commit ba5ee94199b11c1429559a08c2158677dd8f1761 Author: Brad Spengler Date: Thu Mar 3 20:20:19 2016 -0500 Update size_overflow hash table tools/gcc/size_overflow_plugin/size_overflow_hash.data | 1 + 1 file changed, 1 insertion(+) commit 50a5cd726362f0988b81a54d4c962acf8fd34a70 Merge: 335c04c 1cbae46 Author: Brad Spengler Date: Thu Mar 3 20:04:00 2016 -0500 Merge branch 'pax-test' into grsec-test commit 1cbae46efa0b111ef2d46502f8d34c4c572a0e00 Merge: a51cdb8 c252409 Author: Brad Spengler Date: Thu Mar 3 19:57:43 2016 -0500 Merge branch 'linux-4.4.y' into pax-test commit 335c04c8146a696a6101a9c69dbd47f11383549e Merge: 897877e a51cdb8 Author: Brad Spengler Date: Tue Mar 1 17:57:24 2016 -0500 Merge branch 'pax-test' into grsec-test commit a51cdb83569b450858737a30d2be043d87d7ddc1 Author: Brad Spengler Date: Tue Mar 1 17:56:43 2016 -0500 Update to pax-linux-4.4.3-test6.patch: - spender fixed the cftype constification fallout, reported by quasar366 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4391) - fixed a few section mismatches on notifier_block variables - fixed a few REFCOUNT false positives found by Emese's plugin - constified hypervisor_x86 arch/x86/include/asm/hypervisor.h | 2 +- arch/x86/kernel/cpu/mshyperv.c | 2 +- arch/x86/kernel/cpu/vmware.c | 2 +- arch/x86/kernel/kvm.c | 2 +- drivers/lightnvm/rrpc.c | 4 ++-- drivers/lightnvm/rrpc.h | 2 +- drivers/net/can/led.c | 2 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +- drivers/net/ethernet/rocker/rocker.c | 4 ++-- drivers/net/ipvlan/ipvlan_main.c | 6 +++--- drivers/net/vrf.c | 2 +- drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 12 ++++++------ drivers/staging/rtl8188eu/include/rtw_mlme_ext.h | 2 +- drivers/staging/rtl8723au/core/rtw_mlme_ext.c | 12 ++++++------ drivers/staging/rtl8723au/include/drv_types.h | 2 +- drivers/staging/rtl8723au/include/rtw_mlme_ext.h | 2 +- drivers/staging/rtl8723au/include/usb_ops.h | 4 ++-- drivers/thermal/x86_pkg_temp_thermal.c | 2 +- fs/proc/kcore.c | 2 +- mm/hugetlb_cgroup.c | 8 ++++---- mm/mm_init.c | 2 +- mm/slub.c | 2 +- net/mac802154/iface.c | 2 +- 23 files changed, 41 insertions(+), 41 deletions(-) commit 897877e79629a0b854e98cb666a9d898256d45a7 Merge: 1ffa5d5 4f4b213 Author: Brad Spengler Date: Sun Feb 28 20:54:59 2016 -0500 Merge branch 'pax-test' into grsec-test commit 4f4b21342a4a4f87c01f7909406e6b5f4c9dadbf Author: Brad Spengler Date: Sun Feb 28 20:54:06 2016 -0500 Update to pax-linux-4.4.3-test5.patch: - constified xfrm_mgr and cftype, by Mathias Krause - Emese fixed a few checkpatch reports on the gcc plugin generator headers - Emese fixed a false positive size overflow report in get_next_ino, reported by KARBOWSKI Piotr - added a generator for SIMPLE_IPA passes as well include/linux/cgroup-defs.h | 2 +- include/linux/hugetlb.h | 2 +- include/linux/hugetlb_cgroup.h | 11 ++ include/net/xfrm.h | 2 +- kernel/cgroup.c | 29 ++-- mm/hugetlb.c | 55 ++++++- mm/hugetlb_cgroup.c | 60 ++----- mm/mmap.c | 38 ++--- net/xfrm/xfrm_state.c | 4 +- tools/gcc/constify_plugin.c | 5 +- tools/gcc/gcc-common.h | 42 +++-- tools/gcc/gcc-generate-gimple-pass.h | 27 ++-- tools/gcc/gcc-generate-ipa-pass.h | 43 ++--- tools/gcc/gcc-generate-rtl-pass.h | 27 ++-- tools/gcc/gcc-generate-simple_ipa-pass.h | 173 +++++++++++++++++++++ tools/gcc/size_overflow_plugin/.gitignore | 1 + .../disable_size_overflow_hash.data | 7 +- .../size_overflow_plugin/size_overflow_hash.data | 3 - 18 files changed, 385 insertions(+), 146 deletions(-) commit 1ffa5d50a2161311d46b56fdef734f309503cb80 Author: Brad Spengler Date: Sun Feb 28 20:43:02 2016 -0500 Make suid/sgid bruteforce prevention also apply to binaries with fscaps enabled grsecurity/grsec_sig.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit cfdb373a77c88d01c1539e605e28143af5981571 Author: Brad Spengler Date: Sun Feb 28 19:12:39 2016 -0500 compile fix grsecurity/gracl_segv.c | 2 +- grsecurity/grsec_sig.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 67d5160f8c1ee12ee4da1e7ad57f8688fcc77b53 Author: Brad Spengler Date: Sun Feb 28 18:24:50 2016 -0500 Update the daemon check in handling of anti-bruteforcing of suid binaries by GRKERNSEC_BRUTE to prevent a bypass reported by Jann Horn where one could create unprivileged copies of the suid binary via ptrace, inject code into them, and fork+exec a privileged copy. A crash then in the privileged copy would trigger the daemon detection which could be avoided by simply terminating the original process. Defeat this by using our is_privileged_binary() function against the task's mm->binfmt->file to detect an fscaps-enabled or suid/sgid binary being involved. Also update the RBAC RES_CRASH code to use is_privileged_binary(). grsecurity/gracl_segv.c | 15 +-------------- grsecurity/grsec_sig.c | 3 ++- 2 files changed, 3 insertions(+), 15 deletions(-) commit 7382ec22b0c9627c674ccbb00210276d26f219e3 Author: Brad Spengler Date: Sun Feb 28 15:06:32 2016 -0500 Fix a GRKERNSEC_PTRACE_READEXEC bypass reported by Jann Horn where one could dump out an unreadable suid binary by creating a script that used that binary as an interpreter. fs/exec.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) commit 3e60eddebe1c59b97c0b5432506bf8e13d84e8e6 Merge: 2d35d52 8327ee6 Author: Brad Spengler Date: Thu Feb 25 18:44:11 2016 -0500 Merge branch 'pax-test' into grsec-test Conflicts: fs/proc/base.c kernel/ptrace.c mm/process_vm_access.c commit 8327ee64e5e24ae6a3446dd96b95d5185f70e1f6 Merge: 09d53c7 2134d97 Author: Brad Spengler Date: Thu Feb 25 18:36:46 2016 -0500 Merge branch 'linux-4.4.y' into pax-test Conflicts: mm/mmap.c commit 2d35d5276f3feb0c053209f8c3a77b1f55f9d96b Author: Brad Spengler Date: Wed Feb 24 07:59:12 2016 -0500 Remove /proc/pid/map_files which we had previously prevented via an inverted dependency on checkpoint/restart, but clearly should have guarded independently as upstream in 4.3 enabled it regardless of checkpoint/ restart support. It can be used since 4.3 as an ASLR leak under RBAC to processes of the same UID. Thanks to Mathias Krause for the report! fs/proc/base.c | 2 ++ 1 file changed, 2 insertions(+) commit e4f1e517092222aa28179b20e14c0ddfb2796049 Author: Brad Spengler Date: Thu Feb 18 19:32:39 2016 -0500 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 158 +++++++++++++++++---- 1 file changed, 131 insertions(+), 27 deletions(-) commit d5f895ddfa903d0d70425b8c3d7ef649c7e6943b Author: Brad Spengler Date: Thu Feb 18 18:52:37 2016 -0500 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 293 +++++++++++++++++---- 1 file changed, 237 insertions(+), 56 deletions(-) commit 9d198df724c306c36e254fe19d0957fb608c3fa2 Author: Brad Spengler Date: Thu Feb 18 18:23:03 2016 -0500 compile fix tools/gcc/randomize_layout_plugin.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 024d2af98b755712daff6ed7c49af921da4e8883 Author: Brad Spengler Date: Thu Feb 18 18:19:47 2016 -0500 compile fix tools/gcc/randomize_layout_plugin.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 14a7b3bb5c3d8c6ef70c3e0842a5adc7f0f3e2c8 Author: Brad Spengler Date: Thu Feb 18 18:16:32 2016 -0500 compile fix tools/gcc/randomize_layout_plugin.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 9b2d0ee62bc66858c274f256c0502cbcbd34b2bf Author: Brad Spengler Date: Thu Feb 18 17:54:51 2016 -0500 Compile fix tools/gcc/randomize_layout_plugin.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 13823395101c4228ecded4b624583389ee13bfb3 Author: Brad Spengler Date: Thu Feb 18 17:35:21 2016 -0500 compile fix Makefile | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 0316a42a37e67b0bc8a545c7a8b63db2d25f1ab0 Merge: 45cbb7e 09d53c7 Author: Brad Spengler Date: Thu Feb 18 16:40:51 2016 -0500 Merge branch 'pax-test' into grsec-test Conflicts: Makefile include/linux/genl_magic_struct.h scripts/mod/modpost.c tools/gcc/size_overflow_plugin/size_overflow_hash.data commit 09d53c74140e87e886a28980cedbb7e771f2a356 Author: Brad Spengler Date: Thu Feb 18 16:24:02 2016 -0500 Update to pax-linux-4.4.2-test4.patch: - fixed the initialization of ipc_namespace.shm_ctlmax to prevent the size overflow plugin from catching an integer truncation when calling shmem_kernel_file_setup, reported by Mathias Krause - moved gcc plugin related makefile bits into a separate file, by Emese - changed modpost to report writable function pointers separately - increased the size of mem_cgroup.numainfo_events to avoid a wraparound caught by REFCOUNT, reported by alexey vlasov - reduced the size of the compat syscall entry points on amd64 - fixed an integer signedness mixup in drbd caught by the size overflow plugin, reported by iamb and gaima (https://forums.grsecurity.net/viewtopic.php?f=3&t=4366) - Emese regenerated the size overflow hash table for 4.4 - all plugins now use the new pass generator headers Makefile | 73 +- arch/x86/entry/entry_64.S | 2 +- arch/x86/entry/entry_64_compat.S | 48 +- fs/exec.c | 3 + include/linux/genl_magic_struct.h | 4 +- include/linux/memcontrol.h | 2 +- ipc/shm.c | 2 +- mm/memcontrol.c | 6 +- scripts/Makefile.extrawarn | 4 + scripts/Makefile.gcc-plugins | 69 + scripts/mod/modpost.c | 15 +- tools/gcc/checker_plugin.c | 71 +- tools/gcc/colorize_plugin.c | 65 +- tools/gcc/constify_plugin.c | 65 +- tools/gcc/gcc-generate-gimple-pass.h | 172 + tools/gcc/gcc-generate-ipa-pass.h | 286 + tools/gcc/gcc-generate-rtl-pass.h | 172 + tools/gcc/initify_plugin.c | 74 +- tools/gcc/kallocstat_plugin.c | 65 +- tools/gcc/kernexec_plugin.c | 184 +- tools/gcc/latent_entropy_plugin.c | 71 +- tools/gcc/randomize_layout_seed.h | 1 - .../disable_size_overflow_hash.h | 152601 ------------------ .../insert_size_overflow_asm.c | 71 +- .../size_overflow_plugin/intentional_overflow.c | 6 +- tools/gcc/size_overflow_plugin/size_overflow.h | 20 +- .../size_overflow_plugin/size_overflow_hash.data | 2898 +- tools/gcc/size_overflow_plugin/size_overflow_ipa.c | 94 +- .../size_overflow_plugin/size_overflow_plugin.c | 14 +- .../size_overflow_plugin/size_overflow_transform.c | 2 +- .../size_overflow_transform_core.c | 2 +- tools/gcc/stackleak_plugin.c | 132 +- tools/gcc/structleak_plugin.c | 67 +- 33 files changed, 2238 insertions(+), 155123 deletions(-) commit 45cbb7e015a18625dafb019246e13e8cf3a18ace Merge: 3b5448b 0c85110 Author: Brad Spengler Date: Wed Feb 17 19:11:25 2016 -0500 Merge branch 'pax-test' into grsec-test commit 0c851109f683896aaff8a310bbfa943272b47516 Merge: 6cb4f49 1cb8570 Author: Brad Spengler Date: Wed Feb 17 19:11:21 2016 -0500 Merge branch 'linux-4.4.y' into pax-test commit 3b5448bd1d85025d19b2587902e4264eb212a0a3 Author: Brad Spengler Date: Mon Feb 15 18:02:40 2016 -0500 Fix a drbd bug reported by iamb on the forums: https://forums.grsecurity.net/viewtopic.php?f=3&t=4366#p16032 which caused a size_overflow report include/linux/genl_magic_struct.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 061fcd0e74441189a87bfe13b55fb02b98f7d7c0 Author: Brad Spengler Date: Mon Feb 15 13:20:38 2016 -0500 compile fix drivers/staging/wilc1000/host_interface.h | 1 + 1 file changed, 1 insertion(+) commit 675f2dcbdd4ea3293eea9c42f0cc427b1c903fc8 Author: Brad Spengler Date: Mon Feb 15 12:54:52 2016 -0500 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) commit c8c50394f0c9f2e9baaeb884a29be2057cadbf7b Author: Brad Spengler Date: Mon Feb 15 12:53:54 2016 -0500 compile fix drivers/staging/wilc1000/wilc_spi.c | 1 - drivers/staging/wilc1000/wilc_wlan.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) commit a9dd4481db099082967585be8e153899e5fd24c7 Author: Brad Spengler Date: Mon Feb 15 12:52:32 2016 -0500 compile fix fs/proc/fd.c | 2 -- 1 file changed, 2 deletions(-) commit 5acb4fa0063460807096429f073181d1c5a3e566 Author: Brad Spengler Date: Mon Feb 15 12:32:13 2016 -0500 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 224 +++++++++++++++++---- 1 file changed, 182 insertions(+), 42 deletions(-) commit c0bac9ff9af7ef753740622b5736684a32b49a9f Author: Brad Spengler Date: Mon Feb 15 12:31:16 2016 -0500 compile fix drivers/staging/wilc1000/wilc_spi.c | 1 + 1 file changed, 1 insertion(+) commit 2f89ebdee131f6a6c85e611e5b993d4b19bc2673 Author: Brad Spengler Date: Mon Feb 15 12:28:36 2016 -0500 RANDSTRUCT compile fix drivers/staging/wilc1000/wilc_spi.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) commit 693be5d7f5b783f451499bbe83162aeb0f27a09f Author: Brad Spengler Date: Mon Feb 15 12:24:49 2016 -0500 RANDSTRUCT compile fix drivers/staging/wilc1000/wilc_sdio.c | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) commit bdf3dcd665c1a8ef9b69ad6525760c5160ec19a2 Author: Hariprasad S Date: Fri Dec 11 13:59:17 2015 +0530 iw_cxgb3: Fix incorrectly returning error on success The cxgb3_*_send() functions return NET_XMIT_ values, which are positive integers values. So don't treat positive return values as an error. Signed-off-by: Steve Wise Signed-off-by: Hariprasad Shenai Signed-off-by: Doug Ledford drivers/infiniband/hw/cxgb3/iwch_cm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8705fe372dc21046ca3fc55381b70cffb4c60207 Author: Daniel Borkmann Date: Wed Feb 10 16:47:11 2016 +0100 bpf: fix branch offset adjustment on backjumps after patching ctx expansion When ctx access is used, the kernel often needs to expand/rewrite instructions, so after that patching, branch offsets have to be adjusted for both forward and backward jumps in the new eBPF program, but for backward jumps it fails to account the delta. Meaning, for example, if the expansion happens exactly on the insn that sits at the jump target, it doesn't fix up the back jump offset. Analysis on what the check in adjust_branches() is currently doing: /* adjust offset of jmps if necessary */ if (i < pos && i + insn->off + 1 > pos) insn->off += delta; else if (i > pos && i + insn->off + 1 < pos) insn->off -= delta; First condition (forward jumps): Before: After: insns[0] insns[0] insns[1] <--- i/insn insns[1] <--- i/insn insns[2] <--- pos insns[P] <--- pos insns[3] insns[P] `------| delta insns[4] <--- target_X insns[P] `-----| insns[5] insns[3] insns[4] <--- target_X insns[5] First case is if we cross pos-boundary and the jump instruction was before pos. This is handeled correctly. I.e. if i == pos, then this would mean our jump that we currently check was the patchlet itself that we just injected. Since such patchlets are self-contained and have no awareness of any insns before or after the patched one, the delta is correctly not adjusted. Also, for the second condition in case of i + insn->off + 1 == pos, means we jump to that newly patched instruction, so no offset adjustment are needed. That part is correct. Second condition (backward jumps): Before: After: insns[0] insns[0] insns[1] <--- target_X insns[1] <--- target_X insns[2] <--- pos <-- target_Y insns[P] <--- pos <-- target_Y insns[3] insns[P] `------| delta insns[4] <--- i/insn insns[P] `-----| insns[5] insns[3] insns[4] <--- i/insn insns[5] Second interesting case is where we cross pos-boundary and the jump instruction was after pos. Backward jump with i == pos would be impossible and pose a bug somewhere in the patchlet, so the first condition checking i > pos is okay only by itself. However, i + insn->off + 1 < pos does not always work as intended to trigger the adjustment. It works when jump targets would be far off where the delta wouldn't matter. But, for example, where the fixed insn->off before pointed to pos (target_Y), it now points to pos + delta, so that additional room needs to be taken into account for the check. This means that i) both tests here need to be adjusted into pos + delta, and ii) for the second condition, the test needs to be <= as pos itself can be a target in the backjump, too. Fixes: 9bac3d6d548e ("bpf: allow extended BPF programs access skb fields") Signed-off-by: Daniel Borkmann Signed-off-by: David S. Miller kernel/bpf/verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 61b513b644116e77313addf65970db58f4981608 Author: Ryan Ware Date: Thu Feb 11 15:58:44 2016 -0800 EVM: Use crypto_memneq() for digest comparisons This patch fixes vulnerability CVE-2016-2085. The problem exists because the vm_verify_hmac() function includes a use of memcmp(). Unfortunately, this allows timing side channel attacks; specifically a MAC forgery complexity drop from 2^128 to 2^12. This patch changes the memcmp() to the cryptographically safe crypto_memneq(). Reported-by: Xiaofei Rex Guo Signed-off-by: Ryan Ware Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar Signed-off-by: James Morris security/integrity/evm/evm_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 970b961e7d0684624f9c69f0b4367d5c76b65a63 Author: Michael McConville Date: Fri Feb 5 20:46:25 2016 -0500 dscc4: Undefined signed int shift My analysis in the below mail applies, although the second part is unnecessary because i isn't used in arithmetic operations here: https://marc.info/?l=openbsd-tech&m=145377854103866&w=2 Thanks for your time. Signed-off-by: Michael McConville Acked-by: Francois Romieu Signed-off-by: David S. Miller drivers/net/wan/dscc4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d843df24b6680b600e87ebfea3b7b198b90b5a2a Author: Andrey Konovalov Date: Sat Feb 13 11:08:06 2016 +0300 ALSA: usb-audio: avoid freeing umidi object twice The 'umidi' object will be free'd on the error path by snd_usbmidi_free() when tearing down the rawmidi interface. So we shouldn't try to free it in snd_usbmidi_create() after having registered the rawmidi interface. Found by KASAN. Signed-off-by: Andrey Konovalov Acked-by: Clemens Ladisch Cc: Signed-off-by: Takashi Iwai sound/usb/midi.c | 1 - 1 file changed, 1 deletion(-) commit ed3a8ab1976674d56e258da93639e61f1446e703 Author: zengtao Date: Tue Feb 2 11:38:34 2016 +0800 cputime: Prevent 32bit overflow in time[val|spec]_to_cputime() The datatype __kernel_time_t is u32 on 32bit platform, so its subject to overflows in the timeval/timespec to cputime conversion. Currently the following functions are affected: 1. setitimer() 2. timer_create/timer_settime() 3. sys_clock_nanosleep This can happen on MIPS32 and ARM32 with "Full dynticks CPU time accounting" enabled, which is required for CONFIG_NO_HZ_FULL. Enforce u64 conversion to prevent the overflow. Fixes: 31c1fc818715 ("ARM: Kconfig: allow full nohz CPU accounting") Signed-off-by: zengtao Reviewed-by: Arnd Bergmann Cc: Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/1454384314-154784-1-git-send-email-prime.zeng@huawei.com Signed-off-by: Thomas Gleixner include/asm-generic/cputime_nsecs.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit bf8a2de485da37d73850e7cfa31967b7798b6ce0 Author: Brad Spengler Date: Mon Feb 15 11:55:18 2016 -0500 Fix building with allnoconfig, don't make our added DATA_TO_TEXT mismatch warnings count as actual mismatches scripts/mod/modpost.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c9d82b6d0f1a2484fea0a516989dbdc6c55e5693 Author: Brad Spengler Date: Mon Feb 15 11:44:36 2016 -0500 Compile fix tools/gcc/randomize_layout_seed.h | 1 - 1 file changed, 1 deletion(-) commit fb68cbb98732e6801e8fc8d1da1f1195e51ff077 Author: Brad Spengler Date: Mon Feb 15 11:27:32 2016 -0500 disable USELIB init/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit cbda9a44b7f92161eb1e444bf7fe2bbcbedaae65 Author: Brad Spengler Date: Mon Feb 15 11:23:56 2016 -0500 compile fix fs/proc/fd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5cf0a2e87ab7105d1ba01f55f7636fa2e1fa4bb4 Author: Brad Spengler Date: Mon Feb 15 11:19:26 2016 -0500 Initial import of grsecurity for Linux 4.4.1 Documentation/dontdiff | 2 + Documentation/kernel-parameters.txt | 11 + Documentation/sysctl/fs.txt | 23 + Documentation/sysctl/kernel.txt | 15 + Makefile | 18 +- arch/alpha/include/asm/cache.h | 4 +- arch/alpha/kernel/osf_sys.c | 12 +- arch/arc/Kconfig | 1 + arch/arm/Kconfig | 1 + arch/arm/Kconfig.debug | 1 + arch/arm/include/asm/thread_info.h | 7 +- arch/arm/kernel/entry-common.S | 8 +- arch/arm/kernel/process.c | 4 +- arch/arm/kernel/ptrace.c | 9 + arch/arm/kernel/traps.c | 7 +- arch/arm/mm/Kconfig | 4 +- arch/arm/mm/fault.c | 40 +- arch/arm/mm/mmap.c | 8 +- arch/arm/net/bpf_jit_32.c | 51 +- arch/arm64/Kconfig.debug | 1 + arch/avr32/include/asm/cache.h | 4 +- arch/blackfin/Kconfig.debug | 1 + arch/blackfin/include/asm/cache.h | 3 +- arch/cris/include/arch-v10/arch/cache.h | 3 +- arch/cris/include/arch-v32/arch/cache.h | 3 +- arch/frv/include/asm/cache.h | 3 +- arch/frv/mm/elf-fdpic.c | 4 +- arch/hexagon/include/asm/cache.h | 6 +- arch/ia64/Kconfig | 1 + arch/ia64/include/asm/cache.h | 3 +- arch/ia64/kernel/sys_ia64.c | 2 + arch/ia64/mm/hugetlbpage.c | 2 + arch/m32r/include/asm/cache.h | 4 +- arch/m68k/include/asm/cache.h | 4 +- arch/metag/mm/hugetlbpage.c | 1 + arch/microblaze/include/asm/cache.h | 3 +- arch/mips/Kconfig | 1 + arch/mips/include/asm/cache.h | 3 +- arch/mips/include/asm/thread_info.h | 11 +- arch/mips/kernel/irq.c | 3 + arch/mips/kernel/ptrace.c | 9 + arch/mips/mm/mmap.c | 4 +- arch/mn10300/proc-mn103e010/include/proc/cache.h | 4 +- arch/mn10300/proc-mn2ws0050/include/proc/cache.h | 4 +- arch/openrisc/include/asm/cache.h | 4 +- arch/parisc/include/asm/cache.h | 3 + arch/parisc/kernel/sys_parisc.c | 4 + arch/powerpc/Kconfig | 1 + arch/powerpc/include/asm/cache.h | 4 +- arch/powerpc/include/asm/thread_info.h | 5 +- arch/powerpc/kernel/Makefile | 2 + arch/powerpc/kernel/irq.c | 3 + arch/powerpc/kernel/process.c | 10 +- arch/powerpc/kernel/ptrace.c | 14 + arch/powerpc/kernel/traps.c | 5 + arch/powerpc/mm/slice.c | 2 +- arch/s390/Kconfig.debug | 1 + arch/s390/include/asm/cache.h | 4 +- arch/score/include/asm/cache.h | 4 +- arch/sh/include/asm/cache.h | 3 +- arch/sh/mm/mmap.c | 6 +- arch/sparc/include/asm/cache.h | 4 +- arch/sparc/include/asm/pgalloc_64.h | 1 + arch/sparc/include/asm/thread_info_64.h | 8 +- arch/sparc/kernel/process_32.c | 6 +- arch/sparc/kernel/process_64.c | 8 +- arch/sparc/kernel/ptrace_64.c | 14 + arch/sparc/kernel/sys_sparc_64.c | 8 +- arch/sparc/kernel/syscalls.S | 8 +- arch/sparc/kernel/traps_32.c | 8 +- arch/sparc/kernel/traps_64.c | 28 +- arch/sparc/kernel/unaligned_64.c | 2 +- arch/sparc/mm/fault_64.c | 2 +- arch/sparc/mm/hugetlbpage.c | 15 +- arch/tile/Kconfig | 1 + arch/tile/include/asm/cache.h | 3 +- arch/tile/mm/hugetlbpage.c | 2 + arch/um/include/asm/cache.h | 3 +- arch/unicore32/include/asm/cache.h | 6 +- arch/x86/Kconfig | 21 + arch/x86/Kconfig.debug | 2 + arch/x86/entry/common.c | 14 + arch/x86/entry/entry_32.S | 2 +- arch/x86/entry/entry_64.S | 2 +- arch/x86/ia32/ia32_aout.c | 2 + arch/x86/include/asm/floppy.h | 20 +- arch/x86/include/asm/fpu/types.h | 69 +- arch/x86/include/asm/io.h | 2 +- arch/x86/include/asm/page.h | 12 +- arch/x86/include/asm/paravirt_types.h | 23 +- arch/x86/include/asm/pgtable_types.h | 6 +- arch/x86/include/asm/processor.h | 12 +- arch/x86/include/asm/thread_info.h | 6 +- arch/x86/include/asm/uaccess.h | 2 +- arch/x86/kernel/dumpstack.c | 10 +- arch/x86/kernel/dumpstack_32.c | 2 +- arch/x86/kernel/dumpstack_64.c | 2 +- arch/x86/kernel/ioport.c | 13 + arch/x86/kernel/irq_32.c | 3 + arch/x86/kernel/irq_64.c | 4 + arch/x86/kernel/ldt.c | 18 + arch/x86/kernel/msr.c | 10 + arch/x86/kernel/ptrace.c | 14 + arch/x86/kernel/signal.c | 9 +- arch/x86/kernel/sys_i386_32.c | 9 +- arch/x86/kernel/sys_x86_64.c | 8 +- arch/x86/kernel/traps.c | 5 + arch/x86/kernel/verify_cpu.S | 1 + arch/x86/kernel/vm86_32.c | 15 + arch/x86/mm/fault.c | 12 +- arch/x86/mm/hugetlbpage.c | 15 +- arch/x86/mm/init.c | 66 +- arch/x86/mm/init_32.c | 6 +- arch/x86/mm/pageattr.c | 4 +- arch/x86/net/bpf_jit_comp.c | 4 + arch/x86/platform/efi/efi_64.c | 2 +- arch/x86/xen/Kconfig | 1 + arch/xtensa/variants/dc232b/include/variant/core.h | 2 +- arch/xtensa/variants/fsf/include/variant/core.h | 3 +- crypto/scatterwalk.c | 10 +- drivers/acpi/acpica/hwxfsleep.c | 11 +- drivers/acpi/custom_method.c | 4 + drivers/block/cciss.h | 30 +- drivers/block/smart1,2.h | 40 +- drivers/cdrom/cdrom.c | 2 +- drivers/char/Kconfig | 4 +- drivers/char/genrtc.c | 1 + drivers/char/mem.c | 17 + drivers/char/random.c | 5 +- drivers/cpufreq/sparc-us3-cpufreq.c | 2 - drivers/firewire/ohci.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 70 +- drivers/gpu/drm/nouveau/nouveau_ttm.c | 28 +- drivers/gpu/drm/ttm/ttm_bo_manager.c | 10 +- drivers/gpu/drm/virtio/virtgpu_ttm.c | 10 +- drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 10 +- drivers/hid/hid-wiimote-debug.c | 2 +- drivers/infiniband/hw/nes/nes_cm.c | 22 +- drivers/iommu/Kconfig | 1 + drivers/iommu/amd_iommu.c | 14 +- drivers/isdn/gigaset/bas-gigaset.c | 32 +- drivers/isdn/gigaset/ser-gigaset.c | 32 +- drivers/isdn/gigaset/usb-gigaset.c | 32 +- drivers/isdn/i4l/isdn_concap.c | 6 +- drivers/isdn/i4l/isdn_x25iface.c | 16 +- drivers/md/bcache/Kconfig | 1 + drivers/md/raid5.c | 8 + drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +- drivers/media/platform/sti/c8sectpfe/Kconfig | 1 + drivers/media/radio/radio-cadet.c | 5 +- drivers/media/usb/dvb-usb/cinergyT2-core.c | 91 +- drivers/media/usb/dvb-usb/cinergyT2-fe.c | 182 +- drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 37 +- drivers/media/usb/dvb-usb/technisat-usb2.c | 75 +- drivers/message/fusion/mptbase.c | 9 + drivers/misc/sgi-xp/xp_main.c | 12 +- drivers/net/ethernet/brocade/bna/bna_enet.c | 8 +- drivers/net/ppp/pptp.c | 34 +- drivers/net/wan/lmc/lmc_media.c | 97 +- drivers/net/wan/z85230.c | 24 +- drivers/net/wireless/ath/ath9k/Kconfig | 1 - drivers/net/wireless/zd1211rw/zd_usb.c | 2 +- drivers/pci/proc.c | 9 + drivers/platform/x86/asus-wmi.c | 12 + drivers/rtc/rtc-dev.c | 3 + drivers/scsi/bfa/bfa_fcs.c | 19 +- drivers/scsi/bfa/bfa_fcs_lport.c | 29 +- drivers/scsi/bfa/bfa_modules.h | 12 +- drivers/scsi/hpsa.h | 40 +- drivers/staging/lustre/lustre/ldlm/ldlm_flock.c | 2 +- drivers/staging/lustre/lustre/libcfs/module.c | 10 +- drivers/tty/serial/uartlite.c | 4 +- drivers/tty/sysrq.c | 2 +- drivers/tty/tty_io.c | 4 + drivers/tty/vt/keyboard.c | 22 +- drivers/uio/uio.c | 6 +- drivers/usb/core/hub.c | 5 + drivers/usb/gadget/function/f_uac1.c | 1 + drivers/usb/gadget/function/u_uac1.c | 1 + drivers/usb/host/hwa-hc.c | 9 +- drivers/usb/usbip/vhci_sysfs.c | 2 +- drivers/video/fbdev/arcfb.c | 2 +- drivers/video/fbdev/matrox/matroxfb_DAC1064.c | 10 +- drivers/video/fbdev/matrox/matroxfb_Ti3026.c | 5 +- drivers/video/fbdev/sh_mobile_lcdcfb.c | 6 +- drivers/video/logo/logo_linux_clut224.ppm | 2720 ++++---- drivers/xen/xenfs/xenstored.c | 5 + firmware/Makefile | 2 + firmware/WHENCE | 20 +- firmware/bnx2/bnx2-mips-06-6.2.3.fw.ihex | 5804 +++++++++++++++++ firmware/bnx2/bnx2-mips-09-6.2.1b.fw.ihex | 6496 ++++++++++++++++++++ fs/attr.c | 4 + fs/autofs4/waitq.c | 9 + fs/binfmt_aout.c | 7 + fs/binfmt_elf.c | 40 +- fs/compat.c | 20 +- fs/compat_ioctl.c | 253 +- fs/coredump.c | 17 +- fs/dcache.c | 3 + fs/debugfs/inode.c | 11 +- fs/exec.c | 231 +- fs/ext2/balloc.c | 4 +- fs/ext2/super.c | 8 +- fs/ext4/balloc.c | 4 +- fs/ext4/extents.c | 2 +- fs/fcntl.c | 4 + fs/fhandle.c | 3 +- fs/file.c | 4 + fs/filesystems.c | 4 + fs/fs_struct.c | 20 +- fs/hugetlbfs/inode.c | 24 +- fs/inode.c | 8 +- fs/internal.h | 7 + fs/ioctl.c | 4 +- fs/kernfs/dir.c | 6 + fs/mount.h | 4 +- fs/namei.c | 283 +- fs/namespace.c | 24 + fs/nfsd/nfscache.c | 2 +- fs/open.c | 38 + fs/overlayfs/inode.c | 3 + fs/overlayfs/super.c | 6 +- fs/pipe.c | 49 +- fs/posix_acl.c | 15 +- fs/proc/Kconfig | 10 +- fs/proc/array.c | 69 +- fs/proc/base.c | 186 +- fs/proc/cmdline.c | 4 + fs/proc/devices.c | 4 + fs/proc/fd.c | 12 +- fs/proc/generic.c | 64 + fs/proc/inode.c | 17 + fs/proc/internal.h | 11 +- fs/proc/interrupts.c | 4 + fs/proc/kcore.c | 3 + fs/proc/namespaces.c | 4 +- fs/proc/proc_net.c | 31 + fs/proc/proc_sysctl.c | 52 +- fs/proc/root.c | 8 + fs/proc/stat.c | 69 +- fs/proc/task_mmu.c | 66 +- fs/readdir.c | 19 + fs/reiserfs/item_ops.c | 24 +- fs/reiserfs/super.c | 4 + fs/select.c | 2 + fs/seq_file.c | 30 +- fs/stat.c | 20 +- fs/sysfs/dir.c | 30 +- fs/utimes.c | 7 + fs/xattr.c | 26 +- grsecurity/Kconfig | 1203 ++++ grsecurity/Makefile | 54 + grsecurity/gracl.c | 2757 +++++++++ grsecurity/gracl_alloc.c | 105 + grsecurity/gracl_cap.c | 127 + grsecurity/gracl_compat.c | 269 + grsecurity/gracl_fs.c | 448 ++ grsecurity/gracl_ip.c | 386 ++ grsecurity/gracl_learn.c | 207 + grsecurity/gracl_policy.c | 1786 ++++++ grsecurity/gracl_res.c | 68 + grsecurity/gracl_segv.c | 304 + grsecurity/gracl_shm.c | 40 + grsecurity/grsec_chdir.c | 19 + grsecurity/grsec_chroot.c | 467 ++ grsecurity/grsec_disabled.c | 445 ++ grsecurity/grsec_exec.c | 189 + grsecurity/grsec_fifo.c | 26 + grsecurity/grsec_fork.c | 23 + grsecurity/grsec_init.c | 294 + grsecurity/grsec_ipc.c | 48 + grsecurity/grsec_link.c | 65 + grsecurity/grsec_log.c | 340 + grsecurity/grsec_mem.c | 48 + grsecurity/grsec_mount.c | 65 + grsecurity/grsec_pax.c | 47 + grsecurity/grsec_proc.c | 20 + grsecurity/grsec_ptrace.c | 30 + grsecurity/grsec_sig.c | 245 + grsecurity/grsec_sock.c | 244 + grsecurity/grsec_sysctl.c | 497 ++ grsecurity/grsec_time.c | 16 + grsecurity/grsec_tpe.c | 78 + grsecurity/grsec_tty.c | 18 + grsecurity/grsec_usb.c | 15 + grsecurity/grsum.c | 54 + include/linux/binfmts.h | 5 +- include/linux/capability.h | 13 + include/linux/compiler-gcc.h | 5 + include/linux/compiler.h | 8 + include/linux/cred.h | 8 +- include/linux/dcache.h | 5 +- include/linux/fs.h | 26 +- include/linux/fs_struct.h | 2 +- include/linux/fsnotify.h | 6 + include/linux/gracl.h | 342 ++ include/linux/gracl_compat.h | 156 + include/linux/gralloc.h | 9 + include/linux/grdefs.h | 140 + include/linux/grinternal.h | 231 + include/linux/grmsg.h | 119 + include/linux/grsecurity.h | 258 + include/linux/grsock.h | 19 + include/linux/ipc.h | 2 +- include/linux/ipc_namespace.h | 2 +- include/linux/kallsyms.h | 18 +- include/linux/key-type.h | 4 +- include/linux/kmod.h | 5 + include/linux/kobject.h | 2 +- include/linux/lsm_hooks.h | 4 +- include/linux/mm.h | 12 + include/linux/mm_types.h | 4 +- include/linux/module.h | 5 +- include/linux/mount.h | 2 +- include/linux/msg.h | 2 +- include/linux/netfilter/xt_gradm.h | 9 + include/linux/path.h | 4 +- include/linux/perf_event.h | 13 +- include/linux/pid_namespace.h | 2 +- include/linux/pipe_fs_i.h | 4 + include/linux/poison.h | 2 +- include/linux/printk.h | 2 +- include/linux/proc_fs.h | 22 +- include/linux/proc_ns.h | 2 +- include/linux/ptrace.h | 24 +- include/linux/radix-tree.h | 22 +- include/linux/random.h | 2 +- include/linux/rbtree_augmented.h | 4 +- include/linux/scatterlist.h | 12 +- include/linux/sched.h | 115 +- include/linux/security.h | 1 + include/linux/sem.h | 2 +- include/linux/seq_file.h | 5 + include/linux/shm.h | 6 +- include/linux/shmem_fs.h | 5 +- include/linux/skbuff.h | 3 + include/linux/slab.h | 9 - include/linux/sysctl.h | 8 +- include/linux/thread_info.h | 6 +- include/linux/tty.h | 2 +- include/linux/tty_driver.h | 4 +- include/linux/uidgid.h | 5 + include/linux/user_namespace.h | 2 +- include/linux/utsname.h | 2 +- include/linux/vermagic.h | 16 +- include/linux/vmalloc.h | 8 + include/net/af_unix.h | 6 +- include/net/ip.h | 2 +- include/net/neighbour.h | 2 +- include/net/net_namespace.h | 2 +- include/net/netfilter/nf_conntrack_core.h | 8 +- include/net/scm.h | 1 + include/net/sock.h | 2 +- include/trace/events/fs.h | 53 + include/uapi/linux/personality.h | 1 + init/Kconfig | 2 + init/main.c | 46 +- ipc/mqueue.c | 1 + ipc/msg.c | 3 +- ipc/msgutil.c | 4 +- ipc/sem.c | 3 +- ipc/shm.c | 26 +- ipc/util.c | 6 + kernel/auditsc.c | 2 +- kernel/bpf/syscall.c | 10 +- kernel/capability.c | 41 +- kernel/cgroup.c | 5 +- kernel/compat.c | 1 + kernel/configs.c | 11 + kernel/cred.c | 112 +- kernel/events/core.c | 16 +- kernel/exit.c | 10 +- kernel/fork.c | 86 +- kernel/futex.c | 6 +- kernel/futex_compat.c | 2 +- kernel/kallsyms.c | 9 + kernel/kcmp.c | 8 +- kernel/kexec_core.c | 2 +- kernel/kmod.c | 96 +- kernel/kprobes.c | 9 +- kernel/ksysfs.c | 2 + kernel/locking/lockdep_proc.c | 10 +- kernel/module.c | 108 +- kernel/panic.c | 4 +- kernel/pid.c | 18 +- kernel/power/Kconfig | 2 + kernel/printk/printk.c | 7 +- kernel/ptrace.c | 89 +- kernel/resource.c | 10 + kernel/sched/core.c | 11 +- kernel/seccomp.c | 22 +- kernel/signal.c | 37 +- kernel/sys.c | 64 +- kernel/sysctl.c | 186 +- kernel/taskstats.c | 6 + kernel/time/posix-timers.c | 8 + kernel/time/time.c | 5 + kernel/time/timekeeping.c | 3 + kernel/time/timer_list.c | 13 +- kernel/time/timer_stats.c | 10 +- kernel/trace/Kconfig | 2 + kernel/trace/trace_syscalls.c | 8 + kernel/user_namespace.c | 15 + lib/Kconfig.debug | 13 +- lib/Kconfig.kasan | 2 +- lib/is_single_threaded.c | 3 + lib/list_debug.c | 65 +- lib/nlattr.c | 2 + lib/radix-tree.c | 12 +- lib/rbtree.c | 4 +- lib/vsprintf.c | 39 +- localversion-grsec | 1 + mm/Kconfig | 8 +- mm/Kconfig.debug | 1 + mm/filemap.c | 1 + mm/kmemleak.c | 4 +- mm/memory.c | 2 +- mm/mempolicy.c | 12 +- mm/migrate.c | 3 +- mm/mlock.c | 11 +- mm/mmap.c | 103 +- mm/mprotect.c | 8 + mm/oom_kill.c | 4 + mm/page_alloc.c | 2 +- mm/process_vm_access.c | 8 +- mm/shmem.c | 11 +- mm/slab.c | 14 +- mm/slab_common.c | 2 +- mm/slob.c | 12 + mm/slub.c | 33 +- mm/util.c | 3 + mm/vmalloc.c | 82 +- mm/vmstat.c | 29 +- net/appletalk/atalk_proc.c | 2 +- net/atm/lec.c | 6 +- net/atm/mpoa_caches.c | 42 +- net/can/bcm.c | 2 +- net/can/proc.c | 2 +- net/core/dev_ioctl.c | 7 +- net/core/filter.c | 8 +- net/core/net-procfs.c | 17 +- net/core/pktgen.c | 2 +- net/core/scm.c | 7 + net/core/sock.c | 3 +- net/core/sysctl_net_core.c | 2 +- net/decnet/dn_dev.c | 2 +- net/ipv4/Kconfig | 1 + net/ipv4/devinet.c | 6 +- net/ipv4/inet_hashtables.c | 4 + net/ipv4/ip_input.c | 7 + net/ipv4/ip_sockglue.c | 3 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv4/route.c | 6 +- net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_ipv4.c | 24 +- net/ipv4/tcp_minisocks.c | 9 +- net/ipv4/tcp_timer.c | 11 + net/ipv4/udp.c | 24 + net/ipv6/Kconfig | 1 + net/ipv6/addrconf.c | 13 +- net/ipv6/proc.c | 2 +- net/ipv6/tcp_ipv6.c | 23 +- net/ipv6/udp.c | 7 + net/ipx/ipx_proc.c | 2 +- net/irda/irproc.c | 2 +- net/iucv/af_iucv.c | 3 + net/llc/llc_proc.c | 2 +- net/netfilter/Kconfig | 10 + net/netfilter/Makefile | 1 + net/netfilter/nf_conntrack_core.c | 46 +- net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/xt_gradm.c | 51 + net/netfilter/xt_hashlimit.c | 4 +- net/netfilter/xt_recent.c | 2 +- net/openvswitch/actions.c | 19 +- net/sctp/sm_sideeffect.c | 11 +- net/sctp/sm_statefuns.c | 17 +- net/socket.c | 75 +- net/sunrpc/Kconfig | 1 + net/sunrpc/cache.c | 2 +- net/sunrpc/stats.c | 2 +- net/sysctl_net.c | 2 +- net/unix/af_unix.c | 57 +- net/unix/garbage.c | 8 +- net/vmw_vsock/vmci_transport_notify.c | 30 +- net/vmw_vsock/vmci_transport_notify_qstate.c | 30 +- net/x25/sysctl_net_x25.c | 2 +- net/x25/x25_proc.c | 2 +- scripts/package/Makefile | 2 +- scripts/package/mkspec | 41 +- security/Kconfig | 369 +- security/apparmor/file.c | 4 +- security/apparmor/lsm.c | 8 +- security/commoncap.c | 36 +- security/keys/internal.h | 2 +- security/min_addr.c | 2 + security/smack/smack_lsm.c | 8 +- security/tomoyo/file.c | 12 +- security/tomoyo/mount.c | 4 + security/tomoyo/tomoyo.c | 20 +- security/yama/Kconfig | 2 +- security/yama/yama_lsm.c | 4 +- sound/core/timer.c | 4 +- sound/synth/emux/emux_seq.c | 14 +- sound/usb/line6/driver.c | 40 +- sound/usb/line6/toneport.c | 12 +- tools/gcc/.gitignore | 1 + tools/gcc/Makefile | 12 + tools/gcc/gen-random-seed.sh | 8 + tools/gcc/randomize_layout_plugin.c | 930 +++ tools/gcc/size_overflow_plugin/.gitignore | 1 + .../size_overflow_plugin/size_overflow_hash.data | 463 +- 513 files changed, 33007 insertions(+), 3251 deletions(-) commit 6cb4f49b6a55cf16ae82685e1ab9b74c95b2f743 Author: Brad Spengler Date: Mon Feb 15 10:51:41 2016 -0500 Initial import of pax-linux-4.4.1-test3.patch Documentation/dontdiff | 46 +- Documentation/kbuild/makefiles.txt | 39 +- Documentation/kernel-parameters.txt | 28 + Makefile | 119 +- arch/alpha/include/asm/atomic.h | 10 + arch/alpha/include/asm/elf.h | 7 + arch/alpha/include/asm/pgalloc.h | 6 + arch/alpha/include/asm/pgtable.h | 11 + arch/alpha/kernel/module.c | 2 +- arch/alpha/kernel/osf_sys.c | 8 +- arch/alpha/mm/fault.c | 141 +- arch/arm/Kconfig | 3 +- arch/arm/include/asm/atomic.h | 323 +- arch/arm/include/asm/cache.h | 5 +- arch/arm/include/asm/cacheflush.h | 2 +- arch/arm/include/asm/checksum.h | 14 +- arch/arm/include/asm/cmpxchg.h | 4 + arch/arm/include/asm/cpuidle.h | 2 +- arch/arm/include/asm/domain.h | 42 +- arch/arm/include/asm/elf.h | 9 +- arch/arm/include/asm/fncpy.h | 2 + arch/arm/include/asm/futex.h | 1 + arch/arm/include/asm/kmap_types.h | 2 +- arch/arm/include/asm/mach/dma.h | 2 +- arch/arm/include/asm/mach/map.h | 16 +- arch/arm/include/asm/outercache.h | 2 +- arch/arm/include/asm/page.h | 3 +- arch/arm/include/asm/pgalloc.h | 20 + arch/arm/include/asm/pgtable-2level-hwdef.h | 4 +- arch/arm/include/asm/pgtable-2level.h | 3 + arch/arm/include/asm/pgtable-3level.h | 3 + arch/arm/include/asm/pgtable.h | 54 +- arch/arm/include/asm/smp.h | 2 +- arch/arm/include/asm/thread_info.h | 3 + arch/arm/include/asm/tls.h | 3 + arch/arm/include/asm/uaccess.h | 113 +- arch/arm/include/uapi/asm/ptrace.h | 2 +- arch/arm/kernel/armksyms.c | 2 +- arch/arm/kernel/cpuidle.c | 2 +- arch/arm/kernel/entry-armv.S | 109 +- arch/arm/kernel/entry-common.S | 40 +- arch/arm/kernel/entry-header.S | 55 + arch/arm/kernel/fiq.c | 3 + arch/arm/kernel/module-plts.c | 7 +- arch/arm/kernel/module.c | 38 +- arch/arm/kernel/patch.c | 2 + arch/arm/kernel/process.c | 92 +- arch/arm/kernel/reboot.c | 1 + arch/arm/kernel/setup.c | 20 +- arch/arm/kernel/signal.c | 35 +- arch/arm/kernel/smp.c | 2 +- arch/arm/kernel/tcm.c | 4 +- arch/arm/kernel/vmlinux.lds.S | 6 +- arch/arm/kvm/arm.c | 8 +- arch/arm/lib/copy_page.S | 1 + arch/arm/lib/csumpartialcopyuser.S | 4 +- arch/arm/lib/delay.c | 2 +- arch/arm/lib/uaccess_with_memcpy.c | 4 +- arch/arm/mach-exynos/suspend.c | 6 +- arch/arm/mach-mvebu/coherency.c | 4 +- arch/arm/mach-omap2/board-n8x0.c | 2 +- arch/arm/mach-omap2/omap-mpuss-lowpower.c | 4 +- arch/arm/mach-omap2/omap-smp.c | 1 + arch/arm/mach-omap2/omap_device.c | 4 +- arch/arm/mach-omap2/omap_device.h | 4 +- arch/arm/mach-omap2/omap_hwmod.c | 4 +- arch/arm/mach-omap2/powerdomains43xx_data.c | 5 +- arch/arm/mach-omap2/wd_timer.c | 6 +- arch/arm/mach-shmobile/platsmp-apmu.c | 5 +- arch/arm/mach-tegra/cpuidle-tegra20.c | 2 +- arch/arm/mach-tegra/irq.c | 1 + arch/arm/mach-ux500/pm.c | 1 + arch/arm/mach-zynq/platsmp.c | 1 + arch/arm/mm/Kconfig | 6 +- arch/arm/mm/cache-l2x0.c | 2 +- arch/arm/mm/context.c | 10 +- arch/arm/mm/fault.c | 146 + arch/arm/mm/fault.h | 12 + arch/arm/mm/init.c | 39 + arch/arm/mm/ioremap.c | 4 +- arch/arm/mm/mmap.c | 30 +- arch/arm/mm/mmu.c | 162 +- arch/arm/net/bpf_jit_32.c | 3 + arch/arm/plat-iop/setup.c | 2 +- arch/arm/plat-omap/sram.c | 2 + arch/arm64/include/asm/atomic.h | 10 + arch/arm64/include/asm/percpu.h | 8 +- arch/arm64/include/asm/pgalloc.h | 5 + arch/arm64/include/asm/uaccess.h | 1 + arch/arm64/mm/dma-mapping.c | 2 +- arch/avr32/include/asm/elf.h | 8 +- arch/avr32/include/asm/kmap_types.h | 4 +- arch/avr32/mm/fault.c | 27 + arch/frv/include/asm/atomic.h | 10 + arch/frv/include/asm/kmap_types.h | 2 +- arch/frv/mm/elf-fdpic.c | 3 +- arch/ia64/Makefile | 1 + arch/ia64/include/asm/atomic.h | 10 + arch/ia64/include/asm/elf.h | 7 + arch/ia64/include/asm/pgalloc.h | 12 + arch/ia64/include/asm/pgtable.h | 13 +- arch/ia64/include/asm/spinlock.h | 2 +- arch/ia64/include/asm/uaccess.h | 27 +- arch/ia64/kernel/module.c | 45 +- arch/ia64/kernel/palinfo.c | 2 +- arch/ia64/kernel/sys_ia64.c | 7 + arch/ia64/kernel/vmlinux.lds.S | 2 +- arch/ia64/mm/fault.c | 32 +- arch/ia64/mm/init.c | 15 +- arch/m32r/lib/usercopy.c | 6 + arch/mips/cavium-octeon/dma-octeon.c | 2 +- arch/mips/include/asm/atomic.h | 368 +- arch/mips/include/asm/elf.h | 7 + arch/mips/include/asm/exec.h | 2 +- arch/mips/include/asm/hw_irq.h | 2 +- arch/mips/include/asm/local.h | 57 + arch/mips/include/asm/page.h | 2 +- arch/mips/include/asm/pgalloc.h | 5 + arch/mips/include/asm/pgtable.h | 3 + arch/mips/include/asm/uaccess.h | 1 + arch/mips/kernel/binfmt_elfn32.c | 7 + arch/mips/kernel/binfmt_elfo32.c | 7 + arch/mips/kernel/irq-gt641xx.c | 2 +- arch/mips/kernel/irq.c | 6 +- arch/mips/kernel/pm-cps.c | 2 +- arch/mips/kernel/process.c | 12 - arch/mips/kernel/sync-r4k.c | 24 +- arch/mips/kernel/traps.c | 13 +- arch/mips/mm/fault.c | 25 + arch/mips/mm/mmap.c | 51 +- arch/mips/sgi-ip27/ip27-nmi.c | 6 +- arch/mips/sni/rm200.c | 2 +- arch/mips/vr41xx/common/icu.c | 2 +- arch/mips/vr41xx/common/irq.c | 4 +- arch/parisc/include/asm/atomic.h | 10 + arch/parisc/include/asm/elf.h | 7 + arch/parisc/include/asm/pgalloc.h | 6 + arch/parisc/include/asm/pgtable.h | 11 + arch/parisc/include/asm/uaccess.h | 4 +- arch/parisc/kernel/module.c | 50 +- arch/parisc/kernel/sys_parisc.c | 15 + arch/parisc/kernel/traps.c | 4 +- arch/parisc/mm/fault.c | 140 +- arch/powerpc/include/asm/atomic.h | 329 +- arch/powerpc/include/asm/elf.h | 12 + arch/powerpc/include/asm/exec.h | 2 +- arch/powerpc/include/asm/kmap_types.h | 2 +- arch/powerpc/include/asm/local.h | 46 + arch/powerpc/include/asm/mman.h | 2 +- arch/powerpc/include/asm/page.h | 8 +- arch/powerpc/include/asm/page_64.h | 7 +- arch/powerpc/include/asm/pgalloc-64.h | 7 + arch/powerpc/include/asm/pgtable.h | 1 + arch/powerpc/include/asm/pte-hash32.h | 1 + arch/powerpc/include/asm/reg.h | 1 + arch/powerpc/include/asm/smp.h | 2 +- arch/powerpc/include/asm/spinlock.h | 42 +- arch/powerpc/include/asm/uaccess.h | 141 +- arch/powerpc/kernel/Makefile | 5 + arch/powerpc/kernel/exceptions-64e.S | 4 +- arch/powerpc/kernel/exceptions-64s.S | 2 +- arch/powerpc/kernel/module_32.c | 15 +- arch/powerpc/kernel/process.c | 46 - arch/powerpc/kernel/signal_32.c | 2 +- arch/powerpc/kernel/signal_64.c | 2 +- arch/powerpc/kernel/traps.c | 21 + arch/powerpc/kernel/vdso.c | 5 +- arch/powerpc/lib/usercopy_64.c | 18 - arch/powerpc/mm/fault.c | 56 +- arch/powerpc/mm/mmap.c | 16 + arch/powerpc/mm/slice.c | 13 +- arch/powerpc/platforms/cell/spufs/file.c | 4 +- arch/s390/include/asm/atomic.h | 10 + arch/s390/include/asm/elf.h | 7 + arch/s390/include/asm/exec.h | 2 +- arch/s390/include/asm/uaccess.h | 13 +- arch/s390/kernel/module.c | 22 +- arch/s390/kernel/process.c | 20 - arch/s390/mm/mmap.c | 16 + arch/score/include/asm/exec.h | 2 +- arch/score/kernel/process.c | 5 - arch/sh/mm/mmap.c | 22 +- arch/sparc/include/asm/atomic_64.h | 110 +- arch/sparc/include/asm/cache.h | 2 +- arch/sparc/include/asm/elf_32.h | 7 + arch/sparc/include/asm/elf_64.h | 7 + arch/sparc/include/asm/pgalloc_32.h | 1 + arch/sparc/include/asm/pgalloc_64.h | 1 + arch/sparc/include/asm/pgtable.h | 4 + arch/sparc/include/asm/pgtable_32.h | 15 +- arch/sparc/include/asm/pgtsrmmu.h | 5 + arch/sparc/include/asm/setup.h | 4 +- arch/sparc/include/asm/spinlock_64.h | 35 +- arch/sparc/include/asm/thread_info_32.h | 1 + arch/sparc/include/asm/thread_info_64.h | 2 + arch/sparc/include/asm/uaccess.h | 1 + arch/sparc/include/asm/uaccess_32.h | 28 +- arch/sparc/include/asm/uaccess_64.h | 24 +- arch/sparc/kernel/Makefile | 2 +- arch/sparc/kernel/prom_common.c | 2 +- arch/sparc/kernel/smp_64.c | 8 +- arch/sparc/kernel/sys_sparc_32.c | 2 +- arch/sparc/kernel/sys_sparc_64.c | 52 +- arch/sparc/kernel/traps_64.c | 27 +- arch/sparc/lib/Makefile | 2 +- arch/sparc/lib/atomic_64.S | 57 +- arch/sparc/lib/ksyms.c | 6 +- arch/sparc/mm/Makefile | 2 +- arch/sparc/mm/fault_32.c | 292 + arch/sparc/mm/fault_64.c | 486 + arch/sparc/mm/hugetlbpage.c | 22 +- arch/sparc/mm/init_64.c | 10 +- arch/tile/include/asm/atomic_64.h | 10 + arch/tile/include/asm/uaccess.h | 4 +- arch/um/Makefile | 4 + arch/um/include/asm/kmap_types.h | 2 +- arch/um/include/asm/page.h | 3 + arch/um/include/asm/pgtable-3level.h | 1 + arch/um/kernel/process.c | 16 - arch/x86/Kconfig | 26 +- arch/x86/Kconfig.cpu | 6 +- arch/x86/Kconfig.debug | 4 +- arch/x86/Makefile | 13 +- arch/x86/boot/Makefile | 3 + arch/x86/boot/bitops.h | 4 +- arch/x86/boot/boot.h | 2 +- arch/x86/boot/compressed/Makefile | 3 + arch/x86/boot/compressed/efi_stub_32.S | 16 +- arch/x86/boot/compressed/efi_thunk_64.S | 4 +- arch/x86/boot/compressed/head_32.S | 4 +- arch/x86/boot/compressed/head_64.S | 12 +- arch/x86/boot/compressed/misc.c | 11 +- arch/x86/boot/cpucheck.c | 16 +- arch/x86/boot/header.S | 6 +- arch/x86/boot/memory.c | 2 +- arch/x86/boot/video-vesa.c | 1 + arch/x86/boot/video.c | 2 +- arch/x86/crypto/aes-x86_64-asm_64.S | 4 + arch/x86/crypto/aesni-intel_asm.S | 106 +- arch/x86/crypto/blowfish-x86_64-asm_64.S | 7 + arch/x86/crypto/camellia-aesni-avx-asm_64.S | 10 + arch/x86/crypto/camellia-aesni-avx2-asm_64.S | 10 + arch/x86/crypto/camellia-x86_64-asm_64.S | 7 + arch/x86/crypto/cast5-avx-x86_64-asm_64.S | 51 +- arch/x86/crypto/cast6-avx-x86_64-asm_64.S | 25 +- arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 2 + arch/x86/crypto/ghash-clmulni-intel_asm.S | 4 + arch/x86/crypto/salsa20-x86_64-asm_64.S | 4 + arch/x86/crypto/serpent-avx-x86_64-asm_64.S | 9 + arch/x86/crypto/serpent-avx2-asm_64.S | 9 + arch/x86/crypto/serpent-sse2-x86_64-asm_64.S | 4 + arch/x86/crypto/sha1_ssse3_asm.S | 10 +- arch/x86/crypto/sha256-avx-asm.S | 2 + arch/x86/crypto/sha256-avx2-asm.S | 2 + arch/x86/crypto/sha256-ssse3-asm.S | 2 + arch/x86/crypto/sha512-avx-asm.S | 2 + arch/x86/crypto/sha512-avx2-asm.S | 2 + arch/x86/crypto/sha512-ssse3-asm.S | 2 + arch/x86/crypto/twofish-avx-x86_64-asm_64.S | 25 +- arch/x86/crypto/twofish-x86_64-asm_64-3way.S | 4 + arch/x86/crypto/twofish-x86_64-asm_64.S | 3 + arch/x86/entry/calling.h | 86 +- arch/x86/entry/common.c | 28 +- arch/x86/entry/entry_32.S | 311 +- arch/x86/entry/entry_64.S | 625 +- arch/x86/entry/entry_64_compat.S | 67 +- arch/x86/entry/thunk_64.S | 2 + arch/x86/entry/vdso/Makefile | 2 +- arch/x86/entry/vdso/vdso2c.h | 8 +- arch/x86/entry/vdso/vma.c | 37 +- arch/x86/entry/vsyscall/vsyscall_64.c | 20 +- arch/x86/entry/vsyscall/vsyscall_emu_64.S | 2 +- arch/x86/ia32/ia32_signal.c | 23 +- arch/x86/ia32/sys_ia32.c | 42 +- arch/x86/include/asm/alternative-asm.h | 43 +- arch/x86/include/asm/alternative.h | 4 +- arch/x86/include/asm/apic.h | 2 +- arch/x86/include/asm/apm.h | 4 +- arch/x86/include/asm/atomic.h | 230 +- arch/x86/include/asm/atomic64_32.h | 100 + arch/x86/include/asm/atomic64_64.h | 164 +- arch/x86/include/asm/bitops.h | 18 +- arch/x86/include/asm/boot.h | 2 +- arch/x86/include/asm/cache.h | 5 +- arch/x86/include/asm/checksum_32.h | 12 +- arch/x86/include/asm/cmpxchg.h | 39 + arch/x86/include/asm/compat.h | 4 + arch/x86/include/asm/cpufeature.h | 17 +- arch/x86/include/asm/desc.h | 78 +- arch/x86/include/asm/desc_defs.h | 6 + arch/x86/include/asm/div64.h | 2 +- arch/x86/include/asm/dma.h | 2 + arch/x86/include/asm/elf.h | 33 +- arch/x86/include/asm/emergency-restart.h | 2 +- arch/x86/include/asm/fpu/internal.h | 42 +- arch/x86/include/asm/fpu/types.h | 5 +- arch/x86/include/asm/futex.h | 14 +- arch/x86/include/asm/hw_irq.h | 4 +- arch/x86/include/asm/i8259.h | 2 +- arch/x86/include/asm/io.h | 22 +- arch/x86/include/asm/irqflags.h | 5 + arch/x86/include/asm/kprobes.h | 9 +- arch/x86/include/asm/local.h | 106 +- arch/x86/include/asm/mman.h | 15 + arch/x86/include/asm/mmu.h | 14 +- arch/x86/include/asm/mmu_context.h | 133 +- arch/x86/include/asm/module.h | 17 +- arch/x86/include/asm/nmi.h | 19 +- arch/x86/include/asm/page.h | 1 + arch/x86/include/asm/page_32.h | 12 +- arch/x86/include/asm/page_64.h | 14 +- arch/x86/include/asm/paravirt.h | 46 +- arch/x86/include/asm/paravirt_types.h | 15 +- arch/x86/include/asm/pgalloc.h | 23 + arch/x86/include/asm/pgtable-2level.h | 2 + arch/x86/include/asm/pgtable-3level.h | 7 + arch/x86/include/asm/pgtable.h | 126 +- arch/x86/include/asm/pgtable_32.h | 14 +- arch/x86/include/asm/pgtable_32_types.h | 24 +- arch/x86/include/asm/pgtable_64.h | 23 +- arch/x86/include/asm/pgtable_64_types.h | 5 + arch/x86/include/asm/pgtable_types.h | 26 +- arch/x86/include/asm/pmem.h | 2 +- arch/x86/include/asm/preempt.h | 2 +- arch/x86/include/asm/processor.h | 57 +- arch/x86/include/asm/ptrace.h | 15 +- arch/x86/include/asm/realmode.h | 4 +- arch/x86/include/asm/reboot.h | 10 +- arch/x86/include/asm/rmwcc.h | 84 +- arch/x86/include/asm/rwsem.h | 60 +- arch/x86/include/asm/segment.h | 27 +- arch/x86/include/asm/smap.h | 43 + arch/x86/include/asm/smp.h | 14 +- arch/x86/include/asm/stackprotector.h | 4 +- arch/x86/include/asm/stacktrace.h | 34 +- arch/x86/include/asm/switch_to.h | 4 +- arch/x86/include/asm/sys_ia32.h | 6 +- arch/x86/include/asm/thread_info.h | 27 +- arch/x86/include/asm/tlbflush.h | 77 +- arch/x86/include/asm/uaccess.h | 210 +- arch/x86/include/asm/uaccess_32.h | 28 +- arch/x86/include/asm/uaccess_64.h | 169 +- arch/x86/include/asm/word-at-a-time.h | 2 +- arch/x86/include/asm/x86_init.h | 10 +- arch/x86/include/asm/xen/page.h | 2 +- arch/x86/include/uapi/asm/e820.h | 2 +- arch/x86/kernel/Makefile | 2 +- arch/x86/kernel/acpi/boot.c | 4 +- arch/x86/kernel/acpi/sleep.c | 4 + arch/x86/kernel/acpi/wakeup_32.S | 6 +- arch/x86/kernel/alternative.c | 124 +- arch/x86/kernel/apic/apic.c | 4 +- arch/x86/kernel/apic/apic_flat_64.c | 6 +- arch/x86/kernel/apic/apic_noop.c | 2 +- arch/x86/kernel/apic/bigsmp_32.c | 2 +- arch/x86/kernel/apic/io_apic.c | 8 +- arch/x86/kernel/apic/msi.c | 2 +- arch/x86/kernel/apic/probe_32.c | 4 +- arch/x86/kernel/apic/vector.c | 2 + arch/x86/kernel/apic/x2apic_cluster.c | 2 +- arch/x86/kernel/apic/x2apic_phys.c | 2 +- arch/x86/kernel/apic/x2apic_uv_x.c | 2 +- arch/x86/kernel/apm_32.c | 21 +- arch/x86/kernel/asm-offsets.c | 20 + arch/x86/kernel/asm-offsets_64.c | 1 + arch/x86/kernel/cpu/Makefile | 4 - arch/x86/kernel/cpu/amd.c | 2 +- arch/x86/kernel/cpu/bugs_64.c | 2 + arch/x86/kernel/cpu/common.c | 202 +- arch/x86/kernel/cpu/intel_cacheinfo.c | 14 +- arch/x86/kernel/cpu/mcheck/mce.c | 34 +- arch/x86/kernel/cpu/mcheck/p5.c | 3 + arch/x86/kernel/cpu/mcheck/winchip.c | 3 + arch/x86/kernel/cpu/microcode/intel.c | 4 +- arch/x86/kernel/cpu/mtrr/generic.c | 6 +- arch/x86/kernel/cpu/mtrr/main.c | 2 +- arch/x86/kernel/cpu/mtrr/mtrr.h | 2 +- arch/x86/kernel/cpu/perf_event.c | 10 +- arch/x86/kernel/cpu/perf_event.h | 2 +- arch/x86/kernel/cpu/perf_event_amd_iommu.c | 2 +- arch/x86/kernel/cpu/perf_event_intel.c | 34 +- arch/x86/kernel/cpu/perf_event_intel_bts.c | 6 +- arch/x86/kernel/cpu/perf_event_intel_cqm.c | 4 +- arch/x86/kernel/cpu/perf_event_intel_ds.c | 7 +- arch/x86/kernel/cpu/perf_event_intel_lbr.c | 4 +- arch/x86/kernel/cpu/perf_event_intel_pt.c | 42 +- arch/x86/kernel/cpu/perf_event_intel_rapl.c | 2 +- arch/x86/kernel/cpu/perf_event_intel_uncore.c | 2 +- arch/x86/kernel/cpu/perf_event_intel_uncore.h | 2 +- arch/x86/kernel/crash_dump_64.c | 2 +- arch/x86/kernel/doublefault.c | 8 +- arch/x86/kernel/dumpstack.c | 24 +- arch/x86/kernel/dumpstack_32.c | 25 +- arch/x86/kernel/dumpstack_64.c | 62 +- arch/x86/kernel/e820.c | 4 +- arch/x86/kernel/early_printk.c | 1 + arch/x86/kernel/espfix_64.c | 44 +- arch/x86/kernel/fpu/core.c | 24 +- arch/x86/kernel/fpu/init.c | 40 +- arch/x86/kernel/fpu/regset.c | 22 +- arch/x86/kernel/fpu/signal.c | 20 +- arch/x86/kernel/fpu/xstate.c | 6 +- arch/x86/kernel/ftrace.c | 18 +- arch/x86/kernel/head64.c | 14 +- arch/x86/kernel/head_32.S | 235 +- arch/x86/kernel/head_64.S | 173 +- arch/x86/kernel/i386_ksyms_32.c | 12 + arch/x86/kernel/i8259.c | 10 +- arch/x86/kernel/io_delay.c | 2 +- arch/x86/kernel/ioport.c | 2 +- arch/x86/kernel/irq.c | 8 +- arch/x86/kernel/irq_32.c | 45 +- arch/x86/kernel/jump_label.c | 10 +- arch/x86/kernel/kgdb.c | 21 +- arch/x86/kernel/kprobes/core.c | 28 +- arch/x86/kernel/kprobes/opt.c | 16 +- arch/x86/kernel/ksysfs.c | 2 +- arch/x86/kernel/kvmclock.c | 20 +- arch/x86/kernel/ldt.c | 25 + arch/x86/kernel/livepatch.c | 11 +- arch/x86/kernel/machine_kexec_32.c | 6 +- arch/x86/kernel/mcount_64.S | 19 +- arch/x86/kernel/module.c | 78 +- arch/x86/kernel/msr.c | 2 +- arch/x86/kernel/nmi.c | 34 +- arch/x86/kernel/nmi_selftest.c | 4 +- arch/x86/kernel/paravirt-spinlocks.c | 2 +- arch/x86/kernel/paravirt.c | 45 +- arch/x86/kernel/paravirt_patch_64.c | 8 + arch/x86/kernel/pci-calgary_64.c | 2 +- arch/x86/kernel/pci-iommu_table.c | 2 +- arch/x86/kernel/pci-swiotlb.c | 2 +- arch/x86/kernel/process.c | 80 +- arch/x86/kernel/process_32.c | 29 +- arch/x86/kernel/process_64.c | 14 +- arch/x86/kernel/ptrace.c | 20 +- arch/x86/kernel/pvclock.c | 8 +- arch/x86/kernel/reboot.c | 44 +- arch/x86/kernel/reboot_fixups_32.c | 2 +- arch/x86/kernel/relocate_kernel_64.S | 3 +- arch/x86/kernel/setup.c | 29 +- arch/x86/kernel/setup_percpu.c | 29 +- arch/x86/kernel/signal.c | 17 +- arch/x86/kernel/smp.c | 2 +- arch/x86/kernel/smpboot.c | 29 +- arch/x86/kernel/step.c | 6 +- arch/x86/kernel/sys_i386_32.c | 184 + arch/x86/kernel/sys_x86_64.c | 22 +- arch/x86/kernel/tboot.c | 22 +- arch/x86/kernel/time.c | 8 +- arch/x86/kernel/tls.c | 7 +- arch/x86/kernel/tracepoint.c | 4 +- arch/x86/kernel/traps.c | 53 +- arch/x86/kernel/tsc.c | 2 +- arch/x86/kernel/uprobes.c | 4 +- arch/x86/kernel/vm86_32.c | 6 +- arch/x86/kernel/vmlinux.lds.S | 153 +- arch/x86/kernel/x8664_ksyms_64.c | 6 +- arch/x86/kernel/x86_init.c | 6 +- arch/x86/kvm/cpuid.c | 21 +- arch/x86/kvm/emulate.c | 6 +- arch/x86/kvm/i8259.c | 10 +- arch/x86/kvm/ioapic.c | 2 + arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/paging_tmpl.h | 2 +- arch/x86/kvm/svm.c | 10 +- arch/x86/kvm/vmx.c | 62 +- arch/x86/kvm/x86.c | 44 +- arch/x86/lguest/boot.c | 3 +- arch/x86/lib/atomic64_386_32.S | 164 + arch/x86/lib/atomic64_cx8_32.S | 98 +- arch/x86/lib/checksum_32.S | 99 +- arch/x86/lib/clear_page_64.S | 3 + arch/x86/lib/cmpxchg16b_emu.S | 3 + arch/x86/lib/copy_page_64.S | 14 +- arch/x86/lib/copy_user_64.S | 66 +- arch/x86/lib/csum-copy_64.S | 14 +- arch/x86/lib/csum-wrappers_64.c | 8 +- arch/x86/lib/getuser.S | 74 +- arch/x86/lib/insn.c | 8 +- arch/x86/lib/iomap_copy_64.S | 2 + arch/x86/lib/memcpy_64.S | 6 + arch/x86/lib/memmove_64.S | 3 +- arch/x86/lib/memset_64.S | 3 + arch/x86/lib/mmx_32.c | 243 +- arch/x86/lib/msr-reg.S | 2 + arch/x86/lib/putuser.S | 87 +- arch/x86/lib/rwsem.S | 6 +- arch/x86/lib/usercopy_32.c | 359 +- arch/x86/lib/usercopy_64.c | 22 +- arch/x86/math-emu/fpu_aux.c | 2 +- arch/x86/math-emu/fpu_entry.c | 4 +- arch/x86/math-emu/fpu_system.h | 2 +- arch/x86/mm/Makefile | 4 + arch/x86/mm/extable.c | 26 +- arch/x86/mm/fault.c | 570 +- arch/x86/mm/gup.c | 6 +- arch/x86/mm/highmem_32.c | 6 + arch/x86/mm/hugetlbpage.c | 24 +- arch/x86/mm/init.c | 111 +- arch/x86/mm/init_32.c | 111 +- arch/x86/mm/init_64.c | 46 +- arch/x86/mm/iomap_32.c | 4 + arch/x86/mm/ioremap.c | 52 +- arch/x86/mm/kmemcheck/kmemcheck.c | 4 +- arch/x86/mm/mmap.c | 40 +- arch/x86/mm/mmio-mod.c | 10 +- arch/x86/mm/mpx.c | 6 +- arch/x86/mm/numa.c | 4 +- arch/x86/mm/pageattr.c | 42 +- arch/x86/mm/pat.c | 12 +- arch/x86/mm/pat_rbtree.c | 2 +- arch/x86/mm/pf_in.c | 10 +- arch/x86/mm/pgtable.c | 214 +- arch/x86/mm/pgtable_32.c | 3 + arch/x86/mm/setup_nx.c | 7 + arch/x86/mm/tlb.c | 4 + arch/x86/mm/uderef_64.c | 37 + arch/x86/net/bpf_jit.S | 11 + arch/x86/net/bpf_jit_comp.c | 13 +- arch/x86/oprofile/backtrace.c | 6 +- arch/x86/oprofile/nmi_int.c | 8 +- arch/x86/oprofile/op_model_amd.c | 8 +- arch/x86/oprofile/op_model_ppro.c | 7 +- arch/x86/oprofile/op_x86_model.h | 2 +- arch/x86/pci/intel_mid_pci.c | 2 +- arch/x86/pci/irq.c | 8 +- arch/x86/pci/pcbios.c | 144 +- arch/x86/platform/efi/efi_32.c | 24 + arch/x86/platform/efi/efi_64.c | 26 +- arch/x86/platform/efi/efi_stub_32.S | 64 +- arch/x86/platform/efi/efi_stub_64.S | 2 + arch/x86/platform/intel-mid/intel-mid.c | 5 +- arch/x86/platform/intel-mid/intel_mid_weak_decls.h | 6 +- arch/x86/platform/intel-mid/mfld.c | 4 +- arch/x86/platform/intel-mid/mrfl.c | 2 +- arch/x86/platform/intel-quark/imr_selftest.c | 2 +- arch/x86/platform/olpc/olpc_dt.c | 2 +- arch/x86/power/cpu.c | 11 +- arch/x86/realmode/init.c | 10 +- arch/x86/realmode/rm/Makefile | 3 + arch/x86/realmode/rm/header.S | 4 +- arch/x86/realmode/rm/reboot.S | 4 + arch/x86/realmode/rm/trampoline_32.S | 12 +- arch/x86/realmode/rm/trampoline_64.S | 3 +- arch/x86/realmode/rm/wakeup_asm.S | 5 +- arch/x86/tools/Makefile | 2 +- arch/x86/tools/relocs.c | 96 +- arch/x86/um/mem_32.c | 2 +- arch/x86/um/tls_32.c | 2 +- arch/x86/xen/enlighten.c | 50 +- arch/x86/xen/mmu.c | 19 +- arch/x86/xen/smp.c | 16 +- arch/x86/xen/xen-asm_32.S | 2 +- arch/x86/xen/xen-head.S | 11 + arch/x86/xen/xen-ops.h | 2 - block/bio.c | 4 +- block/blk-cgroup.c | 18 +- block/blk-iopoll.c | 2 +- block/blk-map.c | 2 +- block/blk-softirq.c | 2 +- block/bsg.c | 12 +- block/cfq-iosched.c | 4 +- block/compat_ioctl.c | 4 +- block/genhd.c | 9 +- block/partitions/efi.c | 8 +- block/scsi_ioctl.c | 29 +- crypto/cryptd.c | 4 +- crypto/crypto_user.c | 8 +- crypto/pcrypt.c | 2 +- crypto/zlib.c | 12 +- drivers/acpi/acpi_video.c | 2 +- drivers/acpi/apei/apei-internal.h | 2 +- drivers/acpi/apei/ghes.c | 10 +- drivers/acpi/bgrt.c | 6 +- drivers/acpi/blacklist.c | 4 +- drivers/acpi/bus.c | 4 +- drivers/acpi/device_pm.c | 4 +- drivers/acpi/ec.c | 2 +- drivers/acpi/pci_slot.c | 2 +- drivers/acpi/processor_idle.c | 2 +- drivers/acpi/processor_pdc.c | 2 +- drivers/acpi/sleep.c | 2 +- drivers/acpi/sysfs.c | 4 +- drivers/acpi/thermal.c | 2 +- drivers/acpi/video_detect.c | 7 +- drivers/ata/libata-core.c | 12 +- drivers/ata/libata-scsi.c | 2 +- drivers/ata/libata.h | 2 +- drivers/ata/pata_arasan_cf.c | 4 +- drivers/atm/adummy.c | 2 +- drivers/atm/ambassador.c | 8 +- drivers/atm/atmtcp.c | 14 +- drivers/atm/eni.c | 10 +- drivers/atm/firestream.c | 8 +- drivers/atm/fore200e.c | 14 +- drivers/atm/he.c | 18 +- drivers/atm/horizon.c | 4 +- drivers/atm/idt77252.c | 36 +- drivers/atm/iphase.c | 34 +- drivers/atm/lanai.c | 12 +- drivers/atm/nicstar.c | 46 +- drivers/atm/solos-pci.c | 4 +- drivers/atm/suni.c | 4 +- drivers/atm/uPD98402.c | 16 +- drivers/atm/zatm.c | 6 +- drivers/base/bus.c | 4 +- drivers/base/devres.c | 4 +- drivers/base/devtmpfs.c | 8 +- drivers/base/node.c | 2 +- drivers/base/platform-msi.c | 20 +- drivers/base/power/domain.c | 7 +- drivers/base/power/runtime.c | 6 +- drivers/base/power/sysfs.c | 2 +- drivers/base/power/wakeup.c | 8 +- drivers/base/regmap/regmap-debugfs.c | 4 +- drivers/base/regmap/regmap.c | 4 +- drivers/base/syscore.c | 4 +- drivers/block/cciss.c | 28 +- drivers/block/cciss.h | 2 +- drivers/block/cpqarray.c | 28 +- drivers/block/cpqarray.h | 2 +- drivers/block/drbd/drbd_bitmap.c | 2 +- drivers/block/drbd/drbd_int.h | 8 +- drivers/block/drbd/drbd_main.c | 12 +- drivers/block/drbd/drbd_nl.c | 4 +- drivers/block/drbd/drbd_receiver.c | 38 +- drivers/block/drbd/drbd_worker.c | 14 +- drivers/block/pktcdvd.c | 4 +- drivers/block/rbd.c | 2 +- drivers/bluetooth/btwilink.c | 2 +- drivers/bus/arm-cci.c | 12 +- drivers/cdrom/cdrom.c | 11 +- drivers/cdrom/gdrom.c | 1 - drivers/char/agp/compat_ioctl.c | 2 +- drivers/char/agp/frontend.c | 4 +- drivers/char/agp/intel-gtt.c | 4 +- drivers/char/hpet.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 8 +- drivers/char/ipmi/ipmi_si_intf.c | 8 +- drivers/char/ipmi/ipmi_ssif.c | 12 +- drivers/char/mem.c | 47 +- drivers/char/nvram.c | 2 +- drivers/char/pcmcia/synclink_cs.c | 16 +- drivers/char/random.c | 12 +- drivers/char/sonypi.c | 11 +- drivers/char/tpm/tpm_acpi.c | 3 +- drivers/char/tpm/tpm_eventlog.c | 5 +- drivers/char/virtio_console.c | 6 +- drivers/clk/clk-composite.c | 2 +- drivers/clk/samsung/clk.h | 2 +- drivers/clk/socfpga/clk-gate.c | 9 +- drivers/clk/socfpga/clk-pll.c | 9 +- drivers/clk/ti/clk.c | 8 +- drivers/cpufreq/acpi-cpufreq.c | 17 +- drivers/cpufreq/cpufreq-dt.c | 4 +- drivers/cpufreq/cpufreq.c | 30 +- drivers/cpufreq/cpufreq_governor.c | 2 +- drivers/cpufreq/cpufreq_governor.h | 4 +- drivers/cpufreq/cpufreq_ondemand.c | 10 +- drivers/cpufreq/intel_pstate.c | 38 +- drivers/cpufreq/p4-clockmod.c | 12 +- drivers/cpufreq/sparc-us3-cpufreq.c | 67 +- drivers/cpufreq/speedstep-centrino.c | 7 +- drivers/cpuidle/driver.c | 2 +- drivers/cpuidle/dt_idle_states.c | 2 +- drivers/cpuidle/governor.c | 2 +- drivers/cpuidle/sysfs.c | 2 +- drivers/crypto/hifn_795x.c | 4 +- drivers/devfreq/devfreq.c | 4 +- drivers/dma/sh/shdma-base.c | 4 +- drivers/dma/sh/shdmac.c | 2 +- drivers/edac/edac_device.c | 4 +- drivers/edac/edac_mc_sysfs.c | 2 +- drivers/edac/edac_pci.c | 4 +- drivers/edac/edac_pci_sysfs.c | 22 +- drivers/edac/mce_amd.h | 2 +- drivers/firewire/core-card.c | 6 +- drivers/firewire/core-device.c | 2 +- drivers/firewire/core-transaction.c | 1 + drivers/firewire/core.h | 1 + drivers/firmware/dmi-id.c | 2 +- drivers/firmware/dmi_scan.c | 12 +- drivers/firmware/efi/cper.c | 8 +- drivers/firmware/efi/efi.c | 12 +- drivers/firmware/efi/efivars.c | 2 +- drivers/firmware/efi/runtime-map.c | 2 +- drivers/firmware/google/gsmi.c | 2 +- drivers/firmware/google/memconsole.c | 7 +- drivers/firmware/memmap.c | 2 +- drivers/firmware/psci.c | 2 +- drivers/gpio/gpio-davinci.c | 6 +- drivers/gpio/gpio-em.c | 2 +- drivers/gpio/gpio-ich.c | 2 +- drivers/gpio/gpio-omap.c | 4 +- drivers/gpio/gpio-rcar.c | 2 +- drivers/gpio/gpio-vr41xx.c | 2 +- drivers/gpio/gpiolib.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 18 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 6 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 90 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.h | 8 +- .../drm/amd/amdkfd/kfd_device_queue_manager_cik.c | 14 +- .../drm/amd/amdkfd/kfd_device_queue_manager_vi.c | 14 +- drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.h | 2 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 16 +- drivers/gpu/drm/amd/scheduler/gpu_scheduler.c | 2 +- drivers/gpu/drm/amd/scheduler/gpu_scheduler.h | 2 +- drivers/gpu/drm/amd/scheduler/sched_fence.c | 2 +- drivers/gpu/drm/armada/armada_drv.c | 3 +- drivers/gpu/drm/drm_crtc.c | 2 +- drivers/gpu/drm/drm_drv.c | 2 +- drivers/gpu/drm/drm_fops.c | 12 +- drivers/gpu/drm/drm_global.c | 14 +- drivers/gpu/drm/drm_info.c | 13 +- drivers/gpu/drm/drm_ioc32.c | 13 +- drivers/gpu/drm/drm_ioctl.c | 2 +- drivers/gpu/drm/drm_pci.c | 9 +- drivers/gpu/drm/exynos/exynos_drm_drv.c | 1 - drivers/gpu/drm/gma500/mdfld_dsi_dpi.c | 10 +- drivers/gpu/drm/gma500/psb_drv.c | 1 - drivers/gpu/drm/i810/i810_dma.c | 2 +- drivers/gpu/drm/i810/i810_drv.c | 6 +- drivers/gpu/drm/i810/i810_drv.h | 6 +- drivers/gpu/drm/i915/i915_dma.c | 4 +- drivers/gpu/drm/i915/i915_drv.c | 7 +- drivers/gpu/drm/i915/i915_drv.h | 2 +- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 4 +- drivers/gpu/drm/i915/i915_gem_gtt.c | 16 +- drivers/gpu/drm/i915/i915_gem_gtt.h | 6 +- drivers/gpu/drm/i915/i915_ioc32.c | 10 +- drivers/gpu/drm/i915/i915_irq.c | 88 +- drivers/gpu/drm/i915/intel_display.c | 26 +- drivers/gpu/drm/imx/imx-drm-core.c | 2 +- drivers/gpu/drm/mga/mga_drv.c | 5 +- drivers/gpu/drm/mga/mga_drv.h | 6 +- drivers/gpu/drm/mga/mga_ioc32.c | 10 +- drivers/gpu/drm/mga/mga_irq.c | 8 +- drivers/gpu/drm/mga/mga_state.c | 2 +- drivers/gpu/drm/nouveau/nouveau_bios.c | 2 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 13 +- drivers/gpu/drm/nouveau/nouveau_drm.h | 1 - drivers/gpu/drm/nouveau/nouveau_ioc32.c | 2 +- drivers/gpu/drm/nouveau/nouveau_vga.c | 2 +- drivers/gpu/drm/omapdrm/Makefile | 2 +- drivers/gpu/drm/qxl/qxl_cmd.c | 12 +- drivers/gpu/drm/qxl/qxl_debugfs.c | 8 +- drivers/gpu/drm/qxl/qxl_drv.c | 8 +- drivers/gpu/drm/qxl/qxl_drv.h | 8 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 12 +- drivers/gpu/drm/qxl/qxl_irq.c | 16 +- drivers/gpu/drm/qxl/qxl_ttm.c | 38 +- drivers/gpu/drm/r128/r128_cce.c | 2 +- drivers/gpu/drm/r128/r128_drv.c | 4 +- drivers/gpu/drm/r128/r128_drv.h | 6 +- drivers/gpu/drm/r128/r128_ioc32.c | 10 +- drivers/gpu/drm/r128/r128_irq.c | 4 +- drivers/gpu/drm/r128/r128_state.c | 6 +- drivers/gpu/drm/radeon/mkregtable.c | 4 +- drivers/gpu/drm/radeon/radeon_device.c | 2 +- drivers/gpu/drm/radeon/radeon_drv.c | 17 +- drivers/gpu/drm/radeon/radeon_drv.h | 4 +- drivers/gpu/drm/radeon/radeon_ioc32.c | 12 +- drivers/gpu/drm/radeon/radeon_irq.c | 6 +- drivers/gpu/drm/radeon/radeon_kms.c | 2 +- drivers/gpu/drm/radeon/radeon_state.c | 6 +- drivers/gpu/drm/radeon/radeon_ttm.c | 4 +- drivers/gpu/drm/savage/savage_bci.c | 2 +- drivers/gpu/drm/savage/savage_drv.c | 5 +- drivers/gpu/drm/savage/savage_drv.h | 2 +- drivers/gpu/drm/sis/sis_drv.c | 5 +- drivers/gpu/drm/sis/sis_drv.h | 2 +- drivers/gpu/drm/sis/sis_mm.c | 2 +- drivers/gpu/drm/tegra/dc.c | 2 +- drivers/gpu/drm/tegra/dsi.c | 2 +- drivers/gpu/drm/tegra/hdmi.c | 2 +- drivers/gpu/drm/tegra/sor.c | 7 +- drivers/gpu/drm/tilcdc/Makefile | 6 +- drivers/gpu/drm/ttm/ttm_memory.c | 4 +- drivers/gpu/drm/ttm/ttm_page_alloc.c | 18 +- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 18 +- drivers/gpu/drm/udl/udl_fb.c | 1 - drivers/gpu/drm/via/via_dma.c | 2 +- drivers/gpu/drm/via/via_drv.c | 5 +- drivers/gpu/drm/via/via_drv.h | 6 +- drivers/gpu/drm/via/via_irq.c | 18 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_irq.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_marker.c | 2 +- drivers/gpu/vga/vga_switcheroo.c | 4 +- drivers/hid/hid-core.c | 4 +- drivers/hid/hid-sensor-custom.c | 2 +- drivers/hv/channel.c | 6 +- drivers/hv/hv.c | 4 +- drivers/hv/hv_balloon.c | 18 +- drivers/hv/hyperv_vmbus.h | 2 +- drivers/hwmon/acpi_power_meter.c | 6 +- drivers/hwmon/applesmc.c | 2 +- drivers/hwmon/asus_atk0110.c | 10 +- drivers/hwmon/coretemp.c | 2 +- drivers/hwmon/dell-smm-hwmon.c | 2 +- drivers/hwmon/ibmaem.c | 2 +- drivers/hwmon/iio_hwmon.c | 2 +- drivers/hwmon/nct6683.c | 6 +- drivers/hwmon/nct6775.c | 6 +- drivers/hwmon/pmbus/pmbus_core.c | 10 +- drivers/hwmon/sht15.c | 12 +- drivers/hwmon/via-cputemp.c | 2 +- drivers/i2c/busses/i2c-amd756-s4882.c | 2 +- drivers/i2c/busses/i2c-designware-pcidrv.c | 2 +- drivers/i2c/busses/i2c-nforce2-s4985.c | 2 +- drivers/i2c/i2c-dev.c | 2 +- drivers/ide/ide-cd.c | 2 +- drivers/ide/ide-disk.c | 2 +- drivers/iio/industrialio-core.c | 2 +- drivers/iio/magnetometer/ak8975.c | 2 +- drivers/infiniband/core/cm.c | 32 +- drivers/infiniband/core/fmr_pool.c | 20 +- drivers/infiniband/core/netlink.c | 5 +- drivers/infiniband/core/uverbs_cmd.c | 3 + drivers/infiniband/hw/cxgb4/device.c | 6 +- drivers/infiniband/hw/cxgb4/iw_cxgb4.h | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 4 +- drivers/infiniband/hw/mlx4/mad.c | 2 +- drivers/infiniband/hw/mlx4/mcg.c | 2 +- drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 +- drivers/infiniband/hw/mthca/mthca_cmd.c | 8 +- drivers/infiniband/hw/mthca/mthca_main.c | 2 +- drivers/infiniband/hw/mthca/mthca_mr.c | 6 +- drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/nes/nes.c | 4 +- drivers/infiniband/hw/nes/nes.h | 40 +- drivers/infiniband/hw/nes/nes_cm.c | 62 +- drivers/infiniband/hw/nes/nes_mgt.c | 8 +- drivers/infiniband/hw/nes/nes_nic.c | 40 +- drivers/infiniband/hw/nes/nes_verbs.c | 10 +- drivers/infiniband/hw/qib/qib.h | 1 + drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 2 +- drivers/input/evdev.c | 2 +- drivers/input/gameport/gameport.c | 4 +- drivers/input/input.c | 4 +- drivers/input/joystick/sidewinder.c | 1 + drivers/input/misc/ims-pcu.c | 4 +- drivers/input/mouse/psmouse.h | 2 +- drivers/input/mousedev.c | 2 +- drivers/input/serio/serio.c | 4 +- drivers/input/serio/serio_raw.c | 4 +- drivers/input/touchscreen/htcpen.c | 2 +- drivers/iommu/arm-smmu-v3.c | 2 +- drivers/iommu/arm-smmu.c | 43 +- drivers/iommu/io-pgtable-arm.c | 101 +- drivers/iommu/io-pgtable.c | 11 +- drivers/iommu/io-pgtable.h | 19 +- drivers/iommu/iommu.c | 2 +- drivers/iommu/ipmmu-vmsa.c | 13 +- drivers/iommu/irq_remapping.c | 2 +- drivers/irqchip/irq-gic.c | 2 +- drivers/irqchip/irq-i8259.c | 2 +- drivers/irqchip/irq-renesas-intc-irqpin.c | 2 +- drivers/isdn/capi/capi.c | 10 +- drivers/isdn/gigaset/interface.c | 8 +- drivers/isdn/gigaset/usb-gigaset.c | 2 +- drivers/isdn/hardware/avm/b1.c | 4 +- drivers/isdn/i4l/isdn_common.c | 2 + drivers/isdn/i4l/isdn_tty.c | 22 +- drivers/isdn/icn/icn.c | 2 +- drivers/isdn/mISDN/dsp_cmx.c | 2 +- drivers/lguest/core.c | 10 +- drivers/lguest/page_tables.c | 2 +- drivers/lguest/x86/core.c | 12 +- drivers/lguest/x86/switcher_32.S | 27 +- drivers/md/bcache/alloc.c | 2 +- drivers/md/bcache/bcache.h | 10 +- drivers/md/bcache/btree.c | 2 +- drivers/md/bcache/closure.h | 2 +- drivers/md/bcache/io.c | 10 +- drivers/md/bcache/journal.c | 2 +- drivers/md/bcache/stats.c | 26 +- drivers/md/bcache/stats.h | 16 +- drivers/md/bcache/super.c | 2 +- drivers/md/bcache/sysfs.c | 20 +- drivers/md/bitmap.c | 2 +- drivers/md/dm-cache-target.c | 98 +- drivers/md/dm-ioctl.c | 2 +- drivers/md/dm-raid.c | 2 +- drivers/md/dm-raid1.c | 18 +- drivers/md/dm-stats.c | 6 +- drivers/md/dm-stripe.c | 10 +- drivers/md/dm-table.c | 2 +- drivers/md/dm-thin-metadata.c | 4 +- drivers/md/dm.c | 28 +- drivers/md/md.c | 37 +- drivers/md/md.h | 8 +- drivers/md/persistent-data/dm-space-map-metadata.c | 4 +- drivers/md/persistent-data/dm-space-map.h | 1 + drivers/md/raid1.c | 8 +- drivers/md/raid10.c | 20 +- drivers/md/raid5.c | 26 +- drivers/media/dvb-core/dvbdev.c | 2 +- drivers/media/dvb-frontends/af9033.h | 2 +- drivers/media/dvb-frontends/dib3000.h | 2 +- drivers/media/dvb-frontends/dib7000p.h | 2 +- drivers/media/dvb-frontends/dib8000.h | 2 +- drivers/media/pci/cx88/cx88-video.c | 6 +- drivers/media/pci/ivtv/ivtv-driver.c | 2 +- drivers/media/pci/solo6x10/solo6x10-core.c | 2 +- drivers/media/pci/solo6x10/solo6x10-p2m.c | 2 +- drivers/media/pci/solo6x10/solo6x10.h | 2 +- drivers/media/pci/tw68/tw68-core.c | 2 +- drivers/media/pci/zoran/zoran.h | 1 - drivers/media/pci/zoran/zoran_driver.c | 3 - drivers/media/platform/omap/omap_vout.c | 11 +- drivers/media/platform/s5p-tv/mixer.h | 2 +- drivers/media/platform/s5p-tv/mixer_grp_layer.c | 2 +- drivers/media/platform/s5p-tv/mixer_reg.c | 2 +- drivers/media/platform/s5p-tv/mixer_video.c | 24 +- drivers/media/platform/s5p-tv/mixer_vp_layer.c | 2 +- drivers/media/radio/radio-cadet.c | 2 + drivers/media/radio/radio-maxiradio.c | 2 +- drivers/media/radio/radio-shark.c | 2 +- drivers/media/radio/radio-shark2.c | 2 +- drivers/media/radio/radio-si476x.c | 2 +- drivers/media/radio/wl128x/fmdrv_common.c | 2 +- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 12 +- drivers/media/v4l2-core/v4l2-device.c | 4 +- drivers/media/v4l2-core/v4l2-ioctl.c | 13 +- drivers/memory/omap-gpmc.c | 21 +- drivers/message/fusion/mptsas.c | 34 +- drivers/mfd/ab8500-debugfs.c | 2 +- drivers/mfd/kempld-core.c | 2 +- drivers/mfd/max8925-i2c.c | 2 +- drivers/mfd/tps65910.c | 2 +- drivers/mfd/twl4030-irq.c | 9 +- drivers/misc/c2port/core.c | 4 +- drivers/misc/kgdbts.c | 4 +- drivers/misc/lis3lv02d/lis3lv02d.c | 8 +- drivers/misc/lis3lv02d/lis3lv02d.h | 2 +- drivers/misc/mic/scif/scif_api.c | 10 +- drivers/misc/mic/scif/scif_rb.c | 8 +- drivers/misc/sgi-gru/gruhandles.c | 4 +- drivers/misc/sgi-gru/gruprocfs.c | 8 +- drivers/misc/sgi-gru/grutables.h | 158 +- drivers/misc/sgi-xp/xp.h | 2 +- drivers/misc/sgi-xp/xpc.h | 3 +- drivers/misc/sgi-xp/xpc_main.c | 2 +- drivers/mmc/host/dw_mmc.h | 2 +- drivers/mmc/host/mmci.c | 4 +- drivers/mmc/host/omap_hsmmc.c | 4 +- drivers/mmc/host/sdhci-esdhc-imx.c | 7 +- drivers/mmc/host/sdhci-s3c.c | 8 +- drivers/mtd/chips/cfi_cmdset_0020.c | 2 +- drivers/mtd/nand/denali.c | 1 + drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 2 +- drivers/mtd/nftlmount.c | 1 + drivers/mtd/sm_ftl.c | 2 +- drivers/net/bonding/bond_netlink.c | 2 +- drivers/net/caif/caif_hsi.c | 2 +- drivers/net/can/Kconfig | 2 +- drivers/net/can/dev.c | 2 +- drivers/net/can/vcan.c | 2 +- drivers/net/dummy.c | 2 +- drivers/net/ethernet/8390/ax88796.c | 4 +- drivers/net/ethernet/altera/altera_tse_main.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-common.h | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-dcb.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-desc.c | 27 +- drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 143 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 64 +- drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 10 +- drivers/net/ethernet/amd/xgbe/xgbe-main.c | 15 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 27 +- drivers/net/ethernet/amd/xgbe/xgbe-ptp.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe.h | 10 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c | 11 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 3 +- drivers/net/ethernet/broadcom/tg3.h | 1 + drivers/net/ethernet/cavium/liquidio/lio_ethtool.c | 6 +- drivers/net/ethernet/cavium/liquidio/lio_main.c | 11 +- drivers/net/ethernet/chelsio/cxgb3/l2t.h | 2 +- drivers/net/ethernet/dec/tulip/de4x5.c | 4 +- drivers/net/ethernet/emulex/benet/be_main.c | 2 +- drivers/net/ethernet/faraday/ftgmac100.c | 2 + drivers/net/ethernet/faraday/ftmac100.c | 2 + drivers/net/ethernet/intel/i40e/i40e_ptp.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 7 +- drivers/net/ethernet/neterion/vxge/vxge-config.c | 7 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 4 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c | 12 +- .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 +- drivers/net/ethernet/realtek/r8169.c | 8 +- drivers/net/ethernet/sfc/ptp.c | 2 +- drivers/net/ethernet/sfc/selftest.c | 20 +- drivers/net/ethernet/stmicro/stmmac/mmc_core.c | 4 +- drivers/net/ethernet/via/via-rhine.c | 2 +- drivers/net/geneve.c | 2 +- drivers/net/hyperv/hyperv_net.h | 2 +- drivers/net/hyperv/rndis_filter.c | 7 +- drivers/net/ifb.c | 2 +- drivers/net/ipvlan/ipvlan_core.c | 2 +- drivers/net/irda/vlsi_ir.c | 18 +- drivers/net/irda/vlsi_ir.h | 14 +- drivers/net/macvlan.c | 20 +- drivers/net/macvtap.c | 10 +- drivers/net/nlmon.c | 2 +- drivers/net/phy/phy_device.c | 6 +- drivers/net/ppp/ppp_generic.c | 4 +- drivers/net/slip/slhc.c | 2 +- drivers/net/team/team.c | 4 +- drivers/net/tun.c | 7 +- drivers/net/usb/hso.c | 23 +- drivers/net/usb/r8152.c | 2 +- drivers/net/usb/sierra_net.c | 4 +- drivers/net/virtio_net.c | 2 +- drivers/net/vrf.c | 2 +- drivers/net/vxlan.c | 4 +- drivers/net/wimax/i2400m/rx.c | 2 +- drivers/net/wireless/airo.c | 2 +- drivers/net/wireless/at76c50x-usb.c | 2 +- drivers/net/wireless/ath/ath10k/ce.c | 6 +- drivers/net/wireless/ath/ath10k/htc.h | 4 +- drivers/net/wireless/ath/ath9k/ar9002_mac.c | 36 +- drivers/net/wireless/ath/ath9k/ar9003_mac.c | 64 +- drivers/net/wireless/ath/ath9k/hw.h | 4 +- drivers/net/wireless/ath/ath9k/main.c | 22 +- drivers/net/wireless/ath/carl9170/carl9170.h | 6 +- drivers/net/wireless/ath/carl9170/debug.c | 6 +- drivers/net/wireless/ath/carl9170/main.c | 10 +- drivers/net/wireless/ath/carl9170/tx.c | 4 +- drivers/net/wireless/ath/wil6210/wil_platform.h | 2 +- drivers/net/wireless/b43/phy_lp.c | 2 +- drivers/net/wireless/iwlegacy/3945-mac.c | 4 +- drivers/net/wireless/iwlwifi/dvm/debugfs.c | 34 +- drivers/net/wireless/iwlwifi/mvm/d3.c | 4 +- drivers/net/wireless/iwlwifi/mvm/tx.c | 2 +- drivers/net/wireless/iwlwifi/pcie/trans.c | 4 +- drivers/net/wireless/mac80211_hwsim.c | 28 +- drivers/net/wireless/rt2x00/rt2x00.h | 2 +- drivers/net/wireless/rt2x00/rt2x00queue.c | 4 +- drivers/net/wireless/ti/wl1251/sdio.c | 12 +- drivers/net/wireless/ti/wl12xx/main.c | 8 +- drivers/net/wireless/ti/wl18xx/main.c | 6 +- drivers/of/fdt.c | 4 +- drivers/oprofile/buffer_sync.c | 8 +- drivers/oprofile/event_buffer.c | 2 +- drivers/oprofile/oprof.c | 2 +- drivers/oprofile/oprofile_stats.c | 10 +- drivers/oprofile/oprofile_stats.h | 10 +- drivers/oprofile/oprofilefs.c | 6 +- drivers/oprofile/timer_int.c | 2 +- drivers/parport/procfs.c | 4 +- drivers/pci/host/pci-host-generic.c | 2 +- drivers/pci/hotplug/acpiphp_ibm.c | 4 +- drivers/pci/hotplug/cpcihp_generic.c | 6 +- drivers/pci/hotplug/cpcihp_zt5550.c | 14 +- drivers/pci/hotplug/cpqphp_nvram.c | 2 + drivers/pci/hotplug/pci_hotplug_core.c | 6 +- drivers/pci/hotplug/pciehp_core.c | 2 +- drivers/pci/msi.c | 22 +- drivers/pci/pci-sysfs.c | 6 +- drivers/pci/pci.h | 2 +- drivers/pci/pcie/aspm.c | 6 +- drivers/pci/pcie/portdrv_pci.c | 2 +- drivers/pci/probe.c | 2 +- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 2 +- drivers/pinctrl/pinctrl-at91.c | 5 +- drivers/platform/chrome/chromeos_pstore.c | 2 +- drivers/platform/x86/alienware-wmi.c | 4 +- drivers/platform/x86/compal-laptop.c | 2 +- drivers/platform/x86/hdaps.c | 2 +- drivers/platform/x86/ibm_rtl.c | 2 +- drivers/platform/x86/intel_oaktrail.c | 2 +- drivers/platform/x86/msi-laptop.c | 16 +- drivers/platform/x86/msi-wmi.c | 2 +- drivers/platform/x86/samsung-laptop.c | 2 +- drivers/platform/x86/samsung-q10.c | 2 +- drivers/platform/x86/sony-laptop.c | 14 +- drivers/platform/x86/thinkpad_acpi.c | 2 +- drivers/pnp/pnpbios/bioscalls.c | 14 +- drivers/pnp/pnpbios/core.c | 2 +- drivers/power/pda_power.c | 7 +- drivers/power/power_supply.h | 4 +- drivers/power/power_supply_core.c | 7 +- drivers/power/power_supply_sysfs.c | 6 +- drivers/power/reset/at91-reset.c | 5 +- drivers/powercap/powercap_sys.c | 136 +- drivers/ptp/ptp_private.h | 2 +- drivers/ptp/ptp_sysfs.c | 2 +- drivers/regulator/core.c | 4 +- drivers/regulator/max8660.c | 6 +- drivers/regulator/max8973-regulator.c | 16 +- drivers/regulator/mc13892-regulator.c | 8 +- drivers/rtc/rtc-armada38x.c | 7 +- drivers/rtc/rtc-cmos.c | 4 +- drivers/rtc/rtc-ds1307.c | 2 +- drivers/rtc/rtc-m48t59.c | 4 +- drivers/rtc/rtc-rv8803.c | 15 +- drivers/rtc/rtc-test.c | 6 +- drivers/scsi/bfa/bfa_fcpim.h | 2 +- drivers/scsi/bfa/bfa_ioc.h | 4 +- drivers/scsi/fcoe/fcoe_sysfs.c | 12 +- drivers/scsi/hosts.c | 4 +- drivers/scsi/hpsa.c | 38 +- drivers/scsi/hpsa.h | 2 +- drivers/scsi/hptiop.c | 2 - drivers/scsi/hptiop.h | 1 - drivers/scsi/ipr.c | 6 +- drivers/scsi/ipr.h | 2 +- drivers/scsi/libfc/fc_exch.c | 50 +- drivers/scsi/libsas/sas_ata.c | 2 +- drivers/scsi/lpfc/lpfc.h | 8 +- drivers/scsi/lpfc/lpfc_debugfs.c | 18 +- drivers/scsi/lpfc/lpfc_init.c | 6 +- drivers/scsi/lpfc/lpfc_scsi.c | 10 +- drivers/scsi/megaraid/megaraid_sas.h | 2 +- drivers/scsi/pmcraid.c | 20 +- drivers/scsi/pmcraid.h | 8 +- drivers/scsi/qla2xxx/qla_attr.c | 4 +- drivers/scsi/qla2xxx/qla_gbl.h | 4 +- drivers/scsi/qla2xxx/qla_os.c | 6 +- drivers/scsi/qla2xxx/qla_target.c | 10 +- drivers/scsi/qla2xxx/qla_target.h | 2 +- drivers/scsi/qla4xxx/ql4_def.h | 2 +- drivers/scsi/qla4xxx/ql4_os.c | 6 +- drivers/scsi/scsi.c | 2 +- drivers/scsi/scsi_lib.c | 8 +- drivers/scsi/scsi_sysfs.c | 2 +- drivers/scsi/scsi_transport_fc.c | 8 +- drivers/scsi/scsi_transport_iscsi.c | 6 +- drivers/scsi/scsi_transport_srp.c | 6 +- drivers/scsi/sd.c | 6 +- drivers/scsi/sg.c | 2 +- drivers/scsi/sr.c | 21 +- drivers/soc/tegra/fuse/fuse-tegra.c | 2 +- drivers/spi/spi.c | 2 +- drivers/staging/android/timed_output.c | 6 +- drivers/staging/comedi/comedi_fops.c | 8 +- drivers/staging/fbtft/fbtft-core.c | 2 +- drivers/staging/fbtft/fbtft.h | 2 +- drivers/staging/gdm724x/gdm_tty.c | 2 +- drivers/staging/iio/accel/lis3l02dq_ring.c | 2 +- drivers/staging/iio/adc/ad7280a.c | 4 +- drivers/staging/lustre/lnet/selftest/brw_test.c | 12 +- drivers/staging/lustre/lnet/selftest/framework.c | 4 - drivers/staging/lustre/lnet/selftest/ping_test.c | 14 +- drivers/staging/lustre/lustre/include/lustre_dlm.h | 2 +- drivers/staging/lustre/lustre/include/obd.h | 2 +- drivers/staging/octeon/ethernet-rx.c | 20 +- drivers/staging/octeon/ethernet.c | 8 +- drivers/staging/rdma/ipath/ipath_rc.c | 6 +- drivers/staging/rdma/ipath/ipath_ruc.c | 6 +- drivers/staging/rtl8188eu/include/hal_intf.h | 2 +- drivers/staging/rtl8712/rtl871x_io.h | 2 +- drivers/staging/sm750fb/sm750.c | 14 +- drivers/staging/unisys/visorbus/visorbus_private.h | 4 +- drivers/target/sbp/sbp_target.c | 4 +- drivers/thermal/cpu_cooling.c | 9 +- drivers/thermal/devfreq_cooling.c | 19 +- drivers/thermal/int340x_thermal/int3400_thermal.c | 6 +- drivers/thermal/of-thermal.c | 17 +- drivers/thermal/x86_pkg_temp_thermal.c | 2 +- drivers/tty/cyclades.c | 6 +- drivers/tty/hvc/hvc_console.c | 14 +- drivers/tty/hvc/hvcs.c | 21 +- drivers/tty/hvc/hvsi.c | 22 +- drivers/tty/hvc/hvsi_lib.c | 4 +- drivers/tty/ipwireless/tty.c | 27 +- drivers/tty/moxa.c | 2 +- drivers/tty/n_gsm.c | 4 +- drivers/tty/n_tty.c | 19 +- drivers/tty/pty.c | 4 +- drivers/tty/rocket.c | 6 +- drivers/tty/serial/8250/8250_core.c | 10 +- drivers/tty/serial/ifx6x60.c | 2 +- drivers/tty/serial/ioc4_serial.c | 6 +- drivers/tty/serial/kgdb_nmi.c | 4 +- drivers/tty/serial/kgdboc.c | 32 +- drivers/tty/serial/msm_serial.c | 4 +- drivers/tty/serial/samsung.c | 9 +- drivers/tty/serial/serial_core.c | 8 +- drivers/tty/synclink.c | 34 +- drivers/tty/synclink_gt.c | 28 +- drivers/tty/synclinkmp.c | 34 +- drivers/tty/tty_io.c | 2 +- drivers/tty/tty_ldisc.c | 8 +- drivers/tty/tty_port.c | 22 +- drivers/uio/uio.c | 13 +- drivers/usb/atm/cxacru.c | 2 +- drivers/usb/atm/usbatm.c | 24 +- drivers/usb/class/cdc-acm.h | 2 +- drivers/usb/core/devices.c | 6 +- drivers/usb/core/devio.c | 12 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/sysfs.c | 2 +- drivers/usb/core/usb.c | 2 +- drivers/usb/early/ehci-dbgp.c | 16 +- drivers/usb/gadget/function/u_serial.c | 22 +- drivers/usb/gadget/udc/dummy_hcd.c | 2 +- drivers/usb/host/ehci-hcd.c | 2 +- drivers/usb/host/ehci-hub.c | 4 +- drivers/usb/host/ehci-q.c | 4 +- drivers/usb/host/fotg210-hcd.c | 2 +- drivers/usb/host/hwa-hc.c | 2 +- drivers/usb/host/ohci-hcd.c | 2 +- drivers/usb/host/r8a66597.h | 2 +- drivers/usb/host/uhci-hcd.c | 2 +- drivers/usb/host/xhci-pci.c | 2 +- drivers/usb/host/xhci.c | 2 +- drivers/usb/misc/appledisplay.c | 4 +- drivers/usb/serial/console.c | 8 +- drivers/usb/storage/transport.c | 2 +- drivers/usb/storage/usb.c | 2 +- drivers/usb/storage/usb.h | 2 +- drivers/usb/usbip/vhci.h | 2 +- drivers/usb/usbip/vhci_hcd.c | 6 +- drivers/usb/usbip/vhci_rx.c | 2 +- drivers/usb/wusbcore/wa-hc.h | 4 +- drivers/usb/wusbcore/wa-xfer.c | 2 +- drivers/vhost/vringh.c | 20 +- drivers/video/backlight/kb3886_bl.c | 2 +- drivers/video/console/fbcon.c | 2 +- drivers/video/fbdev/aty/aty128fb.c | 2 +- drivers/video/fbdev/aty/atyfb_base.c | 8 +- drivers/video/fbdev/aty/mach64_cursor.c | 5 +- drivers/video/fbdev/core/fb_defio.c | 6 +- drivers/video/fbdev/core/fbmem.c | 12 +- drivers/video/fbdev/hyperv_fb.c | 4 +- drivers/video/fbdev/i810/i810_accel.c | 1 + drivers/video/fbdev/matrox/matroxfb_base.c | 2 +- drivers/video/fbdev/mb862xx/mb862xxfb_accel.c | 16 +- drivers/video/fbdev/nvidia/nvidia.c | 27 +- drivers/video/fbdev/omap2/dss/display.c | 8 +- drivers/video/fbdev/s1d13xxxfb.c | 6 +- drivers/video/fbdev/smscufx.c | 4 +- drivers/video/fbdev/udlfb.c | 36 +- drivers/video/fbdev/uvesafb.c | 52 +- drivers/video/fbdev/vesafb.c | 58 +- drivers/video/fbdev/via/via_clock.h | 2 +- drivers/xen/events/events_base.c | 6 +- fs/Kconfig.binfmt | 2 +- fs/afs/inode.c | 4 +- fs/aio.c | 2 +- fs/autofs4/waitq.c | 2 +- fs/befs/endian.h | 6 +- fs/binfmt_aout.c | 23 +- fs/binfmt_elf.c | 670 +- fs/binfmt_elf_fdpic.c | 4 +- fs/block_dev.c | 2 +- fs/btrfs/ctree.c | 11 +- fs/btrfs/ctree.h | 4 +- fs/btrfs/delayed-inode.c | 9 +- fs/btrfs/delayed-inode.h | 6 +- fs/btrfs/delayed-ref.c | 4 +- fs/btrfs/disk-io.c | 4 +- fs/btrfs/extent_map.c | 8 +- fs/btrfs/file.c | 4 +- fs/btrfs/inode.c | 14 +- fs/btrfs/raid56.c | 32 +- fs/btrfs/super.c | 2 +- fs/btrfs/sysfs.c | 2 +- fs/btrfs/tests/btrfs-tests.c | 2 +- fs/btrfs/tests/free-space-tests.c | 8 +- fs/btrfs/transaction.c | 2 +- fs/btrfs/tree-log.c | 8 +- fs/btrfs/tree-log.h | 2 +- fs/btrfs/volumes.c | 14 +- fs/btrfs/volumes.h | 22 +- fs/buffer.c | 2 +- fs/cachefiles/bind.c | 6 +- fs/cachefiles/daemon.c | 8 +- fs/cachefiles/internal.h | 12 +- fs/cachefiles/namei.c | 2 +- fs/cachefiles/proc.c | 12 +- fs/ceph/dir.c | 12 +- fs/ceph/super.c | 4 +- fs/cifs/cifs_debug.c | 12 +- fs/cifs/cifsfs.c | 8 +- fs/cifs/cifsglob.h | 54 +- fs/cifs/file.c | 12 +- fs/cifs/misc.c | 4 +- fs/cifs/smb1ops.c | 80 +- fs/cifs/smb2ops.c | 84 +- fs/cifs/smb2pdu.c | 3 +- fs/coda/cache.c | 10 +- fs/compat.c | 7 +- fs/compat_binfmt_elf.c | 2 + fs/compat_ioctl.c | 12 +- fs/configfs/dir.c | 10 +- fs/coredump.c | 18 +- fs/dcache.c | 64 +- fs/ecryptfs/inode.c | 2 +- fs/ecryptfs/miscdev.c | 2 +- fs/exec.c | 362 +- fs/ext2/xattr.c | 5 +- fs/ext4/ext4.h | 20 +- fs/ext4/mballoc.c | 44 +- fs/ext4/resize.c | 16 +- fs/ext4/super.c | 2 +- fs/ext4/sysfs.c | 2 +- fs/ext4/xattr.c | 5 +- fs/fhandle.c | 5 +- fs/file.c | 18 +- fs/fs-writeback.c | 11 +- fs/fs_struct.c | 8 +- fs/fscache/cookie.c | 40 +- fs/fscache/internal.h | 202 +- fs/fscache/object.c | 26 +- fs/fscache/operation.c | 38 +- fs/fscache/page.c | 110 +- fs/fscache/stats.c | 348 +- fs/fuse/cuse.c | 10 +- fs/fuse/dev.c | 4 +- fs/gfs2/file.c | 2 +- fs/gfs2/glock.c | 22 +- fs/gfs2/glops.c | 4 +- fs/gfs2/quota.c | 6 +- fs/hugetlbfs/inode.c | 13 +- fs/inode.c | 4 +- fs/jbd2/commit.c | 2 +- fs/jbd2/transaction.c | 4 +- fs/jffs2/erase.c | 3 +- fs/jffs2/wbuf.c | 3 +- fs/jfs/super.c | 2 +- fs/kernfs/dir.c | 2 +- fs/kernfs/file.c | 20 +- fs/libfs.c | 10 +- fs/lockd/clntproc.c | 4 +- fs/namei.c | 16 +- fs/namespace.c | 16 +- fs/nfs/callback_xdr.c | 2 +- fs/nfs/inode.c | 6 +- fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfs4xdr.c | 2 +- fs/nfsd/nfscache.c | 11 +- fs/nfsd/vfs.c | 6 +- fs/nls/nls_base.c | 26 +- fs/nls/nls_euc-jp.c | 6 +- fs/nls/nls_koi8-ru.c | 6 +- fs/notify/fanotify/fanotify_user.c | 4 +- fs/notify/notification.c | 4 +- fs/ntfs/dir.c | 2 +- fs/ntfs/super.c | 6 +- fs/ocfs2/dlm/dlmcommon.h | 4 +- fs/ocfs2/dlm/dlmdebug.c | 10 +- fs/ocfs2/dlm/dlmdomain.c | 4 +- fs/ocfs2/dlm/dlmmaster.c | 4 +- fs/ocfs2/localalloc.c | 2 +- fs/ocfs2/ocfs2.h | 10 +- fs/ocfs2/suballoc.c | 12 +- fs/ocfs2/super.c | 20 +- fs/overlayfs/copy_up.c | 2 +- fs/pipe.c | 72 +- fs/posix_acl.c | 4 +- fs/proc/array.c | 20 + fs/proc/base.c | 4 +- fs/proc/kcore.c | 34 +- fs/proc/meminfo.c | 2 +- fs/proc/nommu.c | 2 +- fs/proc/proc_sysctl.c | 26 +- fs/proc/task_mmu.c | 42 +- fs/proc/task_nommu.c | 4 +- fs/proc/vmcore.c | 16 +- fs/qnx6/qnx6.h | 4 +- fs/quota/netlink.c | 4 +- fs/read_write.c | 2 +- fs/readdir.c | 3 +- fs/reiserfs/do_balan.c | 2 +- fs/reiserfs/procfs.c | 2 +- fs/reiserfs/reiserfs.h | 4 +- fs/seq_file.c | 4 +- fs/splice.c | 43 +- fs/squashfs/xattr.c | 12 +- fs/super.c | 3 +- fs/sysv/sysv.h | 2 +- fs/tracefs/inode.c | 8 +- fs/udf/misc.c | 2 +- fs/ufs/swab.h | 4 +- fs/userfaultfd.c | 2 +- fs/xattr.c | 21 + fs/xfs/libxfs/xfs_bmap.c | 2 +- fs/xfs/libxfs/xfs_da_btree.c | 4 +- fs/xfs/xfs_dir2_readdir.c | 7 +- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_linux.h | 4 +- include/acpi/ghes.h | 2 +- include/asm-generic/4level-fixup.h | 2 + include/asm-generic/atomic-long.h | 176 +- include/asm-generic/atomic64.h | 12 + include/asm-generic/bitops/__fls.h | 2 +- include/asm-generic/bitops/fls.h | 2 +- include/asm-generic/bitops/fls64.h | 4 +- include/asm-generic/bug.h | 6 +- include/asm-generic/cache.h | 4 +- include/asm-generic/emergency-restart.h | 2 +- include/asm-generic/kmap_types.h | 4 +- include/asm-generic/local.h | 13 + include/asm-generic/pgtable-nopmd.h | 18 +- include/asm-generic/pgtable-nopud.h | 15 +- include/asm-generic/pgtable.h | 16 + include/asm-generic/sections.h | 1 + include/asm-generic/uaccess.h | 16 + include/asm-generic/vmlinux.lds.h | 15 +- include/crypto/algapi.h | 2 +- include/drm/drmP.h | 19 +- include/drm/drm_crtc_helper.h | 2 +- include/drm/drm_mm.h | 2 +- include/drm/i915_pciids.h | 2 +- include/drm/intel-gtt.h | 4 +- include/drm/ttm/ttm_memory.h | 2 +- include/drm/ttm/ttm_page_alloc.h | 1 + include/keys/asymmetric-subtype.h | 2 +- include/linux/atmdev.h | 4 +- include/linux/atomic.h | 2 +- include/linux/audit.h | 2 +- include/linux/average.h | 2 +- include/linux/binfmts.h | 3 +- include/linux/bitmap.h | 2 +- include/linux/bitops.h | 8 +- include/linux/blk-cgroup.h | 24 +- include/linux/blkdev.h | 2 +- include/linux/blktrace_api.h | 2 +- include/linux/cache.h | 8 + include/linux/cdrom.h | 1 - include/linux/cleancache.h | 2 +- include/linux/clk-provider.h | 1 + include/linux/compat.h | 6 +- include/linux/compiler-gcc.h | 28 +- include/linux/compiler.h | 193 +- include/linux/configfs.h | 2 +- include/linux/cpufreq.h | 3 +- include/linux/cpuidle.h | 5 +- include/linux/cpumask.h | 14 +- include/linux/crypto.h | 4 +- include/linux/ctype.h | 2 +- include/linux/dcache.h | 4 +- include/linux/decompress/mm.h | 2 +- include/linux/devfreq.h | 2 +- include/linux/device.h | 7 +- include/linux/dma-mapping.h | 2 +- include/linux/efi.h | 1 + include/linux/elf.h | 2 + include/linux/err.h | 4 +- include/linux/extcon.h | 2 +- include/linux/fb.h | 3 +- include/linux/fdtable.h | 2 +- include/linux/fs.h | 5 +- include/linux/fs_struct.h | 2 +- include/linux/fscache-cache.h | 2 +- include/linux/fscache.h | 2 +- include/linux/fsnotify.h | 2 +- include/linux/genhd.h | 4 +- include/linux/genl_magic_func.h | 2 +- include/linux/gfp.h | 12 +- include/linux/highmem.h | 12 + include/linux/hwmon-sysfs.h | 6 +- include/linux/i2c.h | 1 + include/linux/if_pppox.h | 2 +- include/linux/init.h | 12 +- include/linux/init_task.h | 7 + include/linux/interrupt.h | 6 +- include/linux/iommu.h | 2 +- include/linux/ioport.h | 2 +- include/linux/ipc.h | 2 +- include/linux/irq.h | 5 +- include/linux/irqdesc.h | 2 +- include/linux/irqdomain.h | 3 + include/linux/jbd2.h | 2 +- include/linux/jiffies.h | 16 +- include/linux/key-type.h | 2 +- include/linux/kgdb.h | 6 +- include/linux/kmemleak.h | 4 +- include/linux/kobject.h | 3 +- include/linux/kobject_ns.h | 2 +- include/linux/kref.h | 2 +- include/linux/libata.h | 2 +- include/linux/linkage.h | 1 + include/linux/list.h | 15 + include/linux/lockref.h | 26 +- include/linux/math64.h | 10 +- include/linux/mempolicy.h | 7 + include/linux/mm.h | 102 +- include/linux/mm_types.h | 20 + include/linux/mmiotrace.h | 4 +- include/linux/mmzone.h | 2 +- include/linux/mod_devicetable.h | 4 +- include/linux/module.h | 69 +- include/linux/moduleloader.h | 16 + include/linux/moduleparam.h | 4 +- include/linux/net.h | 2 +- include/linux/netdevice.h | 7 +- include/linux/netfilter.h | 2 +- include/linux/netfilter/nfnetlink.h | 2 +- include/linux/netlink.h | 12 +- include/linux/nls.h | 4 +- include/linux/notifier.h | 3 +- include/linux/oprofile.h | 4 +- include/linux/padata.h | 2 +- include/linux/pci_hotplug.h | 3 +- include/linux/percpu.h | 2 +- include/linux/perf_event.h | 12 +- include/linux/pipe_fs_i.h | 8 +- include/linux/pm.h | 1 + include/linux/pm_domain.h | 2 +- include/linux/pm_runtime.h | 2 +- include/linux/pnp.h | 2 +- include/linux/poison.h | 4 +- include/linux/power/smartreflex.h | 2 +- include/linux/ppp-comp.h | 2 +- include/linux/preempt.h | 21 + include/linux/proc_ns.h | 2 +- include/linux/psci.h | 2 +- include/linux/quota.h | 2 +- include/linux/random.h | 19 +- include/linux/rculist.h | 16 + include/linux/rcupdate.h | 8 + include/linux/reboot.h | 14 +- include/linux/regset.h | 3 +- include/linux/relay.h | 2 +- include/linux/rio.h | 2 +- include/linux/rmap.h | 4 +- include/linux/sched.h | 76 +- include/linux/sched/sysctl.h | 1 + include/linux/scif.h | 2 +- include/linux/semaphore.h | 2 +- include/linux/seq_file.h | 1 + include/linux/seqlock.h | 10 + include/linux/signal.h | 2 +- include/linux/skbuff.h | 12 +- include/linux/slab.h | 47 +- include/linux/slab_def.h | 14 +- include/linux/slub_def.h | 2 +- include/linux/smp.h | 2 + include/linux/sock_diag.h | 2 +- include/linux/sonet.h | 2 +- include/linux/spinlock.h | 17 +- include/linux/srcu.h | 5 +- include/linux/sunrpc/addr.h | 8 +- include/linux/sunrpc/clnt.h | 2 +- include/linux/sunrpc/svc.h | 2 +- include/linux/sunrpc/svc_rdma.h | 18 +- include/linux/sunrpc/svcauth.h | 2 +- include/linux/swapops.h | 10 +- include/linux/swiotlb.h | 3 +- include/linux/syscalls.h | 23 +- include/linux/syscore_ops.h | 2 +- include/linux/sysctl.h | 3 +- include/linux/sysfs.h | 9 +- include/linux/sysrq.h | 3 +- include/linux/tcp.h | 14 +- include/linux/thread_info.h | 7 + include/linux/tty.h | 4 +- include/linux/tty_driver.h | 2 +- include/linux/tty_ldisc.h | 2 +- include/linux/types.h | 16 + include/linux/uaccess.h | 2 +- include/linux/uio_driver.h | 2 +- include/linux/unaligned/access_ok.h | 24 +- include/linux/usb.h | 12 +- include/linux/usb/hcd.h | 1 + include/linux/usb/renesas_usbhs.h | 2 +- include/linux/vermagic.h | 21 +- include/linux/vga_switcheroo.h | 8 +- include/linux/vmalloc.h | 7 +- include/linux/vmstat.h | 24 +- include/linux/writeback.h | 3 +- include/linux/xattr.h | 5 +- include/linux/zlib.h | 3 +- include/media/v4l2-dev.h | 2 +- include/media/v4l2-device.h | 2 +- include/net/9p/transport.h | 2 +- include/net/bluetooth/l2cap.h | 2 +- include/net/bonding.h | 2 +- include/net/caif/cfctrl.h | 6 +- include/net/cfg802154.h | 2 +- include/net/flow.h | 2 +- include/net/genetlink.h | 2 +- include/net/gro_cells.h | 2 +- include/net/inet_connection_sock.h | 2 +- include/net/inet_sock.h | 2 +- include/net/inetpeer.h | 2 +- include/net/ip_fib.h | 2 +- include/net/ip_vs.h | 8 +- include/net/ipv6.h | 2 +- include/net/irda/ircomm_tty.h | 1 + include/net/iucv/af_iucv.h | 2 +- include/net/llc_c_ac.h | 2 +- include/net/llc_c_ev.h | 4 +- include/net/llc_c_st.h | 2 +- include/net/llc_s_ac.h | 2 +- include/net/llc_s_st.h | 2 +- include/net/mac80211.h | 6 +- include/net/neighbour.h | 4 +- include/net/net_namespace.h | 18 +- include/net/netlink.h | 2 +- include/net/netns/conntrack.h | 6 +- include/net/netns/ipv4.h | 4 +- include/net/netns/ipv6.h | 4 +- include/net/netns/xfrm.h | 2 +- include/net/ping.h | 2 +- include/net/protocol.h | 4 +- include/net/rtnetlink.h | 2 +- include/net/sctp/checksum.h | 4 +- include/net/sctp/sm.h | 4 +- include/net/sctp/structs.h | 2 +- include/net/snmp.h | 10 +- include/net/sock.h | 12 +- include/net/tcp.h | 8 +- include/net/xfrm.h | 13 +- include/rdma/iw_cm.h | 2 +- include/scsi/libfc.h | 3 +- include/scsi/scsi_device.h | 6 +- include/scsi/scsi_driver.h | 2 +- include/scsi/scsi_transport_fc.h | 3 +- include/scsi/sg.h | 2 +- include/sound/compress_driver.h | 2 +- include/sound/soc.h | 4 +- include/trace/events/irq.h | 4 +- include/uapi/linux/a.out.h | 8 + include/uapi/linux/bcache.h | 5 +- include/uapi/linux/byteorder/little_endian.h | 28 +- include/uapi/linux/connector.h | 2 +- include/uapi/linux/elf.h | 28 + include/uapi/linux/screen_info.h | 2 +- include/uapi/linux/swab.h | 6 +- include/uapi/linux/xattr.h | 4 + include/video/udlfb.h | 8 +- include/video/uvesafb.h | 1 + init/Kconfig | 2 +- init/Makefile | 3 + init/do_mounts.c | 14 +- init/do_mounts.h | 8 +- init/do_mounts_initrd.c | 30 +- init/do_mounts_md.c | 6 +- init/init_task.c | 4 + init/initramfs.c | 38 +- init/main.c | 30 +- ipc/compat.c | 4 +- ipc/ipc_sysctl.c | 14 +- ipc/mq_sysctl.c | 4 +- ipc/sem.c | 4 +- ipc/shm.c | 6 + kernel/audit.c | 8 +- kernel/auditsc.c | 4 +- kernel/bpf/core.c | 7 +- kernel/capability.c | 3 + kernel/compat.c | 38 +- kernel/debug/debug_core.c | 16 +- kernel/debug/kdb/kdb_main.c | 4 +- kernel/events/core.c | 30 +- kernel/events/internal.h | 10 +- kernel/events/uprobes.c | 2 +- kernel/exit.c | 27 +- kernel/fork.c | 175 +- kernel/futex.c | 11 +- kernel/futex_compat.c | 2 +- kernel/gcov/base.c | 7 +- kernel/irq/manage.c | 2 +- kernel/irq/msi.c | 19 +- kernel/irq/spurious.c | 2 +- kernel/jump_label.c | 5 + kernel/kallsyms.c | 37 +- kernel/kexec.c | 3 +- kernel/kmod.c | 8 +- kernel/kprobes.c | 4 +- kernel/ksysfs.c | 2 +- kernel/locking/lockdep.c | 7 +- kernel/locking/mutex-debug.c | 12 +- kernel/locking/mutex-debug.h | 4 +- kernel/locking/mutex.c | 6 +- kernel/module.c | 422 +- kernel/notifier.c | 17 +- kernel/padata.c | 4 +- kernel/panic.c | 5 +- kernel/pid.c | 2 +- kernel/pid_namespace.c | 2 +- kernel/power/process.c | 12 +- kernel/profile.c | 14 +- kernel/ptrace.c | 8 +- kernel/rcu/rcutorture.c | 60 +- kernel/rcu/tiny.c | 4 +- kernel/rcu/tree.c | 42 +- kernel/rcu/tree.h | 16 +- kernel/rcu/tree_plugin.h | 18 +- kernel/rcu/tree_trace.c | 14 +- kernel/resource.c | 4 +- kernel/sched/auto_group.c | 4 +- kernel/sched/core.c | 45 +- kernel/sched/fair.c | 2 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 24 +- kernel/smpboot.c | 4 +- kernel/softirq.c | 12 +- kernel/sys.c | 10 +- kernel/sysctl.c | 34 +- kernel/time/alarmtimer.c | 2 +- kernel/time/posix-cpu-timers.c | 4 +- kernel/time/posix-timers.c | 24 +- kernel/time/timer.c | 2 +- kernel/time/timer_stats.c | 10 +- kernel/trace/blktrace.c | 6 +- kernel/trace/ftrace.c | 15 +- kernel/trace/ring_buffer.c | 96 +- kernel/trace/trace.c | 2 +- kernel/trace/trace.h | 2 +- kernel/trace/trace_clock.c | 4 +- kernel/trace/trace_events.c | 1 - kernel/trace/trace_functions_graph.c | 4 +- kernel/trace/trace_mmiotrace.c | 8 +- kernel/trace/trace_output.c | 10 +- kernel/trace/trace_seq.c | 2 +- kernel/trace/trace_stack.c | 2 +- kernel/user.c | 2 +- kernel/user_namespace.c | 2 +- kernel/utsname_sysctl.c | 2 +- kernel/watchdog.c | 2 +- kernel/workqueue.c | 8 +- lib/Kconfig.debug | 8 +- lib/Makefile | 2 +- lib/bitmap.c | 8 +- lib/bug.c | 2 + lib/debugobjects.c | 2 +- lib/decompress_bunzip2.c | 3 +- lib/decompress_unlzma.c | 4 +- lib/div64.c | 4 +- lib/dma-debug.c | 4 +- lib/inflate.c | 2 +- lib/ioremap.c | 4 +- lib/kobject.c | 4 +- lib/list_debug.c | 126 +- lib/lockref.c | 44 +- lib/percpu-refcount.c | 2 +- lib/radix-tree.c | 2 +- lib/random32.c | 2 +- lib/rhashtable.c | 4 +- lib/show_mem.c | 2 +- lib/strncpy_from_user.c | 2 +- lib/strnlen_user.c | 2 +- lib/swiotlb.c | 2 +- lib/usercopy.c | 6 + lib/vsprintf.c | 12 +- mm/Kconfig | 6 +- mm/backing-dev.c | 4 +- mm/debug.c | 3 + mm/filemap.c | 2 +- mm/gup.c | 13 +- mm/highmem.c | 6 +- mm/hugetlb.c | 70 +- mm/internal.h | 1 + mm/maccess.c | 12 +- mm/madvise.c | 37 + mm/memory-failure.c | 6 +- mm/memory.c | 424 +- mm/mempolicy.c | 25 + mm/mlock.c | 18 +- mm/mm_init.c | 2 +- mm/mmap.c | 582 +- mm/mprotect.c | 137 +- mm/mremap.c | 39 +- mm/nommu.c | 21 +- mm/page-writeback.c | 2 +- mm/page_alloc.c | 50 +- mm/percpu.c | 2 +- mm/process_vm_access.c | 14 +- mm/rmap.c | 45 +- mm/shmem.c | 19 +- mm/slab.c | 111 +- mm/slab.h | 22 +- mm/slab_common.c | 86 +- mm/slob.c | 218 +- mm/slub.c | 109 +- mm/sparse-vmemmap.c | 4 +- mm/sparse.c | 2 +- mm/swap.c | 2 + mm/swapfile.c | 12 +- mm/util.c | 6 + mm/vmalloc.c | 114 +- mm/vmstat.c | 12 +- net/8021q/vlan.c | 5 +- net/8021q/vlan_netlink.c | 2 +- net/9p/mod.c | 4 +- net/9p/trans_fd.c | 2 +- net/atm/atm_misc.c | 8 +- net/atm/lec.h | 2 +- net/atm/proc.c | 6 +- net/atm/resources.c | 4 +- net/ax25/sysctl_net_ax25.c | 2 +- net/batman-adv/bat_iv_ogm.c | 8 +- net/batman-adv/fragmentation.c | 2 +- net/batman-adv/routing.c | 4 +- net/batman-adv/soft-interface.c | 10 +- net/batman-adv/translation-table.c | 14 +- net/batman-adv/types.h | 8 +- net/bluetooth/hci_sock.c | 2 +- net/bluetooth/l2cap_core.c | 6 +- net/bluetooth/l2cap_sock.c | 12 +- net/bluetooth/rfcomm/sock.c | 4 +- net/bluetooth/rfcomm/tty.c | 4 +- net/bridge/br_netlink.c | 2 +- net/bridge/netfilter/ebtables.c | 6 +- net/caif/cfctrl.c | 11 +- net/caif/chnl_net.c | 2 +- net/can/af_can.c | 2 +- net/can/gw.c | 6 +- net/ceph/messenger.c | 4 +- net/compat.c | 26 +- net/core/datagram.c | 2 +- net/core/dev.c | 16 +- net/core/filter.c | 2 +- net/core/flow.c | 6 +- net/core/neighbour.c | 18 +- net/core/net-sysfs.c | 2 +- net/core/net_namespace.c | 8 +- net/core/netpoll.c | 4 +- net/core/rtnetlink.c | 17 +- net/core/scm.c | 12 +- net/core/skbuff.c | 11 +- net/core/sock.c | 28 +- net/core/sock_diag.c | 15 +- net/core/sysctl_net_core.c | 22 +- net/decnet/af_decnet.c | 1 + net/decnet/sysctl_net_decnet.c | 4 +- net/dsa/dsa.c | 2 +- net/hsr/hsr_netlink.c | 2 +- net/ieee802154/6lowpan/core.c | 2 +- net/ieee802154/6lowpan/reassembly.c | 14 +- net/ipv4/af_inet.c | 2 +- net/ipv4/arp.c | 2 +- net/ipv4/devinet.c | 18 +- net/ipv4/fib_frontend.c | 6 +- net/ipv4/fib_semantics.c | 2 +- net/ipv4/inet_connection_sock.c | 4 +- net/ipv4/inet_diag.c | 4 +- net/ipv4/inet_timewait_sock.c | 2 +- net/ipv4/inetpeer.c | 2 +- net/ipv4/ip_fragment.c | 15 +- net/ipv4/ip_gre.c | 6 +- net/ipv4/ip_sockglue.c | 2 +- net/ipv4/ip_vti.c | 4 +- net/ipv4/ipconfig.c | 6 +- net/ipv4/ipip.c | 4 +- net/ipv4/netfilter/arp_tables.c | 12 +- net/ipv4/netfilter/ip_tables.c | 12 +- net/ipv4/ping.c | 14 +- net/ipv4/proc.c | 8 +- net/ipv4/raw.c | 14 +- net/ipv4/route.c | 32 +- net/ipv4/sysctl_net_ipv4.c | 22 +- net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_probe.c | 2 +- net/ipv4/udp.c | 10 +- net/ipv4/xfrm4_mode_transport.c | 2 +- net/ipv4/xfrm4_policy.c | 17 +- net/ipv4/xfrm4_state.c | 4 +- net/ipv6/addrconf.c | 22 +- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/icmp.c | 2 +- net/ipv6/ip6_fib.c | 4 +- net/ipv6/ip6_gre.c | 10 +- net/ipv6/ip6_tunnel.c | 4 +- net/ipv6/ip6_vti.c | 4 +- net/ipv6/ipv6_sockglue.c | 2 +- net/ipv6/ndisc.c | 2 +- net/ipv6/netfilter/ip6_tables.c | 12 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 14 +- net/ipv6/ping.c | 33 +- net/ipv6/proc.c | 10 +- net/ipv6/raw.c | 17 +- net/ipv6/reassembly.c | 13 +- net/ipv6/route.c | 2 +- net/ipv6/sit.c | 4 +- net/ipv6/sysctl_net_ipv6.c | 2 +- net/ipv6/udp.c | 6 +- net/ipv6/xfrm6_policy.c | 17 +- net/irda/ircomm/ircomm_tty.c | 18 +- net/iucv/af_iucv.c | 4 +- net/iucv/iucv.c | 2 +- net/key/af_key.c | 4 +- net/l2tp/l2tp_eth.c | 38 +- net/l2tp/l2tp_ip.c | 2 +- net/l2tp/l2tp_ip6.c | 2 +- net/mac80211/cfg.c | 10 +- net/mac80211/debugfs_key.c | 4 +- net/mac80211/ieee80211_i.h | 3 +- net/mac80211/iface.c | 20 +- net/mac80211/key.c | 4 +- net/mac80211/main.c | 2 +- net/mac80211/pm.c | 4 +- net/mac80211/rate.c | 2 +- net/mac80211/sta_info.c | 2 +- net/mac80211/tx.c | 2 +- net/mac80211/util.c | 8 +- net/mac80211/wpa.c | 10 +- net/mac802154/iface.c | 4 +- net/mpls/af_mpls.c | 6 +- net/netfilter/ipset/ip_set_core.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 6 +- net/netfilter/ipvs/ip_vs_core.c | 4 +- net/netfilter/ipvs/ip_vs_ctl.c | 14 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 2 +- net/netfilter/ipvs/ip_vs_sync.c | 6 +- net/netfilter/ipvs/ip_vs_xmit.c | 4 +- net/netfilter/nf_conntrack_acct.c | 2 +- net/netfilter/nf_conntrack_ecache.c | 2 +- net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 22 +- net/netfilter/nf_conntrack_proto.c | 2 +- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_conntrack_timestamp.c | 2 +- net/netfilter/nf_log.c | 10 +- net/netfilter/nf_sockopt.c | 4 +- net/netfilter/nf_tables_api.c | 13 +- net/netfilter/nfnetlink_acct.c | 7 +- net/netfilter/nfnetlink_cthelper.c | 2 +- net/netfilter/nfnetlink_cttimeout.c | 2 +- net/netfilter/nfnetlink_log.c | 4 +- net/netfilter/nft_compat.c | 9 +- net/netfilter/xt_statistic.c | 8 +- net/netlink/af_netlink.c | 14 +- net/netlink/diag.c | 2 +- net/netlink/genetlink.c | 14 +- net/openvswitch/vport-internal_dev.c | 2 +- net/packet/af_packet.c | 26 +- net/packet/diag.c | 2 +- net/packet/internal.h | 6 +- net/phonet/pep.c | 6 +- net/phonet/socket.c | 2 +- net/phonet/sysctl.c | 2 +- net/rds/cong.c | 6 +- net/rds/ib.h | 2 +- net/rds/ib_cm.c | 2 +- net/rds/ib_recv.c | 4 +- net/rds/iw.h | 2 +- net/rds/iw_cm.c | 2 +- net/rds/iw_recv.c | 4 +- net/rds/rds.h | 2 +- net/rds/tcp.c | 2 +- net/rds/tcp_send.c | 2 +- net/rxrpc/af_rxrpc.c | 2 +- net/rxrpc/ar-ack.c | 14 +- net/rxrpc/ar-call.c | 2 +- net/rxrpc/ar-connection.c | 2 +- net/rxrpc/ar-connevent.c | 2 +- net/rxrpc/ar-input.c | 4 +- net/rxrpc/ar-internal.h | 8 +- net/rxrpc/ar-local.c | 2 +- net/rxrpc/ar-output.c | 4 +- net/rxrpc/ar-peer.c | 2 +- net/rxrpc/ar-proc.c | 4 +- net/rxrpc/ar-transport.c | 2 +- net/rxrpc/rxkad.c | 4 +- net/sched/sch_generic.c | 4 +- net/sctp/ipv6.c | 6 +- net/sctp/protocol.c | 10 +- net/sctp/sm_sideeffect.c | 2 +- net/sctp/socket.c | 21 +- net/sctp/sysctl.c | 10 +- net/socket.c | 18 +- net/sunrpc/auth_gss/svcauth_gss.c | 4 +- net/sunrpc/clnt.c | 4 +- net/sunrpc/sched.c | 4 +- net/sunrpc/svc.c | 4 +- net/sunrpc/svcauth_unix.c | 2 +- net/sunrpc/xprtrdma/svc_rdma.c | 44 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 +- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_transport.c | 10 +- net/tipc/netlink_compat.c | 12 +- net/tipc/subscr.c | 2 +- net/unix/diag.c | 2 +- net/unix/sysctl_net_unix.c | 2 +- net/wireless/wext-core.c | 19 +- net/xfrm/xfrm_policy.c | 16 +- net/xfrm/xfrm_state.c | 33 +- net/xfrm/xfrm_sysctl.c | 2 +- net/xfrm/xfrm_user.c | 2 +- scripts/Kbuild.include | 2 +- scripts/Makefile.build | 2 +- scripts/Makefile.clean | 3 +- scripts/Makefile.host | 69 +- scripts/basic/fixdep.c | 12 +- scripts/dtc/checks.c | 14 +- scripts/dtc/data.c | 6 +- scripts/dtc/flattree.c | 8 +- scripts/dtc/livetree.c | 4 +- scripts/gcc-plugin.sh | 51 + scripts/headers_install.sh | 1 + scripts/kallsyms.c | 4 +- scripts/kconfig/lkc.h | 5 +- scripts/kconfig/menu.c | 2 +- scripts/kconfig/symbol.c | 6 +- scripts/link-vmlinux.sh | 2 +- scripts/mod/file2alias.c | 14 +- scripts/mod/modpost.c | 25 +- scripts/mod/modpost.h | 6 +- scripts/mod/sumversion.c | 2 +- scripts/module-common.lds | 4 + scripts/package/builddeb | 1 + scripts/pnmtologo.c | 6 +- scripts/sortextable.h | 6 +- scripts/tags.sh | 2 +- security/Kconfig | 691 +- security/apparmor/include/policy.h | 2 +- security/apparmor/policy.c | 4 +- security/integrity/ima/ima.h | 4 +- security/integrity/ima/ima_api.c | 2 +- security/integrity/ima/ima_fs.c | 4 +- security/integrity/ima/ima_queue.c | 2 +- security/keys/internal.h | 8 +- security/keys/key.c | 18 +- security/keys/keyring.c | 4 - security/selinux/avc.c | 6 +- security/selinux/include/xfrm.h | 2 +- security/yama/yama_lsm.c | 2 +- sound/aoa/codecs/onyx.c | 7 +- sound/aoa/codecs/onyx.h | 1 + sound/core/oss/pcm_oss.c | 18 +- sound/core/pcm_compat.c | 2 +- sound/core/pcm_native.c | 4 +- sound/core/seq/seq_clientmgr.c | 10 +- sound/core/seq/seq_compat.c | 2 +- sound/core/seq/seq_fifo.c | 6 +- sound/core/seq/seq_fifo.h | 2 +- sound/core/seq/seq_memory.c | 6 +- sound/core/sound.c | 2 +- sound/drivers/mts64.c | 14 +- sound/drivers/opl4/opl4_lib.c | 2 +- sound/drivers/portman2x4.c | 3 +- sound/firewire/amdtp-am824.c | 2 +- sound/firewire/amdtp-stream.c | 4 +- sound/firewire/amdtp-stream.h | 2 +- sound/firewire/digi00x/amdtp-dot.c | 2 +- sound/firewire/isight.c | 10 +- sound/firewire/scs1x.c | 8 +- sound/oss/sb_audio.c | 2 +- sound/oss/swarm_cs4297a.c | 6 +- sound/pci/hda/hda_codec.c | 2 +- sound/pci/ymfpci/ymfpci.h | 2 +- sound/pci/ymfpci/ymfpci_main.c | 12 +- sound/soc/codecs/sti-sas.c | 10 +- sound/soc/intel/skylake/skl-sst-dsp.h | 4 +- sound/soc/soc-ac97.c | 6 +- sound/soc/xtensa/xtfpga-i2s.c | 2 +- tools/gcc/Makefile | 42 + tools/gcc/checker_plugin.c | 549 + tools/gcc/colorize_plugin.c | 215 + tools/gcc/constify_plugin.c | 571 + tools/gcc/gcc-common.h | 819 + tools/gcc/initify_plugin.c | 591 + tools/gcc/kallocstat_plugin.c | 188 + tools/gcc/kernexec_plugin.c | 549 + tools/gcc/latent_entropy_plugin.c | 474 + tools/gcc/randomize_layout_seed.h | 1 + tools/gcc/size_overflow_plugin/.gitignore | 2 + tools/gcc/size_overflow_plugin/Makefile | 28 + .../disable_size_overflow_hash.data | 12434 ++ .../disable_size_overflow_hash.h | 152601 ++++++++++++++++++ .../generate_size_overflow_hash.sh | 103 + .../insert_size_overflow_asm.c | 416 + .../size_overflow_plugin/intentional_overflow.c | 1116 + .../size_overflow_plugin/remove_unnecessary_dup.c | 137 + tools/gcc/size_overflow_plugin/size_overflow.h | 325 + .../gcc/size_overflow_plugin/size_overflow_debug.c | 194 + .../size_overflow_plugin/size_overflow_hash.data | 21454 +++ .../size_overflow_hash_aux.data | 92 + tools/gcc/size_overflow_plugin/size_overflow_ipa.c | 1226 + .../gcc/size_overflow_plugin/size_overflow_misc.c | 505 + .../size_overflow_plugin/size_overflow_plugin.c | 318 + .../size_overflow_plugin_hash.c | 352 + .../size_overflow_plugin/size_overflow_transform.c | 745 + .../size_overflow_transform_core.c | 1015 + tools/gcc/stackleak_plugin.c | 444 + tools/gcc/structleak_plugin.c | 290 + tools/include/linux/compiler.h | 8 + tools/perf/util/include/asm/alternative-asm.h | 3 + tools/virtio/linux/uaccess.h | 2 +- virt/kvm/kvm_main.c | 42 +- 2088 files changed, 221599 insertions(+), 9618 deletions(-) commit 87790bbd0d8dc2bd7fd86cb947e32886db9e9766 Author: Matthew Wilcox Date: Tue Feb 2 16:57:52 2016 -0800 radix-tree: fix race in gang lookup If the indirect_ptr bit is set on a slot, that indicates we need to redo the lookup. Introduce a new function radix_tree_iter_retry() which forces the loop to retry the lookup by setting 'slot' to NULL and turning the iterator back to point at the problematic entry. This is a pretty rare problem to hit at the moment; the lookup has to race with a grow of the radix tree from a height of 0. The consequences of hitting this race are that gang lookup could return a pointer to a radix_tree_node instead of a pointer to whatever the user had inserted in the tree. Fixes: cebbd29e1c2f ("radix-tree: rewrite gang lookup using iterator") Signed-off-by: Matthew Wilcox Cc: Hugh Dickins Cc: Ohad Ben-Cohen Cc: Konstantin Khlebnikov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/radix-tree.h | 16 ++++++++++++++++ lib/radix-tree.c | 12 ++++++++++-- 2 files changed, 26 insertions(+), 2 deletions(-) commit bf628043b4589c910919a0f221ae7f42aa8cea93 Author: Hannes Frederic Sowa Date: Wed Feb 3 02:11:03 2016 +0100 unix: correctly track in-flight fds in sending process user_struct The commit referenced in the Fixes tag incorrectly accounted the number of in-flight fds over a unix domain socket to the original opener of the file-descriptor. This allows another process to arbitrary deplete the original file-openers resource limit for the maximum of open files. Instead the sending processes and its struct cred should be credited. To do so, we add a reference counted struct user_struct pointer to the scm_fp_list and use it to account for the number of inflight unix fds. Fixes: 712f4aad406bb1 ("unix: properly account for FDs passed over unix sockets") Reported-by: David Herrmann Cc: David Herrmann Cc: Willy Tarreau Cc: Linus Torvalds Suggested-by: Linus Torvalds Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller include/net/af_unix.h | 4 ++-- include/net/scm.h | 1 + net/core/scm.c | 7 +++++++ net/unix/af_unix.c | 4 ++-- net/unix/garbage.c | 8 ++++---- 5 files changed, 16 insertions(+), 8 deletions(-) commit e830db443ff78d70b7b63536e688d73907face0c Author: Mike Kravetz Date: Fri Jan 15 16:57:37 2016 -0800 fs/hugetlbfs/inode.c: fix bugs in hugetlb_vmtruncate_list() Hillf Danton noticed bugs in the hugetlb_vmtruncate_list routine. The argument end is of type pgoff_t. It was being converted to a vaddr offset and passed to unmap_hugepage_range. However, end was also being used as an argument to the vma_interval_tree_foreach controlling loop. In addition, the conversion of end to vaddr offset was incorrect. hugetlb_vmtruncate_list is called as part of a file truncate or fallocate hole punch operation. When truncating a hugetlbfs file, this bug could prevent some pages from being unmapped. This is possible if there are multiple vmas mapping the file, and there is a sufficiently sized hole between the mappings. The size of the hole between two vmas (A,B) must be such that the starting virtual address of B is greater than (ending virtual address of A << PAGE_SHIFT). In this case, the pages in B would not be unmapped. If pages are not properly unmapped during truncate, the following BUG is hit: kernel BUG at fs/hugetlbfs/inode.c:428! In the fallocate hole punch case, this bug could prevent pages from being unmapped as in the truncate case. However, for hole punch the result is that unmapped pages will not be removed during the operation. For hole punch, it is also possible that more pages than desired will be unmapped. This unnecessary unmapping will cause page faults to reestablish the mappings on subsequent page access. Fixes: 1bfad99ab (" hugetlbfs: hugetlb_vmtruncate_list() needs to take a range")Reported-by: Hillf Danton Signed-off-by: Mike Kravetz Cc: Hugh Dickins Cc: Naoya Horiguchi Cc: Davidlohr Bueso Cc: Dave Hansen Cc: [4.3] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/hugetlbfs/inode.c | 19 +++++++++++-------- 1 files changed, 11 insertions(+), 8 deletions(-) commit cdb3ba4a9113b779347387f3b6c6ea72dd4db12f Author: Takashi Iwai Date: Thu Feb 4 17:06:13 2016 +0100 ALSA: timer: Fix leftover link at closing In ALSA timer core, the active timer instance is managed in active_list linked list. Each element is added / removed dynamically at timer start, stop and in timer interrupt. The problem is that snd_timer_interrupt() has a thinko and leaves the element in active_list when it's the last opened element. This eventually leads to list corruption or use-after-free error. This hasn't been revealed because we used to delete the list forcibly in snd_timer_stop() in the past. However, the recent fix avoids the double-stop behavior (in commit [f784beb75ce8: ALSA: timer: Fix link corruption due to double start or stop]), and this leak hits reality. This patch fixes the link management in snd_timer_interrupt(). Now it simply unlinks no matter which stream is. BugLink: http://lkml.kernel.org/r/CACT4Y+Yy2aukHP-EDp8-ziNqNNmb-NTf=jDWXMP7jB8HDa2vng@mail.gmail.com Reported-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/timer.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit 47d9647902f6a2f46a2be1e0140ba0f6f8c06008 Author: Konstantin Khlebnikov Date: Fri Feb 5 15:37:01 2016 -0800 radix-tree: fix oops after radix_tree_iter_retry Helper radix_tree_iter_retry() resets next_index to the current index. In following radix_tree_next_slot current chunk size becomes zero. This isn't checked and it tries to dereference null pointer in slot. Tagged iterator is fine because retry happens only at slot 0 where tag bitmask in iter->tags is filled with single bit. Fixes: 46437f9a554f ("radix-tree: fix race in gang lookup") Signed-off-by: Konstantin Khlebnikov Cc: Matthew Wilcox Cc: Hugh Dickins Cc: Ohad Ben-Cohen Cc: Jeremiah Mahler Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/radix-tree.h | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) commit 95b5dcb3c01958502af00b0bc0da1d906aae11a2 Merge: 438be0b 256aeaf Author: Brad Spengler Date: Sun Feb 7 08:29:33 2016 -0500 Merge branch 'pax-test' into grsec-test commit 256aeaf87c22de8edf1f03682a572c590ae07771 Author: Brad Spengler Date: Sun Feb 7 08:29:09 2016 -0500 Update to pax-linux-4.3.5-test28.patch: - fixed an integer truncation bug in numa_clear_kernel_node_hotplug caught by the size overflow plugin, reported by x14sg1 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4374) - spender fixed UDEREF on arm arch/arm/Kconfig | 1 + arch/arm/include/asm/domain.h | 21 ++++++++- arch/arm/include/asm/futex.h | 9 ---- arch/arm/include/asm/thread_info.h | 3 + arch/arm/include/asm/uaccess.h | 81 +++++++++++++++--------------------- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/kernel/process.c | 2 +- arch/arm/mm/alignment.c | 8 ---- arch/x86/mm/numa.c | 2 +- security/Kconfig | 1 - 10 files changed, 60 insertions(+), 70 deletions(-) commit 438be0bd112bd17942b2628c53054dc1007558a1 Author: Brad Spengler Date: Sat Feb 6 19:50:31 2016 -0500 Fix a number of issues caused by the upstream merging of a UDEREF ripoff resulting in unbootable ARM systems reported on the forums arch/arm/Kconfig | 1 + arch/arm/include/asm/domain.h | 21 ++++++++- arch/arm/include/asm/futex.h | 9 ---- arch/arm/include/asm/thread_info.h | 3 + arch/arm/include/asm/uaccess.h | 81 +++++++++++++++--------------------- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/kernel/process.c | 2 +- arch/arm/mm/alignment.c | 8 ---- security/Kconfig | 1 - 9 files changed, 59 insertions(+), 69 deletions(-) commit 4ffdd5ef1f87e611af1efb4f251ada92abe9f4c0 Author: Brad Spengler Date: Sat Feb 6 11:21:53 2016 -0500 Fix another compiler warning net/ipv4/tcp_input.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) commit 30b5b7bc0fd67d458bdd5ab35e4689769eabd2ed Author: Brad Spengler Date: Sat Feb 6 11:16:12 2016 -0500 Fix two compiler warnings kernel/pid.c | 5 ++--- kernel/ptrace.c | 3 ++- 2 files changed, 4 insertions(+), 4 deletions(-) commit dda4d2a21914c480750f10bd55c6e3203d415d8d Author: Brad Spengler Date: Wed Feb 3 21:22:40 2016 -0500 Apply fix for integer truncation in NUMA init code, reported by x14sg1 on the forums: https://forums.grsecurity.net/viewtopic.php?f=3&t=4374 arch/x86/mm/numa.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 477505f7c893cb6a2c3e22f83eefd9c985d7b3ca Merge: a781740 016d0d8 Author: Brad Spengler Date: Wed Feb 3 21:20:58 2016 -0500 Merge branch 'pax-test' into grsec-test commit 016d0d81a8dd4be1304c82a68e0ccf425868f467 Author: Brad Spengler Date: Wed Feb 3 21:20:10 2016 -0500 Update to pax-linux-4.3.5-test27.patch: - fixed a bunch of potential REFCOUNT false positives, reported by Emese - restored padding in fpregs_state for storing AVX-512 state in the future - constified netlink_dump_control - added const version of debug_gimple_stmt for gcc plugins, by Emese - Emese fixed a bug in initify that could have initified too much - Emese fixed a false positive intentional integer overflow in xfrm4_extract_header, reported by corsac arch/x86/include/asm/fpu/types.h | 1 + arch/x86/include/asm/mmu_context.h | 2 +- block/blk-cgroup.c | 18 ++-- block/cfq-iosched.c | 4 +- crypto/crypto_user.c | 8 ++- drivers/acpi/apei/ghes.c | 6 +- drivers/char/ipmi/ipmi_ssif.c | 12 ++-- drivers/gpu/drm/amd/scheduler/gpu_scheduler.c | 2 +- drivers/gpu/drm/amd/scheduler/gpu_scheduler.h | 2 +- drivers/gpu/drm/amd/scheduler/sched_fence.c | 2 +- drivers/infiniband/core/netlink.c | 5 +- drivers/infiniband/hw/cxgb4/device.c | 6 +- drivers/infiniband/hw/cxgb4/iw_cxgb4.h | 2 +- drivers/md/bcache/alloc.c | 2 +- drivers/md/bcache/bcache.h | 10 +- drivers/md/bcache/btree.c | 2 +- drivers/md/bcache/io.c | 10 +- drivers/md/bcache/journal.c | 2 +- drivers/md/bcache/stats.c | 26 +++--- drivers/md/bcache/stats.h | 16 ++-- drivers/md/bcache/super.c | 2 +- drivers/md/bcache/sysfs.c | 20 +++--- drivers/md/dm-cache-target.c | 98 ++++++++++++------------ drivers/md/dm-raid.c | 2 +- drivers/md/md.c | 6 +- drivers/md/md.h | 2 +- drivers/md/raid1.c | 2 +- drivers/md/raid10.c | 2 +- drivers/md/raid5.c | 4 +- drivers/media/pci/zoran/zoran.h | 1 - drivers/media/pci/zoran/zoran_driver.c | 3 - drivers/net/ethernet/sfc/selftest.c | 20 +++--- drivers/net/irda/vlsi_ir.c | 18 ++-- drivers/net/irda/vlsi_ir.h | 14 ++-- drivers/net/wireless/ath/carl9170/carl9170.h | 6 +- drivers/net/wireless/ath/carl9170/debug.c | 6 +- drivers/net/wireless/ath/carl9170/main.c | 10 +- drivers/net/wireless/ath/carl9170/tx.c | 4 +- drivers/net/wireless/iwlwifi/mvm/d3.c | 4 +- drivers/net/wireless/iwlwifi/mvm/tx.c | 2 +- drivers/scsi/hptiop.c | 2 - drivers/scsi/hptiop.h | 1 - drivers/scsi/ipr.c | 6 +- drivers/scsi/ipr.h | 2 +- drivers/scsi/qla2xxx/qla_target.c | 10 +- drivers/scsi/qla2xxx/qla_target.h | 2 +- fs/btrfs/ctree.c | 2 +- fs/btrfs/ctree.h | 4 +- fs/btrfs/delayed-ref.c | 4 +- fs/btrfs/disk-io.c | 4 +- fs/btrfs/file.c | 4 +- fs/btrfs/raid56.c | 32 ++++---- fs/btrfs/tests/btrfs-tests.c | 2 +- fs/btrfs/transaction.c | 2 +- fs/btrfs/tree-log.c | 8 +- fs/btrfs/volumes.c | 14 ++-- fs/btrfs/volumes.h | 22 +++--- fs/jbd2/commit.c | 2 +- fs/jbd2/transaction.c | 4 +- fs/ocfs2/dlm/dlmcommon.h | 4 +- fs/ocfs2/dlm/dlmdebug.c | 10 +- fs/ocfs2/dlm/dlmdomain.c | 4 +- fs/ocfs2/dlm/dlmmaster.c | 4 +- include/acpi/ghes.h | 2 +- include/linux/blk-cgroup.h | 24 +++--- include/linux/jbd2.h | 2 +- include/linux/netlink.h | 12 ++-- include/net/cfg802154.h | 2 +- include/net/mac80211.h | 2 +- include/net/neighbour.h | 2 +- kernel/rcu/tree_plugin.h | 4 +- net/batman-adv/routing.c | 4 +- net/batman-adv/soft-interface.c | 2 +- net/batman-adv/translation-table.c | 14 ++-- net/batman-adv/types.h | 2 +- net/core/neighbour.c | 14 ++-- net/core/rtnetlink.c | 2 +- net/ipv4/arp.c | 2 +- net/ipv4/inet_diag.c | 4 +- net/ipv4/xfrm4_state.c | 4 +- net/ipv6/ndisc.c | 2 +- net/mac80211/cfg.c | 2 +- net/mac80211/debugfs_key.c | 2 +- net/mac80211/key.c | 4 +- net/mac80211/tx.c | 2 +- net/mac80211/wpa.c | 10 +- net/mac802154/iface.c | 4 +- net/netfilter/ipset/ip_set_core.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 22 +++--- net/netfilter/nf_tables_api.c | 13 ++-- net/netfilter/nfnetlink_acct.c | 7 +- net/netfilter/nfnetlink_cthelper.c | 2 +- net/netfilter/nfnetlink_cttimeout.c | 2 +- net/netlink/af_netlink.c | 10 ++- net/netlink/diag.c | 2 +- net/netlink/genetlink.c | 14 ++-- net/packet/af_packet.c | 18 ++-- net/packet/diag.c | 2 +- net/packet/internal.h | 6 +- net/unix/diag.c | 2 +- net/xfrm/xfrm_user.c | 2 +- security/apparmor/include/policy.h | 2 +- security/apparmor/policy.c | 4 +- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_fifo.c | 6 +- sound/core/seq/seq_fifo.h | 2 +- tools/gcc/gcc-common.h | 24 ++++-- tools/gcc/initify_plugin.c | 7 +- tools/lib/api/Makefile | 2 +- 109 files changed, 399 insertions(+), 391 deletions(-) commit a7817402ac837b1aee07fac42537a02097055098 Author: Matt Fleming Date: Fri Jan 29 11:36:10 2016 +0000 x86/mm/pat: Avoid truncation when converting cpa->numpages to address There are a couple of nasty truncation bugs lurking in the pageattr code that can be triggered when mapping EFI regions, e.g. when we pass a cpa->pgd pointer. Because cpa->numpages is a 32-bit value, shifting left by PAGE_SHIFT will truncate the resultant address to 32-bits. Viorel-Cătălin managed to trigger this bug on his Dell machine that provides a ~5GB EFI region which requires 1236992 pages to be mapped. When calling populate_pud() the end of the region gets calculated incorrectly in the following buggy expression, end = start + (cpa->numpages << PAGE_SHIFT); And only 188416 pages are mapped. Next, populate_pud() gets invoked for a second time because of the loop in __change_page_attr_set_clr(), only this time no pages get mapped because shifting the remaining number of pages (1048576) by PAGE_SHIFT is zero. At which point the loop in __change_page_attr_set_clr() spins forever because we fail to map progress. Hitting this bug depends very much on the virtual address we pick to map the large region at and how many pages we map on the initial run through the loop. This explains why this issue was only recently hit with the introduction of commit a5caa209ba9c ("x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down") It's interesting to note that safe uses of cpa->numpages do exist in the pageattr code. If instead of shifting ->numpages we multiply by PAGE_SIZE, no truncation occurs because PAGE_SIZE is a UL value, and so the result is unsigned long. To avoid surprises when users try to convert very large cpa->numpages values to addresses, change the data type from 'int' to 'unsigned long', thereby making it suitable for shifting by PAGE_SHIFT without any type casting. The alternative would be to make liberal use of casting, but that is far more likely to cause problems in the future when someone adds more code and fails to cast properly; this bug was difficult enough to track down in the first place. Reported-and-tested-by: Viorel-Cătălin Răpițeanu Acked-by: Borislav Petkov Cc: Sai Praneeth Prakhya Cc: Signed-off-by: Matt Fleming Link: https://bugzilla.kernel.org/show_bug.cgi?id=110131 Link: http://lkml.kernel.org/r/1454067370-10374-1-git-send-email-matt@codeblueprint.co.uk Signed-off-by: Thomas Gleixner arch/x86/mm/pageattr.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit 64dd9d7a67a742fda257cdd16510c29e695c34b5 Author: Jan Beulich Date: Tue Jan 26 04:15:18 2016 -0700 x86/mm: Fix types used in pgprot cacheability flags translations For PAE kernels "unsigned long" is not suitable to hold page protection flags, since _PAGE_NX doesn't fit there. This is the reason for quite a few W+X pages getting reported as insecure during boot (observed namely for the entire initrd range). Fixes: 281d4078be ("x86: Make page cache mode a real type") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/56A7635602000078000CAFF1@prv-mh.provo.novell.com Signed-off-by: Thomas Gleixner arch/x86/include/asm/pgtable_types.h | 6 ++---- 1 files changed, 2 insertions(+), 4 deletions(-) commit bb9a3a9df0d8dfc96d521676e64c42b37ba22aea Merge: 682d661 f74425b Author: Brad Spengler Date: Sun Jan 31 15:06:25 2016 -0500 Merge branch 'pax-test' into grsec-test Conflicts: drivers/net/slip/slhc.c include/linux/sched.h net/unix/af_unix.c sound/core/timer.c commit f74425b5705bfe52aff9e97659ef10c4a14176c3 Merge: d14af1f 849a2d3 Author: Brad Spengler Date: Sun Jan 31 15:02:55 2016 -0500 Merge branch 'linux-4.3.y' into pax-test Conflicts: arch/x86/include/asm/mmu_context.h commit 682d6611d75542e351c973c8dd74a99d3966c073 Author: Brad Spengler Date: Sat Jan 30 13:05:03 2016 -0500 Based on a report from Mathias Krause, fix up a number of additional instances of ulong overflow when passing in values to gr_learn_resource by saturating to ULONG_MAX mm/mlock.c | 11 ++++++++--- mm/mmap.c | 16 +++++++++++++--- 2 files changed, 21 insertions(+), 6 deletions(-) commit adb52e95fb9ad4ac9c56cd5d47bd668f47c33096 Author: Jann Horn Date: Sat Dec 26 06:00:48 2015 +0100 seccomp: always propagate NO_NEW_PRIVS on tsync Before this patch, a process with some permissive seccomp filter that was applied by root without NO_NEW_PRIVS was able to add more filters to itself without setting NO_NEW_PRIVS by setting the new filter from a throwaway thread with NO_NEW_PRIVS. Signed-off-by: Jann Horn Cc: stable@vger.kernel.org Signed-off-by: Kees Cook kernel/seccomp.c | 22 +++++++++++----------- 1 files changed, 11 insertions(+), 11 deletions(-) commit b85450498a3bbf269441c8963d7574bb3079c838 Merge: 59c216f d14af1f Author: Brad Spengler Date: Fri Jan 29 20:54:13 2016 -0500 Merge branch 'pax-test' into grsec-test commit d14af1f1dd66511f3f0674deee2b572972012b39 Author: Brad Spengler Date: Fri Jan 29 20:53:51 2016 -0500 Update to pax-linux-4.3.4-test26.patch: - Emese fixed a few intentional overflows introduced by gcc, reported by StalkR (https://forums.grsecurity.net/viewtopic.php?f=3&t=4370) fs/cifs/file.c | 2 +- fs/gfs2/file.c | 2 +- .../size_overflow_plugin/intentional_overflow.c | 96 ++++++++++++++++++-- tools/gcc/size_overflow_plugin/size_overflow.h | 2 + .../size_overflow_plugin/size_overflow_plugin.c | 4 +- .../size_overflow_plugin/size_overflow_transform.c | 6 +- .../size_overflow_transform_core.c | 5 + 7 files changed, 102 insertions(+), 15 deletions(-) commit 59c216f13587eacdd692386b7a403ae78ed84fb6 Author: Brad Spengler Date: Wed Jan 27 17:57:21 2016 -0500 Fix a size_overflow report reported by Mathias Krause in our truncation of an loff_t to an unsigned long when being passed to gr_learn_resource() (as all resource checks are against unsigned long values) fs/attr.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) commit 70636c6ad60fc1db3af764ecc789b827b7497a97 Author: Yuchung Cheng Date: Wed Jan 6 12:42:38 2016 -0800 tcp: fix zero cwnd in tcp_cwnd_reduction Patch 3759824da87b ("tcp: PRR uses CRB mode by default and SS mode conditionally") introduced a bug that cwnd may become 0 when both inflight and sndcnt are 0 (cwnd = inflight + sndcnt). This may lead to a div-by-zero if the connection starts another cwnd reduction phase by setting tp->prior_cwnd to the current cwnd (0) in tcp_init_cwnd_reduction(). To prevent this we skip PRR operation when nothing is acked or sacked. Then cwnd must be positive in all cases as long as ssthresh is positive: 1) The proportional reduction mode inflight > ssthresh > 0 2) The reduction bound mode a) inflight == ssthresh > 0 b) inflight < ssthresh sndcnt > 0 since newly_acked_sacked > 0 and inflight < ssthresh Therefore in all cases inflight and sndcnt can not both be 0. We check invalid tp->prior_cwnd to avoid potential div0 bugs. In reality this bug is triggered only with a sequence of less common events. For example, the connection is terminating an ECN-triggered cwnd reduction with an inflight 0, then it receives reordered/old ACKs or DSACKs from prior transmission (which acks nothing). Or the connection is in fast recovery stage that marks everything lost, but fails to retransmit due to local issues, then receives data packets from other end which acks nothing. Fixes: 3759824da87b ("tcp: PRR uses CRB mode by default and SS mode conditionally") Reported-by: Oleksandr Natalenko Signed-off-by: Yuchung Cheng Signed-off-by: Neal Cardwell Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/tcp_input.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) commit dac1da2bedbb43195d371c7a192cfeeb45683df0 Author: Eric Dumazet Date: Sun Jan 24 13:53:50 2016 -0800 af_unix: fix struct pid memory leak Dmitry reported a struct pid leak detected by a syzkaller program. Bug happens in unix_stream_recvmsg() when we break the loop when a signal is pending, without properly releasing scm. Fixes: b3ca9b02b007 ("net: fix multithreaded signal handling in unix recv routines") Reported-by: Dmitry Vyukov Signed-off-by: Eric Dumazet Cc: Rainer Weikusat Signed-off-by: David S. Miller net/unix/af_unix.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit 15cc47f127520d1ac0c1fe76d993c2c27f0f2571 Author: Hannes Frederic Sowa Date: Fri Jan 22 01:39:43 2016 +0100 pptp: fix illegal memory access caused by multiple bind()s Several times already this has been reported as kasan reports caused by syzkaller and trinity and people always looked at RCU races, but it is much more simple. :) In case we bind a pptp socket multiple times, we simply add it to the callid_sock list but don't remove the old binding. Thus the old socket stays in the bucket with unused call_id indexes and doesn't get cleaned up. This causes various forms of kasan reports which were hard to pinpoint. Simply don't allow multiple binds and correct error handling in pptp_bind. Also keep sk_state bits in place in pptp_connect. Fixes: 00959ade36acad ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)") Cc: Dmitry Kozlov Cc: Sasha Levin Cc: Dmitry Vyukov Reported-by: Dmitry Vyukov Cc: Dave Jones Reported-by: Dave Jones Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller drivers/net/ppp/pptp.c | 34 ++++++++++++++++++++++++---------- 1 files changed, 24 insertions(+), 10 deletions(-) commit e2b7b8c66851c85188fa6dab2d2b2a6c85bc7332 Author: Brad Spengler Date: Tue Jan 26 18:17:10 2016 -0500 Add info about cpupower/powertop to GRKERNSEC_KMEM, was present on our wiki but was removed from the config help at some point grsecurity/Kconfig | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) commit ce2e88efa000fc32bfcd84098f57c8ed8310fefc Author: Thomas Egerer Date: Mon Jan 25 12:58:44 2016 +0100 ipv4+ipv6: Make INET*_ESP select CRYPTO_ECHAINIV The ESP algorithms using CBC mode require echainiv. Hence INET*_ESP have to select CRYPTO_ECHAINIV in order to work properly. This solves the issues caused by a misconfiguration as described in [1]. The original approach, patching crypto/Kconfig was turned down by Herbert Xu [2]. [1] https://lists.strongswan.org/pipermail/users/2015-December/009074.html [2] http://marc.info/?l=linux-crypto-vger&m=145224655809562&w=2 Signed-off-by: Thomas Egerer Acked-by: Herbert Xu Signed-off-by: David S. Miller net/ipv4/Kconfig | 1 + net/ipv6/Kconfig | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) commit fca5a303155ea67d28aece0caf2b03ffc3b2668d Merge: 904114c 6339c1f Author: Brad Spengler Date: Tue Jan 26 18:08:40 2016 -0500 Merge branch 'pax-test' into grsec-test commit 6339c1f9a9beafd417bf9f04d4b257e62aeb45b7 Author: Brad Spengler Date: Tue Jan 26 18:07:51 2016 -0500 Update to pax-linux-4.3.4-test25.patch: - fixed incorrect handling of VM_DONTCOPY during fork that would trigger a consistency check in the vma mirroring logic, reported by Mathias Krause - fixed init_new_context on !MODIFY_LDT_SYSCALL configs, reported by tjh (https://forums.grsecurity.net/viewtopic.php?f=3&t=4368) - fixed a few REFCOUNT false positives in SNMP related statistics arch/x86/Kconfig | 2 +- arch/x86/include/asm/mmu_context.h | 17 +++++++++++++++++ include/net/snmp.h | 10 +++++----- kernel/fork.c | 11 +++++++++-- net/ipv4/proc.c | 8 ++++---- net/ipv6/addrconf.c | 4 ++-- net/ipv6/proc.c | 10 +++++----- 7 files changed, 43 insertions(+), 19 deletions(-) commit 904114c2fce3fdff5d57e763da56a78960db4e19 Author: Al Viro Date: Fri Jan 22 18:08:52 2016 -0500 make sure that freeing shmem fast symlinks is RCU-delayed Cc: stable@vger.kernel.org # v4.2+ Signed-off-by: Al Viro include/linux/shmem_fs.h | 5 +---- mm/shmem.c | 9 ++++----- 2 files changed, 5 insertions(+), 9 deletions(-) commit ab86adee64312a2f827dd516cb199521327943ed Author: Sasha Levin Date: Mon Jan 18 19:23:51 2016 -0500 netfilter: nf_conntrack: use safer way to lock all buckets When we need to lock all buckets in the connection hashtable we'd attempt to lock 1024 spinlocks, which is way more preemption levels than supported by the kernel. Furthermore, this behavior was hidden by checking if lockdep is enabled, and if it was - use only 8 buckets(!). Fix this by using a global lock and synchronize all buckets on it when we need to lock them all. This is pretty heavyweight, but is only done when we need to resize the hashtable, and that doesn't happen often enough (or at all). Signed-off-by: Sasha Levin Acked-by: Jesper Dangaard Brouer Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Conflicts: net/netfilter/nfnetlink_cttimeout.c include/net/netfilter/nf_conntrack_core.h | 8 ++---- net/netfilter/nf_conntrack_core.c | 38 +++++++++++++++++++++------- net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 2 +- 4 files changed, 33 insertions(+), 17 deletions(-) commit 37014723527225481c720484bb788a1a6358072f Author: Willy Tarreau Date: Mon Jan 18 16:36:09 2016 +0100 pipe: limit the per-user amount of pages allocated in pipes On no-so-small systems, it is possible for a single process to cause an OOM condition by filling large pipes with data that are never read. A typical process filling 4000 pipes with 1 MB of data will use 4 GB of memory. On small systems it may be tricky to set the pipe max size to prevent this from happening. This patch makes it possible to enforce a per-user soft limit above which new pipes will be limited to a single page, effectively limiting them to 4 kB each, as well as a hard limit above which no new pipes may be created for this user. This has the effect of protecting the system against memory abuse without hurting other users, and still allowing pipes to work correctly though with less data at once. The limit are controlled by two new sysctls : pipe-user-pages-soft, and pipe-user-pages-hard. Both may be disabled by setting them to zero. The default soft limit allows the default number of FDs per process (1024) to create pipes of the default size (64kB), thus reaching a limit of 64MB before starting to create only smaller pipes. With 256 processes limited to 1024 FDs each, this results in 1024*64kB + (256*1024 - 1024) * 4kB = 1084 MB of memory allocated for a user. The hard limit is disabled by default to avoid breaking existing applications that make intensive use of pipes (eg: for splicing). Reported-by: socketpair@gmail.com Reported-by: Tetsuo Handa Mitigates: CVE-2013-4312 (Linux 2.0+) Suggested-by: Linus Torvalds Signed-off-by: Willy Tarreau Signed-off-by: Al Viro Documentation/sysctl/fs.txt | 23 +++++++++++++++++++++ fs/pipe.c | 47 +++++++++++++++++++++++++++++++++++++++++- include/linux/pipe_fs_i.h | 4 +++ include/linux/sched.h | 1 + kernel/sysctl.c | 14 ++++++++++++ 5 files changed, 87 insertions(+), 2 deletions(-) commit 51645fa198d194f746651dcfbc5f24a4cf8b9fb8 Merge: 540f2af 7791ecb Author: Brad Spengler Date: Sat Jan 23 10:57:11 2016 -0500 Merge branch 'pax-test' into grsec-test commit 7791ecb84f840343a5646236fd0d34e1fb450793 Merge: 470069c 399588c Author: Brad Spengler Date: Sat Jan 23 10:56:47 2016 -0500 Merge branch 'linux-4.3.y' into pax-test commit 540f2affebd42cdc26a699208ab4f1cb0cb75e33 Author: Brad Spengler Date: Tue Jan 19 21:18:47 2016 -0500 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) commit 7e649765626a28437f573f0fbe7a51a04615f041 Author: Brad Spengler Date: Tue Jan 19 20:29:46 2016 -0500 Backport fix from: https://lkml.org/lkml/2015/12/13/187 fs/ext4/extents.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 53b859cd0a5f5b6ad54fe0c879dfedaa3c5a3005 Author: Jann Horn Date: Tue Jan 5 18:27:30 2016 +0100 compat_ioctl: don't call do_ioctl under set_fs(KERNEL_DS) This replaces all code in fs/compat_ioctl.c that translated ioctl arguments into a in-kernel structure, then performed do_ioctl under set_fs(KERNEL_DS), with code that allocates data on the user stack and can call the VFS ioctl handler under USER_DS. This is done as a hardening measure because the caller does not know what kind of ioctl handler will be invoked, only that no corresponding compat_ioctl handler exists and what the ioctl command number is. The accidental invocation of an unlocked_ioctl handler that unexpectedly calls copy_to_user could be a severe security issue. Signed-off-by: Jann Horn Signed-off-by: Al Viro Conflicts: fs/compat_ioctl.c fs/compat_ioctl.c | 130 ++++++++++++++++++++++++++++------------------------- 1 files changed, 68 insertions(+), 62 deletions(-) commit 3e89e770ae27e931cd1583f021abac41eeebc3e7 Author: Al Viro Date: Thu Jan 7 09:53:30 2016 -0500 compat_ioctl: don't pass fd around when not needed Signed-off-by: Al Viro fs/compat_ioctl.c | 103 ++++++++++++++++++++++++++-------------------------- fs/internal.h | 7 ++++ fs/ioctl.c | 4 +- include/linux/fs.h | 2 - 4 files changed, 61 insertions(+), 55 deletions(-) commit 9d4e04082752d4d2d68445c4e6faf33a2613df55 Author: Jann Horn Date: Tue Jan 5 18:27:29 2016 +0100 compat_ioctl: don't look up the fd twice In code in fs/compat_ioctl.c that translates ioctl arguments into a in-kernel structure, then performs sys_ioctl, possibly under set_fs(KERNEL_DS), this commit changes the sys_ioctl calls to do_ioctl calls. do_ioctl is a new function that does the same thing as sys_ioctl, but doesn't look up the fd again. This change is made to avoid (potential) security issues because of ioctl handlers that accept one of the ioctl commands I2C_FUNCS, VIDEO_GET_EVENT, MTIOCPOS, MTIOCGET, TIOCGSERIAL, TIOCSSERIAL, RTC_IRQP_READ, RTC_EPOCH_READ. This can happen for multiple reasons: - The ioctl command number could be reused. - The ioctl handler might not check the full ioctl command. This is e.g. true for drm_ioctl. - The ioctl handler is very special, e.g. cuse_file_ioctl The real issue is that set_fs(KERNEL_DS) is used here, but that's fixed in a separate commit "compat_ioctl: don't call do_ioctl under set_fs(KERNEL_DS)". This change mitigates potential security issues by preventing a race that permits invocation of unlocked_ioctl handlers under KERNEL_DS through compat code even if a corresponding compat_ioctl handler exists. So far, no way has been identified to use this to damage kernel memory without having CAP_SYS_ADMIN in the init ns (with the capability, doing reads/writes at arbitrary kernel addresses should be easy through CUSE's ioctl handler with FUSE_IOCTL_UNRESTRICTED set). [AV: two missed sys_ioctl() taken care of] Signed-off-by: Jann Horn Signed-off-by: Al Viro fs/compat_ioctl.c | 122 +++++++++++++++++++++++++++++----------------------- 1 files changed, 68 insertions(+), 54 deletions(-) commit 5bf9e1ed4ebb278cd956ba142914fc04a024309c Author: Vasily Kulikov Date: Fri Jan 15 16:57:55 2016 -0800 include/linux/poison.h: use POISON_POINTER_DELTA for poison pointers TIMER_ENTRY_STATIC is defined as a poison pointers which should point to nowhere. Redefine them using POISON_POINTER_DELTA arithmetics to make sure they really point to non-mappable area declared by the target architecture. Signed-off-by: Vasily Kulikov Acked-by: Thomas Gleixner Cc: Solar Designer Cc: "Kirill A. Shutemov" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Conflicts: include/linux/poison.h include/linux/poison.h | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 60f2e0a05ab8f56c804a9334a23e2b446305d110 Author: Brad Spengler Date: Tue Jan 19 19:41:44 2016 -0500 Fix ARM compilation, reported by Austin Sepp grsecurity/grsec_sig.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit e15383743443dc43460a2fd73e0db0b608610dca Author: Takashi Iwai Date: Mon Jan 18 13:52:47 2016 +0100 ALSA: hrtimer: Fix stall by hrtimer_cancel() hrtimer_cancel() waits for the completion from the callback, thus it must not be called inside the callback itself. This was already a problem in the past with ALSA hrtimer driver, and the early commit [fcfdebe70759: ALSA: hrtimer - Fix lock-up] tried to address it. However, the previous fix is still insufficient: it may still cause a lockup when the ALSA timer instance reprograms itself in its callback. Then it invokes the start function even in snd_timer_interrupt() that is called in hrtimer callback itself, results in a CPU stall. This is no hypothetical problem but actually triggered by syzkaller fuzzer. This patch tries to fix the issue again. Now we call hrtimer_try_to_cancel() at both start and stop functions so that it won't fall into a deadlock, yet giving some chance to cancel the queue if the functions have been called outside the callback. The proper hrtimer_cancel() is called in anyway at closing, so this should be enough. Reported-and-tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/hrtimer.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) commit 12d874daf706e6e7c1ae709141859c809599297e Author: Takashi Iwai Date: Tue Jan 12 12:38:02 2016 +0100 ALSA: seq: Fix missing NULL check at remove_events ioctl snd_seq_ioctl_remove_events() calls snd_seq_fifo_clear() unconditionally even if there is no FIFO assigned, and this leads to an Oops due to NULL dereference. The fix is just to add a proper NULL check. Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/seq/seq_clientmgr.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 2eb0632df1351378946507e7ef7ba0682632a7b5 Author: Takashi Iwai Date: Tue Jan 12 15:36:27 2016 +0100 ALSA: seq: Fix race at timer setup and close ALSA sequencer code has an open race between the timer setup ioctl and the close of the client. This was triggered by syzkaller fuzzer, and a use-after-free was caught there as a result. This patch papers over it by adding a proper queue->timer_mutex lock around the timer-related calls in the relevant code path. Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/seq/seq_queue.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) commit b9e55ab955e59b4a636d78a748be90334a48b485 Author: Takashi Iwai Date: Thu Jan 14 16:30:58 2016 +0100 ALSA: timer: Harden slave timer list handling A slave timer instance might be still accessible in a racy way while operating the master instance as it lacks of locking. Since the master operation is mostly protected with timer->lock, we should cope with it while changing the slave instance, too. Also, some linked lists (active_list and ack_list) of slave instances aren't unlinked immediately at stopping or closing, and this may lead to unexpected accesses. This patch tries to address these issues. It adds spin lock of timer->lock (either from master or slave, which is equivalent) in a few places. For avoiding a deadlock, we ensure that the global slave_active_lock is always locked at first before each timer lock. Also, ack and active_list of slave instances are properly unlinked at snd_timer_stop() and snd_timer_close(). Last but not least, remove the superfluous call of _snd_timer_stop() at removing slave links. This is a noop, and calling it may confuse readers wrt locking. Further cleanup will follow in a later patch. Actually we've got reports of use-after-free by syzkaller fuzzer, and this hopefully fixes these issues. Reported-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/timer.c | 18 ++++++++++++++---- 1 files changed, 14 insertions(+), 4 deletions(-) commit f1ce0547bdfda1b42ae8a66c222f2a897cbe1586 Author: Takashi Iwai Date: Wed Jan 13 17:48:01 2016 +0100 ALSA: timer: Fix race among timer ioctls ALSA timer ioctls have an open race and this may lead to a use-after-free of timer instance object. A simplistic fix is to make each ioctl exclusive. We have already tread_sem for controlling the tread, and extend this as a global mutex to be applied to each ioctl. The downside is, of course, the worse concurrency. But these ioctls aren't to be parallel accessible, in anyway, so it should be fine to serialize there. Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/timer.c | 32 +++++++++++++++++++------------- 1 files changed, 19 insertions(+), 13 deletions(-) commit 8347d8461ed48a98f9c76cc3cfcdad8217d314bc Author: Takashi Iwai Date: Wed Jan 13 21:35:06 2016 +0100 ALSA: timer: Fix double unlink of active_list ALSA timer instance object has a couple of linked lists and they are unlinked unconditionally at snd_timer_stop(). Meanwhile snd_timer_interrupt() unlinks it, but it calls list_del() which leaves the element list itself unchanged. This ends up with unlinking twice, and it was caught by syzkaller fuzzer. The fix is to use list_del_init() variant properly there, too. Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/timer.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 243aebb7ae71d6e11ea9880faa893d1d0d60cd75 Author: Hannes Frederic Sowa Date: Mon Jan 18 18:03:48 2016 +0100 ovs: limit ovs recursions in ovs_execute_actions to not corrupt stack It was seen that defective configurations of openvswitch could overwrite the STACK_END_MAGIC and cause a hard crash of the kernel because of too many recursions within ovs. This problem arises due to the high stack usage of openvswitch. The rest of the kernel is fine with the current limit of 10 (RECURSION_LIMIT). We use the already existing recursion counter in ovs_execute_actions to implement an upper bound of 5 recursions. Cc: Pravin Shelar Cc: Simon Horman Cc: Eric Dumazet Cc: Simon Horman Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller net/openvswitch/actions.c | 19 ++++++++++++++----- 1 files changed, 14 insertions(+), 5 deletions(-) commit 8080793479c6d5befe37a67b1dbd9e4e0a61af96 Author: Ursula Braun Date: Tue Jan 19 10:41:33 2016 +0100 af_iucv: Validate socket address length in iucv_sock_bind() Signed-off-by: Ursula Braun Reported-by: Dmitry Vyukov Reviewed-by: Evgeny Cherkashin Signed-off-by: David S. Miller net/iucv/af_iucv.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) commit 50a383c1c91ed7409c3cbdd41e662d6891463d1b Author: Brad Spengler Date: Tue Jan 19 19:32:54 2016 -0500 Apply the same fix as everyone else for the recent keys vulnerability that is unexploitable under PAX_REFCOUNT Make a couple more changes that no one else can/will include/linux/key-type.h | 4 ++-- ipc/msgutil.c | 4 ++-- security/keys/internal.h | 2 +- security/keys/process_keys.c | 1 + 4 files changed, 6 insertions(+), 5 deletions(-) commit b56c3a63f431c193400aee17543021950bd14bc4 Merge: 38b1a3d 470069c Author: Brad Spengler Date: Sun Jan 17 18:30:19 2016 -0500 Merge branch 'pax-test' into grsec-test commit 470069cfedef2180313233d275be5901bd6d1135 Author: Brad Spengler Date: Sun Jan 17 18:29:59 2016 -0500 Update to pax-linux-4.3.3-test22.patch: - Emesed fixed a gcc induced intentional integer overflow in asix_rx_fixup_internal, reported by thomas callison caffrey - fixed some more fallout from the drm_drivers constification, reported by Colin Childs and Toralf Foerster drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 14 ++++---------- drivers/gpu/drm/drm_pci.c | 3 +++ drivers/gpu/drm/gma500/psb_drv.c | 4 ---- drivers/gpu/drm/i915/i915_drv.c | 16 ++++++++-------- drivers/gpu/drm/nouveau/nouveau_drm.c | 6 +++--- drivers/gpu/drm/radeon/radeon_drv.c | 4 +--- drivers/net/usb/asix_common.c | 3 ++- include/drm/drmP.h | 1 + 8 files changed, 22 insertions(+), 29 deletions(-) commit 38b1a3d676f407865c3d41840df8213c5ad639c1 Author: Brad Spengler Date: Sun Jan 17 12:33:53 2016 -0500 As reported by Luis Ressel, the Kconfig help for GRKERNSEC_BRUTE mentioned banning execution of suid/sgid binaries, though the kernel source clearly only mentions banning execution of suid binaries. Since there's no reason for us to not ban execution of sgid binaries as well, make the implementation match the Kconfig description. fs/exec.c | 4 ++-- grsecurity/grsec_sig.c | 27 ++++++++++++++------------- include/linux/sched.h | 4 ++-- 3 files changed, 18 insertions(+), 17 deletions(-) commit 8c3bcb7dbf7f606acfa0983e81f0f928da1f1ace Merge: d141a86 ea4a835 Author: Brad Spengler Date: Sat Jan 16 14:12:22 2016 -0500 Merge branch 'pax-test' into grsec-test Conflicts: drivers/gpu/drm/i810/i810_drv.c commit ea4a835328ada6513ac013986764d6caea8cd348 Author: Brad Spengler Date: Sat Jan 16 14:11:30 2016 -0500 Update to pax-linux-4.3.3-test21.patch: - fixed some fallout from the drm_drivers constification, reported by spender drivers/gpu/drm/armada/armada_drv.c | 3 +-- drivers/gpu/drm/exynos/exynos_drm_drv.c | 1 - drivers/gpu/drm/i810/i810_dma.c | 2 +- drivers/gpu/drm/i810/i810_drv.c | 6 +++++- drivers/gpu/drm/i810/i810_drv.h | 2 +- 5 files changed, 8 insertions(+), 6 deletions(-) commit d141a86fd66194bc3f896b6809b189e2f12a9a83 Author: Brad Spengler Date: Sat Jan 16 13:16:36 2016 -0500 compile fix drivers/gpu/drm/i810/i810_dma.c | 2 +- drivers/gpu/drm/i810/i810_drv.c | 4 +++- drivers/gpu/drm/i810/i810_drv.h | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) commit 0d9dc4b25ea32c14561bcfe6b5b24f1b00fe0270 Merge: 5fa135d bbda879 Author: Brad Spengler Date: Sat Jan 16 12:59:22 2016 -0500 Merge branch 'pax-test' into grsec-test commit bbda87914edf63e27fb46670bf3a373f2b963c73 Author: Brad Spengler Date: Sat Jan 16 12:58:04 2016 -0500 Update to pax-linux-4.3.3-test20.patch: - constified drm_driver - Emese fixed a special case in handling __func__ in the initify plugin - Emese fixed a false positive size overflow report in handling inbufBits, reported by Martin Filo (https://bugs.gentoo.org/show_bug.cgi?id=567048) - fixed regression that caused perf to not resolve kernel code addresses under KERNEXEC/i386, reported by minipli arch/x86/kernel/cpu/perf_event.h | 2 +- arch/x86/kernel/cpu/perf_event_intel_ds.c | 7 +- arch/x86/kernel/cpu/perf_event_intel_lbr.c | 4 +- arch/x86/kernel/uprobes.c | 2 +- arch/x86/mm/mpx.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 8 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 +- drivers/gpu/drm/drm_pci.c | 6 +- drivers/gpu/drm/gma500/psb_drv.c | 5 +- drivers/gpu/drm/i915/i915_dma.c | 2 +- drivers/gpu/drm/i915/i915_drv.c | 15 ++-- drivers/gpu/drm/i915/i915_drv.h | 2 +- drivers/gpu/drm/i915/i915_irq.c | 88 ++++++++++---------- drivers/gpu/drm/mga/mga_drv.c | 5 +- drivers/gpu/drm/mga/mga_drv.h | 2 +- drivers/gpu/drm/mga/mga_state.c | 2 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 13 ++-- drivers/gpu/drm/qxl/qxl_drv.c | 8 ++- drivers/gpu/drm/qxl/qxl_ioctl.c | 2 +- drivers/gpu/drm/r128/r128_drv.c | 4 +- drivers/gpu/drm/r128/r128_drv.h | 2 +- drivers/gpu/drm/r128/r128_state.c | 2 +- drivers/gpu/drm/radeon/radeon_drv.c | 17 +++- drivers/gpu/drm/radeon/radeon_drv.h | 2 +- drivers/gpu/drm/radeon/radeon_kms.c | 2 +- drivers/gpu/drm/radeon/radeon_state.c | 2 +- drivers/gpu/drm/savage/savage_bci.c | 2 +- drivers/gpu/drm/savage/savage_drv.c | 5 +- drivers/gpu/drm/savage/savage_drv.h | 2 +- drivers/gpu/drm/sis/sis_drv.c | 5 +- drivers/gpu/drm/sis/sis_drv.h | 2 +- drivers/gpu/drm/sis/sis_mm.c | 2 +- drivers/gpu/drm/via/via_dma.c | 2 +- drivers/gpu/drm/via/via_drv.c | 5 +- drivers/gpu/drm/via/via_drv.h | 2 +- include/drm/drmP.h | 2 +- mm/slab.c | 2 +- net/sunrpc/xprtrdma/svc_rdma.c | 6 +- tools/gcc/initify_plugin.c | 15 +++- .../disable_size_overflow_hash.data | 1 + .../size_overflow_plugin/size_overflow_hash.data | 3 +- 42 files changed, 156 insertions(+), 110 deletions(-) commit 5fa135dc116350e0205c39ef65eaf6496ed2748a Author: Brad Spengler Date: Sat Jan 16 12:19:23 2016 -0500 compile fix grsecurity/grsec_sig.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) commit a9090fa58f33f75c7450fda5721a9b13625a47d9 Author: Brad Spengler Date: Sat Jan 16 12:10:37 2016 -0500 As pointed out by Jann Horn, some distros are starting to circumvent previous assumptions about the attainability of a user to control multiple UIDs by handing out suid binaries that allow a user to run processes (including exploits) under a number of other pre-defined UIDs. As this could potentially be used to bypass GRKERNSEC_BRUTE (though it would have to involve some code path that doesn't involve locks) fix that here by ensuring no more than 8 users on a system can be banned before a reboot is required. If more are banned, a panic is triggered. grsecurity/grsec_sig.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) commit a8d37776e9521c567ebff6730d49312f72435f08 Author: Eric Dumazet Date: Thu Dec 3 11:12:07 2015 -0800 proc: add a reschedule point in proc_readfd_common() User can pass an arbitrary large buffer to getdents(). It is typically a 32KB buffer used by libc scandir() implementation. When scanning /proc/{pid}/fd, we can hold cpu way too long, so add a cond_resched() to be kind with other tasks. We've seen latencies of more than 50ms on real workloads. Signed-off-by: Eric Dumazet Cc: Alexander Viro Signed-off-by: Al Viro fs/proc/fd.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit 0adba75f8708f13b1f5d98ebe3fc2fb961e100c8 Author: Rabin Vincent Date: Tue Jan 12 20:17:08 2016 +0100 net: bpf: reject invalid shifts On ARM64, a BUG() is triggered in the eBPF JIT if a filter with a constant shift that can't be encoded in the immediate field of the UBFM/SBFM instructions is passed to the JIT. Since these shifts amounts, which are negative or >= regsize, are invalid, reject them in the eBPF verifier and the classic BPF filter checker, for all architectures. Signed-off-by: Rabin Vincent Acked-by: Alexei Starovoitov Acked-by: Daniel Borkmann Signed-off-by: David S. Miller kernel/bpf/verifier.c | 10 ++++++++++ net/core/filter.c | 5 +++++ 2 files changed, 15 insertions(+), 0 deletions(-) commit c248e115a73496625a1c64660d0eeefd67e55cbf Author: Marcelo Ricardo Leitner Date: Fri Jan 8 11:00:54 2016 -0200 sctp: fix use-after-free in pr_debug statement Dmitry Vyukov reported a use-after-free in the code expanded by the macro debug_post_sfx, which is caused by the use of the asoc pointer after it was freed within sctp_side_effect() scope. This patch fixes it by allowing sctp_side_effect to clear that asoc pointer when the TCB is freed. As Vlad explained, we also have to cover the SCTP_DISPOSITION_ABORT case because it will trigger DELETE_TCB too on that same loop. Also, there were places issuing SCTP_CMD_INIT_FAILED and ASSOC_FAILED but returning SCTP_DISPOSITION_CONSUME, which would fool the scheme above. Fix it by returning SCTP_DISPOSITION_ABORT instead. The macro is already prepared to handle such NULL pointer. Reported-by: Dmitry Vyukov Signed-off-by: Marcelo Ricardo Leitner Acked-by: Vlad Yasevich Signed-off-by: David S. Miller net/sctp/sm_sideeffect.c | 11 ++++++----- net/sctp/sm_statefuns.c | 17 ++++------------- 2 files changed, 10 insertions(+), 18 deletions(-) commit 395ea8a9e73e184fc14153a033000bccf4213213 Author: willy tarreau Date: Sun Jan 10 07:54:56 2016 +0100 unix: properly account for FDs passed over unix sockets It is possible for a process to allocate and accumulate far more FDs than the process' limit by sending them over a unix socket then closing them to keep the process' fd count low. This change addresses this problem by keeping track of the number of FDs in flight per user and preventing non-privileged processes from having more FDs in flight than their configured FD limit. Reported-by: socketpair@gmail.com Reported-by: Tetsuo Handa Mitigates: CVE-2013-4312 (Linux 2.0+) Suggested-by: Linus Torvalds Acked-by: Hannes Frederic Sowa Signed-off-by: Willy Tarreau Signed-off-by: David S. Miller include/linux/sched.h | 1 + net/unix/af_unix.c | 24 ++++++++++++++++++++---- net/unix/garbage.c | 13 ++++++++----- 3 files changed, 29 insertions(+), 9 deletions(-) commit cb207ab8fbd71dcfc4a49d533aba8085012543fd Author: Sasha Levin Date: Thu Jan 7 14:52:43 2016 -0500 net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory proc_dostring() needs an initialized destination string, while the one provided in proc_sctp_do_hmac_alg() contains stack garbage. Thus, writing to cookie_hmac_alg would strlen() that garbage and end up accessing invalid memory. Fixes: 3c68198e7 ("sctp: Make hmac algorithm selection for cookie generation dynamic") Signed-off-by: Sasha Levin Signed-off-by: David S. Miller net/sctp/sysctl.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 4014e09faf0fe9054119624ccfff1236e886b554 Author: Quentin Casasnovas Date: Tue Nov 24 17:13:21 2015 -0500 RDS: fix race condition when sending a message on unbound socket commit 8c7188b23474cca017b3ef354c4a58456f68303a upstream. Sasha's found a NULL pointer dereference in the RDS connection code when sending a message to an apparently unbound socket. The problem is caused by the code checking if the socket is bound in rds_sendmsg(), which checks the rs_bound_addr field without taking a lock on the socket. This opens a race where rs_bound_addr is temporarily set but where the transport is not in rds_bind(), leading to a NULL pointer dereference when trying to dereference 'trans' in __rds_conn_create(). Vegard wrote a reproducer for this issue, so kindly ask him to share if you're interested. I cannot reproduce the NULL pointer dereference using Vegard's reproducer with this patch, whereas I could without. Complete earlier incomplete fix to CVE-2015-6937: 74e98eb08588 ("RDS: verify the underlying transport exists before creating a connection") Cc: David S. Miller Reviewed-by: Vegard Nossum Reviewed-by: Sasha Levin Acked-by: Santosh Shilimkar Signed-off-by: Quentin Casasnovas Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby Conflicts: net/rds/send.c net/rds/connection.c | 6 ------ 1 files changed, 0 insertions(+), 6 deletions(-) commit 206df8d01104344d7588d801016a281a4cd25556 Author: Sasha Levin Date: Tue Sep 8 10:53:40 2015 -0400 RDS: verify the underlying transport exists before creating a connection There was no verification that an underlying transport exists when creating a connection, this would cause dereferencing a NULL ptr. It might happen on sockets that weren't properly bound before attempting to send a message, which will cause a NULL ptr deref: [135546.047719] kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN [135546.051270] Modules linked in: [135546.051781] CPU: 4 PID: 15650 Comm: trinity-c4 Not tainted 4.2.0-next-20150902-sasha-00041-gbaa1222-dirty #2527 [135546.053217] task: ffff8800835bc000 ti: ffff8800bc708000 task.ti: ffff8800bc708000 [135546.054291] RIP: __rds_conn_create (net/rds/connection.c:194) [135546.055666] RSP: 0018:ffff8800bc70fab0 EFLAGS: 00010202 [135546.056457] RAX: dffffc0000000000 RBX: 0000000000000f2c RCX: ffff8800835bc000 [135546.057494] RDX: 0000000000000007 RSI: ffff8800835bccd8 RDI: 0000000000000038 [135546.058530] RBP: ffff8800bc70fb18 R08: 0000000000000001 R09: 0000000000000000 [135546.059556] R10: ffffed014d7a3a23 R11: ffffed014d7a3a21 R12: 0000000000000000 [135546.060614] R13: 0000000000000001 R14: ffff8801ec3d0000 R15: 0000000000000000 [135546.061668] FS: 00007faad4ffb700(0000) GS:ffff880252000000(0000) knlGS:0000000000000000 [135546.062836] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [135546.063682] CR2: 000000000000846a CR3: 000000009d137000 CR4: 00000000000006a0 [135546.064723] Stack: [135546.065048] ffffffffafe2055c ffffffffafe23fc1 ffffed00493097bf ffff8801ec3d0008 [135546.066247] 0000000000000000 00000000000000d0 0000000000000000 ac194a24c0586342 [135546.067438] 1ffff100178e1f78 ffff880320581b00 ffff8800bc70fdd0 ffff880320581b00 [135546.068629] Call Trace: [135546.069028] ? __rds_conn_create (include/linux/rcupdate.h:856 net/rds/connection.c:134) [135546.069989] ? rds_message_copy_from_user (net/rds/message.c:298) [135546.071021] rds_conn_create_outgoing (net/rds/connection.c:278) [135546.071981] rds_sendmsg (net/rds/send.c:1058) [135546.072858] ? perf_trace_lock (include/trace/events/lock.h:38) [135546.073744] ? lockdep_init (kernel/locking/lockdep.c:3298) [135546.074577] ? rds_send_drop_to (net/rds/send.c:976) [135546.075508] ? __might_fault (./arch/x86/include/asm/current.h:14 mm/memory.c:3795) [135546.076349] ? __might_fault (mm/memory.c:3795) [135546.077179] ? rds_send_drop_to (net/rds/send.c:976) [135546.078114] sock_sendmsg (net/socket.c:611 net/socket.c:620) [135546.078856] SYSC_sendto (net/socket.c:1657) [135546.079596] ? SYSC_connect (net/socket.c:1628) [135546.080510] ? trace_dump_stack (kernel/trace/trace.c:1926) [135546.081397] ? ring_buffer_unlock_commit (kernel/trace/ring_buffer.c:2479 kernel/trace/ring_buffer.c:2558 kernel/trace/ring_buffer.c:2674) [135546.082390] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749) [135546.083410] ? trace_event_raw_event_sys_enter (include/trace/events/syscalls.h:16) [135546.084481] ? do_audit_syscall_entry (include/trace/events/syscalls.h:16) [135546.085438] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749) [135546.085515] rds_ib_laddr_check(): addr 36.74.25.172 ret -99 node type -1 Acked-by: Santosh Shilimkar Signed-off-by: Sasha Levin Signed-off-by: David S. Miller net/rds/connection.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) commit 173fa03f05cf0ad485d49a42cbdee8844d3a689a Author: Steven Rostedt (Red Hat) Date: Tue Jan 5 20:32:47 2016 -0500 ftrace/module: Call clean up function when module init fails early If the module init code fails after calling ftrace_module_init() and before calling do_init_module(), we can suffer from a memory leak. This is because ftrace_module_init() allocates pages to store the locations that ftrace hooks are placed in the module text. If do_init_module() fails, it still calls the MODULE_GOING notifiers which will tell ftrace to do a clean up of the pages it allocated for the module. But if load_module() fails before then, the pages allocated by ftrace_module_init() will never be freed. Call ftrace_release_mod() on the module if load_module() fails before getting to do_init_module(). Link: http://lkml.kernel.org/r/567CEA31.1070507@intel.com Reported-by: "Qiu, PeiyangX" Fixes: a949ae560a511 "ftrace/module: Hardcode ftrace_module_init() call into load_module()" Cc: stable@vger.kernel.org # v2.6.38+ Acked-by: Rusty Russell Signed-off-by: Steven Rostedt include/linux/ftrace.h | 1 + kernel/module.c | 6 ++++++ 2 files changed, 7 insertions(+), 0 deletions(-) commit 1e5a4a81a4c16c8ac2e264b88a02cc2f42ed0399 Author: Francesco Ruggeri Date: Wed Jan 6 00:18:48 2016 -0800 net: possible use after free in dst_release dst_release should not access dst->flags after decrementing __refcnt to 0. The dst_entry may be in dst_busy_list and dst_gc_task may dst_destroy it before dst_release gets a chance to access dst->flags. Fixes: d69bbf88c8d0 ("net: fix a race in dst_release()") Fixes: 27b75c95f10d ("net: avoid RCU for NOCACHE dst") Signed-off-by: Francesco Ruggeri Acked-by: Eric Dumazet Signed-off-by: David S. Miller net/core/dst.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) commit bfb0455793dd4e0f0b49d34a68b3249ab55565cc Author: Alan Date: Wed Jan 6 14:55:02 2016 +0000 mkiss: fix scribble on freed memory commit d79f16c046086f4fe0d42184a458e187464eb83e fixed a user triggerable scribble on free memory but added a new one which allows the user to scribble even more and user controlled data into freed space. As with 6pack we need to halt the queue before we free the buffers, because the transmit logic is not protected by the semaphore. Signed-off-by: Alan Cox Signed-off-by: David S. Miller drivers/net/hamradio/mkiss.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) commit 5cbbcbd32dc1949470f61d342503808fa9555276 Author: David Miller Date: Thu Dec 17 16:05:49 2015 -0500 mkiss: Fix use after free in mkiss_close(). Need to do the unregister_device() after all references to the driver private have been done. Signed-off-by: David S. Miller drivers/net/hamradio/mkiss.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit b00171576794a98068e069a660f0991a6a5190ff Author: One Thousand Gnomes Date: Tue Jan 5 11:51:25 2016 +0000 6pack: fix free memory scribbles commit acf673a3187edf72068ee2f92f4dc47d66baed47 fixed a user triggerable free memory scribble but in doing so replaced it with a different one that allows the user to control the data and scribble even more. sixpack_close is called by the tty layer in tty context. The tty context is protected by sp_get() and sp_put(). However network layer activity via sp_xmit() is not protected this way. We must therefore stop the queue otherwise the user gets to dump a buffer mostly of their choice into freed kernel pages. Signed-off-by: Alan Cox Signed-off-by: David S. Miller drivers/net/hamradio/6pack.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) commit 5b64a833907cd230a3106aeba2304b2c1bcd116d Author: David Miller Date: Thu Dec 17 16:05:32 2015 -0500 6pack: Fix use after free in sixpack_close(). Need to do the unregister_device() after all references to the driver private have been done. Also we need to use del_timer_sync() for the timers so that we don't have any asynchronous references after the unregister. Signed-off-by: David S. Miller drivers/net/hamradio/6pack.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) commit 4f9d532742656b3613d579220fd10c78f24ba37b Author: Rabin Vincent Date: Tue Jan 5 16:23:07 2016 +0100 net: filter: make JITs zero A for SKF_AD_ALU_XOR_X The SKF_AD_ALU_XOR_X ancillary is not like the other ancillary data instructions since it XORs A with X while all the others replace A with some loaded value. All the BPF JITs fail to clear A if this is used as the first instruction in a filter. This was found using american fuzzy lop. Add a helper to determine if A needs to be cleared given the first instruction in a filter, and use this in the JITs. Except for ARM, the rest have only been compile-tested. Fixes: 3480593131e0 ("net: filter: get rid of BPF_S_* enum") Signed-off-by: Rabin Vincent Acked-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller arch/arm/net/bpf_jit_32.c | 16 +--------------- arch/mips/net/bpf_jit.c | 16 +--------------- arch/powerpc/net/bpf_jit_comp.c | 13 ++----------- arch/sparc/net/bpf_jit_comp.c | 17 ++--------------- include/linux/filter.h | 19 +++++++++++++++++++ 5 files changed, 25 insertions(+), 56 deletions(-) commit 570d88f8acfffda92b89ae2e1c47320d47256034 Author: John Fastabend Date: Tue Jan 5 09:11:36 2016 -0800 net: sched: fix missing free per cpu on qstats When a qdisc is using per cpu stats (currently just the ingress qdisc) only the bstats are being freed. This also free's the qstats. Fixes: b0ab6f92752b9f9d8 ("net: sched: enable per cpu qstats") Signed-off-by: John Fastabend Acked-by: Eric Dumazet Acked-by: Daniel Borkmann Signed-off-by: David S. Miller net/sched/sch_generic.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) commit 32c0ebc51857ee83470a10dcb234d308a0ed1881 Author: Rabin Vincent Date: Tue Jan 5 18:34:04 2016 +0100 ARM: net: bpf: fix zero right shift The LSR instruction cannot be used to perform a zero right shift since a 0 as the immediate value (imm5) in the LSR instruction encoding means that a shift of 32 is perfomed. See DecodeIMMShift() in the ARM ARM. Make the JIT skip generation of the LSR if a zero-shift is requested. This was found using american fuzzy lop. Signed-off-by: Rabin Vincent Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller arch/arm/net/bpf_jit_32.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) commit 51f5d291750285efa4d4bbe84e5ec23dc00c8d2d Author: Brad Spengler Date: Wed Jan 6 20:35:57 2016 -0500 Don't perform hidden lookups in RBAC against the directory of a file being opened with O_CREAT, reported by Karl Witt Conflicts: fs/namei.c fs/namei.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) commit 5a8266a6b2769ccdb447256f95bc2577a73cccd1 Author: Hannes Frederic Sowa Date: Tue Jan 5 10:46:00 2016 +0100 bridge: Only call /sbin/bridge-stp for the initial network namespace [I stole this patch from Eric Biederman. He wrote:] > There is no defined mechanism to pass network namespace information > into /sbin/bridge-stp therefore don't even try to invoke it except > for bridge devices in the initial network namespace. > > It is possible for unprivileged users to cause /sbin/bridge-stp to be > invoked for any network device name which if /sbin/bridge-stp does not > guard against unreasonable arguments or being invoked twice on the > same network device could cause problems. [Hannes: changed patch using netns_eq] Cc: Eric W. Biederman Signed-off-by: Eric W. Biederman Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller net/bridge/br_stp_if.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) commit 650d535cc39f0aeff2f57e60b6617be25d3ef48b Author: Marcelo Ricardo Leitner Date: Wed Dec 23 16:28:40 2015 -0200 sctp: use GFP_USER for user-controlled kmalloc Commit cacc06215271 ("sctp: use GFP_USER for user-controlled kmalloc") missed two other spots. For connectx, as it's more likely to be used by kernel users of the API, it detects if GFP_USER should be used or not. Fixes: cacc06215271 ("sctp: use GFP_USER for user-controlled kmalloc") Reported-by: Dmitry Vyukov Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller net/sctp/socket.c | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-) commit 5718a1f63c41fc156f729783423b002763779d04 Author: Florian Westphal Date: Thu Dec 31 14:26:33 2015 +0100 connector: bump skb->users before callback invocation Dmitry reports memleak with syskaller program. Problem is that connector bumps skb usecount but might not invoke callback. So move skb_get to where we invoke the callback. Reported-by: Dmitry Vyukov Signed-off-by: Florian Westphal Signed-off-by: David S. Miller drivers/connector/connector.c | 11 +++-------- 1 files changed, 3 insertions(+), 8 deletions(-) commit 2e6372e6a97f8d642416899861f91777f44f13b7 Author: Rainer Weikusat Date: Sun Jan 3 18:56:38 2016 +0000 af_unix: Fix splice-bind deadlock On 2015/11/06, Dmitry Vyukov reported a deadlock involving the splice system call and AF_UNIX sockets, http://lists.openwall.net/netdev/2015/11/06/24 The situation was analyzed as (a while ago) A: socketpair() B: splice() from a pipe to /mnt/regular_file does sb_start_write() on /mnt C: try to freeze /mnt wait for B to finish with /mnt A: bind() try to bind our socket to /mnt/new_socket_name lock our socket, see it not bound yet decide that it needs to create something in /mnt try to do sb_start_write() on /mnt, block (it's waiting for C). D: splice() from the same pipe to our socket lock the pipe, see that socket is connected try to lock the socket, block waiting for A B: get around to actually feeding a chunk from pipe to file, try to lock the pipe. Deadlock. on 2015/11/10 by Al Viro, http://lists.openwall.net/netdev/2015/11/10/4 The patch fixes this by removing the kern_path_create related code from unix_mknod and executing it as part of unix_bind prior acquiring the readlock of the socket in question. This means that A (as used above) will sb_start_write on /mnt before it acquires the readlock, hence, it won't indirectly block B which first did a sb_start_write and then waited for a thread trying to acquire the readlock. Consequently, A being blocked by C waiting for B won't cause a deadlock anymore (effectively, both A and B acquire two locks in opposite order in the situation described above). Dmitry Vyukov() tested the original patch. Signed-off-by: Rainer Weikusat Signed-off-by: David S. Miller Conflicts: net/unix/af_unix.c net/unix/af_unix.c | 70 +++++++++++++++++++++++++++++++-------------------- 1 files changed, 42 insertions(+), 28 deletions(-) commit 2e729e557c571f3253e32472cd7d382ac16cf1c3 Author: Qiu Peiyang Date: Thu Dec 31 13:11:28 2015 +0800 tracing: Fix setting of start_index in find_next() When we do cat /sys/kernel/debug/tracing/printk_formats, we hit kernel panic at t_show. general protection fault: 0000 [#1] PREEMPT SMP CPU: 0 PID: 2957 Comm: sh Tainted: G W O 3.14.55-x86_64-01062-gd4acdc7 #2 RIP: 0010:[] [] t_show+0x22/0xe0 RSP: 0000:ffff88002b4ebe80 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 RDX: 0000000000000004 RSI: ffffffff81fd26a6 RDI: ffff880032f9f7b1 RBP: ffff88002b4ebe98 R08: 0000000000001000 R09: 000000000000ffec R10: 0000000000000000 R11: 000000000000000f R12: ffff880004d9b6c0 R13: 7365725f6d706400 R14: ffff880004d9b6c0 R15: ffffffff82020570 FS: 0000000000000000(0000) GS:ffff88003aa00000(0063) knlGS:00000000f776bc40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000f6c02ff0 CR3: 000000002c2b3000 CR4: 00000000001007f0 Call Trace: [] seq_read+0x2f6/0x3e0 [] vfs_read+0x9b/0x160 [] SyS_read+0x49/0xb0 [] ia32_do_call+0x13/0x13 ---[ end trace 5bd9eb630614861e ]--- Kernel panic - not syncing: Fatal exception When the first time find_next calls find_next_mod_format, it should iterate the trace_bprintk_fmt_list to find the first print format of the module. However in current code, start_index is smaller than *pos at first, and code will not iterate the list. Latter container_of will get the wrong address with former v, which will cause mod_fmt be a meaningless object and so is the returned mod_fmt->fmt. This patch will fix it by correcting the start_index. After fixed, when the first time calls find_next_mod_format, start_index will be equal to *pos, and code will iterate the trace_bprintk_fmt_list to get the right module printk format, so is the returned mod_fmt->fmt. Link: http://lkml.kernel.org/r/5684B900.9000309@intel.com Cc: stable@vger.kernel.org # 3.12+ Fixes: 102c9323c35a8 "tracing: Add __tracepoint_string() to export string pointers" Signed-off-by: Qiu Peiyang Signed-off-by: Steven Rostedt kernel/trace/trace_printk.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit 0994af4b1930f32aa493dc08145cd304f8bfc8f4 Author: Al Viro Date: Mon Dec 28 20:47:08 2015 -0500 [PATCH] arm: fix handling of F_OFD_... in oabi_fcntl64() Cc: stable@vger.kernel.org # 3.15+ Reviewed-by: Jeff Layton Signed-off-by: Al Viro arch/arm/kernel/sys_oabi-compat.c | 73 +++++++++++++++++++------------------ 1 files changed, 37 insertions(+), 36 deletions(-) commit 4ed030f65dcf3e6b0128032a49a7d75f947fa351 Merge: de243c2 3adc55a Author: Brad Spengler Date: Tue Jan 5 18:10:10 2016 -0500 Merge branch 'pax-test' into grsec-test commit 3adc55a5acfa429c2a7cc883aef08b960c0079b0 Author: Brad Spengler Date: Tue Jan 5 18:08:53 2016 -0500 Update to pax-linux-4.3.3-test16.patch: - small cleanup in entry_64.S on x86 - Emese fixed the initify plugin to recursively check variable initializers, reported by Rasmus Villemoes - fixed an integer truncation of a partially uninitialized value bug in em_pop_sreg, reported by fx3 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4354) - fixed alternatives patching of call insns under KERNEXEC/i386, reported by fly_a320 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4305) and TTgrsec (https://forums.grsecurity.net/viewtopic.php?f=3&t=4353) - fixed a size overflow false positive that triggered in tcp_parse_options on arm, reported by iamb (https://forums.grsecurity.net/viewtopic.php?f=3&t=4350&p=15917#p15916) - fixed a boot crash on amd64 with KERNEXEC/OR and CONTEXT_TRACKING, reported by Klaus Kusche (https://bugs.gentoo.org/show_bug.cgi?id=570420) arch/x86/entry/entry_64.S | 60 +++++----- arch/x86/kernel/alternative.c | 2 +- arch/x86/kvm/emulate.c | 4 +- tools/gcc/initify_plugin.c | 123 +++++++++---------- .../disable_size_overflow_hash.data | 4 +- .../size_overflow_plugin/size_overflow_hash.data | 2 - 6 files changed, 93 insertions(+), 102 deletions(-) commit de243c26efd0e423ca92db825af2c3f8eb1ca043 Author: Brad Spengler Date: Tue Dec 29 18:01:24 2015 -0500 It was noticed during an internal audit that the code under GRKERNSEC_PROC_MEMMAP which aimed to enforce a 16MB minimum on RLIMIT_DATA for suid/sgid binaries only did so if RLIMIT_DATA was set lower than PAGE_SIZE. This addition was only supplemental as GRKERNSEC_BRUTE is the main defense against suid/sgid attacks and the flaw above would only eliminate the extra entropy provided for the brk-managed heap, still leaving it with the minimum of 16-bit entropy for mmap on x86 and 28 on x64. mm/mmap.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 8e264cfe47e5f08cdc9ed009a630277206cd2534 Merge: 436201b 2584340 Author: Brad Spengler Date: Mon Dec 28 20:30:01 2015 -0500 Merge branch 'pax-test' into grsec-test commit 2584340eab494e64ec1bf9eb5b0d1ae31f926306 Author: Brad Spengler Date: Mon Dec 28 20:29:28 2015 -0500 Update to pax-linux-4.3.3-test14.patch: - fixed an integer sign conversion error in i2c_dw_pci_probe caught by the size overflow plugin, reported by Jean Lucas and ganymede (https://forums.grsecurity.net/viewtopic.php?f=3&t=4349) - fixed shutdown crash with tboot and KERNEXEC, reported by perfinion - fixed a few false positive and one real size overflow reports in hyperv, reported by hunger - fixed compile regressions on armv5, reported by iamb (https://forums.grsecurity.net/viewtopic.php?f=3&t=4350) - fixed an assert in the initify plugin that triggered in vic_register on arm arch/arm/include/asm/atomic.h | 7 +++++-- arch/arm/include/asm/domain.h | 5 ++--- arch/x86/kernel/tboot.c | 14 +++++++++----- drivers/hv/channel.c | 4 +--- drivers/i2c/busses/i2c-designware-pcidrv.c | 2 +- drivers/net/hyperv/rndis_filter.c | 3 +-- fs/exec.c | 4 ++-- include/linux/atomic.h | 15 --------------- net/core/skbuff.c | 3 ++- tools/gcc/initify_plugin.c | 4 +++- 10 files changed, 26 insertions(+), 35 deletions(-) commit 436201b6626b488d173c8076447000077c27b84a Author: David Howells Date: Fri Dec 18 01:34:26 2015 +0000 KEYS: Fix race between read and revoke This fixes CVE-2015-7550. There's a race between keyctl_read() and keyctl_revoke(). If the revoke happens between keyctl_read() checking the validity of a key and the key's semaphore being taken, then the key type read method will see a revoked key. This causes a problem for the user-defined key type because it assumes in its read method that there will always be a payload in a non-revoked key and doesn't check for a NULL pointer. Fix this by making keyctl_read() check the validity of a key after taking semaphore instead of before. I think the bug was introduced with the original keyrings code. This was discovered by a multithreaded test program generated by syzkaller (http://github.com/google/syzkaller). Here's a cleaned up version: #include #include #include void *thr0(void *arg) { key_serial_t key = (unsigned long)arg; keyctl_revoke(key); return 0; } void *thr1(void *arg) { key_serial_t key = (unsigned long)arg; char buffer[16]; keyctl_read(key, buffer, 16); return 0; } int main() { key_serial_t key = add_key("user", "%", "foo", 3, KEY_SPEC_USER_KEYRING); pthread_t th[5]; pthread_create(&th[0], 0, thr0, (void *)(unsigned long)key); pthread_create(&th[1], 0, thr1, (void *)(unsigned long)key); pthread_create(&th[2], 0, thr0, (void *)(unsigned long)key); pthread_create(&th[3], 0, thr1, (void *)(unsigned long)key); pthread_join(th[0], 0); pthread_join(th[1], 0); pthread_join(th[2], 0); pthread_join(th[3], 0); return 0; } Build as: cc -o keyctl-race keyctl-race.c -lkeyutils -lpthread Run as: while keyctl-race; do :; done as it may need several iterations to crash the kernel. The crash can be summarised as: BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 IP: [] user_read+0x56/0xa3 ... Call Trace: [] keyctl_read_key+0xb6/0xd7 [] SyS_keyctl+0x83/0xe0 [] entry_SYSCALL_64_fastpath+0x12/0x6f Reported-by: Dmitry Vyukov Signed-off-by: David Howells Tested-by: Dmitry Vyukov Cc: stable@vger.kernel.org Signed-off-by: James Morris security/keys/keyctl.c | 18 +++++++++--------- 1 files changed, 9 insertions(+), 9 deletions(-) commit 195cea04477025da4a2078bd3e1fb7c4e11206c2 Author: Brad Spengler Date: Tue Dec 22 20:44:01 2015 -0500 Add new kernel command-line param: pax_size_overflow_report_only If a user triggers a size_overflow violation that makes it difficult to obtain the call trace without serial console/net console, they can use this option to provide that information to us Documentation/kernel-parameters.txt | 5 +++++ fs/exec.c | 12 +++++++++--- init/main.c | 11 +++++++++++ 3 files changed, 25 insertions(+), 3 deletions(-) commit 4254a8da5851df8c08cdca5c392916e8c105408d Author: WANG Cong Date: Mon Dec 21 10:55:45 2015 -0800 addrconf: always initialize sysctl table data When sysctl performs restrict writes, it allows to write from a middle position of a sysctl file, which requires us to initialize the table data before calling proc_dostring() for the write case. Fixes: 3d1bec99320d ("ipv6: introduce secret_stable to ipv6_devconf") Reported-by: Sasha Levin Acked-by: Hannes Frederic Sowa Tested-by: Sasha Levin Signed-off-by: Cong Wang Signed-off-by: David S. Miller net/ipv6/addrconf.c | 11 ++++------- 1 files changed, 4 insertions(+), 7 deletions(-) commit f8002863fb06c363180637046947a78a6ccb3d33 Author: WANG Cong Date: Wed Dec 16 23:39:04 2015 -0800 net: check both type and procotol for tcp sockets Dmitry reported the following out-of-bound access: Call Trace: [] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:294 [] sock_setsockopt+0x1284/0x13d0 net/core/sock.c:880 [< inline >] SYSC_setsockopt net/socket.c:1746 [] SyS_setsockopt+0x1fe/0x240 net/socket.c:1729 [] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 This is because we mistake a raw socket as a tcp socket. We should check both sk->sk_type and sk->sk_protocol to ensure it is a tcp socket. Willem points out __skb_complete_tx_timestamp() needs to fix as well. Reported-by: Dmitry Vyukov Cc: Willem de Bruijn Cc: Eric Dumazet Signed-off-by: Cong Wang Acked-by: Willem de Bruijn Signed-off-by: David S. Miller net/core/skbuff.c | 3 ++- net/core/sock.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) commit bd6b3399804470a4ad8f34229469ca149dceba3d Author: Colin Ian King Date: Fri Dec 18 14:22:01 2015 -0800 proc: fix -ESRCH error when writing to /proc/$pid/coredump_filter Writing to /proc/$pid/coredump_filter always returns -ESRCH because commit 774636e19ed51 ("proc: convert to kstrto*()/kstrto*_from_user()") removed the setting of ret after the get_proc_task call and incorrectly left it as -ESRCH. Instead, return 0 when successful. Example breakage: echo 0 > /proc/self/coredump_filter bash: echo: write error: No such process Fixes: 774636e19ed51 ("proc: convert to kstrto*()/kstrto*_from_user()") Signed-off-by: Colin Ian King Acked-by: Kees Cook Cc: [4.3+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/base.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit b28aca2b99ed08546778355fb9402c503ff9b29e Author: Junichi Nomura Date: Tue Dec 22 10:23:44 2015 -0700 block: ensure to split after potentially bouncing a bio blk_queue_bio() does split then bounce, which makes the segment counting based on pages before bouncing and could go wrong. Move the split to after bouncing, like we do for blk-mq, and the we fix the issue of having the bio count for segments be wrong. Fixes: 54efd50bfd87 ("block: make generic_make_request handle arbitrarily sized bios") Cc: stable@vger.kernel.org Tested-by: Artem S. Tashkinov Signed-off-by: Jens Axboe block/blk-core.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit e62a25e917a9e5b35ddd5b4f1b5e5e30fbd2e84c Merge: f6f63ae ec72fa5 Author: Brad Spengler Date: Tue Dec 22 19:46:26 2015 -0500 Merge branch 'pax-test' into grsec-test commit ec72fa5f8d9cb4e223bad1b8b5c2e1071c222f2a Author: Brad Spengler Date: Tue Dec 22 19:45:51 2015 -0500 Update to pax-linux-4.3.3-test13.patch: - Emese fixed a (probably) false positive integer truncation in xfs_da_grow_inode_int, reported by jdkbx (http://forums.grsecurity.net/viewtopic.php?f=3&t=4346) - fixed a size overflow in btrfs/try_merge_map, reported by Alex W (https://bugs.archlinux.org/task/47173) and mathias and dwokfur (https://forums.grsecurity.net/viewtopic.php?f=3&t=4344) arch/arm/mm/fault.c | 2 +- arch/x86/mm/fault.c | 2 +- fs/btrfs/extent_map.c | 8 ++++++-- fs/xfs/libxfs/xfs_da_btree.c | 4 +++- 4 files changed, 11 insertions(+), 5 deletions(-) commit f6f63ae154cd45028add1dc41957878060d77fbf Author: Brad Spengler Date: Thu Dec 17 18:43:44 2015 -0500 ptrace_has_cap() checks whether the current process should be treated as having a certain capability for ptrace checks against another process. Until now, this was equivalent to has_ns_capability(current, target_ns, CAP_SYS_PTRACE). However, if a root-owned process wants to enter a user namespace for some reason without knowing who owns it and therefore can't change to the namespace owner's uid and gid before entering, as soon as it has entered the namespace, the namespace owner can attach to it via ptrace and thereby gain access to its uid and gid. While it is possible for the entering process to switch to the uid of a claimed namespace owner before entering, causing the attempt to enter to fail if the claimed uid is wrong, this doesn't solve the problem of determining an appropriate gid. With this change, the entering process can first enter the namespace and then safely inspect the namespace's properties, e.g. through /proc/self/{uid_map,gid_map}, assuming that the namespace owner doesn't have access to uid 0. Signed-off-by: Jann Horn kernel/ptrace.c | 30 +++++++++++++++++++++++++----- 1 files changed, 25 insertions(+), 5 deletions(-) commit e314f0fb63020f61543b401ff594e953c2c304e5 Author: tadeusz.struk@intel.com Date: Tue Dec 15 10:46:17 2015 -0800 net: fix uninitialized variable issue msg_iocb needs to be initialized on the recv/recvfrom path. Otherwise afalg will wrongly interpret it as an async call. Cc: stable@vger.kernel.org Reported-by: Harald Freudenberger Signed-off-by: Tadeusz Struk Signed-off-by: David S. Miller net/socket.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit a3f56a43ad56b8fcaf04f6327636ed2f5970de3b Merge: dfa764c 142edcf Author: Brad Spengler Date: Wed Dec 16 21:01:17 2015 -0500 Merge branch 'pax-test' into grsec-test commit 142edcf1005a57fb8887823565cf0bafad2f313c Author: Brad Spengler Date: Wed Dec 16 21:00:57 2015 -0500 Update to pax-linux-4.3.3-test12.patch: - Emese fixed a size overflow false positive in reiserfs/leaf_paste_entries, reported by Christian Apeltauer (https://bugs.gentoo.org/show_bug.cgi?id=568046) - fixed a bunch of int/size_t mismatches in the drivers/tty/n_tty.c code causing size overflow false positives, reported by Toralf Förster, mathias (https://forums.grsecurity.net/viewtopic.php?f=3&t=4342), N8Fear (https://forums.grsecurity.net/viewtopic.php?f=3&t=4341) drivers/tty/n_tty.c | 16 ++++++++-------- .../disable_size_overflow_hash.data | 2 ++ .../size_overflow_plugin/size_overflow_hash.data | 6 ++---- 3 files changed, 12 insertions(+), 12 deletions(-) commit dfa764cc549892a5bfc1083cac78b99032cae577 Author: Hannes Frederic Sowa Date: Tue Dec 15 22:59:12 2015 +0100 ipv6: automatically enable stable privacy mode if stable_secret set Bjørn reported that while we switch all interfaces to privacy stable mode when setting the secret, we don't set this mode for new interfaces. This does not make sense, so change this behaviour. Fixes: 622c81d57b392cc ("ipv6: generation of stable privacy addresses for link-local and autoconf") Reported-by: Bjørn Mork Cc: Bjørn Mork Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller net/ipv6/addrconf.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) commit c2815a1fee03f222273e77c14e43f960da06f35a Author: Brad Spengler Date: Wed Dec 16 13:03:38 2015 -0500 Work around upstream limitation on the number of thread info flags causing a compilation error Reported by fabled at http://forums.grsecurity.net/viewtopic.php?f=3&t=4339 arch/arm/kernel/entry-common.S | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-) commit 8c9ae168e09ae49324d709d76d73d9fc4ca477e1 Author: Brad Spengler Date: Tue Dec 15 19:03:41 2015 -0500 Initial import of grsecurity 3.1 for Linux 4.3.3 Documentation/dontdiff | 2 + Documentation/kernel-parameters.txt | 7 + Documentation/sysctl/kernel.txt | 15 + Makefile | 18 +- arch/alpha/include/asm/cache.h | 4 +- arch/alpha/kernel/osf_sys.c | 12 +- arch/arc/Kconfig | 1 + arch/arm/Kconfig | 1 + arch/arm/Kconfig.debug | 1 + arch/arm/include/asm/thread_info.h | 7 +- arch/arm/kernel/process.c | 4 +- arch/arm/kernel/ptrace.c | 9 + arch/arm/kernel/traps.c | 7 +- arch/arm/mm/Kconfig | 2 +- arch/arm/mm/fault.c | 40 +- arch/arm/mm/mmap.c | 8 +- arch/arm/net/bpf_jit_32.c | 51 +- arch/arm64/Kconfig.debug | 1 + arch/avr32/include/asm/cache.h | 4 +- arch/blackfin/Kconfig.debug | 1 + arch/blackfin/include/asm/cache.h | 3 +- arch/cris/include/arch-v10/arch/cache.h | 3 +- arch/cris/include/arch-v32/arch/cache.h | 3 +- arch/frv/include/asm/cache.h | 3 +- arch/frv/mm/elf-fdpic.c | 4 +- arch/hexagon/include/asm/cache.h | 6 +- arch/ia64/Kconfig | 1 + arch/ia64/include/asm/cache.h | 3 +- arch/ia64/kernel/sys_ia64.c | 2 + arch/ia64/mm/hugetlbpage.c | 2 + arch/m32r/include/asm/cache.h | 4 +- arch/m68k/include/asm/cache.h | 4 +- arch/metag/mm/hugetlbpage.c | 1 + arch/microblaze/include/asm/cache.h | 3 +- arch/mips/Kconfig | 1 + arch/mips/include/asm/cache.h | 3 +- arch/mips/include/asm/thread_info.h | 11 +- arch/mips/kernel/irq.c | 3 + arch/mips/kernel/ptrace.c | 9 + arch/mips/mm/mmap.c | 4 +- arch/mn10300/proc-mn103e010/include/proc/cache.h | 4 +- arch/mn10300/proc-mn2ws0050/include/proc/cache.h | 4 +- arch/openrisc/include/asm/cache.h | 4 +- arch/parisc/include/asm/cache.h | 5 +- arch/parisc/kernel/sys_parisc.c | 4 + arch/powerpc/Kconfig | 1 + arch/powerpc/include/asm/cache.h | 4 +- arch/powerpc/include/asm/thread_info.h | 5 +- arch/powerpc/kernel/Makefile | 2 + arch/powerpc/kernel/irq.c | 3 + arch/powerpc/kernel/process.c | 10 +- arch/powerpc/kernel/ptrace.c | 14 + arch/powerpc/kernel/traps.c | 5 + arch/powerpc/mm/slice.c | 2 +- arch/s390/Kconfig.debug | 1 + arch/s390/include/asm/cache.h | 4 +- arch/score/include/asm/cache.h | 4 +- arch/sh/include/asm/cache.h | 3 +- arch/sh/mm/mmap.c | 6 +- arch/sparc/include/asm/cache.h | 4 +- arch/sparc/include/asm/pgalloc_64.h | 1 + arch/sparc/include/asm/thread_info_64.h | 8 +- arch/sparc/kernel/process_32.c | 6 +- arch/sparc/kernel/process_64.c | 8 +- arch/sparc/kernel/ptrace_64.c | 14 + arch/sparc/kernel/sys_sparc_64.c | 8 +- arch/sparc/kernel/syscalls.S | 8 +- arch/sparc/kernel/traps_32.c | 8 +- arch/sparc/kernel/traps_64.c | 28 +- arch/sparc/kernel/unaligned_64.c | 2 +- arch/sparc/mm/fault_64.c | 2 +- arch/sparc/mm/hugetlbpage.c | 15 +- arch/tile/Kconfig | 1 + arch/tile/include/asm/cache.h | 3 +- arch/tile/mm/hugetlbpage.c | 2 + arch/um/include/asm/cache.h | 3 +- arch/unicore32/include/asm/cache.h | 6 +- arch/x86/Kconfig | 21 + arch/x86/Kconfig.debug | 2 + arch/x86/entry/common.c | 14 + arch/x86/entry/entry_32.S | 2 +- arch/x86/entry/entry_64.S | 2 +- arch/x86/ia32/ia32_aout.c | 2 + arch/x86/include/asm/floppy.h | 20 +- arch/x86/include/asm/fpu/types.h | 69 +- arch/x86/include/asm/io.h | 2 +- arch/x86/include/asm/page.h | 12 +- arch/x86/include/asm/paravirt_types.h | 23 +- arch/x86/include/asm/processor.h | 12 +- arch/x86/include/asm/thread_info.h | 6 +- arch/x86/include/asm/uaccess.h | 2 +- arch/x86/kernel/dumpstack.c | 10 +- arch/x86/kernel/dumpstack_32.c | 2 +- arch/x86/kernel/dumpstack_64.c | 2 +- arch/x86/kernel/ioport.c | 13 + arch/x86/kernel/irq_32.c | 3 + arch/x86/kernel/irq_64.c | 4 + arch/x86/kernel/ldt.c | 18 + arch/x86/kernel/msr.c | 10 + arch/x86/kernel/ptrace.c | 14 + arch/x86/kernel/signal.c | 9 +- arch/x86/kernel/sys_i386_32.c | 9 +- arch/x86/kernel/sys_x86_64.c | 8 +- arch/x86/kernel/traps.c | 5 + arch/x86/kernel/verify_cpu.S | 1 + arch/x86/kernel/vm86_32.c | 15 + arch/x86/kvm/svm.c | 14 +- arch/x86/mm/fault.c | 12 +- arch/x86/mm/hugetlbpage.c | 15 +- arch/x86/mm/init.c | 66 +- arch/x86/mm/init_32.c | 6 +- arch/x86/net/bpf_jit_comp.c | 4 + arch/x86/platform/efi/efi_64.c | 2 +- arch/x86/xen/Kconfig | 1 + arch/xtensa/variants/dc232b/include/variant/core.h | 2 +- arch/xtensa/variants/fsf/include/variant/core.h | 3 +- crypto/ablkcipher.c | 2 +- crypto/blkcipher.c | 2 +- crypto/scatterwalk.c | 10 +- drivers/acpi/acpica/hwxfsleep.c | 11 +- drivers/acpi/custom_method.c | 4 + drivers/block/cciss.h | 30 +- drivers/block/smart1,2.h | 40 +- drivers/cdrom/cdrom.c | 2 +- drivers/char/Kconfig | 4 +- drivers/char/genrtc.c | 1 + drivers/char/ipmi/ipmi_si_intf.c | 8 +- drivers/char/mem.c | 17 + drivers/char/random.c | 5 +- drivers/cpufreq/sparc-us3-cpufreq.c | 2 - drivers/crypto/nx/nx-aes-ccm.c | 2 +- drivers/crypto/nx/nx-aes-gcm.c | 2 +- drivers/crypto/talitos.c | 2 +- drivers/firewire/ohci.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 70 +- drivers/gpu/drm/nouveau/nouveau_ttm.c | 28 +- drivers/gpu/drm/ttm/ttm_bo_manager.c | 10 +- drivers/gpu/drm/virtio/virtgpu_ttm.c | 10 +- drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 10 +- drivers/hid/hid-wiimote-debug.c | 2 +- drivers/infiniband/hw/nes/nes_cm.c | 22 +- drivers/iommu/Kconfig | 1 + drivers/iommu/amd_iommu.c | 14 +- drivers/isdn/gigaset/bas-gigaset.c | 32 +- drivers/isdn/gigaset/ser-gigaset.c | 32 +- drivers/isdn/gigaset/usb-gigaset.c | 32 +- drivers/isdn/hisax/config.c | 2 +- drivers/isdn/hisax/hfc_pci.c | 2 +- drivers/isdn/hisax/hfc_sx.c | 2 +- drivers/isdn/hisax/q931.c | 6 +- drivers/isdn/i4l/isdn_concap.c | 6 +- drivers/isdn/i4l/isdn_x25iface.c | 16 +- drivers/md/bcache/Kconfig | 1 + drivers/md/raid5.c | 8 + drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +- drivers/media/platform/sti/c8sectpfe/Kconfig | 1 + drivers/media/platform/vivid/vivid-osd.c | 1 + drivers/media/radio/radio-cadet.c | 5 +- drivers/media/usb/dvb-usb/cinergyT2-core.c | 91 +- drivers/media/usb/dvb-usb/cinergyT2-fe.c | 182 +- drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 37 +- drivers/media/usb/dvb-usb/technisat-usb2.c | 75 +- drivers/message/fusion/mptbase.c | 9 + drivers/misc/sgi-xp/xp_main.c | 12 +- drivers/net/ethernet/brocade/bna/bna_enet.c | 8 +- drivers/net/ppp/pppoe.c | 14 +- drivers/net/ppp/pptp.c | 6 + drivers/net/slip/slhc.c | 3 + drivers/net/wan/lmc/lmc_media.c | 97 +- drivers/net/wan/x25_asy.c | 6 +- drivers/net/wan/z85230.c | 24 +- drivers/net/wireless/ath/ath9k/Kconfig | 1 - drivers/net/wireless/zd1211rw/zd_usb.c | 2 +- drivers/pci/pci-sysfs.c | 2 +- drivers/pci/proc.c | 9 + drivers/platform/x86/asus-wmi.c | 12 + drivers/rtc/rtc-dev.c | 3 + drivers/scsi/bfa/bfa_fcs.c | 19 +- drivers/scsi/bfa/bfa_fcs_lport.c | 29 +- drivers/scsi/bfa/bfa_modules.h | 12 +- drivers/scsi/hpsa.h | 40 +- drivers/staging/dgnc/dgnc_mgmt.c | 1 + drivers/staging/lustre/lustre/ldlm/ldlm_flock.c | 2 +- drivers/staging/lustre/lustre/libcfs/module.c | 10 +- drivers/target/target_core_sbc.c | 17 +- drivers/target/target_core_transport.c | 14 +- drivers/tty/serial/uartlite.c | 4 +- drivers/tty/sysrq.c | 2 +- drivers/tty/vt/keyboard.c | 22 +- drivers/uio/uio.c | 6 +- drivers/usb/core/hub.c | 5 + drivers/usb/gadget/function/f_uac1.c | 1 + drivers/usb/gadget/function/u_uac1.c | 1 + drivers/usb/host/hwa-hc.c | 9 +- drivers/usb/usbip/vhci_sysfs.c | 2 +- drivers/video/fbdev/arcfb.c | 2 +- drivers/video/fbdev/matrox/matroxfb_DAC1064.c | 10 +- drivers/video/fbdev/matrox/matroxfb_Ti3026.c | 5 +- drivers/video/fbdev/sh_mobile_lcdcfb.c | 6 +- drivers/video/logo/logo_linux_clut224.ppm | 2720 ++++----- drivers/xen/xenfs/xenstored.c | 5 + firmware/Makefile | 2 + firmware/WHENCE | 20 +- firmware/bnx2/bnx2-mips-06-6.2.3.fw.ihex | 5804 +++++++++++++++++ firmware/bnx2/bnx2-mips-09-6.2.1b.fw.ihex | 6496 ++++++++++++++++++++ fs/9p/vfs_inode.c | 4 +- fs/attr.c | 1 + fs/autofs4/waitq.c | 9 + fs/binfmt_aout.c | 7 + fs/binfmt_elf.c | 50 +- fs/compat.c | 20 +- fs/coredump.c | 17 +- fs/dcache.c | 3 + fs/debugfs/inode.c | 11 +- fs/exec.c | 219 +- fs/ext2/balloc.c | 4 +- fs/ext2/super.c | 8 +- fs/ext4/balloc.c | 4 +- fs/fcntl.c | 4 + fs/fhandle.c | 3 +- fs/file.c | 4 + fs/filesystems.c | 4 + fs/fs_struct.c | 20 +- fs/hugetlbfs/inode.c | 5 +- fs/inode.c | 8 +- fs/kernfs/dir.c | 6 + fs/mount.h | 4 +- fs/namei.c | 286 +- fs/namespace.c | 24 + fs/nfsd/nfscache.c | 2 +- fs/open.c | 38 + fs/overlayfs/inode.c | 11 +- fs/overlayfs/super.c | 6 +- fs/pipe.c | 2 +- fs/posix_acl.c | 15 +- fs/proc/Kconfig | 10 +- fs/proc/array.c | 69 +- fs/proc/base.c | 186 +- fs/proc/cmdline.c | 4 + fs/proc/devices.c | 4 + fs/proc/fd.c | 17 +- fs/proc/generic.c | 64 + fs/proc/inode.c | 17 + fs/proc/internal.h | 11 +- fs/proc/interrupts.c | 4 + fs/proc/kcore.c | 3 + fs/proc/meminfo.c | 7 +- fs/proc/namespaces.c | 4 +- fs/proc/proc_net.c | 31 + fs/proc/proc_sysctl.c | 52 +- fs/proc/root.c | 8 + fs/proc/stat.c | 69 +- fs/proc/task_mmu.c | 66 +- fs/readdir.c | 19 + fs/reiserfs/item_ops.c | 24 +- fs/reiserfs/super.c | 4 + fs/select.c | 2 + fs/seq_file.c | 30 +- fs/splice.c | 8 + fs/stat.c | 20 +- fs/sysfs/dir.c | 30 +- fs/sysv/inode.c | 11 +- fs/utimes.c | 7 + fs/xattr.c | 26 +- grsecurity/Kconfig | 1182 ++++ grsecurity/Makefile | 54 + grsecurity/gracl.c | 2757 +++++++++ grsecurity/gracl_alloc.c | 105 + grsecurity/gracl_cap.c | 127 + grsecurity/gracl_compat.c | 269 + grsecurity/gracl_fs.c | 448 ++ grsecurity/gracl_ip.c | 386 ++ grsecurity/gracl_learn.c | 207 + grsecurity/gracl_policy.c | 1786 ++++++ grsecurity/gracl_res.c | 68 + grsecurity/gracl_segv.c | 304 + grsecurity/gracl_shm.c | 40 + grsecurity/grsec_chdir.c | 19 + grsecurity/grsec_chroot.c | 467 ++ grsecurity/grsec_disabled.c | 445 ++ grsecurity/grsec_exec.c | 189 + grsecurity/grsec_fifo.c | 26 + grsecurity/grsec_fork.c | 23 + grsecurity/grsec_init.c | 290 + grsecurity/grsec_ipc.c | 48 + grsecurity/grsec_link.c | 65 + grsecurity/grsec_log.c | 340 + grsecurity/grsec_mem.c | 48 + grsecurity/grsec_mount.c | 65 + grsecurity/grsec_pax.c | 47 + grsecurity/grsec_proc.c | 20 + grsecurity/grsec_ptrace.c | 30 + grsecurity/grsec_sig.c | 236 + grsecurity/grsec_sock.c | 244 + grsecurity/grsec_sysctl.c | 488 ++ grsecurity/grsec_time.c | 16 + grsecurity/grsec_tpe.c | 78 + grsecurity/grsec_usb.c | 15 + grsecurity/grsum.c | 64 + include/linux/binfmts.h | 5 +- include/linux/bitops.h | 2 +- include/linux/capability.h | 13 + include/linux/compiler-gcc.h | 5 + include/linux/compiler.h | 8 + include/linux/cred.h | 8 +- include/linux/dcache.h | 5 +- include/linux/fs.h | 24 +- include/linux/fs_struct.h | 2 +- include/linux/fsnotify.h | 6 + include/linux/gracl.h | 342 + include/linux/gracl_compat.h | 156 + include/linux/gralloc.h | 9 + include/linux/grdefs.h | 140 + include/linux/grinternal.h | 230 + include/linux/grmsg.h | 118 + include/linux/grsecurity.h | 255 + include/linux/grsock.h | 19 + include/linux/ipc.h | 2 +- include/linux/ipc_namespace.h | 2 +- include/linux/kallsyms.h | 18 +- include/linux/kmod.h | 5 + include/linux/kobject.h | 2 +- include/linux/lsm_hooks.h | 4 +- include/linux/mm.h | 12 + include/linux/mm_types.h | 4 +- include/linux/module.h | 5 +- include/linux/mount.h | 2 +- include/linux/msg.h | 2 +- include/linux/netfilter/xt_gradm.h | 9 + include/linux/path.h | 4 +- include/linux/perf_event.h | 13 +- include/linux/pid_namespace.h | 2 +- include/linux/printk.h | 2 +- include/linux/proc_fs.h | 22 +- include/linux/proc_ns.h | 2 +- include/linux/ptrace.h | 24 +- include/linux/random.h | 2 +- include/linux/rbtree_augmented.h | 4 +- include/linux/scatterlist.h | 12 +- include/linux/sched.h | 114 +- include/linux/security.h | 1 + include/linux/sem.h | 2 +- include/linux/seq_file.h | 5 + include/linux/shm.h | 6 +- include/linux/skbuff.h | 3 + include/linux/slab.h | 9 - include/linux/sysctl.h | 8 +- include/linux/thread_info.h | 6 +- include/linux/tty.h | 2 +- include/linux/tty_driver.h | 4 +- include/linux/uidgid.h | 5 + include/linux/user_namespace.h | 2 +- include/linux/utsname.h | 2 +- include/linux/vermagic.h | 16 +- include/linux/vmalloc.h | 20 +- include/net/af_unix.h | 2 +- include/net/dst.h | 33 + include/net/ip.h | 2 +- include/net/neighbour.h | 2 +- include/net/net_namespace.h | 2 +- include/net/sock.h | 4 +- include/target/target_core_base.h | 2 +- include/trace/events/fs.h | 53 + include/uapi/linux/personality.h | 1 + init/Kconfig | 4 +- init/main.c | 35 +- ipc/mqueue.c | 1 + ipc/msg.c | 3 +- ipc/sem.c | 3 +- ipc/shm.c | 26 +- ipc/util.c | 6 + kernel/auditsc.c | 2 +- kernel/bpf/syscall.c | 8 +- kernel/capability.c | 41 +- kernel/cgroup.c | 5 +- kernel/compat.c | 1 + kernel/configs.c | 11 + kernel/cred.c | 112 +- kernel/events/core.c | 16 +- kernel/exit.c | 10 +- kernel/fork.c | 86 +- kernel/futex.c | 6 +- kernel/futex_compat.c | 2 +- kernel/kallsyms.c | 9 + kernel/kcmp.c | 8 +- kernel/kexec_core.c | 2 +- kernel/kmod.c | 95 +- kernel/kprobes.c | 7 +- kernel/ksysfs.c | 2 + kernel/locking/lockdep_proc.c | 10 +- kernel/module.c | 108 +- kernel/panic.c | 4 +- kernel/pid.c | 23 +- kernel/power/Kconfig | 2 + kernel/printk/printk.c | 20 +- kernel/ptrace.c | 56 +- kernel/resource.c | 10 + kernel/sched/core.c | 11 +- kernel/signal.c | 37 +- kernel/sys.c | 64 +- kernel/sysctl.c | 172 +- kernel/taskstats.c | 6 + kernel/time/posix-timers.c | 8 + kernel/time/time.c | 5 + kernel/time/timekeeping.c | 3 + kernel/time/timer_list.c | 13 +- kernel/time/timer_stats.c | 10 +- kernel/trace/Kconfig | 2 + kernel/trace/trace_syscalls.c | 8 + kernel/user_namespace.c | 15 + lib/Kconfig.debug | 13 +- lib/Kconfig.kasan | 2 +- lib/is_single_threaded.c | 3 + lib/list_debug.c | 65 +- lib/nlattr.c | 2 + lib/rbtree.c | 4 +- lib/vsprintf.c | 39 +- localversion-grsec | 1 + mm/Kconfig | 8 +- mm/Kconfig.debug | 1 + mm/filemap.c | 1 + mm/kmemleak.c | 4 +- mm/memory.c | 2 +- mm/mempolicy.c | 12 +- mm/migrate.c | 3 +- mm/mlock.c | 6 +- mm/mmap.c | 93 +- mm/mprotect.c | 8 + mm/oom_kill.c | 28 +- mm/page_alloc.c | 2 +- mm/process_vm_access.c | 8 +- mm/shmem.c | 36 +- mm/slab.c | 14 +- mm/slab_common.c | 2 +- mm/slob.c | 12 + mm/slub.c | 33 +- mm/util.c | 3 + mm/vmalloc.c | 129 +- mm/vmstat.c | 29 +- net/appletalk/atalk_proc.c | 2 +- net/atm/lec.c | 6 +- net/atm/mpoa_caches.c | 42 +- net/bluetooth/sco.c | 3 + net/can/bcm.c | 2 +- net/can/proc.c | 2 +- net/core/dev_ioctl.c | 7 +- net/core/filter.c | 8 +- net/core/net-procfs.c | 17 +- net/core/pktgen.c | 2 +- net/core/sock.c | 3 +- net/core/sysctl_net_core.c | 2 +- net/decnet/dn_dev.c | 2 +- net/ipv4/devinet.c | 6 +- net/ipv4/inet_hashtables.c | 4 + net/ipv4/ip_input.c | 7 + net/ipv4/ip_sockglue.c | 3 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv4/netfilter/nf_nat_pptp.c | 2 +- net/ipv4/route.c | 6 +- net/ipv4/tcp_input.c | 4 +- net/ipv4/tcp_ipv4.c | 29 +- net/ipv4/tcp_minisocks.c | 9 +- net/ipv4/tcp_timer.c | 11 + net/ipv4/udp.c | 24 + net/ipv6/addrconf.c | 13 +- net/ipv6/proc.c | 2 +- net/ipv6/tcp_ipv6.c | 26 +- net/ipv6/udp.c | 7 + net/ipx/ipx_proc.c | 2 +- net/irda/irproc.c | 2 +- net/llc/llc_proc.c | 2 +- net/netfilter/Kconfig | 10 + net/netfilter/Makefile | 1 + net/netfilter/nf_conntrack_core.c | 8 + net/netfilter/xt_gradm.c | 51 + net/netfilter/xt_hashlimit.c | 4 +- net/netfilter/xt_recent.c | 2 +- net/sched/sch_api.c | 2 +- net/sctp/socket.c | 4 +- net/socket.c | 75 +- net/sunrpc/Kconfig | 1 + net/sunrpc/cache.c | 2 +- net/sunrpc/stats.c | 2 +- net/sysctl_net.c | 2 +- net/unix/af_unix.c | 52 +- net/vmw_vsock/vmci_transport_notify.c | 30 +- net/vmw_vsock/vmci_transport_notify_qstate.c | 30 +- net/x25/sysctl_net_x25.c | 2 +- net/x25/x25_proc.c | 2 +- scripts/package/Makefile | 2 +- scripts/package/mkspec | 41 +- security/Kconfig | 369 +- security/apparmor/file.c | 4 +- security/apparmor/lsm.c | 8 +- security/commoncap.c | 36 +- security/min_addr.c | 2 + security/smack/smack_lsm.c | 8 +- security/tomoyo/file.c | 12 +- security/tomoyo/mount.c | 4 + security/tomoyo/tomoyo.c | 20 +- security/yama/Kconfig | 2 +- security/yama/yama_lsm.c | 4 +- sound/synth/emux/emux_seq.c | 14 +- sound/usb/line6/driver.c | 40 +- sound/usb/line6/toneport.c | 12 +- tools/gcc/.gitignore | 1 + tools/gcc/Makefile | 12 + tools/gcc/gen-random-seed.sh | 8 + tools/gcc/randomize_layout_plugin.c | 930 +++ tools/gcc/size_overflow_plugin/.gitignore | 1 + .../size_overflow_plugin/size_overflow_hash.data | 459 ++- 511 files changed, 32631 insertions(+), 3196 deletions(-) commit a76adb92ce39aee8eec5a025c828030ad6135c6d Author: Brad Spengler Date: Tue Dec 15 14:31:49 2015 -0500 Update to pax-linux-4.3.3-test11.patch: - fixed a few compile regressions with the recent plugin changes, reported by spender - updated the size overflow hash table tools/gcc/latent_entropy_plugin.c | 2 +- .../size_overflow_plugin/size_overflow_hash.data | 66 +++++++++++++++++--- tools/gcc/stackleak_plugin.c | 2 +- tools/gcc/structleak_plugin.c | 6 +-- 4 files changed, 60 insertions(+), 16 deletions(-) commit f7284b1fc06628fcb2d35d2beecdea5454d46af9 Author: Brad Spengler Date: Tue Dec 15 11:50:24 2015 -0500 Apply structleak ICE fix for gcc < 4.9 tools/gcc/structleak_plugin.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) commit 92fe3eb9fd10ec7f7334decab1526989669b0287 Author: Brad Spengler Date: Tue Dec 15 07:57:06 2015 -0500 Update to pax-linux-4.3.1-test10.patch: - Emese fixed INDIRECT_REF and TARGET_MEM_REF handling in the initify plugin - Emese regenerated the size overflow hash tables for 4.3 - fixed some compat syscall exit paths to restore r12 under KERNEXEC/or - the latent entropy, stackleak and structleak plugins no longer split the entry block unnecessarily arch/x86/entry/entry_64.S | 2 +- arch/x86/entry/entry_64_compat.S | 15 +- scripts/package/builddeb | 2 +- tools/gcc/initify_plugin.c | 11 +- tools/gcc/latent_entropy_plugin.c | 20 +- .../disable_size_overflow_hash.data | 4 + .../size_overflow_plugin/size_overflow_hash.data | 5345 +++++++++++--------- tools/gcc/stackleak_plugin.c | 26 +- tools/gcc/structleak_plugin.c | 21 +- 9 files changed, 3079 insertions(+), 2367 deletions(-) commit 5bd245cb687319079c2f1c0d6a1170791ed1ed2c Merge: b5847e6 3548341 Author: Brad Spengler Date: Tue Dec 15 07:47:56 2015 -0500 Merge branch 'linux-4.3.y' into pax-4_3 Conflicts: net/unix/af_unix.c commit b5847e6a896c5d99191135ca4d7c3b6be8f116ff Author: Brad Spengler Date: Wed Dec 9 23:11:36 2015 -0500 Update to pax-linux-4.3.1-test9.patch: - fixed __get_user on x86 to lie less about the size of the load, reported by peetaur (https://forums.grsecurity.net/viewtopic.php?f=3&t=4332) - Emese fixed an intentional overflow caused by gcc, reported by saironiq (https://forums.grsecurity.net/viewtopic.php?f=3&t=4333) - Emese fixed a false positive overflow report in the forcedeth driver, reported by fx3 (https://forums.grsecurity.net/viewtopic.php?t=4334) - Emese fixed a false positive overflow report in KVM's emulator, reported by fx3 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4336) - Emese fixed the initify plugin to detect some captured use of __func__, reported by Rasmus Villemoes - constrained shmmax and shmall to avoid triggering size overflow checks, reported by Mathias Krause - the checker plugin can partially handle sparse's locking context annotations, it's context insensitive and thus not exactly useful for now, also see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=59856 Makefile | 6 + arch/x86/include/asm/compat.h | 4 + arch/x86/include/asm/dma.h | 2 + arch/x86/include/asm/pmem.h | 2 +- arch/x86/include/asm/uaccess.h | 20 +- arch/x86/kernel/apic/vector.c | 6 +- arch/x86/kernel/cpu/mtrr/generic.c | 6 +- arch/x86/kernel/cpu/perf_event_intel.c | 28 +- arch/x86/kernel/head_64.S | 1 - arch/x86/kvm/i8259.c | 10 +- arch/x86/kvm/ioapic.c | 2 + arch/x86/kvm/x86.c | 2 + arch/x86/lib/usercopy_64.c | 2 +- arch/x86/mm/mpx.c | 4 +- arch/x86/mm/pageattr.c | 7 + drivers/base/devres.c | 4 +- drivers/base/power/runtime.c | 6 +- drivers/base/regmap/regmap.c | 4 +- drivers/block/drbd/drbd_receiver.c | 4 +- drivers/block/drbd/drbd_worker.c | 6 +- drivers/char/virtio_console.c | 6 +- drivers/md/dm.c | 12 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/macvtap.c | 4 +- drivers/video/fbdev/core/fbmem.c | 10 +- fs/compat.c | 3 +- fs/coredump.c | 2 +- fs/dcache.c | 13 +- fs/fhandle.c | 2 +- fs/file.c | 14 +- fs/fs-writeback.c | 11 +- fs/overlayfs/copy_up.c | 2 +- fs/readdir.c | 3 +- fs/super.c | 3 +- include/linux/compiler.h | 36 ++- include/linux/rcupdate.h | 8 + include/linux/sched.h | 4 +- include/linux/seqlock.h | 10 + include/linux/spinlock.h | 17 +- include/linux/srcu.h | 5 +- include/linux/syscalls.h | 2 +- include/linux/writeback.h | 3 +- include/uapi/linux/swab.h | 6 +- ipc/ipc_sysctl.c | 6 + kernel/exit.c | 25 +- kernel/resource.c | 4 +- kernel/signal.c | 12 +- kernel/user.c | 2 +- kernel/workqueue.c | 6 +- lib/rhashtable.c | 4 +- net/compat.c | 2 +- net/ipv4/xfrm4_mode_transport.c | 2 +- security/keys/internal.h | 8 +- security/keys/keyring.c | 4 - sound/core/seq/seq_clientmgr.c | 8 +- sound/core/seq/seq_compat.c | 2 +- sound/core/seq/seq_memory.c | 6 +- tools/gcc/checker_plugin.c | 415 +++++++++++++++++++- tools/gcc/gcc-common.h | 1 + tools/gcc/initify_plugin.c | 33 ++- .../disable_size_overflow_hash.data | 1 + .../size_overflow_plugin/size_overflow_hash.data | 1 - 62 files changed, 708 insertions(+), 140 deletions(-) commit f2634c2f6995f4231616f24ed016f890c701f939 Merge: 1241bff 5f8b236 Author: Brad Spengler Date: Wed Dec 9 21:50:47 2015 -0500 Merge branch 'linux-4.3.y' into pax-4_3 Conflicts: arch/x86/kernel/fpu/xstate.c arch/x86/kernel/head_64.S commit 1241bff82e3d7dadb05de0a60b8d2822afc6547c Author: Brad Spengler Date: Sun Dec 6 08:44:56 2015 -0500 Update to pax-linux-4.3-test8.patch: - fixed integer truncation check in md introduced by upstream commits 284ae7cab0f7335c9e0aa8992b28415ef1a54c7c and 58c0fed400603a802968b23ddf78f029c5a84e41, reported by BeiKed9o (https://forums.grsecurity.net/viewtopic.php?f=3&t=4328) - gcc plugin compilation problems will now also produce the output of the checking script to make diagnosis easier, reported by hunger - Emese fixed a false positive size overflow report in __vhost_add_used_n, reported by quasar366 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4329) - fixed a potential integer truncation error in the raid1 code caught by the size overflow plugin, reported by d1b (https://forums.grsecurity.net/viewtopic.php?f=3&t=4331) Makefile | 5 +++ drivers/md/md.c | 5 ++- drivers/md/raid1.c | 2 +- fs/proc/task_mmu.c | 3 ++ .../disable_size_overflow_hash.data | 4 ++- .../size_overflow_plugin/intentional_overflow.c | 32 ++++++++++++++++--- .../size_overflow_plugin/size_overflow_hash.data | 2 - .../size_overflow_plugin/size_overflow_plugin.c | 2 +- 8 files changed, 43 insertions(+), 12 deletions(-) commit cce6a9f9bdd27096632ca1c0246dcc07f2eb1a18 Author: Brad Spengler Date: Fri Dec 4 14:24:12 2015 -0500 Initial import of pax-linux-4.3-test7.patch Documentation/dontdiff | 47 +- Documentation/kbuild/makefiles.txt | 39 +- Documentation/kernel-parameters.txt | 28 + Makefile | 108 +- arch/alpha/include/asm/atomic.h | 10 + arch/alpha/include/asm/elf.h | 7 + arch/alpha/include/asm/pgalloc.h | 6 + arch/alpha/include/asm/pgtable.h | 11 + arch/alpha/kernel/module.c | 2 +- arch/alpha/kernel/osf_sys.c | 8 +- arch/alpha/mm/fault.c | 141 +- arch/arm/Kconfig | 2 +- arch/arm/include/asm/atomic.h | 320 +- arch/arm/include/asm/cache.h | 5 +- arch/arm/include/asm/cacheflush.h | 2 +- arch/arm/include/asm/checksum.h | 14 +- arch/arm/include/asm/cmpxchg.h | 4 + arch/arm/include/asm/cpuidle.h | 2 +- arch/arm/include/asm/domain.h | 22 +- arch/arm/include/asm/elf.h | 9 +- arch/arm/include/asm/fncpy.h | 2 + arch/arm/include/asm/futex.h | 10 + arch/arm/include/asm/kmap_types.h | 2 +- arch/arm/include/asm/mach/dma.h | 2 +- arch/arm/include/asm/mach/map.h | 16 +- arch/arm/include/asm/outercache.h | 2 +- arch/arm/include/asm/page.h | 3 +- arch/arm/include/asm/pgalloc.h | 20 + arch/arm/include/asm/pgtable-2level-hwdef.h | 4 +- arch/arm/include/asm/pgtable-2level.h | 3 + arch/arm/include/asm/pgtable-3level.h | 3 + arch/arm/include/asm/pgtable.h | 54 +- arch/arm/include/asm/smp.h | 2 +- arch/arm/include/asm/tls.h | 3 + arch/arm/include/asm/uaccess.h | 79 +- arch/arm/include/uapi/asm/ptrace.h | 2 +- arch/arm/kernel/armksyms.c | 2 +- arch/arm/kernel/cpuidle.c | 2 +- arch/arm/kernel/entry-armv.S | 109 +- arch/arm/kernel/entry-common.S | 40 +- arch/arm/kernel/entry-header.S | 55 + arch/arm/kernel/fiq.c | 3 + arch/arm/kernel/module-plts.c | 7 +- arch/arm/kernel/module.c | 38 +- arch/arm/kernel/patch.c | 2 + arch/arm/kernel/process.c | 90 +- arch/arm/kernel/reboot.c | 1 + arch/arm/kernel/setup.c | 20 +- arch/arm/kernel/signal.c | 35 +- arch/arm/kernel/smp.c | 2 +- arch/arm/kernel/tcm.c | 4 +- arch/arm/kernel/vmlinux.lds.S | 6 +- arch/arm/kvm/arm.c | 8 +- arch/arm/lib/copy_page.S | 1 + arch/arm/lib/csumpartialcopyuser.S | 4 +- arch/arm/lib/delay.c | 2 +- arch/arm/lib/uaccess_with_memcpy.c | 4 +- arch/arm/mach-exynos/suspend.c | 6 +- arch/arm/mach-mvebu/coherency.c | 4 +- arch/arm/mach-omap2/board-n8x0.c | 2 +- arch/arm/mach-omap2/omap-mpuss-lowpower.c | 4 +- arch/arm/mach-omap2/omap-smp.c | 1 + arch/arm/mach-omap2/omap-wakeupgen.c | 2 +- arch/arm/mach-omap2/omap_device.c | 4 +- arch/arm/mach-omap2/omap_device.h | 4 +- arch/arm/mach-omap2/omap_hwmod.c | 4 +- arch/arm/mach-omap2/powerdomains43xx_data.c | 5 +- arch/arm/mach-omap2/wd_timer.c | 6 +- arch/arm/mach-shmobile/platsmp-apmu.c | 5 +- arch/arm/mach-tegra/cpuidle-tegra20.c | 2 +- arch/arm/mach-tegra/irq.c | 1 + arch/arm/mach-ux500/pm.c | 1 + arch/arm/mach-zynq/platsmp.c | 1 + arch/arm/mm/Kconfig | 6 +- arch/arm/mm/alignment.c | 8 + arch/arm/mm/cache-l2x0.c | 2 +- arch/arm/mm/context.c | 10 +- arch/arm/mm/fault.c | 146 + arch/arm/mm/fault.h | 12 + arch/arm/mm/init.c | 39 + arch/arm/mm/ioremap.c | 4 +- arch/arm/mm/mmap.c | 30 +- arch/arm/mm/mmu.c | 162 +- arch/arm/net/bpf_jit_32.c | 3 + arch/arm/plat-iop/setup.c | 2 +- arch/arm/plat-omap/sram.c | 2 + arch/arm64/include/asm/atomic.h | 10 + arch/arm64/include/asm/percpu.h | 8 +- arch/arm64/include/asm/pgalloc.h | 5 + arch/arm64/include/asm/uaccess.h | 1 + arch/arm64/mm/dma-mapping.c | 2 +- arch/avr32/include/asm/elf.h | 8 +- arch/avr32/include/asm/kmap_types.h | 4 +- arch/avr32/mm/fault.c | 27 + arch/frv/include/asm/atomic.h | 10 + arch/frv/include/asm/kmap_types.h | 2 +- arch/frv/mm/elf-fdpic.c | 3 +- arch/ia64/Makefile | 1 + arch/ia64/include/asm/atomic.h | 10 + arch/ia64/include/asm/elf.h | 7 + arch/ia64/include/asm/pgalloc.h | 12 + arch/ia64/include/asm/pgtable.h | 13 +- arch/ia64/include/asm/spinlock.h | 2 +- arch/ia64/include/asm/uaccess.h | 27 +- arch/ia64/kernel/module.c | 45 +- arch/ia64/kernel/palinfo.c | 2 +- arch/ia64/kernel/sys_ia64.c | 7 + arch/ia64/kernel/vmlinux.lds.S | 2 +- arch/ia64/mm/fault.c | 32 +- arch/ia64/mm/init.c | 15 +- arch/m32r/lib/usercopy.c | 6 + arch/mips/cavium-octeon/dma-octeon.c | 2 +- arch/mips/include/asm/atomic.h | 368 +- arch/mips/include/asm/elf.h | 7 + arch/mips/include/asm/exec.h | 2 +- arch/mips/include/asm/hw_irq.h | 2 +- arch/mips/include/asm/local.h | 57 + arch/mips/include/asm/page.h | 2 +- arch/mips/include/asm/pgalloc.h | 5 + arch/mips/include/asm/pgtable.h | 3 + arch/mips/include/asm/uaccess.h | 1 + arch/mips/kernel/binfmt_elfn32.c | 7 + arch/mips/kernel/binfmt_elfo32.c | 7 + arch/mips/kernel/irq-gt641xx.c | 2 +- arch/mips/kernel/irq.c | 6 +- arch/mips/kernel/pm-cps.c | 2 +- arch/mips/kernel/process.c | 12 - arch/mips/kernel/sync-r4k.c | 24 +- arch/mips/kernel/traps.c | 13 +- arch/mips/mm/fault.c | 25 + arch/mips/mm/mmap.c | 51 +- arch/mips/sgi-ip27/ip27-nmi.c | 6 +- arch/mips/sni/rm200.c | 2 +- arch/mips/vr41xx/common/icu.c | 2 +- arch/mips/vr41xx/common/irq.c | 4 +- arch/parisc/include/asm/atomic.h | 10 + arch/parisc/include/asm/elf.h | 7 + arch/parisc/include/asm/pgalloc.h | 6 + arch/parisc/include/asm/pgtable.h | 11 + arch/parisc/include/asm/uaccess.h | 4 +- arch/parisc/kernel/module.c | 50 +- arch/parisc/kernel/sys_parisc.c | 15 + arch/parisc/kernel/traps.c | 4 +- arch/parisc/mm/fault.c | 140 +- arch/powerpc/include/asm/atomic.h | 329 +- arch/powerpc/include/asm/elf.h | 12 + arch/powerpc/include/asm/exec.h | 2 +- arch/powerpc/include/asm/kmap_types.h | 2 +- arch/powerpc/include/asm/local.h | 46 + arch/powerpc/include/asm/mman.h | 2 +- arch/powerpc/include/asm/page.h | 8 +- arch/powerpc/include/asm/page_64.h | 7 +- arch/powerpc/include/asm/pgalloc-64.h | 7 + arch/powerpc/include/asm/pgtable.h | 1 + arch/powerpc/include/asm/pte-hash32.h | 1 + arch/powerpc/include/asm/reg.h | 1 + arch/powerpc/include/asm/smp.h | 2 +- arch/powerpc/include/asm/spinlock.h | 42 +- arch/powerpc/include/asm/uaccess.h | 141 +- arch/powerpc/kernel/Makefile | 5 + arch/powerpc/kernel/exceptions-64e.S | 4 +- arch/powerpc/kernel/exceptions-64s.S | 2 +- arch/powerpc/kernel/module_32.c | 15 +- arch/powerpc/kernel/process.c | 46 - arch/powerpc/kernel/signal_32.c | 2 +- arch/powerpc/kernel/signal_64.c | 2 +- arch/powerpc/kernel/traps.c | 21 + arch/powerpc/kernel/vdso.c | 5 +- arch/powerpc/lib/usercopy_64.c | 18 - arch/powerpc/mm/fault.c | 56 +- arch/powerpc/mm/mmap.c | 16 + arch/powerpc/mm/slice.c | 13 +- arch/powerpc/platforms/cell/spufs/file.c | 4 +- arch/s390/include/asm/atomic.h | 10 + arch/s390/include/asm/elf.h | 7 + arch/s390/include/asm/exec.h | 2 +- arch/s390/include/asm/uaccess.h | 13 +- arch/s390/kernel/module.c | 22 +- arch/s390/kernel/process.c | 24 - arch/s390/mm/mmap.c | 16 + arch/score/include/asm/exec.h | 2 +- arch/score/kernel/process.c | 5 - arch/sh/mm/mmap.c | 22 +- arch/sparc/include/asm/atomic_64.h | 110 +- arch/sparc/include/asm/cache.h | 2 +- arch/sparc/include/asm/elf_32.h | 7 + arch/sparc/include/asm/elf_64.h | 7 + arch/sparc/include/asm/pgalloc_32.h | 1 + arch/sparc/include/asm/pgalloc_64.h | 1 + arch/sparc/include/asm/pgtable.h | 4 + arch/sparc/include/asm/pgtable_32.h | 15 +- arch/sparc/include/asm/pgtsrmmu.h | 5 + arch/sparc/include/asm/setup.h | 4 +- arch/sparc/include/asm/spinlock_64.h | 35 +- arch/sparc/include/asm/thread_info_32.h | 1 + arch/sparc/include/asm/thread_info_64.h | 2 + arch/sparc/include/asm/uaccess.h | 1 + arch/sparc/include/asm/uaccess_32.h | 28 +- arch/sparc/include/asm/uaccess_64.h | 24 +- arch/sparc/kernel/Makefile | 2 +- arch/sparc/kernel/prom_common.c | 2 +- arch/sparc/kernel/smp_64.c | 8 +- arch/sparc/kernel/sys_sparc_32.c | 2 +- arch/sparc/kernel/sys_sparc_64.c | 52 +- arch/sparc/kernel/traps_64.c | 27 +- arch/sparc/lib/Makefile | 2 +- arch/sparc/lib/atomic_64.S | 57 +- arch/sparc/lib/ksyms.c | 6 +- arch/sparc/mm/Makefile | 2 +- arch/sparc/mm/fault_32.c | 292 + arch/sparc/mm/fault_64.c | 486 + arch/sparc/mm/hugetlbpage.c | 22 +- arch/sparc/mm/init_64.c | 10 +- arch/tile/include/asm/atomic_64.h | 10 + arch/tile/include/asm/uaccess.h | 4 +- arch/um/Makefile | 4 + arch/um/include/asm/kmap_types.h | 2 +- arch/um/include/asm/page.h | 3 + arch/um/include/asm/pgtable-3level.h | 1 + arch/um/kernel/process.c | 16 - arch/x86/Kconfig | 15 +- arch/x86/Kconfig.cpu | 6 +- arch/x86/Kconfig.debug | 4 +- arch/x86/Makefile | 13 +- arch/x86/boot/Makefile | 3 + arch/x86/boot/bitops.h | 4 +- arch/x86/boot/boot.h | 2 +- arch/x86/boot/compressed/Makefile | 3 + arch/x86/boot/compressed/efi_stub_32.S | 16 +- arch/x86/boot/compressed/efi_thunk_64.S | 4 +- arch/x86/boot/compressed/head_32.S | 4 +- arch/x86/boot/compressed/head_64.S | 12 +- arch/x86/boot/compressed/misc.c | 11 +- arch/x86/boot/cpucheck.c | 16 +- arch/x86/boot/header.S | 6 +- arch/x86/boot/memory.c | 2 +- arch/x86/boot/video-vesa.c | 1 + arch/x86/boot/video.c | 2 +- arch/x86/crypto/aes-x86_64-asm_64.S | 4 + arch/x86/crypto/aesni-intel_asm.S | 106 +- arch/x86/crypto/blowfish-x86_64-asm_64.S | 7 + arch/x86/crypto/camellia-aesni-avx-asm_64.S | 10 + arch/x86/crypto/camellia-aesni-avx2-asm_64.S | 10 + arch/x86/crypto/camellia-x86_64-asm_64.S | 7 + arch/x86/crypto/cast5-avx-x86_64-asm_64.S | 51 +- arch/x86/crypto/cast6-avx-x86_64-asm_64.S | 25 +- arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 4 +- arch/x86/crypto/ghash-clmulni-intel_asm.S | 4 + arch/x86/crypto/salsa20-x86_64-asm_64.S | 4 + arch/x86/crypto/serpent-avx-x86_64-asm_64.S | 9 + arch/x86/crypto/serpent-avx2-asm_64.S | 9 + arch/x86/crypto/serpent-sse2-x86_64-asm_64.S | 4 + arch/x86/crypto/sha1_ssse3_asm.S | 10 +- arch/x86/crypto/sha256-avx-asm.S | 2 + arch/x86/crypto/sha256-avx2-asm.S | 2 + arch/x86/crypto/sha256-ssse3-asm.S | 2 + arch/x86/crypto/sha512-avx-asm.S | 2 + arch/x86/crypto/sha512-avx2-asm.S | 2 + arch/x86/crypto/sha512-ssse3-asm.S | 2 + arch/x86/crypto/twofish-avx-x86_64-asm_64.S | 25 +- arch/x86/crypto/twofish-x86_64-asm_64-3way.S | 4 + arch/x86/crypto/twofish-x86_64-asm_64.S | 3 + arch/x86/entry/calling.h | 86 +- arch/x86/entry/common.c | 13 +- arch/x86/entry/entry_32.S | 351 +- arch/x86/entry/entry_64.S | 619 +- arch/x86/entry/entry_64_compat.S | 159 +- arch/x86/entry/thunk_64.S | 2 + arch/x86/entry/vdso/Makefile | 2 +- arch/x86/entry/vdso/vdso2c.h | 8 +- arch/x86/entry/vdso/vma.c | 41 +- arch/x86/entry/vsyscall/vsyscall_64.c | 16 +- arch/x86/entry/vsyscall/vsyscall_emu_64.S | 2 +- arch/x86/ia32/ia32_signal.c | 23 +- arch/x86/ia32/sys_ia32.c | 42 +- arch/x86/include/asm/alternative-asm.h | 43 +- arch/x86/include/asm/alternative.h | 4 +- arch/x86/include/asm/apic.h | 2 +- arch/x86/include/asm/apm.h | 4 +- arch/x86/include/asm/atomic.h | 230 +- arch/x86/include/asm/atomic64_32.h | 100 + arch/x86/include/asm/atomic64_64.h | 164 +- arch/x86/include/asm/bitops.h | 18 +- arch/x86/include/asm/boot.h | 2 +- arch/x86/include/asm/cache.h | 5 +- arch/x86/include/asm/checksum_32.h | 12 +- arch/x86/include/asm/cmpxchg.h | 39 + arch/x86/include/asm/compat.h | 2 +- arch/x86/include/asm/cpufeature.h | 17 +- arch/x86/include/asm/desc.h | 78 +- arch/x86/include/asm/desc_defs.h | 6 + arch/x86/include/asm/div64.h | 2 +- arch/x86/include/asm/elf.h | 33 +- arch/x86/include/asm/emergency-restart.h | 2 +- arch/x86/include/asm/fpu/internal.h | 42 +- arch/x86/include/asm/fpu/types.h | 6 +- arch/x86/include/asm/futex.h | 14 +- arch/x86/include/asm/hw_irq.h | 4 +- arch/x86/include/asm/i8259.h | 2 +- arch/x86/include/asm/io.h | 22 +- arch/x86/include/asm/irqflags.h | 5 + arch/x86/include/asm/kprobes.h | 9 +- arch/x86/include/asm/local.h | 106 +- arch/x86/include/asm/mman.h | 15 + arch/x86/include/asm/mmu.h | 14 +- arch/x86/include/asm/mmu_context.h | 114 +- arch/x86/include/asm/module.h | 17 +- arch/x86/include/asm/nmi.h | 19 +- arch/x86/include/asm/page.h | 1 + arch/x86/include/asm/page_32.h | 12 +- arch/x86/include/asm/page_64.h | 14 +- arch/x86/include/asm/paravirt.h | 46 +- arch/x86/include/asm/paravirt_types.h | 15 +- arch/x86/include/asm/pgalloc.h | 23 + arch/x86/include/asm/pgtable-2level.h | 2 + arch/x86/include/asm/pgtable-3level.h | 7 + arch/x86/include/asm/pgtable.h | 128 +- arch/x86/include/asm/pgtable_32.h | 14 +- arch/x86/include/asm/pgtable_32_types.h | 24 +- arch/x86/include/asm/pgtable_64.h | 23 +- arch/x86/include/asm/pgtable_64_types.h | 5 + arch/x86/include/asm/pgtable_types.h | 26 +- arch/x86/include/asm/preempt.h | 2 +- arch/x86/include/asm/processor.h | 57 +- arch/x86/include/asm/ptrace.h | 13 +- arch/x86/include/asm/realmode.h | 4 +- arch/x86/include/asm/reboot.h | 10 +- arch/x86/include/asm/rmwcc.h | 84 +- arch/x86/include/asm/rwsem.h | 60 +- arch/x86/include/asm/segment.h | 27 +- arch/x86/include/asm/smap.h | 43 + arch/x86/include/asm/smp.h | 14 +- arch/x86/include/asm/stackprotector.h | 4 +- arch/x86/include/asm/stacktrace.h | 32 +- arch/x86/include/asm/switch_to.h | 4 +- arch/x86/include/asm/sys_ia32.h | 6 +- arch/x86/include/asm/thread_info.h | 27 +- arch/x86/include/asm/tlbflush.h | 77 +- arch/x86/include/asm/uaccess.h | 192 +- arch/x86/include/asm/uaccess_32.h | 28 +- arch/x86/include/asm/uaccess_64.h | 169 +- arch/x86/include/asm/word-at-a-time.h | 2 +- arch/x86/include/asm/x86_init.h | 10 +- arch/x86/include/asm/xen/page.h | 2 +- arch/x86/include/uapi/asm/e820.h | 2 +- arch/x86/kernel/Makefile | 2 +- arch/x86/kernel/acpi/boot.c | 4 +- arch/x86/kernel/acpi/sleep.c | 4 + arch/x86/kernel/acpi/wakeup_32.S | 6 +- arch/x86/kernel/alternative.c | 124 +- arch/x86/kernel/apic/apic.c | 4 +- arch/x86/kernel/apic/apic_flat_64.c | 6 +- arch/x86/kernel/apic/apic_noop.c | 2 +- arch/x86/kernel/apic/bigsmp_32.c | 2 +- arch/x86/kernel/apic/io_apic.c | 8 +- arch/x86/kernel/apic/msi.c | 2 +- arch/x86/kernel/apic/probe_32.c | 4 +- arch/x86/kernel/apic/vector.c | 4 +- arch/x86/kernel/apic/x2apic_cluster.c | 2 +- arch/x86/kernel/apic/x2apic_phys.c | 2 +- arch/x86/kernel/apic/x2apic_uv_x.c | 2 +- arch/x86/kernel/apm_32.c | 21 +- arch/x86/kernel/asm-offsets.c | 20 + arch/x86/kernel/asm-offsets_64.c | 1 + arch/x86/kernel/cpu/Makefile | 4 - arch/x86/kernel/cpu/amd.c | 2 +- arch/x86/kernel/cpu/bugs_64.c | 2 + arch/x86/kernel/cpu/common.c | 202 +- arch/x86/kernel/cpu/intel_cacheinfo.c | 14 +- arch/x86/kernel/cpu/mcheck/mce.c | 34 +- arch/x86/kernel/cpu/mcheck/p5.c | 3 + arch/x86/kernel/cpu/mcheck/winchip.c | 3 + arch/x86/kernel/cpu/microcode/intel.c | 4 +- arch/x86/kernel/cpu/mtrr/main.c | 2 +- arch/x86/kernel/cpu/mtrr/mtrr.h | 2 +- arch/x86/kernel/cpu/perf_event.c | 10 +- arch/x86/kernel/cpu/perf_event_amd_iommu.c | 2 +- arch/x86/kernel/cpu/perf_event_intel.c | 6 +- arch/x86/kernel/cpu/perf_event_intel_bts.c | 6 +- arch/x86/kernel/cpu/perf_event_intel_cqm.c | 4 +- arch/x86/kernel/cpu/perf_event_intel_pt.c | 44 +- arch/x86/kernel/cpu/perf_event_intel_rapl.c | 2 +- arch/x86/kernel/cpu/perf_event_intel_uncore.c | 2 +- arch/x86/kernel/cpu/perf_event_intel_uncore.h | 2 +- arch/x86/kernel/crash_dump_64.c | 2 +- arch/x86/kernel/doublefault.c | 8 +- arch/x86/kernel/dumpstack.c | 24 +- arch/x86/kernel/dumpstack_32.c | 25 +- arch/x86/kernel/dumpstack_64.c | 62 +- arch/x86/kernel/e820.c | 4 +- arch/x86/kernel/early_printk.c | 1 + arch/x86/kernel/espfix_64.c | 44 +- arch/x86/kernel/fpu/core.c | 24 +- arch/x86/kernel/fpu/init.c | 40 +- arch/x86/kernel/fpu/regset.c | 22 +- arch/x86/kernel/fpu/signal.c | 20 +- arch/x86/kernel/fpu/xstate.c | 8 +- arch/x86/kernel/ftrace.c | 18 +- arch/x86/kernel/head64.c | 14 +- arch/x86/kernel/head_32.S | 235 +- arch/x86/kernel/head_64.S | 173 +- arch/x86/kernel/i386_ksyms_32.c | 12 + arch/x86/kernel/i8259.c | 10 +- arch/x86/kernel/io_delay.c | 2 +- arch/x86/kernel/ioport.c | 2 +- arch/x86/kernel/irq.c | 8 +- arch/x86/kernel/irq_32.c | 45 +- arch/x86/kernel/jump_label.c | 10 +- arch/x86/kernel/kgdb.c | 21 +- arch/x86/kernel/kprobes/core.c | 28 +- arch/x86/kernel/kprobes/opt.c | 16 +- arch/x86/kernel/ksysfs.c | 2 +- arch/x86/kernel/kvmclock.c | 20 +- arch/x86/kernel/ldt.c | 25 + arch/x86/kernel/livepatch.c | 12 +- arch/x86/kernel/machine_kexec_32.c | 6 +- arch/x86/kernel/mcount_64.S | 19 +- arch/x86/kernel/module.c | 78 +- arch/x86/kernel/msr.c | 2 +- arch/x86/kernel/nmi.c | 34 +- arch/x86/kernel/nmi_selftest.c | 4 +- arch/x86/kernel/paravirt-spinlocks.c | 2 +- arch/x86/kernel/paravirt.c | 45 +- arch/x86/kernel/paravirt_patch_64.c | 8 + arch/x86/kernel/pci-calgary_64.c | 2 +- arch/x86/kernel/pci-iommu_table.c | 2 +- arch/x86/kernel/pci-swiotlb.c | 2 +- arch/x86/kernel/process.c | 80 +- arch/x86/kernel/process_32.c | 29 +- arch/x86/kernel/process_64.c | 14 +- arch/x86/kernel/ptrace.c | 20 +- arch/x86/kernel/pvclock.c | 8 +- arch/x86/kernel/reboot.c | 44 +- arch/x86/kernel/reboot_fixups_32.c | 2 +- arch/x86/kernel/relocate_kernel_64.S | 3 +- arch/x86/kernel/setup.c | 29 +- arch/x86/kernel/setup_percpu.c | 29 +- arch/x86/kernel/signal.c | 17 +- arch/x86/kernel/smp.c | 2 +- arch/x86/kernel/smpboot.c | 29 +- arch/x86/kernel/step.c | 6 +- arch/x86/kernel/sys_i386_32.c | 184 + arch/x86/kernel/sys_x86_64.c | 22 +- arch/x86/kernel/tboot.c | 14 +- arch/x86/kernel/time.c | 8 +- arch/x86/kernel/tls.c | 7 +- arch/x86/kernel/tracepoint.c | 4 +- arch/x86/kernel/traps.c | 53 +- arch/x86/kernel/tsc.c | 2 +- arch/x86/kernel/uprobes.c | 2 +- arch/x86/kernel/vm86_32.c | 6 +- arch/x86/kernel/vmlinux.lds.S | 153 +- arch/x86/kernel/x8664_ksyms_64.c | 6 +- arch/x86/kernel/x86_init.c | 6 +- arch/x86/kvm/cpuid.c | 21 +- arch/x86/kvm/emulate.c | 2 +- arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/paging_tmpl.h | 2 +- arch/x86/kvm/svm.c | 10 +- arch/x86/kvm/vmx.c | 62 +- arch/x86/kvm/x86.c | 42 +- arch/x86/lguest/boot.c | 3 +- arch/x86/lib/atomic64_386_32.S | 164 + arch/x86/lib/atomic64_cx8_32.S | 98 +- arch/x86/lib/checksum_32.S | 99 +- arch/x86/lib/clear_page_64.S | 3 + arch/x86/lib/cmpxchg16b_emu.S | 3 + arch/x86/lib/copy_page_64.S | 14 +- arch/x86/lib/copy_user_64.S | 66 +- arch/x86/lib/csum-copy_64.S | 14 +- arch/x86/lib/csum-wrappers_64.c | 8 +- arch/x86/lib/getuser.S | 74 +- arch/x86/lib/insn.c | 8 +- arch/x86/lib/iomap_copy_64.S | 2 + arch/x86/lib/memcpy_64.S | 6 + arch/x86/lib/memmove_64.S | 3 +- arch/x86/lib/memset_64.S | 3 + arch/x86/lib/mmx_32.c | 243 +- arch/x86/lib/msr-reg.S | 2 + arch/x86/lib/putuser.S | 87 +- arch/x86/lib/rwsem.S | 6 +- arch/x86/lib/usercopy_32.c | 359 +- arch/x86/lib/usercopy_64.c | 20 +- arch/x86/math-emu/fpu_aux.c | 2 +- arch/x86/math-emu/fpu_entry.c | 4 +- arch/x86/math-emu/fpu_system.h | 2 +- arch/x86/mm/Makefile | 4 + arch/x86/mm/extable.c | 26 +- arch/x86/mm/fault.c | 570 +- arch/x86/mm/gup.c | 6 +- arch/x86/mm/highmem_32.c | 6 + arch/x86/mm/hugetlbpage.c | 24 +- arch/x86/mm/init.c | 111 +- arch/x86/mm/init_32.c | 111 +- arch/x86/mm/init_64.c | 46 +- arch/x86/mm/iomap_32.c | 4 + arch/x86/mm/ioremap.c | 52 +- arch/x86/mm/kmemcheck/kmemcheck.c | 4 +- arch/x86/mm/mmap.c | 40 +- arch/x86/mm/mmio-mod.c | 10 +- arch/x86/mm/numa.c | 2 +- arch/x86/mm/pageattr.c | 38 +- arch/x86/mm/pat.c | 12 +- arch/x86/mm/pat_rbtree.c | 2 +- arch/x86/mm/pf_in.c | 10 +- arch/x86/mm/pgtable.c | 214 +- arch/x86/mm/pgtable_32.c | 3 + arch/x86/mm/setup_nx.c | 7 + arch/x86/mm/tlb.c | 4 + arch/x86/mm/uderef_64.c | 37 + arch/x86/net/bpf_jit.S | 11 + arch/x86/net/bpf_jit_comp.c | 13 +- arch/x86/oprofile/backtrace.c | 6 +- arch/x86/oprofile/nmi_int.c | 8 +- arch/x86/oprofile/op_model_amd.c | 8 +- arch/x86/oprofile/op_model_ppro.c | 7 +- arch/x86/oprofile/op_x86_model.h | 2 +- arch/x86/pci/intel_mid_pci.c | 2 +- arch/x86/pci/irq.c | 8 +- arch/x86/pci/pcbios.c | 144 +- arch/x86/platform/efi/efi_32.c | 24 + arch/x86/platform/efi/efi_64.c | 26 +- arch/x86/platform/efi/efi_stub_32.S | 64 +- arch/x86/platform/efi/efi_stub_64.S | 2 + arch/x86/platform/intel-mid/intel-mid.c | 5 +- arch/x86/platform/intel-mid/intel_mid_weak_decls.h | 6 +- arch/x86/platform/intel-mid/mfld.c | 4 +- arch/x86/platform/intel-mid/mrfl.c | 2 +- arch/x86/platform/intel-quark/imr_selftest.c | 2 +- arch/x86/platform/olpc/olpc_dt.c | 2 +- arch/x86/power/cpu.c | 11 +- arch/x86/realmode/init.c | 10 +- arch/x86/realmode/rm/Makefile | 3 + arch/x86/realmode/rm/header.S | 4 +- arch/x86/realmode/rm/reboot.S | 4 + arch/x86/realmode/rm/trampoline_32.S | 12 +- arch/x86/realmode/rm/trampoline_64.S | 3 +- arch/x86/realmode/rm/wakeup_asm.S | 5 +- arch/x86/tools/Makefile | 2 +- arch/x86/tools/relocs.c | 96 +- arch/x86/um/mem_32.c | 2 +- arch/x86/um/tls_32.c | 2 +- arch/x86/xen/enlighten.c | 50 +- arch/x86/xen/mmu.c | 19 +- arch/x86/xen/smp.c | 16 +- arch/x86/xen/xen-asm_32.S | 2 +- arch/x86/xen/xen-head.S | 11 + arch/x86/xen/xen-ops.h | 2 - block/bio.c | 4 +- block/blk-iopoll.c | 2 +- block/blk-map.c | 2 +- block/blk-softirq.c | 2 +- block/bsg.c | 12 +- block/compat_ioctl.c | 4 +- block/genhd.c | 9 +- block/partitions/efi.c | 8 +- block/scsi_ioctl.c | 29 +- crypto/cryptd.c | 4 +- crypto/pcrypt.c | 2 +- crypto/zlib.c | 12 +- drivers/acpi/acpi_video.c | 2 +- drivers/acpi/apei/apei-internal.h | 2 +- drivers/acpi/apei/ghes.c | 4 +- drivers/acpi/bgrt.c | 6 +- drivers/acpi/blacklist.c | 4 +- drivers/acpi/bus.c | 4 +- drivers/acpi/device_pm.c | 4 +- drivers/acpi/ec.c | 2 +- drivers/acpi/pci_slot.c | 2 +- drivers/acpi/processor_idle.c | 2 +- drivers/acpi/processor_pdc.c | 2 +- drivers/acpi/sleep.c | 2 +- drivers/acpi/sysfs.c | 4 +- drivers/acpi/thermal.c | 2 +- drivers/acpi/video_detect.c | 7 +- drivers/ata/libata-core.c | 12 +- drivers/ata/libata-scsi.c | 2 +- drivers/ata/libata.h | 2 +- drivers/ata/pata_arasan_cf.c | 4 +- drivers/atm/adummy.c | 2 +- drivers/atm/ambassador.c | 8 +- drivers/atm/atmtcp.c | 14 +- drivers/atm/eni.c | 10 +- drivers/atm/firestream.c | 8 +- drivers/atm/fore200e.c | 14 +- drivers/atm/he.c | 18 +- drivers/atm/horizon.c | 4 +- drivers/atm/idt77252.c | 36 +- drivers/atm/iphase.c | 34 +- drivers/atm/lanai.c | 12 +- drivers/atm/nicstar.c | 46 +- drivers/atm/solos-pci.c | 4 +- drivers/atm/suni.c | 4 +- drivers/atm/uPD98402.c | 16 +- drivers/atm/zatm.c | 6 +- drivers/base/bus.c | 4 +- drivers/base/devtmpfs.c | 8 +- drivers/base/node.c | 2 +- drivers/base/platform-msi.c | 20 +- drivers/base/power/domain.c | 11 +- drivers/base/power/sysfs.c | 2 +- drivers/base/power/wakeup.c | 8 +- drivers/base/regmap/regmap-debugfs.c | 11 +- drivers/base/syscore.c | 4 +- drivers/block/cciss.c | 28 +- drivers/block/cciss.h | 2 +- drivers/block/cpqarray.c | 28 +- drivers/block/cpqarray.h | 2 +- drivers/block/drbd/drbd_bitmap.c | 2 +- drivers/block/drbd/drbd_int.h | 8 +- drivers/block/drbd/drbd_main.c | 12 +- drivers/block/drbd/drbd_nl.c | 4 +- drivers/block/drbd/drbd_receiver.c | 34 +- drivers/block/drbd/drbd_worker.c | 8 +- drivers/block/pktcdvd.c | 4 +- drivers/block/rbd.c | 2 +- drivers/bluetooth/btwilink.c | 2 +- drivers/bus/arm-cci.c | 12 +- drivers/cdrom/cdrom.c | 11 +- drivers/cdrom/gdrom.c | 1 - drivers/char/agp/compat_ioctl.c | 2 +- drivers/char/agp/frontend.c | 4 +- drivers/char/agp/intel-gtt.c | 4 +- drivers/char/hpet.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 8 +- drivers/char/ipmi/ipmi_si_intf.c | 8 +- drivers/char/mem.c | 47 +- drivers/char/nvram.c | 2 +- drivers/char/pcmcia/synclink_cs.c | 16 +- drivers/char/random.c | 12 +- drivers/char/sonypi.c | 11 +- drivers/char/tpm/tpm_acpi.c | 3 +- drivers/char/tpm/tpm_eventlog.c | 4 +- drivers/char/virtio_console.c | 4 +- drivers/clk/clk-composite.c | 2 +- drivers/clk/samsung/clk.h | 2 +- drivers/clk/socfpga/clk-gate.c | 9 +- drivers/clk/socfpga/clk-pll.c | 9 +- drivers/clk/ti/clk.c | 8 +- drivers/cpufreq/acpi-cpufreq.c | 17 +- drivers/cpufreq/cpufreq-dt.c | 4 +- drivers/cpufreq/cpufreq.c | 30 +- drivers/cpufreq/cpufreq_governor.c | 2 +- drivers/cpufreq/cpufreq_governor.h | 4 +- drivers/cpufreq/cpufreq_ondemand.c | 10 +- drivers/cpufreq/intel_pstate.c | 33 +- drivers/cpufreq/p4-clockmod.c | 12 +- drivers/cpufreq/sparc-us3-cpufreq.c | 67 +- drivers/cpufreq/speedstep-centrino.c | 7 +- drivers/cpuidle/driver.c | 2 +- drivers/cpuidle/dt_idle_states.c | 2 +- drivers/cpuidle/governor.c | 2 +- drivers/cpuidle/sysfs.c | 2 +- drivers/crypto/hifn_795x.c | 4 +- drivers/devfreq/devfreq.c | 4 +- drivers/dma/sh/shdma-base.c | 4 +- drivers/dma/sh/shdmac.c | 2 +- drivers/edac/edac_device.c | 4 +- drivers/edac/edac_mc_sysfs.c | 2 +- drivers/edac/edac_pci.c | 4 +- drivers/edac/edac_pci_sysfs.c | 22 +- drivers/edac/mce_amd.h | 2 +- drivers/firewire/core-card.c | 6 +- drivers/firewire/core-device.c | 2 +- drivers/firewire/core-transaction.c | 1 + drivers/firewire/core.h | 1 + drivers/firmware/dmi-id.c | 2 +- drivers/firmware/dmi_scan.c | 12 +- drivers/firmware/efi/cper.c | 8 +- drivers/firmware/efi/efi.c | 12 +- drivers/firmware/efi/efivars.c | 2 +- drivers/firmware/efi/runtime-map.c | 2 +- drivers/firmware/google/gsmi.c | 2 +- drivers/firmware/google/memconsole.c | 7 +- drivers/firmware/memmap.c | 2 +- drivers/firmware/psci.c | 2 +- drivers/gpio/gpio-davinci.c | 6 +- drivers/gpio/gpio-em.c | 2 +- drivers/gpio/gpio-ich.c | 2 +- drivers/gpio/gpio-omap.c | 4 +- drivers/gpio/gpio-rcar.c | 2 +- drivers/gpio/gpio-vr41xx.c | 2 +- drivers/gpio/gpiolib.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 6 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 90 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.h | 8 +- .../drm/amd/amdkfd/kfd_device_queue_manager_cik.c | 14 +- .../drm/amd/amdkfd/kfd_device_queue_manager_vi.c | 14 +- drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.h | 2 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 16 +- drivers/gpu/drm/drm_crtc.c | 2 +- drivers/gpu/drm/drm_drv.c | 2 +- drivers/gpu/drm/drm_fops.c | 12 +- drivers/gpu/drm/drm_global.c | 14 +- drivers/gpu/drm/drm_info.c | 13 +- drivers/gpu/drm/drm_ioc32.c | 13 +- drivers/gpu/drm/drm_ioctl.c | 2 +- drivers/gpu/drm/gma500/mdfld_dsi_dpi.c | 10 +- drivers/gpu/drm/i810/i810_drv.h | 4 +- drivers/gpu/drm/i915/i915_dma.c | 2 +- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 4 +- drivers/gpu/drm/i915/i915_gem_gtt.c | 16 +- drivers/gpu/drm/i915/i915_gem_gtt.h | 6 +- drivers/gpu/drm/i915/i915_ioc32.c | 10 +- drivers/gpu/drm/i915/intel_display.c | 26 +- drivers/gpu/drm/imx/imx-drm-core.c | 2 +- drivers/gpu/drm/mga/mga_drv.h | 4 +- drivers/gpu/drm/mga/mga_ioc32.c | 10 +- drivers/gpu/drm/mga/mga_irq.c | 8 +- drivers/gpu/drm/nouveau/nouveau_bios.c | 2 +- drivers/gpu/drm/nouveau/nouveau_drm.h | 1 - drivers/gpu/drm/nouveau/nouveau_ioc32.c | 2 +- drivers/gpu/drm/nouveau/nouveau_vga.c | 2 +- drivers/gpu/drm/omapdrm/Makefile | 2 +- drivers/gpu/drm/qxl/qxl_cmd.c | 12 +- drivers/gpu/drm/qxl/qxl_debugfs.c | 8 +- drivers/gpu/drm/qxl/qxl_drv.h | 8 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 10 +- drivers/gpu/drm/qxl/qxl_irq.c | 16 +- drivers/gpu/drm/qxl/qxl_ttm.c | 38 +- drivers/gpu/drm/r128/r128_cce.c | 2 +- drivers/gpu/drm/r128/r128_drv.h | 4 +- drivers/gpu/drm/r128/r128_ioc32.c | 10 +- drivers/gpu/drm/r128/r128_irq.c | 4 +- drivers/gpu/drm/r128/r128_state.c | 4 +- drivers/gpu/drm/radeon/mkregtable.c | 4 +- drivers/gpu/drm/radeon/radeon_device.c | 2 +- drivers/gpu/drm/radeon/radeon_drv.h | 2 +- drivers/gpu/drm/radeon/radeon_ioc32.c | 12 +- drivers/gpu/drm/radeon/radeon_irq.c | 6 +- drivers/gpu/drm/radeon/radeon_state.c | 4 +- drivers/gpu/drm/radeon/radeon_ttm.c | 4 +- drivers/gpu/drm/tegra/dc.c | 2 +- drivers/gpu/drm/tegra/dsi.c | 2 +- drivers/gpu/drm/tegra/hdmi.c | 2 +- drivers/gpu/drm/tegra/sor.c | 7 +- drivers/gpu/drm/tilcdc/Makefile | 6 +- drivers/gpu/drm/ttm/ttm_memory.c | 4 +- drivers/gpu/drm/ttm/ttm_page_alloc.c | 18 +- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 18 +- drivers/gpu/drm/udl/udl_fb.c | 1 - drivers/gpu/drm/via/via_drv.h | 4 +- drivers/gpu/drm/via/via_irq.c | 18 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_irq.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_marker.c | 2 +- drivers/gpu/vga/vga_switcheroo.c | 4 +- drivers/hid/hid-core.c | 4 +- drivers/hid/hid-sensor-custom.c | 2 +- drivers/hv/channel.c | 2 +- drivers/hv/hv.c | 4 +- drivers/hv/hv_balloon.c | 18 +- drivers/hv/hyperv_vmbus.h | 2 +- drivers/hwmon/acpi_power_meter.c | 6 +- drivers/hwmon/applesmc.c | 2 +- drivers/hwmon/asus_atk0110.c | 10 +- drivers/hwmon/coretemp.c | 2 +- drivers/hwmon/dell-smm-hwmon.c | 2 +- drivers/hwmon/ibmaem.c | 2 +- drivers/hwmon/iio_hwmon.c | 2 +- drivers/hwmon/nct6683.c | 6 +- drivers/hwmon/nct6775.c | 6 +- drivers/hwmon/pmbus/pmbus_core.c | 10 +- drivers/hwmon/sht15.c | 12 +- drivers/hwmon/via-cputemp.c | 2 +- drivers/i2c/busses/i2c-amd756-s4882.c | 2 +- drivers/i2c/busses/i2c-nforce2-s4985.c | 2 +- drivers/i2c/i2c-dev.c | 2 +- drivers/ide/ide-cd.c | 2 +- drivers/ide/ide-disk.c | 2 +- drivers/iio/industrialio-core.c | 2 +- drivers/iio/magnetometer/ak8975.c | 2 +- drivers/infiniband/core/cm.c | 32 +- drivers/infiniband/core/fmr_pool.c | 20 +- drivers/infiniband/core/uverbs_cmd.c | 3 + drivers/infiniband/hw/cxgb4/mem.c | 4 +- drivers/infiniband/hw/mlx4/mad.c | 2 +- drivers/infiniband/hw/mlx4/mcg.c | 2 +- drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 +- drivers/infiniband/hw/mthca/mthca_cmd.c | 8 +- drivers/infiniband/hw/mthca/mthca_main.c | 2 +- drivers/infiniband/hw/mthca/mthca_mr.c | 6 +- drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/nes/nes.c | 4 +- drivers/infiniband/hw/nes/nes.h | 40 +- drivers/infiniband/hw/nes/nes_cm.c | 62 +- drivers/infiniband/hw/nes/nes_mgt.c | 8 +- drivers/infiniband/hw/nes/nes_nic.c | 40 +- drivers/infiniband/hw/nes/nes_verbs.c | 10 +- drivers/infiniband/hw/qib/qib.h | 1 + drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 2 +- drivers/input/gameport/gameport.c | 4 +- drivers/input/input.c | 4 +- drivers/input/joystick/sidewinder.c | 1 + drivers/input/joystick/xpad.c | 4 +- drivers/input/misc/ims-pcu.c | 4 +- drivers/input/mouse/psmouse.h | 2 +- drivers/input/mousedev.c | 2 +- drivers/input/serio/serio.c | 4 +- drivers/input/serio/serio_raw.c | 4 +- drivers/input/touchscreen/htcpen.c | 2 +- drivers/iommu/arm-smmu-v3.c | 2 +- drivers/iommu/arm-smmu.c | 43 +- drivers/iommu/io-pgtable-arm.c | 101 +- drivers/iommu/io-pgtable.c | 11 +- drivers/iommu/io-pgtable.h | 19 +- drivers/iommu/iommu.c | 2 +- drivers/iommu/ipmmu-vmsa.c | 13 +- drivers/iommu/irq_remapping.c | 2 +- drivers/irqchip/irq-gic.c | 2 +- drivers/irqchip/irq-i8259.c | 2 +- drivers/irqchip/irq-renesas-intc-irqpin.c | 2 +- drivers/irqchip/irq-renesas-irqc.c | 2 +- drivers/isdn/capi/capi.c | 10 +- drivers/isdn/gigaset/interface.c | 8 +- drivers/isdn/gigaset/usb-gigaset.c | 2 +- drivers/isdn/hardware/avm/b1.c | 4 +- drivers/isdn/i4l/isdn_common.c | 2 + drivers/isdn/i4l/isdn_tty.c | 22 +- drivers/isdn/icn/icn.c | 2 +- drivers/isdn/mISDN/dsp_cmx.c | 2 +- drivers/lguest/core.c | 10 +- drivers/lguest/page_tables.c | 2 +- drivers/lguest/x86/core.c | 12 +- drivers/lguest/x86/switcher_32.S | 27 +- drivers/md/bcache/closure.h | 2 +- drivers/md/bitmap.c | 2 +- drivers/md/dm-ioctl.c | 2 +- drivers/md/dm-raid1.c | 18 +- drivers/md/dm-stats.c | 6 +- drivers/md/dm-stripe.c | 10 +- drivers/md/dm-table.c | 2 +- drivers/md/dm-thin-metadata.c | 4 +- drivers/md/dm.c | 16 +- drivers/md/md.c | 26 +- drivers/md/md.h | 6 +- drivers/md/persistent-data/dm-space-map-metadata.c | 4 +- drivers/md/persistent-data/dm-space-map.h | 1 + drivers/md/raid1.c | 4 +- drivers/md/raid10.c | 18 +- drivers/md/raid5.c | 22 +- drivers/media/dvb-core/dvbdev.c | 2 +- drivers/media/dvb-frontends/af9033.h | 2 +- drivers/media/dvb-frontends/dib3000.h | 2 +- drivers/media/dvb-frontends/dib7000p.h | 2 +- drivers/media/dvb-frontends/dib8000.h | 2 +- drivers/media/pci/cx88/cx88-video.c | 6 +- drivers/media/pci/ivtv/ivtv-driver.c | 2 +- drivers/media/pci/solo6x10/solo6x10-core.c | 2 +- drivers/media/pci/solo6x10/solo6x10-p2m.c | 2 +- drivers/media/pci/solo6x10/solo6x10.h | 2 +- drivers/media/pci/tw68/tw68-core.c | 2 +- drivers/media/platform/omap/omap_vout.c | 11 +- drivers/media/platform/s5p-tv/mixer.h | 2 +- drivers/media/platform/s5p-tv/mixer_grp_layer.c | 2 +- drivers/media/platform/s5p-tv/mixer_reg.c | 2 +- drivers/media/platform/s5p-tv/mixer_video.c | 24 +- drivers/media/platform/s5p-tv/mixer_vp_layer.c | 2 +- drivers/media/radio/radio-cadet.c | 2 + drivers/media/radio/radio-maxiradio.c | 2 +- drivers/media/radio/radio-shark.c | 2 +- drivers/media/radio/radio-shark2.c | 2 +- drivers/media/radio/radio-si476x.c | 2 +- drivers/media/radio/wl128x/fmdrv_common.c | 2 +- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 12 +- drivers/media/v4l2-core/v4l2-device.c | 4 +- drivers/media/v4l2-core/v4l2-ioctl.c | 13 +- drivers/memory/omap-gpmc.c | 21 +- drivers/message/fusion/mptsas.c | 34 +- drivers/mfd/ab8500-debugfs.c | 2 +- drivers/mfd/kempld-core.c | 2 +- drivers/mfd/max8925-i2c.c | 2 +- drivers/mfd/tps65910.c | 2 +- drivers/mfd/twl4030-irq.c | 9 +- drivers/mfd/wm5110-tables.c | 2 +- drivers/mfd/wm8998-tables.c | 2 +- drivers/misc/c2port/core.c | 4 +- drivers/misc/kgdbts.c | 4 +- drivers/misc/lis3lv02d/lis3lv02d.c | 8 +- drivers/misc/lis3lv02d/lis3lv02d.h | 2 +- drivers/misc/mic/scif/scif_rb.c | 8 +- drivers/misc/sgi-gru/gruhandles.c | 4 +- drivers/misc/sgi-gru/gruprocfs.c | 8 +- drivers/misc/sgi-gru/grutables.h | 154 +- drivers/misc/sgi-xp/xp.h | 2 +- drivers/misc/sgi-xp/xpc.h | 3 +- drivers/misc/sgi-xp/xpc_main.c | 2 +- drivers/mmc/card/block.c | 2 +- drivers/mmc/host/dw_mmc.h | 2 +- drivers/mmc/host/mmci.c | 4 +- drivers/mmc/host/omap_hsmmc.c | 4 +- drivers/mmc/host/sdhci-esdhc-imx.c | 7 +- drivers/mmc/host/sdhci-s3c.c | 8 +- drivers/mtd/chips/cfi_cmdset_0020.c | 2 +- drivers/mtd/nand/denali.c | 1 + drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 2 +- drivers/mtd/nftlmount.c | 1 + drivers/mtd/sm_ftl.c | 2 +- drivers/net/bonding/bond_netlink.c | 2 +- drivers/net/caif/caif_hsi.c | 2 +- drivers/net/can/Kconfig | 2 +- drivers/net/can/dev.c | 2 +- drivers/net/can/vcan.c | 2 +- drivers/net/dummy.c | 2 +- drivers/net/ethernet/8390/ax88796.c | 4 +- drivers/net/ethernet/altera/altera_tse_main.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-common.h | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-dcb.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-desc.c | 27 +- drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 143 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 64 +- drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 10 +- drivers/net/ethernet/amd/xgbe/xgbe-main.c | 15 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 27 +- drivers/net/ethernet/amd/xgbe/xgbe-ptp.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe.h | 10 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c | 11 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 3 +- drivers/net/ethernet/broadcom/tg3.h | 1 + drivers/net/ethernet/cavium/liquidio/lio_ethtool.c | 6 +- drivers/net/ethernet/cavium/liquidio/lio_main.c | 11 +- drivers/net/ethernet/chelsio/cxgb3/l2t.h | 2 +- drivers/net/ethernet/dec/tulip/de4x5.c | 4 +- drivers/net/ethernet/emulex/benet/be_main.c | 2 +- drivers/net/ethernet/faraday/ftgmac100.c | 2 + drivers/net/ethernet/faraday/ftmac100.c | 2 + drivers/net/ethernet/intel/i40e/i40e_ptp.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 7 +- drivers/net/ethernet/neterion/vxge/vxge-config.c | 7 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 4 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c | 12 +- .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 +- drivers/net/ethernet/realtek/r8169.c | 8 +- drivers/net/ethernet/sfc/ptp.c | 2 +- drivers/net/ethernet/stmicro/stmmac/mmc_core.c | 4 +- drivers/net/ethernet/via/via-rhine.c | 2 +- drivers/net/geneve.c | 2 +- drivers/net/hyperv/hyperv_net.h | 2 +- drivers/net/hyperv/rndis_filter.c | 4 +- drivers/net/ifb.c | 2 +- drivers/net/ipvlan/ipvlan_core.c | 2 +- drivers/net/macvlan.c | 20 +- drivers/net/macvtap.c | 6 +- drivers/net/nlmon.c | 2 +- drivers/net/phy/phy_device.c | 6 +- drivers/net/ppp/ppp_generic.c | 4 +- drivers/net/slip/slhc.c | 2 +- drivers/net/team/team.c | 4 +- drivers/net/tun.c | 7 +- drivers/net/usb/hso.c | 23 +- drivers/net/usb/r8152.c | 2 +- drivers/net/usb/sierra_net.c | 4 +- drivers/net/virtio_net.c | 2 +- drivers/net/vrf.c | 2 +- drivers/net/vxlan.c | 4 +- drivers/net/wimax/i2400m/rx.c | 2 +- drivers/net/wireless/airo.c | 2 +- drivers/net/wireless/at76c50x-usb.c | 2 +- drivers/net/wireless/ath/ath10k/ce.c | 6 +- drivers/net/wireless/ath/ath10k/htc.c | 7 +- drivers/net/wireless/ath/ath10k/htc.h | 4 +- drivers/net/wireless/ath/ath9k/ar9002_mac.c | 36 +- drivers/net/wireless/ath/ath9k/ar9003_mac.c | 64 +- drivers/net/wireless/ath/ath9k/hw.h | 4 +- drivers/net/wireless/ath/ath9k/main.c | 22 +- drivers/net/wireless/ath/wil6210/wil_platform.h | 2 +- drivers/net/wireless/b43/phy_lp.c | 2 +- drivers/net/wireless/iwlegacy/3945-mac.c | 4 +- drivers/net/wireless/iwlwifi/dvm/debugfs.c | 34 +- drivers/net/wireless/iwlwifi/pcie/trans.c | 4 +- drivers/net/wireless/mac80211_hwsim.c | 28 +- drivers/net/wireless/rndis_wlan.c | 2 +- drivers/net/wireless/rt2x00/rt2x00.h | 2 +- drivers/net/wireless/rt2x00/rt2x00queue.c | 4 +- drivers/net/wireless/ti/wl1251/sdio.c | 12 +- drivers/net/wireless/ti/wl12xx/main.c | 8 +- drivers/net/wireless/ti/wl18xx/main.c | 6 +- drivers/nfc/nfcwilink.c | 2 +- drivers/of/fdt.c | 4 +- drivers/oprofile/buffer_sync.c | 8 +- drivers/oprofile/event_buffer.c | 2 +- drivers/oprofile/oprof.c | 2 +- drivers/oprofile/oprofile_stats.c | 10 +- drivers/oprofile/oprofile_stats.h | 10 +- drivers/oprofile/oprofilefs.c | 6 +- drivers/oprofile/timer_int.c | 2 +- drivers/parport/procfs.c | 4 +- drivers/pci/host/pci-host-generic.c | 24 +- drivers/pci/hotplug/acpiphp_ibm.c | 4 +- drivers/pci/hotplug/cpcihp_generic.c | 6 +- drivers/pci/hotplug/cpcihp_zt5550.c | 14 +- drivers/pci/hotplug/cpqphp_nvram.c | 2 + drivers/pci/hotplug/pci_hotplug_core.c | 6 +- drivers/pci/hotplug/pciehp_core.c | 2 +- drivers/pci/msi.c | 22 +- drivers/pci/pci-sysfs.c | 6 +- drivers/pci/pci.h | 2 +- drivers/pci/pcie/aspm.c | 6 +- drivers/pci/pcie/portdrv_pci.c | 2 +- drivers/pci/probe.c | 2 +- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 2 +- drivers/pinctrl/pinctrl-at91.c | 5 +- drivers/platform/chrome/chromeos_pstore.c | 2 +- drivers/platform/x86/alienware-wmi.c | 4 +- drivers/platform/x86/compal-laptop.c | 2 +- drivers/platform/x86/hdaps.c | 2 +- drivers/platform/x86/ibm_rtl.c | 2 +- drivers/platform/x86/intel_oaktrail.c | 2 +- drivers/platform/x86/msi-laptop.c | 16 +- drivers/platform/x86/msi-wmi.c | 2 +- drivers/platform/x86/samsung-laptop.c | 2 +- drivers/platform/x86/samsung-q10.c | 2 +- drivers/platform/x86/sony-laptop.c | 14 +- drivers/platform/x86/thinkpad_acpi.c | 2 +- drivers/pnp/pnpbios/bioscalls.c | 14 +- drivers/pnp/pnpbios/core.c | 2 +- drivers/power/pda_power.c | 7 +- drivers/power/power_supply.h | 4 +- drivers/power/power_supply_core.c | 7 +- drivers/power/power_supply_sysfs.c | 6 +- drivers/power/reset/at91-reset.c | 9 +- drivers/powercap/powercap_sys.c | 136 +- drivers/ptp/ptp_private.h | 2 +- drivers/ptp/ptp_sysfs.c | 2 +- drivers/regulator/core.c | 4 +- drivers/regulator/max8660.c | 6 +- drivers/regulator/max8973-regulator.c | 16 +- drivers/regulator/mc13892-regulator.c | 8 +- drivers/rtc/rtc-armada38x.c | 7 +- drivers/rtc/rtc-cmos.c | 4 +- drivers/rtc/rtc-ds1307.c | 2 +- drivers/rtc/rtc-m48t59.c | 4 +- drivers/rtc/rtc-test.c | 6 +- drivers/scsi/be2iscsi/be_main.c | 2 +- drivers/scsi/bfa/bfa_fcpim.h | 2 +- drivers/scsi/bfa/bfa_ioc.h | 4 +- drivers/scsi/fcoe/fcoe_sysfs.c | 12 +- drivers/scsi/hosts.c | 4 +- drivers/scsi/hpsa.c | 38 +- drivers/scsi/hpsa.h | 2 +- drivers/scsi/libfc/fc_exch.c | 50 +- drivers/scsi/libsas/sas_ata.c | 2 +- drivers/scsi/lpfc/lpfc.h | 8 +- drivers/scsi/lpfc/lpfc_debugfs.c | 18 +- drivers/scsi/lpfc/lpfc_init.c | 6 +- drivers/scsi/lpfc/lpfc_scsi.c | 10 +- drivers/scsi/megaraid/megaraid_sas.h | 2 +- drivers/scsi/mpt2sas/mpt2sas_scsih.c | 8 +- drivers/scsi/pmcraid.c | 20 +- drivers/scsi/pmcraid.h | 8 +- drivers/scsi/qla2xxx/qla_attr.c | 4 +- drivers/scsi/qla2xxx/qla_gbl.h | 4 +- drivers/scsi/qla2xxx/qla_os.c | 6 +- drivers/scsi/qla4xxx/ql4_def.h | 2 +- drivers/scsi/qla4xxx/ql4_os.c | 6 +- drivers/scsi/scsi.c | 2 +- drivers/scsi/scsi_lib.c | 8 +- drivers/scsi/scsi_sysfs.c | 2 +- drivers/scsi/scsi_transport_fc.c | 8 +- drivers/scsi/scsi_transport_iscsi.c | 6 +- drivers/scsi/scsi_transport_srp.c | 6 +- drivers/scsi/sd.c | 6 +- drivers/scsi/sg.c | 2 +- drivers/scsi/sr.c | 21 +- drivers/soc/tegra/fuse/fuse-tegra.c | 2 +- drivers/spi/spi.c | 2 +- drivers/staging/android/timed_output.c | 6 +- drivers/staging/comedi/comedi_fops.c | 8 +- drivers/staging/fbtft/fbtft-core.c | 2 +- drivers/staging/fbtft/fbtft.h | 2 +- drivers/staging/gdm724x/gdm_tty.c | 2 +- drivers/staging/iio/accel/lis3l02dq_ring.c | 2 +- drivers/staging/iio/adc/ad7280a.c | 4 +- drivers/staging/lustre/lnet/selftest/brw_test.c | 12 +- drivers/staging/lustre/lnet/selftest/framework.c | 4 - drivers/staging/lustre/lnet/selftest/ping_test.c | 14 +- drivers/staging/lustre/lustre/include/lustre_dlm.h | 2 +- drivers/staging/lustre/lustre/include/obd.h | 2 +- drivers/staging/octeon/ethernet-rx.c | 20 +- drivers/staging/octeon/ethernet.c | 8 +- drivers/staging/rdma/ipath/ipath_rc.c | 6 +- drivers/staging/rdma/ipath/ipath_ruc.c | 6 +- drivers/staging/rtl8188eu/include/hal_intf.h | 2 +- drivers/staging/rtl8712/rtl871x_io.h | 2 +- drivers/staging/sm750fb/sm750.c | 14 +- drivers/staging/unisys/visorbus/visorbus_private.h | 4 +- drivers/target/sbp/sbp_target.c | 4 +- drivers/thermal/cpu_cooling.c | 9 +- drivers/thermal/int340x_thermal/int3400_thermal.c | 6 +- drivers/thermal/of-thermal.c | 17 +- drivers/thermal/x86_pkg_temp_thermal.c | 2 +- drivers/tty/cyclades.c | 6 +- drivers/tty/hvc/hvc_console.c | 14 +- drivers/tty/hvc/hvcs.c | 21 +- drivers/tty/hvc/hvsi.c | 22 +- drivers/tty/hvc/hvsi_lib.c | 4 +- drivers/tty/ipwireless/tty.c | 27 +- drivers/tty/moxa.c | 2 +- drivers/tty/n_gsm.c | 4 +- drivers/tty/n_tty.c | 3 +- drivers/tty/pty.c | 4 +- drivers/tty/rocket.c | 6 +- drivers/tty/serial/8250/8250_core.c | 10 +- drivers/tty/serial/ifx6x60.c | 2 +- drivers/tty/serial/ioc4_serial.c | 6 +- drivers/tty/serial/kgdb_nmi.c | 4 +- drivers/tty/serial/kgdboc.c | 32 +- drivers/tty/serial/msm_serial.c | 4 +- drivers/tty/serial/samsung.c | 9 +- drivers/tty/serial/serial_core.c | 8 +- drivers/tty/synclink.c | 34 +- drivers/tty/synclink_gt.c | 28 +- drivers/tty/synclinkmp.c | 34 +- drivers/tty/tty_io.c | 2 +- drivers/tty/tty_ldisc.c | 8 +- drivers/tty/tty_port.c | 22 +- drivers/uio/uio.c | 13 +- drivers/usb/atm/cxacru.c | 2 +- drivers/usb/atm/usbatm.c | 24 +- drivers/usb/class/cdc-acm.h | 2 +- drivers/usb/core/devices.c | 6 +- drivers/usb/core/devio.c | 12 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/sysfs.c | 2 +- drivers/usb/core/usb.c | 2 +- drivers/usb/early/ehci-dbgp.c | 16 +- drivers/usb/gadget/function/u_serial.c | 22 +- drivers/usb/gadget/udc/dummy_hcd.c | 2 +- drivers/usb/host/ehci-hcd.c | 2 +- drivers/usb/host/ehci-hub.c | 4 +- drivers/usb/host/ehci-q.c | 4 +- drivers/usb/host/fotg210-hcd.c | 2 +- drivers/usb/host/fusbh200-hcd.c | 2 +- drivers/usb/host/hwa-hc.c | 2 +- drivers/usb/host/ohci-hcd.c | 2 +- drivers/usb/host/r8a66597.h | 2 +- drivers/usb/host/uhci-hcd.c | 2 +- drivers/usb/host/xhci-pci.c | 2 +- drivers/usb/host/xhci.c | 2 +- drivers/usb/misc/appledisplay.c | 4 +- drivers/usb/serial/console.c | 8 +- drivers/usb/storage/transport.c | 2 +- drivers/usb/storage/usb.c | 2 +- drivers/usb/storage/usb.h | 2 +- drivers/usb/usbip/vhci.h | 2 +- drivers/usb/usbip/vhci_hcd.c | 6 +- drivers/usb/usbip/vhci_rx.c | 2 +- drivers/usb/wusbcore/wa-hc.h | 4 +- drivers/usb/wusbcore/wa-xfer.c | 2 +- drivers/vfio/vfio.c | 2 +- drivers/vhost/vringh.c | 20 +- drivers/video/backlight/kb3886_bl.c | 2 +- drivers/video/console/fbcon.c | 2 +- drivers/video/fbdev/aty/aty128fb.c | 2 +- drivers/video/fbdev/aty/atyfb_base.c | 8 +- drivers/video/fbdev/aty/mach64_cursor.c | 5 +- drivers/video/fbdev/core/fb_defio.c | 6 +- drivers/video/fbdev/core/fbmem.c | 2 +- drivers/video/fbdev/hyperv_fb.c | 4 +- drivers/video/fbdev/i810/i810_accel.c | 1 + drivers/video/fbdev/matrox/matroxfb_base.c | 2 +- drivers/video/fbdev/mb862xx/mb862xxfb_accel.c | 16 +- drivers/video/fbdev/nvidia/nvidia.c | 27 +- drivers/video/fbdev/omap2/dss/display.c | 8 +- drivers/video/fbdev/s1d13xxxfb.c | 6 +- drivers/video/fbdev/smscufx.c | 4 +- drivers/video/fbdev/udlfb.c | 36 +- drivers/video/fbdev/uvesafb.c | 52 +- drivers/video/fbdev/vesafb.c | 58 +- drivers/video/fbdev/via/via_clock.h | 2 +- drivers/xen/events/events_base.c | 6 +- drivers/xen/evtchn.c | 4 +- fs/Kconfig.binfmt | 2 +- fs/afs/inode.c | 4 +- fs/aio.c | 2 +- fs/autofs4/waitq.c | 2 +- fs/befs/endian.h | 6 +- fs/binfmt_aout.c | 23 +- fs/binfmt_elf.c | 670 +- fs/binfmt_elf_fdpic.c | 4 +- fs/block_dev.c | 2 +- fs/btrfs/ctree.c | 9 +- fs/btrfs/delayed-inode.c | 9 +- fs/btrfs/delayed-inode.h | 6 +- fs/btrfs/file.c | 10 +- fs/btrfs/inode.c | 14 +- fs/btrfs/super.c | 2 +- fs/btrfs/sysfs.c | 2 +- fs/btrfs/tests/free-space-tests.c | 8 +- fs/btrfs/tree-log.h | 2 +- fs/buffer.c | 2 +- fs/cachefiles/bind.c | 6 +- fs/cachefiles/daemon.c | 8 +- fs/cachefiles/internal.h | 12 +- fs/cachefiles/namei.c | 2 +- fs/cachefiles/proc.c | 12 +- fs/ceph/dir.c | 12 +- fs/ceph/super.c | 4 +- fs/cifs/cifs_debug.c | 12 +- fs/cifs/cifsfs.c | 8 +- fs/cifs/cifsglob.h | 54 +- fs/cifs/file.c | 10 +- fs/cifs/misc.c | 4 +- fs/cifs/smb1ops.c | 80 +- fs/cifs/smb2ops.c | 84 +- fs/cifs/smb2pdu.c | 3 +- fs/coda/cache.c | 10 +- fs/compat.c | 4 +- fs/compat_binfmt_elf.c | 2 + fs/compat_ioctl.c | 12 +- fs/configfs/dir.c | 10 +- fs/coredump.c | 16 +- fs/dcache.c | 51 +- fs/ecryptfs/inode.c | 2 +- fs/ecryptfs/miscdev.c | 2 +- fs/exec.c | 362 +- fs/ext2/xattr.c | 5 +- fs/ext4/ext4.h | 20 +- fs/ext4/mballoc.c | 44 +- fs/ext4/resize.c | 16 +- fs/ext4/super.c | 4 +- fs/ext4/xattr.c | 5 +- fs/fhandle.c | 3 +- fs/file.c | 4 +- fs/fs_struct.c | 8 +- fs/fscache/cookie.c | 40 +- fs/fscache/internal.h | 202 +- fs/fscache/object.c | 26 +- fs/fscache/operation.c | 38 +- fs/fscache/page.c | 110 +- fs/fscache/stats.c | 348 +- fs/fuse/cuse.c | 10 +- fs/fuse/dev.c | 4 +- fs/gfs2/glock.c | 22 +- fs/gfs2/glops.c | 4 +- fs/gfs2/quota.c | 6 +- fs/hugetlbfs/inode.c | 13 +- fs/inode.c | 4 +- fs/jffs2/erase.c | 3 +- fs/jffs2/wbuf.c | 3 +- fs/jfs/super.c | 2 +- fs/kernfs/dir.c | 2 +- fs/kernfs/file.c | 20 +- fs/libfs.c | 10 +- fs/lockd/clntproc.c | 4 +- fs/namei.c | 16 +- fs/namespace.c | 16 +- fs/nfs/callback_xdr.c | 2 +- fs/nfs/inode.c | 6 +- fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfs4xdr.c | 2 +- fs/nfsd/nfscache.c | 11 +- fs/nfsd/vfs.c | 6 +- fs/nls/nls_base.c | 26 +- fs/nls/nls_euc-jp.c | 6 +- fs/nls/nls_koi8-ru.c | 6 +- fs/notify/fanotify/fanotify_user.c | 4 +- fs/notify/notification.c | 4 +- fs/ntfs/dir.c | 2 +- fs/ntfs/super.c | 6 +- fs/ocfs2/localalloc.c | 2 +- fs/ocfs2/ocfs2.h | 10 +- fs/ocfs2/suballoc.c | 12 +- fs/ocfs2/super.c | 20 +- fs/pipe.c | 72 +- fs/posix_acl.c | 4 +- fs/proc/array.c | 20 + fs/proc/base.c | 4 +- fs/proc/kcore.c | 34 +- fs/proc/meminfo.c | 2 +- fs/proc/nommu.c | 2 +- fs/proc/proc_sysctl.c | 26 +- fs/proc/task_mmu.c | 39 +- fs/proc/task_nommu.c | 4 +- fs/proc/vmcore.c | 16 +- fs/qnx6/qnx6.h | 4 +- fs/quota/netlink.c | 4 +- fs/read_write.c | 2 +- fs/reiserfs/do_balan.c | 2 +- fs/reiserfs/procfs.c | 2 +- fs/reiserfs/reiserfs.h | 4 +- fs/seq_file.c | 4 +- fs/splice.c | 43 +- fs/squashfs/xattr.c | 12 +- fs/sysv/sysv.h | 2 +- fs/tracefs/inode.c | 8 +- fs/udf/misc.c | 2 +- fs/ufs/swab.h | 4 +- fs/userfaultfd.c | 2 +- fs/xattr.c | 21 + fs/xfs/libxfs/xfs_bmap.c | 2 +- fs/xfs/xfs_dir2_readdir.c | 7 +- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_linux.h | 4 +- include/asm-generic/4level-fixup.h | 2 + include/asm-generic/atomic-long.h | 156 +- include/asm-generic/atomic64.h | 12 + include/asm-generic/bitops/__fls.h | 2 +- include/asm-generic/bitops/fls.h | 2 +- include/asm-generic/bitops/fls64.h | 4 +- include/asm-generic/bug.h | 6 +- include/asm-generic/cache.h | 4 +- include/asm-generic/emergency-restart.h | 2 +- include/asm-generic/kmap_types.h | 4 +- include/asm-generic/local.h | 13 + include/asm-generic/pgtable-nopmd.h | 18 +- include/asm-generic/pgtable-nopud.h | 15 +- include/asm-generic/pgtable.h | 16 + include/asm-generic/sections.h | 1 + include/asm-generic/uaccess.h | 16 + include/asm-generic/vmlinux.lds.h | 15 +- include/crypto/algapi.h | 2 +- include/drm/drmP.h | 16 +- include/drm/drm_crtc_helper.h | 2 +- include/drm/drm_mm.h | 2 +- include/drm/i915_pciids.h | 2 +- include/drm/intel-gtt.h | 4 +- include/drm/ttm/ttm_memory.h | 2 +- include/drm/ttm/ttm_page_alloc.h | 1 + include/keys/asymmetric-subtype.h | 2 +- include/linux/atmdev.h | 4 +- include/linux/atomic.h | 17 +- include/linux/audit.h | 2 +- include/linux/average.h | 2 +- include/linux/binfmts.h | 3 +- include/linux/bitmap.h | 2 +- include/linux/bitops.h | 8 +- include/linux/blkdev.h | 2 +- include/linux/blktrace_api.h | 2 +- include/linux/cache.h | 8 + include/linux/cdrom.h | 1 - include/linux/cleancache.h | 2 +- include/linux/clk-provider.h | 1 + include/linux/compat.h | 6 +- include/linux/compiler-gcc.h | 28 +- include/linux/compiler.h | 157 +- include/linux/configfs.h | 2 +- include/linux/cpufreq.h | 3 +- include/linux/cpuidle.h | 5 +- include/linux/cpumask.h | 14 +- include/linux/crypto.h | 4 +- include/linux/ctype.h | 2 +- include/linux/dcache.h | 4 +- include/linux/decompress/mm.h | 2 +- include/linux/devfreq.h | 2 +- include/linux/device.h | 7 +- include/linux/dma-mapping.h | 2 +- include/linux/efi.h | 1 + include/linux/elf.h | 2 + include/linux/err.h | 4 +- include/linux/extcon.h | 2 +- include/linux/fb.h | 3 +- include/linux/fdtable.h | 2 +- include/linux/fs.h | 5 +- include/linux/fs_struct.h | 2 +- include/linux/fscache-cache.h | 2 +- include/linux/fscache.h | 2 +- include/linux/fsnotify.h | 2 +- include/linux/genhd.h | 4 +- include/linux/genl_magic_func.h | 2 +- include/linux/gfp.h | 12 +- include/linux/highmem.h | 12 + include/linux/hwmon-sysfs.h | 6 +- include/linux/i2c.h | 1 + include/linux/if_pppox.h | 2 +- include/linux/init.h | 12 +- include/linux/init_task.h | 7 + include/linux/interrupt.h | 6 +- include/linux/iommu.h | 2 +- include/linux/ioport.h | 2 +- include/linux/ipc.h | 2 +- include/linux/irq.h | 5 +- include/linux/irqdesc.h | 2 +- include/linux/irqdomain.h | 3 + include/linux/jiffies.h | 16 +- include/linux/key-type.h | 2 +- include/linux/kgdb.h | 6 +- include/linux/kmemleak.h | 4 +- include/linux/kobject.h | 3 +- include/linux/kobject_ns.h | 2 +- include/linux/kref.h | 2 +- include/linux/libata.h | 2 +- include/linux/linkage.h | 1 + include/linux/list.h | 15 + include/linux/lockref.h | 26 +- include/linux/math64.h | 10 +- include/linux/mempolicy.h | 7 + include/linux/mm.h | 102 +- include/linux/mm_types.h | 20 + include/linux/mmiotrace.h | 4 +- include/linux/mmzone.h | 2 +- include/linux/mod_devicetable.h | 4 +- include/linux/module.h | 69 +- include/linux/moduleloader.h | 16 + include/linux/moduleparam.h | 4 +- include/linux/net.h | 2 +- include/linux/netdevice.h | 7 +- include/linux/netfilter.h | 2 +- include/linux/netfilter/nfnetlink.h | 2 +- include/linux/nls.h | 4 +- include/linux/notifier.h | 3 +- include/linux/oprofile.h | 4 +- include/linux/padata.h | 2 +- include/linux/pci_hotplug.h | 3 +- include/linux/percpu.h | 2 +- include/linux/perf_event.h | 12 +- include/linux/pipe_fs_i.h | 8 +- include/linux/pm.h | 1 + include/linux/pm_domain.h | 4 +- include/linux/pm_runtime.h | 2 +- include/linux/pnp.h | 2 +- include/linux/poison.h | 4 +- include/linux/power/smartreflex.h | 2 +- include/linux/ppp-comp.h | 2 +- include/linux/preempt.h | 21 + include/linux/proc_ns.h | 2 +- include/linux/psci.h | 2 +- include/linux/quota.h | 2 +- include/linux/random.h | 19 +- include/linux/rculist.h | 16 + include/linux/reboot.h | 14 +- include/linux/regset.h | 3 +- include/linux/relay.h | 2 +- include/linux/rio.h | 2 +- include/linux/rmap.h | 4 +- include/linux/sched.h | 72 +- include/linux/sched/sysctl.h | 1 + include/linux/semaphore.h | 2 +- include/linux/seq_file.h | 1 + include/linux/signal.h | 2 +- include/linux/skbuff.h | 12 +- include/linux/slab.h | 47 +- include/linux/slab_def.h | 14 +- include/linux/slub_def.h | 2 +- include/linux/smp.h | 2 + include/linux/sock_diag.h | 2 +- include/linux/sonet.h | 2 +- include/linux/sunrpc/addr.h | 8 +- include/linux/sunrpc/clnt.h | 2 +- include/linux/sunrpc/svc.h | 2 +- include/linux/sunrpc/svc_rdma.h | 18 +- include/linux/sunrpc/svcauth.h | 2 +- include/linux/swapops.h | 10 +- include/linux/swiotlb.h | 3 +- include/linux/syscalls.h | 21 +- include/linux/syscore_ops.h | 2 +- include/linux/sysctl.h | 3 +- include/linux/sysfs.h | 9 +- include/linux/sysrq.h | 3 +- include/linux/tcp.h | 14 +- include/linux/thread_info.h | 7 + include/linux/tty.h | 4 +- include/linux/tty_driver.h | 2 +- include/linux/tty_ldisc.h | 2 +- include/linux/types.h | 16 + include/linux/uaccess.h | 6 +- include/linux/uio_driver.h | 2 +- include/linux/unaligned/access_ok.h | 24 +- include/linux/usb.h | 12 +- include/linux/usb/hcd.h | 1 + include/linux/usb/renesas_usbhs.h | 2 +- include/linux/vermagic.h | 21 +- include/linux/vga_switcheroo.h | 8 +- include/linux/vmalloc.h | 7 +- include/linux/vmstat.h | 24 +- include/linux/xattr.h | 5 +- include/linux/zlib.h | 3 +- include/media/v4l2-dev.h | 2 +- include/media/v4l2-device.h | 2 +- include/net/9p/transport.h | 2 +- include/net/bluetooth/l2cap.h | 2 +- include/net/bonding.h | 2 +- include/net/caif/cfctrl.h | 6 +- include/net/flow.h | 2 +- include/net/genetlink.h | 2 +- include/net/gro_cells.h | 2 +- include/net/inet_connection_sock.h | 2 +- include/net/inet_sock.h | 2 +- include/net/inetpeer.h | 2 +- include/net/ip_fib.h | 2 +- include/net/ip_vs.h | 8 +- include/net/ipv6.h | 2 +- include/net/irda/ircomm_tty.h | 1 + include/net/iucv/af_iucv.h | 2 +- include/net/llc_c_ac.h | 2 +- include/net/llc_c_ev.h | 4 +- include/net/llc_c_st.h | 2 +- include/net/llc_s_ac.h | 2 +- include/net/llc_s_st.h | 2 +- include/net/mac80211.h | 4 +- include/net/neighbour.h | 2 +- include/net/net_namespace.h | 18 +- include/net/netlink.h | 2 +- include/net/netns/conntrack.h | 6 +- include/net/netns/ipv4.h | 4 +- include/net/netns/ipv6.h | 4 +- include/net/netns/xfrm.h | 2 +- include/net/ping.h | 2 +- include/net/protocol.h | 4 +- include/net/rtnetlink.h | 2 +- include/net/sctp/checksum.h | 4 +- include/net/sctp/sm.h | 4 +- include/net/sctp/structs.h | 2 +- include/net/sock.h | 12 +- include/net/tcp.h | 8 +- include/net/xfrm.h | 13 +- include/rdma/iw_cm.h | 2 +- include/scsi/libfc.h | 3 +- include/scsi/scsi_device.h | 6 +- include/scsi/scsi_driver.h | 2 +- include/scsi/scsi_transport_fc.h | 3 +- include/scsi/sg.h | 2 +- include/sound/compress_driver.h | 2 +- include/sound/soc.h | 4 +- include/trace/events/irq.h | 4 +- include/uapi/linux/a.out.h | 8 + include/uapi/linux/bcache.h | 5 +- include/uapi/linux/byteorder/little_endian.h | 28 +- include/uapi/linux/connector.h | 2 +- include/uapi/linux/elf.h | 28 + include/uapi/linux/screen_info.h | 3 +- include/uapi/linux/swab.h | 6 +- include/uapi/linux/xattr.h | 4 + include/video/udlfb.h | 8 +- include/video/uvesafb.h | 1 + init/Kconfig | 2 +- init/Makefile | 3 + init/do_mounts.c | 14 +- init/do_mounts.h | 8 +- init/do_mounts_initrd.c | 30 +- init/do_mounts_md.c | 6 +- init/init_task.c | 4 + init/initramfs.c | 38 +- init/main.c | 30 +- ipc/compat.c | 4 +- ipc/ipc_sysctl.c | 8 +- ipc/mq_sysctl.c | 4 +- ipc/sem.c | 4 +- ipc/shm.c | 6 + kernel/audit.c | 8 +- kernel/auditsc.c | 4 +- kernel/bpf/core.c | 7 +- kernel/capability.c | 3 + kernel/compat.c | 38 +- kernel/debug/debug_core.c | 16 +- kernel/debug/kdb/kdb_main.c | 4 +- kernel/events/core.c | 26 +- kernel/events/internal.h | 10 +- kernel/events/uprobes.c | 2 +- kernel/exit.c | 2 +- kernel/fork.c | 167 +- kernel/futex.c | 11 +- kernel/futex_compat.c | 2 +- kernel/gcov/base.c | 7 +- kernel/irq/manage.c | 2 +- kernel/irq/msi.c | 19 +- kernel/irq/spurious.c | 2 +- kernel/jump_label.c | 5 + kernel/kallsyms.c | 37 +- kernel/kexec.c | 3 +- kernel/kmod.c | 8 +- kernel/kprobes.c | 4 +- kernel/ksysfs.c | 2 +- kernel/locking/lockdep.c | 7 +- kernel/locking/mutex-debug.c | 12 +- kernel/locking/mutex-debug.h | 4 +- kernel/locking/mutex.c | 6 +- kernel/module.c | 422 +- kernel/notifier.c | 17 +- kernel/padata.c | 4 +- kernel/panic.c | 5 +- kernel/pid.c | 2 +- kernel/pid_namespace.c | 2 +- kernel/power/process.c | 12 +- kernel/profile.c | 14 +- kernel/ptrace.c | 8 +- kernel/rcu/rcutorture.c | 60 +- kernel/rcu/tiny.c | 4 +- kernel/rcu/tree.c | 44 +- kernel/rcu/tree.h | 14 +- kernel/rcu/tree_plugin.h | 14 +- kernel/rcu/tree_trace.c | 12 +- kernel/sched/auto_group.c | 4 +- kernel/sched/core.c | 45 +- kernel/sched/fair.c | 2 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 12 +- kernel/smpboot.c | 4 +- kernel/softirq.c | 12 +- kernel/sys.c | 10 +- kernel/sysctl.c | 34 +- kernel/time/alarmtimer.c | 2 +- kernel/time/posix-cpu-timers.c | 4 +- kernel/time/posix-timers.c | 24 +- kernel/time/timer.c | 2 +- kernel/time/timer_stats.c | 10 +- kernel/trace/blktrace.c | 6 +- kernel/trace/ftrace.c | 15 +- kernel/trace/ring_buffer.c | 96 +- kernel/trace/trace.c | 2 +- kernel/trace/trace.h | 2 +- kernel/trace/trace_clock.c | 4 +- kernel/trace/trace_events.c | 1 - kernel/trace/trace_functions_graph.c | 4 +- kernel/trace/trace_mmiotrace.c | 8 +- kernel/trace/trace_output.c | 10 +- kernel/trace/trace_seq.c | 2 +- kernel/trace/trace_stack.c | 2 +- kernel/user_namespace.c | 2 +- kernel/utsname_sysctl.c | 2 +- kernel/watchdog.c | 2 +- kernel/workqueue.c | 2 +- lib/Kconfig.debug | 8 +- lib/Makefile | 2 +- lib/bitmap.c | 8 +- lib/bug.c | 2 + lib/debugobjects.c | 2 +- lib/decompress_bunzip2.c | 3 +- lib/decompress_unlzma.c | 4 +- lib/div64.c | 4 +- lib/dma-debug.c | 4 +- lib/inflate.c | 2 +- lib/ioremap.c | 4 +- lib/kobject.c | 4 +- lib/list_debug.c | 126 +- lib/lockref.c | 44 +- lib/percpu-refcount.c | 2 +- lib/radix-tree.c | 2 +- lib/random32.c | 2 +- lib/show_mem.c | 2 +- lib/strncpy_from_user.c | 2 +- lib/strnlen_user.c | 2 +- lib/swiotlb.c | 2 +- lib/usercopy.c | 6 + lib/vsprintf.c | 12 +- mm/Kconfig | 6 +- mm/backing-dev.c | 4 +- mm/debug.c | 3 + mm/filemap.c | 2 +- mm/gup.c | 13 +- mm/highmem.c | 6 +- mm/hugetlb.c | 70 +- mm/internal.h | 1 + mm/maccess.c | 4 +- mm/madvise.c | 37 + mm/memory-failure.c | 6 +- mm/memory.c | 424 +- mm/mempolicy.c | 25 + mm/mlock.c | 15 +- mm/mm_init.c | 2 +- mm/mmap.c | 582 +- mm/mprotect.c | 137 +- mm/mremap.c | 39 +- mm/nommu.c | 21 +- mm/page-writeback.c | 2 +- mm/page_alloc.c | 49 +- mm/percpu.c | 2 +- mm/process_vm_access.c | 14 +- mm/rmap.c | 45 +- mm/shmem.c | 19 +- mm/slab.c | 109 +- mm/slab.h | 22 +- mm/slab_common.c | 86 +- mm/slob.c | 218 +- mm/slub.c | 102 +- mm/sparse-vmemmap.c | 4 +- mm/sparse.c | 2 +- mm/swap.c | 2 + mm/swapfile.c | 12 +- mm/util.c | 6 + mm/vmalloc.c | 114 +- mm/vmstat.c | 12 +- net/8021q/vlan.c | 5 +- net/8021q/vlan_netlink.c | 2 +- net/9p/mod.c | 4 +- net/9p/trans_fd.c | 2 +- net/atm/atm_misc.c | 8 +- net/atm/lec.h | 2 +- net/atm/proc.c | 6 +- net/atm/resources.c | 4 +- net/ax25/sysctl_net_ax25.c | 2 +- net/batman-adv/bat_iv_ogm.c | 8 +- net/batman-adv/fragmentation.c | 2 +- net/batman-adv/soft-interface.c | 8 +- net/batman-adv/types.h | 6 +- net/bluetooth/hci_sock.c | 2 +- net/bluetooth/l2cap_core.c | 6 +- net/bluetooth/l2cap_sock.c | 12 +- net/bluetooth/rfcomm/sock.c | 4 +- net/bluetooth/rfcomm/tty.c | 4 +- net/bridge/br_netlink.c | 2 +- net/bridge/netfilter/ebtables.c | 6 +- net/caif/cfctrl.c | 11 +- net/caif/chnl_net.c | 2 +- net/can/af_can.c | 2 +- net/can/gw.c | 6 +- net/ceph/messenger.c | 4 +- net/compat.c | 24 +- net/core/datagram.c | 2 +- net/core/dev.c | 16 +- net/core/filter.c | 2 +- net/core/flow.c | 6 +- net/core/neighbour.c | 4 +- net/core/net-sysfs.c | 2 +- net/core/net_namespace.c | 8 +- net/core/netpoll.c | 4 +- net/core/rtnetlink.c | 15 +- net/core/scm.c | 14 +- net/core/skbuff.c | 8 +- net/core/sock.c | 28 +- net/core/sock_diag.c | 15 +- net/core/sysctl_net_core.c | 22 +- net/decnet/af_decnet.c | 1 + net/decnet/sysctl_net_decnet.c | 4 +- net/dsa/dsa.c | 2 +- net/hsr/hsr_netlink.c | 2 +- net/ieee802154/6lowpan/core.c | 2 +- net/ieee802154/6lowpan/reassembly.c | 14 +- net/ipv4/af_inet.c | 2 +- net/ipv4/devinet.c | 18 +- net/ipv4/fib_frontend.c | 6 +- net/ipv4/fib_semantics.c | 2 +- net/ipv4/inet_connection_sock.c | 4 +- net/ipv4/inet_timewait_sock.c | 2 +- net/ipv4/inetpeer.c | 2 +- net/ipv4/ip_fragment.c | 15 +- net/ipv4/ip_gre.c | 6 +- net/ipv4/ip_sockglue.c | 2 +- net/ipv4/ip_vti.c | 4 +- net/ipv4/ipconfig.c | 6 +- net/ipv4/ipip.c | 4 +- net/ipv4/netfilter/arp_tables.c | 12 +- net/ipv4/netfilter/ip_tables.c | 12 +- net/ipv4/ping.c | 14 +- net/ipv4/raw.c | 14 +- net/ipv4/route.c | 32 +- net/ipv4/sysctl_net_ipv4.c | 22 +- net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_probe.c | 2 +- net/ipv4/udp.c | 10 +- net/ipv4/xfrm4_policy.c | 18 +- net/ipv6/addrconf.c | 18 +- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/icmp.c | 2 +- net/ipv6/ip6_fib.c | 4 +- net/ipv6/ip6_gre.c | 10 +- net/ipv6/ip6_tunnel.c | 4 +- net/ipv6/ip6_vti.c | 4 +- net/ipv6/ipv6_sockglue.c | 2 +- net/ipv6/netfilter/ip6_tables.c | 12 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 14 +- net/ipv6/ping.c | 33 +- net/ipv6/raw.c | 17 +- net/ipv6/reassembly.c | 13 +- net/ipv6/route.c | 2 +- net/ipv6/sit.c | 4 +- net/ipv6/sysctl_net_ipv6.c | 2 +- net/ipv6/udp.c | 6 +- net/ipv6/xfrm6_policy.c | 17 +- net/irda/ircomm/ircomm_tty.c | 18 +- net/iucv/af_iucv.c | 4 +- net/iucv/iucv.c | 2 +- net/key/af_key.c | 4 +- net/l2tp/l2tp_eth.c | 38 +- net/l2tp/l2tp_ip.c | 2 +- net/l2tp/l2tp_ip6.c | 2 +- net/mac80211/cfg.c | 8 +- net/mac80211/ieee80211_i.h | 3 +- net/mac80211/iface.c | 20 +- net/mac80211/main.c | 2 +- net/mac80211/pm.c | 4 +- net/mac80211/rate.c | 2 +- net/mac80211/sta_info.c | 2 +- net/mac80211/util.c | 8 +- net/mpls/af_mpls.c | 6 +- net/netfilter/ipset/ip_set_core.c | 2 +- net/netfilter/ipvs/ip_vs_conn.c | 6 +- net/netfilter/ipvs/ip_vs_core.c | 4 +- net/netfilter/ipvs/ip_vs_ctl.c | 14 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 2 +- net/netfilter/ipvs/ip_vs_sync.c | 6 +- net/netfilter/ipvs/ip_vs_xmit.c | 4 +- net/netfilter/nf_conntrack_acct.c | 2 +- net/netfilter/nf_conntrack_ecache.c | 2 +- net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_proto.c | 2 +- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_conntrack_timestamp.c | 2 +- net/netfilter/nf_log.c | 10 +- net/netfilter/nf_sockopt.c | 4 +- net/netfilter/nfnetlink_log.c | 4 +- net/netfilter/nft_compat.c | 9 +- net/netfilter/xt_statistic.c | 8 +- net/netlink/af_netlink.c | 4 +- net/openvswitch/vport-internal_dev.c | 2 +- net/packet/af_packet.c | 8 +- net/phonet/pep.c | 6 +- net/phonet/socket.c | 2 +- net/phonet/sysctl.c | 2 +- net/rds/cong.c | 6 +- net/rds/ib.h | 2 +- net/rds/ib_cm.c | 2 +- net/rds/ib_recv.c | 4 +- net/rds/iw.h | 2 +- net/rds/iw_cm.c | 2 +- net/rds/iw_recv.c | 4 +- net/rds/rds.h | 2 +- net/rds/tcp.c | 2 +- net/rds/tcp_send.c | 2 +- net/rxrpc/af_rxrpc.c | 2 +- net/rxrpc/ar-ack.c | 14 +- net/rxrpc/ar-call.c | 2 +- net/rxrpc/ar-connection.c | 2 +- net/rxrpc/ar-connevent.c | 2 +- net/rxrpc/ar-input.c | 4 +- net/rxrpc/ar-internal.h | 8 +- net/rxrpc/ar-local.c | 2 +- net/rxrpc/ar-output.c | 4 +- net/rxrpc/ar-peer.c | 2 +- net/rxrpc/ar-proc.c | 4 +- net/rxrpc/ar-transport.c | 2 +- net/rxrpc/rxkad.c | 4 +- net/sched/sch_generic.c | 4 +- net/sctp/ipv6.c | 6 +- net/sctp/protocol.c | 10 +- net/sctp/sm_sideeffect.c | 2 +- net/sctp/socket.c | 21 +- net/sctp/sysctl.c | 10 +- net/socket.c | 18 +- net/sunrpc/auth_gss/svcauth_gss.c | 4 +- net/sunrpc/clnt.c | 4 +- net/sunrpc/sched.c | 4 +- net/sunrpc/svc.c | 4 +- net/sunrpc/svcauth_unix.c | 2 +- net/sunrpc/xprtrdma/svc_rdma.c | 38 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 +- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_transport.c | 10 +- net/tipc/netlink_compat.c | 12 +- net/tipc/subscr.c | 2 +- net/unix/af_unix.c | 7 +- net/unix/sysctl_net_unix.c | 2 +- net/wireless/wext-core.c | 19 +- net/xfrm/xfrm_policy.c | 16 +- net/xfrm/xfrm_state.c | 33 +- net/xfrm/xfrm_sysctl.c | 2 +- scripts/Kbuild.include | 2 +- scripts/Makefile.build | 2 +- scripts/Makefile.clean | 3 +- scripts/Makefile.host | 69 +- scripts/basic/fixdep.c | 12 +- scripts/dtc/checks.c | 14 +- scripts/dtc/data.c | 6 +- scripts/dtc/flattree.c | 8 +- scripts/dtc/livetree.c | 4 +- scripts/gcc-plugin.sh | 51 + scripts/headers_install.sh | 1 + scripts/kallsyms.c | 4 +- scripts/kconfig/lkc.h | 5 +- scripts/kconfig/menu.c | 2 +- scripts/kconfig/symbol.c | 6 +- scripts/link-vmlinux.sh | 2 +- scripts/mod/file2alias.c | 14 +- scripts/mod/modpost.c | 25 +- scripts/mod/modpost.h | 6 +- scripts/mod/sumversion.c | 2 +- scripts/module-common.lds | 4 + scripts/package/builddeb | 1 + scripts/pnmtologo.c | 6 +- scripts/sortextable.h | 6 +- scripts/tags.sh | 2 +- security/Kconfig | 692 +- security/integrity/ima/ima.h | 4 +- security/integrity/ima/ima_api.c | 2 +- security/integrity/ima/ima_fs.c | 4 +- security/integrity/ima/ima_queue.c | 2 +- security/keys/key.c | 18 +- security/selinux/avc.c | 6 +- security/selinux/include/xfrm.h | 2 +- security/yama/yama_lsm.c | 2 +- sound/aoa/codecs/onyx.c | 7 +- sound/aoa/codecs/onyx.h | 1 + sound/core/oss/pcm_oss.c | 18 +- sound/core/pcm_compat.c | 2 +- sound/core/pcm_native.c | 4 +- sound/core/sound.c | 2 +- sound/drivers/mts64.c | 14 +- sound/drivers/opl4/opl4_lib.c | 2 +- sound/drivers/portman2x4.c | 3 +- sound/firewire/amdtp.c | 4 +- sound/firewire/amdtp.h | 4 +- sound/firewire/isight.c | 10 +- sound/firewire/scs1x.c | 8 +- sound/oss/sb_audio.c | 2 +- sound/oss/swarm_cs4297a.c | 6 +- sound/pci/hda/hda_codec.c | 2 +- sound/pci/ymfpci/ymfpci.h | 2 +- sound/pci/ymfpci/ymfpci_main.c | 12 +- sound/soc/codecs/sti-sas.c | 10 +- sound/soc/soc-ac97.c | 6 +- sound/soc/xtensa/xtfpga-i2s.c | 2 +- tools/gcc/Makefile | 42 + tools/gcc/checker_plugin.c | 150 + tools/gcc/colorize_plugin.c | 215 + tools/gcc/constify_plugin.c | 571 + tools/gcc/gcc-common.h | 812 + tools/gcc/initify_plugin.c | 552 + tools/gcc/kallocstat_plugin.c | 188 + tools/gcc/kernexec_plugin.c | 549 + tools/gcc/latent_entropy_plugin.c | 470 + tools/gcc/size_overflow_plugin/.gitignore | 2 + tools/gcc/size_overflow_plugin/Makefile | 28 + .../disable_size_overflow_hash.data |12422 ++++++++++++ .../generate_size_overflow_hash.sh | 103 + .../insert_size_overflow_asm.c | 416 + .../size_overflow_plugin/intentional_overflow.c | 1010 + .../size_overflow_plugin/remove_unnecessary_dup.c | 137 + tools/gcc/size_overflow_plugin/size_overflow.h | 323 + .../gcc/size_overflow_plugin/size_overflow_debug.c | 194 + .../size_overflow_plugin/size_overflow_hash.data |20735 ++++++++++++++++++++ .../size_overflow_hash_aux.data | 92 + tools/gcc/size_overflow_plugin/size_overflow_ipa.c | 1226 ++ .../gcc/size_overflow_plugin/size_overflow_misc.c | 505 + .../size_overflow_plugin/size_overflow_plugin.c | 318 + .../size_overflow_plugin_hash.c | 352 + .../size_overflow_plugin/size_overflow_transform.c | 749 + .../size_overflow_transform_core.c | 1010 + tools/gcc/stackleak_plugin.c | 436 + tools/gcc/structleak_plugin.c | 287 + tools/include/linux/compiler.h | 8 + tools/lib/api/Makefile | 2 +- tools/perf/util/include/asm/alternative-asm.h | 3 + tools/virtio/linux/uaccess.h | 2 +- virt/kvm/kvm_main.c | 42 +- 1944 files changed, 66925 insertions(+), 8949 deletions(-)