commit 1a8f5138359b0b1b2f6e07d3bc1ab1e4ca3a0bda Author: Brad Spengler Date: Sat Sep 19 14:45:47 2015 -0400 Improve logging of textrels, as suggested by the PaX Team In the case of textrels, unlike the other features under rwxmap_log, we're logging allowed transitions, either from rx->rw or from rw->rx. fs/binfmt_elf.c | 2 +- grsecurity/grsec_log.c | 3 ++- grsecurity/grsec_pax.c | 6 ++++-- include/linux/grinternal.h | 2 +- include/linux/grmsg.h | 2 +- include/linux/grsecurity.h | 2 +- 6 files changed, 10 insertions(+), 7 deletions(-) commit f96899231124d616f85b1283baa69df4c593e266 Author: Brad Spengler Date: Sun Sep 13 14:17:09 2015 -0400 Update our *_secure sysctl variants as well kernel/sysctl.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit 4f5e68af3c693a2214e26052ead9658a0ce85df6 Author: Ilya Dryomov Date: Wed Sep 9 15:39:06 2015 -0700 sysctl: fix int -> unsigned long assignments in INT_MIN case The following if (val < 0) *lvalp = (unsigned long)-val; is incorrect because the compiler is free to assume -val to be positive and use a sign-extend instruction for extending the bit pattern. This is a problem if val == INT_MIN: # echo -2147483648 >/proc/sys/dev/scsi/logging_level # cat /proc/sys/dev/scsi/logging_level -18446744071562067968 Cast to unsigned long before negation - that way we first sign-extend and then negate an unsigned, which is well defined. With this: # cat /proc/sys/dev/scsi/logging_level -2147483648 Signed-off-by: Ilya Dryomov Cc: Mikulas Patocka Cc: Robert Xiao Cc: "Eric W. Biederman" Cc: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/sysctl.c | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) commit 8d9daf1705a8b321508a9e31d59b06d1dfe7290a Merge: db21a18 a964f88 Author: Brad Spengler Date: Sun Sep 13 13:37:22 2015 -0400 Merge branch 'pax-test' into grsec-test Conflicts: arch/x86/xen/Kconfig commit a964f883594918a075b038cc9634d70260e73048 Merge: 6f2767b 0c5c1f1 Author: Brad Spengler Date: Sun Sep 13 13:36:25 2015 -0400 Merge branch 'linux-4.1.y' into pax-test commit db21a18b927710f55c4e27871e889d5e64a75625 Author: Brad Spengler Date: Fri Sep 11 19:49:18 2015 -0400 Work around a compilation error caused by the following patch: 2015-08-17 Jason Merrill + + PR c++/65734 + * stor-layout.c (layout_type): Layout the TYPE_MAIN_VARIANT. It's currently only been observed with the Debian unstable version of GCC 5.2. The record fields themselves are shared among all type variants, so all we need to do (as we did before) is update the pointer to the list of fields for each type variant. Then, as the above patch only performs layouts on the main type variant, we explicitly only perform the resetting of TYPE_SIZE and the call to layout_type for that main variant. This will prevent TYPE_SIZE from being left as NULL_TREE for the other variants, which is interpreted in later GCC code as an incomplete type, causing the observed compilation errors. Since finalize_type_size() ends up being called on all type variants, we don't need to do any additional work. tools/gcc/randomize_layout_plugin.c | 16 ++++++++++++---- 1 files changed, 12 insertions(+), 4 deletions(-) commit e9978423f2be2079590c31770ed9fd25c80c8840 Merge: 5316471 6f2767b Author: Brad Spengler Date: Thu Sep 10 17:55:32 2015 -0400 Merge branch 'pax-test' into grsec-test commit 6f2767b753af5394329acecb713f35f219937fb7 Author: Brad Spengler Date: Thu Sep 10 17:54:44 2015 -0400 Update to pax-linux-4.1.6-test16.patch: - fixed a section mismatch problem on bios32_indirect - fixed __phys_addr_symbol prototype on amd64, reported by igraltist - Mathias Krause fixed an integer underflow problem caught by the size_overflow plugin in _decode_session6, reported by satmd and Marcin Jurkowski (https://bugs.gentoo.org/show_bug.cgi?id=545192) - fixed mm counter accounting for swap entries under SEGMEXEC/i386 arch/x86/include/asm/page_64.h | 4 ++-- arch/x86/pci/pcbios.c | 2 +- mm/memory.c | 19 +++++++++++++++---- net/ipv6/xfrm6_policy.c | 6 ++++-- tools/gcc/constify_plugin.c | 6 +----- tools/gcc/gcc-common.h | 2 ++ 6 files changed, 25 insertions(+), 14 deletions(-) commit 5316471ff29eab2296624f7d1dd8fe9ee185ee4b Author: Masahiro Yamada Date: Mon Aug 17 04:03:33 2015 +0100 ARM: 8418/1: add boot image dependencies to not generate invalid images U-Boot is often used to boot the kernel on ARM boards, but uImage is not built by "make all", so we are often inclined to do "make all uImage" to generate DTBs, modules and uImage in a single command, but we should notice a pitfall behind it. In fact, "make all uImage" could generate an invalid uImage if it is run with the parallel option (-j). You can reproduce this problem with the following procedure: [1] First, build "all" and "uImage" separately. You will get a valid uImage $ git clean -f -x -d $ export CROSS_COMPILE= $ make -s -j8 ARCH=arm multi_v7_defconfig $ make -s -j8 ARCH=arm all $ make -j8 ARCH=arm UIMAGE_LOADADDR=0x80208000 uImage CHK include/config/kernel.release CHK include/generated/uapi/linux/version.h CHK include/generated/utsrelease.h make[1]: `include/generated/mach-types.h' is up to date. CHK include/generated/timeconst.h CHK include/generated/bounds.h CHK include/generated/asm-offsets.h CALL scripts/checksyscalls.sh CHK include/generated/compile.h Kernel: arch/arm/boot/Image is ready Kernel: arch/arm/boot/zImage is ready UIMAGE arch/arm/boot/uImage Image Name: Linux-4.2.0-rc5-00156-gdd2384a-d Created: Sat Aug 8 23:21:35 2015 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 6138648 Bytes = 5994.77 kB = 5.85 MB Load Address: 80208000 Entry Point: 80208000 Image arch/arm/boot/uImage is ready $ ls -l arch/arm/boot/*Image -rwxrwxr-x 1 masahiro masahiro 13766656 Aug 8 23:20 arch/arm/boot/Image -rw-rw-r-- 1 masahiro masahiro 6138712 Aug 8 23:21 arch/arm/boot/uImage -rwxrwxr-x 1 masahiro masahiro 6138648 Aug 8 23:20 arch/arm/boot/zImage [2] Update some source file(s) $ touch init/main.c [3] Then, re-build "all" and "uImage" simultaneously. You will get an invalid uImage at random. $ make -j8 ARCH=arm UIMAGE_LOADADDR=0x80208000 all uImage CHK include/config/kernel.release CHK include/generated/uapi/linux/version.h CHK include/generated/utsrelease.h make[1]: `include/generated/mach-types.h' is up to date. CHK include/generated/timeconst.h CHK include/generated/bounds.h CHK include/generated/asm-offsets.h CALL scripts/checksyscalls.sh CC init/main.o CHK include/generated/compile.h LD init/built-in.o LINK vmlinux LD vmlinux.o MODPOST vmlinux.o GEN .version CHK include/generated/compile.h UPD include/generated/compile.h CC init/version.o LD init/built-in.o KSYM .tmp_kallsyms1.o KSYM .tmp_kallsyms2.o LD vmlinux SORTEX vmlinux SYSMAP System.map OBJCOPY arch/arm/boot/Image Building modules, stage 2. Kernel: arch/arm/boot/Image is ready GZIP arch/arm/boot/compressed/piggy.gzip AS arch/arm/boot/compressed/piggy.gzip.o Kernel: arch/arm/boot/Image is ready LD arch/arm/boot/compressed/vmlinux GZIP arch/arm/boot/compressed/piggy.gzip OBJCOPY arch/arm/boot/zImage Kernel: arch/arm/boot/zImage is ready UIMAGE arch/arm/boot/uImage Image Name: Linux-4.2.0-rc5-00156-gdd2384a-d Created: Sat Aug 8 23:23:14 2015 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 26472 Bytes = 25.85 kB = 0.03 MB Load Address: 80208000 Entry Point: 80208000 Image arch/arm/boot/uImage is ready MODPOST 192 modules AS arch/arm/boot/compressed/piggy.gzip.o LD arch/arm/boot/compressed/vmlinux OBJCOPY arch/arm/boot/zImage Kernel: arch/arm/boot/zImage is ready $ ls -l arch/arm/boot/*Image -rwxrwxr-x 1 masahiro masahiro 13766656 Aug 8 23:23 arch/arm/boot/Image -rw-rw-r-- 1 masahiro masahiro 26536 Aug 8 23:23 arch/arm/boot/uImage -rwxrwxr-x 1 masahiro masahiro 6138648 Aug 8 23:23 arch/arm/boot/zImage Please notice the uImage is extremely small when this issue is encountered. Besides, "Kernel: arch/arm/boot/zImage is ready" is displayed twice, before and after the uImage log. The root cause of this is the race condition between zImage and uImage. Actually, uImage depends on zImage, but the dependency between the two is only described in arch/arm/boot/Makefile. Because arch/arm/boot/Makefile is not included from the top-level Makefile, it cannot know the dependency between zImage and uImage. Consequently, when we run make with the parallel option, Kbuild updates vmlinux first, and then two different threads descends into the arch/arm/boot/Makefile almost at the same time, one for updating zImage and the other for uImage. While one thread is re-generating zImage, the other also tries to update zImage before creating uImage on top of that. zImage is overwritten by the slower thread and then uImage is created based on the half-written zImage. This is the reason why "Kernel: arch/arm/boot/zImage is ready" is displayed twice, and a broken uImage is created. The same problem could happen on bootpImage. This commit adds dependencies among Image, zImage, uImage, and bootpImage to arch/arm/Makefile, which is included from the top-level Makefile. Signed-off-by: Masahiro Yamada Signed-off-by: Russell King arch/arm/Makefile | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) commit f42eedeab0696d55347452d2b77911e06ed90a14 Author: Vincent Bernat Date: Sat Aug 15 15:49:13 2015 +0200 9p: ensure err is initialized to 0 in p9_client_read/write Some use of those functions were providing unitialized values to those functions. Notably, when reading 0 bytes from an empty file on a 9P filesystem, the return code of read() was not 0. Tested with this simple program: #include #include #include #include #include int main(int argc, const char **argv) { assert(argc == 2); char buffer[256]; int fd = open(argv[1], O_RDONLY|O_NOCTTY); assert(fd >= 0); assert(read(fd, buffer, 0) == 0); return 0; } Cc: stable@vger.kernel.org # v4.1 Signed-off-by: Vincent Bernat Signed-off-by: Al Viro net/9p/client.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) commit 77e41c5af13df22d45eae269a4241ad9ec56d73c Author: Michal Hocko Date: Fri Aug 21 14:11:51 2015 -0700 mm: make page pfmemalloc check more robust Commit c48a11c7ad26 ("netvm: propagate page->pfmemalloc to skb") added checks for page->pfmemalloc to __skb_fill_page_desc(): if (page->pfmemalloc && !page->mapping) skb->pfmemalloc = true; It assumes page->mapping == NULL implies that page->pfmemalloc can be trusted. However, __delete_from_page_cache() can set set page->mapping to NULL and leave page->index value alone. Due to being in union, a non-zero page->index will be interpreted as true page->pfmemalloc. So the assumption is invalid if the networking code can see such a page. And it seems it can. We have encountered this with a NFS over loopback setup when such a page is attached to a new skbuf. There is no copying going on in this case so the page confuses __skb_fill_page_desc which interprets the index as pfmemalloc flag and the network stack drops packets that have been allocated using the reserves unless they are to be queued on sockets handling the swapping which is the case here and that leads to hangs when the nfs client waits for a response from the server which has been dropped and thus never arrive. The struct page is already heavily packed so rather than finding another hole to put it in, let's do a trick instead. We can reuse the index again but define it to an impossible value (-1UL). This is the page index so it should never see the value that large. Replace all direct users of page->pfmemalloc by page_is_pfmemalloc which will hide this nastiness from unspoiled eyes. The information will get lost if somebody wants to use page->index obviously but that was the case before and the original code expected that the information should be persisted somewhere else if that is really needed (e.g. what SLAB and SLUB do). [akpm@linux-foundation.org: fix blooper in slub] Fixes: c48a11c7ad26 ("netvm: propagate page->pfmemalloc to skb") Signed-off-by: Michal Hocko Debugged-by: Vlastimil Babka Debugged-by: Jiri Bohac Cc: Eric Dumazet Cc: David Miller Acked-by: Mel Gorman Cc: [3.6+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Conflicts: mm/page_alloc.c drivers/net/ethernet/intel/fm10k/fm10k_main.c | 2 +- drivers/net/ethernet/intel/igb/igb_main.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 2 +- include/linux/mm.h | 28 +++++++++++++++++++++ include/linux/mm_types.h | 9 ------ include/linux/skbuff.h | 14 +++------ mm/page_alloc.c | 7 +++- mm/slab.c | 4 +- mm/slub.c | 2 +- net/core/skbuff.c | 2 +- 11 files changed, 46 insertions(+), 28 deletions(-) commit 9f031f8887e8fad0cc93f07b346021630f1697e3 Author: Andy Lutomirski Date: Mon Aug 17 12:22:50 2015 -0700 Revert "sched/x86_64: Don't save flags on context switch" This reverts commit: 2c7577a75837 ("sched/x86_64: Don't save flags on context switch") It was a nice speedup. It's also not quite correct: SYSENTER enables interrupts too early. We can re-add this optimization once the SYSENTER code is beaten into shape, which should happen in 4.3 or 4.4. Signed-off-by: Andy Lutomirski Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: stable@vger.kernel.org # v3.19 Link: http://lkml.kernel.org/r/85f56651f59f76624e80785a8fd3bdfdd089a818.1439838962.git.luto@kernel.org Signed-off-by: Ingo Molnar arch/x86/include/asm/switch_to.h | 12 ++++-------- 1 files changed, 4 insertions(+), 8 deletions(-) commit cee8eacb4ed0695ad72fc8a4bb515bf4aaadf1d7 Merge: 1a0a86b 6de0e2c Author: Brad Spengler Date: Tue Aug 18 19:50:26 2015 -0400 Merge branch 'pax-test' into grsec-test commit 6de0e2c52cdd79828f8f31298d67ec6020c51ff7 Author: Brad Spengler Date: Tue Aug 18 19:50:00 2015 -0400 Update to pax-linux-4.1.6-test14.patch: - fixed early memory reservation problem under KERNEXEC/i386, reported by spender arch/x86/kernel/setup.c | 9 ++------- 1 files changed, 2 insertions(+), 7 deletions(-) commit 1a0a86be4eb920418dd8c87e32742291a8a1c9a5 Merge: 417d7cf 81cf0c8 Author: Brad Spengler Date: Tue Aug 18 18:17:05 2015 -0400 Merge branch 'pax-test' into grsec-test Conflicts: arch/x86/include/asm/tlbflush.h commit 81cf0c88c9a2338e2d6687eb5efe72797a4cef5a Merge: 0007a85 4ff62ca Author: Brad Spengler Date: Tue Aug 18 18:16:20 2015 -0400 Update to pax-linux-4.1.6-test13.patch: - fixed some more integer handling issues in sr_done, reported by Christian Apeltauer and nickrobbins@yahoo.com (https://bugs.gentoo.org/show_bug.cgi?id=555860) - fixed KERNEXEC/i386 and alternatives patching some more, reported by ubug (https://forums.grsecurity.net/viewtopic.php?f=3&t=4252) - cleaned up __native_flush_tlb after the recent split of PCID/UDEREF support - made some preparatory changes to support the upcoming size overflow feature that tracks data flow across structure fields as well Merge branch 'linux-4.1.y' into pax-test Conflicts: arch/x86/kernel/entry_64.S arch/x86/kernel/nmi.c commit 417d7cf832d54e32e04357cf1060023717497049 Author: Eric Dumazet Date: Mon Aug 10 15:07:34 2015 -0700 inet: fix possible request socket leak In commit b357a364c57c9 ("inet: fix possible panic in reqsk_queue_unlink()"), I missed fact that tcp_check_req() can return the listener socket in one case, and that we must release the request socket refcount or we leak it. Tested: Following packetdrill test template shows the issue 0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 1) = 0 +0 < S 0:0(0) win 2920 +0 > S. 0:0(0) ack 1 +.002 < . 1:1(0) ack 21 win 2920 +0 > R 21:21(0) Fixes: b357a364c57c9 ("inet: fix possible panic in reqsk_queue_unlink()") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/tcp_ipv4.c | 2 +- net/ipv6/tcp_ipv6.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 00d1b8e2bdbad87b713fba3a4866f10693c7c114 Author: Manfred Spraul Date: Fri Aug 14 15:35:10 2015 -0700 ipc/sem.c: update/correct memory barriers sem_lock() did not properly pair memory barriers: !spin_is_locked() and spin_unlock_wait() are both only control barriers. The code needs an acquire barrier, otherwise the cpu might perform read operations before the lock test. As no primitive exists inside and since it seems noone wants another primitive, the code creates a local primitive within ipc/sem.c. With regards to -stable: The change of sem_wait_array() is a bugfix, the change to sem_lock() is a nop (just a preprocessor redefinition to improve the readability). The bugfix is necessary for all kernels that use sem_wait_array() (i.e.: starting from 3.10). Signed-off-by: Manfred Spraul Reported-by: Oleg Nesterov Acked-by: Peter Zijlstra (Intel) Cc: "Paul E. McKenney" Cc: Kirill Tkhai Cc: Ingo Molnar Cc: Josh Poimboeuf Cc: Davidlohr Bueso Cc: [3.10+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ipc/sem.c | 18 ++++++++++++++---- 1 files changed, 14 insertions(+), 4 deletions(-) commit 92e6c9f02acf1ecb2b51c7c7a46a7f82f7c16375 Author: Andy Whitcroft Date: Thu Aug 13 20:49:01 2015 +0100 ipv4: off-by-one in continuation handling in /proc/net/route When generating /proc/net/route we emit a header followed by a line for each route. When a short read is performed we will restart this process based on the open file descriptor. When calculating the start point we fail to take into account that the 0th entry is the header. This leads us to skip the first entry when doing a continuation read. This can be easily seen with the comparison below: while read l; do echo "$l"; done A cat /proc/net/route >B diff -bu A B | grep '^[+-]' On my example machine I have approximatly 10KB of route output. There we see the very first non-title element is lost in the while read case, and an entry around the 8K mark in the cat case: +wlan0 00000000 02021EAC 0003 0 0 400 00000000 0 0 0 -tun1 00C0AC0A 00000000 0001 0 0 950 00C0FFFF 0 0 0 Fix up the off-by-one when reaquiring position on continuation. Fixes: 8be33e955cb9 ("fib_trie: Fib walk rcu should take a tnode and key instead of a trie and a leaf") BugLink: http://bugs.launchpad.net/bugs/1483440 Acked-by: Alexander Duyck Signed-off-by: Andy Whitcroft Signed-off-by: David S. Miller net/ipv4/fib_trie.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 934dc18989ecb31873d13f1056c2782ba6c29574 Author: Linus Torvalds Date: Thu Aug 13 08:25:20 2015 -0700 Revert x86 sigcontext cleanups This reverts commits 9a036b93a344 ("x86/signal/64: Remove 'fs' and 'gs' from sigcontext") and c6f2062935c8 ("x86/signal/64: Fix SS handling for signals delivered to 64-bit programs"). They were cleanups, but they break dosemu by changing the signal return behavior (and removing 'fs' and 'gs' from the sigcontext struct - while not actually changing any behavior - causes build problems). Reported-and-tested-by: Stas Sergeev Acked-by: Andy Lutomirski Cc: Ingo Molnar Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds arch/x86/include/asm/sigcontext.h | 6 +++--- arch/x86/include/uapi/asm/sigcontext.h | 21 +++------------------ arch/x86/kernel/signal.c | 26 +++++++++++--------------- 3 files changed, 17 insertions(+), 36 deletions(-) commit abd2382b82a99608d21f7c0372ba3f4fc7f1d698 Author: Brad Spengler Date: Fri Aug 14 21:33:40 2015 -0400 Revert "ARM: net: handle negative offsets in BPF JIT." This reverts commit 36523ec244eb01a4fce02a1cbc0643eb80a55324. arch/arm/net/bpf_jit_32.c | 47 ++++++++------------------------------------ 1 files changed, 9 insertions(+), 38 deletions(-) commit 1f986987319e242de1c1a09022d5d813924c6aa4 Author: Brad Spengler Date: Mon Aug 10 20:34:37 2015 -0400 compile fix recent PCID change arch/x86/include/asm/tlbflush.h | 11 +++++------ 1 files changed, 5 insertions(+), 6 deletions(-) commit c64bb46423e12f56b43f338115cd187caeb6034b Author: Brad Spengler Date: Mon Aug 10 20:00:53 2015 -0400 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit 9d2f46bfdb737df5bd56b4bb77e5393f84bb802a Author: Krzysztof Kozlowski Date: Mon Aug 3 14:57:30 2015 +0900 HID: hid-input: Fix accessing freed memory during device disconnect During unbinding the driver was dereferencing a pointer to memory already freed by power_supply_unregister(). Driver was freeing its internal description of battery through pointers stored in power_supply structure. However, because the core owns the power supply instance, after calling power_supply_unregister() this memory is freed and the driver cannot access these members. Fix this by storing the pointer to internal description of battery in a local variable before calling power_supply_unregister(), so the pointer remains valid. Signed-off-by: Krzysztof Kozlowski Reported-by: H.J. Lu Fixes: 297d716f6260 ("power_supply: Change ownership from driver to core") Cc: Reviewed-by: Dmitry Torokhov Signed-off-by: Jiri Kosina drivers/hid/hid-input.c | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) commit 3df182a69e38644cffc1fcde01408bfdd84dd920 Author: Brad Spengler Date: Mon Aug 10 19:24:50 2015 -0400 Small optimization that avoids a find_vm_area on stack copies mm/slab.c | 6 +++++- mm/slob.c | 6 +++++- mm/slub.c | 6 +++++- 3 files changed, 15 insertions(+), 3 deletions(-) commit 8bdd4f688a9d992ecbe58802bd0de32c42c5297f Author: Brad Spengler Date: Mon Aug 10 19:15:58 2015 -0400 Add ability to mark vmalloc maps as being involved in copies to userland. This allows us to restore the new seq file buffer allocation code and maintain our existing infoleak protection for seqfile buffers. fs/seq_file.c | 11 ++++++++++- include/linux/vmalloc.h | 4 ++++ mm/slab.c | 7 +++++++ mm/slob.c | 7 +++++++ mm/slub.c | 7 +++++++ mm/vmalloc.c | 8 ++++++++ 6 files changed, 43 insertions(+), 1 deletions(-) commit a3f5cb0a1c1ed7fc67651d3a2b81ca41231ee3f3 Author: Nikolay Aleksandrov Date: Tue Aug 4 19:06:33 2015 +0200 bridge: netlink: account for the IFLA_BRPORT_PROXYARP_WIFI attribute size and policy The attribute size wasn't accounted for in the get_slave_size() callback (br_port_get_slave_size) when it was introduced, so fix it now. Also add a policy entry for it in br_port_policy. Signed-off-by: Nikolay Aleksandrov Fixes: 842a9ae08a25 ("bridge: Extend Proxy ARP design to allow optional rules for Wi-Fi") Signed-off-by: David S. Miller net/bridge/br_netlink.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) commit 5e8e9a3f0f858fbba32b5f5966d65987d009ed70 Author: Nikolay Aleksandrov Date: Tue Aug 4 19:06:32 2015 +0200 bridge: netlink: account for the IFLA_BRPORT_PROXYARP attribute size and policy The attribute size wasn't accounted for in the get_slave_size() callback (br_port_get_slave_size) when it was introduced, so fix it now. Also add a policy entry for it in br_port_policy. Signed-off-by: Nikolay Aleksandrov Fixes: 958501163ddd ("bridge: Add support for IEEE 802.11 Proxy ARP") Signed-off-by: David S. Miller net/bridge/br_netlink.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) commit a19f8506f07feb487f51c876c5d5176c899b3387 Author: Dan Carpenter Date: Sat Aug 1 15:33:26 2015 +0300 rds: fix an integer overflow test in rds_info_getsockopt() "len" is a signed integer. We check that len is not negative, so it goes from zero to INT_MAX. PAGE_SIZE is unsigned long so the comparison is type promoted to unsigned long. ULONG_MAX - 4095 is a higher than INT_MAX so the condition can never be true. I don't know if this is harmful but it seems safe to limit "len" to INT_MAX - 4095. Fixes: a8c879a7ee98 ('RDS: Info and stats') Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller net/rds/info.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit f22c7b1b8c91ec671dfb118ecb1dbb404c653bf8 Author: Herbert Xu Date: Tue Aug 4 15:42:47 2015 +0800 net: Fix skb_set_peeked use-after-free bug The commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec ("net: Clone skb before setting peeked flag") introduced a use-after-free bug in skb_recv_datagram. This is because skb_set_peeked may create a new skb and free the existing one. As it stands the caller will continue to use the old freed skb. This patch fixes it by making skb_set_peeked return the new skb (or the old one if unchanged). Fixes: 738ac1ebb96d ("net: Clone skb before setting peeked flag") Reported-by: Brenden Blanco Signed-off-by: Herbert Xu Tested-by: Brenden Blanco Reviewed-by: Konstantin Khlebnikov Signed-off-by: David S. Miller net/core/datagram.c | 13 +++++++------ 1 files changed, 7 insertions(+), 6 deletions(-) commit 2d8040a96a62265ac5545261cc3485d1e465f235 Author: David S. Miller Date: Thu Aug 6 19:13:25 2015 -0700 sparc64: Fix userspace FPU register corruptions. If we have a series of events from userpsace, with %fprs=FPRS_FEF, like follows: ETRAP ETRAP VIS_ENTRY(fprs=0x4) VIS_EXIT RTRAP (kernel FPU restore with fpu_saved=0x4) RTRAP We will not restore the user registers that were clobbered by the FPU using kernel code in the inner-most trap. Traps allocate FPU save slots in the thread struct, and FPU using sequences save the "dirty" FPU registers only. This works at the initial trap level because all of the registers get recorded into the top-level FPU save area, and we'll return to userspace with the FPU disabled so that any FPU use by the user will take an FPU disabled trap wherein we'll load the registers back up properly. But this is not how trap returns from kernel to kernel operate. The simplest fix for this bug is to always save all FPU register state for anything other than the top-most FPU save area. Getting rid of the optimized inner-slot FPU saving code ends up making VISEntryHalf degenerate into plain VISEntry. Longer term we need to do something smarter to reinstate the partial save optimizations. Perhaps the fundament error is having trap entry and exit allocate FPU save slots and restore register state. Instead, the VISEntry et al. calls should be doing that work. This bug is about two decades old. Reported-by: James Y Knight Signed-off-by: David S. Miller arch/sparc/include/asm/visasm.h | 16 +++------ arch/sparc/lib/NG4memcpy.S | 5 ++- arch/sparc/lib/VISsave.S | 67 +------------------------------------- arch/sparc/lib/ksyms.c | 4 -- 4 files changed, 11 insertions(+), 81 deletions(-) commit 5f11caef496debbc32465910acf360bed4a7953e Author: Al Viro Date: Tue Aug 4 23:23:50 2015 -0400 may_follow_link() should use nd->inode Now that we can get there in RCU mode, we shouldn't play with nd->path.dentry->d_inode - it's not guaranteed to be stable. Use nd->inode instead. Reported-by: Hugh Dickins Signed-off-by: Al Viro fs/namei.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 7ceeafab141e7a54050b2d392181f670b0a3aea4 Merge: 84279d9 0007a85 Author: Brad Spengler Date: Mon Aug 10 18:34:56 2015 -0400 Merge branch 'pax-test' into grsec-test commit 0007a85d08e7c1e6ab95aaeb31c142c237b543f0 Author: Brad Spengler Date: Mon Aug 10 18:34:34 2015 -0400 Update to pax-linux-4.1.5-test12.patch: - fixed boot warning about static_cpu_has(X86_FEATURE_PCIDUDEREF) arch/x86/include/asm/cpufeature.h | 2 +- arch/x86/kernel/head64.c | 2 -- 2 files changed, 1 insertions(+), 3 deletions(-) commit 4f50708a26734083292c7c906dcff241ef82924c Merge: 640dcd8 352cb86 Author: Brad Spengler Date: Mon Aug 10 18:33:43 2015 -0400 Merge branch 'linux-4.1.y' into pax-test commit 84279d97b5e4697c143a255ea1424e3c4157cceb Author: Brad Spengler Date: Mon Aug 10 02:39:35 2015 -0400 Backport virtio-net security fix by Jason Wang from: http://marc.info/?l=linux-netdev&m=143868216724068&w=2 drivers/net/virtio_net.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit fcf4c10e74760ab213cec1b55d63e2d2fd9da01d Merge: c5627f0 640dcd8 Author: Brad Spengler Date: Mon Aug 10 02:29:34 2015 -0400 Merge branch 'pax-test' into grsec-test Conflicts: init/main.c commit 640dcd80f5bc1cad2e143729b8a9b422165cdc7e Author: Brad Spengler Date: Mon Aug 10 02:26:15 2015 -0400 Update to pax-linux-4.1.4-test11.patch: - more fixes for pax_nouderef handling (PCID/INVPCID will still be used on the host), reported by Victor arch/x86/include/asm/cpufeature.h | 1 + arch/x86/include/asm/mmu_context.h | 10 ++-- arch/x86/include/asm/tlbflush.h | 26 +++++---- arch/x86/kernel/cpu/common.c | 80 +++++++++++++++++++++++----- arch/x86/kernel/entry_64.S | 4 +- drivers/gpu/drm/drm_ioc32.c | 1 - init/main.c | 48 ----------------- mm/memory.c | 1 - tools/gcc/size_overflow_plugin/.gitignore | 1 + 9 files changed, 90 insertions(+), 82 deletions(-) commit c5627f0435c7ec05a07670d053ff24876106e7d2 Author: Brad Spengler Date: Mon Aug 3 22:36:31 2015 -0400 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) commit cd384c2ee9ff24d7c8e83685bc2793a9ddb80328 Author: Brad Spengler Date: Mon Aug 3 22:12:02 2015 -0400 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) commit d877f072db628ea9265aa7f651384d7e0ec6865a Author: Brad Spengler Date: Mon Aug 3 21:46:08 2015 -0400 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) commit 9c510798245942db9e1df1945f7a240f3d51ad80 Merge: 5cbedec a10d38f Author: Brad Spengler Date: Mon Aug 3 21:16:26 2015 -0400 Merge branch 'pax-test' into grsec-test Conflicts: security/selinux/hooks.c commit a10d38f1c800bd587a5feeed9d8cea68dba1aec5 Merge: d0fff4d 89e4199 Author: Brad Spengler Date: Mon Aug 3 21:15:54 2015 -0400 Merge branch 'linux-4.1.y' into pax-test Conflicts: drivers/gpu/drm/drm_ioc32.c lib/bitmap.c mm/memory.c commit 5cbedec9d29ae9835ac38560f82cb98acc993647 Author: Benjamin Randazzo Date: Sat Jul 25 16:36:50 2015 +0200 md: use kzalloc() when bitmap is disabled In drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a mdu_bitmap_file_t called "file". 5769 file = kmalloc(sizeof(*file), GFP_NOIO); 5770 if (!file) 5771 return -ENOMEM; This structure is copied to user space at the end of the function. 5786 if (err == 0 && 5787 copy_to_user(arg, file, sizeof(*file))) 5788 err = -EFAULT But if bitmap is disabled only the first byte of "file" is initialized with zero, so it's possible to read some bytes (up to 4095) of kernel space memory from user space. This is an information leak. 5775 /* bitmap disabled, zero the first byte and copy out */ 5776 if (!mddev->bitmap_info.file) 5777 file->pathname[0] = '\0'; Signed-off-by: Benjamin Randazzo Signed-off-by: NeilBrown Conflicts: drivers/md/md.c drivers/md/md.c | 22 +++++++++++----------- 1 files changed, 11 insertions(+), 11 deletions(-) commit ef22ba5ed995e594e32b3c6c80246b0037c98e7e Author: Kinglong Mee Date: Mon Jul 27 15:31:38 2015 +0800 nfs: Fix an oops caused by using other thread's stack space in ASYNC mode An oops caused by using other thread's stack space in sunrpc ASYNC sending thread. [ 9839.007187] ------------[ cut here ]------------ [ 9839.007923] kernel BUG at fs/nfs/nfs4xdr.c:910! [ 9839.008069] invalid opcode: 0000 [#1] SMP [ 9839.008069] Modules linked in: blocklayoutdriver rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache snd_hda_codec_generic snd_hda_intel snd_hda_controller snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm joydev iosf_mbi crct10dif_pclmul snd_timer crc32_pclmul crc32c_intel ghash_clmulni_intel snd soundcore ppdev pvpanic parport_pc i2c_piix4 serio_raw virtio_balloon parport acpi_cpufreq nfsd nfs_acl lockd grace auth_rpcgss sunrpc qxl drm_kms_helper virtio_net virtio_console virtio_blk ttm drm virtio_pci virtio_ring virtio ata_generic pata_acpi [ 9839.008069] CPU: 0 PID: 308 Comm: kworker/0:1H Not tainted 4.0.0-0.rc4.git1.3.fc23.x86_64 #1 [ 9839.008069] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 9839.008069] Workqueue: rpciod rpc_async_schedule [sunrpc] [ 9839.008069] task: ffff8800d8b4d8e0 ti: ffff880036678000 task.ti: ffff880036678000 [ 9839.008069] RIP: 0010:[] [] reserve_space.part.73+0x9/0x10 [nfsv4] [ 9839.008069] RSP: 0018:ffff88003667ba58 EFLAGS: 00010246 [ 9839.008069] RAX: 0000000000000000 RBX: 000000001fc15e18 RCX: ffff8800c0193800 [ 9839.008069] RDX: ffff8800e4ae3f24 RSI: 000000001fc15e2c RDI: ffff88003667bcd0 [ 9839.008069] RBP: ffff88003667ba58 R08: ffff8800d9173008 R09: 0000000000000003 [ 9839.008069] R10: ffff88003667bcd0 R11: 000000000000000c R12: 0000000000010000 [ 9839.008069] R13: ffff8800d9173350 R14: 0000000000000000 R15: ffff8800c0067b98 [ 9839.008069] FS: 0000000000000000(0000) GS:ffff88011fc00000(0000) knlGS:0000000000000000 [ 9839.008069] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9839.008069] CR2: 00007f988c9c8bb0 CR3: 00000000d99b6000 CR4: 00000000000407f0 [ 9839.008069] Stack: [ 9839.008069] ffff88003667bbc8 ffffffffa03412c5 00000000c6c55680 ffff880000000003 [ 9839.008069] 0000000000000088 00000010c6c55680 0001000000000002 ffffffff816e87e9 [ 9839.008069] 0000000000000000 00000000477290e2 ffff88003667bab8 ffffffff81327ba3 [ 9839.008069] Call Trace: [ 9839.008069] [] encode_attrs+0x435/0x530 [nfsv4] [ 9839.008069] [] ? inet_sendmsg+0x69/0xb0 [ 9839.008069] [] ? selinux_socket_sendmsg+0x23/0x30 [ 9839.008069] [] ? do_sock_sendmsg+0x9f/0xc0 [ 9839.008069] [] ? kernel_sendmsg+0x58/0x70 [ 9839.008069] [] ? xdr_reserve_space+0x20/0x170 [sunrpc] [ 9839.008069] [] ? xdr_reserve_space+0x20/0x170 [sunrpc] [ 9839.008069] [] ? nfs4_xdr_enc_open_noattr+0x130/0x130 [nfsv4] [ 9839.008069] [] encode_open+0x2d5/0x340 [nfsv4] [ 9839.008069] [] ? nfs4_xdr_enc_open_noattr+0x130/0x130 [nfsv4] [ 9839.008069] [] ? xdr_encode_opaque+0x19/0x20 [sunrpc] [ 9839.008069] [] ? encode_string+0x2b/0x40 [nfsv4] [ 9839.008069] [] nfs4_xdr_enc_open+0xb3/0x140 [nfsv4] [ 9839.008069] [] rpcauth_wrap_req+0xac/0xf0 [sunrpc] [ 9839.008069] [] call_transmit+0x18b/0x2d0 [sunrpc] [ 9839.008069] [] ? call_decode+0x860/0x860 [sunrpc] [ 9839.008069] [] ? call_decode+0x860/0x860 [sunrpc] [ 9839.008069] [] __rpc_execute+0x90/0x460 [sunrpc] [ 9839.008069] [] rpc_async_schedule+0x15/0x20 [sunrpc] [ 9839.008069] [] process_one_work+0x1bb/0x410 [ 9839.008069] [] worker_thread+0x53/0x470 [ 9839.008069] [] ? process_one_work+0x410/0x410 [ 9839.008069] [] ? process_one_work+0x410/0x410 [ 9839.008069] [] kthread+0xd8/0xf0 [ 9839.008069] [] ? kthread_worker_fn+0x180/0x180 [ 9839.008069] [] ret_from_fork+0x58/0x90 [ 9839.008069] [] ? kthread_worker_fn+0x180/0x180 [ 9839.008069] Code: 00 00 48 c7 c7 21 fa 37 a0 e8 94 1c d6 e0 c6 05 d2 17 05 00 01 8b 03 eb d7 66 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 <0f> 0b 0f 1f 44 00 00 66 66 66 66 90 55 48 89 e5 41 54 53 89 f3 [ 9839.008069] RIP [] reserve_space.part.73+0x9/0x10 [nfsv4] [ 9839.008069] RSP [ 9839.071114] ---[ end trace cc14c03adb522e94 ]--- Signed-off-by: Kinglong Mee Signed-off-by: Trond Myklebust fs/nfs/internal.h | 21 +++++++++++++++++++++ fs/nfs/nfs4proc.c | 10 +++++++++- 2 files changed, 30 insertions(+), 1 deletions(-) commit 79a18310c8c3f5e66e8b0d5ec4623b04734c982e Author: Brad Spengler Date: Sat Aug 1 14:55:32 2015 -0400 From: Colin Ian King Subject: [PATCH] KEYS: ensure we free the assoc array edit if edit is valid __key_link_end is not freeing the associated array edit structure and this leads to a 512 byte memory leak each time an identical existing key is added with add_key(). The reason the add_key() system call returns okay is that key_create_or_update() calls __key_link_begin() before checking to see whether it can update a key directly rather than adding/replacing - which it turns out it can. Thus __key_link() is not called through __key_instantiate_and_link() and __key_link_end() must cancel the edit. CVE-2015-1333 Signed-off-by: Colin Ian King Signed-off-by: David Howells security/keys/keyring.c | 8 +++++--- 1 files changed, 5 insertions(+), 3 deletions(-) commit 66b9be9914bf6c6d81a83b364cd992369ad7664e Author: Shahed Shaikh Date: Wed Jul 29 07:55:35 2015 -0400 qlcnic: Fix corruption while copying Use proper typecasting while performing byte-by-byte copy Signed-off-by: Shahed Shaikh Signed-off-by: David S. Miller .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 6663f1a1d2bafc21dcb990066413f1580bd17a9a Author: Eric Dumazet Date: Wed Jul 29 12:01:41 2015 +0200 ipv6: flush nd cache on IFF_NOARP change This patch is the IPv6 equivalent of commit 6c8b4e3ff81b ("arp: flush arp cache on IFF_NOARP change") Without it, we keep buggy neighbours in the cache, with destination MAC address equal to our own MAC address. Tested: tcpdump -i eth0 -s 0 ip6 -n -e & ip link set dev eth0 arp off ping6 remote // sends buggy frames ip link set dev eth0 arp on ping6 remote // should work once kernel is patched Signed-off-by: Eric Dumazet Reported-by: Mario Fanelli Signed-off-by: David S. Miller net/ipv6/ndisc.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) commit 5b6b6bc934c671c3583072b045fd44261f962243 Author: Guenter Roeck Date: Sat Jul 4 13:23:42 2015 -0700 hwmon: (nct7802) Fix integer overflow seen when writing voltage limits Writing a large value into a voltage limit attribute can result in an overflow due to an auto-conversion from unsigned long to unsigned int. Cc: Constantine Shulyupin Reviewed-by: Jean Delvare Cc: stable@vger.kernel.org # v4.1+ Signed-off-by: Guenter Roeck drivers/hwmon/nct7802.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 24494632f692af77e1bc1a85959cf661405f4dec Author: Dmitry Skorodumov Date: Tue Jul 28 18:38:32 2015 +0400 x86/efi: Use all 64 bit of efi_memmap in setup_e820() The efi_info structure stores low 32 bits of memory map in efi_memmap and high 32 bits in efi_memmap_hi. While constructing pointer in the setup_e820(), need to take into account all 64 bit of the pointer. It is because on 64bit machine the function efi_get_memory_map() may return full 64bit pointer and before the patch that pointer was truncated. The issue is triggered on Parallles virtual machine and fixed with this patch. Signed-off-by: Dmitry Skorodumov Cc: Denis V. Lunev Cc: Signed-off-by: Matt Fleming arch/x86/boot/compressed/eboot.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) commit e559670082dc866b8d7460f965f715fdd577d961 Author: Ricardo Neri Date: Wed Jul 15 19:36:03 2015 -0700 efi: Check for NULL efi kernel parameters Even though it is documented how to specifiy efi parameters, it is possible to cause a kernel panic due to a dereference of a NULL pointer when parsing such parameters if "efi" alone is given: PANIC: early exception 0e rip 10:ffffffff812fb361 error 0 cr2 0 [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 4.2.0-rc1+ #450 [ 0.000000] ffffffff81fe20a9 ffffffff81e03d50 ffffffff8184bb0f 00000000000003f8 [ 0.000000] 0000000000000000 ffffffff81e03e08 ffffffff81f371a1 64656c62616e6520 [ 0.000000] 0000000000000069 000000000000005f 0000000000000000 0000000000000000 [ 0.000000] Call Trace: [ 0.000000] [] dump_stack+0x45/0x57 [ 0.000000] [] early_idt_handler_common+0x81/0xae [ 0.000000] [] ? parse_option_str+0x11/0x90 [ 0.000000] [] arch_parse_efi_cmdline+0x15/0x42 [ 0.000000] [] do_early_param+0x50/0x8a [ 0.000000] [] parse_args+0x1e3/0x400 [ 0.000000] [] parse_early_options+0x24/0x28 [ 0.000000] [] ? loglevel+0x31/0x31 [ 0.000000] [] parse_early_param+0x31/0x3d [ 0.000000] [] setup_arch+0x2de/0xc08 [ 0.000000] [] ? vprintk_default+0x1a/0x20 [ 0.000000] [] start_kernel+0x90/0x423 [ 0.000000] [] x86_64_start_reservations+0x2a/0x2c [ 0.000000] [] x86_64_start_kernel+0xeb/0xef [ 0.000000] RIP 0xffffffff81ba2efc This panic is not reproducible with "efi=" as this will result in a non-NULL zero-length string. Thus, verify that the pointer to the parameter string is not NULL. This is consistent with other parameter-parsing functions which check for NULL pointers. Signed-off-by: Ricardo Neri Cc: Dave Young Cc: Signed-off-by: Matt Fleming arch/x86/platform/efi/efi.c | 5 +++++ drivers/firmware/efi/efi.c | 5 +++++ 2 files changed, 10 insertions(+), 0 deletions(-) commit 5ff384683c424fd7a1aa5c60f3f74aaea195be16 Author: Andy Lutomirski Date: Thu Jul 30 14:31:31 2015 -0700 x86/xen: Probe target addresses in set_aliased_prot() before the hypercall The update_va_mapping hypercall can fail if the VA isn't present in the guest's page tables. Under certain loads, this can result in an OOPS when the target address is in unpopulated vmap space. While we're at it, add comments to help explain what's going on. This isn't a great long-term fix. This code should probably be changed to use something like set_memory_ro. Signed-off-by: Andy Lutomirski Cc: Andrew Cooper Cc: Andy Lutomirski Cc: Boris Ostrovsky Cc: Borislav Petkov Cc: Brian Gerst Cc: David Vrabel Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Jan Beulich Cc: Konrad Rzeszutek Wilk Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Sasha Levin Cc: Steven Rostedt Cc: Thomas Gleixner Cc: security@kernel.org Cc: Cc: xen-devel Link: http://lkml.kernel.org/r/0b0e55b995cda11e7829f140b833ef932fcabe3a.1438291540.git.luto@kernel.org Signed-off-by: Ingo Molnar arch/x86/xen/enlighten.c | 40 ++++++++++++++++++++++++++++++++++++++++ 1 files changed, 40 insertions(+), 0 deletions(-) commit bdc543e6fa0c1cf74bca28aeb344a1e225d7e09b Merge: 672a089 d0fff4d Author: Brad Spengler Date: Tue Jul 28 19:37:49 2015 -0400 Merge branch 'pax-test' into grsec-test commit d0fff4d52431b3b92fb24b3baa7f25d5b7b88439 Author: Brad Spengler Date: Tue Jul 28 19:37:28 2015 -0400 Revert PCID changes arch/x86/include/asm/cpufeature.h | 1 - arch/x86/include/asm/mmu_context.h | 10 +++++----- arch/x86/include/asm/tlbflush.h | 20 +++++++++----------- arch/x86/kernel/cpu/common.c | 31 ++++++++++++++----------------- init/main.c | 3 ++- 5 files changed, 30 insertions(+), 35 deletions(-) commit 672a0895cf976099d985d2a2ef0978fa3b5b5423 Author: Dave Hansen Date: Mon Jul 20 16:01:53 2015 -0700 x86/mm: Add parenthesis for TLB tracepoint size calculation flush_tlb_info->flush_start/end are both normal virtual addresses. When calculating 'nr_pages' (only used for the tracepoint), I neglected to put parenthesis in. Thanks to David Koufaty for pointing this out. Signed-off-by: Dave Hansen Cc: Andrew Morton Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: dave@sr71.net Cc: Link: http://lkml.kernel.org/r/20150720230153.9E834081@viggo.jf.intel.com Signed-off-by: Ingo Molnar arch/x86/mm/tlb.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 5f1e4f78d034c849ab516a7e5d45475b95eb9a13 Author: Toshi Kani Date: Thu Jul 16 17:23:15 2015 -0600 x86/mm: Remove region_is_ram() call from ioremap __ioremap_caller() calls region_is_ram() to walk through the iomem_resource table to check if a target range is in RAM, which was added to improve the lookup performance over page_is_ram() (commit 906e36c5c717 "x86: use optimized ioresource lookup in ioremap function"). page_is_ram() was no longer used when this change was added, though. __ioremap_caller() then calls walk_system_ram_range(), which had replaced page_is_ram() to improve the lookup performance (commit c81c8a1eeede "x86, ioremap: Speed up check for RAM pages"). Since both checks walk through the same iomem_resource table for the same purpose, there is no need to call both functions. Aside of that walk_system_ram_range() is the only useful check at the moment because region_is_ram() always returns -1 due to an implementation bug. That bug in region_is_ram() cannot be fixed without breaking existing ioremap callers, which rely on the subtle difference of walk_system_ram_range() versus non page aligned ranges. Once these offending callers are fixed we can use region_is_ram() and remove walk_system_ram_range(). [ tglx: Massaged changelog ] Signed-off-by: Toshi Kani Reviewed-by: Dan Williams Cc: Roland Dreier Cc: Mike Travis Cc: Luis R. Rodriguez Cc: H. Peter Anvin Cc: Ingo Molnar Cc: Borislav Petkov Cc: linux-mm@kvack.org Link: http://lkml.kernel.org/r/1437088996-28511-3-git-send-email-toshi.kani@hp.com Signed-off-by: Thomas Gleixner arch/x86/mm/ioremap.c | 24 ++++++------------------ 1 files changed, 6 insertions(+), 18 deletions(-) commit 4eed17a1f681e80501895c461980734de2bf0c26 Author: Toshi Kani Date: Thu Jul 16 17:23:14 2015 -0600 x86/mm: Move warning from __ioremap_check_ram() to the call site __ioremap_check_ram() has a WARN_ONCE() which is emitted when the given pfn range is not RAM. The warning is bogus in two aspects: - it never triggers since walk_system_ram_range() only calls __ioremap_check_ram() for RAM ranges. - the warning message is wrong as it says: "ioremap on RAM' after it established that the pfn range is not RAM. Move the WARN_ONCE() to __ioremap_caller(), and update the message to include the address range so we get an actual warning when something tries to ioremap system RAM. [ tglx: Massaged changelog ] Signed-off-by: Toshi Kani Reviewed-by: Dan Williams Cc: Roland Dreier Cc: Luis R. Rodriguez Cc: H. Peter Anvin Cc: Ingo Molnar Cc: Borislav Petkov Cc: linux-mm@kvack.org Link: http://lkml.kernel.org/r/1437088996-28511-2-git-send-email-toshi.kani@hp.com Signed-off-by: Thomas Gleixner arch/x86/mm/ioremap.c | 7 ++++--- 1 files changed, 4 insertions(+), 3 deletions(-) commit 9af4e75578b65827a05cae89a9cdb77d6caef754 Author: Toshi Kani Date: Thu Jul 16 17:23:16 2015 -0600 mm: Fix bugs in region_is_ram() region_is_ram() looks up the iomem_resource table to check if a target range is in RAM. However, it always returns with -1 due to invalid range checks. It always breaks the loop at the first entry of the table. Another issue is that it compares p->flags and flags, but it always fails. flags is declared as int, which makes it as a negative value with IORESOURCE_BUSY (0x80000000) set while p->flags is unsigned long. Fix the range check and flags so that region_is_ram() works as advertised. Signed-off-by: Toshi Kani Reviewed-by: Dan Williams Cc: Mike Travis Cc: Luis R. Rodriguez Cc: Andrew Morton Cc: Roland Dreier Cc: linux-mm@kvack.org Link: http://lkml.kernel.org/r/1437088996-28511-4-git-send-email-toshi.kani@hp.com Signed-off-by: Thomas Gleixner kernel/resource.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) commit db002defded430624dbef2561ceb76501c8f956b Author: Tomas Winkler Date: Thu Jun 18 11:41:03 2015 +0300 mei: prevent unloading mei hw modules while the device is opened. chrdev_open() increases reference counter on cdev->owner. Instead of assigning the owner to mei subsystem, the owner has to be set to the underlaying HW module (mei_me or mei_txe), so once the device is opened the HW module cannot be unloaded. Cc: #3.17+ Signed-off-by: Tomas Winkler Signed-off-by: Alexander Usyskin Signed-off-by: Greg Kroah-Hartman drivers/misc/mei/main.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 426a498250be1cf7eb47a4b211754eac4c856fc9 Author: Steven Rostedt (Red Hat) Date: Fri Jul 24 10:38:12 2015 -0400 ftrace: Fix breakage of set_ftrace_pid Commit 4104d326b670 ("ftrace: Remove global function list and call function directly") simplified the ftrace code by removing the global_ops list with a new design. But this cleanup also broke the filtering of PIDs that are added to the set_ftrace_pid file. Add back the proper hooks to have pid filtering working once again. Cc: stable@vger.kernel.org # 3.16+ Reported-by: Matt Fleming Reported-by: Richard Weinberger Tested-by: Matt Fleming Signed-off-by: Steven Rostedt include/linux/ftrace.h | 3 ++ kernel/trace/ftrace.c | 52 +++++++++++++++++++++++++++++++---------------- 2 files changed, 37 insertions(+), 18 deletions(-) commit ecf07c60ecb962a459c5b466cafc51be06433e4d Author: Matt Fleming Date: Tue Jul 21 15:55:09 2015 +0100 perf/x86/intel/cqm: Return cached counter value from IRQ context Peter reported the following potential crash which I was able to reproduce with his test program, [ 148.765788] ------------[ cut here ]------------ [ 148.765796] WARNING: CPU: 34 PID: 2840 at kernel/smp.c:417 smp_call_function_many+0xb6/0x260() [ 148.765797] Modules linked in: [ 148.765800] CPU: 34 PID: 2840 Comm: perf Not tainted 4.2.0-rc1+ #4 [ 148.765803] ffffffff81cdc398 ffff88085f105950 ffffffff818bdfd5 0000000000000007 [ 148.765805] 0000000000000000 ffff88085f105990 ffffffff810e413a 0000000000000000 [ 148.765807] ffffffff82301080 0000000000000022 ffffffff8107f640 ffffffff8107f640 [ 148.765809] Call Trace: [ 148.765810] [] dump_stack+0x45/0x57 [ 148.765818] [] warn_slowpath_common+0x8a/0xc0 [ 148.765822] [] ? intel_cqm_stable+0x60/0x60 [ 148.765824] [] ? intel_cqm_stable+0x60/0x60 [ 148.765825] [] warn_slowpath_null+0x1a/0x20 [ 148.765827] [] smp_call_function_many+0xb6/0x260 [ 148.765829] [] ? intel_cqm_stable+0x60/0x60 [ 148.765831] [] on_each_cpu_mask+0x28/0x60 [ 148.765832] [] intel_cqm_event_count+0x7f/0xe0 [ 148.765836] [] perf_output_read+0x2a5/0x400 [ 148.765839] [] perf_output_sample+0x31a/0x590 [ 148.765840] [] ? perf_prepare_sample+0x26d/0x380 [ 148.765841] [] perf_event_output+0x47/0x60 [ 148.765843] [] __perf_event_overflow+0x215/0x240 [ 148.765844] [] perf_event_overflow+0x14/0x20 [ 148.765847] [] intel_pmu_handle_irq+0x1d4/0x440 [ 148.765849] [] ? __perf_event_task_sched_in+0x36/0xa0 [ 148.765853] [] ? vunmap_page_range+0x19d/0x2f0 [ 148.765854] [] ? unmap_kernel_range_noflush+0x11/0x20 [ 148.765859] [] ? ghes_copy_tofrom_phys+0x11e/0x2a0 [ 148.765863] [] ? native_apic_msr_write+0x2b/0x30 [ 148.765865] [] ? x2apic_send_IPI_self+0x1d/0x20 [ 148.765869] [] ? arch_irq_work_raise+0x35/0x40 [ 148.765872] [] ? irq_work_queue+0x66/0x80 [ 148.765875] [] perf_event_nmi_handler+0x26/0x40 [ 148.765877] [] nmi_handle+0x79/0x100 [ 148.765879] [] default_do_nmi+0x42/0x100 [ 148.765880] [] do_nmi+0x83/0xb0 [ 148.765884] [] end_repeat_nmi+0x1e/0x2e [ 148.765886] [] ? __perf_event_task_sched_in+0x36/0xa0 [ 148.765888] [] ? __perf_event_task_sched_in+0x36/0xa0 [ 148.765890] [] ? __perf_event_task_sched_in+0x36/0xa0 [ 148.765891] <> [] finish_task_switch+0x156/0x210 [ 148.765898] [] __schedule+0x341/0x920 [ 148.765899] [] schedule+0x37/0x80 [ 148.765903] [] ? do_page_fault+0x2f/0x80 [ 148.765905] [] schedule_user+0x1a/0x50 [ 148.765907] [] retint_careful+0x14/0x32 [ 148.765908] ---[ end trace e33ff2be78e14901 ]--- The CQM task events are not safe to be called from within interrupt context because they require performing an IPI to read the counter value on all sockets. And performing IPIs from within IRQ context is a "no-no". Make do with the last read counter value currently event in event->count when we're invoked in this context. Reported-by: Peter Zijlstra Signed-off-by: Matt Fleming Cc: Thomas Gleixner Cc: Vikas Shivappa Cc: Kanaka Juvva Cc: Will Auld Cc: Link: http://lkml.kernel.org/r/1437490509-15373-1-git-send-email-matt@codeblueprint.co.uk Signed-off-by: Thomas Gleixner arch/x86/kernel/cpu/perf_event_intel_cqm.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) commit f0b71d674319afc7cd3d408a95c315ab9332fea6 Author: Nikolay Aleksandrov Date: Thu Jul 23 12:05:40 2015 +0200 inet: frags: remove INET_FRAG_EVICTED and use list_evictor for the test We can simply remove the INET_FRAG_EVICTED flag to avoid all the flags race conditions with the evictor and use a participation test for the evictor list, when we're at that point (after inet_frag_kill) in the timer there're 2 possible cases: 1. The evictor added the entry to its evictor list while the timer was waiting for the chainlock or 2. The timer unchained the entry and the evictor won't see it In both cases we should be able to see list_evictor correctly due to the sync on the chainlock. Joint work with Florian Westphal. Tested-by: Frank Schreuder Signed-off-by: Nikolay Aleksandrov Signed-off-by: Florian Westphal Signed-off-by: David S. Miller include/net/inet_frag.h | 7 +++++-- net/ipv4/inet_fragment.c | 1 - net/ipv4/ip_fragment.c | 2 +- net/ipv6/reassembly.c | 2 +- 4 files changed, 7 insertions(+), 5 deletions(-) commit 5bab758a94075d04d16c2e693620149e80c80a6b Author: Florian Westphal Date: Thu Jul 23 12:05:39 2015 +0200 inet: frag: don't wait for timer deletion when evicting Frank reports 'NMI watchdog: BUG: soft lockup' errors when load is high. Instead of (potentially) unbounded restarts of the eviction process, just skip to the next entry. One caveat is that, when a netns is exiting, a timer may still be running by the time inet_evict_bucket returns. We use the frag memory accounting to wait for outstanding timers, so that when we free the percpu counter we can be sure no running timer will trip over it. Reported-and-tested-by: Frank Schreuder Signed-off-by: Florian Westphal Signed-off-by: David S. Miller net/ipv4/inet_fragment.c | 29 +++++++++++------------------ 1 files changed, 11 insertions(+), 18 deletions(-) commit 243266640fe195843ebaf0f06f00b81861d79083 Author: Florian Westphal Date: Thu Jul 23 12:05:38 2015 +0200 inet: frag: change *_frag_mem_limit functions to take netns_frags as argument Followup patch will call it after inet_frag_queue was freed, so q->net doesn't work anymore (but netf = q->net; free(q); mem_limit(netf) would). Tested-by: Frank Schreuder Signed-off-by: Florian Westphal Signed-off-by: David S. Miller include/net/inet_frag.h | 8 ++++---- net/ieee802154/6lowpan/reassembly.c | 6 +++--- net/ipv4/inet_fragment.c | 4 ++-- net/ipv4/ip_fragment.c | 10 +++++----- net/ipv6/netfilter/nf_conntrack_reasm.c | 6 +++--- net/ipv6/reassembly.c | 6 +++--- 6 files changed, 20 insertions(+), 20 deletions(-) commit 980c50f6c86defb6bc40d7912008fb5d7057b345 Author: Florian Westphal Date: Thu Jul 23 12:05:37 2015 +0200 inet: frag: don't re-use chainlist for evictor commit 65ba1f1ec0eff ("inet: frags: fix a race between inet_evict_bucket and inet_frag_kill") describes the bug, but the fix doesn't work reliably. Problem is that ->flags member can be set on other cpu without chainlock being held by that task, i.e. the RMW-Cycle can clear INET_FRAG_EVICTED bit after we put the element on the evictor private list. We can crash when walking the 'private' evictor list since an element can be deleted from list underneath the evictor. Join work with Nikolay Alexandrov. Fixes: b13d3cbfb8e8 ("inet: frag: move eviction of queues to work queue") Reported-by: Johan Schuijt Tested-by: Frank Schreuder Signed-off-by: Nikolay Alexandrov Signed-off-by: Florian Westphal Signed-off-by: David S. Miller include/net/inet_frag.h | 2 ++ net/ipv4/inet_fragment.c | 8 +++----- 2 files changed, 5 insertions(+), 5 deletions(-) commit 18dbb7c79efd6ad05708d5015e9ba1013b5e8d78 Author: Johan Hedberg Date: Mon Jul 20 20:31:25 2015 +0300 Bluetooth: Fix NULL pointer dereference in smp_conn_security The l2cap_conn->smp pointer may be NULL for various valid reasons where SMP has failed to initialize properly. One such scenario is when crypto support is missing, another when the adapter has been powered on through a legacy method. The smp_conn_security() function should have the appropriate check for this situation to avoid NULL pointer dereferences. Signed-off-by: Johan Hedberg Signed-off-by: Marcel Holtmann Cc: stable@vger.kernel.org # 4.0+ net/bluetooth/smp.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) commit f7806e7d24320350c2673c37682a4ebcede48fbb Merge: 7da4469 9188503 Author: Brad Spengler Date: Sun Jul 26 19:15:42 2015 -0400 Merge branch 'pax-test' into grsec-test commit 918850373a254f92f9c146bcaa66ccbcc4da5aa2 Author: Brad Spengler Date: Sun Jul 26 19:15:21 2015 -0400 Update to pax-linux-4.1.3-test10.patch: - fixed compile errors on arm, reported by Michael Tremer - fixed the new pax_nouderef mechanism arch/arm/include/asm/cpuidle.h | 2 +- arch/arm/kernel/cpuidle.c | 2 +- arch/x86/include/asm/cpufeature.h | 1 + arch/x86/include/asm/mmu_context.h | 10 +++++----- arch/x86/include/asm/tlbflush.h | 20 +++++++++++--------- arch/x86/kernel/cpu/common.c | 2 ++ drivers/clk/clk-mux.c | 4 ++-- drivers/clk/samsung/clk.h | 2 +- drivers/gpio/gpio-omap.c | 2 +- drivers/gpu/drm/tegra/sor.c | 7 +++++-- drivers/scsi/be2iscsi/be_main.c | 2 +- include/linux/clk-provider.h | 6 +++--- init/main.c | 1 + 13 files changed, 35 insertions(+), 26 deletions(-) commit 7da446903dcd5e93faba1291772a19f3e0e1f261 Merge: 8fa9f45 47942a0 Author: Brad Spengler Date: Sun Jul 26 11:26:15 2015 -0400 Merge branch 'pax-test' into grsec-test commit 47942a0e37ae866e4a24bbd468fc1f6fe881589d Author: Brad Spengler Date: Sun Jul 26 11:25:51 2015 -0400 Update to pax-linux-4.1.3-test9.patch: - pax_nouderef no longer disables PCID/INVPCID so that they are still available in guest VMs - fixed userland crashes under amd64/UDEREF/KERNEXEC caused by an oversight while backporting the NMI fixes, reported by Victor, ajj146 and Nicolas Simond arch/x86/kernel/cpu/common.c | 31 ++++++++++++++++--------------- arch/x86/kernel/entry_64.S | 10 +++++++++- init/main.c | 2 -- 3 files changed, 25 insertions(+), 18 deletions(-) commit 8fa9f4585fd2d0f71bcf2f6472643f1bcfced4ef Author: Brad Spengler Date: Sat Jul 25 16:12:36 2015 -0400 Protect kexec_load_disabled as well, even though it's disabled under GRKERNSEC_KMEM already kernel/kexec.c | 2 +- kernel/sysctl.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit b16ef6f1b3f856c0fd8fad389ab82294dd34fb37 Author: Brad Spengler Date: Sat Jul 25 15:10:12 2015 -0400 Add additional missing Broadcom firmware firmware/Makefile | 1 + firmware/WHENCE | 1 + firmware/bnx2/bnx2-mips-06-6.2.3.fw.ihex | 5804 ++++++++++++++++++++++++++++++ 3 files changed, 5806 insertions(+), 0 deletions(-) commit dc3a346dcef9b4aec5c6529c786350da2e470aea Merge: 5523ddd 24124ed Author: Brad Spengler Date: Sat Jul 25 12:48:23 2015 -0400 Merge branch 'pax-test' into grsec-test commit 24124edb545ae3bdbd00f4f3657a0a30a883580f Author: Brad Spengler Date: Sat Jul 25 12:47:40 2015 -0400 Update to pax-linux-4.1.3-test8.patch: - backported the recent NMI fixes for CVE-2015-3290, CVE-2015-3291 and CVE-2015-5157, by Andy Lutomirski (https://git.kernel.org/cgit/linux/kernel/git/luto/linux.git/log/?h=x86/nmi-backport and http://seclists.org/oss-sec/2015/q3/168) arch/x86/kernel/entry_64.S | 314 +++++++++++++++++++++++++++++--------------- arch/x86/kernel/nmi.c | 139 +++++++++----------- 2 files changed, 267 insertions(+), 186 deletions(-) commit 5523ddde21cc0a2c16a0aed628e3488de0598f58 Author: Brad Spengler Date: Sat Jul 25 11:49:44 2015 -0400 compile fix kernel/sysctl.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) commit 4e0fa4c29dab6b0cf5e183d31b7f84dd83d86d9d Author: Brad Spengler Date: Sat Jul 25 11:28:15 2015 -0400 Implement modify_ldt sysctl toggle from https://lkml.org/lkml/2015/7/25/103, make it not depend on CONFIG_MODIFY_LDT_SYSCALL, force modify_ldt to off regardless of config setting if grsec is enabled (with the allowance to turn it on at runtime), and harden up the implementation a bit Documentation/sysctl/kernel.txt | 15 +++++++++++++++ arch/x86/Kconfig | 16 ++++++++++++++++ arch/x86/kernel/ldt.c | 18 ++++++++++++++++++ kernel/sysctl.c | 8 ++++++++ 4 files changed, 57 insertions(+), 0 deletions(-) commit 532568688f8e8535f3045cba322a8ecde5c47653 Author: Brad Spengler Date: Sat Jul 25 11:02:49 2015 -0400 compile fix grsecurity/grsec_sysctl.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 5e354cb8e19b2584a7b98bf998abb798cdc3a673 Author: Brad Spengler Date: Sat Jul 25 10:59:07 2015 -0400 compile fix include/linux/sysctl.h | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) commit ff2992ddd0298fb7a507e599be8240ab5f6b2503 Author: Brad Spengler Date: Sat Jul 25 10:50:51 2015 -0400 Add framework for having ambiently read-only sysctl variables. Add all grsecurity sysctl entries to it, as well as security-relevant upstream sysctl values (modules_disabled, kptr_restrict, etc) grsecurity/grsec_init.c | 104 ++++++++++++++++++++++---------------------- grsecurity/grsec_sysctl.c | 104 ++++++++++++++++++++++---------------------- include/linux/sysctl.h | 2 + kernel/events/core.c | 6 +- kernel/module.c | 2 +- kernel/printk/printk.c | 2 +- kernel/sysctl.c | 89 +++++++++++++++++++++++++++++++++++--- lib/vsprintf.c | 4 +- 8 files changed, 195 insertions(+), 118 deletions(-) commit d265460434f9f8ab420d67e961b5a80b3cd3dc82 Author: Alex Williamson Date: Tue Jul 14 14:48:53 2015 -0600 iommu/vt-d: Fix VM domain ID leak This continues the attempt to fix commit fb170fb4c548 ("iommu/vt-d: Introduce helper functions to make code symmetric for readability"). The previous attempt in commit 71684406905f ("iommu/vt-d: Detach domain *only* from attached iommus") overlooked the fact that dmar_domain.iommu_bmp gets cleared for VM domains when devices are detached: intel_iommu_detach_device domain_remove_one_dev_info domain_detach_iommu The domain is detached from the iommu, but the iommu is still attached to the domain, for whatever reason. Thus when we get to domain_exit(), we can't rely on iommu_bmp for VM domains to find the active iommus, we must check them all. Without that, the corresponding bit in intel_iommu.domain_ids doesn't get cleared and repeated VM domain creation and destruction will run out of domain IDs. Meanwhile we still can't call iommu_detach_domain() on arbitrary non-VM domains or we risk clearing in-use domain IDs, as 71684406905f attempted to address. It's tempting to modify iommu_detach_domain() to test the domain iommu_bmp, but the call ordering from domain_remove_one_dev_info() prevents it being able to work as fb170fb4c548 seems to have intended. Caching of unused VM domains on the iommu object seems to be the root of the problem, but this code is far too fragile for that kind of rework to be proposed for stable, so we simply revert this chunk to its state prior to fb170fb4c548. Fixes: fb170fb4c548 ("iommu/vt-d: Introduce helper functions to make code symmetric for readability") Fixes: 71684406905f ("iommu/vt-d: Detach domain *only* from attached iommus") Signed-off-by: Alex Williamson Cc: Jiang Liu Cc: stable@vger.kernel.org # v3.17+ Signed-off-by: Joerg Roedel drivers/iommu/intel-iommu.c | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-) commit 2a4ff00000e1d36651ec534b8ef59435b9798835 Author: Eric W. Biederman Date: Fri Jul 17 14:54:27 2015 -0500 mnt: In detach_mounts detach the appropriate unmounted mount The handling of in detach_mounts of unmounted but connected mounts is buggy and can lead to an infinite loop. Correct the handling of unmounted mounts in detach_mount. When the mountpoint of an unmounted but connected mount is connected to a dentry, and that dentry is deleted we need to disconnect that mount from the parent mount and the deleted dentry. Nothing changes for the unmounted and connected children. They can be safely ignored. Cc: stable@vger.kernel.org Fixes: ce07d891a0891d3c0d0c2d73d577490486b809e1 mnt: Honor MNT_LOCKED when detaching mounts Signed-off-by: "Eric W. Biederman" fs/namespace.c | 7 ++----- 1 files changed, 2 insertions(+), 5 deletions(-) commit 4056b87d96d91d73041c360e8260a4a7b6d803ca Author: Eric W. Biederman Date: Fri Jul 17 14:15:30 2015 -0500 mnt: Clarify and correct the disconnect logic in umount_tree rmdir mntpoint will result in an infinite loop when there is a mount locked on the mountpoint in another mount namespace. This is because the logic to test to see if a mount should be disconnected in umount_tree is buggy. Move the logic to decide if a mount should remain connected to it's mountpoint into it's own function disconnect_mount so that clarity of expression instead of terseness of expression becomes a virtue. When the conditions where it is invalid to leave a mount connected are first ruled out, the logic for deciding if a mount should be disconnected becomes much clearer and simpler. Fixes: e0c9c0afd2fc958ffa34b697972721d81df8a56f mnt: Update detach_mounts to leave mounts connected Fixes: ce07d891a0891d3c0d0c2d73d577490486b809e1 mnt: Honor MNT_LOCKED when detaching mounts Cc: stable@vger.kernel.org Signed-off-by: "Eric W. Biederman" fs/namespace.c | 35 +++++++++++++++++++++++++++++++---- fs/pnode.h | 2 -- 2 files changed, 31 insertions(+), 6 deletions(-) commit beae0745e79a74772b8d9a0c4ece83d23d851716 Author: Nicolas Schichan Date: Tue Jul 21 14:14:12 2015 +0200 ARM: net: fix condition for load_order > 0 when translating load instructions. To check whether the load should take the fast path or not, the code would check that (r_skb_hlen - load_order) is greater than the offset of the access using an "Unsigned higher or same" condition. For halfword accesses and an skb length of 1 at offset 0, that test is valid, as we end up comparing 0xffffffff(-1) and 0, so the fast path is taken and the filter allows the load to wrongly succeed. A similar issue exists for word loads at offset 0 and an skb length of less than 4. Fix that by using the condition "Signed greater than or equal" condition for the fast path code for load orders greater than 0. Signed-off-by: Nicolas Schichan Signed-off-by: David S. Miller arch/arm/net/bpf_jit_32.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 36523ec244eb01a4fce02a1cbc0643eb80a55324 Author: Nicolas Schichan Date: Tue Jul 21 14:14:13 2015 +0200 ARM: net: handle negative offsets in BPF JIT. Previously, the JIT would reject negative offsets known during code generation and mishandle negative offsets provided at runtime. Fix that by calling bpf_internal_load_pointer_neg_helper() appropriately in the jit_get_skb_{b,h,w} slow path helpers and by forcing the execution flow to the slow path helpers when the offset is negative. Signed-off-by: Nicolas Schichan Signed-off-by: David S. Miller arch/arm/net/bpf_jit_32.c | 47 ++++++++++++++++++++++++++++++++++++-------- 1 files changed, 38 insertions(+), 9 deletions(-) commit 7202f5f549b01fe9fa5837c7102668895ea6916e Author: Nicolas Schichan Date: Tue Jul 21 14:14:14 2015 +0200 ARM: net: fix vlan access instructions in ARM JIT. This makes BPF_ANC | SKF_AD_VLAN_TAG and BPF_ANC | SKF_AD_VLAN_TAG_PRESENT have the same behaviour as the in kernel VM and makes the test_bpf LD_VLAN_TAG and LD_VLAN_TAG_PRESENT tests pass. Signed-off-by: Nicolas Schichan Signed-off-by: David S. Miller arch/arm/net/bpf_jit_32.c | 8 +++++--- 1 files changed, 5 insertions(+), 3 deletions(-) commit 87b1904179ce906f1d9926a19184f6e38448e527 Author: Konstantin Khlebnikov Date: Fri Jul 17 14:01:11 2015 +0300 net: ratelimit warnings about dst entry refcount underflow or overflow Kernel generates a lot of warnings when dst entry reference counter overflows and becomes negative. That bug was seen several times at machines with outdated 3.10.y kernels. Most like it's already fixed in upstream. Anyway that flood completely kills machine and makes further debugging impossible. Signed-off-by: Konstantin Khlebnikov Signed-off-by: David S. Miller net/core/dst.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) commit ba84fb968446cbe2499439d812ca80886a17d5c9 Author: Simon Guinot Date: Sun Jul 19 13:00:53 2015 +0200 net: mvneta: fix refilling for Rx DMA buffers With the actual code, if a memory allocation error happens while refilling a Rx descriptor, then the original Rx buffer is both passed to the networking stack (in a SKB) and let in the Rx ring. This leads to various kernel oops and crashes. As a fix, this patch moves Rx descriptor refilling ahead of building SKB with the associated Rx buffer. In case of a memory allocation failure, data is dropped and the original DMA buffer is put back into the Rx ring. Signed-off-by: Simon Guinot Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP network unit") Cc: # v3.8+ Tested-by: Yoann Sculo Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvneta.c | 22 ++++++++++------------ 1 files changed, 10 insertions(+), 12 deletions(-) commit b884f1d8eecd2404cf6f6dd1aba1ac0b93a37bca Author: Daniel Borkmann Date: Fri Jul 17 22:38:43 2015 +0200 sched: cls_bpf: fix panic on filter replace The following test case causes a NULL pointer dereference in cls_bpf: FOO="1,6 0 0 4294967295," tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 action ok tc filter replace dev foo parent 1: pref 49152 handle 0x1 \ bpf bytecode "$FOO" flowid 1:1 action drop The problem is that commit 1f947bf151e9 ("net: sched: rcu'ify cls_bpf") accidentally swapped the arguments of list_replace_rcu(), the old element needs to be the first argument and the new element the second. Fixes: 1f947bf151e9 ("net: sched: rcu'ify cls_bpf") Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller net/sched/cls_bpf.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit b7bc68bc309cdb7ad58f8e4ec6b5db95f921178b Author: Daniel Borkmann Date: Fri Jul 17 22:38:45 2015 +0200 sched: cls_flow: fix panic on filter replace The following test case causes a NULL pointer dereference in cls_flow: tc filter add dev foo parent 1: handle 0x1 flow hash keys dst action ok tc filter replace dev foo parent 1: pref 49152 handle 0x1 \ flow hash keys mark action drop To be more precise, actually two different panics are fixed, the first occurs because tcf_exts_init() is not called on the newly allocated filter when we do a replace. And the second panic uncovered after that happens since the arguments of list_replace_rcu() are swapped, the old element needs to be the first argument and the new element the second. Fixes: 70da9f0bf999 ("net: sched: cls_flow use RCU") Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Signed-off-by: David S. Miller net/sched/cls_flow.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) commit f17540910375d47fe675bc5f1080cac1418b7332 Author: Christophe Jaillet Date: Mon Jul 13 11:32:43 2015 +0200 parisc: mm: Fix a memory leak related to pmd not attached to the pgd Commit 0e0da48dee8d ("parisc: mm: don't count preallocated pmds") introduced a memory leak. After this commit, the 'return' statement in pmd_free is executed in all cases. Even for pmd that are not attached to the pgd. So 'free_pages' can never be called anymore, leading to a memory leak. Signed-off-by: Christophe JAILLET Acked-by: Kirill A. Shutemov Acked-by: Mikulas Patocka Acked-by: Helge Deller Cc: stable@vger.kernel.org # v4.0+ Signed-off-by: Helge Deller arch/parisc/include/asm/pgalloc.h | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) commit ad167680a92c235b342491acdde96e38987e6aa3 Author: Seymour, Shane M Date: Thu Jul 2 12:01:10 2015 +0000 st: null pointer dereference panic caused by use after kref_put by st_open Two SLES11 SP3 servers encountered similar crashes simultaneously following some kind of SAN/tape target issue: ... qla2xxx [0000:81:00.0]-801c:3: Abort command issued nexus=3:0:2 -- 1 2002. qla2xxx [0000:81:00.0]-801c:3: Abort command issued nexus=3:0:2 -- 1 2002. qla2xxx [0000:81:00.0]-8009:3: DEVICE RESET ISSUED nexus=3:0:2 cmd=ffff882f89c2c7c0. qla2xxx [0000:81:00.0]-800c:3: do_reset failed for cmd=ffff882f89c2c7c0. qla2xxx [0000:81:00.0]-800f:3: DEVICE RESET FAILED: Task management failed nexus=3:0:2 cmd=ffff882f89c2c7c0. qla2xxx [0000:81:00.0]-8009:3: TARGET RESET ISSUED nexus=3:0:2 cmd=ffff882f89c2c7c0. qla2xxx [0000:81:00.0]-800c:3: do_reset failed for cmd=ffff882f89c2c7c0. qla2xxx [0000:81:00.0]-800f:3: TARGET RESET FAILED: Task management failed nexus=3:0:2 cmd=ffff882f89c2c7c0. qla2xxx [0000:81:00.0]-8012:3: BUS RESET ISSUED nexus=3:0:2. qla2xxx [0000:81:00.0]-802b:3: BUS RESET SUCCEEDED nexus=3:0:2. qla2xxx [0000:81:00.0]-505f:3: Link is operational (8 Gbps). qla2xxx [0000:81:00.0]-8018:3: ADAPTER RESET ISSUED nexus=3:0:2. qla2xxx [0000:81:00.0]-00af:3: Performing ISP error recovery - ha=ffff88bf04d18000. rport-3:0-0: blocked FC remote port time out: removing target and saving binding qla2xxx [0000:81:00.0]-505f:3: Link is operational (8 Gbps). qla2xxx [0000:81:00.0]-8017:3: ADAPTER RESET SUCCEEDED nexus=3:0:2. rport-2:0-0: blocked FC remote port time out: removing target and saving binding sg_rq_end_io: device detached BUG: unable to handle kernel NULL pointer dereference at 00000000000002a8 IP: [] __pm_runtime_idle+0x28/0x90 PGD 7e6586f067 PUD 7e5af06067 PMD 0 [1739975.390354] Oops: 0002 [#1] SMP CPU 0 ... Supported: No, Proprietary modules are loaded [1739975.390463] Pid: 27965, comm: ABCD Tainted: PF X 3.0.101-0.29-default #1 HP ProLiant DL580 Gen8 RIP: 0010:[] [] __pm_runtime_idle+0x28/0x90 RSP: 0018:ffff8839dc1e7c68 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff883f0592fc00 RCX: 0000000000000090 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000138 RBP: 0000000000000138 R08: 0000000000000010 R09: ffffffff81bd39d0 R10: 00000000000009c0 R11: ffffffff81025790 R12: 0000000000000001 R13: ffff883022212b80 R14: 0000000000000004 R15: ffff883022212b80 FS: 00007f8e54560720(0000) GS:ffff88407f800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 00000000000002a8 CR3: 0000007e6ced6000 CR4: 00000000001407f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process ABCD (pid: 27965, threadinfo ffff8839dc1e6000, task ffff883592e0c640) Stack: ffff883f0592fc00 00000000fffffffa 0000000000000001 ffff883022212b80 ffff883eff772400 ffffffffa03fa309 0000000000000000 0000000000000000 ffffffffa04003a0 ffff883f063196c0 ffff887f0379a930 ffffffff8115ea1e Call Trace: [] st_open+0x129/0x240 [st] [] chrdev_open+0x13e/0x200 [] __dentry_open+0x198/0x310 [] do_last+0x1f4/0x800 [] path_openat+0xd9/0x420 [] do_filp_open+0x4c/0xc0 [] do_sys_open+0x17f/0x250 [] system_call_fastpath+0x16/0x1b [<00007f8e4f617fd0>] 0x7f8e4f617fcf Code: eb d3 90 48 83 ec 28 40 f6 c6 04 48 89 6c 24 08 4c 89 74 24 20 48 89 fd 48 89 1c 24 4c 89 64 24 10 41 89 f6 4c 89 6c 24 18 74 11 ff 8f 70 01 00 00 0f 94 c0 45 31 ed 84 c0 74 2b 4c 8d a5 a0 RIP [] __pm_runtime_idle+0x28/0x90 RSP CR2: 00000000000002a8 Analysis reveals the cause of the crash to be due to STp->device being NULL. The pointer was NULLed via scsi_tape_put(STp) when it calls scsi_tape_release(). In st_open() we jump to err_out after scsi_block_when_processing_errors() completes and returns the device as offline (sdev_state was SDEV_DEL): 1180 /* Open the device. Needs to take the BKL only because of incrementing the SCSI host 1181 module count. */ 1182 static int st_open(struct inode *inode, struct file *filp) 1183 { 1184 int i, retval = (-EIO); 1185 int resumed = 0; 1186 struct scsi_tape *STp; 1187 struct st_partstat *STps; 1188 int dev = TAPE_NR(inode); 1189 char *name; ... 1217 if (scsi_autopm_get_device(STp->device) < 0) { 1218 retval = -EIO; 1219 goto err_out; 1220 } 1221 resumed = 1; 1222 if (!scsi_block_when_processing_errors(STp->device)) { 1223 retval = (-ENXIO); 1224 goto err_out; 1225 } ... 1264 err_out: 1265 normalize_buffer(STp->buffer); 1266 spin_lock(&st_use_lock); 1267 STp->in_use = 0; 1268 spin_unlock(&st_use_lock); 1269 scsi_tape_put(STp); <-- STp->device = 0 after this 1270 if (resumed) 1271 scsi_autopm_put_device(STp->device); 1272 return retval; The ref count for the struct scsi_tape had already been reduced to 1 when the .remove method of the st module had been called. The kref_put() in scsi_tape_put() caused scsi_tape_release() to be called: 0266 static void scsi_tape_put(struct scsi_tape *STp) 0267 { 0268 struct scsi_device *sdev = STp->device; 0269 0270 mutex_lock(&st_ref_mutex); 0271 kref_put(&STp->kref, scsi_tape_release); <-- calls this 0272 scsi_device_put(sdev); 0273 mutex_unlock(&st_ref_mutex); 0274 } In scsi_tape_release() the struct scsi_device in the struct scsi_tape gets set to NULL: 4273 static void scsi_tape_release(struct kref *kref) 4274 { 4275 struct scsi_tape *tpnt = to_scsi_tape(kref); 4276 struct gendisk *disk = tpnt->disk; 4277 4278 tpnt->device = NULL; <<<---- where the dev is nulled 4279 4280 if (tpnt->buffer) { 4281 normalize_buffer(tpnt->buffer); 4282 kfree(tpnt->buffer->reserved_pages); 4283 kfree(tpnt->buffer); 4284 } 4285 4286 disk->private_data = NULL; 4287 put_disk(disk); 4288 kfree(tpnt); 4289 return; 4290 } Although the problem was reported on SLES11.3 the problem appears in linux-next as well. The crash is fixed by reordering the code so we no longer access the struct scsi_tape after the kref_put() is done on it in st_open(). Signed-off-by: Shane Seymour Signed-off-by: Darren Lavender Reviewed-by: Johannes Thumshirn Acked-by: Kai Mäkisara Cc: stable@vger.kernel.org Signed-off-by: James Bottomley drivers/scsi/st.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 17389660416307cfab2095080c1e4471ee804f99 Author: Nicolas Iooss Date: Fri Jul 17 16:23:42 2015 -0700 include, lib: add __printf attributes to several function prototypes Using __printf attributes helps to detect several format string issues at compile time (even though -Wformat-security is currently disabled in Makefile). For example it can detect when formatting a pointer as a number, like the issue fixed in commit a3fa71c40f18 ("wl18xx: show rx_frames_per_rates as an array as it really is"), or when the arguments do not match the format string, c.f. for example commit 5ce1aca81435 ("reiserfs: fix __RASSERT format string"). To prevent similar bugs in the future, add a __printf attribute to every function prototype which needs one in include/linux/ and lib/. These functions were mostly found by using gcc's -Wsuggest-attribute=format flag. Signed-off-by: Nicolas Iooss Cc: Greg Kroah-Hartman Cc: Felipe Balbi Cc: Joel Becker Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Conflicts: include/linux/clkdev.h include/linux/configfs.h include/linux/printk.h include/linux/clkdev.h | 5 +++-- include/linux/compat.h | 2 +- include/linux/configfs.h | 3 ++- include/linux/cpu.h | 7 ++++--- include/linux/dcache.h | 3 ++- include/linux/device.h | 15 +++++++-------- include/linux/iommu.h | 2 +- include/linux/kernel.h | 9 +++++---- include/linux/kobject.h | 5 +++-- include/linux/mmiotrace.h | 2 +- include/linux/printk.h | 6 +++--- lib/kobject.c | 5 +++-- 12 files changed, 35 insertions(+), 29 deletions(-) commit 41d349e4ee5c4982523f42946a91bb78aa2a7cf6 Author: Joonsoo Kim Date: Fri Jul 17 16:24:15 2015 -0700 mm/page_owner: fix possible access violation When I tested my new patches, I found that page pointer which is used for setting page_owner information is changed. This is because page pointer is used to set new migratetype in loop. After this work, page pointer could be out of bound. If this wrong pointer is used for page_owner, access violation happens. Below is error message that I got. BUG: unable to handle kernel paging request at 0000000000b00018 IP: [] save_stack_address+0x30/0x40 PGD 1af2d067 PUD 166e0067 PMD 0 Oops: 0002 [#1] SMP ...snip... Call Trace: print_context_stack+0xcf/0x100 dump_trace+0x15f/0x320 save_stack_trace+0x2f/0x50 __set_page_owner+0x46/0x70 __isolate_free_page+0x1f7/0x210 split_free_page+0x21/0xb0 isolate_freepages_block+0x1e2/0x410 compaction_alloc+0x22d/0x2d0 migrate_pages+0x289/0x8b0 compact_zone+0x409/0x880 compact_zone_order+0x6d/0x90 try_to_compact_pages+0x110/0x210 __alloc_pages_direct_compact+0x3d/0xe6 __alloc_pages_nodemask+0x6cd/0x9a0 alloc_pages_current+0x91/0x100 runtest_store+0x296/0xa50 simple_attr_write+0xbd/0xe0 __vfs_write+0x28/0xf0 vfs_write+0xa9/0x1b0 SyS_write+0x46/0xb0 system_call_fastpath+0x16/0x75 This patch fixes this error by moving up set_page_owner(). Signed-off-by: Joonsoo Kim Cc: Mel Gorman Cc: Vlastimil Babka Acked-by: Minchan Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) commit c7fc195271c087aaf6e7b9c19d632a03d0dcd44f Author: Joonsoo Kim Date: Fri Jul 17 16:24:20 2015 -0700 mm/cma_debug: fix debugging alloc/free interface CMA has alloc/free interface for debugging. It is intended that alloc/free occurs in specific CMA region, but, currently, alloc/free interface is on root dir due to the bug so we can't select CMA region where alloc/free happens. This patch fixes this problem by making alloc/free interface per CMA region. Signed-off-by: Joonsoo Kim Acked-by: Michal Nazarewicz Cc: Sasha Levin Cc: Stefan Strogin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/cma_debug.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit bdce4b16c357b6f1aa0de2ebc1e9e737de7b3835 Author: Joonsoo Kim Date: Fri Jul 17 16:24:23 2015 -0700 mm/cma_debug: correct size input to bitmap function In CMA, 1 bit in bitmap means 1 << order_per_bits pages so size of bitmap is cma->count >> order_per_bits rather than just cma->count. This patch fixes it. Signed-off-by: Joonsoo Kim Acked-by: Michal Nazarewicz Cc: Sasha Levin Cc: Stefan Strogin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/cma_debug.c | 7 ++++--- 1 files changed, 4 insertions(+), 3 deletions(-) commit 9fdcb2243392e451c0dead8c1056085cedc295d9 Author: Ming Lei Date: Thu Jul 16 19:53:22 2015 +0800 blk-mq: set default timeout as 30 seconds It is reasonable to set default timeout of request as 30 seconds instead of 30000 ticks, which may be 300 seconds if HZ is 100, for example, some arm64 based systems may choose 100 HZ. Signed-off-by: Ming Lei Fixes: c76cbbcf4044 ("blk-mq: put blk_queue_rq_timeout together in blk_mq_init_queue()" Signed-off-by: Jens Axboe block/blk-mq.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 1a4d0e757cc0e4685c9df14a70a1ac589f25a094 Author: WANG Cong Date: Tue Jul 14 16:35:54 2015 +0300 ipvlan: use rcu_deference_bh() in ipvlan_queue_xmit() In tx path rcu_read_lock_bh() is held, so we need rcu_deference_bh(). This fixes the following warning: =============================== [ INFO: suspicious RCU usage. ] 4.1.0-rc1+ #1007 Not tainted ------------------------------- drivers/net/ipvlan/ipvlan.h:106 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 1, debug_locks = 0 1 lock held by dhclient/1076: #0: (rcu_read_lock_bh){......}, at: [] rcu_lock_acquire+0x0/0x26 stack backtrace: CPU: 2 PID: 1076 Comm: dhclient Not tainted 4.1.0-rc1+ #1007 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 0000000000000001 ffff8800d381bac8 ffffffff81a4154f 000000003c1a3c19 ffff8800d4d0a690 ffff8800d381baf8 ffffffff810b849f ffff880117d41148 ffff880117d40000 ffff880117d40068 0000000000000156 ffff8800d381bb18 Call Trace: [] dump_stack+0x4c/0x65 [] lockdep_rcu_suspicious+0x107/0x110 [] ipvlan_port_get_rcu+0x47/0x4e [] ipvlan_queue_xmit+0x35/0x450 [] ? rcu_read_unlock+0x3e/0x5f [] ? local_clock+0x19/0x22 [] ? __lock_is_held+0x39/0x52 [] ipvlan_start_xmit+0x1b/0x44 [] dev_hard_start_xmit+0x2ae/0x467 [] __dev_queue_xmit+0x50a/0x60c [] dev_queue_xmit_sk+0x13/0x15 [] dev_queue_xmit+0x10/0x12 [] packet_sendmsg+0xb6b/0xbdf [] ? mark_lock+0x2e/0x226 [] ? sched_clock_cpu+0x9e/0xb7 [] sock_sendmsg_nosec+0x12/0x1d [] sock_sendmsg+0x29/0x2e [] sock_write_iter+0x70/0x91 [] __vfs_write+0x7e/0xa7 [] vfs_write+0x92/0xe8 [] SyS_write+0x47/0x7e [] system_call_fastpath+0x12/0x6f Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") Cc: Mahesh Bandewar Signed-off-by: Cong Wang Acked-by: Mahesh Bandewar Acked-by: Konstantin Khlebnikov Signed-off-by: David S. Miller drivers/net/ipvlan/ipvlan.h | 5 +++++ drivers/net/ipvlan/ipvlan_core.c | 2 +- 2 files changed, 6 insertions(+), 1 deletions(-) commit 748406865b681031a76395feff1a21c70becfbb0 Author: Alexei Starovoitov Date: Tue Jul 14 12:15:19 2015 -0700 tc: act_bpf: fix memory leak prog->bpf_ops is populated when act_bpf is used with classic BPF and prog->bpf_name is optionally used with extended BPF. Fix memory leak when act_bpf is released. Fixes: d23b8ad8ab23 ("tc: add BPF based action") Fixes: a8cb5f556b56 ("act_bpf: add initial eBPF support for actions") Acked-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Signed-off-by: David S. Miller net/sched/act_bpf.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) commit 2e4619c3f6717c3574c94203d4acf985b6edf05b Author: WANG Cong Date: Tue Jul 14 11:21:58 2015 -0700 fq_codel: fix return value of fq_codel_drop() The ->drop() is supposed to return the number of bytes it dropped, however fq_codel_drop() returns the index of the flow where it drops a packet from. Fix this by introducing a helper to wrap fq_codel_drop(). Cc: Eric Dumazet Signed-off-by: Cong Wang Signed-off-by: Cong Wang Acked-by: Eric Dumazet Signed-off-by: David S. Miller net/sched/sch_fq_codel.c | 11 ++++++++++- 1 files changed, 10 insertions(+), 1 deletions(-) commit 18294b99527edea4cba5cc5aca498d23eafaa81f Author: WANG Cong Date: Tue Jul 14 11:21:57 2015 -0700 net_sched: fix a use-after-free in sfq Fixes: 25331d6ce42b ("net: sched: implement qstat helper routines") Cc: John Fastabend Signed-off-by: Cong Wang Signed-off-by: Cong Wang Signed-off-by: David S. Miller net/sched/sch_sfq.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit c0cd739353abe2da2e9e08fef1f7ae4e6ae94a0f Author: WANG Cong Date: Mon Jul 13 12:30:07 2015 -0700 fq_codel: fix a use-after-free Fixes: 25331d6ce42b ("net: sched: implement qstat helper routines") Cc: John Fastabend Signed-off-by: Cong Wang Signed-off-by: Cong Wang Acked-by: Eric Dumazet Signed-off-by: David S. Miller net/sched/sch_fq_codel.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 5309e574e2fc2c9eb51e3c6d0c18b963e54b6af3 Author: Daniel Borkmann Date: Mon Jul 13 00:06:02 2015 +0200 rtnetlink: reject non-IFLA_VF_PORT attributes inside IFLA_VF_PORTS Similarly as in commit 4f7d2cdfdde7 ("rtnetlink: verify IFLA_VF_INFO attributes before passing them to driver"), we have a double nesting of netlink attributes, i.e. IFLA_VF_PORTS only contains IFLA_VF_PORT that is nested itself. While IFLA_VF_PORTS is a verified attribute from ifla_policy[], we only check if the IFLA_VF_PORTS container has IFLA_VF_PORT attributes and then pass the attribute's content itself via nla_parse_nested(). It would be more correct to reject inner types other than IFLA_VF_PORT instead of continuing parsing and also similarly as in commit 4f7d2cdfdde7, to check for a minimum of NLA_HDRLEN. Signed-off-by: Daniel Borkmann Cc: Roopa Prabhu Cc: Scott Feldman Cc: Jason Gunthorpe Acked-by: Roopa Prabhu Signed-off-by: David S. Miller net/core/rtnetlink.c | 11 +++++++---- 1 files changed, 7 insertions(+), 4 deletions(-) commit 60e851424772877a48d95b4614a35ca7f8922b02 Author: Herbert Xu Date: Mon Jul 13 16:04:13 2015 +0800 net: Clone skb before setting peeked flag Shared skbs must not be modified and this is crucial for broadcast and/or multicast paths where we use it as an optimisation to avoid unnecessary cloning. The function skb_recv_datagram breaks this rule by setting peeked without cloning the skb first. This causes funky races which leads to double-free. This patch fixes this by cloning the skb and replacing the skb in the list when setting skb->peeked. Fixes: a59322be07c9 ("[UDP]: Only increment counter on first peek/recv") Reported-by: Konstantin Khlebnikov Signed-off-by: Herbert Xu Signed-off-by: David S. Miller net/core/datagram.c | 41 ++++++++++++++++++++++++++++++++++++++--- 1 files changed, 38 insertions(+), 3 deletions(-) commit e8e18c6e6e66399c6c81847457e216931c78888a Author: Richard Stearn Date: Mon Jul 13 11:38:24 2015 +0200 NET: AX.25: Stop heartbeat timer on disconnect. This may result in a kernel panic. The bug has always existed but somehow we've run out of luck now and it bites. Signed-off-by: Richard Stearn Cc: stable@vger.kernel.org # all branches Signed-off-by: Ralf Baechle Signed-off-by: David S. Miller net/ax25/ax25_subr.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit 6091b9490e663f1eb1195581b3c93fc752014aeb Author: Herbert Xu Date: Mon Jul 13 20:01:42 2015 +0800 net: Fix skb csum races when peeking When we calculate the checksum on the recv path, we store the result in the skb as an optimisation in case we need the checksum again down the line. This is in fact bogus for the MSG_PEEK case as this is done without any locking. So multiple threads can peek and then store the result to the same skb, potentially resulting in bogus skb states. This patch fixes this by only storing the result if the skb is not shared. This preserves the optimisations for the few cases where it can be done safely due to locking or other reasons, e.g., SIOCINQ. Signed-off-by: Herbert Xu Acked-by: Eric Dumazet Signed-off-by: David S. Miller net/core/datagram.c | 15 +++++++++------ 1 files changed, 9 insertions(+), 6 deletions(-) commit 03c466bdf7bbedcd25ee0ec9c0292967b44cc477 Author: Dan Carpenter Date: Sun Jul 12 01:20:55 2015 +0300 net/xen-netback: off by one in BUG_ON() condition The > should be >=. I also added spaces around the '-' operations so the code is a little more consistent and matches the condition better. Fixes: f53c3fe8dad7 ('xen-netback: Introduce TX grant mapping') Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller drivers/net/xen-netback/netback.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) commit ed39de3e75da10b25c2bb469c3be5c09049474d0 Author: Neil Horman Date: Tue Jul 7 14:02:18 2015 -0400 vmxnet3: prevent receive getting out of sequence on napi poll vmxnet3's current napi path is built to count every rx descriptor we recieve, and use that as a count of the napi budget. That means its possible to return from a napi poll halfway through recieving a fragmented packet accross multiple dma descriptors. If that happens, the next napi poll will start with the descriptor ring in an improper state (e.g. the first descriptor we look at may have the end-of-packet bit set), which will cause a BUG halt in the driver. Fix the issue by only counting whole received packets in the napi poll and returning that value, rather than the descriptor count. Tested by the reporter and myself, successfully Signed-off-by: Neil Horman CC: Shreyas Bhatewara CC: "David S. Miller" Acked-by: Andy Gospodarek Signed-off-by: David S. Miller drivers/net/vmxnet3/vmxnet3_drv.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) commit 3892929957683de4df7b0e8a0c17d7ebd5ca3e4f Author: Johannes Thumshirn Date: Wed Jul 8 17:16:49 2015 +0200 macvtap: Destroy minor_idr on module_exit Destroy minor_idr on module_exit, reclaiming the allocated memory. This was detected by the following semantic patch (written by Luis Rodriguez ) @ defines_module_init @ declarer name module_init, module_exit; declarer name DEFINE_IDR; identifier init; @@ module_init(init); @ defines_module_exit @ identifier exit; @@ module_exit(exit); @ declares_idr depends on defines_module_init && defines_module_exit @ identifier idr; @@ DEFINE_IDR(idr); @ on_exit_calls_destroy depends on declares_idr && defines_module_exit @ identifier declares_idr.idr, defines_module_exit.exit; @@ exit(void) { ... idr_destroy(&idr); ... } @ missing_module_idr_destroy depends on declares_idr && defines_module_exit && !on_exit_calls_destroy @ identifier declares_idr.idr, defines_module_exit.exit; @@ exit(void) { ... +idr_destroy(&idr); } Signed-off-by: Johannes Thumshirn Signed-off-by: David S. Miller drivers/net/macvtap.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit ae8298739e89fcd27c26a55ee7633068ad39f201 Author: Vaishali Thakkar Date: Wed Jul 8 10:49:30 2015 +0530 net: systemport: Use eth_hw_addr_random Use eth_hw_addr_random() instead of calling random_ether_addr(). Here, this change is setting addr_assign_type to NET_ADDR_RANDOM. The Coccinelle semantic patch that performs this transformation is as follows: @@ identifier a,b; @@ -random_ether_addr(a->b); +eth_hw_addr_random(a); Signed-off-by: Vaishali Thakkar Tested-by: Florian Fainelli Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bcmsysport.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit eee71120eb1a9bb5289bba524cd8a1d3c86f7916 Author: Vutla, Lokesh Date: Thu Jul 2 18:33:28 2015 +0530 crypto: omap-des - Fix unmapping of dma channels dma_unmap_sg() is being called twice after completing the task. Looks like this is a copy paste error when creating des driver. With this the following warn appears during boot: [ 4.210457] ------------[ cut here ]------------ [ 4.215114] WARNING: CPU: 0 PID: 0 at lib/dma-debug.c:1080 check_unmap+0x710/0x9a0() [ 4.222899] omap-des 480a5000.des: DMA-API: device driver tries to free DMA memory it has not allocated [device address=0x00000000ab2ce000] [size=8 bytes] [ 4.236785] Modules linked in: [ 4.239860] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.14.39-02999-g1bc045a-dirty #182 [ 4.247918] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [ 4.255710] [] (show_stack) from [] (dump_stack+0x84/0xb8) [ 4.262977] [] (dump_stack) from [] (warn_slowpath_common+0x68/0x8c) [ 4.271107] [] (warn_slowpath_common) from [] (warn_slowpath_fmt+0x30/0x40) [ 4.279854] [] (warn_slowpath_fmt) from [] (check_unmap+0x710/0x9a0) [ 4.287991] [] (check_unmap) from [] (debug_dma_unmap_sg+0x90/0x19c) [ 4.296128] [] (debug_dma_unmap_sg) from [] (omap_des_done_task+0x1cc/0x3e4) [ 4.304963] [] (omap_des_done_task) from [] (tasklet_action+0x84/0x124) [ 4.313370] [] (tasklet_action) from [] (__do_softirq+0xf0/0x20c) [ 4.321235] [] (__do_softirq) from [] (irq_exit+0x98/0xec) [ 4.328500] [] (irq_exit) from [] (handle_IRQ+0x50/0xb0) [ 4.335589] [] (handle_IRQ) from [] (gic_handle_irq+0x28/0x5c) Removing the duplicate call to dma_unmap_sg(). Cc: stable@vger.kernel.org Reported-by: Tomi Valkeinen Signed-off-by: Lokesh Vutla Signed-off-by: Herbert Xu drivers/crypto/omap-des.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) commit 18664b993af1d940bc2fc3a440845840615d77ad Author: Al Viro Date: Sun Jul 12 10:34:29 2015 -0400 9p: don't leave a half-initialized inode sitting around Cc: stable@vger.kernel.org # all branches Signed-off-by: Al Viro fs/9p/vfs_inode.c | 3 +-- fs/9p/vfs_inode_dotl.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) commit 5490b434dd429b33e1c7eac3c19f0a8db54bd00e Author: Al Viro Date: Sun Jul 12 10:39:45 2015 -0400 fix a braino in ovl_d_select_inode() when opening a directory we want the overlayfs inode, not one from the topmost layer. Reported-By: Andrey Jr. Melnikov Tested-By: Andrey Jr. Melnikov Signed-off-by: Al Viro fs/overlayfs/inode.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) commit 36b84539390fc30663a7a026eef598c4656124bc Author: Al Viro Date: Wed Jul 8 02:42:38 2015 +0100 freeing unlinked file indefinitely delayed Normally opening a file, unlinking it and then closing will have the inode freed upon close() (provided that it's not otherwise busy and has no remaining links, of course). However, there's one case where that does *not* happen. Namely, if you open it by fhandle with cold dcache, then unlink() and close(). In normal case you get d_delete() in unlink(2) notice that dentry is busy and unhash it; on the final dput() it will be forcibly evicted from dcache, triggering iput() and inode removal. In this case, though, we end up with *two* dentries - disconnected (created by open-by-fhandle) and regular one (used by unlink()). The latter will have its reference to inode dropped just fine, but the former will not - it's considered hashed (it is on the ->s_anon list), so it will stay around until the memory pressure will finally do it in. As the result, we have the final iput() delayed indefinitely. It's trivial to reproduce - void flush_dcache(void) { system("mount -o remount,rw /"); } static char buf[20 * 1024 * 1024]; main() { int fd; union { struct file_handle f; char buf[MAX_HANDLE_SZ]; } x; int m; x.f.handle_bytes = sizeof(x); chdir("/root"); mkdir("foo", 0700); fd = open("foo/bar", O_CREAT | O_RDWR, 0600); close(fd); name_to_handle_at(AT_FDCWD, "foo/bar", &x.f, &m, 0); flush_dcache(); fd = open_by_handle_at(AT_FDCWD, &x.f, O_RDWR); unlink("foo/bar"); write(fd, buf, sizeof(buf)); system("df ."); /* 20Mb eaten */ close(fd); system("df ."); /* should've freed those 20Mb */ flush_dcache(); system("df ."); /* should be the same as #2 */ } will spit out something like Filesystem 1K-blocks Used Available Use% Mounted on /dev/root 322023 303843 1131 100% / Filesystem 1K-blocks Used Available Use% Mounted on /dev/root 322023 303843 1131 100% / Filesystem 1K-blocks Used Available Use% Mounted on /dev/root 322023 283282 21692 93% / - inode gets freed only when dentry is finally evicted (here we trigger than by remount; normally it would've happened in response to memory pressure hell knows when). Cc: stable@vger.kernel.org # v2.6.38+; earlier ones need s/kill_it/unhash_it/ Acked-by: J. Bruce Fields Signed-off-by: Al Viro fs/dcache.c | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) commit 96e42524166fe104eb4ce2337ec83d827c5a1f9b Author: Brad Spengler Date: Fri Jul 24 21:17:42 2015 -0400 cred_subscribers has to do with the ->cred and ->real_cred fields, not our delayed_cred field, so don't count it towards it to avoid a BUG() with DEBUG_CREDENTIALS enabled kernel/cred.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) commit 79a0711455de96f695e9eaf404a2e5e125ec918d Merge: 3aae0c0 b917aab Author: Brad Spengler Date: Fri Jul 24 07:30:44 2015 -0400 Merge branch 'pax-test' into grsec-test Conflicts: drivers/net/ethernet/amd/xgbe/xgbe-dev.c drivers/tty/serial/8250/8250_core.c fs/proc/generic.c commit b917aabeb2d7b2f8621726a3741a312141eb823e Merge: bd9c3c8 c8bde72 Author: Brad Spengler Date: Fri Jul 24 07:19:46 2015 -0400 Update to pax-linux-4.1.3-test7.patch: - fixed another silly copy-paste error that would hang the kernel with i386 userland on an amd64 kernel, reported by spender - fixed silly copy-paste error that would cause early boot crashes on !PCID systems - disable the use of __int128 when the size overflow plugin is enabled - fixed plugin compile errors due to the previous update to gcc-common.h - Emese fixed a size overflow false positive, reported by gaima (https://forums.grsecurity.net/viewtopic.php?f=3&t=4232) Merge branch 'linux-4.1.y' into pax-test Conflicts: include/linux/kmemleak.h commit 3aae0c06150f2d0edd5de7fdc451fcb9d92f6630 Author: Brad Spengler Date: Wed Jul 22 20:06:19 2015 -0400 fix label typo in PCID alternatives, from pipacs arch/x86/kernel/entry_64.S | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 4e8c0f54ad0df5a9bd15a8a7d9dd80dd8f9abbca Author: Brad Spengler Date: Sun Jul 12 11:12:01 2015 -0400 sm750 constify compile fix drivers/staging/sm750fb/sm750.c | 16 +++++++++++----- 1 files changed, 11 insertions(+), 5 deletions(-) commit 7b41532287be8596b40ff8a89260a2e77535ab6f Author: Brad Spengler Date: Sun Jul 12 10:33:11 2015 -0400 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 713 +++++++++++++++----- 1 files changed, 555 insertions(+), 158 deletions(-) commit 180d814a4601c8f53bb5147cfb902e79a1936e44 Author: Brad Spengler Date: Sun Jul 12 02:33:19 2015 -0400 serial constify compile fixes drivers/tty/serial/8250/8250_core.c | 8 +++++--- drivers/tty/serial/uartlite.c | 4 ++-- 2 files changed, 7 insertions(+), 5 deletions(-) commit 338a2a25ce91d3355a1534f889019f7769ca7ba2 Author: Brad Spengler Date: Sun Jul 12 02:05:44 2015 -0400 rtc constify compile fix drivers/rtc/rtc-test.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) commit 48cf6904def83d1dfd7131960f69c2088d96a8a8 Author: Brad Spengler Date: Sun Jul 12 01:45:49 2015 -0400 more amd xgbe constify compile fixes drivers/net/ethernet/amd/xgbe/xgbe-desc.c | 2 +- drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 4 ++-- drivers/net/ethernet/amd/xgbe/xgbe.h | 8 ++++---- 3 files changed, 7 insertions(+), 7 deletions(-) commit edb5beab2ed5cdc8b86cf2c00feded7b1ff7015a Author: Brad Spengler Date: Sun Jul 12 01:26:30 2015 -0400 hid sensor constify compile fix drivers/hid/hid-sensor-custom.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit 6426185a4a34d7fcdaad8affcf163378bc2f44a0 Author: Brad Spengler Date: Sun Jul 12 01:15:39 2015 -0400 hid sensor constify fix drivers/hid/hid-sensor-custom.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit d1a8ca75a5391570183688fc7a769a90ac09c49f Author: Brad Spengler Date: Sun Jul 12 01:09:37 2015 -0400 constify compile fix on dsa_netdevice_nb net/dsa/dsa.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit b649e0688cb346fa71b84ff77dc52791c6d418ed Author: Brad Spengler Date: Sun Jul 12 00:57:38 2015 -0400 more amd xgbe compile fixes drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 2 +- drivers/net/ethernet/amd/xgbe/xgbe.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) commit b4a813cf341440108d351bcd8114d7d6656184dd Author: Brad Spengler Date: Sun Jul 12 00:42:04 2015 -0400 compile fixes for amd xgbe driver drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 144 +++++++++++++++--------------- 1 files changed, 72 insertions(+), 72 deletions(-) commit d78936ae01718c4f9a3dfe76cdbf4345df050d81 Author: Brad Spengler Date: Sun Jul 12 00:13:37 2015 -0400 compile fix grsecurity/gracl_fs.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) commit b7255f77200fb7b508be06c7b2dd3d1e3c403a5b Author: Brad Spengler Date: Sun Jul 12 00:07:19 2015 -0400 compile fix and fix tracefs const modification fs/tracefs/inode.c | 6 ++++-- grsecurity/gracl.c | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-) commit 83873aba9c78a658e782ec826cbb5b0e671e4da9 Author: Brad Spengler Date: Sun Jul 12 00:02:28 2015 -0400 compile fix include/linux/capability.h | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) commit a24d90f1ab8314d612035d9fbf8d5de83a0818a8 Author: Brad Spengler Date: Sat Jul 11 23:56:19 2015 -0400 Initial import of grsecurity 3.1 for Linux 4.1 Documentation/dontdiff | 2 + Documentation/kernel-parameters.txt | 7 + Makefile | 18 +- arch/alpha/include/asm/cache.h | 4 +- arch/alpha/kernel/osf_sys.c | 12 +- arch/arm/Kconfig | 1 + arch/arm/include/asm/thread_info.h | 9 +- arch/arm/kernel/process.c | 4 +- arch/arm/kernel/ptrace.c | 9 + arch/arm/kernel/traps.c | 7 +- arch/arm/mm/Kconfig | 2 +- arch/arm/mm/fault.c | 40 +- arch/arm/mm/mmap.c | 8 +- arch/arm/net/bpf_jit_32.c | 4 + arch/avr32/include/asm/cache.h | 4 +- arch/blackfin/include/asm/cache.h | 3 +- arch/cris/include/arch-v10/arch/cache.h | 3 +- arch/cris/include/arch-v32/arch/cache.h | 3 +- arch/frv/include/asm/cache.h | 3 +- arch/frv/mm/elf-fdpic.c | 4 +- arch/hexagon/include/asm/cache.h | 6 +- arch/ia64/Kconfig | 1 + arch/ia64/include/asm/cache.h | 3 +- arch/ia64/kernel/sys_ia64.c | 2 + arch/ia64/mm/hugetlbpage.c | 2 + arch/m32r/include/asm/cache.h | 4 +- arch/m68k/include/asm/cache.h | 4 +- arch/metag/mm/hugetlbpage.c | 1 + arch/microblaze/include/asm/cache.h | 3 +- arch/mips/Kconfig | 1 + arch/mips/include/asm/cache.h | 3 +- arch/mips/include/asm/thread_info.h | 11 +- arch/mips/kernel/irq.c | 3 + arch/mips/kernel/ptrace.c | 9 + arch/mips/mm/mmap.c | 4 +- arch/mn10300/proc-mn103e010/include/proc/cache.h | 4 +- arch/mn10300/proc-mn2ws0050/include/proc/cache.h | 4 +- arch/openrisc/include/asm/cache.h | 4 +- arch/parisc/include/asm/cache.h | 5 +- arch/parisc/kernel/sys_parisc.c | 4 + arch/powerpc/Kconfig | 1 + arch/powerpc/include/asm/cache.h | 3 +- arch/powerpc/include/asm/thread_info.h | 5 +- arch/powerpc/kernel/Makefile | 2 + arch/powerpc/kernel/irq.c | 3 + arch/powerpc/kernel/process.c | 10 +- arch/powerpc/kernel/ptrace.c | 14 + arch/powerpc/kernel/traps.c | 5 + arch/powerpc/mm/slice.c | 2 +- arch/s390/include/asm/cache.h | 4 +- arch/score/include/asm/cache.h | 4 +- arch/sh/include/asm/cache.h | 3 +- arch/sh/mm/mmap.c | 6 +- arch/sparc/include/asm/cache.h | 4 +- arch/sparc/include/asm/pgalloc_64.h | 1 + arch/sparc/include/asm/thread_info_64.h | 8 +- arch/sparc/kernel/process_32.c | 6 +- arch/sparc/kernel/process_64.c | 8 +- arch/sparc/kernel/ptrace_64.c | 14 + arch/sparc/kernel/sys_sparc_64.c | 8 +- arch/sparc/kernel/syscalls.S | 8 +- arch/sparc/kernel/traps_32.c | 8 +- arch/sparc/kernel/traps_64.c | 28 +- arch/sparc/kernel/unaligned_64.c | 2 +- arch/sparc/mm/fault_64.c | 2 +- arch/sparc/mm/hugetlbpage.c | 15 +- arch/tile/Kconfig | 1 + arch/tile/include/asm/cache.h | 3 +- arch/tile/mm/hugetlbpage.c | 2 + arch/um/include/asm/cache.h | 3 +- arch/unicore32/include/asm/cache.h | 6 +- arch/x86/Kconfig | 5 + arch/x86/ia32/ia32_aout.c | 2 + arch/x86/include/asm/floppy.h | 20 +- arch/x86/include/asm/io.h | 2 +- arch/x86/include/asm/page.h | 12 +- arch/x86/include/asm/paravirt_types.h | 23 +- arch/x86/include/asm/processor.h | 2 +- arch/x86/include/asm/thread_info.h | 8 +- arch/x86/kernel/dumpstack.c | 10 +- arch/x86/kernel/dumpstack_32.c | 2 +- arch/x86/kernel/dumpstack_64.c | 2 +- arch/x86/kernel/entry_32.S | 2 +- arch/x86/kernel/entry_64.S | 2 +- arch/x86/kernel/espfix_64.c | 2 +- arch/x86/kernel/ioport.c | 13 + arch/x86/kernel/irq_32.c | 3 + arch/x86/kernel/irq_64.c | 4 + arch/x86/kernel/msr.c | 10 + arch/x86/kernel/ptrace.c | 28 + arch/x86/kernel/signal.c | 9 +- arch/x86/kernel/sys_i386_32.c | 9 +- arch/x86/kernel/sys_x86_64.c | 8 +- arch/x86/kernel/traps.c | 5 + arch/x86/kernel/verify_cpu.S | 1 + arch/x86/kernel/vm86_32.c | 16 + arch/x86/kvm/lapic.h | 2 +- arch/x86/lib/usercopy.c | 2 +- arch/x86/mm/fault.c | 12 +- arch/x86/mm/hugetlbpage.c | 15 +- arch/x86/mm/init.c | 66 +- arch/x86/mm/init_32.c | 6 +- arch/x86/net/bpf_jit_comp.c | 4 + arch/x86/platform/efi/efi_64.c | 2 +- arch/x86/xen/Kconfig | 1 + arch/xtensa/variants/dc232b/include/variant/core.h | 2 +- arch/xtensa/variants/fsf/include/variant/core.h | 3 +- drivers/acpi/acpica/hwxfsleep.c | 11 +- drivers/acpi/custom_method.c | 4 + drivers/block/cciss.h | 30 +- drivers/block/smart1,2.h | 40 +- drivers/cdrom/cdrom.c | 2 +- drivers/char/Kconfig | 4 +- drivers/char/genrtc.c | 1 + drivers/char/mem.c | 17 + drivers/char/random.c | 5 +- drivers/cpufreq/sparc-us3-cpufreq.c | 2 - drivers/firewire/ohci.c | 4 + drivers/gpu/drm/drm_context.c | 50 +- drivers/gpu/drm/drm_drv.c | 11 +- drivers/gpu/drm/drm_lock.c | 18 +- drivers/gpu/drm/i915/i915_dma.c | 2 + drivers/gpu/drm/nouveau/nouveau_drm.c | 3 +- drivers/gpu/drm/nouveau/nouveau_ttm.c | 30 +- drivers/gpu/drm/ttm/ttm_bo_manager.c | 10 +- drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 10 +- drivers/hid/hid-wiimote-debug.c | 2 +- drivers/infiniband/hw/nes/nes_cm.c | 22 +- drivers/iommu/amd_iommu.c | 14 +- drivers/isdn/gigaset/bas-gigaset.c | 32 +- drivers/isdn/gigaset/ser-gigaset.c | 32 +- drivers/isdn/gigaset/usb-gigaset.c | 32 +- drivers/isdn/i4l/isdn_concap.c | 6 +- drivers/isdn/i4l/isdn_x25iface.c | 16 +- drivers/md/raid5.c | 8 + drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +- drivers/media/radio/radio-cadet.c | 5 +- drivers/media/usb/dvb-usb/cinergyT2-core.c | 91 +- drivers/media/usb/dvb-usb/cinergyT2-fe.c | 182 +- drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 37 +- drivers/media/usb/dvb-usb/technisat-usb2.c | 75 +- drivers/message/fusion/mptbase.c | 9 + drivers/misc/sgi-xp/xp_main.c | 12 +- drivers/net/ethernet/brocade/bna/bna_enet.c | 8 +- drivers/net/wan/lmc/lmc_media.c | 97 +- drivers/net/wan/z85230.c | 24 +- drivers/net/wireless/zd1211rw/zd_usb.c | 2 +- drivers/nfc/st21nfca/st21nfca.c | 11 +- drivers/pci/proc.c | 9 + drivers/platform/x86/asus-wmi.c | 12 + drivers/rtc/rtc-dev.c | 3 + drivers/scsi/bfa/bfa_fcs.c | 19 +- drivers/scsi/bfa/bfa_fcs_lport.c | 29 +- drivers/scsi/bfa/bfa_modules.h | 12 +- drivers/scsi/hpsa.h | 40 +- drivers/staging/lustre/lustre/ldlm/ldlm_flock.c | 2 +- drivers/staging/lustre/lustre/libcfs/module.c | 10 +- drivers/tty/sysrq.c | 2 +- drivers/tty/vt/keyboard.c | 22 +- drivers/uio/uio.c | 6 +- drivers/usb/core/hub.c | 5 + drivers/usb/gadget/configfs.c | 2 +- drivers/usb/gadget/function/f_uac1.c | 1 + drivers/usb/gadget/function/u_uac1.c | 1 + drivers/usb/host/hwa-hc.c | 9 +- drivers/video/fbdev/arcfb.c | 2 +- drivers/video/fbdev/matrox/matroxfb_DAC1064.c | 10 +- drivers/video/fbdev/matrox/matroxfb_Ti3026.c | 5 +- drivers/video/fbdev/sh_mobile_lcdcfb.c | 6 +- drivers/video/logo/logo_linux_clut224.ppm | 2720 ++++----- drivers/xen/xenfs/xenstored.c | 5 + firmware/Makefile | 1 + firmware/WHENCE | 19 +- firmware/bnx2/bnx2-mips-09-6.2.1b.fw.ihex | 6496 ++++++++++++++++++++ fs/attr.c | 1 + fs/autofs4/waitq.c | 9 + fs/binfmt_aout.c | 7 + fs/binfmt_elf.c | 40 +- fs/compat.c | 20 +- fs/configfs/item.c | 4 +- fs/coredump.c | 17 +- fs/dcache.c | 3 + fs/debugfs/inode.c | 11 +- fs/exec.c | 218 +- fs/ext2/balloc.c | 4 +- fs/ext2/super.c | 8 +- fs/ext3/balloc.c | 4 +- fs/ext3/super.c | 8 +- fs/ext4/balloc.c | 4 +- fs/fcntl.c | 4 + fs/fhandle.c | 3 +- fs/file.c | 4 + fs/filesystems.c | 4 + fs/fs_struct.c | 20 +- fs/hugetlbfs/inode.c | 5 +- fs/inode.c | 6 +- fs/kernfs/dir.c | 6 + fs/mount.h | 4 +- fs/namei.c | 240 +- fs/namespace.c | 24 + fs/nfsd/nfscache.c | 2 +- fs/open.c | 38 + fs/overlayfs/super.c | 6 +- fs/pipe.c | 2 +- fs/posix_acl.c | 15 +- fs/proc/Kconfig | 10 +- fs/proc/array.c | 66 +- fs/proc/base.c | 163 +- fs/proc/cmdline.c | 4 + fs/proc/devices.c | 4 + fs/proc/fd.c | 17 +- fs/proc/generic.c | 64 + fs/proc/inode.c | 17 + fs/proc/internal.h | 11 +- fs/proc/interrupts.c | 4 + fs/proc/kcore.c | 3 + fs/proc/proc_net.c | 31 + fs/proc/proc_sysctl.c | 52 +- fs/proc/root.c | 8 + fs/proc/stat.c | 69 +- fs/proc/task_mmu.c | 66 +- fs/readdir.c | 19 + fs/reiserfs/item_ops.c | 24 +- fs/reiserfs/super.c | 4 + fs/select.c | 2 + fs/seq_file.c | 37 +- fs/stat.c | 20 +- fs/sysfs/dir.c | 30 +- fs/utimes.c | 7 + fs/xattr.c | 26 +- grsecurity/Kconfig | 1182 ++++ grsecurity/Makefile | 54 + grsecurity/gracl.c | 2757 +++++++++ grsecurity/gracl_alloc.c | 105 + grsecurity/gracl_cap.c | 127 + grsecurity/gracl_compat.c | 269 + grsecurity/gracl_fs.c | 451 ++ grsecurity/gracl_ip.c | 386 ++ grsecurity/gracl_learn.c | 207 + grsecurity/gracl_policy.c | 1786 ++++++ grsecurity/gracl_res.c | 68 + grsecurity/gracl_segv.c | 304 + grsecurity/gracl_shm.c | 40 + grsecurity/grsec_chdir.c | 19 + grsecurity/grsec_chroot.c | 467 ++ grsecurity/grsec_disabled.c | 445 ++ grsecurity/grsec_exec.c | 189 + grsecurity/grsec_fifo.c | 26 + grsecurity/grsec_fork.c | 23 + grsecurity/grsec_init.c | 290 + grsecurity/grsec_ipc.c | 48 + grsecurity/grsec_link.c | 59 + grsecurity/grsec_log.c | 341 + grsecurity/grsec_mem.c | 48 + grsecurity/grsec_mount.c | 65 + grsecurity/grsec_pax.c | 45 + grsecurity/grsec_proc.c | 20 + grsecurity/grsec_ptrace.c | 30 + grsecurity/grsec_sig.c | 236 + grsecurity/grsec_sock.c | 244 + grsecurity/grsec_sysctl.c | 488 ++ grsecurity/grsec_time.c | 16 + grsecurity/grsec_tpe.c | 78 + grsecurity/grsec_usb.c | 15 + grsecurity/grsum.c | 64 + include/drm/drmP.h | 23 +- include/linux/binfmts.h | 5 +- include/linux/capability.h | 5 + include/linux/compiler-gcc4.h | 5 + include/linux/compiler-gcc5.h | 5 + include/linux/compiler.h | 8 + include/linux/configfs.h | 2 +- include/linux/cred.h | 8 +- include/linux/dcache.h | 5 +- include/linux/fs.h | 24 +- include/linux/fs_struct.h | 2 +- include/linux/fsnotify.h | 6 + include/linux/gracl.h | 342 + include/linux/gracl_compat.h | 156 + include/linux/gralloc.h | 9 + include/linux/grdefs.h | 140 + include/linux/grinternal.h | 230 + include/linux/grmsg.h | 118 + include/linux/grsecurity.h | 247 + include/linux/grsock.h | 19 + include/linux/ipc_namespace.h | 2 +- include/linux/kallsyms.h | 18 +- include/linux/kmod.h | 5 + include/linux/kobject.h | 2 +- include/linux/mm.h | 12 + include/linux/mm_types.h | 4 +- include/linux/module.h | 4 +- include/linux/mount.h | 2 +- include/linux/netfilter/xt_gradm.h | 9 + include/linux/path.h | 4 +- include/linux/perf_event.h | 13 +- include/linux/pid_namespace.h | 2 +- include/linux/printk.h | 2 +- include/linux/proc_fs.h | 22 +- include/linux/proc_ns.h | 2 +- include/linux/random.h | 2 +- include/linux/rbtree_augmented.h | 4 +- include/linux/scatterlist.h | 12 +- include/linux/sched.h | 104 +- include/linux/security.h | 3 +- include/linux/seq_file.h | 5 + include/linux/shm.h | 4 + include/linux/skbuff.h | 3 + include/linux/slab.h | 9 - include/linux/sysctl.h | 4 +- include/linux/thread_info.h | 6 +- include/linux/tty.h | 2 +- include/linux/tty_driver.h | 4 +- include/linux/uidgid.h | 5 + include/linux/user_namespace.h | 2 +- include/linux/utsname.h | 2 +- include/linux/vermagic.h | 16 +- include/linux/vmalloc.h | 4 + include/net/af_unix.h | 2 +- include/net/ip.h | 2 +- include/net/neighbour.h | 2 +- include/net/net_namespace.h | 2 +- include/net/sock.h | 2 +- include/trace/events/fs.h | 53 + include/uapi/drm/i915_drm.h | 1 + include/uapi/linux/personality.h | 1 + init/Kconfig | 3 +- init/main.c | 35 +- ipc/mqueue.c | 1 + ipc/shm.c | 23 + ipc/util.c | 6 + kernel/auditsc.c | 2 +- kernel/bpf/syscall.c | 8 +- kernel/capability.c | 41 +- kernel/cgroup.c | 5 +- kernel/compat.c | 1 + kernel/configs.c | 11 + kernel/cred.c | 113 +- kernel/events/core.c | 14 +- kernel/exit.c | 10 +- kernel/fork.c | 86 +- kernel/futex.c | 4 +- kernel/kallsyms.c | 9 + kernel/kcmp.c | 4 + kernel/kmod.c | 95 +- kernel/kprobes.c | 7 +- kernel/ksysfs.c | 2 + kernel/locking/lockdep_proc.c | 10 +- kernel/module.c | 106 +- kernel/panic.c | 4 +- kernel/pid.c | 19 +- kernel/power/Kconfig | 2 + kernel/printk/printk.c | 5 + kernel/ptrace.c | 20 +- kernel/resource.c | 10 + kernel/sched/core.c | 11 +- kernel/signal.c | 37 +- kernel/sys.c | 64 +- kernel/sysctl.c | 71 +- kernel/taskstats.c | 6 + kernel/time/posix-timers.c | 8 + kernel/time/time.c | 5 + kernel/time/timekeeping.c | 3 + kernel/time/timer_list.c | 12 + kernel/time/timer_stats.c | 10 +- kernel/trace/trace_events_filter.c | 6 + kernel/trace/trace_syscalls.c | 8 + kernel/user_namespace.c | 15 + lib/Kconfig.debug | 7 +- lib/is_single_threaded.c | 3 + lib/list_debug.c | 65 +- lib/nlattr.c | 2 + lib/rbtree.c | 4 +- lib/vsprintf.c | 37 +- localversion-grsec | 1 + mm/Kconfig | 5 +- mm/Kconfig.debug | 1 + mm/filemap.c | 1 + mm/kmemleak.c | 4 +- mm/memory.c | 2 +- mm/mempolicy.c | 12 +- mm/migrate.c | 3 +- mm/mlock.c | 6 +- mm/mmap.c | 93 +- mm/mprotect.c | 8 + mm/page_alloc.c | 2 +- mm/process_vm_access.c | 6 + mm/shmem.c | 2 +- mm/slab.c | 2 +- mm/slab_common.c | 2 +- mm/slub.c | 22 +- mm/util.c | 3 + mm/vmalloc.c | 72 +- mm/vmstat.c | 29 +- net/appletalk/atalk_proc.c | 2 +- net/atm/lec.c | 6 +- net/atm/mpoa_caches.c | 42 +- net/bridge/br_mdb.c | 2 + net/can/bcm.c | 2 +- net/can/proc.c | 2 +- net/core/dev_ioctl.c | 7 +- net/core/filter.c | 8 +- net/core/net-procfs.c | 17 +- net/core/pktgen.c | 2 +- net/core/sock.c | 3 +- net/core/sysctl_net_core.c | 2 +- net/decnet/dn_dev.c | 2 +- net/ipv4/devinet.c | 6 +- net/ipv4/inet_hashtables.c | 5 + net/ipv4/ip_input.c | 7 + net/ipv4/ip_sockglue.c | 3 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv4/route.c | 6 +- net/ipv4/tcp_input.c | 4 +- net/ipv4/tcp_ipv4.c | 24 +- net/ipv4/tcp_minisocks.c | 9 +- net/ipv4/tcp_timer.c | 11 + net/ipv4/udp.c | 24 + net/ipv6/addrconf.c | 13 +- net/ipv6/proc.c | 2 +- net/ipv6/tcp_ipv6.c | 23 +- net/ipv6/udp.c | 7 + net/ipx/ipx_proc.c | 2 +- net/irda/irproc.c | 2 +- net/llc/llc_proc.c | 2 +- net/netfilter/Kconfig | 10 + net/netfilter/Makefile | 1 + net/netfilter/nf_conntrack_core.c | 8 + net/netfilter/xt_gradm.c | 51 + net/netfilter/xt_hashlimit.c | 4 +- net/netfilter/xt_recent.c | 2 +- net/socket.c | 71 +- net/sunrpc/cache.c | 2 +- net/sunrpc/stats.c | 2 +- net/sysctl_net.c | 2 +- net/tipc/socket.c | 1 + net/unix/af_unix.c | 52 +- net/vmw_vsock/vmci_transport_notify.c | 30 +- net/vmw_vsock/vmci_transport_notify_qstate.c | 30 +- net/x25/sysctl_net_x25.c | 2 +- net/x25/x25_proc.c | 2 +- scripts/package/Makefile | 2 +- scripts/package/mkspec | 38 +- security/Kconfig | 369 +- security/apparmor/file.c | 4 +- security/apparmor/lsm.c | 8 +- security/commoncap.c | 29 + security/min_addr.c | 2 + security/selinux/hooks.c | 3 +- security/tomoyo/file.c | 12 +- security/tomoyo/mount.c | 4 + security/tomoyo/tomoyo.c | 20 +- security/yama/Kconfig | 2 +- sound/synth/emux/emux_seq.c | 14 +- sound/usb/line6/driver.c | 40 +- sound/usb/line6/toneport.c | 12 +- tools/gcc/.gitignore | 1 + tools/gcc/Makefile | 12 + tools/gcc/constify_plugin.c | 4 + tools/gcc/gen-random-seed.sh | 8 + tools/gcc/randomize_layout_plugin.c | 922 +++ tools/gcc/size_overflow_plugin/.gitignore | 2 + .../size_overflow_plugin/size_overflow_hash.data | 690 ++- 463 files changed, 26450 insertions(+), 2932 deletions(-) commit bd9c3c87dd1c7919cde1008efd963724d9a3752b Author: Brad Spengler Date: Sat Jul 11 19:14:11 2015 -0400 Initial import of pax-linux-4.1.2-test2.patch Documentation/dontdiff | 47 +- Documentation/kbuild/makefiles.txt | 39 +- Documentation/kernel-parameters.txt | 28 + Makefile | 108 +- arch/alpha/include/asm/atomic.h | 10 + arch/alpha/include/asm/elf.h | 7 + arch/alpha/include/asm/pgalloc.h | 6 + arch/alpha/include/asm/pgtable.h | 11 + arch/alpha/kernel/module.c | 2 +- arch/alpha/kernel/osf_sys.c | 8 +- arch/alpha/mm/fault.c | 141 +- arch/arm/Kconfig | 2 +- arch/arm/include/asm/atomic.h | 319 +- arch/arm/include/asm/barrier.h | 2 +- arch/arm/include/asm/cache.h | 5 +- arch/arm/include/asm/cacheflush.h | 2 +- arch/arm/include/asm/checksum.h | 14 +- arch/arm/include/asm/cmpxchg.h | 2 + arch/arm/include/asm/domain.h | 33 +- arch/arm/include/asm/elf.h | 9 +- arch/arm/include/asm/fncpy.h | 2 + arch/arm/include/asm/futex.h | 10 + arch/arm/include/asm/kmap_types.h | 2 +- arch/arm/include/asm/mach/dma.h | 2 +- arch/arm/include/asm/mach/map.h | 16 +- arch/arm/include/asm/outercache.h | 2 +- arch/arm/include/asm/page.h | 3 +- arch/arm/include/asm/pgalloc.h | 20 + arch/arm/include/asm/pgtable-2level-hwdef.h | 4 +- arch/arm/include/asm/pgtable-2level.h | 3 + arch/arm/include/asm/pgtable-3level.h | 3 + arch/arm/include/asm/pgtable.h | 54 +- arch/arm/include/asm/psci.h | 2 +- arch/arm/include/asm/smp.h | 2 +- arch/arm/include/asm/thread_info.h | 6 +- arch/arm/include/asm/tls.h | 3 + arch/arm/include/asm/uaccess.h | 96 +- arch/arm/include/uapi/asm/ptrace.h | 2 +- arch/arm/kernel/armksyms.c | 8 +- arch/arm/kernel/entry-armv.S | 110 +- arch/arm/kernel/entry-common.S | 40 +- arch/arm/kernel/entry-header.S | 60 + arch/arm/kernel/fiq.c | 3 + arch/arm/kernel/head.S | 2 +- arch/arm/kernel/module.c | 31 +- arch/arm/kernel/patch.c | 2 + arch/arm/kernel/process.c | 90 +- arch/arm/kernel/psci.c | 2 +- arch/arm/kernel/reboot.c | 1 + arch/arm/kernel/setup.c | 20 +- arch/arm/kernel/signal.c | 35 +- arch/arm/kernel/smp.c | 2 +- arch/arm/kernel/tcm.c | 4 +- arch/arm/kernel/traps.c | 6 +- arch/arm/kernel/vmlinux.lds.S | 6 +- arch/arm/kvm/arm.c | 10 +- arch/arm/lib/clear_user.S | 6 +- arch/arm/lib/copy_from_user.S | 6 +- arch/arm/lib/copy_page.S | 1 + arch/arm/lib/copy_to_user.S | 6 +- arch/arm/lib/csumpartialcopyuser.S | 4 +- arch/arm/lib/delay.c | 2 +- arch/arm/lib/uaccess_with_memcpy.c | 4 +- arch/arm/mach-exynos/suspend.c | 6 +- arch/arm/mach-keystone/keystone.c | 2 +- arch/arm/mach-mvebu/coherency.c | 4 +- arch/arm/mach-omap2/board-n8x0.c | 2 +- arch/arm/mach-omap2/omap-mpuss-lowpower.c | 4 +- arch/arm/mach-omap2/omap-smp.c | 1 + arch/arm/mach-omap2/omap-wakeupgen.c | 2 +- arch/arm/mach-omap2/omap_device.c | 4 +- arch/arm/mach-omap2/omap_device.h | 4 +- arch/arm/mach-omap2/omap_hwmod.c | 4 +- arch/arm/mach-omap2/powerdomains43xx_data.c | 5 +- arch/arm/mach-omap2/wd_timer.c | 6 +- arch/arm/mach-tegra/cpuidle-tegra20.c | 2 +- arch/arm/mach-tegra/irq.c | 1 + arch/arm/mach-ux500/pm.c | 1 + arch/arm/mach-ux500/setup.h | 7 - arch/arm/mach-zynq/platsmp.c | 1 + arch/arm/mm/Kconfig | 6 +- arch/arm/mm/alignment.c | 8 + arch/arm/mm/cache-l2x0.c | 2 +- arch/arm/mm/context.c | 10 +- arch/arm/mm/fault.c | 146 + arch/arm/mm/fault.h | 12 + arch/arm/mm/init.c | 39 + arch/arm/mm/ioremap.c | 4 +- arch/arm/mm/mmap.c | 30 +- arch/arm/mm/mmu.c | 182 +- arch/arm/net/bpf_jit_32.c | 3 + arch/arm/plat-iop/setup.c | 2 +- arch/arm/plat-omap/sram.c | 2 + arch/arm64/include/asm/atomic.h | 10 + arch/arm64/include/asm/barrier.h | 2 +- arch/arm64/include/asm/percpu.h | 8 +- arch/arm64/include/asm/pgalloc.h | 5 + arch/arm64/include/asm/uaccess.h | 1 + arch/arm64/mm/dma-mapping.c | 2 +- arch/avr32/include/asm/elf.h | 8 +- arch/avr32/include/asm/kmap_types.h | 4 +- arch/avr32/mm/fault.c | 27 + arch/frv/include/asm/atomic.h | 10 + arch/frv/include/asm/kmap_types.h | 2 +- arch/frv/mm/elf-fdpic.c | 3 +- arch/ia64/Makefile | 1 + arch/ia64/include/asm/atomic.h | 10 + arch/ia64/include/asm/barrier.h | 2 +- arch/ia64/include/asm/elf.h | 7 + arch/ia64/include/asm/pgalloc.h | 12 + arch/ia64/include/asm/pgtable.h | 13 +- arch/ia64/include/asm/spinlock.h | 2 +- arch/ia64/include/asm/uaccess.h | 27 +- arch/ia64/kernel/module.c | 45 +- arch/ia64/kernel/palinfo.c | 2 +- arch/ia64/kernel/sys_ia64.c | 7 + arch/ia64/kernel/vmlinux.lds.S | 2 +- arch/ia64/mm/fault.c | 32 +- arch/ia64/mm/init.c | 15 +- arch/m32r/lib/usercopy.c | 6 + arch/metag/include/asm/barrier.h | 2 +- arch/mips/cavium-octeon/dma-octeon.c | 2 +- arch/mips/include/asm/atomic.h | 355 +- arch/mips/include/asm/barrier.h | 2 +- arch/mips/include/asm/elf.h | 7 + arch/mips/include/asm/exec.h | 2 +- arch/mips/include/asm/hw_irq.h | 2 +- arch/mips/include/asm/local.h | 57 + arch/mips/include/asm/page.h | 2 +- arch/mips/include/asm/pgalloc.h | 5 + arch/mips/include/asm/pgtable.h | 3 + arch/mips/include/asm/uaccess.h | 1 + arch/mips/kernel/binfmt_elfn32.c | 7 + arch/mips/kernel/binfmt_elfo32.c | 7 + arch/mips/kernel/i8259.c | 2 +- arch/mips/kernel/irq-gt641xx.c | 2 +- arch/mips/kernel/irq.c | 6 +- arch/mips/kernel/pm-cps.c | 2 +- arch/mips/kernel/process.c | 12 - arch/mips/kernel/sync-r4k.c | 24 +- arch/mips/kernel/traps.c | 13 +- arch/mips/kvm/mips.c | 2 +- arch/mips/mm/fault.c | 25 + arch/mips/mm/mmap.c | 51 +- arch/mips/sgi-ip27/ip27-nmi.c | 6 +- arch/mips/sni/rm200.c | 2 +- arch/mips/vr41xx/common/icu.c | 2 +- arch/mips/vr41xx/common/irq.c | 4 +- arch/parisc/include/asm/atomic.h | 10 + arch/parisc/include/asm/elf.h | 7 + arch/parisc/include/asm/pgalloc.h | 6 + arch/parisc/include/asm/pgtable.h | 11 + arch/parisc/include/asm/uaccess.h | 4 +- arch/parisc/kernel/module.c | 50 +- arch/parisc/kernel/sys_parisc.c | 15 + arch/parisc/kernel/traps.c | 4 +- arch/parisc/mm/fault.c | 140 +- arch/powerpc/include/asm/atomic.h | 329 +- arch/powerpc/include/asm/barrier.h | 2 +- arch/powerpc/include/asm/elf.h | 12 + arch/powerpc/include/asm/exec.h | 2 +- arch/powerpc/include/asm/kmap_types.h | 2 +- arch/powerpc/include/asm/local.h | 46 + arch/powerpc/include/asm/mman.h | 2 +- arch/powerpc/include/asm/page.h | 8 +- arch/powerpc/include/asm/page_64.h | 7 +- arch/powerpc/include/asm/pgalloc-64.h | 7 + arch/powerpc/include/asm/pgtable.h | 1 + arch/powerpc/include/asm/pte-hash32.h | 1 + arch/powerpc/include/asm/reg.h | 1 + arch/powerpc/include/asm/smp.h | 2 +- arch/powerpc/include/asm/spinlock.h | 42 +- arch/powerpc/include/asm/uaccess.h | 141 +- arch/powerpc/kernel/Makefile | 5 + arch/powerpc/kernel/exceptions-64e.S | 4 +- arch/powerpc/kernel/exceptions-64s.S | 2 +- arch/powerpc/kernel/module_32.c | 15 +- arch/powerpc/kernel/process.c | 46 - arch/powerpc/kernel/signal_32.c | 2 +- arch/powerpc/kernel/signal_64.c | 2 +- arch/powerpc/kernel/traps.c | 21 + arch/powerpc/kernel/vdso.c | 5 +- arch/powerpc/kvm/powerpc.c | 2 +- arch/powerpc/lib/usercopy_64.c | 18 - arch/powerpc/mm/fault.c | 56 +- arch/powerpc/mm/mmap.c | 16 + arch/powerpc/mm/slice.c | 13 +- arch/powerpc/platforms/cell/spufs/file.c | 4 +- arch/s390/include/asm/atomic.h | 10 + arch/s390/include/asm/barrier.h | 2 +- arch/s390/include/asm/elf.h | 7 + arch/s390/include/asm/exec.h | 2 +- arch/s390/include/asm/uaccess.h | 13 +- arch/s390/kernel/module.c | 22 +- arch/s390/kernel/process.c | 24 - arch/s390/mm/mmap.c | 16 + arch/score/include/asm/exec.h | 2 +- arch/score/kernel/process.c | 5 - arch/sh/mm/mmap.c | 22 +- arch/sparc/include/asm/atomic_64.h | 110 +- arch/sparc/include/asm/barrier_64.h | 2 +- arch/sparc/include/asm/cache.h | 2 +- arch/sparc/include/asm/elf_32.h | 7 + arch/sparc/include/asm/elf_64.h | 7 + arch/sparc/include/asm/pgalloc_32.h | 1 + arch/sparc/include/asm/pgalloc_64.h | 1 + arch/sparc/include/asm/pgtable.h | 4 + arch/sparc/include/asm/pgtable_32.h | 15 +- arch/sparc/include/asm/pgtsrmmu.h | 5 + arch/sparc/include/asm/setup.h | 4 +- arch/sparc/include/asm/spinlock_64.h | 35 +- arch/sparc/include/asm/thread_info_32.h | 1 + arch/sparc/include/asm/thread_info_64.h | 2 + arch/sparc/include/asm/uaccess.h | 1 + arch/sparc/include/asm/uaccess_32.h | 28 +- arch/sparc/include/asm/uaccess_64.h | 24 +- arch/sparc/kernel/Makefile | 2 +- arch/sparc/kernel/prom_common.c | 2 +- arch/sparc/kernel/smp_64.c | 8 +- arch/sparc/kernel/sys_sparc_32.c | 2 +- arch/sparc/kernel/sys_sparc_64.c | 52 +- arch/sparc/kernel/traps_64.c | 27 +- arch/sparc/lib/Makefile | 2 +- arch/sparc/lib/atomic_64.S | 57 +- arch/sparc/lib/ksyms.c | 6 +- arch/sparc/mm/Makefile | 2 +- arch/sparc/mm/fault_32.c | 292 + arch/sparc/mm/fault_64.c | 486 + arch/sparc/mm/hugetlbpage.c | 22 +- arch/sparc/mm/init_64.c | 10 +- arch/tile/include/asm/atomic_64.h | 10 + arch/tile/include/asm/uaccess.h | 4 +- arch/um/Makefile | 4 + arch/um/include/asm/kmap_types.h | 2 +- arch/um/include/asm/page.h | 3 + arch/um/include/asm/pgtable-3level.h | 1 + arch/um/kernel/process.c | 16 - arch/x86/Kconfig | 11 +- arch/x86/Kconfig.cpu | 6 +- arch/x86/Kconfig.debug | 4 +- arch/x86/Makefile | 13 +- arch/x86/boot/Makefile | 3 + arch/x86/boot/bitops.h | 4 +- arch/x86/boot/boot.h | 2 +- arch/x86/boot/compressed/Makefile | 3 + arch/x86/boot/compressed/efi_stub_32.S | 16 +- arch/x86/boot/compressed/efi_thunk_64.S | 4 +- arch/x86/boot/compressed/head_32.S | 4 +- arch/x86/boot/compressed/head_64.S | 12 +- arch/x86/boot/compressed/misc.c | 11 +- arch/x86/boot/cpucheck.c | 16 +- arch/x86/boot/header.S | 6 +- arch/x86/boot/memory.c | 2 +- arch/x86/boot/video-vesa.c | 1 + arch/x86/boot/video.c | 2 +- arch/x86/crypto/aes-x86_64-asm_64.S | 4 + arch/x86/crypto/aesni-intel_asm.S | 106 +- arch/x86/crypto/blowfish-x86_64-asm_64.S | 7 + arch/x86/crypto/camellia-aesni-avx-asm_64.S | 10 + arch/x86/crypto/camellia-aesni-avx2-asm_64.S | 10 + arch/x86/crypto/camellia-x86_64-asm_64.S | 7 + arch/x86/crypto/cast5-avx-x86_64-asm_64.S | 51 +- arch/x86/crypto/cast6-avx-x86_64-asm_64.S | 25 +- arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 4 +- arch/x86/crypto/ghash-clmulni-intel_asm.S | 4 + arch/x86/crypto/salsa20-x86_64-asm_64.S | 4 + arch/x86/crypto/serpent-avx-x86_64-asm_64.S | 9 + arch/x86/crypto/serpent-avx2-asm_64.S | 9 + arch/x86/crypto/serpent-sse2-x86_64-asm_64.S | 4 + arch/x86/crypto/sha1_ssse3_asm.S | 10 +- arch/x86/crypto/sha256-avx-asm.S | 2 + arch/x86/crypto/sha256-avx2-asm.S | 2 + arch/x86/crypto/sha256-ssse3-asm.S | 2 + arch/x86/crypto/sha512-avx-asm.S | 2 + arch/x86/crypto/sha512-avx2-asm.S | 2 + arch/x86/crypto/sha512-ssse3-asm.S | 2 + arch/x86/crypto/twofish-avx-x86_64-asm_64.S | 25 +- arch/x86/crypto/twofish-x86_64-asm_64-3way.S | 4 + arch/x86/crypto/twofish-x86_64-asm_64.S | 3 + arch/x86/ia32/ia32_signal.c | 23 +- arch/x86/ia32/ia32entry.S | 164 +- arch/x86/ia32/sys_ia32.c | 4 +- arch/x86/include/asm/alternative-asm.h | 43 +- arch/x86/include/asm/alternative.h | 4 +- arch/x86/include/asm/apic.h | 2 +- arch/x86/include/asm/apm.h | 4 +- arch/x86/include/asm/atomic.h | 269 +- arch/x86/include/asm/atomic64_32.h | 100 + arch/x86/include/asm/atomic64_64.h | 164 +- arch/x86/include/asm/barrier.h | 4 +- arch/x86/include/asm/bitops.h | 18 +- arch/x86/include/asm/boot.h | 7 +- arch/x86/include/asm/cache.h | 5 +- arch/x86/include/asm/calling.h | 92 +- arch/x86/include/asm/checksum_32.h | 12 +- arch/x86/include/asm/cmpxchg.h | 39 + arch/x86/include/asm/compat.h | 2 +- arch/x86/include/asm/cpufeature.h | 16 +- arch/x86/include/asm/desc.h | 78 +- arch/x86/include/asm/desc_defs.h | 6 + arch/x86/include/asm/div64.h | 2 +- arch/x86/include/asm/elf.h | 33 +- arch/x86/include/asm/emergency-restart.h | 2 +- arch/x86/include/asm/fpu-internal.h | 8 +- arch/x86/include/asm/futex.h | 14 +- arch/x86/include/asm/hw_irq.h | 4 +- arch/x86/include/asm/i8259.h | 2 +- arch/x86/include/asm/io.h | 21 +- arch/x86/include/asm/irqflags.h | 5 + arch/x86/include/asm/kprobes.h | 9 +- arch/x86/include/asm/local.h | 106 +- arch/x86/include/asm/mman.h | 15 + arch/x86/include/asm/mmu.h | 16 +- arch/x86/include/asm/mmu_context.h | 136 +- arch/x86/include/asm/module.h | 17 +- arch/x86/include/asm/nmi.h | 19 +- arch/x86/include/asm/page.h | 1 + arch/x86/include/asm/page_64.h | 8 +- arch/x86/include/asm/paravirt.h | 46 +- arch/x86/include/asm/paravirt_types.h | 15 +- arch/x86/include/asm/pgalloc.h | 23 + arch/x86/include/asm/pgtable-2level.h | 2 + arch/x86/include/asm/pgtable-3level.h | 4 + arch/x86/include/asm/pgtable.h | 128 +- arch/x86/include/asm/pgtable_32.h | 14 +- arch/x86/include/asm/pgtable_32_types.h | 15 +- arch/x86/include/asm/pgtable_64.h | 22 +- arch/x86/include/asm/pgtable_64_types.h | 5 + arch/x86/include/asm/pgtable_types.h | 26 +- arch/x86/include/asm/preempt.h | 2 +- arch/x86/include/asm/processor.h | 49 +- arch/x86/include/asm/ptrace.h | 13 +- arch/x86/include/asm/qrwlock.h | 4 +- arch/x86/include/asm/realmode.h | 4 +- arch/x86/include/asm/reboot.h | 10 +- arch/x86/include/asm/rmwcc.h | 84 +- arch/x86/include/asm/rwsem.h | 60 +- arch/x86/include/asm/segment.h | 27 +- arch/x86/include/asm/smap.h | 43 + arch/x86/include/asm/smp.h | 14 +- arch/x86/include/asm/stackprotector.h | 4 +- arch/x86/include/asm/stacktrace.h | 32 +- arch/x86/include/asm/switch_to.h | 4 +- arch/x86/include/asm/thread_info.h | 23 +- arch/x86/include/asm/tlbflush.h | 75 +- arch/x86/include/asm/uaccess.h | 192 +- arch/x86/include/asm/uaccess_32.h | 28 +- arch/x86/include/asm/uaccess_64.h | 169 +- arch/x86/include/asm/word-at-a-time.h | 2 +- arch/x86/include/asm/x86_init.h | 10 +- arch/x86/include/asm/xen/page.h | 2 +- arch/x86/include/asm/xsave.h | 14 +- arch/x86/include/uapi/asm/e820.h | 2 +- arch/x86/kernel/Makefile | 2 +- arch/x86/kernel/acpi/boot.c | 4 +- arch/x86/kernel/acpi/sleep.c | 4 + arch/x86/kernel/acpi/wakeup_32.S | 6 +- arch/x86/kernel/alternative.c | 88 +- arch/x86/kernel/apic/apic.c | 4 +- arch/x86/kernel/apic/apic_flat_64.c | 4 +- arch/x86/kernel/apic/apic_noop.c | 2 +- arch/x86/kernel/apic/bigsmp_32.c | 2 +- arch/x86/kernel/apic/io_apic.c | 8 +- arch/x86/kernel/apic/probe_32.c | 2 +- arch/x86/kernel/apic/vector.c | 4 +- arch/x86/kernel/apic/x2apic_cluster.c | 4 +- arch/x86/kernel/apic/x2apic_phys.c | 2 +- arch/x86/kernel/apic/x2apic_uv_x.c | 2 +- arch/x86/kernel/apm_32.c | 21 +- arch/x86/kernel/asm-offsets.c | 20 + arch/x86/kernel/asm-offsets_64.c | 1 + arch/x86/kernel/cpu/Makefile | 4 - arch/x86/kernel/cpu/amd.c | 2 +- arch/x86/kernel/cpu/common.c | 140 +- arch/x86/kernel/cpu/intel_cacheinfo.c | 14 +- arch/x86/kernel/cpu/mcheck/mce.c | 31 +- arch/x86/kernel/cpu/mcheck/p5.c | 3 + arch/x86/kernel/cpu/mcheck/winchip.c | 3 + arch/x86/kernel/cpu/microcode/core.c | 2 +- arch/x86/kernel/cpu/microcode/intel.c | 4 +- arch/x86/kernel/cpu/mtrr/main.c | 2 +- arch/x86/kernel/cpu/mtrr/mtrr.h | 2 +- arch/x86/kernel/cpu/perf_event.c | 8 +- arch/x86/kernel/cpu/perf_event_amd_iommu.c | 2 +- arch/x86/kernel/cpu/perf_event_intel.c | 6 +- arch/x86/kernel/cpu/perf_event_intel_bts.c | 6 +- arch/x86/kernel/cpu/perf_event_intel_cqm.c | 4 +- arch/x86/kernel/cpu/perf_event_intel_pt.c | 44 +- arch/x86/kernel/cpu/perf_event_intel_rapl.c | 2 +- arch/x86/kernel/cpu/perf_event_intel_uncore.c | 2 +- arch/x86/kernel/cpu/perf_event_intel_uncore.h | 2 +- arch/x86/kernel/cpuid.c | 2 +- arch/x86/kernel/crash_dump_64.c | 2 +- arch/x86/kernel/doublefault.c | 8 +- arch/x86/kernel/dumpstack.c | 24 +- arch/x86/kernel/dumpstack_32.c | 25 +- arch/x86/kernel/dumpstack_64.c | 62 +- arch/x86/kernel/e820.c | 4 +- arch/x86/kernel/early_printk.c | 1 + arch/x86/kernel/entry_32.S | 360 +- arch/x86/kernel/entry_64.S | 651 +- arch/x86/kernel/espfix_64.c | 13 +- arch/x86/kernel/ftrace.c | 18 +- arch/x86/kernel/head64.c | 13 +- arch/x86/kernel/head_32.S | 228 +- arch/x86/kernel/head_64.S | 149 +- arch/x86/kernel/i386_ksyms_32.c | 12 + arch/x86/kernel/i8259.c | 10 +- arch/x86/kernel/io_delay.c | 2 +- arch/x86/kernel/ioport.c | 2 +- arch/x86/kernel/irq.c | 8 +- arch/x86/kernel/irq_32.c | 45 +- arch/x86/kernel/jump_label.c | 8 +- arch/x86/kernel/kgdb.c | 21 +- arch/x86/kernel/kprobes/core.c | 28 +- arch/x86/kernel/kprobes/opt.c | 16 +- arch/x86/kernel/ksysfs.c | 2 +- arch/x86/kernel/ldt.c | 31 +- arch/x86/kernel/livepatch.c | 12 +- arch/x86/kernel/machine_kexec_32.c | 6 +- arch/x86/kernel/mcount_64.S | 19 +- arch/x86/kernel/module.c | 78 +- arch/x86/kernel/msr.c | 2 +- arch/x86/kernel/nmi.c | 34 +- arch/x86/kernel/nmi_selftest.c | 4 +- arch/x86/kernel/paravirt-spinlocks.c | 2 +- arch/x86/kernel/paravirt.c | 45 +- arch/x86/kernel/paravirt_patch_64.c | 8 + arch/x86/kernel/pci-calgary_64.c | 2 +- arch/x86/kernel/pci-iommu_table.c | 2 +- arch/x86/kernel/pci-swiotlb.c | 2 +- arch/x86/kernel/process.c | 56 +- arch/x86/kernel/process_32.c | 34 +- arch/x86/kernel/process_64.c | 20 +- arch/x86/kernel/ptrace.c | 20 +- arch/x86/kernel/pvclock.c | 8 +- arch/x86/kernel/reboot.c | 44 +- arch/x86/kernel/reboot_fixups_32.c | 2 +- arch/x86/kernel/relocate_kernel_64.S | 3 +- arch/x86/kernel/setup.c | 27 +- arch/x86/kernel/setup_percpu.c | 29 +- arch/x86/kernel/signal.c | 17 +- arch/x86/kernel/smp.c | 2 +- arch/x86/kernel/smpboot.c | 31 +- arch/x86/kernel/step.c | 10 +- arch/x86/kernel/sys_i386_32.c | 184 + arch/x86/kernel/sys_x86_64.c | 22 +- arch/x86/kernel/tboot.c | 14 +- arch/x86/kernel/time.c | 8 +- arch/x86/kernel/tls.c | 7 +- arch/x86/kernel/tracepoint.c | 4 +- arch/x86/kernel/traps.c | 53 +- arch/x86/kernel/tsc.c | 2 +- arch/x86/kernel/uprobes.c | 2 +- arch/x86/kernel/vm86_32.c | 6 +- arch/x86/kernel/vmlinux.lds.S | 147 +- arch/x86/kernel/vsyscall_64.c | 16 +- arch/x86/kernel/x8664_ksyms_64.c | 6 +- arch/x86/kernel/x86_init.c | 6 +- arch/x86/kernel/xsave.c | 10 +- arch/x86/kvm/cpuid.c | 21 +- arch/x86/kvm/emulate.c | 2 +- arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/paging_tmpl.h | 2 +- arch/x86/kvm/svm.c | 8 + arch/x86/kvm/vmx.c | 82 +- arch/x86/kvm/x86.c | 8 +- arch/x86/lguest/boot.c | 3 +- arch/x86/lib/atomic64_386_32.S | 164 + arch/x86/lib/atomic64_cx8_32.S | 104 +- arch/x86/lib/checksum_32.S | 100 +- arch/x86/lib/clear_page_64.S | 3 + arch/x86/lib/cmpxchg16b_emu.S | 3 + arch/x86/lib/copy_page_64.S | 18 +- arch/x86/lib/copy_user_64.S | 60 +- arch/x86/lib/copy_user_nocache_64.S | 14 + arch/x86/lib/csum-copy_64.S | 18 +- arch/x86/lib/csum-wrappers_64.c | 8 +- arch/x86/lib/getuser.S | 74 +- arch/x86/lib/insn.c | 8 +- arch/x86/lib/iomap_copy_64.S | 2 + arch/x86/lib/memcpy_64.S | 6 + arch/x86/lib/memmove_64.S | 3 +- arch/x86/lib/memset_64.S | 3 + arch/x86/lib/mmx_32.c | 243 +- arch/x86/lib/msr-reg.S | 2 + arch/x86/lib/putuser.S | 90 +- arch/x86/lib/rwsem.S | 6 +- arch/x86/lib/thunk_64.S | 2 + arch/x86/lib/usercopy_32.c | 357 +- arch/x86/lib/usercopy_64.c | 20 +- arch/x86/mm/Makefile | 4 + arch/x86/mm/extable.c | 25 +- arch/x86/mm/fault.c | 570 +- arch/x86/mm/gup.c | 6 +- arch/x86/mm/highmem_32.c | 4 + arch/x86/mm/hugetlbpage.c | 24 +- arch/x86/mm/init.c | 101 +- arch/x86/mm/init_32.c | 111 +- arch/x86/mm/init_64.c | 46 +- arch/x86/mm/iomap_32.c | 4 + arch/x86/mm/ioremap.c | 45 +- arch/x86/mm/kmemcheck/kmemcheck.c | 4 +- arch/x86/mm/mmap.c | 40 +- arch/x86/mm/mmio-mod.c | 10 +- arch/x86/mm/numa.c | 2 +- arch/x86/mm/pageattr.c | 33 +- arch/x86/mm/pat.c | 20 +- arch/x86/mm/pat_rbtree.c | 2 +- arch/x86/mm/pf_in.c | 10 +- arch/x86/mm/pgtable.c | 162 +- arch/x86/mm/pgtable_32.c | 3 + arch/x86/mm/physaddr.c | 4 +- arch/x86/mm/setup_nx.c | 7 + arch/x86/mm/tlb.c | 4 + arch/x86/mm/uderef_64.c | 37 + arch/x86/net/bpf_jit.S | 11 + arch/x86/net/bpf_jit_comp.c | 13 +- arch/x86/oprofile/backtrace.c | 6 +- arch/x86/oprofile/nmi_int.c | 8 +- arch/x86/oprofile/op_model_amd.c | 8 +- arch/x86/oprofile/op_model_ppro.c | 7 +- arch/x86/oprofile/op_x86_model.h | 2 +- arch/x86/pci/intel_mid_pci.c | 2 +- arch/x86/pci/irq.c | 8 +- arch/x86/pci/pcbios.c | 144 +- arch/x86/platform/efi/efi_32.c | 24 + arch/x86/platform/efi/efi_64.c | 26 +- arch/x86/platform/efi/efi_stub_32.S | 64 +- arch/x86/platform/efi/efi_stub_64.S | 2 + arch/x86/platform/intel-mid/intel-mid.c | 5 +- arch/x86/platform/intel-mid/intel_mid_weak_decls.h | 6 +- arch/x86/platform/intel-mid/mfld.c | 4 +- arch/x86/platform/intel-mid/mrfl.c | 2 +- arch/x86/platform/intel-quark/imr_selftest.c | 2 +- arch/x86/platform/olpc/olpc_dt.c | 2 +- arch/x86/power/cpu.c | 11 +- arch/x86/realmode/init.c | 10 +- arch/x86/realmode/rm/Makefile | 3 + arch/x86/realmode/rm/header.S | 4 +- arch/x86/realmode/rm/reboot.S | 4 + arch/x86/realmode/rm/trampoline_32.S | 12 +- arch/x86/realmode/rm/trampoline_64.S | 3 +- arch/x86/realmode/rm/wakeup_asm.S | 5 +- arch/x86/tools/Makefile | 2 +- arch/x86/tools/relocs.c | 94 +- arch/x86/um/mem_32.c | 2 +- arch/x86/um/tls_32.c | 2 +- arch/x86/vdso/Makefile | 2 +- arch/x86/vdso/vdso2c.h | 2 +- arch/x86/vdso/vdso32-setup.c | 1 + arch/x86/vdso/vma.c | 41 +- arch/x86/xen/enlighten.c | 50 +- arch/x86/xen/mmu.c | 17 +- arch/x86/xen/smp.c | 16 +- arch/x86/xen/xen-asm_32.S | 2 +- arch/x86/xen/xen-head.S | 11 + arch/x86/xen/xen-ops.h | 2 - block/bio.c | 4 +- block/blk-iopoll.c | 2 +- block/blk-map.c | 2 +- block/blk-softirq.c | 2 +- block/bsg.c | 12 +- block/compat_ioctl.c | 4 +- block/genhd.c | 9 +- block/partitions/efi.c | 8 +- block/scsi_ioctl.c | 29 +- crypto/cryptd.c | 4 +- crypto/pcrypt.c | 2 +- crypto/zlib.c | 4 +- drivers/acpi/apei/apei-internal.h | 2 +- drivers/acpi/apei/ghes.c | 4 +- drivers/acpi/bgrt.c | 6 +- drivers/acpi/blacklist.c | 4 +- drivers/acpi/bus.c | 4 +- drivers/acpi/device_pm.c | 4 +- drivers/acpi/ec.c | 2 +- drivers/acpi/pci_slot.c | 2 +- drivers/acpi/processor_driver.c | 2 +- drivers/acpi/processor_idle.c | 2 +- drivers/acpi/processor_pdc.c | 2 +- drivers/acpi/sleep.c | 2 +- drivers/acpi/sysfs.c | 4 +- drivers/acpi/thermal.c | 2 +- drivers/acpi/video.c | 2 +- drivers/ata/libahci.c | 2 +- drivers/ata/libata-core.c | 12 +- drivers/ata/libata-scsi.c | 2 +- drivers/ata/libata.h | 2 +- drivers/ata/pata_arasan_cf.c | 4 +- drivers/atm/adummy.c | 2 +- drivers/atm/ambassador.c | 8 +- drivers/atm/atmtcp.c | 14 +- drivers/atm/eni.c | 10 +- drivers/atm/firestream.c | 8 +- drivers/atm/fore200e.c | 14 +- drivers/atm/he.c | 18 +- drivers/atm/horizon.c | 4 +- drivers/atm/idt77252.c | 36 +- drivers/atm/iphase.c | 34 +- drivers/atm/lanai.c | 12 +- drivers/atm/nicstar.c | 46 +- drivers/atm/solos-pci.c | 4 +- drivers/atm/suni.c | 4 +- drivers/atm/uPD98402.c | 16 +- drivers/atm/zatm.c | 6 +- drivers/base/bus.c | 4 +- drivers/base/devtmpfs.c | 8 +- drivers/base/node.c | 2 +- drivers/base/power/domain.c | 11 +- drivers/base/power/sysfs.c | 2 +- drivers/base/power/wakeup.c | 8 +- drivers/base/syscore.c | 4 +- drivers/block/cciss.c | 28 +- drivers/block/cciss.h | 2 +- drivers/block/cpqarray.c | 28 +- drivers/block/cpqarray.h | 2 +- drivers/block/drbd/drbd_bitmap.c | 2 +- drivers/block/drbd/drbd_int.h | 8 +- drivers/block/drbd/drbd_main.c | 12 +- drivers/block/drbd/drbd_nl.c | 4 +- drivers/block/drbd/drbd_receiver.c | 34 +- drivers/block/drbd/drbd_worker.c | 8 +- drivers/block/pktcdvd.c | 4 +- drivers/block/rbd.c | 2 +- drivers/bluetooth/btwilink.c | 2 +- drivers/cdrom/cdrom.c | 11 +- drivers/cdrom/gdrom.c | 1 - drivers/char/agp/compat_ioctl.c | 2 +- drivers/char/agp/frontend.c | 4 +- drivers/char/hpet.c | 2 +- drivers/char/i8k.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 8 +- drivers/char/ipmi/ipmi_si_intf.c | 8 +- drivers/char/mem.c | 47 +- drivers/char/nvram.c | 2 +- drivers/char/pcmcia/synclink_cs.c | 16 +- drivers/char/random.c | 12 +- drivers/char/sonypi.c | 11 +- drivers/char/tpm/tpm_acpi.c | 3 +- drivers/char/tpm/tpm_eventlog.c | 7 +- drivers/char/virtio_console.c | 4 +- drivers/clk/clk-composite.c | 2 +- drivers/clk/samsung/clk.h | 2 +- drivers/clk/socfpga/clk-gate.c | 9 +- drivers/clk/socfpga/clk-pll.c | 9 +- drivers/cpufreq/acpi-cpufreq.c | 17 +- drivers/cpufreq/cpufreq-dt.c | 4 +- drivers/cpufreq/cpufreq.c | 26 +- drivers/cpufreq/cpufreq_governor.c | 6 +- drivers/cpufreq/cpufreq_governor.h | 4 +- drivers/cpufreq/cpufreq_ondemand.c | 10 +- drivers/cpufreq/intel_pstate.c | 33 +- drivers/cpufreq/p4-clockmod.c | 12 +- drivers/cpufreq/sparc-us3-cpufreq.c | 67 +- drivers/cpufreq/speedstep-centrino.c | 7 +- drivers/cpuidle/driver.c | 2 +- drivers/cpuidle/governor.c | 2 +- drivers/cpuidle/sysfs.c | 2 +- drivers/crypto/hifn_795x.c | 4 +- drivers/devfreq/devfreq.c | 4 +- drivers/dma/sh/shdma-base.c | 4 +- drivers/dma/sh/shdmac.c | 2 +- drivers/edac/edac_device.c | 4 +- drivers/edac/edac_mc_sysfs.c | 2 +- drivers/edac/edac_pci.c | 4 +- drivers/edac/edac_pci_sysfs.c | 22 +- drivers/edac/mce_amd.h | 2 +- drivers/firewire/core-card.c | 6 +- drivers/firewire/core-device.c | 2 +- drivers/firewire/core-transaction.c | 1 + drivers/firewire/core.h | 1 + drivers/firmware/dmi-id.c | 2 +- drivers/firmware/efi/cper.c | 8 +- drivers/firmware/efi/efi.c | 12 +- drivers/firmware/efi/efivars.c | 2 +- drivers/firmware/efi/runtime-map.c | 2 +- drivers/firmware/google/gsmi.c | 2 +- drivers/firmware/google/memconsole.c | 7 +- drivers/firmware/memmap.c | 2 +- drivers/gpio/gpio-em.c | 2 +- drivers/gpio/gpio-ich.c | 2 +- drivers/gpio/gpio-omap.c | 2 +- drivers/gpio/gpio-rcar.c | 2 +- drivers/gpio/gpio-vr41xx.c | 2 +- drivers/gpio/gpiolib.c | 13 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.h | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.h | 2 +- drivers/gpu/drm/drm_crtc.c | 2 +- drivers/gpu/drm/drm_drv.c | 2 +- drivers/gpu/drm/drm_fops.c | 12 +- drivers/gpu/drm/drm_global.c | 14 +- drivers/gpu/drm/drm_info.c | 13 +- drivers/gpu/drm/drm_ioc32.c | 13 +- drivers/gpu/drm/drm_ioctl.c | 2 +- drivers/gpu/drm/gma500/mdfld_dsi_dpi.c | 10 +- drivers/gpu/drm/i810/i810_drv.h | 4 +- drivers/gpu/drm/i915/i915_dma.c | 2 +- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 4 +- drivers/gpu/drm/i915/i915_ioc32.c | 16 +- drivers/gpu/drm/i915/intel_display.c | 26 +- drivers/gpu/drm/imx/imx-drm-core.c | 2 +- drivers/gpu/drm/mga/mga_drv.h | 4 +- drivers/gpu/drm/mga/mga_ioc32.c | 10 +- drivers/gpu/drm/mga/mga_irq.c | 8 +- drivers/gpu/drm/nouveau/nouveau_bios.c | 2 +- drivers/gpu/drm/nouveau/nouveau_drm.h | 1 - drivers/gpu/drm/nouveau/nouveau_ioc32.c | 2 +- drivers/gpu/drm/nouveau/nouveau_vga.c | 2 +- drivers/gpu/drm/qxl/qxl_cmd.c | 12 +- drivers/gpu/drm/qxl/qxl_debugfs.c | 8 +- drivers/gpu/drm/qxl/qxl_drv.h | 8 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 10 +- drivers/gpu/drm/qxl/qxl_irq.c | 16 +- drivers/gpu/drm/qxl/qxl_ttm.c | 38 +- drivers/gpu/drm/r128/r128_cce.c | 2 +- drivers/gpu/drm/r128/r128_drv.h | 4 +- drivers/gpu/drm/r128/r128_ioc32.c | 10 +- drivers/gpu/drm/r128/r128_irq.c | 4 +- drivers/gpu/drm/r128/r128_state.c | 4 +- drivers/gpu/drm/radeon/mkregtable.c | 4 +- drivers/gpu/drm/radeon/radeon_device.c | 2 +- drivers/gpu/drm/radeon/radeon_drv.h | 2 +- drivers/gpu/drm/radeon/radeon_ioc32.c | 12 +- drivers/gpu/drm/radeon/radeon_irq.c | 6 +- drivers/gpu/drm/radeon/radeon_state.c | 4 +- drivers/gpu/drm/radeon/radeon_ttm.c | 4 +- drivers/gpu/drm/tegra/dc.c | 2 +- drivers/gpu/drm/tegra/dsi.c | 2 +- drivers/gpu/drm/tegra/hdmi.c | 2 +- drivers/gpu/drm/ttm/ttm_memory.c | 4 +- drivers/gpu/drm/ttm/ttm_page_alloc.c | 18 +- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 18 +- drivers/gpu/drm/udl/udl_fb.c | 1 - drivers/gpu/drm/via/via_drv.h | 4 +- drivers/gpu/drm/via/via_irq.c | 18 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_irq.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_marker.c | 2 +- drivers/gpu/vga/vga_switcheroo.c | 4 +- drivers/hid/hid-core.c | 4 +- drivers/hv/channel.c | 2 +- drivers/hv/hv.c | 4 +- drivers/hv/hv_balloon.c | 18 +- drivers/hv/hyperv_vmbus.h | 2 +- drivers/hwmon/acpi_power_meter.c | 6 +- drivers/hwmon/applesmc.c | 2 +- drivers/hwmon/asus_atk0110.c | 10 +- drivers/hwmon/coretemp.c | 2 +- drivers/hwmon/ibmaem.c | 2 +- drivers/hwmon/iio_hwmon.c | 2 +- drivers/hwmon/nct6683.c | 6 +- drivers/hwmon/nct6775.c | 6 +- drivers/hwmon/pmbus/pmbus_core.c | 10 +- drivers/hwmon/sht15.c | 12 +- drivers/hwmon/via-cputemp.c | 2 +- drivers/i2c/busses/i2c-amd756-s4882.c | 2 +- drivers/i2c/busses/i2c-diolan-u2c.c | 2 +- drivers/i2c/busses/i2c-nforce2-s4985.c | 2 +- drivers/i2c/i2c-dev.c | 2 +- drivers/ide/ide-cd.c | 2 +- drivers/iio/industrialio-core.c | 2 +- drivers/infiniband/core/cm.c | 32 +- drivers/infiniband/core/fmr_pool.c | 20 +- drivers/infiniband/core/uverbs_cmd.c | 3 + drivers/infiniband/hw/cxgb4/mem.c | 4 +- drivers/infiniband/hw/ipath/ipath_rc.c | 6 +- drivers/infiniband/hw/ipath/ipath_ruc.c | 6 +- drivers/infiniband/hw/mlx4/mad.c | 2 +- drivers/infiniband/hw/mlx4/mcg.c | 2 +- drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 +- drivers/infiniband/hw/mthca/mthca_cmd.c | 8 +- drivers/infiniband/hw/mthca/mthca_main.c | 2 +- drivers/infiniband/hw/mthca/mthca_mr.c | 6 +- drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/nes/nes.c | 4 +- drivers/infiniband/hw/nes/nes.h | 40 +- drivers/infiniband/hw/nes/nes_cm.c | 62 +- drivers/infiniband/hw/nes/nes_mgt.c | 8 +- drivers/infiniband/hw/nes/nes_nic.c | 40 +- drivers/infiniband/hw/nes/nes_verbs.c | 10 +- drivers/infiniband/hw/qib/qib.h | 1 + drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 2 +- drivers/input/gameport/gameport.c | 4 +- drivers/input/input.c | 4 +- drivers/input/joystick/sidewinder.c | 1 + drivers/input/joystick/xpad.c | 4 +- drivers/input/misc/ims-pcu.c | 4 +- drivers/input/mouse/psmouse.h | 2 +- drivers/input/mousedev.c | 2 +- drivers/input/serio/serio.c | 4 +- drivers/input/serio/serio_raw.c | 4 +- drivers/input/touchscreen/htcpen.c | 2 +- drivers/iommu/arm-smmu.c | 43 +- drivers/iommu/io-pgtable-arm.c | 101 +- drivers/iommu/io-pgtable.c | 11 +- drivers/iommu/io-pgtable.h | 19 +- drivers/iommu/iommu.c | 2 +- drivers/iommu/ipmmu-vmsa.c | 13 +- drivers/iommu/irq_remapping.c | 12 +- drivers/irqchip/irq-gic.c | 2 +- drivers/irqchip/irq-renesas-intc-irqpin.c | 2 +- drivers/irqchip/irq-renesas-irqc.c | 2 +- drivers/isdn/capi/capi.c | 10 +- drivers/isdn/gigaset/interface.c | 8 +- drivers/isdn/gigaset/usb-gigaset.c | 2 +- drivers/isdn/hardware/avm/b1.c | 4 +- drivers/isdn/i4l/isdn_common.c | 2 + drivers/isdn/i4l/isdn_tty.c | 22 +- drivers/isdn/icn/icn.c | 2 +- drivers/isdn/mISDN/dsp_cmx.c | 2 +- drivers/lguest/core.c | 10 +- drivers/lguest/page_tables.c | 2 +- drivers/lguest/x86/core.c | 12 +- drivers/lguest/x86/switcher_32.S | 27 +- drivers/md/bcache/closure.h | 2 +- drivers/md/bitmap.c | 2 +- drivers/md/dm-ioctl.c | 2 +- drivers/md/dm-raid1.c | 16 +- drivers/md/dm-stats.c | 6 +- drivers/md/dm-stripe.c | 10 +- drivers/md/dm-table.c | 2 +- drivers/md/dm-thin-metadata.c | 4 +- drivers/md/dm.c | 16 +- drivers/md/md.c | 26 +- drivers/md/md.h | 6 +- drivers/md/persistent-data/dm-space-map-metadata.c | 4 +- drivers/md/persistent-data/dm-space-map.h | 1 + drivers/md/raid1.c | 4 +- drivers/md/raid10.c | 16 +- drivers/md/raid5.c | 22 +- drivers/media/dvb-core/dvbdev.c | 2 +- drivers/media/dvb-frontends/af9033.h | 2 +- drivers/media/dvb-frontends/dib3000.h | 2 +- drivers/media/dvb-frontends/dib7000p.h | 2 +- drivers/media/dvb-frontends/dib8000.h | 2 +- drivers/media/pci/cx88/cx88-video.c | 6 +- drivers/media/pci/ivtv/ivtv-driver.c | 2 +- drivers/media/pci/solo6x10/solo6x10-core.c | 2 +- drivers/media/pci/solo6x10/solo6x10-p2m.c | 2 +- drivers/media/pci/solo6x10/solo6x10.h | 2 +- drivers/media/pci/tw68/tw68-core.c | 2 +- drivers/media/platform/omap/omap_vout.c | 11 +- drivers/media/platform/s5p-tv/mixer.h | 2 +- drivers/media/platform/s5p-tv/mixer_grp_layer.c | 2 +- drivers/media/platform/s5p-tv/mixer_reg.c | 2 +- drivers/media/platform/s5p-tv/mixer_video.c | 24 +- drivers/media/platform/s5p-tv/mixer_vp_layer.c | 2 +- drivers/media/radio/radio-cadet.c | 2 + drivers/media/radio/radio-maxiradio.c | 2 +- drivers/media/radio/radio-shark.c | 2 +- drivers/media/radio/radio-shark2.c | 2 +- drivers/media/radio/radio-si476x.c | 2 +- drivers/media/radio/wl128x/fmdrv_common.c | 2 +- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 12 +- drivers/media/v4l2-core/v4l2-device.c | 4 +- drivers/media/v4l2-core/v4l2-ioctl.c | 13 +- drivers/memory/omap-gpmc.c | 21 +- drivers/message/fusion/mptsas.c | 34 +- drivers/mfd/ab8500-debugfs.c | 2 +- drivers/mfd/kempld-core.c | 2 +- drivers/mfd/max8925-i2c.c | 2 +- drivers/mfd/tps65910.c | 2 +- drivers/mfd/twl4030-irq.c | 9 +- drivers/misc/c2port/core.c | 4 +- drivers/misc/eeprom/sunxi_sid.c | 4 +- drivers/misc/kgdbts.c | 4 +- drivers/misc/lis3lv02d/lis3lv02d.c | 8 +- drivers/misc/lis3lv02d/lis3lv02d.h | 2 +- drivers/misc/sgi-gru/gruhandles.c | 4 +- drivers/misc/sgi-gru/gruprocfs.c | 8 +- drivers/misc/sgi-gru/grutables.h | 154 +- drivers/misc/sgi-xp/xp.h | 2 +- drivers/misc/sgi-xp/xpc.h | 3 +- drivers/misc/sgi-xp/xpc_main.c | 2 +- drivers/mmc/card/block.c | 2 +- drivers/mmc/host/dw_mmc.h | 2 +- drivers/mmc/host/mmci.c | 4 +- drivers/mmc/host/omap_hsmmc.c | 4 +- drivers/mmc/host/sdhci-esdhc-imx.c | 7 +- drivers/mmc/host/sdhci-s3c.c | 8 +- drivers/mtd/chips/cfi_cmdset_0020.c | 2 +- drivers/mtd/nand/denali.c | 1 + drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 2 +- drivers/mtd/nftlmount.c | 1 + drivers/mtd/sm_ftl.c | 2 +- drivers/net/bonding/bond_netlink.c | 2 +- drivers/net/caif/caif_hsi.c | 2 +- drivers/net/can/Kconfig | 2 +- drivers/net/can/dev.c | 2 +- drivers/net/can/vcan.c | 2 +- drivers/net/dummy.c | 2 +- drivers/net/ethernet/8390/ax88796.c | 4 +- drivers/net/ethernet/altera/altera_tse_main.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-common.h | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-dcb.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-desc.c | 27 +- drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 141 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 58 +- drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 6 +- drivers/net/ethernet/amd/xgbe/xgbe-main.c | 11 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-ptp.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe.h | 7 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c | 11 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 3 +- drivers/net/ethernet/broadcom/tg3.h | 1 + drivers/net/ethernet/chelsio/cxgb3/l2t.h | 2 +- drivers/net/ethernet/dec/tulip/de4x5.c | 4 +- drivers/net/ethernet/emulex/benet/be_main.c | 2 +- drivers/net/ethernet/faraday/ftgmac100.c | 2 + drivers/net/ethernet/faraday/ftmac100.c | 2 + drivers/net/ethernet/intel/i40e/i40e_ptp.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 4 +- drivers/net/ethernet/neterion/vxge/vxge-config.c | 7 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 4 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c | 12 +- .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 +- drivers/net/ethernet/realtek/r8169.c | 8 +- drivers/net/ethernet/sfc/ptp.c | 2 +- drivers/net/ethernet/stmicro/stmmac/mmc_core.c | 4 +- drivers/net/ethernet/via/via-rhine.c | 2 +- drivers/net/hyperv/hyperv_net.h | 2 +- drivers/net/hyperv/rndis_filter.c | 4 +- drivers/net/ifb.c | 2 +- drivers/net/macvlan.c | 20 +- drivers/net/macvtap.c | 6 +- drivers/net/nlmon.c | 2 +- drivers/net/phy/phy_device.c | 6 +- drivers/net/ppp/ppp_generic.c | 4 +- drivers/net/slip/slhc.c | 2 +- drivers/net/team/team.c | 4 +- drivers/net/tun.c | 7 +- drivers/net/usb/hso.c | 23 +- drivers/net/usb/r8152.c | 2 +- drivers/net/usb/sierra_net.c | 4 +- drivers/net/virtio_net.c | 2 +- drivers/net/vxlan.c | 4 +- drivers/net/wimax/i2400m/rx.c | 2 +- drivers/net/wireless/airo.c | 2 +- drivers/net/wireless/at76c50x-usb.c | 2 +- drivers/net/wireless/ath/ath10k/htc.c | 7 +- drivers/net/wireless/ath/ath10k/htc.h | 4 +- drivers/net/wireless/ath/ath9k/ar9002_mac.c | 36 +- drivers/net/wireless/ath/ath9k/ar9003_mac.c | 64 +- drivers/net/wireless/ath/ath9k/hw.h | 4 +- drivers/net/wireless/ath/ath9k/main.c | 22 +- drivers/net/wireless/b43/phy_lp.c | 2 +- drivers/net/wireless/iwlegacy/3945-mac.c | 4 +- drivers/net/wireless/iwlwifi/dvm/debugfs.c | 34 +- drivers/net/wireless/iwlwifi/pcie/trans.c | 4 +- drivers/net/wireless/mac80211_hwsim.c | 28 +- drivers/net/wireless/rndis_wlan.c | 2 +- drivers/net/wireless/rt2x00/rt2x00.h | 2 +- drivers/net/wireless/rt2x00/rt2x00queue.c | 4 +- drivers/net/wireless/ti/wl1251/sdio.c | 12 +- drivers/net/wireless/ti/wl12xx/main.c | 8 +- drivers/net/wireless/ti/wl18xx/main.c | 6 +- drivers/nfc/nfcwilink.c | 2 +- drivers/of/fdt.c | 4 +- drivers/oprofile/buffer_sync.c | 8 +- drivers/oprofile/event_buffer.c | 2 +- drivers/oprofile/oprof.c | 2 +- drivers/oprofile/oprofile_files.c | 2 +- drivers/oprofile/oprofile_stats.c | 10 +- drivers/oprofile/oprofile_stats.h | 10 +- drivers/oprofile/oprofilefs.c | 6 +- drivers/oprofile/timer_int.c | 2 +- drivers/parport/procfs.c | 4 +- drivers/pci/host/pci-host-generic.c | 24 +- drivers/pci/hotplug/acpiphp_ibm.c | 4 +- drivers/pci/hotplug/cpcihp_generic.c | 6 +- drivers/pci/hotplug/cpcihp_zt5550.c | 14 +- drivers/pci/hotplug/cpqphp_nvram.c | 2 + drivers/pci/hotplug/pci_hotplug_core.c | 6 +- drivers/pci/hotplug/pciehp_core.c | 2 +- drivers/pci/msi.c | 6 +- drivers/pci/pci-sysfs.c | 6 +- drivers/pci/pci.h | 2 +- drivers/pci/pcie/aspm.c | 6 +- drivers/pci/pcie/portdrv_pci.c | 2 +- drivers/pci/probe.c | 2 +- drivers/platform/chrome/chromeos_pstore.c | 2 +- drivers/platform/x86/alienware-wmi.c | 4 +- drivers/platform/x86/compal-laptop.c | 2 +- drivers/platform/x86/hdaps.c | 2 +- drivers/platform/x86/ibm_rtl.c | 2 +- drivers/platform/x86/intel_oaktrail.c | 2 +- drivers/platform/x86/msi-laptop.c | 16 +- drivers/platform/x86/msi-wmi.c | 2 +- drivers/platform/x86/samsung-laptop.c | 2 +- drivers/platform/x86/samsung-q10.c | 2 +- drivers/platform/x86/sony-laptop.c | 14 +- drivers/platform/x86/thinkpad_acpi.c | 2 +- drivers/pnp/pnpbios/bioscalls.c | 14 +- drivers/pnp/pnpbios/core.c | 2 +- drivers/power/pda_power.c | 7 +- drivers/power/power_supply.h | 4 +- drivers/power/power_supply_core.c | 7 +- drivers/power/power_supply_sysfs.c | 6 +- drivers/powercap/powercap_sys.c | 136 +- drivers/ptp/ptp_private.h | 2 +- drivers/ptp/ptp_sysfs.c | 2 +- drivers/regulator/core.c | 4 +- drivers/regulator/max8660.c | 6 +- drivers/regulator/max8973-regulator.c | 8 +- drivers/regulator/mc13892-regulator.c | 8 +- drivers/rtc/rtc-cmos.c | 4 +- drivers/rtc/rtc-ds1307.c | 2 +- drivers/rtc/rtc-m48t59.c | 4 +- drivers/scsi/bfa/bfa_fcpim.h | 2 +- drivers/scsi/bfa/bfa_ioc.h | 4 +- drivers/scsi/fcoe/fcoe_sysfs.c | 12 +- drivers/scsi/hosts.c | 4 +- drivers/scsi/hpsa.c | 36 +- drivers/scsi/hpsa.h | 2 +- drivers/scsi/libfc/fc_exch.c | 50 +- drivers/scsi/libsas/sas_ata.c | 2 +- drivers/scsi/lpfc/lpfc.h | 8 +- drivers/scsi/lpfc/lpfc_debugfs.c | 18 +- drivers/scsi/lpfc/lpfc_init.c | 6 +- drivers/scsi/lpfc/lpfc_scsi.c | 10 +- drivers/scsi/mpt2sas/mpt2sas_scsih.c | 8 +- drivers/scsi/pmcraid.c | 20 +- drivers/scsi/pmcraid.h | 8 +- drivers/scsi/qla2xxx/qla_attr.c | 4 +- drivers/scsi/qla2xxx/qla_gbl.h | 4 +- drivers/scsi/qla2xxx/qla_os.c | 6 +- drivers/scsi/qla4xxx/ql4_def.h | 2 +- drivers/scsi/qla4xxx/ql4_os.c | 6 +- drivers/scsi/scsi.c | 2 +- drivers/scsi/scsi_lib.c | 8 +- drivers/scsi/scsi_sysfs.c | 2 +- drivers/scsi/scsi_transport_fc.c | 8 +- drivers/scsi/scsi_transport_iscsi.c | 6 +- drivers/scsi/scsi_transport_srp.c | 6 +- drivers/scsi/sd.c | 6 +- drivers/scsi/sg.c | 2 +- drivers/scsi/sr.c | 8 +- drivers/soc/tegra/fuse/fuse-tegra.c | 2 +- drivers/spi/spi.c | 2 +- drivers/staging/android/timed_output.c | 6 +- drivers/staging/comedi/comedi_fops.c | 8 +- drivers/staging/fbtft/fbtft-core.c | 2 +- drivers/staging/fbtft/fbtft.h | 2 +- drivers/staging/gdm724x/gdm_tty.c | 2 +- drivers/staging/i2o/i2o.h | 2 +- drivers/staging/i2o/i2o_proc.c | 67 +- drivers/staging/i2o/iop.c | 8 +- drivers/staging/lustre/lnet/selftest/brw_test.c | 12 +- drivers/staging/lustre/lnet/selftest/framework.c | 4 - drivers/staging/lustre/lnet/selftest/ping_test.c | 14 +- drivers/staging/lustre/lustre/include/lustre_dlm.h | 2 +- drivers/staging/lustre/lustre/include/obd.h | 2 +- drivers/staging/lustre/lustre/libcfs/module.c | 6 +- drivers/staging/octeon/ethernet-rx.c | 12 +- drivers/staging/octeon/ethernet.c | 8 +- drivers/staging/rtl8188eu/include/hal_intf.h | 2 +- drivers/staging/rtl8712/rtl871x_io.h | 2 +- drivers/staging/unisys/visorchipset/visorchipset.h | 4 +- drivers/target/sbp/sbp_target.c | 4 +- drivers/target/target_core_device.c | 2 +- drivers/target/target_core_transport.c | 2 +- drivers/thermal/int340x_thermal/int3400_thermal.c | 6 +- drivers/thermal/of-thermal.c | 17 +- drivers/thermal/x86_pkg_temp_thermal.c | 2 +- drivers/tty/cyclades.c | 6 +- drivers/tty/hvc/hvc_console.c | 14 +- drivers/tty/hvc/hvcs.c | 21 +- drivers/tty/hvc/hvsi.c | 22 +- drivers/tty/hvc/hvsi_lib.c | 4 +- drivers/tty/ipwireless/tty.c | 27 +- drivers/tty/moxa.c | 2 +- drivers/tty/n_gsm.c | 4 +- drivers/tty/n_tty.c | 5 +- drivers/tty/pty.c | 4 +- drivers/tty/rocket.c | 6 +- drivers/tty/serial/8250/8250_core.c | 4 +- drivers/tty/serial/ioc4_serial.c | 6 +- drivers/tty/serial/kgdb_nmi.c | 4 +- drivers/tty/serial/kgdboc.c | 32 +- drivers/tty/serial/msm_serial.c | 4 +- drivers/tty/serial/samsung.c | 9 +- drivers/tty/serial/serial_core.c | 8 +- drivers/tty/synclink.c | 34 +- drivers/tty/synclink_gt.c | 28 +- drivers/tty/synclinkmp.c | 34 +- drivers/tty/tty_io.c | 2 +- drivers/tty/tty_ldisc.c | 8 +- drivers/tty/tty_port.c | 22 +- drivers/uio/uio.c | 13 +- drivers/usb/atm/cxacru.c | 2 +- drivers/usb/atm/usbatm.c | 24 +- drivers/usb/core/devices.c | 6 +- drivers/usb/core/devio.c | 10 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/message.c | 6 +- drivers/usb/core/sysfs.c | 2 +- drivers/usb/core/usb.c | 2 +- drivers/usb/early/ehci-dbgp.c | 16 +- drivers/usb/gadget/function/u_serial.c | 22 +- drivers/usb/host/ehci-hub.c | 4 +- drivers/usb/misc/appledisplay.c | 4 +- drivers/usb/serial/console.c | 8 +- drivers/usb/storage/usb.h | 2 +- drivers/usb/usbip/vhci.h | 2 +- drivers/usb/usbip/vhci_hcd.c | 6 +- drivers/usb/usbip/vhci_rx.c | 2 +- drivers/usb/wusbcore/wa-hc.h | 4 +- drivers/usb/wusbcore/wa-xfer.c | 2 +- drivers/vfio/vfio.c | 2 +- drivers/vhost/vringh.c | 20 +- drivers/video/backlight/kb3886_bl.c | 2 +- drivers/video/fbdev/aty/aty128fb.c | 2 +- drivers/video/fbdev/aty/atyfb_base.c | 8 +- drivers/video/fbdev/aty/mach64_cursor.c | 5 +- drivers/video/fbdev/core/fb_defio.c | 6 +- drivers/video/fbdev/core/fbmem.c | 2 +- drivers/video/fbdev/hyperv_fb.c | 4 +- drivers/video/fbdev/i810/i810_accel.c | 1 + drivers/video/fbdev/mb862xx/mb862xxfb_accel.c | 16 +- drivers/video/fbdev/nvidia/nvidia.c | 27 +- drivers/video/fbdev/omap2/dss/display.c | 8 +- drivers/video/fbdev/s1d13xxxfb.c | 6 +- drivers/video/fbdev/smscufx.c | 4 +- drivers/video/fbdev/udlfb.c | 36 +- drivers/video/fbdev/uvesafb.c | 52 +- drivers/video/fbdev/vesafb.c | 58 +- drivers/video/fbdev/via/via_clock.h | 2 +- drivers/xen/events/events_base.c | 6 +- fs/9p/vfs_inode.c | 2 +- fs/Kconfig.binfmt | 2 +- fs/afs/inode.c | 4 +- fs/aio.c | 2 +- fs/autofs4/waitq.c | 2 +- fs/befs/endian.h | 6 +- fs/binfmt_aout.c | 23 +- fs/binfmt_elf.c | 670 +- fs/block_dev.c | 2 +- fs/btrfs/ctree.c | 9 +- fs/btrfs/delayed-inode.c | 6 +- fs/btrfs/delayed-inode.h | 4 +- fs/btrfs/super.c | 2 +- fs/btrfs/sysfs.c | 2 +- fs/btrfs/tests/free-space-tests.c | 8 +- fs/btrfs/tree-log.h | 2 +- fs/buffer.c | 2 +- fs/cachefiles/bind.c | 6 +- fs/cachefiles/daemon.c | 8 +- fs/cachefiles/internal.h | 12 +- fs/cachefiles/namei.c | 2 +- fs/cachefiles/proc.c | 12 +- fs/ceph/dir.c | 11 +- fs/ceph/super.c | 4 +- fs/cifs/cifs_debug.c | 12 +- fs/cifs/cifsfs.c | 8 +- fs/cifs/cifsglob.h | 54 +- fs/cifs/file.c | 10 +- fs/cifs/misc.c | 4 +- fs/cifs/smb1ops.c | 80 +- fs/cifs/smb2ops.c | 84 +- fs/cifs/smb2pdu.c | 3 +- fs/coda/cache.c | 10 +- fs/compat.c | 4 +- fs/compat_binfmt_elf.c | 2 + fs/compat_ioctl.c | 12 +- fs/configfs/dir.c | 10 +- fs/coredump.c | 16 +- fs/dcache.c | 51 +- fs/ecryptfs/inode.c | 2 +- fs/ecryptfs/miscdev.c | 2 +- fs/exec.c | 362 +- fs/ext2/xattr.c | 5 +- fs/ext3/xattr.c | 5 +- fs/ext4/ext4.h | 20 +- fs/ext4/mballoc.c | 44 +- fs/ext4/mmp.c | 2 +- fs/ext4/resize.c | 16 +- fs/ext4/super.c | 4 +- fs/ext4/xattr.c | 5 +- fs/fhandle.c | 3 +- fs/file.c | 4 +- fs/fs_struct.c | 8 +- fs/fscache/cookie.c | 40 +- fs/fscache/internal.h | 200 +- fs/fscache/object.c | 26 +- fs/fscache/operation.c | 30 +- fs/fscache/page.c | 110 +- fs/fscache/stats.c | 344 +- fs/fuse/cuse.c | 10 +- fs/fuse/dev.c | 4 +- fs/fuse/dir.c | 2 +- fs/gfs2/glock.c | 22 +- fs/gfs2/glops.c | 4 +- fs/gfs2/quota.c | 6 +- fs/hostfs/hostfs_kern.c | 2 +- fs/hugetlbfs/inode.c | 13 +- fs/inode.c | 4 +- fs/jffs2/erase.c | 3 +- fs/jffs2/wbuf.c | 3 +- fs/jfs/super.c | 2 +- fs/kernfs/dir.c | 2 +- fs/kernfs/file.c | 20 +- fs/kernfs/symlink.c | 2 +- fs/libfs.c | 12 +- fs/lockd/clntproc.c | 4 +- fs/namei.c | 24 +- fs/namespace.c | 16 +- fs/nfs/callback_xdr.c | 2 +- fs/nfs/inode.c | 6 +- fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfs4xdr.c | 2 +- fs/nfsd/nfscache.c | 11 +- fs/nfsd/vfs.c | 6 +- fs/nls/nls_base.c | 26 +- fs/nls/nls_euc-jp.c | 6 +- fs/nls/nls_koi8-ru.c | 6 +- fs/notify/fanotify/fanotify_user.c | 4 +- fs/notify/notification.c | 4 +- fs/ntfs/dir.c | 2 +- fs/ntfs/super.c | 6 +- fs/ocfs2/localalloc.c | 2 +- fs/ocfs2/ocfs2.h | 10 +- fs/ocfs2/suballoc.c | 12 +- fs/ocfs2/super.c | 20 +- fs/pipe.c | 72 +- fs/posix_acl.c | 4 +- fs/proc/array.c | 20 + fs/proc/base.c | 4 +- fs/proc/kcore.c | 34 +- fs/proc/meminfo.c | 2 +- fs/proc/nommu.c | 2 +- fs/proc/proc_sysctl.c | 18 +- fs/proc/task_mmu.c | 39 +- fs/proc/task_nommu.c | 4 +- fs/proc/vmcore.c | 16 +- fs/qnx6/qnx6.h | 4 +- fs/quota/netlink.c | 4 +- fs/read_write.c | 2 +- fs/reiserfs/do_balan.c | 2 +- fs/reiserfs/procfs.c | 2 +- fs/reiserfs/reiserfs.h | 4 +- fs/seq_file.c | 4 +- fs/splice.c | 43 +- fs/squashfs/xattr.c | 12 +- fs/sysv/sysv.h | 2 +- fs/ubifs/io.c | 2 +- fs/udf/misc.c | 2 +- fs/ufs/swab.h | 4 +- fs/xattr.c | 21 + fs/xfs/libxfs/xfs_bmap.c | 2 +- fs/xfs/xfs_dir2_readdir.c | 7 +- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_linux.h | 4 +- include/asm-generic/4level-fixup.h | 2 + include/asm-generic/atomic-long.h | 214 +- include/asm-generic/atomic64.h | 12 + include/asm-generic/barrier.h | 2 +- include/asm-generic/bitops/__fls.h | 2 +- include/asm-generic/bitops/fls.h | 2 +- include/asm-generic/bitops/fls64.h | 4 +- include/asm-generic/bug.h | 6 +- include/asm-generic/cache.h | 4 +- include/asm-generic/emergency-restart.h | 2 +- include/asm-generic/kmap_types.h | 4 +- include/asm-generic/local.h | 13 + include/asm-generic/pgtable-nopmd.h | 18 +- include/asm-generic/pgtable-nopud.h | 15 +- include/asm-generic/pgtable.h | 16 + include/asm-generic/uaccess.h | 16 + include/asm-generic/vmlinux.lds.h | 13 +- include/crypto/algapi.h | 2 +- include/drm/drmP.h | 16 +- include/drm/drm_crtc_helper.h | 2 +- include/drm/i915_pciids.h | 2 +- include/drm/ttm/ttm_memory.h | 2 +- include/drm/ttm/ttm_page_alloc.h | 1 + include/keys/asymmetric-subtype.h | 2 +- include/linux/atmdev.h | 4 +- include/linux/atomic.h | 2 +- include/linux/audit.h | 2 +- include/linux/binfmts.h | 3 +- include/linux/bitmap.h | 2 +- include/linux/bitops.h | 6 +- include/linux/blkdev.h | 2 +- include/linux/blktrace_api.h | 2 +- include/linux/cache.h | 8 + include/linux/cdrom.h | 1 - include/linux/cleancache.h | 2 +- include/linux/clk-provider.h | 1 + include/linux/compat.h | 6 +- include/linux/compiler-gcc.h | 4 +- include/linux/compiler-gcc4.h | 24 + include/linux/compiler-gcc5.h | 23 + include/linux/compiler.h | 93 +- include/linux/completion.h | 12 +- include/linux/configfs.h | 2 +- include/linux/cpufreq.h | 3 +- include/linux/cpuidle.h | 5 +- include/linux/cpumask.h | 14 +- include/linux/crypto.h | 6 +- include/linux/ctype.h | 2 +- include/linux/dcache.h | 4 +- include/linux/decompress/mm.h | 2 +- include/linux/devfreq.h | 2 +- include/linux/device.h | 7 +- include/linux/dma-mapping.h | 2 +- include/linux/efi.h | 1 + include/linux/elf.h | 2 + include/linux/err.h | 4 +- include/linux/extcon.h | 2 +- include/linux/fb.h | 3 +- include/linux/fdtable.h | 2 +- include/linux/frontswap.h | 2 +- include/linux/fs.h | 5 +- include/linux/fs_struct.h | 2 +- include/linux/fscache-cache.h | 4 +- include/linux/fscache.h | 2 +- include/linux/fsnotify.h | 2 +- include/linux/genhd.h | 4 +- include/linux/genl_magic_func.h | 2 +- include/linux/gfp.h | 12 +- include/linux/highmem.h | 12 + include/linux/hwmon-sysfs.h | 6 +- include/linux/i2c.h | 1 + include/linux/if_pppox.h | 2 +- include/linux/init.h | 12 +- include/linux/init_task.h | 7 + include/linux/interrupt.h | 6 +- include/linux/iommu.h | 2 +- include/linux/ioport.h | 2 +- include/linux/irq.h | 3 +- include/linux/irqdesc.h | 2 +- include/linux/irqdomain.h | 1 + include/linux/jiffies.h | 14 +- include/linux/kernel.h | 2 +- include/linux/key-type.h | 2 +- include/linux/kgdb.h | 6 +- include/linux/kmemleak.h | 4 +- include/linux/kobject.h | 3 +- include/linux/kobject_ns.h | 2 +- include/linux/kref.h | 2 +- include/linux/kvm_host.h | 4 +- include/linux/libata.h | 2 +- include/linux/linkage.h | 1 + include/linux/list.h | 15 + include/linux/lockref.h | 26 +- include/linux/math64.h | 10 +- include/linux/mempolicy.h | 7 + include/linux/mm.h | 104 +- include/linux/mm_types.h | 20 + include/linux/mmiotrace.h | 4 +- include/linux/mmzone.h | 2 +- include/linux/mod_devicetable.h | 4 +- include/linux/module.h | 60 +- include/linux/moduleloader.h | 16 + include/linux/moduleparam.h | 4 +- include/linux/namei.h | 4 +- include/linux/net.h | 2 +- include/linux/netdevice.h | 7 +- include/linux/netfilter.h | 2 +- include/linux/netfilter/nfnetlink.h | 2 +- include/linux/nls.h | 4 +- include/linux/notifier.h | 3 +- include/linux/oprofile.h | 4 +- include/linux/padata.h | 2 +- include/linux/pci_hotplug.h | 3 +- include/linux/percpu.h | 2 +- include/linux/perf_event.h | 12 +- include/linux/pipe_fs_i.h | 8 +- include/linux/pm.h | 1 + include/linux/pm_domain.h | 4 +- include/linux/pm_runtime.h | 2 +- include/linux/pnp.h | 2 +- include/linux/poison.h | 4 +- include/linux/power/smartreflex.h | 2 +- include/linux/ppp-comp.h | 2 +- include/linux/preempt.h | 21 + include/linux/proc_ns.h | 2 +- include/linux/quota.h | 2 +- include/linux/random.h | 23 +- include/linux/rculist.h | 20 +- include/linux/rcupdate.h | 2 +- include/linux/reboot.h | 14 +- include/linux/regset.h | 3 +- include/linux/relay.h | 2 +- include/linux/rio.h | 2 +- include/linux/rmap.h | 4 +- include/linux/sched.h | 70 +- include/linux/sched/sysctl.h | 1 + include/linux/security.h | 2 - include/linux/semaphore.h | 2 +- include/linux/seq_file.h | 1 + include/linux/signal.h | 2 +- include/linux/skbuff.h | 10 +- include/linux/slab.h | 47 +- include/linux/slab_def.h | 14 +- include/linux/slub_def.h | 2 +- include/linux/smp.h | 2 + include/linux/sock_diag.h | 2 +- include/linux/sonet.h | 2 +- include/linux/sunrpc/addr.h | 8 +- include/linux/sunrpc/clnt.h | 2 +- include/linux/sunrpc/svc.h | 2 +- include/linux/sunrpc/svc_rdma.h | 18 +- include/linux/sunrpc/svcauth.h | 2 +- include/linux/swiotlb.h | 3 +- include/linux/syscalls.h | 21 +- include/linux/syscore_ops.h | 2 +- include/linux/sysctl.h | 3 +- include/linux/sysfs.h | 9 +- include/linux/sysrq.h | 3 +- include/linux/thread_info.h | 7 + include/linux/tty.h | 4 +- include/linux/tty_driver.h | 2 +- include/linux/tty_ldisc.h | 2 +- include/linux/types.h | 16 + include/linux/uaccess.h | 6 +- include/linux/uio_driver.h | 2 +- include/linux/unaligned/access_ok.h | 24 +- include/linux/usb.h | 4 +- include/linux/usb/renesas_usbhs.h | 2 +- include/linux/vermagic.h | 21 +- include/linux/vga_switcheroo.h | 8 +- include/linux/vmalloc.h | 7 +- include/linux/vmstat.h | 24 +- include/linux/xattr.h | 5 +- include/linux/zlib.h | 3 +- include/media/v4l2-dev.h | 2 +- include/media/v4l2-device.h | 2 +- include/net/9p/transport.h | 2 +- include/net/bluetooth/l2cap.h | 2 +- include/net/bonding.h | 2 +- include/net/caif/cfctrl.h | 6 +- include/net/flow.h | 2 +- include/net/genetlink.h | 2 +- include/net/gro_cells.h | 2 +- include/net/inet_connection_sock.h | 2 +- include/net/inetpeer.h | 2 +- include/net/ip_fib.h | 2 +- include/net/ip_vs.h | 8 +- include/net/irda/ircomm_tty.h | 1 + include/net/iucv/af_iucv.h | 2 +- include/net/llc_c_ac.h | 2 +- include/net/llc_c_ev.h | 4 +- include/net/llc_c_st.h | 2 +- include/net/llc_s_ac.h | 2 +- include/net/llc_s_st.h | 2 +- include/net/mac80211.h | 2 +- include/net/neighbour.h | 2 +- include/net/net_namespace.h | 16 +- include/net/netlink.h | 2 +- include/net/netns/conntrack.h | 6 +- include/net/netns/ipv4.h | 4 +- include/net/netns/ipv6.h | 4 +- include/net/netns/xfrm.h | 2 +- include/net/ping.h | 2 +- include/net/protocol.h | 4 +- include/net/rtnetlink.h | 2 +- include/net/sctp/checksum.h | 4 +- include/net/sctp/sm.h | 4 +- include/net/sctp/structs.h | 2 +- include/net/sock.h | 10 +- include/net/tcp.h | 8 +- include/net/xfrm.h | 13 +- include/rdma/iw_cm.h | 2 +- include/scsi/libfc.h | 3 +- include/scsi/scsi_device.h | 6 +- include/scsi/scsi_driver.h | 2 +- include/scsi/scsi_transport_fc.h | 3 +- include/sound/compress_driver.h | 2 +- include/sound/soc.h | 4 +- include/target/target_core_base.h | 2 +- include/trace/events/irq.h | 4 +- include/uapi/linux/a.out.h | 8 + include/uapi/linux/bcache.h | 5 +- include/uapi/linux/byteorder/little_endian.h | 28 +- include/uapi/linux/elf.h | 28 + include/uapi/linux/screen_info.h | 3 +- include/uapi/linux/swab.h | 6 +- include/uapi/linux/xattr.h | 4 + include/video/udlfb.h | 8 +- include/video/uvesafb.h | 1 + init/Kconfig | 2 +- init/Makefile | 3 + init/do_mounts.c | 14 +- init/do_mounts.h | 8 +- init/do_mounts_initrd.c | 30 +- init/do_mounts_md.c | 6 +- init/init_task.c | 4 + init/initramfs.c | 38 +- init/main.c | 78 +- ipc/compat.c | 4 +- ipc/ipc_sysctl.c | 8 +- ipc/mq_sysctl.c | 4 +- ipc/sem.c | 4 +- ipc/shm.c | 6 + kernel/audit.c | 8 +- kernel/auditsc.c | 4 +- kernel/bpf/core.c | 7 +- kernel/capability.c | 3 + kernel/compat.c | 38 +- kernel/debug/debug_core.c | 16 +- kernel/debug/kdb/kdb_main.c | 4 +- kernel/events/core.c | 26 +- kernel/events/internal.h | 10 +- kernel/events/uprobes.c | 2 +- kernel/exit.c | 2 +- kernel/fork.c | 163 +- kernel/futex.c | 11 +- kernel/futex_compat.c | 2 +- kernel/gcov/base.c | 7 +- kernel/irq/manage.c | 2 +- kernel/irq/spurious.c | 2 +- kernel/jump_label.c | 5 + kernel/kallsyms.c | 37 +- kernel/kexec.c | 3 +- kernel/kmod.c | 8 +- kernel/kprobes.c | 4 +- kernel/ksysfs.c | 2 +- kernel/locking/lockdep.c | 7 +- kernel/locking/mutex-debug.c | 12 +- kernel/locking/mutex-debug.h | 4 +- kernel/locking/mutex.c | 6 +- kernel/locking/rtmutex-tester.c | 24 +- kernel/module.c | 357 +- kernel/notifier.c | 17 +- kernel/padata.c | 4 +- kernel/panic.c | 5 +- kernel/pid.c | 2 +- kernel/pid_namespace.c | 2 +- kernel/power/process.c | 12 +- kernel/profile.c | 14 +- kernel/ptrace.c | 8 +- kernel/rcu/rcutorture.c | 60 +- kernel/rcu/tiny.c | 4 +- kernel/rcu/tiny_plugin.h | 6 +- kernel/rcu/tree.c | 128 +- kernel/rcu/tree.h | 26 +- kernel/rcu/tree_plugin.h | 42 +- kernel/rcu/tree_trace.c | 22 +- kernel/rcu/update.c | 10 +- kernel/sched/auto_group.c | 4 +- kernel/sched/completion.c | 6 +- kernel/sched/core.c | 45 +- kernel/sched/fair.c | 4 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 12 +- kernel/smpboot.c | 4 +- kernel/softirq.c | 12 +- kernel/sys.c | 10 +- kernel/sysctl.c | 34 +- kernel/time/alarmtimer.c | 2 +- kernel/time/hrtimer.c | 2 +- kernel/time/posix-cpu-timers.c | 4 +- kernel/time/posix-timers.c | 24 +- kernel/time/timer.c | 4 +- kernel/time/timer_stats.c | 10 +- kernel/torture.c | 10 +- kernel/trace/blktrace.c | 6 +- kernel/trace/ftrace.c | 15 +- kernel/trace/ring_buffer.c | 96 +- kernel/trace/trace.c | 2 +- kernel/trace/trace.h | 2 +- kernel/trace/trace_clock.c | 4 +- kernel/trace/trace_events.c | 1 - kernel/trace/trace_functions_graph.c | 4 +- kernel/trace/trace_mmiotrace.c | 8 +- kernel/trace/trace_output.c | 10 +- kernel/trace/trace_seq.c | 2 +- kernel/trace/trace_stack.c | 2 +- kernel/user_namespace.c | 2 +- kernel/utsname_sysctl.c | 2 +- kernel/watchdog.c | 2 +- kernel/workqueue.c | 2 +- lib/Kconfig.debug | 8 +- lib/Makefile | 2 +- lib/average.c | 2 +- lib/bitmap.c | 10 +- lib/bug.c | 2 + lib/debugobjects.c | 2 +- lib/decompress_bunzip2.c | 3 +- lib/decompress_unlzma.c | 4 +- lib/div64.c | 4 +- lib/dma-debug.c | 4 +- lib/inflate.c | 2 +- lib/ioremap.c | 4 +- lib/kobject.c | 4 +- lib/list_debug.c | 126 +- lib/lockref.c | 44 +- lib/percpu-refcount.c | 2 +- lib/radix-tree.c | 2 +- lib/random32.c | 2 +- lib/show_mem.c | 2 +- lib/strncpy_from_user.c | 2 +- lib/strnlen_user.c | 2 +- lib/swiotlb.c | 2 +- lib/test-hexdump.c | 6 +- lib/usercopy.c | 6 + lib/vsprintf.c | 12 +- mm/Kconfig | 6 +- mm/backing-dev.c | 4 +- mm/filemap.c | 2 +- mm/gup.c | 13 +- mm/highmem.c | 7 +- mm/hugetlb.c | 70 +- mm/internal.h | 3 +- mm/maccess.c | 4 +- mm/madvise.c | 37 + mm/memory-failure.c | 30 +- mm/memory.c | 410 +- mm/mempolicy.c | 25 + mm/mlock.c | 15 +- mm/mm_init.c | 2 +- mm/mmap.c | 582 +- mm/mprotect.c | 137 +- mm/mremap.c | 44 +- mm/nommu.c | 21 +- mm/page-writeback.c | 2 +- mm/page_alloc.c | 48 +- mm/percpu.c | 2 +- mm/process_vm_access.c | 14 +- mm/rmap.c | 45 +- mm/shmem.c | 19 +- mm/slab.c | 109 +- mm/slab.h | 22 +- mm/slab_common.c | 86 +- mm/slob.c | 218 +- mm/slub.c | 101 +- mm/sparse-vmemmap.c | 4 +- mm/sparse.c | 2 +- mm/swap.c | 2 + mm/swapfile.c | 12 +- mm/util.c | 6 + mm/vmalloc.c | 112 +- mm/vmstat.c | 12 +- net/8021q/vlan.c | 5 +- net/8021q/vlan_netlink.c | 2 +- net/9p/mod.c | 4 +- net/9p/trans_fd.c | 2 +- net/atm/atm_misc.c | 8 +- net/atm/lec.h | 2 +- net/atm/proc.c | 6 +- net/atm/resources.c | 4 +- net/ax25/sysctl_net_ax25.c | 2 +- net/batman-adv/bat_iv_ogm.c | 8 +- net/batman-adv/fragmentation.c | 2 +- net/batman-adv/soft-interface.c | 8 +- net/batman-adv/types.h | 6 +- net/bluetooth/hci_sock.c | 2 +- net/bluetooth/l2cap_core.c | 6 +- net/bluetooth/l2cap_sock.c | 12 +- net/bluetooth/rfcomm/sock.c | 4 +- net/bluetooth/rfcomm/tty.c | 4 +- net/bridge/br_netlink.c | 2 +- net/bridge/netfilter/ebtables.c | 6 +- net/caif/cfctrl.c | 11 +- net/caif/chnl_net.c | 2 +- net/can/af_can.c | 2 +- net/can/gw.c | 6 +- net/ceph/messenger.c | 4 +- net/compat.c | 24 +- net/core/datagram.c | 2 +- net/core/dev.c | 16 +- net/core/filter.c | 2 +- net/core/flow.c | 6 +- net/core/neighbour.c | 4 +- net/core/net-sysfs.c | 2 +- net/core/net_namespace.c | 8 +- net/core/netpoll.c | 4 +- net/core/rtnetlink.c | 15 +- net/core/scm.c | 8 +- net/core/skbuff.c | 8 +- net/core/sock.c | 26 +- net/core/sock_diag.c | 9 +- net/core/sysctl_net_core.c | 22 +- net/decnet/af_decnet.c | 1 + net/decnet/sysctl_net_decnet.c | 4 +- net/hsr/hsr_netlink.c | 2 +- net/ieee802154/6lowpan/core.c | 2 +- net/ieee802154/6lowpan/reassembly.c | 14 +- net/ipv4/af_inet.c | 2 +- net/ipv4/devinet.c | 18 +- net/ipv4/fib_frontend.c | 6 +- net/ipv4/fib_semantics.c | 2 +- net/ipv4/inetpeer.c | 2 +- net/ipv4/ip_fragment.c | 15 +- net/ipv4/ip_gre.c | 6 +- net/ipv4/ip_sockglue.c | 2 +- net/ipv4/ip_vti.c | 4 +- net/ipv4/ipconfig.c | 6 +- net/ipv4/ipip.c | 4 +- net/ipv4/netfilter/arp_tables.c | 12 +- net/ipv4/netfilter/ip_tables.c | 12 +- net/ipv4/ping.c | 14 +- net/ipv4/raw.c | 14 +- net/ipv4/route.c | 32 +- net/ipv4/sysctl_net_ipv4.c | 22 +- net/ipv4/tcp_input.c | 4 +- net/ipv4/tcp_probe.c | 2 +- net/ipv4/udp.c | 10 +- net/ipv4/xfrm4_policy.c | 18 +- net/ipv6/addrconf.c | 16 +- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/icmp.c | 2 +- net/ipv6/ip6_fib.c | 4 +- net/ipv6/ip6_gre.c | 10 +- net/ipv6/ip6_tunnel.c | 4 +- net/ipv6/ip6_vti.c | 4 +- net/ipv6/ipv6_sockglue.c | 2 +- net/ipv6/netfilter/ip6_tables.c | 12 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 14 +- net/ipv6/ping.c | 33 +- net/ipv6/raw.c | 17 +- net/ipv6/reassembly.c | 13 +- net/ipv6/route.c | 2 +- net/ipv6/sit.c | 4 +- net/ipv6/sysctl_net_ipv6.c | 2 +- net/ipv6/udp.c | 6 +- net/ipv6/xfrm6_policy.c | 17 +- net/irda/ircomm/ircomm_tty.c | 18 +- net/iucv/af_iucv.c | 4 +- net/iucv/iucv.c | 2 +- net/key/af_key.c | 4 +- net/l2tp/l2tp_eth.c | 38 +- net/l2tp/l2tp_ip.c | 2 +- net/l2tp/l2tp_ip6.c | 2 +- net/mac80211/cfg.c | 8 +- net/mac80211/ieee80211_i.h | 3 +- net/mac80211/iface.c | 16 +- net/mac80211/main.c | 2 +- net/mac80211/pm.c | 4 +- net/mac80211/rate.c | 2 +- net/mac80211/sta_info.c | 2 +- net/mac80211/util.c | 8 +- net/mpls/af_mpls.c | 6 +- net/netfilter/ipset/ip_set_core.c | 2 +- net/netfilter/ipvs/ip_vs_conn.c | 6 +- net/netfilter/ipvs/ip_vs_core.c | 4 +- net/netfilter/ipvs/ip_vs_ctl.c | 14 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 2 +- net/netfilter/ipvs/ip_vs_sync.c | 6 +- net/netfilter/ipvs/ip_vs_xmit.c | 4 +- net/netfilter/nf_conntrack_acct.c | 2 +- net/netfilter/nf_conntrack_ecache.c | 2 +- net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_proto.c | 2 +- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_conntrack_timestamp.c | 2 +- net/netfilter/nf_log.c | 10 +- net/netfilter/nf_sockopt.c | 4 +- net/netfilter/nfnetlink_log.c | 4 +- net/netfilter/nft_compat.c | 9 +- net/netfilter/xt_statistic.c | 8 +- net/netlink/af_netlink.c | 4 +- net/openvswitch/vport-internal_dev.c | 2 +- net/openvswitch/vport.c | 16 +- net/openvswitch/vport.h | 8 +- net/packet/af_packet.c | 8 +- net/phonet/pep.c | 6 +- net/phonet/socket.c | 2 +- net/phonet/sysctl.c | 2 +- net/rds/cong.c | 6 +- net/rds/ib.h | 2 +- net/rds/ib_cm.c | 2 +- net/rds/ib_recv.c | 4 +- net/rds/iw.h | 2 +- net/rds/iw_cm.c | 2 +- net/rds/iw_recv.c | 4 +- net/rds/rds.h | 2 +- net/rds/tcp.c | 2 +- net/rds/tcp_send.c | 2 +- net/rxrpc/af_rxrpc.c | 2 +- net/rxrpc/ar-ack.c | 14 +- net/rxrpc/ar-call.c | 2 +- net/rxrpc/ar-connection.c | 2 +- net/rxrpc/ar-connevent.c | 2 +- net/rxrpc/ar-input.c | 4 +- net/rxrpc/ar-internal.h | 8 +- net/rxrpc/ar-local.c | 2 +- net/rxrpc/ar-output.c | 4 +- net/rxrpc/ar-peer.c | 2 +- net/rxrpc/ar-proc.c | 4 +- net/rxrpc/ar-transport.c | 2 +- net/rxrpc/rxkad.c | 4 +- net/sched/sch_generic.c | 4 +- net/sctp/ipv6.c | 6 +- net/sctp/protocol.c | 10 +- net/sctp/sm_sideeffect.c | 2 +- net/sctp/socket.c | 21 +- net/sctp/sysctl.c | 10 +- net/socket.c | 18 +- net/sunrpc/auth_gss/svcauth_gss.c | 4 +- net/sunrpc/clnt.c | 4 +- net/sunrpc/sched.c | 4 +- net/sunrpc/svc.c | 4 +- net/sunrpc/svcauth_unix.c | 4 +- net/sunrpc/xprtrdma/svc_rdma.c | 38 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 +- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_transport.c | 10 +- net/tipc/netlink_compat.c | 12 +- net/tipc/subscr.c | 2 +- net/unix/af_unix.c | 7 +- net/unix/sysctl_net_unix.c | 2 +- net/wireless/wext-core.c | 19 +- net/xfrm/xfrm_policy.c | 16 +- net/xfrm/xfrm_state.c | 33 +- net/xfrm/xfrm_sysctl.c | 2 +- scripts/Kbuild.include | 2 +- scripts/Makefile.build | 2 +- scripts/Makefile.clean | 3 +- scripts/Makefile.host | 63 +- scripts/basic/fixdep.c | 12 +- scripts/gcc-plugin.sh | 51 + scripts/headers_install.sh | 1 + scripts/link-vmlinux.sh | 2 +- scripts/mod/file2alias.c | 14 +- scripts/mod/modpost.c | 25 +- scripts/mod/modpost.h | 6 +- scripts/mod/sumversion.c | 2 +- scripts/module-common.lds | 4 + scripts/package/builddeb | 1 + scripts/pnmtologo.c | 6 +- scripts/sortextable.h | 6 +- scripts/tags.sh | 2 +- security/Kconfig | 692 +- security/apparmor/lsm.c | 2 +- security/integrity/ima/ima.h | 4 +- security/integrity/ima/ima_api.c | 2 +- security/integrity/ima/ima_fs.c | 4 +- security/integrity/ima/ima_queue.c | 2 +- security/keys/key.c | 18 +- security/security.c | 9 +- security/selinux/avc.c | 6 +- security/selinux/hooks.c | 10 +- security/selinux/include/xfrm.h | 2 +- security/smack/smack_lsm.c | 2 +- security/tomoyo/tomoyo.c | 2 +- security/yama/yama_lsm.c | 4 +- sound/aoa/codecs/onyx.c | 7 +- sound/aoa/codecs/onyx.h | 1 + sound/core/oss/pcm_oss.c | 18 +- sound/core/pcm_compat.c | 2 +- sound/core/pcm_native.c | 4 +- sound/core/sound.c | 2 +- sound/drivers/mts64.c | 14 +- sound/drivers/opl4/opl4_lib.c | 2 +- sound/drivers/portman2x4.c | 3 +- sound/firewire/amdtp.c | 4 +- sound/firewire/amdtp.h | 4 +- sound/firewire/isight.c | 10 +- sound/firewire/scs1x.c | 8 +- sound/oss/sb_audio.c | 2 +- sound/oss/swarm_cs4297a.c | 6 +- sound/pci/hda/hda_codec.c | 2 +- sound/pci/ymfpci/ymfpci.h | 2 +- sound/pci/ymfpci/ymfpci_main.c | 12 +- sound/soc/soc-ac97.c | 6 +- sound/soc/xtensa/xtfpga-i2s.c | 2 +- tools/gcc/Makefile | 42 + tools/gcc/checker_plugin.c | 150 + tools/gcc/colorize_plugin.c | 215 + tools/gcc/constify_plugin.c | 564 + tools/gcc/gcc-common.h | 689 + tools/gcc/initify_plugin.c | 450 + tools/gcc/kallocstat_plugin.c | 188 + tools/gcc/kernexec_plugin.c | 547 + tools/gcc/latent_entropy_plugin.c | 474 + tools/gcc/size_overflow_plugin/.gitignore | 1 + tools/gcc/size_overflow_plugin/Makefile | 20 + .../generate_size_overflow_hash.sh | 102 + .../insert_size_overflow_asm.c | 409 + .../size_overflow_plugin/intentional_overflow.c | 958 + tools/gcc/size_overflow_plugin/misc.c | 441 + .../size_overflow_plugin/remove_unnecessary_dup.c | 137 + tools/gcc/size_overflow_plugin/size_overflow.h | 281 + .../gcc/size_overflow_plugin/size_overflow_debug.c | 164 + .../size_overflow_plugin/size_overflow_hash.data |27576 ++++++++++++++++++++ .../size_overflow_hash_aux.data | 92 + tools/gcc/size_overflow_plugin/size_overflow_ipa.c | 913 + .../size_overflow_plugin/size_overflow_plugin.c | 256 + .../size_overflow_plugin_hash.c | 345 + .../size_overflow_plugin/size_overflow_transform.c | 433 + .../size_overflow_transform_core.c | 962 + tools/gcc/stackleak_plugin.c | 432 + tools/gcc/structleak_plugin.c | 287 + tools/include/linux/compiler.h | 8 + tools/lib/api/Makefile | 2 +- tools/perf/util/include/asm/alternative-asm.h | 3 + tools/virtio/linux/uaccess.h | 2 +- virt/kvm/kvm_main.c | 44 +- 1898 files changed, 59774 insertions(+), 8683 deletions(-)