grsec-scrape autocommit. 1 new patch(es).

[thirdparty/grsecurity-scrape.git] / test / changelog-test.txt

commit 3784195d73223b2f93db2d8edd454483509c0808
Author: Djalal Harouni <tixxdz@opendz.org>
Date:   Sun May 20 13:55:30 2012 +0000

    drivers/net/stmmac: seq_file fix memory leak
    
    Use single_release() instead of seq_release() to free memory allocated
    by single_open().
    
    Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

commit 98131862203fd281c4cb8cbe01a8f20190f62cf7
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat May 26 11:51:18 2012 -0400

    When called for anonymous (non-shared) mappings,
    hugetlb_reserve_pages() does a resv_map_alloc().  It depends on
    code in hugetlbfs's vm_ops->close() to release that allocation.
    
    However, in the mmap() failure path, we do a plain unmap_region()
    without the remove_vma() which actually calls vm_ops->close().
    
    This is a decent fix.  This leak could get reintroduced if
    new code (say, after hugetlb_reserve_pages() in
    hugetlbfs_file_mmap()) decides to return an error.  But, I think
    it would have to unroll the reservation anyway.
    
    This hasn't been extensively tested.  Pretty much compile and
    boot tested along with Christoph's test case:
    
        http://marc.info/?l=linux-mm&m=133728900729735
    
    Signed-off-by: Dave Hansen <dave@linux.vnet.ibm.com>
    Acked-by: Mel Gorman <mel@csn.ul.ie>
    ecked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Reported/tested-by: Christoph Lameter <cl@linux.com>

 mm/hugetlb.c |   28 ++++++++++++++++++++++------
 1 files changed, 22 insertions(+), 6 deletions(-)

commit 42526ac1fb37d444036f7ed781538f01979112b9
Merge: ef9c2e2 fe4d20a
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat May 26 11:31:58 2012 -0400

    Merge branch 'pax-test' into grsec-test
    
    Conflicts:
        fs/nfs/nfs4xdr.c

commit fe4d20ae91718b4c267bc9b048552d6a0daba5f1
Merge: 981e60c 4dc1c17
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat May 26 11:30:35 2012 -0400

    Update to pax-linux-3.3.7-test15.patch
    Merge branch 'linux-3.3.y' into pax-test
    
    Conflicts:
        kernel/compat.c

commit 981e60cc448ce110e658c23c290cf96409ac558b
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat May 26 11:00:42 2012 -0400

    Update to pax-linux-3.3.6-test15.patch

 Makefile                                           |    4 +-
 arch/x86/crypto/aesni-intel_glue.c                 |    2 -
 arch/x86/include/asm/floppy.h                      |    1 -
 arch/x86/include/asm/kvm_host.h                    |    4 +-
 arch/x86/include/asm/syscalls.h                    |    2 +-
 arch/x86/include/asm/uaccess_32.h                  |   17 -
 arch/x86/include/asm/uaccess_64.h                  |   18 -
 arch/x86/kernel/cpu/mcheck/mce-inject.c            |    2 -
 arch/x86/kernel/cpu/mtrr/if.c                      |    2 -
 arch/x86/kernel/dumpstack_64.c                     |    3 +
 arch/x86/kernel/i387.c                             |   20 -
 arch/x86/kernel/ldt.c                              |    2 -
 arch/x86/kernel/microcode_intel.c                  |    1 -
 arch/x86/kernel/module.c                           |    1 -
 arch/x86/kernel/ptrace.c                           |    4 -
 arch/x86/kernel/setup_percpu.c                     |    4 -
 arch/x86/kernel/tls.h                              |    2 +-
 arch/x86/kernel/vm86_32.c                          |    3 -
 arch/x86/kvm/x86.c                                 |   21 -
 arch/x86/kvm/x86.h                                 |    4 +-
 arch/x86/platform/uv/tlb_uv.c                      |    4 -
 crypto/ablkcipher.c                                |    4 -
 crypto/aead.c                                      |    3 -
 crypto/blkcipher.c                                 |    3 -
 crypto/cipher.c                                    |    3 -
 drivers/acpi/battery.c                             |    3 -
 drivers/acpi/sbs.c                                 |    3 -
 drivers/infiniband/hw/ipath/ipath_fs.c             |    4 -
 drivers/infiniband/hw/qib/qib_fs.c                 |    4 -
 drivers/lguest/lguest_user.c                       |    1 -
 drivers/md/dm-raid1.c                              |    4 -
 drivers/md/dm-stripe.c                             |    1 -
 drivers/media/video/cpia2/cpia2_core.c             |    1 -
 drivers/media/video/cx18/cx18-alsa-pcm.c           |    2 -
 drivers/media/video/cx231xx/cx231xx-audio.c        |    2 -
 drivers/media/video/em28xx/em28xx-audio.c          |    2 -
 drivers/media/video/meye.c                         |    1 -
 drivers/media/video/saa7164/saa7164-encoder.c      |    2 -
 drivers/media/video/saa7164/saa7164-vbi.c          |    2 -
 drivers/media/video/videobuf-dma-contig.c          |    1 -
 drivers/media/video/videobuf-dma-sg.c              |    1 -
 drivers/media/video/videobuf-vmalloc.c             |    1 -
 drivers/mtd/ubi/debug.c                            |    2 -
 drivers/net/ethernet/chelsio/cxgb/sge.c            |    2 -
 drivers/net/ethernet/chelsio/cxgb3/sge.c           |    4 -
 drivers/net/ethernet/chelsio/cxgb4/sge.c           |    3 -
 drivers/net/ethernet/chelsio/cxgb4vf/sge.c         |    3 -
 drivers/net/wireless/ath/ath5k/debug.c             |    3 -
 drivers/net/wireless/ath/ath9k/debug.c             |    2 -
 drivers/net/wireless/ath/ath9k/htc_drv_debug.c     |    2 -
 drivers/oprofile/oprofile_files.c                  |    5 -
 drivers/oprofile/oprofilefs.c                      |    1 -
 drivers/platform/x86/asus_acpi.c                   |    2 -
 drivers/platform/x86/toshiba_acpi.c                |    2 -
 drivers/staging/rtl8192e/rtllib_module.c           |    2 -
 .../staging/rtl8192u/ieee80211/ieee80211_module.c  |    2 -
 fs/cifs/asn1.c                                     |    3 -
 fs/configfs/file.c                                 |    2 -
 fs/ncpfs/ncplib_kernel.h                           |    4 +-
 fs/sysfs/bin.c                                     |    2 -
 fs/ubifs/debug.c                                   |    3 -
 include/asm-generic/pgtable-nopud.h                |    1 +
 include/asm-generic/uaccess.h                      |   11 -
 include/linux/compiler-gcc4.h                      |    1 +
 include/linux/compiler.h                           |    1 +
 include/linux/crash_dump.h                         |    2 +-
 include/linux/kvm_host.h                           |   14 +-
 include/linux/moduleloader.h                       |    2 +-
 include/linux/oprofile.h                           |    2 +-
 include/linux/slab.h                               |    4 +-
 include/linux/slab_def.h                           |    2 -
 include/linux/slob_def.h                           |    2 -
 include/linux/slub_def.h                           |    6 +-
 include/linux/uaccess.h                            |    2 +-
 include/linux/vmalloc.h                            |   18 +-
 mm/vmalloc.c                                       |    4 +
 net/bridge/netfilter/ebt_ulog.c                    |    1 -
 net/ipv4/ah4.c                                     |    2 -
 net/ipv4/netfilter/arp_tables.c                    |   10 -
 net/ipv4/netfilter/ip_tables.c                     |   11 -
 net/ipv4/netfilter/ipt_ULOG.c                      |    1 -
 net/ipv4/netfilter/nf_nat_snmp_basic.c             |    4 -
 net/ipv6/ah6.c                                     |    2 -
 net/ipv6/netfilter/ip6_tables.c                    |   11 -
 scripts/Makefile.lib                               |    6 +-
 tools/gcc/size_overflow_hash1.h                    | 3047 --------------------
 tools/gcc/size_overflow_hash2.h                    |   35 -
 tools/gcc/size_overflow_plugin.c                   |  158 +-
 88 files changed, 144 insertions(+), 3434 deletions(-)

commit ef9c2e2cad33a477bf0c8f1ccf8aafb4a213a3df
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat May 19 10:47:15 2012 -0400

    init ebda range earlier in boot
    
    Conflicts:
    
        arch/x86/mm/init.c

 arch/x86/mm/init.c |   48 +++++++++++++++++++++++++++++-------------------
 1 files changed, 29 insertions(+), 19 deletions(-)

commit 945355803ce381eacce23b3383aca5964a92d063
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat May 19 09:19:42 2012 -0400

    [PATCH] mm: read_pmd_atomic: fix 32bit PAE pmd walk vs pmd_populate SMP race condition
    
    When holding the mmap_sem for reading, pmd_offset_map_lock should only
    run on a pmd_t that has been read atomically from the pmdp
    pointer, otherwise we may read only half of it leading to this crash.
    
    PID: 11679  TASK: f06e8000  CPU: 3   COMMAND: "do_race_2_panic"
     #0 [f06a9dd8] crash_kexec at c049b5ec
     #1 [f06a9e2c] oops_end at c083d1c2
     #2 [f06a9e40] no_context at c0433ded
     #3 [f06a9e64] bad_area_nosemaphore at c043401a
     #4 [f06a9e6c] __do_page_fault at c0434493
     #5 [f06a9eec] do_page_fault at c083eb45
     #6 [f06a9f04] error_code (via page_fault) at c083c5d5
        EAX: 01fb470c EBX: fff35000 ECX: 00000003 EDX: 00000100 EBP:
        00000000
        DS:  007b     ESI: 9e201000 ES:  007b     EDI: 01fb4700 GS:  00e0
        CS:  0060     EIP: c083bc14 ERR: ffffffff EFLAGS: 00010246
     #7 [f06a9f38] _spin_lock at c083bc14
     #8 [f06a9f44] sys_mincore at c0507b7d
     #9 [f06a9fb0] system_call at c083becd
                             start           len
        EAX: ffffffda  EBX: 9e200000  ECX: 00001000  EDX: 6228537f
        DS:  007b      ESI: 00000000  ES:  007b      EDI: 003d0f00
        SS:  007b      ESP: 62285354  EBP: 62285388  GS:  0033
        CS:  0073      EIP: 00291416  ERR: 000000da  EFLAGS: 00000286
    
    This should be a longstanding bug affecting x86 32bit PAE without
    THP. Only archs with 64bit large pmd_t and 32bit unsigned long should
    be affected.
    
    With THP enabled the barrier() in
    pmd_none_or_trans_huge_or_clear_bad() would partly hide the bug when
    the pmd transition from none to stable, by forcing a re-read of the
    *pmd in pmd_offset_map_lock, but when THP is enabled a new set of
    problem arises by the fact could then transition freely in any of the
    none, pmd_trans_huge or pmd_trans_stable states. So making the barrier
    in pmd_none_or_trans_huge_or_clear_bad() unconditional isn't good idea
    and it would be a flakey solution.
    
    This should be fully fixed by introducing a read_pmd_atomic that reads
    the pmd in order with THP disabled, or by reading the pmd atomically
    with cmpxchg8b with THP enabled.
    
    Luckily this new race condition only triggers in the places that must
    already be covered by pmd_none_or_trans_huge_or_clear_bad() so the fix
    is localized there but this bug is not related to THP.
    
    NOTE: this can trigger on x86 32bit systems with PAE enabled with more
    than 4G of ram, otherwise the high part of the pmd will never risk to
    be truncated because it would be zero at all times, in turn so hiding
    the SMP race.
    
    This bug was discovered and fully debugged by Ulrich, quote:
    
    ----
    [..]
    pmd_none_or_trans_huge_or_clear_bad() loads the content of edx and
    eax.
    
        496 static inline int pmd_none_or_trans_huge_or_clear_bad(pmd_t
        *pmd)
        497 {
        498         /* depend on compiler for an atomic pmd read */
        499         pmd_t pmdval = *pmd;
    
                                    // edi = pmd pointer
    0xc0507a74 <sys_mincore+548>:   mov    0x8(%esp),%edi
    ...
                                    // edx = PTE page table high address
    0xc0507a84 <sys_mincore+564>:   mov    0x4(%edi),%edx
    ...
                                    // eax = PTE page table low address
    0xc0507a8e <sys_mincore+574>:   mov    (%edi),%eax
    
    [..]
    
    Please note that the PMD is not read atomically. These are two "mov"
    instructions where the high order bits of the PMD entry are fetched
    first. Hence, the above machine code is prone to the following race.
    
    -  The PMD entry {high|low} is 0x0000000000000000.
       The "mov" at 0xc0507a84 loads 0x00000000 into edx.
    
    -  A page fault (on another CPU) sneaks in between the two "mov"
       instructions and instantiates the PMD.
    
    -  The PMD entry {high|low} is now 0x00000003fda38067.
       The "mov" at 0xc0507a8e loads 0xfda38067 into eax.
    ----
    
    Reported-by: Ulrich Obergfell <uobergfe <at> redhat.com>
    Signed-off-by: Andrea Arcangeli <aarcange <at> redhat.com>
    ---
     arch/x86/include/asm/pgtable-3level.h |   50 +++++++++++++++++++++++++++++++++
     include/asm-generic/pgtable.h         |   22 +++++++++++++-
     2 files changed, 70 insertions(+), 2 deletions(-)

 arch/x86/include/asm/pgtable-3level.h |   50 +++++++++++++++++++++++++++++++++
 include/asm-generic/pgtable.h         |   22 +++++++++++++-
 2 files changed, 70 insertions(+), 2 deletions(-)

commit c372470ba53425b2e159282d81680c0c84f3750d
Author: Tushar Dave <tushar.n.dave@intel.com>
Date:   Thu May 17 01:04:50 2012 +0000

    e1000: Prevent reset task killing itself.
    
    Killing reset task while adapter is resetting causes deadlock.
    Only kill reset task if adapter is not resetting.
    Ref bug #43132 on bugzilla.kernel.org
    
    CC: stable@vger.kernel.org
    Signed-off-by: Tushar Dave <tushar.n.dave@intel.com>
    Tested-by: Aaron Brown <aaron.f.brown@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

 drivers/net/ethernet/intel/e1000/e1000_main.c |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

commit 1ef7b1503902f0e58f843417b514ab79d52f85aa
Author: Willy Tarreau <w@1wt.eu>
Date:   Thu May 17 11:14:14 2012 +0000

    tcp: do_tcp_sendpages() must try to push data out on oom conditions
    
    Since recent changes on TCP splicing (starting with commits 2f533844
    "tcp: allow splice() to build full TSO packets" and 35f9c09f "tcp:
    tcp_sendpages() should call tcp_push() once"), I started seeing
    massive stalls when forwarding traffic between two sockets using
    splice() when pipe buffers were larger than socket buffers.
    
    Latest changes (net: netdev_alloc_skb() use build_skb()) made the
    problem even more apparent.
    
    The reason seems to be that if do_tcp_sendpages() fails on out of memory
    condition without being able to send at least one byte, tcp_push() is not
    called and the buffers cannot be flushed.
    
    After applying the attached patch, I cannot reproduce the stalls at all
    and the data rate it perfectly stable and steady under any condition
    which previously caused the problem to be permanent.
    
    The issue seems to have been there since before the kernel migrated to
    git, which makes me think that the stalls I occasionally experienced
    with tux during stress-tests years ago were probably related to the
    same issue.
    
    This issue was first encountered on 3.0.31 and 3.2.17, so please backport
    to -stable.
    
    Signed-off-by: Willy Tarreau <w@1wt.eu>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Cc: <stable@vger.kernel.org>

 net/ipv4/tcp.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)

commit f1ef0322da87da4de06f2c12d9615e5b62906d98
Author: Sachin Prabhu <sprabhu@redhat.com>
Date:   Tue Apr 17 14:35:39 2012 +0100

    Avoid reading past buffer when calling GETACL
    
    Bug noticed in commit
    bf118a342f10dafe44b14451a1392c3254629a1f
    
    When calling GETACL, if the size of the bitmap array, the length
    attribute and the acl returned by the server is greater than the
    allocated buffer(args.acl_len), we can Oops with a General Protection
    fault at _copy_from_pages() when we attempt to read past the pages
    allocated.
    
    This patch allocates an extra PAGE for the bitmap and checks to see that
    the bitmap + attribute_length + ACLs don't exceed the buffer space
    allocated to it.
    
    Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
    Reported-by: Jian Li <jiali@redhat.com>
    [Trond: Fixed a size_t vs unsigned int printk() warning]
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

 fs/nfs/nfs4proc.c |   16 ++++++++++------
 fs/nfs/nfs4xdr.c  |   18 +++++++++++-------
 2 files changed, 21 insertions(+), 13 deletions(-)

commit 6405eafd58c9a79fdd2c383fcd15e1231f30e52d
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat May 19 08:30:54 2012 -0400

    Precompute _start/_end

 arch/x86/mm/init.c |   25 ++++++++++++-------------
 1 files changed, 12 insertions(+), 13 deletions(-)

commit 86d09b7998377aa2a41dfa094f09e3e37681771b
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat May 19 07:45:06 2012 -0400

    Use new method of EBDA detection
    Resolves issue from: https://bugs.gentoo.org/show_bug.cgi?id=416415

 arch/x86/mm/init.c |   28 +++++++++++++++++++++++++++-
 1 files changed, 27 insertions(+), 1 deletions(-)

commit ae5d8ccb14ea02206a73bcfcb6fd1584229c7816
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Fri May 4 11:34:03 2012 +0000

    connector/userns: replace netlink uses of cap_raised() with capable()
    
    In 2009 Philip Reiser notied that a few users of netlink connector
    interface needed a capability check and added the idiom
    cap_raised(nsp->eff_cap, CAP_SYS_ADMIN) to a few of them, on the premise
    that netlink was asynchronous.
    
    In 2011 Patrick McHardy noticed we were being silly because netlink is
    synchronous and removed eff_cap from the netlink_skb_params and changed
    the idiom to cap_raised(current_cap(), CAP_SYS_ADMIN).
    
    Looking at those spots with a fresh eye we should be calling
    capable(CAP_SYS_ADMIN).  The only reason I can see for not calling capable
    is that it once appeared we were not in the same task as the caller which
    would have made calling capable() impossible.
    
    In the initial user_namespace the only difference between between
    cap_raised(current_cap(), CAP_SYS_ADMIN) and capable(CAP_SYS_ADMIN) are a
    few sanity checks and the fact that capable(CAP_SYS_ADMIN) sets
    PF_SUPERPRIV if we use the capability.
    
    Since we are going to be using root privilege setting PF_SUPERPRIV seems
    the right thing to do.
    
    The motivation for this that patch is that in a child user namespace
    cap_raised(current_cap(),...) tests your capabilities with respect to that
    child user namespace not capabilities in the initial user namespace and
    thus will allow processes that should be unprivielged to use the kernel
    services that are only protected with cap_raised(current_cap(),..).
    
    To fix possible user_namespace issues and to just clean up the code
    replace cap_raised(current_cap(), CAP_SYS_ADMIN) with
    capable(CAP_SYS_ADMIN).
    
    Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
    Cc: Patrick McHardy <kaber@trash.net>
    Cc: Philipp Reisner <philipp.reisner@linbit.com>
    Acked-by: Serge E. Hallyn <serge.hallyn@canonical.com>
    Acked-by: Andrew G. Morgan <morgan@kernel.org>
    Cc: Vasiliy Kulikov <segoon@openwall.com>
    Cc: David Howells <dhowells@redhat.com>
    Reviewed-by: James Morris <james.l.morris@oracle.com>
    Cc: David Miller <davem@davemloft.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

 drivers/block/drbd/drbd_nl.c           |    2 +-
 drivers/md/dm-log-userspace-transfer.c |    2 +-
 drivers/video/uvesafb.c                |    2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

commit 74650b6cb5756e6e78f90b31830ebe779c87e454
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Sun May 13 08:44:18 2012 +0000

    openvswitch: checking wrong variable in queue_userspace_packet()
    
    "skb" is non-NULL here, for example we dereference it in skb_clone().
    The intent was to test "nskb" which was just set.
    
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Jesse Gross <jesse@nicira.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

 net/openvswitch/datapath.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

commit c9edc7f133cb58a6f079390f1e31eac1d3122c86
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun May 13 15:42:34 2012 -0400

    Add MIPS support to GRKERNSEC_SETXID, choose a thread info flag bit
    for each of our supported architectures that can be properly expressed
    within the instruction making use of an immediate value:
    < 12 on sparc64
    < 32 on mips
    < 16 on powerpc
    < 8 or expressable within 8 bits with a shift amount on arm
    
    (different values required for this kernel due to 3.3 feature additions)
    
    Conflicts:
    
        arch/arm/include/asm/thread_info.h
        arch/sparc/include/asm/thread_info_64.h

 arch/arm/include/asm/thread_info.h      |    7 ++++++-
 arch/mips/include/asm/thread_info.h     |    9 +++++++--
 arch/mips/kernel/ptrace.c               |    9 +++++++++
 arch/mips/kernel/scall32-o32.S          |    2 +-
 arch/mips/kernel/scall64-64.S           |    2 +-
 arch/mips/kernel/scall64-n32.S          |    2 +-
 arch/mips/kernel/scall64-o32.S          |    2 +-
 arch/powerpc/include/asm/thread_info.h  |    5 +++--
 arch/sparc/include/asm/thread_info_64.h |    4 ++--
 arch/x86/include/asm/thread_info.h      |    3 ++-
 grsecurity/Kconfig                      |    4 ++--
 11 files changed, 35 insertions(+), 14 deletions(-)

commit 941429c6316391a4104d5781bf96a4a88b8b270d
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun May 13 14:21:06 2012 -0400

    Add arm/ppc/sparc64 support to GRKERNSEC_SETXID

 arch/arm/include/asm/thread_info.h      |    5 ++++-
 arch/arm/kernel/ptrace.c                |    9 +++++++++
 arch/powerpc/include/asm/thread_info.h  |    6 +++++-
 arch/powerpc/kernel/ptrace.c            |   14 ++++++++++++++
 arch/sparc/include/asm/thread_info_64.h |    7 +++++++
 arch/sparc/kernel/ptrace_64.c           |   14 ++++++++++++++
 arch/sparc/kernel/syscalls.S            |   10 +++++-----
 arch/x86/include/asm/thread_info.h      |    2 +-
 grsecurity/Kconfig                      |    4 ++--
 9 files changed, 61 insertions(+), 10 deletions(-)

commit 27cd051e9c71168dd4ba8048be2bcd962cb9c1bb
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat May 12 23:24:22 2012 -0400

    Make CONFIG_GRKERNSEC_SETXID depend on X86 for now, more architectures to
    be added later
    Speeds up implementation by using existing thread info flag check
    Will also apply the new credentials faster than the previous method, either
    upon the next syscall entry or exit
    Resolves oops triggerable by root reported by Pavel Labushev

 arch/x86/include/asm/thread_info.h |    8 +++++---
 arch/x86/kernel/ptrace.c           |   14 ++++++++++++++
 grsecurity/Kconfig                 |    3 ++-
 kernel/cred.c                      |   11 ++++++++++-
 kernel/sched/core.c                |   15 ---------------
 5 files changed, 31 insertions(+), 20 deletions(-)

commit 47565c239f57cef0f68934085945072768d8bfa3
Merge: f170787 58b316c
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat May 12 17:21:53 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit 58b316c3d406413e6e007f313534cd54114c15e3
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat May 12 17:21:15 2012 -0400

    Update to pax-linux-3.3.6-test12.patch

 arch/x86/kernel/entry_32.S     |    2 +-
 arch/x86/lib/atomic64_cx8_32.S |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

commit f170787d59bfe8af56d3d12c6422ca6c9ee2c9a3
Merge: 1f1f22a 37725adf
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat May 12 15:54:19 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit 37725adf42f6e157916e779acc37696810bc3213
Merge: a17565b b67be2a
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat May 12 15:54:06 2012 -0400

    Merge branch 'linux-3.3.y' into pax-test
    
    Conflicts:
        arch/x86/boot/compressed/relocs.c

commit 1f1f22a1225b5083787871fa1b3825a3ad26c1dd
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed May 9 17:22:32 2012 -0400

    No need to perform descendent checks on anything but PTRACE_ATTACH/PTRACE_SEIZE
    resolves issue with strace -f v4.7

 grsecurity/gracl.c |   25 +++++++++++++------------
 1 files changed, 13 insertions(+), 12 deletions(-)

commit 93d733045b6ebd24173c9ddbf70232382f196ab7
Merge: a2446fc a17565b
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed May 9 17:13:44 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit a17565bf6246281d34fd530b7f93b6dc3affe932
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed May 9 17:13:23 2012 -0400

    Update to pax-linux-3.3.5-test11.patch

 arch/x86/mm/hugetlbpage.c |    7 ++++++-
 arch/x86/mm/init_64.c     |    2 +-
 lib/ioremap.c             |    4 ++--
 mm/memory.c               |    8 ++++++--
 4 files changed, 15 insertions(+), 6 deletions(-)

commit a2446fc9e8ab4215b81285e8e38fb7691fede567
Author: Jeff Mahoney <jeffm@suse.com>
Date:   Wed Apr 25 14:32:09 2012 +0000

    dl2k: Clean up rio_ioctl
    
    The dl2k driver's rio_ioctl call has a few issues:
    - No permissions checking
    - Implements SIOCGMIIREG and SIOCGMIIREG using the SIOCDEVPRIVATE numbers
    - Has a few ioctls that may have been used for debugging at one point
      but have no place in the kernel proper.
    
    This patch removes all but the MII ioctls, renumbers them to use the
    standard ones, and adds the proper permission check for SIOCSMIIREG.
    
    We can also get rid of the dl2k-specific struct mii_data in favor of
    the generic struct mii_ioctl_data.
    
    Since we have the phyid on hand, we can add the SIOCGMIIPHY ioctl too.
    
    Most of the MII code for the driver could probably be converted to use
    the generic MII library but I don't have a device to test the results.
    
    Reported-by: Stephan Mueller <stephan.mueller@atsec.com>
    Signed-off-by: Jeff Mahoney <jeffm@suse.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

 drivers/net/ethernet/dlink/dl2k.c |   52 ++++++------------------------------
 drivers/net/ethernet/dlink/dl2k.h |    7 -----
 2 files changed, 9 insertions(+), 50 deletions(-)

commit 0387e294960d1a97aecf9a091fd04dc6ea60dc24
Merge: 8721cf2 b472141
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon May 7 17:47:29 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit b472141f82dcaaebb0915579b664deb13dd51a63
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon May 7 17:47:09 2012 -0400

    Update to pax-linux-3.3.5-test10.patch

 arch/alpha/include/asm/pgalloc.h      |    6 +++
 arch/arm/include/asm/pgalloc.h        |    6 +++
 arch/ia64/include/asm/pgalloc.h       |   12 ++++++
 arch/mips/include/asm/pgalloc.h       |    5 ++
 arch/parisc/include/asm/pgalloc.h     |    6 +++
 arch/powerpc/include/asm/pgalloc-64.h |    7 +++
 arch/sparc/include/asm/pgalloc_32.h   |    1 +
 arch/sparc/include/asm/pgalloc_64.h   |    1 +
 arch/um/include/asm/pgtable-3level.h  |    1 +
 arch/x86/include/asm/pgalloc.h        |   16 ++++++++
 arch/x86/include/asm/pgtable_64.h     |    2 +
 arch/x86/mm/init_64.c                 |    6 +-
 fs/binfmt_elf.c                       |    6 ++-
 include/linux/mm.h                    |   26 ++++++++++++
 mm/memory.c                           |   41 ++++++++++++++++++++
 mm/sparse-vmemmap.c                   |    4 +-
 mm/vmalloc.c                          |    4 +-
 tools/gcc/size_overflow_plugin.c      |   68 ++++++++++++++++++++++++++-------
 18 files changed, 196 insertions(+), 22 deletions(-)

commit 1d0532c4ddc0739cd7638044ffc05159992468b3
Merge: 09bdf6a dda1cd5
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon May 7 17:46:55 2012 -0400

    Merge branch 'linux-3.3.y' into pax-test

commit 8721cf24ffec2f9a120ad5a057b305c0e42c6f74
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Mon Apr 16 22:48:15 2012 +0200

    i387: ptrace breaks the lazy-fpu-restore logic
    
    Starting from 7e16838d "i387: support lazy restore of FPU state"
    we assume that fpu_owner_task doesn't need restore_fpu_checking()
    on the context switch, its FPU state should match what we already
    have in the FPU on this CPU.
    
    However, debugger can change the tracee's FPU state, in this case
    we should reset fpu.last_cpu to ensure fpu_lazy_restore() can't
    return true.
    
    Change init_fpu() to do this, it is called by user_regset->set()
    methods.
    
    Reported-by: Jan Kratochvil <jan.kratochvil@redhat.com>
    Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Link: http://lkml.kernel.org/r/20120416204815.GB24884@redhat.com
    Cc: <stable@vger.kernel.org> v3.3
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>

 arch/x86/kernel/i387.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

commit e21c05262f5cb25748625efe8c8955ec052772d8
Merge: daa5a9b 09bdf6a
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Apr 27 17:52:51 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit 09bdf6a25a5f726fa28e60d0594ecf58dd766696
Merge: 955435e d0c4f31
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Apr 27 17:52:43 2012 -0400

    Merge branch 'linux-3.3.y' into pax-test

commit daa5a9b75978fafef5f453d3efb91723ad084539
Merge: 76b9055 955435e
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Apr 23 18:07:54 2012 -0400

    Merge branch 'pax-test' into grsec-test
    
    Conflicts:
        security/Kconfig

commit 955435e0efc1b188f632ca4d0918b133174a0fba
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Apr 23 17:53:48 2012 -0400

    Update to pax-linux-3.3.3-test8.patch

 arch/x86/kvm/svm.c                   |    1 -
 drivers/gpu/drm/i915/intel_display.c |    8 +++++++-
 drivers/video/uvesafb.c              |    5 +++--
 security/Kconfig                     |    1 +
 tools/gcc/constify_plugin.c          |    2 +-
 5 files changed, 12 insertions(+), 5 deletions(-)

commit 76b90550e7c2202e102e09f48b77def5302b1298
Merge: ed57dbd e64c3b2
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 22 20:52:35 2012 -0400

    Upstream finally got around to fixing the ASLR infoleak I found and fixed
    in grsecurity in 2009.  Three years with the fix in plain sight in the patch,
    yet still it wasn't known or fixed until I explicitly mentioned it to Kees.
    (this seems to be a recurring theme)
    
    Merge branch 'pax-test' into grsec-test
    
    Conflicts:
        kernel/futex.c
        kernel/futex_compat.c
        security/commoncap.c

commit e64c3b2239335992182ff96235b81e2a87230b80
Merge: e538e1d fa023d5
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 22 20:46:57 2012 -0400

    Merge branch 'linux-3.3.y' into pax-test

commit ed57dbd68c344c1d0e6617247fb7e80e7db1d796
Author: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Date:   Fri Apr 13 03:35:13 2012 +0000

    sparc64: Eliminate obsolete __handle_softirq() function
    
    The invocation of softirq is now handled by irq_exit(), so there is no
    need for sparc64 to invoke it on the trap-return path.  In fact, doing so
    is a bug because if the trap occurred in the idle loop, this invocation
    can result in lockdep-RCU failures.  The problem is that RCU ignores idle
    CPUs, and the sparc64 trap-return path to the softirq handlers fails to
    tell RCU that the CPU must be considered non-idle while those handlers
    are executing.  This means that RCU is ignoring any RCU read-side critical
    sections in those handlers, which in turn means that RCU-protected data
    can be yanked out from under those read-side critical sections.
    
    The shiny new lockdep-RCU ability to detect RCU read-side critical sections
    that RCU is ignoring located this problem.
    
    The fix is straightforward: Make sparc64 stop manually invoking the
    softirq handlers.
    
    Reported-by: Meelis Roos <mroos@linux.ee>
    Suggested-by: David Miller <davem@davemloft.net>
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Tested-by: Meelis Roos <mroos@linux.ee>
    Cc: stable@vger.kernel.org
    Signed-off-by: David S. Miller <davem@davemloft.net>

 arch/sparc/kernel/rtrap_64.S |    7 -------
 1 files changed, 0 insertions(+), 7 deletions(-)

commit e094cb83872b493ec77323eef91eaf409f13df79
Author: David S. Miller <davem@davemloft.net>
Date:   Fri Apr 13 11:56:22 2012 -0700

    sparc64: Fix bootup crash on sun4v.
    
    The DS driver registers as a subsys_initcall() but this can be too
    early, in particular this risks registering before we've had a chance
    to allocate and setup module_kset in kernel/params.c which is
    performed also as a subsyts_initcall().
    
    Register DS using device_initcall() insteal.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Cc: stable@vger.kernel.org

 arch/sparc/kernel/ds.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

commit 2fe8dca41a62e05f6c0a0bf4852f8a8d0b8967e0
Author: Lubos Lunak <l.lunak@suse.cz>
Date:   Wed Mar 21 14:08:24 2012 +0100

    do not export kernel's NULL #define to userspace
    
    GCC's NULL is actually __null, which allows detecting some questionable
    NULL usage and warn about it.  Moreover each platform/compiler should
    have its own stddef.h anyway (which is different from linux/stddef.h).
    
    So there's no good reason to leak kernel's NULL to userspace and
    override what the compiler provides.
    
    Signed-off-by: Luboš Luňák <l.lunak@suse.cz>
    Acked-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 include/linux/stddef.h |    8 ++------
 1 files changed, 2 insertions(+), 6 deletions(-)

commit 7dc1db81ece569ccad1227ef72ab58c4f160c5f9
Author: Alex Williamson <alex.williamson@redhat.com>
Date:   Wed Apr 11 09:51:49 2012 -0600

    KVM: unmap pages from the iommu when slots are removed
    
    We've been adding new mappings, but not destroying old mappings.
    This can lead to a page leak as pages are pinned using
    get_user_pages, but only unpinned with put_page if they still
    exist in the memslots list on vm shutdown.  A memslot that is
    destroyed while an iommu domain is enabled for the guest will
    therefore result in an elevated page reference count that is
    never cleared.
    
    Additionally, without this fix, the iommu is only programmed
    with the first translation for a gpa.  This can result in
    peer-to-peer errors if a mapping is destroyed and replaced by a
    new mapping at the same gpa as the iommu will still be pointing
    to the original, pinned memory address.
    
    Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
    Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

 include/linux/kvm_host.h |    6 ++++++
 virt/kvm/iommu.c         |    7 ++++++-
 virt/kvm/kvm_main.c      |    5 +++--
 3 files changed, 15 insertions(+), 3 deletions(-)

commit b0e0913f11ccad2909d96833b21f3d1dd1dd187b
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Apr 19 20:27:57 2012 -0400

    http://marc.info/?l=linux-kernel&m=133455712201581&w=2
    
    Currently we do not validate the vector length before calling
    get_user_pages_fast(), host stack would be easily overflowed by
    malicious guest driver who give us a descriptor with length greater
    than MAX_SKB_FRAGS. Solve this problem by checking the free entries
    before trying to pin user pages.
    
    Signed-off-by: Jason Wang <jasowang@redhat.com>

 drivers/net/macvtap.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

commit a3632ca0baf60466c650053eb72e1b047540e4cc
Author: Eric Paris <eparis@redhat.com>
Date:   Tue Apr 17 16:26:54 2012 -0400

    fcaps: clear the same personality flags as suid when fcaps are used
    
    If a process increases permissions using fcaps all of the dangerous
    personality flags which are cleared for suid apps should also be cleared.
    Thus programs given priviledge with fcaps will continue to have address space
    randomization enabled even if the parent tried to disable it to make it
    easier to attack.
    
    Signed-off-by: Eric Paris <eparis@redhat.com>
    Reviewed-by: Serge Hallyn <serge.hallyn@canonical.com>
    Signed-off-by: James Morris <james.l.morris@oracle.com>

 security/commoncap.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

commit 6bb89c4bd981848dd5647a2f3c933937d8e49a61
Merge: c7db64d e538e1d
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 15 11:08:50 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit e538e1de0e33950814137a835b0402a097939c3f
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 15 11:08:26 2012 -0400

    Update to pax-linux-3.3.2-test7.patch

 arch/x86/include/asm/cmpxchg.h  |    4 ++--
 arch/x86/include/asm/kvm_host.h |    2 +-
 arch/x86/kvm/vmx.c              |    1 -
 include/asm-generic/pgtable.h   |    4 ++--
 kernel/panic.c                  |    2 +-
 5 files changed, 6 insertions(+), 7 deletions(-)

commit c7db64db701e32d76797a3e07bc5c43c4029bb4b
Author: Jason Wessel <jason.wessel@windriver.com>
Date:   Thu Apr 12 12:49:17 2012 -0700

    panic: fix stack dump print on direct call to panic()
    
    Commit 6e6f0a1f0fa6 ("panic: don't print redundant backtraces on oops")
    causes a regression where no stack trace will be printed at all for the
    case where kernel code calls panic() directly while not processing an
    oops, and of course there are 100's of instances of this type of call.
    
    The original commit executed the check (!oops_in_progress), but this will
    always be false because just before the dump_stack() there is a call to
    bust_spinlocks(1), which does the following:
    
      void __attribute__((weak)) bust_spinlocks(int yes)
      {
        if (yes) {
                ++oops_in_progress;
    
    The proper way to resolve the problem that original commit tried to
    solve is to avoid printing a stack dump from panic() when the either of
    the following conditions is true:
    
      1) TAINT_DIE has been set (this is done by oops_end())
         This indicates and oops has already been printed.
      2) oops_in_progress > 1
         This guards against the rare case where panic() is invoked
         a second time, or in between oops_begin() and oops_end()
    
    Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
    Cc: Andi Kleen <ak@linux.intel.com>
    Cc: <stable@vger.kernel.org>        [3.3+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 kernel/panic.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

commit fa5fabf348ab41988ef87d20d24e3203c2aa8d40
Author: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Date:   Thu Apr 12 12:49:12 2012 -0700

    drivers/char/random.c: fix boot id uniqueness race
    
    /proc/sys/kernel/random/boot_id can be read concurrently by userspace
    processes.  If two (or more) user-space processes concurrently read
    boot_id when sysctl_bootid is not yet assigned, a race can occur making
    boot_id differ between the reads.  Because the whole point of the boot id
    is to be unique across a kernel execution, fix this by protecting this
    operation with a spinlock.
    
    Given that this operation is not frequently used, hitting the spinlock
    on each call should not be an issue.
    
    Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Cc: "Theodore Ts'o" <tytso@mit.edu>
    Cc: Matt Mackall <mpm@selenic.com>
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Cc: Greg Kroah-Hartman <greg@kroah.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 drivers/char/random.c |   11 ++++++++---
 1 files changed, 8 insertions(+), 3 deletions(-)

commit 9f055943f8c70a331e6066d154584b94b8a7e6ff
Merge: 15291162 69e4937
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Apr 13 16:10:29 2012 -0400

    Merge branch 'pax-test' into grsec-test
    
    Conflicts:
        kernel/sysctl.c

commit 69e4937b96b2c03dbe975eb70991f89bbe448411
Merge: 0c851ef ad07d7b
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Apr 13 16:09:07 2012 -0400

    Merge branch 'linux-3.3.y' into pax-test

commit 152911622e7f698d34ae653ea79060d3f518bcb7
Merge: 5c04558 0c851ef
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Apr 9 17:02:01 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit 0c851ef08806717abcb17f2e3f7156250a68e31a
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Apr 9 17:01:48 2012 -0400

    Update to pax-linux-3.3.1-test7.patch

 arch/x86/kernel/kdebugfs.c |    2 ++
 arch/x86/mm/pgtable.c      |    4 ++++
 2 files changed, 6 insertions(+), 0 deletions(-)

commit 5c04558d606ca8cfe925fa0d1c7cdcc7ad15b199
Merge: 29547b5 8bb406f
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 8 16:01:46 2012 -0400

    Merge branch 'pax-test' into grsec-test
    
    Conflicts:
        mm/mmap.c
        security/Kconfig

commit 29547b5c27a97d0e13bd59bc3869f270ec472d66
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 8 15:59:33 2012 -0400

    Revert "Fix RLIMIT_AS accounting with brk randomization"
    
    This reverts commit e8719b11ed6e03b3c9c4ca769dcd9341af0ca411.

 fs/binfmt_elf.c |    2 +-
 mm/mmap.c       |    2 --
 2 files changed, 1 insertions(+), 3 deletions(-)

commit 784a578e35994ada12d51ee064538c06f0ad527c
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 8 15:59:14 2012 -0400

    Revert "Fix RLIMIT_AS checking with brk randomization"
    
    This reverts commit 0f5c00e65adef2b874afcaf36bd15898f1b07d1e.

 fs/binfmt_elf.c |    2 --
 mm/mmap.c       |    5 +----
 2 files changed, 1 insertions(+), 6 deletions(-)

commit 68018e31a67166e3459768a57bcb9827c42e4906
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 8 15:58:59 2012 -0400

    Revert "set end_data before mmap of gap otherwise we'll be counting toward RLIMIT_AS"
    
    This reverts commit 3822d8ebbe141004d4b57c71cbc4ed2948753059.

 fs/binfmt_elf.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

commit 22ed2b3ef411bfe753ddcb039f52a02336003f98
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 8 15:58:40 2012 -0400

    Revert "Fix RLIMIT_AS checking with brk randomization"
    
    This reverts commit 5693e0379b65616a111084fc0db5e408ee716d54.

 fs/binfmt_elf.c |    2 ++
 mm/mmap.c       |    2 +-
 2 files changed, 3 insertions(+), 1 deletions(-)

commit dd0706106b0a4e80d65cb971262faedb2eff82cb
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 8 15:58:12 2012 -0400

    Revert "fix wraparound"
    
    This reverts commit daa20cc1ecd09f3745ee2895af1385e02be79822.

 fs/binfmt_elf.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)

commit 803884ee45cb70ea06558aa4e409fbcff93d3d71
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 8 15:56:40 2012 -0400

    Revert "fake start_brk value before mmap is processed"
    
    This reverts commit a18343183d8978e473d53569ed4d700ff798ad35.

 fs/binfmt_elf.c |    1 -
 1 files changed, 0 insertions(+), 1 deletions(-)

commit 8bb406fb30151e48b05390fcbdf886c3a9f773f9
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 8 15:55:34 2012 -0400

    Update to pax-linux-3.3.1-test6.patch

 Documentation/dontdiff                             |    1 +
 Makefile                                           |    7 +-
 arch/x86/crypto/aesni-intel_glue.c                 |    2 +
 arch/x86/include/asm/floppy.h                      |    1 +
 arch/x86/include/asm/kvm_host.h                    |    6 +-
 arch/x86/include/asm/syscalls.h                    |    2 +-
 arch/x86/include/asm/uaccess_32.h                  |   31 +-
 arch/x86/include/asm/uaccess_64.h                  |   38 +-
 arch/x86/kernel/cpu/mcheck/mce-inject.c            |    2 +
 arch/x86/kernel/cpu/mtrr/if.c                      |    2 +
 arch/x86/kernel/i387.c                             |   20 +
 arch/x86/kernel/ldt.c                              |    2 +
 arch/x86/kernel/microcode_intel.c                  |    1 +
 arch/x86/kernel/module.c                           |    1 +
 arch/x86/kernel/ptrace.c                           |    4 +
 arch/x86/kernel/setup_percpu.c                     |    4 +
 arch/x86/kernel/tls.h                              |    2 +-
 arch/x86/kernel/vm86_32.c                          |    3 +
 arch/x86/kvm/svm.c                                 |    1 +
 arch/x86/kvm/vmx.c                                 |    1 +
 arch/x86/kvm/x86.c                                 |   21 +
 arch/x86/kvm/x86.h                                 |    4 +-
 arch/x86/lib/usercopy_32.c                         |    6 +
 arch/x86/mm/pgtable.c                              |   12 +-
 arch/x86/platform/uv/tlb_uv.c                      |    4 +
 crypto/ablkcipher.c                                |    4 +
 crypto/aead.c                                      |    3 +
 crypto/blkcipher.c                                 |    3 +
 crypto/cipher.c                                    |    3 +
 drivers/acpi/battery.c                             |    3 +
 drivers/acpi/sbs.c                                 |    3 +
 drivers/infiniband/hw/ipath/ipath_fs.c             |    4 +
 drivers/infiniband/hw/qib/qib_fs.c                 |    4 +
 drivers/lguest/lguest_user.c                       |    1 +
 drivers/md/dm-raid1.c                              |    4 +
 drivers/md/dm-stripe.c                             |    1 +
 drivers/media/video/cpia2/cpia2_core.c             |    1 +
 drivers/media/video/cx18/cx18-alsa-pcm.c           |    2 +
 drivers/media/video/cx231xx/cx231xx-audio.c        |    2 +
 drivers/media/video/em28xx/em28xx-audio.c          |    2 +
 drivers/media/video/meye.c                         |    1 +
 drivers/media/video/saa7164/saa7164-encoder.c      |    2 +
 drivers/media/video/saa7164/saa7164-vbi.c          |    2 +
 drivers/media/video/videobuf-dma-contig.c          |    1 +
 drivers/media/video/videobuf-dma-sg.c              |    1 +
 drivers/media/video/videobuf-vmalloc.c             |    1 +
 drivers/mtd/ubi/build.c                            |   16 +-
 drivers/mtd/ubi/debug.c                            |    2 +
 drivers/net/ethernet/chelsio/cxgb/sge.c            |    2 +
 drivers/net/ethernet/chelsio/cxgb3/sge.c           |    4 +
 drivers/net/ethernet/chelsio/cxgb4/sge.c           |    3 +
 drivers/net/ethernet/chelsio/cxgb4vf/sge.c         |    3 +
 drivers/net/wireless/ath/ath5k/debug.c             |    3 +
 drivers/net/wireless/ath/ath9k/debug.c             |    2 +
 drivers/net/wireless/ath/ath9k/htc_drv_debug.c     |    2 +
 drivers/oprofile/oprofile_files.c                  |    5 +
 drivers/oprofile/oprofilefs.c                      |    1 +
 drivers/platform/x86/asus_acpi.c                   |    2 +
 drivers/platform/x86/toshiba_acpi.c                |    2 +
 drivers/staging/rtl8192e/rtllib_module.c           |    2 +
 .../staging/rtl8192u/ieee80211/ieee80211_module.c  |    2 +
 drivers/usb/core/message.c                         |    4 +-
 fs/binfmt_elf.c                                    |    1 +
 fs/cifs/asn1.c                                     |    3 +
 fs/configfs/file.c                                 |    2 +
 fs/exec.c                                          |   10 +
 fs/ncpfs/ncplib_kernel.h                           |    4 +-
 fs/seq_file.c                                      |   12 +-
 fs/sysfs/bin.c                                     |    2 +
 fs/ubifs/debug.c                                   |    3 +
 include/asm-generic/int-l64.h                      |    2 -
 include/asm-generic/int-ll64.h                     |    2 -
 include/asm-generic/uaccess.h                      |   11 +
 include/linux/compiler-gcc4.h                      |    3 +
 include/linux/compiler.h                           |    3 +
 include/linux/crash_dump.h                         |    2 +-
 include/linux/kvm_host.h                           |   14 +-
 include/linux/mm_types.h                           |    4 +-
 include/linux/moduleloader.h                       |    4 +-
 include/linux/oprofile.h                           |    2 +-
 include/linux/slab.h                               |   63 +-
 include/linux/slab_def.h                           |    6 +-
 include/linux/slob_def.h                           |    5 +-
 include/linux/slub_def.h                           |   10 +-
 include/linux/uaccess.h                            |    2 +-
 include/linux/vmalloc.h                            |  123 +-
 mm/mmap.c                                          |    5 +
 mm/util.c                                          |    2 -
 mm/vmalloc.c                                       |    9 -
 net/bridge/netfilter/ebt_ulog.c                    |    1 +
 net/ipv4/ah4.c                                     |    2 +
 net/ipv4/netfilter/arp_tables.c                    |   10 +
 net/ipv4/netfilter/ip_tables.c                     |   11 +
 net/ipv4/netfilter/ipt_ULOG.c                      |    1 +
 net/ipv4/netfilter/nf_nat_snmp_basic.c             |    6 +-
 net/ipv6/ah6.c                                     |    2 +
 net/ipv6/netfilter/ip6_tables.c                    |   11 +
 scripts/mod/modpost.c                              |    2 +-
 scripts/tags.sh                                    |    2 +-
 security/Kconfig                                   |   15 +-
 tools/gcc/Makefile                                 |    3 +
 tools/gcc/kernexec_plugin.c                        |    2 +-
 tools/gcc/size_overflow_hash1.h                    | 3047 ++++++++++++++++++++
 tools/gcc/size_overflow_hash2.h                    |   35 +
 tools/gcc/size_overflow_plugin.c                   | 1110 +++++++
 105 files changed, 4589 insertions(+), 261 deletions(-)

commit 8b57bb1090a9dbe75bee876917e2522d278f004b
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 8 15:40:58 2012 -0400

    Always allow use of AF_UNSPEC for already-connected sockets to disconnect

 grsecurity/gracl_ip.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

commit 9f88f736253a3bffdaaefc2dfb97cba3761707aa
Author: Eric Dumazet <eric.dumazet@gmail.com>
Date:   Thu Apr 5 22:17:46 2012 +0000

    netlink: fix races after skb queueing
    
    As soon as an skb is queued into socket receive_queue, another thread
    can consume it, so we are not allowed to reference skb anymore, or risk
    use after free.
    
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

 net/netlink/af_netlink.c |   24 +++++++++++++-----------
 1 files changed, 13 insertions(+), 11 deletions(-)

commit cdbca15d6401902654b96d3105113865c37941e4
Author: Eric Dumazet <eric.dumazet@gmail.com>
Date:   Fri Apr 6 10:49:10 2012 +0200

    net: fix a race in sock_queue_err_skb()
    
    As soon as an skb is queued into socket error queue, another thread
    can consume it, so we are not allowed to reference skb anymore, or risk
    use after free.
    
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

 net/core/skbuff.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

commit 96360cf85c2108f01a4fbbcfe6f63b4893f6a0fc
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 8 10:13:28 2012 -0400

    always allow admin to follow ptrace'd execs
    no need for task_lock

 grsecurity/gracl.c |   19 ++++++++++++++++---
 1 files changed, 16 insertions(+), 3 deletions(-)

commit 9b915f7c937489fc3625981b619006c496e4bdaf
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 8 07:01:20 2012 -0400

    Require CAP_SYS_ADMIN for /sys/kernel/uevent_helper

 kernel/ksysfs.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

commit ac1df8a3412ab214b392a7eaee2b96f3478c8469
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Apr 8 06:58:58 2012 -0400

    Require CAP_SYS_ADMIN for /proc/sysrq-trigger

 drivers/tty/sysrq.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

commit a18343183d8978e473d53569ed4d700ff798ad35
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Apr 6 19:45:36 2012 -0400

    fake start_brk value before mmap is processed

 fs/binfmt_elf.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

commit daa20cc1ecd09f3745ee2895af1385e02be79822
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Apr 6 18:56:24 2012 -0400

    fix wraparound

 fs/binfmt_elf.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

commit 5693e0379b65616a111084fc0db5e408ee716d54
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Apr 6 18:14:20 2012 -0400

    Fix RLIMIT_AS checking with brk randomization

 fs/binfmt_elf.c |    2 --
 mm/mmap.c       |    2 +-
 2 files changed, 1 insertions(+), 3 deletions(-)

commit 3822d8ebbe141004d4b57c71cbc4ed2948753059
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Apr 5 21:23:00 2012 -0400

    set end_data before mmap of gap otherwise we'll be counting toward RLIMIT_AS

 fs/binfmt_elf.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

commit 0f5c00e65adef2b874afcaf36bd15898f1b07d1e
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Apr 5 20:54:16 2012 -0400

    Fix RLIMIT_AS checking with brk randomization

 fs/binfmt_elf.c |    2 ++
 mm/mmap.c       |    5 ++++-
 2 files changed, 6 insertions(+), 1 deletions(-)

commit e8719b11ed6e03b3c9c4ca769dcd9341af0ca411
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Apr 5 19:53:46 2012 -0400

    Fix RLIMIT_AS accounting with brk randomization

 fs/binfmt_elf.c |    2 +-
 mm/mmap.c       |    2 ++
 2 files changed, 3 insertions(+), 1 deletions(-)

commit 71e7dbb7e5586987130b85faec1b689557ae89ea
Merge: 236c100 d333553
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Apr 2 17:38:41 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit d333553e2c2b46b81ddeaa6c06e66d885f853514
Merge: efbb92a 07a4483
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Apr 2 17:38:26 2012 -0400

    Merge branch 'linux-3.3.y' into pax-test
    
    Conflicts:
        arch/x86/net/bpf_jit_comp.c

commit 236c100307ff0416f0ef17efe7540a2ce0077cbf
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Sat Mar 24 10:52:50 2012 +0300

    x86, tls: Off by one limit check
    
    These are used as offsets into an array of GDT_ENTRY_TLS_ENTRIES members
    so GDT_ENTRY_TLS_ENTRIES is one past the end of the array.
    
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Link: http://lkml.kernel.org/r/20120324075250.GA28258@elgon.mountain
    Cc: <stable@vger.kernel.org>
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>

 arch/x86/kernel/tls.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

commit 7062ff9c0cada849bc7d984d6318d52be7647b44
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Mon Mar 19 16:19:53 2012 -0700

    vfs: get rid of batshit-insane pointless dentry hash calculations
    
    For some odd historical reason, the final mixing round for the dentry
    cache hash table lookup had an insane "xor with big constant" logic.  In
    two places.
    
    The big constant that is being xor'ed is GOLDEN_RATIO_PRIME, which is a
    fairly random-looking number that is designed to be *multiplied* with so
    that the bits get spread out over a whole long-word.
    
    But xor'ing with it is insane.  It doesn't really even change the hash -
    it really only shifts the hash around in the hash table.  To make
    matters worse, the insane big constant is different on 32-bit and 64-bit
    builds, even though the name hash bits we use are always 32-bit (and the
    bits from the pointer we mix in effectively are too).
    
    It's all total voodoo programming, in other words.
    
    Now, some testing and analysis of the hash chains shows that the rest of
    the hash function seems to be fairly good.  It does pick the right bits
    of the parent dentry pointer, for example, and while it's generally a
    bad idea to use an xor to mix down the upper bits (because if there is a
    repeating pattern, the xor can cause "destructive interference"), it
    seems to not have been a disaster.
    
    For example, replacing the hash with the normal "hash_long()" code (that
    uses the GOLDEN_RATIO_PRIME constant correctly, btw) actually just makes
    the hash worse.  The hand-picked hash knew which bits of the pointer had
    the highest entropy, and hash_long() ends up mixing bits less optimally
    at least in some trivial tests.
    
    So the hash function overall seems fine, it just has that really odd
    "shift result around by a constant xor".
    
    So get rid of the silly xor, and replace the down-mixing of the bits
    with an add instead of an xor that tends to not have the same kind of
    destructive interference issues.  Some stats on the resulting hash
    chains shows that they look statistically identical before and after,
    but the code is simpler and no longer makes you go "WTF?".
    
    Also, the incoming hash really is just "unsigned int", not a long, and
    there's no real point to worry about the high 26 bits of the dentry
    pointer for the 64-bit case, because they are all going to be identical
    anyway.
    
    So also change the hashing to be done in the more natural 'unsigned int'
    that is the real size of the actual hashed data anyway.
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 fs/dcache.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

commit 1933ee4cf1ce8f256e0441323d0fa1555016ca3c
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Fri Mar 23 15:02:40 2012 -0700

    ptrace: don't send SIGTRAP on exec if SEIZED
    
    ptrace_event(PTRACE_EVENT_EXEC) sends SIGTRAP if PT_TRACE_EXEC is not
    set.  This is because this SIGTRAP predates PTRACE_O_TRACEEXEC option,
    we do not need/want this with PT_SEIZED which can set the options during
    attach.
    
    Suggested-by: Pedro Alves <palves@redhat.com>
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Cc: Chris Evans <scarybeasts@gmail.com>
    Cc: Indan Zupancic <indan@nul.nu>
    Cc: Denys Vlasenko <vda.linux@googlemail.com>
    Cc: Tejun Heo <tj@kernel.org>
    Cc: Pedro Alves <palves@redhat.com>
    Cc: Jan Kratochvil <jan.kratochvil@redhat.com>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 include/linux/ptrace.h |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

commit 96b9985a386432ddefbca4f3ca3837fe72652e77
Author: Dmitry Adamushko <dmitry.adamushko@gmail.com>
Date:   Thu Mar 22 21:39:25 2012 +0100

    x86-32: Fix endless loop when processing signals for kernel tasks
    
    The problem occurs on !CONFIG_VM86 kernels [1] when a kernel-mode task
    returns from a system call with a pending signal.
    
    A real-life scenario is a child of 'khelper' returning from a failed
    kernel_execve() in ____call_usermodehelper() [ kernel/kmod.c ].
    kernel_execve() fails due to a pending SIGKILL, which is the result of
    "kill -9 -1" (at least, busybox's init does it upon reboot).
    
    The loop is as follows:
    
    * syscall_exit_work:
     - work_pending:            // start_of_the_loop
     - work_notify_sig:
       - do_notify_resume()
         - do_signal()
           - if (!user_mode(regs)) return;
     - resume_userspace         // TIF_SIGPENDING is still set
     - work_pending             // so we call work_pending => goto
                                // start_of_the_loop
    
    More information can be found in another LKML thread:
    http://www.serverphorums.com/read.php?12,457826
    
    [1] the problem was also seen on MIPS.
    
    Signed-off-by: Dmitry Adamushko <dmitry.adamushko@gmail.com>
    Link: http://lkml.kernel.org/r/1332448765.2299.68.camel@dimm
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Roland McGrath <roland@hack.frob.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>

 arch/x86/kernel/entry_32.S |   17 ++++++++++-------
 1 files changed, 10 insertions(+), 7 deletions(-)

commit d2184c1098a46d3b1f96299f352d11f2e20da3b0
Merge: 412185c efbb92a
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Mar 25 18:35:21 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit efbb92ad36e7e4f53482380f53a9cc38faca925d
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Mar 25 18:35:07 2012 -0400

    Update to pax-linux-3.3-test4.patch

 fs/binfmt_elf.c         |    8 ++++----
 kernel/rcutiny_plugin.h |    2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

commit 412185c4992a6b746d4afd039ba43ef234f67aad
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Mar 24 20:19:01 2012 -0400

    compile fix

 fs/proc/base.c |   12 +++++++-----
 1 files changed, 7 insertions(+), 5 deletions(-)

commit c9ef1bf36c5145857ddec249fd3faac5507661cd
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Mar 24 20:03:33 2012 -0400

    Fix port of /proc restrictions

 fs/proc/base.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

commit 3eb9d8c8fef296ab41ac6db5e24f8472f2849ea9
Merge: 0e19043 0570523
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Mar 24 19:35:37 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit 0570523cdca02dd228082b0152dd14140aa9b4d4
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Mar 24 19:34:11 2012 -0400

    Update to pax-linux-3.3-test3.patch
    reduces overcommit amount from recently increased brk entropy

 arch/arm/include/asm/atomic.h |    5 +++++
 fs/binfmt_elf.c               |   27 ++++++++++++++++++++++-----
 fs/bio.c                      |    2 +-
 3 files changed, 28 insertions(+), 6 deletions(-)

commit 0e19043d13ef5ba8c833d075d49b5cfb1bdfec53
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Mar 24 19:25:48 2012 -0400

    Hold rcu_read_lock

 fs/proc/base.c |   22 +++++++++++++---------
 1 files changed, 13 insertions(+), 9 deletions(-)

commit 9a90e1cffec9080574cef64611b1828690a6f3d8
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Mar 24 19:20:34 2012 -0400

    compile fix

 grsecurity/gracl.c        |   25 ++++++++++++++++---------
 grsecurity/grsec_chroot.c |    4 ++--
 2 files changed, 18 insertions(+), 11 deletions(-)

commit 485755bfa7629914889409b5aa18d614fedaf873
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Mar 24 18:34:44 2012 -0400

    compile fix

 fs/proc/base.c            |    4 ++--
 grsecurity/grsec_chroot.c |    3 +--
 2 files changed, 3 insertions(+), 4 deletions(-)

commit e796b6a7bd9f204ae918e9bef8b6aa7650735e77
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Mar 24 18:30:36 2012 -0400

    compile fix

 fs/proc/base.c            |   10 ++--------
 grsecurity/grsec_chroot.c |    1 +
 grsecurity/grsec_exec.c   |    2 ++
 3 files changed, 5 insertions(+), 8 deletions(-)

commit 75f929048fd30016197a1d3b265b46591b985e72
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Mar 24 18:19:34 2012 -0400

    compile fix

 kernel/fork.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

commit f5d20702ca626d8ed7c7cdb3312f02dcf7eb0fe8
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Mar 24 18:16:51 2012 -0400

    Initial patch of grsecurity 2.9 for Linux 3.3

 Makefile                                           |    8 +-
 arch/alpha/include/asm/cache.h                     |    4 +-
 arch/arm/include/asm/cache.h                       |    2 +
 arch/arm/kernel/traps.c                            |    5 +
 arch/arm/mach-ux500/mbox-db5500.c                  |    2 +-
 arch/avr32/include/asm/cache.h                     |    4 +-
 arch/blackfin/include/asm/cache.h                  |    3 +-
 arch/cris/include/arch-v10/arch/cache.h            |    3 +-
 arch/cris/include/arch-v32/arch/cache.h            |    3 +-
 arch/frv/include/asm/cache.h                       |    3 +-
 arch/h8300/include/asm/cache.h                     |    4 +-
 arch/hexagon/include/asm/cache.h                   |    6 +-
 arch/ia64/include/asm/cache.h                      |    3 +-
 arch/m32r/include/asm/cache.h                      |    4 +-
 arch/m68k/include/asm/cache.h                      |    4 +-
 arch/microblaze/include/asm/cache.h                |    3 +-
 arch/mips/include/asm/cache.h                      |    3 +-
 arch/mn10300/proc-mn103e010/include/proc/cache.h   |    4 +-
 arch/mn10300/proc-mn2ws0050/include/proc/cache.h   |    4 +-
 arch/openrisc/include/asm/cache.h                  |    4 +-
 arch/parisc/include/asm/cache.h                    |    5 +-
 arch/powerpc/include/asm/cache.h                   |    3 +-
 arch/powerpc/kernel/process.c                      |   10 +-
 arch/powerpc/kernel/traps.c                        |    5 +
 arch/s390/include/asm/cache.h                      |    4 +-
 arch/score/include/asm/cache.h                     |    4 +-
 arch/sh/include/asm/cache.h                        |    3 +-
 arch/sparc/Makefile                                |    2 +-
 arch/sparc/include/asm/cache.h                     |    4 +-
 arch/sparc/kernel/process_32.c                     |    8 +-
 arch/sparc/kernel/process_64.c                     |    8 +-
 arch/sparc/kernel/traps_32.c                       |    8 +-
 arch/sparc/kernel/traps_64.c                       |   28 +-
 arch/sparc/kernel/unaligned_64.c                   |    2 +-
 arch/sparc/mm/fault_64.c                           |    2 +-
 arch/tile/include/asm/cache.h                      |    3 +-
 arch/um/include/asm/cache.h                        |    3 +-
 arch/unicore32/include/asm/cache.h                 |    6 +-
 arch/x86/Kconfig                                   |    5 +-
 arch/x86/ia32/ia32_aout.c                          |    2 +
 arch/x86/kernel/acpi/realmode/wakeup.S             |    4 +
 arch/x86/kernel/dumpstack.c                        |    8 +
 arch/x86/kernel/entry_32.S                         |    2 +-
 arch/x86/kernel/entry_64.S                         |    2 +-
 arch/x86/kernel/ioport.c                           |   13 +
 arch/x86/kernel/verify_cpu.S                       |    1 +
 arch/x86/kernel/vm86_32.c                          |   16 +
 arch/x86/mm/fault.c                                |   11 +-
 arch/x86/mm/init.c                                 |   15 +
 arch/xtensa/variants/dc232b/include/variant/core.h |    2 +-
 arch/xtensa/variants/fsf/include/variant/core.h    |    3 +-
 arch/xtensa/variants/s6000/include/variant/core.h  |    3 +-
 drivers/block/cciss.c                              |    2 +
 drivers/char/Kconfig                               |    4 +-
 drivers/char/briq_panel.c                          |    8 +-
 drivers/char/genrtc.c                              |    1 +
 drivers/char/mem.c                                 |   17 +
 drivers/char/random.c                              |   12 +
 drivers/gpu/drm/drm_info.c                         |    4 +
 drivers/message/fusion/mptbase.c                   |    5 +
 drivers/pci/proc.c                                 |    9 +
 drivers/rtc/rtc-dev.c                              |    3 +
 drivers/tty/vt/keyboard.c                          |   10 +
 drivers/tty/vt/vt_ioctl.c                          |   12 +-
 drivers/video/logo/logo_linux_clut224.ppm          | 2721 ++++++--------
 fs/attr.c                                          |    1 +
 fs/binfmt_aout.c                                   |    7 +
 fs/binfmt_elf.c                                    |    6 +
 fs/btrfs/inode.c                                   |   10 +-
 fs/btrfs/ioctl.c                                   |    6 +-
 fs/ceph/dir.c                                      |    2 +-
 fs/compat.c                                        |   18 +
 fs/debugfs/inode.c                                 |    4 +
 fs/exec.c                                          |  155 +-
 fs/ext2/balloc.c                                   |    2 +-
 fs/ext3/balloc.c                                   |    5 +-
 fs/ext4/balloc.c                                   |    4 +-
 fs/fcntl.c                                         |    6 +
 fs/file.c                                          |    2 +
 fs/filesystems.c                                   |    5 +
 fs/fs_struct.c                                     |   11 +-
 fs/hugetlbfs/inode.c                               |    2 +-
 fs/namei.c                                         |  226 +-
 fs/namespace.c                                     |   24 +
 fs/open.c                                          |   35 +
 fs/pipe.c                                          |    2 +-
 fs/proc/Kconfig                                    |   10 +-
 fs/proc/array.c                                    |   61 +-
 fs/proc/base.c                                     |  171 +-
 fs/proc/cmdline.c                                  |    4 +
 fs/proc/devices.c                                  |    4 +
 fs/proc/inode.c                                    |   17 +
 fs/proc/internal.h                                 |    3 +
 fs/proc/kcore.c                                    |    3 +
 fs/proc/proc_net.c                                 |   11 +
 fs/proc/proc_sysctl.c                              |   31 +-
 fs/proc/root.c                                     |    8 +
 fs/proc/task_mmu.c                                 |   67 +-
 fs/readdir.c                                       |   19 +
 fs/select.c                                        |    2 +
 fs/seq_file.c                                      |    4 +
 fs/sysfs/dir.c                                     |   12 +
 fs/utimes.c                                        |    7 +
 fs/xattr.c                                         |   20 +-
 grsecurity/Kconfig                                 | 1078 +++++
 grsecurity/Makefile                                |   38 +
 grsecurity/gracl.c                                 | 4172 ++++++++++++++++++++
 grsecurity/gracl_alloc.c                           |  105 +
 grsecurity/gracl_cap.c                             |  110 +
 grsecurity/gracl_fs.c                              |  435 ++
 grsecurity/gracl_ip.c                              |  381 ++
 grsecurity/gracl_learn.c                           |  207 +
 grsecurity/gracl_res.c                             |   68 +
 grsecurity/gracl_segv.c                            |  299 ++
 grsecurity/gracl_shm.c                             |   40 +
 grsecurity/grsec_chdir.c                           |   19 +
 grsecurity/grsec_chroot.c                          |  368 ++
 grsecurity/grsec_disabled.c                        |  437 ++
 grsecurity/grsec_exec.c                            |  172 +
 grsecurity/grsec_fifo.c                            |   24 +
 grsecurity/grsec_fork.c                            |   23 +
 grsecurity/grsec_init.c                            |  277 ++
 grsecurity/grsec_link.c                            |   43 +
 grsecurity/grsec_log.c                             |  322 ++
 grsecurity/grsec_mem.c                             |   40 +
 grsecurity/grsec_mount.c                           |   62 +
 grsecurity/grsec_pax.c                             |   36 +
 grsecurity/grsec_ptrace.c                          |   30 +
 grsecurity/grsec_sig.c                             |  207 +
 grsecurity/grsec_sock.c                            |  244 ++
 grsecurity/grsec_sysctl.c                          |  451 +++
 grsecurity/grsec_time.c                            |   16 +
 grsecurity/grsec_tpe.c                             |   73 +
 grsecurity/grsum.c                                 |   61 +
 include/linux/capability.h                         |    2 +
 include/linux/cred.h                               |    3 +
 include/linux/gracl.h                              |  319 ++
 include/linux/gralloc.h                            |    9 +
 include/linux/grdefs.h                             |  140 +
 include/linux/grinternal.h                         |  221 ++
 include/linux/grmsg.h                              |  109 +
 include/linux/grsecurity.h                         |  232 ++
 include/linux/grsock.h                             |   19 +
 include/linux/kallsyms.h                           |   13 +-
 include/linux/kmod.h                               |    2 +
 include/linux/netfilter/xt_gradm.h                 |    9 +
 include/linux/personality.h                        |    1 +
 include/linux/proc_fs.h                            |   12 +
 include/linux/sched.h                              |   54 +-
 include/linux/security.h                           |    1 +
 include/linux/seq_file.h                           |    3 +
 include/linux/shm.h                                |    4 +
 include/linux/sysctl.h                             |    2 +
 include/linux/tracehook.h                          |    9 +-
 include/linux/vermagic.h                           |    9 +-
 init/Kconfig                                       |    1 +
 init/main.c                                        |    4 +
 ipc/mqueue.c                                       |    1 +
 ipc/shm.c                                          |   28 +
 kernel/capability.c                                |   32 +-
 kernel/compat.c                                    |    1 +
 kernel/configs.c                                   |   11 +
 kernel/cred.c                                      |   99 +-
 kernel/exit.c                                      |   25 +-
 kernel/fork.c                                      |   15 +-
 kernel/futex.c                                     |    5 +
 kernel/futex_compat.c                              |    8 +-
 kernel/kallsyms.c                                  |    8 +
 kernel/kmod.c                                      |   64 +-
 kernel/module.c                                    |   80 +-
 kernel/panic.c                                     |    4 +-
 kernel/pid.c                                       |   19 +-
 kernel/posix-cpu-timers.c                          |    1 +
 kernel/posix-timers.c                              |    8 +
 kernel/printk.c                                    |    5 +
 kernel/ptrace.c                                    |   20 +-
 kernel/resource.c                                  |   10 +
 kernel/sched/core.c                                |   21 +-
 kernel/signal.c                                    |   37 +-
 kernel/sys.c                                       |   43 +-
 kernel/sysctl.c                                    |   51 +-
 kernel/sysctl_check.c                              |    1 +
 kernel/taskstats.c                                 |    6 +
 kernel/time.c                                      |    5 +
 kernel/time/timekeeping.c                          |    3 +
 kernel/time/timer_list.c                           |   12 +
 kernel/time/timer_stats.c                          |    8 +
 lib/Kconfig.debug                                  |    1 +
 lib/is_single_threaded.c                           |    3 +
 lib/vsprintf.c                                     |   18 +-
 localversion-grsec                                 |    1 +
 mm/Kconfig                                         |    2 +-
 mm/filemap.c                                       |    1 +
 mm/kmemleak.c                                      |    2 +-
 mm/mempolicy.c                                     |   11 +-
 mm/migrate.c                                       |   11 +-
 mm/mlock.c                                         |    3 +
 mm/mmap.c                                          |   30 +-
 mm/mprotect.c                                      |    8 +
 mm/page_alloc.c                                    |    6 +
 mm/process_vm_access.c                             |    6 +
 mm/shmem.c                                         |    2 +-
 mm/slab.c                                          |    2 +-
 mm/slub.c                                          |   14 +-
 mm/vmstat.c                                        |   18 +-
 net/core/dev.c                                     |    4 +
 net/core/sock.c                                    |    2 +-
 net/core/sock_diag.c                               |    7 +
 net/econet/Kconfig                                 |    2 +-
 net/ipv4/inet_hashtables.c                         |    5 +
 net/ipv4/ip_sockglue.c                             |    3 +-
 net/ipv4/raw.c                                     |    8 +-
 net/ipv4/tcp_ipv4.c                                |   42 +-
 net/ipv4/tcp_minisocks.c                           |    8 +
 net/ipv4/tcp_timer.c                               |   11 +
 net/ipv4/udp.c                                     |   31 +-
 net/ipv6/raw.c                                     |    8 +-
 net/ipv6/tcp_ipv6.c                                |   46 +-
 net/ipv6/udp.c                                     |   14 +-
 net/netfilter/Kconfig                              |   10 +
 net/netfilter/Makefile                             |    1 +
 net/netfilter/xt_gradm.c                           |   51 +
 net/netrom/af_netrom.c                             |    2 +-
 net/phonet/af_phonet.c                             |    4 +-
 net/phonet/socket.c                                |    7 +-
 net/sctp/proc.c                                    |    3 +-
 net/socket.c                                       |   62 +-
 net/sysctl_net.c                                   |    2 +-
 net/unix/af_unix.c                                 |   20 +
 scripts/Makefile.build                             |    2 +-
 security/Kconfig                                   |   87 +-
 security/apparmor/lsm.c                            |    2 +-
 security/commoncap.c                               |    4 +
 security/min_addr.c                                |    2 +
 security/security.c                                |    2 -
 security/selinux/hooks.c                           |    2 -
 tools/gcc/Makefile                                 |    2 +-
 237 files changed, 14385 insertions(+), 1923 deletions(-)

commit 65a4fc291c85027ea1be6b06dc99d3cfcd07a1d9
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Mar 24 15:31:31 2012 -0400

    Import pax-linux-3.3-test2.patch

 Documentation/dontdiff                             |   29 +-
 Documentation/kernel-parameters.txt                |    7 +
 Makefile                                           |   83 +++-
 arch/alpha/include/asm/atomic.h                    |   10 +
 arch/alpha/include/asm/elf.h                       |    7 +
 arch/alpha/include/asm/pgtable.h                   |   11 +
 arch/alpha/kernel/module.c                         |    2 +-
 arch/alpha/kernel/osf_sys.c                        |   10 +-
 arch/alpha/mm/fault.c                              |  141 +++++-
 arch/arm/include/asm/atomic.h                      |  394 ++++++++++++-
 arch/arm/include/asm/cache.h                       |    2 +-
 arch/arm/include/asm/cacheflush.h                  |    2 +-
 arch/arm/include/asm/elf.h                         |   13 +-
 arch/arm/include/asm/kmap_types.h                  |    1 +
 arch/arm/include/asm/outercache.h                  |    2 +-
 arch/arm/include/asm/page.h                        |    2 +-
 arch/arm/include/asm/system.h                      |    9 +
 arch/arm/include/asm/uaccess.h                     |   27 +-
 arch/arm/kernel/armksyms.c                         |    4 +-
 arch/arm/kernel/process.c                          |   10 +-
 arch/arm/kernel/setup.c                            |    6 +-
 arch/arm/lib/copy_from_user.S                      |    6 +-
 arch/arm/lib/copy_page.S                           |    1 +
 arch/arm/lib/copy_to_user.S                        |    6 +-
 arch/arm/lib/uaccess.S                             |   12 +-
 arch/arm/lib/uaccess_with_memcpy.c                 |    2 +-
 arch/arm/mach-omap2/board-n8x0.c                   |    2 +-
 arch/arm/mm/fault.c                                |   48 ++
 arch/arm/mm/mmap.c                                 |   31 +-
 arch/arm/plat-samsung/include/plat/dma-ops.h       |    2 +-
 arch/arm/plat-samsung/include/plat/ehci.h          |    2 +-
 arch/avr32/include/asm/elf.h                       |    8 +-
 arch/avr32/include/asm/kmap_types.h                |    3 +-
 arch/avr32/mm/fault.c                              |   27 +
 arch/frv/include/asm/atomic.h                      |   10 +
 arch/frv/include/asm/kmap_types.h                  |    1 +
 arch/frv/mm/elf-fdpic.c                            |    7 +-
 arch/ia64/include/asm/atomic.h                     |   10 +
 arch/ia64/include/asm/elf.h                        |    7 +
 arch/ia64/include/asm/pgtable.h                    |   13 +-
 arch/ia64/include/asm/spinlock.h                   |    2 +-
 arch/ia64/include/asm/uaccess.h                    |    4 +-
 arch/ia64/kernel/module.c                          |   48 ++-
 arch/ia64/kernel/sys_ia64.c                        |   13 +-
 arch/ia64/kernel/vmlinux.lds.S                     |    2 +-
 arch/ia64/mm/fault.c                               |   33 +-
 arch/ia64/mm/hugetlbpage.c                         |    2 +-
 arch/ia64/mm/init.c                                |   13 +
 arch/m32r/lib/usercopy.c                           |    6 +
 arch/mips/include/asm/atomic.h                     |   14 +
 arch/mips/include/asm/elf.h                        |   11 +-
 arch/mips/include/asm/page.h                       |    2 +-
 arch/mips/include/asm/system.h                     |    2 +-
 arch/mips/kernel/binfmt_elfn32.c                   |    7 +
 arch/mips/kernel/binfmt_elfo32.c                   |    7 +
 arch/mips/kernel/process.c                         |   12 -
 arch/mips/mm/fault.c                               |   17 +
 arch/mips/mm/mmap.c                                |   41 +-
 arch/parisc/include/asm/atomic.h                   |   10 +
 arch/parisc/include/asm/elf.h                      |    7 +
 arch/parisc/include/asm/pgtable.h                  |   11 +
 arch/parisc/kernel/module.c                        |   50 ++-
 arch/parisc/kernel/sys_parisc.c                    |    6 +-
 arch/parisc/kernel/traps.c                         |    4 +-
 arch/parisc/mm/fault.c                             |  140 +++++-
 arch/powerpc/include/asm/atomic.h                  |   10 +
 arch/powerpc/include/asm/elf.h                     |   18 +-
 arch/powerpc/include/asm/kmap_types.h              |    1 +
 arch/powerpc/include/asm/mman.h                    |    2 +-
 arch/powerpc/include/asm/page.h                    |    8 +-
 arch/powerpc/include/asm/page_64.h                 |    7 +-
 arch/powerpc/include/asm/pgtable.h                 |    1 +
 arch/powerpc/include/asm/pte-hash32.h              |    1 +
 arch/powerpc/include/asm/reg.h                     |    1 +
 arch/powerpc/include/asm/system.h                  |    2 +-
 arch/powerpc/include/asm/uaccess.h                 |  142 +++--
 arch/powerpc/kernel/exceptions-64e.S               |    4 +-
 arch/powerpc/kernel/exceptions-64s.S               |    2 +-
 arch/powerpc/kernel/irq.c                          |   10 +-
 arch/powerpc/kernel/module_32.c                    |   13 +-
 arch/powerpc/kernel/process.c                      |   55 --
 arch/powerpc/kernel/signal_32.c                    |    2 +-
 arch/powerpc/kernel/signal_64.c                    |    2 +-
 arch/powerpc/kernel/vdso.c                         |    5 +-
 arch/powerpc/lib/usercopy_64.c                     |   18 -
 arch/powerpc/mm/fault.c                            |   55 ++-
 arch/powerpc/mm/mmap_64.c                          |   12 +
 arch/powerpc/mm/slice.c                            |   23 +-
 arch/s390/include/asm/atomic.h                     |   10 +
 arch/s390/include/asm/elf.h                        |   13 +-
 arch/s390/include/asm/system.h                     |    2 +-
 arch/s390/include/asm/uaccess.h                    |   11 +
 arch/s390/kernel/module.c                          |   22 +-
 arch/s390/kernel/process.c                         |   36 --
 arch/s390/mm/mmap.c                                |   24 +
 arch/score/include/asm/system.h                    |    2 +-
 arch/score/kernel/process.c                        |    5 -
 arch/sh/mm/mmap.c                                  |   24 +-
 arch/sparc/include/asm/atomic_64.h                 |  106 +++-
 arch/sparc/include/asm/cache.h                     |    2 +-
 arch/sparc/include/asm/elf_32.h                    |    7 +
 arch/sparc/include/asm/elf_64.h                    |    7 +
 arch/sparc/include/asm/pgtable_32.h                |   17 +
 arch/sparc/include/asm/pgtsrmmu.h                  |    7 +
 arch/sparc/include/asm/spinlock_64.h               |   35 +-
 arch/sparc/include/asm/thread_info_32.h            |    2 +
 arch/sparc/include/asm/thread_info_64.h            |    2 +
 arch/sparc/include/asm/uaccess.h                   |    8 +
 arch/sparc/include/asm/uaccess_32.h                |   27 +-
 arch/sparc/include/asm/uaccess_64.h                |   19 +-
 arch/sparc/kernel/Makefile                         |    2 +-
 arch/sparc/kernel/sys_sparc_32.c                   |    4 +-
 arch/sparc/kernel/sys_sparc_64.c                   |   52 +-
 arch/sparc/kernel/traps_64.c                       |   13 +-
 arch/sparc/lib/Makefile                            |    2 +-
 arch/sparc/lib/atomic_64.S                         |  148 +++++-
 arch/sparc/lib/ksyms.c                             |    6 +
 arch/sparc/mm/Makefile                             |    2 +-
 arch/sparc/mm/fault_32.c                           |  283 +++++++++
 arch/sparc/mm/fault_64.c                           |  477 +++++++++++++++
 arch/sparc/mm/hugetlbpage.c                        |   16 +-
 arch/sparc/mm/init_32.c                            |   15 +-
 arch/sparc/mm/srmmu.c                              |    7 +
 arch/tile/include/asm/atomic_64.h                  |   10 +
 arch/um/Makefile                                   |    4 +
 arch/um/include/asm/kmap_types.h                   |    1 +
 arch/um/include/asm/page.h                         |    3 +
 arch/um/kernel/process.c                           |   16 -
 arch/x86/Kconfig                                   |    9 +-
 arch/x86/Kconfig.cpu                               |    6 +-
 arch/x86/Kconfig.debug                             |    4 +-
 arch/x86/Makefile                                  |   10 +
 arch/x86/boot/Makefile                             |    3 +
 arch/x86/boot/bitops.h                             |    4 +-
 arch/x86/boot/boot.h                               |    4 +-
 arch/x86/boot/compressed/Makefile                  |    3 +
 arch/x86/boot/compressed/head_32.S                 |    7 +-
 arch/x86/boot/compressed/head_64.S                 |    4 +-
 arch/x86/boot/compressed/misc.c                    |    4 +-
 arch/x86/boot/compressed/relocs.c                  |   85 +++-
 arch/x86/boot/cpucheck.c                           |   28 +-
 arch/x86/boot/header.S                             |    2 +-
 arch/x86/boot/memory.c                             |    2 +-
 arch/x86/boot/video-vesa.c                         |    1 +
 arch/x86/boot/video.c                              |    2 +-
 arch/x86/crypto/aes-x86_64-asm_64.S                |    4 +
 arch/x86/crypto/aesni-intel_asm.S                  |   31 +
 arch/x86/crypto/blowfish-x86_64-asm_64.S           |    8 +
 arch/x86/crypto/salsa20-x86_64-asm_64.S            |    5 +
 arch/x86/crypto/serpent-sse2-x86_64-asm_64.S       |    5 +
 arch/x86/crypto/sha1_ssse3_asm.S                   |    3 +
 arch/x86/crypto/twofish-x86_64-asm_64-3way.S       |    5 +
 arch/x86/crypto/twofish-x86_64-asm_64.S            |    3 +
 arch/x86/ia32/ia32_signal.c                        |   20 +-
 arch/x86/ia32/ia32entry.S                          |  126 +++-
 arch/x86/ia32/sys_ia32.c                           |   18 +-
 arch/x86/include/asm/alternative-asm.h             |   39 ++
 arch/x86/include/asm/alternative.h                 |    2 +-
 arch/x86/include/asm/apic.h                        |    2 +-
 arch/x86/include/asm/apm.h                         |    4 +-
 arch/x86/include/asm/atomic.h                      |  285 +++++++++-
 arch/x86/include/asm/atomic64_32.h                 |  100 +++
 arch/x86/include/asm/atomic64_64.h                 |  202 ++++++-
 arch/x86/include/asm/bitops.h                      |    2 +-
 arch/x86/include/asm/boot.h                        |    7 +-
 arch/x86/include/asm/cache.h                       |    5 +-
 arch/x86/include/asm/cacheflush.h                  |    2 +-
 arch/x86/include/asm/checksum_32.h                 |   12 +-
 arch/x86/include/asm/cmpxchg.h                     |   35 ++
 arch/x86/include/asm/cpufeature.h                  |    2 +-
 arch/x86/include/asm/desc.h                        |   65 ++-
 arch/x86/include/asm/desc_defs.h                   |    6 +
 arch/x86/include/asm/e820.h                        |    2 +-
 arch/x86/include/asm/elf.h                         |   27 +-
 arch/x86/include/asm/emergency-restart.h           |    2 +-
 arch/x86/include/asm/futex.h                       |   14 +-
 arch/x86/include/asm/hw_irq.h                      |    4 +-
 arch/x86/include/asm/i387.h                        |   14 +-
 arch/x86/include/asm/io.h                          |   11 +
 arch/x86/include/asm/irqflags.h                    |    5 +
 arch/x86/include/asm/kprobes.h                     |    9 +-
 arch/x86/include/asm/kvm_host.h                    |    2 +-
 arch/x86/include/asm/local.h                       |   94 +++-
 arch/x86/include/asm/mman.h                        |   10 +
 arch/x86/include/asm/mmu.h                         |   16 +-
 arch/x86/include/asm/mmu_context.h                 |   76 +++-
 arch/x86/include/asm/module.h                      |   17 +-
 arch/x86/include/asm/page_64_types.h               |    2 +-
 arch/x86/include/asm/paravirt.h                    |   44 ++-
 arch/x86/include/asm/paravirt_types.h              |   19 +-
 arch/x86/include/asm/pgalloc.h                     |    7 +
 arch/x86/include/asm/pgtable-2level.h              |    2 +
 arch/x86/include/asm/pgtable-3level.h              |    4 +
 arch/x86/include/asm/pgtable.h                     |  110 ++++-
 arch/x86/include/asm/pgtable_32.h                  |   14 +-
 arch/x86/include/asm/pgtable_32_types.h            |   15 +-
 arch/x86/include/asm/pgtable_64.h                  |   17 +-
 arch/x86/include/asm/pgtable_64_types.h            |    5 +
 arch/x86/include/asm/pgtable_types.h               |   36 +-
 arch/x86/include/asm/processor.h                   |   35 +-
 arch/x86/include/asm/ptrace.h                      |   18 +-
 arch/x86/include/asm/reboot.h                      |   12 +-
 arch/x86/include/asm/rwsem.h                       |   60 ++-
 arch/x86/include/asm/segment.h                     |   22 +-
 arch/x86/include/asm/smp.h                         |   14 +-
 arch/x86/include/asm/spinlock.h                    |   36 +-
 arch/x86/include/asm/stackprotector.h              |    4 +-
 arch/x86/include/asm/stacktrace.h                  |   32 +-
 arch/x86/include/asm/sys_ia32.h                    |    2 +-
 arch/x86/include/asm/system.h                      |   10 +-
 arch/x86/include/asm/thread_info.h                 |   87 +--
 arch/x86/include/asm/uaccess.h                     |   93 +++-
 arch/x86/include/asm/uaccess_32.h                  |   95 +++-
 arch/x86/include/asm/uaccess_64.h                  |  272 +++++++---
 arch/x86/include/asm/vdso.h                        |    2 +-
 arch/x86/include/asm/x86_init.h                    |   26 +-
 arch/x86/include/asm/xsave.h                       |   12 +-
 arch/x86/kernel/acpi/realmode/Makefile             |    3 +
 arch/x86/kernel/acpi/sleep.c                       |    4 +
 arch/x86/kernel/acpi/wakeup_32.S                   |    6 +-
 arch/x86/kernel/alternative.c                      |   65 ++-
 arch/x86/kernel/apic/apic.c                        |    4 +-
 arch/x86/kernel/apic/io_apic.c                     |    8 +-
 arch/x86/kernel/apm_32.c                           |   19 +-
 arch/x86/kernel/asm-offsets.c                      |   20 +
 arch/x86/kernel/asm-offsets_64.c                   |    1 +
 arch/x86/kernel/cpu/Makefile                       |    4 -
 arch/x86/kernel/cpu/amd.c                          |    2 +-
 arch/x86/kernel/cpu/common.c                       |   77 +--
 arch/x86/kernel/cpu/intel.c                        |    2 +-
 arch/x86/kernel/cpu/mcheck/mce.c                   |   27 +-
 arch/x86/kernel/cpu/mcheck/p5.c                    |    3 +
 arch/x86/kernel/cpu/mcheck/winchip.c               |    3 +
 arch/x86/kernel/cpu/mtrr/main.c                    |    2 +-
 arch/x86/kernel/cpu/mtrr/mtrr.h                    |    2 +-
 arch/x86/kernel/cpu/perf_event.c                   |    2 +-
 arch/x86/kernel/crash.c                            |    4 +-
 arch/x86/kernel/doublefault_32.c                   |    8 +-
 arch/x86/kernel/dumpstack.c                        |   29 +-
 arch/x86/kernel/dumpstack_32.c                     |   32 +-
 arch/x86/kernel/dumpstack_64.c                     |   58 ++-
 arch/x86/kernel/early_printk.c                     |    1 +
 arch/x86/kernel/entry_32.S                         |  378 ++++++++++--
 arch/x86/kernel/entry_64.S                         |  512 ++++++++++++++--
 arch/x86/kernel/ftrace.c                           |   14 +-
 arch/x86/kernel/head32.c                           |    4 +-
 arch/x86/kernel/head_32.S                          |  244 +++++++--
 arch/x86/kernel/head_64.S                          |  158 ++++--
 arch/x86/kernel/i386_ksyms_32.c                    |    8 +
 arch/x86/kernel/i8259.c                            |    2 +-
 arch/x86/kernel/init_task.c                        |    7 +-
 arch/x86/kernel/ioport.c                           |    2 +-
 arch/x86/kernel/irq.c                              |   10 +-
 arch/x86/kernel/irq_32.c                           |   69 +--
 arch/x86/kernel/irq_64.c                           |    2 +-
 arch/x86/kernel/kgdb.c                             |   10 +-
 arch/x86/kernel/kprobes.c                          |   34 +-
 arch/x86/kernel/ldt.c                              |   31 +-
 arch/x86/kernel/machine_kexec_32.c                 |    6 +-
 arch/x86/kernel/microcode_intel.c                  |    4 +-
 arch/x86/kernel/module.c                           |   76 +++-
 arch/x86/kernel/nmi.c                              |   11 +
 arch/x86/kernel/paravirt-spinlocks.c               |    2 +-
 arch/x86/kernel/paravirt.c                         |   43 +-
 arch/x86/kernel/pci-iommu_table.c                  |    2 +-
 arch/x86/kernel/process.c                          |   81 ++-
 arch/x86/kernel/process_32.c                       |   21 +-
 arch/x86/kernel/process_64.c                       |   18 +-
 arch/x86/kernel/ptrace.c                           |    8 +-
 arch/x86/kernel/pvclock.c                          |    8 +-
 arch/x86/kernel/reboot.c                           |   51 ++-
 arch/x86/kernel/relocate_kernel_64.S               |    4 +-
 arch/x86/kernel/setup.c                            |   14 +-
 arch/x86/kernel/setup_percpu.c                     |   27 +-
 arch/x86/kernel/signal.c                           |   21 +-
 arch/x86/kernel/smpboot.c                          |   15 +-
 arch/x86/kernel/step.c                             |   10 +-
 arch/x86/kernel/sys_i386_32.c                      |  231 +++++++-
 arch/x86/kernel/sys_x86_64.c                       |   52 +-
 arch/x86/kernel/tboot.c                            |   12 +-
 arch/x86/kernel/time.c                             |   10 +-
 arch/x86/kernel/tls.c                              |    5 +
 arch/x86/kernel/trampoline_32.S                    |    8 +-
 arch/x86/kernel/trampoline_64.S                    |    4 +-
 arch/x86/kernel/traps.c                            |   59 ++-
 arch/x86/kernel/vm86_32.c                          |    6 +-
 arch/x86/kernel/vmlinux.lds.S                      |  147 ++++--
 arch/x86/kernel/vsyscall_64.c                      |   14 +-
 arch/x86/kernel/x8664_ksyms_64.c                   |    2 -
 arch/x86/kernel/xsave.c                            |    6 +-
 arch/x86/kvm/cpuid.c                               |   21 +-
 arch/x86/kvm/emulate.c                             |    4 +-
 arch/x86/kvm/lapic.c                               |    2 +-
 arch/x86/kvm/paging_tmpl.h                         |    2 +-
 arch/x86/kvm/svm.c                                 |    8 +
 arch/x86/kvm/vmx.c                                 |   35 +-
 arch/x86/kvm/x86.c                                 |   10 +-
 arch/x86/lguest/boot.c                             |    3 +-
 arch/x86/lib/atomic64_32.c                         |   32 +
 arch/x86/lib/atomic64_386_32.S                     |  164 +++++
 arch/x86/lib/atomic64_cx8_32.S                     |  103 +++-
 arch/x86/lib/checksum_32.S                         |  100 +++-
 arch/x86/lib/clear_page_64.S                       |    5 +-
 arch/x86/lib/cmpxchg16b_emu.S                      |    2 +
 arch/x86/lib/copy_page_64.S                        |   12 +-
 arch/x86/lib/copy_user_64.S                        |   47 +--
 arch/x86/lib/copy_user_nocache_64.S                |   20 +-
 arch/x86/lib/csum-copy_64.S                        |    2 +
 arch/x86/lib/csum-wrappers_64.c                    |   16 +-
 arch/x86/lib/getuser.S                             |   68 ++-
 arch/x86/lib/insn.c                                |    9 +-
 arch/x86/lib/iomap_copy_64.S                       |    2 +
 arch/x86/lib/memcpy_64.S                           |   18 +-
 arch/x86/lib/memmove_64.S                          |   34 +-
 arch/x86/lib/memset_64.S                           |    7 +-
 arch/x86/lib/mmx_32.c                              |  243 +++++---
 arch/x86/lib/msr-reg.S                             |   18 +-
 arch/x86/lib/putuser.S                             |   87 +++-
 arch/x86/lib/rwlock.S                              |   42 ++
 arch/x86/lib/rwsem.S                               |    6 +-
 arch/x86/lib/thunk_64.S                            |    2 +
 arch/x86/lib/usercopy_32.c                         |  379 ++++++++-----
 arch/x86/lib/usercopy_64.c                         |   32 +-
 arch/x86/mm/extable.c                              |    2 +-
 arch/x86/mm/fault.c                                |  551 ++++++++++++++++-
 arch/x86/mm/gup.c                                  |    2 +-
 arch/x86/mm/highmem_32.c                           |    4 +
 arch/x86/mm/hugetlbpage.c                          |  113 ++--
 arch/x86/mm/init.c                                 |   91 +++-
 arch/x86/mm/init_32.c                              |  122 ++--
 arch/x86/mm/init_64.c                              |   40 +-
 arch/x86/mm/iomap_32.c                             |    4 +
 arch/x86/mm/ioremap.c                              |   10 +-
 arch/x86/mm/kmemcheck/kmemcheck.c                  |    4 +-
 arch/x86/mm/mmap.c                                 |   41 +-
 arch/x86/mm/mmio-mod.c                             |    6 +-
 arch/x86/mm/pageattr-test.c                        |    2 +-
 arch/x86/mm/pageattr.c                             |   33 +-
 arch/x86/mm/pat.c                                  |   12 +-
 arch/x86/mm/pf_in.c                                |   10 +-
 arch/x86/mm/pgtable.c                              |  125 +++--
 arch/x86/mm/pgtable_32.c                           |    3 +
 arch/x86/mm/setup_nx.c                             |    7 +
 arch/x86/mm/tlb.c                                  |    4 +
 arch/x86/net/bpf_jit.S                             |   10 +
 arch/x86/net/bpf_jit_comp.c                        |   38 +-
 arch/x86/oprofile/backtrace.c                      |    8 +-
 arch/x86/pci/mrst.c                                |    4 +-
 arch/x86/pci/pcbios.c                              |  146 ++++-
 arch/x86/platform/efi/efi_32.c                     |   19 +
 arch/x86/platform/efi/efi_stub_32.S                |   48 +-
 arch/x86/platform/efi/efi_stub_64.S                |    8 +
 arch/x86/platform/mrst/mrst.c                      |    6 +-
 arch/x86/power/cpu.c                               |    4 +-
 arch/x86/vdso/Makefile                             |    2 +-
 arch/x86/vdso/vdso32-setup.c                       |   23 +-
 arch/x86/vdso/vma.c                                |   30 +-
 arch/x86/xen/enlighten.c                           |   35 +-
 arch/x86/xen/mmu.c                                 |    9 +
 arch/x86/xen/smp.c                                 |   16 +-
 arch/x86/xen/xen-asm_32.S                          |   12 +-
 arch/x86/xen/xen-head.S                            |   11 +
 arch/x86/xen/xen-ops.h                             |    2 -
 block/blk-iopoll.c                                 |    2 +-
 block/blk-map.c                                    |    2 +-
 block/blk-softirq.c                                |    2 +-
 block/bsg.c                                        |   12 +-
 block/compat_ioctl.c                               |    2 +-
 block/partitions/efi.c                             |    8 +-
 block/scsi_ioctl.c                                 |   27 +-
 crypto/cryptd.c                                    |    4 +-
 drivers/acpi/apei/cper.c                           |    8 +-
 drivers/acpi/ec_sys.c                              |   12 +-
 drivers/acpi/proc.c                                |   18 +-
 drivers/acpi/processor_driver.c                    |    2 +-
 drivers/ata/libata-core.c                          |    8 +-
 drivers/ata/pata_arasan_cf.c                       |    4 +-
 drivers/atm/adummy.c                               |    2 +-
 drivers/atm/ambassador.c                           |    8 +-
 drivers/atm/atmtcp.c                               |   14 +-
 drivers/atm/eni.c                                  |   12 +-
 drivers/atm/firestream.c                           |    8 +-
 drivers/atm/fore200e.c                             |   14 +-
 drivers/atm/he.c                                   |   18 +-
 drivers/atm/horizon.c                              |    4 +-
 drivers/atm/idt77252.c                             |   36 +-
 drivers/atm/iphase.c                               |   34 +-
 drivers/atm/lanai.c                                |   12 +-
 drivers/atm/nicstar.c                              |   46 +-
 drivers/atm/solos-pci.c                            |    4 +-
 drivers/atm/suni.c                                 |    4 +-
 drivers/atm/uPD98402.c                             |   16 +-
 drivers/atm/zatm.c                                 |    6 +-
 drivers/base/devtmpfs.c                            |    2 +-
 drivers/base/power/wakeup.c                        |    8 +-
 drivers/block/cciss.c                              |   28 +-
 drivers/block/cciss.h                              |    2 +-
 drivers/block/cpqarray.c                           |   28 +-
 drivers/block/cpqarray.h                           |    2 +-
 drivers/block/drbd/drbd_int.h                      |   20 +-
 drivers/block/drbd/drbd_main.c                     |   10 +-
 drivers/block/drbd/drbd_nl.c                       |   10 +-
 drivers/block/drbd/drbd_receiver.c                 |   20 +-
 drivers/block/loop.c                               |    2 +-
 drivers/char/agp/frontend.c                        |    2 +-
 drivers/char/hpet.c                                |    2 +-
 drivers/char/ipmi/ipmi_msghandler.c                |    8 +-
 drivers/char/ipmi/ipmi_si_intf.c                   |    8 +-
 drivers/char/mbcs.c                                |    2 +-
 drivers/char/mem.c                                 |   41 ++-
 drivers/char/nvram.c                               |    2 +-
 drivers/char/random.c                              |    4 +-
 drivers/char/sonypi.c                              |    9 +-
 drivers/char/tpm/tpm.c                             |    2 +-
 drivers/char/tpm/tpm_bios.c                        |   14 +-
 drivers/char/virtio_console.c                      |    4 +-
 drivers/edac/amd64_edac.c                          |    2 +-
 drivers/edac/amd76x_edac.c                         |    2 +-
 drivers/edac/e752x_edac.c                          |    2 +-
 drivers/edac/e7xxx_edac.c                          |    2 +-
 drivers/edac/edac_pci_sysfs.c                      |   20 +-
 drivers/edac/i3000_edac.c                          |    2 +-
 drivers/edac/i3200_edac.c                          |    2 +-
 drivers/edac/i5000_edac.c                          |    2 +-
 drivers/edac/i5100_edac.c                          |    2 +-
 drivers/edac/i5400_edac.c                          |    2 +-
 drivers/edac/i7300_edac.c                          |    2 +-
 drivers/edac/i7core_edac.c                         |    2 +-
 drivers/edac/i82443bxgx_edac.c                     |    2 +-
 drivers/edac/i82860_edac.c                         |    2 +-
 drivers/edac/i82875p_edac.c                        |    2 +-
 drivers/edac/i82975x_edac.c                        |    2 +-
 drivers/edac/mce_amd.h                             |    2 +-
 drivers/edac/r82600_edac.c                         |    2 +-
 drivers/edac/sb_edac.c                             |    2 +-
 drivers/edac/x38_edac.c                            |    2 +-
 drivers/firewire/core-card.c                       |    2 +-
 drivers/firewire/core-cdev.c                       |    3 +-
 drivers/firewire/core-transaction.c                |    1 +
 drivers/firewire/core.h                            |    1 +
 drivers/firmware/dmi_scan.c                        |    7 +-
 drivers/gpio/gpio-vr41xx.c                         |    2 +-
 drivers/gpu/drm/drm_crtc_helper.c                  |    2 +-
 drivers/gpu/drm/drm_drv.c                          |    4 +-
 drivers/gpu/drm/drm_fops.c                         |   16 +-
 drivers/gpu/drm/drm_global.c                       |   14 +-
 drivers/gpu/drm/drm_info.c                         |   14 +-
 drivers/gpu/drm/drm_ioc32.c                        |    4 +-
 drivers/gpu/drm/drm_ioctl.c                        |    2 +-
 drivers/gpu/drm/drm_lock.c                         |    4 +-
 drivers/gpu/drm/i810/i810_dma.c                    |    8 +-
 drivers/gpu/drm/i810/i810_drv.h                    |    4 +-
 drivers/gpu/drm/i915/i915_debugfs.c                |    4 +-
 drivers/gpu/drm/i915/i915_dma.c                    |    2 +-
 drivers/gpu/drm/i915/i915_drv.h                    |    8 +-
 drivers/gpu/drm/i915/i915_gem_execbuffer.c         |    6 +-
 drivers/gpu/drm/i915/i915_irq.c                    |   10 +-
 drivers/gpu/drm/i915/intel_display.c               |   10 +-
 drivers/gpu/drm/mga/mga_drv.h                      |    4 +-
 drivers/gpu/drm/mga/mga_irq.c                      |    8 +-
 drivers/gpu/drm/nouveau/nouveau_bios.c             |    4 +-
 drivers/gpu/drm/nouveau/nouveau_drv.h              |   12 +-
 drivers/gpu/drm/nouveau/nouveau_fence.c            |    4 +-
 drivers/gpu/drm/nouveau/nouveau_gem.c              |    2 +-
 drivers/gpu/drm/nouveau/nouveau_state.c            |    2 +-
 drivers/gpu/drm/nouveau/nv04_graph.c               |    2 +-
 drivers/gpu/drm/r128/r128_cce.c                    |    2 +-
 drivers/gpu/drm/r128/r128_drv.h                    |    4 +-
 drivers/gpu/drm/r128/r128_irq.c                    |    4 +-
 drivers/gpu/drm/r128/r128_state.c                  |    4 +-
 drivers/gpu/drm/radeon/mkregtable.c                |    4 +-
 drivers/gpu/drm/radeon/radeon.h                    |    6 +-
 drivers/gpu/drm/radeon/radeon_device.c             |    2 +-
 drivers/gpu/drm/radeon/radeon_drv.h                |    2 +-
 drivers/gpu/drm/radeon/radeon_fence.c              |    6 +-
 drivers/gpu/drm/radeon/radeon_ioc32.c              |    2 +-
 drivers/gpu/drm/radeon/radeon_irq.c                |    6 +-
 drivers/gpu/drm/radeon/radeon_state.c              |    4 +-
 drivers/gpu/drm/radeon/radeon_ttm.c                |    6 +-
 drivers/gpu/drm/radeon/rs690.c                     |    4 +-
 drivers/gpu/drm/ttm/ttm_page_alloc.c               |    4 +-
 drivers/gpu/drm/via/via_drv.h                      |    4 +-
 drivers/gpu/drm/via/via_irq.c                      |   18 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_drv.h                |    2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c               |    8 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_irq.c                |    4 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_marker.c             |    2 +-
 drivers/hid/hid-core.c                             |    4 +-
 drivers/hid/usbhid/hiddev.c                        |    2 +-
 drivers/hv/channel.c                               |    4 +-
 drivers/hv/hv.c                                    |    2 +-
 drivers/hv/hyperv_vmbus.h                          |    2 +-
 drivers/hv/vmbus_drv.c                             |    4 +-
 drivers/hwmon/acpi_power_meter.c                   |    2 -
 drivers/hwmon/sht15.c                              |   12 +-
 drivers/i2c/busses/i2c-amd756-s4882.c              |    2 +-
 drivers/i2c/busses/i2c-nforce2-s4985.c             |    2 +-
 drivers/i2c/i2c-mux.c                              |    2 +-
 drivers/ide/aec62xx.c                              |    2 +-
 drivers/ide/alim15x3.c                             |    2 +-
 drivers/ide/amd74xx.c                              |    2 +-
 drivers/ide/atiixp.c                               |    2 +-
 drivers/ide/cmd64x.c                               |    2 +-
 drivers/ide/cs5520.c                               |    2 +-
 drivers/ide/cs5530.c                               |    2 +-
 drivers/ide/cs5535.c                               |    2 +-
 drivers/ide/cy82c693.c                             |    2 +-
 drivers/ide/hpt366.c                               |   24 +-
 drivers/ide/ide-cd.c                               |    2 +-
 drivers/ide/ide-pci-generic.c                      |    2 +-
 drivers/ide/it8172.c                               |    2 +-
 drivers/ide/it8213.c                               |    2 +-
 drivers/ide/it821x.c                               |    2 +-
 drivers/ide/jmicron.c                              |    2 +-
 drivers/ide/ns87415.c                              |    2 +-
 drivers/ide/opti621.c                              |    2 +-
 drivers/ide/pdc202xx_new.c                         |    2 +-
 drivers/ide/pdc202xx_old.c                         |    2 +-
 drivers/ide/piix.c                                 |    2 +-
 drivers/ide/rz1000.c                               |    2 +-
 drivers/ide/sc1200.c                               |    2 +-
 drivers/ide/scc_pata.c                             |    2 +-
 drivers/ide/serverworks.c                          |    2 +-
 drivers/ide/siimage.c                              |    2 +-
 drivers/ide/sis5513.c                              |    2 +-
 drivers/ide/sl82c105.c                             |    2 +-
 drivers/ide/slc90e66.c                             |    2 +-
 drivers/ide/tc86c001.c                             |    2 +-
 drivers/ide/triflex.c                              |    2 +-
 drivers/ide/trm290.c                               |    2 +-
 drivers/ide/via82cxxx.c                            |    2 +-
 drivers/ieee802154/fakehard.c                      |    2 +-
 drivers/infiniband/core/cm.c                       |   32 +-
 drivers/infiniband/core/fmr_pool.c                 |   20 +-
 drivers/infiniband/hw/cxgb4/mem.c                  |    4 +-
 drivers/infiniband/hw/ipath/ipath_rc.c             |    6 +-
 drivers/infiniband/hw/ipath/ipath_ruc.c            |    6 +-
 drivers/infiniband/hw/nes/nes.c                    |    4 +-
 drivers/infiniband/hw/nes/nes.h                    |   40 +-
 drivers/infiniband/hw/nes/nes_cm.c                 |   62 +-
 drivers/infiniband/hw/nes/nes_mgt.c                |    8 +-
 drivers/infiniband/hw/nes/nes_nic.c                |   40 +-
 drivers/infiniband/hw/nes/nes_verbs.c              |   10 +-
 drivers/infiniband/hw/qib/qib.h                    |    1 +
 drivers/input/gameport/gameport.c                  |    4 +-
 drivers/input/input.c                              |    4 +-
 drivers/input/joystick/sidewinder.c                |    1 +
 drivers/input/joystick/xpad.c                      |    4 +-
 drivers/input/mousedev.c                           |    2 +-
 drivers/input/serio/serio.c                        |    4 +-
 drivers/isdn/capi/capi.c                           |   10 +-
 drivers/isdn/gigaset/common.c                      |    2 +-
 drivers/isdn/gigaset/gigaset.h                     |    3 +-
 drivers/isdn/gigaset/interface.c                   |   22 +-
 drivers/isdn/hardware/avm/b1.c                     |    4 +-
 drivers/isdn/hardware/eicon/divasync.h             |    2 +-
 drivers/isdn/hardware/eicon/xdi_adapter.h          |    2 +-
 drivers/isdn/icn/icn.c                             |    2 +-
 drivers/lguest/core.c                              |   10 +-
 drivers/lguest/x86/core.c                          |   12 +-
 drivers/lguest/x86/switcher_32.S                   |   27 +-
 drivers/macintosh/macio_asic.c                     |    2 +-
 drivers/md/dm-ioctl.c                              |    2 +-
 drivers/md/dm-raid1.c                              |   16 +-
 drivers/md/dm-stripe.c                             |   10 +-
 drivers/md/dm-table.c                              |    2 +-
 drivers/md/dm-thin-metadata.c                      |    4 +-
 drivers/md/dm.c                                    |   16 +-
 drivers/md/md.c                                    |   28 +-
 drivers/md/md.h                                    |    6 +-
 drivers/md/persistent-data/dm-space-map-checker.c  |    2 +-
 drivers/md/persistent-data/dm-space-map-disk.c     |    2 +-
 drivers/md/persistent-data/dm-space-map-metadata.c |    2 +-
 drivers/md/persistent-data/dm-space-map.h          |    1 +
 drivers/md/raid1.c                                 |    4 +-
 drivers/md/raid10.c                                |   16 +-
 drivers/md/raid5.c                                 |   10 +-
 drivers/media/dvb/ddbridge/ddbridge-core.c         |    2 +-
 drivers/media/dvb/dvb-core/dvb_demux.h             |    2 +-
 drivers/media/dvb/dvb-core/dvbdev.c                |    2 +-
 drivers/media/dvb/dvb-usb/cxusb.c                  |    2 +-
 drivers/media/dvb/dvb-usb/dw2102.c                 |    2 +-
 drivers/media/dvb/frontends/dib3000.h              |    2 +-
 drivers/media/dvb/ngene/ngene-cards.c              |    2 +-
 drivers/media/radio/radio-cadet.c                  |    2 +
 drivers/media/video/au0828/au0828.h                |    2 +-
 drivers/media/video/cx88/cx88-alsa.c               |    2 +-
 drivers/media/video/omap/omap_vout.c               |   11 +-
 drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h |    2 +-
 drivers/media/video/timblogiw.c                    |    4 +-
 drivers/message/fusion/mptsas.c                    |   34 +-
 drivers/message/fusion/mptscsih.c                  |   19 +-
 drivers/message/i2o/i2o_proc.c                     |   44 +-
 drivers/message/i2o/iop.c                          |    8 +-
 drivers/mfd/abx500-core.c                          |    2 +-
 drivers/mfd/janz-cmodio.c                          |    1 +
 drivers/misc/lis3lv02d/lis3lv02d.c                 |    8 +-
 drivers/misc/lis3lv02d/lis3lv02d.h                 |    2 +-
 drivers/misc/sgi-gru/gruhandles.c                  |    4 +-
 drivers/misc/sgi-gru/gruprocfs.c                   |    8 +-
 drivers/misc/sgi-gru/grutables.h                   |  154 +++---
 drivers/misc/sgi-xp/xp.h                           |    2 +-
 drivers/misc/sgi-xp/xpc.h                          |    3 +-
 drivers/misc/sgi-xp/xpc_main.c                     |    2 +-
 drivers/mmc/host/sdhci-pci.c                       |    2 +-
 drivers/mtd/devices/doc2000.c                      |    2 +-
 drivers/mtd/devices/doc2001.c                      |    2 +-
 drivers/mtd/nand/denali.c                          |    1 +
 drivers/mtd/nftlmount.c                            |    1 +
 drivers/mtd/ubi/build.c                            |   16 +-
 drivers/net/ethernet/atheros/atlx/atl2.c           |    2 +-
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h     |    2 +-
 drivers/net/ethernet/broadcom/tg3.h                |    1 +
 drivers/net/ethernet/chelsio/cxgb3/l2t.h           |    2 +-
 drivers/net/ethernet/dec/tulip/de4x5.c             |    4 +-
 drivers/net/ethernet/dec/tulip/eeprom.c            |    2 +-
 drivers/net/ethernet/dec/tulip/winbond-840.c       |    2 +-
 drivers/net/ethernet/dlink/sundance.c              |    2 +-
 drivers/net/ethernet/emulex/benet/be_main.c        |    2 +-
 drivers/net/ethernet/faraday/ftgmac100.c           |    2 +
 drivers/net/ethernet/faraday/ftmac100.c            |    2 +
 drivers/net/ethernet/fealnx.c                      |    2 +-
 drivers/net/ethernet/intel/e1000e/80003es2lan.c    |    2 +-
 drivers/net/ethernet/intel/e1000e/82571.c          |    2 +-
 drivers/net/ethernet/intel/e1000e/hw.h             |    9 +-
 drivers/net/ethernet/intel/igb/e1000_hw.h          |   12 +-
 drivers/net/ethernet/intel/igbvf/vf.h              |    6 +-
 drivers/net/ethernet/intel/ixgbe/ixgbe_type.h      |   12 +-
 drivers/net/ethernet/intel/ixgbevf/vf.h            |    6 +-
 drivers/net/ethernet/mellanox/mlx4/main.c          |    1 +
 drivers/net/ethernet/neterion/vxge/vxge-config.h   |    2 +-
 drivers/net/ethernet/neterion/vxge/vxge-traffic.h  |    2 +-
 drivers/net/ethernet/realtek/r8169.c               |    6 +-
 drivers/net/ethernet/sis/sis190.c                  |    2 +-
 drivers/net/ethernet/stmicro/stmmac/mmc_core.c     |    4 +-
 drivers/net/hyperv/hyperv_net.h                    |    2 +-
 drivers/net/hyperv/rndis_filter.c                  |    4 +-
 drivers/net/ppp/ppp_generic.c                      |    4 +-
 drivers/net/tokenring/abyss.c                      |    8 +-
 drivers/net/tokenring/madgemc.c                    |    8 +-
 drivers/net/tokenring/proteon.c                    |    8 +-
 drivers/net/tokenring/skisa.c                      |    8 +-
 drivers/net/usb/hso.c                              |   25 +-
 drivers/net/wireless/ath/ath.h                     |    1 +
 drivers/net/wireless/ath/ath9k/ar9002_mac.c        |   30 +-
 drivers/net/wireless/ath/ath9k/ar9003_mac.c        |   58 +-
 drivers/net/wireless/ath/ath9k/hw.h                |    6 +-
 .../net/wireless/brcm80211/brcmsmac/phy/phy_int.h  |    2 +-
 drivers/net/wireless/iwlegacy/3945-mac.c           |    4 +-
 drivers/net/wireless/iwlwifi/iwl-debug.h           |    4 +-
 drivers/net/wireless/mac80211_hwsim.c              |    8 +-
 drivers/net/wireless/mwifiex/main.h                |    2 +-
 drivers/net/wireless/rndis_wlan.c                  |    2 +-
 drivers/net/wireless/wl1251/wl1251.h               |    2 +-
 drivers/oprofile/buffer_sync.c                     |    8 +-
 drivers/oprofile/event_buffer.c                    |    2 +-
 drivers/oprofile/oprof.c                           |    2 +-
 drivers/oprofile/oprofile_stats.c                  |   10 +-
 drivers/oprofile/oprofile_stats.h                  |   10 +-
 drivers/oprofile/oprofilefs.c                      |    2 +-
 drivers/parport/procfs.c                           |    4 +-
 drivers/pci/hotplug/cpci_hotplug.h                 |    2 +-
 drivers/pci/hotplug/cpqphp_nvram.c                 |    4 +
 drivers/pci/pcie/aspm.c                            |    6 +-
 drivers/pci/probe.c                                |    2 +-
 drivers/platform/x86/thinkpad_acpi.c               |   70 ++-
 drivers/pnp/pnpbios/bioscalls.c                    |   14 +-
 drivers/pnp/resource.c                             |    4 +-
 drivers/power/bq27x00_battery.c                    |    2 +-
 drivers/regulator/max8660.c                        |    6 +-
 drivers/regulator/mc13892-regulator.c              |    6 +-
 drivers/scsi/aacraid/aacraid.h                     |    2 +-
 drivers/scsi/aacraid/linit.c                       |    2 +-
 drivers/scsi/aic94xx/aic94xx_init.c                |    2 +-
 drivers/scsi/bfa/bfa.h                             |    2 +-
 drivers/scsi/bfa/bfa_fcpim.c                       |    4 +-
 drivers/scsi/bfa/bfa_fcpim.h                       |    3 +-
 drivers/scsi/bfa/bfa_ioc.h                         |    4 +-
 drivers/scsi/hosts.c                               |    4 +-
 drivers/scsi/hpsa.c                                |   30 +-
 drivers/scsi/hpsa.h                                |    2 +-
 drivers/scsi/ips.h                                 |    2 +-
 drivers/scsi/libfc/fc_exch.c                       |   38 +-
 drivers/scsi/libsas/sas_ata.c                      |    2 +-
 drivers/scsi/lpfc/lpfc.h                           |    8 +-
 drivers/scsi/lpfc/lpfc_debugfs.c                   |   18 +-
 drivers/scsi/lpfc/lpfc_init.c                      |    6 +-
 drivers/scsi/lpfc/lpfc_scsi.c                      |   16 +-
 drivers/scsi/pmcraid.c                             |   20 +-
 drivers/scsi/pmcraid.h                             |    8 +-
 drivers/scsi/qla2xxx/qla_def.h                     |    2 +-
 drivers/scsi/qla4xxx/ql4_def.h                     |    2 +-
 drivers/scsi/qla4xxx/ql4_os.c                      |    6 +-
 drivers/scsi/scsi.c                                |    2 +-
 drivers/scsi/scsi_lib.c                            |    6 +-
 drivers/scsi/scsi_sysfs.c                          |    2 +-
 drivers/scsi/scsi_tgt_lib.c                        |    2 +-
 drivers/scsi/scsi_transport_fc.c                   |    8 +-
 drivers/scsi/scsi_transport_iscsi.c                |    6 +-
 drivers/scsi/scsi_transport_srp.c                  |    6 +-
 drivers/scsi/sg.c                                  |    6 +-
 drivers/spi/spi-dw-pci.c                           |    2 +-
 drivers/spi/spi.c                                  |    2 +-
 drivers/staging/octeon/ethernet-rx.c               |   12 +-
 drivers/staging/octeon/ethernet.c                  |    8 +-
 drivers/staging/rtl8712/rtl871x_io.h               |    2 +-
 drivers/staging/sbe-2t3e3/netdev.c                 |    2 +-
 drivers/staging/speakup/speakup_soft.c             |    2 +-
 drivers/staging/usbip/usbip_common.h               |    2 +-
 drivers/staging/usbip/vhci.h                       |    2 +-
 drivers/staging/usbip/vhci_hcd.c                   |    6 +-
 drivers/staging/usbip/vhci_rx.c                    |    2 +-
 drivers/staging/vt6655/hostap.c                    |    7 +-
 drivers/staging/vt6656/hostap.c                    |    7 +-
 drivers/staging/wlan-ng/hfa384x_usb.c              |    2 +-
 drivers/staging/zcache/tmem.c                      |    4 +-
 drivers/staging/zcache/tmem.h                      |    2 +
 drivers/target/iscsi/iscsi_target.c                |    2 +-
 drivers/target/target_core_tmr.c                   |    6 +-
 drivers/target/target_core_transport.c             |   16 +-
 drivers/tty/hvc/hvcs.c                             |   23 +-
 drivers/tty/ipwireless/tty.c                       |   29 +-
 drivers/tty/n_gsm.c                                |    2 +-
 drivers/tty/n_tty.c                                |    3 +-
 drivers/tty/pty.c                                  |    4 +-
 drivers/tty/serial/kgdboc.c                        |   32 +-
 drivers/tty/tty_io.c                               |    2 +-
 drivers/tty/tty_ldisc.c                            |   10 +-
 drivers/uio/uio.c                                  |   21 +-
 drivers/usb/atm/cxacru.c                           |    2 +-
 drivers/usb/atm/usbatm.c                           |   24 +-
 drivers/usb/core/devices.c                         |    6 +-
 drivers/usb/core/message.c                         |    4 +-
 drivers/usb/early/ehci-dbgp.c                      |   16 +-
 drivers/usb/wusbcore/wa-hc.h                       |    4 +-
 drivers/usb/wusbcore/wa-xfer.c                     |    2 +-
 drivers/vhost/vhost.c                              |    2 +-
 drivers/video/aty/aty128fb.c                       |    2 +-
 drivers/video/fbcmap.c                             |    3 +-
 drivers/video/fbmem.c                              |    6 +-
 drivers/video/geode/gx1fb_core.c                   |    2 +-
 drivers/video/gxt4500.c                            |    4 +-
 drivers/video/i810/i810_accel.c                    |    1 +
 drivers/video/i810/i810_main.c                     |    2 +-
 drivers/video/jz4740_fb.c                          |    2 +-
 drivers/video/udlfb.c                              |   32 +-
 drivers/video/uvesafb.c                            |   36 ++-
 drivers/video/vesafb.c                             |   51 ++-
 drivers/video/via/via_clock.h                      |    2 +-
 drivers/xen/xen-pciback/conf_space.h               |    6 +-
 fs/9p/vfs_inode.c                                  |    2 +-
 fs/Kconfig.binfmt                                  |    2 +-
 fs/aio.c                                           |   11 +-
 fs/autofs4/waitq.c                                 |    2 +-
 fs/befs/linuxvfs.c                                 |    2 +-
 fs/binfmt_aout.c                                   |   23 +-
 fs/binfmt_elf.c                                    |  609 ++++++++++++++++++-
 fs/binfmt_flat.c                                   |    6 +
 fs/bio.c                                           |    2 +-
 fs/block_dev.c                                     |    2 +-
 fs/btrfs/check-integrity.c                         |    2 +-
 fs/btrfs/ctree.c                                   |    9 +-
 fs/btrfs/ioctl.c                                   |    2 +-
 fs/btrfs/relocation.c                              |    2 +-
 fs/cachefiles/bind.c                               |    6 +-
 fs/cachefiles/daemon.c                             |    8 +-
 fs/cachefiles/internal.h                           |   12 +-
 fs/cachefiles/namei.c                              |    2 +-
 fs/cachefiles/proc.c                               |   12 +-
 fs/cachefiles/rdwr.c                               |    2 +-
 fs/ceph/dir.c                                      |    2 +-
 fs/cifs/cifs_debug.c                               |   86 ++--
 fs/cifs/cifsfs.c                                   |    8 +-
 fs/cifs/cifsglob.h                                 |   50 +-
 fs/cifs/link.c                                     |    2 +-
 fs/cifs/misc.c                                     |    4 +-
 fs/coda/cache.c                                    |   10 +-
 fs/compat.c                                        |    6 +-
 fs/compat_binfmt_elf.c                             |    2 +
 fs/compat_ioctl.c                                  |   10 +-
 fs/configfs/dir.c                                  |   10 +-
 fs/dcache.c                                        |    2 +-
 fs/ecryptfs/inode.c                                |    6 +-
 fs/ecryptfs/miscdev.c                              |    2 +-
 fs/ecryptfs/read_write.c                           |    4 +-
 fs/exec.c                                          |  317 +++++++++--
 fs/ext4/ext4.h                                     |   20 +-
 fs/ext4/mballoc.c                                  |   44 +-
 fs/fcntl.c                                         |    4 +-
 fs/fifo.c                                          |   22 +-
 fs/fs_struct.c                                     |   12 +-
 fs/fscache/cookie.c                                |   34 +-
 fs/fscache/internal.h                              |  182 +++---
 fs/fscache/object.c                                |   26 +-
 fs/fscache/operation.c                             |   28 +-
 fs/fscache/page.c                                  |  106 ++--
 fs/fscache/stats.c                                 |  330 +++++-----
 fs/fuse/cuse.c                                     |   10 +-
 fs/fuse/dev.c                                      |    2 +-
 fs/fuse/dir.c                                      |    2 +-
 fs/gfs2/inode.c                                    |    2 +-
 fs/inode.c                                         |    4 +-
 fs/jffs2/erase.c                                   |    3 +-
 fs/jffs2/wbuf.c                                    |    3 +-
 fs/jfs/super.c                                     |    2 +-
 fs/libfs.c                                         |   10 +-
 fs/lockd/clntproc.c                                |    4 +-
 fs/locks.c                                         |    8 +-
 fs/namei.c                                         |   13 +-
 fs/nfs/inode.c                                     |    8 +-
 fs/nfsd/vfs.c                                      |    6 +-
 fs/notify/fanotify/fanotify_user.c                 |    3 +-
 fs/notify/notification.c                           |    4 +-
 fs/ntfs/dir.c                                      |    2 +-
 fs/ntfs/file.c                                     |    4 +-
 fs/ocfs2/localalloc.c                              |    2 +-
 fs/ocfs2/ocfs2.h                                   |   10 +-
 fs/ocfs2/suballoc.c                                |   12 +-
 fs/ocfs2/super.c                                   |   20 +-
 fs/ocfs2/symlink.c                                 |    2 +-
 fs/pipe.c                                          |   33 +-
 fs/proc/array.c                                    |   20 +
 fs/proc/base.c                                     |    2 +-
 fs/proc/kcore.c                                    |   32 +-
 fs/proc/meminfo.c                                  |    2 +-
 fs/proc/nommu.c                                    |    2 +-
 fs/proc/task_mmu.c                                 |   39 +-
 fs/proc/task_nommu.c                               |    4 +-
 fs/quota/netlink.c                                 |    4 +-
 fs/readdir.c                                       |    2 +-
 fs/reiserfs/do_balan.c                             |    2 +-
 fs/reiserfs/procfs.c                               |    2 +-
 fs/seq_file.c                                      |   14 +-
 fs/splice.c                                        |   36 +-
 fs/sysfs/file.c                                    |   10 +-
 fs/sysfs/symlink.c                                 |    2 +-
 fs/udf/misc.c                                      |    2 +-
 fs/xattr_acl.c                                     |    4 +-
 fs/xfs/xfs_bmap.c                                  |    2 +-
 fs/xfs/xfs_dir2_sf.c                               |   10 +-
 fs/xfs/xfs_ioctl.c                                 |    2 +-
 fs/xfs/xfs_iops.c                                  |    2 +-
 include/acpi/acpi_bus.h                            |    2 +-
 include/asm-generic/atomic-long.h                  |  183 ++++++
 include/asm-generic/atomic64.h                     |   12 +
 include/asm-generic/cache.h                        |    4 +-
 include/asm-generic/emergency-restart.h            |    2 +-
 include/asm-generic/int-l64.h                      |    2 +
 include/asm-generic/int-ll64.h                     |    2 +
 include/asm-generic/kmap_types.h                   |    3 +-
 include/asm-generic/local.h                        |    1 +
 include/asm-generic/pgtable-nopmd.h                |   18 +-
 include/asm-generic/pgtable-nopud.h                |   14 +-
 include/asm-generic/pgtable.h                      |    8 +
 include/asm-generic/vmlinux.lds.h                  |   10 +-
 include/drm/drmP.h                                 |    5 +-
 include/drm/drm_crtc_helper.h                      |    4 +-
 include/drm/ttm/ttm_memory.h                       |    2 +-
 include/linux/a.out.h                              |    8 +
 include/linux/atmdev.h                             |    2 +-
 include/linux/binfmts.h                            |    1 +
 include/linux/blkdev.h                             |    2 +-
 include/linux/blktrace_api.h                       |    2 +-
 include/linux/byteorder/little_endian.h            |   24 +-
 include/linux/cache.h                              |    4 +
 include/linux/cleancache.h                         |    2 +-
 include/linux/compiler-gcc4.h                      |   11 +
 include/linux/compiler.h                           |   60 ++-
 include/linux/cpuset.h                             |    2 +-
 include/linux/crypto.h                             |    6 +-
 include/linux/decompress/mm.h                      |    2 +-
 include/linux/dma-mapping.h                        |    2 +-
 include/linux/efi.h                                |    2 +-
 include/linux/elf.h                                |   30 +
 include/linux/filter.h                             |    4 +
 include/linux/firewire.h                           |    2 +-
 include/linux/fs.h                                 |    3 +-
 include/linux/fs_struct.h                          |    2 +-
 include/linux/fscache-cache.h                      |    4 +-
 include/linux/fsnotify.h                           |    2 +-
 include/linux/fsnotify_backend.h                   |    1 +
 include/linux/ftrace_event.h                       |    4 +-
 include/linux/genhd.h                              |    2 +-
 include/linux/hid.h                                |    2 +-
 include/linux/highmem.h                            |   12 +
 include/linux/i2c.h                                |    1 +
 include/linux/i2o.h                                |    2 +-
 include/linux/if_team.h                            |    3 +-
 include/linux/init.h                               |    4 +-
 include/linux/init_task.h                          |    7 +
 include/linux/intel-iommu.h                        |    2 +-
 include/linux/interrupt.h                          |    6 +-
 include/linux/kgdb.h                               |    6 +-
 include/linux/kref.h                               |    2 +-
 include/linux/kvm_host.h                           |    4 +-
 include/linux/libata.h                             |    2 +-
 include/linux/mca.h                                |    2 +-
 include/linux/memory.h                             |    2 +-
 include/linux/mfd/abx500.h                         |    1 +
 include/linux/mm.h                                 |   66 +--
 include/linux/mm_types.h                           |   20 +
 include/linux/mmu_notifier.h                       |    6 +-
 include/linux/mmzone.h                             |    2 +-
 include/linux/mod_devicetable.h                    |    4 +-
 include/linux/module.h                             |   54 ++-
 include/linux/moduleloader.h                       |   12 +
 include/linux/moduleparam.h                        |    4 +-
 include/linux/namei.h                              |    6 +-
 include/linux/netdevice.h                          |    3 +-
 include/linux/of_pdt.h                             |    2 +-
 include/linux/oprofile.h                           |    4 +-
 include/linux/padata.h                             |    2 +-
 include/linux/perf_event.h                         |    8 +-
 include/linux/pipe_fs_i.h                          |    6 +-
 include/linux/pm_runtime.h                         |    2 +-
 include/linux/poison.h                             |    4 +-
 include/linux/preempt.h                            |    2 +-
 include/linux/proc_fs.h                            |    2 +-
 include/linux/random.h                             |    7 +-
 include/linux/reboot.h                             |   14 +-
 include/linux/reiserfs_fs.h                        |    2 +-
 include/linux/reiserfs_fs_sb.h                     |    2 +-
 include/linux/relay.h                              |    2 +-
 include/linux/rfkill.h                             |    1 +
 include/linux/rio.h                                |    2 +-
 include/linux/rmap.h                               |    4 +-
 include/linux/sched.h                              |   69 ++-
 include/linux/screen_info.h                        |    3 +-
 include/linux/seq_file.h                           |    1 +
 include/linux/skbuff.h                             |    8 +-
 include/linux/slab.h                               |   73 +++-
 include/linux/slab_def.h                           |    8 +-
 include/linux/slub_def.h                           |    4 +-
 include/linux/sonet.h                              |    2 +-
 include/linux/sunrpc/clnt.h                        |    8 +-
 include/linux/sunrpc/sched.h                       |    1 +
 include/linux/sunrpc/svc_rdma.h                    |   18 +-
 include/linux/sysctl.h                             |    6 +-
 include/linux/tty_ldisc.h                          |    2 +-
 include/linux/types.h                              |   16 +
 include/linux/uaccess.h                            |    6 +-
 include/linux/unaligned/access_ok.h                |   12 +-
 include/linux/usb/renesas_usbhs.h                  |    4 +-
 include/linux/vermagic.h                           |   21 +-
 include/linux/vmalloc.h                            |  104 ++++
 include/linux/vmstat.h                             |   20 +-
 include/linux/xattr.h                              |    5 +
 include/media/saa7146_vv.h                         |    2 +-
 include/media/v4l2-dev.h                           |    3 +-
 include/media/v4l2-ioctl.h                         |    2 +-
 include/net/caif/caif_hsi.h                        |    2 +-
 include/net/caif/cfctrl.h                          |    6 +-
 include/net/flow.h                                 |    2 +-
 include/net/inetpeer.h                             |    8 +-
 include/net/ip_fib.h                               |    2 +-
 include/net/ip_vs.h                                |    4 +-
 include/net/irda/ircomm_core.h                     |    2 +-
 include/net/irda/ircomm_tty.h                      |    5 +-
 include/net/iucv/af_iucv.h                         |    2 +-
 include/net/neighbour.h                            |    2 +-
 include/net/netlink.h                              |    2 +-
 include/net/netns/ipv4.h                           |    4 +-
 include/net/sctp/sctp.h                            |    6 +-
 include/net/sock.h                                 |    4 +-
 include/net/tcp.h                                  |    2 +-
 include/net/udp.h                                  |    2 +-
 include/net/xfrm.h                                 |    2 +-
 include/rdma/iw_cm.h                               |    2 +-
 include/scsi/libfc.h                               |    3 +-
 include/scsi/scsi_device.h                         |    6 +-
 include/scsi/scsi_transport_fc.h                   |    2 +-
 include/sound/ak4xxx-adda.h                        |    2 +-
 include/sound/hwdep.h                              |    2 +-
 include/sound/info.h                               |    2 +-
 include/sound/pcm.h                                |    1 +
 include/sound/sb16_csp.h                           |    2 +-
 include/sound/soc.h                                |    4 +-
 include/sound/ymfpci.h                             |    2 +-
 include/target/target_core_base.h                  |    8 +-
 include/trace/events/irq.h                         |    4 +-
 include/video/udlfb.h                              |    8 +-
 include/video/uvesafb.h                            |    1 +
 init/Kconfig                                       |    2 +-
 init/do_mounts.c                                   |   14 +-
 init/do_mounts.h                                   |    8 +-
 init/do_mounts_initrd.c                            |   28 +-
 init/do_mounts_md.c                                |    6 +-
 init/initramfs.c                                   |   40 +-
 init/main.c                                        |   56 ++-
 ipc/msg.c                                          |   11 +-
 ipc/sem.c                                          |   11 +-
 ipc/shm.c                                          |   17 +-
 kernel/acct.c                                      |    2 +-
 kernel/audit.c                                     |    8 +-
 kernel/auditsc.c                                   |    4 +-
 kernel/capability.c                                |    3 +
 kernel/compat.c                                    |   44 +-
 kernel/debug/debug_core.c                          |   16 +-
 kernel/debug/kdb/kdb_main.c                        |    4 +-
 kernel/events/core.c                               |   28 +-
 kernel/exit.c                                      |    4 +-
 kernel/fork.c                                      |  165 ++++--
 kernel/futex.c                                     |    9 +
 kernel/gcov/base.c                                 |    7 +-
 kernel/hrtimer.c                                   |    2 +-
 kernel/jump_label.c                                |    4 +
 kernel/kallsyms.c                                  |   39 ++-
 kernel/kexec.c                                     |    3 +-
 kernel/kmod.c                                      |    2 +-
 kernel/kprobes.c                                   |    8 +-
 kernel/lockdep.c                                   |    7 +-
 kernel/lockdep_proc.c                              |    2 +-
 kernel/module.c                                    |  326 +++++++----
 kernel/mutex-debug.c                               |   12 +-
 kernel/mutex-debug.h                               |    4 +-
 kernel/mutex.c                                     |    7 +-
 kernel/padata.c                                    |    8 +-
 kernel/panic.c                                     |    3 +-
 kernel/pid.c                                       |    2 +-
 kernel/posix-cpu-timers.c                          |    4 +-
 kernel/posix-timers.c                              |   20 +-
 kernel/power/poweroff.c                            |    2 +-
 kernel/power/process.c                             |   13 +-
 kernel/profile.c                                   |   14 +-
 kernel/ptrace.c                                    |    6 +-
 kernel/rcutiny.c                                   |    4 +-
 kernel/rcutorture.c                                |   56 +-
 kernel/rcutree.c                                   |   32 +-
 kernel/rcutree.h                                   |    2 +-
 kernel/rcutree_plugin.h                            |   16 +-
 kernel/rcutree_trace.c                             |    4 +-
 kernel/rtmutex-tester.c                            |   24 +-
 kernel/sched/auto_group.c                          |    4 +-
 kernel/sched/fair.c                                |    2 +-
 kernel/signal.c                                    |    8 +-
 kernel/smp.c                                       |    8 +-
 kernel/softirq.c                                   |   14 +-
 kernel/sys.c                                       |   12 +-
 kernel/sysctl.c                                    |   37 ++-
 kernel/sysctl_binary.c                             |   14 +-
 kernel/time/alarmtimer.c                           |    2 +-
 kernel/time/tick-broadcast.c                       |    2 +-
 kernel/time/timer_stats.c                          |   10 +-
 kernel/timer.c                                     |    2 +-
 kernel/trace/blktrace.c                            |    6 +-
 kernel/trace/ftrace.c                              |   11 +-
 kernel/trace/trace.c                               |    6 +-
 kernel/trace/trace_events.c                        |   25 +-
 kernel/trace/trace_kprobe.c                        |    8 +-
 kernel/trace/trace_mmiotrace.c                     |    8 +-
 kernel/trace/trace_output.c                        |    2 +-
 kernel/trace/trace_stack.c                         |    2 +-
 kernel/trace/trace_workqueue.c                     |    6 +-
 lib/bitmap.c                                       |    8 +-
 lib/bug.c                                          |    2 +
 lib/debugobjects.c                                 |    2 +-
 lib/devres.c                                       |    4 +-
 lib/dma-debug.c                                    |    2 +-
 lib/extable.c                                      |    3 +
 lib/inflate.c                                      |    2 +-
 lib/radix-tree.c                                   |    2 +-
 lib/vsprintf.c                                     |   12 +-
 mm/Kconfig                                         |    6 +-
 mm/filemap.c                                       |    2 +-
 mm/fremap.c                                        |    5 +
 mm/highmem.c                                       |    7 +-
 mm/huge_memory.c                                   |    2 +-
 mm/hugetlb.c                                       |   54 ++
 mm/internal.h                                      |    1 +
 mm/maccess.c                                       |    4 +-
 mm/madvise.c                                       |   41 ++
 mm/memory-failure.c                                |   18 +-
 mm/memory.c                                        |  358 +++++++++--
 mm/mempolicy.c                                     |   25 +
 mm/mlock.c                                         |   20 +-
 mm/mmap.c                                          |  632 +++++++++++++++++---
 mm/mprotect.c                                      |  137 +++++-
 mm/mremap.c                                        |   45 ++-
 mm/nommu.c                                         |   11 +-
 mm/page_alloc.c                                    |   14 +-
 mm/percpu.c                                        |    2 +-
 mm/process_vm_access.c                             |   14 +-
 mm/rmap.c                                          |   41 ++-
 mm/shmem.c                                         |    5 +-
 mm/slab.c                                          |   81 ++-
 mm/slob.c                                          |  180 +++++-
 mm/slub.c                                          |   69 ++-
 mm/swap.c                                          |    3 +
 mm/swapfile.c                                      |   12 +-
 mm/util.c                                          |    8 +
 mm/vmalloc.c                                       |   92 +++-
 mm/vmstat.c                                        |    6 +-
 net/8021q/vlan.c                                   |    3 +-
 net/9p/trans_fd.c                                  |    2 +-
 net/atm/atm_misc.c                                 |    8 +-
 net/atm/lec.h                                      |    2 +-
 net/atm/mpc.h                                      |    2 +-
 net/atm/proc.c                                     |    6 +-
 net/atm/resources.c                                |    4 +-
 net/batman-adv/bat_iv_ogm.c                        |    6 +-
 net/batman-adv/hard-interface.c                    |    4 +-
 net/batman-adv/soft-interface.c                    |    4 +-
 net/batman-adv/types.h                             |    6 +-
 net/batman-adv/unicast.c                           |    2 +-
 net/bluetooth/hci_conn.c                           |    2 +-
 net/bluetooth/l2cap_core.c                         |   12 +-
 net/bridge/netfilter/ebtables.c                    |    2 +-
 net/caif/caif_socket.c                             |   43 +-
 net/caif/cfctrl.c                                  |   11 +-
 net/can/gw.c                                       |    2 +-
 net/compat.c                                       |   32 +-
 net/core/datagram.c                                |    2 +-
 net/core/dev.c                                     |   16 +-
 net/core/flow.c                                    |    8 +-
 net/core/iovec.c                                   |    4 +-
 net/core/rtnetlink.c                               |    2 +-
 net/core/scm.c                                     |    8 +-
 net/core/sock.c                                    |   16 +-
 net/decnet/sysctl_net_decnet.c                     |    4 +-
 net/ipv4/fib_frontend.c                            |    6 +-
 net/ipv4/fib_semantics.c                           |    2 +-
 net/ipv4/inetpeer.c                                |    4 +-
 net/ipv4/ip_fragment.c                             |    2 +-
 net/ipv4/ip_sockglue.c                             |    2 +-
 net/ipv4/ipconfig.c                                |    6 +-
 net/ipv4/netfilter/nf_nat_snmp_basic.c             |    2 +-
 net/ipv4/ping.c                                    |    2 +-
 net/ipv4/raw.c                                     |   14 +-
 net/ipv4/route.c                                   |    6 +-
 net/ipv4/tcp_probe.c                               |    2 +-
 net/ipv4/udp.c                                     |    8 +-
 net/ipv6/addrconf.c                                |    2 +-
 net/ipv6/inet6_connection_sock.c                   |    4 +-
 net/ipv6/ipv6_sockglue.c                           |    2 +-
 net/ipv6/raw.c                                     |   19 +-
 net/ipv6/udp.c                                     |    8 +-
 net/irda/ircomm/ircomm_tty.c                       |   38 +-
 net/iucv/af_iucv.c                                 |    4 +-
 net/key/af_key.c                                   |    4 +-
 net/mac80211/ieee80211_i.h                         |    3 +-
 net/mac80211/iface.c                               |   12 +-
 net/mac80211/main.c                                |    2 +-
 net/mac80211/pm.c                                  |    6 +-
 net/mac80211/rate.c                                |    2 +-
 net/mac80211/rc80211_pid_debugfs.c                 |    2 +-
 net/mac80211/util.c                                |    2 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |    6 +-
 net/netfilter/ipvs/ip_vs_core.c                    |    4 +-
 net/netfilter/ipvs/ip_vs_ctl.c                     |   10 +-
 net/netfilter/ipvs/ip_vs_sync.c                    |    4 +-
 net/netfilter/ipvs/ip_vs_xmit.c                    |    4 +-
 net/netfilter/nfnetlink_log.c                      |    4 +-
 net/netfilter/xt_statistic.c                       |    8 +-
 net/netlink/af_netlink.c                           |    4 +-
 net/packet/af_packet.c                             |    8 +-
 net/phonet/pep.c                                   |    6 +-
 net/phonet/socket.c                                |    2 +-
 net/rds/cong.c                                     |    6 +-
 net/rds/ib.h                                       |    2 +-
 net/rds/ib_cm.c                                    |    2 +-
 net/rds/ib_recv.c                                  |    4 +-
 net/rds/iw.h                                       |    2 +-
 net/rds/iw_cm.c                                    |    2 +-
 net/rds/iw_recv.c                                  |    4 +-
 net/rds/tcp.c                                      |    2 +-
 net/rds/tcp_send.c                                 |    2 +-
 net/rxrpc/af_rxrpc.c                               |    2 +-
 net/rxrpc/ar-ack.c                                 |   14 +-
 net/rxrpc/ar-call.c                                |    2 +-
 net/rxrpc/ar-connection.c                          |    2 +-
 net/rxrpc/ar-connevent.c                           |    2 +-
 net/rxrpc/ar-input.c                               |    4 +-
 net/rxrpc/ar-internal.h                            |    8 +-
 net/rxrpc/ar-local.c                               |    2 +-
 net/rxrpc/ar-output.c                              |    4 +-
 net/rxrpc/ar-peer.c                                |    2 +-
 net/rxrpc/ar-proc.c                                |    4 +-
 net/rxrpc/ar-transport.c                           |    2 +-
 net/rxrpc/rxkad.c                                  |    4 +-
 net/sctp/socket.c                                  |    2 +-
 net/socket.c                                       |   34 +-
 net/sunrpc/sched.c                                 |    4 +-
 net/sunrpc/svcsock.c                               |    2 +-
 net/sunrpc/xprtrdma/svc_rdma.c                     |   38 +-
 net/sunrpc/xprtrdma/svc_rdma_recvfrom.c            |    6 +-
 net/sunrpc/xprtrdma/svc_rdma_sendto.c              |    2 +-
 net/sunrpc/xprtrdma/svc_rdma_transport.c           |   10 +-
 net/tipc/link.c                                    |    6 +-
 net/tipc/msg.c                                     |    2 +-
 net/tipc/subscr.c                                  |    2 +-
 net/wireless/core.h                                |    2 +-
 net/wireless/wext-core.c                           |   19 +-
 net/xfrm/xfrm_policy.c                             |   16 +-
 scripts/Makefile.build                             |    4 +-
 scripts/Makefile.clean                             |    3 +-
 scripts/Makefile.host                              |    2 +
 scripts/basic/fixdep.c                             |   12 +-
 scripts/gcc-plugin.sh                              |    2 +
 scripts/mod/file2alias.c                           |   14 +-
 scripts/mod/modpost.c                              |   25 +-
 scripts/mod/modpost.h                              |    6 +-
 scripts/mod/sumversion.c                           |    2 +-
 scripts/pnmtologo.c                                |    6 +-
 security/Kconfig                                   |  618 +++++++++++++++++++-
 security/integrity/ima/ima.h                       |    4 +-
 security/integrity/ima/ima_api.c                   |    2 +-
 security/integrity/ima/ima_fs.c                    |    4 +-
 security/integrity/ima/ima_queue.c                 |    2 +-
 security/keys/compat.c                             |    2 +-
 security/keys/keyctl.c                             |    8 +-
 security/keys/keyring.c                            |    6 +-
 security/security.c                                |    8 +-
 security/selinux/hooks.c                           |    2 +-
 security/selinux/include/xfrm.h                    |    2 +-
 security/smack/smack_lsm.c                         |    2 +-
 security/tomoyo/tomoyo.c                           |    2 +-
 sound/aoa/codecs/onyx.c                            |    7 +-
 sound/aoa/codecs/onyx.h                            |    1 +
 sound/core/oss/pcm_oss.c                           |   18 +-
 sound/core/pcm_compat.c                            |    2 +-
 sound/core/pcm_native.c                            |    4 +-
 sound/core/seq/seq_device.c                        |    8 +-
 sound/drivers/mts64.c                              |   14 +-
 sound/drivers/opl4/opl4_lib.c                      |    2 +-
 sound/drivers/portman2x4.c                         |    3 +-
 sound/firewire/amdtp.c                             |    4 +-
 sound/firewire/amdtp.h                             |    2 +-
 sound/firewire/isight.c                            |   10 +-
 sound/isa/cmi8330.c                                |    2 +-
 sound/oss/sb_audio.c                               |    2 +-
 sound/oss/swarm_cs4297a.c                          |    6 +-
 sound/pci/hda/hda_codec.h                          |    7 +-
 sound/pci/ice1712/ice1712.h                        |    4 +-
 sound/pci/ymfpci/ymfpci_main.c                     |   12 +-
 sound/soc/soc-pcm.c                                |    2 +-
 sound/usb/card.h                                   |    3 +-
 tools/gcc/Makefile                                 |   23 +
 tools/gcc/checker_plugin.c                         |  171 ++++++
 tools/gcc/colorize_plugin.c                        |  147 +++++
 tools/gcc/constify_plugin.c                        |  303 ++++++++++
 tools/gcc/kallocstat_plugin.c                      |  167 +++++
 tools/gcc/kernexec_plugin.c                        |  427 +++++++++++++
 tools/gcc/stackleak_plugin.c                       |  313 ++++++++++
 tools/perf/util/include/asm/alternative-asm.h      |    3 +
 usr/gen_init_cpio.c                                |    7 +-
 virt/kvm/kvm_main.c                                |   20 +-
 1246 files changed, 18805 insertions(+), 5986 deletions(-)
commit a00016a11e35e91aec8e2d9b6ec4c6fbb11d6d2b
Merge: 0949bd4 fc53d63
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Mar 22 19:03:44 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit fc53d6338964741b368070ec5c935bc579b8c2a6
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Mar 22 19:02:45 2012 -0400

    Update to pax-linux-3.2.12-test33.patch

commit 0949bd46a6455b308f66ad7c993bfee62412db35
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Mar 22 16:56:09 2012 -0400

    Use current_umask() instead of current->fs->umask

commit 22f6432d0fe733619cfcb523782ed7d80c46d645
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Mar 21 19:42:42 2012 -0400

    compile fix

commit 0cad49d6b8fbb32395da924c1665a1110a9a9eef
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Mar 21 19:34:56 2012 -0400

    Resolve some very tricky hash table manipulations that resulted in an infinite loop in certain
    uses of domains with particular hash collisions

commit 47fc52e0a068a29d6cca2f809daf0679cba33c44
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Mar 20 20:25:49 2012 -0400

    zero kernel_role

commit b00953b43c69238d181d21121ef1577c988d5f6b
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Mar 20 19:29:34 2012 -0400

    zero real_root after releasing it

commit 0b3ab73ce5d34a2c3206955cd65eddd6bdfd32a1
Merge: b724f59 273f98e
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Mar 20 19:11:26 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit 273f98e58cdac555d3b5dce5c1ca168349f95878
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Mar 20 19:10:52 2012 -0400

    Temporary workaround for (most) size_overflow plugin false-positives
    Increase randomization for brk-managed heap to 21 bits
    Update to pax-linux-3.2.12-test32.patch

commit b724f59125304460c2af8bd4b02921993afbb5d3
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Mar 20 18:58:53 2012 -0400

    compile fix

commit 329f1a9d0f137d0a973316c53bbec18a6eeecd4f
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Mar 20 18:52:23 2012 -0400

    Require default and kernel role

commit a7c5c4f55bdd61cfcd0fb1be7a67160429409878
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Mar 20 18:47:28 2012 -0400

    Allow policies without special roles
    don't call free_variables in error path of copy_user_acl, we'll call it later (triggered by a policy without special roles)

commit 402ec3d24d66d38403dc543c84851f5e72d39e22
Merge: 8e012dc f14661a
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Mar 19 18:06:59 2012 -0400

    Merge branch 'pax-test' into grsec-test
    
    Conflicts:
        fs/namei.c

commit f14661aaf202155c97f66626cea0269017bb7775
Merge: eae671f 058b017
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Mar 19 18:05:44 2012 -0400

    Merge branch 'linux-3.2.y' into pax-test

commit 8e012dcf7a50b7cde34c2cec93ecedd049123b75
Author: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Date:   Fri Mar 16 17:08:39 2012 -0700

    nilfs2: fix NULL pointer dereference in nilfs_load_super_block()
    
    According to the report from Slicky Devil, nilfs caused kernel oops at
    nilfs_load_super_block function during mount after he shrank the
    partition without resizing the filesystem:
    
     BUG: unable to handle kernel NULL pointer dereference at 00000048
     IP: [<d0d7a08e>] nilfs_load_super_block+0x17e/0x280 [nilfs2]
     *pde = 00000000
     Oops: 0000 [#1] PREEMPT SMP
     ...
     Call Trace:
      [<d0d7a87b>] init_nilfs+0x4b/0x2e0 [nilfs2]
      [<d0d6f707>] nilfs_mount+0x447/0x5b0 [nilfs2]
      [<c0226636>] mount_fs+0x36/0x180
      [<c023d961>] vfs_kern_mount+0x51/0xa0
      [<c023ddae>] do_kern_mount+0x3e/0xe0
      [<c023f189>] do_mount+0x169/0x700
      [<c023fa9b>] sys_mount+0x6b/0xa0
      [<c04abd1f>] sysenter_do_call+0x12/0x28
     Code: 53 18 8b 43 20 89 4b 18 8b 4b 24 89 53 1c 89 43 24 89 4b 20 8b 43
     20 c7 43 2c 00 00 00 00 23 75 e8 8b 50 68 89 53 28 8b 54 b3 20 <8b> 72
     48 8b 7a 4c 8b 55 08 89 b3 84 00 00 00 89 bb 88 00 00 00
     EIP: [<d0d7a08e>] nilfs_load_super_block+0x17e/0x280 [nilfs2] SS:ESP 0068:ca9bbdcc
     CR2: 0000000000000048
    
    This turned out due to a defect in an error path which runs if the
    calculated location of the secondary super block was invalid.
    
    This patch fixes it and eliminates the reported oops.
    
    Reported-by: Slicky Devil <slicky.dvl@gmail.com>
    Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
    Tested-by: Slicky Devil <slicky.dvl@gmail.com>
    Cc: <stable@vger.kernel.org>        [2.6.30+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 8067d7f69bf27dc08057a771cf125e71e4575bf2
Author: Haogang Chen <haogangchen@gmail.com>
Date:   Fri Mar 16 17:08:38 2012 -0700

    nilfs2: clamp ns_r_segments_percentage to [1, 99]
    
    ns_r_segments_percentage is read from the disk.  Bogus or malicious
    value could cause integer overflow and malfunction due to meaningless
    disk usage calculation.  This patch reports error when mounting such
    bogus volumes.
    
    Signed-off-by: Haogang Chen <haogangchen@gmail.com>
    Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit e1a90645643f9b0194a5984ec8febd06360d5c8b
Author: Eric Dumazet <eric.dumazet@gmail.com>
Date:   Sat Mar 10 09:20:21 2012 +0000

    tcp: fix syncookie regression
    
    commit ea4fc0d619 (ipv4: Don't use rt->rt_{src,dst} in ip_queue_xmit())
    added a serious regression on synflood handling.
    
    Simon Kirby discovered a successful connection was delayed by 20 seconds
    before being responsive.
    
    In my tests, I discovered that xmit frames were lost, and needed ~4
    retransmits and a socket dst rebuild before being really sent.
    
    In case of syncookie initiated connection, we use a different path to
    initialize the socket dst, and inet->cork.fl.u.ip4 is left cleared.
    
    As ip_queue_xmit() now depends on inet flow being setup, fix this by
    copying the temp flowi4 we use in cookie_v4_check().
    
    Reported-by: Simon Kirby <sim@netnation.com>
    Bisected-by: Simon Kirby <sim@netnation.com>
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Tested-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 06c6c8628bf38b08b4d97f4c55cde9fdecfb5d65
Author: Stanislav Kinsbursky <skinsbursky@parallels.com>
Date:   Mon Mar 12 02:59:41 2012 +0000

    tun: don't hold network namespace by tun sockets
    
    v3: added previously removed sock_put() to the tun_release() callback, because
    sk_release_kernel() doesn't drop the socket reference.
    
    v2: sk_release_kernel() used for socket release. Dummy tun_release() is
    required for sk_release_kernel() ---> sock_release() ---> sock->ops->release()
    call.
    
    TUN was designed to destroy it's socket on network namesapce shutdown. But this
    will never happen for persistent device, because it's socket holds network
    namespace.
    This patch removes of holding network namespace by TUN socket and replaces it
    by creating socket in init_net and then changing it's net it to desired one. On
    shutdown socket is moved back to init_net prior to final put.
    
    Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 46ae7374bd387c58d673a9e58852a9fd31042c5c
Author: Tyler Hicks <tyhicks@canonical.com>
Date:   Mon Dec 12 10:02:30 2011 -0600

    vfs: Correctly set the dir i_mutex lockdep class
    
    9a7aa12f3911853a introduced additional logic around setting the i_mutex
    lockdep class for directory inodes. The idea was that some filesystems
    may want their own special lockdep class for different directory
    inodes and calling unlock_new_inode() should not clobber one of
    those special classes.
    
    I believe that the added conditional, around the *negated* return value
    of lockdep_match_class(), caused directory inodes to be placed in the
    wrong lockdep class.
    
    inode_init_always() sets the i_mutex lockdep class with i_mutex_key for
    all inodes. If the filesystem did not change the class during inode
    initialization, then the conditional mentioned above was false and the
    directory inode was incorrectly left in the non-directory lockdep class.
    If the filesystem did set a special lockdep class, then the conditional
    mentioned above was true and that class was clobbered with
    i_mutex_dir_key.
    
    This patch removes the negation from the conditional so that the i_mutex
    lockdep class is properly set for directory inodes. Special classes are
    preserved and directory inodes with unmodified classes are set with
    i_mutex_dir_key.
    
    Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit 603590b0d2eca61ce26499eac9c563bc567a18c9
Author: Jan Kara <jack@suse.cz>
Date:   Mon Feb 20 17:54:00 2012 +0100

    udf: Fix deadlock in udf_release_file()
    
    udf_release_file() can be called from munmap() path with mmap_sem held.  Thus
    we cannot take i_mutex there because that ranks above mmap_sem. Luckily,
    i_mutex is not needed in udf_release_file() anymore since protection by
    i_data_sem is enough to protect from races with write and truncate.
    
    Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
    Reviewed-by: Namjae Jeon <linkinjeon@gmail.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit ca79ab9034f3c2f7e3f65c35e0d9ed3ecea529bf
Author: Miklos Szeredi <mszeredi@suse.cz>
Date:   Tue Mar 6 13:56:33 2012 +0100

    vfs: fix double put after complete_walk()
    
    complete_walk() already puts nd->path, no need to do it again at cleanup time.
    
    This would result in Oopses if triggered, apparently the codepath is not too
    well exercised.
    
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    CC: stable@vger.kernel.org
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit 13885ba2b18400f3ef6540497d30f1af896605e5
Author: Miklos Szeredi <mszeredi@suse.cz>
Date:   Tue Mar 6 13:56:34 2012 +0100

    vfs: fix return value from do_last()
    
    complete_walk() returns either ECHILD or ESTALE.  do_last() turns this into
    ECHILD unconditionally.  If not in RCU mode, this error will reach userspace
    which is complete nonsense.
    
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    CC: stable@vger.kernel.org
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    
    Conflicts:
    
        fs/namei.c

commit f5ab7572c99ffb58953eb1070622307e904c3b7f
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Sat Mar 10 17:07:28 2012 -0500

    restore smp_mb() in unlock_new_inode()
    
    wait_on_inode() doesn't have ->i_lock
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit f3e758cd08e3881982d4b78eb72fe8a1ead6b872
Author: David S. Miller <davem@davemloft.net>
Date:   Tue Mar 13 18:19:51 2012 -0700

    sparc32: Add -Av8 to assembler command line.
    
    Newer version of binutils are more strict about specifying the
    correct options to enable certain classes of instructions.
    
    The sparc32 build is done for v7 in order to support sun4c systems
    which lack hardware integer multiply and divide instructions.
    
    So we have to pass -Av8 when building the assembler routines that
    use these instructions and get patched into the kernel when we find
    out that we have a v8 capable cpu.
    
    Reported-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 66276ec78b2a971d2e704e5ef963cdc8b6a049a4
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Fri Mar 9 20:55:10 2012 +0100

    x86: Derandom delay_tsc for 64 bit
    
    Commit f0fbf0abc093 ("x86: integrate delay functions") converted
    delay_tsc() into a random delay generator for 64 bit.  The reason is
    that it merged the mostly identical versions of delay_32.c and
    delay_64.c.  Though the subtle difference of the result was:
    
     static void delay_tsc(unsigned long loops)
     {
    -   unsigned bclock, now;
    +   unsigned long bclock, now;
    
    Now the function uses rdtscl() which returns the lower 32bit of the
    TSC. On 32bit that's not problematic as unsigned long is 32bit. On 64
    bit this fails when the lower 32bit are close to wrap around when
    bclock is read, because the following check
    
           if ((now - bclock) >= loops)
                        break;
    
    evaluated to true on 64bit for e.g. bclock = 0xffffffff and now = 0
    because the unsigned long (now - bclock) of these values results in
    0xffffffff00000001 which is definitely larger than the loops
    value. That explains Tvortkos observation:
    
    "Because I am seeing udelay(500) (_occasionally_) being short, and
     that by delaying for some duration between 0us (yep) and 491us."
    
    Make those variables explicitely u32 again, so this works for both 32
    and 64 bit.
    
    Reported-by: Tvrtko Ursulin <tvrtko.ursulin@onelan.co.uk>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: stable@vger.kernel.org # >= 2.6.27
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 2d0ddb60f5031bdf79b4d51225f9f2d5856255bf
Author: Al Viro <viro@ZenIV.linux.org.uk>
Date:   Thu Mar 8 17:51:19 2012 +0000

    aio: fix the "too late munmap()" race
    
    Current code has put_ioctx() called asynchronously from aio_fput_routine();
    that's done *after* we have killed the request that used to pin ioctx,
    so there's nothing to stop io_destroy() waiting in wait_for_all_aios()
    from progressing.  As the result, we can end up with async call of
    put_ioctx() being the last one and possibly happening during exit_mmap()
    or elf_core_dump(), neither of which expects stray munmap() being done
    to them...
    
    We do need to prevent _freeing_ ioctx until aio_fput_routine() is done
    with that, but that's all we care about - neither io_destroy() nor
    exit_aio() will progress past wait_for_all_aios() until aio_fput_routine()
    does really_put_req(), so the ioctx teardown won't be done until then
    and we don't care about the contents of ioctx past that point.
    
    Since actual freeing of these suckers is RCU-delayed, we don't need to
    bump ioctx refcount when request goes into list for async removal.
    All we need is rcu_read_lock held just over the ->ctx_lock-protected
    area in aio_fput_routine().
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
    Acked-by: Benjamin LaHaise <bcrl@kvack.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 002124c055afbf09b52226af65621999e8316448
Author: Al Viro <viro@ZenIV.linux.org.uk>
Date:   Wed Mar 7 05:16:35 2012 +0000

    aio: fix io_setup/io_destroy race
    
    Have ioctx_alloc() return an extra reference, so that caller would drop it
    on success and not bother with re-grabbing it on failure exit.  The current
    code is obviously broken - io_destroy() from another thread that managed
    to guess the address io_setup() would've returned would free ioctx right
    under us; gets especially interesting if aio_context_t * we pass to
    io_setup() points to PROT_READ mapping, so put_user() fails and we end
    up doing io_destroy() on kioctx another thread has just got freed...
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Acked-by: Benjamin LaHaise <bcrl@kvack.org>
    Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit a1cd2719b8ed8e40dbd98c87713ac23a2169f6d8
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Thu Mar 15 15:17:12 2012 -0700

    drivers/video/backlight/s6e63m0.c: fix corruption storing gamma mode
    
    strict_strtoul() writes a long but ->gamma_mode only has space to store an
    int, so on 64 bit systems we end up scribbling over ->gamma_table_count as
    well.  I've changed it to use kstrtouint() instead.
    
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Inki Dae <inki.dae@samsung.com>
    Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit cf83f735a5571f4341ee6eab947a1f7d833cea6e
Merge: e4b05b6 eae671f
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Mar 16 21:04:27 2012 -0400

    Merge branch 'pax-test' into grsec-test
    
    Conflicts:
        security/Kconfig

commit eae671fafe93f04685c04a089cc13efebc05d600
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Mar 16 20:58:01 2012 -0400

    Update to pax-linux-3.2.11-test31.patch
    Introduction of the size_overflow plugin from Emese Revfy
    Many thanks to Emese for her hard work :)

commit e4b05b65c645c412eceb9c950ee7b4771627e6b1
Merge: e55aa68 258c015
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Mar 15 20:59:19 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit 258c0159fa6dd5044ca984eeaad57bb6e21bacea
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Mar 15 20:59:05 2012 -0400

    fix ARM compilation

commit e55aa68f4bb20e75cd7423123aa612c2a69590c0
Merge: 8f95ea9 55b7573
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Mar 14 19:33:41 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit 55b7573f6c2f3be26fb39c7bd6a9d742d02811ca
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Mar 14 19:33:15 2012 -0400

    Update to pax-linux-3.2.10-test28.patch

commit 8f95ea9f718c293794a1f6bdd2a5f5f336f7bd64
Merge: c8786a2 886ac5e
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Mar 13 17:38:13 2012 -0400

    Merge branch 'pax-test' into grsec-test
    
    Greets and thanks to snq for his assistance in testing/debugging REFCOUNT on ARM :)

commit 886ac5eeb1835e87cf7398b8aae9e9ba6b36bf77
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Mar 13 17:37:44 2012 -0400

    Update to pax-linux-3.2.10-test26.patch

commit c8786a2abed5e5327f68efa520c04db99bb6a63a
Merge: 219c982 c061fcf
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Mar 13 17:25:06 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit c061fcfa6b78f3774800821144d8ac2d94d7da3e
Merge: 89373d2 3f4b3b2
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Mar 13 17:25:02 2012 -0400

    Merge branch 'linux-3.2.y' into pax-test

commit 219c982a05abe47be4ea7d749e1b408e0cb86f1f
Merge: 54e19a3 89373d2
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Mar 12 17:23:57 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit 89373d2abafb9bda97f78bdb157d1d05cf21e008
Merge: a778588 7459f11
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Mar 12 17:23:49 2012 -0400

    Merge branch 'linux-3.2.y' into pax-test

commit 54e19a3979978fca902b14ae25125f26fbbbc7a7
Merge: c4650f1 a778588
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Mar 12 16:51:25 2012 -0400

    Merge branch 'pax-test' into grsec-test

commit a778588c9d1b75c48c1f09aac98c1b28bd87a749
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Mar 12 16:51:12 2012 -0400

    Update to pax-linux-3.2.9-test24.patch

commit c4650f14b13f84735fe3de06a1f3ff5776473eff
Merge: fb2abee 1015790
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Mar 11 21:08:28 2012 -0400

    Merge branch 'pax-test' into grsec-test
    
    Conflicts:
        security/Kconfig

commit 101579028a736c224e590c7e12a7357018c424e1
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Mar 11 21:07:27 2012 -0400

    Update to pax-linux-3.2.9-test22.patch

commit fb2abee4b9b49f5f18342a8cdf7aa3ba2b7c9100
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Mar 11 11:02:17 2012 -0400

    Allow 4096 CPUs

commit 96bae28cbe6a41d48e3b56e5904814096e956000
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Mar 11 10:25:58 2012 -0400

    Use a per-cpu 48-bit counter instead of a global atomic64
    Initialize each counter to have the cpu number in the lower 16 bits
    instead of incrementing the counter each time by 1, perform the increments
    above the cpu number so that wrapping/exhausting the counter doesn't corrupt
    any state
    idea from PaX Team

commit b975688101da6e966aebb1bc6b8c5c5983974f9c
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Mar 10 20:33:12 2012 -0500

    Special vnsec edition! :)
    Further reduce argv/env allowance for suid/sgid apps to 512KB
    Clamp suid/sgid stack resource limit to 8MB (preventing compat mmap layout fallback/too large stack gap)
    Clear 3GB personality on suid/sgid binaries
    Restore 4 bits entropy in the lowest bits of arg/env strings (now 28 bits on x86, 39 bits on x64)
      with the main purpose of throwing off program stack -> arg/env alignment
    Update documentation

commit e5cfa902c4e891d11dd2086543d2555aa0c27d33
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Mar 10 19:54:47 2012 -0500

    Resolve skbuff.h warnings that turn into errors during compilation in
    the grsecurity directory with -Werror

commit 2023210ad43a944033fcacc660ce410888f562ee
Merge: ece4383 5f66adf
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Mar 9 19:48:01 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 5f66adf72f83730a07bc79a2fab56afed6dbbd0e
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Mar 9 19:47:06 2012 -0500

    Add colorize plugin

commit ece4383e5e91c92d138c4df84225a70b552f4d69
Merge: a366d0e ab4a5a1
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Mar 9 17:56:46 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit ab4a5a1a67289c3585e2ff8aa64ecece7bd17eea
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Mar 9 17:56:26 2012 -0500

    Update to pax-linux-3.2.9-test21.patch

commit a366d0ed963ce93fce10121c1100989d5f064e75
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Sun Mar 4 19:52:03 2012 -0500

    mm: fix find_vma_prev
    
    Commit 6bd4837de96e ("mm: simplify find_vma_prev()") broke memory
    management on PA-RISC.
    
    After application of the patch, programs that allocate big arrays on the
    stack crash with segfault, for example, this will crash if compiled
    without optimization:
    
      int main()
      {
        char array[200000];
        array[199999] = 0;
        return 0;
      }
    
    The reason is that PA-RISC has up-growing stack and the stack is usually
    the last memory area.  In the above example, a page fault happens above
    the stack.
    
    Previously, if we passed too high address to find_vma_prev, it returned
    NULL and stored the last VMA in *pprev.  After "simplify find_vma_prev"
    change, it stores NULL in *pprev.  Consequently, the stack area is not
    found and it is not expanded, as it used to be before the change.
    
    This patch restores the old behavior and makes it return the last VMA in
    *pprev if the requested address is higher than address of any other VMA.
    
    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 9cd8dd4d56051099f11563f72fcd91cd0ce19604
Author: Hugh Dickins <hughd@google.com>
Date:   Tue Mar 6 12:28:52 2012 -0800

    mmap: EINVAL not ENOMEM when rejecting VM_GROWS
    
    Currently error is -ENOMEM when rejecting VM_GROWSDOWN|VM_GROWSUP
    from shared anonymous: hoist the file case's -EINVAL up for both.
    
    Signed-off-by: Hugh Dickins <hughd@google.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 97745dce6c87f9d9ca5b4be9bd4c2fc1684ca04c
Author: Al Viro <viro@ZenIV.linux.org.uk>
Date:   Mon Mar 5 06:38:42 2012 +0000

    aout: move setup_arg_pages() prior to reading/mapping the binary
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 3b20ce55ae8cffee43cb4afdf5be438b5ac4fef0
Author: Jan Beulich <JBeulich@suse.com>
Date:   Mon Mar 5 16:49:24 2012 +0000

    vsprintf: make %pV handling compatible with kasprintf()
    
    kasprintf() (and potentially other functions that I didn't run across so
    far) want to evaluate argument lists twice.  Caring to do so for the
    primary list is obviously their job, but they can't reasonably be
    expected to check the format string for instances of %pV, which however
    need special handling too: On architectures like x86-64 (as opposed to
    e.g.  ix86), using the same argument list twice doesn't produce the
    expected results, as an internally managed cursor gets updated during
    the first run.
    
    Fix the problem by always acting on a copy of the original list when
    handling %pV.
    
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 4146896ab9674f51d4909f3a52bc7fe80f04e4cb
Author: Al Viro <viro@ZenIV.linux.org.uk>
Date:   Mon Mar 5 06:39:47 2012 +0000

    VM_GROWS{UP,DOWN} shouldn't be set on shmem VMAs
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit a831bd53764695ea680cc1fa3c98759a610ed2ac
Author: Christian König <deathsimple@vodafone.de>
Date:   Tue Feb 28 23:19:20 2012 +0100

    drm/radeon: fix uninitialized variable
    
    Without this fix the driver randomly treats
    textures as arrays and I'm really wondering
    why gcc isn't complaining about it.
    
    Signed-off-by: Christian König <deathsimple@vodafone.de>
    Reviewed-by: Jerome Glisse <jglisse@redhat.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>

commit aa2cd55f97f3cc03bdd895b6e8ba99619ee69dfc
Author: H. Peter Anvin <hpa@zytor.com>
Date:   Fri Mar 2 10:43:48 2012 -0800

    regset: Prevent null pointer reference on readonly regsets
    
    The regset common infrastructure assumed that regsets would always
    have .get and .set methods, but not necessarily .active methods.
    Unfortunately people have since written regsets without .set methods.
    
    Rather than putting in stub functions everywhere, handle regsets with
    null .get or .set methods explicitly.
    
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Reviewed-by: Oleg Nesterov <oleg@redhat.com>
    Acked-by: Roland McGrath <roland@hack.frob.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 072ddd99401c79b53c6bf6bff9deb93022124c79
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Mar 5 18:12:57 2012 -0500

    Fix compiler errors reported on forums

commit 1606774b48af24e6f99d99c624c0e447d4b66474
Merge: 3127bd5 4ca2ffd
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Mar 5 17:31:35 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 4ca2ffd9da024f4ba2d0cb6245ba1b2726169452
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Mar 5 17:31:21 2012 -0500

    Update to pax-linux-3.2.9-test20.patch

commit 3127bd581a292966b1057c7433219dac188c3720
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Mar 2 21:30:37 2012 -0500

    Fix memory leak on logged exec_id check failure in /proc/pid/statm
    Thanks to Djalal Harouni for the report

commit d9f1a3be0e97e0632f97379322712d8deeb3ce23
Merge: 0a56be8 9aa8288
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Mar 2 18:38:22 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 9aa8288a09e6e03ce37c08136b26bff17a093b5c
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Mar 2 18:37:43 2012 -0500

    Update to pax-linux-3.2.9-test19.patch

commit 0a56be884bbd7ce733cac0b879c45383494d73b0
Merge: 9e66745 3f5c52a
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Mar 1 20:18:01 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 3f5c52aba100b3bb252980f9d363aafde52da1a2
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Mar 1 20:16:56 2012 -0500

    Update to pax-linux-3.2.9-test18.patch

commit ae53ec231d12719a36bf871f8c5841020ed692ee
Merge: b255baf 44fb317
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Mar 1 20:15:31 2012 -0500

    Merge branch 'linux-3.2.y' into pax-test

commit 9e667456c03eadea2f305be761abe4de9a5877a3
Merge: 5e4e200 b255baf
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Feb 27 20:53:59 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit b255baf50365d39b406f43aab2c64745607baaa2
Merge: 340ce90 1de504e
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Feb 27 20:53:29 2012 -0500

    Merge branch 'linux-3.2.y' into pax-test
    Update to pax-linux-3.2.8-test17.patch
    
    Conflicts:
        arch/x86/include/asm/i387.h
        arch/x86/kernel/process_32.c
        arch/x86/kernel/traps.c

commit 5e4e200ac530452884b625cb75de240e1e98c731
Merge: 44306d7 340ce90
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Feb 27 18:02:13 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 340ce90d98a043fa8e4ed9ffc229d4c1f86e2fec
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Feb 27 18:01:48 2012 -0500

    Update to pax-linux-3.2.7-test17.patch

commit 44306d7b3097f77e73040dd25f4f6750751bae7a
Merge: 29d0b07 521c411
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Feb 26 19:04:15 2012 -0500

    Merge branch 'pax-test' into grsec-test
    
    Conflicts:
        Makefile

commit 521c411bb4ca66ce01146fde8bac9dd22414076d
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Feb 26 19:03:33 2012 -0500

    Update to pax-linux-3.2.7-test16.patch

commit 29d0b07290bb9a10cdfcc3c30058e16265330dea
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Feb 26 17:12:44 2012 -0500

    fix typo

commit 344f6d84e5d3fdc6ec40a078fc2f5861d340b2ef
Merge: f45b3be caa8f83
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Feb 25 20:59:27 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit caa8f83456c4d0b204beefffaa1d1993f2348d08
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Feb 25 20:59:12 2012 -0500

    Update to pax-linux-3.2.7-test15.patch

commit f45b3be34a345502a302e736af9a65742ddef7cb
Merge: 62f35fd 9f1309b
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Feb 25 11:40:15 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 9f1309b0b935e3b30fc87a9e3009b84cf943ef47
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Feb 25 11:39:57 2012 -0500

    Update to pax-linux-3.2.7-test14.patch

commit 62f35fdbecc58f2988fe13638d907b87a15776bb
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Feb 25 09:08:55 2012 -0500

    We could log on attempted exploits of writing /proc/self/mem, but the current
    log function declares the access a read, so just swap the ordering for now

commit 066ee8f9c26f1549b4ad893508777b549c8d4b79
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Feb 25 08:46:14 2012 -0500

    Log /proc/pid/mem attempts

commit 674471e581893a94d475acac3e3c4496209b3ac9
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Feb 25 08:15:00 2012 -0500

    Make use of f_version for protecting /proc file structs (fine since we're not a directory
    or seq_file)

commit eab42cfdd237ffcdd8ec24bedecc275a3a9e987f
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Feb 24 20:02:19 2012 -0500

    Fix ia64 compilation

commit 50dfea412fd395e0183c2ade368efa525d38b267
Merge: 12db845 4c6f99b
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Feb 24 19:00:53 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 4c6f99bf338e03966356b147d0360cb3b522a44f
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Feb 24 19:00:36 2012 -0500

    (6:57:09 PM) pipacs: but you can be proactive
    (Fix other-arch atomic64/REFCOUNT compilation failures)

commit 12db8453f6bb0a756f369c9151668ba1249bc478
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Feb 23 21:10:12 2012 -0500

    Remove unnecessary copies, as suggested by solar

commit cc02cab84368467ea03cb35f861a8a7092d91ab4
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Feb 23 20:59:35 2012 -0500

    Make global_exec_counter static, as suggested by solar

commit e642091a475ebb3a30e81f85e7751233d0c2af43
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Feb 23 19:00:26 2012 -0500

    sync with stable tree

commit 6df09c3d8e371905b7b8fe90c4188f23614c6be5
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Feb 23 18:48:47 2012 -0500

    Remove unneeded gr_acl_handle_fchmod, as the code is shared now by gr_acl_handle_chmod
    Remove handling of old kludge in chmod/fchmod

commit 815cb62f2ca7b58efc39778b3a855feb675ab56c
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Feb 23 18:18:49 2012 -0500

    Apply umask checks to chmod/fchmod as well, as requested by sponsor
    Union the enforced umask with the existing one to produce minimal privilege
    Change umask type to u16

commit 0e7668c6abbdbcd3f7f9759e3994d6f4bc9953f0
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Feb 22 18:16:11 2012 -0500

    Add per-role umask enforcement to RBAC, requested by a sponsor

commit ad5ac943fe58199f1cc475912a39edb157acb77b
Merge: dda0bb5 41722e3
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Feb 20 20:04:42 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 41722e342e116d95f3d3556d66c97c888d752d39
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Feb 20 20:04:00 2012 -0500

    Merge changes from pax-linux-3.2.7-test12.patch, fixes KVM incompatibility with
    KERNEXEC plugin

commit dda0bb57137846a476a866c60db2681aaf6052c0
Merge: 4fd554e d70927a
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Feb 20 20:01:41 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit d70927afec977d489a54c106a3c3ddc32e953050
Merge: 1daebf1 9d0231c
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Feb 20 20:01:33 2012 -0500

    Merge branch 'linux-3.2.y' into pax-test

commit 4fd554e3a097b22c5049fcdc423897477deff5ef
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Feb 20 09:17:57 2012 -0500

    Fix wrong logic on capability checks for switching roles, broke policies
    Thanks to Richard Kojedzinszky for reporting

commit 12f97d52ac603f24344f8d71569c412a307e9422
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Feb 16 21:20:10 2012 -0500

    sparc64 compile fix

commit 07af3d8e76a6a47ce1836e5b20ed8c0f879c8201
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Feb 16 18:38:32 2012 -0500

    Update configuration help and name for GRKERNSEC_PROC_MEMMAP

commit 5ced6f8def06c2176b40b5fa07345fc723dc4dcb
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Feb 16 18:18:01 2012 -0500

    optimize the check a bit

commit 03159050f64989be44ae03be769cbed62a7cd2e5
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Feb 16 18:00:45 2012 -0500

    smile VUPEN :D
    (limit argv+env to 1MB for suid/sgid binaries)

commit dd759d8800d225a397e4de49fe729c7d601298d2
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Feb 16 17:49:33 2012 -0500

    Address Space Protection -> Memory Protections (suggested on IRC for consistency)

commit 4de635bda8ebfb85312e3bf851bdbff93de400da
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Feb 16 17:45:06 2012 -0500

    Change the long long type for exec_id to the proper u64

commit 4feb07e7cb64b3d0f0f8cca1aef70bc725cae6fa
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Thu Feb 9 00:46:47 2012 +0000

    isdn: type bug in isdn_net_header()
    
    We use len to store the return value from eth_header().  eth_header()
    can return -ETH_HLEN (-14).  We want to pass this back instead of
    truncating it to 65522 and returning that.
    
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Neil Horman <nhorman@tuxdriver.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 134ac8545b47f0f27d550ea6e1edb3a1ed7a9748
Author: Heiko Carstens <heiko.carstens@de.ibm.com>
Date:   Sat Feb 4 10:47:10 2012 +0100

    exec: fix use-after-free bug in setup_new_exec()
    
    Setting the task name is done within setup_new_exec() by accessing
    bprm->filename. However this happens after flush_old_exec().
    This may result in a use after free bug, flush_old_exec() may
    "complete" vfork_done, which will wake up the parent which in turn
    may free the passed in filename.
    To fix this add a new tcomm field in struct linux_binprm which
    contains the now early generated task name until it is used.
    
    Fixes this bug on s390:
    
      Unable to handle kernel pointer dereference at virtual kernel address 0000000039768000
      Process kworker/u:3 (pid: 245, task: 000000003a3dc840, ksp: 0000000039453818)
      Krnl PSW : 0704000180000000 0000000000282e94 (setup_new_exec+0xa0/0x374)
      Call Trace:
      ([<0000000000282e2c>] setup_new_exec+0x38/0x374)
       [<00000000002dd12e>] load_elf_binary+0x402/0x1bf4
       [<0000000000280a42>] search_binary_handler+0x38e/0x5bc
       [<0000000000282b6c>] do_execve_common+0x410/0x514
       [<0000000000282cb6>] do_execve+0x46/0x58
       [<00000000005bce58>] kernel_execve+0x28/0x70
       [<000000000014ba2e>] ____call_usermodehelper+0x102/0x140
       [<00000000005bc8da>] kernel_thread_starter+0x6/0xc
       [<00000000005bc8d4>] kernel_thread_starter+0x0/0xc
      Last Breaking-Event-Address:
       [<00000000002830f0>] setup_new_exec+0x2fc/0x374
    
      Kernel panic - not syncing: Fatal exception: panic_on_oops
    
    Reported-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
    Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit d758ee9f5230893dabb5aab737b3109684bde196
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Fri Feb 10 09:03:58 2012 +0100

    relay: prevent integer overflow in relay_open()
    
    "subbuf_size" and "n_subbufs" come from the user and they need to be
    capped to prevent an integer overflow.
    
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Cc: stable@kernel.org
    Signed-off-by: Jens Axboe <axboe@kernel.dk>

commit 40ed7b34848b8e0d7bf9a3fc21a7c75ce1ae507c
Merge: b1baadf 1daebf1
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Feb 13 17:47:04 2012 -0500

    Merge branch 'pax-test' into grsec-test
    
    Conflicts:
        fs/proc/base.c

commit 1daebf1d623fe5b0efdd329f78562eb7078bc772
Merge: 1413df2 c2db2e2
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Feb 13 17:45:54 2012 -0500

    Merge branch 'linux-3.2.y' into pax-test

commit b1baadf5047ab67cf61cd20bf58c6afb09c37c7d
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Feb 12 16:44:05 2012 -0500

    add missing declaration

commit 3981059c35e8463002517935c28f3d74b8e3703c
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Feb 12 16:36:04 2012 -0500

    Require CAP_SETUID/CAP_SETGID in a subject in order to change roles
    in addition to existing checks (this handles the setresuid ruid = euid case)

commit 0beab03263c773f463412c350ad9064b44b6ede0
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Feb 12 16:13:40 2012 -0500

    Revert setreuid changes when RBAC is enabled, breaks freeradius
    I'll fix the learning issue Lavish reported a different way through
    gradm modifications
    
    This reverts commit d54ec64b7078f1dcb71b5d8a29e47d4a0f46c111.

commit 0c61cb1cfbbfec7d07647268c922d51434d22621
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Feb 11 14:22:46 2012 -0500

    copy exec_id on fork

commit 000c08e0890630086b2ed04084050ed856a7ec31
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Feb 10 20:00:36 2012 -0500

    compile fix

commit 54b8c8f54484e5ee18040657827158bc4b63bccc
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Feb 10 19:19:52 2012 -0500

    Introduce enhancement to CONFIG_GRKERNSEC_PROC_MEMMAP
    denies reading of sensitive /proc/pid entries where the file descriptor
    was opened in a different task than the one performing the read

commit dd19579049186e2648b9ae5e42af04cfda7ab2dc
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Feb 10 17:43:24 2012 -0500

    Remove duplicate signal check

commit 6ff60c34155bb73a4eec7bbfe6f59e9d35e1c0c6
Merge: 4eba97e 1413df2
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Feb 8 19:24:34 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 1413df258d4664d928b876ffb57e1bdc1ccd06f6
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Feb 8 19:24:08 2012 -0500

    Merge changes from pax-linux-3.2.4-test11.patch

commit 4eba97eda7f7d25b7ab6ad5c9de094545e749044
Merge: 0e058dd 8dd90a2
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Feb 6 17:50:12 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 8dd90a21adfeefd86134d1fedf77b958bc59eaa3
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Feb 6 17:49:07 2012 -0500

    Merge changes from pax-linux-3.2.4-test10.patch, fixes BPF JIT double-free

commit a6b5dfed0937a0eb386b4b519a387f8e8177ffdc
Merge: 7e4169c 6133971
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Feb 6 17:48:57 2012 -0500

    Merge branch 'linux-3.2.y' into pax-test

commit 0e058dd6d14e0c67c44dd332a871f1fe1bb06095
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Feb 5 19:24:45 2012 -0500

    We now allow configurations with no PaX markings, giving the system no way to override the defaults

commit 9afb0110287e31c3c56d861b4927f64f8dbd7857
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Feb 5 10:01:23 2012 -0500

    Increase the buffer size of logged TPE reason, otherwise we could truncate the "y" in directory

commit a6a0ad24a5f7bef90236d94c1bdfe21d291fc834
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Feb 4 21:01:16 2012 -0500

    Improve security of ptrace-based monitoring/sandboxing
    See:
    http://article.gmane.org/gmane.linux.kernel.lsm/15156

commit ca4ca5a1027b41f9528794e52a53ce9c47926101
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Feb 3 20:42:55 2012 -0500

    fix typo

commit d54ec64b7078f1dcb71b5d8a29e47d4a0f46c111
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Feb 3 20:25:38 2012 -0500

    Reported by lavish on IRC:
    If a suid/sgid binary did not learn any setuid/setgid call during learning,
    we would not any CAP_SETUID/CAP_SETGID capability to the task, nor
    any restrictions on uid/gid changes.  uid and gid can however be changed
    within a suid/sgid binary via setresuid/setresgid with ruid/rgid set to
    euid/egid.
    
    My fix:
    POSIX doesn't specify whether unprivileged users can perform the above
    setresuid/setresgid as an unprivileged user, though Linux has historically
    permitted them.  Modify this behavior when RBAC is enabled to require
    CAP_SETUID/CAP_SETGID for these operations.
    
    Thanks to Lavish for the report!
    
    Conflicts:
    
        kernel/sys.c

commit e55be1f30908f1ad4450cb0558cde71ff5c7247f
Merge: ba586eb 7e4169c
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Feb 3 20:10:21 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 7e4169c6c880ec9641f1178c88545913c8a21e1f
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Feb 3 20:10:05 2012 -0500

    Merge changes from pax-linux-3.2.4-test9.patch

commit ba586ebbcd0ed781e38a99c580a757a00347c6eb
Author: Christopher Yeoh <cyeoh@au1.ibm.com>
Date:   Thu Feb 2 11:34:09 2012 +1030

    Fix race in process_vm_rw_core
    
    This fixes the race in process_vm_core found by Oleg (see
    
      http://article.gmane.org/gmane.linux.kernel/1235667/
    
    for details).
    
    This has been updated since I last sent it as the creation of the new
    mm_access() function did almost exactly the same thing as parts of the
    previous version of this patch did.
    
    In order to use mm_access() even when /proc isn't enabled, we move it to
    kernel/fork.c where other related process mm access functions already
    are.
    
    Signed-off-by: Chris Yeoh <yeohc@au1.ibm.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    
    Conflicts:
    
        fs/proc/base.c
        mm/process_vm_access.c

commit b9194d60fb9fe579f5c34817ed822abde18939a0
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Tue Jan 31 17:15:11 2012 +0100

    proc: make sure mem_open() doesn't pin the target's memory
    
    Once /proc/pid/mem is opened, the memory can't be released until
    mem_release() even if its owner exits.
    
    Change mem_open() to do atomic_inc(mm_count) + mmput(), this only
    pins mm_struct. Change mem_rw() to do atomic_inc_not_zero(mm_count)
    before access_remote_vm(), this verifies that this mm is still alive.
    
    I am not sure what should mem_rw() return if atomic_inc_not_zero()
    fails. With this patch it returns zero to match the "mm == NULL" case,
    may be it should return -EINVAL like it did before e268337d.
    
    Perhaps it makes sense to add the additional fatal_signal_pending()
    check into the main loop, to ensure we do not hold this memory if
    the target task was oom-killed.
    
    Cc: stable@kernel.org
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit d4500134f9363bc79556e0e7a1fd811cd8552cc4
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Tue Jan 31 17:14:38 2012 +0100

    proc: mem_release() should check mm != NULL
    
    mem_release() can hit mm == NULL, add the necessary check.
    
    Cc: stable@kernel.org
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 5d1c11221a86f233fdbb232312a561f85d0a3a05
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Tue Jan 31 17:14:54 2012 +0100

    note: redisabled mem_write
    
    proc: unify mem_read() and mem_write()
    
    No functional changes, cleanup and preparation.
    
    mem_read() and mem_write() are very similar. Move this code into the
    new common helper, mem_rw(), which takes the additional "int write"
    argument.
    
    Cc: stable@kernel.org
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    
    Conflicts:
    
        fs/proc/base.c

commit af966b421d9f55ab7e1a8b2741beba44b22bc2e0
Merge: 3903f01 01fee18
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Feb 3 19:50:40 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 01fee1851aef26b898ccba5312cabf1f919b74cb
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Feb 3 19:49:46 2012 -0500

    Merge changes from pax-linux-3.2.4-test8.patch

commit c2490ddbfc3f5dd664dd0e1b8575856c3be01879
Merge: 201c0db 141936c
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Feb 3 19:49:01 2012 -0500

    Merge branch 'linux-3.2.y' into pax-test

commit 3903f0172ecadf7a575ba3535402a1506133640a
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Jan 30 23:26:44 2012 -0500

    Implement new version of CONFIG_GRKERNSEC_SYSFS_RESTRICT
    
    We'll whitelist required directories for compatibility instead of requiring
    that people disable the feature entirely if they use SELinux, fuse, etc
    
    Conflicts:
    
        fs/sysfs/mount.c

commit e3618feaa7e63807f1b88c199882075b3ec9bd05
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Jan 29 01:12:19 2012 -0500

    perform RBAC check if TPE is on but match fails, matches previous behavior

commit 627b7fe22799a86e2f81a74f0e0c53474bec3100
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Jan 28 13:17:06 2012 -0500

    log more information about the reason for a TPE denial for novice users, requested by a sponsor

commit efefd67008cbad8a8591e2484410966a300a39a5
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 27 19:58:53 2012 -0500

    merge upstream sha512 changes

commit 8a79280377db78fb2091fe01eddb9e24f75d9fe1
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 27 19:49:07 2012 -0500

    drop lock on error in xfs_readlink
    
    http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=aaad641eadfd3e74b0fbb68fcf539b9cef0415d0

commit aa5f2f63e37f426bf2211c5fb8f7bc70de14f08a
Author: Li Wang <liwang@nudt.edu.cn>
Date:   Thu Jan 19 09:44:36 2012 +0800

    eCryptfs: Infinite loop due to overflow in ecryptfs_write()
    
    ecryptfs_write() can enter an infinite loop when truncating a file to a
    size larger than 4G. This only happens on architectures where size_t is
    represented by 32 bits.
    
    This was caused by a size_t overflow due to it incorrectly being used to
    store the result of a calculation which uses potentially large values of
    type loff_t.
    
    [tyhicks@canonical.com: rewrite subject and commit message]
    Signed-off-by: Li Wang <liwang@nudt.edu.cn>
    Signed-off-by: Yunchuan Wen <wenyunchuan@kylinos.com.cn>
    Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Tyler Hicks <tyhicks@canonical.com>

commit a7607747d0f74f357d78bb796d70635dd05f46e8
Author: Tyler Hicks <tyhicks@canonical.com>
Date:   Thu Jan 19 20:33:44 2012 -0600

    eCryptfs: Check inode changes in setattr
    
    Most filesystems call inode_change_ok() very early in ->setattr(), but
    eCryptfs didn't call it at all. It allowed the lower filesystem to make
    the call in its ->setattr() function. Then, eCryptfs would copy the
    appropriate inode attributes from the lower inode to the eCryptfs inode.
    
    This patch changes that and actually calls inode_change_ok() on the
    eCryptfs inode, fairly early in ecryptfs_setattr(). Ideally, the call
    would happen earlier in ecryptfs_setattr(), but there are some possible
    inode initialization steps that must happen first.
    
    Since the call was already being made on the lower inode, the change in
    functionality should be minimal, except for the case of a file extending
    truncate call. In that case, inode_newsize_ok() was never being
    called on the eCryptfs inode. Rather than inode_newsize_ok() catching
    maximum file size errors early on, eCryptfs would encrypt zeroed pages
    and write them to the lower filesystem until the lower filesystem's
    write path caught the error in generic_write_checks(). This patch
    introduces a new function, called ecryptfs_inode_newsize_ok(), which
    checks if the new lower file size is within the appropriate limits when
    the truncate operation will be growing the lower file.
    
    In summary this change prevents eCryptfs truncate operations (and the
    resulting page encryptions), which would exceed the lower filesystem
    limits or FSIZE rlimits, from ever starting.
    
    Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
    Reviewed-by: Li Wang <liwang@nudt.edu.cn>
    Cc: <stable@vger.kernel.org>

commit 0d96f190a39505254ace4e9330219aaeda9b64e3
Author: Tyler Hicks <tyhicks@canonical.com>
Date:   Wed Jan 18 18:30:04 2012 -0600

    eCryptfs: Make truncate path killable
    
    ecryptfs_write() handles the truncation of eCryptfs inodes. It grabs a
    page, zeroes out the appropriate portions, and then encrypts the page
    before writing it to the lower filesystem. It was unkillable and due to
    the lack of sparse file support could result in tying up a large portion
    of system resources, while encrypting pages of zeros, with no way for
    the truncate operation to be stopped from userspace.
    
    This patch adds the ability for ecryptfs_write() to detect a pending
    fatal signal and return as gracefully as possible. The intent is to
    leave the lower file in a useable state, while still allowing a user to
    break out of the encryption loop. If a pending fatal signal is detected,
    the eCryptfs inode size is updated to reflect the modified inode size
    and then -EINTR is returned.
    
    Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
    Cc: <stable@vger.kernel.org>

commit a02d0d2516b9e92edffeb8fca87462bca49c1f6f
Author: Tyler Hicks <tyhicks@canonical.com>
Date:   Tue Jan 24 10:02:22 2012 -0600

    eCryptfs: Fix oops when printing debug info in extent crypto functions
    
    If pages passed to the eCryptfs extent-based crypto functions are not
    mapped and the module parameter ecryptfs_verbosity=1 was specified at
    loading time, a NULL pointer dereference will occur.
    
    Note that this wouldn't happen on a production system, as you wouldn't
    pass ecryptfs_verbosity=1 on a production system. It leaks private
    information to the system logs and is for debugging only.
    
    The debugging info printed in these messages is no longer very useful
    and rather than doing a kmap() in these debugging paths, it will be
    better to simply remove the debugging paths completely.
    
    https://launchpad.net/bugs/913651
    
    Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
    Reported-by: Daniel DeFreez
    Cc: <stable@vger.kernel.org>

commit b1c44d3054dc7f293b2e0a98c0e9e5e03e01f04c
Author: Tyler Hicks <tyhicks@canonical.com>
Date:   Thu Jan 12 11:30:44 2012 +0100

    eCryptfs: Sanitize write counts of /dev/ecryptfs
    
    A malicious count value specified when writing to /dev/ecryptfs may
    result in a a very large kernel memory allocation.
    
    This patch peeks at the specified packet payload size, adds that to the
    size of the packet headers and compares the result with the write count
    value. The resulting maximum memory allocation size is approximately 532
    bytes.
    
    Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
    Reported-by: Sasha Levin <levinsasha928@gmail.com>
    Cc: <stable@vger.kernel.org>

commit 96dcb7282d323813181a1791f51c0ab7696b675b
Merge: 6c09fa5 201c0db
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 27 19:44:15 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 201c0dbf177527367676028151e36d340923f033
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 27 19:43:24 2012 -0500

    Merge changes from pax-linux-3.2.2-test6.patch, fixes 0 order vmalloc allocation errors
    on loading modules with empty sections

commit 6c09fa566a7c29f00556ca12f343f2db91c4f42b
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 27 19:42:13 2012 -0500

    compile fix

commit 917ae526b4fcec2b3e1afefa13de9dff7d8a5423
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 27 19:39:28 2012 -0500

    use LSM flags instead of duplicating checks

commit 0cf3be2ea2ae43c9dd4933fb26c0429041b8acb8
Merge: 44b9f11 558718b
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 27 18:56:23 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 558718b2217beff69edf60f34a6f9893d910e9ac
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 27 18:56:04 2012 -0500

    Merge changes from pax-linux-3.2.2-test6.patch

commit 44b9f1132b2de7cbf5f57525fe0f7f9fb0a76507
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 27 18:53:55 2012 -0500

    don't increase the size of task_struct when unnecessary
    change ptrace_readexec log message

commit a9c9626e054adb885883aa64f85506852894dd33
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 27 18:16:28 2012 -0500

    Update documentation for CONFIG_GRKERNSEC_PTRACE_READEXEC --
    the protection applies to all unreadable binaries.

commit 98fdf4ab69eba7a72efb2054295daafdbbc2fb8f
Merge: 7b3f3af 05a1349
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Jan 25 20:52:09 2012 -0500

    Merge branch 'pax-test' into grsec-test
    
    Conflicts:
        block/scsi_ioctl.c
        drivers/scsi/sd.c
        fs/proc/base.c

commit 05a134966efb9cb9346ad3422888969ffc79ac1d
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Jan 25 20:47:36 2012 -0500

    Resync with pax-linux-3.2.2-test5.patch

commit 5ecaafd81b229aeeb5656df36f9c8da86307f82a
Merge: c6d443d 3499d64
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Jan 25 20:45:16 2012 -0500

    Merge branch 'linux-3.2.y' into pax-test (and pax-linux-3.2.2-test5.patch)
    
    Conflicts:
        ipc/shm.c

commit 7b3f3afd7444613c759d68ff8c2efaebfae3bab1
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Jan 24 19:42:01 2012 -0500

    Add two new features, one is automatic by enabling CONFIG_GRKERNSEC
    (may be changed if it breaks some userland), the other has its own
    config option
    
    First feature requires CAP_SYS_ADMIN to write to any sysctl entry via
    the syscall or /proc/sys.
    
    Second feature requires read access to a suid/sgid binary in order
    to ptrace it, preventing infoleaking of binaries in situations where
    the admin has specified 4711 or 2711 perms.  Feature has been
    given the config option CONFIG_GRKERNSEC_PTRACE_READEXEC and
    a sysctl entry of ptrace_readexec

commit 11a7bb25c411c9dccfdca5718639b4becdffd388
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Jan 22 14:37:10 2012 -0500

    Compilation fixes

commit cd400e21c7c352baba47d6f375297a7847afb33a
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Jan 22 14:20:27 2012 -0500

    Initial port of grsecurity 2.2.2 for Linux 3.2.1
    Note that the new syscalls added to this kernel for remote process read/write
    are subject to ptrace hardening/other relevant RBAC features
    /proc/slabinfo is S_IRUSR via mainline now, so I made slab_allocators S_IRUSR by default
    as well
    pax_track_stack has been removed from support for this kernel -- if you're running this kernel
    you should be using a version of gcc with plugin support

commit c6d443d1270f455c56a4ffe0f1dd3d3e7ec12a2f
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Jan 22 11:47:31 2012 -0500

    Import pax-linux-3.2.1-test5.patch
commit bfd7db842f835f9837cd43644459b3a95b0b488d
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Jan 22 11:02:02 2012 -0500

    Allow processes to access others' /proc/pid/maps files (subject to the normal modification of data)
    instead of returning -EACCES
    thanks to Wraith from irc for the report

commit 873ac13576506cd48ddb527c2540f274e249da50
Merge: 34083dd 8a44fcc
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 20 18:04:02 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 8a44fcc90cf3368003dc84e1ed013b2e4248c9b2
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 20 18:02:15 2012 -0500

    Merge the diff between pax-linux-3.2.1-test4.patch and pax-linux-3.2.1-test5.patch
    Denies executable shared memory when MPROTECT is active
    Fixes ia32 emulation crash on 64bit host introduced in a recent patch

commit 34083ddf5c0b2b1c0f5e9f7d9e32ddcba223446b
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Jan 19 20:23:14 2012 -0500

    Introduce new GRKERNSEC_SETXID implementation
    We're not able to change the credentials of other threads in the process until at most
    one syscall after the first thread does it, since we mark the threads as needing rescheduling
    and such work occurs on syscall exit.
    This does however ensure that we're only modifying the current task's credentials
    which upholds RCU expectations
    
    Many thanks to corsac for testing

commit 5f900ad54d3992a4e1cda88273acc2f897a42e71
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Jan 19 17:42:48 2012 -0500

    Simplify backport

commit f02e444f7b2fb286f99d3b4031ff4e44a4606c37
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Jan 19 17:08:16 2012 -0500

    Commit the latest silent fix for a local privilege escalation from Linus
    Also disable writing to /proc/pid/mem
    http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=e268337dfe26dfc7efd422a804dbb27977a3cccc

commit 814d38c72b1ee3338294576a05af4f6ca9cffa6c
Merge: 0394a3f 7e6299b
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Jan 18 20:22:09 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 7e6299b4733c082dde930375dd207b63237751ec
Merge: 83555fb 9bb1282
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Jan 18 20:21:37 2012 -0500

    Merge branch 'linux-3.1.y' into pax-test

commit 0394a3f36c6195dcaf22e265c94d11bb7338c6f7
Author: Jesper Juhl <jj@chaosbits.net>
Date:   Sun Jan 8 22:44:29 2012 +0100

    audit: always follow va_copy() with va_end()
    
    A call to va_copy() should always be followed by a call to va_end() in
    the same function.  In kernel/autit.c::audit_log_vformat() this is not
    always done.  This patch makes sure va_end() is always called.
    
    Signed-off-by: Jesper Juhl <jj@chaosbits.net>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Eric Paris <eparis@redhat.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit fcbb39319e88bfdf70efe3931cf80a9f23b1a4d9
Author: Andi Kleen <ak@linux.intel.com>
Date:   Thu Jan 12 17:20:30 2012 -0800

    panic: don't print redundant backtraces on oops
    
    When an oops causes a panic and panic prints another backtrace it's pretty
    common to have the original oops data be scrolled away on a 80x50 screen.
    
    The second backtrace is quite redundant and not needed anyways.
    
    So don't print the panic backtrace when oops_in_progress is true.
    
    [akpm@linux-foundation.org: add comment]
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 22e4717d04333e2aff6d5d1b2c1b16045f367a1f
Author: Miklos Szeredi <mszeredi@suse.cz>
Date:   Thu Jan 12 17:59:46 2012 +0100

    fsnotify: don't BUG in fsnotify_destroy_mark()
    
    Removing the parent of a watched file results in "kernel BUG at
    fs/notify/mark.c:139".
    
    To reproduce
    
      add "-w /tmp/audit/dir/watched_file" to audit.rules
      rm -rf /tmp/audit/dir
    
    This is caused by fsnotify_destroy_mark() being called without an
    extra reference taken by the caller.
    
    Reported by Francesco Cosoleto here:
    
      https://bugzilla.novell.com/show_bug.cgi?id=689860
    
    Fix by removing the BUG_ON and adding a comment about not accessing mark after
    the iput.
    
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    CC: stable@vger.kernel.org
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 1a90cff66ed00cd57bf00a990d13e95060fa362c
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Thu Jan 12 16:01:28 2012 +0100

    block: fail SCSI passthrough ioctls on partition devices
    
    Linux allows executing the SG_IO ioctl on a partition or LVM volume, and
    will pass the command to the underlying block device.  This is
    well-known, but it is also a large security problem when (via Unix
    permissions, ACLs, SELinux or a combination thereof) a program or user
    needs to be granted access only to part of the disk.
    
    This patch lets partitions forward a small set of harmless ioctls;
    others are logged with printk so that we can see which ioctls are
    actually sent.  In my tests only CDROM_GET_CAPABILITY actually occurred.
    Of course it was being sent to a (partition on a) hard disk, so it would
    have failed with ENOTTY and the patch isn't changing anything in
    practice.  Still, I'm treating it specially to avoid spamming the logs.
    
    In principle, this restriction should include programs running with
    CAP_SYS_RAWIO.  If for example I let a program access /dev/sda2 and
    /dev/sdb, it still should not be able to read/write outside the
    boundaries of /dev/sda2 independent of the capabilities.  However, for
    now programs with CAP_SYS_RAWIO will still be allowed to send the
    ioctls.  Their actions will still be logged.
    
    This patch does not affect the non-libata IDE driver.  That driver
    however already tests for bd != bd->bd_contains before issuing some
    ioctl; it could be restricted further to forbid these ioctls even for
    programs running with CAP_SYS_ADMIN/CAP_SYS_RAWIO.
    
    Cc: linux-scsi@vger.kernel.org
    Cc: Jens Axboe <axboe@kernel.dk>
    Cc: James Bottomley <JBottomley@parallels.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    [ Make it also print the command name when warning - Linus ]
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit b41a1178caa15bd7d6d5b36c04c7b1ead05717e2
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Thu Jan 12 16:01:27 2012 +0100

    block: add and use scsi_blk_cmd_ioctl
    
    Introduce a wrapper around scsi_cmd_ioctl that takes a block device.
    
    The function will then be enhanced to detect partition block devices
    and, in that case, subject the ioctls to whitelisting.
    
    Cc: linux-scsi@vger.kernel.org
    Cc: Jens Axboe <axboe@kernel.dk>
    Cc: James Bottomley <JBottomley@parallels.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 97a79814903fc350e1d13704ea31528a42705401
Author: Kees Cook <keescook@chromium.org>
Date:   Sat Jan 7 10:41:04 2012 -0800

    audit: treat s_id as an untrusted string
    
    The use of s_id should go through the untrusted string path, just to be
    extra careful.
    
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Acked-by: Mimi Zohar <zohar@us.ibm.com>
    Signed-off-by: Eric Paris <eparis@redhat.com>

commit 2d3f39e9dd73f26a8248fd4442f110d983c5b419
Author: Xi Wang <xi.wang@gmail.com>
Date:   Tue Dec 20 18:39:41 2011 -0500

    audit: fix signedness bug in audit_log_execve_info()
    
    In the loop, a size_t "len" is used to hold the return value of
    audit_log_single_execve_arg(), which returns -1 on error.  In that
    case the error handling (len <= 0) will be bypassed since "len" is
    unsigned, and the loop continues with (p += len) being wrapped.
    Change the type of "len" to signed int to fix the error handling.
    
        size_t len;
        ...
        for (...) {
                len = audit_log_single_execve_arg(...);
                if (len <= 0)
                        break;
                p += len;
        }
    
    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    Signed-off-by: Eric Paris <eparis@redhat.com>

commit 1b3dc2ea3204fb22b9d0d30b2b7953991f5be594
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Tue Jan 17 03:28:51 2012 -0300

    [media] ds3000: using logical && instead of bitwise &
    
    The intent here was to test if the FE_HAS_LOCK was set.  The current
    test is equivalent to "if (status) { ..."
    
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

commit 36522330dc59d2fc70c042f3f081d75c32b6259a
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Jan 16 13:10:38 2012 -0500

    Ignore the 0 signal for protected task RBAC checks

commit d513acd55f7a683f6e146a4f570cdb63300479ab
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Jan 16 11:56:13 2012 -0500

    whitespace cleanup

commit ced261c4b82818c700aff8487f647f6f3e5b5122
Merge: d48751f 83555fb
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 13 20:12:54 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 83555fb431e5be6c0e09687ff3bdc583f0caf9d9
Merge: fcd8129 93dad39
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 13 20:12:43 2012 -0500

    Merge branch 'linux-3.1.y' into pax-test

commit d48751f3919ae855fda0ff6c149db82442329253
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Jan 11 19:05:47 2012 -0500

    Call our own set_user when forcing change to new id

commit 26d9d497f6b926bc1699980aa18c360a3d3c52a0
Merge: e6578ff fcd8129
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Jan 10 16:00:10 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit fcd8129277601f2e2d5a2066120cf8b2472d7d1f
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Jan 10 15:58:43 2012 -0500

    Merge changes from pax-linux-3.1.8-test23.patch

commit e6578ff3e7629c432ed9b99bde6af2a1c00279b5
Merge: 8859ec3 a120549
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 6 21:45:56 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit a12054967a77090de1caa07c41e694a77db4e237
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 6 21:45:30 2012 -0500

    Merge changes from pax-linux-3.1.8-test22.patch

commit 8859ec32f9815c274df65448f9f2960176c380d3
Merge: a5016b4 ddd4114
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 6 21:26:08 2012 -0500

    Merge branch 'pax-test' into grsec-test
    
    Conflicts:
        fs/binfmt_elf.c
        security/Kconfig

commit ddd41147e158a79704983a409b7433eba797cf66
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 6 21:12:42 2012 -0500

    Resync with PaX patch (whitespace difference)

commit 29e569df8205c5f0e043fe4803aa984406c8b118
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 6 21:09:47 2012 -0500

    Merge changes from pax-linux-3.1.8-test21.patch

commit a5016b4f9c09c337b17e063a7f369af1e86d944d
Merge: 0124c92 04231d5
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 6 18:52:20 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 04231d52dc8d0d6788a6bc6709dc046d3eb37097
Merge: 7bdddeb a919904
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 6 18:51:50 2012 -0500

    Merge branch 'linux-3.1.y' into pax-test
    
    Conflicts:
        include/net/flow.h

commit 0124c9264234c450904a0a5fa2f8c608ab8e3796
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Jan 6 18:33:05 2012 -0500

    Make GRKERNSEC_SETXID option compatible with credential debugging

commit 69919c6da7cf8a781439da15b597a7d6bc9b3abe
Author: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Date:   Wed Dec 28 15:57:11 2011 -0800

    mm/mempolicy.c: refix mbind_range() vma issue
    
    commit 8aacc9f550 ("mm/mempolicy.c: fix pgoff in mbind vma merge") is the
    slightly incorrect fix.
    
    Why? Think following case.
    
    1. map 4 pages of a file at offset 0
    
       [0123]
    
    2. map 2 pages just after the first mapping of the same file but with
       page offset 2
    
       [0123][23]
    
    3. mbind() 2 pages from the first mapping at offset 2.
       mbind_range() should treat new vma is,
    
       [0123][23]
         |23|
         mbind vma
    
       but it does
    
       [0123][23]
         |01|
         mbind vma
    
       Oops. then, it makes wrong vma merge and splitting ([01][0123] or similar).
    
    This patch fixes it.
    
    [testcase]
      test result - before the patch
    
        case4: 126: test failed. expect '2,4', actual '2,2,2'
                case5: passed
        case6: passed
        case7: passed
        case8: passed
        case_n: 246: test failed. expect '4,2', actual '1,4'
    
        ------------[ cut here ]------------
        kernel BUG at mm/filemap.c:135!
        invalid opcode: 0000 [#4] SMP DEBUG_PAGEALLOC
    
        (snip long bug on messages)
    
      test result - after the patch
    
        case4: passed
                case5: passed
        case6: passed
        case7: passed
        case8: passed
        case_n: passed
    
      source:  mbind_vma_test.c
    ============================================================
     #include <numaif.h>
     #include <numa.h>
     #include <sys/mman.h>
     #include <stdio.h>
     #include <unistd.h>
     #include <stdlib.h>
     #include <string.h>
    
    static unsigned long pagesize;
    void* mmap_addr;
    struct bitmask *nmask;
    char buf[1024];
    FILE *file;
    char retbuf[10240] = "";
    int mapped_fd;
    
    char *rubysrc = "ruby -e '\
      pid = %d; \
      vstart = 0x%llx; \
      vend = 0x%llx; \
      s = `pmap -q #{pid}`; \
      rary = []; \
      s.each_line {|line|; \
        ary=line.split(\" \"); \
        addr = ary[0].to_i(16); \
        if(vstart <= addr && addr < vend) then \
          rary.push(ary[1].to_i()/4); \
        end; \
      }; \
      print rary.join(\",\"); \
    '";
    
    void init(void)
    {
        void* addr;
        char buf[128];
    
        nmask = numa_allocate_nodemask();
        numa_bitmask_setbit(nmask, 0);
    
        pagesize = getpagesize();
    
        sprintf(buf, "%s", "mbind_vma_XXXXXX");
        mapped_fd = mkstemp(buf);
        if (mapped_fd == -1)
                perror("mkstemp "), exit(1);
        unlink(buf);
    
        if (lseek(mapped_fd, pagesize*8, SEEK_SET) < 0)
                perror("lseek "), exit(1);
        if (write(mapped_fd, "\0", 1) < 0)
                perror("write "), exit(1);
    
        addr = mmap(NULL, pagesize*8, PROT_NONE,
                    MAP_SHARED, mapped_fd, 0);
        if (addr == MAP_FAILED)
                perror("mmap "), exit(1);
    
        if (mprotect(addr+pagesize, pagesize*6, PROT_READ|PROT_WRITE) < 0)
                perror("mprotect "), exit(1);
    
        mmap_addr = addr + pagesize;
    
        /* make page populate */
        memset(mmap_addr, 0, pagesize*6);
    }
    
    void fin(void)
    {
        void* addr = mmap_addr - pagesize;
        munmap(addr, pagesize*8);
    
        memset(buf, 0, sizeof(buf));
        memset(retbuf, 0, sizeof(retbuf));
    }
    
    void mem_bind(int index, int len)
    {
        int err;
    
        err = mbind(mmap_addr+pagesize*index, pagesize*len,
                    MPOL_BIND, nmask->maskp, nmask->size, 0);
        if (err)
                perror("mbind "), exit(err);
    }
    
    void mem_interleave(int index, int len)
    {
        int err;
    
        err = mbind(mmap_addr+pagesize*index, pagesize*len,
                    MPOL_INTERLEAVE, nmask->maskp, nmask->size, 0);
        if (err)
                perror("mbind "), exit(err);
    }
    
    void mem_unbind(int index, int len)
    {
        int err;
    
        err = mbind(mmap_addr+pagesize*index, pagesize*len,
                    MPOL_DEFAULT, NULL, 0, 0);
        if (err)
                perror("mbind "), exit(err);
    }
    
    void Assert(char *expected, char *value, char *name, int line)
    {
        if (strcmp(expected, value) == 0) {
                fprintf(stderr, "%s: passed\n", name);
                return;
        }
        else {
                fprintf(stderr, "%s: %d: test failed. expect '%s', actual '%s'\n",
                        name, line,
                        expected, value);
    //          exit(1);
        }
    }
    
    /*
          AAAA
        PPPPPPNNNNNN
        might become
        PPNNNNNNNNNN
        case 4 below
    */
    void case4(void)
    {
        init();
        sprintf(buf, rubysrc, getpid(), mmap_addr, mmap_addr+pagesize*6);
    
        mem_bind(0, 4);
        mem_unbind(2, 2);
    
        file = popen(buf, "r");
        fread(retbuf, sizeof(retbuf), 1, file);
        Assert("2,4", retbuf, "case4", __LINE__);
    
        fin();
    }
    
    /*
           AAAA
     PPPPPPNNNNNN
     might become
     PPPPPPPPPPNN
     case 5 below
    */
    void case5(void)
    {
        init();
        sprintf(buf, rubysrc, getpid(), mmap_addr, mmap_addr+pagesize*6);
    
        mem_bind(0, 2);
        mem_bind(2, 2);
    
        file = popen(buf, "r");
        fread(retbuf, sizeof(retbuf), 1, file);
        Assert("4,2", retbuf, "case5", __LINE__);
    
        fin();
    }
    
    /*
            AAAA
        PPPPNNNNXXXX
        might become
        PPPPPPPPPPPP 6
    */
    void case6(void)
    {
        init();
        sprintf(buf, rubysrc, getpid(), mmap_addr, mmap_addr+pagesize*6);
    
        mem_bind(0, 2);
        mem_bind(4, 2);
        mem_bind(2, 2);
    
        file = popen(buf, "r");
        fread(retbuf, sizeof(retbuf), 1, file);
        Assert("6", retbuf, "case6", __LINE__);
    
        fin();
    }
    
    /*
        AAAA
    PPPPNNNNXXXX
    might become
    PPPPPPPPXXXX 7
    */
    void case7(void)
    {
        init();
        sprintf(buf, rubysrc, getpid(), mmap_addr, mmap_addr+pagesize*6);
    
        mem_bind(0, 2);
        mem_interleave(4, 2);
        mem_bind(2, 2);
    
        file = popen(buf, "r");
        fread(retbuf, sizeof(retbuf), 1, file);
        Assert("4,2", retbuf, "case7", __LINE__);
    
        fin();
    }
    
    /*
        AAAA
    PPPPNNNNXXXX
    might become
    PPPPNNNNNNNN 8
    */
    void case8(void)
    {
        init();
        sprintf(buf, rubysrc, getpid(), mmap_addr, mmap_addr+pagesize*6);
    
        mem_bind(0, 2);
        mem_interleave(4, 2);
        mem_interleave(2, 2);
    
        file = popen(buf, "r");
        fread(retbuf, sizeof(retbuf), 1, file);
        Assert("2,4", retbuf, "case8", __LINE__);
    
        fin();
    }
    
    void case_n(void)
    {
        init();
        sprintf(buf, rubysrc, getpid(), mmap_addr, mmap_addr+pagesize*6);
    
        /* make redundunt mappings [0][1234][34][7] */
        mmap(mmap_addr + pagesize*4, pagesize*2, PROT_READ|PROT_WRITE,
             MAP_FIXED|MAP_SHARED, mapped_fd, pagesize*3);
    
        /* Expect to do nothing. */
        mem_unbind(2, 2);
    
        file = popen(buf, "r");
        fread(retbuf, sizeof(retbuf), 1, file);
        Assert("4,2", retbuf, "case_n", __LINE__);
    
        fin();
    }
    
    int main(int argc, char** argv)
    {
        case4();
        case5();
        case6();
        case7();
        case8();
        case_n();
    
        return 0;
    }
    =============================================================
    
    Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Acked-by: Johannes Weiner <hannes@cmpxchg.org>
    Cc: Minchan Kim <minchan.kim@gmail.com>
    Cc: Caspar Zhang <caspar@casparzhang.com>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
    Cc: Mel Gorman <mel@csn.ul.ie>
    Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
    Cc: <stable@vger.kernel.org>                [3.1.x]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit f3a1082005781777086df235049f8c0b7efe524e
Author: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Date:   Tue Dec 27 22:32:41 2011 -0500

    packet: fix possible dev refcnt leak when bind fail
    
    If bind is fail when bind is called after set PACKET_FANOUT
    sock option, the dev refcnt will leak.
    
    Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 915f8b08dac68839dc7204ee81cf9852fda16d24
Author: Haogang Chen <haogangchen@gmail.com>
Date:   Mon Dec 19 17:11:56 2011 -0800

    nilfs2: potential integer overflow in nilfs_ioctl_clean_segments()
    
    There is a potential integer overflow in nilfs_ioctl_clean_segments().
    When a large argv[n].v_nmembs is passed from the userspace, the subsequent
    call to vmalloc() will allocate a buffer smaller than expected, which
    leads to out-of-bound access in nilfs_ioctl_move_blocks() and
    lfs_clean_segments().
    
    The following check does not prevent the overflow because nsegs is also
    controlled by the userspace and could be very large.
    
                if (argv[n].v_nmembs > nsegs * nilfs->ns_blocks_per_segment)
                        goto out_free;
    
    This patch clamps argv[n].v_nmembs to UINT_MAX / argv[n].v_size, and
    returns -EINVAL when overflow.
    
    Signed-off-by: Haogang Chen <haogangchen@gmail.com>
    Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 006afb6eb7a7398edc0068c3a7b9510ffaf80f72
Author: Kautuk Consul <consul.kautuk@gmail.com>
Date:   Mon Dec 19 17:12:04 2011 -0800

    mm/vmalloc.c: remove static declaration of va from __get_vm_area_node
    
    Static storage is not required for the struct vmap_area in
    __get_vm_area_node.
    
    Removing "static" to store this variable on the stack instead.
    
    Signed-off-by: Kautuk Consul <consul.kautuk@gmail.com>
    Acked-by: David Rientjes <rientjes@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 461ecdf221edb089e5fa0d5563e1688cd0a36f66
Author: Michel Lespinasse <walken@google.com>
Date:   Mon Dec 19 17:12:06 2011 -0800

    binary_sysctl(): fix memory leak
    
    binary_sysctl() calls sysctl_getname() which allocates from names_cache
    slab usin __getname()
    
    The matching function to free the name is __putname(), and not putname()
    which should be used only to match getname() allocations.
    
    This is because when auditing is enabled, putname() calls audit_putname
    *instead* (not in addition) to __putname().  Then, if a syscall is in
    progress, audit_putname does not release the name - instead, it expects
    the name to get released when the syscall completes, but that will happen
    only if audit_getname() was called previously, i.e.  if the name was
    allocated with getname() rather than the naked __getname().  So,
    __getname() followed by putname() ends up leaking memory.
    
    Signed-off-by: Michel Lespinasse <walken@google.com>
    Acked-by: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Christoph Hellwig <hch@infradead.org>
    Cc: Eric Paris <eparis@redhat.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 0a2cd3ef50c0bae70d59c74a77db0455d26fde56
Author: Sean Hefty <sean.hefty@intel.com>
Date:   Tue Dec 6 21:17:11 2011 +0000

    RDMA/cma: Verify private data length
    
    private_data_len is defined as a u8.  If the user specifies a large
    private_data size (> 220 bytes), we will calculate a total length that
    exceeds 255, resulting in private_data_len wrapping back to 0.  This
    can lead to overwriting random kernel memory.  Avoid this by verifying
    that the resulting size fits into a u8.
    
    Reported-by: B. Thery <benjamin.thery@bull.net>
    Addresses: <http://bugs.openfabrics.org/bugzilla/show_bug.cgi?id=2335>
    Signed-off-by: Sean Hefty <sean.hefty@intel.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit 6b618c54aaec99078629ec5b9575cb7d6fc31176
Author: Xi Wang <xi.wang@gmail.com>
Date:   Sun Dec 11 23:40:56 2011 -0800

    Input: cma3000_d0x - fix signedness bug in cma3000_thread_irq()
    
    The error check (intr_status < 0) didn't work because intr_status is
    a u8.  Change its type to signed int.
    
    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

commit e27f34e383d7863b2528a63b81b23db09781f6b6
Author: Xi Wang <xi.wang@gmail.com>
Date:   Fri Dec 16 12:44:15 2011 +0000

    sctp: fix incorrect overflow check on autoclose
    
    Commit 8ffd3208 voids the previous patches f6778aab and 810c0719 for
    limiting the autoclose value.  If userspace passes in -1 on 32-bit
    platform, the overflow check didn't work and autoclose would be set
    to 0xffffffff.
    
    This patch defines a max_autoclose (in seconds) for limiting the value
    and exposes it through sysctl, with the following intentions.
    
    1) Avoid overflowing autoclose * HZ.
    
    2) Keep the default autoclose bound consistent across 32- and 64-bit
       platforms (INT_MAX / HZ in this patch).
    
    3) Keep the autoclose value consistent between setsockopt() and
       getsockopt() calls.
    
    Suggested-by: Vlad Yasevich <vladislav.yasevich@hp.com>
    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 8ebdfaad2f46ff0ac9fef9858e436bcc712a1ac8
Author: Xi Wang <xi.wang@gmail.com>
Date:   Wed Dec 21 05:18:33 2011 -0500

    vmwgfx: fix incorrect VRAM size check in vmw_kms_fb_create()
    
    Commit e133e737 didn't correctly fix the integer overflow issue.
    
    -   unsigned int required_size;
    +   u64 required_size;
        ...
        required_size = mode_cmd->pitch * mode_cmd->height;
    -   if (unlikely(required_size > dev_priv->vram_size)) {
    +   if (unlikely(required_size > (u64) dev_priv->vram_size)) {
    
    Note that both pitch and height are u32.  Their product is still u32 and
    would overflow before being assigned to required_size.  A correct way is
    to convert pitch and height to u64 before the multiplication.
    
        required_size = (u64)mode_cmd->pitch * (u64)mode_cmd->height;
    
    This patch calls the existing vmw_kms_validate_mode_vram() for
    validation.
    
    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    Reviewed-and-tested-by: Thomas Hellstrom <thellstrom@vmware.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    
    Conflicts:
    
        drivers/gpu/drm/vmwgfx/vmwgfx_kms.c

commit eb8f0bd01fb994c9abc77dc84729794cd841753d
Author: Xi Wang <xi.wang@gmail.com>
Date:   Thu Dec 22 13:35:22 2011 +0000

    rps: fix insufficient bounds checking in store_rps_dev_flow_table_cnt()
    
    Setting a large rps_flow_cnt like (1 << 30) on 32-bit platform will
    cause a kernel oops due to insufficient bounds checking.
    
        if (count > 1<<30) {
                /* Enforce a limit to prevent overflow */
                return -EINVAL;
        }
        count = roundup_pow_of_two(count);
        table = vmalloc(RPS_DEV_FLOW_TABLE_SIZE(count));
    
    Note that the macro RPS_DEV_FLOW_TABLE_SIZE(count) is defined as:
    
        ... + (count * sizeof(struct rps_dev_flow))
    
    where sizeof(struct rps_dev_flow) is 8.  (1 << 30) * 8 will overflow
    32 bits.
    
    This patch replaces the magic number (1 << 30) with a symbolic bound.
    
    Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 648188958672024b616c42c1f6c98c8cfc85619d
Author: Xi Wang <xi.wang@gmail.com>
Date:   Fri Dec 30 10:40:17 2011 -0500

    netfilter: ctnetlink: fix timeout calculation
    
    The sanity check (timeout < 0) never works; the dividend is unsigned
    and so is the division, which should have been a signed division.
    
        long timeout = (ct->timeout.expires - jiffies) / HZ;
        if (timeout < 0)
                timeout = 0;
    
    This patch converts the time values to signed for the division.
    
    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit ab03a0973cee73f88655ff4981812ad316a6cd59
Merge: 76f82df 7bdddeb
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Jan 3 17:42:50 2012 -0500

    Merge branch 'pax-test' into grsec-test

commit 7bdddebd9d274a344a1c57a561152160c9e9a32a
Merge: 3e59cb5 55cc81a
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Jan 3 17:42:36 2012 -0500

    Merge branch 'linux-3.1.y' into pax-test

commit 76f82df18ba181687f454426fa9ced7a92b2ac1f
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Dec 22 20:15:02 2011 -0500

    Only further restrict futex targeting another process -- our modified
    permission check also happened to allow a case where a process retaining
    uid 0 could issue futex syscalls against other uid 0 tasks, despite the euid
    being non-zero (reported on forums by ben_w)

commit 6b235a4450a5fea41663ec35fa0608988b6078c6
Merge: 97c16f0 3e59cb5
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Dec 22 19:11:06 2011 -0500

    Merge branch 'pax-test' into grsec-test
    
    Conflicts:
        fs/hfs/btree.c

commit 3e59cb503d4ca6ce0954b8d3eb508cf7d1a31f50
Merge: 285eb4e c26f60b
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Dec 22 19:09:57 2011 -0500

    Merge branch 'linux-3.1.y' into pax-test
    
    Conflicts:
        arch/x86/kernel/process.c

commit 97c16f0fcff592160c1787bd1c56ae7ad070ac17
Author: Brad Spengler <spender@grsecurity.net>
Date:   Mon Dec 19 21:54:01 2011 -0500

    Add new option: "Enforce consistent multithreaded privileges"

commit 7d125a16a5245b2bafc9184b8f93e864394ba1cb
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Dec 7 19:58:31 2011 -0500

    Remove harmless duplicate code -- exec_file would be null already so the
    second check would never pass.

commit 4e3304e94aa72737810bc50169519af157dce4ce
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Dec 7 19:50:39 2011 -0500

    Revert back to (possibly?) undocumented /proc/pid behavior that gdb
    depended on for attaching to a thread.  Entries exist in /proc for
    threads, but are not visible in a readdir.

commit 1bd899335f23815cfe8deac44c6b346398f3b95e
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Dec 4 18:03:28 2011 -0500

    Put the already-walked path if in RCU-walk mode

commit ec7ae36b7159f10649709779443a988662965d66
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Dec 4 17:35:21 2011 -0500

    Fix memory leak introduced by recent (unpublished) commit
    75ab998b94a29d464518d6d501bdde3fbfcbfa14

commit 1e2318a8ea2e67eaf17236be374b5da8a5ba5e04
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Dec 4 13:56:10 2011 -0500

    Explicitly check size copied to userland in override_release to silence gcc

commit c30a85d0fff67e0724e726febb934c0b6fa01c6c
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Dec 4 13:54:02 2011 -0500

    Initialize variable to silence erroneous gcc warning

commit 2cf8e7a3bf4e97b2cd3de9ebc453bc505dc7eb78
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Dec 4 13:47:47 2011 -0500

    Future-proof other potential RCU-aware locations where we can log.

commit 0c904e8c7ea0338c47c7ae825e093a152dc8f8a8
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sun Dec 4 13:02:54 2011 -0500

    Fix freeze reported by 'vs' on the forums.  Bug occurred due to
    MAY_NOT_BLOCK added to Linux 3.1.  Our logging code, when a capability used
    in generic_permission() was in the task's effective set but disallowed by
    RBAC, would block when acquiring locks resulting in the freeze.
    
    Also update the ordering of checks so that CAP_DAC_READ_SEARCH isn't logged
    as being required when CAP_DAC_OVERRIDE is present (consistent with
    older patches).

commit ab694e5eccfbc369baa593ebc1269d1908cf16dc
Author: Xi Wang <xi.wang@gmail.com>
Date:   Tue Nov 29 09:26:30 2011 +0000

    sctp: better integer overflow check in sctp_auth_create_key()
    
    The check from commit 30c2235c is incomplete and cannot prevent
    cases like key_len = 0x80000000 (INT_MAX + 1).  In that case, the
    left-hand side of the check (INT_MAX - key_len), which is unsigned,
    becomes 0xffffffff (UINT_MAX) and bypasses the check.
    
    However this shouldn't be a security issue.  The function is called
    from the following two code paths:
    
     1) setsockopt()
    
     2) sctp_auth_asoc_set_secret()
    
    In case (1), sca_keylength is never going to exceed 65535 since it's
    bounded by a u16 from the user API.  As such, the key length will
    never overflow.
    
    In case (2), sca_keylength is computed based on the user key (1 short)
    and 2 * key_vector (3 shorts) for a total of 7 * USHRT_MAX, which still
    will not overflow.
    
    In other words, this overflow check is not really necessary.  Just
    make it more correct.
    
    Signed-off-by: Xi Wang <xi.wang@gmail.com>
    Cc: Vlad Yasevich <vladislav.yasevich@hp.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit e565e28c3635a1d50f80541fbf6b606d742fec76
Author: Josh Boyer <jwboyer@redhat.com>
Date:   Fri Aug 19 14:50:26 2011 -0400

    fs/minix: Verify bitmap block counts before mounting
    
    Newer versions of MINIX can create filesystems that allocate an extra
    bitmap block.  Mounting of this succeeds, but doing a statfs call will
    result in an oops in count_free because of a negative number being used
    for the bh index.
    
    Avoid this by verifying the number of allocated blocks at mount time,
    erroring out if there are not enough and make statfs ignore the extras
    if there are too many.
    
    This fixes https://bugzilla.kernel.org/show_bug.cgi?id=18792
    
    Signed-off-by: Josh Boyer <jwboyer@redhat.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit 6e134e398ec1a3f428261680e83df4319e64bed9
Author: Julia Lawall <julia@diku.dk>
Date:   Tue Nov 15 14:53:11 2011 -0800

    drivers/gpu/vga/vgaarb.c: add missing kfree
    
    kbuf is a buffer that is local to this function, so all of the error paths
    leaving the function should release it.
    
    Signed-off-by: Julia Lawall <julia@diku.dk>
    Cc: Jesper Juhl <jj@chaosbits.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Dave Airlie <airlied@redhat.com>

commit 2b9057b321e36860e8d63985b5c4e496f254b717
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Dec 3 21:33:28 2011 -0500

    Import changes between pax-linux-3.1.4-test18.patch and grsecurity-2.2.2-3.1.4-201112021740.patch

commit 5dfe6091dca281a456eaff5e7b4692d768a05cfd
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Dec 3 21:29:37 2011 -0500

    Import pax-linux-3.1.4-test18.patch

commit 285eb4ea45d853ae00426b3315a61c1368080dad
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Dec 10 18:33:46 2011 -0500

    Import changes from pax-linux-3.1.5-test20.patch

commit a6bda918fc90ec1d5c387e978d147ad2044153f1
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Dec 8 20:55:54 2011 -0500

    Import changes from pax-linux-3.1.4-test19.patch

commit e6d987bdb782b280f882cc20055e3d9cb28ad3a5
Author: Brad Spengler <spender@grsecurity.net>
Date:   Sat Dec 3 21:29:37 2011 -0500

    Import pax-linux-3.1.4-test18.patch