-
3443 arch/mips/vr41xx/common/irq.c | 4 +-
3444 arch/parisc/include/asm/atomic.h | 10 +
3445 arch/parisc/include/asm/elf.h | 7 +
3446 arch/parisc/include/asm/pgalloc.h | 6 +
3447 arch/parisc/include/asm/pgtable.h | 11 +
3448 arch/parisc/include/asm/uaccess.h | 4 +-
3449 arch/parisc/kernel/module.c | 50 +-
3450 arch/parisc/kernel/sys_parisc.c | 15 +
3451 arch/parisc/kernel/traps.c | 4 +-
3452 arch/parisc/mm/fault.c | 140 +-
3453 arch/powerpc/include/asm/atomic.h | 329 +-
3454 arch/powerpc/include/asm/barrier.h | 2 +-
3455 arch/powerpc/include/asm/elf.h | 12 +
3456 arch/powerpc/include/asm/exec.h | 2 +-
3457 arch/powerpc/include/asm/kmap_types.h | 2 +-
3458 arch/powerpc/include/asm/local.h | 46 +
3459 arch/powerpc/include/asm/mman.h | 2 +-
3460 arch/powerpc/include/asm/page.h | 8 +-
3461 arch/powerpc/include/asm/page_64.h | 7 +-
3462 arch/powerpc/include/asm/pgalloc-64.h | 7 +
3463 arch/powerpc/include/asm/pgtable.h | 1 +
3464 arch/powerpc/include/asm/pte-hash32.h | 1 +
3465 arch/powerpc/include/asm/reg.h | 1 +
3466 arch/powerpc/include/asm/smp.h | 2 +-
3467 arch/powerpc/include/asm/spinlock.h | 42 +-
3468 arch/powerpc/include/asm/uaccess.h | 141 +-
3469 arch/powerpc/kernel/Makefile | 5 +
3470 arch/powerpc/kernel/exceptions-64e.S | 4 +-
3471 arch/powerpc/kernel/exceptions-64s.S | 2 +-
3472 arch/powerpc/kernel/module_32.c | 15 +-
3473 arch/powerpc/kernel/process.c | 46 -
3474 arch/powerpc/kernel/signal_32.c | 2 +-
3475 arch/powerpc/kernel/signal_64.c | 2 +-
3476 arch/powerpc/kernel/traps.c | 21 +
3477 arch/powerpc/kernel/vdso.c | 5 +-
3478 arch/powerpc/kvm/powerpc.c | 2 +-
3479 arch/powerpc/lib/usercopy_64.c | 18 -
3480 arch/powerpc/mm/fault.c | 56 +-
3481 arch/powerpc/mm/mmap.c | 16 +
3482 arch/powerpc/mm/slice.c | 13 +-
3483 arch/powerpc/platforms/cell/spufs/file.c | 4 +-
3484 arch/s390/include/asm/atomic.h | 10 +
3485 arch/s390/include/asm/barrier.h | 2 +-
3486 arch/s390/include/asm/elf.h | 7 +
3487 arch/s390/include/asm/exec.h | 2 +-
3488 arch/s390/include/asm/uaccess.h | 13 +-
3489 arch/s390/kernel/module.c | 22 +-
3490 arch/s390/kernel/process.c | 24 -
3491 arch/s390/mm/mmap.c | 16 +
3492 arch/score/include/asm/exec.h | 2 +-
3493 arch/score/kernel/process.c | 5 -
3494 arch/sh/mm/mmap.c | 22 +-
3495 arch/sparc/include/asm/atomic_64.h | 110 +-
3496 arch/sparc/include/asm/barrier_64.h | 2 +-
3497 arch/sparc/include/asm/cache.h | 2 +-
3498 arch/sparc/include/asm/elf_32.h | 7 +
3499 arch/sparc/include/asm/elf_64.h | 7 +
3500 arch/sparc/include/asm/pgalloc_32.h | 1 +
3501 arch/sparc/include/asm/pgalloc_64.h | 1 +
3502 arch/sparc/include/asm/pgtable.h | 4 +
3503 arch/sparc/include/asm/pgtable_32.h | 15 +-
3504 arch/sparc/include/asm/pgtsrmmu.h | 5 +
3505 arch/sparc/include/asm/setup.h | 4 +-
3506 arch/sparc/include/asm/spinlock_64.h | 35 +-
3507 arch/sparc/include/asm/thread_info_32.h | 1 +
3508 arch/sparc/include/asm/thread_info_64.h | 2 +
3509 arch/sparc/include/asm/uaccess.h | 1 +
3510 arch/sparc/include/asm/uaccess_32.h | 28 +-
3511 arch/sparc/include/asm/uaccess_64.h | 24 +-
3512 arch/sparc/kernel/Makefile | 2 +-
3513 arch/sparc/kernel/prom_common.c | 2 +-
3514 arch/sparc/kernel/smp_64.c | 8 +-
3515 arch/sparc/kernel/sys_sparc_32.c | 2 +-
3516 arch/sparc/kernel/sys_sparc_64.c | 52 +-
3517 arch/sparc/kernel/traps_64.c | 27 +-
3518 arch/sparc/lib/Makefile | 2 +-
3519 arch/sparc/lib/atomic_64.S | 57 +-
3520 arch/sparc/lib/ksyms.c | 6 +-
3521 arch/sparc/mm/Makefile | 2 +-
3522 arch/sparc/mm/fault_32.c | 292 +
3523 arch/sparc/mm/fault_64.c | 486 +
3524 arch/sparc/mm/hugetlbpage.c | 22 +-
3525 arch/sparc/mm/init_64.c | 10 +-
3526 arch/tile/include/asm/atomic_64.h | 10 +
3527 arch/tile/include/asm/uaccess.h | 4 +-
3528 arch/um/Makefile | 4 +
3529 arch/um/include/asm/kmap_types.h | 2 +-
3530 arch/um/include/asm/page.h | 3 +
3531 arch/um/include/asm/pgtable-3level.h | 1 +
3532 arch/um/kernel/process.c | 16 -
3533 arch/x86/Kconfig | 15 +-
3534 arch/x86/Kconfig.cpu | 6 +-
3535 arch/x86/Kconfig.debug | 4 +-
3536 arch/x86/Makefile | 13 +-
3537 arch/x86/boot/Makefile | 3 +
3538 arch/x86/boot/bitops.h | 4 +-
3539 arch/x86/boot/boot.h | 2 +-
3540 arch/x86/boot/compressed/Makefile | 3 +
3541 arch/x86/boot/compressed/efi_stub_32.S | 16 +-
3542 arch/x86/boot/compressed/efi_thunk_64.S | 4 +-
3543 arch/x86/boot/compressed/head_32.S | 4 +-
3544 arch/x86/boot/compressed/head_64.S | 12 +-
3545 arch/x86/boot/compressed/misc.c | 11 +-
3546 arch/x86/boot/cpucheck.c | 16 +-
3547 arch/x86/boot/header.S | 6 +-
3548 arch/x86/boot/memory.c | 2 +-
3549 arch/x86/boot/video-vesa.c | 1 +
3550 arch/x86/boot/video.c | 2 +-
3551 arch/x86/crypto/aes-x86_64-asm_64.S | 4 +
3552 arch/x86/crypto/aesni-intel_asm.S | 106 +-
3553 arch/x86/crypto/blowfish-x86_64-asm_64.S | 7 +
3554 arch/x86/crypto/camellia-aesni-avx-asm_64.S | 10 +
3555 arch/x86/crypto/camellia-aesni-avx2-asm_64.S | 10 +
3556 arch/x86/crypto/camellia-x86_64-asm_64.S | 7 +
3557 arch/x86/crypto/cast5-avx-x86_64-asm_64.S | 51 +-
3558 arch/x86/crypto/cast6-avx-x86_64-asm_64.S | 25 +-
3559 arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 4 +-
3560 arch/x86/crypto/ghash-clmulni-intel_asm.S | 4 +
3561 arch/x86/crypto/salsa20-x86_64-asm_64.S | 4 +
3562 arch/x86/crypto/serpent-avx-x86_64-asm_64.S | 9 +
3563 arch/x86/crypto/serpent-avx2-asm_64.S | 9 +
3564 arch/x86/crypto/serpent-sse2-x86_64-asm_64.S | 4 +
3565 arch/x86/crypto/sha1_ssse3_asm.S | 10 +-
3566 arch/x86/crypto/sha256-avx-asm.S | 2 +
3567 arch/x86/crypto/sha256-avx2-asm.S | 2 +
3568 arch/x86/crypto/sha256-ssse3-asm.S | 2 +
3569 arch/x86/crypto/sha512-avx-asm.S | 2 +
3570 arch/x86/crypto/sha512-avx2-asm.S | 2 +
3571 arch/x86/crypto/sha512-ssse3-asm.S | 2 +
3572 arch/x86/crypto/twofish-avx-x86_64-asm_64.S | 25 +-
3573 arch/x86/crypto/twofish-x86_64-asm_64-3way.S | 4 +
3574 arch/x86/crypto/twofish-x86_64-asm_64.S | 3 +
3575 arch/x86/entry/calling.h | 92 +-
3576 arch/x86/entry/entry_32.S | 360 +-
3577 arch/x86/entry/entry_64.S | 636 +-
3578 arch/x86/entry/entry_64_compat.S | 159 +-
3579 arch/x86/entry/thunk_64.S | 2 +
3580 arch/x86/entry/vdso/Makefile | 2 +-
3581 arch/x86/entry/vdso/vdso2c.h | 4 +-
3582 arch/x86/entry/vdso/vma.c | 41 +-
3583 arch/x86/entry/vsyscall/vsyscall_64.c | 16 +-
3584 arch/x86/ia32/ia32_signal.c | 23 +-
3585 arch/x86/ia32/sys_ia32.c | 42 +-
3586 arch/x86/include/asm/alternative-asm.h | 43 +-
3587 arch/x86/include/asm/alternative.h | 4 +-
3588 arch/x86/include/asm/apic.h | 2 +-
3589 arch/x86/include/asm/apm.h | 4 +-
3590 arch/x86/include/asm/atomic.h | 269 +-
3591 arch/x86/include/asm/atomic64_32.h | 100 +
3592 arch/x86/include/asm/atomic64_64.h | 164 +-
3593 arch/x86/include/asm/barrier.h | 4 +-
3594 arch/x86/include/asm/bitops.h | 18 +-
3595 arch/x86/include/asm/boot.h | 2 +-
3596 arch/x86/include/asm/cache.h | 5 +-
3597 arch/x86/include/asm/checksum_32.h | 12 +-
3598 arch/x86/include/asm/cmpxchg.h | 39 +
3599 arch/x86/include/asm/compat.h | 2 +-
3600 arch/x86/include/asm/cpufeature.h | 17 +-
3601 arch/x86/include/asm/desc.h | 78 +-
3602 arch/x86/include/asm/desc_defs.h | 6 +
3603 arch/x86/include/asm/div64.h | 2 +-
3604 arch/x86/include/asm/elf.h | 33 +-
3605 arch/x86/include/asm/emergency-restart.h | 2 +-
3606 arch/x86/include/asm/fpu/internal.h | 36 +-
3607 arch/x86/include/asm/fpu/types.h | 5 +-
3608 arch/x86/include/asm/futex.h | 14 +-
3609 arch/x86/include/asm/hw_irq.h | 4 +-
3610 arch/x86/include/asm/i8259.h | 2 +-
3611 arch/x86/include/asm/io.h | 22 +-
3612 arch/x86/include/asm/irqflags.h | 5 +
3613 arch/x86/include/asm/kprobes.h | 9 +-
3614 arch/x86/include/asm/local.h | 106 +-
3615 arch/x86/include/asm/mman.h | 15 +
3616 arch/x86/include/asm/mmu.h | 14 +-
3617 arch/x86/include/asm/mmu_context.h | 138 +-
3618 arch/x86/include/asm/module.h | 17 +-
3619 arch/x86/include/asm/nmi.h | 19 +-
3620 arch/x86/include/asm/page.h | 1 +
3621 arch/x86/include/asm/page_32.h | 12 +-
3622 arch/x86/include/asm/page_64.h | 14 +-
3623 arch/x86/include/asm/paravirt.h | 46 +-
3624 arch/x86/include/asm/paravirt_types.h | 15 +-
3625 arch/x86/include/asm/pgalloc.h | 23 +
3626 arch/x86/include/asm/pgtable-2level.h | 2 +
3627 arch/x86/include/asm/pgtable-3level.h | 4 +
3628 arch/x86/include/asm/pgtable.h | 128 +-
3629 arch/x86/include/asm/pgtable_32.h | 14 +-
3630 arch/x86/include/asm/pgtable_32_types.h | 24 +-
3631 arch/x86/include/asm/pgtable_64.h | 22 +-
3632 arch/x86/include/asm/pgtable_64_types.h | 5 +
3633 arch/x86/include/asm/pgtable_types.h | 26 +-
3634 arch/x86/include/asm/preempt.h | 2 +-
3635 arch/x86/include/asm/processor.h | 59 +-
3636 arch/x86/include/asm/ptrace.h | 21 +-
3637 arch/x86/include/asm/qrwlock.h | 4 +-
3638 arch/x86/include/asm/realmode.h | 4 +-
3639 arch/x86/include/asm/reboot.h | 10 +-
3640 arch/x86/include/asm/rmwcc.h | 84 +-
3641 arch/x86/include/asm/rwsem.h | 60 +-
3642 arch/x86/include/asm/segment.h | 27 +-
3643 arch/x86/include/asm/smap.h | 43 +
3644 arch/x86/include/asm/smp.h | 14 +-
3645 arch/x86/include/asm/stackprotector.h | 4 +-
3646 arch/x86/include/asm/stacktrace.h | 32 +-
3647 arch/x86/include/asm/switch_to.h | 4 +-
3648 arch/x86/include/asm/sys_ia32.h | 6 +-
3649 arch/x86/include/asm/thread_info.h | 27 +-
3650 arch/x86/include/asm/tlbflush.h | 77 +-
3651 arch/x86/include/asm/uaccess.h | 192 +-
3652 arch/x86/include/asm/uaccess_32.h | 28 +-
3653 arch/x86/include/asm/uaccess_64.h | 169 +-
3654 arch/x86/include/asm/word-at-a-time.h | 2 +-
3655 arch/x86/include/asm/x86_init.h | 10 +-
3656 arch/x86/include/asm/xen/page.h | 2 +-
3657 arch/x86/include/uapi/asm/e820.h | 2 +-
3658 arch/x86/kernel/Makefile | 2 +-
3659 arch/x86/kernel/acpi/boot.c | 4 +-
3660 arch/x86/kernel/acpi/sleep.c | 4 +
3661 arch/x86/kernel/acpi/wakeup_32.S | 6 +-
3662 arch/x86/kernel/alternative.c | 124 +-
3663 arch/x86/kernel/apic/apic.c | 4 +-
3664 arch/x86/kernel/apic/apic_flat_64.c | 4 +-
3665 arch/x86/kernel/apic/apic_noop.c | 2 +-
3666 arch/x86/kernel/apic/bigsmp_32.c | 2 +-
3667 arch/x86/kernel/apic/io_apic.c | 8 +-
3668 arch/x86/kernel/apic/msi.c | 2 +-
3669 arch/x86/kernel/apic/probe_32.c | 2 +-
3670 arch/x86/kernel/apic/vector.c | 4 +-
3671 arch/x86/kernel/apic/x2apic_cluster.c | 4 +-
3672 arch/x86/kernel/apic/x2apic_phys.c | 2 +-
3673 arch/x86/kernel/apic/x2apic_uv_x.c | 2 +-
3674 arch/x86/kernel/apm_32.c | 21 +-
3675 arch/x86/kernel/asm-offsets.c | 20 +
3676 arch/x86/kernel/asm-offsets_64.c | 1 +
3677 arch/x86/kernel/cpu/Makefile | 4 -
3678 arch/x86/kernel/cpu/amd.c | 2 +-
3679 arch/x86/kernel/cpu/common.c | 202 +-
3680 arch/x86/kernel/cpu/intel_cacheinfo.c | 14 +-
3681 arch/x86/kernel/cpu/mcheck/mce.c | 31 +-
3682 arch/x86/kernel/cpu/mcheck/p5.c | 3 +
3683 arch/x86/kernel/cpu/mcheck/winchip.c | 3 +
3684 arch/x86/kernel/cpu/microcode/core.c | 2 +-
3685 arch/x86/kernel/cpu/microcode/intel.c | 4 +-
3686 arch/x86/kernel/cpu/mtrr/main.c | 2 +-
3687 arch/x86/kernel/cpu/mtrr/mtrr.h | 2 +-
3688 arch/x86/kernel/cpu/perf_event.c | 10 +-
3689 arch/x86/kernel/cpu/perf_event_amd_iommu.c | 2 +-
3690 arch/x86/kernel/cpu/perf_event_intel.c | 6 +-
3691 arch/x86/kernel/cpu/perf_event_intel_bts.c | 6 +-
3692 arch/x86/kernel/cpu/perf_event_intel_cqm.c | 4 +-
3693 arch/x86/kernel/cpu/perf_event_intel_pt.c | 44 +-
3694 arch/x86/kernel/cpu/perf_event_intel_rapl.c | 2 +-
3695 arch/x86/kernel/cpu/perf_event_intel_uncore.c | 2 +-
3696 arch/x86/kernel/cpu/perf_event_intel_uncore.h | 2 +-
3697 arch/x86/kernel/cpuid.c | 2 +-
3698 arch/x86/kernel/crash_dump_64.c | 2 +-
3699 arch/x86/kernel/doublefault.c | 8 +-
3700 arch/x86/kernel/dumpstack.c | 24 +-
3701 arch/x86/kernel/dumpstack_32.c | 25 +-
3702 arch/x86/kernel/dumpstack_64.c | 62 +-
3703 arch/x86/kernel/e820.c | 4 +-
3704 arch/x86/kernel/early_printk.c | 1 +
3705 arch/x86/kernel/espfix_64.c | 13 +-
3706 arch/x86/kernel/fpu/core.c | 22 +-
3707 arch/x86/kernel/fpu/init.c | 8 +-
3708 arch/x86/kernel/fpu/regset.c | 22 +-
3709 arch/x86/kernel/fpu/signal.c | 20 +-
3710 arch/x86/kernel/fpu/xstate.c | 8 +-
3711 arch/x86/kernel/ftrace.c | 18 +-
3712 arch/x86/kernel/head64.c | 14 +-
3713 arch/x86/kernel/head_32.S | 235 +-
3714 arch/x86/kernel/head_64.S | 149 +-
3715 arch/x86/kernel/i386_ksyms_32.c | 12 +
3716 arch/x86/kernel/i8259.c | 10 +-
3717 arch/x86/kernel/io_delay.c | 2 +-
3718 arch/x86/kernel/ioport.c | 2 +-
3719 arch/x86/kernel/irq.c | 8 +-
3720 arch/x86/kernel/irq_32.c | 45 +-
3721 arch/x86/kernel/jump_label.c | 10 +-
3722 arch/x86/kernel/kgdb.c | 21 +-
3723 arch/x86/kernel/kprobes/core.c | 28 +-
3724 arch/x86/kernel/kprobes/opt.c | 16 +-
3725 arch/x86/kernel/ksysfs.c | 2 +-
3726 arch/x86/kernel/ldt.c | 25 +
3727 arch/x86/kernel/livepatch.c | 12 +-
3728 arch/x86/kernel/machine_kexec_32.c | 6 +-
3729 arch/x86/kernel/mcount_64.S | 19 +-
3730 arch/x86/kernel/module.c | 78 +-
3731 arch/x86/kernel/msr.c | 2 +-
3732 arch/x86/kernel/nmi.c | 34 +-
3733 arch/x86/kernel/nmi_selftest.c | 4 +-
3734 arch/x86/kernel/paravirt-spinlocks.c | 2 +-
3735 arch/x86/kernel/paravirt.c | 45 +-
3736 arch/x86/kernel/paravirt_patch_64.c | 8 +
3737 arch/x86/kernel/pci-calgary_64.c | 2 +-
3738 arch/x86/kernel/pci-iommu_table.c | 2 +-
3739 arch/x86/kernel/pci-swiotlb.c | 2 +-
3740 arch/x86/kernel/process.c | 71 +-
3741 arch/x86/kernel/process_32.c | 30 +-
3742 arch/x86/kernel/process_64.c | 19 +-
3743 arch/x86/kernel/ptrace.c | 20 +-
3744 arch/x86/kernel/pvclock.c | 8 +-
3745 arch/x86/kernel/reboot.c | 44 +-
3746 arch/x86/kernel/reboot_fixups_32.c | 2 +-
3747 arch/x86/kernel/relocate_kernel_64.S | 3 +-
3748 arch/x86/kernel/setup.c | 29 +-
3749 arch/x86/kernel/setup_percpu.c | 29 +-
3750 arch/x86/kernel/signal.c | 17 +-
3751 arch/x86/kernel/smp.c | 2 +-
3752 arch/x86/kernel/smpboot.c | 29 +-
3753 arch/x86/kernel/step.c | 6 +-
3754 arch/x86/kernel/sys_i386_32.c | 184 +
3755 arch/x86/kernel/sys_x86_64.c | 22 +-
3756 arch/x86/kernel/tboot.c | 14 +-
3757 arch/x86/kernel/time.c | 8 +-
3758 arch/x86/kernel/tls.c | 7 +-
3759 arch/x86/kernel/tracepoint.c | 4 +-
3760 arch/x86/kernel/traps.c | 53 +-
3761 arch/x86/kernel/tsc.c | 2 +-
3762 arch/x86/kernel/uprobes.c | 2 +-
3763 arch/x86/kernel/vm86_32.c | 6 +-
3764 arch/x86/kernel/vmlinux.lds.S | 147 +-
3765 arch/x86/kernel/x8664_ksyms_64.c | 6 +-
3766 arch/x86/kernel/x86_init.c | 6 +-
3767 arch/x86/kvm/cpuid.c | 21 +-
3768 arch/x86/kvm/emulate.c | 2 +-
3769 arch/x86/kvm/lapic.c | 2 +-
3770 arch/x86/kvm/paging_tmpl.h | 2 +-
3771 arch/x86/kvm/svm.c | 8 +
3772 arch/x86/kvm/vmx.c | 82 +-
3773 arch/x86/kvm/x86.c | 44 +-
3774 arch/x86/lguest/boot.c | 3 +-
3775 arch/x86/lib/atomic64_386_32.S | 164 +
3776 arch/x86/lib/atomic64_cx8_32.S | 98 +-
3777 arch/x86/lib/checksum_32.S | 97 +-
3778 arch/x86/lib/clear_page_64.S | 3 +
3779 arch/x86/lib/cmpxchg16b_emu.S | 3 +
3780 arch/x86/lib/copy_page_64.S | 14 +-
3781 arch/x86/lib/copy_user_64.S | 66 +-
3782 arch/x86/lib/csum-copy_64.S | 14 +-
3783 arch/x86/lib/csum-wrappers_64.c | 8 +-
3784 arch/x86/lib/getuser.S | 74 +-
3785 arch/x86/lib/insn.c | 8 +-
3786 arch/x86/lib/iomap_copy_64.S | 2 +
3787 arch/x86/lib/memcpy_64.S | 6 +
3788 arch/x86/lib/memmove_64.S | 3 +-
3789 arch/x86/lib/memset_64.S | 3 +
3790 arch/x86/lib/mmx_32.c | 243 +-
3791 arch/x86/lib/msr-reg.S | 2 +
3792 arch/x86/lib/putuser.S | 87 +-
3793 arch/x86/lib/rwsem.S | 6 +-
3794 arch/x86/lib/usercopy_32.c | 359 +-
3795 arch/x86/lib/usercopy_64.c | 20 +-
3796 arch/x86/math-emu/fpu_aux.c | 2 +-
3797 arch/x86/math-emu/fpu_entry.c | 4 +-
3798 arch/x86/math-emu/fpu_system.h | 2 +-
3799 arch/x86/mm/Makefile | 4 +
3800 arch/x86/mm/extable.c | 26 +-
3801 arch/x86/mm/fault.c | 570 +-
3802 arch/x86/mm/gup.c | 6 +-
3803 arch/x86/mm/highmem_32.c | 4 +
3804 arch/x86/mm/hugetlbpage.c | 24 +-
3805 arch/x86/mm/init.c | 101 +-
3806 arch/x86/mm/init_32.c | 111 +-
3807 arch/x86/mm/init_64.c | 46 +-
3808 arch/x86/mm/iomap_32.c | 4 +
3809 arch/x86/mm/ioremap.c | 44 +-
3810 arch/x86/mm/kmemcheck/kmemcheck.c | 4 +-
3811 arch/x86/mm/mmap.c | 40 +-
3812 arch/x86/mm/mmio-mod.c | 10 +-
3813 arch/x86/mm/numa.c | 2 +-
3814 arch/x86/mm/pageattr.c | 33 +-
3815 arch/x86/mm/pat.c | 12 +-
3816 arch/x86/mm/pat_rbtree.c | 2 +-
3817 arch/x86/mm/pf_in.c | 10 +-
3818 arch/x86/mm/pgtable.c | 162 +-
3819 arch/x86/mm/pgtable_32.c | 3 +
3820 arch/x86/mm/setup_nx.c | 7 +
3821 arch/x86/mm/tlb.c | 4 +
3822 arch/x86/mm/uderef_64.c | 37 +
3823 arch/x86/net/bpf_jit.S | 11 +
3824 arch/x86/net/bpf_jit_comp.c | 13 +-
3825 arch/x86/oprofile/backtrace.c | 6 +-
3826 arch/x86/oprofile/nmi_int.c | 8 +-
3827 arch/x86/oprofile/op_model_amd.c | 8 +-
3828 arch/x86/oprofile/op_model_ppro.c | 7 +-
3829 arch/x86/oprofile/op_x86_model.h | 2 +-
3830 arch/x86/pci/intel_mid_pci.c | 2 +-
3831 arch/x86/pci/irq.c | 8 +-
3832 arch/x86/pci/pcbios.c | 144 +-
3833 arch/x86/platform/efi/efi_32.c | 24 +
3834 arch/x86/platform/efi/efi_64.c | 26 +-
3835 arch/x86/platform/efi/efi_stub_32.S | 64 +-
3836 arch/x86/platform/efi/efi_stub_64.S | 2 +
3837 arch/x86/platform/intel-mid/intel-mid.c | 5 +-
3838 arch/x86/platform/intel-mid/intel_mid_weak_decls.h | 6 +-
3839 arch/x86/platform/intel-mid/mfld.c | 4 +-
3840 arch/x86/platform/intel-mid/mrfl.c | 2 +-
3841 arch/x86/platform/intel-quark/imr_selftest.c | 2 +-
3842 arch/x86/platform/olpc/olpc_dt.c | 2 +-
3843 arch/x86/power/cpu.c | 11 +-
3844 arch/x86/realmode/init.c | 10 +-
3845 arch/x86/realmode/rm/Makefile | 3 +
3846 arch/x86/realmode/rm/header.S | 4 +-
3847 arch/x86/realmode/rm/reboot.S | 4 +
3848 arch/x86/realmode/rm/trampoline_32.S | 12 +-
3849 arch/x86/realmode/rm/trampoline_64.S | 3 +-
3850 arch/x86/realmode/rm/wakeup_asm.S | 5 +-
3851 arch/x86/tools/Makefile | 2 +-
3852 arch/x86/tools/relocs.c | 96 +-
3853 arch/x86/um/mem_32.c | 2 +-
3854 arch/x86/um/tls_32.c | 2 +-
3855 arch/x86/xen/enlighten.c | 50 +-
3856 arch/x86/xen/mmu.c | 17 +-
3857 arch/x86/xen/smp.c | 16 +-
3858 arch/x86/xen/xen-asm_32.S | 2 +-
3859 arch/x86/xen/xen-head.S | 11 +
3860 arch/x86/xen/xen-ops.h | 2 -
3861 block/bio.c | 4 +-
3862 block/blk-iopoll.c | 2 +-
3863 block/blk-map.c | 2 +-
3864 block/blk-softirq.c | 2 +-
3865 block/bsg.c | 12 +-
3866 block/compat_ioctl.c | 4 +-
3867 block/genhd.c | 9 +-
3868 block/partitions/efi.c | 8 +-
3869 block/scsi_ioctl.c | 29 +-
3870 crypto/cryptd.c | 4 +-
3871 crypto/pcrypt.c | 2 +-
3872 crypto/zlib.c | 4 +-
3873 drivers/acpi/acpi_video.c | 2 +-
3874 drivers/acpi/apei/apei-internal.h | 2 +-
3875 drivers/acpi/apei/ghes.c | 4 +-
3876 drivers/acpi/bgrt.c | 6 +-
3877 drivers/acpi/blacklist.c | 4 +-
3878 drivers/acpi/bus.c | 4 +-
3879 drivers/acpi/device_pm.c | 4 +-
3880 drivers/acpi/ec.c | 2 +-
3881 drivers/acpi/pci_slot.c | 2 +-
3882 drivers/acpi/processor_driver.c | 2 +-
3883 drivers/acpi/processor_idle.c | 2 +-
3884 drivers/acpi/processor_pdc.c | 2 +-
3885 drivers/acpi/sleep.c | 2 +-
3886 drivers/acpi/sysfs.c | 4 +-
3887 drivers/acpi/thermal.c | 2 +-
3888 drivers/acpi/video_detect.c | 7 +-
3889 drivers/ata/libahci.c | 2 +-
3890 drivers/ata/libata-core.c | 12 +-
3891 drivers/ata/libata-scsi.c | 2 +-
3892 drivers/ata/libata.h | 2 +-
3893 drivers/ata/pata_arasan_cf.c | 4 +-
3894 drivers/atm/adummy.c | 2 +-
3895 drivers/atm/ambassador.c | 8 +-
3896 drivers/atm/atmtcp.c | 14 +-
3897 drivers/atm/eni.c | 10 +-
3898 drivers/atm/firestream.c | 8 +-
3899 drivers/atm/fore200e.c | 14 +-
3900 drivers/atm/he.c | 18 +-
3901 drivers/atm/horizon.c | 4 +-
3902 drivers/atm/idt77252.c | 36 +-
3903 drivers/atm/iphase.c | 34 +-
3904 drivers/atm/lanai.c | 12 +-
3905 drivers/atm/nicstar.c | 46 +-
3906 drivers/atm/solos-pci.c | 4 +-
3907 drivers/atm/suni.c | 4 +-
3908 drivers/atm/uPD98402.c | 16 +-
3909 drivers/atm/zatm.c | 6 +-
3910 drivers/base/bus.c | 4 +-
3911 drivers/base/devtmpfs.c | 8 +-
3912 drivers/base/node.c | 2 +-
3913 drivers/base/power/domain.c | 11 +-
3914 drivers/base/power/sysfs.c | 2 +-
3915 drivers/base/power/wakeup.c | 8 +-
3916 drivers/base/syscore.c | 4 +-
3917 drivers/block/cciss.c | 28 +-
3918 drivers/block/cciss.h | 2 +-
3919 drivers/block/cpqarray.c | 28 +-
3920 drivers/block/cpqarray.h | 2 +-
3921 drivers/block/drbd/drbd_bitmap.c | 2 +-
3922 drivers/block/drbd/drbd_int.h | 8 +-
3923 drivers/block/drbd/drbd_main.c | 12 +-
3924 drivers/block/drbd/drbd_nl.c | 4 +-
3925 drivers/block/drbd/drbd_receiver.c | 34 +-
3926 drivers/block/drbd/drbd_worker.c | 8 +-
3927 drivers/block/pktcdvd.c | 4 +-
3928 drivers/block/rbd.c | 2 +-
3929 drivers/bluetooth/btwilink.c | 2 +-
3930 drivers/cdrom/cdrom.c | 11 +-
3931 drivers/cdrom/gdrom.c | 1 -
3932 drivers/char/agp/compat_ioctl.c | 2 +-
3933 drivers/char/agp/frontend.c | 4 +-
3934 drivers/char/agp/intel-gtt.c | 4 +-
3935 drivers/char/hpet.c | 2 +-
3936 drivers/char/ipmi/ipmi_msghandler.c | 8 +-
3937 drivers/char/ipmi/ipmi_si_intf.c | 8 +-
3938 drivers/char/mem.c | 47 +-
3939 drivers/char/nvram.c | 2 +-
3940 drivers/char/pcmcia/synclink_cs.c | 16 +-
3941 drivers/char/random.c | 12 +-
3942 drivers/char/sonypi.c | 11 +-
3943 drivers/char/tpm/tpm_acpi.c | 3 +-
3944 drivers/char/tpm/tpm_eventlog.c | 7 +-
3945 drivers/char/virtio_console.c | 4 +-
3946 drivers/clk/clk-composite.c | 2 +-
3947 drivers/clk/samsung/clk.h | 2 +-
3948 drivers/clk/socfpga/clk-gate.c | 9 +-
3949 drivers/clk/socfpga/clk-pll.c | 9 +-
3950 drivers/cpufreq/acpi-cpufreq.c | 17 +-
3951 drivers/cpufreq/cpufreq-dt.c | 4 +-
3952 drivers/cpufreq/cpufreq.c | 26 +-
3953 drivers/cpufreq/cpufreq_governor.c | 2 +-
3954 drivers/cpufreq/cpufreq_governor.h | 4 +-
3955 drivers/cpufreq/cpufreq_ondemand.c | 10 +-
3956 drivers/cpufreq/intel_pstate.c | 33 +-
3957 drivers/cpufreq/p4-clockmod.c | 12 +-
3958 drivers/cpufreq/sparc-us3-cpufreq.c | 67 +-
3959 drivers/cpufreq/speedstep-centrino.c | 7 +-
3960 drivers/cpuidle/driver.c | 2 +-
3961 drivers/cpuidle/dt_idle_states.c | 2 +-
3962 drivers/cpuidle/governor.c | 2 +-
3963 drivers/cpuidle/sysfs.c | 2 +-
3964 drivers/crypto/hifn_795x.c | 4 +-
3965 drivers/devfreq/devfreq.c | 4 +-
3966 drivers/dma/sh/shdma-base.c | 4 +-
3967 drivers/dma/sh/shdmac.c | 2 +-
3968 drivers/edac/edac_device.c | 4 +-
3969 drivers/edac/edac_mc_sysfs.c | 2 +-
3970 drivers/edac/edac_pci.c | 4 +-
3971 drivers/edac/edac_pci_sysfs.c | 22 +-
3972 drivers/edac/mce_amd.h | 2 +-
3973 drivers/firewire/core-card.c | 6 +-
3974 drivers/firewire/core-device.c | 2 +-
3975 drivers/firewire/core-transaction.c | 1 +
3976 drivers/firewire/core.h | 1 +
3977 drivers/firmware/dmi-id.c | 2 +-
3978 drivers/firmware/dmi_scan.c | 12 +-
3979 drivers/firmware/efi/cper.c | 8 +-
3980 drivers/firmware/efi/efi.c | 12 +-
3981 drivers/firmware/efi/efivars.c | 2 +-
3982 drivers/firmware/efi/runtime-map.c | 2 +-
3983 drivers/firmware/google/gsmi.c | 2 +-
3984 drivers/firmware/google/memconsole.c | 7 +-
3985 drivers/firmware/memmap.c | 2 +-
3986 drivers/gpio/gpio-davinci.c | 6 +-
3987 drivers/gpio/gpio-em.c | 2 +-
3988 drivers/gpio/gpio-ich.c | 2 +-
3989 drivers/gpio/gpio-omap.c | 4 +-
3990 drivers/gpio/gpio-rcar.c | 2 +-
3991 drivers/gpio/gpio-vr41xx.c | 2 +-
3992 drivers/gpio/gpiolib.c | 13 +-
3993 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +-
3994 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 2 +-
3995 drivers/gpu/drm/amd/amdkfd/kfd_device.c | 6 +-
3996 .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 90 +-
3997 .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.h | 8 +-
3998 .../drm/amd/amdkfd/kfd_device_queue_manager_cik.c | 14 +-
3999 .../drm/amd/amdkfd/kfd_device_queue_manager_vi.c | 14 +-
4000 drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c | 4 +-
4001 drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 +-
4002 drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.h | 2 +-
4003 .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 16 +-
4004 drivers/gpu/drm/drm_crtc.c | 2 +-
4005 drivers/gpu/drm/drm_drv.c | 2 +-
4006 drivers/gpu/drm/drm_fops.c | 12 +-
4007 drivers/gpu/drm/drm_global.c | 14 +-
4008 drivers/gpu/drm/drm_info.c | 13 +-
4009 drivers/gpu/drm/drm_ioc32.c | 13 +-
4010 drivers/gpu/drm/drm_ioctl.c | 2 +-
4011 drivers/gpu/drm/gma500/mdfld_dsi_dpi.c | 10 +-
4012 drivers/gpu/drm/i810/i810_drv.h | 4 +-
4013 drivers/gpu/drm/i915/i915_debugfs.c | 2 +-
4014 drivers/gpu/drm/i915/i915_dma.c | 2 +-
4015 drivers/gpu/drm/i915/i915_gem_execbuffer.c | 4 +-
4016 drivers/gpu/drm/i915/i915_gem_gtt.c | 32 +-
4017 drivers/gpu/drm/i915/i915_gem_gtt.h | 16 +-
4018 drivers/gpu/drm/i915/i915_gem_stolen.c | 2 +-
4019 drivers/gpu/drm/i915/i915_ioc32.c | 16 +-
4020 drivers/gpu/drm/i915/intel_display.c | 26 +-
4021 drivers/gpu/drm/imx/imx-drm-core.c | 2 +-
4022 drivers/gpu/drm/mga/mga_drv.h | 4 +-
4023 drivers/gpu/drm/mga/mga_ioc32.c | 10 +-
4024 drivers/gpu/drm/mga/mga_irq.c | 8 +-
4025 drivers/gpu/drm/nouveau/nouveau_bios.c | 2 +-
4026 drivers/gpu/drm/nouveau/nouveau_drm.h | 1 -
4027 drivers/gpu/drm/nouveau/nouveau_ioc32.c | 2 +-
4028 drivers/gpu/drm/nouveau/nouveau_vga.c | 2 +-
4029 drivers/gpu/drm/omapdrm/Makefile | 2 +-
4030 drivers/gpu/drm/qxl/qxl_cmd.c | 12 +-
4031 drivers/gpu/drm/qxl/qxl_debugfs.c | 8 +-
4032 drivers/gpu/drm/qxl/qxl_drv.h | 8 +-
4033 drivers/gpu/drm/qxl/qxl_ioctl.c | 10 +-
4034 drivers/gpu/drm/qxl/qxl_irq.c | 16 +-
4035 drivers/gpu/drm/qxl/qxl_ttm.c | 38 +-
4036 drivers/gpu/drm/r128/r128_cce.c | 2 +-
4037 drivers/gpu/drm/r128/r128_drv.h | 4 +-
4038 drivers/gpu/drm/r128/r128_ioc32.c | 10 +-
4039 drivers/gpu/drm/r128/r128_irq.c | 4 +-
4040 drivers/gpu/drm/r128/r128_state.c | 4 +-
4041 drivers/gpu/drm/radeon/mkregtable.c | 4 +-
4042 drivers/gpu/drm/radeon/radeon_device.c | 2 +-
4043 drivers/gpu/drm/radeon/radeon_drv.h | 2 +-
4044 drivers/gpu/drm/radeon/radeon_ioc32.c | 12 +-
4045 drivers/gpu/drm/radeon/radeon_irq.c | 6 +-
4046 drivers/gpu/drm/radeon/radeon_state.c | 4 +-
4047 drivers/gpu/drm/radeon/radeon_ttm.c | 4 +-
4048 drivers/gpu/drm/tegra/dc.c | 2 +-
4049 drivers/gpu/drm/tegra/dsi.c | 2 +-
4050 drivers/gpu/drm/tegra/hdmi.c | 2 +-
4051 drivers/gpu/drm/tegra/sor.c | 7 +-
4052 drivers/gpu/drm/tilcdc/Makefile | 6 +-
4053 drivers/gpu/drm/ttm/ttm_memory.c | 4 +-
4054 drivers/gpu/drm/ttm/ttm_page_alloc.c | 18 +-
4055 drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 18 +-
4056 drivers/gpu/drm/udl/udl_fb.c | 1 -
4057 drivers/gpu/drm/via/via_drv.h | 4 +-
4058 drivers/gpu/drm/via/via_irq.c | 18 +-
4059 drivers/gpu/drm/virtio/virtgpu_debugfs.c | 2 +-
4060 drivers/gpu/drm/virtio/virtgpu_fence.c | 2 +-
4061 drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 2 +-
4062 drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 8 +-
4063 drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c | 4 +-
4064 drivers/gpu/drm/vmwgfx/vmwgfx_irq.c | 4 +-
4065 drivers/gpu/drm/vmwgfx/vmwgfx_marker.c | 2 +-
4066 drivers/gpu/vga/vga_switcheroo.c | 4 +-
4067 drivers/hid/hid-core.c | 4 +-
4068 drivers/hid/hid-sensor-custom.c | 2 +-
4069 drivers/hv/channel.c | 2 +-
4070 drivers/hv/hv.c | 4 +-
4071 drivers/hv/hv_balloon.c | 18 +-
4072 drivers/hv/hyperv_vmbus.h | 2 +-
4073 drivers/hwmon/acpi_power_meter.c | 6 +-
4074 drivers/hwmon/applesmc.c | 2 +-
4075 drivers/hwmon/asus_atk0110.c | 10 +-
4076 drivers/hwmon/coretemp.c | 2 +-
4077 drivers/hwmon/dell-smm-hwmon.c | 2 +-
4078 drivers/hwmon/ibmaem.c | 2 +-
4079 drivers/hwmon/iio_hwmon.c | 2 +-
4080 drivers/hwmon/nct6683.c | 6 +-
4081 drivers/hwmon/nct6775.c | 6 +-
4082 drivers/hwmon/pmbus/pmbus_core.c | 10 +-
4083 drivers/hwmon/sht15.c | 12 +-
4084 drivers/hwmon/via-cputemp.c | 2 +-
4085 drivers/i2c/busses/i2c-amd756-s4882.c | 2 +-
4086 drivers/i2c/busses/i2c-diolan-u2c.c | 2 +-
4087 drivers/i2c/busses/i2c-nforce2-s4985.c | 2 +-
4088 drivers/i2c/i2c-dev.c | 2 +-
4089 drivers/ide/ide-cd.c | 2 +-
4090 drivers/iio/industrialio-core.c | 2 +-
4091 drivers/iio/magnetometer/ak8975.c | 2 +-
4092 drivers/infiniband/core/cm.c | 32 +-
4093 drivers/infiniband/core/fmr_pool.c | 20 +-
4094 drivers/infiniband/core/uverbs_cmd.c | 3 +
4095 drivers/infiniband/hw/cxgb4/mem.c | 4 +-
4096 drivers/infiniband/hw/ipath/ipath_rc.c | 6 +-
4097 drivers/infiniband/hw/ipath/ipath_ruc.c | 6 +-
4098 drivers/infiniband/hw/mlx4/mad.c | 2 +-
4099 drivers/infiniband/hw/mlx4/mcg.c | 2 +-
4100 drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 +-
4101 drivers/infiniband/hw/mthca/mthca_cmd.c | 8 +-
4102 drivers/infiniband/hw/mthca/mthca_main.c | 2 +-
4103 drivers/infiniband/hw/mthca/mthca_mr.c | 6 +-
4104 drivers/infiniband/hw/mthca/mthca_provider.c | 2 +-
4105 drivers/infiniband/hw/nes/nes.c | 4 +-
4106 drivers/infiniband/hw/nes/nes.h | 40 +-
4107 drivers/infiniband/hw/nes/nes_cm.c | 62 +-
4108 drivers/infiniband/hw/nes/nes_mgt.c | 8 +-
4109 drivers/infiniband/hw/nes/nes_nic.c | 40 +-
4110 drivers/infiniband/hw/nes/nes_verbs.c | 10 +-
4111 drivers/infiniband/hw/qib/qib.h | 1 +
4112 drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 2 +-
4113 drivers/input/gameport/gameport.c | 4 +-
4114 drivers/input/input.c | 4 +-
4115 drivers/input/joystick/sidewinder.c | 1 +
4116 drivers/input/joystick/xpad.c | 4 +-
4117 drivers/input/misc/ims-pcu.c | 4 +-
4118 drivers/input/mouse/psmouse.h | 2 +-
4119 drivers/input/mousedev.c | 2 +-
4120 drivers/input/serio/serio.c | 4 +-
4121 drivers/input/serio/serio_raw.c | 4 +-
4122 drivers/input/touchscreen/htcpen.c | 2 +-
4123 drivers/iommu/arm-smmu.c | 43 +-
4124 drivers/iommu/io-pgtable-arm.c | 101 +-
4125 drivers/iommu/io-pgtable.c | 11 +-
4126 drivers/iommu/io-pgtable.h | 19 +-
4127 drivers/iommu/iommu.c | 2 +-
4128 drivers/iommu/ipmmu-vmsa.c | 13 +-
4129 drivers/iommu/irq_remapping.c | 2 +-
4130 drivers/irqchip/irq-gic.c | 2 +-
4131 drivers/irqchip/irq-renesas-intc-irqpin.c | 2 +-
4132 drivers/irqchip/irq-renesas-irqc.c | 2 +-
4133 drivers/isdn/capi/capi.c | 10 +-
4134 drivers/isdn/gigaset/interface.c | 8 +-
4135 drivers/isdn/gigaset/usb-gigaset.c | 2 +-
4136 drivers/isdn/hardware/avm/b1.c | 4 +-
4137 drivers/isdn/i4l/isdn_common.c | 2 +
4138 drivers/isdn/i4l/isdn_tty.c | 22 +-
4139 drivers/isdn/icn/icn.c | 2 +-
4140 drivers/isdn/mISDN/dsp_cmx.c | 2 +-
4141 drivers/lguest/core.c | 10 +-
4142 drivers/lguest/page_tables.c | 2 +-
4143 drivers/lguest/x86/core.c | 12 +-
4144 drivers/lguest/x86/switcher_32.S | 27 +-
4145 drivers/md/bcache/closure.h | 2 +-
4146 drivers/md/bitmap.c | 2 +-
4147 drivers/md/dm-ioctl.c | 2 +-
4148 drivers/md/dm-raid1.c | 18 +-
4149 drivers/md/dm-stats.c | 6 +-
4150 drivers/md/dm-stripe.c | 10 +-
4151 drivers/md/dm-table.c | 2 +-
4152 drivers/md/dm-thin-metadata.c | 4 +-
4153 drivers/md/dm.c | 16 +-
4154 drivers/md/md.c | 26 +-
4155 drivers/md/md.h | 6 +-
4156 drivers/md/persistent-data/dm-space-map-metadata.c | 4 +-
4157 drivers/md/persistent-data/dm-space-map.h | 1 +
4158 drivers/md/raid1.c | 4 +-
4159 drivers/md/raid10.c | 16 +-
4160 drivers/md/raid5.c | 22 +-
4161 drivers/media/dvb-core/dvbdev.c | 2 +-
4162 drivers/media/dvb-frontends/af9033.h | 2 +-
4163 drivers/media/dvb-frontends/dib3000.h | 2 +-
4164 drivers/media/dvb-frontends/dib7000p.h | 2 +-
4165 drivers/media/dvb-frontends/dib8000.h | 2 +-
4166 drivers/media/pci/cx88/cx88-video.c | 6 +-
4167 drivers/media/pci/ivtv/ivtv-driver.c | 2 +-
4168 drivers/media/pci/solo6x10/solo6x10-core.c | 2 +-
4169 drivers/media/pci/solo6x10/solo6x10-p2m.c | 2 +-
4170 drivers/media/pci/solo6x10/solo6x10.h | 2 +-
4171 drivers/media/pci/tw68/tw68-core.c | 2 +-
4172 drivers/media/platform/omap/omap_vout.c | 11 +-
4173 drivers/media/platform/s5p-tv/mixer.h | 2 +-
4174 drivers/media/platform/s5p-tv/mixer_grp_layer.c | 2 +-
4175 drivers/media/platform/s5p-tv/mixer_reg.c | 2 +-
4176 drivers/media/platform/s5p-tv/mixer_video.c | 24 +-
4177 drivers/media/platform/s5p-tv/mixer_vp_layer.c | 2 +-
4178 drivers/media/radio/radio-cadet.c | 2 +
4179 drivers/media/radio/radio-maxiradio.c | 2 +-
4180 drivers/media/radio/radio-shark.c | 2 +-
4181 drivers/media/radio/radio-shark2.c | 2 +-
4182 drivers/media/radio/radio-si476x.c | 2 +-
4183 drivers/media/radio/wl128x/fmdrv_common.c | 2 +-
4184 drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 12 +-
4185 drivers/media/v4l2-core/v4l2-device.c | 4 +-
4186 drivers/media/v4l2-core/v4l2-ioctl.c | 13 +-
4187 drivers/memory/omap-gpmc.c | 21 +-
4188 drivers/message/fusion/mptsas.c | 34 +-
4189 drivers/mfd/ab8500-debugfs.c | 2 +-
4190 drivers/mfd/kempld-core.c | 2 +-
4191 drivers/mfd/max8925-i2c.c | 2 +-
4192 drivers/mfd/tps65910.c | 2 +-
4193 drivers/mfd/twl4030-irq.c | 9 +-
4194 drivers/misc/c2port/core.c | 4 +-
4195 drivers/misc/eeprom/sunxi_sid.c | 4 +-
4196 drivers/misc/kgdbts.c | 4 +-
4197 drivers/misc/lis3lv02d/lis3lv02d.c | 8 +-
4198 drivers/misc/lis3lv02d/lis3lv02d.h | 2 +-
4199 drivers/misc/mic/scif/scif_rb.c | 8 +-
4200 drivers/misc/sgi-gru/gruhandles.c | 4 +-
4201 drivers/misc/sgi-gru/gruprocfs.c | 8 +-
4202 drivers/misc/sgi-gru/grutables.h | 154 +-
4203 drivers/misc/sgi-xp/xp.h | 2 +-
4204 drivers/misc/sgi-xp/xpc.h | 3 +-
4205 drivers/misc/sgi-xp/xpc_main.c | 2 +-
4206 drivers/mmc/card/block.c | 2 +-
4207 drivers/mmc/host/dw_mmc.h | 2 +-
4208 drivers/mmc/host/mmci.c | 4 +-
4209 drivers/mmc/host/omap_hsmmc.c | 4 +-
4210 drivers/mmc/host/sdhci-esdhc-imx.c | 7 +-
4211 drivers/mmc/host/sdhci-s3c.c | 8 +-
4212 drivers/mtd/chips/cfi_cmdset_0020.c | 2 +-
4213 drivers/mtd/nand/denali.c | 1 +
4214 drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 2 +-
4215 drivers/mtd/nftlmount.c | 1 +
4216 drivers/mtd/sm_ftl.c | 2 +-
4217 drivers/net/bonding/bond_netlink.c | 2 +-
4218 drivers/net/caif/caif_hsi.c | 2 +-
4219 drivers/net/can/Kconfig | 2 +-
4220 drivers/net/can/dev.c | 2 +-
4221 drivers/net/can/vcan.c | 2 +-
4222 drivers/net/dummy.c | 2 +-
4223 drivers/net/ethernet/8390/ax88796.c | 4 +-
4224 drivers/net/ethernet/altera/altera_tse_main.c | 4 +-
4225 drivers/net/ethernet/amd/xgbe/xgbe-common.h | 4 +-
4226 drivers/net/ethernet/amd/xgbe/xgbe-dcb.c | 4 +-
4227 drivers/net/ethernet/amd/xgbe/xgbe-desc.c | 27 +-
4228 drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 143 +-
4229 drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 64 +-
4230 drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 10 +-
4231 drivers/net/ethernet/amd/xgbe/xgbe-main.c | 15 +-
4232 drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 27 +-
4233 drivers/net/ethernet/amd/xgbe/xgbe-ptp.c | 4 +-
4234 drivers/net/ethernet/amd/xgbe/xgbe.h | 10 +-
4235 drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 2 +-
4236 drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c | 11 +-
4237 drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 3 +-
4238 drivers/net/ethernet/broadcom/tg3.h | 1 +
4239 drivers/net/ethernet/cavium/liquidio/lio_ethtool.c | 6 +-
4240 drivers/net/ethernet/cavium/liquidio/lio_main.c | 11 +-
4241 drivers/net/ethernet/chelsio/cxgb3/l2t.h | 2 +-
4242 drivers/net/ethernet/dec/tulip/de4x5.c | 4 +-
4243 drivers/net/ethernet/emulex/benet/be_main.c | 2 +-
4244 drivers/net/ethernet/faraday/ftgmac100.c | 2 +
4245 drivers/net/ethernet/faraday/ftmac100.c | 2 +
4246 drivers/net/ethernet/intel/i40e/i40e_ptp.c | 2 +-
4247 drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 2 +-
4248 drivers/net/ethernet/mellanox/mlx4/en_tx.c | 4 +-
4249 drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +-
4250 drivers/net/ethernet/neterion/vxge/vxge-config.c | 7 +-
4251 .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 4 +-
4252 .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c | 12 +-
4253 .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 +-
4254 drivers/net/ethernet/realtek/r8169.c | 8 +-
4255 drivers/net/ethernet/sfc/ptp.c | 2 +-
4256 drivers/net/ethernet/stmicro/stmmac/mmc_core.c | 4 +-
4257 drivers/net/ethernet/via/via-rhine.c | 2 +-
4258 drivers/net/hyperv/hyperv_net.h | 2 +-
4259 drivers/net/hyperv/rndis_filter.c | 4 +-
4260 drivers/net/ifb.c | 2 +-
4261 drivers/net/ipvlan/ipvlan_core.c | 2 +-
4262 drivers/net/macvlan.c | 20 +-
4263 drivers/net/macvtap.c | 6 +-
4264 drivers/net/nlmon.c | 2 +-
4265 drivers/net/phy/phy_device.c | 6 +-
4266 drivers/net/ppp/ppp_generic.c | 4 +-
4267 drivers/net/slip/slhc.c | 2 +-
4268 drivers/net/team/team.c | 4 +-
4269 drivers/net/tun.c | 7 +-
4270 drivers/net/usb/hso.c | 23 +-
4271 drivers/net/usb/r8152.c | 2 +-
4272 drivers/net/usb/sierra_net.c | 4 +-
4273 drivers/net/virtio_net.c | 2 +-
4274 drivers/net/vxlan.c | 4 +-
4275 drivers/net/wimax/i2400m/rx.c | 2 +-
4276 drivers/net/wireless/airo.c | 2 +-
4277 drivers/net/wireless/at76c50x-usb.c | 2 +-
4278 drivers/net/wireless/ath/ath10k/htc.c | 7 +-
4279 drivers/net/wireless/ath/ath10k/htc.h | 4 +-
4280 drivers/net/wireless/ath/ath9k/ar9002_mac.c | 36 +-
4281 drivers/net/wireless/ath/ath9k/ar9003_mac.c | 64 +-
4282 drivers/net/wireless/ath/ath9k/hw.h | 4 +-
4283 drivers/net/wireless/ath/ath9k/main.c | 22 +-
4284 drivers/net/wireless/b43/phy_lp.c | 2 +-
4285 drivers/net/wireless/iwlegacy/3945-mac.c | 4 +-
4286 drivers/net/wireless/iwlwifi/dvm/debugfs.c | 34 +-
4287 drivers/net/wireless/iwlwifi/pcie/trans.c | 4 +-
4288 drivers/net/wireless/mac80211_hwsim.c | 28 +-
4289 drivers/net/wireless/rndis_wlan.c | 2 +-
4290 drivers/net/wireless/rt2x00/rt2x00.h | 2 +-
4291 drivers/net/wireless/rt2x00/rt2x00queue.c | 4 +-
4292 drivers/net/wireless/ti/wl1251/sdio.c | 12 +-
4293 drivers/net/wireless/ti/wl12xx/main.c | 8 +-
4294 drivers/net/wireless/ti/wl18xx/main.c | 6 +-
4295 drivers/nfc/nfcwilink.c | 2 +-
4296 drivers/of/fdt.c | 4 +-
4297 drivers/oprofile/buffer_sync.c | 8 +-
4298 drivers/oprofile/event_buffer.c | 2 +-
4299 drivers/oprofile/oprof.c | 2 +-
4300 drivers/oprofile/oprofile_files.c | 2 +-
4301 drivers/oprofile/oprofile_stats.c | 10 +-
4302 drivers/oprofile/oprofile_stats.h | 10 +-
4303 drivers/oprofile/oprofilefs.c | 6 +-
4304 drivers/oprofile/timer_int.c | 2 +-
4305 drivers/parport/procfs.c | 4 +-
4306 drivers/pci/host/pci-host-generic.c | 24 +-
4307 drivers/pci/hotplug/acpiphp_ibm.c | 4 +-
4308 drivers/pci/hotplug/cpcihp_generic.c | 6 +-
4309 drivers/pci/hotplug/cpcihp_zt5550.c | 14 +-
4310 drivers/pci/hotplug/cpqphp_nvram.c | 2 +
4311 drivers/pci/hotplug/pci_hotplug_core.c | 6 +-
4312 drivers/pci/hotplug/pciehp_core.c | 2 +-
4313 drivers/pci/msi.c | 21 +-
4314 drivers/pci/pci-sysfs.c | 6 +-
4315 drivers/pci/pci.h | 2 +-
4316 drivers/pci/pcie/aspm.c | 6 +-
4317 drivers/pci/pcie/portdrv_pci.c | 2 +-
4318 drivers/pci/probe.c | 2 +-
4319 drivers/pinctrl/pinctrl-at91.c | 5 +-
4320 drivers/platform/chrome/chromeos_pstore.c | 2 +-
4321 drivers/platform/x86/alienware-wmi.c | 4 +-
4322 drivers/platform/x86/compal-laptop.c | 2 +-
4323 drivers/platform/x86/hdaps.c | 2 +-
4324 drivers/platform/x86/ibm_rtl.c | 2 +-
4325 drivers/platform/x86/intel_oaktrail.c | 2 +-
4326 drivers/platform/x86/msi-laptop.c | 16 +-
4327 drivers/platform/x86/msi-wmi.c | 2 +-
4328 drivers/platform/x86/samsung-laptop.c | 2 +-
4329 drivers/platform/x86/samsung-q10.c | 2 +-
4330 drivers/platform/x86/sony-laptop.c | 14 +-
4331 drivers/platform/x86/thinkpad_acpi.c | 2 +-
4332 drivers/pnp/pnpbios/bioscalls.c | 14 +-
4333 drivers/pnp/pnpbios/core.c | 2 +-
4334 drivers/power/pda_power.c | 7 +-
4335 drivers/power/power_supply.h | 4 +-
4336 drivers/power/power_supply_core.c | 7 +-
4337 drivers/power/power_supply_sysfs.c | 6 +-
4338 drivers/power/reset/at91-reset.c | 9 +-
4339 drivers/powercap/powercap_sys.c | 136 +-
4340 drivers/ptp/ptp_private.h | 2 +-
4341 drivers/ptp/ptp_sysfs.c | 2 +-
4342 drivers/regulator/core.c | 4 +-
4343 drivers/regulator/max8660.c | 6 +-
4344 drivers/regulator/max8973-regulator.c | 16 +-
4345 drivers/regulator/mc13892-regulator.c | 8 +-
4346 drivers/rtc/rtc-armada38x.c | 7 +-
4347 drivers/rtc/rtc-cmos.c | 4 +-
4348 drivers/rtc/rtc-ds1307.c | 2 +-
4349 drivers/rtc/rtc-m48t59.c | 4 +-
4350 drivers/rtc/rtc-test.c | 6 +-
4351 drivers/scsi/be2iscsi/be_main.c | 2 +-
4352 drivers/scsi/bfa/bfa_fcpim.h | 2 +-
4353 drivers/scsi/bfa/bfa_ioc.h | 4 +-
4354 drivers/scsi/fcoe/fcoe_sysfs.c | 12 +-
4355 drivers/scsi/hosts.c | 4 +-
4356 drivers/scsi/hpsa.c | 38 +-
4357 drivers/scsi/hpsa.h | 2 +-
4358 drivers/scsi/libfc/fc_exch.c | 50 +-
4359 drivers/scsi/libsas/sas_ata.c | 2 +-
4360 drivers/scsi/lpfc/lpfc.h | 8 +-
4361 drivers/scsi/lpfc/lpfc_debugfs.c | 18 +-
4362 drivers/scsi/lpfc/lpfc_init.c | 6 +-
4363 drivers/scsi/lpfc/lpfc_scsi.c | 10 +-
4364 drivers/scsi/mpt2sas/mpt2sas_scsih.c | 8 +-
4365 drivers/scsi/pmcraid.c | 20 +-
4366 drivers/scsi/pmcraid.h | 8 +-
4367 drivers/scsi/qla2xxx/qla_attr.c | 4 +-
4368 drivers/scsi/qla2xxx/qla_gbl.h | 4 +-
4369 drivers/scsi/qla2xxx/qla_os.c | 6 +-
4370 drivers/scsi/qla4xxx/ql4_def.h | 2 +-
4371 drivers/scsi/qla4xxx/ql4_os.c | 6 +-
4372 drivers/scsi/scsi.c | 2 +-
4373 drivers/scsi/scsi_lib.c | 8 +-
4374 drivers/scsi/scsi_sysfs.c | 2 +-
4375 drivers/scsi/scsi_transport_fc.c | 8 +-
4376 drivers/scsi/scsi_transport_iscsi.c | 6 +-
4377 drivers/scsi/scsi_transport_srp.c | 6 +-
4378 drivers/scsi/sd.c | 6 +-
4379 drivers/scsi/sg.c | 2 +-
4380 drivers/scsi/sr.c | 21 +-
4381 drivers/soc/tegra/fuse/fuse-tegra.c | 2 +-
4382 drivers/spi/spi.c | 2 +-
4383 drivers/spi/spidev.c | 2 +-
4384 drivers/staging/android/timed_output.c | 6 +-
4385 drivers/staging/comedi/comedi_fops.c | 8 +-
4386 drivers/staging/fbtft/fbtft-core.c | 2 +-
4387 drivers/staging/fbtft/fbtft.h | 2 +-
4388 drivers/staging/gdm724x/gdm_tty.c | 2 +-
4389 drivers/staging/iio/accel/lis3l02dq_ring.c | 2 +-
4390 drivers/staging/iio/adc/ad7280a.c | 4 +-
4391 drivers/staging/lustre/lnet/selftest/brw_test.c | 12 +-
4392 drivers/staging/lustre/lnet/selftest/framework.c | 4 -
4393 drivers/staging/lustre/lnet/selftest/ping_test.c | 14 +-
4394 drivers/staging/lustre/lustre/include/lustre_dlm.h | 2 +-
4395 drivers/staging/lustre/lustre/include/obd.h | 2 +-
4396 drivers/staging/lustre/lustre/libcfs/module.c | 6 +-
4397 drivers/staging/octeon/ethernet-rx.c | 12 +-
4398 drivers/staging/octeon/ethernet.c | 8 +-
4399 drivers/staging/rtl8188eu/include/hal_intf.h | 2 +-
4400 drivers/staging/rtl8712/rtl871x_io.h | 2 +-
4401 drivers/staging/sm750fb/sm750.c | 14 +-
4402 drivers/staging/unisys/visorbus/visorbus_private.h | 4 +-
4403 drivers/target/sbp/sbp_target.c | 4 +-
4404 drivers/target/target_core_device.c | 2 +-
4405 drivers/target/target_core_transport.c | 2 +-
4406 drivers/thermal/cpu_cooling.c | 9 +-
4407 drivers/thermal/int340x_thermal/int3400_thermal.c | 6 +-
4408 drivers/thermal/of-thermal.c | 17 +-
4409 drivers/thermal/x86_pkg_temp_thermal.c | 2 +-
4410 drivers/tty/cyclades.c | 6 +-
4411 drivers/tty/hvc/hvc_console.c | 14 +-
4412 drivers/tty/hvc/hvcs.c | 21 +-
4413 drivers/tty/hvc/hvsi.c | 22 +-
4414 drivers/tty/hvc/hvsi_lib.c | 4 +-
4415 drivers/tty/ipwireless/tty.c | 27 +-
4416 drivers/tty/moxa.c | 2 +-
4417 drivers/tty/n_gsm.c | 4 +-
4418 drivers/tty/n_tty.c | 5 +-
4419 drivers/tty/pty.c | 4 +-
4420 drivers/tty/rocket.c | 6 +-
4421 drivers/tty/serial/8250/8250_core.c | 10 +-
4422 drivers/tty/serial/ifx6x60.c | 2 +-
4423 drivers/tty/serial/ioc4_serial.c | 6 +-
4424 drivers/tty/serial/kgdb_nmi.c | 4 +-
4425 drivers/tty/serial/kgdboc.c | 32 +-
4426 drivers/tty/serial/msm_serial.c | 4 +-
4427 drivers/tty/serial/samsung.c | 9 +-
4428 drivers/tty/serial/serial_core.c | 8 +-
4429 drivers/tty/synclink.c | 34 +-
4430 drivers/tty/synclink_gt.c | 28 +-
4431 drivers/tty/synclinkmp.c | 34 +-
4432 drivers/tty/tty_io.c | 2 +-
4433 drivers/tty/tty_ldisc.c | 8 +-
4434 drivers/tty/tty_port.c | 22 +-
4435 drivers/uio/uio.c | 13 +-
4436 drivers/usb/atm/cxacru.c | 2 +-
4437 drivers/usb/atm/usbatm.c | 24 +-
4438 drivers/usb/core/devices.c | 6 +-
4439 drivers/usb/core/devio.c | 10 +-
4440 drivers/usb/core/hcd.c | 4 +-
4441 drivers/usb/core/message.c | 6 +-
4442 drivers/usb/core/sysfs.c | 2 +-
4443 drivers/usb/core/usb.c | 2 +-
4444 drivers/usb/early/ehci-dbgp.c | 16 +-
4445 drivers/usb/gadget/function/u_serial.c | 22 +-
4446 drivers/usb/gadget/udc/dummy_hcd.c | 2 +-
4447 drivers/usb/host/ehci-hcd.c | 2 +-
4448 drivers/usb/host/ehci-hub.c | 4 +-
4449 drivers/usb/host/ehci-q.c | 4 +-
4450 drivers/usb/host/fotg210-hcd.c | 2 +-
4451 drivers/usb/host/fusbh200-hcd.c | 2 +-
4452 drivers/usb/host/hwa-hc.c | 2 +-
4453 drivers/usb/host/ohci-hcd.c | 2 +-
4454 drivers/usb/host/r8a66597.h | 2 +-
4455 drivers/usb/host/uhci-hcd.c | 2 +-
4456 drivers/usb/host/xhci-pci.c | 2 +-
4457 drivers/usb/host/xhci.c | 2 +-
4458 drivers/usb/misc/appledisplay.c | 4 +-
4459 drivers/usb/serial/console.c | 8 +-
4460 drivers/usb/storage/usb.c | 2 +-
4461 drivers/usb/storage/usb.h | 2 +-
4462 drivers/usb/usbip/vhci.h | 2 +-
4463 drivers/usb/usbip/vhci_hcd.c | 6 +-
4464 drivers/usb/usbip/vhci_rx.c | 2 +-
4465 drivers/usb/wusbcore/wa-hc.h | 4 +-
4466 drivers/usb/wusbcore/wa-xfer.c | 2 +-
4467 drivers/vfio/vfio.c | 2 +-
4468 drivers/vhost/vringh.c | 20 +-
4469 drivers/video/backlight/kb3886_bl.c | 2 +-
4470 drivers/video/fbdev/aty/aty128fb.c | 2 +-
4471 drivers/video/fbdev/aty/atyfb_base.c | 8 +-
4472 drivers/video/fbdev/aty/mach64_cursor.c | 5 +-
4473 drivers/video/fbdev/core/fb_defio.c | 6 +-
4474 drivers/video/fbdev/core/fbmem.c | 2 +-
4475 drivers/video/fbdev/hyperv_fb.c | 4 +-
4476 drivers/video/fbdev/i810/i810_accel.c | 1 +
4477 drivers/video/fbdev/matrox/matroxfb_base.c | 2 +-
4478 drivers/video/fbdev/mb862xx/mb862xxfb_accel.c | 16 +-
4479 drivers/video/fbdev/nvidia/nvidia.c | 27 +-
4480 drivers/video/fbdev/omap2/dss/display.c | 8 +-
4481 drivers/video/fbdev/s1d13xxxfb.c | 6 +-
4482 drivers/video/fbdev/smscufx.c | 4 +-
4483 drivers/video/fbdev/udlfb.c | 36 +-
4484 drivers/video/fbdev/uvesafb.c | 52 +-
4485 drivers/video/fbdev/vesafb.c | 58 +-
4486 drivers/video/fbdev/via/via_clock.h | 2 +-
4487 drivers/xen/events/events_base.c | 6 +-
4488 drivers/xen/evtchn.c | 4 +-
4489 fs/Kconfig.binfmt | 2 +-
4490 fs/afs/inode.c | 4 +-
4491 fs/aio.c | 2 +-
4492 fs/autofs4/waitq.c | 2 +-
4493 fs/befs/endian.h | 6 +-
4494 fs/binfmt_aout.c | 23 +-
4495 fs/binfmt_elf.c | 672 +-
4496 fs/binfmt_elf_fdpic.c | 2 +-
4497 fs/block_dev.c | 2 +-
4498 fs/btrfs/ctree.c | 9 +-
4499 fs/btrfs/delayed-inode.c | 6 +-
4500 fs/btrfs/delayed-inode.h | 4 +-
4501 fs/btrfs/super.c | 2 +-
4502 fs/btrfs/sysfs.c | 2 +-
4503 fs/btrfs/tests/free-space-tests.c | 8 +-
4504 fs/btrfs/tree-log.h | 2 +-
4505 fs/buffer.c | 2 +-
4506 fs/cachefiles/bind.c | 6 +-
4507 fs/cachefiles/daemon.c | 8 +-
4508 fs/cachefiles/internal.h | 12 +-
4509 fs/cachefiles/namei.c | 2 +-
4510 fs/cachefiles/proc.c | 12 +-
4511 fs/ceph/dir.c | 12 +-
4512 fs/ceph/super.c | 4 +-
4513 fs/cifs/cifs_debug.c | 12 +-
4514 fs/cifs/cifsfs.c | 8 +-
4515 fs/cifs/cifsglob.h | 54 +-
4516 fs/cifs/file.c | 10 +-
4517 fs/cifs/misc.c | 4 +-
4518 fs/cifs/smb1ops.c | 80 +-
4519 fs/cifs/smb2ops.c | 84 +-
4520 fs/cifs/smb2pdu.c | 3 +-
4521 fs/coda/cache.c | 10 +-
4522 fs/compat.c | 4 +-
4523 fs/compat_binfmt_elf.c | 2 +
4524 fs/compat_ioctl.c | 12 +-
4525 fs/configfs/dir.c | 10 +-
4526 fs/coredump.c | 16 +-
4527 fs/dcache.c | 51 +-
4528 fs/ecryptfs/inode.c | 2 +-
4529 fs/ecryptfs/miscdev.c | 2 +-
4530 fs/exec.c | 362 +-
4531 fs/ext2/xattr.c | 5 +-
4532 fs/ext3/xattr.c | 5 +-
4533 fs/ext4/ext4.h | 20 +-
4534 fs/ext4/mballoc.c | 44 +-
4535 fs/ext4/mmp.c | 2 +-
4536 fs/ext4/resize.c | 16 +-
4537 fs/ext4/super.c | 4 +-
4538 fs/ext4/xattr.c | 5 +-
4539 fs/fhandle.c | 3 +-
4540 fs/file.c | 4 +-
4541 fs/fs_struct.c | 8 +-
4542 fs/fscache/cookie.c | 40 +-
4543 fs/fscache/internal.h | 202 +-
4544 fs/fscache/object.c | 26 +-
4545 fs/fscache/operation.c | 38 +-
4546 fs/fscache/page.c | 110 +-
4547 fs/fscache/stats.c | 348 +-
4548 fs/fuse/cuse.c | 10 +-
4549 fs/fuse/dev.c | 4 +-
4550 fs/gfs2/glock.c | 22 +-
4551 fs/gfs2/glops.c | 4 +-
4552 fs/gfs2/quota.c | 6 +-
4553 fs/hugetlbfs/inode.c | 13 +-
4554 fs/inode.c | 4 +-
4555 fs/jffs2/erase.c | 3 +-
4556 fs/jffs2/wbuf.c | 3 +-
4557 fs/jfs/super.c | 2 +-
4558 fs/kernfs/dir.c | 2 +-
4559 fs/kernfs/file.c | 20 +-
4560 fs/libfs.c | 10 +-
4561 fs/lockd/clntproc.c | 4 +-
4562 fs/namei.c | 16 +-
4563 fs/namespace.c | 16 +-
4564 fs/nfs/callback_xdr.c | 2 +-
4565 fs/nfs/inode.c | 6 +-
4566 fs/nfsd/nfs4proc.c | 2 +-
4567 fs/nfsd/nfs4xdr.c | 2 +-
4568 fs/nfsd/nfscache.c | 11 +-
4569 fs/nfsd/vfs.c | 6 +-
4570 fs/nls/nls_base.c | 26 +-
4571 fs/nls/nls_euc-jp.c | 6 +-
4572 fs/nls/nls_koi8-ru.c | 6 +-
4573 fs/notify/fanotify/fanotify_user.c | 4 +-
4574 fs/notify/notification.c | 4 +-
4575 fs/ntfs/dir.c | 2 +-
4576 fs/ntfs/super.c | 6 +-
4577 fs/ocfs2/localalloc.c | 2 +-
4578 fs/ocfs2/ocfs2.h | 10 +-
4579 fs/ocfs2/suballoc.c | 12 +-
4580 fs/ocfs2/super.c | 20 +-
4581 fs/pipe.c | 72 +-
4582 fs/posix_acl.c | 4 +-
4583 fs/proc/array.c | 20 +
4584 fs/proc/base.c | 4 +-
4585 fs/proc/kcore.c | 34 +-
4586 fs/proc/meminfo.c | 2 +-
4587 fs/proc/nommu.c | 2 +-
4588 fs/proc/proc_sysctl.c | 26 +-
4589 fs/proc/task_mmu.c | 39 +-
4590 fs/proc/task_nommu.c | 4 +-
4591 fs/proc/vmcore.c | 16 +-
4592 fs/qnx6/qnx6.h | 4 +-
4593 fs/quota/netlink.c | 4 +-
4594 fs/read_write.c | 2 +-
4595 fs/reiserfs/do_balan.c | 2 +-
4596 fs/reiserfs/procfs.c | 2 +-
4597 fs/reiserfs/reiserfs.h | 4 +-
4598 fs/seq_file.c | 4 +-
4599 fs/splice.c | 43 +-
4600 fs/squashfs/xattr.c | 12 +-
4601 fs/sysv/sysv.h | 2 +-
4602 fs/tracefs/inode.c | 8 +-
4603 fs/ubifs/io.c | 2 +-
4604 fs/udf/misc.c | 2 +-
4605 fs/ufs/swab.h | 4 +-
4606 fs/xattr.c | 21 +
4607 fs/xfs/libxfs/xfs_bmap.c | 2 +-
4608 fs/xfs/xfs_dir2_readdir.c | 7 +-
4609 fs/xfs/xfs_ioctl.c | 2 +-
4610 fs/xfs/xfs_linux.h | 4 +-
4611 include/asm-generic/4level-fixup.h | 2 +
4612 include/asm-generic/atomic-long.h | 214 +-
4613 include/asm-generic/atomic64.h | 12 +
4614 include/asm-generic/barrier.h | 2 +-
4615 include/asm-generic/bitops/__fls.h | 2 +-
4616 include/asm-generic/bitops/fls.h | 2 +-
4617 include/asm-generic/bitops/fls64.h | 4 +-
4618 include/asm-generic/bug.h | 6 +-
4619 include/asm-generic/cache.h | 4 +-
4620 include/asm-generic/emergency-restart.h | 2 +-
4621 include/asm-generic/kmap_types.h | 4 +-
4622 include/asm-generic/local.h | 13 +
4623 include/asm-generic/pgtable-nopmd.h | 18 +-
4624 include/asm-generic/pgtable-nopud.h | 15 +-
4625 include/asm-generic/pgtable.h | 16 +
4626 include/asm-generic/uaccess.h | 16 +
4627 include/asm-generic/vmlinux.lds.h | 13 +-
4628 include/crypto/algapi.h | 2 +-
4629 include/drm/drmP.h | 16 +-
4630 include/drm/drm_crtc_helper.h | 2 +-
4631 include/drm/drm_mm.h | 2 +-
4632 include/drm/i915_pciids.h | 2 +-
4633 include/drm/intel-gtt.h | 4 +-
4634 include/drm/ttm/ttm_memory.h | 2 +-
4635 include/drm/ttm/ttm_page_alloc.h | 1 +
4636 include/keys/asymmetric-subtype.h | 2 +-
4637 include/linux/atmdev.h | 4 +-
4638 include/linux/atomic.h | 2 +-
4639 include/linux/audit.h | 2 +-
4640 include/linux/binfmts.h | 3 +-
4641 include/linux/bitmap.h | 2 +-
4642 include/linux/bitops.h | 8 +-
4643 include/linux/blkdev.h | 2 +-
4644 include/linux/blktrace_api.h | 2 +-
4645 include/linux/cache.h | 8 +
4646 include/linux/cdrom.h | 1 -
4647 include/linux/cleancache.h | 2 +-
4648 include/linux/clk-provider.h | 1 +
4649 include/linux/compat.h | 6 +-
4650 include/linux/compiler-gcc.h | 28 +-
4651 include/linux/compiler.h | 95 +-
4652 include/linux/completion.h | 12 +-
4653 include/linux/configfs.h | 2 +-
4654 include/linux/cpufreq.h | 3 +-
4655 include/linux/cpuidle.h | 5 +-
4656 include/linux/cpumask.h | 14 +-
4657 include/linux/crypto.h | 4 +-
4658 include/linux/ctype.h | 2 +-
4659 include/linux/dcache.h | 4 +-
4660 include/linux/decompress/mm.h | 2 +-
4661 include/linux/devfreq.h | 2 +-
4662 include/linux/device.h | 7 +-
4663 include/linux/dma-mapping.h | 2 +-
4664 include/linux/efi.h | 1 +
4665 include/linux/elf.h | 2 +
4666 include/linux/err.h | 4 +-
4667 include/linux/extcon.h | 2 +-
4668 include/linux/fb.h | 3 +-
4669 include/linux/fdtable.h | 2 +-
4670 include/linux/fs.h | 5 +-
4671 include/linux/fs_struct.h | 2 +-
4672 include/linux/fscache-cache.h | 2 +-
4673 include/linux/fscache.h | 2 +-
4674 include/linux/fsnotify.h | 2 +-
4675 include/linux/genhd.h | 4 +-
4676 include/linux/genl_magic_func.h | 2 +-
4677 include/linux/gfp.h | 12 +-
4678 include/linux/highmem.h | 12 +
4679 include/linux/hwmon-sysfs.h | 6 +-
4680 include/linux/i2c.h | 1 +
4681 include/linux/if_pppox.h | 2 +-
4682 include/linux/init.h | 12 +-
4683 include/linux/init_task.h | 7 +
4684 include/linux/interrupt.h | 6 +-
4685 include/linux/iommu.h | 2 +-
4686 include/linux/ioport.h | 2 +-
4687 include/linux/ipc.h | 2 +-
4688 include/linux/irq.h | 5 +-
4689 include/linux/irqdesc.h | 2 +-
4690 include/linux/irqdomain.h | 3 +
4691 include/linux/jiffies.h | 30 +-
4692 include/linux/kernel.h | 2 +-
4693 include/linux/key-type.h | 2 +-
4694 include/linux/kgdb.h | 6 +-
4695 include/linux/kmemleak.h | 4 +-
4696 include/linux/kobject.h | 3 +-
4697 include/linux/kobject_ns.h | 2 +-
4698 include/linux/kref.h | 2 +-
4699 include/linux/kvm_host.h | 4 +-
4700 include/linux/libata.h | 2 +-
4701 include/linux/linkage.h | 1 +
4702 include/linux/list.h | 15 +
4703 include/linux/lockref.h | 26 +-
4704 include/linux/math64.h | 10 +-
4705 include/linux/mempolicy.h | 7 +
4706 include/linux/mm.h | 104 +-
4707 include/linux/mm_types.h | 20 +
4708 include/linux/mmiotrace.h | 4 +-
4709 include/linux/mmzone.h | 2 +-
4710 include/linux/mod_devicetable.h | 4 +-
4711 include/linux/module.h | 69 +-
4712 include/linux/moduleloader.h | 16 +
4713 include/linux/moduleparam.h | 4 +-
4714 include/linux/net.h | 2 +-
4715 include/linux/netdevice.h | 7 +-
4716 include/linux/netfilter.h | 2 +-
4717 include/linux/netfilter/nfnetlink.h | 2 +-
4718 include/linux/nls.h | 4 +-
4719 include/linux/notifier.h | 3 +-
4720 include/linux/oprofile.h | 4 +-
4721 include/linux/padata.h | 2 +-
4722 include/linux/pci_hotplug.h | 3 +-
4723 include/linux/percpu.h | 2 +-
4724 include/linux/perf_event.h | 12 +-
4725 include/linux/pipe_fs_i.h | 8 +-
4726 include/linux/pm.h | 1 +
4727 include/linux/pm_domain.h | 4 +-
4728 include/linux/pm_runtime.h | 2 +-
4729 include/linux/pnp.h | 2 +-
4730 include/linux/poison.h | 4 +-
4731 include/linux/power/smartreflex.h | 2 +-
4732 include/linux/ppp-comp.h | 2 +-
4733 include/linux/preempt.h | 21 +
4734 include/linux/proc_ns.h | 2 +-
4735 include/linux/quota.h | 2 +-
4736 include/linux/random.h | 23 +-
4737 include/linux/rculist.h | 16 +
4738 include/linux/reboot.h | 14 +-
4739 include/linux/regset.h | 3 +-
4740 include/linux/relay.h | 2 +-
4741 include/linux/rio.h | 2 +-
4742 include/linux/rmap.h | 4 +-
4743 include/linux/sched.h | 74 +-
4744 include/linux/sched/sysctl.h | 1 +
4745 include/linux/semaphore.h | 2 +-
4746 include/linux/seq_file.h | 1 +
4747 include/linux/signal.h | 2 +-
4748 include/linux/skbuff.h | 10 +-
4749 include/linux/slab.h | 47 +-
4750 include/linux/slab_def.h | 14 +-
4751 include/linux/slub_def.h | 2 +-
4752 include/linux/smp.h | 2 +
4753 include/linux/sock_diag.h | 2 +-
4754 include/linux/sonet.h | 2 +-
4755 include/linux/sunrpc/addr.h | 8 +-
4756 include/linux/sunrpc/clnt.h | 2 +-
4757 include/linux/sunrpc/svc.h | 2 +-
4758 include/linux/sunrpc/svc_rdma.h | 18 +-
4759 include/linux/sunrpc/svcauth.h | 2 +-
4760 include/linux/swiotlb.h | 3 +-
4761 include/linux/syscalls.h | 21 +-
4762 include/linux/syscore_ops.h | 2 +-
4763 include/linux/sysctl.h | 3 +-
4764 include/linux/sysfs.h | 9 +-
4765 include/linux/sysrq.h | 3 +-
4766 include/linux/tcp.h | 14 +-
4767 include/linux/thread_info.h | 7 +
4768 include/linux/tty.h | 4 +-
4769 include/linux/tty_driver.h | 2 +-
4770 include/linux/tty_ldisc.h | 2 +-
4771 include/linux/types.h | 16 +
4772 include/linux/uaccess.h | 6 +-
4773 include/linux/uio_driver.h | 2 +-
4774 include/linux/unaligned/access_ok.h | 24 +-
4775 include/linux/usb.h | 6 +-
4776 include/linux/usb/hcd.h | 1 +
4777 include/linux/usb/renesas_usbhs.h | 2 +-
4778 include/linux/vermagic.h | 21 +-
4779 include/linux/vga_switcheroo.h | 8 +-
4780 include/linux/vmalloc.h | 7 +-
4781 include/linux/vmstat.h | 24 +-
4782 include/linux/xattr.h | 5 +-
4783 include/linux/zlib.h | 3 +-
4784 include/media/v4l2-dev.h | 2 +-
4785 include/media/v4l2-device.h | 2 +-
4786 include/net/9p/transport.h | 2 +-
4787 include/net/bluetooth/l2cap.h | 2 +-
4788 include/net/bonding.h | 2 +-
4789 include/net/caif/cfctrl.h | 6 +-
4790 include/net/flow.h | 2 +-
4791 include/net/genetlink.h | 2 +-
4792 include/net/gro_cells.h | 2 +-
4793 include/net/inet_connection_sock.h | 2 +-
4794 include/net/inet_sock.h | 2 +-
4795 include/net/inetpeer.h | 2 +-
4796 include/net/ip_fib.h | 2 +-
4797 include/net/ip_vs.h | 8 +-
4798 include/net/irda/ircomm_tty.h | 1 +
4799 include/net/iucv/af_iucv.h | 2 +-
4800 include/net/llc_c_ac.h | 2 +-
4801 include/net/llc_c_ev.h | 4 +-
4802 include/net/llc_c_st.h | 2 +-
4803 include/net/llc_s_ac.h | 2 +-
4804 include/net/llc_s_st.h | 2 +-
4805 include/net/mac80211.h | 2 +-
4806 include/net/neighbour.h | 2 +-
4807 include/net/net_namespace.h | 18 +-
4808 include/net/netlink.h | 2 +-
4809 include/net/netns/conntrack.h | 6 +-
4810 include/net/netns/ipv4.h | 4 +-
4811 include/net/netns/ipv6.h | 4 +-
4812 include/net/netns/xfrm.h | 2 +-
4813 include/net/ping.h | 2 +-
4814 include/net/protocol.h | 4 +-
4815 include/net/rtnetlink.h | 2 +-
4816 include/net/sctp/checksum.h | 4 +-
4817 include/net/sctp/sm.h | 4 +-
4818 include/net/sctp/structs.h | 2 +-
4819 include/net/sock.h | 12 +-
4820 include/net/tcp.h | 8 +-
4821 include/net/xfrm.h | 13 +-
4822 include/rdma/iw_cm.h | 2 +-
4823 include/scsi/libfc.h | 3 +-
4824 include/scsi/scsi_device.h | 6 +-
4825 include/scsi/scsi_driver.h | 2 +-
4826 include/scsi/scsi_transport_fc.h | 3 +-
4827 include/scsi/sg.h | 2 +-
4828 include/sound/compress_driver.h | 2 +-
4829 include/sound/soc.h | 4 +-
4830 include/target/target_core_base.h | 2 +-
4831 include/trace/events/irq.h | 4 +-
4832 include/uapi/linux/a.out.h | 8 +
4833 include/uapi/linux/bcache.h | 5 +-
4834 include/uapi/linux/byteorder/little_endian.h | 28 +-
4835 include/uapi/linux/connector.h | 2 +-
4836 include/uapi/linux/elf.h | 28 +
4837 include/uapi/linux/screen_info.h | 3 +-
4838 include/uapi/linux/swab.h | 6 +-
4839 include/uapi/linux/xattr.h | 4 +
4840 include/video/udlfb.h | 8 +-
4841 include/video/uvesafb.h | 1 +
4842 init/Kconfig | 2 +-
4843 init/Makefile | 3 +
4844 init/do_mounts.c | 14 +-
4845 init/do_mounts.h | 8 +-
4846 init/do_mounts_initrd.c | 30 +-
4847 init/do_mounts_md.c | 6 +-
4848 init/init_task.c | 4 +
4849 init/initramfs.c | 38 +-
4850 init/main.c | 30 +-
4851 ipc/compat.c | 4 +-
4852 ipc/ipc_sysctl.c | 8 +-
4853 ipc/mq_sysctl.c | 4 +-
4854 ipc/sem.c | 4 +-
4855 ipc/shm.c | 6 +
4856 kernel/audit.c | 8 +-
4857 kernel/auditsc.c | 4 +-
4858 kernel/bpf/core.c | 7 +-
4859 kernel/capability.c | 3 +
4860 kernel/compat.c | 38 +-
4861 kernel/debug/debug_core.c | 16 +-
4862 kernel/debug/kdb/kdb_main.c | 4 +-
4863 kernel/events/core.c | 26 +-
4864 kernel/events/internal.h | 10 +-
4865 kernel/events/uprobes.c | 2 +-
4866 kernel/exit.c | 2 +-
4867 kernel/fork.c | 165 +-
4868 kernel/futex.c | 11 +-
4869 kernel/futex_compat.c | 2 +-
4870 kernel/gcov/base.c | 7 +-
4871 kernel/irq/manage.c | 2 +-
4872 kernel/irq/msi.c | 20 +-
4873 kernel/irq/spurious.c | 2 +-
4874 kernel/jump_label.c | 5 +
4875 kernel/kallsyms.c | 37 +-
4876 kernel/kexec.c | 3 +-
4877 kernel/kmod.c | 8 +-
4878 kernel/kprobes.c | 4 +-
4879 kernel/ksysfs.c | 2 +-
4880 kernel/locking/lockdep.c | 7 +-
4881 kernel/locking/mutex-debug.c | 12 +-
4882 kernel/locking/mutex-debug.h | 4 +-
4883 kernel/locking/mutex.c | 6 +-
4884 kernel/locking/rtmutex-tester.c | 24 +-
4885 kernel/module.c | 422 +-
4886 kernel/notifier.c | 17 +-
4887 kernel/padata.c | 4 +-
4888 kernel/panic.c | 5 +-
4889 kernel/pid.c | 2 +-
4890 kernel/pid_namespace.c | 2 +-
4891 kernel/power/process.c | 12 +-
4892 kernel/profile.c | 14 +-
4893 kernel/ptrace.c | 8 +-
4894 kernel/rcu/rcutorture.c | 60 +-
4895 kernel/rcu/tiny.c | 4 +-
4896 kernel/rcu/tree.c | 66 +-
4897 kernel/rcu/tree.h | 26 +-
4898 kernel/rcu/tree_plugin.h | 14 +-
4899 kernel/rcu/tree_trace.c | 22 +-
4900 kernel/sched/auto_group.c | 4 +-
4901 kernel/sched/completion.c | 6 +-
4902 kernel/sched/core.c | 45 +-
4903 kernel/sched/fair.c | 2 +-
4904 kernel/sched/sched.h | 2 +-
4905 kernel/signal.c | 12 +-
4906 kernel/smpboot.c | 4 +-
4907 kernel/softirq.c | 12 +-
4908 kernel/sys.c | 10 +-
4909 kernel/sysctl.c | 34 +-
4910 kernel/time/alarmtimer.c | 2 +-
4911 kernel/time/posix-cpu-timers.c | 4 +-
4912 kernel/time/posix-timers.c | 24 +-
4913 kernel/time/timer.c | 4 +-
4914 kernel/time/timer_stats.c | 10 +-
4915 kernel/trace/blktrace.c | 6 +-
4916 kernel/trace/ftrace.c | 15 +-
4917 kernel/trace/ring_buffer.c | 96 +-
4918 kernel/trace/trace.c | 2 +-
4919 kernel/trace/trace.h | 2 +-
4920 kernel/trace/trace_clock.c | 4 +-
4921 kernel/trace/trace_events.c | 1 -
4922 kernel/trace/trace_functions_graph.c | 4 +-
4923 kernel/trace/trace_mmiotrace.c | 8 +-
4924 kernel/trace/trace_output.c | 10 +-
4925 kernel/trace/trace_seq.c | 2 +-
4926 kernel/trace/trace_stack.c | 2 +-
4927 kernel/user_namespace.c | 2 +-
4928 kernel/utsname_sysctl.c | 2 +-
4929 kernel/watchdog.c | 2 +-
4930 kernel/workqueue.c | 4 +-
4931 lib/Kconfig.debug | 8 +-
4932 lib/Makefile | 2 +-
4933 lib/average.c | 2 +-
4934 lib/bitmap.c | 10 +-
4935 lib/bug.c | 2 +
4936 lib/debugobjects.c | 2 +-
4937 lib/decompress_bunzip2.c | 3 +-
4938 lib/decompress_unlzma.c | 4 +-
4939 lib/div64.c | 4 +-
4940 lib/dma-debug.c | 4 +-
4941 lib/inflate.c | 2 +-
4942 lib/ioremap.c | 4 +-
4943 lib/kobject.c | 4 +-
4944 lib/list_debug.c | 126 +-
4945 lib/lockref.c | 44 +-
4946 lib/percpu-refcount.c | 2 +-
4947 lib/radix-tree.c | 2 +-
4948 lib/random32.c | 2 +-
4949 lib/show_mem.c | 2 +-
4950 lib/strncpy_from_user.c | 2 +-
4951 lib/strnlen_user.c | 2 +-
4952 lib/swiotlb.c | 2 +-
4953 lib/usercopy.c | 6 +
4954 lib/vsprintf.c | 12 +-
4955 mm/Kconfig | 6 +-
4956 mm/backing-dev.c | 4 +-
4957 mm/filemap.c | 2 +-
4958 mm/gup.c | 13 +-
4959 mm/highmem.c | 7 +-
4960 mm/hugetlb.c | 70 +-
4961 mm/internal.h | 3 +-
4962 mm/maccess.c | 4 +-
4963 mm/madvise.c | 37 +
4964 mm/memory-failure.c | 34 +-
4965 mm/memory.c | 425 +-
4966 mm/mempolicy.c | 25 +
4967 mm/mlock.c | 15 +-
4968 mm/mm_init.c | 2 +-
4969 mm/mmap.c | 582 +-
4970 mm/mprotect.c | 137 +-
4971 mm/mremap.c | 44 +-
4972 mm/nommu.c | 21 +-
4973 mm/page-writeback.c | 2 +-
4974 mm/page_alloc.c | 49 +-
4975 mm/percpu.c | 2 +-
4976 mm/process_vm_access.c | 14 +-
4977 mm/rmap.c | 45 +-
4978 mm/shmem.c | 19 +-
4979 mm/slab.c | 109 +-
4980 mm/slab.h | 22 +-
4981 mm/slab_common.c | 86 +-
4982 mm/slob.c | 218 +-
4983 mm/slub.c | 102 +-
4984 mm/sparse-vmemmap.c | 4 +-
4985 mm/sparse.c | 2 +-
4986 mm/swap.c | 2 +
4987 mm/swapfile.c | 12 +-
4988 mm/util.c | 6 +
4989 mm/vmalloc.c | 112 +-
4990 mm/vmstat.c | 12 +-
4991 net/8021q/vlan.c | 5 +-
4992 net/8021q/vlan_netlink.c | 2 +-
4993 net/9p/mod.c | 4 +-
4994 net/9p/trans_fd.c | 2 +-
4995 net/atm/atm_misc.c | 8 +-
4996 net/atm/lec.h | 2 +-
4997 net/atm/proc.c | 6 +-
4998 net/atm/resources.c | 4 +-
4999 net/ax25/sysctl_net_ax25.c | 2 +-
5000 net/batman-adv/bat_iv_ogm.c | 8 +-
5001 net/batman-adv/fragmentation.c | 2 +-
5002 net/batman-adv/soft-interface.c | 8 +-
5003 net/batman-adv/types.h | 6 +-
5004 net/bluetooth/hci_sock.c | 2 +-
5005 net/bluetooth/l2cap_core.c | 6 +-
5006 net/bluetooth/l2cap_sock.c | 12 +-
5007 net/bluetooth/rfcomm/sock.c | 4 +-
5008 net/bluetooth/rfcomm/tty.c | 4 +-
5009 net/bridge/br_netlink.c | 2 +-
5010 net/bridge/netfilter/ebtables.c | 6 +-
5011 net/caif/cfctrl.c | 11 +-
5012 net/caif/chnl_net.c | 2 +-
5013 net/can/af_can.c | 2 +-
5014 net/can/gw.c | 6 +-
5015 net/ceph/messenger.c | 4 +-
5016 net/compat.c | 24 +-
5017 net/core/datagram.c | 2 +-
5018 net/core/dev.c | 16 +-
5019 net/core/filter.c | 2 +-
5020 net/core/flow.c | 6 +-
5021 net/core/neighbour.c | 4 +-
5022 net/core/net-sysfs.c | 2 +-
5023 net/core/net_namespace.c | 8 +-
5024 net/core/netpoll.c | 4 +-
5025 net/core/rtnetlink.c | 15 +-
5026 net/core/scm.c | 8 +-
5027 net/core/skbuff.c | 8 +-
5028 net/core/sock.c | 28 +-
5029 net/core/sock_diag.c | 15 +-
5030 net/core/sysctl_net_core.c | 22 +-
5031 net/decnet/af_decnet.c | 1 +
5032 net/decnet/sysctl_net_decnet.c | 4 +-
5033 net/dsa/dsa.c | 2 +-
5034 net/hsr/hsr_netlink.c | 2 +-
5035 net/ieee802154/6lowpan/core.c | 2 +-
5036 net/ieee802154/6lowpan/reassembly.c | 14 +-
5037 net/ipv4/af_inet.c | 2 +-
5038 net/ipv4/devinet.c | 18 +-
5039 net/ipv4/fib_frontend.c | 6 +-
5040 net/ipv4/fib_semantics.c | 2 +-
5041 net/ipv4/inet_connection_sock.c | 4 +-
5042 net/ipv4/inet_timewait_sock.c | 2 +-
5043 net/ipv4/inetpeer.c | 2 +-
5044 net/ipv4/ip_fragment.c | 15 +-
5045 net/ipv4/ip_gre.c | 6 +-
5046 net/ipv4/ip_sockglue.c | 2 +-
5047 net/ipv4/ip_vti.c | 4 +-
5048 net/ipv4/ipconfig.c | 6 +-
5049 net/ipv4/ipip.c | 4 +-
5050 net/ipv4/netfilter/arp_tables.c | 12 +-
5051 net/ipv4/netfilter/ip_tables.c | 12 +-
5052 net/ipv4/ping.c | 14 +-
5053 net/ipv4/raw.c | 14 +-
5054 net/ipv4/route.c | 32 +-
5055 net/ipv4/sysctl_net_ipv4.c | 22 +-
5056 net/ipv4/tcp_input.c | 6 +-
5057 net/ipv4/tcp_probe.c | 2 +-
5058 net/ipv4/udp.c | 10 +-
5059 net/ipv4/xfrm4_policy.c | 18 +-
5060 net/ipv6/addrconf.c | 16 +-
5061 net/ipv6/af_inet6.c | 2 +-
5062 net/ipv6/datagram.c | 2 +-
5063 net/ipv6/icmp.c | 2 +-
5064 net/ipv6/ip6_fib.c | 4 +-
5065 net/ipv6/ip6_gre.c | 10 +-
5066 net/ipv6/ip6_tunnel.c | 4 +-
5067 net/ipv6/ip6_vti.c | 4 +-
5068 net/ipv6/ipv6_sockglue.c | 2 +-
5069 net/ipv6/netfilter/ip6_tables.c | 12 +-
5070 net/ipv6/netfilter/nf_conntrack_reasm.c | 14 +-
5071 net/ipv6/ping.c | 33 +-
5072 net/ipv6/raw.c | 17 +-
5073 net/ipv6/reassembly.c | 13 +-
5074 net/ipv6/route.c | 2 +-
5075 net/ipv6/sit.c | 4 +-
5076 net/ipv6/sysctl_net_ipv6.c | 2 +-
5077 net/ipv6/udp.c | 6 +-
5078 net/ipv6/xfrm6_policy.c | 23 +-
5079 net/irda/ircomm/ircomm_tty.c | 18 +-
5080 net/iucv/af_iucv.c | 4 +-
5081 net/iucv/iucv.c | 2 +-
5082 net/key/af_key.c | 4 +-
5083 net/l2tp/l2tp_eth.c | 38 +-
5084 net/l2tp/l2tp_ip.c | 2 +-
5085 net/l2tp/l2tp_ip6.c | 2 +-
5086 net/mac80211/cfg.c | 8 +-
5087 net/mac80211/ieee80211_i.h | 3 +-
5088 net/mac80211/iface.c | 20 +-
5089 net/mac80211/main.c | 2 +-
5090 net/mac80211/pm.c | 4 +-
5091 net/mac80211/rate.c | 2 +-
5092 net/mac80211/sta_info.c | 2 +-
5093 net/mac80211/util.c | 8 +-
5094 net/mpls/af_mpls.c | 6 +-
5095 net/netfilter/ipset/ip_set_core.c | 2 +-
5096 net/netfilter/ipvs/ip_vs_conn.c | 6 +-
5097 net/netfilter/ipvs/ip_vs_core.c | 4 +-
5098 net/netfilter/ipvs/ip_vs_ctl.c | 14 +-
5099 net/netfilter/ipvs/ip_vs_lblc.c | 2 +-
5100 net/netfilter/ipvs/ip_vs_lblcr.c | 2 +-
5101 net/netfilter/ipvs/ip_vs_sync.c | 6 +-
5102 net/netfilter/ipvs/ip_vs_xmit.c | 4 +-
5103 net/netfilter/nf_conntrack_acct.c | 2 +-
5104 net/netfilter/nf_conntrack_ecache.c | 2 +-
5105 net/netfilter/nf_conntrack_helper.c | 2 +-
5106 net/netfilter/nf_conntrack_proto.c | 2 +-
5107 net/netfilter/nf_conntrack_standalone.c | 2 +-
5108 net/netfilter/nf_conntrack_timestamp.c | 2 +-
5109 net/netfilter/nf_log.c | 10 +-
5110 net/netfilter/nf_sockopt.c | 4 +-
5111 net/netfilter/nfnetlink_log.c | 4 +-
5112 net/netfilter/nft_compat.c | 9 +-
5113 net/netfilter/xt_statistic.c | 8 +-
5114 net/netlink/af_netlink.c | 4 +-
5115 net/openvswitch/vport-internal_dev.c | 2 +-
5116 net/openvswitch/vport.c | 16 +-
5117 net/openvswitch/vport.h | 8 +-
5118 net/packet/af_packet.c | 8 +-
5119 net/phonet/pep.c | 6 +-
5120 net/phonet/socket.c | 2 +-
5121 net/phonet/sysctl.c | 2 +-
5122 net/rds/cong.c | 6 +-
5123 net/rds/ib.h | 2 +-
5124 net/rds/ib_cm.c | 2 +-
5125 net/rds/ib_recv.c | 4 +-
5126 net/rds/iw.h | 2 +-
5127 net/rds/iw_cm.c | 2 +-
5128 net/rds/iw_recv.c | 4 +-
5129 net/rds/rds.h | 2 +-
5130 net/rds/tcp.c | 2 +-
5131 net/rds/tcp_send.c | 2 +-
5132 net/rxrpc/af_rxrpc.c | 2 +-
5133 net/rxrpc/ar-ack.c | 14 +-
5134 net/rxrpc/ar-call.c | 2 +-
5135 net/rxrpc/ar-connection.c | 2 +-
5136 net/rxrpc/ar-connevent.c | 2 +-
5137 net/rxrpc/ar-input.c | 4 +-
5138 net/rxrpc/ar-internal.h | 8 +-
5139 net/rxrpc/ar-local.c | 2 +-
5140 net/rxrpc/ar-output.c | 4 +-
5141 net/rxrpc/ar-peer.c | 2 +-
5142 net/rxrpc/ar-proc.c | 4 +-
5143 net/rxrpc/ar-transport.c | 2 +-
5144 net/rxrpc/rxkad.c | 4 +-
5145 net/sched/sch_generic.c | 4 +-
5146 net/sctp/ipv6.c | 6 +-
5147 net/sctp/protocol.c | 10 +-
5148 net/sctp/sm_sideeffect.c | 2 +-
5149 net/sctp/socket.c | 21 +-
5150 net/sctp/sysctl.c | 10 +-
5151 net/socket.c | 18 +-
5152 net/sunrpc/auth_gss/svcauth_gss.c | 4 +-
5153 net/sunrpc/clnt.c | 4 +-
5154 net/sunrpc/sched.c | 4 +-
5155 net/sunrpc/svc.c | 4 +-
5156 net/sunrpc/svcauth_unix.c | 4 +-
5157 net/sunrpc/xprtrdma/svc_rdma.c | 38 +-
5158 net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 +-
5159 net/sunrpc/xprtrdma/svc_rdma_sendto.c | 2 +-
5160 net/sunrpc/xprtrdma/svc_rdma_transport.c | 10 +-
5161 net/tipc/netlink_compat.c | 12 +-
5162 net/tipc/subscr.c | 2 +-
5163 net/unix/af_unix.c | 7 +-
5164 net/unix/sysctl_net_unix.c | 2 +-
5165 net/wireless/wext-core.c | 19 +-
5166 net/xfrm/xfrm_policy.c | 16 +-
5167 net/xfrm/xfrm_state.c | 33 +-
5168 net/xfrm/xfrm_sysctl.c | 2 +-
5169 scripts/Kbuild.include | 2 +-
5170 scripts/Makefile.build | 2 +-
5171 scripts/Makefile.clean | 3 +-
5172 scripts/Makefile.host | 63 +-
5173 scripts/basic/fixdep.c | 12 +-
5174 scripts/dtc/checks.c | 14 +-
5175 scripts/dtc/data.c | 6 +-
5176 scripts/dtc/flattree.c | 8 +-
5177 scripts/dtc/livetree.c | 4 +-
5178 scripts/gcc-plugin.sh | 51 +
5179 scripts/headers_install.sh | 1 +
5180 scripts/kallsyms.c | 4 +-
5181 scripts/kconfig/lkc.h | 5 +-
5182 scripts/kconfig/menu.c | 2 +-
5183 scripts/kconfig/symbol.c | 6 +-
5184 scripts/link-vmlinux.sh | 2 +-
5185 scripts/mod/file2alias.c | 14 +-
5186 scripts/mod/modpost.c | 25 +-
5187 scripts/mod/modpost.h | 6 +-
5188 scripts/mod/sumversion.c | 2 +-
5189 scripts/module-common.lds | 4 +
5190 scripts/package/builddeb | 1 +
5191 scripts/pnmtologo.c | 6 +-
5192 scripts/sortextable.h | 6 +-
5193 scripts/tags.sh | 2 +-
5194 security/Kconfig | 691 +-
5195 security/integrity/ima/ima.h | 4 +-
5196 security/integrity/ima/ima_api.c | 2 +-
5197 security/integrity/ima/ima_fs.c | 4 +-
5198 security/integrity/ima/ima_queue.c | 2 +-
5199 security/keys/key.c | 18 +-
5200 security/selinux/avc.c | 6 +-
5201 security/selinux/include/xfrm.h | 2 +-
5202 security/yama/yama_lsm.c | 2 +-
5203 sound/aoa/codecs/onyx.c | 7 +-
5204 sound/aoa/codecs/onyx.h | 1 +
5205 sound/core/oss/pcm_oss.c | 18 +-
5206 sound/core/pcm_compat.c | 2 +-
5207 sound/core/pcm_native.c | 4 +-
5208 sound/core/sound.c | 2 +-
5209 sound/drivers/mts64.c | 14 +-
5210 sound/drivers/opl4/opl4_lib.c | 2 +-
5211 sound/drivers/portman2x4.c | 3 +-
5212 sound/firewire/amdtp.c | 4 +-
5213 sound/firewire/amdtp.h | 4 +-
5214 sound/firewire/isight.c | 10 +-
5215 sound/firewire/scs1x.c | 8 +-
5216 sound/oss/sb_audio.c | 2 +-
5217 sound/oss/swarm_cs4297a.c | 6 +-
5218 sound/pci/hda/hda_codec.c | 2 +-
5219 sound/pci/ymfpci/ymfpci.h | 2 +-
5220 sound/pci/ymfpci/ymfpci_main.c | 12 +-
5221 sound/soc/soc-ac97.c | 6 +-
5222 sound/soc/xtensa/xtfpga-i2s.c | 2 +-
5223 tools/gcc/Makefile | 42 +
5224 tools/gcc/checker_plugin.c | 150 +
5225 tools/gcc/colorize_plugin.c | 215 +
5226 tools/gcc/constify_plugin.c | 564 +
5227 tools/gcc/gcc-common.h | 790 +
5228 tools/gcc/initify_plugin.c | 450 +
5229 tools/gcc/kallocstat_plugin.c | 188 +
5230 tools/gcc/kernexec_plugin.c | 551 +
5231 tools/gcc/latent_entropy_plugin.c | 470 +
5232 tools/gcc/size_overflow_plugin/.gitignore | 2 +
5233 tools/gcc/size_overflow_plugin/Makefile | 26 +
5234 .../disable_size_overflow_hash.data |11008 ++++++++++++++
5235 .../generate_size_overflow_hash.sh | 103 +
5236 .../insert_size_overflow_asm.c | 409 +
5237 .../size_overflow_plugin/intentional_overflow.c | 980 ++
5238 .../size_overflow_plugin/remove_unnecessary_dup.c | 137 +
5239 tools/gcc/size_overflow_plugin/size_overflow.h | 329 +
5240 .../gcc/size_overflow_plugin/size_overflow_debug.c | 192 +
5241 .../size_overflow_plugin/size_overflow_hash.data |15719 ++++++++++++++++++++
5242 .../size_overflow_hash_aux.data | 92 +
5243 tools/gcc/size_overflow_plugin/size_overflow_ipa.c | 1373 ++
5244 .../gcc/size_overflow_plugin/size_overflow_misc.c | 505 +
5245 .../size_overflow_plugin/size_overflow_plugin.c | 318 +
5246 .../size_overflow_plugin_hash.c | 353 +
5247 .../size_overflow_plugin/size_overflow_transform.c | 576 +
5248 .../size_overflow_transform_core.c | 962 ++
5249 tools/gcc/stackleak_plugin.c | 436 +
5250 tools/gcc/structleak_plugin.c | 287 +
5251 tools/include/linux/compiler.h | 8 +
5252 tools/lib/api/Makefile | 2 +-
5253 tools/perf/util/include/asm/alternative-asm.h | 3 +
5254 tools/virtio/linux/uaccess.h | 2 +-
5255 virt/kvm/kvm_main.c | 44 +-
5256 1963 files changed, 60342 insertions(+), 8946 deletions(-)