commit b0b41430a8c9e6e5067c896c07d361e527e298e8 Author: Brad Spengler Date: Sat May 21 13:59:19 2016 -0400 Fix gcc assert properly, from Emese Revfy tools/gcc/size_overflow_plugin/intentional_overflow.c | 2 +- tools/gcc/size_overflow_plugin/size_overflow_plugin.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 5e7a47f06420603b0f26f1b45fe2ab02838795c9 Merge: f844209 5929595 Author: Brad Spengler Date: Fri May 20 20:19:27 2016 -0400 Merge branch 'pax-test' into grsec-test commit 5929595ec558e9282901842bdf9e4a981751fb08 Author: Brad Spengler Date: Fri May 20 20:18:58 2016 -0400 Update to pax-linux-4.5.5-test9.patch: - fixed a few more incorrect fptr casts for RAP arch/x86/math-emu/fpu_etc.c | 9 +++++++-- arch/x86/math-emu/fpu_trig.c | 13 +++++++++---- arch/x86/math-emu/reg_constant.c | 7 ++++++- drivers/isdn/hisax/hfc_2bds0.c | 4 ++-- drivers/isdn/hisax/hfcscard.c | 6 ++++-- drivers/isdn/hisax/saphir.c | 5 +++-- drivers/isdn/hisax/teleint.c | 5 +++-- drivers/media/pci/sta2x11/sta2x11_vip.c | 5 +++-- drivers/net/hamradio/baycom_epp.c | 2 +- 9 files changed, 38 insertions(+), 18 deletions(-) commit f84420916698cdf33a81f046206d050e2c3e6966 Merge: fa18ce2 445754e Author: Brad Spengler Date: Fri May 20 18:52:20 2016 -0400 Merge branch 'pax-test' into grsec-test commit 445754e5717176c2b3431a0cde1e90df51cc43e2 Author: Brad Spengler Date: Fri May 20 18:51:52 2016 -0400 Update to pax-linux-4.5.4-test8.patch: - fixed a USERCOPY report in the mwifiex driver, by Dennis Wassenberg and Mathias Krause drivers/net/wireless/marvell/mwifiex/11n_aggr.c | 2 +- drivers/net/wireless/marvell/mwifiex/pcie.c | 4 ++-- drivers/net/wireless/marvell/mwifiex/sdio.c | 10 ++++------ 3 files changed, 7 insertions(+), 9 deletions(-) commit fa18ce2d37a92442162fb72b8f85ee86120ffacb Author: Brad Spengler Date: Thu May 19 18:30:08 2016 -0400 Update size_overflow hash, from Dr. Toth tools/gcc/size_overflow_plugin/size_overflow_hash.data | 1 + 1 file changed, 1 insertion(+) commit 61c487965dbc34618fe292663759d6fa0515bcad Merge: fbc84d2 a734dbd Author: Brad Spengler Date: Thu May 19 06:26:52 2016 -0400 Merge branch 'pax-test' into grsec-test commit a734dbda8b785c38baa1858df2bffc89b45d070a Merge: 238dfca 3b41b7e Author: Brad Spengler Date: Thu May 19 06:24:25 2016 -0400 Merge branch 'linux-4.5.y' into pax-test commit fbc84d202d311b4dc09bcc922678df60b6e76614 Merge: 84fa82c 238dfca Author: Brad Spengler Date: Fri May 13 18:00:06 2016 -0400 Merge branch 'pax-test' into grsec-test commit 238dfca3ffe87f4410e67c8ceb554b9ce4f3132b Author: Brad Spengler Date: Fri May 13 17:59:42 2016 -0400 Compile fix for older gcc tools/gcc/size_overflow_plugin/intentional_overflow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 84fa82c59fa5051e1485a3dcc857b87b70dbc18d Merge: 2cece8e 4654023 Author: Brad Spengler Date: Fri May 13 17:31:49 2016 -0400 Merge branch 'pax-test' into grsec-test commit 4654023e72b0834142594eee879e657664498443 Author: Brad Spengler Date: Fri May 13 17:29:38 2016 -0400 Update to pax-linux-4.5.4-test7.patch: - changed the RAP hash emission code to accomodate x86 disassemblers, suggested by Mathias Krause - fixed a few size overflow false positives in JFS due to the lack of endian conversion macros for signed types, reported by ryonaloli via hunger - fixed a compiler assert triggered by the size overflow plugin tools/gcc/rap_plugin/rap_plugin.c | 39 ++++++++++++++++++---- .../disable_size_overflow_hash.data | 3 ++ .../size_overflow_plugin/intentional_overflow.c | 2 +- .../size_overflow_plugin/size_overflow_hash.data | 3 -- 4 files changed, 36 insertions(+), 11 deletions(-) commit 2cece8e8e0e2fce9943345c0ebebd7436929868e Merge: 6df0471 ea68d2e Author: Brad Spengler Date: Thu May 12 18:41:15 2016 -0400 Merge branch 'pax-test' into grsec-test commit ea68d2e7123a83aba24db99d5ef487b1397fd6d0 Author: Brad Spengler Date: Thu May 12 18:40:50 2016 -0400 Update to pax-linux-4.5.3-test6.patch: - really fixed https://forums.grsecurity.net/viewtopic.php?f=3&t=4473 - the nfsd_proc_read fix for RAP had a typo causing an oops, reported by Carlos Carvalho (https://forums.grsecurity.net/viewtopic.php?f=3&t=4471) - fixed a few format string warnings in the RAP hash emission code, reported by Dwokfur drivers/net/ppp/pptp.c | 1 - fs/nfsd/nfsproc.c | 2 +- tools/gcc/rap_plugin/rap_fptr_pass.c | 2 +- tools/gcc/rap_plugin/rap_plugin.c | 14 ++++++++++---- 4 files changed, 12 insertions(+), 7 deletions(-) commit 6df04719a7cf4d3f60c9e6190f8eb4b986ce2b1b Author: David Howells Date: Tue Feb 23 11:03:12 2016 +0000 KEYS: Fix ASN.1 indefinite length object parsing This fixes CVE-2016-0758. In the ASN.1 decoder, when the length field of an ASN.1 value is extracted, it isn't validated against the remaining amount of data before being added to the cursor. With a sufficiently large size indicated, the check: datalen - dp < 2 may then fail due to integer overflow. Fix this by checking the length indicated against the amount of remaining data in both places a definite length is determined. Whilst we're at it, make the following changes: (1) Check the maximum size of extended length does not exceed the capacity of the variable it's being stored in (len) rather than the type that variable is assumed to be (size_t). (2) Compare the EOC tag to the symbolic constant ASN1_EOC rather than the integer 0. (3) To reduce confusion, move the initialisation of len outside of: for (len = 0; n > 0; n--) { since it doesn't have anything to do with the loop counter n. Signed-off-by: David Howells Reviewed-by: Mimi Zohar Acked-by: David Woodhouse Acked-by: Peter Jones lib/asn1_decoder.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit acb6cef8047476b8afc3ff3f07286b9e36de1b77 Merge: 735f14a a7c9bec Author: Brad Spengler Date: Wed May 11 17:05:21 2016 -0400 Merge branch 'pax-test' into grsec-test commit a7c9bec57dea73ceee1246a64df55038ea840be9 Merge: f5bd134 a29ab35 Author: Brad Spengler Date: Wed May 11 17:04:48 2016 -0400 Merge branch 'linux-4.5.y' into pax-test commit 735f14a2b5562cd1329b263a81781d59dacffd3e Author: Brad Spengler Date: Wed May 11 06:57:40 2016 -0400 Fix typo in nfsd RAP changes causing oops reported by Carlos Carvalho at: https://forums.grsecurity.net/viewtopic.php?f=3&t=4471 fs/nfsd/nfsproc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 35e1e615072d0bb885b38ee1b2ada7a0a6a91f9d Merge: 9e3e5ae3e f5bd134 Author: Brad Spengler Date: Tue May 10 20:56:54 2016 -0400 Merge branch 'pax-test' into grsec-test commit f5bd1342fa631bb3b69a2e8919785c827c4edf74 Author: Brad Spengler Date: Tue May 10 20:55:57 2016 -0400 Update to pax-linux-4.5.3-test5.patch: - marked all indirectly callable x86 asm crypto functions, reported by Dwokfur and minipli (https://forums.grsecurity.net/viewtopic.php?f=3&t=4468) - worked around an intentional integer overflow introduced by gcc-6 that triggered a size overflow false positive, reported by hooruD, chron and Fen (https://forums.grsecurity.net/viewtopic.php?f=3&t=4469) - made some preparations for enabling RAP on i386 as well, will have to wait due to KERNEXEC arch/x86/crypto/aesni-intel_asm.S | 6 +++--- arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S | 4 ++-- arch/x86/crypto/sha-mb/sha1_mb_mgr_submit_avx2.S | 2 +- arch/x86/crypto/sha256_ni_asm.S | 2 +- arch/x86/crypto/twofish-i586-asm_32.S | 2 +- arch/x86/entry/common.c | 1 - include/linux/linkage.h | 22 +++++++++++++++------- tools/gcc/rap_plugin/rap_fptr_pass.c | 2 +- tools/gcc/rap_plugin/rap_hash.c | 1 + tools/gcc/rap_plugin/rap_plugin.c | 18 +++++++++--------- .../disable_size_overflow_hash.data | 1 + .../size_overflow_plugin/size_overflow_hash.data | 1 - 12 files changed, 35 insertions(+), 27 deletions(-) commit 9e3e5ae3e9ed69452d4133490dd1831376b9a1e8 Merge: e5983fd cfcaa03 Author: Brad Spengler Date: Sun May 8 08:04:18 2016 -0400 Merge branch 'pax-test' into grsec-test commit cfcaa036dd3756fc32e083a7c486c1143d93fd22 Author: Brad Spengler Date: Sun May 8 08:03:53 2016 -0400 Update to pax-linux-4.5.3-test4.patch: - fixed a few incorrect function types (mostly start_xmit callbacks) found by RAP, reported by cinder (https://forums.grsecurity.net/viewtopic.php?f=3&t=4466) drivers/char/tpm/tpm-chip.c | 7 ++++++- drivers/net/can/bfin_can.c | 2 +- drivers/net/can/flexcan.c | 2 +- drivers/net/ethernet/adi/bfin_mac.c | 2 +- drivers/net/ethernet/allwinner/sun4i-emac.c | 2 +- drivers/net/ethernet/amd/7990.c | 2 +- drivers/net/ethernet/amd/7990.h | 2 +- drivers/net/ethernet/amd/atarilance.c | 4 ++-- drivers/net/ethernet/amd/declance.c | 2 +- drivers/net/ethernet/amd/sun3lance.c | 4 ++-- drivers/net/ethernet/amd/sunlance.c | 2 +- drivers/net/ethernet/broadcom/bcm63xx_enet.c | 2 +- drivers/net/ethernet/davicom/dm9000.c | 2 +- drivers/net/ethernet/faraday/ftgmac100.c | 2 +- drivers/net/ethernet/faraday/ftmac100.c | 2 +- drivers/net/ethernet/freescale/fec_mpc52xx.c | 2 +- drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c | 2 +- drivers/net/ethernet/freescale/gianfar.c | 4 ++-- drivers/net/ethernet/freescale/ucc_geth.c | 2 +- drivers/net/ethernet/i825xx/lib82596.c | 4 ++-- drivers/net/ethernet/ibm/ehea/ehea_main.c | 2 +- drivers/net/ethernet/ibm/emac/core.c | 4 ++-- drivers/net/ethernet/micrel/ks8695net.c | 2 +- drivers/net/ethernet/moxa/moxart_ether.c | 2 +- drivers/net/ethernet/netx-eth.c | 2 +- drivers/net/ethernet/nuvoton/w90p910_ether.c | 2 +- drivers/net/ethernet/nxp/lpc_eth.c | 2 +- drivers/net/ethernet/seeq/sgiseeq.c | 2 +- drivers/net/ethernet/sgi/ioc3-eth.c | 4 ++-- drivers/net/ethernet/smsc/smc911x.c | 2 +- drivers/net/ethernet/smsc/smc91x.c | 2 +- drivers/net/ethernet/sun/sunbmac.c | 2 +- drivers/net/ethernet/sun/sunqe.c | 2 +- drivers/net/ethernet/sun/sunvnet.c | 10 +++++----- drivers/net/ethernet/ti/cpmac.c | 2 +- drivers/net/ethernet/ti/netcp_core.c | 2 +- drivers/net/ethernet/xilinx/ll_temac_main.c | 2 +- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +- drivers/net/xen-netback/interface.c | 2 +- drivers/net/xen-netfront.c | 2 +- 40 files changed, 55 insertions(+), 50 deletions(-) commit e5983fd19799feb3bf947cd0dc2b5435deee3332 Merge: 5ecb84f a235ecd Author: Brad Spengler Date: Sat May 7 00:00:42 2016 -0400 Merge branch 'pax-test' into grsec-test commit a235ecd8bdece417e83f9cf89c76607bf15955dc Author: Brad Spengler Date: Fri May 6 23:59:34 2016 -0400 Update to pax-linux-4.5.3-test3.patch: - fixed some more of PARAVIRT for RAP, reported by hunger - Emese increased the coverage of initify by marking up str* and mem* functions - added error reporting for refusing to load modules incompatible with KERNEXEC's 'or' method, reported by Martin Väth (https://bugs.gentoo.org/show_bug.cgi?id=581726) arch/arm/include/asm/string.h | 10 ++--- arch/arm64/include/asm/string.h | 22 +++++------ arch/x86/boot/string.h | 4 +- arch/x86/include/asm/string_32.h | 20 +++++----- arch/x86/include/asm/string_64.h | 16 ++++---- arch/x86/kernel/paravirt-spinlocks.c | 22 +++++++++-- arch/x86/xen/mmu.c | 6 ++- drivers/gpu/drm/gma500/mdfld_dsi_dpi.c | 10 ++--- include/linux/string.h | 70 +++++++++++++++++----------------- include/linux/syscalls.h | 2 +- kernel/module.c | 4 +- mm/fadvise.c | 2 +- tools/gcc/randomize_layout_seed.h | 1 - tools/gcc/rap_plugin/rap_plugin.c | 7 +++- 14 files changed, 109 insertions(+), 87 deletions(-) commit 5ecb84f55a9bdf8b39054c23d90646ba0591ce1c Author: Brad Spengler Date: Fri May 6 08:51:58 2016 -0400 Remove !PARAVIRT dependency on RAP security/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit eecd10d7c579d2601c384c1e9e0f062a8dda40e7 Author: Brad Spengler Date: Fri May 6 06:34:48 2016 -0400 Update copyright year tools/gcc/randomize_layout_plugin.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7d7e01439c2601abcae2ecfc66a883be258a2691 Merge: 3315e83 c2aa83b Author: Brad Spengler Date: Fri May 6 06:34:25 2016 -0400 Merge branch 'pax-test' into grsec-test commit c2aa83bf2d65989c262ff33312874ee7fe38606a Author: Brad Spengler Date: Fri May 6 06:34:04 2016 -0400 Update to pax-linux-4.5.2-test2.patch: - minipli fixed a few missing hunks left out from the 4.5 port - fixed a regression in handling user.pax.flags on tmpfs, reported by blueness and Stebalien (https://forums.grsecurity.net/viewtopic.php?f=3&t=4462) - fixed a few compile regressions on arm, reported by Wizzup - fixed PARAVIRT for RAP, reported by spender - fixed the very old PAGEEXEC/i386 TLB reload code for SMAP (not that it could work there), reported by spender - Emese fixed a false positive size overflow report caused by gcc-5 and newer, reported by quasar366 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4455) arch/arm/Kconfig | 2 +- arch/arm/include/asm/domain.h | 2 +- arch/arm/kernel/process.c | 6 + arch/mips/mm/mmap.c | 27 ++++ arch/powerpc/kernel/process.c | 39 +++++ arch/s390/kernel/process.c | 13 ++ arch/x86/entry/entry_32.S | 2 +- arch/x86/include/asm/fixmap.h | 2 +- arch/x86/kernel/paravirt.c | 90 +++++++++-- arch/x86/mm/fault.c | 2 + arch/x86/mm/pgtable.c | 2 +- drivers/cpufreq/intel_pstate.c | 2 +- drivers/gpu/drm/gma500/mdfld_dsi_dpi.c | 7 +- drivers/net/ethernet/8390/ax88796.c | 4 +- drivers/oprofile/oprofilefs.c | 4 +- drivers/platform/x86/thinkpad_acpi.c | 1 - fs/xattr.c | 2 +- include/asm-generic/atomic-long.h | 4 + include/uapi/linux/xattr.h | 3 +- kernel/module.c | 2 +- mm/shmem.c | 2 - security/Kconfig | 2 + .../insert_size_overflow_asm.c | 2 +- .../size_overflow_plugin/intentional_overflow.c | 80 ++++++++-- .../size_overflow_plugin/remove_unnecessary_dup.c | 2 +- tools/gcc/size_overflow_plugin/size_overflow.h | 8 +- .../gcc/size_overflow_plugin/size_overflow_debug.c | 2 +- tools/gcc/size_overflow_plugin/size_overflow_ipa.c | 2 +- .../gcc/size_overflow_plugin/size_overflow_misc.c | 2 +- .../size_overflow_plugin/size_overflow_plugin.c | 2 +- .../size_overflow_plugin_hash.c | 2 +- .../size_overflow_plugin/size_overflow_transform.c | 34 ++--- .../size_overflow_transform_core.c | 170 +++++++++++---------- 33 files changed, 370 insertions(+), 156 deletions(-) commit 3315e83c1e9738784da3c1c5836dd13b7593a8f1 Author: Brad Spengler Date: Wed May 4 21:03:36 2016 -0400 Add PAGEEXEC support for i386 !PAE on SMAP-capable processors (won't be used by anyone, just for correctness sake) arch/x86/mm/fault.c | 2 ++ 1 file changed, 2 insertions(+) commit b9e96108d2092c12e42e1810a62aec85f6ddc501 Merge: 6d98323 a3273aa Author: Brad Spengler Date: Wed May 4 19:06:44 2016 -0400 Merge branch 'pax-test' into grsec-test commit a3273aa2488f9e201620ee53af1acfd99c58650a Merge: e0e4c2c fbc310e Author: Brad Spengler Date: Wed May 4 19:06:36 2016 -0400 Merge branch 'linux-4.5.y' into pax-test commit 6d98323e0b511bdb77b9ef11d84207219331ac69 Author: Brad Spengler Date: Tue May 3 21:58:09 2016 -0400 Backport fix from http://www.spinics.net/lists/linux-usb/msg140243.html drivers/usb/core/devio.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit b003c68f96dd6a483b515290756816b6c909f34f Author: Brad Spengler Date: Sun May 1 12:06:48 2016 -0400 Add note about RANDSTRUCT and the gcc runtime library exception tools/gcc/randomize_layout_plugin.c | 5 +++++ 1 file changed, 5 insertions(+) commit fe375f07d31c5d561fcca4016f7c33e885fa3586 Author: Brad Spengler Date: Fri Apr 29 06:22:29 2016 -0400 Revert change to regmap_access_show() drivers/base/regmap/regmap-debugfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 3f5df6e7cf9716b4854fb282b6eb22cb1e52e92a Author: Brad Spengler Date: Fri Apr 29 06:20:12 2016 -0400 Merge a number of fixes from Mathias Krause arch/x86/entry/entry_32.S | 2 +- drivers/base/regmap/regmap-debugfs.c | 3 ++- drivers/cpufreq/intel_pstate.c | 2 +- drivers/gpu/drm/gma500/mdfld_dsi_dpi.c | 7 ++++++- drivers/oprofile/oprofilefs.c | 4 ++-- drivers/platform/x86/thinkpad_acpi.c | 1 - init/Kconfig | 1 - kernel/module.c | 4 +--- 8 files changed, 13 insertions(+), 11 deletions(-) commit 127927d7e57793eca299226cb31ecd9d235bbd62 Author: Brad Spengler Date: Thu Apr 28 20:58:04 2016 -0400 Add temporary dependency on !PARAVIRT for RAP until some fallout can be fixed security/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d37fff4904eee095ce50ea522efbfaf2a4bcb47e Author: Brad Spengler Date: Thu Apr 28 18:44:18 2016 -0400 Update to pax-linux-4.5.2-test1y.patch tools/gcc/rap_plugin/rap_plugin.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 5e309719b190a24dccd73c8b6ae388bd7f34660b Merge: ac01f5e e0e4c2c Author: Brad Spengler Date: Thu Apr 28 17:37:37 2016 -0400 Merge branch 'pax-test' into grsec-test commit e0e4c2ce05e0cd594b716a1e12d91928a0d083fd Author: Brad Spengler Date: Thu Apr 28 17:36:23 2016 -0400 Update to pax-linux-4.5.2-test1x.patch arch/x86/include/asm/alternative-asm.h | 8 -------- drivers/lguest/core.c | 2 +- kernel/sched/deadline.c | 4 ++-- mm/swap.c | 7 ++++++- tools/gcc/colorize_plugin.c | 2 +- tools/gcc/gcc-common.h | 21 +++++++++++++++++++++ 6 files changed, 31 insertions(+), 13 deletions(-) commit ac01f5eb279d93b10d63f87c9d851e039ab1bc3e Author: Brad Spengler Date: Thu Apr 28 17:35:14 2016 -0400 Initial import of grsecurity 3.1 for 4.5.2 with limited RAP support Documentation/dontdiff | 2 + Documentation/kernel-parameters.txt | 11 + Documentation/sysctl/kernel.txt | 15 + Makefile | 5 +- arch/alpha/include/asm/cache.h | 4 +- arch/alpha/kernel/osf_sys.c | 12 +- arch/arc/Kconfig | 1 + arch/arm/Kconfig | 1 + arch/arm/Kconfig.debug | 1 + arch/arm/include/asm/thread_info.h | 7 +- arch/arm/kernel/entry-common.S | 8 +- arch/arm/kernel/process.c | 4 +- arch/arm/kernel/ptrace.c | 9 + arch/arm/kernel/traps.c | 7 +- arch/arm/mm/Kconfig | 4 +- arch/arm/mm/fault.c | 40 +- arch/arm/mm/mmap.c | 8 +- arch/arm/net/bpf_jit_32.c | 51 +- arch/arm64/Kconfig.debug | 1 + arch/avr32/include/asm/cache.h | 4 +- arch/blackfin/Kconfig.debug | 1 + arch/blackfin/include/asm/cache.h | 3 +- arch/cris/include/arch-v10/arch/cache.h | 3 +- arch/cris/include/arch-v32/arch/cache.h | 3 +- arch/frv/include/asm/cache.h | 3 +- arch/frv/mm/elf-fdpic.c | 4 +- arch/hexagon/include/asm/cache.h | 6 +- arch/ia64/Kconfig | 1 + arch/ia64/include/asm/cache.h | 3 +- arch/ia64/kernel/sys_ia64.c | 2 + arch/ia64/mm/hugetlbpage.c | 2 + arch/m32r/include/asm/cache.h | 4 +- arch/m68k/include/asm/cache.h | 4 +- arch/metag/mm/hugetlbpage.c | 1 + arch/microblaze/include/asm/cache.h | 3 +- arch/mips/Kconfig | 1 + arch/mips/include/asm/thread_info.h | 11 +- arch/mips/kernel/irq.c | 3 + arch/mips/kernel/ptrace.c | 9 + arch/mips/mm/mmap.c | 4 +- arch/mn10300/proc-mn103e010/include/proc/cache.h | 4 +- arch/mn10300/proc-mn2ws0050/include/proc/cache.h | 4 +- arch/nios2/lib/memset.c | 2 +- arch/openrisc/include/asm/cache.h | 4 +- arch/parisc/include/asm/cache.h | 3 + arch/parisc/kernel/sys_parisc.c | 4 + arch/powerpc/Kconfig | 1 + arch/powerpc/include/asm/cache.h | 4 +- arch/powerpc/include/asm/thread_info.h | 5 +- arch/powerpc/kernel/Makefile | 2 + arch/powerpc/kernel/irq.c | 3 + arch/powerpc/kernel/process.c | 10 +- arch/powerpc/kernel/ptrace.c | 14 + arch/powerpc/kernel/traps.c | 5 + arch/powerpc/mm/slice.c | 2 +- arch/s390/Kconfig.debug | 1 + arch/s390/include/asm/cache.h | 4 +- arch/score/include/asm/cache.h | 4 +- arch/sh/include/asm/cache.h | 3 +- arch/sh/mm/mmap.c | 6 +- arch/sparc/include/asm/cache.h | 4 +- arch/sparc/include/asm/pgalloc_64.h | 1 + arch/sparc/include/asm/thread_info_64.h | 8 +- arch/sparc/kernel/process_32.c | 6 +- arch/sparc/kernel/process_64.c | 8 +- arch/sparc/kernel/ptrace_64.c | 14 + arch/sparc/kernel/sys_sparc_64.c | 8 +- arch/sparc/kernel/syscalls.S | 8 +- arch/sparc/kernel/traps_32.c | 8 +- arch/sparc/kernel/traps_64.c | 28 +- arch/sparc/kernel/unaligned_64.c | 2 +- arch/sparc/mm/fault_64.c | 2 +- arch/sparc/mm/hugetlbpage.c | 15 +- arch/tile/Kconfig | 1 + arch/tile/include/asm/cache.h | 3 +- arch/tile/mm/hugetlbpage.c | 2 + arch/um/include/asm/cache.h | 3 +- arch/unicore32/include/asm/cache.h | 6 +- arch/x86/Kconfig | 21 + arch/x86/Kconfig.debug | 2 + arch/x86/crypto/sha-mb/sha1_mb.c | 4 +- arch/x86/entry/common.c | 14 + arch/x86/entry/entry_32.S | 2 +- arch/x86/entry/entry_64.S | 2 +- arch/x86/ia32/ia32_aout.c | 2 + arch/x86/include/asm/floppy.h | 20 +- arch/x86/include/asm/fpu/types.h | 69 +- arch/x86/include/asm/io.h | 2 +- arch/x86/include/asm/page.h | 12 +- arch/x86/include/asm/paravirt_types.h | 21 +- arch/x86/include/asm/processor.h | 12 +- arch/x86/include/asm/thread_info.h | 6 +- arch/x86/kernel/dumpstack.c | 10 +- arch/x86/kernel/dumpstack_32.c | 2 +- arch/x86/kernel/dumpstack_64.c | 2 +- arch/x86/kernel/ioport.c | 13 + arch/x86/kernel/irq_32.c | 3 + arch/x86/kernel/irq_64.c | 4 + arch/x86/kernel/ldt.c | 18 + arch/x86/kernel/msr.c | 10 + arch/x86/kernel/ptrace.c | 14 + arch/x86/kernel/signal.c | 9 +- arch/x86/kernel/sys_i386_32.c | 9 +- arch/x86/kernel/sys_x86_64.c | 8 +- arch/x86/kernel/traps.c | 5 + arch/x86/kernel/verify_cpu.S | 1 + arch/x86/kernel/vm86_32.c | 15 + arch/x86/mm/fault.c | 12 +- arch/x86/mm/hugetlbpage.c | 15 +- arch/x86/mm/init.c | 66 +- arch/x86/mm/init_32.c | 6 +- arch/x86/net/bpf_jit_comp.c | 4 + arch/x86/platform/efi/efi_64.c | 2 +- arch/x86/xen/Kconfig | 1 + arch/xtensa/variants/dc232b/include/variant/core.h | 2 +- arch/xtensa/variants/fsf/include/variant/core.h | 3 +- crypto/scatterwalk.c | 10 +- drivers/acpi/acpica/hwxfsleep.c | 11 +- drivers/acpi/custom_method.c | 4 + drivers/block/cciss.h | 30 +- drivers/block/smart1,2.h | 40 +- drivers/cdrom/cdrom.c | 2 +- drivers/char/Kconfig | 4 +- drivers/char/genrtc.c | 1 + drivers/char/mem.c | 17 + drivers/char/random.c | 5 +- drivers/cpufreq/sparc-us3-cpufreq.c | 2 - drivers/crypto/ccp/ccp-crypto-aes-cmac.c | 3 + drivers/crypto/ccp/ccp-crypto-sha.c | 3 + drivers/crypto/marvell/cesa.h | 3 +- drivers/crypto/marvell/hash.c | 106 +- drivers/firewire/ohci.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 78 +- drivers/gpu/drm/nouveau/nouveau_ttm.c | 28 +- drivers/gpu/drm/ttm/ttm_bo_manager.c | 10 +- drivers/gpu/drm/virtio/virtgpu_ttm.c | 10 +- drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 10 +- drivers/hid/hid-wiimote-debug.c | 2 +- drivers/infiniband/hw/nes/nes_cm.c | 22 +- drivers/input/touchscreen/sur40.c | 21 +- drivers/iommu/Kconfig | 1 + drivers/iommu/amd_iommu.c | 14 +- drivers/isdn/gigaset/bas-gigaset.c | 32 +- drivers/isdn/gigaset/ser-gigaset.c | 32 +- drivers/isdn/gigaset/usb-gigaset.c | 32 +- drivers/isdn/i4l/isdn_concap.c | 6 +- drivers/isdn/i4l/isdn_x25iface.c | 16 +- drivers/lguest/core.c | 2 +- drivers/md/bcache/Kconfig | 1 + drivers/md/raid5.c | 8 + drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +- drivers/media/platform/sti/c8sectpfe/Kconfig | 1 + drivers/media/radio/radio-cadet.c | 5 +- drivers/media/usb/dvb-usb/cinergyT2-core.c | 91 +- drivers/media/usb/dvb-usb/cinergyT2-fe.c | 182 +- drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 37 +- drivers/media/usb/dvb-usb/technisat-usb2.c | 75 +- drivers/message/fusion/mptbase.c | 9 + drivers/misc/sgi-xp/xp_main.c | 12 +- drivers/net/ethernet/brocade/bna/bna_enet.c | 8 +- drivers/net/ethernet/mellanox/mlx4/en_rx.c | 2 +- drivers/net/hyperv/hyperv_net.h | 7 +- drivers/net/hyperv/netvsc_drv.c | 5 +- drivers/net/hyperv/rndis_filter.c | 4 +- drivers/net/wan/lmc/lmc_media.c | 97 +- drivers/net/wan/z85230.c | 24 +- drivers/net/wireless/ath/ath9k/Kconfig | 1 - drivers/net/wireless/zydas/zd1211rw/zd_usb.c | 2 +- drivers/pci/proc.c | 9 + drivers/platform/x86/asus-wmi.c | 12 + drivers/rtc/rtc-dev.c | 3 + drivers/scsi/bfa/bfa_fcs.c | 19 +- drivers/scsi/bfa/bfa_fcs_lport.c | 29 +- drivers/scsi/bfa/bfa_modules.h | 12 +- drivers/scsi/cxgbi/libcxgbi.c | 1 + drivers/scsi/hpsa.h | 40 +- drivers/staging/lustre/lustre/ldlm/ldlm_flock.c | 2 +- drivers/staging/lustre/lustre/libcfs/module.c | 10 +- drivers/staging/wilc1000/host_interface.h | 1 + drivers/staging/wilc1000/wilc_spi.c | 1 + drivers/tty/serial/uartlite.c | 4 +- drivers/tty/sysrq.c | 2 +- drivers/tty/tty_io.c | 4 + drivers/tty/vt/keyboard.c | 22 +- drivers/uio/uio.c | 6 +- drivers/usb/core/hub.c | 5 + drivers/usb/gadget/function/f_uac1.c | 1 + drivers/usb/gadget/function/u_uac1.c | 1 + drivers/usb/host/hwa-hc.c | 9 +- drivers/usb/usbip/usbip_common.c | 11 + drivers/usb/usbip/vhci_sysfs.c | 2 +- drivers/video/fbdev/arcfb.c | 2 +- drivers/video/fbdev/matrox/matroxfb_DAC1064.c | 10 +- drivers/video/fbdev/matrox/matroxfb_Ti3026.c | 5 +- drivers/video/fbdev/sh_mobile_lcdcfb.c | 6 +- drivers/video/logo/logo_linux_clut224.ppm | 2720 ++++---- drivers/xen/xenfs/xenstored.c | 5 + firmware/Makefile | 2 + firmware/WHENCE | 20 +- firmware/bnx2/bnx2-mips-06-6.2.3.fw.ihex | 5804 +++++++++++++++++ firmware/bnx2/bnx2-mips-09-6.2.1b.fw.ihex | 6496 ++++++++++++++++++++ fs/attr.c | 4 + fs/autofs4/waitq.c | 9 + fs/binfmt_aout.c | 7 + fs/binfmt_elf.c | 40 +- fs/compat.c | 20 +- fs/coredump.c | 17 +- fs/dcache.c | 3 + fs/debugfs/inode.c | 19 +- fs/ecryptfs/keystore.c | 6 +- fs/exec.c | 235 +- fs/ext2/balloc.c | 4 +- fs/ext2/super.c | 8 +- fs/ext4/balloc.c | 4 +- fs/ext4/extents.c | 2 +- fs/fcntl.c | 4 + fs/fhandle.c | 3 +- fs/file.c | 4 + fs/filesystems.c | 4 + fs/fs_struct.c | 20 +- fs/hugetlbfs/inode.c | 5 +- fs/inode.c | 8 +- fs/kernfs/dir.c | 6 + fs/mount.h | 4 +- fs/namei.c | 295 +- fs/namespace.c | 24 + fs/nfsd/nfscache.c | 2 +- fs/open.c | 38 + fs/overlayfs/inode.c | 3 + fs/overlayfs/super.c | 6 +- fs/pipe.c | 2 +- fs/posix_acl.c | 15 +- fs/proc/Kconfig | 10 +- fs/proc/array.c | 67 +- fs/proc/base.c | 175 +- fs/proc/cmdline.c | 4 + fs/proc/devices.c | 4 + fs/proc/fd.c | 13 +- fs/proc/generic.c | 64 + fs/proc/inode.c | 17 + fs/proc/internal.h | 11 +- fs/proc/interrupts.c | 4 + fs/proc/kcore.c | 3 + fs/proc/proc_net.c | 31 + fs/proc/proc_sysctl.c | 52 +- fs/proc/root.c | 8 + fs/proc/stat.c | 69 +- fs/proc/task_mmu.c | 66 +- fs/readdir.c | 19 + fs/reiserfs/item_ops.c | 24 +- fs/reiserfs/super.c | 4 + fs/select.c | 2 + fs/seq_file.c | 30 +- fs/stat.c | 20 +- fs/sysfs/dir.c | 30 +- fs/utimes.c | 7 + fs/xattr.c | 26 +- grsecurity/Kconfig | 1205 ++++ grsecurity/Makefile | 54 + grsecurity/gracl.c | 2757 +++++++++ grsecurity/gracl_alloc.c | 105 + grsecurity/gracl_cap.c | 127 + grsecurity/gracl_compat.c | 269 + grsecurity/gracl_fs.c | 448 ++ grsecurity/gracl_ip.c | 386 ++ grsecurity/gracl_learn.c | 207 + grsecurity/gracl_policy.c | 1784 ++++++ grsecurity/gracl_res.c | 68 + grsecurity/gracl_segv.c | 304 + grsecurity/gracl_shm.c | 40 + grsecurity/grsec_chdir.c | 19 + grsecurity/grsec_chroot.c | 506 ++ grsecurity/grsec_disabled.c | 445 ++ grsecurity/grsec_exec.c | 189 + grsecurity/grsec_fifo.c | 26 + grsecurity/grsec_fork.c | 23 + grsecurity/grsec_init.c | 294 + grsecurity/grsec_ipc.c | 48 + grsecurity/grsec_link.c | 65 + grsecurity/grsec_log.c | 340 + grsecurity/grsec_mem.c | 48 + grsecurity/grsec_mount.c | 65 + grsecurity/grsec_pax.c | 47 + grsecurity/grsec_proc.c | 20 + grsecurity/grsec_ptrace.c | 30 + grsecurity/grsec_sig.c | 245 + grsecurity/grsec_sock.c | 244 + grsecurity/grsec_sysctl.c | 497 ++ grsecurity/grsec_time.c | 16 + grsecurity/grsec_tpe.c | 78 + grsecurity/grsec_tty.c | 18 + grsecurity/grsec_usb.c | 15 + grsecurity/grsum.c | 54 + include/linux/binfmts.h | 5 +- include/linux/capability.h | 13 + include/linux/compiler-gcc.h | 5 + include/linux/compiler.h | 8 + include/linux/cred.h | 8 +- include/linux/dcache.h | 5 +- include/linux/fs.h | 24 +- include/linux/fs_struct.h | 2 +- include/linux/fsnotify.h | 6 + include/linux/gracl.h | 342 ++ include/linux/gracl_compat.h | 156 + include/linux/gralloc.h | 9 + include/linux/grdefs.h | 140 + include/linux/grinternal.h | 231 + include/linux/grmsg.h | 120 + include/linux/grsecurity.h | 259 + include/linux/grsock.h | 19 + include/linux/ipc.h | 2 +- include/linux/ipc_namespace.h | 2 +- include/linux/kallsyms.h | 18 +- include/linux/key-type.h | 4 +- include/linux/kmod.h | 5 + include/linux/kobject.h | 2 +- include/linux/lsm_hooks.h | 4 +- include/linux/mm.h | 12 + include/linux/mm_types.h | 4 +- include/linux/module.h | 5 +- include/linux/mount.h | 2 +- include/linux/msg.h | 2 +- include/linux/netfilter/xt_gradm.h | 9 + include/linux/path.h | 4 +- include/linux/perf_event.h | 13 +- include/linux/pid_namespace.h | 2 +- include/linux/printk.h | 2 +- include/linux/proc_fs.h | 22 +- include/linux/proc_ns.h | 2 +- include/linux/random.h | 2 +- include/linux/rbtree_augmented.h | 4 +- include/linux/scatterlist.h | 12 +- include/linux/sched.h | 114 +- include/linux/security.h | 1 + include/linux/sem.h | 2 +- include/linux/seq_file.h | 5 + include/linux/shm.h | 6 +- include/linux/skbuff.h | 3 + include/linux/slab.h | 9 - include/linux/sysctl.h | 8 +- include/linux/thread_info.h | 6 +- include/linux/tty.h | 2 +- include/linux/tty_driver.h | 4 +- include/linux/uidgid.h | 5 + include/linux/user_namespace.h | 2 +- include/linux/utsname.h | 2 +- include/linux/vermagic.h | 16 +- include/linux/vmalloc.h | 8 + include/net/af_unix.h | 2 +- include/net/ip.h | 2 +- include/net/neighbour.h | 2 +- include/net/net_namespace.h | 2 +- include/net/sctp/structs.h | 2 +- include/net/sock.h | 2 +- include/trace/events/fs.h | 53 + include/uapi/linux/personality.h | 1 + init/Kconfig | 4 + init/main.c | 46 +- ipc/mqueue.c | 1 + ipc/msg.c | 3 +- ipc/msgutil.c | 4 +- ipc/sem.c | 3 +- ipc/shm.c | 26 +- ipc/util.c | 6 + kernel/auditsc.c | 2 +- kernel/bpf/syscall.c | 10 +- kernel/bpf/verifier.c | 1 - kernel/capability.c | 41 +- kernel/cgroup.c | 5 +- kernel/compat.c | 1 + kernel/configs.c | 11 + kernel/cred.c | 112 +- kernel/events/core.c | 14 +- kernel/exit.c | 10 +- kernel/fork.c | 86 +- kernel/futex.c | 4 +- kernel/kallsyms.c | 9 + kernel/kcmp.c | 4 + kernel/kexec_core.c | 2 +- kernel/kmod.c | 96 +- kernel/kprobes.c | 9 +- kernel/ksysfs.c | 2 + kernel/locking/lockdep_proc.c | 10 +- kernel/module.c | 110 +- kernel/panic.c | 4 +- kernel/pid.c | 18 +- kernel/power/Kconfig | 2 + kernel/printk/printk.c | 7 +- kernel/ptrace.c | 50 +- kernel/resource.c | 10 + kernel/sched/core.c | 11 +- kernel/sched/debug.c | 4 + kernel/signal.c | 37 +- kernel/sys.c | 64 +- kernel/sysctl.c | 172 +- kernel/taskstats.c | 6 + kernel/time/posix-timers.c | 8 + kernel/time/time.c | 5 + kernel/time/timekeeping.c | 3 + kernel/time/timer_list.c | 13 +- kernel/time/timer_stats.c | 10 +- kernel/trace/Kconfig | 2 + kernel/trace/trace_syscalls.c | 8 + kernel/user_namespace.c | 15 + kernel/workqueue.c | 29 + lib/Kconfig.debug | 12 +- lib/Kconfig.kasan | 2 +- lib/is_single_threaded.c | 3 + lib/list_debug.c | 65 +- lib/nlattr.c | 2 + lib/rbtree.c | 4 +- lib/vsprintf.c | 39 +- localversion-grsec | 1 + mm/Kconfig | 8 +- mm/Kconfig.debug | 1 + mm/filemap.c | 8 +- mm/kmemleak.c | 4 +- mm/memory.c | 2 +- mm/mempolicy.c | 12 +- mm/migrate.c | 3 +- mm/mlock.c | 11 +- mm/mmap.c | 127 +- mm/mprotect.c | 8 + mm/oom_kill.c | 4 + mm/page_alloc.c | 2 +- mm/process_vm_access.c | 6 + mm/shmem.c | 2 +- mm/slab.c | 14 +- mm/slab_common.c | 2 +- mm/slob.c | 12 + mm/slub.c | 33 +- mm/swap.c | 6 +- mm/util.c | 3 + mm/vmalloc.c | 82 +- mm/vmstat.c | 29 +- net/appletalk/atalk_proc.c | 2 +- net/atm/lec.c | 6 +- net/atm/mpoa_caches.c | 43 +- net/bridge/netfilter/ebtables.c | 4 + net/can/bcm.c | 2 +- net/can/proc.c | 2 +- net/core/dev_ioctl.c | 7 +- net/core/filter.c | 8 +- net/core/net-procfs.c | 17 +- net/core/pktgen.c | 2 +- net/core/sock.c | 23 +- net/core/sysctl_net_core.c | 2 +- net/decnet/dn_dev.c | 2 +- net/ipv4/devinet.c | 6 +- net/ipv4/inet_hashtables.c | 4 + net/ipv4/ip_input.c | 7 + net/ipv4/ip_sockglue.c | 3 +- net/ipv4/netfilter/arp_tables.c | 43 +- net/ipv4/netfilter/ip_tables.c | 48 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv4/route.c | 6 +- net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_ipv4.c | 24 +- net/ipv4/tcp_minisocks.c | 9 +- net/ipv4/tcp_timer.c | 11 + net/ipv4/udp.c | 24 + net/ipv6/addrconf.c | 13 +- net/ipv6/netfilter/ip6_tables.c | 48 +- net/ipv6/proc.c | 2 +- net/ipv6/tcp_ipv6.c | 23 +- net/ipv6/udp.c | 7 + net/ipx/ipx_proc.c | 2 +- net/irda/irproc.c | 2 +- net/llc/llc_proc.c | 2 +- net/netfilter/Kconfig | 10 + net/netfilter/Makefile | 1 + net/netfilter/nf_conntrack_core.c | 8 + net/netfilter/xt_gradm.c | 51 + net/netfilter/xt_hashlimit.c | 4 +- net/netfilter/xt_recent.c | 2 +- net/packet/af_packet.c | 1 + net/sctp/bind_addr.c | 14 +- net/sctp/protocol.c | 1 + net/sctp/sm_make_chunk.c | 3 +- net/sctp/socket.c | 4 +- net/socket.c | 75 +- net/sunrpc/Kconfig | 1 + net/sunrpc/cache.c | 2 +- net/sunrpc/stats.c | 2 +- net/sysctl_net.c | 2 +- net/unix/af_unix.c | 52 +- net/vmw_vsock/vmci_transport_notify.c | 30 +- net/vmw_vsock/vmci_transport_notify_qstate.c | 30 +- net/x25/sysctl_net_x25.c | 2 +- net/x25/x25_proc.c | 2 +- scripts/package/Makefile | 2 +- scripts/package/mkspec | 41 +- security/Kconfig | 364 +- security/apparmor/file.c | 4 +- security/apparmor/lsm.c | 8 +- security/commoncap.c | 29 + security/keys/internal.h | 2 +- security/min_addr.c | 2 + security/tomoyo/file.c | 12 +- security/tomoyo/mount.c | 4 + security/tomoyo/tomoyo.c | 20 +- security/yama/Kconfig | 2 +- sound/synth/emux/emux_seq.c | 14 +- sound/usb/line6/driver.c | 40 +- sound/usb/line6/toneport.c | 12 +- tools/gcc/.gitignore | 1 + tools/gcc/Makefile | 12 + tools/gcc/gen-random-seed.sh | 8 + tools/gcc/randomize_layout_plugin.c | 935 +++ tools/gcc/randomize_layout_seed.h | 1 - .../size_overflow_plugin/size_overflow_hash.data | 202 +- 511 files changed, 32630 insertions(+), 3134 deletions(-) commit a89837d0fc99aab94b5c8b975215de260271c1f7 Author: Brad Spengler Date: Wed Apr 27 20:43:37 2016 -0400 Initial port of PaX to 4.5.2 with a limited form of RAP (< 1/5th the total size of the full developed RAP plugin) No retaddr protection via XOR canary No C++ support No LTO support Removal of a few optimization passes No compile time reporting of bad fptr casts The RAP plugin should therefore be used only to compile an appropriate vanilla kernel with this patch. Documentation/dontdiff | 46 +- Documentation/kbuild/makefiles.txt | 39 +- Documentation/kernel-parameters.txt | 28 + Makefile | 52 +- arch/alpha/include/asm/atomic.h | 10 + arch/alpha/include/asm/elf.h | 7 + arch/alpha/include/asm/pgalloc.h | 6 + arch/alpha/include/asm/pgtable.h | 11 + arch/alpha/kernel/module.c | 2 +- arch/alpha/kernel/osf_sys.c | 8 +- arch/alpha/mm/fault.c | 141 +- arch/arm/Kconfig | 3 +- arch/arm/include/asm/atomic.h | 323 +- arch/arm/include/asm/cache.h | 5 +- arch/arm/include/asm/cacheflush.h | 2 +- arch/arm/include/asm/checksum.h | 14 +- arch/arm/include/asm/cmpxchg.h | 4 + arch/arm/include/asm/cpuidle.h | 2 +- arch/arm/include/asm/domain.h | 42 +- arch/arm/include/asm/elf.h | 9 +- arch/arm/include/asm/fncpy.h | 2 + arch/arm/include/asm/futex.h | 1 + arch/arm/include/asm/kmap_types.h | 2 +- arch/arm/include/asm/mach/dma.h | 2 +- arch/arm/include/asm/mach/map.h | 16 +- arch/arm/include/asm/outercache.h | 2 +- arch/arm/include/asm/page.h | 3 +- arch/arm/include/asm/pgalloc.h | 20 + arch/arm/include/asm/pgtable-2level-hwdef.h | 4 +- arch/arm/include/asm/pgtable-2level.h | 3 + arch/arm/include/asm/pgtable-3level.h | 3 + arch/arm/include/asm/pgtable.h | 54 +- arch/arm/include/asm/smp.h | 2 +- arch/arm/include/asm/thread_info.h | 3 + arch/arm/include/asm/tls.h | 3 + arch/arm/include/asm/uaccess.h | 113 +- arch/arm/include/uapi/asm/ptrace.h | 2 +- arch/arm/kernel/armksyms.c | 2 +- arch/arm/kernel/cpuidle.c | 2 +- arch/arm/kernel/entry-armv.S | 109 +- arch/arm/kernel/entry-common.S | 40 +- arch/arm/kernel/entry-header.S | 55 + arch/arm/kernel/fiq.c | 3 + arch/arm/kernel/module-plts.c | 7 +- arch/arm/kernel/module.c | 38 +- arch/arm/kernel/patch.c | 2 + arch/arm/kernel/process.c | 92 +- arch/arm/kernel/reboot.c | 1 + arch/arm/kernel/setup.c | 20 +- arch/arm/kernel/signal.c | 35 +- arch/arm/kernel/smp.c | 2 +- arch/arm/kernel/tcm.c | 4 +- arch/arm/kernel/vmlinux.lds.S | 6 +- arch/arm/kvm/arm.c | 8 +- arch/arm/lib/copy_page.S | 1 + arch/arm/lib/csumpartialcopyuser.S | 4 +- arch/arm/lib/delay.c | 2 +- arch/arm/lib/uaccess_with_memcpy.c | 4 +- arch/arm/mach-exynos/suspend.c | 6 +- arch/arm/mach-mvebu/coherency.c | 4 +- arch/arm/mach-omap2/board-n8x0.c | 2 +- arch/arm/mach-omap2/omap-mpuss-lowpower.c | 4 +- arch/arm/mach-omap2/omap-smp.c | 1 + arch/arm/mach-omap2/omap_device.c | 4 +- arch/arm/mach-omap2/omap_device.h | 4 +- arch/arm/mach-omap2/omap_hwmod.c | 4 +- arch/arm/mach-omap2/powerdomains43xx_data.c | 5 +- arch/arm/mach-omap2/wd_timer.c | 6 +- arch/arm/mach-shmobile/platsmp-apmu.c | 5 +- arch/arm/mach-tegra/cpuidle-tegra20.c | 2 +- arch/arm/mach-tegra/irq.c | 1 + arch/arm/mach-ux500/pm.c | 1 + arch/arm/mach-zynq/platsmp.c | 1 + arch/arm/mm/Kconfig | 6 +- arch/arm/mm/cache-l2x0.c | 2 +- arch/arm/mm/context.c | 10 +- arch/arm/mm/fault.c | 146 + arch/arm/mm/fault.h | 12 + arch/arm/mm/init.c | 39 + arch/arm/mm/ioremap.c | 4 +- arch/arm/mm/mmap.c | 36 +- arch/arm/mm/mmu.c | 162 +- arch/arm/net/bpf_jit_32.c | 3 + arch/arm/plat-iop/setup.c | 2 +- arch/arm/plat-omap/sram.c | 2 + arch/arm64/include/asm/atomic.h | 10 + arch/arm64/include/asm/percpu.h | 8 +- arch/arm64/include/asm/pgalloc.h | 5 + arch/arm64/include/asm/uaccess.h | 1 + arch/arm64/mm/dma-mapping.c | 2 +- arch/avr32/include/asm/elf.h | 8 +- arch/avr32/include/asm/kmap_types.h | 4 +- arch/avr32/mm/fault.c | 27 + arch/frv/include/asm/atomic.h | 10 + arch/frv/include/asm/kmap_types.h | 2 +- arch/frv/mm/elf-fdpic.c | 3 +- arch/ia64/Makefile | 1 + arch/ia64/include/asm/atomic.h | 10 + arch/ia64/include/asm/elf.h | 7 + arch/ia64/include/asm/pgalloc.h | 12 + arch/ia64/include/asm/pgtable.h | 13 +- arch/ia64/include/asm/spinlock.h | 2 +- arch/ia64/include/asm/uaccess.h | 27 +- arch/ia64/kernel/module.c | 20 +- arch/ia64/kernel/palinfo.c | 2 +- arch/ia64/kernel/sys_ia64.c | 7 + arch/ia64/kernel/vmlinux.lds.S | 2 +- arch/ia64/mm/fault.c | 32 +- arch/ia64/mm/init.c | 15 +- arch/m32r/lib/usercopy.c | 6 + arch/mips/cavium-octeon/dma-octeon.c | 2 +- arch/mips/include/asm/atomic.h | 372 +- arch/mips/include/asm/cache.h | 3 +- arch/mips/include/asm/elf.h | 7 + arch/mips/include/asm/exec.h | 2 +- arch/mips/include/asm/hw_irq.h | 2 +- arch/mips/include/asm/local.h | 57 + arch/mips/include/asm/page.h | 2 +- arch/mips/include/asm/pgalloc.h | 5 + arch/mips/include/asm/pgtable.h | 3 + arch/mips/include/asm/uaccess.h | 1 + arch/mips/kernel/binfmt_elfn32.c | 7 + arch/mips/kernel/binfmt_elfo32.c | 7 + arch/mips/kernel/irq-gt641xx.c | 2 +- arch/mips/kernel/irq.c | 6 +- arch/mips/kernel/pm-cps.c | 2 +- arch/mips/kernel/process.c | 12 - arch/mips/kernel/sync-r4k.c | 24 +- arch/mips/kernel/traps.c | 13 +- arch/mips/lib/ashldi3.c | 21 +- arch/mips/lib/ashrdi3.c | 19 +- arch/mips/lib/libgcc.h | 12 +- arch/mips/mm/fault.c | 25 + arch/mips/mm/init.c | 4 +- arch/mips/mm/mmap.c | 51 +- arch/mips/sgi-ip27/ip27-nmi.c | 6 +- arch/mips/sni/rm200.c | 2 +- arch/mips/vr41xx/common/icu.c | 2 +- arch/mips/vr41xx/common/irq.c | 4 +- arch/parisc/include/asm/atomic.h | 10 + arch/parisc/include/asm/elf.h | 7 + arch/parisc/include/asm/pgalloc.h | 6 + arch/parisc/include/asm/pgtable.h | 11 + arch/parisc/include/asm/uaccess.h | 4 +- arch/parisc/kernel/module.c | 26 +- arch/parisc/kernel/sys_parisc.c | 15 + arch/parisc/kernel/traps.c | 4 +- arch/parisc/mm/fault.c | 140 +- arch/powerpc/include/asm/atomic.h | 329 +- arch/powerpc/include/asm/book3s/32/hash.h | 1 + arch/powerpc/include/asm/elf.h | 12 + arch/powerpc/include/asm/exec.h | 2 +- arch/powerpc/include/asm/kmap_types.h | 2 +- arch/powerpc/include/asm/local.h | 46 + arch/powerpc/include/asm/mman.h | 2 +- arch/powerpc/include/asm/page.h | 8 +- arch/powerpc/include/asm/page_64.h | 7 +- arch/powerpc/include/asm/pgalloc-64.h | 7 + arch/powerpc/include/asm/pgtable.h | 1 + arch/powerpc/include/asm/reg.h | 1 + arch/powerpc/include/asm/smp.h | 2 +- arch/powerpc/include/asm/spinlock.h | 42 +- arch/powerpc/include/asm/uaccess.h | 141 +- arch/powerpc/kernel/Makefile | 5 + arch/powerpc/kernel/exceptions-64e.S | 4 +- arch/powerpc/kernel/exceptions-64s.S | 2 +- arch/powerpc/kernel/module_32.c | 15 +- arch/powerpc/kernel/process.c | 46 - arch/powerpc/kernel/signal_32.c | 2 +- arch/powerpc/kernel/signal_64.c | 2 +- arch/powerpc/kernel/traps.c | 21 + arch/powerpc/kernel/vdso.c | 5 +- arch/powerpc/lib/usercopy_64.c | 18 - arch/powerpc/mm/fault.c | 56 +- arch/powerpc/mm/mmap.c | 16 + arch/powerpc/mm/slice.c | 21 +- arch/powerpc/platforms/cell/spufs/file.c | 4 +- arch/s390/include/asm/atomic.h | 10 + arch/s390/include/asm/elf.h | 7 + arch/s390/include/asm/exec.h | 2 +- arch/s390/include/asm/uaccess.h | 13 +- arch/s390/kernel/module.c | 22 +- arch/s390/kernel/process.c | 20 - arch/s390/mm/mmap.c | 22 +- arch/score/include/asm/exec.h | 2 +- arch/score/kernel/process.c | 5 - arch/sh/mm/mmap.c | 28 +- arch/sparc/include/asm/atomic_64.h | 110 +- arch/sparc/include/asm/cache.h | 2 +- arch/sparc/include/asm/elf_32.h | 7 + arch/sparc/include/asm/elf_64.h | 7 + arch/sparc/include/asm/pgalloc_32.h | 1 + arch/sparc/include/asm/pgalloc_64.h | 1 + arch/sparc/include/asm/pgtable.h | 4 + arch/sparc/include/asm/pgtable_32.h | 15 +- arch/sparc/include/asm/pgtsrmmu.h | 5 + arch/sparc/include/asm/setup.h | 4 +- arch/sparc/include/asm/spinlock_64.h | 35 +- arch/sparc/include/asm/thread_info_32.h | 1 + arch/sparc/include/asm/thread_info_64.h | 2 + arch/sparc/include/asm/uaccess.h | 1 + arch/sparc/include/asm/uaccess_32.h | 28 +- arch/sparc/include/asm/uaccess_64.h | 24 +- arch/sparc/kernel/Makefile | 2 +- arch/sparc/kernel/prom_common.c | 2 +- arch/sparc/kernel/smp_64.c | 8 +- arch/sparc/kernel/sys_sparc_32.c | 2 +- arch/sparc/kernel/sys_sparc_64.c | 58 +- arch/sparc/kernel/traps_64.c | 27 +- arch/sparc/lib/Makefile | 2 +- arch/sparc/lib/atomic_64.S | 57 +- arch/sparc/lib/ksyms.c | 6 +- arch/sparc/mm/Makefile | 2 +- arch/sparc/mm/fault_32.c | 292 + arch/sparc/mm/fault_64.c | 486 + arch/sparc/mm/hugetlbpage.c | 30 +- arch/sparc/mm/init_64.c | 10 +- arch/tile/include/asm/atomic_64.h | 10 + arch/tile/include/asm/uaccess.h | 4 +- arch/um/Makefile | 4 + arch/um/include/asm/kmap_types.h | 2 +- arch/um/include/asm/page.h | 3 + arch/um/include/asm/pgtable-3level.h | 1 + arch/um/kernel/process.c | 16 - arch/x86/Kconfig | 26 +- arch/x86/Kconfig.cpu | 6 +- arch/x86/Kconfig.debug | 4 +- arch/x86/Makefile | 13 +- arch/x86/boot/Makefile | 3 + arch/x86/boot/bitops.h | 4 +- arch/x86/boot/boot.h | 2 +- arch/x86/boot/compressed/Makefile | 20 + arch/x86/boot/compressed/efi_stub_32.S | 16 +- arch/x86/boot/compressed/efi_thunk_64.S | 4 +- arch/x86/boot/compressed/head_32.S | 4 +- arch/x86/boot/compressed/head_64.S | 12 +- arch/x86/boot/compressed/misc.c | 11 +- arch/x86/boot/cpucheck.c | 16 +- arch/x86/boot/header.S | 6 +- arch/x86/boot/memory.c | 2 +- arch/x86/boot/video-vesa.c | 1 + arch/x86/boot/video.c | 2 +- arch/x86/crypto/aes-x86_64-asm_64.S | 4 + arch/x86/crypto/aesni-intel_asm.S | 110 +- arch/x86/crypto/aesni-intel_glue.c | 4 +- arch/x86/crypto/blowfish-x86_64-asm_64.S | 11 +- arch/x86/crypto/camellia-aesni-avx-asm_64.S | 22 +- arch/x86/crypto/camellia-aesni-avx2-asm_64.S | 22 +- arch/x86/crypto/camellia-x86_64-asm_64.S | 11 +- arch/x86/crypto/camellia_aesni_avx2_glue.c | 18 +- arch/x86/crypto/camellia_aesni_avx_glue.c | 18 +- arch/x86/crypto/camellia_glue.c | 8 +- arch/x86/crypto/cast5-avx-x86_64-asm_64.S | 55 +- arch/x86/crypto/cast6-avx-x86_64-asm_64.S | 37 +- arch/x86/crypto/cast6_avx_glue.c | 16 +- arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 2 + arch/x86/crypto/ghash-clmulni-intel_asm.S | 4 + arch/x86/crypto/glue_helper.c | 2 +- arch/x86/crypto/salsa20-x86_64-asm_64.S | 4 + arch/x86/crypto/serpent-avx-x86_64-asm_64.S | 21 +- arch/x86/crypto/serpent-avx2-asm_64.S | 21 +- arch/x86/crypto/serpent-sse2-x86_64-asm_64.S | 4 + arch/x86/crypto/serpent_avx2_glue.c | 14 +- arch/x86/crypto/serpent_avx_glue.c | 18 +- arch/x86/crypto/serpent_sse2_glue.c | 4 +- arch/x86/crypto/sha1_ssse3_asm.S | 13 +- arch/x86/crypto/sha1_ssse3_glue.c | 56 +- arch/x86/crypto/sha256-avx-asm.S | 5 +- arch/x86/crypto/sha256-avx2-asm.S | 5 +- arch/x86/crypto/sha256-ssse3-asm.S | 6 +- arch/x86/crypto/sha256_ssse3_glue.c | 26 +- arch/x86/crypto/sha512-avx-asm.S | 5 +- arch/x86/crypto/sha512-avx2-asm.S | 5 +- arch/x86/crypto/sha512-ssse3-asm.S | 5 +- arch/x86/crypto/sha512_ssse3_glue.c | 22 +- arch/x86/crypto/twofish-avx-x86_64-asm_64.S | 37 +- arch/x86/crypto/twofish-i586-asm_32.S | 2 +- arch/x86/crypto/twofish-x86_64-asm_64-3way.S | 6 +- arch/x86/crypto/twofish-x86_64-asm_64.S | 7 +- arch/x86/crypto/twofish_avx_glue.c | 21 +- arch/x86/crypto/twofish_glue.c | 4 +- arch/x86/crypto/twofish_glue_3way.c | 12 +- arch/x86/entry/Makefile | 2 + arch/x86/entry/calling.h | 86 +- arch/x86/entry/common.c | 70 +- arch/x86/entry/entry_32.S | 311 +- arch/x86/entry/entry_64.S | 629 +- arch/x86/entry/entry_64_compat.S | 115 +- arch/x86/entry/thunk_64.S | 2 + arch/x86/entry/vdso/Makefile | 5 +- arch/x86/entry/vdso/vclock_gettime.c | 2 +- arch/x86/entry/vdso/vdso2c.h | 8 +- arch/x86/entry/vdso/vma.c | 37 +- arch/x86/entry/vsyscall/vsyscall_64.c | 20 +- arch/x86/entry/vsyscall/vsyscall_emu_64.S | 2 +- arch/x86/ia32/ia32_signal.c | 23 +- arch/x86/ia32/sys_ia32.c | 42 +- arch/x86/include/asm/alternative-asm.h | 51 +- arch/x86/include/asm/alternative.h | 4 +- arch/x86/include/asm/apic.h | 2 +- arch/x86/include/asm/apm.h | 4 +- arch/x86/include/asm/atomic.h | 230 +- arch/x86/include/asm/atomic64_32.h | 100 + arch/x86/include/asm/atomic64_64.h | 164 +- arch/x86/include/asm/bitops.h | 18 +- arch/x86/include/asm/boot.h | 2 +- arch/x86/include/asm/cache.h | 5 +- arch/x86/include/asm/checksum_32.h | 12 +- arch/x86/include/asm/cmpxchg.h | 39 + arch/x86/include/asm/compat.h | 4 + arch/x86/include/asm/cpufeature.h | 16 +- arch/x86/include/asm/crypto/camellia.h | 30 +- arch/x86/include/asm/crypto/glue_helper.h | 10 +- arch/x86/include/asm/crypto/serpent-avx.h | 18 +- arch/x86/include/asm/crypto/serpent-sse2.h | 8 +- arch/x86/include/asm/crypto/twofish.h | 10 +- arch/x86/include/asm/desc.h | 78 +- arch/x86/include/asm/desc_defs.h | 6 + arch/x86/include/asm/div64.h | 2 +- arch/x86/include/asm/dma.h | 2 + arch/x86/include/asm/elf.h | 33 +- arch/x86/include/asm/emergency-restart.h | 2 +- arch/x86/include/asm/fpu/internal.h | 38 +- arch/x86/include/asm/fpu/types.h | 5 +- arch/x86/include/asm/futex.h | 14 +- arch/x86/include/asm/hw_irq.h | 4 +- arch/x86/include/asm/hypervisor.h | 2 +- arch/x86/include/asm/i8259.h | 2 +- arch/x86/include/asm/io.h | 22 +- arch/x86/include/asm/irqflags.h | 5 + arch/x86/include/asm/kprobes.h | 9 +- arch/x86/include/asm/kvm_emulate.h | 7 +- arch/x86/include/asm/local.h | 106 +- arch/x86/include/asm/mman.h | 15 + arch/x86/include/asm/mmu.h | 14 +- arch/x86/include/asm/mmu_context.h | 133 +- arch/x86/include/asm/module.h | 23 +- arch/x86/include/asm/nmi.h | 19 +- arch/x86/include/asm/page.h | 1 + arch/x86/include/asm/page_32.h | 12 +- arch/x86/include/asm/page_64.h | 14 +- arch/x86/include/asm/paravirt.h | 46 +- arch/x86/include/asm/paravirt_types.h | 13 +- arch/x86/include/asm/pgalloc.h | 23 + arch/x86/include/asm/pgtable-2level.h | 2 + arch/x86/include/asm/pgtable-3level.h | 7 + arch/x86/include/asm/pgtable.h | 126 +- arch/x86/include/asm/pgtable_32.h | 14 +- arch/x86/include/asm/pgtable_32_types.h | 24 +- arch/x86/include/asm/pgtable_64.h | 23 +- arch/x86/include/asm/pgtable_64_types.h | 5 + arch/x86/include/asm/pgtable_types.h | 27 +- arch/x86/include/asm/pmem.h | 2 +- arch/x86/include/asm/preempt.h | 2 +- arch/x86/include/asm/processor.h | 57 +- arch/x86/include/asm/ptrace.h | 15 +- arch/x86/include/asm/realmode.h | 4 +- arch/x86/include/asm/reboot.h | 10 +- arch/x86/include/asm/rmwcc.h | 84 +- arch/x86/include/asm/rwsem.h | 60 +- arch/x86/include/asm/segment.h | 27 +- arch/x86/include/asm/smap.h | 43 + arch/x86/include/asm/smp.h | 14 +- arch/x86/include/asm/stackprotector.h | 4 +- arch/x86/include/asm/stacktrace.h | 34 +- arch/x86/include/asm/switch_to.h | 4 +- arch/x86/include/asm/sys_ia32.h | 6 +- arch/x86/include/asm/thread_info.h | 27 +- arch/x86/include/asm/tlbflush.h | 77 +- arch/x86/include/asm/traps.h | 4 +- arch/x86/include/asm/uaccess.h | 210 +- arch/x86/include/asm/uaccess_32.h | 28 +- arch/x86/include/asm/uaccess_64.h | 169 +- arch/x86/include/asm/word-at-a-time.h | 2 +- arch/x86/include/asm/x86_init.h | 10 +- arch/x86/include/asm/xen/page.h | 2 +- arch/x86/include/uapi/asm/e820.h | 2 +- arch/x86/kernel/Makefile | 2 +- arch/x86/kernel/acpi/boot.c | 4 +- arch/x86/kernel/acpi/sleep.c | 4 + arch/x86/kernel/acpi/wakeup_32.S | 6 +- arch/x86/kernel/alternative.c | 124 +- arch/x86/kernel/apic/apic.c | 4 +- arch/x86/kernel/apic/apic_flat_64.c | 6 +- arch/x86/kernel/apic/apic_noop.c | 2 +- arch/x86/kernel/apic/bigsmp_32.c | 2 +- arch/x86/kernel/apic/io_apic.c | 10 +- arch/x86/kernel/apic/msi.c | 2 +- arch/x86/kernel/apic/probe_32.c | 4 +- arch/x86/kernel/apic/vector.c | 2 + arch/x86/kernel/apic/x2apic_cluster.c | 2 +- arch/x86/kernel/apic/x2apic_phys.c | 2 +- arch/x86/kernel/apic/x2apic_uv_x.c | 2 +- arch/x86/kernel/apm_32.c | 21 +- arch/x86/kernel/asm-offsets.c | 20 + arch/x86/kernel/asm-offsets_64.c | 1 + arch/x86/kernel/cpu/Makefile | 4 - arch/x86/kernel/cpu/amd.c | 2 +- arch/x86/kernel/cpu/bugs_64.c | 2 + arch/x86/kernel/cpu/common.c | 202 +- arch/x86/kernel/cpu/intel_cacheinfo.c | 14 +- arch/x86/kernel/cpu/mcheck/mce.c | 34 +- arch/x86/kernel/cpu/mcheck/p5.c | 3 + arch/x86/kernel/cpu/mcheck/winchip.c | 3 + arch/x86/kernel/cpu/microcode/intel.c | 4 +- arch/x86/kernel/cpu/mshyperv.c | 2 +- arch/x86/kernel/cpu/mtrr/generic.c | 6 +- arch/x86/kernel/cpu/mtrr/main.c | 2 +- arch/x86/kernel/cpu/mtrr/mtrr.h | 2 +- arch/x86/kernel/cpu/perf_event.c | 10 +- arch/x86/kernel/cpu/perf_event.h | 2 +- arch/x86/kernel/cpu/perf_event_amd_iommu.c | 8 +- arch/x86/kernel/cpu/perf_event_intel.c | 34 +- arch/x86/kernel/cpu/perf_event_intel_bts.c | 6 +- arch/x86/kernel/cpu/perf_event_intel_cqm.c | 4 +- arch/x86/kernel/cpu/perf_event_intel_ds.c | 7 +- arch/x86/kernel/cpu/perf_event_intel_lbr.c | 4 +- arch/x86/kernel/cpu/perf_event_intel_pt.c | 42 +- arch/x86/kernel/cpu/perf_event_intel_rapl.c | 8 +- arch/x86/kernel/cpu/perf_event_intel_uncore.c | 6 +- arch/x86/kernel/cpu/perf_event_intel_uncore.h | 14 +- arch/x86/kernel/cpu/vmware.c | 2 +- arch/x86/kernel/crash_dump_64.c | 2 +- arch/x86/kernel/doublefault.c | 8 +- arch/x86/kernel/dumpstack.c | 24 +- arch/x86/kernel/dumpstack_32.c | 25 +- arch/x86/kernel/dumpstack_64.c | 72 +- arch/x86/kernel/e820.c | 4 +- arch/x86/kernel/early_printk.c | 1 + arch/x86/kernel/espfix_64.c | 44 +- arch/x86/kernel/fpu/core.c | 24 +- arch/x86/kernel/fpu/init.c | 49 +- arch/x86/kernel/fpu/regset.c | 22 +- arch/x86/kernel/fpu/signal.c | 20 +- arch/x86/kernel/fpu/xstate.c | 6 +- arch/x86/kernel/ftrace.c | 18 +- arch/x86/kernel/head64.c | 14 +- arch/x86/kernel/head_32.S | 237 +- arch/x86/kernel/head_64.S | 173 +- arch/x86/kernel/i386_ksyms_32.c | 12 + arch/x86/kernel/i8259.c | 10 +- arch/x86/kernel/io_delay.c | 2 +- arch/x86/kernel/ioport.c | 2 +- arch/x86/kernel/irq.c | 8 +- arch/x86/kernel/irq_32.c | 45 +- arch/x86/kernel/jump_label.c | 10 +- arch/x86/kernel/kgdb.c | 21 +- arch/x86/kernel/kprobes/core.c | 28 +- arch/x86/kernel/kprobes/opt.c | 16 +- arch/x86/kernel/ksysfs.c | 2 +- arch/x86/kernel/kvm.c | 2 +- arch/x86/kernel/kvmclock.c | 20 +- arch/x86/kernel/ldt.c | 25 + arch/x86/kernel/livepatch.c | 9 +- arch/x86/kernel/machine_kexec_32.c | 6 +- arch/x86/kernel/mcount_64.S | 21 +- arch/x86/kernel/module.c | 78 +- arch/x86/kernel/msr.c | 2 +- arch/x86/kernel/nmi.c | 34 +- arch/x86/kernel/nmi_selftest.c | 4 +- arch/x86/kernel/paravirt-spinlocks.c | 2 +- arch/x86/kernel/paravirt.c | 43 +- arch/x86/kernel/paravirt_patch_64.c | 8 + arch/x86/kernel/pci-calgary_64.c | 2 +- arch/x86/kernel/pci-iommu_table.c | 2 +- arch/x86/kernel/pci-swiotlb.c | 2 +- arch/x86/kernel/process.c | 80 +- arch/x86/kernel/process_32.c | 29 +- arch/x86/kernel/process_64.c | 14 +- arch/x86/kernel/ptrace.c | 20 +- arch/x86/kernel/pvclock.c | 8 +- arch/x86/kernel/reboot.c | 44 +- arch/x86/kernel/reboot_fixups_32.c | 2 +- arch/x86/kernel/relocate_kernel_64.S | 3 +- arch/x86/kernel/setup.c | 29 +- arch/x86/kernel/setup_percpu.c | 29 +- arch/x86/kernel/signal.c | 17 +- arch/x86/kernel/smp.c | 2 +- arch/x86/kernel/smpboot.c | 29 +- arch/x86/kernel/step.c | 6 +- arch/x86/kernel/sys_i386_32.c | 184 + arch/x86/kernel/sys_x86_64.c | 28 +- arch/x86/kernel/tboot.c | 22 +- arch/x86/kernel/time.c | 8 +- arch/x86/kernel/tls.c | 7 +- arch/x86/kernel/tracepoint.c | 4 +- arch/x86/kernel/traps.c | 64 +- arch/x86/kernel/tsc.c | 2 +- arch/x86/kernel/uprobes.c | 4 +- arch/x86/kernel/vm86_32.c | 6 +- arch/x86/kernel/vmlinux.lds.S | 153 +- arch/x86/kernel/x8664_ksyms_64.c | 6 +- arch/x86/kernel/x86_init.c | 6 +- arch/x86/kvm/cpuid.c | 21 +- arch/x86/kvm/emulate.c | 20 +- arch/x86/kvm/i8259.c | 10 +- arch/x86/kvm/ioapic.c | 2 + arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/paging_tmpl.h | 2 +- arch/x86/kvm/svm.c | 10 +- arch/x86/kvm/vmx.c | 60 +- arch/x86/kvm/x86.c | 44 +- arch/x86/lguest/boot.c | 3 +- arch/x86/lib/atomic64_386_32.S | 164 + arch/x86/lib/atomic64_cx8_32.S | 98 +- arch/x86/lib/checksum_32.S | 99 +- arch/x86/lib/clear_page_64.S | 3 + arch/x86/lib/cmpxchg16b_emu.S | 3 + arch/x86/lib/copy_page_64.S | 14 +- arch/x86/lib/copy_user_64.S | 66 +- arch/x86/lib/csum-copy_64.S | 14 +- arch/x86/lib/csum-wrappers_64.c | 8 +- arch/x86/lib/getuser.S | 74 +- arch/x86/lib/insn.c | 8 +- arch/x86/lib/iomap_copy_64.S | 2 + arch/x86/lib/memcpy_64.S | 6 + arch/x86/lib/memmove_64.S | 3 +- arch/x86/lib/memset_64.S | 3 + arch/x86/lib/mmx_32.c | 243 +- arch/x86/lib/msr-reg.S | 2 + arch/x86/lib/putuser.S | 87 +- arch/x86/lib/rwsem.S | 6 +- arch/x86/lib/usercopy_32.c | 359 +- arch/x86/lib/usercopy_64.c | 22 +- arch/x86/math-emu/fpu_aux.c | 2 +- arch/x86/math-emu/fpu_entry.c | 4 +- arch/x86/math-emu/fpu_system.h | 2 +- arch/x86/mm/Makefile | 4 + arch/x86/mm/extable.c | 26 +- arch/x86/mm/fault.c | 570 +- arch/x86/mm/gup.c | 6 +- arch/x86/mm/highmem_32.c | 6 + arch/x86/mm/hugetlbpage.c | 24 +- arch/x86/mm/init.c | 111 +- arch/x86/mm/init_32.c | 111 +- arch/x86/mm/init_64.c | 46 +- arch/x86/mm/iomap_32.c | 4 + arch/x86/mm/ioremap.c | 52 +- arch/x86/mm/kmemcheck/kmemcheck.c | 4 +- arch/x86/mm/mmap.c | 40 +- arch/x86/mm/mmio-mod.c | 10 +- arch/x86/mm/mpx.c | 6 +- arch/x86/mm/numa.c | 2 +- arch/x86/mm/pageattr.c | 42 +- arch/x86/mm/pat.c | 12 +- arch/x86/mm/pat_rbtree.c | 2 +- arch/x86/mm/pf_in.c | 10 +- arch/x86/mm/pgtable.c | 209 +- arch/x86/mm/pgtable_32.c | 3 + arch/x86/mm/setup_nx.c | 7 + arch/x86/mm/tlb.c | 4 + arch/x86/mm/uderef_64.c | 37 + arch/x86/net/bpf_jit.S | 11 + arch/x86/net/bpf_jit_comp.c | 13 +- arch/x86/oprofile/backtrace.c | 6 +- arch/x86/oprofile/nmi_int.c | 10 +- arch/x86/oprofile/op_model_amd.c | 8 +- arch/x86/oprofile/op_model_ppro.c | 7 +- arch/x86/oprofile/op_x86_model.h | 2 +- arch/x86/pci/intel_mid_pci.c | 2 +- arch/x86/pci/irq.c | 8 +- arch/x86/pci/pcbios.c | 112 +- arch/x86/pci/vmd.c | 4 +- arch/x86/platform/efi/efi_32.c | 24 + arch/x86/platform/efi/efi_64.c | 26 +- arch/x86/platform/efi/efi_stub_32.S | 64 +- arch/x86/platform/efi/efi_stub_64.S | 2 + arch/x86/platform/intel-mid/intel-mid.c | 5 +- arch/x86/platform/intel-mid/intel_mid_weak_decls.h | 6 +- arch/x86/platform/intel-mid/mfld.c | 4 +- arch/x86/platform/intel-mid/mrfl.c | 2 +- arch/x86/platform/intel-quark/imr_selftest.c | 2 +- arch/x86/platform/olpc/olpc_dt.c | 2 +- arch/x86/power/cpu.c | 11 +- arch/x86/realmode/init.c | 10 +- arch/x86/realmode/rm/Makefile | 3 + arch/x86/realmode/rm/header.S | 4 +- arch/x86/realmode/rm/reboot.S | 4 + arch/x86/realmode/rm/trampoline_32.S | 12 +- arch/x86/realmode/rm/trampoline_64.S | 3 +- arch/x86/realmode/rm/wakeup_asm.S | 5 +- arch/x86/tools/Makefile | 2 +- arch/x86/tools/relocs.c | 97 +- arch/x86/um/mem_32.c | 2 +- arch/x86/um/tls_32.c | 2 +- arch/x86/xen/enlighten.c | 52 +- arch/x86/xen/mmu.c | 19 +- arch/x86/xen/smp.c | 16 +- arch/x86/xen/xen-asm_32.S | 2 +- arch/x86/xen/xen-head.S | 11 + arch/x86/xen/xen-ops.h | 2 - block/bio.c | 4 +- block/blk-cgroup.c | 18 +- block/blk-map.c | 2 +- block/blk-softirq.c | 2 +- block/bsg.c | 12 +- block/cfq-iosched.c | 4 +- block/compat_ioctl.c | 4 +- block/genhd.c | 9 +- block/partitions/efi.c | 8 +- block/scsi_ioctl.c | 29 +- crypto/cast6_generic.c | 6 +- crypto/cryptd.c | 4 +- crypto/crypto_user.c | 2 +- crypto/pcrypt.c | 2 +- crypto/salsa20_generic.c | 16 +- crypto/serpent_generic.c | 6 +- crypto/zlib.c | 12 +- drivers/acpi/ac.c | 2 +- drivers/acpi/acpi_video.c | 2 +- drivers/acpi/apei/apei-internal.h | 2 +- drivers/acpi/apei/ghes.c | 10 +- drivers/acpi/battery.c | 2 +- drivers/acpi/bgrt.c | 6 +- drivers/acpi/blacklist.c | 4 +- drivers/acpi/bus.c | 4 +- drivers/acpi/device_pm.c | 4 +- drivers/acpi/ec.c | 6 +- drivers/acpi/pci_slot.c | 2 +- drivers/acpi/processor_idle.c | 2 +- drivers/acpi/processor_pdc.c | 2 +- drivers/acpi/sleep.c | 2 +- drivers/acpi/sysfs.c | 14 +- drivers/acpi/thermal.c | 2 +- drivers/acpi/video_detect.c | 7 +- drivers/android/binder.c | 2 +- drivers/ata/libata-core.c | 12 +- drivers/ata/libata-scsi.c | 2 +- drivers/ata/libata.h | 2 +- drivers/ata/pata_arasan_cf.c | 4 +- drivers/atm/adummy.c | 2 +- drivers/atm/ambassador.c | 8 +- drivers/atm/atmtcp.c | 14 +- drivers/atm/eni.c | 10 +- drivers/atm/firestream.c | 8 +- drivers/atm/fore200e.c | 14 +- drivers/atm/he.c | 18 +- drivers/atm/horizon.c | 4 +- drivers/atm/idt77252.c | 36 +- drivers/atm/iphase.c | 34 +- drivers/atm/lanai.c | 12 +- drivers/atm/nicstar.c | 46 +- drivers/atm/solos-pci.c | 4 +- drivers/atm/suni.c | 4 +- drivers/atm/uPD98402.c | 16 +- drivers/atm/zatm.c | 6 +- drivers/base/bus.c | 4 +- drivers/base/devres.c | 4 +- drivers/base/devtmpfs.c | 8 +- drivers/base/node.c | 2 +- drivers/base/platform-msi.c | 20 +- drivers/base/power/domain.c | 6 +- drivers/base/power/runtime.c | 61 +- drivers/base/power/sysfs.c | 2 +- drivers/base/power/wakeup.c | 8 +- drivers/base/regmap/regmap-debugfs.c | 4 +- drivers/base/regmap/regmap.c | 4 +- drivers/base/syscore.c | 4 +- drivers/block/cciss.c | 28 +- drivers/block/cciss.h | 2 +- drivers/block/cpqarray.c | 28 +- drivers/block/cpqarray.h | 2 +- drivers/block/drbd/drbd_bitmap.c | 2 +- drivers/block/drbd/drbd_int.h | 8 +- drivers/block/drbd/drbd_main.c | 12 +- drivers/block/drbd/drbd_nl.c | 16 +- drivers/block/drbd/drbd_receiver.c | 38 +- drivers/block/drbd/drbd_state.c | 12 +- drivers/block/drbd/drbd_state.h | 2 +- drivers/block/drbd/drbd_state_change.h | 8 +- drivers/block/drbd/drbd_worker.c | 14 +- drivers/block/floppy.c | 8 +- drivers/block/pktcdvd.c | 4 +- drivers/block/rbd.c | 2 +- drivers/bluetooth/btwilink.c | 2 +- drivers/bus/arm-cci.c | 12 +- drivers/cdrom/cdrom.c | 11 +- drivers/cdrom/gdrom.c | 1 - drivers/char/agp/compat_ioctl.c | 2 +- drivers/char/agp/frontend.c | 4 +- drivers/char/agp/intel-gtt.c | 4 +- drivers/char/hpet.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 8 +- drivers/char/ipmi/ipmi_poweroff.c | 2 +- drivers/char/ipmi/ipmi_si_intf.c | 12 +- drivers/char/ipmi/ipmi_ssif.c | 12 +- drivers/char/mem.c | 47 +- drivers/char/nvram.c | 2 +- drivers/char/pcmcia/synclink_cs.c | 16 +- drivers/char/random.c | 12 +- drivers/char/sonypi.c | 11 +- drivers/char/tpm/tpm_acpi.c | 3 +- drivers/char/tpm/tpm_eventlog.c | 5 +- drivers/char/virtio_console.c | 6 +- drivers/clk/clk-composite.c | 2 +- drivers/clk/samsung/clk.h | 2 +- drivers/clk/socfpga/clk-gate.c | 9 +- drivers/clk/socfpga/clk-pll.c | 9 +- drivers/clk/ti/clk.c | 8 +- drivers/cpufreq/acpi-cpufreq.c | 17 +- drivers/cpufreq/cpufreq-dt.c | 4 +- drivers/cpufreq/cpufreq.c | 27 +- drivers/cpufreq/cpufreq_governor.c | 2 +- drivers/cpufreq/cpufreq_governor.h | 10 +- drivers/cpufreq/cpufreq_ondemand.c | 10 +- drivers/cpufreq/intel_pstate.c | 54 +- drivers/cpufreq/p4-clockmod.c | 12 +- drivers/cpufreq/sparc-us3-cpufreq.c | 67 +- drivers/cpufreq/speedstep-centrino.c | 7 +- drivers/cpuidle/driver.c | 2 +- drivers/cpuidle/dt_idle_states.c | 2 +- drivers/cpuidle/governor.c | 2 +- drivers/cpuidle/governors/ladder.c | 13 +- drivers/cpuidle/sysfs.c | 2 +- drivers/crypto/hifn_795x.c | 4 +- drivers/crypto/qat/qat_common/adf_aer.c | 2 +- drivers/crypto/qat/qat_common/adf_sriov.c | 4 +- drivers/crypto/qat/qat_common/adf_vf_isr.c | 6 +- drivers/devfreq/devfreq.c | 4 +- drivers/dma/sh/shdma-base.c | 4 +- drivers/dma/sh/shdmac.c | 2 +- drivers/edac/edac_device.c | 4 +- drivers/edac/edac_device_sysfs.c | 2 +- drivers/edac/edac_mc_sysfs.c | 4 +- drivers/edac/edac_module.c | 2 +- drivers/edac/edac_pci.c | 4 +- drivers/edac/edac_pci_sysfs.c | 22 +- drivers/edac/mce_amd.h | 2 +- drivers/firewire/core-card.c | 6 +- drivers/firewire/core-cdev.c | 4 +- drivers/firewire/core-device.c | 2 +- drivers/firewire/core-iso.c | 2 +- drivers/firewire/core-transaction.c | 1 + drivers/firewire/core.h | 1 + drivers/firmware/dmi-id.c | 9 +- drivers/firmware/dmi_scan.c | 12 +- drivers/firmware/efi/cper.c | 8 +- drivers/firmware/efi/efi.c | 12 +- drivers/firmware/efi/efivars.c | 2 +- drivers/firmware/efi/runtime-map.c | 2 +- drivers/firmware/google/gsmi.c | 2 +- drivers/firmware/google/memconsole.c | 7 +- drivers/firmware/memmap.c | 2 +- drivers/firmware/psci.c | 2 +- drivers/gpio/gpio-davinci.c | 6 +- drivers/gpio/gpio-em.c | 2 +- drivers/gpio/gpio-ich.c | 2 +- drivers/gpio/gpio-omap.c | 4 +- drivers/gpio/gpio-rcar.c | 2 +- drivers/gpio/gpio-vr41xx.c | 2 +- drivers/gpio/gpiolib.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 18 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 +- drivers/gpu/drm/amd/amdgpu/fiji_smc.c | 4 +- drivers/gpu/drm/amd/amdgpu/iceland_smc.c | 4 +- drivers/gpu/drm/amd/amdgpu/tonga_smc.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 6 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 90 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.h | 8 +- .../drm/amd/amdkfd/kfd_device_queue_manager_cik.c | 14 +- .../drm/amd/amdkfd/kfd_device_queue_manager_vi.c | 14 +- drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.h | 2 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 16 +- drivers/gpu/drm/amd/scheduler/gpu_scheduler.c | 2 +- drivers/gpu/drm/amd/scheduler/gpu_scheduler.h | 2 +- drivers/gpu/drm/amd/scheduler/sched_fence.c | 2 +- drivers/gpu/drm/armada/armada_drv.c | 3 +- drivers/gpu/drm/ast/ast_mode.c | 2 +- drivers/gpu/drm/bochs/bochs_kms.c | 2 +- drivers/gpu/drm/drm_atomic.c | 7 +- drivers/gpu/drm/drm_crtc.c | 10 +- drivers/gpu/drm/drm_drv.c | 2 +- drivers/gpu/drm/drm_fops.c | 12 +- drivers/gpu/drm/drm_global.c | 14 +- drivers/gpu/drm/drm_info.c | 13 +- drivers/gpu/drm/drm_ioc32.c | 13 +- drivers/gpu/drm/drm_ioctl.c | 2 +- drivers/gpu/drm/drm_irq.c | 7 +- drivers/gpu/drm/drm_pci.c | 9 +- drivers/gpu/drm/exynos/exynos_drm_drv.c | 1 - drivers/gpu/drm/exynos/exynos_drm_g2d.c | 7 +- drivers/gpu/drm/gma500/cdv_intel_crt.c | 2 +- drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +- drivers/gpu/drm/gma500/cdv_intel_hdmi.c | 2 +- drivers/gpu/drm/gma500/cdv_intel_lvds.c | 2 +- drivers/gpu/drm/gma500/mdfld_dsi_output.c | 8 +- drivers/gpu/drm/gma500/oaktrail_hdmi.c | 2 +- drivers/gpu/drm/gma500/psb_drv.c | 1 - drivers/gpu/drm/gma500/psb_intel_drv.h | 2 +- drivers/gpu/drm/gma500/psb_intel_lvds.c | 2 +- drivers/gpu/drm/gma500/psb_intel_sdvo.c | 2 +- drivers/gpu/drm/i2c/tda998x_drv.c | 2 +- drivers/gpu/drm/i810/i810_dma.c | 2 +- drivers/gpu/drm/i810/i810_drv.c | 6 +- drivers/gpu/drm/i810/i810_drv.h | 6 +- drivers/gpu/drm/i915/dvo.h | 2 +- drivers/gpu/drm/i915/i915_dma.c | 4 +- drivers/gpu/drm/i915/i915_drv.c | 7 +- drivers/gpu/drm/i915/i915_drv.h | 2 +- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 4 +- drivers/gpu/drm/i915/i915_gem_gtt.c | 16 +- drivers/gpu/drm/i915/i915_gem_gtt.h | 6 +- drivers/gpu/drm/i915/i915_ioc32.c | 10 +- drivers/gpu/drm/i915/i915_irq.c | 88 +- drivers/gpu/drm/i915/intel_display.c | 26 +- drivers/gpu/drm/imx/imx-drm-core.c | 2 +- drivers/gpu/drm/mga/mga_drv.c | 5 +- drivers/gpu/drm/mga/mga_drv.h | 6 +- drivers/gpu/drm/mga/mga_ioc32.c | 10 +- drivers/gpu/drm/mga/mga_irq.c | 8 +- drivers/gpu/drm/mga/mga_state.c | 2 +- drivers/gpu/drm/mgag200/mgag200_mode.c | 2 +- drivers/gpu/drm/nouveau/nouveau_acpi.c | 2 +- drivers/gpu/drm/nouveau/nouveau_bios.c | 2 +- drivers/gpu/drm/nouveau/nouveau_connector.c | 2 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 13 +- drivers/gpu/drm/nouveau/nouveau_drm.h | 1 - drivers/gpu/drm/nouveau/nouveau_ioc32.c | 2 +- drivers/gpu/drm/nouveau/nouveau_usif.c | 7 +- drivers/gpu/drm/nouveau/nouveau_vga.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 7 +- .../gpu/drm/nouveau/nvkm/subdev/bios/shadowpci.c | 7 +- drivers/gpu/drm/omapdrm/Makefile | 2 +- drivers/gpu/drm/omapdrm/dss/display.c | 8 +- drivers/gpu/drm/qxl/qxl_cmd.c | 12 +- drivers/gpu/drm/qxl/qxl_debugfs.c | 8 +- drivers/gpu/drm/qxl/qxl_display.c | 2 +- drivers/gpu/drm/qxl/qxl_drv.c | 8 +- drivers/gpu/drm/qxl/qxl_drv.h | 8 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 12 +- drivers/gpu/drm/qxl/qxl_irq.c | 16 +- drivers/gpu/drm/qxl/qxl_ttm.c | 38 +- drivers/gpu/drm/r128/r128_cce.c | 2 +- drivers/gpu/drm/r128/r128_drv.c | 4 +- drivers/gpu/drm/r128/r128_drv.h | 6 +- drivers/gpu/drm/r128/r128_ioc32.c | 10 +- drivers/gpu/drm/r128/r128_irq.c | 4 +- drivers/gpu/drm/r128/r128_state.c | 6 +- drivers/gpu/drm/radeon/mkregtable.c | 4 +- drivers/gpu/drm/radeon/radeon_atpx_handler.c | 2 +- drivers/gpu/drm/radeon/radeon_connectors.c | 10 +- drivers/gpu/drm/radeon/radeon_device.c | 2 +- drivers/gpu/drm/radeon/radeon_drv.c | 11 +- drivers/gpu/drm/radeon/radeon_ioc32.c | 12 +- drivers/gpu/drm/radeon/radeon_kms.c | 8 +- drivers/gpu/drm/radeon/radeon_ttm.c | 4 +- drivers/gpu/drm/savage/savage_bci.c | 2 +- drivers/gpu/drm/savage/savage_drv.c | 5 +- drivers/gpu/drm/savage/savage_drv.h | 2 +- drivers/gpu/drm/sis/sis_drv.c | 5 +- drivers/gpu/drm/sis/sis_drv.h | 2 +- drivers/gpu/drm/sis/sis_mm.c | 2 +- drivers/gpu/drm/tegra/dc.c | 2 +- drivers/gpu/drm/tegra/dsi.c | 2 +- drivers/gpu/drm/tegra/hdmi.c | 2 +- drivers/gpu/drm/tegra/sor.c | 7 +- drivers/gpu/drm/tilcdc/Makefile | 6 +- drivers/gpu/drm/ttm/ttm_memory.c | 4 +- drivers/gpu/drm/ttm/ttm_page_alloc.c | 18 +- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 18 +- drivers/gpu/drm/udl/udl_connector.c | 2 +- drivers/gpu/drm/udl/udl_fb.c | 1 - drivers/gpu/drm/vc4/vc4_drv.c | 8 +- drivers/gpu/drm/via/via_dma.c | 2 +- drivers/gpu/drm/via/via_drv.c | 5 +- drivers/gpu/drm/via/via_drv.h | 6 +- drivers/gpu/drm/via/via_irq.c | 18 +- drivers/gpu/drm/virtio/virtgpu_display.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 7 +- drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_irq.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_marker.c | 2 +- drivers/gpu/vga/vga_switcheroo.c | 4 +- drivers/hid/hid-core.c | 4 +- drivers/hid/hid-magicmouse.c | 2 +- drivers/hid/hid-sensor-custom.c | 2 +- drivers/hv/channel.c | 6 +- drivers/hv/hv.c | 4 +- drivers/hv/hv_balloon.c | 18 +- drivers/hv/hyperv_vmbus.h | 2 +- drivers/hwmon/acpi_power_meter.c | 6 +- drivers/hwmon/applesmc.c | 2 +- drivers/hwmon/asus_atk0110.c | 10 +- drivers/hwmon/coretemp.c | 2 +- drivers/hwmon/dell-smm-hwmon.c | 2 +- drivers/hwmon/ibmaem.c | 2 +- drivers/hwmon/iio_hwmon.c | 2 +- drivers/hwmon/nct6683.c | 6 +- drivers/hwmon/nct6775.c | 6 +- drivers/hwmon/pmbus/pmbus_core.c | 10 +- drivers/hwmon/sht15.c | 12 +- drivers/hwmon/via-cputemp.c | 2 +- drivers/i2c/busses/i2c-amd756-s4882.c | 2 +- drivers/i2c/busses/i2c-designware-pcidrv.c | 2 +- drivers/i2c/busses/i2c-nforce2-s4985.c | 2 +- drivers/i2c/i2c-dev.c | 2 +- drivers/ide/ide-cd.c | 2 +- drivers/ide/ide-disk.c | 2 +- drivers/ide/ide.c | 4 +- drivers/idle/intel_idle.c | 6 +- drivers/iio/industrialio-core.c | 2 +- drivers/iio/magnetometer/ak8975.c | 2 +- drivers/infiniband/core/cm.c | 46 +- drivers/infiniband/core/fmr_pool.c | 20 +- drivers/infiniband/core/netlink.c | 5 +- drivers/infiniband/core/ucm.c | 4 +- drivers/infiniband/core/uverbs_cmd.c | 3 + drivers/infiniband/hw/cxgb4/device.c | 6 +- drivers/infiniband/hw/cxgb4/iw_cxgb4.h | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 4 +- drivers/infiniband/hw/mlx4/mad.c | 2 +- drivers/infiniband/hw/mlx4/mcg.c | 2 +- drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 +- drivers/infiniband/hw/mthca/mthca_cmd.c | 8 +- drivers/infiniband/hw/mthca/mthca_main.c | 2 +- drivers/infiniband/hw/mthca/mthca_mr.c | 6 +- drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/nes/nes.c | 4 +- drivers/infiniband/hw/nes/nes.h | 40 +- drivers/infiniband/hw/nes/nes_cm.c | 62 +- drivers/infiniband/hw/nes/nes_mgt.c | 8 +- drivers/infiniband/hw/nes/nes_nic.c | 42 +- drivers/infiniband/hw/nes/nes_verbs.c | 10 +- drivers/infiniband/hw/qib/qib.h | 1 + drivers/infiniband/hw/qib/qib_iba7322.c | 4 +- drivers/infiniband/hw/qib/qib_pcie.c | 2 +- drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 +- drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 2 +- drivers/infiniband/ulp/srpt/ib_srpt.c | 8 +- drivers/input/evdev.c | 2 +- drivers/input/gameport/gameport.c | 4 +- drivers/input/input.c | 4 +- drivers/input/joystick/sidewinder.c | 1 + drivers/input/misc/ims-pcu.c | 4 +- drivers/input/mouse/psmouse.h | 2 +- drivers/input/mousedev.c | 2 +- drivers/input/serio/serio.c | 4 +- drivers/input/serio/serio_raw.c | 4 +- drivers/input/touchscreen/htcpen.c | 2 +- drivers/iommu/arm-smmu-v3.c | 2 +- drivers/iommu/arm-smmu.c | 42 +- drivers/iommu/io-pgtable-arm.c | 98 +- drivers/iommu/io-pgtable.c | 11 +- drivers/iommu/io-pgtable.h | 21 +- drivers/iommu/iommu.c | 2 +- drivers/iommu/ipmmu-vmsa.c | 13 +- drivers/iommu/irq_remapping.c | 2 +- drivers/irqchip/irq-gic.c | 2 +- drivers/irqchip/irq-i8259.c | 2 +- drivers/irqchip/irq-renesas-intc-irqpin.c | 2 +- drivers/irqchip/irq-ts4800.c | 2 +- drivers/isdn/capi/capi.c | 10 +- drivers/isdn/gigaset/interface.c | 8 +- drivers/isdn/gigaset/usb-gigaset.c | 2 +- drivers/isdn/hardware/avm/b1.c | 4 +- drivers/isdn/hardware/eicon/capifunc.c | 6 +- drivers/isdn/hardware/eicon/dadapter.c | 18 +- drivers/isdn/hardware/eicon/diddfunc.c | 7 +- drivers/isdn/hardware/eicon/divasfunc.c | 9 +- drivers/isdn/hardware/eicon/divasync.h | 2 +- drivers/isdn/hardware/eicon/idifunc.c | 9 +- drivers/isdn/hardware/eicon/mntfunc.c | 13 +- drivers/isdn/hardware/mISDN/avmfritz.c | 2 +- drivers/isdn/hardware/mISDN/hfcmulti.c | 7 +- drivers/isdn/hardware/mISDN/hfcpci.c | 16 +- drivers/isdn/hardware/mISDN/mISDNinfineon.c | 7 +- drivers/isdn/hardware/mISDN/mISDNipac.c | 5 +- drivers/isdn/hardware/mISDN/netjet.c | 2 +- drivers/isdn/hardware/mISDN/speedfax.c | 7 +- drivers/isdn/hardware/mISDN/w6692.c | 7 +- drivers/isdn/hisax/amd7930_fn.c | 5 +- drivers/isdn/hisax/arcofi.c | 5 +- drivers/isdn/hisax/diva.c | 7 +- drivers/isdn/hisax/elsa.c | 9 +- drivers/isdn/hisax/fsm.c | 5 +- drivers/isdn/hisax/hfc4s8s_l1.c | 14 +- drivers/isdn/hisax/hfc_pci.c | 10 +- drivers/isdn/hisax/hfc_sx.c | 10 +- drivers/isdn/hisax/hfc_usb.c | 12 +- drivers/isdn/hisax/icc.c | 5 +- drivers/isdn/hisax/ipacx.c | 7 +- drivers/isdn/hisax/isac.c | 5 +- drivers/isdn/hisax/isar.c | 5 +- drivers/isdn/hisax/isdnl3.c | 5 +- drivers/isdn/hisax/w6692.c | 5 +- drivers/isdn/i4l/isdn_common.c | 2 + drivers/isdn/i4l/isdn_tty.c | 22 +- drivers/isdn/icn/icn.c | 2 +- drivers/isdn/mISDN/dsp.h | 4 +- drivers/isdn/mISDN/dsp_cmx.c | 4 +- drivers/isdn/mISDN/dsp_core.c | 4 +- drivers/isdn/mISDN/dsp_tones.c | 4 +- drivers/isdn/mISDN/fsm.c | 5 +- drivers/isdn/mISDN/l1oip_core.c | 8 +- drivers/lguest/core.c | 9 +- drivers/lguest/page_tables.c | 2 +- drivers/lguest/x86/core.c | 12 +- drivers/lguest/x86/switcher_32.S | 27 +- drivers/lightnvm/rrpc.c | 4 +- drivers/lightnvm/rrpc.h | 2 +- drivers/md/bcache/alloc.c | 2 +- drivers/md/bcache/bcache.h | 10 +- drivers/md/bcache/btree.c | 2 +- drivers/md/bcache/closure.h | 2 +- drivers/md/bcache/io.c | 10 +- drivers/md/bcache/journal.c | 2 +- drivers/md/bcache/stats.c | 26 +- drivers/md/bcache/stats.h | 16 +- drivers/md/bcache/super.c | 2 +- drivers/md/bcache/sysfs.c | 20 +- drivers/md/bitmap.c | 2 +- drivers/md/dm-cache-target.c | 116 +- drivers/md/dm-ioctl.c | 2 +- drivers/md/dm-raid.c | 2 +- drivers/md/dm-raid1.c | 18 +- drivers/md/dm-stats.c | 6 +- drivers/md/dm-stripe.c | 10 +- drivers/md/dm-table.c | 2 +- drivers/md/dm-thin-metadata.c | 4 +- drivers/md/dm.c | 28 +- drivers/md/md.c | 41 +- drivers/md/md.h | 8 +- drivers/md/persistent-data/dm-space-map-metadata.c | 4 +- drivers/md/persistent-data/dm-space-map.h | 1 + drivers/md/raid1.c | 8 +- drivers/md/raid10.c | 20 +- drivers/md/raid5.c | 26 +- drivers/media/dvb-core/dvb_net.c | 2 +- drivers/media/dvb-core/dvbdev.c | 2 +- drivers/media/dvb-frontends/af9033.h | 2 +- drivers/media/dvb-frontends/cx24116.c | 2 +- drivers/media/dvb-frontends/cx24117.c | 2 +- drivers/media/dvb-frontends/cx24120.c | 2 +- drivers/media/dvb-frontends/cx24123.c | 2 +- drivers/media/dvb-frontends/cxd2820r_core.c | 2 +- drivers/media/dvb-frontends/dib3000.h | 2 +- drivers/media/dvb-frontends/dib7000p.h | 2 +- drivers/media/dvb-frontends/dib8000.h | 2 +- drivers/media/dvb-frontends/hd29l2.c | 2 +- drivers/media/dvb-frontends/lgdt3306a.c | 2 +- drivers/media/dvb-frontends/mt312.c | 6 +- drivers/media/dvb-frontends/s921.c | 2 +- drivers/media/pci/bt8xx/dst.c | 2 +- drivers/media/pci/cx88/cx88-video.c | 6 +- drivers/media/pci/ivtv/ivtv-driver.c | 2 +- drivers/media/pci/pt1/va1j5jf8007s.c | 2 +- drivers/media/pci/pt1/va1j5jf8007t.c | 2 +- drivers/media/pci/solo6x10/solo6x10-core.c | 2 +- drivers/media/pci/solo6x10/solo6x10-p2m.c | 2 +- drivers/media/pci/solo6x10/solo6x10.h | 2 +- drivers/media/pci/tw68/tw68-core.c | 2 +- drivers/media/pci/zoran/zoran.h | 1 - drivers/media/pci/zoran/zoran_card.c | 4 +- drivers/media/pci/zoran/zoran_driver.c | 3 - drivers/media/platform/omap/omap_vout.c | 11 +- drivers/media/platform/s5p-tv/mixer.h | 2 +- drivers/media/platform/s5p-tv/mixer_grp_layer.c | 2 +- drivers/media/platform/s5p-tv/mixer_reg.c | 2 +- drivers/media/platform/s5p-tv/mixer_video.c | 24 +- drivers/media/platform/s5p-tv/mixer_vp_layer.c | 2 +- drivers/media/platform/soc_camera/soc_camera.c | 2 +- drivers/media/radio/radio-cadet.c | 2 + drivers/media/radio/radio-maxiradio.c | 2 +- drivers/media/radio/radio-shark.c | 2 +- drivers/media/radio/radio-shark2.c | 2 +- drivers/media/radio/radio-si476x.c | 2 +- drivers/media/radio/wl128x/fmdrv_common.c | 2 +- drivers/media/usb/pvrusb2/pvrusb2-context.c | 8 +- drivers/media/usb/pvrusb2/pvrusb2-dvb.c | 7 +- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 2 +- drivers/media/usb/pvrusb2/pvrusb2-std.c | 2 +- drivers/media/usb/pvrusb2/pvrusb2-v4l2.c | 6 +- drivers/media/usb/uvc/uvc_driver.c | 4 +- drivers/media/v4l2-core/v4l2-common.c | 2 +- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 12 +- drivers/media/v4l2-core/v4l2-device.c | 4 +- drivers/media/v4l2-core/v4l2-ioctl.c | 293 +- drivers/memory/omap-gpmc.c | 21 +- drivers/message/fusion/mptbase.c | 4 +- drivers/message/fusion/mptlan.c | 2 +- drivers/message/fusion/mptsas.c | 34 +- drivers/mfd/ab8500-debugfs.c | 2 +- drivers/mfd/kempld-core.c | 2 +- drivers/mfd/max8925-i2c.c | 2 +- drivers/mfd/tps65910.c | 2 +- drivers/mfd/twl4030-irq.c | 9 +- drivers/misc/c2port/core.c | 4 +- drivers/misc/kgdbts.c | 6 +- drivers/misc/lis3lv02d/lis3lv02d.c | 8 +- drivers/misc/lis3lv02d/lis3lv02d.h | 2 +- drivers/misc/mic/scif/scif_api.c | 10 +- drivers/misc/mic/scif/scif_rb.c | 8 +- drivers/misc/sgi-gru/gruhandles.c | 4 +- drivers/misc/sgi-gru/gruprocfs.c | 8 +- drivers/misc/sgi-gru/grutables.h | 158 +- drivers/misc/sgi-xp/xp.h | 2 +- drivers/misc/sgi-xp/xp_main.c | 57 +- drivers/misc/sgi-xp/xpc.h | 3 +- drivers/misc/sgi-xp/xpc_main.c | 2 +- drivers/misc/sgi-xp/xpnet.c | 2 +- drivers/misc/ti-st/st_kim.c | 32 +- drivers/mmc/card/mmc_test.c | 4 +- drivers/mmc/host/dw_mmc.h | 2 +- drivers/mmc/host/mmci.c | 4 +- drivers/mmc/host/omap_hsmmc.c | 4 +- drivers/mmc/host/sdhci-esdhc-imx.c | 7 +- drivers/mmc/host/sdhci-s3c.c | 8 +- drivers/mtd/chips/cfi_cmdset_0020.c | 2 +- drivers/mtd/devices/block2mtd.c | 2 +- drivers/mtd/devices/phram.c | 2 +- drivers/mtd/maps/gpio-addr-flash.c | 2 +- drivers/mtd/maps/latch-addr-flash.c | 2 +- drivers/mtd/maps/pci.c | 4 +- drivers/mtd/maps/pcmciamtd.c | 8 +- drivers/mtd/maps/sbc_gxx.c | 2 +- drivers/mtd/nand/cafe_nand.c | 18 +- drivers/mtd/nand/denali.c | 1 + drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 2 +- drivers/mtd/nftlmount.c | 1 + drivers/mtd/sm_ftl.c | 2 +- drivers/mtd/ubi/build.c | 2 +- drivers/net/bonding/bond_netlink.c | 2 +- drivers/net/caif/caif_hsi.c | 4 +- drivers/net/caif/caif_serial.c | 2 +- drivers/net/caif/caif_spi.c | 2 +- drivers/net/caif/caif_virtio.c | 2 +- drivers/net/can/Kconfig | 2 +- drivers/net/can/dev.c | 2 +- drivers/net/can/janz-ican3.c | 2 +- drivers/net/can/led.c | 2 +- drivers/net/can/sun4i_can.c | 2 +- drivers/net/can/vcan.c | 2 +- drivers/net/can/xilinx_can.c | 2 +- drivers/net/dummy.c | 2 +- drivers/net/ethernet/8390/ax88796.c | 4 +- drivers/net/ethernet/8390/axnet_cs.c | 4 +- drivers/net/ethernet/8390/ne2k-pci.c | 6 +- drivers/net/ethernet/8390/pcnet_cs.c | 4 +- drivers/net/ethernet/altera/altera_tse_main.c | 6 +- drivers/net/ethernet/amd/amd8111e.c | 5 +- drivers/net/ethernet/amd/pcnet32.c | 7 +- drivers/net/ethernet/amd/xgbe/xgbe-common.h | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-dcb.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-desc.c | 27 +- drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 143 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 66 +- drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 10 +- drivers/net/ethernet/amd/xgbe/xgbe-main.c | 15 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 27 +- drivers/net/ethernet/amd/xgbe/xgbe-ptp.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe.h | 10 +- drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 4 +- drivers/net/ethernet/arc/emac_main.c | 2 +- drivers/net/ethernet/atheros/alx/main.c | 2 +- drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 2 +- drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 2 +- drivers/net/ethernet/aurora/nb8800.c | 2 +- drivers/net/ethernet/broadcom/bnx2.c | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 216 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h | 4 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c | 11 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 3 +- drivers/net/ethernet/broadcom/tg3.c | 2 +- drivers/net/ethernet/broadcom/tg3.h | 1 + drivers/net/ethernet/brocade/bna/bfa_cs.h | 42 +- drivers/net/ethernet/brocade/bna/bfa_ioc.c | 10 +- drivers/net/ethernet/brocade/bna/bfa_ioc.h | 4 +- drivers/net/ethernet/brocade/bna/bfa_msgq.h | 8 +- drivers/net/ethernet/brocade/bna/bna_enet.c | 6 +- drivers/net/ethernet/brocade/bna/bna_tx_rx.c | 6 +- drivers/net/ethernet/brocade/bna/bna_types.h | 24 +- drivers/net/ethernet/brocade/bna/bnad.c | 11 +- drivers/net/ethernet/cadence/macb.c | 4 +- drivers/net/ethernet/cavium/liquidio/lio_ethtool.c | 6 +- drivers/net/ethernet/cavium/liquidio/lio_main.c | 15 +- drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 2 +- drivers/net/ethernet/chelsio/cxgb3/l2t.h | 2 +- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 +- drivers/net/ethernet/chelsio/cxgb4vf/adapter.h | 2 +- drivers/net/ethernet/chelsio/cxgb4vf/sge.c | 2 +- drivers/net/ethernet/dec/tulip/de4x5.c | 13 +- drivers/net/ethernet/emulex/benet/be_main.c | 4 +- drivers/net/ethernet/faraday/ftgmac100.c | 2 + drivers/net/ethernet/faraday/ftmac100.c | 2 + drivers/net/ethernet/hisilicon/hip04_eth.c | 2 +- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 2 +- drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 6 +- drivers/net/ethernet/intel/e100.c | 2 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 2 +- drivers/net/ethernet/intel/e1000e/netdev.c | 2 +- drivers/net/ethernet/intel/fm10k/fm10k_pci.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_ptp.c | 2 +- drivers/net/ethernet/intel/igb/igb_main.c | 2 +- drivers/net/ethernet/intel/igbvf/netdev.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 2 +- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 4 +- drivers/net/ethernet/marvell/pxa168_eth.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 4 +- drivers/net/ethernet/mellanox/mlx4/main.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +- drivers/net/ethernet/micrel/ks8851_mll.c | 2 +- drivers/net/ethernet/neterion/s2io.c | 2 +- drivers/net/ethernet/neterion/vxge/vxge-config.c | 7 +- drivers/net/ethernet/neterion/vxge/vxge-main.c | 2 +- .../net/ethernet/netronome/nfp/nfp_net_common.c | 2 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- .../net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | 4 +- .../net/ethernet/qlogic/netxen/netxen_nic_main.c | 2 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 4 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c | 12 +- drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 2 +- .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 +- drivers/net/ethernet/realtek/r8169.c | 8 +- drivers/net/ethernet/renesas/sh_eth.c | 2 +- drivers/net/ethernet/rocker/rocker.c | 4 +- drivers/net/ethernet/sfc/ptp.c | 2 +- drivers/net/ethernet/sfc/selftest.c | 20 +- drivers/net/ethernet/smsc/smsc911x.c | 2 +- drivers/net/ethernet/stmicro/stmmac/mmc_core.c | 4 +- drivers/net/ethernet/synopsys/dwc_eth_qos.c | 2 +- drivers/net/ethernet/via/via-rhine.c | 2 +- drivers/net/ethernet/wiznet/w5100.c | 2 +- drivers/net/ethernet/wiznet/w5300.c | 2 +- drivers/net/geneve.c | 2 +- drivers/net/hyperv/hyperv_net.h | 2 +- drivers/net/hyperv/netvsc_drv.c | 2 +- drivers/net/hyperv/rndis_filter.c | 7 +- drivers/net/ifb.c | 2 +- drivers/net/ipvlan/ipvlan_core.c | 2 +- drivers/net/ipvlan/ipvlan_main.c | 6 +- drivers/net/irda/sh_irda.c | 2 +- drivers/net/irda/vlsi_ir.c | 18 +- drivers/net/irda/vlsi_ir.h | 14 +- drivers/net/macvlan.c | 20 +- drivers/net/macvtap.c | 10 +- drivers/net/nlmon.c | 2 +- drivers/net/phy/phy_device.c | 6 +- drivers/net/plip/plip.c | 2 +- drivers/net/ppp/ppp_generic.c | 4 +- drivers/net/ppp/pptp.c | 1 + drivers/net/rionet.c | 2 +- drivers/net/slip/slhc.c | 2 +- drivers/net/team/team.c | 4 +- drivers/net/tun.c | 7 +- drivers/net/usb/hso.c | 28 +- drivers/net/usb/ipheth.c | 2 +- drivers/net/usb/r8152.c | 2 +- drivers/net/usb/sierra_net.c | 4 +- drivers/net/virtio_net.c | 2 +- drivers/net/vrf.c | 4 +- drivers/net/vxlan.c | 4 +- drivers/net/wimax/i2400m/rx.c | 2 +- drivers/net/wireless/ath/ath10k/ce.c | 6 +- drivers/net/wireless/ath/ath10k/htc.h | 4 +- drivers/net/wireless/ath/ath6kl/core.h | 2 +- drivers/net/wireless/ath/ath6kl/txrx.c | 2 +- drivers/net/wireless/ath/ath9k/ar9002_mac.c | 36 +- drivers/net/wireless/ath/ath9k/ar9003_mac.c | 64 +- drivers/net/wireless/ath/ath9k/hw.h | 4 +- drivers/net/wireless/ath/ath9k/main.c | 22 +- drivers/net/wireless/ath/carl9170/carl9170.h | 6 +- drivers/net/wireless/ath/carl9170/debug.c | 6 +- drivers/net/wireless/ath/carl9170/main.c | 10 +- drivers/net/wireless/ath/carl9170/tx.c | 4 +- drivers/net/wireless/ath/wil6210/pcie_bus.c | 2 +- drivers/net/wireless/ath/wil6210/wil_platform.h | 2 +- drivers/net/wireless/atmel/at76c50x-usb.c | 2 +- drivers/net/wireless/atmel/atmel.c | 183 +- drivers/net/wireless/broadcom/b43/phy_lp.c | 2 +- drivers/net/wireless/broadcom/b43legacy/main.c | 5 +- .../broadcom/brcm80211/brcmsmac/phy/phy_cmn.c | 3 +- .../broadcom/brcm80211/brcmsmac/phy_shim.c | 5 +- .../broadcom/brcm80211/brcmsmac/phy_shim.h | 2 +- drivers/net/wireless/cisco/airo.c | 201 +- drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 +- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 6 +- drivers/net/wireless/intel/iwlegacy/3945-mac.c | 11 +- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 7 +- drivers/net/wireless/intel/iwlwifi/dvm/debugfs.c | 34 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 4 +- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 2 +- drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 4 +- .../net/wireless/intersil/hostap/hostap_ioctl.c | 134 +- drivers/net/wireless/intersil/orinoco/wext.c | 131 +- drivers/net/wireless/intersil/prism54/isl_ioctl.c | 292 +- drivers/net/wireless/mac80211_hwsim.c | 28 +- drivers/net/wireless/marvell/mwifiex/main.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2400pci.c | 4 +- drivers/net/wireless/ralink/rt2x00/rt2500pci.c | 4 +- drivers/net/wireless/ralink/rt2x00/rt2500usb.c | 4 +- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 6 +- drivers/net/wireless/ralink/rt2x00/rt2x00.h | 2 +- drivers/net/wireless/ralink/rt2x00/rt2x00queue.c | 4 +- drivers/net/wireless/ralink/rt2x00/rt61pci.c | 4 +- drivers/net/wireless/ralink/rt2x00/rt73usb.c | 4 +- drivers/net/wireless/realtek/rtlwifi/base.c | 14 +- drivers/net/wireless/realtek/rtlwifi/base.h | 4 +- drivers/net/wireless/realtek/rtlwifi/pci.c | 15 +- drivers/net/wireless/realtek/rtlwifi/ps.c | 6 +- drivers/net/wireless/realtek/rtlwifi/ps.h | 6 +- drivers/net/wireless/ti/wl1251/sdio.c | 12 +- drivers/net/wireless/ti/wl12xx/main.c | 8 +- drivers/net/wireless/ti/wl18xx/main.c | 6 +- drivers/net/wireless/zydas/zd1201.c | 192 +- drivers/nvme/host/pci.c | 2 +- drivers/of/fdt.c | 4 +- drivers/oprofile/buffer_sync.c | 8 +- drivers/oprofile/event_buffer.c | 2 +- drivers/oprofile/oprof.c | 2 +- drivers/oprofile/oprofile_stats.c | 10 +- drivers/oprofile/oprofile_stats.h | 10 +- drivers/oprofile/oprofilefs.c | 2 +- drivers/oprofile/timer_int.c | 2 +- drivers/parport/procfs.c | 4 +- drivers/pci/host/pci-host-generic.c | 2 +- drivers/pci/hotplug/acpiphp_ibm.c | 4 +- drivers/pci/hotplug/cpcihp_generic.c | 6 +- drivers/pci/hotplug/cpcihp_zt5550.c | 14 +- drivers/pci/hotplug/cpqphp_nvram.c | 2 + drivers/pci/hotplug/pci_hotplug_core.c | 6 +- drivers/pci/hotplug/pciehp_core.c | 2 +- drivers/pci/msi.c | 22 +- drivers/pci/pci-sysfs.c | 6 +- drivers/pci/pci.h | 4 +- drivers/pci/pcie/aspm.c | 10 +- drivers/pci/pcie/portdrv_pci.c | 2 +- drivers/pci/probe.c | 2 +- drivers/pci/setup-bus.c | 2 +- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 2 +- drivers/pinctrl/pinctrl-at91.c | 5 +- drivers/platform/chrome/chromeos_pstore.c | 2 +- drivers/platform/x86/alienware-wmi.c | 4 +- drivers/platform/x86/apple-gmux.c | 2 +- drivers/platform/x86/compal-laptop.c | 2 +- drivers/platform/x86/hdaps.c | 2 +- drivers/platform/x86/ibm_rtl.c | 2 +- drivers/platform/x86/intel_oaktrail.c | 2 +- drivers/platform/x86/msi-laptop.c | 16 +- drivers/platform/x86/msi-wmi.c | 2 +- drivers/platform/x86/samsung-laptop.c | 2 +- drivers/platform/x86/samsung-q10.c | 2 +- drivers/platform/x86/sony-laptop.c | 14 +- drivers/platform/x86/thinkpad_acpi.c | 11 +- drivers/pnp/pnpbios/bioscalls.c | 14 +- drivers/pnp/pnpbios/core.c | 2 +- drivers/power/pda_power.c | 7 +- drivers/power/power_supply.h | 4 +- drivers/power/power_supply_core.c | 7 +- drivers/power/power_supply_sysfs.c | 6 +- drivers/power/reset/at91-reset.c | 5 +- drivers/powercap/powercap_sys.c | 136 +- drivers/ptp/ptp_private.h | 2 +- drivers/ptp/ptp_sysfs.c | 2 +- drivers/regulator/core.c | 4 +- drivers/regulator/max8660.c | 6 +- drivers/regulator/max8973-regulator.c | 16 +- drivers/regulator/mc13892-regulator.c | 8 +- drivers/remoteproc/remoteproc_core.c | 26 +- drivers/rtc/rtc-armada38x.c | 7 +- drivers/rtc/rtc-cmos.c | 4 +- drivers/rtc/rtc-ds1307.c | 2 +- drivers/rtc/rtc-m48t59.c | 4 +- drivers/rtc/rtc-rv8803.c | 15 +- drivers/rtc/rtc-rx8010.c | 8 +- drivers/rtc/rtc-test.c | 6 +- drivers/scsi/aacraid/aachba.c | 11 +- drivers/scsi/aic7xxx/aic79xx.h | 2 +- drivers/scsi/aic7xxx/aic79xx_core.c | 11 +- drivers/scsi/be2iscsi/be_main.c | 2 +- drivers/scsi/bfa/bfa.h | 4 +- drivers/scsi/bfa/bfa_core.c | 4 +- drivers/scsi/bfa/bfa_cs.h | 124 +- drivers/scsi/bfa/bfa_fcpim.h | 14 +- drivers/scsi/bfa/bfa_fcs.h | 34 +- drivers/scsi/bfa/bfa_fcs_fcpim.c | 6 +- drivers/scsi/bfa/bfa_fcs_lport.c | 4 +- drivers/scsi/bfa/bfa_fcs_rport.c | 4 +- drivers/scsi/bfa/bfa_ioc.c | 8 +- drivers/scsi/bfa/bfa_ioc.h | 16 +- drivers/scsi/bfa/bfa_svc.c | 12 +- drivers/scsi/bfa/bfa_svc.h | 20 +- drivers/scsi/bfa/bfad.c | 12 +- drivers/scsi/bfa/bfad_bsg.c | 8 +- drivers/scsi/bfa/bfad_drv.h | 5 +- drivers/scsi/csiostor/csio_defs.h | 19 +- drivers/scsi/csiostor/csio_hw.c | 67 +- drivers/scsi/csiostor/csio_init.c | 2 +- drivers/scsi/csiostor/csio_lnode.c | 32 +- drivers/scsi/csiostor/csio_rnode.c | 28 +- drivers/scsi/csiostor/csio_scsi.c | 37 +- drivers/scsi/fcoe/fcoe_sysfs.c | 12 +- drivers/scsi/fcoe/fcoe_transport.c | 16 +- drivers/scsi/hosts.c | 4 +- drivers/scsi/hpsa.c | 38 +- drivers/scsi/hpsa.h | 2 +- drivers/scsi/hptiop.c | 2 - drivers/scsi/hptiop.h | 1 - drivers/scsi/ipr.c | 32 +- drivers/scsi/ipr.h | 2 +- drivers/scsi/libfc/fc_exch.c | 50 +- drivers/scsi/libsas/sas_ata.c | 2 +- drivers/scsi/lpfc/lpfc.h | 8 +- drivers/scsi/lpfc/lpfc_debugfs.c | 18 +- drivers/scsi/lpfc/lpfc_init.c | 8 +- drivers/scsi/lpfc/lpfc_scsi.c | 10 +- drivers/scsi/megaraid/megaraid_sas.h | 2 +- drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +- drivers/scsi/pmcraid.c | 46 +- drivers/scsi/pmcraid.h | 8 +- drivers/scsi/qla2xxx/qla_attr.c | 4 +- drivers/scsi/qla2xxx/qla_gbl.h | 8 +- drivers/scsi/qla2xxx/qla_os.c | 15 +- drivers/scsi/qla2xxx/qla_target.c | 16 +- drivers/scsi/qla2xxx/qla_target.h | 2 +- drivers/scsi/qla4xxx/ql4_def.h | 2 +- drivers/scsi/qla4xxx/ql4_os.c | 15 +- drivers/scsi/scsi.c | 2 +- drivers/scsi/scsi_lib.c | 8 +- drivers/scsi/scsi_sysfs.c | 2 +- drivers/scsi/scsi_transport_fc.c | 8 +- drivers/scsi/scsi_transport_iscsi.c | 6 +- drivers/scsi/scsi_transport_spi.c | 2 +- drivers/scsi/scsi_transport_srp.c | 8 +- drivers/scsi/sd.c | 6 +- drivers/scsi/sg.c | 2 +- drivers/scsi/sr.c | 21 +- drivers/soc/tegra/fuse/fuse-tegra.c | 2 +- drivers/spi/spi.c | 2 +- drivers/staging/android/timed_output.c | 6 +- drivers/staging/comedi/comedi_fops.c | 8 +- drivers/staging/fbtft/fbtft-core.c | 2 +- drivers/staging/fbtft/fbtft.h | 2 +- drivers/staging/gdm724x/gdm_lte.c | 2 +- drivers/staging/gdm724x/gdm_tty.c | 2 +- drivers/staging/gdm72xx/gdm_wimax.c | 2 +- drivers/staging/iio/accel/lis3l02dq_ring.c | 2 +- drivers/staging/iio/adc/ad7280a.c | 4 +- .../staging/lustre/lnet/klnds/socklnd/socklnd.h | 6 +- drivers/staging/lustre/lnet/selftest/brw_test.c | 12 +- drivers/staging/lustre/lnet/selftest/framework.c | 4 - drivers/staging/lustre/lnet/selftest/ping_test.c | 14 +- .../lustre/lustre/include/lustre/lustre_idl.h | 92 +- drivers/staging/lustre/lustre/include/lustre_dlm.h | 8 +- drivers/staging/lustre/lustre/include/lustre_net.h | 2 +- drivers/staging/lustre/lustre/include/obd.h | 2 +- drivers/staging/lustre/lustre/ldlm/ldlm_request.c | 5 +- drivers/staging/lustre/lustre/llite/dir.c | 2 +- drivers/staging/lustre/lustre/lov/lov_io.c | 62 +- drivers/staging/lustre/lustre/obdclass/llog_swab.c | 24 +- drivers/staging/lustre/lustre/osc/osc_request.c | 24 +- drivers/staging/lustre/lustre/ptlrpc/layout.c | 7 +- .../staging/lustre/lustre/ptlrpc/pack_generic.c | 151 +- drivers/staging/octeon/ethernet-rx.c | 24 +- drivers/staging/octeon/ethernet.c | 8 +- drivers/staging/panel/panel.c | 4 +- drivers/staging/rdma/hfi1/pcie.c | 2 +- drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 18 +- drivers/staging/rtl8188eu/hal/rtl8188eu_recv.c | 2 +- drivers/staging/rtl8188eu/hal/rtl8188eu_xmit.c | 2 +- drivers/staging/rtl8188eu/include/Hal8188EPhyCfg.h | 8 - drivers/staging/rtl8188eu/include/hal_intf.h | 5 +- drivers/staging/rtl8188eu/include/odm_precomp.h | 2 +- drivers/staging/rtl8188eu/include/recv_osdep.h | 1 - drivers/staging/rtl8188eu/include/rtl8188e_recv.h | 2 +- drivers/staging/rtl8188eu/include/rtl8188e_xmit.h | 2 +- drivers/staging/rtl8188eu/include/rtw_cmd.h | 1 - drivers/staging/rtl8188eu/include/rtw_eeprom.h | 6 - drivers/staging/rtl8188eu/include/rtw_ioctl.h | 9 - drivers/staging/rtl8188eu/include/rtw_mlme_ext.h | 12 +- drivers/staging/rtl8188eu/include/xmit_osdep.h | 2 +- drivers/staging/rtl8188eu/os_dep/usb_ops_linux.c | 4 +- drivers/staging/rtl8188eu/os_dep/xmit_linux.c | 2 +- drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 49 +- drivers/staging/rtl8192e/rtl8192e/rtl_core.h | 4 +- drivers/staging/rtl8192e/rtl8192e/rtl_dm.c | 10 +- drivers/staging/rtl8192e/rtl8192e/rtl_dm.h | 4 +- drivers/staging/rtl8192e/rtl8192e/rtl_ps.c | 6 +- drivers/staging/rtl8192e/rtl8192e/rtl_ps.h | 3 +- drivers/staging/rtl8192e/rtl8192e/rtl_wx.c | 48 +- drivers/staging/rtl8192e/rtllib.h | 4 +- drivers/staging/rtl8192e/rtllib_softmac.c | 32 +- drivers/staging/rtl8192e/rtllib_softmac_wx.c | 2 +- drivers/staging/rtl8192e/rtllib_tx.c | 2 +- drivers/staging/rtl8192u/ieee80211/ieee80211.h | 2 +- .../staging/rtl8192u/ieee80211/ieee80211_softmac.c | 6 +- drivers/staging/rtl8192u/ieee80211/ieee80211_tx.c | 2 +- drivers/staging/rtl8192u/r8192U_core.c | 7 +- drivers/staging/rtl8712/rtl8712_recv.c | 6 +- drivers/staging/rtl8712/rtl871x_io.h | 2 +- drivers/staging/rtl8712/rtl871x_ioctl.h | 14 - drivers/staging/rtl8712/rtl871x_xmit.c | 2 +- drivers/staging/rtl8712/rtl871x_xmit.h | 2 +- drivers/staging/rtl8712/usb_ops_linux.c | 2 +- drivers/staging/rtl8712/xmit_linux.c | 2 +- drivers/staging/rtl8712/xmit_osdep.h | 2 +- drivers/staging/rtl8723au/core/rtw_mlme_ext.c | 12 +- drivers/staging/rtl8723au/core/rtw_xmit.c | 2 +- drivers/staging/rtl8723au/hal/rtl8723au_recv.c | 2 +- drivers/staging/rtl8723au/hal/usb_ops_linux.c | 4 +- drivers/staging/rtl8723au/include/Hal8723APhyCfg.h | 8 - drivers/staging/rtl8723au/include/drv_types.h | 2 +- drivers/staging/rtl8723au/include/hal_intf.h | 2 - drivers/staging/rtl8723au/include/recv_osdep.h | 1 - drivers/staging/rtl8723au/include/rtw_ap.h | 2 - drivers/staging/rtl8723au/include/rtw_cmd.h | 1 - drivers/staging/rtl8723au/include/rtw_eeprom.h | 7 - drivers/staging/rtl8723au/include/rtw_mlme_ext.h | 14 +- drivers/staging/rtl8723au/include/usb_ops.h | 8 +- drivers/staging/rtl8723au/include/xmit_osdep.h | 2 +- drivers/staging/rtl8723au/os_dep/ioctl_cfg80211.c | 2 +- drivers/staging/rtl8723au/os_dep/xmit_linux.c | 2 +- drivers/staging/sm750fb/sm750.c | 14 +- drivers/staging/unisys/visorbus/visorbus_private.h | 4 +- drivers/staging/unisys/visornic/visornic_main.c | 2 +- drivers/staging/wilc1000/linux_wlan.c | 2 +- drivers/staging/wilc1000/wilc_spi.c | 2 - drivers/staging/wilc1000/wilc_wlan.h | 2 +- drivers/staging/wlan-ng/p80211netdev.c | 2 +- drivers/target/sbp/sbp_target.c | 4 +- drivers/thermal/cpu_cooling.c | 9 +- drivers/thermal/devfreq_cooling.c | 19 +- drivers/thermal/int340x_thermal/int3400_thermal.c | 6 +- drivers/thermal/of-thermal.c | 17 +- drivers/thermal/x86_pkg_temp_thermal.c | 2 +- drivers/tty/cyclades.c | 6 +- drivers/tty/hvc/hvc_console.c | 14 +- drivers/tty/hvc/hvcs.c | 21 +- drivers/tty/hvc/hvsi.c | 22 +- drivers/tty/hvc/hvsi_lib.c | 4 +- drivers/tty/ipwireless/tty.c | 27 +- drivers/tty/moxa.c | 2 +- drivers/tty/n_gsm.c | 6 +- drivers/tty/n_tty.c | 28 +- drivers/tty/pty.c | 4 +- drivers/tty/rocket.c | 6 +- drivers/tty/serial/8250/8250_core.c | 10 +- drivers/tty/serial/8250/8250_pci.c | 2 +- drivers/tty/serial/ifx6x60.c | 2 +- drivers/tty/serial/ioc4_serial.c | 6 +- drivers/tty/serial/jsm/jsm_driver.c | 2 +- drivers/tty/serial/kgdb_nmi.c | 4 +- drivers/tty/serial/kgdboc.c | 34 +- drivers/tty/serial/msm_serial.c | 4 +- drivers/tty/serial/samsung.c | 9 +- drivers/tty/serial/serial_core.c | 8 +- drivers/tty/synclink.c | 34 +- drivers/tty/synclink_gt.c | 28 +- drivers/tty/synclinkmp.c | 34 +- drivers/tty/tty_io.c | 2 +- drivers/tty/tty_ldisc.c | 8 +- drivers/tty/tty_port.c | 22 +- drivers/uio/uio.c | 13 +- drivers/usb/atm/cxacru.c | 2 +- drivers/usb/atm/usbatm.c | 24 +- drivers/usb/class/cdc-acm.h | 2 +- drivers/usb/core/devices.c | 6 +- drivers/usb/core/devio.c | 12 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/sysfs.c | 2 +- drivers/usb/core/usb.c | 2 +- drivers/usb/early/ehci-dbgp.c | 16 +- drivers/usb/gadget/function/f_phonet.c | 2 +- drivers/usb/gadget/function/u_serial.c | 22 +- drivers/usb/gadget/legacy/inode.c | 4 +- drivers/usb/gadget/udc/dummy_hcd.c | 2 +- drivers/usb/host/ehci-hcd.c | 2 +- drivers/usb/host/ehci-hub.c | 4 +- drivers/usb/host/ehci-q.c | 4 +- drivers/usb/host/fotg210-hcd.c | 2 +- drivers/usb/host/hwa-hc.c | 2 +- drivers/usb/host/ohci-hcd.c | 2 +- drivers/usb/host/r8a66597.h | 2 +- drivers/usb/host/uhci-hcd.c | 2 +- drivers/usb/host/xhci-pci.c | 2 +- drivers/usb/host/xhci.c | 2 +- drivers/usb/misc/appledisplay.c | 4 +- drivers/usb/misc/sisusbvga/sisusb_con.c | 98 +- drivers/usb/serial/console.c | 8 +- drivers/usb/storage/transport.c | 2 +- drivers/usb/storage/usb.c | 2 +- drivers/usb/storage/usb.h | 2 +- drivers/usb/usbip/vhci.h | 2 +- drivers/usb/usbip/vhci_hcd.c | 6 +- drivers/usb/usbip/vhci_rx.c | 2 +- drivers/usb/wusbcore/wa-hc.h | 4 +- drivers/usb/wusbcore/wa-xfer.c | 2 +- drivers/vfio/pci/vfio_pci.c | 2 +- drivers/vhost/vringh.c | 20 +- drivers/video/backlight/kb3886_bl.c | 2 +- drivers/video/console/dummycon.c | 96 +- drivers/video/console/fbcon.c | 2 +- drivers/video/console/vgacon.c | 23 +- drivers/video/fbdev/aty/aty128fb.c | 2 +- drivers/video/fbdev/aty/atyfb_base.c | 8 +- drivers/video/fbdev/aty/mach64_ct.c | 5 +- drivers/video/fbdev/aty/mach64_cursor.c | 5 +- drivers/video/fbdev/aty/mach64_gx.c | 17 +- drivers/video/fbdev/core/fb_defio.c | 6 +- drivers/video/fbdev/core/fbmem.c | 12 +- drivers/video/fbdev/hyperv_fb.c | 4 +- drivers/video/fbdev/i810/i810_accel.c | 1 + drivers/video/fbdev/matrox/matroxfb_base.c | 2 +- drivers/video/fbdev/mb862xx/mb862xxfb_accel.c | 16 +- drivers/video/fbdev/nvidia/nvidia.c | 27 +- drivers/video/fbdev/omap2/omapfb/dss/display.c | 8 +- drivers/video/fbdev/s1d13xxxfb.c | 6 +- drivers/video/fbdev/sis/sis_main.h | 2 +- drivers/video/fbdev/smscufx.c | 4 +- drivers/video/fbdev/udlfb.c | 36 +- drivers/video/fbdev/uvesafb.c | 52 +- drivers/video/fbdev/vesafb.c | 58 +- drivers/video/fbdev/via/via_clock.h | 2 +- drivers/xen/events/events_base.c | 6 +- drivers/xen/xen-pciback/pci_stub.c | 2 +- fs/9p/vfs_addr.c | 2 +- fs/9p/vfs_inode_dotl.c | 4 +- fs/Kconfig.binfmt | 2 +- fs/afs/file.c | 8 +- fs/afs/inode.c | 4 +- fs/afs/internal.h | 4 +- fs/aio.c | 2 +- fs/autofs4/waitq.c | 2 +- fs/befs/endian.h | 6 +- fs/binfmt_aout.c | 23 +- fs/binfmt_elf.c | 670 +- fs/binfmt_elf_fdpic.c | 4 +- fs/block_dev.c | 2 +- fs/btrfs/ctree.c | 11 +- fs/btrfs/ctree.h | 4 +- fs/btrfs/delayed-inode.c | 6 +- fs/btrfs/delayed-inode.h | 4 +- fs/btrfs/delayed-ref.c | 4 +- fs/btrfs/disk-io.c | 4 +- fs/btrfs/extent_map.c | 8 +- fs/btrfs/file.c | 4 +- fs/btrfs/free-space-cache.h | 1 + fs/btrfs/raid56.c | 30 +- fs/btrfs/super.c | 2 +- fs/btrfs/sysfs.c | 2 +- fs/btrfs/tests/btrfs-tests.c | 2 +- fs/btrfs/tests/free-space-tests.c | 2 +- fs/btrfs/transaction.c | 2 +- fs/btrfs/tree-log.c | 8 +- fs/btrfs/tree-log.h | 2 +- fs/btrfs/volumes.c | 14 +- fs/btrfs/volumes.h | 22 +- fs/buffer.c | 2 +- fs/cachefiles/bind.c | 6 +- fs/cachefiles/daemon.c | 8 +- fs/cachefiles/internal.h | 12 +- fs/cachefiles/namei.c | 2 +- fs/cachefiles/proc.c | 12 +- fs/ceph/dir.c | 12 +- fs/ceph/super.c | 4 +- fs/cifs/cifs_debug.c | 12 +- fs/cifs/cifsfs.c | 8 +- fs/cifs/cifsglob.h | 54 +- fs/cifs/file.c | 14 +- fs/cifs/misc.c | 4 +- fs/cifs/smb1ops.c | 80 +- fs/cifs/smb2ops.c | 84 +- fs/cifs/smb2pdu.c | 3 +- fs/coda/cache.c | 10 +- fs/coda/dir.c | 5 +- fs/compat.c | 9 +- fs/compat_binfmt_elf.c | 2 + fs/compat_ioctl.c | 12 +- fs/configfs/dir.c | 10 +- fs/coredump.c | 18 +- fs/dcache.c | 64 +- fs/ecryptfs/inode.c | 2 +- fs/ecryptfs/miscdev.c | 2 +- fs/exec.c | 365 +- fs/exofs/inode.c | 7 +- fs/ext2/xattr.c | 5 +- fs/ext4/ext4.h | 20 +- fs/ext4/mballoc.c | 44 +- fs/ext4/resize.c | 16 +- fs/ext4/super.c | 2 +- fs/ext4/sysfs.c | 2 +- fs/ext4/xattr.c | 5 +- fs/fhandle.c | 5 +- fs/file.c | 18 +- fs/freevxfs/vxfs_inode.c | 8 +- fs/freevxfs/vxfs_inode.h | 4 +- fs/fs-writeback.c | 11 +- fs/fs_struct.c | 8 +- fs/fscache/cookie.c | 40 +- fs/fscache/internal.h | 202 +- fs/fscache/object.c | 26 +- fs/fscache/operation.c | 38 +- fs/fscache/page.c | 110 +- fs/fscache/stats.c | 348 +- fs/fuse/cuse.c | 10 +- fs/fuse/dev.c | 4 +- fs/fuse/file.c | 4 +- fs/fuse/inode.c | 4 +- fs/gfs2/aops.c | 2 +- fs/gfs2/file.c | 2 +- fs/gfs2/glock.c | 22 +- fs/gfs2/glops.c | 4 +- fs/gfs2/quota.c | 6 +- fs/hugetlbfs/inode.c | 13 +- fs/inode.c | 4 +- fs/jbd2/commit.c | 2 +- fs/jbd2/transaction.c | 4 +- fs/jffs2/erase.c | 3 +- fs/jffs2/file.c | 3 +- fs/jffs2/fs.c | 2 +- fs/jffs2/os-linux.h | 2 +- fs/jffs2/wbuf.c | 3 +- fs/jfs/super.c | 2 +- fs/kernfs/dir.c | 2 +- fs/kernfs/file.c | 20 +- fs/libfs.c | 10 +- fs/lockd/clnt4xdr.c | 46 +- fs/lockd/clntproc.c | 4 +- fs/lockd/clntxdr.c | 44 +- fs/lockd/mon.c | 24 +- fs/lockd/svc.c | 2 +- fs/lockd/svc4proc.c | 69 +- fs/lockd/svcproc.c | 75 +- fs/lockd/xdr.c | 44 +- fs/lockd/xdr4.c | 41 +- fs/logfs/dev_bdev.c | 13 +- fs/logfs/dev_mtd.c | 13 +- fs/logfs/dir.c | 4 +- fs/logfs/logfs.h | 5 +- fs/logfs/readwrite.c | 2 +- fs/logfs/segment.c | 2 +- fs/logfs/super.c | 39 - fs/namei.c | 16 +- fs/namespace.c | 16 +- fs/nfs/callback.h | 18 +- fs/nfs/callback_proc.c | 26 +- fs/nfs/callback_xdr.c | 73 +- fs/nfs/dir.c | 5 +- fs/nfs/inode.c | 6 +- fs/nfs/internal.h | 5 +- fs/nfs/mount_clnt.c | 26 +- fs/nfs/nfs2xdr.c | 101 +- fs/nfs/nfs3xdr.c | 201 +- fs/nfs/nfs42xdr.c | 60 +- fs/nfs/nfs4xdr.c | 507 +- fs/nfs/read.c | 2 +- fs/nfs/symlink.c | 6 +- fs/nfsd/current_stateid.h | 24 +- fs/nfsd/nfs2acl.c | 85 +- fs/nfsd/nfs3acl.c | 44 +- fs/nfsd/nfs3proc.c | 271 +- fs/nfsd/nfs3xdr.c | 171 +- fs/nfsd/nfs4callback.c | 31 +- fs/nfsd/nfs4proc.c | 320 +- fs/nfsd/nfs4state.c | 111 +- fs/nfsd/nfs4xdr.c | 564 +- fs/nfsd/nfscache.c | 11 +- fs/nfsd/nfsproc.c | 193 +- fs/nfsd/nfsxdr.c | 96 +- fs/nfsd/vfs.c | 6 +- fs/nfsd/xdr.h | 50 +- fs/nfsd/xdr3.h | 100 +- fs/nfsd/xdr4.h | 50 +- fs/nls/nls_base.c | 26 +- fs/nls/nls_cp932.c | 2 +- fs/nls/nls_cp936.c | 2 +- fs/nls/nls_cp949.c | 2 +- fs/nls/nls_cp950.c | 2 +- fs/nls/nls_euc-jp.c | 8 +- fs/nls/nls_koi8-ru.c | 8 +- fs/notify/fanotify/fanotify_user.c | 4 +- fs/notify/notification.c | 4 +- fs/ntfs/dir.c | 4 +- fs/ntfs/inode.c | 19 +- fs/ntfs/inode.h | 4 +- fs/ntfs/mft.c | 4 +- fs/ntfs/super.c | 8 +- fs/ocfs2/dlm/dlmcommon.h | 4 +- fs/ocfs2/dlm/dlmdebug.c | 10 +- fs/ocfs2/dlm/dlmdomain.c | 4 +- fs/ocfs2/dlm/dlmmaster.c | 4 +- fs/ocfs2/dlmfs/dlmfs.c | 4 +- fs/ocfs2/localalloc.c | 2 +- fs/ocfs2/ocfs2.h | 10 +- fs/ocfs2/suballoc.c | 12 +- fs/ocfs2/super.c | 20 +- fs/overlayfs/copy_up.c | 2 +- fs/pipe.c | 72 +- fs/posix_acl.c | 4 +- fs/proc/array.c | 20 + fs/proc/base.c | 7 +- fs/proc/kcore.c | 36 +- fs/proc/meminfo.c | 2 +- fs/proc/nommu.c | 2 +- fs/proc/proc_sysctl.c | 26 +- fs/proc/task_mmu.c | 39 +- fs/proc/task_nommu.c | 6 +- fs/proc/vmcore.c | 16 +- fs/qnx6/qnx6.h | 4 +- fs/quota/netlink.c | 4 +- fs/read_write.c | 34 +- fs/readdir.c | 3 +- fs/reiserfs/do_balan.c | 2 +- fs/reiserfs/procfs.c | 2 +- fs/reiserfs/reiserfs.h | 4 +- fs/select.c | 2 +- fs/seq_file.c | 4 +- fs/splice.c | 43 +- fs/squashfs/xattr.c | 10 +- fs/super.c | 3 +- fs/sysv/sysv.h | 2 +- fs/tracefs/inode.c | 8 +- fs/ubifs/find.c | 34 +- fs/ubifs/lprops.c | 5 +- fs/udf/misc.c | 2 +- fs/ufs/swab.h | 4 +- fs/userfaultfd.c | 2 +- fs/xattr.c | 21 + fs/xfs/libxfs/xfs_bmap.c | 2 +- fs/xfs/libxfs/xfs_da_btree.c | 4 +- fs/xfs/xfs_dir2_readdir.c | 7 +- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_linux.h | 4 +- include/acpi/ghes.h | 2 +- include/asm-generic/4level-fixup.h | 2 + include/asm-generic/atomic-long.h | 176 +- include/asm-generic/atomic64.h | 12 + include/asm-generic/bitops/__fls.h | 2 +- include/asm-generic/bitops/fls.h | 2 +- include/asm-generic/bitops/fls64.h | 4 +- include/asm-generic/bug.h | 6 +- include/asm-generic/cache.h | 4 +- include/asm-generic/emergency-restart.h | 2 +- include/asm-generic/kmap_types.h | 4 +- include/asm-generic/local.h | 13 + include/asm-generic/pgtable-nopmd.h | 18 +- include/asm-generic/pgtable-nopud.h | 15 +- include/asm-generic/pgtable.h | 16 + include/asm-generic/sections.h | 1 + include/asm-generic/uaccess.h | 16 + include/asm-generic/vmlinux.lds.h | 15 +- include/crypto/algapi.h | 2 +- include/crypto/cast6.h | 4 +- include/crypto/serpent.h | 4 +- include/crypto/xts.h | 2 +- include/drm/drmP.h | 19 +- include/drm/drm_mm.h | 2 +- include/drm/drm_modeset_helper_vtables.h | 2 +- include/drm/i915_pciids.h | 2 +- include/drm/intel-gtt.h | 4 +- include/drm/ttm/ttm_memory.h | 2 +- include/drm/ttm/ttm_page_alloc.h | 1 + include/keys/asymmetric-subtype.h | 2 +- include/keys/encrypted-type.h | 2 +- include/keys/rxrpc-type.h | 2 +- include/keys/user-type.h | 2 +- include/linux/atmdev.h | 4 +- include/linux/atomic.h | 12 +- include/linux/audit.h | 2 +- include/linux/average.h | 2 +- include/linux/binfmts.h | 3 +- include/linux/bitmap.h | 2 +- include/linux/bitops.h | 8 +- include/linux/blk-cgroup.h | 24 +- include/linux/blkdev.h | 2 +- include/linux/blktrace_api.h | 2 +- include/linux/cache.h | 8 + include/linux/cdrom.h | 1 - include/linux/cgroup-defs.h | 2 +- include/linux/cleancache.h | 2 +- include/linux/clk-provider.h | 1 + include/linux/compat.h | 15 +- include/linux/compiler-gcc.h | 30 +- include/linux/compiler.h | 193 +- include/linux/configfs.h | 2 +- include/linux/cpufreq.h | 7 +- include/linux/cpuidle.h | 5 +- include/linux/cpumask.h | 14 +- include/linux/crypto.h | 4 +- include/linux/ctype.h | 2 +- include/linux/dcache.h | 4 +- include/linux/decompress/mm.h | 2 +- include/linux/devfreq.h | 2 +- include/linux/device.h | 7 +- include/linux/dma-mapping.h | 2 +- include/linux/efi.h | 1 + include/linux/elf.h | 2 + include/linux/err.h | 4 +- include/linux/extcon.h | 2 +- include/linux/fb.h | 3 +- include/linux/fdtable.h | 2 +- include/linux/firewire.h | 2 +- include/linux/fs.h | 5 +- include/linux/fs_struct.h | 2 +- include/linux/fscache-cache.h | 2 +- include/linux/fscache.h | 2 +- include/linux/fsnotify.h | 2 +- include/linux/genhd.h | 4 +- include/linux/genl_magic_func.h | 2 +- include/linux/genl_magic_struct.h | 4 +- include/linux/gfp.h | 14 +- include/linux/highmem.h | 12 + include/linux/hugetlb.h | 2 +- include/linux/hugetlb_cgroup.h | 11 + include/linux/hwmon-sysfs.h | 6 +- include/linux/i2c.h | 1 + include/linux/if_pppox.h | 2 +- include/linux/init.h | 12 +- include/linux/init_task.h | 7 + include/linux/interrupt.h | 6 +- include/linux/iommu.h | 2 +- include/linux/ioport.h | 2 +- include/linux/ipc.h | 2 +- include/linux/irq.h | 5 +- include/linux/irqdesc.h | 2 +- include/linux/irqdomain.h | 3 + include/linux/jbd2.h | 2 +- include/linux/jiffies.h | 16 +- include/linux/kallsyms.h | 18 +- include/linux/key-type.h | 2 +- include/linux/kgdb.h | 6 +- include/linux/kmemleak.h | 4 +- include/linux/kobject.h | 3 +- include/linux/kobject_ns.h | 2 +- include/linux/kref.h | 2 +- include/linux/libata.h | 2 +- include/linux/linkage.h | 12 + include/linux/list.h | 15 + include/linux/lockd/xdr.h | 34 +- include/linux/lockd/xdr4.h | 34 +- include/linux/lockref.h | 26 +- include/linux/math64.h | 10 +- include/linux/memcontrol.h | 2 +- include/linux/mempolicy.h | 7 + include/linux/mm.h | 97 +- include/linux/mm_types.h | 20 + include/linux/mmiotrace.h | 4 +- include/linux/mmzone.h | 2 +- include/linux/mod_devicetable.h | 4 +- include/linux/module.h | 58 +- include/linux/moduleloader.h | 16 + include/linux/moduleparam.h | 12 +- include/linux/net.h | 2 +- include/linux/netdevice.h | 7 +- include/linux/netfilter.h | 2 +- include/linux/netfilter/ipset/ip_set_comment.h | 3 +- include/linux/netfilter/nfnetlink.h | 2 +- include/linux/netlink.h | 12 +- include/linux/nls.h | 4 +- include/linux/notifier.h | 3 +- include/linux/oprofile.h | 4 +- include/linux/padata.h | 2 +- include/linux/pagemap.h | 4 +- include/linux/pci_hotplug.h | 3 +- include/linux/percpu.h | 2 +- include/linux/perf_event.h | 12 +- include/linux/pid.h | 4 +- include/linux/pipe_fs_i.h | 8 +- include/linux/pm.h | 1 + include/linux/pm_domain.h | 2 +- include/linux/pm_runtime.h | 2 +- include/linux/pnp.h | 2 +- include/linux/poison.h | 4 +- include/linux/power/smartreflex.h | 2 +- include/linux/ppp-comp.h | 2 +- include/linux/preempt.h | 21 + include/linux/printk.h | 2 +- include/linux/proc_ns.h | 2 +- include/linux/psci.h | 2 +- include/linux/quota.h | 2 +- include/linux/random.h | 19 +- include/linux/rculist.h | 16 + include/linux/rcupdate.h | 8 + include/linux/reboot.h | 14 +- include/linux/regset.h | 3 +- include/linux/relay.h | 2 +- include/linux/rio.h | 2 +- include/linux/rmap.h | 4 +- include/linux/sched.h | 76 +- include/linux/sched/sysctl.h | 1 + include/linux/scif.h | 2 +- include/linux/semaphore.h | 2 +- include/linux/seq_file.h | 1 + include/linux/seqlock.h | 10 + include/linux/signal.h | 2 +- include/linux/skbuff.h | 12 +- include/linux/slab.h | 47 +- include/linux/slab_def.h | 14 +- include/linux/slub_def.h | 2 +- include/linux/smp.h | 2 + include/linux/sock_diag.h | 2 +- include/linux/sonet.h | 2 +- include/linux/spinlock.h | 17 +- include/linux/srcu.h | 5 +- include/linux/sunrpc/addr.h | 8 +- include/linux/sunrpc/clnt.h | 2 +- include/linux/sunrpc/svc.h | 2 +- include/linux/sunrpc/svc_rdma.h | 18 +- include/linux/sunrpc/svcauth.h | 2 +- include/linux/swapops.h | 10 +- include/linux/swiotlb.h | 3 +- include/linux/syscalls.h | 34 +- include/linux/syscore_ops.h | 2 +- include/linux/sysctl.h | 3 +- include/linux/sysfs.h | 9 +- include/linux/sysrq.h | 3 +- include/linux/tcp.h | 14 +- include/linux/thread_info.h | 7 + include/linux/tty.h | 4 +- include/linux/tty_driver.h | 2 +- include/linux/tty_ldisc.h | 2 +- include/linux/types.h | 16 + include/linux/uaccess.h | 2 +- include/linux/uio_driver.h | 2 +- include/linux/unaligned/access_ok.h | 24 +- include/linux/usb.h | 12 +- include/linux/usb/hcd.h | 1 + include/linux/usb/renesas_usbhs.h | 2 +- include/linux/vermagic.h | 21 +- include/linux/vga_switcheroo.h | 8 +- include/linux/vmalloc.h | 7 +- include/linux/vmstat.h | 24 +- include/linux/writeback.h | 3 +- include/linux/xattr.h | 5 +- include/linux/zlib.h | 3 +- include/media/v4l2-dev.h | 2 +- include/media/v4l2-device.h | 2 +- include/net/9p/transport.h | 2 +- include/net/bluetooth/l2cap.h | 2 +- include/net/bonding.h | 2 +- include/net/caif/cfctrl.h | 6 +- include/net/cfg80211-wext.h | 20 +- include/net/cfg802154.h | 2 +- include/net/fib_rules.h | 3 +- include/net/flow.h | 2 +- include/net/genetlink.h | 2 +- include/net/gro_cells.h | 2 +- include/net/inet_connection_sock.h | 2 +- include/net/inet_sock.h | 2 +- include/net/inetpeer.h | 2 +- include/net/ip_fib.h | 2 +- include/net/ip_vs.h | 8 +- include/net/ipv6.h | 2 +- include/net/irda/ircomm_tty.h | 1 + include/net/irda/irias_object.h | 2 +- include/net/irda/irlmp.h | 1 + include/net/irda/irlmp_event.h | 6 +- include/net/irda/timer.h | 6 +- include/net/iucv/af_iucv.h | 2 +- include/net/llc_c_ac.h | 2 +- include/net/llc_c_ev.h | 4 +- include/net/llc_c_st.h | 2 +- include/net/llc_s_ac.h | 2 +- include/net/llc_s_st.h | 2 +- include/net/mac80211.h | 6 +- include/net/neighbour.h | 4 +- include/net/net_namespace.h | 18 +- include/net/netfilter/nf_conntrack.h | 2 +- include/net/netlink.h | 2 +- include/net/netns/conntrack.h | 6 +- include/net/netns/ipv4.h | 4 +- include/net/netns/ipv6.h | 4 +- include/net/netns/xfrm.h | 2 +- include/net/ping.h | 2 +- include/net/protocol.h | 4 +- include/net/rtnetlink.h | 2 +- include/net/sctp/checksum.h | 4 +- include/net/sctp/sm.h | 4 +- include/net/sctp/structs.h | 2 +- include/net/snmp.h | 10 +- include/net/sock.h | 12 +- include/net/tcp.h | 8 +- include/net/xfrm.h | 15 +- include/rdma/ib_cm.h | 8 +- include/rdma/iw_cm.h | 2 +- include/scsi/libfc.h | 3 +- include/scsi/scsi_device.h | 6 +- include/scsi/scsi_driver.h | 2 +- include/scsi/scsi_transport_fc.h | 3 +- include/scsi/sg.h | 2 +- include/sound/compress_driver.h | 2 +- include/sound/control.h | 4 +- include/sound/pcm.h | 2 +- include/sound/rawmidi.h | 3 +- include/sound/seq_kernel.h | 2 +- include/sound/soc.h | 4 +- include/trace/events/irq.h | 4 +- include/uapi/linux/a.out.h | 8 + include/uapi/linux/bcache.h | 5 +- include/uapi/linux/byteorder/little_endian.h | 28 +- include/uapi/linux/connector.h | 2 +- include/uapi/linux/elf.h | 28 + include/uapi/linux/screen_info.h | 2 +- include/uapi/linux/swab.h | 6 +- include/uapi/linux/xattr.h | 4 + include/video/udlfb.h | 8 +- include/video/uvesafb.h | 1 + init/Kconfig | 2 +- init/Makefile | 3 + init/do_mounts.c | 16 +- init/do_mounts.h | 8 +- init/do_mounts_initrd.c | 30 +- init/do_mounts_md.c | 6 +- init/init_task.c | 4 + init/initramfs.c | 38 +- init/main.c | 30 +- ipc/compat.c | 4 +- ipc/ipc_sysctl.c | 14 +- ipc/mq_sysctl.c | 4 +- ipc/sem.c | 4 +- ipc/shm.c | 8 +- kernel/audit.c | 8 +- kernel/auditsc.c | 4 +- kernel/bpf/core.c | 28 +- kernel/capability.c | 3 + kernel/cgroup.c | 29 +- kernel/compat.c | 38 +- kernel/debug/debug_core.c | 16 +- kernel/debug/kdb/kdb_main.c | 4 +- kernel/events/core.c | 38 +- kernel/events/internal.h | 10 +- kernel/events/uprobes.c | 2 +- kernel/exit.c | 27 +- kernel/fork.c | 175 +- kernel/futex.c | 11 +- kernel/futex_compat.c | 2 +- kernel/irq/manage.c | 2 +- kernel/irq/msi.c | 19 +- kernel/irq/spurious.c | 2 +- kernel/jump_label.c | 5 + kernel/kallsyms.c | 40 +- kernel/kexec.c | 3 +- kernel/kmod.c | 8 +- kernel/kprobes.c | 4 +- kernel/ksysfs.c | 2 +- kernel/locking/lockdep.c | 7 +- kernel/locking/mutex-debug.c | 12 +- kernel/locking/mutex-debug.h | 4 +- kernel/locking/mutex.c | 6 +- kernel/module.c | 403 +- kernel/notifier.c | 17 +- kernel/padata.c | 4 +- kernel/panic.c | 11 +- kernel/pid.c | 6 +- kernel/pid_namespace.c | 2 +- kernel/power/process.c | 12 +- kernel/profile.c | 14 +- kernel/ptrace.c | 8 +- kernel/rcu/rcutorture.c | 60 +- kernel/rcu/tiny.c | 4 +- kernel/rcu/tree.c | 42 +- kernel/rcu/tree.h | 16 +- kernel/rcu/tree_plugin.h | 18 +- kernel/rcu/tree_trace.c | 14 +- kernel/resource.c | 4 +- kernel/sched/auto_group.c | 4 +- kernel/sched/core.c | 49 +- kernel/sched/fair.c | 2 +- kernel/sched/rt.c | 4 +- kernel/sched/sched.h | 13 +- kernel/signal.c | 28 +- kernel/smp.c | 2 +- kernel/smpboot.c | 4 +- kernel/softirq.c | 12 +- kernel/stop_machine.c | 2 +- kernel/sys.c | 10 +- kernel/sys_ni.c | 4 +- kernel/sysctl.c | 34 +- kernel/time/alarmtimer.c | 4 +- kernel/time/posix-clock.c | 8 +- kernel/time/posix-cpu-timers.c | 4 +- kernel/time/posix-timers.c | 36 +- kernel/time/timer.c | 2 +- kernel/time/timer_stats.c | 10 +- kernel/trace/blktrace.c | 6 +- kernel/trace/ftrace.c | 33 +- kernel/trace/ring_buffer.c | 96 +- kernel/trace/trace.c | 2 +- kernel/trace/trace.h | 2 +- kernel/trace/trace_clock.c | 4 +- kernel/trace/trace_events.c | 1 - kernel/trace/trace_functions_graph.c | 4 +- kernel/trace/trace_mmiotrace.c | 8 +- kernel/trace/trace_output.c | 10 +- kernel/trace/trace_seq.c | 2 +- kernel/trace/trace_stack.c | 2 +- kernel/user.c | 2 +- kernel/user_namespace.c | 2 +- kernel/utsname_sysctl.c | 2 +- kernel/watchdog.c | 2 +- kernel/workqueue.c | 8 +- lib/Kconfig.debug | 8 +- lib/Makefile | 2 +- lib/bitmap.c | 8 +- lib/bug.c | 2 + lib/debugobjects.c | 2 +- lib/decompress_bunzip2.c | 3 +- lib/decompress_unlzma.c | 4 +- lib/div64.c | 4 +- lib/dma-debug.c | 4 +- lib/inflate.c | 2 +- lib/ioremap.c | 4 +- lib/irq_poll.c | 2 +- lib/kobject.c | 4 +- lib/list_debug.c | 126 +- lib/lockref.c | 44 +- lib/percpu-refcount.c | 2 +- lib/radix-tree.c | 2 +- lib/random32.c | 2 +- lib/rhashtable.c | 4 +- lib/show_mem.c | 2 +- lib/strncpy_from_user.c | 2 +- lib/strnlen_user.c | 2 +- lib/swiotlb.c | 2 +- lib/usercopy.c | 6 + lib/vsprintf.c | 12 +- mm/Kconfig | 6 +- mm/backing-dev.c | 4 +- mm/debug.c | 3 + mm/filemap.c | 10 +- mm/gup.c | 13 +- mm/highmem.c | 6 +- mm/hugetlb.c | 125 +- mm/hugetlb_cgroup.c | 60 +- mm/internal.h | 3 +- mm/maccess.c | 12 +- mm/madvise.c | 37 + mm/memcontrol.c | 6 +- mm/memory-failure.c | 6 +- mm/memory.c | 424 +- mm/mempolicy.c | 25 + mm/mlock.c | 18 +- mm/mm_init.c | 2 +- mm/mmap.c | 573 +- mm/mprotect.c | 137 +- mm/mremap.c | 39 +- mm/nommu.c | 21 +- mm/page-writeback.c | 2 +- mm/page_alloc.c | 53 +- mm/percpu.c | 2 +- mm/process_vm_access.c | 14 +- mm/readahead.c | 2 +- mm/rmap.c | 43 +- mm/shmem.c | 37 +- mm/slab.c | 111 +- mm/slab.h | 22 +- mm/slab_common.c | 86 +- mm/slob.c | 218 +- mm/slub.c | 111 +- mm/sparse-vmemmap.c | 4 +- mm/sparse.c | 2 +- mm/swap.c | 2 + mm/swapfile.c | 12 +- mm/util.c | 6 + mm/vmalloc.c | 116 +- mm/vmstat.c | 12 +- net/8021q/vlan.c | 5 +- net/8021q/vlan_netlink.c | 2 +- net/9p/mod.c | 4 +- net/9p/trans_fd.c | 2 +- net/atm/atm_misc.c | 8 +- net/atm/lec.h | 2 +- net/atm/proc.c | 6 +- net/atm/resources.c | 4 +- net/ax25/sysctl_net_ax25.c | 2 +- net/batman-adv/bat_iv_ogm.c | 8 +- net/batman-adv/fragmentation.c | 2 +- net/batman-adv/routing.c | 4 +- net/batman-adv/soft-interface.c | 12 +- net/batman-adv/sysfs.c | 40 +- net/batman-adv/sysfs.h | 4 +- net/batman-adv/translation-table.c | 14 +- net/batman-adv/types.h | 8 +- net/bluetooth/hci_sock.c | 2 +- net/bluetooth/l2cap_core.c | 6 +- net/bluetooth/l2cap_sock.c | 12 +- net/bluetooth/rfcomm/sock.c | 4 +- net/bluetooth/rfcomm/tty.c | 4 +- net/bridge/br_netlink.c | 2 +- net/bridge/netfilter/ebtables.c | 6 +- net/caif/cfctrl.c | 11 +- net/caif/chnl_net.c | 4 +- net/can/af_can.c | 2 +- net/can/gw.c | 6 +- net/ceph/ceph_common.c | 2 +- net/ceph/messenger.c | 4 +- net/compat.c | 26 +- net/core/datagram.c | 2 +- net/core/dev.c | 16 +- net/core/filter.c | 2 +- net/core/flow.c | 6 +- net/core/neighbour.c | 18 +- net/core/net-sysfs.c | 2 +- net/core/net_namespace.c | 8 +- net/core/netpoll.c | 4 +- net/core/rtnetlink.c | 17 +- net/core/scm.c | 12 +- net/core/skbuff.c | 11 +- net/core/sock.c | 28 +- net/core/sock_diag.c | 15 +- net/core/sysctl_net_core.c | 22 +- net/decnet/af_decnet.c | 1 + net/decnet/sysctl_net_decnet.c | 4 +- net/dsa/dsa.c | 2 +- net/hsr/hsr_device.c | 2 +- net/hsr/hsr_netlink.c | 2 +- net/ieee802154/6lowpan/core.c | 2 +- net/ieee802154/6lowpan/reassembly.c | 14 +- net/ipv4/af_inet.c | 2 +- net/ipv4/arp.c | 2 +- net/ipv4/devinet.c | 18 +- net/ipv4/fib_frontend.c | 6 +- net/ipv4/fib_semantics.c | 2 +- net/ipv4/inet_connection_sock.c | 4 +- net/ipv4/inet_diag.c | 4 +- net/ipv4/inet_timewait_sock.c | 2 +- net/ipv4/inetpeer.c | 2 +- net/ipv4/ip_fragment.c | 15 +- net/ipv4/ip_gre.c | 6 +- net/ipv4/ip_sockglue.c | 2 +- net/ipv4/ip_vti.c | 4 +- net/ipv4/ipconfig.c | 6 +- net/ipv4/ipip.c | 4 +- net/ipv4/netfilter/arp_tables.c | 12 +- net/ipv4/netfilter/ip_tables.c | 12 +- net/ipv4/ping.c | 14 +- net/ipv4/proc.c | 8 +- net/ipv4/raw.c | 14 +- net/ipv4/route.c | 32 +- net/ipv4/sysctl_net_ipv4.c | 22 +- net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_probe.c | 2 +- net/ipv4/udp.c | 10 +- net/ipv4/xfrm4_mode_transport.c | 2 +- net/ipv4/xfrm4_policy.c | 17 +- net/ipv4/xfrm4_state.c | 4 +- net/ipv6/addrconf.c | 24 +- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/icmp.c | 2 +- net/ipv6/inet6_hashtables.c | 2 +- net/ipv6/ip6_fib.c | 4 +- net/ipv6/ip6_gre.c | 10 +- net/ipv6/ip6_tunnel.c | 4 +- net/ipv6/ip6_vti.c | 4 +- net/ipv6/ipv6_sockglue.c | 2 +- net/ipv6/ndisc.c | 2 +- net/ipv6/netfilter/ip6_tables.c | 12 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 14 +- net/ipv6/ping.c | 33 +- net/ipv6/proc.c | 10 +- net/ipv6/raw.c | 17 +- net/ipv6/reassembly.c | 13 +- net/ipv6/route.c | 2 +- net/ipv6/sit.c | 4 +- net/ipv6/sysctl_net_ipv6.c | 2 +- net/ipv6/udp.c | 6 +- net/ipv6/xfrm6_mode_transport.c | 2 +- net/ipv6/xfrm6_policy.c | 17 +- net/irda/discovery.c | 2 +- net/irda/ircomm/ircomm_core.c | 13 +- net/irda/ircomm/ircomm_tty.c | 24 +- net/irda/ircomm/ircomm_tty_attach.c | 4 +- net/irda/irda_device.c | 14 +- net/irda/iriap.c | 14 +- net/irda/irias_object.c | 10 +- net/irda/irlan/irlan_client.c | 2 +- net/irda/irlap.c | 15 +- net/irda/irlap_event.c | 2 +- net/irda/irlmp.c | 21 +- net/irda/irlmp_event.c | 6 +- net/irda/irnet/irnet.h | 2 +- net/irda/irnet/irnet_irda.c | 6 +- net/irda/irttp.c | 8 +- net/irda/timer.c | 24 +- net/iucv/af_iucv.c | 4 +- net/iucv/iucv.c | 2 +- net/key/af_key.c | 4 +- net/l2tp/l2tp_eth.c | 40 +- net/l2tp/l2tp_ip.c | 2 +- net/l2tp/l2tp_ip6.c | 2 +- net/mac80211/cfg.c | 10 +- net/mac80211/debugfs.c | 2 +- net/mac80211/debugfs_key.c | 4 +- net/mac80211/ieee80211_i.h | 3 +- net/mac80211/iface.c | 20 +- net/mac80211/key.c | 4 +- net/mac80211/main.c | 2 +- net/mac80211/pm.c | 4 +- net/mac80211/rate.c | 2 +- net/mac80211/sta_info.c | 2 +- net/mac80211/tx.c | 2 +- net/mac80211/util.c | 8 +- net/mac80211/wpa.c | 10 +- net/mac802154/iface.c | 6 +- net/mpls/af_mpls.c | 10 +- net/netfilter/ipset/ip_set_core.c | 7 +- net/netfilter/ipvs/ip_vs_conn.c | 6 +- net/netfilter/ipvs/ip_vs_core.c | 4 +- net/netfilter/ipvs/ip_vs_ctl.c | 14 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 2 +- net/netfilter/ipvs/ip_vs_sync.c | 6 +- net/netfilter/ipvs/ip_vs_xmit.c | 4 +- net/netfilter/nf_conntrack_acct.c | 2 +- net/netfilter/nf_conntrack_core.c | 2 +- net/netfilter/nf_conntrack_ecache.c | 2 +- net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 22 +- net/netfilter/nf_conntrack_proto.c | 2 +- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_conntrack_timestamp.c | 2 +- net/netfilter/nf_log.c | 10 +- net/netfilter/nf_nat_ftp.c | 2 +- net/netfilter/nf_nat_irc.c | 2 +- net/netfilter/nf_sockopt.c | 4 +- net/netfilter/nf_tables_api.c | 13 +- net/netfilter/nfnetlink_acct.c | 7 +- net/netfilter/nfnetlink_cthelper.c | 2 +- net/netfilter/nfnetlink_cttimeout.c | 2 +- net/netfilter/nfnetlink_log.c | 4 +- net/netfilter/nft_compat.c | 9 +- net/netfilter/xt_IDLETIMER.c | 12 +- net/netfilter/xt_statistic.c | 8 +- net/netlink/af_netlink.c | 14 +- net/netlink/diag.c | 2 +- net/netlink/genetlink.c | 14 +- net/openvswitch/vport-geneve.c | 7 +- net/openvswitch/vport-gre.c | 7 +- net/openvswitch/vport-internal_dev.c | 4 +- net/openvswitch/vport-netdev.c | 7 +- net/openvswitch/vport-vxlan.c | 7 +- net/packet/af_packet.c | 26 +- net/packet/diag.c | 2 +- net/packet/internal.h | 6 +- net/phonet/pep.c | 6 +- net/phonet/socket.c | 2 +- net/phonet/sysctl.c | 2 +- net/rds/cong.c | 6 +- net/rds/ib.h | 2 +- net/rds/ib_cm.c | 2 +- net/rds/ib_recv.c | 4 +- net/rds/iw.h | 2 +- net/rds/iw_cm.c | 2 +- net/rds/iw_recv.c | 4 +- net/rds/rds.h | 2 +- net/rds/tcp.c | 2 +- net/rds/tcp.h | 6 +- net/rds/tcp_send.c | 2 +- net/rxrpc/af_rxrpc.c | 2 +- net/rxrpc/ar-ack.c | 14 +- net/rxrpc/ar-call.c | 2 +- net/rxrpc/ar-connection.c | 2 +- net/rxrpc/ar-connevent.c | 2 +- net/rxrpc/ar-input.c | 4 +- net/rxrpc/ar-internal.h | 8 +- net/rxrpc/ar-local.c | 2 +- net/rxrpc/ar-output.c | 4 +- net/rxrpc/ar-peer.c | 2 +- net/rxrpc/ar-proc.c | 4 +- net/rxrpc/ar-transport.c | 2 +- net/rxrpc/rxkad.c | 4 +- net/sched/sch_generic.c | 4 +- net/sched/sch_tbf.c | 9 +- net/sctp/ipv6.c | 6 +- net/sctp/protocol.c | 10 +- net/sctp/sm_sideeffect.c | 4 +- net/sctp/socket.c | 21 +- net/sctp/sysctl.c | 10 +- net/socket.c | 18 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 4 +- net/sunrpc/auth_gss/gss_rpc_xdr.c | 11 +- net/sunrpc/auth_gss/gss_rpc_xdr.h | 8 +- net/sunrpc/auth_gss/svcauth_gss.c | 4 +- net/sunrpc/clnt.c | 4 +- net/sunrpc/rpcb_clnt.c | 66 +- net/sunrpc/sched.c | 4 +- net/sunrpc/svc.c | 8 +- net/sunrpc/svcauth_unix.c | 2 +- net/sunrpc/xprtrdma/svc_rdma.c | 44 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 +- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_transport.c | 10 +- net/tipc/netlink_compat.c | 12 +- net/tipc/subscr.c | 2 +- net/unix/diag.c | 2 +- net/unix/sysctl_net_unix.c | 2 +- net/wireless/scan.c | 3 +- net/wireless/wext-compat.c | 140 +- net/wireless/wext-compat.h | 8 +- net/wireless/wext-core.c | 19 +- net/wireless/wext-sme.c | 5 +- net/xfrm/xfrm_policy.c | 16 +- net/xfrm/xfrm_state.c | 37 +- net/xfrm/xfrm_sysctl.c | 2 +- net/xfrm/xfrm_user.c | 2 +- scripts/Kbuild.include | 2 +- scripts/Makefile.build | 2 +- scripts/Makefile.clean | 3 +- scripts/Makefile.extrawarn | 4 + scripts/Makefile.gcc-plugins | 69 + scripts/Makefile.host | 68 +- scripts/basic/fixdep.c | 12 +- scripts/dtc/checks.c | 14 +- scripts/dtc/data.c | 6 +- scripts/dtc/flattree.c | 8 +- scripts/dtc/livetree.c | 4 +- scripts/gcc-plugin.sh | 51 + scripts/headers_install.sh | 1 + scripts/kallsyms.c | 4 +- scripts/kconfig/lkc.h | 5 +- scripts/kconfig/menu.c | 2 +- scripts/kconfig/symbol.c | 6 +- scripts/link-vmlinux.sh | 2 +- scripts/mod/file2alias.c | 14 +- scripts/mod/modpost.c | 40 +- scripts/mod/modpost.h | 6 +- scripts/mod/sumversion.c | 2 +- scripts/module-common.lds | 4 + scripts/package/builddeb | 1 + scripts/pnmtologo.c | 6 +- scripts/sortextable.h | 6 +- scripts/tags.sh | 2 +- security/Kconfig | 703 +- security/apparmor/include/policy.h | 2 +- security/apparmor/lsm.c | 16 +- security/apparmor/policy.c | 4 +- security/integrity/ima/ima.h | 4 +- security/integrity/ima/ima_api.c | 2 +- security/integrity/ima/ima_fs.c | 4 +- security/integrity/ima/ima_queue.c | 2 +- security/keys/internal.h | 8 +- security/keys/key.c | 18 +- security/keys/keyring.c | 4 - security/selinux/avc.c | 6 +- security/selinux/include/xfrm.h | 2 +- security/yama/yama_lsm.c | 2 +- sound/aoa/codecs/onyx.c | 7 +- sound/aoa/codecs/onyx.h | 1 + sound/core/oss/pcm_oss.c | 18 +- sound/core/pcm_compat.c | 2 +- sound/core/pcm_lib.c | 3 +- sound/core/pcm_native.c | 4 +- sound/core/rawmidi.c | 5 +- sound/core/seq/oss/seq_oss_synth.c | 4 +- sound/core/seq/seq_clientmgr.c | 10 +- sound/core/seq/seq_compat.c | 2 +- sound/core/seq/seq_fifo.c | 6 +- sound/core/seq/seq_fifo.h | 2 +- sound/core/seq/seq_memory.c | 18 +- sound/core/seq/seq_midi.c | 5 +- sound/core/seq/seq_virmidi.c | 2 +- sound/core/sound.c | 2 +- sound/drivers/mts64.c | 14 +- sound/drivers/opl4/opl4_lib.c | 2 +- sound/drivers/portman2x4.c | 3 +- sound/firewire/amdtp-am824.c | 2 +- sound/firewire/amdtp-stream.c | 4 +- sound/firewire/amdtp-stream.h | 2 +- sound/firewire/digi00x/amdtp-dot.c | 2 +- sound/firewire/isight.c | 10 +- sound/firewire/oxfw/oxfw-scs1x.c | 8 +- sound/oss/sb_audio.c | 2 +- sound/oss/swarm_cs4297a.c | 6 +- sound/pci/als300.c | 2 +- sound/pci/aw2/aw2-alsa.c | 2 - sound/pci/aw2/aw2-saa7146.c | 4 +- sound/pci/ctxfi/ctamixer.c | 14 +- sound/pci/ctxfi/ctamixer.h | 8 +- sound/pci/ctxfi/ctatc.c | 20 +- sound/pci/ctxfi/ctdaio.c | 6 +- sound/pci/ctxfi/ctdaio.h | 4 +- sound/pci/ctxfi/ctsrc.c | 13 +- sound/pci/ctxfi/ctsrc.h | 8 +- sound/pci/hda/hda_codec.c | 2 +- sound/pci/ymfpci/ymfpci.h | 2 +- sound/pci/ymfpci/ymfpci_main.c | 12 +- sound/soc/codecs/cx20442.c | 8 +- sound/soc/codecs/sti-sas.c | 10 +- sound/soc/codecs/tlv320dac33.c | 7 +- sound/soc/codecs/uda1380.c | 7 +- sound/soc/intel/skylake/skl-sst-dsp.h | 4 +- sound/soc/soc-ac97.c | 6 +- sound/soc/xtensa/xtfpga-i2s.c | 2 +- tools/gcc/Makefile | 46 + tools/gcc/checker_plugin.c | 496 + tools/gcc/colorize_plugin.c | 162 + tools/gcc/constify_plugin.c | 521 + tools/gcc/gcc-common.h | 858 + tools/gcc/gcc-generate-gimple-pass.h | 175 + tools/gcc/gcc-generate-ipa-pass.h | 289 + tools/gcc/gcc-generate-rtl-pass.h | 175 + tools/gcc/gcc-generate-simple_ipa-pass.h | 175 + tools/gcc/initify_plugin.c | 536 + tools/gcc/kallocstat_plugin.c | 135 + tools/gcc/kernexec_plugin.c | 407 + tools/gcc/latent_entropy_plugin.c | 422 + tools/gcc/randomize_layout_seed.h | 1 + tools/gcc/rap_plugin/Makefile | 4 + tools/gcc/rap_plugin/rap.h | 36 + tools/gcc/rap_plugin/rap_fptr_pass.c | 220 + tools/gcc/rap_plugin/rap_hash.c | 381 + tools/gcc/rap_plugin/rap_plugin.c | 477 + tools/gcc/rap_plugin/sip.c | 96 + tools/gcc/size_overflow_plugin/.gitignore | 3 + tools/gcc/size_overflow_plugin/Makefile | 28 + .../disable_size_overflow_hash.data | 12440 +++++++++++ .../generate_size_overflow_hash.sh | 103 + .../insert_size_overflow_asm.c | 369 + .../size_overflow_plugin/intentional_overflow.c | 1118 + .../size_overflow_plugin/remove_unnecessary_dup.c | 137 + tools/gcc/size_overflow_plugin/size_overflow.h | 329 + .../gcc/size_overflow_plugin/size_overflow_debug.c | 194 + .../size_overflow_plugin/size_overflow_hash.data | 21508 +++++++++++++++++++ .../size_overflow_hash_aux.data | 92 + tools/gcc/size_overflow_plugin/size_overflow_ipa.c | 1163 + .../gcc/size_overflow_plugin/size_overflow_misc.c | 505 + .../size_overflow_plugin/size_overflow_plugin.c | 290 + .../size_overflow_plugin_hash.c | 352 + .../size_overflow_plugin/size_overflow_transform.c | 745 + .../size_overflow_transform_core.c | 1015 + tools/gcc/stackleak_plugin.c | 350 + tools/gcc/structleak_plugin.c | 239 + tools/include/linux/compiler.h | 8 + tools/perf/util/include/asm/alternative-asm.h | 3 + tools/virtio/linux/uaccess.h | 2 +- virt/kvm/kvm_main.c | 42 +- 2639 files changed, 76327 insertions(+), 13888 deletions(-) commit 5988c8dba8a5da45e35d71f4a8fec34c267258c5 Author: Brad Spengler Date: Mon Apr 25 20:40:53 2016 -0400 Fix DoS in n_tty_receive_buf_common reported by marcan at: https://forums.grsecurity.net/viewtopic.php?t=4342&p=16222 and via lengthy diatribe on Twitter: https://twitter.com/marcan42/status/724740708104474626 https://twitter.com/marcan42/status/724740985146609664 https://twitter.com/marcan42/status/724741270325760000 https://twitter.com/marcan42/status/724742465199050752 https://twitter.com/marcan42/status/724745886794833920 https://twitter.com/marcan42/status/724749571495075840 https://twitter.com/marcan42/status/724746427285409796 https://twitter.com/marcan42/status/724743150263095296 https://twitter.com/marcan42/status/724757473433808896 Fix it correctly instead of using the incorrect fix suggested by marcan (aka "try reading the code next time") The original code was meant to fix an integer truncation issue that would also have caused a SIZE_OVERFLOW "DoS". drivers/tty/n_tty.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 5459ff57d8987389fa17d5d6f55b70a789347c2f Author: Brad Spengler Date: Mon Apr 25 19:52:33 2016 -0400 Avoid overflow in environ_read() caught by SIZE_OVERFLOW, reported by jotik at: https://forums.grsecurity.net/viewtopic.php?t=4363&p=16217 patch from Mathias Krause fs/proc/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 24a5c92e147af1e739e9eeca020c61ad2674e784 Author: Jiri Benc Date: Fri Apr 22 13:09:13 2016 +0200 cxgbi: fix uninitialized flowi6 ip6_route_output looks into different fields in the passed flowi6 structure, yet cxgbi passes garbage in nearly all those fields. Zero the structure out first. Fixes: fc8d0590d9142 ("libcxgbi: Add ipv6 api to driver") Signed-off-by: Jiri Benc Signed-off-by: David S. Miller drivers/scsi/cxgbi/libcxgbi.c | 1 + 1 file changed, 1 insertion(+) commit ec65caa32652841a5be21d6e73146921af16d7a8 Author: Brad Spengler Date: Wed Apr 20 20:59:43 2016 -0400 Make /proc/sched_debug only readable by root, mentioned in recent NCC Group paper on Linux containers kernel/sched/debug.c | 4 ++++ 1 file changed, 4 insertions(+) commit 7957d30730bb26a4aef54ab484dc3b4108f1fdb1 Merge: 463149f ff26083 Author: Brad Spengler Date: Wed Apr 20 17:55:53 2016 -0400 Merge branch 'pax-test' into grsec-test commit ff260839e610d2bc1b0c579edd7deb0028198f01 Author: Brad Spengler Date: Wed Apr 20 17:55:24 2016 -0400 Update to pax-linux-4.4.8-test14.patch: - Emese fixed some CodingStyle issues in the latent entropy plugin - fixed some build problems on mips, reported by Steve Arnold (https://bugs.gentoo.org/show_bug.cgi?id=578394) arch/mips/include/asm/cache.h | 3 ++- arch/mips/lib/ashldi3.c | 21 ++++++++++++++------- arch/mips/lib/ashrdi3.c | 19 +++++++++++++------ arch/mips/lib/libgcc.h | 12 +++++++++--- drivers/idle/intel_idle.c | 6 ++++-- tools/gcc/latent_entropy_plugin.c | 29 +++++++++++++++-------------- 6 files changed, 57 insertions(+), 33 deletions(-) commit 463149f47a64db4b26a13009f83ed73d393a209c Author: Xiaodong Liu Date: Tue Apr 12 09:45:51 2016 +0000 crypto: sha1-mb - use corrcet pointer while completing jobs In sha_complete_job, incorrect mcryptd_hash_request_ctx pointer is used when check and complete other jobs. If the memory of first completed req is freed, while still completing other jobs in the func, kernel will crash since NULL pointer is assigned to RIP. Cc: Signed-off-by: Xiaodong Liu Acked-by: Tim Chen Signed-off-by: Herbert Xu arch/x86/crypto/sha-mb/sha1_mb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b4e6484e67b917afb77478cab1260f41dbbc92fc Author: Tom Lendacky Date: Wed Apr 13 10:52:25 2016 -0500 crypto: ccp - Prevent information leakage on export Prevent information from leaking to userspace by doing a memset to 0 of the export state structure before setting the structure values and copying it. This prevents un-initialized padding areas from being copied into the export area. Cc: # 3.14.x- Reported-by: Ben Hutchings Signed-off-by: Tom Lendacky Signed-off-by: Herbert Xu drivers/crypto/ccp/ccp-crypto-aes-cmac.c | 3 +++ drivers/crypto/ccp/ccp-crypto-sha.c | 3 +++ 2 files changed, 6 insertions(+) commit 7d7e961d3f4e4614b22518d8e410e6cf4108f1b0 Author: Konstantin Khlebnikov Date: Mon Apr 18 14:33:54 2016 +0300 net/mlx4_en: allocate non 0-order pages for RX ring with __GFP_NOMEMALLOC High order pages are optional here since commit 51151a16a60f ("mlx4: allow order-0 memory allocations in RX path"), so here is no reason for depleting reserves. Generic __netdev_alloc_frag() implements the same logic. Signed-off-by: Konstantin Khlebnikov Acked-by: Eric Dumazet Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/en_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6b80edde2edc7fd055f9be8ec42b88abbe328639 Author: Ignat Korchagin Date: Thu Mar 17 18:00:29 2016 +0000 USB: usbip: fix potential out-of-bounds write Fix potential out-of-bounds write to urb->transfer_buffer usbip handles network communication directly in the kernel. When receiving a packet from its peer, usbip code parses headers according to protocol. As part of this parsing urb->actual_length is filled. Since the input for urb->actual_length comes from the network, it should be treated as untrusted. Any entity controlling the network may put any value in the input and the preallocated urb->transfer_buffer may not be large enough to hold the data. Thus, the malicious entity is able to write arbitrary data to kernel memory. Signed-off-by: Ignat Korchagin Signed-off-by: Greg Kroah-Hartman drivers/usb/usbip/usbip_common.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 0ce101ec9e74c2cfcd28cbcd18b0626e3d9a2482 Merge: d60a24d f5fe5fd Author: Brad Spengler Date: Wed Apr 20 17:35:58 2016 -0400 Merge branch 'pax-test' into grsec-test commit f5fe5fddf49f1b81a2a3bb43b1e0a8c087aba438 Merge: a107ba2 8c9aef0 Author: Brad Spengler Date: Wed Apr 20 17:35:29 2016 -0400 Merge branch 'linux-4.4.y' into pax-test commit d60a24d6e4f61072d0bd1dc12be1177181fa8c2b Author: Brad Spengler Date: Mon Apr 18 17:48:10 2016 -0400 fix cast for constify change, reported by pipacs drivers/idle/intel_idle.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1d376287aeba7a53c91d5ee49ef0a11d02193964 Author: Brad Spengler Date: Fri Apr 15 21:31:07 2016 -0400 Use proper type for function pointer drivers/gpu/drm/gma500/mdfld_dsi_output.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 0a4104a2fa32904102fac07245426d78a1e9dfab Author: Brad Spengler Date: Fri Apr 15 21:24:04 2016 -0400 Fix skylake cstates compat with constify drivers/idle/intel_idle.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit f433f8fd372253c9e78e307afe5b800c5ab0ea61 Author: Brad Spengler Date: Fri Apr 15 21:10:44 2016 -0400 Update size_overflow hash table tools/gcc/size_overflow_plugin/size_overflow_hash.data | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit ef7804da81cb3c6b6a4c985a3c14ee230a03f26a Author: Brad Spengler Date: Fri Apr 15 20:52:37 2016 -0400 compile fix fs/coredump.c | 3 --- 1 file changed, 3 deletions(-) commit 967224da52bd98d078b1237aea5ec9e622238fba Merge: 92771d6 a107ba2 Author: Brad Spengler Date: Fri Apr 15 20:30:23 2016 -0400 Merge branch 'pax-test' into grsec-test commit a107ba25214d9694eb836fb04c782ad694977b91 Merge: 4d8fc00 b40108b Author: Brad Spengler Date: Fri Apr 15 20:18:26 2016 -0400 Merge branch 'linux-4.4.y' into pax-test commit 92771d60677d68e8f6ea7a91ff34dd6e24b6d4cf Author: Brad Spengler Date: Sun Apr 10 07:18:03 2016 -0400 From: Mathias Krause To: "David S. Miller" Cc: netdev@vger.kernel.org, "Eric W. Biederman" , Pavel Emelyanov Subject: [PATCH net] packet: fix heap info leak in PACKET_DIAG_MCLIST sock_diag interface Because we miss to wipe the remainder of i->addr[] in packet_mc_add(), pdiag_put_mclist() leaks uninitialized heap bytes via the PACKET_DIAG_MCLIST netlink attribute. Fix this by explicitly memset(0)ing the remaining bytes in i->addr[]. Fixes: eea68e2f1a00 ("packet: Report socket mclist info via diag module") Signed-off-by: Mathias Krause Cc: Eric W. Biederman Cc: Pavel Emelyanov --- The bug itself precedes commit eea68e2f1a00 but the list wasn't exposed to userland before the introduction of the packet_diag interface. Therefore the "Fixes:" line on that commit. net/packet/af_packet.c | 1 + 1 file changed, 1 insertion(+) commit 4286ce3f9e9db4d68870af46ae1d5f9b90b920dd Author: Jakub Sitnicki Date: Tue Apr 5 18:41:08 2016 +0200 ipv6: Count in extension headers in skb->network_header When sending a UDPv6 message longer than MTU, account for the length of fragmentable IPv6 extension headers in skb->network_header offset. Same as we do in alloc_new_skb path in __ip6_append_data(). This ensures that later on __ip6_make_skb() will make space in headroom for fragmentable extension headers: /* move skb->data to ip header from ext header */ if (skb->data < skb_network_header(skb)) __skb_pull(skb, skb_network_offset(skb)); Prevents a splat due to skb_under_panic: skbuff: skb_under_panic: text:ffffffff8143397b len:2126 put:14 \ head:ffff880005bacf50 data:ffff880005bacf4a tail:0x48 end:0xc0 dev:lo ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:104! invalid opcode: 0000 [#1] KASAN CPU: 0 PID: 160 Comm: reproducer Not tainted 4.6.0-rc2 #65 [...] Call Trace: [] skb_push+0x79/0x80 [] eth_header+0x2b/0x100 [] neigh_resolve_output+0x210/0x310 [] ip6_finish_output2+0x4a7/0x7c0 [] ip6_output+0x16a/0x280 [] ip6_local_out+0xb1/0xf0 [] ip6_send_skb+0x45/0xd0 [] udp_v6_send_skb+0x246/0x5d0 [] udpv6_sendmsg+0xa6e/0x1090 [...] Reported-by: Ji Jianwen Signed-off-by: Jakub Sitnicki Acked-by: Hannes Frederic Sowa Signed-off-by: David S. Miller net/ipv6/ip6_output.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 638dad49a9ba3d86f627adb58b2f4636ed253685 Author: Thadeu Lima de Souza Cascardo Date: Fri Apr 1 17:17:50 2016 -0300 ip6_tunnel: set rtnl_link_ops before calling register_netdevice When creating an ip6tnl tunnel with ip tunnel, rtnl_link_ops is not set before ip6_tnl_create2 is called. When register_netdevice is called, there is no linkinfo attribute in the NEWLINK message because of that. Setting rtnl_link_ops before calling register_netdevice fixes that. Fixes: 0b112457229d ("ip6tnl: add support of link creation via rtnl") Signed-off-by: Thadeu Lima de Souza Cascardo Acked-by: Nicolas Dichtel Signed-off-by: David S. Miller net/ipv6/ip6_tunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 14146a0bfaf2ced0055fe549c8fa0941c61e2457 Author: Brad Spengler Date: Tue Apr 5 21:12:44 2016 -0400 Code cleanups to RANDSTRUCT based on feedback from the PaX Team tools/gcc/randomize_layout_plugin.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) commit 3f7dea5e59b0bb34f6bdb628c87251f0105b3d57 Author: Brad Spengler Date: Sun Apr 3 20:10:10 2016 -0400 Fix RANDSTRUCT support on ARM tools/gcc/randomize_layout_plugin.c | 54 +++++++++++++++++++++++++++++++++++-- 1 file changed, 52 insertions(+), 2 deletions(-) commit bd893a75ab49f6ea5a216eb334471507337118ba Merge: 87b7f1d 4d8fc00 Author: Brad Spengler Date: Sat Apr 2 11:54:20 2016 -0400 Merge branch 'pax-test' into grsec-test commit 4d8fc00c0066b1921e233123b346efe6ffb27691 Author: Brad Spengler Date: Sat Apr 2 11:53:53 2016 -0400 Update to pax-linux-4.4.6-test13.patch: - fixed a REFCOUNT related compile regression on mips, reported by Steve Arnold (https://bugs.gentoo.org/show_bug.cgi?id=578394) - worked around an integer signedness mixup in md causing a size overflow false positive, reported by Étienne Buira (https://bugs.gentoo.org/show_bug.cgi?id=578502) arch/mips/include/asm/atomic.h | 4 ---- tools/gcc/size_overflow_plugin/disable_size_overflow_hash.data | 1 + tools/gcc/size_overflow_plugin/size_overflow_hash.data | 1 - 3 files changed, 1 insertion(+), 5 deletions(-) commit 87b7f1d200023ba826b9d552834a2ee85e67526c Merge: 3335266 3abdad0 Author: Brad Spengler Date: Sat Apr 2 11:19:17 2016 -0400 Merge branch 'pax-test' into grsec-test commit 3abdad0c3b436c076c88289f07a250b811d6f79d Author: Brad Spengler Date: Sat Apr 2 11:12:56 2016 -0400 Update to pax-linux-4.4.6-test12.patch: - fixed vmalloc_fault on i386/PAE to use the correct percpu userland pgd table/entry - fixed a size overflow false positive report in pptp, reported by Pinkbyte (https://forums.grsecurity.net/viewtopic.php?f=3&t=4437) - fixed a size overflow false positive report in tbf_segment, reported by audiocricket (https://forums.grsecurity.net/viewtopic.php?f=3&t=4438) - Emese fixed the x86 vdso32 CFLAGS to omit the gcc plugins - Emese simplified the gcc plugin related make rules, suggested by Masahiro Yamada - André Fabian Silva Delgado fixed a compile regression on arm, reported by coadde (https://forums.grsecurity.net/viewtopic.php?f=3&t=4435) - fixed an integer sign conversion error in nfs_super_set_maxbytes caught by the size overflow plugin, reported by Alexey Dvoichenkov - fixed a size overflow false positive in squashfs, reported by Mathias Krause - fixed a size overflow false positive in xfrm6_transport_output, reported by marcan (https://forums.grsecurity.net/viewtopic.php?f=3&t=4426) - fixed an integer truncation bug in elf_kcore_store_hdr caught by the size overflow plugin - fixed a gratuitous userland dereference in the amd64 stack walker - added latent entropy gathering to a few more functions - constified a few smp_hotplug_thread instances arch/x86/entry/vdso/Makefile | 1 + arch/x86/include/asm/cpufeature.h | 1 - arch/x86/kernel/dumpstack_64.c | 17 ++++++----------- arch/x86/kernel/head_32.S | 6 +++--- arch/x86/mm/fault.c | 2 +- drivers/iommu/arm-smmu.c | 2 +- drivers/net/ppp/pptp.c | 1 + drivers/staging/rdma/ehca/ehca_irq.c | 2 +- fs/nfs/internal.h | 5 +++-- fs/proc/kcore.c | 2 +- kernel/module.c | 6 +++--- kernel/rcu/tree.c | 2 +- kernel/softirq.c | 2 +- kernel/stop_machine.c | 2 +- net/ipv6/xfrm6_mode_transport.c | 2 +- net/sched/sch_tbf.c | 9 ++++++--- scripts/Makefile.gcc-plugins | 13 +++---------- scripts/Makefile.host | 3 +-- .../disable_size_overflow_hash.data | 4 +++- tools/gcc/size_overflow_plugin/size_overflow_hash.data | 6 ++---- 20 files changed, 40 insertions(+), 48 deletions(-) commit 3335266d5bec9bc01580736c0a7026ed96cf25e5 Author: Mika Penttilä Date: Mon Feb 22 17:56:52 2016 +0100 ARM: 8544/1: set_memory_xx fixes Allow zero size updates. This makes set_memory_xx() consistent with x86, s390 and arm64 and makes apply_to_page_range() not to BUG() when loading modules. Signed-off-by: Mika Penttilä mika.penttila@nextfour.com Signed-off-by: Russell King arch/arm/mm/pageattr.c | 3 +++ 1 file changed, 3 insertions(+) commit d6d6499b22c0e5593a16f41c516041b23fbf9eeb Author: Josh Boyer Date: Mon Mar 14 10:42:38 2016 -0400 USB: iowarrior: fix oops with malicious USB descriptors The iowarrior driver expects at least one valid endpoint. If given malicious descriptors that specify 0 for the number of endpoints, it will crash in the probe function. Ensure there is at least one endpoint on the interface before using it. The full report of this issue can be found here: http://seclists.org/bugtraq/2016/Mar/87 Reported-by: Ralf Spenneberg Cc: stable Signed-off-by: Josh Boyer Signed-off-by: Greg Kroah-Hartman drivers/usb/misc/iowarrior.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 79a1fb47ab1245e81040bcd45b3e44e65d282684 Author: Oliver Neukum Date: Tue Mar 15 10:14:04 2016 +0100 USB: cdc-acm: more sanity checking An attack has become available which pretends to be a quirky device circumventing normal sanity checks and crashes the kernel by an insufficient number of interfaces. This patch adds a check to the code path for quirky devices. Signed-off-by: Oliver Neukum CC: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman drivers/usb/class/cdc-acm.c | 3 +++ 1 file changed, 3 insertions(+) commit 6ee21acdf0da6602671cb50edeca0abfba3955f7 Author: Oliver Neukum Date: Wed Mar 16 13:26:17 2016 +0100 USB: usb_driver_claim_interface: add sanity checking Attacks that trick drivers into passing a NULL pointer to usb_driver_claim_interface() using forged descriptors are known. This thwarts them by sanity checking. Signed-off-by: Oliver Neukum CC: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman drivers/usb/core/driver.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 44247834ddab762509eaaf5c742e15bfadcd9d94 Author: Paolo Bonzini Date: Mon Mar 21 10:15:25 2016 +0100 KVM: fix spin_lock_init order on x86 Moving the initialization earlier is needed in 4.6 because kvm_arch_init_vm is now using mmu_lock, causing lockdep to complain: [ 284.440294] INFO: trying to register non-static key. [ 284.445259] the code is fine but needs lockdep annotation. [ 284.450736] turning off the locking correctness validator. ... [ 284.528318] [] lock_acquire+0xd3/0x240 [ 284.533733] [] ? kvm_page_track_register_notifier+0x20/0x60 [kvm] [ 284.541467] [] _raw_spin_lock+0x41/0x80 [ 284.546960] [] ? kvm_page_track_register_notifier+0x20/0x60 [kvm] [ 284.554707] [] kvm_page_track_register_notifier+0x20/0x60 [kvm] [ 284.562281] [] kvm_mmu_init_vm+0x20/0x30 [kvm] [ 284.568381] [] kvm_arch_init_vm+0x1ea/0x200 [kvm] [ 284.574740] [] kvm_dev_ioctl+0xbf/0x4d0 [kvm] However, it also helps fixing a preexisting problem, which is why this patch is also good for stable kernels: kvm_create_vm was incrementing current->mm->mm_count but not decrementing it at the out_err label (in case kvm_init_mmu_notifier failed). The new initialization order makes it possible to add the required mmdrop without adding a new error label. Cc: stable@vger.kernel.org Reported-by: Borislav Petkov Signed-off-by: Paolo Bonzini virt/kvm/kvm_main.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) commit 9d0cf281d74a9fe490f3ba5ca3d0e57eac066e1c Author: Paolo Bonzini Date: Fri Mar 18 16:53:42 2016 +0100 KVM: VMX: avoid guest hang on invalid invvpid instruction A guest executing an invalid invvpid instruction would hang because the instruction pointer was not updated. Reported-by: jmontleo@redhat.com Tested-by: jmontleo@redhat.com Cc: stable@vger.kernel.org Fixes: 99b83ac893b84ed1a62ad6d1f2b6cc32026b9e85 Reviewed-by: David Matlack Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx.c | 1 + 1 file changed, 1 insertion(+) commit 602caaece277e5e21ae43771398bbf7778061beb Author: Paolo Bonzini Date: Fri Mar 18 16:53:29 2016 +0100 KVM: VMX: avoid guest hang on invalid invept instruction A guest executing an invalid invept instruction would hang because the instruction pointer was not updated. Cc: stable@vger.kernel.org Fixes: bfd0a56b90005f8c8a004baf407ad90045c2b11e Reviewed-by: David Matlack Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx.c | 1 + 1 file changed, 1 insertion(+) commit 3309ac82d6596de8abc6ea51dd0a942416da1cc1 Author: Jann Horn Date: Tue Mar 22 14:25:36 2016 -0700 fs/coredump: prevent fsuid=0 dumps into user-controlled directories This commit fixes the following security hole affecting systems where all of the following conditions are fulfilled: - The fs.suid_dumpable sysctl is set to 2. - The kernel.core_pattern sysctl's value starts with "/". (Systems where kernel.core_pattern starts with "|/" are not affected.) - Unprivileged user namespace creation is permitted. (This is true on Linux >=3.8, but some distributions disallow it by default using a distro patch.) Under these conditions, if a program executes under secure exec rules, causing it to run with the SUID_DUMP_ROOT flag, then unshares its user namespace, changes its root directory and crashes, the coredump will be written using fsuid=0 and a path derived from kernel.core_pattern - but this path is interpreted relative to the root directory of the process, allowing the attacker to control where a coredump will be written with root privileges. To fix the security issue, always interpret core_pattern for dumps that are written under SUID_DUMP_ROOT relative to the root directory of init. Signed-off-by: Jann Horn Acked-by: Kees Cook Cc: Al Viro Cc: "Eric W. Biederman" Cc: Andy Lutomirski Cc: Oleg Nesterov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/um/drivers/mconsole_kern.c | 2 +- fs/coredump.c | 31 +++++++++++++++++++++++++++---- fs/fhandle.c | 2 +- fs/open.c | 6 ++---- include/linux/fs.h | 2 +- kernel/sysctl_binary.c | 2 +- 6 files changed, 33 insertions(+), 12 deletions(-) commit a7c8d3c91a3e50d0873942f09afbb5071382d5e7 Author: Takashi Iwai Date: Fri Apr 1 12:28:16 2016 +0200 ALSA: timer: Use mod_timer() for rearming the system timer ALSA system timer backend stops the timer via del_timer() without sync and leaves del_timer_sync() at the close instead. This is because of the restriction by the design of ALSA timer: namely, the stop callback may be called from the timer handler, and calling the sync shall lead to a hangup. However, this also triggers a kernel BUG() when the timer is rearmed immediately after stopping without sync: kernel BUG at kernel/time/timer.c:966! Call Trace: [] snd_timer_s_start+0x13e/0x1a0 [] snd_timer_interrupt+0x504/0xec0 [] ? debug_check_no_locks_freed+0x290/0x290 [] snd_timer_s_function+0xb4/0x120 [] call_timer_fn+0x162/0x520 [] ? call_timer_fn+0xcd/0x520 [] ? snd_timer_interrupt+0xec0/0xec0 .... It's the place where add_timer() checks the pending timer. It's clear that this may happen after the immediate restart without sync in our cases. So, the workaround here is just to use mod_timer() instead of add_timer(). This looks like a band-aid fix, but it's a right move, as snd_timer_interrupt() takes care of the continuous rearm of timer. Reported-by: Jiri Slaby Cc: Signed-off-by: Takashi Iwai sound/core/timer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 2de05c5fc90b461d78a54a7240b664a068844c8c Author: Daniel Vetter Date: Wed Mar 30 11:40:43 2016 +0200 drm/udl: Use unlocked gem unreferencing For drm_gem_object_unreference callers are required to hold dev->struct_mutex, which these paths don't. Enforcing this requirement has become a bit more strict with commit ef4c6270bf2867e2f8032e9614d1a8cfc6c71663 Author: Daniel Vetter Date: Thu Oct 15 09:36:25 2015 +0200 drm/gem: Check locking in drm_gem_object_unreference Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter Signed-off-by: Dave Airlie drivers/gpu/drm/udl/udl_fb.c | 2 +- drivers/gpu/drm/udl/udl_gem.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit c8153b6b1731b8fee33966dd8d148643240f1dc0 Author: Jan Kara Date: Mon Dec 7 14:34:49 2015 -0500 ext4: fix races of writeback with punch hole and zero range When doing delayed allocation, update of on-disk inode size is postponed until IO submission time. However hole punch or zero range fallocate calls can end up discarding the tail page cache page and thus on-disk inode size would never be properly updated. Make sure the on-disk inode size is updated before truncating page cache. Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/ext4.h | 3 +++ fs/ext4/extents.c | 5 +++++ fs/ext4/inode.c | 35 ++++++++++++++++++++++++++++++++++- 3 files changed, 42 insertions(+), 1 deletion(-) commit d64beb441579f2667e99eb9d4d6e83deb88bf59b Author: Jan Kara Date: Mon Dec 7 14:31:11 2015 -0500 ext4: fix races between buffered IO and collapse / insert range Current code implementing FALLOC_FL_COLLAPSE_RANGE and FALLOC_FL_INSERT_RANGE is prone to races with buffered writes and page faults. If buffered write or write via mmap manages to squeeze between filemap_write_and_wait_range() and truncate_pagecache() in the fallocate implementations, the written data is simply discarded by truncate_pagecache() although it should have been shifted. Fix the problem by moving filemap_write_and_wait_range() call inside i_mutex and i_mmap_sem. That way we are protected against races with both buffered writes and page faults. Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/extents.c | 59 +++++++++++++++++++++++++++++-------------------------- 1 file changed, 31 insertions(+), 28 deletions(-) commit b1ae49aa4dad39233b16456e0765a23ba4e0546c Author: Jan Kara Date: Mon Dec 7 14:29:17 2015 -0500 ext4: move unlocked dio protection from ext4_alloc_file_blocks() Currently ext4_alloc_file_blocks() was handling protection against unlocked DIO. However we now need to sometimes call it under i_mmap_sem and sometimes not and DIO protection ranks above it (although strictly speaking this cannot currently create any deadlocks). Also ext4_zero_range() was actually getting & releasing unlocked DIO protection twice in some cases. Luckily it didn't introduce any real bug but it was a land mine waiting to be stepped on. So move DIO protection out from ext4_alloc_file_blocks() into the two callsites. Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/extents.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) commit f9329a4ec30a26f0fababf809c5f1a3ef851b625 Author: Jan Kara Date: Mon Dec 7 14:28:03 2015 -0500 ext4: fix races between page faults and hole punching Currently, page faults and hole punching are completely unsynchronized. This can result in page fault faulting in a page into a range that we are punching after truncate_pagecache_range() has been called and thus we can end up with a page mapped to disk blocks that will be shortly freed. Filesystem corruption will shortly follow. Note that the same race is avoided for truncate by checking page fault offset against i_size but there isn't similar mechanism available for punching holes. Fix the problem by creating new rw semaphore i_mmap_sem in inode and grab it for writing over truncate, hole punching, and other functions removing blocks from extent tree and for read over page faults. We cannot easily use i_data_sem for this since that ranks below transaction start and we need something ranking above it so that it can be held over the whole truncate / hole punching operation. Also remove various workarounds we had in the code to reduce race window when page fault could have created pages with stale mapping information. Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/ext4.h | 10 +++++++++ fs/ext4/extents.c | 54 ++++++++++++++++++++++++-------------------- fs/ext4/file.c | 66 ++++++++++++++++++++++++++++++++++++++++++++++-------- fs/ext4/inode.c | 36 +++++++++++++++++++++-------- fs/ext4/super.c | 1 + fs/ext4/truncate.h | 2 ++ 6 files changed, 127 insertions(+), 42 deletions(-) commit 572a615b85c1d5c8aeea4ffd24ab428775a1cca9 Author: Guenter Roeck Date: Sat Mar 26 12:28:05 2016 -0700 hwmon: (max1111) Return -ENODEV from max1111_read_channel if not instantiated arm:pxa_defconfig can result in the following crash if the max1111 driver is not instantiated. Unhandled fault: page domain fault (0x01b) at 0x00000000 pgd = c0004000 [00000000] *pgd=00000000 Internal error: : 1b [#1] PREEMPT ARM Modules linked in: CPU: 0 PID: 300 Comm: kworker/0:1 Not tainted 4.5.0-01301-g1701f680407c #10 Hardware name: SHARP Akita Workqueue: events sharpsl_charge_toggle task: c390a000 ti: c391e000 task.ti: c391e000 PC is at max1111_read_channel+0x20/0x30 LR is at sharpsl_pm_pxa_read_max1111+0x2c/0x3c pc : [] lr : [] psr: 20000013 ... [] (max1111_read_channel) from [] (sharpsl_pm_pxa_read_max1111+0x2c/0x3c) [] (sharpsl_pm_pxa_read_max1111) from [] (spitzpm_read_devdata+0x5c/0xc4) [] (spitzpm_read_devdata) from [] (sharpsl_check_battery_temp+0x78/0x110) [] (sharpsl_check_battery_temp) from [] (sharpsl_charge_toggle+0x48/0x110) [] (sharpsl_charge_toggle) from [] (process_one_work+0x14c/0x48c) [] (process_one_work) from [] (worker_thread+0x3c/0x5d4) [] (worker_thread) from [] (kthread+0xd0/0xec) [] (kthread) from [] (ret_from_fork+0x14/0x24) This can occur because the SPI controller driver (SPI_PXA2XX) is built as module and thus not necessarily loaded. While building SPI_PXA2XX into the kernel would make the problem disappear, it appears prudent to ensure that the driver is instantiated before accessing its data structures. Cc: Arnd Bergmann Cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck drivers/hwmon/max1111.c | 6 ++++++ 1 file changed, 6 insertions(+) commit f75f1af7a0b4be055855ca5120ee78174f3370f2 Author: Nicolai Stange Date: Sun Mar 20 23:23:46 2016 +0100 PKCS#7: pkcs7_validate_trust(): initialize the _trusted output argument Despite what the DocBook comment to pkcs7_validate_trust() says, the *_trusted argument is never set to false. pkcs7_validate_trust() only positively sets *_trusted upon encountering a trusted PKCS#7 SignedInfo block. This is quite unfortunate since its callers, system_verify_data() for example, depend on pkcs7_validate_trust() clearing *_trusted on non-trust. Indeed, UBSAN splats when attempting to load the uninitialized local variable 'trusted' from system_verify_data() in pkcs7_validate_trust(): UBSAN: Undefined behaviour in crypto/asymmetric_keys/pkcs7_trust.c:194:14 load of value 82 is not a valid value for type '_Bool' [...] Call Trace: [] dump_stack+0xbc/0x117 [] ? _atomic_dec_and_lock+0x169/0x169 [] ubsan_epilogue+0xd/0x4e [] __ubsan_handle_load_invalid_value+0x111/0x158 [] ? val_to_string.constprop.12+0xcf/0xcf [] ? x509_request_asymmetric_key+0x114/0x370 [] ? kfree+0x220/0x370 [] ? public_key_verify_signature_2+0x32/0x50 [] pkcs7_validate_trust+0x524/0x5f0 [] system_verify_data+0xca/0x170 [] ? top_trace_array+0x9b/0x9b [] ? __vfs_read+0x279/0x3d0 [] mod_verify_sig+0x1ff/0x290 [...] The implication is that pkcs7_validate_trust() effectively grants trust when it really shouldn't have. Fix this by explicitly setting *_trusted to false at the very beginning of pkcs7_validate_trust(). Cc: Signed-off-by: Nicolai Stange Signed-off-by: Herbert Xu crypto/asymmetric_keys/pkcs7_trust.c | 2 ++ 1 file changed, 2 insertions(+) commit 1052826f7352ccc98167129b0b83222f45d50046 Author: Florian Westphal Date: Tue Mar 22 18:02:49 2016 +0100 netfilter: x_tables: validate e->target_offset early We should check that e->target_offset is sane before mark_source_chains gets called since it will fetch the target entry for loop detection. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/ipv4/netfilter/arp_tables.c | 17 ++++++++--------- net/ipv4/netfilter/ip_tables.c | 17 ++++++++--------- net/ipv6/netfilter/ip6_tables.c | 17 ++++++++--------- 3 files changed, 24 insertions(+), 27 deletions(-) commit b35d19509e8dab157214e46dd24314663ccf554f Author: Florian Westphal Date: Tue Mar 22 18:02:50 2016 +0100 netfilter: x_tables: make sure e->next_offset covers remaining blob size Otherwise this function may read data beyond the ruleset blob. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/ipv4/netfilter/arp_tables.c | 6 ++++-- net/ipv4/netfilter/ip_tables.c | 6 ++++-- net/ipv6/netfilter/ip6_tables.c | 6 ++++-- 3 files changed, 12 insertions(+), 6 deletions(-) commit 4d7642ed66b69140733a7b51fcd6d37ce4d4514c Author: Florian Westphal Date: Tue Mar 22 18:02:52 2016 +0100 netfilter: x_tables: fix unconditional helper Ben Hawkes says: In the mark_source_chains function (net/ipv4/netfilter/ip_tables.c) it is possible for a user-supplied ipt_entry structure to have a large next_offset field. This field is not bounds checked prior to writing a counter value at the supplied offset. Problem is that mark_source_chains should not have been called -- the rule doesn't have a next entry, so its supposed to return an absolute verdict of either ACCEPT or DROP. However, the function conditional() doesn't work as the name implies. It only checks that the rule is using wildcard address matching. However, an unconditional rule must also not be using any matches (no -m args). The underflow validator only checked the addresses, therefore passing the 'unconditional absolute verdict' test, while mark_source_chains also tested for presence of matches, and thus proceeeded to the next (not-existent) rule. Unify this so that all the callers have same idea of 'unconditional rule'. Reported-by: Ben Hawkes Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/ipv4/netfilter/arp_tables.c | 18 +++++++++--------- net/ipv4/netfilter/ip_tables.c | 23 +++++++++++------------ net/ipv6/netfilter/ip6_tables.c | 23 +++++++++++------------ 3 files changed, 31 insertions(+), 33 deletions(-) commit e3e51682563f1453dfc4b9ef88b29af4d1a78e78 Author: Pablo Neira Ayuso Date: Thu Mar 24 21:29:53 2016 +0100 netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES Make sure the table names via getsockopt GET_ENTRIES is nul-terminated in ebtables and all the x_tables variants and their respective compat code. Uncovered by KASAN. Reported-by: Baozeng Ding Signed-off-by: Pablo Neira Ayuso net/bridge/netfilter/ebtables.c | 4 ++++ net/ipv4/netfilter/arp_tables.c | 2 ++ net/ipv4/netfilter/ip_tables.c | 2 ++ net/ipv6/netfilter/ip6_tables.c | 2 ++ 4 files changed, 10 insertions(+) commit 7742471b674597627f8f608f6a89c6e5bbd6533d Author: Nicolai Stange Date: Fri Mar 25 14:22:14 2016 -0700 mm/filemap: generic_file_read_iter(): check for zero reads unconditionally If - generic_file_read_iter() gets called with a zero read length, - the read offset is at a page boundary, - IOCB_DIRECT is not set - and the page in question hasn't made it into the page cache yet, then do_generic_file_read() will trigger a readahead with a req_size hint of zero. Since roundup_pow_of_two(0) is undefined, UBSAN reports UBSAN: Undefined behaviour in include/linux/log2.h:63:13 shift exponent 64 is too large for 64-bit type 'long unsigned int' CPU: 3 PID: 1017 Comm: sa1 Tainted: G L 4.5.0-next-20160318+ #14 [...] Call Trace: [...] [] ondemand_readahead+0x3aa/0x3d0 [] ? ondemand_readahead+0x3aa/0x3d0 [] ? find_get_entry+0x2d/0x210 [] page_cache_sync_readahead+0x63/0xa0 [] do_generic_file_read+0x80d/0xf90 [] generic_file_read_iter+0x185/0x420 [...] [] __vfs_read+0x256/0x3d0 [...] when get_init_ra_size() gets called from ondemand_readahead(). The net effect is that the initial readahead size is arch dependent for requested read lengths of zero: for example, since 1UL << (sizeof(unsigned long) * 8) evaluates to 1 on x86 while its result is 0 on ARMv7, the initial readahead size becomes 4 on the former and 0 on the latter. What's more, whether or not the file access timestamp is updated for zero length reads is decided differently for the two cases of IOCB_DIRECT being set or cleared: in the first case, generic_file_read_iter() explicitly skips updating that timestamp while in the latter case, it is always updated through the call to do_generic_file_read(). According to POSIX, zero length reads "do not modify the last data access timestamp" and thus, the IOCB_DIRECT behaviour is POSIXly correct. Let generic_file_read_iter() unconditionally check the requested read length at its entry and return immediately with success if it is zero. Signed-off-by: Nicolai Stange Cc: Al Viro Reviewed-by: Jan Kara Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/filemap.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 604785419da498d7e876a0191b2e11626db706bb Author: Oliver Neukum Date: Thu Mar 17 14:00:17 2016 -0700 Input: ims-pcu - sanity check against missing interfaces A malicious device missing interface can make the driver oops. Add sanity checking. Signed-off-by: Oliver Neukum CC: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov drivers/input/misc/ims-pcu.c | 4 ++++ 1 file changed, 4 insertions(+) commit 24c3f4f6652f07eb2c3deea1488ff4de00592e80 Author: Vladis Dronov Date: Wed Mar 23 11:53:46 2016 -0700 Input: ati_remote2 - fix crashes on detecting device with invalid descriptor The ati_remote2 driver expects at least two interfaces with one endpoint each. If given malicious descriptor that specify one interface or no endpoints, it will crash in the probe function. Ensure there is at least two interfaces and one endpoint for each interface before using it. The full disclosure: http://seclists.org/bugtraq/2016/Mar/90 Reported-by: Ralf Spenneberg Signed-off-by: Vladis Dronov Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov drivers/input/misc/ati_remote2.c | 36 ++++++++++++++++++++++++++++++------ 1 file changed, 30 insertions(+), 6 deletions(-) commit 262df604d00e72a4b930fbf7fe3a770f0196a5a5 Author: Oliver Neukum Date: Wed Mar 23 14:36:56 2016 -0700 Input: sur40 - fix DMA on stack During the initialisation the driver uses a buffer on the stack for DMA. That violates the cache coherency rules. The fix is to allocate the buffer with kmalloc(). Signed-off-by: Oliver Neukum Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/sur40.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) commit 015dd03669b2ab646723f6b123377e4ef5694a10 Author: Haiyang Zhang Date: Wed Mar 23 09:43:10 2016 -0700 hv_netvsc: Fix the array sizes to be max supported channels The VRSS_CHANNEL_MAX is the max number of channels supported by Hyper-V hosts. We use it for the related array sizes instead of using NR_CPUS, which may be set to several thousands. This patch reduces possible memory allocation failures. Signed-off-by: Haiyang Zhang Reviewed-by: K. Y. Srinivasan Signed-off-by: David S. Miller drivers/net/hyperv/hyperv_net.h | 7 ++++--- drivers/net/hyperv/rndis_filter.c | 4 ++-- 2 files changed, 6 insertions(+), 5 deletions(-) commit a850a78d6393ef22a970266cbbefdf3dba0267b5 Author: Haiyang Zhang Date: Wed Mar 23 09:43:09 2016 -0700 hv_netvsc: Fix accessing freed memory in netvsc_change_mtu() struct netvsc_device is freed in rndis_filter_device_remove(). So we save the nvdev->num_chn into a temp variable for later usage. (Please also include this patch into stable branch.) Signed-off-by: Haiyang Zhang Reviewed-by: K. Y. Srinivasan Signed-off-by: David S. Miller drivers/net/hyperv/netvsc_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 7409626e43fe871cede30ac926425938f3ccddaf Author: Guillaume Nault Date: Wed Mar 23 16:38:55 2016 +0100 ppp: take reference on channels netns Let channels hold a reference on their network namespace. Some channel types, like ppp_async and ppp_synctty, can have their userspace controller running in a different namespace. Therefore they can't rely on them to preclude their netns from being removed from under them. ================================================================== BUG: KASAN: use-after-free in ppp_unregister_channel+0x372/0x3a0 at addr ffff880064e217e0 Read of size 8 by task syz-executor/11581 ============================================================================= BUG net_namespace (Not tainted): kasan: bad access detected ----------------------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: Allocated in copy_net_ns+0x6b/0x1a0 age=92569 cpu=3 pid=6906 [< none >] ___slab_alloc+0x4c7/0x500 kernel/mm/slub.c:2440 [< none >] __slab_alloc+0x4c/0x90 kernel/mm/slub.c:2469 [< inline >] slab_alloc_node kernel/mm/slub.c:2532 [< inline >] slab_alloc kernel/mm/slub.c:2574 [< none >] kmem_cache_alloc+0x23a/0x2b0 kernel/mm/slub.c:2579 [< inline >] kmem_cache_zalloc kernel/include/linux/slab.h:597 [< inline >] net_alloc kernel/net/core/net_namespace.c:325 [< none >] copy_net_ns+0x6b/0x1a0 kernel/net/core/net_namespace.c:360 [< none >] create_new_namespaces+0x2f6/0x610 kernel/kernel/nsproxy.c:95 [< none >] copy_namespaces+0x297/0x320 kernel/kernel/nsproxy.c:150 [< none >] copy_process.part.35+0x1bf4/0x5760 kernel/kernel/fork.c:1451 [< inline >] copy_process kernel/kernel/fork.c:1274 [< none >] _do_fork+0x1bc/0xcb0 kernel/kernel/fork.c:1723 [< inline >] SYSC_clone kernel/kernel/fork.c:1832 [< none >] SyS_clone+0x37/0x50 kernel/kernel/fork.c:1826 [< none >] entry_SYSCALL_64_fastpath+0x16/0x7a kernel/arch/x86/entry/entry_64.S:185 INFO: Freed in net_drop_ns+0x67/0x80 age=575 cpu=2 pid=2631 [< none >] __slab_free+0x1fc/0x320 kernel/mm/slub.c:2650 [< inline >] slab_free kernel/mm/slub.c:2805 [< none >] kmem_cache_free+0x2a0/0x330 kernel/mm/slub.c:2814 [< inline >] net_free kernel/net/core/net_namespace.c:341 [< none >] net_drop_ns+0x67/0x80 kernel/net/core/net_namespace.c:348 [< none >] cleanup_net+0x4e5/0x600 kernel/net/core/net_namespace.c:448 [< none >] process_one_work+0x794/0x1440 kernel/kernel/workqueue.c:2036 [< none >] worker_thread+0xdb/0xfc0 kernel/kernel/workqueue.c:2170 [< none >] kthread+0x23f/0x2d0 kernel/drivers/block/aoe/aoecmd.c:1303 [< none >] ret_from_fork+0x3f/0x70 kernel/arch/x86/entry/entry_64.S:468 INFO: Slab 0xffffea0001938800 objects=3 used=0 fp=0xffff880064e20000 flags=0x5fffc0000004080 INFO: Object 0xffff880064e20000 @offset=0 fp=0xffff880064e24200 CPU: 1 PID: 11581 Comm: syz-executor Tainted: G B 4.4.0+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014 00000000ffffffff ffff8800662c7790 ffffffff8292049d ffff88003e36a300 ffff880064e20000 ffff880064e20000 ffff8800662c77c0 ffffffff816f2054 ffff88003e36a300 ffffea0001938800 ffff880064e20000 0000000000000000 Call Trace: [< inline >] __dump_stack kernel/lib/dump_stack.c:15 [] dump_stack+0x6f/0xa2 kernel/lib/dump_stack.c:50 [] print_trailer+0xf4/0x150 kernel/mm/slub.c:654 [] object_err+0x2f/0x40 kernel/mm/slub.c:661 [< inline >] print_address_description kernel/mm/kasan/report.c:138 [] kasan_report_error+0x215/0x530 kernel/mm/kasan/report.c:236 [< inline >] kasan_report kernel/mm/kasan/report.c:259 [] __asan_report_load8_noabort+0x3e/0x40 kernel/mm/kasan/report.c:280 [< inline >] ? ppp_pernet kernel/include/linux/compiler.h:218 [] ? ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392 [< inline >] ppp_pernet kernel/include/linux/compiler.h:218 [] ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392 [< inline >] ? ppp_pernet kernel/drivers/net/ppp/ppp_generic.c:293 [] ? ppp_unregister_channel+0xe6/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392 [] ppp_asynctty_close+0xa3/0x130 kernel/drivers/net/ppp/ppp_async.c:241 [] ? async_lcp_peek+0x5b0/0x5b0 kernel/drivers/net/ppp/ppp_async.c:1000 [] tty_ldisc_close.isra.1+0x99/0xe0 kernel/drivers/tty/tty_ldisc.c:478 [] tty_ldisc_kill+0x40/0x170 kernel/drivers/tty/tty_ldisc.c:744 [] tty_ldisc_release+0x1b3/0x260 kernel/drivers/tty/tty_ldisc.c:772 [] tty_release+0xac1/0x13e0 kernel/drivers/tty/tty_io.c:1901 [] ? release_tty+0x320/0x320 kernel/drivers/tty/tty_io.c:1688 [] __fput+0x236/0x780 kernel/fs/file_table.c:208 [] ____fput+0x15/0x20 kernel/fs/file_table.c:244 [] task_work_run+0x16b/0x200 kernel/kernel/task_work.c:115 [< inline >] exit_task_work kernel/include/linux/task_work.h:21 [] do_exit+0x8b5/0x2c60 kernel/kernel/exit.c:750 [] ? debug_check_no_locks_freed+0x290/0x290 kernel/kernel/locking/lockdep.c:4123 [] ? mm_update_next_owner+0x6f0/0x6f0 kernel/kernel/exit.c:357 [] ? __dequeue_signal+0x136/0x470 kernel/kernel/signal.c:550 [] ? recalc_sigpending_tsk+0x13b/0x180 kernel/kernel/signal.c:145 [] do_group_exit+0x108/0x330 kernel/kernel/exit.c:880 [] get_signal+0x5e4/0x14f0 kernel/kernel/signal.c:2307 [< inline >] ? kretprobe_table_lock kernel/kernel/kprobes.c:1113 [] ? kprobe_flush_task+0xb5/0x450 kernel/kernel/kprobes.c:1158 [] do_signal+0x83/0x1c90 kernel/arch/x86/kernel/signal.c:712 [] ? recycle_rp_inst+0x310/0x310 kernel/include/linux/list.h:655 [] ? setup_sigcontext+0x780/0x780 kernel/arch/x86/kernel/signal.c:165 [] ? finish_task_switch+0x424/0x5f0 kernel/kernel/sched/core.c:2692 [< inline >] ? finish_lock_switch kernel/kernel/sched/sched.h:1099 [] ? finish_task_switch+0x120/0x5f0 kernel/kernel/sched/core.c:2678 [< inline >] ? context_switch kernel/kernel/sched/core.c:2807 [] ? __schedule+0x919/0x1bd0 kernel/kernel/sched/core.c:3283 [] exit_to_usermode_loop+0xf1/0x1a0 kernel/arch/x86/entry/common.c:247 [< inline >] prepare_exit_to_usermode kernel/arch/x86/entry/common.c:282 [] syscall_return_slowpath+0x19f/0x210 kernel/arch/x86/entry/common.c:344 [] int_ret_from_sys_call+0x25/0x9f kernel/arch/x86/entry/entry_64.S:281 Memory state around the buggy address: ffff880064e21680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff880064e21700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff880064e21780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff880064e21800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff880064e21880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fixes: 273ec51dd7ce ("net: ppp_generic - introduce net-namespace functionality v2") Reported-by: Baozeng Ding Signed-off-by: Guillaume Nault Reviewed-by: Cyrill Gorcunov Signed-off-by: David S. Miller drivers/net/ppp/ppp_generic.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit bfb890c1ac9d29b377f6bec4a5aab51d053114c4 Author: Herbert Xu Date: Wed Mar 16 17:06:01 2016 +0800 eCryptfs: Use skcipher and shash eCryptfs: Fix null pointer dereference on kzalloc error path The conversion to skcipher and shash added a couple of null pointer dereference bugs on the kzalloc failure path. This patch fixes them. Fixes: 3095e8e366b4 ("eCryptfs: Use skcipher and shash") Reported-by: Dan Carpenter Signed-off-by: Herbert Xu fs/ecryptfs/keystore.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 58a8421ae537e0609c4ff59bf6b11be869a43cc6 Author: Boris BREZILLON Date: Thu Mar 17 10:21:34 2016 +0100 crypto: marvell/cesa - fix memory leak Crypto requests are not guaranteed to be finalized (->final() call), and can be freed at any moment, without getting any notification from the core. This can lead to memory leaks of the ->cache buffer. Make this buffer part of the request object, and allocate an extra buffer from the DMA cache pool when doing DMA operations. As a side effect, this patch also fixes another bug related to cache allocation and DMA operations. When the core allocates a new request and import an existing state, a cache buffer can be allocated (depending on the state). The problem is, at that very moment, we don't know yet whether the request will use DMA or not, and since everything is likely to be initialized to zero, mv_cesa_ahash_alloc_cache() thinks it should allocate a buffer for standard operation. But when mv_cesa_ahash_free_cache() is called, req->type has been set to CESA_DMA_REQ in the meantime, thus leading to an invalind dma_pool_free() call (the buffer passed in argument has not been allocated from the pool). Signed-off-by: Boris Brezillon Reported-by: Gregory CLEMENT Signed-off-by: Herbert Xu drivers/crypto/marvell/cesa.h | 3 +- drivers/crypto/marvell/hash.c | 86 +++++++++---------------------------------- 2 files changed, 20 insertions(+), 69 deletions(-) commit 1ec604f99895b9c37f26a692ff83a7da02d667fd Author: Boris BREZILLON Date: Thu Mar 17 10:21:35 2016 +0100 crypto: marvell/cesa - initialize hash states ->export() might be called before we have done an update operation, and in this case the ->state field is left uninitialized. Put the correct default value when initializing the request. Signed-off-by: Boris Brezillon Signed-off-by: Herbert Xu drivers/crypto/marvell/hash.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) commit 23879f055d23e82c2f78cceca22c33e631973977 Author: David S. Miller Date: Sun Mar 13 23:28:00 2016 -0400 ipv4: Don't do expensive useless work during inetdev destroy. When an inetdev is destroyed, every address assigned to the interface is removed. And in this scenerio we do two pointless things which can be very expensive if the number of assigned interfaces is large: 1) Address promotion. We are deleting all addresses, so there is no point in doing this. 2) A full nf conntrack table purge for every address. We only need to do this once, as is already caught by the existing masq_dev_notifier so masq_inet_event() can skip this. Reported-by: Solar Designer Signed-off-by: David S. Miller Tested-by: Cyrill Gorcunov net/ipv4/devinet.c | 4 ++++ net/ipv4/fib_frontend.c | 4 ++++ net/ipv4/netfilter/nf_nat_masquerade_ipv4.c | 12 ++++++++++-- 3 files changed, 18 insertions(+), 2 deletions(-) commit 60394231e840e884024592a76a6c5612433d3756 Author: Marcelo Ricardo Leitner Date: Tue Mar 8 10:34:28 2016 -0300 sctp: fix copying more bytes than expected in sctp_add_bind_addr Dmitry reported that sctp_add_bind_addr may read more bytes than expected in case the parameter is a IPv4 addr supplied by the user through calls such as sctp_bindx_add(), because it always copies sizeof(union sctp_addr) while the buffer may be just a struct sockaddr_in, which is smaller. This patch then fixes it by limiting the memcpy to the min between the union size and a (new parameter) provided addr size. Where possible this parameter still is the size of that union, except for reading from user-provided buffers, which then it accounts for protocol type. Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller include/net/sctp/structs.h | 2 +- net/sctp/bind_addr.c | 14 ++++++++------ net/sctp/protocol.c | 1 + net/sctp/sm_make_chunk.c | 3 ++- net/sctp/socket.c | 4 +++- 5 files changed, 15 insertions(+), 9 deletions(-) commit 9831caa50e1453818c5ec618890291f028b7992f Author: Brad Spengler Date: Mon Mar 28 19:20:28 2016 -0400 Also allow /bin/false as needed by systemd kernel/kmod.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bb38a61b496a3f09f4d7b93d2f0fe15476918147 Author: Brad Spengler Date: Tue Mar 22 16:59:43 2016 -0400 Fix size_overflow FP reported by marcan at: https://forums.grsecurity.net/viewtopic.php?f=3&t=4426 net/ipv6/xfrm6_mode_transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 523a36a9c845da3051e58c6767c2e1a0f640998a Merge: 0d0ec9e c0b77a7 Author: Brad Spengler Date: Wed Mar 16 20:20:40 2016 -0400 Merge branch 'pax-test' into grsec-test commit c0b77a7cb578199f0b7dc90768a13ca6c044aba9 Merge: 10d57c1 0d19123 Author: Brad Spengler Date: Wed Mar 16 20:20:27 2016 -0400 Merge branch 'linux-4.4.y' into pax-test commit 0d0ec9ee83144ab839710a01cfd746bd78257394 Author: Brad Spengler Date: Mon Mar 14 20:15:47 2016 -0400 Invert logic to clean up code fs/namei.c | 32 +++++++------------------------- grsecurity/grsec_chroot.c | 10 +++++----- 2 files changed, 12 insertions(+), 30 deletions(-) commit 39e0e623c84863af7b3ace759b583ff938fde2b7 Author: Brad Spengler Date: Mon Mar 14 19:59:36 2016 -0400 compile fix fs/namei.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 2b3ad8bc095fea829275b7fcc7e5671677b8ed33 Author: Brad Spengler Date: Mon Mar 14 19:57:53 2016 -0400 Also handle renames fs/namei.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 54dfd13b19743d4a340de0cd5683b5bde44e7d9c Author: Brad Spengler Date: Mon Mar 14 19:45:56 2016 -0400 Add additional check to cover lookup family of functions fs/namei.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit c3df846baa7873fb99401136f220676b87452918 Author: Brad Spengler Date: Mon Mar 14 18:42:37 2016 -0400 compile fix fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 384ea9c0ef9df4298dfa3a71948c08e70f1092bf Author: Brad Spengler Date: Mon Mar 14 18:34:40 2016 -0400 Fix recent chroot check on the create side, as reported by Toralf Foerster fs/namei.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) commit 82e7dc61a626c47887d392ff9cd35b104f01fd25 Author: Paolo Bonzini Date: Tue Mar 8 12:13:39 2016 +0100 KVM: MMU: fix ept=0/pte.u=1/pte.w=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 combo Yes, all of these are needed. :) This is admittedly a bit odd, but kvm-unit-tests access.flat tests this if you run it with "-cpu host" and of course ept=0. KVM runs the guest with CR0.WP=1, so it must handle supervisor writes specially when pte.u=1/pte.w=0/CR0.WP=0. Such writes cause a fault when U=1 and W=0 in the SPTE, but they must succeed because CR0.WP=0. When KVM gets the fault, it sets U=0 and W=1 in the shadow PTE and restarts execution. This will still cause a user write to fault, while supervisor writes will succeed. User reads will fault spuriously now, and KVM will then flip U and W again in the SPTE (U=1, W=0). User reads will be enabled and supervisor writes disabled, going back to the originary situation where supervisor writes fault spuriously. When SMEP is in effect, however, U=0 will enable kernel execution of this page. To avoid this, KVM also sets NX=1 in the shadow PTE together with U=0. If the guest has not enabled NX, the result is a continuous stream of page faults due to the NX bit being reserved. The fix is to force EFER.NX=1 even if the CPU is taking care of the EFER switch. (All machines with SMEP have the CPU_LOAD_IA32_EFER vm-entry control, so they do not use user-return notifiers for EFER---if they did, EFER.NX would be forced to the same value as the host). There is another bug in the reserved bit check, which I've split to a separate patch for easier application to stable kernels. Cc: stable@vger.kernel.org Cc: Andy Lutomirski Reviewed-by: Xiao Guangrong Fixes: f6577a5fa15d82217ca73c74cd2dcbc0f6c781dd Signed-off-by: Paolo Bonzini Documentation/virtual/kvm/mmu.txt | 3 ++- arch/x86/kvm/vmx.c | 36 +++++++++++++++++++++++------------- 2 files changed, 25 insertions(+), 14 deletions(-) commit 802a88e57b141e9643e93afb7805813ad8da22f3 Author: Paolo Bonzini Date: Wed Mar 9 14:28:02 2016 +0100 KVM: MMU: fix reserved bit check for ept=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 KVM has special logic to handle pages with pte.u=1 and pte.w=0 when CR0.WP=1. These pages' SPTEs flip continuously between two states: U=1/W=0 (user and supervisor reads allowed, supervisor writes not allowed) and U=0/W=1 (supervisor reads and writes allowed, user writes not allowed). When SMEP is in effect, however, U=0 will enable kernel execution of this page. To avoid this, KVM also sets NX=1 in the shadow PTE together with U=0, making the two states U=1/W=0/NX=gpte.NX and U=0/W=1/NX=1. When guest EFER has the NX bit cleared, the reserved bit check thinks that the latter state is invalid; teach it that the smep_andnot_wp case will also use the NX bit of SPTEs. Cc: stable@vger.kernel.org Reviewed-by: Xiao Guangrong Fixes: c258b62b264fdc469b6d3610a907708068145e3b Signed-off-by: Paolo Bonzini arch/x86/kvm/mmu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 3925851224428c1d2bca32cf33821befb947c4f3 Author: Ming Lei Date: Sat Mar 12 22:56:19 2016 +0800 block: don't optimize for non-cloned bio in bio_get_last_bvec() For !BIO_CLONED bio, we can use .bi_vcnt safely, but it doesn't mean we can just simply return .bi_io_vec[.bi_vcnt - 1] because the start postion may have been moved in the middle of the bvec, such as splitting in the middle of bvec. Fixes: 7bcd79ac50d9(block: bio: introduce helpers to get the 1st and last bvec) Cc: stable@vger.kernel.org Reported-by: Kent Overstreet Signed-off-by: Ming Lei Signed-off-by: Jens Axboe include/linux/bio.h | 5 ----- 1 file changed, 5 deletions(-) commit db541463b4a0926bebdbac743c8736fb9e903d58 Author: Borislav Petkov Date: Fri Mar 11 12:32:06 2016 +0100 x86/fpu: Fix eager-FPU handling on legacy FPU machines i486 derived cores like Intel Quark support only the very old, legacy x87 FPU (FSAVE/FRSTOR, CPUID bit FXSR is not set), and our FPU code wasn't handling the saving and restoring there properly in the 'eagerfpu' case. So after we made eagerfpu the default for all CPU types: 58122bf1d856 x86/fpu: Default eagerfpu=on on all CPUs these old FPU designs broke. First, Andy Shevchenko reported a splat: WARNING: CPU: 0 PID: 823 at arch/x86/include/asm/fpu/internal.h:163 fpu__clear+0x8c/0x160 which was us trying to execute FXRSTOR on those machines even though they don't support it. After taking care of that, Bryan O'Donoghue reported that a simple FPU test still failed because we weren't initializing the FPU state properly on those machines. Take care of all that. Reported-and-tested-by: Bryan O'Donoghue Reported-by: Andy Shevchenko Signed-off-by: Borislav Petkov Acked-by: Linus Torvalds Cc: Andrew Morton Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Dave Hansen Cc: Denys Vlasenko Cc: Fenghua Yu Cc: H. Peter Anvin Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Quentin Casasnovas Cc: Thomas Gleixner Cc: Yu-cheng Link: http://lkml.kernel.org/r/20160311113206.GD4312@pd.tnic Signed-off-by: Ingo Molnar arch/x86/kernel/fpu/core.c | 4 +++- arch/x86/kernel/fpu/init.c | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) commit 8fed14e935cb62d2d46e99793d728dc7760dcc87 Author: Brad Spengler Date: Sun Mar 13 11:35:56 2016 -0400 Compile fixes fs/namei.c | 2 +- grsecurity/grsec_chroot.c | 2 +- include/linux/grsecurity.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit aab25a3496c4683c5858056960010119fb7d9a5a Author: Brad Spengler Date: Sun Mar 13 10:53:59 2016 -0400 Use fput instead of put_filp() fs/namei.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 928ddec9dfe5415dff82d941c3b3e76ee6f48761 Author: Brad Spengler Date: Sun Mar 13 10:30:54 2016 -0400 Update MPROTECT_COMPAT config description, disable by default security/Kconfig | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) commit 4cc29af2e81e7a4bdfab1afedfdedca6e23362d5 Author: Brad Spengler Date: Sun Mar 13 10:35:55 2016 -0400 As reported by Jann Horn, chroot scenarios where the chrooting application brings in a directory fd can be used to access any file outside of the chroot via *at syscalls. To maintain compatibility with Chromium and other apps, we specifically only disallow relative accesses off a directory fd when the final path is not located under that directory described by the fd and exists outside of the chroot. This additional restriction will exist under the current GRKERNSEC_CHROOT_FCHDIR option. fs/namei.c | 9 +++++++++ grsecurity/Kconfig | 10 ++++++---- grsecurity/grsec_chroot.c | 39 +++++++++++++++++++++++++++++++++++++++ include/linux/grmsg.h | 1 + include/linux/grsecurity.h | 1 + 5 files changed, 56 insertions(+), 4 deletions(-) commit 7d02a991213f0b07a3677dcc93cdafc3ac309142 Author: Brad Spengler Date: Thu Mar 10 22:17:16 2016 -0500 Update size_overflow hash table tools/gcc/size_overflow_plugin/size_overflow_hash.data | 1 + 1 file changed, 1 insertion(+) commit 29f25ddda6a5625340df26beb394279fefea2b49 Author: Brad Spengler Date: Thu Mar 10 22:16:04 2016 -0500 Fix module support kernel/module.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b057a45636b626e7eaf03077ed0916b95fea054c Merge: ba5ee94 10d57c1 Author: Brad Spengler Date: Thu Mar 10 21:36:10 2016 -0500 Merge branch 'pax-test' into grsec-test commit 10d57c107e7fabffbe616b14efab73df585576c2 Merge: 1cbae46 62e2195 Author: Brad Spengler Date: Thu Mar 10 21:34:58 2016 -0500 Update to pax-linux-4.4.5-test9.patch: - fixed an integer signedness mixup in the old select syscall caught by the size overflow plugin, by Mathias Krause - Emese cleaned up a few unnecessary type casts in the size overflow plugin - fixed the initify plugin to not trigger a compiler assert with gcc 6 in LTO mode - compile the x86 vdso without plugins, reported by Emese - fixed a REFCOUNT/arm compile error, reported by coadde (https://forums.grsecurity.net/viewtopic.php?f=3&t=4410) - fixed gcc-common.h for gcc 6, reported by psturm (https://forums.grsecurity.net/viewtopic.php?f=3&t=4394) Merge branch 'linux-4.4.y' into pax-test commit ba5ee94199b11c1429559a08c2158677dd8f1761 Author: Brad Spengler Date: Thu Mar 3 20:20:19 2016 -0500 Update size_overflow hash table tools/gcc/size_overflow_plugin/size_overflow_hash.data | 1 + 1 file changed, 1 insertion(+) commit 50a5cd726362f0988b81a54d4c962acf8fd34a70 Merge: 335c04c 1cbae46 Author: Brad Spengler Date: Thu Mar 3 20:04:00 2016 -0500 Merge branch 'pax-test' into grsec-test commit 1cbae46efa0b111ef2d46502f8d34c4c572a0e00 Merge: a51cdb8 c252409 Author: Brad Spengler Date: Thu Mar 3 19:57:43 2016 -0500 Merge branch 'linux-4.4.y' into pax-test commit 335c04c8146a696a6101a9c69dbd47f11383549e Merge: 897877e a51cdb8 Author: Brad Spengler Date: Tue Mar 1 17:57:24 2016 -0500 Merge branch 'pax-test' into grsec-test commit a51cdb83569b450858737a30d2be043d87d7ddc1 Author: Brad Spengler Date: Tue Mar 1 17:56:43 2016 -0500 Update to pax-linux-4.4.3-test6.patch: - spender fixed the cftype constification fallout, reported by quasar366 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4391) - fixed a few section mismatches on notifier_block variables - fixed a few REFCOUNT false positives found by Emese's plugin - constified hypervisor_x86 arch/x86/include/asm/hypervisor.h | 2 +- arch/x86/kernel/cpu/mshyperv.c | 2 +- arch/x86/kernel/cpu/vmware.c | 2 +- arch/x86/kernel/kvm.c | 2 +- drivers/lightnvm/rrpc.c | 4 ++-- drivers/lightnvm/rrpc.h | 2 +- drivers/net/can/led.c | 2 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +- drivers/net/ethernet/rocker/rocker.c | 4 ++-- drivers/net/ipvlan/ipvlan_main.c | 6 +++--- drivers/net/vrf.c | 2 +- drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 12 ++++++------ drivers/staging/rtl8188eu/include/rtw_mlme_ext.h | 2 +- drivers/staging/rtl8723au/core/rtw_mlme_ext.c | 12 ++++++------ drivers/staging/rtl8723au/include/drv_types.h | 2 +- drivers/staging/rtl8723au/include/rtw_mlme_ext.h | 2 +- drivers/staging/rtl8723au/include/usb_ops.h | 4 ++-- drivers/thermal/x86_pkg_temp_thermal.c | 2 +- fs/proc/kcore.c | 2 +- mm/hugetlb_cgroup.c | 8 ++++---- mm/mm_init.c | 2 +- mm/slub.c | 2 +- net/mac802154/iface.c | 2 +- 23 files changed, 41 insertions(+), 41 deletions(-) commit 897877e79629a0b854e98cb666a9d898256d45a7 Merge: 1ffa5d5 4f4b213 Author: Brad Spengler Date: Sun Feb 28 20:54:59 2016 -0500 Merge branch 'pax-test' into grsec-test commit 4f4b21342a4a4f87c01f7909406e6b5f4c9dadbf Author: Brad Spengler Date: Sun Feb 28 20:54:06 2016 -0500 Update to pax-linux-4.4.3-test5.patch: - constified xfrm_mgr and cftype, by Mathias Krause - Emese fixed a few checkpatch reports on the gcc plugin generator headers - Emese fixed a false positive size overflow report in get_next_ino, reported by KARBOWSKI Piotr - added a generator for SIMPLE_IPA passes as well include/linux/cgroup-defs.h | 2 +- include/linux/hugetlb.h | 2 +- include/linux/hugetlb_cgroup.h | 11 ++ include/net/xfrm.h | 2 +- kernel/cgroup.c | 29 ++-- mm/hugetlb.c | 55 ++++++- mm/hugetlb_cgroup.c | 60 ++----- mm/mmap.c | 38 ++--- net/xfrm/xfrm_state.c | 4 +- tools/gcc/constify_plugin.c | 5 +- tools/gcc/gcc-common.h | 42 +++-- tools/gcc/gcc-generate-gimple-pass.h | 27 ++-- tools/gcc/gcc-generate-ipa-pass.h | 43 ++--- tools/gcc/gcc-generate-rtl-pass.h | 27 ++-- tools/gcc/gcc-generate-simple_ipa-pass.h | 173 +++++++++++++++++++++ tools/gcc/size_overflow_plugin/.gitignore | 1 + .../disable_size_overflow_hash.data | 7 +- .../size_overflow_plugin/size_overflow_hash.data | 3 - 18 files changed, 385 insertions(+), 146 deletions(-) commit 1ffa5d50a2161311d46b56fdef734f309503cb80 Author: Brad Spengler Date: Sun Feb 28 20:43:02 2016 -0500 Make suid/sgid bruteforce prevention also apply to binaries with fscaps enabled grsecurity/grsec_sig.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit cfdb373a77c88d01c1539e605e28143af5981571 Author: Brad Spengler Date: Sun Feb 28 19:12:39 2016 -0500 compile fix grsecurity/gracl_segv.c | 2 +- grsecurity/grsec_sig.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 67d5160f8c1ee12ee4da1e7ad57f8688fcc77b53 Author: Brad Spengler Date: Sun Feb 28 18:24:50 2016 -0500 Update the daemon check in handling of anti-bruteforcing of suid binaries by GRKERNSEC_BRUTE to prevent a bypass reported by Jann Horn where one could create unprivileged copies of the suid binary via ptrace, inject code into them, and fork+exec a privileged copy. A crash then in the privileged copy would trigger the daemon detection which could be avoided by simply terminating the original process. Defeat this by using our is_privileged_binary() function against the task's mm->binfmt->file to detect an fscaps-enabled or suid/sgid binary being involved. Also update the RBAC RES_CRASH code to use is_privileged_binary(). grsecurity/gracl_segv.c | 15 +-------------- grsecurity/grsec_sig.c | 3 ++- 2 files changed, 3 insertions(+), 15 deletions(-) commit 7382ec22b0c9627c674ccbb00210276d26f219e3 Author: Brad Spengler Date: Sun Feb 28 15:06:32 2016 -0500 Fix a GRKERNSEC_PTRACE_READEXEC bypass reported by Jann Horn where one could dump out an unreadable suid binary by creating a script that used that binary as an interpreter. fs/exec.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) commit 3e60eddebe1c59b97c0b5432506bf8e13d84e8e6 Merge: 2d35d52 8327ee6 Author: Brad Spengler Date: Thu Feb 25 18:44:11 2016 -0500 Merge branch 'pax-test' into grsec-test Conflicts: fs/proc/base.c kernel/ptrace.c mm/process_vm_access.c commit 8327ee64e5e24ae6a3446dd96b95d5185f70e1f6 Merge: 09d53c7 2134d97 Author: Brad Spengler Date: Thu Feb 25 18:36:46 2016 -0500 Merge branch 'linux-4.4.y' into pax-test Conflicts: mm/mmap.c commit 2d35d5276f3feb0c053209f8c3a77b1f55f9d96b Author: Brad Spengler Date: Wed Feb 24 07:59:12 2016 -0500 Remove /proc/pid/map_files which we had previously prevented via an inverted dependency on checkpoint/restart, but clearly should have guarded independently as upstream in 4.3 enabled it regardless of checkpoint/ restart support. It can be used since 4.3 as an ASLR leak under RBAC to processes of the same UID. Thanks to Mathias Krause for the report! fs/proc/base.c | 2 ++ 1 file changed, 2 insertions(+) commit e4f1e517092222aa28179b20e14c0ddfb2796049 Author: Brad Spengler Date: Thu Feb 18 19:32:39 2016 -0500 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 158 +++++++++++++++++---- 1 file changed, 131 insertions(+), 27 deletions(-) commit d5f895ddfa903d0d70425b8c3d7ef649c7e6943b Author: Brad Spengler Date: Thu Feb 18 18:52:37 2016 -0500 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 293 +++++++++++++++++---- 1 file changed, 237 insertions(+), 56 deletions(-) commit 9d198df724c306c36e254fe19d0957fb608c3fa2 Author: Brad Spengler Date: Thu Feb 18 18:23:03 2016 -0500 compile fix tools/gcc/randomize_layout_plugin.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 024d2af98b755712daff6ed7c49af921da4e8883 Author: Brad Spengler Date: Thu Feb 18 18:19:47 2016 -0500 compile fix tools/gcc/randomize_layout_plugin.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 14a7b3bb5c3d8c6ef70c3e0842a5adc7f0f3e2c8 Author: Brad Spengler Date: Thu Feb 18 18:16:32 2016 -0500 compile fix tools/gcc/randomize_layout_plugin.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 9b2d0ee62bc66858c274f256c0502cbcbd34b2bf Author: Brad Spengler Date: Thu Feb 18 17:54:51 2016 -0500 Compile fix tools/gcc/randomize_layout_plugin.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 13823395101c4228ecded4b624583389ee13bfb3 Author: Brad Spengler Date: Thu Feb 18 17:35:21 2016 -0500 compile fix Makefile | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 0316a42a37e67b0bc8a545c7a8b63db2d25f1ab0 Merge: 45cbb7e 09d53c7 Author: Brad Spengler Date: Thu Feb 18 16:40:51 2016 -0500 Merge branch 'pax-test' into grsec-test Conflicts: Makefile include/linux/genl_magic_struct.h scripts/mod/modpost.c tools/gcc/size_overflow_plugin/size_overflow_hash.data commit 09d53c74140e87e886a28980cedbb7e771f2a356 Author: Brad Spengler Date: Thu Feb 18 16:24:02 2016 -0500 Update to pax-linux-4.4.2-test4.patch: - fixed the initialization of ipc_namespace.shm_ctlmax to prevent the size overflow plugin from catching an integer truncation when calling shmem_kernel_file_setup, reported by Mathias Krause - moved gcc plugin related makefile bits into a separate file, by Emese - changed modpost to report writable function pointers separately - increased the size of mem_cgroup.numainfo_events to avoid a wraparound caught by REFCOUNT, reported by alexey vlasov - reduced the size of the compat syscall entry points on amd64 - fixed an integer signedness mixup in drbd caught by the size overflow plugin, reported by iamb and gaima (https://forums.grsecurity.net/viewtopic.php?f=3&t=4366) - Emese regenerated the size overflow hash table for 4.4 - all plugins now use the new pass generator headers Makefile | 73 +- arch/x86/entry/entry_64.S | 2 +- arch/x86/entry/entry_64_compat.S | 48 +- fs/exec.c | 3 + include/linux/genl_magic_struct.h | 4 +- include/linux/memcontrol.h | 2 +- ipc/shm.c | 2 +- mm/memcontrol.c | 6 +- scripts/Makefile.extrawarn | 4 + scripts/Makefile.gcc-plugins | 69 + scripts/mod/modpost.c | 15 +- tools/gcc/checker_plugin.c | 71 +- tools/gcc/colorize_plugin.c | 65 +- tools/gcc/constify_plugin.c | 65 +- tools/gcc/gcc-generate-gimple-pass.h | 172 + tools/gcc/gcc-generate-ipa-pass.h | 286 + tools/gcc/gcc-generate-rtl-pass.h | 172 + tools/gcc/initify_plugin.c | 74 +- tools/gcc/kallocstat_plugin.c | 65 +- tools/gcc/kernexec_plugin.c | 184 +- tools/gcc/latent_entropy_plugin.c | 71 +- tools/gcc/randomize_layout_seed.h | 1 - .../disable_size_overflow_hash.h | 152601 ------------------ .../insert_size_overflow_asm.c | 71 +- .../size_overflow_plugin/intentional_overflow.c | 6 +- tools/gcc/size_overflow_plugin/size_overflow.h | 20 +- .../size_overflow_plugin/size_overflow_hash.data | 2898 +- tools/gcc/size_overflow_plugin/size_overflow_ipa.c | 94 +- .../size_overflow_plugin/size_overflow_plugin.c | 14 +- .../size_overflow_plugin/size_overflow_transform.c | 2 +- .../size_overflow_transform_core.c | 2 +- tools/gcc/stackleak_plugin.c | 132 +- tools/gcc/structleak_plugin.c | 67 +- 33 files changed, 2238 insertions(+), 155123 deletions(-) commit 45cbb7e015a18625dafb019246e13e8cf3a18ace Merge: 3b5448b 0c85110 Author: Brad Spengler Date: Wed Feb 17 19:11:25 2016 -0500 Merge branch 'pax-test' into grsec-test commit 0c851109f683896aaff8a310bbfa943272b47516 Merge: 6cb4f49 1cb8570 Author: Brad Spengler Date: Wed Feb 17 19:11:21 2016 -0500 Merge branch 'linux-4.4.y' into pax-test commit 3b5448bd1d85025d19b2587902e4264eb212a0a3 Author: Brad Spengler Date: Mon Feb 15 18:02:40 2016 -0500 Fix a drbd bug reported by iamb on the forums: https://forums.grsecurity.net/viewtopic.php?f=3&t=4366#p16032 which caused a size_overflow report include/linux/genl_magic_struct.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 061fcd0e74441189a87bfe13b55fb02b98f7d7c0 Author: Brad Spengler Date: Mon Feb 15 13:20:38 2016 -0500 compile fix drivers/staging/wilc1000/host_interface.h | 1 + 1 file changed, 1 insertion(+) commit 675f2dcbdd4ea3293eea9c42f0cc427b1c903fc8 Author: Brad Spengler Date: Mon Feb 15 12:54:52 2016 -0500 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) commit c8c50394f0c9f2e9baaeb884a29be2057cadbf7b Author: Brad Spengler Date: Mon Feb 15 12:53:54 2016 -0500 compile fix drivers/staging/wilc1000/wilc_spi.c | 1 - drivers/staging/wilc1000/wilc_wlan.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) commit a9dd4481db099082967585be8e153899e5fd24c7 Author: Brad Spengler Date: Mon Feb 15 12:52:32 2016 -0500 compile fix fs/proc/fd.c | 2 -- 1 file changed, 2 deletions(-) commit 5acb4fa0063460807096429f073181d1c5a3e566 Author: Brad Spengler Date: Mon Feb 15 12:32:13 2016 -0500 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 224 +++++++++++++++++---- 1 file changed, 182 insertions(+), 42 deletions(-) commit c0bac9ff9af7ef753740622b5736684a32b49a9f Author: Brad Spengler Date: Mon Feb 15 12:31:16 2016 -0500 compile fix drivers/staging/wilc1000/wilc_spi.c | 1 + 1 file changed, 1 insertion(+) commit 2f89ebdee131f6a6c85e611e5b993d4b19bc2673 Author: Brad Spengler Date: Mon Feb 15 12:28:36 2016 -0500 RANDSTRUCT compile fix drivers/staging/wilc1000/wilc_spi.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) commit 693be5d7f5b783f451499bbe83162aeb0f27a09f Author: Brad Spengler Date: Mon Feb 15 12:24:49 2016 -0500 RANDSTRUCT compile fix drivers/staging/wilc1000/wilc_sdio.c | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) commit bdf3dcd665c1a8ef9b69ad6525760c5160ec19a2 Author: Hariprasad S Date: Fri Dec 11 13:59:17 2015 +0530 iw_cxgb3: Fix incorrectly returning error on success The cxgb3_*_send() functions return NET_XMIT_ values, which are positive integers values. So don't treat positive return values as an error. Signed-off-by: Steve Wise Signed-off-by: Hariprasad Shenai Signed-off-by: Doug Ledford drivers/infiniband/hw/cxgb3/iwch_cm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8705fe372dc21046ca3fc55381b70cffb4c60207 Author: Daniel Borkmann Date: Wed Feb 10 16:47:11 2016 +0100 bpf: fix branch offset adjustment on backjumps after patching ctx expansion When ctx access is used, the kernel often needs to expand/rewrite instructions, so after that patching, branch offsets have to be adjusted for both forward and backward jumps in the new eBPF program, but for backward jumps it fails to account the delta. Meaning, for example, if the expansion happens exactly on the insn that sits at the jump target, it doesn't fix up the back jump offset. Analysis on what the check in adjust_branches() is currently doing: /* adjust offset of jmps if necessary */ if (i < pos && i + insn->off + 1 > pos) insn->off += delta; else if (i > pos && i + insn->off + 1 < pos) insn->off -= delta; First condition (forward jumps): Before: After: insns[0] insns[0] insns[1] <--- i/insn insns[1] <--- i/insn insns[2] <--- pos insns[P] <--- pos insns[3] insns[P] `------| delta insns[4] <--- target_X insns[P] `-----| insns[5] insns[3] insns[4] <--- target_X insns[5] First case is if we cross pos-boundary and the jump instruction was before pos. This is handeled correctly. I.e. if i == pos, then this would mean our jump that we currently check was the patchlet itself that we just injected. Since such patchlets are self-contained and have no awareness of any insns before or after the patched one, the delta is correctly not adjusted. Also, for the second condition in case of i + insn->off + 1 == pos, means we jump to that newly patched instruction, so no offset adjustment are needed. That part is correct. Second condition (backward jumps): Before: After: insns[0] insns[0] insns[1] <--- target_X insns[1] <--- target_X insns[2] <--- pos <-- target_Y insns[P] <--- pos <-- target_Y insns[3] insns[P] `------| delta insns[4] <--- i/insn insns[P] `-----| insns[5] insns[3] insns[4] <--- i/insn insns[5] Second interesting case is where we cross pos-boundary and the jump instruction was after pos. Backward jump with i == pos would be impossible and pose a bug somewhere in the patchlet, so the first condition checking i > pos is okay only by itself. However, i + insn->off + 1 < pos does not always work as intended to trigger the adjustment. It works when jump targets would be far off where the delta wouldn't matter. But, for example, where the fixed insn->off before pointed to pos (target_Y), it now points to pos + delta, so that additional room needs to be taken into account for the check. This means that i) both tests here need to be adjusted into pos + delta, and ii) for the second condition, the test needs to be <= as pos itself can be a target in the backjump, too. Fixes: 9bac3d6d548e ("bpf: allow extended BPF programs access skb fields") Signed-off-by: Daniel Borkmann Signed-off-by: David S. Miller kernel/bpf/verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 61b513b644116e77313addf65970db58f4981608 Author: Ryan Ware Date: Thu Feb 11 15:58:44 2016 -0800 EVM: Use crypto_memneq() for digest comparisons This patch fixes vulnerability CVE-2016-2085. The problem exists because the vm_verify_hmac() function includes a use of memcmp(). Unfortunately, this allows timing side channel attacks; specifically a MAC forgery complexity drop from 2^128 to 2^12. This patch changes the memcmp() to the cryptographically safe crypto_memneq(). Reported-by: Xiaofei Rex Guo Signed-off-by: Ryan Ware Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar Signed-off-by: James Morris security/integrity/evm/evm_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 970b961e7d0684624f9c69f0b4367d5c76b65a63 Author: Michael McConville Date: Fri Feb 5 20:46:25 2016 -0500 dscc4: Undefined signed int shift My analysis in the below mail applies, although the second part is unnecessary because i isn't used in arithmetic operations here: https://marc.info/?l=openbsd-tech&m=145377854103866&w=2 Thanks for your time. Signed-off-by: Michael McConville Acked-by: Francois Romieu Signed-off-by: David S. Miller drivers/net/wan/dscc4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d843df24b6680b600e87ebfea3b7b198b90b5a2a Author: Andrey Konovalov Date: Sat Feb 13 11:08:06 2016 +0300 ALSA: usb-audio: avoid freeing umidi object twice The 'umidi' object will be free'd on the error path by snd_usbmidi_free() when tearing down the rawmidi interface. So we shouldn't try to free it in snd_usbmidi_create() after having registered the rawmidi interface. Found by KASAN. Signed-off-by: Andrey Konovalov Acked-by: Clemens Ladisch Cc: Signed-off-by: Takashi Iwai sound/usb/midi.c | 1 - 1 file changed, 1 deletion(-) commit ed3a8ab1976674d56e258da93639e61f1446e703 Author: zengtao Date: Tue Feb 2 11:38:34 2016 +0800 cputime: Prevent 32bit overflow in time[val|spec]_to_cputime() The datatype __kernel_time_t is u32 on 32bit platform, so its subject to overflows in the timeval/timespec to cputime conversion. Currently the following functions are affected: 1. setitimer() 2. timer_create/timer_settime() 3. sys_clock_nanosleep This can happen on MIPS32 and ARM32 with "Full dynticks CPU time accounting" enabled, which is required for CONFIG_NO_HZ_FULL. Enforce u64 conversion to prevent the overflow. Fixes: 31c1fc818715 ("ARM: Kconfig: allow full nohz CPU accounting") Signed-off-by: zengtao Reviewed-by: Arnd Bergmann Cc: Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/1454384314-154784-1-git-send-email-prime.zeng@huawei.com Signed-off-by: Thomas Gleixner include/asm-generic/cputime_nsecs.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit bf8a2de485da37d73850e7cfa31967b7798b6ce0 Author: Brad Spengler Date: Mon Feb 15 11:55:18 2016 -0500 Fix building with allnoconfig, don't make our added DATA_TO_TEXT mismatch warnings count as actual mismatches scripts/mod/modpost.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c9d82b6d0f1a2484fea0a516989dbdc6c55e5693 Author: Brad Spengler Date: Mon Feb 15 11:44:36 2016 -0500 Compile fix tools/gcc/randomize_layout_seed.h | 1 - 1 file changed, 1 deletion(-) commit fb68cbb98732e6801e8fc8d1da1f1195e51ff077 Author: Brad Spengler Date: Mon Feb 15 11:27:32 2016 -0500 disable USELIB init/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit cbda9a44b7f92161eb1e444bf7fe2bbcbedaae65 Author: Brad Spengler Date: Mon Feb 15 11:23:56 2016 -0500 compile fix fs/proc/fd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5cf0a2e87ab7105d1ba01f55f7636fa2e1fa4bb4 Author: Brad Spengler Date: Mon Feb 15 11:19:26 2016 -0500 Initial import of grsecurity for Linux 4.4.1 Documentation/dontdiff | 2 + Documentation/kernel-parameters.txt | 11 + Documentation/sysctl/fs.txt | 23 + Documentation/sysctl/kernel.txt | 15 + Makefile | 18 +- arch/alpha/include/asm/cache.h | 4 +- arch/alpha/kernel/osf_sys.c | 12 +- arch/arc/Kconfig | 1 + arch/arm/Kconfig | 1 + arch/arm/Kconfig.debug | 1 + arch/arm/include/asm/thread_info.h | 7 +- arch/arm/kernel/entry-common.S | 8 +- arch/arm/kernel/process.c | 4 +- arch/arm/kernel/ptrace.c | 9 + arch/arm/kernel/traps.c | 7 +- arch/arm/mm/Kconfig | 4 +- arch/arm/mm/fault.c | 40 +- arch/arm/mm/mmap.c | 8 +- arch/arm/net/bpf_jit_32.c | 51 +- arch/arm64/Kconfig.debug | 1 + arch/avr32/include/asm/cache.h | 4 +- arch/blackfin/Kconfig.debug | 1 + arch/blackfin/include/asm/cache.h | 3 +- arch/cris/include/arch-v10/arch/cache.h | 3 +- arch/cris/include/arch-v32/arch/cache.h | 3 +- arch/frv/include/asm/cache.h | 3 +- arch/frv/mm/elf-fdpic.c | 4 +- arch/hexagon/include/asm/cache.h | 6 +- arch/ia64/Kconfig | 1 + arch/ia64/include/asm/cache.h | 3 +- arch/ia64/kernel/sys_ia64.c | 2 + arch/ia64/mm/hugetlbpage.c | 2 + arch/m32r/include/asm/cache.h | 4 +- arch/m68k/include/asm/cache.h | 4 +- arch/metag/mm/hugetlbpage.c | 1 + arch/microblaze/include/asm/cache.h | 3 +- arch/mips/Kconfig | 1 + arch/mips/include/asm/cache.h | 3 +- arch/mips/include/asm/thread_info.h | 11 +- arch/mips/kernel/irq.c | 3 + arch/mips/kernel/ptrace.c | 9 + arch/mips/mm/mmap.c | 4 +- arch/mn10300/proc-mn103e010/include/proc/cache.h | 4 +- arch/mn10300/proc-mn2ws0050/include/proc/cache.h | 4 +- arch/openrisc/include/asm/cache.h | 4 +- arch/parisc/include/asm/cache.h | 3 + arch/parisc/kernel/sys_parisc.c | 4 + arch/powerpc/Kconfig | 1 + arch/powerpc/include/asm/cache.h | 4 +- arch/powerpc/include/asm/thread_info.h | 5 +- arch/powerpc/kernel/Makefile | 2 + arch/powerpc/kernel/irq.c | 3 + arch/powerpc/kernel/process.c | 10 +- arch/powerpc/kernel/ptrace.c | 14 + arch/powerpc/kernel/traps.c | 5 + arch/powerpc/mm/slice.c | 2 +- arch/s390/Kconfig.debug | 1 + arch/s390/include/asm/cache.h | 4 +- arch/score/include/asm/cache.h | 4 +- arch/sh/include/asm/cache.h | 3 +- arch/sh/mm/mmap.c | 6 +- arch/sparc/include/asm/cache.h | 4 +- arch/sparc/include/asm/pgalloc_64.h | 1 + arch/sparc/include/asm/thread_info_64.h | 8 +- arch/sparc/kernel/process_32.c | 6 +- arch/sparc/kernel/process_64.c | 8 +- arch/sparc/kernel/ptrace_64.c | 14 + arch/sparc/kernel/sys_sparc_64.c | 8 +- arch/sparc/kernel/syscalls.S | 8 +- arch/sparc/kernel/traps_32.c | 8 +- arch/sparc/kernel/traps_64.c | 28 +- arch/sparc/kernel/unaligned_64.c | 2 +- arch/sparc/mm/fault_64.c | 2 +- arch/sparc/mm/hugetlbpage.c | 15 +- arch/tile/Kconfig | 1 + arch/tile/include/asm/cache.h | 3 +- arch/tile/mm/hugetlbpage.c | 2 + arch/um/include/asm/cache.h | 3 +- arch/unicore32/include/asm/cache.h | 6 +- arch/x86/Kconfig | 21 + arch/x86/Kconfig.debug | 2 + arch/x86/entry/common.c | 14 + arch/x86/entry/entry_32.S | 2 +- arch/x86/entry/entry_64.S | 2 +- arch/x86/ia32/ia32_aout.c | 2 + arch/x86/include/asm/floppy.h | 20 +- arch/x86/include/asm/fpu/types.h | 69 +- arch/x86/include/asm/io.h | 2 +- arch/x86/include/asm/page.h | 12 +- arch/x86/include/asm/paravirt_types.h | 23 +- arch/x86/include/asm/pgtable_types.h | 6 +- arch/x86/include/asm/processor.h | 12 +- arch/x86/include/asm/thread_info.h | 6 +- arch/x86/include/asm/uaccess.h | 2 +- arch/x86/kernel/dumpstack.c | 10 +- arch/x86/kernel/dumpstack_32.c | 2 +- arch/x86/kernel/dumpstack_64.c | 2 +- arch/x86/kernel/ioport.c | 13 + arch/x86/kernel/irq_32.c | 3 + arch/x86/kernel/irq_64.c | 4 + arch/x86/kernel/ldt.c | 18 + arch/x86/kernel/msr.c | 10 + arch/x86/kernel/ptrace.c | 14 + arch/x86/kernel/signal.c | 9 +- arch/x86/kernel/sys_i386_32.c | 9 +- arch/x86/kernel/sys_x86_64.c | 8 +- arch/x86/kernel/traps.c | 5 + arch/x86/kernel/verify_cpu.S | 1 + arch/x86/kernel/vm86_32.c | 15 + arch/x86/mm/fault.c | 12 +- arch/x86/mm/hugetlbpage.c | 15 +- arch/x86/mm/init.c | 66 +- arch/x86/mm/init_32.c | 6 +- arch/x86/mm/pageattr.c | 4 +- arch/x86/net/bpf_jit_comp.c | 4 + arch/x86/platform/efi/efi_64.c | 2 +- arch/x86/xen/Kconfig | 1 + arch/xtensa/variants/dc232b/include/variant/core.h | 2 +- arch/xtensa/variants/fsf/include/variant/core.h | 3 +- crypto/scatterwalk.c | 10 +- drivers/acpi/acpica/hwxfsleep.c | 11 +- drivers/acpi/custom_method.c | 4 + drivers/block/cciss.h | 30 +- drivers/block/smart1,2.h | 40 +- drivers/cdrom/cdrom.c | 2 +- drivers/char/Kconfig | 4 +- drivers/char/genrtc.c | 1 + drivers/char/mem.c | 17 + drivers/char/random.c | 5 +- drivers/cpufreq/sparc-us3-cpufreq.c | 2 - drivers/firewire/ohci.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 70 +- drivers/gpu/drm/nouveau/nouveau_ttm.c | 28 +- drivers/gpu/drm/ttm/ttm_bo_manager.c | 10 +- drivers/gpu/drm/virtio/virtgpu_ttm.c | 10 +- drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 10 +- drivers/hid/hid-wiimote-debug.c | 2 +- drivers/infiniband/hw/nes/nes_cm.c | 22 +- drivers/iommu/Kconfig | 1 + drivers/iommu/amd_iommu.c | 14 +- drivers/isdn/gigaset/bas-gigaset.c | 32 +- drivers/isdn/gigaset/ser-gigaset.c | 32 +- drivers/isdn/gigaset/usb-gigaset.c | 32 +- drivers/isdn/i4l/isdn_concap.c | 6 +- drivers/isdn/i4l/isdn_x25iface.c | 16 +- drivers/md/bcache/Kconfig | 1 + drivers/md/raid5.c | 8 + drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +- drivers/media/platform/sti/c8sectpfe/Kconfig | 1 + drivers/media/radio/radio-cadet.c | 5 +- drivers/media/usb/dvb-usb/cinergyT2-core.c | 91 +- drivers/media/usb/dvb-usb/cinergyT2-fe.c | 182 +- drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 37 +- drivers/media/usb/dvb-usb/technisat-usb2.c | 75 +- drivers/message/fusion/mptbase.c | 9 + drivers/misc/sgi-xp/xp_main.c | 12 +- drivers/net/ethernet/brocade/bna/bna_enet.c | 8 +- drivers/net/ppp/pptp.c | 34 +- drivers/net/wan/lmc/lmc_media.c | 97 +- drivers/net/wan/z85230.c | 24 +- drivers/net/wireless/ath/ath9k/Kconfig | 1 - drivers/net/wireless/zd1211rw/zd_usb.c | 2 +- drivers/pci/proc.c | 9 + drivers/platform/x86/asus-wmi.c | 12 + drivers/rtc/rtc-dev.c | 3 + drivers/scsi/bfa/bfa_fcs.c | 19 +- drivers/scsi/bfa/bfa_fcs_lport.c | 29 +- drivers/scsi/bfa/bfa_modules.h | 12 +- drivers/scsi/hpsa.h | 40 +- drivers/staging/lustre/lustre/ldlm/ldlm_flock.c | 2 +- drivers/staging/lustre/lustre/libcfs/module.c | 10 +- drivers/tty/serial/uartlite.c | 4 +- drivers/tty/sysrq.c | 2 +- drivers/tty/tty_io.c | 4 + drivers/tty/vt/keyboard.c | 22 +- drivers/uio/uio.c | 6 +- drivers/usb/core/hub.c | 5 + drivers/usb/gadget/function/f_uac1.c | 1 + drivers/usb/gadget/function/u_uac1.c | 1 + drivers/usb/host/hwa-hc.c | 9 +- drivers/usb/usbip/vhci_sysfs.c | 2 +- drivers/video/fbdev/arcfb.c | 2 +- drivers/video/fbdev/matrox/matroxfb_DAC1064.c | 10 +- drivers/video/fbdev/matrox/matroxfb_Ti3026.c | 5 +- drivers/video/fbdev/sh_mobile_lcdcfb.c | 6 +- drivers/video/logo/logo_linux_clut224.ppm | 2720 ++++---- drivers/xen/xenfs/xenstored.c | 5 + firmware/Makefile | 2 + firmware/WHENCE | 20 +- firmware/bnx2/bnx2-mips-06-6.2.3.fw.ihex | 5804 +++++++++++++++++ firmware/bnx2/bnx2-mips-09-6.2.1b.fw.ihex | 6496 ++++++++++++++++++++ fs/attr.c | 4 + fs/autofs4/waitq.c | 9 + fs/binfmt_aout.c | 7 + fs/binfmt_elf.c | 40 +- fs/compat.c | 20 +- fs/compat_ioctl.c | 253 +- fs/coredump.c | 17 +- fs/dcache.c | 3 + fs/debugfs/inode.c | 11 +- fs/exec.c | 231 +- fs/ext2/balloc.c | 4 +- fs/ext2/super.c | 8 +- fs/ext4/balloc.c | 4 +- fs/ext4/extents.c | 2 +- fs/fcntl.c | 4 + fs/fhandle.c | 3 +- fs/file.c | 4 + fs/filesystems.c | 4 + fs/fs_struct.c | 20 +- fs/hugetlbfs/inode.c | 24 +- fs/inode.c | 8 +- fs/internal.h | 7 + fs/ioctl.c | 4 +- fs/kernfs/dir.c | 6 + fs/mount.h | 4 +- fs/namei.c | 283 +- fs/namespace.c | 24 + fs/nfsd/nfscache.c | 2 +- fs/open.c | 38 + fs/overlayfs/inode.c | 3 + fs/overlayfs/super.c | 6 +- fs/pipe.c | 49 +- fs/posix_acl.c | 15 +- fs/proc/Kconfig | 10 +- fs/proc/array.c | 69 +- fs/proc/base.c | 186 +- fs/proc/cmdline.c | 4 + fs/proc/devices.c | 4 + fs/proc/fd.c | 12 +- fs/proc/generic.c | 64 + fs/proc/inode.c | 17 + fs/proc/internal.h | 11 +- fs/proc/interrupts.c | 4 + fs/proc/kcore.c | 3 + fs/proc/namespaces.c | 4 +- fs/proc/proc_net.c | 31 + fs/proc/proc_sysctl.c | 52 +- fs/proc/root.c | 8 + fs/proc/stat.c | 69 +- fs/proc/task_mmu.c | 66 +- fs/readdir.c | 19 + fs/reiserfs/item_ops.c | 24 +- fs/reiserfs/super.c | 4 + fs/select.c | 2 + fs/seq_file.c | 30 +- fs/stat.c | 20 +- fs/sysfs/dir.c | 30 +- fs/utimes.c | 7 + fs/xattr.c | 26 +- grsecurity/Kconfig | 1203 ++++ grsecurity/Makefile | 54 + grsecurity/gracl.c | 2757 +++++++++ grsecurity/gracl_alloc.c | 105 + grsecurity/gracl_cap.c | 127 + grsecurity/gracl_compat.c | 269 + grsecurity/gracl_fs.c | 448 ++ grsecurity/gracl_ip.c | 386 ++ grsecurity/gracl_learn.c | 207 + grsecurity/gracl_policy.c | 1786 ++++++ grsecurity/gracl_res.c | 68 + grsecurity/gracl_segv.c | 304 + grsecurity/gracl_shm.c | 40 + grsecurity/grsec_chdir.c | 19 + grsecurity/grsec_chroot.c | 467 ++ grsecurity/grsec_disabled.c | 445 ++ grsecurity/grsec_exec.c | 189 + grsecurity/grsec_fifo.c | 26 + grsecurity/grsec_fork.c | 23 + grsecurity/grsec_init.c | 294 + grsecurity/grsec_ipc.c | 48 + grsecurity/grsec_link.c | 65 + grsecurity/grsec_log.c | 340 + grsecurity/grsec_mem.c | 48 + grsecurity/grsec_mount.c | 65 + grsecurity/grsec_pax.c | 47 + grsecurity/grsec_proc.c | 20 + grsecurity/grsec_ptrace.c | 30 + grsecurity/grsec_sig.c | 245 + grsecurity/grsec_sock.c | 244 + grsecurity/grsec_sysctl.c | 497 ++ grsecurity/grsec_time.c | 16 + grsecurity/grsec_tpe.c | 78 + grsecurity/grsec_tty.c | 18 + grsecurity/grsec_usb.c | 15 + grsecurity/grsum.c | 54 + include/linux/binfmts.h | 5 +- include/linux/capability.h | 13 + include/linux/compiler-gcc.h | 5 + include/linux/compiler.h | 8 + include/linux/cred.h | 8 +- include/linux/dcache.h | 5 +- include/linux/fs.h | 26 +- include/linux/fs_struct.h | 2 +- include/linux/fsnotify.h | 6 + include/linux/gracl.h | 342 ++ include/linux/gracl_compat.h | 156 + include/linux/gralloc.h | 9 + include/linux/grdefs.h | 140 + include/linux/grinternal.h | 231 + include/linux/grmsg.h | 119 + include/linux/grsecurity.h | 258 + include/linux/grsock.h | 19 + include/linux/ipc.h | 2 +- include/linux/ipc_namespace.h | 2 +- include/linux/kallsyms.h | 18 +- include/linux/key-type.h | 4 +- include/linux/kmod.h | 5 + include/linux/kobject.h | 2 +- include/linux/lsm_hooks.h | 4 +- include/linux/mm.h | 12 + include/linux/mm_types.h | 4 +- include/linux/module.h | 5 +- include/linux/mount.h | 2 +- include/linux/msg.h | 2 +- include/linux/netfilter/xt_gradm.h | 9 + include/linux/path.h | 4 +- include/linux/perf_event.h | 13 +- include/linux/pid_namespace.h | 2 +- include/linux/pipe_fs_i.h | 4 + include/linux/poison.h | 2 +- include/linux/printk.h | 2 +- include/linux/proc_fs.h | 22 +- include/linux/proc_ns.h | 2 +- include/linux/ptrace.h | 24 +- include/linux/radix-tree.h | 22 +- include/linux/random.h | 2 +- include/linux/rbtree_augmented.h | 4 +- include/linux/scatterlist.h | 12 +- include/linux/sched.h | 115 +- include/linux/security.h | 1 + include/linux/sem.h | 2 +- include/linux/seq_file.h | 5 + include/linux/shm.h | 6 +- include/linux/shmem_fs.h | 5 +- include/linux/skbuff.h | 3 + include/linux/slab.h | 9 - include/linux/sysctl.h | 8 +- include/linux/thread_info.h | 6 +- include/linux/tty.h | 2 +- include/linux/tty_driver.h | 4 +- include/linux/uidgid.h | 5 + include/linux/user_namespace.h | 2 +- include/linux/utsname.h | 2 +- include/linux/vermagic.h | 16 +- include/linux/vmalloc.h | 8 + include/net/af_unix.h | 6 +- include/net/ip.h | 2 +- include/net/neighbour.h | 2 +- include/net/net_namespace.h | 2 +- include/net/netfilter/nf_conntrack_core.h | 8 +- include/net/scm.h | 1 + include/net/sock.h | 2 +- include/trace/events/fs.h | 53 + include/uapi/linux/personality.h | 1 + init/Kconfig | 2 + init/main.c | 46 +- ipc/mqueue.c | 1 + ipc/msg.c | 3 +- ipc/msgutil.c | 4 +- ipc/sem.c | 3 +- ipc/shm.c | 26 +- ipc/util.c | 6 + kernel/auditsc.c | 2 +- kernel/bpf/syscall.c | 10 +- kernel/capability.c | 41 +- kernel/cgroup.c | 5 +- kernel/compat.c | 1 + kernel/configs.c | 11 + kernel/cred.c | 112 +- kernel/events/core.c | 16 +- kernel/exit.c | 10 +- kernel/fork.c | 86 +- kernel/futex.c | 6 +- kernel/futex_compat.c | 2 +- kernel/kallsyms.c | 9 + kernel/kcmp.c | 8 +- kernel/kexec_core.c | 2 +- kernel/kmod.c | 96 +- kernel/kprobes.c | 9 +- kernel/ksysfs.c | 2 + kernel/locking/lockdep_proc.c | 10 +- kernel/module.c | 108 +- kernel/panic.c | 4 +- kernel/pid.c | 18 +- kernel/power/Kconfig | 2 + kernel/printk/printk.c | 7 +- kernel/ptrace.c | 89 +- kernel/resource.c | 10 + kernel/sched/core.c | 11 +- kernel/seccomp.c | 22 +- kernel/signal.c | 37 +- kernel/sys.c | 64 +- kernel/sysctl.c | 186 +- kernel/taskstats.c | 6 + kernel/time/posix-timers.c | 8 + kernel/time/time.c | 5 + kernel/time/timekeeping.c | 3 + kernel/time/timer_list.c | 13 +- kernel/time/timer_stats.c | 10 +- kernel/trace/Kconfig | 2 + kernel/trace/trace_syscalls.c | 8 + kernel/user_namespace.c | 15 + lib/Kconfig.debug | 13 +- lib/Kconfig.kasan | 2 +- lib/is_single_threaded.c | 3 + lib/list_debug.c | 65 +- lib/nlattr.c | 2 + lib/radix-tree.c | 12 +- lib/rbtree.c | 4 +- lib/vsprintf.c | 39 +- localversion-grsec | 1 + mm/Kconfig | 8 +- mm/Kconfig.debug | 1 + mm/filemap.c | 1 + mm/kmemleak.c | 4 +- mm/memory.c | 2 +- mm/mempolicy.c | 12 +- mm/migrate.c | 3 +- mm/mlock.c | 11 +- mm/mmap.c | 103 +- mm/mprotect.c | 8 + mm/oom_kill.c | 4 + mm/page_alloc.c | 2 +- mm/process_vm_access.c | 8 +- mm/shmem.c | 11 +- mm/slab.c | 14 +- mm/slab_common.c | 2 +- mm/slob.c | 12 + mm/slub.c | 33 +- mm/util.c | 3 + mm/vmalloc.c | 82 +- mm/vmstat.c | 29 +- net/appletalk/atalk_proc.c | 2 +- net/atm/lec.c | 6 +- net/atm/mpoa_caches.c | 42 +- net/can/bcm.c | 2 +- net/can/proc.c | 2 +- net/core/dev_ioctl.c | 7 +- net/core/filter.c | 8 +- net/core/net-procfs.c | 17 +- net/core/pktgen.c | 2 +- net/core/scm.c | 7 + net/core/sock.c | 3 +- net/core/sysctl_net_core.c | 2 +- net/decnet/dn_dev.c | 2 +- net/ipv4/Kconfig | 1 + net/ipv4/devinet.c | 6 +- net/ipv4/inet_hashtables.c | 4 + net/ipv4/ip_input.c | 7 + net/ipv4/ip_sockglue.c | 3 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv4/route.c | 6 +- net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_ipv4.c | 24 +- net/ipv4/tcp_minisocks.c | 9 +- net/ipv4/tcp_timer.c | 11 + net/ipv4/udp.c | 24 + net/ipv6/Kconfig | 1 + net/ipv6/addrconf.c | 13 +- net/ipv6/proc.c | 2 +- net/ipv6/tcp_ipv6.c | 23 +- net/ipv6/udp.c | 7 + net/ipx/ipx_proc.c | 2 +- net/irda/irproc.c | 2 +- net/iucv/af_iucv.c | 3 + net/llc/llc_proc.c | 2 +- net/netfilter/Kconfig | 10 + net/netfilter/Makefile | 1 + net/netfilter/nf_conntrack_core.c | 46 +- net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 2 +- net/netfilter/xt_gradm.c | 51 + net/netfilter/xt_hashlimit.c | 4 +- net/netfilter/xt_recent.c | 2 +- net/openvswitch/actions.c | 19 +- net/sctp/sm_sideeffect.c | 11 +- net/sctp/sm_statefuns.c | 17 +- net/socket.c | 75 +- net/sunrpc/Kconfig | 1 + net/sunrpc/cache.c | 2 +- net/sunrpc/stats.c | 2 +- net/sysctl_net.c | 2 +- net/unix/af_unix.c | 57 +- net/unix/garbage.c | 8 +- net/vmw_vsock/vmci_transport_notify.c | 30 +- net/vmw_vsock/vmci_transport_notify_qstate.c | 30 +- net/x25/sysctl_net_x25.c | 2 +- net/x25/x25_proc.c | 2 +- scripts/package/Makefile | 2 +- scripts/package/mkspec | 41 +- security/Kconfig | 369 +- security/apparmor/file.c | 4 +- security/apparmor/lsm.c | 8 +- security/commoncap.c | 36 +- security/keys/internal.h | 2 +- security/min_addr.c | 2 + security/smack/smack_lsm.c | 8 +- security/tomoyo/file.c | 12 +- security/tomoyo/mount.c | 4 + security/tomoyo/tomoyo.c | 20 +- security/yama/Kconfig | 2 +- security/yama/yama_lsm.c | 4 +- sound/core/timer.c | 4 +- sound/synth/emux/emux_seq.c | 14 +- sound/usb/line6/driver.c | 40 +- sound/usb/line6/toneport.c | 12 +- tools/gcc/.gitignore | 1 + tools/gcc/Makefile | 12 + tools/gcc/gen-random-seed.sh | 8 + tools/gcc/randomize_layout_plugin.c | 930 +++ tools/gcc/size_overflow_plugin/.gitignore | 1 + .../size_overflow_plugin/size_overflow_hash.data | 463 +- 513 files changed, 33007 insertions(+), 3251 deletions(-) commit 6cb4f49b6a55cf16ae82685e1ab9b74c95b2f743 Author: Brad Spengler Date: Mon Feb 15 10:51:41 2016 -0500 Initial import of pax-linux-4.4.1-test3.patch Documentation/dontdiff | 46 +- Documentation/kbuild/makefiles.txt | 39 +- Documentation/kernel-parameters.txt | 28 + Makefile | 119 +- arch/alpha/include/asm/atomic.h | 10 + arch/alpha/include/asm/elf.h | 7 + arch/alpha/include/asm/pgalloc.h | 6 + arch/alpha/include/asm/pgtable.h | 11 + arch/alpha/kernel/module.c | 2 +- arch/alpha/kernel/osf_sys.c | 8 +- arch/alpha/mm/fault.c | 141 +- arch/arm/Kconfig | 3 +- arch/arm/include/asm/atomic.h | 323 +- arch/arm/include/asm/cache.h | 5 +- arch/arm/include/asm/cacheflush.h | 2 +- arch/arm/include/asm/checksum.h | 14 +- arch/arm/include/asm/cmpxchg.h | 4 + arch/arm/include/asm/cpuidle.h | 2 +- arch/arm/include/asm/domain.h | 42 +- arch/arm/include/asm/elf.h | 9 +- arch/arm/include/asm/fncpy.h | 2 + arch/arm/include/asm/futex.h | 1 + arch/arm/include/asm/kmap_types.h | 2 +- arch/arm/include/asm/mach/dma.h | 2 +- arch/arm/include/asm/mach/map.h | 16 +- arch/arm/include/asm/outercache.h | 2 +- arch/arm/include/asm/page.h | 3 +- arch/arm/include/asm/pgalloc.h | 20 + arch/arm/include/asm/pgtable-2level-hwdef.h | 4 +- arch/arm/include/asm/pgtable-2level.h | 3 + arch/arm/include/asm/pgtable-3level.h | 3 + arch/arm/include/asm/pgtable.h | 54 +- arch/arm/include/asm/smp.h | 2 +- arch/arm/include/asm/thread_info.h | 3 + arch/arm/include/asm/tls.h | 3 + arch/arm/include/asm/uaccess.h | 113 +- arch/arm/include/uapi/asm/ptrace.h | 2 +- arch/arm/kernel/armksyms.c | 2 +- arch/arm/kernel/cpuidle.c | 2 +- arch/arm/kernel/entry-armv.S | 109 +- arch/arm/kernel/entry-common.S | 40 +- arch/arm/kernel/entry-header.S | 55 + arch/arm/kernel/fiq.c | 3 + arch/arm/kernel/module-plts.c | 7 +- arch/arm/kernel/module.c | 38 +- arch/arm/kernel/patch.c | 2 + arch/arm/kernel/process.c | 92 +- arch/arm/kernel/reboot.c | 1 + arch/arm/kernel/setup.c | 20 +- arch/arm/kernel/signal.c | 35 +- arch/arm/kernel/smp.c | 2 +- arch/arm/kernel/tcm.c | 4 +- arch/arm/kernel/vmlinux.lds.S | 6 +- arch/arm/kvm/arm.c | 8 +- arch/arm/lib/copy_page.S | 1 + arch/arm/lib/csumpartialcopyuser.S | 4 +- arch/arm/lib/delay.c | 2 +- arch/arm/lib/uaccess_with_memcpy.c | 4 +- arch/arm/mach-exynos/suspend.c | 6 +- arch/arm/mach-mvebu/coherency.c | 4 +- arch/arm/mach-omap2/board-n8x0.c | 2 +- arch/arm/mach-omap2/omap-mpuss-lowpower.c | 4 +- arch/arm/mach-omap2/omap-smp.c | 1 + arch/arm/mach-omap2/omap_device.c | 4 +- arch/arm/mach-omap2/omap_device.h | 4 +- arch/arm/mach-omap2/omap_hwmod.c | 4 +- arch/arm/mach-omap2/powerdomains43xx_data.c | 5 +- arch/arm/mach-omap2/wd_timer.c | 6 +- arch/arm/mach-shmobile/platsmp-apmu.c | 5 +- arch/arm/mach-tegra/cpuidle-tegra20.c | 2 +- arch/arm/mach-tegra/irq.c | 1 + arch/arm/mach-ux500/pm.c | 1 + arch/arm/mach-zynq/platsmp.c | 1 + arch/arm/mm/Kconfig | 6 +- arch/arm/mm/cache-l2x0.c | 2 +- arch/arm/mm/context.c | 10 +- arch/arm/mm/fault.c | 146 + arch/arm/mm/fault.h | 12 + arch/arm/mm/init.c | 39 + arch/arm/mm/ioremap.c | 4 +- arch/arm/mm/mmap.c | 30 +- arch/arm/mm/mmu.c | 162 +- arch/arm/net/bpf_jit_32.c | 3 + arch/arm/plat-iop/setup.c | 2 +- arch/arm/plat-omap/sram.c | 2 + arch/arm64/include/asm/atomic.h | 10 + arch/arm64/include/asm/percpu.h | 8 +- arch/arm64/include/asm/pgalloc.h | 5 + arch/arm64/include/asm/uaccess.h | 1 + arch/arm64/mm/dma-mapping.c | 2 +- arch/avr32/include/asm/elf.h | 8 +- arch/avr32/include/asm/kmap_types.h | 4 +- arch/avr32/mm/fault.c | 27 + arch/frv/include/asm/atomic.h | 10 + arch/frv/include/asm/kmap_types.h | 2 +- arch/frv/mm/elf-fdpic.c | 3 +- arch/ia64/Makefile | 1 + arch/ia64/include/asm/atomic.h | 10 + arch/ia64/include/asm/elf.h | 7 + arch/ia64/include/asm/pgalloc.h | 12 + arch/ia64/include/asm/pgtable.h | 13 +- arch/ia64/include/asm/spinlock.h | 2 +- arch/ia64/include/asm/uaccess.h | 27 +- arch/ia64/kernel/module.c | 45 +- arch/ia64/kernel/palinfo.c | 2 +- arch/ia64/kernel/sys_ia64.c | 7 + arch/ia64/kernel/vmlinux.lds.S | 2 +- arch/ia64/mm/fault.c | 32 +- arch/ia64/mm/init.c | 15 +- arch/m32r/lib/usercopy.c | 6 + arch/mips/cavium-octeon/dma-octeon.c | 2 +- arch/mips/include/asm/atomic.h | 368 +- arch/mips/include/asm/elf.h | 7 + arch/mips/include/asm/exec.h | 2 +- arch/mips/include/asm/hw_irq.h | 2 +- arch/mips/include/asm/local.h | 57 + arch/mips/include/asm/page.h | 2 +- arch/mips/include/asm/pgalloc.h | 5 + arch/mips/include/asm/pgtable.h | 3 + arch/mips/include/asm/uaccess.h | 1 + arch/mips/kernel/binfmt_elfn32.c | 7 + arch/mips/kernel/binfmt_elfo32.c | 7 + arch/mips/kernel/irq-gt641xx.c | 2 +- arch/mips/kernel/irq.c | 6 +- arch/mips/kernel/pm-cps.c | 2 +- arch/mips/kernel/process.c | 12 - arch/mips/kernel/sync-r4k.c | 24 +- arch/mips/kernel/traps.c | 13 +- arch/mips/mm/fault.c | 25 + arch/mips/mm/mmap.c | 51 +- arch/mips/sgi-ip27/ip27-nmi.c | 6 +- arch/mips/sni/rm200.c | 2 +- arch/mips/vr41xx/common/icu.c | 2 +- arch/mips/vr41xx/common/irq.c | 4 +- arch/parisc/include/asm/atomic.h | 10 + arch/parisc/include/asm/elf.h | 7 + arch/parisc/include/asm/pgalloc.h | 6 + arch/parisc/include/asm/pgtable.h | 11 + arch/parisc/include/asm/uaccess.h | 4 +- arch/parisc/kernel/module.c | 50 +- arch/parisc/kernel/sys_parisc.c | 15 + arch/parisc/kernel/traps.c | 4 +- arch/parisc/mm/fault.c | 140 +- arch/powerpc/include/asm/atomic.h | 329 +- arch/powerpc/include/asm/elf.h | 12 + arch/powerpc/include/asm/exec.h | 2 +- arch/powerpc/include/asm/kmap_types.h | 2 +- arch/powerpc/include/asm/local.h | 46 + arch/powerpc/include/asm/mman.h | 2 +- arch/powerpc/include/asm/page.h | 8 +- arch/powerpc/include/asm/page_64.h | 7 +- arch/powerpc/include/asm/pgalloc-64.h | 7 + arch/powerpc/include/asm/pgtable.h | 1 + arch/powerpc/include/asm/pte-hash32.h | 1 + arch/powerpc/include/asm/reg.h | 1 + arch/powerpc/include/asm/smp.h | 2 +- arch/powerpc/include/asm/spinlock.h | 42 +- arch/powerpc/include/asm/uaccess.h | 141 +- arch/powerpc/kernel/Makefile | 5 + arch/powerpc/kernel/exceptions-64e.S | 4 +- arch/powerpc/kernel/exceptions-64s.S | 2 +- arch/powerpc/kernel/module_32.c | 15 +- arch/powerpc/kernel/process.c | 46 - arch/powerpc/kernel/signal_32.c | 2 +- arch/powerpc/kernel/signal_64.c | 2 +- arch/powerpc/kernel/traps.c | 21 + arch/powerpc/kernel/vdso.c | 5 +- arch/powerpc/lib/usercopy_64.c | 18 - arch/powerpc/mm/fault.c | 56 +- arch/powerpc/mm/mmap.c | 16 + arch/powerpc/mm/slice.c | 13 +- arch/powerpc/platforms/cell/spufs/file.c | 4 +- arch/s390/include/asm/atomic.h | 10 + arch/s390/include/asm/elf.h | 7 + arch/s390/include/asm/exec.h | 2 +- arch/s390/include/asm/uaccess.h | 13 +- arch/s390/kernel/module.c | 22 +- arch/s390/kernel/process.c | 20 - arch/s390/mm/mmap.c | 16 + arch/score/include/asm/exec.h | 2 +- arch/score/kernel/process.c | 5 - arch/sh/mm/mmap.c | 22 +- arch/sparc/include/asm/atomic_64.h | 110 +- arch/sparc/include/asm/cache.h | 2 +- arch/sparc/include/asm/elf_32.h | 7 + arch/sparc/include/asm/elf_64.h | 7 + arch/sparc/include/asm/pgalloc_32.h | 1 + arch/sparc/include/asm/pgalloc_64.h | 1 + arch/sparc/include/asm/pgtable.h | 4 + arch/sparc/include/asm/pgtable_32.h | 15 +- arch/sparc/include/asm/pgtsrmmu.h | 5 + arch/sparc/include/asm/setup.h | 4 +- arch/sparc/include/asm/spinlock_64.h | 35 +- arch/sparc/include/asm/thread_info_32.h | 1 + arch/sparc/include/asm/thread_info_64.h | 2 + arch/sparc/include/asm/uaccess.h | 1 + arch/sparc/include/asm/uaccess_32.h | 28 +- arch/sparc/include/asm/uaccess_64.h | 24 +- arch/sparc/kernel/Makefile | 2 +- arch/sparc/kernel/prom_common.c | 2 +- arch/sparc/kernel/smp_64.c | 8 +- arch/sparc/kernel/sys_sparc_32.c | 2 +- arch/sparc/kernel/sys_sparc_64.c | 52 +- arch/sparc/kernel/traps_64.c | 27 +- arch/sparc/lib/Makefile | 2 +- arch/sparc/lib/atomic_64.S | 57 +- arch/sparc/lib/ksyms.c | 6 +- arch/sparc/mm/Makefile | 2 +- arch/sparc/mm/fault_32.c | 292 + arch/sparc/mm/fault_64.c | 486 + arch/sparc/mm/hugetlbpage.c | 22 +- arch/sparc/mm/init_64.c | 10 +- arch/tile/include/asm/atomic_64.h | 10 + arch/tile/include/asm/uaccess.h | 4 +- arch/um/Makefile | 4 + arch/um/include/asm/kmap_types.h | 2 +- arch/um/include/asm/page.h | 3 + arch/um/include/asm/pgtable-3level.h | 1 + arch/um/kernel/process.c | 16 - arch/x86/Kconfig | 26 +- arch/x86/Kconfig.cpu | 6 +- arch/x86/Kconfig.debug | 4 +- arch/x86/Makefile | 13 +- arch/x86/boot/Makefile | 3 + arch/x86/boot/bitops.h | 4 +- arch/x86/boot/boot.h | 2 +- arch/x86/boot/compressed/Makefile | 3 + arch/x86/boot/compressed/efi_stub_32.S | 16 +- arch/x86/boot/compressed/efi_thunk_64.S | 4 +- arch/x86/boot/compressed/head_32.S | 4 +- arch/x86/boot/compressed/head_64.S | 12 +- arch/x86/boot/compressed/misc.c | 11 +- arch/x86/boot/cpucheck.c | 16 +- arch/x86/boot/header.S | 6 +- arch/x86/boot/memory.c | 2 +- arch/x86/boot/video-vesa.c | 1 + arch/x86/boot/video.c | 2 +- arch/x86/crypto/aes-x86_64-asm_64.S | 4 + arch/x86/crypto/aesni-intel_asm.S | 106 +- arch/x86/crypto/blowfish-x86_64-asm_64.S | 7 + arch/x86/crypto/camellia-aesni-avx-asm_64.S | 10 + arch/x86/crypto/camellia-aesni-avx2-asm_64.S | 10 + arch/x86/crypto/camellia-x86_64-asm_64.S | 7 + arch/x86/crypto/cast5-avx-x86_64-asm_64.S | 51 +- arch/x86/crypto/cast6-avx-x86_64-asm_64.S | 25 +- arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 2 + arch/x86/crypto/ghash-clmulni-intel_asm.S | 4 + arch/x86/crypto/salsa20-x86_64-asm_64.S | 4 + arch/x86/crypto/serpent-avx-x86_64-asm_64.S | 9 + arch/x86/crypto/serpent-avx2-asm_64.S | 9 + arch/x86/crypto/serpent-sse2-x86_64-asm_64.S | 4 + arch/x86/crypto/sha1_ssse3_asm.S | 10 +- arch/x86/crypto/sha256-avx-asm.S | 2 + arch/x86/crypto/sha256-avx2-asm.S | 2 + arch/x86/crypto/sha256-ssse3-asm.S | 2 + arch/x86/crypto/sha512-avx-asm.S | 2 + arch/x86/crypto/sha512-avx2-asm.S | 2 + arch/x86/crypto/sha512-ssse3-asm.S | 2 + arch/x86/crypto/twofish-avx-x86_64-asm_64.S | 25 +- arch/x86/crypto/twofish-x86_64-asm_64-3way.S | 4 + arch/x86/crypto/twofish-x86_64-asm_64.S | 3 + arch/x86/entry/calling.h | 86 +- arch/x86/entry/common.c | 28 +- arch/x86/entry/entry_32.S | 311 +- arch/x86/entry/entry_64.S | 625 +- arch/x86/entry/entry_64_compat.S | 67 +- arch/x86/entry/thunk_64.S | 2 + arch/x86/entry/vdso/Makefile | 2 +- arch/x86/entry/vdso/vdso2c.h | 8 +- arch/x86/entry/vdso/vma.c | 37 +- arch/x86/entry/vsyscall/vsyscall_64.c | 20 +- arch/x86/entry/vsyscall/vsyscall_emu_64.S | 2 +- arch/x86/ia32/ia32_signal.c | 23 +- arch/x86/ia32/sys_ia32.c | 42 +- arch/x86/include/asm/alternative-asm.h | 43 +- arch/x86/include/asm/alternative.h | 4 +- arch/x86/include/asm/apic.h | 2 +- arch/x86/include/asm/apm.h | 4 +- arch/x86/include/asm/atomic.h | 230 +- arch/x86/include/asm/atomic64_32.h | 100 + arch/x86/include/asm/atomic64_64.h | 164 +- arch/x86/include/asm/bitops.h | 18 +- arch/x86/include/asm/boot.h | 2 +- arch/x86/include/asm/cache.h | 5 +- arch/x86/include/asm/checksum_32.h | 12 +- arch/x86/include/asm/cmpxchg.h | 39 + arch/x86/include/asm/compat.h | 4 + arch/x86/include/asm/cpufeature.h | 17 +- arch/x86/include/asm/desc.h | 78 +- arch/x86/include/asm/desc_defs.h | 6 + arch/x86/include/asm/div64.h | 2 +- arch/x86/include/asm/dma.h | 2 + arch/x86/include/asm/elf.h | 33 +- arch/x86/include/asm/emergency-restart.h | 2 +- arch/x86/include/asm/fpu/internal.h | 42 +- arch/x86/include/asm/fpu/types.h | 5 +- arch/x86/include/asm/futex.h | 14 +- arch/x86/include/asm/hw_irq.h | 4 +- arch/x86/include/asm/i8259.h | 2 +- arch/x86/include/asm/io.h | 22 +- arch/x86/include/asm/irqflags.h | 5 + arch/x86/include/asm/kprobes.h | 9 +- arch/x86/include/asm/local.h | 106 +- arch/x86/include/asm/mman.h | 15 + arch/x86/include/asm/mmu.h | 14 +- arch/x86/include/asm/mmu_context.h | 133 +- arch/x86/include/asm/module.h | 17 +- arch/x86/include/asm/nmi.h | 19 +- arch/x86/include/asm/page.h | 1 + arch/x86/include/asm/page_32.h | 12 +- arch/x86/include/asm/page_64.h | 14 +- arch/x86/include/asm/paravirt.h | 46 +- arch/x86/include/asm/paravirt_types.h | 15 +- arch/x86/include/asm/pgalloc.h | 23 + arch/x86/include/asm/pgtable-2level.h | 2 + arch/x86/include/asm/pgtable-3level.h | 7 + arch/x86/include/asm/pgtable.h | 126 +- arch/x86/include/asm/pgtable_32.h | 14 +- arch/x86/include/asm/pgtable_32_types.h | 24 +- arch/x86/include/asm/pgtable_64.h | 23 +- arch/x86/include/asm/pgtable_64_types.h | 5 + arch/x86/include/asm/pgtable_types.h | 26 +- arch/x86/include/asm/pmem.h | 2 +- arch/x86/include/asm/preempt.h | 2 +- arch/x86/include/asm/processor.h | 57 +- arch/x86/include/asm/ptrace.h | 15 +- arch/x86/include/asm/realmode.h | 4 +- arch/x86/include/asm/reboot.h | 10 +- arch/x86/include/asm/rmwcc.h | 84 +- arch/x86/include/asm/rwsem.h | 60 +- arch/x86/include/asm/segment.h | 27 +- arch/x86/include/asm/smap.h | 43 + arch/x86/include/asm/smp.h | 14 +- arch/x86/include/asm/stackprotector.h | 4 +- arch/x86/include/asm/stacktrace.h | 34 +- arch/x86/include/asm/switch_to.h | 4 +- arch/x86/include/asm/sys_ia32.h | 6 +- arch/x86/include/asm/thread_info.h | 27 +- arch/x86/include/asm/tlbflush.h | 77 +- arch/x86/include/asm/uaccess.h | 210 +- arch/x86/include/asm/uaccess_32.h | 28 +- arch/x86/include/asm/uaccess_64.h | 169 +- arch/x86/include/asm/word-at-a-time.h | 2 +- arch/x86/include/asm/x86_init.h | 10 +- arch/x86/include/asm/xen/page.h | 2 +- arch/x86/include/uapi/asm/e820.h | 2 +- arch/x86/kernel/Makefile | 2 +- arch/x86/kernel/acpi/boot.c | 4 +- arch/x86/kernel/acpi/sleep.c | 4 + arch/x86/kernel/acpi/wakeup_32.S | 6 +- arch/x86/kernel/alternative.c | 124 +- arch/x86/kernel/apic/apic.c | 4 +- arch/x86/kernel/apic/apic_flat_64.c | 6 +- arch/x86/kernel/apic/apic_noop.c | 2 +- arch/x86/kernel/apic/bigsmp_32.c | 2 +- arch/x86/kernel/apic/io_apic.c | 8 +- arch/x86/kernel/apic/msi.c | 2 +- arch/x86/kernel/apic/probe_32.c | 4 +- arch/x86/kernel/apic/vector.c | 2 + arch/x86/kernel/apic/x2apic_cluster.c | 2 +- arch/x86/kernel/apic/x2apic_phys.c | 2 +- arch/x86/kernel/apic/x2apic_uv_x.c | 2 +- arch/x86/kernel/apm_32.c | 21 +- arch/x86/kernel/asm-offsets.c | 20 + arch/x86/kernel/asm-offsets_64.c | 1 + arch/x86/kernel/cpu/Makefile | 4 - arch/x86/kernel/cpu/amd.c | 2 +- arch/x86/kernel/cpu/bugs_64.c | 2 + arch/x86/kernel/cpu/common.c | 202 +- arch/x86/kernel/cpu/intel_cacheinfo.c | 14 +- arch/x86/kernel/cpu/mcheck/mce.c | 34 +- arch/x86/kernel/cpu/mcheck/p5.c | 3 + arch/x86/kernel/cpu/mcheck/winchip.c | 3 + arch/x86/kernel/cpu/microcode/intel.c | 4 +- arch/x86/kernel/cpu/mtrr/generic.c | 6 +- arch/x86/kernel/cpu/mtrr/main.c | 2 +- arch/x86/kernel/cpu/mtrr/mtrr.h | 2 +- arch/x86/kernel/cpu/perf_event.c | 10 +- arch/x86/kernel/cpu/perf_event.h | 2 +- arch/x86/kernel/cpu/perf_event_amd_iommu.c | 2 +- arch/x86/kernel/cpu/perf_event_intel.c | 34 +- arch/x86/kernel/cpu/perf_event_intel_bts.c | 6 +- arch/x86/kernel/cpu/perf_event_intel_cqm.c | 4 +- arch/x86/kernel/cpu/perf_event_intel_ds.c | 7 +- arch/x86/kernel/cpu/perf_event_intel_lbr.c | 4 +- arch/x86/kernel/cpu/perf_event_intel_pt.c | 42 +- arch/x86/kernel/cpu/perf_event_intel_rapl.c | 2 +- arch/x86/kernel/cpu/perf_event_intel_uncore.c | 2 +- arch/x86/kernel/cpu/perf_event_intel_uncore.h | 2 +- arch/x86/kernel/crash_dump_64.c | 2 +- arch/x86/kernel/doublefault.c | 8 +- arch/x86/kernel/dumpstack.c | 24 +- arch/x86/kernel/dumpstack_32.c | 25 +- arch/x86/kernel/dumpstack_64.c | 62 +- arch/x86/kernel/e820.c | 4 +- arch/x86/kernel/early_printk.c | 1 + arch/x86/kernel/espfix_64.c | 44 +- arch/x86/kernel/fpu/core.c | 24 +- arch/x86/kernel/fpu/init.c | 40 +- arch/x86/kernel/fpu/regset.c | 22 +- arch/x86/kernel/fpu/signal.c | 20 +- arch/x86/kernel/fpu/xstate.c | 6 +- arch/x86/kernel/ftrace.c | 18 +- arch/x86/kernel/head64.c | 14 +- arch/x86/kernel/head_32.S | 235 +- arch/x86/kernel/head_64.S | 173 +- arch/x86/kernel/i386_ksyms_32.c | 12 + arch/x86/kernel/i8259.c | 10 +- arch/x86/kernel/io_delay.c | 2 +- arch/x86/kernel/ioport.c | 2 +- arch/x86/kernel/irq.c | 8 +- arch/x86/kernel/irq_32.c | 45 +- arch/x86/kernel/jump_label.c | 10 +- arch/x86/kernel/kgdb.c | 21 +- arch/x86/kernel/kprobes/core.c | 28 +- arch/x86/kernel/kprobes/opt.c | 16 +- arch/x86/kernel/ksysfs.c | 2 +- arch/x86/kernel/kvmclock.c | 20 +- arch/x86/kernel/ldt.c | 25 + arch/x86/kernel/livepatch.c | 11 +- arch/x86/kernel/machine_kexec_32.c | 6 +- arch/x86/kernel/mcount_64.S | 19 +- arch/x86/kernel/module.c | 78 +- arch/x86/kernel/msr.c | 2 +- arch/x86/kernel/nmi.c | 34 +- arch/x86/kernel/nmi_selftest.c | 4 +- arch/x86/kernel/paravirt-spinlocks.c | 2 +- arch/x86/kernel/paravirt.c | 45 +- arch/x86/kernel/paravirt_patch_64.c | 8 + arch/x86/kernel/pci-calgary_64.c | 2 +- arch/x86/kernel/pci-iommu_table.c | 2 +- arch/x86/kernel/pci-swiotlb.c | 2 +- arch/x86/kernel/process.c | 80 +- arch/x86/kernel/process_32.c | 29 +- arch/x86/kernel/process_64.c | 14 +- arch/x86/kernel/ptrace.c | 20 +- arch/x86/kernel/pvclock.c | 8 +- arch/x86/kernel/reboot.c | 44 +- arch/x86/kernel/reboot_fixups_32.c | 2 +- arch/x86/kernel/relocate_kernel_64.S | 3 +- arch/x86/kernel/setup.c | 29 +- arch/x86/kernel/setup_percpu.c | 29 +- arch/x86/kernel/signal.c | 17 +- arch/x86/kernel/smp.c | 2 +- arch/x86/kernel/smpboot.c | 29 +- arch/x86/kernel/step.c | 6 +- arch/x86/kernel/sys_i386_32.c | 184 + arch/x86/kernel/sys_x86_64.c | 22 +- arch/x86/kernel/tboot.c | 22 +- arch/x86/kernel/time.c | 8 +- arch/x86/kernel/tls.c | 7 +- arch/x86/kernel/tracepoint.c | 4 +- arch/x86/kernel/traps.c | 53 +- arch/x86/kernel/tsc.c | 2 +- arch/x86/kernel/uprobes.c | 4 +- arch/x86/kernel/vm86_32.c | 6 +- arch/x86/kernel/vmlinux.lds.S | 153 +- arch/x86/kernel/x8664_ksyms_64.c | 6 +- arch/x86/kernel/x86_init.c | 6 +- arch/x86/kvm/cpuid.c | 21 +- arch/x86/kvm/emulate.c | 6 +- arch/x86/kvm/i8259.c | 10 +- arch/x86/kvm/ioapic.c | 2 + arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/paging_tmpl.h | 2 +- arch/x86/kvm/svm.c | 10 +- arch/x86/kvm/vmx.c | 62 +- arch/x86/kvm/x86.c | 44 +- arch/x86/lguest/boot.c | 3 +- arch/x86/lib/atomic64_386_32.S | 164 + arch/x86/lib/atomic64_cx8_32.S | 98 +- arch/x86/lib/checksum_32.S | 99 +- arch/x86/lib/clear_page_64.S | 3 + arch/x86/lib/cmpxchg16b_emu.S | 3 + arch/x86/lib/copy_page_64.S | 14 +- arch/x86/lib/copy_user_64.S | 66 +- arch/x86/lib/csum-copy_64.S | 14 +- arch/x86/lib/csum-wrappers_64.c | 8 +- arch/x86/lib/getuser.S | 74 +- arch/x86/lib/insn.c | 8 +- arch/x86/lib/iomap_copy_64.S | 2 + arch/x86/lib/memcpy_64.S | 6 + arch/x86/lib/memmove_64.S | 3 +- arch/x86/lib/memset_64.S | 3 + arch/x86/lib/mmx_32.c | 243 +- arch/x86/lib/msr-reg.S | 2 + arch/x86/lib/putuser.S | 87 +- arch/x86/lib/rwsem.S | 6 +- arch/x86/lib/usercopy_32.c | 359 +- arch/x86/lib/usercopy_64.c | 22 +- arch/x86/math-emu/fpu_aux.c | 2 +- arch/x86/math-emu/fpu_entry.c | 4 +- arch/x86/math-emu/fpu_system.h | 2 +- arch/x86/mm/Makefile | 4 + arch/x86/mm/extable.c | 26 +- arch/x86/mm/fault.c | 570 +- arch/x86/mm/gup.c | 6 +- arch/x86/mm/highmem_32.c | 6 + arch/x86/mm/hugetlbpage.c | 24 +- arch/x86/mm/init.c | 111 +- arch/x86/mm/init_32.c | 111 +- arch/x86/mm/init_64.c | 46 +- arch/x86/mm/iomap_32.c | 4 + arch/x86/mm/ioremap.c | 52 +- arch/x86/mm/kmemcheck/kmemcheck.c | 4 +- arch/x86/mm/mmap.c | 40 +- arch/x86/mm/mmio-mod.c | 10 +- arch/x86/mm/mpx.c | 6 +- arch/x86/mm/numa.c | 4 +- arch/x86/mm/pageattr.c | 42 +- arch/x86/mm/pat.c | 12 +- arch/x86/mm/pat_rbtree.c | 2 +- arch/x86/mm/pf_in.c | 10 +- arch/x86/mm/pgtable.c | 214 +- arch/x86/mm/pgtable_32.c | 3 + arch/x86/mm/setup_nx.c | 7 + arch/x86/mm/tlb.c | 4 + arch/x86/mm/uderef_64.c | 37 + arch/x86/net/bpf_jit.S | 11 + arch/x86/net/bpf_jit_comp.c | 13 +- arch/x86/oprofile/backtrace.c | 6 +- arch/x86/oprofile/nmi_int.c | 8 +- arch/x86/oprofile/op_model_amd.c | 8 +- arch/x86/oprofile/op_model_ppro.c | 7 +- arch/x86/oprofile/op_x86_model.h | 2 +- arch/x86/pci/intel_mid_pci.c | 2 +- arch/x86/pci/irq.c | 8 +- arch/x86/pci/pcbios.c | 144 +- arch/x86/platform/efi/efi_32.c | 24 + arch/x86/platform/efi/efi_64.c | 26 +- arch/x86/platform/efi/efi_stub_32.S | 64 +- arch/x86/platform/efi/efi_stub_64.S | 2 + arch/x86/platform/intel-mid/intel-mid.c | 5 +- arch/x86/platform/intel-mid/intel_mid_weak_decls.h | 6 +- arch/x86/platform/intel-mid/mfld.c | 4 +- arch/x86/platform/intel-mid/mrfl.c | 2 +- arch/x86/platform/intel-quark/imr_selftest.c | 2 +- arch/x86/platform/olpc/olpc_dt.c | 2 +- arch/x86/power/cpu.c | 11 +- arch/x86/realmode/init.c | 10 +- arch/x86/realmode/rm/Makefile | 3 + arch/x86/realmode/rm/header.S | 4 +- arch/x86/realmode/rm/reboot.S | 4 + arch/x86/realmode/rm/trampoline_32.S | 12 +- arch/x86/realmode/rm/trampoline_64.S | 3 +- arch/x86/realmode/rm/wakeup_asm.S | 5 +- arch/x86/tools/Makefile | 2 +- arch/x86/tools/relocs.c | 96 +- arch/x86/um/mem_32.c | 2 +- arch/x86/um/tls_32.c | 2 +- arch/x86/xen/enlighten.c | 50 +- arch/x86/xen/mmu.c | 19 +- arch/x86/xen/smp.c | 16 +- arch/x86/xen/xen-asm_32.S | 2 +- arch/x86/xen/xen-head.S | 11 + arch/x86/xen/xen-ops.h | 2 - block/bio.c | 4 +- block/blk-cgroup.c | 18 +- block/blk-iopoll.c | 2 +- block/blk-map.c | 2 +- block/blk-softirq.c | 2 +- block/bsg.c | 12 +- block/cfq-iosched.c | 4 +- block/compat_ioctl.c | 4 +- block/genhd.c | 9 +- block/partitions/efi.c | 8 +- block/scsi_ioctl.c | 29 +- crypto/cryptd.c | 4 +- crypto/crypto_user.c | 8 +- crypto/pcrypt.c | 2 +- crypto/zlib.c | 12 +- drivers/acpi/acpi_video.c | 2 +- drivers/acpi/apei/apei-internal.h | 2 +- drivers/acpi/apei/ghes.c | 10 +- drivers/acpi/bgrt.c | 6 +- drivers/acpi/blacklist.c | 4 +- drivers/acpi/bus.c | 4 +- drivers/acpi/device_pm.c | 4 +- drivers/acpi/ec.c | 2 +- drivers/acpi/pci_slot.c | 2 +- drivers/acpi/processor_idle.c | 2 +- drivers/acpi/processor_pdc.c | 2 +- drivers/acpi/sleep.c | 2 +- drivers/acpi/sysfs.c | 4 +- drivers/acpi/thermal.c | 2 +- drivers/acpi/video_detect.c | 7 +- drivers/ata/libata-core.c | 12 +- drivers/ata/libata-scsi.c | 2 +- drivers/ata/libata.h | 2 +- drivers/ata/pata_arasan_cf.c | 4 +- drivers/atm/adummy.c | 2 +- drivers/atm/ambassador.c | 8 +- drivers/atm/atmtcp.c | 14 +- drivers/atm/eni.c | 10 +- drivers/atm/firestream.c | 8 +- drivers/atm/fore200e.c | 14 +- drivers/atm/he.c | 18 +- drivers/atm/horizon.c | 4 +- drivers/atm/idt77252.c | 36 +- drivers/atm/iphase.c | 34 +- drivers/atm/lanai.c | 12 +- drivers/atm/nicstar.c | 46 +- drivers/atm/solos-pci.c | 4 +- drivers/atm/suni.c | 4 +- drivers/atm/uPD98402.c | 16 +- drivers/atm/zatm.c | 6 +- drivers/base/bus.c | 4 +- drivers/base/devres.c | 4 +- drivers/base/devtmpfs.c | 8 +- drivers/base/node.c | 2 +- drivers/base/platform-msi.c | 20 +- drivers/base/power/domain.c | 7 +- drivers/base/power/runtime.c | 6 +- drivers/base/power/sysfs.c | 2 +- drivers/base/power/wakeup.c | 8 +- drivers/base/regmap/regmap-debugfs.c | 4 +- drivers/base/regmap/regmap.c | 4 +- drivers/base/syscore.c | 4 +- drivers/block/cciss.c | 28 +- drivers/block/cciss.h | 2 +- drivers/block/cpqarray.c | 28 +- drivers/block/cpqarray.h | 2 +- drivers/block/drbd/drbd_bitmap.c | 2 +- drivers/block/drbd/drbd_int.h | 8 +- drivers/block/drbd/drbd_main.c | 12 +- drivers/block/drbd/drbd_nl.c | 4 +- drivers/block/drbd/drbd_receiver.c | 38 +- drivers/block/drbd/drbd_worker.c | 14 +- drivers/block/pktcdvd.c | 4 +- drivers/block/rbd.c | 2 +- drivers/bluetooth/btwilink.c | 2 +- drivers/bus/arm-cci.c | 12 +- drivers/cdrom/cdrom.c | 11 +- drivers/cdrom/gdrom.c | 1 - drivers/char/agp/compat_ioctl.c | 2 +- drivers/char/agp/frontend.c | 4 +- drivers/char/agp/intel-gtt.c | 4 +- drivers/char/hpet.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 8 +- drivers/char/ipmi/ipmi_si_intf.c | 8 +- drivers/char/ipmi/ipmi_ssif.c | 12 +- drivers/char/mem.c | 47 +- drivers/char/nvram.c | 2 +- drivers/char/pcmcia/synclink_cs.c | 16 +- drivers/char/random.c | 12 +- drivers/char/sonypi.c | 11 +- drivers/char/tpm/tpm_acpi.c | 3 +- drivers/char/tpm/tpm_eventlog.c | 5 +- drivers/char/virtio_console.c | 6 +- drivers/clk/clk-composite.c | 2 +- drivers/clk/samsung/clk.h | 2 +- drivers/clk/socfpga/clk-gate.c | 9 +- drivers/clk/socfpga/clk-pll.c | 9 +- drivers/clk/ti/clk.c | 8 +- drivers/cpufreq/acpi-cpufreq.c | 17 +- drivers/cpufreq/cpufreq-dt.c | 4 +- drivers/cpufreq/cpufreq.c | 30 +- drivers/cpufreq/cpufreq_governor.c | 2 +- drivers/cpufreq/cpufreq_governor.h | 4 +- drivers/cpufreq/cpufreq_ondemand.c | 10 +- drivers/cpufreq/intel_pstate.c | 38 +- drivers/cpufreq/p4-clockmod.c | 12 +- drivers/cpufreq/sparc-us3-cpufreq.c | 67 +- drivers/cpufreq/speedstep-centrino.c | 7 +- drivers/cpuidle/driver.c | 2 +- drivers/cpuidle/dt_idle_states.c | 2 +- drivers/cpuidle/governor.c | 2 +- drivers/cpuidle/sysfs.c | 2 +- drivers/crypto/hifn_795x.c | 4 +- drivers/devfreq/devfreq.c | 4 +- drivers/dma/sh/shdma-base.c | 4 +- drivers/dma/sh/shdmac.c | 2 +- drivers/edac/edac_device.c | 4 +- drivers/edac/edac_mc_sysfs.c | 2 +- drivers/edac/edac_pci.c | 4 +- drivers/edac/edac_pci_sysfs.c | 22 +- drivers/edac/mce_amd.h | 2 +- drivers/firewire/core-card.c | 6 +- drivers/firewire/core-device.c | 2 +- drivers/firewire/core-transaction.c | 1 + drivers/firewire/core.h | 1 + drivers/firmware/dmi-id.c | 2 +- drivers/firmware/dmi_scan.c | 12 +- drivers/firmware/efi/cper.c | 8 +- drivers/firmware/efi/efi.c | 12 +- drivers/firmware/efi/efivars.c | 2 +- drivers/firmware/efi/runtime-map.c | 2 +- drivers/firmware/google/gsmi.c | 2 +- drivers/firmware/google/memconsole.c | 7 +- drivers/firmware/memmap.c | 2 +- drivers/firmware/psci.c | 2 +- drivers/gpio/gpio-davinci.c | 6 +- drivers/gpio/gpio-em.c | 2 +- drivers/gpio/gpio-ich.c | 2 +- drivers/gpio/gpio-omap.c | 4 +- drivers/gpio/gpio-rcar.c | 2 +- drivers/gpio/gpio-vr41xx.c | 2 +- drivers/gpio/gpiolib.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 18 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 6 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 90 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.h | 8 +- .../drm/amd/amdkfd/kfd_device_queue_manager_cik.c | 14 +- .../drm/amd/amdkfd/kfd_device_queue_manager_vi.c | 14 +- drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.h | 2 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 16 +- drivers/gpu/drm/amd/scheduler/gpu_scheduler.c | 2 +- drivers/gpu/drm/amd/scheduler/gpu_scheduler.h | 2 +- drivers/gpu/drm/amd/scheduler/sched_fence.c | 2 +- drivers/gpu/drm/armada/armada_drv.c | 3 +- drivers/gpu/drm/drm_crtc.c | 2 +- drivers/gpu/drm/drm_drv.c | 2 +- drivers/gpu/drm/drm_fops.c | 12 +- drivers/gpu/drm/drm_global.c | 14 +- drivers/gpu/drm/drm_info.c | 13 +- drivers/gpu/drm/drm_ioc32.c | 13 +- drivers/gpu/drm/drm_ioctl.c | 2 +- drivers/gpu/drm/drm_pci.c | 9 +- drivers/gpu/drm/exynos/exynos_drm_drv.c | 1 - drivers/gpu/drm/gma500/mdfld_dsi_dpi.c | 10 +- drivers/gpu/drm/gma500/psb_drv.c | 1 - drivers/gpu/drm/i810/i810_dma.c | 2 +- drivers/gpu/drm/i810/i810_drv.c | 6 +- drivers/gpu/drm/i810/i810_drv.h | 6 +- drivers/gpu/drm/i915/i915_dma.c | 4 +- drivers/gpu/drm/i915/i915_drv.c | 7 +- drivers/gpu/drm/i915/i915_drv.h | 2 +- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 4 +- drivers/gpu/drm/i915/i915_gem_gtt.c | 16 +- drivers/gpu/drm/i915/i915_gem_gtt.h | 6 +- drivers/gpu/drm/i915/i915_ioc32.c | 10 +- drivers/gpu/drm/i915/i915_irq.c | 88 +- drivers/gpu/drm/i915/intel_display.c | 26 +- drivers/gpu/drm/imx/imx-drm-core.c | 2 +- drivers/gpu/drm/mga/mga_drv.c | 5 +- drivers/gpu/drm/mga/mga_drv.h | 6 +- drivers/gpu/drm/mga/mga_ioc32.c | 10 +- drivers/gpu/drm/mga/mga_irq.c | 8 +- drivers/gpu/drm/mga/mga_state.c | 2 +- drivers/gpu/drm/nouveau/nouveau_bios.c | 2 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 13 +- drivers/gpu/drm/nouveau/nouveau_drm.h | 1 - drivers/gpu/drm/nouveau/nouveau_ioc32.c | 2 +- drivers/gpu/drm/nouveau/nouveau_vga.c | 2 +- drivers/gpu/drm/omapdrm/Makefile | 2 +- drivers/gpu/drm/qxl/qxl_cmd.c | 12 +- drivers/gpu/drm/qxl/qxl_debugfs.c | 8 +- drivers/gpu/drm/qxl/qxl_drv.c | 8 +- drivers/gpu/drm/qxl/qxl_drv.h | 8 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 12 +- drivers/gpu/drm/qxl/qxl_irq.c | 16 +- drivers/gpu/drm/qxl/qxl_ttm.c | 38 +- drivers/gpu/drm/r128/r128_cce.c | 2 +- drivers/gpu/drm/r128/r128_drv.c | 4 +- drivers/gpu/drm/r128/r128_drv.h | 6 +- drivers/gpu/drm/r128/r128_ioc32.c | 10 +- drivers/gpu/drm/r128/r128_irq.c | 4 +- drivers/gpu/drm/r128/r128_state.c | 6 +- drivers/gpu/drm/radeon/mkregtable.c | 4 +- drivers/gpu/drm/radeon/radeon_device.c | 2 +- drivers/gpu/drm/radeon/radeon_drv.c | 17 +- drivers/gpu/drm/radeon/radeon_drv.h | 4 +- drivers/gpu/drm/radeon/radeon_ioc32.c | 12 +- drivers/gpu/drm/radeon/radeon_irq.c | 6 +- drivers/gpu/drm/radeon/radeon_kms.c | 2 +- drivers/gpu/drm/radeon/radeon_state.c | 6 +- drivers/gpu/drm/radeon/radeon_ttm.c | 4 +- drivers/gpu/drm/savage/savage_bci.c | 2 +- drivers/gpu/drm/savage/savage_drv.c | 5 +- drivers/gpu/drm/savage/savage_drv.h | 2 +- drivers/gpu/drm/sis/sis_drv.c | 5 +- drivers/gpu/drm/sis/sis_drv.h | 2 +- drivers/gpu/drm/sis/sis_mm.c | 2 +- drivers/gpu/drm/tegra/dc.c | 2 +- drivers/gpu/drm/tegra/dsi.c | 2 +- drivers/gpu/drm/tegra/hdmi.c | 2 +- drivers/gpu/drm/tegra/sor.c | 7 +- drivers/gpu/drm/tilcdc/Makefile | 6 +- drivers/gpu/drm/ttm/ttm_memory.c | 4 +- drivers/gpu/drm/ttm/ttm_page_alloc.c | 18 +- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 18 +- drivers/gpu/drm/udl/udl_fb.c | 1 - drivers/gpu/drm/via/via_dma.c | 2 +- drivers/gpu/drm/via/via_drv.c | 5 +- drivers/gpu/drm/via/via_drv.h | 6 +- drivers/gpu/drm/via/via_irq.c | 18 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_irq.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_marker.c | 2 +- drivers/gpu/vga/vga_switcheroo.c | 4 +- drivers/hid/hid-core.c | 4 +- drivers/hid/hid-sensor-custom.c | 2 +- drivers/hv/channel.c | 6 +- drivers/hv/hv.c | 4 +- drivers/hv/hv_balloon.c | 18 +- drivers/hv/hyperv_vmbus.h | 2 +- drivers/hwmon/acpi_power_meter.c | 6 +- drivers/hwmon/applesmc.c | 2 +- drivers/hwmon/asus_atk0110.c | 10 +- drivers/hwmon/coretemp.c | 2 +- drivers/hwmon/dell-smm-hwmon.c | 2 +- drivers/hwmon/ibmaem.c | 2 +- drivers/hwmon/iio_hwmon.c | 2 +- drivers/hwmon/nct6683.c | 6 +- drivers/hwmon/nct6775.c | 6 +- drivers/hwmon/pmbus/pmbus_core.c | 10 +- drivers/hwmon/sht15.c | 12 +- drivers/hwmon/via-cputemp.c | 2 +- drivers/i2c/busses/i2c-amd756-s4882.c | 2 +- drivers/i2c/busses/i2c-designware-pcidrv.c | 2 +- drivers/i2c/busses/i2c-nforce2-s4985.c | 2 +- drivers/i2c/i2c-dev.c | 2 +- drivers/ide/ide-cd.c | 2 +- drivers/ide/ide-disk.c | 2 +- drivers/iio/industrialio-core.c | 2 +- drivers/iio/magnetometer/ak8975.c | 2 +- drivers/infiniband/core/cm.c | 32 +- drivers/infiniband/core/fmr_pool.c | 20 +- drivers/infiniband/core/netlink.c | 5 +- drivers/infiniband/core/uverbs_cmd.c | 3 + drivers/infiniband/hw/cxgb4/device.c | 6 +- drivers/infiniband/hw/cxgb4/iw_cxgb4.h | 2 +- drivers/infiniband/hw/cxgb4/mem.c | 4 +- drivers/infiniband/hw/mlx4/mad.c | 2 +- drivers/infiniband/hw/mlx4/mcg.c | 2 +- drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 +- drivers/infiniband/hw/mthca/mthca_cmd.c | 8 +- drivers/infiniband/hw/mthca/mthca_main.c | 2 +- drivers/infiniband/hw/mthca/mthca_mr.c | 6 +- drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/nes/nes.c | 4 +- drivers/infiniband/hw/nes/nes.h | 40 +- drivers/infiniband/hw/nes/nes_cm.c | 62 +- drivers/infiniband/hw/nes/nes_mgt.c | 8 +- drivers/infiniband/hw/nes/nes_nic.c | 40 +- drivers/infiniband/hw/nes/nes_verbs.c | 10 +- drivers/infiniband/hw/qib/qib.h | 1 + drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 2 +- drivers/input/evdev.c | 2 +- drivers/input/gameport/gameport.c | 4 +- drivers/input/input.c | 4 +- drivers/input/joystick/sidewinder.c | 1 + drivers/input/misc/ims-pcu.c | 4 +- drivers/input/mouse/psmouse.h | 2 +- drivers/input/mousedev.c | 2 +- drivers/input/serio/serio.c | 4 +- drivers/input/serio/serio_raw.c | 4 +- drivers/input/touchscreen/htcpen.c | 2 +- drivers/iommu/arm-smmu-v3.c | 2 +- drivers/iommu/arm-smmu.c | 43 +- drivers/iommu/io-pgtable-arm.c | 101 +- drivers/iommu/io-pgtable.c | 11 +- drivers/iommu/io-pgtable.h | 19 +- drivers/iommu/iommu.c | 2 +- drivers/iommu/ipmmu-vmsa.c | 13 +- drivers/iommu/irq_remapping.c | 2 +- drivers/irqchip/irq-gic.c | 2 +- drivers/irqchip/irq-i8259.c | 2 +- drivers/irqchip/irq-renesas-intc-irqpin.c | 2 +- drivers/isdn/capi/capi.c | 10 +- drivers/isdn/gigaset/interface.c | 8 +- drivers/isdn/gigaset/usb-gigaset.c | 2 +- drivers/isdn/hardware/avm/b1.c | 4 +- drivers/isdn/i4l/isdn_common.c | 2 + drivers/isdn/i4l/isdn_tty.c | 22 +- drivers/isdn/icn/icn.c | 2 +- drivers/isdn/mISDN/dsp_cmx.c | 2 +- drivers/lguest/core.c | 10 +- drivers/lguest/page_tables.c | 2 +- drivers/lguest/x86/core.c | 12 +- drivers/lguest/x86/switcher_32.S | 27 +- drivers/md/bcache/alloc.c | 2 +- drivers/md/bcache/bcache.h | 10 +- drivers/md/bcache/btree.c | 2 +- drivers/md/bcache/closure.h | 2 +- drivers/md/bcache/io.c | 10 +- drivers/md/bcache/journal.c | 2 +- drivers/md/bcache/stats.c | 26 +- drivers/md/bcache/stats.h | 16 +- drivers/md/bcache/super.c | 2 +- drivers/md/bcache/sysfs.c | 20 +- drivers/md/bitmap.c | 2 +- drivers/md/dm-cache-target.c | 98 +- drivers/md/dm-ioctl.c | 2 +- drivers/md/dm-raid.c | 2 +- drivers/md/dm-raid1.c | 18 +- drivers/md/dm-stats.c | 6 +- drivers/md/dm-stripe.c | 10 +- drivers/md/dm-table.c | 2 +- drivers/md/dm-thin-metadata.c | 4 +- drivers/md/dm.c | 28 +- drivers/md/md.c | 37 +- drivers/md/md.h | 8 +- drivers/md/persistent-data/dm-space-map-metadata.c | 4 +- drivers/md/persistent-data/dm-space-map.h | 1 + drivers/md/raid1.c | 8 +- drivers/md/raid10.c | 20 +- drivers/md/raid5.c | 26 +- drivers/media/dvb-core/dvbdev.c | 2 +- drivers/media/dvb-frontends/af9033.h | 2 +- drivers/media/dvb-frontends/dib3000.h | 2 +- drivers/media/dvb-frontends/dib7000p.h | 2 +- drivers/media/dvb-frontends/dib8000.h | 2 +- drivers/media/pci/cx88/cx88-video.c | 6 +- drivers/media/pci/ivtv/ivtv-driver.c | 2 +- drivers/media/pci/solo6x10/solo6x10-core.c | 2 +- drivers/media/pci/solo6x10/solo6x10-p2m.c | 2 +- drivers/media/pci/solo6x10/solo6x10.h | 2 +- drivers/media/pci/tw68/tw68-core.c | 2 +- drivers/media/pci/zoran/zoran.h | 1 - drivers/media/pci/zoran/zoran_driver.c | 3 - drivers/media/platform/omap/omap_vout.c | 11 +- drivers/media/platform/s5p-tv/mixer.h | 2 +- drivers/media/platform/s5p-tv/mixer_grp_layer.c | 2 +- drivers/media/platform/s5p-tv/mixer_reg.c | 2 +- drivers/media/platform/s5p-tv/mixer_video.c | 24 +- drivers/media/platform/s5p-tv/mixer_vp_layer.c | 2 +- drivers/media/radio/radio-cadet.c | 2 + drivers/media/radio/radio-maxiradio.c | 2 +- drivers/media/radio/radio-shark.c | 2 +- drivers/media/radio/radio-shark2.c | 2 +- drivers/media/radio/radio-si476x.c | 2 +- drivers/media/radio/wl128x/fmdrv_common.c | 2 +- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 12 +- drivers/media/v4l2-core/v4l2-device.c | 4 +- drivers/media/v4l2-core/v4l2-ioctl.c | 13 +- drivers/memory/omap-gpmc.c | 21 +- drivers/message/fusion/mptsas.c | 34 +- drivers/mfd/ab8500-debugfs.c | 2 +- drivers/mfd/kempld-core.c | 2 +- drivers/mfd/max8925-i2c.c | 2 +- drivers/mfd/tps65910.c | 2 +- drivers/mfd/twl4030-irq.c | 9 +- drivers/misc/c2port/core.c | 4 +- drivers/misc/kgdbts.c | 4 +- drivers/misc/lis3lv02d/lis3lv02d.c | 8 +- drivers/misc/lis3lv02d/lis3lv02d.h | 2 +- drivers/misc/mic/scif/scif_api.c | 10 +- drivers/misc/mic/scif/scif_rb.c | 8 +- drivers/misc/sgi-gru/gruhandles.c | 4 +- drivers/misc/sgi-gru/gruprocfs.c | 8 +- drivers/misc/sgi-gru/grutables.h | 158 +- drivers/misc/sgi-xp/xp.h | 2 +- drivers/misc/sgi-xp/xpc.h | 3 +- drivers/misc/sgi-xp/xpc_main.c | 2 +- drivers/mmc/host/dw_mmc.h | 2 +- drivers/mmc/host/mmci.c | 4 +- drivers/mmc/host/omap_hsmmc.c | 4 +- drivers/mmc/host/sdhci-esdhc-imx.c | 7 +- drivers/mmc/host/sdhci-s3c.c | 8 +- drivers/mtd/chips/cfi_cmdset_0020.c | 2 +- drivers/mtd/nand/denali.c | 1 + drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 2 +- drivers/mtd/nftlmount.c | 1 + drivers/mtd/sm_ftl.c | 2 +- drivers/net/bonding/bond_netlink.c | 2 +- drivers/net/caif/caif_hsi.c | 2 +- drivers/net/can/Kconfig | 2 +- drivers/net/can/dev.c | 2 +- drivers/net/can/vcan.c | 2 +- drivers/net/dummy.c | 2 +- drivers/net/ethernet/8390/ax88796.c | 4 +- drivers/net/ethernet/altera/altera_tse_main.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-common.h | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-dcb.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-desc.c | 27 +- drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 143 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 64 +- drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 10 +- drivers/net/ethernet/amd/xgbe/xgbe-main.c | 15 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 27 +- drivers/net/ethernet/amd/xgbe/xgbe-ptp.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe.h | 10 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c | 11 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 3 +- drivers/net/ethernet/broadcom/tg3.h | 1 + drivers/net/ethernet/cavium/liquidio/lio_ethtool.c | 6 +- drivers/net/ethernet/cavium/liquidio/lio_main.c | 11 +- drivers/net/ethernet/chelsio/cxgb3/l2t.h | 2 +- drivers/net/ethernet/dec/tulip/de4x5.c | 4 +- drivers/net/ethernet/emulex/benet/be_main.c | 2 +- drivers/net/ethernet/faraday/ftgmac100.c | 2 + drivers/net/ethernet/faraday/ftmac100.c | 2 + drivers/net/ethernet/intel/i40e/i40e_ptp.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 7 +- drivers/net/ethernet/neterion/vxge/vxge-config.c | 7 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 4 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c | 12 +- .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 +- drivers/net/ethernet/realtek/r8169.c | 8 +- drivers/net/ethernet/sfc/ptp.c | 2 +- drivers/net/ethernet/sfc/selftest.c | 20 +- drivers/net/ethernet/stmicro/stmmac/mmc_core.c | 4 +- drivers/net/ethernet/via/via-rhine.c | 2 +- drivers/net/geneve.c | 2 +- drivers/net/hyperv/hyperv_net.h | 2 +- drivers/net/hyperv/rndis_filter.c | 7 +- drivers/net/ifb.c | 2 +- drivers/net/ipvlan/ipvlan_core.c | 2 +- drivers/net/irda/vlsi_ir.c | 18 +- drivers/net/irda/vlsi_ir.h | 14 +- drivers/net/macvlan.c | 20 +- drivers/net/macvtap.c | 10 +- drivers/net/nlmon.c | 2 +- drivers/net/phy/phy_device.c | 6 +- drivers/net/ppp/ppp_generic.c | 4 +- drivers/net/slip/slhc.c | 2 +- drivers/net/team/team.c | 4 +- drivers/net/tun.c | 7 +- drivers/net/usb/hso.c | 23 +- drivers/net/usb/r8152.c | 2 +- drivers/net/usb/sierra_net.c | 4 +- drivers/net/virtio_net.c | 2 +- drivers/net/vrf.c | 2 +- drivers/net/vxlan.c | 4 +- drivers/net/wimax/i2400m/rx.c | 2 +- drivers/net/wireless/airo.c | 2 +- drivers/net/wireless/at76c50x-usb.c | 2 +- drivers/net/wireless/ath/ath10k/ce.c | 6 +- drivers/net/wireless/ath/ath10k/htc.h | 4 +- drivers/net/wireless/ath/ath9k/ar9002_mac.c | 36 +- drivers/net/wireless/ath/ath9k/ar9003_mac.c | 64 +- drivers/net/wireless/ath/ath9k/hw.h | 4 +- drivers/net/wireless/ath/ath9k/main.c | 22 +- drivers/net/wireless/ath/carl9170/carl9170.h | 6 +- drivers/net/wireless/ath/carl9170/debug.c | 6 +- drivers/net/wireless/ath/carl9170/main.c | 10 +- drivers/net/wireless/ath/carl9170/tx.c | 4 +- drivers/net/wireless/ath/wil6210/wil_platform.h | 2 +- drivers/net/wireless/b43/phy_lp.c | 2 +- drivers/net/wireless/iwlegacy/3945-mac.c | 4 +- drivers/net/wireless/iwlwifi/dvm/debugfs.c | 34 +- drivers/net/wireless/iwlwifi/mvm/d3.c | 4 +- drivers/net/wireless/iwlwifi/mvm/tx.c | 2 +- drivers/net/wireless/iwlwifi/pcie/trans.c | 4 +- drivers/net/wireless/mac80211_hwsim.c | 28 +- drivers/net/wireless/rt2x00/rt2x00.h | 2 +- drivers/net/wireless/rt2x00/rt2x00queue.c | 4 +- drivers/net/wireless/ti/wl1251/sdio.c | 12 +- drivers/net/wireless/ti/wl12xx/main.c | 8 +- drivers/net/wireless/ti/wl18xx/main.c | 6 +- drivers/of/fdt.c | 4 +- drivers/oprofile/buffer_sync.c | 8 +- drivers/oprofile/event_buffer.c | 2 +- drivers/oprofile/oprof.c | 2 +- drivers/oprofile/oprofile_stats.c | 10 +- drivers/oprofile/oprofile_stats.h | 10 +- drivers/oprofile/oprofilefs.c | 6 +- drivers/oprofile/timer_int.c | 2 +- drivers/parport/procfs.c | 4 +- drivers/pci/host/pci-host-generic.c | 2 +- drivers/pci/hotplug/acpiphp_ibm.c | 4 +- drivers/pci/hotplug/cpcihp_generic.c | 6 +- drivers/pci/hotplug/cpcihp_zt5550.c | 14 +- drivers/pci/hotplug/cpqphp_nvram.c | 2 + drivers/pci/hotplug/pci_hotplug_core.c | 6 +- drivers/pci/hotplug/pciehp_core.c | 2 +- drivers/pci/msi.c | 22 +- drivers/pci/pci-sysfs.c | 6 +- drivers/pci/pci.h | 2 +- drivers/pci/pcie/aspm.c | 6 +- drivers/pci/pcie/portdrv_pci.c | 2 +- drivers/pci/probe.c | 2 +- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 2 +- drivers/pinctrl/pinctrl-at91.c | 5 +- drivers/platform/chrome/chromeos_pstore.c | 2 +- drivers/platform/x86/alienware-wmi.c | 4 +- drivers/platform/x86/compal-laptop.c | 2 +- drivers/platform/x86/hdaps.c | 2 +- drivers/platform/x86/ibm_rtl.c | 2 +- drivers/platform/x86/intel_oaktrail.c | 2 +- drivers/platform/x86/msi-laptop.c | 16 +- drivers/platform/x86/msi-wmi.c | 2 +- drivers/platform/x86/samsung-laptop.c | 2 +- drivers/platform/x86/samsung-q10.c | 2 +- drivers/platform/x86/sony-laptop.c | 14 +- drivers/platform/x86/thinkpad_acpi.c | 2 +- drivers/pnp/pnpbios/bioscalls.c | 14 +- drivers/pnp/pnpbios/core.c | 2 +- drivers/power/pda_power.c | 7 +- drivers/power/power_supply.h | 4 +- drivers/power/power_supply_core.c | 7 +- drivers/power/power_supply_sysfs.c | 6 +- drivers/power/reset/at91-reset.c | 5 +- drivers/powercap/powercap_sys.c | 136 +- drivers/ptp/ptp_private.h | 2 +- drivers/ptp/ptp_sysfs.c | 2 +- drivers/regulator/core.c | 4 +- drivers/regulator/max8660.c | 6 +- drivers/regulator/max8973-regulator.c | 16 +- drivers/regulator/mc13892-regulator.c | 8 +- drivers/rtc/rtc-armada38x.c | 7 +- drivers/rtc/rtc-cmos.c | 4 +- drivers/rtc/rtc-ds1307.c | 2 +- drivers/rtc/rtc-m48t59.c | 4 +- drivers/rtc/rtc-rv8803.c | 15 +- drivers/rtc/rtc-test.c | 6 +- drivers/scsi/bfa/bfa_fcpim.h | 2 +- drivers/scsi/bfa/bfa_ioc.h | 4 +- drivers/scsi/fcoe/fcoe_sysfs.c | 12 +- drivers/scsi/hosts.c | 4 +- drivers/scsi/hpsa.c | 38 +- drivers/scsi/hpsa.h | 2 +- drivers/scsi/hptiop.c | 2 - drivers/scsi/hptiop.h | 1 - drivers/scsi/ipr.c | 6 +- drivers/scsi/ipr.h | 2 +- drivers/scsi/libfc/fc_exch.c | 50 +- drivers/scsi/libsas/sas_ata.c | 2 +- drivers/scsi/lpfc/lpfc.h | 8 +- drivers/scsi/lpfc/lpfc_debugfs.c | 18 +- drivers/scsi/lpfc/lpfc_init.c | 6 +- drivers/scsi/lpfc/lpfc_scsi.c | 10 +- drivers/scsi/megaraid/megaraid_sas.h | 2 +- drivers/scsi/pmcraid.c | 20 +- drivers/scsi/pmcraid.h | 8 +- drivers/scsi/qla2xxx/qla_attr.c | 4 +- drivers/scsi/qla2xxx/qla_gbl.h | 4 +- drivers/scsi/qla2xxx/qla_os.c | 6 +- drivers/scsi/qla2xxx/qla_target.c | 10 +- drivers/scsi/qla2xxx/qla_target.h | 2 +- drivers/scsi/qla4xxx/ql4_def.h | 2 +- drivers/scsi/qla4xxx/ql4_os.c | 6 +- drivers/scsi/scsi.c | 2 +- drivers/scsi/scsi_lib.c | 8 +- drivers/scsi/scsi_sysfs.c | 2 +- drivers/scsi/scsi_transport_fc.c | 8 +- drivers/scsi/scsi_transport_iscsi.c | 6 +- drivers/scsi/scsi_transport_srp.c | 6 +- drivers/scsi/sd.c | 6 +- drivers/scsi/sg.c | 2 +- drivers/scsi/sr.c | 21 +- drivers/soc/tegra/fuse/fuse-tegra.c | 2 +- drivers/spi/spi.c | 2 +- drivers/staging/android/timed_output.c | 6 +- drivers/staging/comedi/comedi_fops.c | 8 +- drivers/staging/fbtft/fbtft-core.c | 2 +- drivers/staging/fbtft/fbtft.h | 2 +- drivers/staging/gdm724x/gdm_tty.c | 2 +- drivers/staging/iio/accel/lis3l02dq_ring.c | 2 +- drivers/staging/iio/adc/ad7280a.c | 4 +- drivers/staging/lustre/lnet/selftest/brw_test.c | 12 +- drivers/staging/lustre/lnet/selftest/framework.c | 4 - drivers/staging/lustre/lnet/selftest/ping_test.c | 14 +- drivers/staging/lustre/lustre/include/lustre_dlm.h | 2 +- drivers/staging/lustre/lustre/include/obd.h | 2 +- drivers/staging/octeon/ethernet-rx.c | 20 +- drivers/staging/octeon/ethernet.c | 8 +- drivers/staging/rdma/ipath/ipath_rc.c | 6 +- drivers/staging/rdma/ipath/ipath_ruc.c | 6 +- drivers/staging/rtl8188eu/include/hal_intf.h | 2 +- drivers/staging/rtl8712/rtl871x_io.h | 2 +- drivers/staging/sm750fb/sm750.c | 14 +- drivers/staging/unisys/visorbus/visorbus_private.h | 4 +- drivers/target/sbp/sbp_target.c | 4 +- drivers/thermal/cpu_cooling.c | 9 +- drivers/thermal/devfreq_cooling.c | 19 +- drivers/thermal/int340x_thermal/int3400_thermal.c | 6 +- drivers/thermal/of-thermal.c | 17 +- drivers/thermal/x86_pkg_temp_thermal.c | 2 +- drivers/tty/cyclades.c | 6 +- drivers/tty/hvc/hvc_console.c | 14 +- drivers/tty/hvc/hvcs.c | 21 +- drivers/tty/hvc/hvsi.c | 22 +- drivers/tty/hvc/hvsi_lib.c | 4 +- drivers/tty/ipwireless/tty.c | 27 +- drivers/tty/moxa.c | 2 +- drivers/tty/n_gsm.c | 4 +- drivers/tty/n_tty.c | 19 +- drivers/tty/pty.c | 4 +- drivers/tty/rocket.c | 6 +- drivers/tty/serial/8250/8250_core.c | 10 +- drivers/tty/serial/ifx6x60.c | 2 +- drivers/tty/serial/ioc4_serial.c | 6 +- drivers/tty/serial/kgdb_nmi.c | 4 +- drivers/tty/serial/kgdboc.c | 32 +- drivers/tty/serial/msm_serial.c | 4 +- drivers/tty/serial/samsung.c | 9 +- drivers/tty/serial/serial_core.c | 8 +- drivers/tty/synclink.c | 34 +- drivers/tty/synclink_gt.c | 28 +- drivers/tty/synclinkmp.c | 34 +- drivers/tty/tty_io.c | 2 +- drivers/tty/tty_ldisc.c | 8 +- drivers/tty/tty_port.c | 22 +- drivers/uio/uio.c | 13 +- drivers/usb/atm/cxacru.c | 2 +- drivers/usb/atm/usbatm.c | 24 +- drivers/usb/class/cdc-acm.h | 2 +- drivers/usb/core/devices.c | 6 +- drivers/usb/core/devio.c | 12 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/sysfs.c | 2 +- drivers/usb/core/usb.c | 2 +- drivers/usb/early/ehci-dbgp.c | 16 +- drivers/usb/gadget/function/u_serial.c | 22 +- drivers/usb/gadget/udc/dummy_hcd.c | 2 +- drivers/usb/host/ehci-hcd.c | 2 +- drivers/usb/host/ehci-hub.c | 4 +- drivers/usb/host/ehci-q.c | 4 +- drivers/usb/host/fotg210-hcd.c | 2 +- drivers/usb/host/hwa-hc.c | 2 +- drivers/usb/host/ohci-hcd.c | 2 +- drivers/usb/host/r8a66597.h | 2 +- drivers/usb/host/uhci-hcd.c | 2 +- drivers/usb/host/xhci-pci.c | 2 +- drivers/usb/host/xhci.c | 2 +- drivers/usb/misc/appledisplay.c | 4 +- drivers/usb/serial/console.c | 8 +- drivers/usb/storage/transport.c | 2 +- drivers/usb/storage/usb.c | 2 +- drivers/usb/storage/usb.h | 2 +- drivers/usb/usbip/vhci.h | 2 +- drivers/usb/usbip/vhci_hcd.c | 6 +- drivers/usb/usbip/vhci_rx.c | 2 +- drivers/usb/wusbcore/wa-hc.h | 4 +- drivers/usb/wusbcore/wa-xfer.c | 2 +- drivers/vhost/vringh.c | 20 +- drivers/video/backlight/kb3886_bl.c | 2 +- drivers/video/console/fbcon.c | 2 +- drivers/video/fbdev/aty/aty128fb.c | 2 +- drivers/video/fbdev/aty/atyfb_base.c | 8 +- drivers/video/fbdev/aty/mach64_cursor.c | 5 +- drivers/video/fbdev/core/fb_defio.c | 6 +- drivers/video/fbdev/core/fbmem.c | 12 +- drivers/video/fbdev/hyperv_fb.c | 4 +- drivers/video/fbdev/i810/i810_accel.c | 1 + drivers/video/fbdev/matrox/matroxfb_base.c | 2 +- drivers/video/fbdev/mb862xx/mb862xxfb_accel.c | 16 +- drivers/video/fbdev/nvidia/nvidia.c | 27 +- drivers/video/fbdev/omap2/dss/display.c | 8 +- drivers/video/fbdev/s1d13xxxfb.c | 6 +- drivers/video/fbdev/smscufx.c | 4 +- drivers/video/fbdev/udlfb.c | 36 +- drivers/video/fbdev/uvesafb.c | 52 +- drivers/video/fbdev/vesafb.c | 58 +- drivers/video/fbdev/via/via_clock.h | 2 +- drivers/xen/events/events_base.c | 6 +- fs/Kconfig.binfmt | 2 +- fs/afs/inode.c | 4 +- fs/aio.c | 2 +- fs/autofs4/waitq.c | 2 +- fs/befs/endian.h | 6 +- fs/binfmt_aout.c | 23 +- fs/binfmt_elf.c | 670 +- fs/binfmt_elf_fdpic.c | 4 +- fs/block_dev.c | 2 +- fs/btrfs/ctree.c | 11 +- fs/btrfs/ctree.h | 4 +- fs/btrfs/delayed-inode.c | 9 +- fs/btrfs/delayed-inode.h | 6 +- fs/btrfs/delayed-ref.c | 4 +- fs/btrfs/disk-io.c | 4 +- fs/btrfs/extent_map.c | 8 +- fs/btrfs/file.c | 4 +- fs/btrfs/inode.c | 14 +- fs/btrfs/raid56.c | 32 +- fs/btrfs/super.c | 2 +- fs/btrfs/sysfs.c | 2 +- fs/btrfs/tests/btrfs-tests.c | 2 +- fs/btrfs/tests/free-space-tests.c | 8 +- fs/btrfs/transaction.c | 2 +- fs/btrfs/tree-log.c | 8 +- fs/btrfs/tree-log.h | 2 +- fs/btrfs/volumes.c | 14 +- fs/btrfs/volumes.h | 22 +- fs/buffer.c | 2 +- fs/cachefiles/bind.c | 6 +- fs/cachefiles/daemon.c | 8 +- fs/cachefiles/internal.h | 12 +- fs/cachefiles/namei.c | 2 +- fs/cachefiles/proc.c | 12 +- fs/ceph/dir.c | 12 +- fs/ceph/super.c | 4 +- fs/cifs/cifs_debug.c | 12 +- fs/cifs/cifsfs.c | 8 +- fs/cifs/cifsglob.h | 54 +- fs/cifs/file.c | 12 +- fs/cifs/misc.c | 4 +- fs/cifs/smb1ops.c | 80 +- fs/cifs/smb2ops.c | 84 +- fs/cifs/smb2pdu.c | 3 +- fs/coda/cache.c | 10 +- fs/compat.c | 7 +- fs/compat_binfmt_elf.c | 2 + fs/compat_ioctl.c | 12 +- fs/configfs/dir.c | 10 +- fs/coredump.c | 18 +- fs/dcache.c | 64 +- fs/ecryptfs/inode.c | 2 +- fs/ecryptfs/miscdev.c | 2 +- fs/exec.c | 362 +- fs/ext2/xattr.c | 5 +- fs/ext4/ext4.h | 20 +- fs/ext4/mballoc.c | 44 +- fs/ext4/resize.c | 16 +- fs/ext4/super.c | 2 +- fs/ext4/sysfs.c | 2 +- fs/ext4/xattr.c | 5 +- fs/fhandle.c | 5 +- fs/file.c | 18 +- fs/fs-writeback.c | 11 +- fs/fs_struct.c | 8 +- fs/fscache/cookie.c | 40 +- fs/fscache/internal.h | 202 +- fs/fscache/object.c | 26 +- fs/fscache/operation.c | 38 +- fs/fscache/page.c | 110 +- fs/fscache/stats.c | 348 +- fs/fuse/cuse.c | 10 +- fs/fuse/dev.c | 4 +- fs/gfs2/file.c | 2 +- fs/gfs2/glock.c | 22 +- fs/gfs2/glops.c | 4 +- fs/gfs2/quota.c | 6 +- fs/hugetlbfs/inode.c | 13 +- fs/inode.c | 4 +- fs/jbd2/commit.c | 2 +- fs/jbd2/transaction.c | 4 +- fs/jffs2/erase.c | 3 +- fs/jffs2/wbuf.c | 3 +- fs/jfs/super.c | 2 +- fs/kernfs/dir.c | 2 +- fs/kernfs/file.c | 20 +- fs/libfs.c | 10 +- fs/lockd/clntproc.c | 4 +- fs/namei.c | 16 +- fs/namespace.c | 16 +- fs/nfs/callback_xdr.c | 2 +- fs/nfs/inode.c | 6 +- fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfs4xdr.c | 2 +- fs/nfsd/nfscache.c | 11 +- fs/nfsd/vfs.c | 6 +- fs/nls/nls_base.c | 26 +- fs/nls/nls_euc-jp.c | 6 +- fs/nls/nls_koi8-ru.c | 6 +- fs/notify/fanotify/fanotify_user.c | 4 +- fs/notify/notification.c | 4 +- fs/ntfs/dir.c | 2 +- fs/ntfs/super.c | 6 +- fs/ocfs2/dlm/dlmcommon.h | 4 +- fs/ocfs2/dlm/dlmdebug.c | 10 +- fs/ocfs2/dlm/dlmdomain.c | 4 +- fs/ocfs2/dlm/dlmmaster.c | 4 +- fs/ocfs2/localalloc.c | 2 +- fs/ocfs2/ocfs2.h | 10 +- fs/ocfs2/suballoc.c | 12 +- fs/ocfs2/super.c | 20 +- fs/overlayfs/copy_up.c | 2 +- fs/pipe.c | 72 +- fs/posix_acl.c | 4 +- fs/proc/array.c | 20 + fs/proc/base.c | 4 +- fs/proc/kcore.c | 34 +- fs/proc/meminfo.c | 2 +- fs/proc/nommu.c | 2 +- fs/proc/proc_sysctl.c | 26 +- fs/proc/task_mmu.c | 42 +- fs/proc/task_nommu.c | 4 +- fs/proc/vmcore.c | 16 +- fs/qnx6/qnx6.h | 4 +- fs/quota/netlink.c | 4 +- fs/read_write.c | 2 +- fs/readdir.c | 3 +- fs/reiserfs/do_balan.c | 2 +- fs/reiserfs/procfs.c | 2 +- fs/reiserfs/reiserfs.h | 4 +- fs/seq_file.c | 4 +- fs/splice.c | 43 +- fs/squashfs/xattr.c | 12 +- fs/super.c | 3 +- fs/sysv/sysv.h | 2 +- fs/tracefs/inode.c | 8 +- fs/udf/misc.c | 2 +- fs/ufs/swab.h | 4 +- fs/userfaultfd.c | 2 +- fs/xattr.c | 21 + fs/xfs/libxfs/xfs_bmap.c | 2 +- fs/xfs/libxfs/xfs_da_btree.c | 4 +- fs/xfs/xfs_dir2_readdir.c | 7 +- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_linux.h | 4 +- include/acpi/ghes.h | 2 +- include/asm-generic/4level-fixup.h | 2 + include/asm-generic/atomic-long.h | 176 +- include/asm-generic/atomic64.h | 12 + include/asm-generic/bitops/__fls.h | 2 +- include/asm-generic/bitops/fls.h | 2 +- include/asm-generic/bitops/fls64.h | 4 +- include/asm-generic/bug.h | 6 +- include/asm-generic/cache.h | 4 +- include/asm-generic/emergency-restart.h | 2 +- include/asm-generic/kmap_types.h | 4 +- include/asm-generic/local.h | 13 + include/asm-generic/pgtable-nopmd.h | 18 +- include/asm-generic/pgtable-nopud.h | 15 +- include/asm-generic/pgtable.h | 16 + include/asm-generic/sections.h | 1 + include/asm-generic/uaccess.h | 16 + include/asm-generic/vmlinux.lds.h | 15 +- include/crypto/algapi.h | 2 +- include/drm/drmP.h | 19 +- include/drm/drm_crtc_helper.h | 2 +- include/drm/drm_mm.h | 2 +- include/drm/i915_pciids.h | 2 +- include/drm/intel-gtt.h | 4 +- include/drm/ttm/ttm_memory.h | 2 +- include/drm/ttm/ttm_page_alloc.h | 1 + include/keys/asymmetric-subtype.h | 2 +- include/linux/atmdev.h | 4 +- include/linux/atomic.h | 2 +- include/linux/audit.h | 2 +- include/linux/average.h | 2 +- include/linux/binfmts.h | 3 +- include/linux/bitmap.h | 2 +- include/linux/bitops.h | 8 +- include/linux/blk-cgroup.h | 24 +- include/linux/blkdev.h | 2 +- include/linux/blktrace_api.h | 2 +- include/linux/cache.h | 8 + include/linux/cdrom.h | 1 - include/linux/cleancache.h | 2 +- include/linux/clk-provider.h | 1 + include/linux/compat.h | 6 +- include/linux/compiler-gcc.h | 28 +- include/linux/compiler.h | 193 +- include/linux/configfs.h | 2 +- include/linux/cpufreq.h | 3 +- include/linux/cpuidle.h | 5 +- include/linux/cpumask.h | 14 +- include/linux/crypto.h | 4 +- include/linux/ctype.h | 2 +- include/linux/dcache.h | 4 +- include/linux/decompress/mm.h | 2 +- include/linux/devfreq.h | 2 +- include/linux/device.h | 7 +- include/linux/dma-mapping.h | 2 +- include/linux/efi.h | 1 + include/linux/elf.h | 2 + include/linux/err.h | 4 +- include/linux/extcon.h | 2 +- include/linux/fb.h | 3 +- include/linux/fdtable.h | 2 +- include/linux/fs.h | 5 +- include/linux/fs_struct.h | 2 +- include/linux/fscache-cache.h | 2 +- include/linux/fscache.h | 2 +- include/linux/fsnotify.h | 2 +- include/linux/genhd.h | 4 +- include/linux/genl_magic_func.h | 2 +- include/linux/gfp.h | 12 +- include/linux/highmem.h | 12 + include/linux/hwmon-sysfs.h | 6 +- include/linux/i2c.h | 1 + include/linux/if_pppox.h | 2 +- include/linux/init.h | 12 +- include/linux/init_task.h | 7 + include/linux/interrupt.h | 6 +- include/linux/iommu.h | 2 +- include/linux/ioport.h | 2 +- include/linux/ipc.h | 2 +- include/linux/irq.h | 5 +- include/linux/irqdesc.h | 2 +- include/linux/irqdomain.h | 3 + include/linux/jbd2.h | 2 +- include/linux/jiffies.h | 16 +- include/linux/key-type.h | 2 +- include/linux/kgdb.h | 6 +- include/linux/kmemleak.h | 4 +- include/linux/kobject.h | 3 +- include/linux/kobject_ns.h | 2 +- include/linux/kref.h | 2 +- include/linux/libata.h | 2 +- include/linux/linkage.h | 1 + include/linux/list.h | 15 + include/linux/lockref.h | 26 +- include/linux/math64.h | 10 +- include/linux/mempolicy.h | 7 + include/linux/mm.h | 102 +- include/linux/mm_types.h | 20 + include/linux/mmiotrace.h | 4 +- include/linux/mmzone.h | 2 +- include/linux/mod_devicetable.h | 4 +- include/linux/module.h | 69 +- include/linux/moduleloader.h | 16 + include/linux/moduleparam.h | 4 +- include/linux/net.h | 2 +- include/linux/netdevice.h | 7 +- include/linux/netfilter.h | 2 +- include/linux/netfilter/nfnetlink.h | 2 +- include/linux/netlink.h | 12 +- include/linux/nls.h | 4 +- include/linux/notifier.h | 3 +- include/linux/oprofile.h | 4 +- include/linux/padata.h | 2 +- include/linux/pci_hotplug.h | 3 +- include/linux/percpu.h | 2 +- include/linux/perf_event.h | 12 +- include/linux/pipe_fs_i.h | 8 +- include/linux/pm.h | 1 + include/linux/pm_domain.h | 2 +- include/linux/pm_runtime.h | 2 +- include/linux/pnp.h | 2 +- include/linux/poison.h | 4 +- include/linux/power/smartreflex.h | 2 +- include/linux/ppp-comp.h | 2 +- include/linux/preempt.h | 21 + include/linux/proc_ns.h | 2 +- include/linux/psci.h | 2 +- include/linux/quota.h | 2 +- include/linux/random.h | 19 +- include/linux/rculist.h | 16 + include/linux/rcupdate.h | 8 + include/linux/reboot.h | 14 +- include/linux/regset.h | 3 +- include/linux/relay.h | 2 +- include/linux/rio.h | 2 +- include/linux/rmap.h | 4 +- include/linux/sched.h | 76 +- include/linux/sched/sysctl.h | 1 + include/linux/scif.h | 2 +- include/linux/semaphore.h | 2 +- include/linux/seq_file.h | 1 + include/linux/seqlock.h | 10 + include/linux/signal.h | 2 +- include/linux/skbuff.h | 12 +- include/linux/slab.h | 47 +- include/linux/slab_def.h | 14 +- include/linux/slub_def.h | 2 +- include/linux/smp.h | 2 + include/linux/sock_diag.h | 2 +- include/linux/sonet.h | 2 +- include/linux/spinlock.h | 17 +- include/linux/srcu.h | 5 +- include/linux/sunrpc/addr.h | 8 +- include/linux/sunrpc/clnt.h | 2 +- include/linux/sunrpc/svc.h | 2 +- include/linux/sunrpc/svc_rdma.h | 18 +- include/linux/sunrpc/svcauth.h | 2 +- include/linux/swapops.h | 10 +- include/linux/swiotlb.h | 3 +- include/linux/syscalls.h | 23 +- include/linux/syscore_ops.h | 2 +- include/linux/sysctl.h | 3 +- include/linux/sysfs.h | 9 +- include/linux/sysrq.h | 3 +- include/linux/tcp.h | 14 +- include/linux/thread_info.h | 7 + include/linux/tty.h | 4 +- include/linux/tty_driver.h | 2 +- include/linux/tty_ldisc.h | 2 +- include/linux/types.h | 16 + include/linux/uaccess.h | 2 +- include/linux/uio_driver.h | 2 +- include/linux/unaligned/access_ok.h | 24 +- include/linux/usb.h | 12 +- include/linux/usb/hcd.h | 1 + include/linux/usb/renesas_usbhs.h | 2 +- include/linux/vermagic.h | 21 +- include/linux/vga_switcheroo.h | 8 +- include/linux/vmalloc.h | 7 +- include/linux/vmstat.h | 24 +- include/linux/writeback.h | 3 +- include/linux/xattr.h | 5 +- include/linux/zlib.h | 3 +- include/media/v4l2-dev.h | 2 +- include/media/v4l2-device.h | 2 +- include/net/9p/transport.h | 2 +- include/net/bluetooth/l2cap.h | 2 +- include/net/bonding.h | 2 +- include/net/caif/cfctrl.h | 6 +- include/net/cfg802154.h | 2 +- include/net/flow.h | 2 +- include/net/genetlink.h | 2 +- include/net/gro_cells.h | 2 +- include/net/inet_connection_sock.h | 2 +- include/net/inet_sock.h | 2 +- include/net/inetpeer.h | 2 +- include/net/ip_fib.h | 2 +- include/net/ip_vs.h | 8 +- include/net/ipv6.h | 2 +- include/net/irda/ircomm_tty.h | 1 + include/net/iucv/af_iucv.h | 2 +- include/net/llc_c_ac.h | 2 +- include/net/llc_c_ev.h | 4 +- include/net/llc_c_st.h | 2 +- include/net/llc_s_ac.h | 2 +- include/net/llc_s_st.h | 2 +- include/net/mac80211.h | 6 +- include/net/neighbour.h | 4 +- include/net/net_namespace.h | 18 +- include/net/netlink.h | 2 +- include/net/netns/conntrack.h | 6 +- include/net/netns/ipv4.h | 4 +- include/net/netns/ipv6.h | 4 +- include/net/netns/xfrm.h | 2 +- include/net/ping.h | 2 +- include/net/protocol.h | 4 +- include/net/rtnetlink.h | 2 +- include/net/sctp/checksum.h | 4 +- include/net/sctp/sm.h | 4 +- include/net/sctp/structs.h | 2 +- include/net/snmp.h | 10 +- include/net/sock.h | 12 +- include/net/tcp.h | 8 +- include/net/xfrm.h | 13 +- include/rdma/iw_cm.h | 2 +- include/scsi/libfc.h | 3 +- include/scsi/scsi_device.h | 6 +- include/scsi/scsi_driver.h | 2 +- include/scsi/scsi_transport_fc.h | 3 +- include/scsi/sg.h | 2 +- include/sound/compress_driver.h | 2 +- include/sound/soc.h | 4 +- include/trace/events/irq.h | 4 +- include/uapi/linux/a.out.h | 8 + include/uapi/linux/bcache.h | 5 +- include/uapi/linux/byteorder/little_endian.h | 28 +- include/uapi/linux/connector.h | 2 +- include/uapi/linux/elf.h | 28 + include/uapi/linux/screen_info.h | 2 +- include/uapi/linux/swab.h | 6 +- include/uapi/linux/xattr.h | 4 + include/video/udlfb.h | 8 +- include/video/uvesafb.h | 1 + init/Kconfig | 2 +- init/Makefile | 3 + init/do_mounts.c | 14 +- init/do_mounts.h | 8 +- init/do_mounts_initrd.c | 30 +- init/do_mounts_md.c | 6 +- init/init_task.c | 4 + init/initramfs.c | 38 +- init/main.c | 30 +- ipc/compat.c | 4 +- ipc/ipc_sysctl.c | 14 +- ipc/mq_sysctl.c | 4 +- ipc/sem.c | 4 +- ipc/shm.c | 6 + kernel/audit.c | 8 +- kernel/auditsc.c | 4 +- kernel/bpf/core.c | 7 +- kernel/capability.c | 3 + kernel/compat.c | 38 +- kernel/debug/debug_core.c | 16 +- kernel/debug/kdb/kdb_main.c | 4 +- kernel/events/core.c | 30 +- kernel/events/internal.h | 10 +- kernel/events/uprobes.c | 2 +- kernel/exit.c | 27 +- kernel/fork.c | 175 +- kernel/futex.c | 11 +- kernel/futex_compat.c | 2 +- kernel/gcov/base.c | 7 +- kernel/irq/manage.c | 2 +- kernel/irq/msi.c | 19 +- kernel/irq/spurious.c | 2 +- kernel/jump_label.c | 5 + kernel/kallsyms.c | 37 +- kernel/kexec.c | 3 +- kernel/kmod.c | 8 +- kernel/kprobes.c | 4 +- kernel/ksysfs.c | 2 +- kernel/locking/lockdep.c | 7 +- kernel/locking/mutex-debug.c | 12 +- kernel/locking/mutex-debug.h | 4 +- kernel/locking/mutex.c | 6 +- kernel/module.c | 422 +- kernel/notifier.c | 17 +- kernel/padata.c | 4 +- kernel/panic.c | 5 +- kernel/pid.c | 2 +- kernel/pid_namespace.c | 2 +- kernel/power/process.c | 12 +- kernel/profile.c | 14 +- kernel/ptrace.c | 8 +- kernel/rcu/rcutorture.c | 60 +- kernel/rcu/tiny.c | 4 +- kernel/rcu/tree.c | 42 +- kernel/rcu/tree.h | 16 +- kernel/rcu/tree_plugin.h | 18 +- kernel/rcu/tree_trace.c | 14 +- kernel/resource.c | 4 +- kernel/sched/auto_group.c | 4 +- kernel/sched/core.c | 45 +- kernel/sched/fair.c | 2 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 24 +- kernel/smpboot.c | 4 +- kernel/softirq.c | 12 +- kernel/sys.c | 10 +- kernel/sysctl.c | 34 +- kernel/time/alarmtimer.c | 2 +- kernel/time/posix-cpu-timers.c | 4 +- kernel/time/posix-timers.c | 24 +- kernel/time/timer.c | 2 +- kernel/time/timer_stats.c | 10 +- kernel/trace/blktrace.c | 6 +- kernel/trace/ftrace.c | 15 +- kernel/trace/ring_buffer.c | 96 +- kernel/trace/trace.c | 2 +- kernel/trace/trace.h | 2 +- kernel/trace/trace_clock.c | 4 +- kernel/trace/trace_events.c | 1 - kernel/trace/trace_functions_graph.c | 4 +- kernel/trace/trace_mmiotrace.c | 8 +- kernel/trace/trace_output.c | 10 +- kernel/trace/trace_seq.c | 2 +- kernel/trace/trace_stack.c | 2 +- kernel/user.c | 2 +- kernel/user_namespace.c | 2 +- kernel/utsname_sysctl.c | 2 +- kernel/watchdog.c | 2 +- kernel/workqueue.c | 8 +- lib/Kconfig.debug | 8 +- lib/Makefile | 2 +- lib/bitmap.c | 8 +- lib/bug.c | 2 + lib/debugobjects.c | 2 +- lib/decompress_bunzip2.c | 3 +- lib/decompress_unlzma.c | 4 +- lib/div64.c | 4 +- lib/dma-debug.c | 4 +- lib/inflate.c | 2 +- lib/ioremap.c | 4 +- lib/kobject.c | 4 +- lib/list_debug.c | 126 +- lib/lockref.c | 44 +- lib/percpu-refcount.c | 2 +- lib/radix-tree.c | 2 +- lib/random32.c | 2 +- lib/rhashtable.c | 4 +- lib/show_mem.c | 2 +- lib/strncpy_from_user.c | 2 +- lib/strnlen_user.c | 2 +- lib/swiotlb.c | 2 +- lib/usercopy.c | 6 + lib/vsprintf.c | 12 +- mm/Kconfig | 6 +- mm/backing-dev.c | 4 +- mm/debug.c | 3 + mm/filemap.c | 2 +- mm/gup.c | 13 +- mm/highmem.c | 6 +- mm/hugetlb.c | 70 +- mm/internal.h | 1 + mm/maccess.c | 12 +- mm/madvise.c | 37 + mm/memory-failure.c | 6 +- mm/memory.c | 424 +- mm/mempolicy.c | 25 + mm/mlock.c | 18 +- mm/mm_init.c | 2 +- mm/mmap.c | 582 +- mm/mprotect.c | 137 +- mm/mremap.c | 39 +- mm/nommu.c | 21 +- mm/page-writeback.c | 2 +- mm/page_alloc.c | 50 +- mm/percpu.c | 2 +- mm/process_vm_access.c | 14 +- mm/rmap.c | 45 +- mm/shmem.c | 19 +- mm/slab.c | 111 +- mm/slab.h | 22 +- mm/slab_common.c | 86 +- mm/slob.c | 218 +- mm/slub.c | 109 +- mm/sparse-vmemmap.c | 4 +- mm/sparse.c | 2 +- mm/swap.c | 2 + mm/swapfile.c | 12 +- mm/util.c | 6 + mm/vmalloc.c | 114 +- mm/vmstat.c | 12 +- net/8021q/vlan.c | 5 +- net/8021q/vlan_netlink.c | 2 +- net/9p/mod.c | 4 +- net/9p/trans_fd.c | 2 +- net/atm/atm_misc.c | 8 +- net/atm/lec.h | 2 +- net/atm/proc.c | 6 +- net/atm/resources.c | 4 +- net/ax25/sysctl_net_ax25.c | 2 +- net/batman-adv/bat_iv_ogm.c | 8 +- net/batman-adv/fragmentation.c | 2 +- net/batman-adv/routing.c | 4 +- net/batman-adv/soft-interface.c | 10 +- net/batman-adv/translation-table.c | 14 +- net/batman-adv/types.h | 8 +- net/bluetooth/hci_sock.c | 2 +- net/bluetooth/l2cap_core.c | 6 +- net/bluetooth/l2cap_sock.c | 12 +- net/bluetooth/rfcomm/sock.c | 4 +- net/bluetooth/rfcomm/tty.c | 4 +- net/bridge/br_netlink.c | 2 +- net/bridge/netfilter/ebtables.c | 6 +- net/caif/cfctrl.c | 11 +- net/caif/chnl_net.c | 2 +- net/can/af_can.c | 2 +- net/can/gw.c | 6 +- net/ceph/messenger.c | 4 +- net/compat.c | 26 +- net/core/datagram.c | 2 +- net/core/dev.c | 16 +- net/core/filter.c | 2 +- net/core/flow.c | 6 +- net/core/neighbour.c | 18 +- net/core/net-sysfs.c | 2 +- net/core/net_namespace.c | 8 +- net/core/netpoll.c | 4 +- net/core/rtnetlink.c | 17 +- net/core/scm.c | 12 +- net/core/skbuff.c | 11 +- net/core/sock.c | 28 +- net/core/sock_diag.c | 15 +- net/core/sysctl_net_core.c | 22 +- net/decnet/af_decnet.c | 1 + net/decnet/sysctl_net_decnet.c | 4 +- net/dsa/dsa.c | 2 +- net/hsr/hsr_netlink.c | 2 +- net/ieee802154/6lowpan/core.c | 2 +- net/ieee802154/6lowpan/reassembly.c | 14 +- net/ipv4/af_inet.c | 2 +- net/ipv4/arp.c | 2 +- net/ipv4/devinet.c | 18 +- net/ipv4/fib_frontend.c | 6 +- net/ipv4/fib_semantics.c | 2 +- net/ipv4/inet_connection_sock.c | 4 +- net/ipv4/inet_diag.c | 4 +- net/ipv4/inet_timewait_sock.c | 2 +- net/ipv4/inetpeer.c | 2 +- net/ipv4/ip_fragment.c | 15 +- net/ipv4/ip_gre.c | 6 +- net/ipv4/ip_sockglue.c | 2 +- net/ipv4/ip_vti.c | 4 +- net/ipv4/ipconfig.c | 6 +- net/ipv4/ipip.c | 4 +- net/ipv4/netfilter/arp_tables.c | 12 +- net/ipv4/netfilter/ip_tables.c | 12 +- net/ipv4/ping.c | 14 +- net/ipv4/proc.c | 8 +- net/ipv4/raw.c | 14 +- net/ipv4/route.c | 32 +- net/ipv4/sysctl_net_ipv4.c | 22 +- net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_probe.c | 2 +- net/ipv4/udp.c | 10 +- net/ipv4/xfrm4_mode_transport.c | 2 +- net/ipv4/xfrm4_policy.c | 17 +- net/ipv4/xfrm4_state.c | 4 +- net/ipv6/addrconf.c | 22 +- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/icmp.c | 2 +- net/ipv6/ip6_fib.c | 4 +- net/ipv6/ip6_gre.c | 10 +- net/ipv6/ip6_tunnel.c | 4 +- net/ipv6/ip6_vti.c | 4 +- net/ipv6/ipv6_sockglue.c | 2 +- net/ipv6/ndisc.c | 2 +- net/ipv6/netfilter/ip6_tables.c | 12 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 14 +- net/ipv6/ping.c | 33 +- net/ipv6/proc.c | 10 +- net/ipv6/raw.c | 17 +- net/ipv6/reassembly.c | 13 +- net/ipv6/route.c | 2 +- net/ipv6/sit.c | 4 +- net/ipv6/sysctl_net_ipv6.c | 2 +- net/ipv6/udp.c | 6 +- net/ipv6/xfrm6_policy.c | 17 +- net/irda/ircomm/ircomm_tty.c | 18 +- net/iucv/af_iucv.c | 4 +- net/iucv/iucv.c | 2 +- net/key/af_key.c | 4 +- net/l2tp/l2tp_eth.c | 38 +- net/l2tp/l2tp_ip.c | 2 +- net/l2tp/l2tp_ip6.c | 2 +- net/mac80211/cfg.c | 10 +- net/mac80211/debugfs_key.c | 4 +- net/mac80211/ieee80211_i.h | 3 +- net/mac80211/iface.c | 20 +- net/mac80211/key.c | 4 +- net/mac80211/main.c | 2 +- net/mac80211/pm.c | 4 +- net/mac80211/rate.c | 2 +- net/mac80211/sta_info.c | 2 +- net/mac80211/tx.c | 2 +- net/mac80211/util.c | 8 +- net/mac80211/wpa.c | 10 +- net/mac802154/iface.c | 4 +- net/mpls/af_mpls.c | 6 +- net/netfilter/ipset/ip_set_core.c | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 6 +- net/netfilter/ipvs/ip_vs_core.c | 4 +- net/netfilter/ipvs/ip_vs_ctl.c | 14 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 2 +- net/netfilter/ipvs/ip_vs_sync.c | 6 +- net/netfilter/ipvs/ip_vs_xmit.c | 4 +- net/netfilter/nf_conntrack_acct.c | 2 +- net/netfilter/nf_conntrack_ecache.c | 2 +- net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 22 +- net/netfilter/nf_conntrack_proto.c | 2 +- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_conntrack_timestamp.c | 2 +- net/netfilter/nf_log.c | 10 +- net/netfilter/nf_sockopt.c | 4 +- net/netfilter/nf_tables_api.c | 13 +- net/netfilter/nfnetlink_acct.c | 7 +- net/netfilter/nfnetlink_cthelper.c | 2 +- net/netfilter/nfnetlink_cttimeout.c | 2 +- net/netfilter/nfnetlink_log.c | 4 +- net/netfilter/nft_compat.c | 9 +- net/netfilter/xt_statistic.c | 8 +- net/netlink/af_netlink.c | 14 +- net/netlink/diag.c | 2 +- net/netlink/genetlink.c | 14 +- net/openvswitch/vport-internal_dev.c | 2 +- net/packet/af_packet.c | 26 +- net/packet/diag.c | 2 +- net/packet/internal.h | 6 +- net/phonet/pep.c | 6 +- net/phonet/socket.c | 2 +- net/phonet/sysctl.c | 2 +- net/rds/cong.c | 6 +- net/rds/ib.h | 2 +- net/rds/ib_cm.c | 2 +- net/rds/ib_recv.c | 4 +- net/rds/iw.h | 2 +- net/rds/iw_cm.c | 2 +- net/rds/iw_recv.c | 4 +- net/rds/rds.h | 2 +- net/rds/tcp.c | 2 +- net/rds/tcp_send.c | 2 +- net/rxrpc/af_rxrpc.c | 2 +- net/rxrpc/ar-ack.c | 14 +- net/rxrpc/ar-call.c | 2 +- net/rxrpc/ar-connection.c | 2 +- net/rxrpc/ar-connevent.c | 2 +- net/rxrpc/ar-input.c | 4 +- net/rxrpc/ar-internal.h | 8 +- net/rxrpc/ar-local.c | 2 +- net/rxrpc/ar-output.c | 4 +- net/rxrpc/ar-peer.c | 2 +- net/rxrpc/ar-proc.c | 4 +- net/rxrpc/ar-transport.c | 2 +- net/rxrpc/rxkad.c | 4 +- net/sched/sch_generic.c | 4 +- net/sctp/ipv6.c | 6 +- net/sctp/protocol.c | 10 +- net/sctp/sm_sideeffect.c | 2 +- net/sctp/socket.c | 21 +- net/sctp/sysctl.c | 10 +- net/socket.c | 18 +- net/sunrpc/auth_gss/svcauth_gss.c | 4 +- net/sunrpc/clnt.c | 4 +- net/sunrpc/sched.c | 4 +- net/sunrpc/svc.c | 4 +- net/sunrpc/svcauth_unix.c | 2 +- net/sunrpc/xprtrdma/svc_rdma.c | 44 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 +- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_transport.c | 10 +- net/tipc/netlink_compat.c | 12 +- net/tipc/subscr.c | 2 +- net/unix/diag.c | 2 +- net/unix/sysctl_net_unix.c | 2 +- net/wireless/wext-core.c | 19 +- net/xfrm/xfrm_policy.c | 16 +- net/xfrm/xfrm_state.c | 33 +- net/xfrm/xfrm_sysctl.c | 2 +- net/xfrm/xfrm_user.c | 2 +- scripts/Kbuild.include | 2 +- scripts/Makefile.build | 2 +- scripts/Makefile.clean | 3 +- scripts/Makefile.host | 69 +- scripts/basic/fixdep.c | 12 +- scripts/dtc/checks.c | 14 +- scripts/dtc/data.c | 6 +- scripts/dtc/flattree.c | 8 +- scripts/dtc/livetree.c | 4 +- scripts/gcc-plugin.sh | 51 + scripts/headers_install.sh | 1 + scripts/kallsyms.c | 4 +- scripts/kconfig/lkc.h | 5 +- scripts/kconfig/menu.c | 2 +- scripts/kconfig/symbol.c | 6 +- scripts/link-vmlinux.sh | 2 +- scripts/mod/file2alias.c | 14 +- scripts/mod/modpost.c | 25 +- scripts/mod/modpost.h | 6 +- scripts/mod/sumversion.c | 2 +- scripts/module-common.lds | 4 + scripts/package/builddeb | 1 + scripts/pnmtologo.c | 6 +- scripts/sortextable.h | 6 +- scripts/tags.sh | 2 +- security/Kconfig | 691 +- security/apparmor/include/policy.h | 2 +- security/apparmor/policy.c | 4 +- security/integrity/ima/ima.h | 4 +- security/integrity/ima/ima_api.c | 2 +- security/integrity/ima/ima_fs.c | 4 +- security/integrity/ima/ima_queue.c | 2 +- security/keys/internal.h | 8 +- security/keys/key.c | 18 +- security/keys/keyring.c | 4 - security/selinux/avc.c | 6 +- security/selinux/include/xfrm.h | 2 +- security/yama/yama_lsm.c | 2 +- sound/aoa/codecs/onyx.c | 7 +- sound/aoa/codecs/onyx.h | 1 + sound/core/oss/pcm_oss.c | 18 +- sound/core/pcm_compat.c | 2 +- sound/core/pcm_native.c | 4 +- sound/core/seq/seq_clientmgr.c | 10 +- sound/core/seq/seq_compat.c | 2 +- sound/core/seq/seq_fifo.c | 6 +- sound/core/seq/seq_fifo.h | 2 +- sound/core/seq/seq_memory.c | 6 +- sound/core/sound.c | 2 +- sound/drivers/mts64.c | 14 +- sound/drivers/opl4/opl4_lib.c | 2 +- sound/drivers/portman2x4.c | 3 +- sound/firewire/amdtp-am824.c | 2 +- sound/firewire/amdtp-stream.c | 4 +- sound/firewire/amdtp-stream.h | 2 +- sound/firewire/digi00x/amdtp-dot.c | 2 +- sound/firewire/isight.c | 10 +- sound/firewire/scs1x.c | 8 +- sound/oss/sb_audio.c | 2 +- sound/oss/swarm_cs4297a.c | 6 +- sound/pci/hda/hda_codec.c | 2 +- sound/pci/ymfpci/ymfpci.h | 2 +- sound/pci/ymfpci/ymfpci_main.c | 12 +- sound/soc/codecs/sti-sas.c | 10 +- sound/soc/intel/skylake/skl-sst-dsp.h | 4 +- sound/soc/soc-ac97.c | 6 +- sound/soc/xtensa/xtfpga-i2s.c | 2 +- tools/gcc/Makefile | 42 + tools/gcc/checker_plugin.c | 549 + tools/gcc/colorize_plugin.c | 215 + tools/gcc/constify_plugin.c | 571 + tools/gcc/gcc-common.h | 819 + tools/gcc/initify_plugin.c | 591 + tools/gcc/kallocstat_plugin.c | 188 + tools/gcc/kernexec_plugin.c | 549 + tools/gcc/latent_entropy_plugin.c | 474 + tools/gcc/randomize_layout_seed.h | 1 + tools/gcc/size_overflow_plugin/.gitignore | 2 + tools/gcc/size_overflow_plugin/Makefile | 28 + .../disable_size_overflow_hash.data | 12434 ++ .../disable_size_overflow_hash.h | 152601 ++++++++++++++++++ .../generate_size_overflow_hash.sh | 103 + .../insert_size_overflow_asm.c | 416 + .../size_overflow_plugin/intentional_overflow.c | 1116 + .../size_overflow_plugin/remove_unnecessary_dup.c | 137 + tools/gcc/size_overflow_plugin/size_overflow.h | 325 + .../gcc/size_overflow_plugin/size_overflow_debug.c | 194 + .../size_overflow_plugin/size_overflow_hash.data | 21454 +++ .../size_overflow_hash_aux.data | 92 + tools/gcc/size_overflow_plugin/size_overflow_ipa.c | 1226 + .../gcc/size_overflow_plugin/size_overflow_misc.c | 505 + .../size_overflow_plugin/size_overflow_plugin.c | 318 + .../size_overflow_plugin_hash.c | 352 + .../size_overflow_plugin/size_overflow_transform.c | 745 + .../size_overflow_transform_core.c | 1015 + tools/gcc/stackleak_plugin.c | 444 + tools/gcc/structleak_plugin.c | 290 + tools/include/linux/compiler.h | 8 + tools/perf/util/include/asm/alternative-asm.h | 3 + tools/virtio/linux/uaccess.h | 2 +- virt/kvm/kvm_main.c | 42 +- 2088 files changed, 221599 insertions(+), 9618 deletions(-) commit 87790bbd0d8dc2bd7fd86cb947e32886db9e9766 Author: Matthew Wilcox Date: Tue Feb 2 16:57:52 2016 -0800 radix-tree: fix race in gang lookup If the indirect_ptr bit is set on a slot, that indicates we need to redo the lookup. Introduce a new function radix_tree_iter_retry() which forces the loop to retry the lookup by setting 'slot' to NULL and turning the iterator back to point at the problematic entry. This is a pretty rare problem to hit at the moment; the lookup has to race with a grow of the radix tree from a height of 0. The consequences of hitting this race are that gang lookup could return a pointer to a radix_tree_node instead of a pointer to whatever the user had inserted in the tree. Fixes: cebbd29e1c2f ("radix-tree: rewrite gang lookup using iterator") Signed-off-by: Matthew Wilcox Cc: Hugh Dickins Cc: Ohad Ben-Cohen Cc: Konstantin Khlebnikov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/radix-tree.h | 16 ++++++++++++++++ lib/radix-tree.c | 12 ++++++++++-- 2 files changed, 26 insertions(+), 2 deletions(-) commit bf628043b4589c910919a0f221ae7f42aa8cea93 Author: Hannes Frederic Sowa Date: Wed Feb 3 02:11:03 2016 +0100 unix: correctly track in-flight fds in sending process user_struct The commit referenced in the Fixes tag incorrectly accounted the number of in-flight fds over a unix domain socket to the original opener of the file-descriptor. This allows another process to arbitrary deplete the original file-openers resource limit for the maximum of open files. Instead the sending processes and its struct cred should be credited. To do so, we add a reference counted struct user_struct pointer to the scm_fp_list and use it to account for the number of inflight unix fds. Fixes: 712f4aad406bb1 ("unix: properly account for FDs passed over unix sockets") Reported-by: David Herrmann Cc: David Herrmann Cc: Willy Tarreau Cc: Linus Torvalds Suggested-by: Linus Torvalds Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller include/net/af_unix.h | 4 ++-- include/net/scm.h | 1 + net/core/scm.c | 7 +++++++ net/unix/af_unix.c | 4 ++-- net/unix/garbage.c | 8 ++++---- 5 files changed, 16 insertions(+), 8 deletions(-) commit e830db443ff78d70b7b63536e688d73907face0c Author: Mike Kravetz Date: Fri Jan 15 16:57:37 2016 -0800 fs/hugetlbfs/inode.c: fix bugs in hugetlb_vmtruncate_list() Hillf Danton noticed bugs in the hugetlb_vmtruncate_list routine. The argument end is of type pgoff_t. It was being converted to a vaddr offset and passed to unmap_hugepage_range. However, end was also being used as an argument to the vma_interval_tree_foreach controlling loop. In addition, the conversion of end to vaddr offset was incorrect. hugetlb_vmtruncate_list is called as part of a file truncate or fallocate hole punch operation. When truncating a hugetlbfs file, this bug could prevent some pages from being unmapped. This is possible if there are multiple vmas mapping the file, and there is a sufficiently sized hole between the mappings. The size of the hole between two vmas (A,B) must be such that the starting virtual address of B is greater than (ending virtual address of A << PAGE_SHIFT). In this case, the pages in B would not be unmapped. If pages are not properly unmapped during truncate, the following BUG is hit: kernel BUG at fs/hugetlbfs/inode.c:428! In the fallocate hole punch case, this bug could prevent pages from being unmapped as in the truncate case. However, for hole punch the result is that unmapped pages will not be removed during the operation. For hole punch, it is also possible that more pages than desired will be unmapped. This unnecessary unmapping will cause page faults to reestablish the mappings on subsequent page access. Fixes: 1bfad99ab (" hugetlbfs: hugetlb_vmtruncate_list() needs to take a range")Reported-by: Hillf Danton Signed-off-by: Mike Kravetz Cc: Hugh Dickins Cc: Naoya Horiguchi Cc: Davidlohr Bueso Cc: Dave Hansen Cc: [4.3] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/hugetlbfs/inode.c | 19 +++++++++++-------- 1 files changed, 11 insertions(+), 8 deletions(-) commit cdb3ba4a9113b779347387f3b6c6ea72dd4db12f Author: Takashi Iwai Date: Thu Feb 4 17:06:13 2016 +0100 ALSA: timer: Fix leftover link at closing In ALSA timer core, the active timer instance is managed in active_list linked list. Each element is added / removed dynamically at timer start, stop and in timer interrupt. The problem is that snd_timer_interrupt() has a thinko and leaves the element in active_list when it's the last opened element. This eventually leads to list corruption or use-after-free error. This hasn't been revealed because we used to delete the list forcibly in snd_timer_stop() in the past. However, the recent fix avoids the double-stop behavior (in commit [f784beb75ce8: ALSA: timer: Fix link corruption due to double start or stop]), and this leak hits reality. This patch fixes the link management in snd_timer_interrupt(). Now it simply unlinks no matter which stream is. BugLink: http://lkml.kernel.org/r/CACT4Y+Yy2aukHP-EDp8-ziNqNNmb-NTf=jDWXMP7jB8HDa2vng@mail.gmail.com Reported-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/timer.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit 47d9647902f6a2f46a2be1e0140ba0f6f8c06008 Author: Konstantin Khlebnikov Date: Fri Feb 5 15:37:01 2016 -0800 radix-tree: fix oops after radix_tree_iter_retry Helper radix_tree_iter_retry() resets next_index to the current index. In following radix_tree_next_slot current chunk size becomes zero. This isn't checked and it tries to dereference null pointer in slot. Tagged iterator is fine because retry happens only at slot 0 where tag bitmask in iter->tags is filled with single bit. Fixes: 46437f9a554f ("radix-tree: fix race in gang lookup") Signed-off-by: Konstantin Khlebnikov Cc: Matthew Wilcox Cc: Hugh Dickins Cc: Ohad Ben-Cohen Cc: Jeremiah Mahler Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/radix-tree.h | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) commit 95b5dcb3c01958502af00b0bc0da1d906aae11a2 Merge: 438be0b 256aeaf Author: Brad Spengler Date: Sun Feb 7 08:29:33 2016 -0500 Merge branch 'pax-test' into grsec-test commit 256aeaf87c22de8edf1f03682a572c590ae07771 Author: Brad Spengler Date: Sun Feb 7 08:29:09 2016 -0500 Update to pax-linux-4.3.5-test28.patch: - fixed an integer truncation bug in numa_clear_kernel_node_hotplug caught by the size overflow plugin, reported by x14sg1 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4374) - spender fixed UDEREF on arm arch/arm/Kconfig | 1 + arch/arm/include/asm/domain.h | 21 ++++++++- arch/arm/include/asm/futex.h | 9 ---- arch/arm/include/asm/thread_info.h | 3 + arch/arm/include/asm/uaccess.h | 81 +++++++++++++++--------------------- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/kernel/process.c | 2 +- arch/arm/mm/alignment.c | 8 ---- arch/x86/mm/numa.c | 2 +- security/Kconfig | 1 - 10 files changed, 60 insertions(+), 70 deletions(-) commit 438be0bd112bd17942b2628c53054dc1007558a1 Author: Brad Spengler Date: Sat Feb 6 19:50:31 2016 -0500 Fix a number of issues caused by the upstream merging of a UDEREF ripoff resulting in unbootable ARM systems reported on the forums arch/arm/Kconfig | 1 + arch/arm/include/asm/domain.h | 21 ++++++++- arch/arm/include/asm/futex.h | 9 ---- arch/arm/include/asm/thread_info.h | 3 + arch/arm/include/asm/uaccess.h | 81 +++++++++++++++--------------------- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/kernel/process.c | 2 +- arch/arm/mm/alignment.c | 8 ---- security/Kconfig | 1 - 9 files changed, 59 insertions(+), 69 deletions(-) commit 4ffdd5ef1f87e611af1efb4f251ada92abe9f4c0 Author: Brad Spengler Date: Sat Feb 6 11:21:53 2016 -0500 Fix another compiler warning net/ipv4/tcp_input.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) commit 30b5b7bc0fd67d458bdd5ab35e4689769eabd2ed Author: Brad Spengler Date: Sat Feb 6 11:16:12 2016 -0500 Fix two compiler warnings kernel/pid.c | 5 ++--- kernel/ptrace.c | 3 ++- 2 files changed, 4 insertions(+), 4 deletions(-) commit dda4d2a21914c480750f10bd55c6e3203d415d8d Author: Brad Spengler Date: Wed Feb 3 21:22:40 2016 -0500 Apply fix for integer truncation in NUMA init code, reported by x14sg1 on the forums: https://forums.grsecurity.net/viewtopic.php?f=3&t=4374 arch/x86/mm/numa.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 477505f7c893cb6a2c3e22f83eefd9c985d7b3ca Merge: a781740 016d0d8 Author: Brad Spengler Date: Wed Feb 3 21:20:58 2016 -0500 Merge branch 'pax-test' into grsec-test commit 016d0d81a8dd4be1304c82a68e0ccf425868f467 Author: Brad Spengler Date: Wed Feb 3 21:20:10 2016 -0500 Update to pax-linux-4.3.5-test27.patch: - fixed a bunch of potential REFCOUNT false positives, reported by Emese - restored padding in fpregs_state for storing AVX-512 state in the future - constified netlink_dump_control - added const version of debug_gimple_stmt for gcc plugins, by Emese - Emese fixed a bug in initify that could have initified too much - Emese fixed a false positive intentional integer overflow in xfrm4_extract_header, reported by corsac arch/x86/include/asm/fpu/types.h | 1 + arch/x86/include/asm/mmu_context.h | 2 +- block/blk-cgroup.c | 18 ++-- block/cfq-iosched.c | 4 +- crypto/crypto_user.c | 8 ++- drivers/acpi/apei/ghes.c | 6 +- drivers/char/ipmi/ipmi_ssif.c | 12 ++-- drivers/gpu/drm/amd/scheduler/gpu_scheduler.c | 2 +- drivers/gpu/drm/amd/scheduler/gpu_scheduler.h | 2 +- drivers/gpu/drm/amd/scheduler/sched_fence.c | 2 +- drivers/infiniband/core/netlink.c | 5 +- drivers/infiniband/hw/cxgb4/device.c | 6 +- drivers/infiniband/hw/cxgb4/iw_cxgb4.h | 2 +- drivers/md/bcache/alloc.c | 2 +- drivers/md/bcache/bcache.h | 10 +- drivers/md/bcache/btree.c | 2 +- drivers/md/bcache/io.c | 10 +- drivers/md/bcache/journal.c | 2 +- drivers/md/bcache/stats.c | 26 +++--- drivers/md/bcache/stats.h | 16 ++-- drivers/md/bcache/super.c | 2 +- drivers/md/bcache/sysfs.c | 20 +++--- drivers/md/dm-cache-target.c | 98 ++++++++++++------------ drivers/md/dm-raid.c | 2 +- drivers/md/md.c | 6 +- drivers/md/md.h | 2 +- drivers/md/raid1.c | 2 +- drivers/md/raid10.c | 2 +- drivers/md/raid5.c | 4 +- drivers/media/pci/zoran/zoran.h | 1 - drivers/media/pci/zoran/zoran_driver.c | 3 - drivers/net/ethernet/sfc/selftest.c | 20 +++--- drivers/net/irda/vlsi_ir.c | 18 ++-- drivers/net/irda/vlsi_ir.h | 14 ++-- drivers/net/wireless/ath/carl9170/carl9170.h | 6 +- drivers/net/wireless/ath/carl9170/debug.c | 6 +- drivers/net/wireless/ath/carl9170/main.c | 10 +- drivers/net/wireless/ath/carl9170/tx.c | 4 +- drivers/net/wireless/iwlwifi/mvm/d3.c | 4 +- drivers/net/wireless/iwlwifi/mvm/tx.c | 2 +- drivers/scsi/hptiop.c | 2 - drivers/scsi/hptiop.h | 1 - drivers/scsi/ipr.c | 6 +- drivers/scsi/ipr.h | 2 +- drivers/scsi/qla2xxx/qla_target.c | 10 +- drivers/scsi/qla2xxx/qla_target.h | 2 +- fs/btrfs/ctree.c | 2 +- fs/btrfs/ctree.h | 4 +- fs/btrfs/delayed-ref.c | 4 +- fs/btrfs/disk-io.c | 4 +- fs/btrfs/file.c | 4 +- fs/btrfs/raid56.c | 32 ++++---- fs/btrfs/tests/btrfs-tests.c | 2 +- fs/btrfs/transaction.c | 2 +- fs/btrfs/tree-log.c | 8 +- fs/btrfs/volumes.c | 14 ++-- fs/btrfs/volumes.h | 22 +++--- fs/jbd2/commit.c | 2 +- fs/jbd2/transaction.c | 4 +- fs/ocfs2/dlm/dlmcommon.h | 4 +- fs/ocfs2/dlm/dlmdebug.c | 10 +- fs/ocfs2/dlm/dlmdomain.c | 4 +- fs/ocfs2/dlm/dlmmaster.c | 4 +- include/acpi/ghes.h | 2 +- include/linux/blk-cgroup.h | 24 +++--- include/linux/jbd2.h | 2 +- include/linux/netlink.h | 12 ++-- include/net/cfg802154.h | 2 +- include/net/mac80211.h | 2 +- include/net/neighbour.h | 2 +- kernel/rcu/tree_plugin.h | 4 +- net/batman-adv/routing.c | 4 +- net/batman-adv/soft-interface.c | 2 +- net/batman-adv/translation-table.c | 14 ++-- net/batman-adv/types.h | 2 +- net/core/neighbour.c | 14 ++-- net/core/rtnetlink.c | 2 +- net/ipv4/arp.c | 2 +- net/ipv4/inet_diag.c | 4 +- net/ipv4/xfrm4_state.c | 4 +- net/ipv6/ndisc.c | 2 +- net/mac80211/cfg.c | 2 +- net/mac80211/debugfs_key.c | 2 +- net/mac80211/key.c | 4 +- net/mac80211/tx.c | 2 +- net/mac80211/wpa.c | 10 +- net/mac802154/iface.c | 4 +- net/netfilter/ipset/ip_set_core.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 22 +++--- net/netfilter/nf_tables_api.c | 13 ++-- net/netfilter/nfnetlink_acct.c | 7 +- net/netfilter/nfnetlink_cthelper.c | 2 +- net/netfilter/nfnetlink_cttimeout.c | 2 +- net/netlink/af_netlink.c | 10 ++- net/netlink/diag.c | 2 +- net/netlink/genetlink.c | 14 ++-- net/packet/af_packet.c | 18 ++-- net/packet/diag.c | 2 +- net/packet/internal.h | 6 +- net/unix/diag.c | 2 +- net/xfrm/xfrm_user.c | 2 +- security/apparmor/include/policy.h | 2 +- security/apparmor/policy.c | 4 +- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_fifo.c | 6 +- sound/core/seq/seq_fifo.h | 2 +- tools/gcc/gcc-common.h | 24 ++++-- tools/gcc/initify_plugin.c | 7 +- tools/lib/api/Makefile | 2 +- 109 files changed, 399 insertions(+), 391 deletions(-) commit a7817402ac837b1aee07fac42537a02097055098 Author: Matt Fleming Date: Fri Jan 29 11:36:10 2016 +0000 x86/mm/pat: Avoid truncation when converting cpa->numpages to address There are a couple of nasty truncation bugs lurking in the pageattr code that can be triggered when mapping EFI regions, e.g. when we pass a cpa->pgd pointer. Because cpa->numpages is a 32-bit value, shifting left by PAGE_SHIFT will truncate the resultant address to 32-bits. Viorel-Cătălin managed to trigger this bug on his Dell machine that provides a ~5GB EFI region which requires 1236992 pages to be mapped. When calling populate_pud() the end of the region gets calculated incorrectly in the following buggy expression, end = start + (cpa->numpages << PAGE_SHIFT); And only 188416 pages are mapped. Next, populate_pud() gets invoked for a second time because of the loop in __change_page_attr_set_clr(), only this time no pages get mapped because shifting the remaining number of pages (1048576) by PAGE_SHIFT is zero. At which point the loop in __change_page_attr_set_clr() spins forever because we fail to map progress. Hitting this bug depends very much on the virtual address we pick to map the large region at and how many pages we map on the initial run through the loop. This explains why this issue was only recently hit with the introduction of commit a5caa209ba9c ("x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down") It's interesting to note that safe uses of cpa->numpages do exist in the pageattr code. If instead of shifting ->numpages we multiply by PAGE_SIZE, no truncation occurs because PAGE_SIZE is a UL value, and so the result is unsigned long. To avoid surprises when users try to convert very large cpa->numpages values to addresses, change the data type from 'int' to 'unsigned long', thereby making it suitable for shifting by PAGE_SHIFT without any type casting. The alternative would be to make liberal use of casting, but that is far more likely to cause problems in the future when someone adds more code and fails to cast properly; this bug was difficult enough to track down in the first place. Reported-and-tested-by: Viorel-Cătălin Răpițeanu Acked-by: Borislav Petkov Cc: Sai Praneeth Prakhya Cc: Signed-off-by: Matt Fleming Link: https://bugzilla.kernel.org/show_bug.cgi?id=110131 Link: http://lkml.kernel.org/r/1454067370-10374-1-git-send-email-matt@codeblueprint.co.uk Signed-off-by: Thomas Gleixner arch/x86/mm/pageattr.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit 64dd9d7a67a742fda257cdd16510c29e695c34b5 Author: Jan Beulich Date: Tue Jan 26 04:15:18 2016 -0700 x86/mm: Fix types used in pgprot cacheability flags translations For PAE kernels "unsigned long" is not suitable to hold page protection flags, since _PAGE_NX doesn't fit there. This is the reason for quite a few W+X pages getting reported as insecure during boot (observed namely for the entire initrd range). Fixes: 281d4078be ("x86: Make page cache mode a real type") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/56A7635602000078000CAFF1@prv-mh.provo.novell.com Signed-off-by: Thomas Gleixner arch/x86/include/asm/pgtable_types.h | 6 ++---- 1 files changed, 2 insertions(+), 4 deletions(-) commit bb9a3a9df0d8dfc96d521676e64c42b37ba22aea Merge: 682d661 f74425b Author: Brad Spengler Date: Sun Jan 31 15:06:25 2016 -0500 Merge branch 'pax-test' into grsec-test Conflicts: drivers/net/slip/slhc.c include/linux/sched.h net/unix/af_unix.c sound/core/timer.c commit f74425b5705bfe52aff9e97659ef10c4a14176c3 Merge: d14af1f 849a2d3 Author: Brad Spengler Date: Sun Jan 31 15:02:55 2016 -0500 Merge branch 'linux-4.3.y' into pax-test Conflicts: arch/x86/include/asm/mmu_context.h commit 682d6611d75542e351c973c8dd74a99d3966c073 Author: Brad Spengler Date: Sat Jan 30 13:05:03 2016 -0500 Based on a report from Mathias Krause, fix up a number of additional instances of ulong overflow when passing in values to gr_learn_resource by saturating to ULONG_MAX mm/mlock.c | 11 ++++++++--- mm/mmap.c | 16 +++++++++++++--- 2 files changed, 21 insertions(+), 6 deletions(-) commit adb52e95fb9ad4ac9c56cd5d47bd668f47c33096 Author: Jann Horn Date: Sat Dec 26 06:00:48 2015 +0100 seccomp: always propagate NO_NEW_PRIVS on tsync Before this patch, a process with some permissive seccomp filter that was applied by root without NO_NEW_PRIVS was able to add more filters to itself without setting NO_NEW_PRIVS by setting the new filter from a throwaway thread with NO_NEW_PRIVS. Signed-off-by: Jann Horn Cc: stable@vger.kernel.org Signed-off-by: Kees Cook kernel/seccomp.c | 22 +++++++++++----------- 1 files changed, 11 insertions(+), 11 deletions(-) commit b85450498a3bbf269441c8963d7574bb3079c838 Merge: 59c216f d14af1f Author: Brad Spengler Date: Fri Jan 29 20:54:13 2016 -0500 Merge branch 'pax-test' into grsec-test commit d14af1f1dd66511f3f0674deee2b572972012b39 Author: Brad Spengler Date: Fri Jan 29 20:53:51 2016 -0500 Update to pax-linux-4.3.4-test26.patch: - Emese fixed a few intentional overflows introduced by gcc, reported by StalkR (https://forums.grsecurity.net/viewtopic.php?f=3&t=4370) fs/cifs/file.c | 2 +- fs/gfs2/file.c | 2 +- .../size_overflow_plugin/intentional_overflow.c | 96 ++++++++++++++++++-- tools/gcc/size_overflow_plugin/size_overflow.h | 2 + .../size_overflow_plugin/size_overflow_plugin.c | 4 +- .../size_overflow_plugin/size_overflow_transform.c | 6 +- .../size_overflow_transform_core.c | 5 + 7 files changed, 102 insertions(+), 15 deletions(-) commit 59c216f13587eacdd692386b7a403ae78ed84fb6 Author: Brad Spengler Date: Wed Jan 27 17:57:21 2016 -0500 Fix a size_overflow report reported by Mathias Krause in our truncation of an loff_t to an unsigned long when being passed to gr_learn_resource() (as all resource checks are against unsigned long values) fs/attr.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) commit 70636c6ad60fc1db3af764ecc789b827b7497a97 Author: Yuchung Cheng Date: Wed Jan 6 12:42:38 2016 -0800 tcp: fix zero cwnd in tcp_cwnd_reduction Patch 3759824da87b ("tcp: PRR uses CRB mode by default and SS mode conditionally") introduced a bug that cwnd may become 0 when both inflight and sndcnt are 0 (cwnd = inflight + sndcnt). This may lead to a div-by-zero if the connection starts another cwnd reduction phase by setting tp->prior_cwnd to the current cwnd (0) in tcp_init_cwnd_reduction(). To prevent this we skip PRR operation when nothing is acked or sacked. Then cwnd must be positive in all cases as long as ssthresh is positive: 1) The proportional reduction mode inflight > ssthresh > 0 2) The reduction bound mode a) inflight == ssthresh > 0 b) inflight < ssthresh sndcnt > 0 since newly_acked_sacked > 0 and inflight < ssthresh Therefore in all cases inflight and sndcnt can not both be 0. We check invalid tp->prior_cwnd to avoid potential div0 bugs. In reality this bug is triggered only with a sequence of less common events. For example, the connection is terminating an ECN-triggered cwnd reduction with an inflight 0, then it receives reordered/old ACKs or DSACKs from prior transmission (which acks nothing). Or the connection is in fast recovery stage that marks everything lost, but fails to retransmit due to local issues, then receives data packets from other end which acks nothing. Fixes: 3759824da87b ("tcp: PRR uses CRB mode by default and SS mode conditionally") Reported-by: Oleksandr Natalenko Signed-off-by: Yuchung Cheng Signed-off-by: Neal Cardwell Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/tcp_input.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) commit dac1da2bedbb43195d371c7a192cfeeb45683df0 Author: Eric Dumazet Date: Sun Jan 24 13:53:50 2016 -0800 af_unix: fix struct pid memory leak Dmitry reported a struct pid leak detected by a syzkaller program. Bug happens in unix_stream_recvmsg() when we break the loop when a signal is pending, without properly releasing scm. Fixes: b3ca9b02b007 ("net: fix multithreaded signal handling in unix recv routines") Reported-by: Dmitry Vyukov Signed-off-by: Eric Dumazet Cc: Rainer Weikusat Signed-off-by: David S. Miller net/unix/af_unix.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit 15cc47f127520d1ac0c1fe76d993c2c27f0f2571 Author: Hannes Frederic Sowa Date: Fri Jan 22 01:39:43 2016 +0100 pptp: fix illegal memory access caused by multiple bind()s Several times already this has been reported as kasan reports caused by syzkaller and trinity and people always looked at RCU races, but it is much more simple. :) In case we bind a pptp socket multiple times, we simply add it to the callid_sock list but don't remove the old binding. Thus the old socket stays in the bucket with unused call_id indexes and doesn't get cleaned up. This causes various forms of kasan reports which were hard to pinpoint. Simply don't allow multiple binds and correct error handling in pptp_bind. Also keep sk_state bits in place in pptp_connect. Fixes: 00959ade36acad ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)") Cc: Dmitry Kozlov Cc: Sasha Levin Cc: Dmitry Vyukov Reported-by: Dmitry Vyukov Cc: Dave Jones Reported-by: Dave Jones Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller drivers/net/ppp/pptp.c | 34 ++++++++++++++++++++++++---------- 1 files changed, 24 insertions(+), 10 deletions(-) commit e2b7b8c66851c85188fa6dab2d2b2a6c85bc7332 Author: Brad Spengler Date: Tue Jan 26 18:17:10 2016 -0500 Add info about cpupower/powertop to GRKERNSEC_KMEM, was present on our wiki but was removed from the config help at some point grsecurity/Kconfig | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) commit ce2e88efa000fc32bfcd84098f57c8ed8310fefc Author: Thomas Egerer Date: Mon Jan 25 12:58:44 2016 +0100 ipv4+ipv6: Make INET*_ESP select CRYPTO_ECHAINIV The ESP algorithms using CBC mode require echainiv. Hence INET*_ESP have to select CRYPTO_ECHAINIV in order to work properly. This solves the issues caused by a misconfiguration as described in [1]. The original approach, patching crypto/Kconfig was turned down by Herbert Xu [2]. [1] https://lists.strongswan.org/pipermail/users/2015-December/009074.html [2] http://marc.info/?l=linux-crypto-vger&m=145224655809562&w=2 Signed-off-by: Thomas Egerer Acked-by: Herbert Xu Signed-off-by: David S. Miller net/ipv4/Kconfig | 1 + net/ipv6/Kconfig | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) commit fca5a303155ea67d28aece0caf2b03ffc3b2668d Merge: 904114c 6339c1f Author: Brad Spengler Date: Tue Jan 26 18:08:40 2016 -0500 Merge branch 'pax-test' into grsec-test commit 6339c1f9a9beafd417bf9f04d4b257e62aeb45b7 Author: Brad Spengler Date: Tue Jan 26 18:07:51 2016 -0500 Update to pax-linux-4.3.4-test25.patch: - fixed incorrect handling of VM_DONTCOPY during fork that would trigger a consistency check in the vma mirroring logic, reported by Mathias Krause - fixed init_new_context on !MODIFY_LDT_SYSCALL configs, reported by tjh (https://forums.grsecurity.net/viewtopic.php?f=3&t=4368) - fixed a few REFCOUNT false positives in SNMP related statistics arch/x86/Kconfig | 2 +- arch/x86/include/asm/mmu_context.h | 17 +++++++++++++++++ include/net/snmp.h | 10 +++++----- kernel/fork.c | 11 +++++++++-- net/ipv4/proc.c | 8 ++++---- net/ipv6/addrconf.c | 4 ++-- net/ipv6/proc.c | 10 +++++----- 7 files changed, 43 insertions(+), 19 deletions(-) commit 904114c2fce3fdff5d57e763da56a78960db4e19 Author: Al Viro Date: Fri Jan 22 18:08:52 2016 -0500 make sure that freeing shmem fast symlinks is RCU-delayed Cc: stable@vger.kernel.org # v4.2+ Signed-off-by: Al Viro include/linux/shmem_fs.h | 5 +---- mm/shmem.c | 9 ++++----- 2 files changed, 5 insertions(+), 9 deletions(-) commit ab86adee64312a2f827dd516cb199521327943ed Author: Sasha Levin Date: Mon Jan 18 19:23:51 2016 -0500 netfilter: nf_conntrack: use safer way to lock all buckets When we need to lock all buckets in the connection hashtable we'd attempt to lock 1024 spinlocks, which is way more preemption levels than supported by the kernel. Furthermore, this behavior was hidden by checking if lockdep is enabled, and if it was - use only 8 buckets(!). Fix this by using a global lock and synchronize all buckets on it when we need to lock them all. This is pretty heavyweight, but is only done when we need to resize the hashtable, and that doesn't happen often enough (or at all). Signed-off-by: Sasha Levin Acked-by: Jesper Dangaard Brouer Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Conflicts: net/netfilter/nfnetlink_cttimeout.c include/net/netfilter/nf_conntrack_core.h | 8 ++---- net/netfilter/nf_conntrack_core.c | 38 +++++++++++++++++++++------- net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 2 +- 4 files changed, 33 insertions(+), 17 deletions(-) commit 37014723527225481c720484bb788a1a6358072f Author: Willy Tarreau Date: Mon Jan 18 16:36:09 2016 +0100 pipe: limit the per-user amount of pages allocated in pipes On no-so-small systems, it is possible for a single process to cause an OOM condition by filling large pipes with data that are never read. A typical process filling 4000 pipes with 1 MB of data will use 4 GB of memory. On small systems it may be tricky to set the pipe max size to prevent this from happening. This patch makes it possible to enforce a per-user soft limit above which new pipes will be limited to a single page, effectively limiting them to 4 kB each, as well as a hard limit above which no new pipes may be created for this user. This has the effect of protecting the system against memory abuse without hurting other users, and still allowing pipes to work correctly though with less data at once. The limit are controlled by two new sysctls : pipe-user-pages-soft, and pipe-user-pages-hard. Both may be disabled by setting them to zero. The default soft limit allows the default number of FDs per process (1024) to create pipes of the default size (64kB), thus reaching a limit of 64MB before starting to create only smaller pipes. With 256 processes limited to 1024 FDs each, this results in 1024*64kB + (256*1024 - 1024) * 4kB = 1084 MB of memory allocated for a user. The hard limit is disabled by default to avoid breaking existing applications that make intensive use of pipes (eg: for splicing). Reported-by: socketpair@gmail.com Reported-by: Tetsuo Handa Mitigates: CVE-2013-4312 (Linux 2.0+) Suggested-by: Linus Torvalds Signed-off-by: Willy Tarreau Signed-off-by: Al Viro Documentation/sysctl/fs.txt | 23 +++++++++++++++++++++ fs/pipe.c | 47 +++++++++++++++++++++++++++++++++++++++++- include/linux/pipe_fs_i.h | 4 +++ include/linux/sched.h | 1 + kernel/sysctl.c | 14 ++++++++++++ 5 files changed, 87 insertions(+), 2 deletions(-) commit 51645fa198d194f746651dcfbc5f24a4cf8b9fb8 Merge: 540f2af 7791ecb Author: Brad Spengler Date: Sat Jan 23 10:57:11 2016 -0500 Merge branch 'pax-test' into grsec-test commit 7791ecb84f840343a5646236fd0d34e1fb450793 Merge: 470069c 399588c Author: Brad Spengler Date: Sat Jan 23 10:56:47 2016 -0500 Merge branch 'linux-4.3.y' into pax-test commit 540f2affebd42cdc26a699208ab4f1cb0cb75e33 Author: Brad Spengler Date: Tue Jan 19 21:18:47 2016 -0500 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) commit 7e649765626a28437f573f0fbe7a51a04615f041 Author: Brad Spengler Date: Tue Jan 19 20:29:46 2016 -0500 Backport fix from: https://lkml.org/lkml/2015/12/13/187 fs/ext4/extents.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 53b859cd0a5f5b6ad54fe0c879dfedaa3c5a3005 Author: Jann Horn Date: Tue Jan 5 18:27:30 2016 +0100 compat_ioctl: don't call do_ioctl under set_fs(KERNEL_DS) This replaces all code in fs/compat_ioctl.c that translated ioctl arguments into a in-kernel structure, then performed do_ioctl under set_fs(KERNEL_DS), with code that allocates data on the user stack and can call the VFS ioctl handler under USER_DS. This is done as a hardening measure because the caller does not know what kind of ioctl handler will be invoked, only that no corresponding compat_ioctl handler exists and what the ioctl command number is. The accidental invocation of an unlocked_ioctl handler that unexpectedly calls copy_to_user could be a severe security issue. Signed-off-by: Jann Horn Signed-off-by: Al Viro Conflicts: fs/compat_ioctl.c fs/compat_ioctl.c | 130 ++++++++++++++++++++++++++++------------------------- 1 files changed, 68 insertions(+), 62 deletions(-) commit 3e89e770ae27e931cd1583f021abac41eeebc3e7 Author: Al Viro Date: Thu Jan 7 09:53:30 2016 -0500 compat_ioctl: don't pass fd around when not needed Signed-off-by: Al Viro fs/compat_ioctl.c | 103 ++++++++++++++++++++++++++-------------------------- fs/internal.h | 7 ++++ fs/ioctl.c | 4 +- include/linux/fs.h | 2 - 4 files changed, 61 insertions(+), 55 deletions(-) commit 9d4e04082752d4d2d68445c4e6faf33a2613df55 Author: Jann Horn Date: Tue Jan 5 18:27:29 2016 +0100 compat_ioctl: don't look up the fd twice In code in fs/compat_ioctl.c that translates ioctl arguments into a in-kernel structure, then performs sys_ioctl, possibly under set_fs(KERNEL_DS), this commit changes the sys_ioctl calls to do_ioctl calls. do_ioctl is a new function that does the same thing as sys_ioctl, but doesn't look up the fd again. This change is made to avoid (potential) security issues because of ioctl handlers that accept one of the ioctl commands I2C_FUNCS, VIDEO_GET_EVENT, MTIOCPOS, MTIOCGET, TIOCGSERIAL, TIOCSSERIAL, RTC_IRQP_READ, RTC_EPOCH_READ. This can happen for multiple reasons: - The ioctl command number could be reused. - The ioctl handler might not check the full ioctl command. This is e.g. true for drm_ioctl. - The ioctl handler is very special, e.g. cuse_file_ioctl The real issue is that set_fs(KERNEL_DS) is used here, but that's fixed in a separate commit "compat_ioctl: don't call do_ioctl under set_fs(KERNEL_DS)". This change mitigates potential security issues by preventing a race that permits invocation of unlocked_ioctl handlers under KERNEL_DS through compat code even if a corresponding compat_ioctl handler exists. So far, no way has been identified to use this to damage kernel memory without having CAP_SYS_ADMIN in the init ns (with the capability, doing reads/writes at arbitrary kernel addresses should be easy through CUSE's ioctl handler with FUSE_IOCTL_UNRESTRICTED set). [AV: two missed sys_ioctl() taken care of] Signed-off-by: Jann Horn Signed-off-by: Al Viro fs/compat_ioctl.c | 122 +++++++++++++++++++++++++++++----------------------- 1 files changed, 68 insertions(+), 54 deletions(-) commit 5bf9e1ed4ebb278cd956ba142914fc04a024309c Author: Vasily Kulikov Date: Fri Jan 15 16:57:55 2016 -0800 include/linux/poison.h: use POISON_POINTER_DELTA for poison pointers TIMER_ENTRY_STATIC is defined as a poison pointers which should point to nowhere. Redefine them using POISON_POINTER_DELTA arithmetics to make sure they really point to non-mappable area declared by the target architecture. Signed-off-by: Vasily Kulikov Acked-by: Thomas Gleixner Cc: Solar Designer Cc: "Kirill A. Shutemov" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Conflicts: include/linux/poison.h include/linux/poison.h | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 60f2e0a05ab8f56c804a9334a23e2b446305d110 Author: Brad Spengler Date: Tue Jan 19 19:41:44 2016 -0500 Fix ARM compilation, reported by Austin Sepp grsecurity/grsec_sig.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit e15383743443dc43460a2fd73e0db0b608610dca Author: Takashi Iwai Date: Mon Jan 18 13:52:47 2016 +0100 ALSA: hrtimer: Fix stall by hrtimer_cancel() hrtimer_cancel() waits for the completion from the callback, thus it must not be called inside the callback itself. This was already a problem in the past with ALSA hrtimer driver, and the early commit [fcfdebe70759: ALSA: hrtimer - Fix lock-up] tried to address it. However, the previous fix is still insufficient: it may still cause a lockup when the ALSA timer instance reprograms itself in its callback. Then it invokes the start function even in snd_timer_interrupt() that is called in hrtimer callback itself, results in a CPU stall. This is no hypothetical problem but actually triggered by syzkaller fuzzer. This patch tries to fix the issue again. Now we call hrtimer_try_to_cancel() at both start and stop functions so that it won't fall into a deadlock, yet giving some chance to cancel the queue if the functions have been called outside the callback. The proper hrtimer_cancel() is called in anyway at closing, so this should be enough. Reported-and-tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/hrtimer.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) commit 12d874daf706e6e7c1ae709141859c809599297e Author: Takashi Iwai Date: Tue Jan 12 12:38:02 2016 +0100 ALSA: seq: Fix missing NULL check at remove_events ioctl snd_seq_ioctl_remove_events() calls snd_seq_fifo_clear() unconditionally even if there is no FIFO assigned, and this leads to an Oops due to NULL dereference. The fix is just to add a proper NULL check. Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/seq/seq_clientmgr.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 2eb0632df1351378946507e7ef7ba0682632a7b5 Author: Takashi Iwai Date: Tue Jan 12 15:36:27 2016 +0100 ALSA: seq: Fix race at timer setup and close ALSA sequencer code has an open race between the timer setup ioctl and the close of the client. This was triggered by syzkaller fuzzer, and a use-after-free was caught there as a result. This patch papers over it by adding a proper queue->timer_mutex lock around the timer-related calls in the relevant code path. Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/seq/seq_queue.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) commit b9e55ab955e59b4a636d78a748be90334a48b485 Author: Takashi Iwai Date: Thu Jan 14 16:30:58 2016 +0100 ALSA: timer: Harden slave timer list handling A slave timer instance might be still accessible in a racy way while operating the master instance as it lacks of locking. Since the master operation is mostly protected with timer->lock, we should cope with it while changing the slave instance, too. Also, some linked lists (active_list and ack_list) of slave instances aren't unlinked immediately at stopping or closing, and this may lead to unexpected accesses. This patch tries to address these issues. It adds spin lock of timer->lock (either from master or slave, which is equivalent) in a few places. For avoiding a deadlock, we ensure that the global slave_active_lock is always locked at first before each timer lock. Also, ack and active_list of slave instances are properly unlinked at snd_timer_stop() and snd_timer_close(). Last but not least, remove the superfluous call of _snd_timer_stop() at removing slave links. This is a noop, and calling it may confuse readers wrt locking. Further cleanup will follow in a later patch. Actually we've got reports of use-after-free by syzkaller fuzzer, and this hopefully fixes these issues. Reported-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/timer.c | 18 ++++++++++++++---- 1 files changed, 14 insertions(+), 4 deletions(-) commit f1ce0547bdfda1b42ae8a66c222f2a897cbe1586 Author: Takashi Iwai Date: Wed Jan 13 17:48:01 2016 +0100 ALSA: timer: Fix race among timer ioctls ALSA timer ioctls have an open race and this may lead to a use-after-free of timer instance object. A simplistic fix is to make each ioctl exclusive. We have already tread_sem for controlling the tread, and extend this as a global mutex to be applied to each ioctl. The downside is, of course, the worse concurrency. But these ioctls aren't to be parallel accessible, in anyway, so it should be fine to serialize there. Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/timer.c | 32 +++++++++++++++++++------------- 1 files changed, 19 insertions(+), 13 deletions(-) commit 8347d8461ed48a98f9c76cc3cfcdad8217d314bc Author: Takashi Iwai Date: Wed Jan 13 21:35:06 2016 +0100 ALSA: timer: Fix double unlink of active_list ALSA timer instance object has a couple of linked lists and they are unlinked unconditionally at snd_timer_stop(). Meanwhile snd_timer_interrupt() unlinks it, but it calls list_del() which leaves the element list itself unchanged. This ends up with unlinking twice, and it was caught by syzkaller fuzzer. The fix is to use list_del_init() variant properly there, too. Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/timer.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 243aebb7ae71d6e11ea9880faa893d1d0d60cd75 Author: Hannes Frederic Sowa Date: Mon Jan 18 18:03:48 2016 +0100 ovs: limit ovs recursions in ovs_execute_actions to not corrupt stack It was seen that defective configurations of openvswitch could overwrite the STACK_END_MAGIC and cause a hard crash of the kernel because of too many recursions within ovs. This problem arises due to the high stack usage of openvswitch. The rest of the kernel is fine with the current limit of 10 (RECURSION_LIMIT). We use the already existing recursion counter in ovs_execute_actions to implement an upper bound of 5 recursions. Cc: Pravin Shelar Cc: Simon Horman Cc: Eric Dumazet Cc: Simon Horman Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller net/openvswitch/actions.c | 19 ++++++++++++++----- 1 files changed, 14 insertions(+), 5 deletions(-) commit 8080793479c6d5befe37a67b1dbd9e4e0a61af96 Author: Ursula Braun Date: Tue Jan 19 10:41:33 2016 +0100 af_iucv: Validate socket address length in iucv_sock_bind() Signed-off-by: Ursula Braun Reported-by: Dmitry Vyukov Reviewed-by: Evgeny Cherkashin Signed-off-by: David S. Miller net/iucv/af_iucv.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) commit 50a383c1c91ed7409c3cbdd41e662d6891463d1b Author: Brad Spengler Date: Tue Jan 19 19:32:54 2016 -0500 Apply the same fix as everyone else for the recent keys vulnerability that is unexploitable under PAX_REFCOUNT Make a couple more changes that no one else can/will include/linux/key-type.h | 4 ++-- ipc/msgutil.c | 4 ++-- security/keys/internal.h | 2 +- security/keys/process_keys.c | 1 + 4 files changed, 6 insertions(+), 5 deletions(-) commit b56c3a63f431c193400aee17543021950bd14bc4 Merge: 38b1a3d 470069c Author: Brad Spengler Date: Sun Jan 17 18:30:19 2016 -0500 Merge branch 'pax-test' into grsec-test commit 470069cfedef2180313233d275be5901bd6d1135 Author: Brad Spengler Date: Sun Jan 17 18:29:59 2016 -0500 Update to pax-linux-4.3.3-test22.patch: - Emesed fixed a gcc induced intentional integer overflow in asix_rx_fixup_internal, reported by thomas callison caffrey - fixed some more fallout from the drm_drivers constification, reported by Colin Childs and Toralf Foerster drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 14 ++++---------- drivers/gpu/drm/drm_pci.c | 3 +++ drivers/gpu/drm/gma500/psb_drv.c | 4 ---- drivers/gpu/drm/i915/i915_drv.c | 16 ++++++++-------- drivers/gpu/drm/nouveau/nouveau_drm.c | 6 +++--- drivers/gpu/drm/radeon/radeon_drv.c | 4 +--- drivers/net/usb/asix_common.c | 3 ++- include/drm/drmP.h | 1 + 8 files changed, 22 insertions(+), 29 deletions(-) commit 38b1a3d676f407865c3d41840df8213c5ad639c1 Author: Brad Spengler Date: Sun Jan 17 12:33:53 2016 -0500 As reported by Luis Ressel, the Kconfig help for GRKERNSEC_BRUTE mentioned banning execution of suid/sgid binaries, though the kernel source clearly only mentions banning execution of suid binaries. Since there's no reason for us to not ban execution of sgid binaries as well, make the implementation match the Kconfig description. fs/exec.c | 4 ++-- grsecurity/grsec_sig.c | 27 ++++++++++++++------------- include/linux/sched.h | 4 ++-- 3 files changed, 18 insertions(+), 17 deletions(-) commit 8c3bcb7dbf7f606acfa0983e81f0f928da1f1ace Merge: d141a86 ea4a835 Author: Brad Spengler Date: Sat Jan 16 14:12:22 2016 -0500 Merge branch 'pax-test' into grsec-test Conflicts: drivers/gpu/drm/i810/i810_drv.c commit ea4a835328ada6513ac013986764d6caea8cd348 Author: Brad Spengler Date: Sat Jan 16 14:11:30 2016 -0500 Update to pax-linux-4.3.3-test21.patch: - fixed some fallout from the drm_drivers constification, reported by spender drivers/gpu/drm/armada/armada_drv.c | 3 +-- drivers/gpu/drm/exynos/exynos_drm_drv.c | 1 - drivers/gpu/drm/i810/i810_dma.c | 2 +- drivers/gpu/drm/i810/i810_drv.c | 6 +++++- drivers/gpu/drm/i810/i810_drv.h | 2 +- 5 files changed, 8 insertions(+), 6 deletions(-) commit d141a86fd66194bc3f896b6809b189e2f12a9a83 Author: Brad Spengler Date: Sat Jan 16 13:16:36 2016 -0500 compile fix drivers/gpu/drm/i810/i810_dma.c | 2 +- drivers/gpu/drm/i810/i810_drv.c | 4 +++- drivers/gpu/drm/i810/i810_drv.h | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) commit 0d9dc4b25ea32c14561bcfe6b5b24f1b00fe0270 Merge: 5fa135d bbda879 Author: Brad Spengler Date: Sat Jan 16 12:59:22 2016 -0500 Merge branch 'pax-test' into grsec-test commit bbda87914edf63e27fb46670bf3a373f2b963c73 Author: Brad Spengler Date: Sat Jan 16 12:58:04 2016 -0500 Update to pax-linux-4.3.3-test20.patch: - constified drm_driver - Emese fixed a special case in handling __func__ in the initify plugin - Emese fixed a false positive size overflow report in handling inbufBits, reported by Martin Filo (https://bugs.gentoo.org/show_bug.cgi?id=567048) - fixed regression that caused perf to not resolve kernel code addresses under KERNEXEC/i386, reported by minipli arch/x86/kernel/cpu/perf_event.h | 2 +- arch/x86/kernel/cpu/perf_event_intel_ds.c | 7 +- arch/x86/kernel/cpu/perf_event_intel_lbr.c | 4 +- arch/x86/kernel/uprobes.c | 2 +- arch/x86/mm/mpx.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 8 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 +- drivers/gpu/drm/drm_pci.c | 6 +- drivers/gpu/drm/gma500/psb_drv.c | 5 +- drivers/gpu/drm/i915/i915_dma.c | 2 +- drivers/gpu/drm/i915/i915_drv.c | 15 ++-- drivers/gpu/drm/i915/i915_drv.h | 2 +- drivers/gpu/drm/i915/i915_irq.c | 88 ++++++++++---------- drivers/gpu/drm/mga/mga_drv.c | 5 +- drivers/gpu/drm/mga/mga_drv.h | 2 +- drivers/gpu/drm/mga/mga_state.c | 2 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 13 ++-- drivers/gpu/drm/qxl/qxl_drv.c | 8 ++- drivers/gpu/drm/qxl/qxl_ioctl.c | 2 +- drivers/gpu/drm/r128/r128_drv.c | 4 +- drivers/gpu/drm/r128/r128_drv.h | 2 +- drivers/gpu/drm/r128/r128_state.c | 2 +- drivers/gpu/drm/radeon/radeon_drv.c | 17 +++- drivers/gpu/drm/radeon/radeon_drv.h | 2 +- drivers/gpu/drm/radeon/radeon_kms.c | 2 +- drivers/gpu/drm/radeon/radeon_state.c | 2 +- drivers/gpu/drm/savage/savage_bci.c | 2 +- drivers/gpu/drm/savage/savage_drv.c | 5 +- drivers/gpu/drm/savage/savage_drv.h | 2 +- drivers/gpu/drm/sis/sis_drv.c | 5 +- drivers/gpu/drm/sis/sis_drv.h | 2 +- drivers/gpu/drm/sis/sis_mm.c | 2 +- drivers/gpu/drm/via/via_dma.c | 2 +- drivers/gpu/drm/via/via_drv.c | 5 +- drivers/gpu/drm/via/via_drv.h | 2 +- include/drm/drmP.h | 2 +- mm/slab.c | 2 +- net/sunrpc/xprtrdma/svc_rdma.c | 6 +- tools/gcc/initify_plugin.c | 15 +++- .../disable_size_overflow_hash.data | 1 + .../size_overflow_plugin/size_overflow_hash.data | 3 +- 42 files changed, 156 insertions(+), 110 deletions(-) commit 5fa135dc116350e0205c39ef65eaf6496ed2748a Author: Brad Spengler Date: Sat Jan 16 12:19:23 2016 -0500 compile fix grsecurity/grsec_sig.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) commit a9090fa58f33f75c7450fda5721a9b13625a47d9 Author: Brad Spengler Date: Sat Jan 16 12:10:37 2016 -0500 As pointed out by Jann Horn, some distros are starting to circumvent previous assumptions about the attainability of a user to control multiple UIDs by handing out suid binaries that allow a user to run processes (including exploits) under a number of other pre-defined UIDs. As this could potentially be used to bypass GRKERNSEC_BRUTE (though it would have to involve some code path that doesn't involve locks) fix that here by ensuring no more than 8 users on a system can be banned before a reboot is required. If more are banned, a panic is triggered. grsecurity/grsec_sig.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) commit a8d37776e9521c567ebff6730d49312f72435f08 Author: Eric Dumazet Date: Thu Dec 3 11:12:07 2015 -0800 proc: add a reschedule point in proc_readfd_common() User can pass an arbitrary large buffer to getdents(). It is typically a 32KB buffer used by libc scandir() implementation. When scanning /proc/{pid}/fd, we can hold cpu way too long, so add a cond_resched() to be kind with other tasks. We've seen latencies of more than 50ms on real workloads. Signed-off-by: Eric Dumazet Cc: Alexander Viro Signed-off-by: Al Viro fs/proc/fd.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit 0adba75f8708f13b1f5d98ebe3fc2fb961e100c8 Author: Rabin Vincent Date: Tue Jan 12 20:17:08 2016 +0100 net: bpf: reject invalid shifts On ARM64, a BUG() is triggered in the eBPF JIT if a filter with a constant shift that can't be encoded in the immediate field of the UBFM/SBFM instructions is passed to the JIT. Since these shifts amounts, which are negative or >= regsize, are invalid, reject them in the eBPF verifier and the classic BPF filter checker, for all architectures. Signed-off-by: Rabin Vincent Acked-by: Alexei Starovoitov Acked-by: Daniel Borkmann Signed-off-by: David S. Miller kernel/bpf/verifier.c | 10 ++++++++++ net/core/filter.c | 5 +++++ 2 files changed, 15 insertions(+), 0 deletions(-) commit c248e115a73496625a1c64660d0eeefd67e55cbf Author: Marcelo Ricardo Leitner Date: Fri Jan 8 11:00:54 2016 -0200 sctp: fix use-after-free in pr_debug statement Dmitry Vyukov reported a use-after-free in the code expanded by the macro debug_post_sfx, which is caused by the use of the asoc pointer after it was freed within sctp_side_effect() scope. This patch fixes it by allowing sctp_side_effect to clear that asoc pointer when the TCB is freed. As Vlad explained, we also have to cover the SCTP_DISPOSITION_ABORT case because it will trigger DELETE_TCB too on that same loop. Also, there were places issuing SCTP_CMD_INIT_FAILED and ASSOC_FAILED but returning SCTP_DISPOSITION_CONSUME, which would fool the scheme above. Fix it by returning SCTP_DISPOSITION_ABORT instead. The macro is already prepared to handle such NULL pointer. Reported-by: Dmitry Vyukov Signed-off-by: Marcelo Ricardo Leitner Acked-by: Vlad Yasevich Signed-off-by: David S. Miller net/sctp/sm_sideeffect.c | 11 ++++++----- net/sctp/sm_statefuns.c | 17 ++++------------- 2 files changed, 10 insertions(+), 18 deletions(-) commit 395ea8a9e73e184fc14153a033000bccf4213213 Author: willy tarreau Date: Sun Jan 10 07:54:56 2016 +0100 unix: properly account for FDs passed over unix sockets It is possible for a process to allocate and accumulate far more FDs than the process' limit by sending them over a unix socket then closing them to keep the process' fd count low. This change addresses this problem by keeping track of the number of FDs in flight per user and preventing non-privileged processes from having more FDs in flight than their configured FD limit. Reported-by: socketpair@gmail.com Reported-by: Tetsuo Handa Mitigates: CVE-2013-4312 (Linux 2.0+) Suggested-by: Linus Torvalds Acked-by: Hannes Frederic Sowa Signed-off-by: Willy Tarreau Signed-off-by: David S. Miller include/linux/sched.h | 1 + net/unix/af_unix.c | 24 ++++++++++++++++++++---- net/unix/garbage.c | 13 ++++++++----- 3 files changed, 29 insertions(+), 9 deletions(-) commit cb207ab8fbd71dcfc4a49d533aba8085012543fd Author: Sasha Levin Date: Thu Jan 7 14:52:43 2016 -0500 net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory proc_dostring() needs an initialized destination string, while the one provided in proc_sctp_do_hmac_alg() contains stack garbage. Thus, writing to cookie_hmac_alg would strlen() that garbage and end up accessing invalid memory. Fixes: 3c68198e7 ("sctp: Make hmac algorithm selection for cookie generation dynamic") Signed-off-by: Sasha Levin Signed-off-by: David S. Miller net/sctp/sysctl.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 4014e09faf0fe9054119624ccfff1236e886b554 Author: Quentin Casasnovas Date: Tue Nov 24 17:13:21 2015 -0500 RDS: fix race condition when sending a message on unbound socket commit 8c7188b23474cca017b3ef354c4a58456f68303a upstream. Sasha's found a NULL pointer dereference in the RDS connection code when sending a message to an apparently unbound socket. The problem is caused by the code checking if the socket is bound in rds_sendmsg(), which checks the rs_bound_addr field without taking a lock on the socket. This opens a race where rs_bound_addr is temporarily set but where the transport is not in rds_bind(), leading to a NULL pointer dereference when trying to dereference 'trans' in __rds_conn_create(). Vegard wrote a reproducer for this issue, so kindly ask him to share if you're interested. I cannot reproduce the NULL pointer dereference using Vegard's reproducer with this patch, whereas I could without. Complete earlier incomplete fix to CVE-2015-6937: 74e98eb08588 ("RDS: verify the underlying transport exists before creating a connection") Cc: David S. Miller Reviewed-by: Vegard Nossum Reviewed-by: Sasha Levin Acked-by: Santosh Shilimkar Signed-off-by: Quentin Casasnovas Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby Conflicts: net/rds/send.c net/rds/connection.c | 6 ------ 1 files changed, 0 insertions(+), 6 deletions(-) commit 206df8d01104344d7588d801016a281a4cd25556 Author: Sasha Levin Date: Tue Sep 8 10:53:40 2015 -0400 RDS: verify the underlying transport exists before creating a connection There was no verification that an underlying transport exists when creating a connection, this would cause dereferencing a NULL ptr. It might happen on sockets that weren't properly bound before attempting to send a message, which will cause a NULL ptr deref: [135546.047719] kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN [135546.051270] Modules linked in: [135546.051781] CPU: 4 PID: 15650 Comm: trinity-c4 Not tainted 4.2.0-next-20150902-sasha-00041-gbaa1222-dirty #2527 [135546.053217] task: ffff8800835bc000 ti: ffff8800bc708000 task.ti: ffff8800bc708000 [135546.054291] RIP: __rds_conn_create (net/rds/connection.c:194) [135546.055666] RSP: 0018:ffff8800bc70fab0 EFLAGS: 00010202 [135546.056457] RAX: dffffc0000000000 RBX: 0000000000000f2c RCX: ffff8800835bc000 [135546.057494] RDX: 0000000000000007 RSI: ffff8800835bccd8 RDI: 0000000000000038 [135546.058530] RBP: ffff8800bc70fb18 R08: 0000000000000001 R09: 0000000000000000 [135546.059556] R10: ffffed014d7a3a23 R11: ffffed014d7a3a21 R12: 0000000000000000 [135546.060614] R13: 0000000000000001 R14: ffff8801ec3d0000 R15: 0000000000000000 [135546.061668] FS: 00007faad4ffb700(0000) GS:ffff880252000000(0000) knlGS:0000000000000000 [135546.062836] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [135546.063682] CR2: 000000000000846a CR3: 000000009d137000 CR4: 00000000000006a0 [135546.064723] Stack: [135546.065048] ffffffffafe2055c ffffffffafe23fc1 ffffed00493097bf ffff8801ec3d0008 [135546.066247] 0000000000000000 00000000000000d0 0000000000000000 ac194a24c0586342 [135546.067438] 1ffff100178e1f78 ffff880320581b00 ffff8800bc70fdd0 ffff880320581b00 [135546.068629] Call Trace: [135546.069028] ? __rds_conn_create (include/linux/rcupdate.h:856 net/rds/connection.c:134) [135546.069989] ? rds_message_copy_from_user (net/rds/message.c:298) [135546.071021] rds_conn_create_outgoing (net/rds/connection.c:278) [135546.071981] rds_sendmsg (net/rds/send.c:1058) [135546.072858] ? perf_trace_lock (include/trace/events/lock.h:38) [135546.073744] ? lockdep_init (kernel/locking/lockdep.c:3298) [135546.074577] ? rds_send_drop_to (net/rds/send.c:976) [135546.075508] ? __might_fault (./arch/x86/include/asm/current.h:14 mm/memory.c:3795) [135546.076349] ? __might_fault (mm/memory.c:3795) [135546.077179] ? rds_send_drop_to (net/rds/send.c:976) [135546.078114] sock_sendmsg (net/socket.c:611 net/socket.c:620) [135546.078856] SYSC_sendto (net/socket.c:1657) [135546.079596] ? SYSC_connect (net/socket.c:1628) [135546.080510] ? trace_dump_stack (kernel/trace/trace.c:1926) [135546.081397] ? ring_buffer_unlock_commit (kernel/trace/ring_buffer.c:2479 kernel/trace/ring_buffer.c:2558 kernel/trace/ring_buffer.c:2674) [135546.082390] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749) [135546.083410] ? trace_event_raw_event_sys_enter (include/trace/events/syscalls.h:16) [135546.084481] ? do_audit_syscall_entry (include/trace/events/syscalls.h:16) [135546.085438] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749) [135546.085515] rds_ib_laddr_check(): addr 36.74.25.172 ret -99 node type -1 Acked-by: Santosh Shilimkar Signed-off-by: Sasha Levin Signed-off-by: David S. Miller net/rds/connection.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) commit 173fa03f05cf0ad485d49a42cbdee8844d3a689a Author: Steven Rostedt (Red Hat) Date: Tue Jan 5 20:32:47 2016 -0500 ftrace/module: Call clean up function when module init fails early If the module init code fails after calling ftrace_module_init() and before calling do_init_module(), we can suffer from a memory leak. This is because ftrace_module_init() allocates pages to store the locations that ftrace hooks are placed in the module text. If do_init_module() fails, it still calls the MODULE_GOING notifiers which will tell ftrace to do a clean up of the pages it allocated for the module. But if load_module() fails before then, the pages allocated by ftrace_module_init() will never be freed. Call ftrace_release_mod() on the module if load_module() fails before getting to do_init_module(). Link: http://lkml.kernel.org/r/567CEA31.1070507@intel.com Reported-by: "Qiu, PeiyangX" Fixes: a949ae560a511 "ftrace/module: Hardcode ftrace_module_init() call into load_module()" Cc: stable@vger.kernel.org # v2.6.38+ Acked-by: Rusty Russell Signed-off-by: Steven Rostedt include/linux/ftrace.h | 1 + kernel/module.c | 6 ++++++ 2 files changed, 7 insertions(+), 0 deletions(-) commit 1e5a4a81a4c16c8ac2e264b88a02cc2f42ed0399 Author: Francesco Ruggeri Date: Wed Jan 6 00:18:48 2016 -0800 net: possible use after free in dst_release dst_release should not access dst->flags after decrementing __refcnt to 0. The dst_entry may be in dst_busy_list and dst_gc_task may dst_destroy it before dst_release gets a chance to access dst->flags. Fixes: d69bbf88c8d0 ("net: fix a race in dst_release()") Fixes: 27b75c95f10d ("net: avoid RCU for NOCACHE dst") Signed-off-by: Francesco Ruggeri Acked-by: Eric Dumazet Signed-off-by: David S. Miller net/core/dst.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) commit bfb0455793dd4e0f0b49d34a68b3249ab55565cc Author: Alan Date: Wed Jan 6 14:55:02 2016 +0000 mkiss: fix scribble on freed memory commit d79f16c046086f4fe0d42184a458e187464eb83e fixed a user triggerable scribble on free memory but added a new one which allows the user to scribble even more and user controlled data into freed space. As with 6pack we need to halt the queue before we free the buffers, because the transmit logic is not protected by the semaphore. Signed-off-by: Alan Cox Signed-off-by: David S. Miller drivers/net/hamradio/mkiss.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) commit 5cbbcbd32dc1949470f61d342503808fa9555276 Author: David Miller Date: Thu Dec 17 16:05:49 2015 -0500 mkiss: Fix use after free in mkiss_close(). Need to do the unregister_device() after all references to the driver private have been done. Signed-off-by: David S. Miller drivers/net/hamradio/mkiss.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit b00171576794a98068e069a660f0991a6a5190ff Author: One Thousand Gnomes Date: Tue Jan 5 11:51:25 2016 +0000 6pack: fix free memory scribbles commit acf673a3187edf72068ee2f92f4dc47d66baed47 fixed a user triggerable free memory scribble but in doing so replaced it with a different one that allows the user to control the data and scribble even more. sixpack_close is called by the tty layer in tty context. The tty context is protected by sp_get() and sp_put(). However network layer activity via sp_xmit() is not protected this way. We must therefore stop the queue otherwise the user gets to dump a buffer mostly of their choice into freed kernel pages. Signed-off-by: Alan Cox Signed-off-by: David S. Miller drivers/net/hamradio/6pack.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) commit 5b64a833907cd230a3106aeba2304b2c1bcd116d Author: David Miller Date: Thu Dec 17 16:05:32 2015 -0500 6pack: Fix use after free in sixpack_close(). Need to do the unregister_device() after all references to the driver private have been done. Also we need to use del_timer_sync() for the timers so that we don't have any asynchronous references after the unregister. Signed-off-by: David S. Miller drivers/net/hamradio/6pack.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) commit 4f9d532742656b3613d579220fd10c78f24ba37b Author: Rabin Vincent Date: Tue Jan 5 16:23:07 2016 +0100 net: filter: make JITs zero A for SKF_AD_ALU_XOR_X The SKF_AD_ALU_XOR_X ancillary is not like the other ancillary data instructions since it XORs A with X while all the others replace A with some loaded value. All the BPF JITs fail to clear A if this is used as the first instruction in a filter. This was found using american fuzzy lop. Add a helper to determine if A needs to be cleared given the first instruction in a filter, and use this in the JITs. Except for ARM, the rest have only been compile-tested. Fixes: 3480593131e0 ("net: filter: get rid of BPF_S_* enum") Signed-off-by: Rabin Vincent Acked-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller arch/arm/net/bpf_jit_32.c | 16 +--------------- arch/mips/net/bpf_jit.c | 16 +--------------- arch/powerpc/net/bpf_jit_comp.c | 13 ++----------- arch/sparc/net/bpf_jit_comp.c | 17 ++--------------- include/linux/filter.h | 19 +++++++++++++++++++ 5 files changed, 25 insertions(+), 56 deletions(-) commit 570d88f8acfffda92b89ae2e1c47320d47256034 Author: John Fastabend Date: Tue Jan 5 09:11:36 2016 -0800 net: sched: fix missing free per cpu on qstats When a qdisc is using per cpu stats (currently just the ingress qdisc) only the bstats are being freed. This also free's the qstats. Fixes: b0ab6f92752b9f9d8 ("net: sched: enable per cpu qstats") Signed-off-by: John Fastabend Acked-by: Eric Dumazet Acked-by: Daniel Borkmann Signed-off-by: David S. Miller net/sched/sch_generic.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) commit 32c0ebc51857ee83470a10dcb234d308a0ed1881 Author: Rabin Vincent Date: Tue Jan 5 18:34:04 2016 +0100 ARM: net: bpf: fix zero right shift The LSR instruction cannot be used to perform a zero right shift since a 0 as the immediate value (imm5) in the LSR instruction encoding means that a shift of 32 is perfomed. See DecodeIMMShift() in the ARM ARM. Make the JIT skip generation of the LSR if a zero-shift is requested. This was found using american fuzzy lop. Signed-off-by: Rabin Vincent Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller arch/arm/net/bpf_jit_32.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) commit 51f5d291750285efa4d4bbe84e5ec23dc00c8d2d Author: Brad Spengler Date: Wed Jan 6 20:35:57 2016 -0500 Don't perform hidden lookups in RBAC against the directory of a file being opened with O_CREAT, reported by Karl Witt Conflicts: fs/namei.c fs/namei.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) commit 5a8266a6b2769ccdb447256f95bc2577a73cccd1 Author: Hannes Frederic Sowa Date: Tue Jan 5 10:46:00 2016 +0100 bridge: Only call /sbin/bridge-stp for the initial network namespace [I stole this patch from Eric Biederman. He wrote:] > There is no defined mechanism to pass network namespace information > into /sbin/bridge-stp therefore don't even try to invoke it except > for bridge devices in the initial network namespace. > > It is possible for unprivileged users to cause /sbin/bridge-stp to be > invoked for any network device name which if /sbin/bridge-stp does not > guard against unreasonable arguments or being invoked twice on the > same network device could cause problems. [Hannes: changed patch using netns_eq] Cc: Eric W. Biederman Signed-off-by: Eric W. Biederman Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller net/bridge/br_stp_if.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) commit 650d535cc39f0aeff2f57e60b6617be25d3ef48b Author: Marcelo Ricardo Leitner Date: Wed Dec 23 16:28:40 2015 -0200 sctp: use GFP_USER for user-controlled kmalloc Commit cacc06215271 ("sctp: use GFP_USER for user-controlled kmalloc") missed two other spots. For connectx, as it's more likely to be used by kernel users of the API, it detects if GFP_USER should be used or not. Fixes: cacc06215271 ("sctp: use GFP_USER for user-controlled kmalloc") Reported-by: Dmitry Vyukov Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller net/sctp/socket.c | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-) commit 5718a1f63c41fc156f729783423b002763779d04 Author: Florian Westphal Date: Thu Dec 31 14:26:33 2015 +0100 connector: bump skb->users before callback invocation Dmitry reports memleak with syskaller program. Problem is that connector bumps skb usecount but might not invoke callback. So move skb_get to where we invoke the callback. Reported-by: Dmitry Vyukov Signed-off-by: Florian Westphal Signed-off-by: David S. Miller drivers/connector/connector.c | 11 +++-------- 1 files changed, 3 insertions(+), 8 deletions(-) commit 2e6372e6a97f8d642416899861f91777f44f13b7 Author: Rainer Weikusat Date: Sun Jan 3 18:56:38 2016 +0000 af_unix: Fix splice-bind deadlock On 2015/11/06, Dmitry Vyukov reported a deadlock involving the splice system call and AF_UNIX sockets, http://lists.openwall.net/netdev/2015/11/06/24 The situation was analyzed as (a while ago) A: socketpair() B: splice() from a pipe to /mnt/regular_file does sb_start_write() on /mnt C: try to freeze /mnt wait for B to finish with /mnt A: bind() try to bind our socket to /mnt/new_socket_name lock our socket, see it not bound yet decide that it needs to create something in /mnt try to do sb_start_write() on /mnt, block (it's waiting for C). D: splice() from the same pipe to our socket lock the pipe, see that socket is connected try to lock the socket, block waiting for A B: get around to actually feeding a chunk from pipe to file, try to lock the pipe. Deadlock. on 2015/11/10 by Al Viro, http://lists.openwall.net/netdev/2015/11/10/4 The patch fixes this by removing the kern_path_create related code from unix_mknod and executing it as part of unix_bind prior acquiring the readlock of the socket in question. This means that A (as used above) will sb_start_write on /mnt before it acquires the readlock, hence, it won't indirectly block B which first did a sb_start_write and then waited for a thread trying to acquire the readlock. Consequently, A being blocked by C waiting for B won't cause a deadlock anymore (effectively, both A and B acquire two locks in opposite order in the situation described above). Dmitry Vyukov() tested the original patch. Signed-off-by: Rainer Weikusat Signed-off-by: David S. Miller Conflicts: net/unix/af_unix.c net/unix/af_unix.c | 70 +++++++++++++++++++++++++++++++-------------------- 1 files changed, 42 insertions(+), 28 deletions(-) commit 2e729e557c571f3253e32472cd7d382ac16cf1c3 Author: Qiu Peiyang Date: Thu Dec 31 13:11:28 2015 +0800 tracing: Fix setting of start_index in find_next() When we do cat /sys/kernel/debug/tracing/printk_formats, we hit kernel panic at t_show. general protection fault: 0000 [#1] PREEMPT SMP CPU: 0 PID: 2957 Comm: sh Tainted: G W O 3.14.55-x86_64-01062-gd4acdc7 #2 RIP: 0010:[] [] t_show+0x22/0xe0 RSP: 0000:ffff88002b4ebe80 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 RDX: 0000000000000004 RSI: ffffffff81fd26a6 RDI: ffff880032f9f7b1 RBP: ffff88002b4ebe98 R08: 0000000000001000 R09: 000000000000ffec R10: 0000000000000000 R11: 000000000000000f R12: ffff880004d9b6c0 R13: 7365725f6d706400 R14: ffff880004d9b6c0 R15: ffffffff82020570 FS: 0000000000000000(0000) GS:ffff88003aa00000(0063) knlGS:00000000f776bc40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000f6c02ff0 CR3: 000000002c2b3000 CR4: 00000000001007f0 Call Trace: [] seq_read+0x2f6/0x3e0 [] vfs_read+0x9b/0x160 [] SyS_read+0x49/0xb0 [] ia32_do_call+0x13/0x13 ---[ end trace 5bd9eb630614861e ]--- Kernel panic - not syncing: Fatal exception When the first time find_next calls find_next_mod_format, it should iterate the trace_bprintk_fmt_list to find the first print format of the module. However in current code, start_index is smaller than *pos at first, and code will not iterate the list. Latter container_of will get the wrong address with former v, which will cause mod_fmt be a meaningless object and so is the returned mod_fmt->fmt. This patch will fix it by correcting the start_index. After fixed, when the first time calls find_next_mod_format, start_index will be equal to *pos, and code will iterate the trace_bprintk_fmt_list to get the right module printk format, so is the returned mod_fmt->fmt. Link: http://lkml.kernel.org/r/5684B900.9000309@intel.com Cc: stable@vger.kernel.org # 3.12+ Fixes: 102c9323c35a8 "tracing: Add __tracepoint_string() to export string pointers" Signed-off-by: Qiu Peiyang Signed-off-by: Steven Rostedt kernel/trace/trace_printk.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit 0994af4b1930f32aa493dc08145cd304f8bfc8f4 Author: Al Viro Date: Mon Dec 28 20:47:08 2015 -0500 [PATCH] arm: fix handling of F_OFD_... in oabi_fcntl64() Cc: stable@vger.kernel.org # 3.15+ Reviewed-by: Jeff Layton Signed-off-by: Al Viro arch/arm/kernel/sys_oabi-compat.c | 73 +++++++++++++++++++------------------ 1 files changed, 37 insertions(+), 36 deletions(-) commit 4ed030f65dcf3e6b0128032a49a7d75f947fa351 Merge: de243c2 3adc55a Author: Brad Spengler Date: Tue Jan 5 18:10:10 2016 -0500 Merge branch 'pax-test' into grsec-test commit 3adc55a5acfa429c2a7cc883aef08b960c0079b0 Author: Brad Spengler Date: Tue Jan 5 18:08:53 2016 -0500 Update to pax-linux-4.3.3-test16.patch: - small cleanup in entry_64.S on x86 - Emese fixed the initify plugin to recursively check variable initializers, reported by Rasmus Villemoes - fixed an integer truncation of a partially uninitialized value bug in em_pop_sreg, reported by fx3 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4354) - fixed alternatives patching of call insns under KERNEXEC/i386, reported by fly_a320 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4305) and TTgrsec (https://forums.grsecurity.net/viewtopic.php?f=3&t=4353) - fixed a size overflow false positive that triggered in tcp_parse_options on arm, reported by iamb (https://forums.grsecurity.net/viewtopic.php?f=3&t=4350&p=15917#p15916) - fixed a boot crash on amd64 with KERNEXEC/OR and CONTEXT_TRACKING, reported by Klaus Kusche (https://bugs.gentoo.org/show_bug.cgi?id=570420) arch/x86/entry/entry_64.S | 60 +++++----- arch/x86/kernel/alternative.c | 2 +- arch/x86/kvm/emulate.c | 4 +- tools/gcc/initify_plugin.c | 123 +++++++++---------- .../disable_size_overflow_hash.data | 4 +- .../size_overflow_plugin/size_overflow_hash.data | 2 - 6 files changed, 93 insertions(+), 102 deletions(-) commit de243c26efd0e423ca92db825af2c3f8eb1ca043 Author: Brad Spengler Date: Tue Dec 29 18:01:24 2015 -0500 It was noticed during an internal audit that the code under GRKERNSEC_PROC_MEMMAP which aimed to enforce a 16MB minimum on RLIMIT_DATA for suid/sgid binaries only did so if RLIMIT_DATA was set lower than PAGE_SIZE. This addition was only supplemental as GRKERNSEC_BRUTE is the main defense against suid/sgid attacks and the flaw above would only eliminate the extra entropy provided for the brk-managed heap, still leaving it with the minimum of 16-bit entropy for mmap on x86 and 28 on x64. mm/mmap.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 8e264cfe47e5f08cdc9ed009a630277206cd2534 Merge: 436201b 2584340 Author: Brad Spengler Date: Mon Dec 28 20:30:01 2015 -0500 Merge branch 'pax-test' into grsec-test commit 2584340eab494e64ec1bf9eb5b0d1ae31f926306 Author: Brad Spengler Date: Mon Dec 28 20:29:28 2015 -0500 Update to pax-linux-4.3.3-test14.patch: - fixed an integer sign conversion error in i2c_dw_pci_probe caught by the size overflow plugin, reported by Jean Lucas and ganymede (https://forums.grsecurity.net/viewtopic.php?f=3&t=4349) - fixed shutdown crash with tboot and KERNEXEC, reported by perfinion - fixed a few false positive and one real size overflow reports in hyperv, reported by hunger - fixed compile regressions on armv5, reported by iamb (https://forums.grsecurity.net/viewtopic.php?f=3&t=4350) - fixed an assert in the initify plugin that triggered in vic_register on arm arch/arm/include/asm/atomic.h | 7 +++++-- arch/arm/include/asm/domain.h | 5 ++--- arch/x86/kernel/tboot.c | 14 +++++++++----- drivers/hv/channel.c | 4 +--- drivers/i2c/busses/i2c-designware-pcidrv.c | 2 +- drivers/net/hyperv/rndis_filter.c | 3 +-- fs/exec.c | 4 ++-- include/linux/atomic.h | 15 --------------- net/core/skbuff.c | 3 ++- tools/gcc/initify_plugin.c | 4 +++- 10 files changed, 26 insertions(+), 35 deletions(-) commit 436201b6626b488d173c8076447000077c27b84a Author: David Howells Date: Fri Dec 18 01:34:26 2015 +0000 KEYS: Fix race between read and revoke This fixes CVE-2015-7550. There's a race between keyctl_read() and keyctl_revoke(). If the revoke happens between keyctl_read() checking the validity of a key and the key's semaphore being taken, then the key type read method will see a revoked key. This causes a problem for the user-defined key type because it assumes in its read method that there will always be a payload in a non-revoked key and doesn't check for a NULL pointer. Fix this by making keyctl_read() check the validity of a key after taking semaphore instead of before. I think the bug was introduced with the original keyrings code. This was discovered by a multithreaded test program generated by syzkaller (http://github.com/google/syzkaller). Here's a cleaned up version: #include #include #include void *thr0(void *arg) { key_serial_t key = (unsigned long)arg; keyctl_revoke(key); return 0; } void *thr1(void *arg) { key_serial_t key = (unsigned long)arg; char buffer[16]; keyctl_read(key, buffer, 16); return 0; } int main() { key_serial_t key = add_key("user", "%", "foo", 3, KEY_SPEC_USER_KEYRING); pthread_t th[5]; pthread_create(&th[0], 0, thr0, (void *)(unsigned long)key); pthread_create(&th[1], 0, thr1, (void *)(unsigned long)key); pthread_create(&th[2], 0, thr0, (void *)(unsigned long)key); pthread_create(&th[3], 0, thr1, (void *)(unsigned long)key); pthread_join(th[0], 0); pthread_join(th[1], 0); pthread_join(th[2], 0); pthread_join(th[3], 0); return 0; } Build as: cc -o keyctl-race keyctl-race.c -lkeyutils -lpthread Run as: while keyctl-race; do :; done as it may need several iterations to crash the kernel. The crash can be summarised as: BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 IP: [] user_read+0x56/0xa3 ... Call Trace: [] keyctl_read_key+0xb6/0xd7 [] SyS_keyctl+0x83/0xe0 [] entry_SYSCALL_64_fastpath+0x12/0x6f Reported-by: Dmitry Vyukov Signed-off-by: David Howells Tested-by: Dmitry Vyukov Cc: stable@vger.kernel.org Signed-off-by: James Morris security/keys/keyctl.c | 18 +++++++++--------- 1 files changed, 9 insertions(+), 9 deletions(-) commit 195cea04477025da4a2078bd3e1fb7c4e11206c2 Author: Brad Spengler Date: Tue Dec 22 20:44:01 2015 -0500 Add new kernel command-line param: pax_size_overflow_report_only If a user triggers a size_overflow violation that makes it difficult to obtain the call trace without serial console/net console, they can use this option to provide that information to us Documentation/kernel-parameters.txt | 5 +++++ fs/exec.c | 12 +++++++++--- init/main.c | 11 +++++++++++ 3 files changed, 25 insertions(+), 3 deletions(-) commit 4254a8da5851df8c08cdca5c392916e8c105408d Author: WANG Cong Date: Mon Dec 21 10:55:45 2015 -0800 addrconf: always initialize sysctl table data When sysctl performs restrict writes, it allows to write from a middle position of a sysctl file, which requires us to initialize the table data before calling proc_dostring() for the write case. Fixes: 3d1bec99320d ("ipv6: introduce secret_stable to ipv6_devconf") Reported-by: Sasha Levin Acked-by: Hannes Frederic Sowa Tested-by: Sasha Levin Signed-off-by: Cong Wang Signed-off-by: David S. Miller net/ipv6/addrconf.c | 11 ++++------- 1 files changed, 4 insertions(+), 7 deletions(-) commit f8002863fb06c363180637046947a78a6ccb3d33 Author: WANG Cong Date: Wed Dec 16 23:39:04 2015 -0800 net: check both type and procotol for tcp sockets Dmitry reported the following out-of-bound access: Call Trace: [] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:294 [] sock_setsockopt+0x1284/0x13d0 net/core/sock.c:880 [< inline >] SYSC_setsockopt net/socket.c:1746 [] SyS_setsockopt+0x1fe/0x240 net/socket.c:1729 [] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 This is because we mistake a raw socket as a tcp socket. We should check both sk->sk_type and sk->sk_protocol to ensure it is a tcp socket. Willem points out __skb_complete_tx_timestamp() needs to fix as well. Reported-by: Dmitry Vyukov Cc: Willem de Bruijn Cc: Eric Dumazet Signed-off-by: Cong Wang Acked-by: Willem de Bruijn Signed-off-by: David S. Miller net/core/skbuff.c | 3 ++- net/core/sock.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) commit bd6b3399804470a4ad8f34229469ca149dceba3d Author: Colin Ian King Date: Fri Dec 18 14:22:01 2015 -0800 proc: fix -ESRCH error when writing to /proc/$pid/coredump_filter Writing to /proc/$pid/coredump_filter always returns -ESRCH because commit 774636e19ed51 ("proc: convert to kstrto*()/kstrto*_from_user()") removed the setting of ret after the get_proc_task call and incorrectly left it as -ESRCH. Instead, return 0 when successful. Example breakage: echo 0 > /proc/self/coredump_filter bash: echo: write error: No such process Fixes: 774636e19ed51 ("proc: convert to kstrto*()/kstrto*_from_user()") Signed-off-by: Colin Ian King Acked-by: Kees Cook Cc: [4.3+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/base.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit b28aca2b99ed08546778355fb9402c503ff9b29e Author: Junichi Nomura Date: Tue Dec 22 10:23:44 2015 -0700 block: ensure to split after potentially bouncing a bio blk_queue_bio() does split then bounce, which makes the segment counting based on pages before bouncing and could go wrong. Move the split to after bouncing, like we do for blk-mq, and the we fix the issue of having the bio count for segments be wrong. Fixes: 54efd50bfd87 ("block: make generic_make_request handle arbitrarily sized bios") Cc: stable@vger.kernel.org Tested-by: Artem S. Tashkinov Signed-off-by: Jens Axboe block/blk-core.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit e62a25e917a9e5b35ddd5b4f1b5e5e30fbd2e84c Merge: f6f63ae ec72fa5 Author: Brad Spengler Date: Tue Dec 22 19:46:26 2015 -0500 Merge branch 'pax-test' into grsec-test commit ec72fa5f8d9cb4e223bad1b8b5c2e1071c222f2a Author: Brad Spengler Date: Tue Dec 22 19:45:51 2015 -0500 Update to pax-linux-4.3.3-test13.patch: - Emese fixed a (probably) false positive integer truncation in xfs_da_grow_inode_int, reported by jdkbx (http://forums.grsecurity.net/viewtopic.php?f=3&t=4346) - fixed a size overflow in btrfs/try_merge_map, reported by Alex W (https://bugs.archlinux.org/task/47173) and mathias and dwokfur (https://forums.grsecurity.net/viewtopic.php?f=3&t=4344) arch/arm/mm/fault.c | 2 +- arch/x86/mm/fault.c | 2 +- fs/btrfs/extent_map.c | 8 ++++++-- fs/xfs/libxfs/xfs_da_btree.c | 4 +++- 4 files changed, 11 insertions(+), 5 deletions(-) commit f6f63ae154cd45028add1dc41957878060d77fbf Author: Brad Spengler Date: Thu Dec 17 18:43:44 2015 -0500 ptrace_has_cap() checks whether the current process should be treated as having a certain capability for ptrace checks against another process. Until now, this was equivalent to has_ns_capability(current, target_ns, CAP_SYS_PTRACE). However, if a root-owned process wants to enter a user namespace for some reason without knowing who owns it and therefore can't change to the namespace owner's uid and gid before entering, as soon as it has entered the namespace, the namespace owner can attach to it via ptrace and thereby gain access to its uid and gid. While it is possible for the entering process to switch to the uid of a claimed namespace owner before entering, causing the attempt to enter to fail if the claimed uid is wrong, this doesn't solve the problem of determining an appropriate gid. With this change, the entering process can first enter the namespace and then safely inspect the namespace's properties, e.g. through /proc/self/{uid_map,gid_map}, assuming that the namespace owner doesn't have access to uid 0. Signed-off-by: Jann Horn kernel/ptrace.c | 30 +++++++++++++++++++++++++----- 1 files changed, 25 insertions(+), 5 deletions(-) commit e314f0fb63020f61543b401ff594e953c2c304e5 Author: tadeusz.struk@intel.com Date: Tue Dec 15 10:46:17 2015 -0800 net: fix uninitialized variable issue msg_iocb needs to be initialized on the recv/recvfrom path. Otherwise afalg will wrongly interpret it as an async call. Cc: stable@vger.kernel.org Reported-by: Harald Freudenberger Signed-off-by: Tadeusz Struk Signed-off-by: David S. Miller net/socket.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit a3f56a43ad56b8fcaf04f6327636ed2f5970de3b Merge: dfa764c 142edcf Author: Brad Spengler Date: Wed Dec 16 21:01:17 2015 -0500 Merge branch 'pax-test' into grsec-test commit 142edcf1005a57fb8887823565cf0bafad2f313c Author: Brad Spengler Date: Wed Dec 16 21:00:57 2015 -0500 Update to pax-linux-4.3.3-test12.patch: - Emese fixed a size overflow false positive in reiserfs/leaf_paste_entries, reported by Christian Apeltauer (https://bugs.gentoo.org/show_bug.cgi?id=568046) - fixed a bunch of int/size_t mismatches in the drivers/tty/n_tty.c code causing size overflow false positives, reported by Toralf Förster, mathias (https://forums.grsecurity.net/viewtopic.php?f=3&t=4342), N8Fear (https://forums.grsecurity.net/viewtopic.php?f=3&t=4341) drivers/tty/n_tty.c | 16 ++++++++-------- .../disable_size_overflow_hash.data | 2 ++ .../size_overflow_plugin/size_overflow_hash.data | 6 ++---- 3 files changed, 12 insertions(+), 12 deletions(-) commit dfa764cc549892a5bfc1083cac78b99032cae577 Author: Hannes Frederic Sowa Date: Tue Dec 15 22:59:12 2015 +0100 ipv6: automatically enable stable privacy mode if stable_secret set Bjørn reported that while we switch all interfaces to privacy stable mode when setting the secret, we don't set this mode for new interfaces. This does not make sense, so change this behaviour. Fixes: 622c81d57b392cc ("ipv6: generation of stable privacy addresses for link-local and autoconf") Reported-by: Bjørn Mork Cc: Bjørn Mork Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller net/ipv6/addrconf.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) commit c2815a1fee03f222273e77c14e43f960da06f35a Author: Brad Spengler Date: Wed Dec 16 13:03:38 2015 -0500 Work around upstream limitation on the number of thread info flags causing a compilation error Reported by fabled at http://forums.grsecurity.net/viewtopic.php?f=3&t=4339 arch/arm/kernel/entry-common.S | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-) commit 8c9ae168e09ae49324d709d76d73d9fc4ca477e1 Author: Brad Spengler Date: Tue Dec 15 19:03:41 2015 -0500 Initial import of grsecurity 3.1 for Linux 4.3.3 Documentation/dontdiff | 2 + Documentation/kernel-parameters.txt | 7 + Documentation/sysctl/kernel.txt | 15 + Makefile | 18 +- arch/alpha/include/asm/cache.h | 4 +- arch/alpha/kernel/osf_sys.c | 12 +- arch/arc/Kconfig | 1 + arch/arm/Kconfig | 1 + arch/arm/Kconfig.debug | 1 + arch/arm/include/asm/thread_info.h | 7 +- arch/arm/kernel/process.c | 4 +- arch/arm/kernel/ptrace.c | 9 + arch/arm/kernel/traps.c | 7 +- arch/arm/mm/Kconfig | 2 +- arch/arm/mm/fault.c | 40 +- arch/arm/mm/mmap.c | 8 +- arch/arm/net/bpf_jit_32.c | 51 +- arch/arm64/Kconfig.debug | 1 + arch/avr32/include/asm/cache.h | 4 +- arch/blackfin/Kconfig.debug | 1 + arch/blackfin/include/asm/cache.h | 3 +- arch/cris/include/arch-v10/arch/cache.h | 3 +- arch/cris/include/arch-v32/arch/cache.h | 3 +- arch/frv/include/asm/cache.h | 3 +- arch/frv/mm/elf-fdpic.c | 4 +- arch/hexagon/include/asm/cache.h | 6 +- arch/ia64/Kconfig | 1 + arch/ia64/include/asm/cache.h | 3 +- arch/ia64/kernel/sys_ia64.c | 2 + arch/ia64/mm/hugetlbpage.c | 2 + arch/m32r/include/asm/cache.h | 4 +- arch/m68k/include/asm/cache.h | 4 +- arch/metag/mm/hugetlbpage.c | 1 + arch/microblaze/include/asm/cache.h | 3 +- arch/mips/Kconfig | 1 + arch/mips/include/asm/cache.h | 3 +- arch/mips/include/asm/thread_info.h | 11 +- arch/mips/kernel/irq.c | 3 + arch/mips/kernel/ptrace.c | 9 + arch/mips/mm/mmap.c | 4 +- arch/mn10300/proc-mn103e010/include/proc/cache.h | 4 +- arch/mn10300/proc-mn2ws0050/include/proc/cache.h | 4 +- arch/openrisc/include/asm/cache.h | 4 +- arch/parisc/include/asm/cache.h | 5 +- arch/parisc/kernel/sys_parisc.c | 4 + arch/powerpc/Kconfig | 1 + arch/powerpc/include/asm/cache.h | 4 +- arch/powerpc/include/asm/thread_info.h | 5 +- arch/powerpc/kernel/Makefile | 2 + arch/powerpc/kernel/irq.c | 3 + arch/powerpc/kernel/process.c | 10 +- arch/powerpc/kernel/ptrace.c | 14 + arch/powerpc/kernel/traps.c | 5 + arch/powerpc/mm/slice.c | 2 +- arch/s390/Kconfig.debug | 1 + arch/s390/include/asm/cache.h | 4 +- arch/score/include/asm/cache.h | 4 +- arch/sh/include/asm/cache.h | 3 +- arch/sh/mm/mmap.c | 6 +- arch/sparc/include/asm/cache.h | 4 +- arch/sparc/include/asm/pgalloc_64.h | 1 + arch/sparc/include/asm/thread_info_64.h | 8 +- arch/sparc/kernel/process_32.c | 6 +- arch/sparc/kernel/process_64.c | 8 +- arch/sparc/kernel/ptrace_64.c | 14 + arch/sparc/kernel/sys_sparc_64.c | 8 +- arch/sparc/kernel/syscalls.S | 8 +- arch/sparc/kernel/traps_32.c | 8 +- arch/sparc/kernel/traps_64.c | 28 +- arch/sparc/kernel/unaligned_64.c | 2 +- arch/sparc/mm/fault_64.c | 2 +- arch/sparc/mm/hugetlbpage.c | 15 +- arch/tile/Kconfig | 1 + arch/tile/include/asm/cache.h | 3 +- arch/tile/mm/hugetlbpage.c | 2 + arch/um/include/asm/cache.h | 3 +- arch/unicore32/include/asm/cache.h | 6 +- arch/x86/Kconfig | 21 + arch/x86/Kconfig.debug | 2 + arch/x86/entry/common.c | 14 + arch/x86/entry/entry_32.S | 2 +- arch/x86/entry/entry_64.S | 2 +- arch/x86/ia32/ia32_aout.c | 2 + arch/x86/include/asm/floppy.h | 20 +- arch/x86/include/asm/fpu/types.h | 69 +- arch/x86/include/asm/io.h | 2 +- arch/x86/include/asm/page.h | 12 +- arch/x86/include/asm/paravirt_types.h | 23 +- arch/x86/include/asm/processor.h | 12 +- arch/x86/include/asm/thread_info.h | 6 +- arch/x86/include/asm/uaccess.h | 2 +- arch/x86/kernel/dumpstack.c | 10 +- arch/x86/kernel/dumpstack_32.c | 2 +- arch/x86/kernel/dumpstack_64.c | 2 +- arch/x86/kernel/ioport.c | 13 + arch/x86/kernel/irq_32.c | 3 + arch/x86/kernel/irq_64.c | 4 + arch/x86/kernel/ldt.c | 18 + arch/x86/kernel/msr.c | 10 + arch/x86/kernel/ptrace.c | 14 + arch/x86/kernel/signal.c | 9 +- arch/x86/kernel/sys_i386_32.c | 9 +- arch/x86/kernel/sys_x86_64.c | 8 +- arch/x86/kernel/traps.c | 5 + arch/x86/kernel/verify_cpu.S | 1 + arch/x86/kernel/vm86_32.c | 15 + arch/x86/kvm/svm.c | 14 +- arch/x86/mm/fault.c | 12 +- arch/x86/mm/hugetlbpage.c | 15 +- arch/x86/mm/init.c | 66 +- arch/x86/mm/init_32.c | 6 +- arch/x86/net/bpf_jit_comp.c | 4 + arch/x86/platform/efi/efi_64.c | 2 +- arch/x86/xen/Kconfig | 1 + arch/xtensa/variants/dc232b/include/variant/core.h | 2 +- arch/xtensa/variants/fsf/include/variant/core.h | 3 +- crypto/ablkcipher.c | 2 +- crypto/blkcipher.c | 2 +- crypto/scatterwalk.c | 10 +- drivers/acpi/acpica/hwxfsleep.c | 11 +- drivers/acpi/custom_method.c | 4 + drivers/block/cciss.h | 30 +- drivers/block/smart1,2.h | 40 +- drivers/cdrom/cdrom.c | 2 +- drivers/char/Kconfig | 4 +- drivers/char/genrtc.c | 1 + drivers/char/ipmi/ipmi_si_intf.c | 8 +- drivers/char/mem.c | 17 + drivers/char/random.c | 5 +- drivers/cpufreq/sparc-us3-cpufreq.c | 2 - drivers/crypto/nx/nx-aes-ccm.c | 2 +- drivers/crypto/nx/nx-aes-gcm.c | 2 +- drivers/crypto/talitos.c | 2 +- drivers/firewire/ohci.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 70 +- drivers/gpu/drm/nouveau/nouveau_ttm.c | 28 +- drivers/gpu/drm/ttm/ttm_bo_manager.c | 10 +- drivers/gpu/drm/virtio/virtgpu_ttm.c | 10 +- drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 10 +- drivers/hid/hid-wiimote-debug.c | 2 +- drivers/infiniband/hw/nes/nes_cm.c | 22 +- drivers/iommu/Kconfig | 1 + drivers/iommu/amd_iommu.c | 14 +- drivers/isdn/gigaset/bas-gigaset.c | 32 +- drivers/isdn/gigaset/ser-gigaset.c | 32 +- drivers/isdn/gigaset/usb-gigaset.c | 32 +- drivers/isdn/hisax/config.c | 2 +- drivers/isdn/hisax/hfc_pci.c | 2 +- drivers/isdn/hisax/hfc_sx.c | 2 +- drivers/isdn/hisax/q931.c | 6 +- drivers/isdn/i4l/isdn_concap.c | 6 +- drivers/isdn/i4l/isdn_x25iface.c | 16 +- drivers/md/bcache/Kconfig | 1 + drivers/md/raid5.c | 8 + drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +- drivers/media/platform/sti/c8sectpfe/Kconfig | 1 + drivers/media/platform/vivid/vivid-osd.c | 1 + drivers/media/radio/radio-cadet.c | 5 +- drivers/media/usb/dvb-usb/cinergyT2-core.c | 91 +- drivers/media/usb/dvb-usb/cinergyT2-fe.c | 182 +- drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 37 +- drivers/media/usb/dvb-usb/technisat-usb2.c | 75 +- drivers/message/fusion/mptbase.c | 9 + drivers/misc/sgi-xp/xp_main.c | 12 +- drivers/net/ethernet/brocade/bna/bna_enet.c | 8 +- drivers/net/ppp/pppoe.c | 14 +- drivers/net/ppp/pptp.c | 6 + drivers/net/slip/slhc.c | 3 + drivers/net/wan/lmc/lmc_media.c | 97 +- drivers/net/wan/x25_asy.c | 6 +- drivers/net/wan/z85230.c | 24 +- drivers/net/wireless/ath/ath9k/Kconfig | 1 - drivers/net/wireless/zd1211rw/zd_usb.c | 2 +- drivers/pci/pci-sysfs.c | 2 +- drivers/pci/proc.c | 9 + drivers/platform/x86/asus-wmi.c | 12 + drivers/rtc/rtc-dev.c | 3 + drivers/scsi/bfa/bfa_fcs.c | 19 +- drivers/scsi/bfa/bfa_fcs_lport.c | 29 +- drivers/scsi/bfa/bfa_modules.h | 12 +- drivers/scsi/hpsa.h | 40 +- drivers/staging/dgnc/dgnc_mgmt.c | 1 + drivers/staging/lustre/lustre/ldlm/ldlm_flock.c | 2 +- drivers/staging/lustre/lustre/libcfs/module.c | 10 +- drivers/target/target_core_sbc.c | 17 +- drivers/target/target_core_transport.c | 14 +- drivers/tty/serial/uartlite.c | 4 +- drivers/tty/sysrq.c | 2 +- drivers/tty/vt/keyboard.c | 22 +- drivers/uio/uio.c | 6 +- drivers/usb/core/hub.c | 5 + drivers/usb/gadget/function/f_uac1.c | 1 + drivers/usb/gadget/function/u_uac1.c | 1 + drivers/usb/host/hwa-hc.c | 9 +- drivers/usb/usbip/vhci_sysfs.c | 2 +- drivers/video/fbdev/arcfb.c | 2 +- drivers/video/fbdev/matrox/matroxfb_DAC1064.c | 10 +- drivers/video/fbdev/matrox/matroxfb_Ti3026.c | 5 +- drivers/video/fbdev/sh_mobile_lcdcfb.c | 6 +- drivers/video/logo/logo_linux_clut224.ppm | 2720 ++++----- drivers/xen/xenfs/xenstored.c | 5 + firmware/Makefile | 2 + firmware/WHENCE | 20 +- firmware/bnx2/bnx2-mips-06-6.2.3.fw.ihex | 5804 +++++++++++++++++ firmware/bnx2/bnx2-mips-09-6.2.1b.fw.ihex | 6496 ++++++++++++++++++++ fs/9p/vfs_inode.c | 4 +- fs/attr.c | 1 + fs/autofs4/waitq.c | 9 + fs/binfmt_aout.c | 7 + fs/binfmt_elf.c | 50 +- fs/compat.c | 20 +- fs/coredump.c | 17 +- fs/dcache.c | 3 + fs/debugfs/inode.c | 11 +- fs/exec.c | 219 +- fs/ext2/balloc.c | 4 +- fs/ext2/super.c | 8 +- fs/ext4/balloc.c | 4 +- fs/fcntl.c | 4 + fs/fhandle.c | 3 +- fs/file.c | 4 + fs/filesystems.c | 4 + fs/fs_struct.c | 20 +- fs/hugetlbfs/inode.c | 5 +- fs/inode.c | 8 +- fs/kernfs/dir.c | 6 + fs/mount.h | 4 +- fs/namei.c | 286 +- fs/namespace.c | 24 + fs/nfsd/nfscache.c | 2 +- fs/open.c | 38 + fs/overlayfs/inode.c | 11 +- fs/overlayfs/super.c | 6 +- fs/pipe.c | 2 +- fs/posix_acl.c | 15 +- fs/proc/Kconfig | 10 +- fs/proc/array.c | 69 +- fs/proc/base.c | 186 +- fs/proc/cmdline.c | 4 + fs/proc/devices.c | 4 + fs/proc/fd.c | 17 +- fs/proc/generic.c | 64 + fs/proc/inode.c | 17 + fs/proc/internal.h | 11 +- fs/proc/interrupts.c | 4 + fs/proc/kcore.c | 3 + fs/proc/meminfo.c | 7 +- fs/proc/namespaces.c | 4 +- fs/proc/proc_net.c | 31 + fs/proc/proc_sysctl.c | 52 +- fs/proc/root.c | 8 + fs/proc/stat.c | 69 +- fs/proc/task_mmu.c | 66 +- fs/readdir.c | 19 + fs/reiserfs/item_ops.c | 24 +- fs/reiserfs/super.c | 4 + fs/select.c | 2 + fs/seq_file.c | 30 +- fs/splice.c | 8 + fs/stat.c | 20 +- fs/sysfs/dir.c | 30 +- fs/sysv/inode.c | 11 +- fs/utimes.c | 7 + fs/xattr.c | 26 +- grsecurity/Kconfig | 1182 ++++ grsecurity/Makefile | 54 + grsecurity/gracl.c | 2757 +++++++++ grsecurity/gracl_alloc.c | 105 + grsecurity/gracl_cap.c | 127 + grsecurity/gracl_compat.c | 269 + grsecurity/gracl_fs.c | 448 ++ grsecurity/gracl_ip.c | 386 ++ grsecurity/gracl_learn.c | 207 + grsecurity/gracl_policy.c | 1786 ++++++ grsecurity/gracl_res.c | 68 + grsecurity/gracl_segv.c | 304 + grsecurity/gracl_shm.c | 40 + grsecurity/grsec_chdir.c | 19 + grsecurity/grsec_chroot.c | 467 ++ grsecurity/grsec_disabled.c | 445 ++ grsecurity/grsec_exec.c | 189 + grsecurity/grsec_fifo.c | 26 + grsecurity/grsec_fork.c | 23 + grsecurity/grsec_init.c | 290 + grsecurity/grsec_ipc.c | 48 + grsecurity/grsec_link.c | 65 + grsecurity/grsec_log.c | 340 + grsecurity/grsec_mem.c | 48 + grsecurity/grsec_mount.c | 65 + grsecurity/grsec_pax.c | 47 + grsecurity/grsec_proc.c | 20 + grsecurity/grsec_ptrace.c | 30 + grsecurity/grsec_sig.c | 236 + grsecurity/grsec_sock.c | 244 + grsecurity/grsec_sysctl.c | 488 ++ grsecurity/grsec_time.c | 16 + grsecurity/grsec_tpe.c | 78 + grsecurity/grsec_usb.c | 15 + grsecurity/grsum.c | 64 + include/linux/binfmts.h | 5 +- include/linux/bitops.h | 2 +- include/linux/capability.h | 13 + include/linux/compiler-gcc.h | 5 + include/linux/compiler.h | 8 + include/linux/cred.h | 8 +- include/linux/dcache.h | 5 +- include/linux/fs.h | 24 +- include/linux/fs_struct.h | 2 +- include/linux/fsnotify.h | 6 + include/linux/gracl.h | 342 + include/linux/gracl_compat.h | 156 + include/linux/gralloc.h | 9 + include/linux/grdefs.h | 140 + include/linux/grinternal.h | 230 + include/linux/grmsg.h | 118 + include/linux/grsecurity.h | 255 + include/linux/grsock.h | 19 + include/linux/ipc.h | 2 +- include/linux/ipc_namespace.h | 2 +- include/linux/kallsyms.h | 18 +- include/linux/kmod.h | 5 + include/linux/kobject.h | 2 +- include/linux/lsm_hooks.h | 4 +- include/linux/mm.h | 12 + include/linux/mm_types.h | 4 +- include/linux/module.h | 5 +- include/linux/mount.h | 2 +- include/linux/msg.h | 2 +- include/linux/netfilter/xt_gradm.h | 9 + include/linux/path.h | 4 +- include/linux/perf_event.h | 13 +- include/linux/pid_namespace.h | 2 +- include/linux/printk.h | 2 +- include/linux/proc_fs.h | 22 +- include/linux/proc_ns.h | 2 +- include/linux/ptrace.h | 24 +- include/linux/random.h | 2 +- include/linux/rbtree_augmented.h | 4 +- include/linux/scatterlist.h | 12 +- include/linux/sched.h | 114 +- include/linux/security.h | 1 + include/linux/sem.h | 2 +- include/linux/seq_file.h | 5 + include/linux/shm.h | 6 +- include/linux/skbuff.h | 3 + include/linux/slab.h | 9 - include/linux/sysctl.h | 8 +- include/linux/thread_info.h | 6 +- include/linux/tty.h | 2 +- include/linux/tty_driver.h | 4 +- include/linux/uidgid.h | 5 + include/linux/user_namespace.h | 2 +- include/linux/utsname.h | 2 +- include/linux/vermagic.h | 16 +- include/linux/vmalloc.h | 20 +- include/net/af_unix.h | 2 +- include/net/dst.h | 33 + include/net/ip.h | 2 +- include/net/neighbour.h | 2 +- include/net/net_namespace.h | 2 +- include/net/sock.h | 4 +- include/target/target_core_base.h | 2 +- include/trace/events/fs.h | 53 + include/uapi/linux/personality.h | 1 + init/Kconfig | 4 +- init/main.c | 35 +- ipc/mqueue.c | 1 + ipc/msg.c | 3 +- ipc/sem.c | 3 +- ipc/shm.c | 26 +- ipc/util.c | 6 + kernel/auditsc.c | 2 +- kernel/bpf/syscall.c | 8 +- kernel/capability.c | 41 +- kernel/cgroup.c | 5 +- kernel/compat.c | 1 + kernel/configs.c | 11 + kernel/cred.c | 112 +- kernel/events/core.c | 16 +- kernel/exit.c | 10 +- kernel/fork.c | 86 +- kernel/futex.c | 6 +- kernel/futex_compat.c | 2 +- kernel/kallsyms.c | 9 + kernel/kcmp.c | 8 +- kernel/kexec_core.c | 2 +- kernel/kmod.c | 95 +- kernel/kprobes.c | 7 +- kernel/ksysfs.c | 2 + kernel/locking/lockdep_proc.c | 10 +- kernel/module.c | 108 +- kernel/panic.c | 4 +- kernel/pid.c | 23 +- kernel/power/Kconfig | 2 + kernel/printk/printk.c | 20 +- kernel/ptrace.c | 56 +- kernel/resource.c | 10 + kernel/sched/core.c | 11 +- kernel/signal.c | 37 +- kernel/sys.c | 64 +- kernel/sysctl.c | 172 +- kernel/taskstats.c | 6 + kernel/time/posix-timers.c | 8 + kernel/time/time.c | 5 + kernel/time/timekeeping.c | 3 + kernel/time/timer_list.c | 13 +- kernel/time/timer_stats.c | 10 +- kernel/trace/Kconfig | 2 + kernel/trace/trace_syscalls.c | 8 + kernel/user_namespace.c | 15 + lib/Kconfig.debug | 13 +- lib/Kconfig.kasan | 2 +- lib/is_single_threaded.c | 3 + lib/list_debug.c | 65 +- lib/nlattr.c | 2 + lib/rbtree.c | 4 +- lib/vsprintf.c | 39 +- localversion-grsec | 1 + mm/Kconfig | 8 +- mm/Kconfig.debug | 1 + mm/filemap.c | 1 + mm/kmemleak.c | 4 +- mm/memory.c | 2 +- mm/mempolicy.c | 12 +- mm/migrate.c | 3 +- mm/mlock.c | 6 +- mm/mmap.c | 93 +- mm/mprotect.c | 8 + mm/oom_kill.c | 28 +- mm/page_alloc.c | 2 +- mm/process_vm_access.c | 8 +- mm/shmem.c | 36 +- mm/slab.c | 14 +- mm/slab_common.c | 2 +- mm/slob.c | 12 + mm/slub.c | 33 +- mm/util.c | 3 + mm/vmalloc.c | 129 +- mm/vmstat.c | 29 +- net/appletalk/atalk_proc.c | 2 +- net/atm/lec.c | 6 +- net/atm/mpoa_caches.c | 42 +- net/bluetooth/sco.c | 3 + net/can/bcm.c | 2 +- net/can/proc.c | 2 +- net/core/dev_ioctl.c | 7 +- net/core/filter.c | 8 +- net/core/net-procfs.c | 17 +- net/core/pktgen.c | 2 +- net/core/sock.c | 3 +- net/core/sysctl_net_core.c | 2 +- net/decnet/dn_dev.c | 2 +- net/ipv4/devinet.c | 6 +- net/ipv4/inet_hashtables.c | 4 + net/ipv4/ip_input.c | 7 + net/ipv4/ip_sockglue.c | 3 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv4/netfilter/nf_nat_pptp.c | 2 +- net/ipv4/route.c | 6 +- net/ipv4/tcp_input.c | 4 +- net/ipv4/tcp_ipv4.c | 29 +- net/ipv4/tcp_minisocks.c | 9 +- net/ipv4/tcp_timer.c | 11 + net/ipv4/udp.c | 24 + net/ipv6/addrconf.c | 13 +- net/ipv6/proc.c | 2 +- net/ipv6/tcp_ipv6.c | 26 +- net/ipv6/udp.c | 7 + net/ipx/ipx_proc.c | 2 +- net/irda/irproc.c | 2 +- net/llc/llc_proc.c | 2 +- net/netfilter/Kconfig | 10 + net/netfilter/Makefile | 1 + net/netfilter/nf_conntrack_core.c | 8 + net/netfilter/xt_gradm.c | 51 + net/netfilter/xt_hashlimit.c | 4 +- net/netfilter/xt_recent.c | 2 +- net/sched/sch_api.c | 2 +- net/sctp/socket.c | 4 +- net/socket.c | 75 +- net/sunrpc/Kconfig | 1 + net/sunrpc/cache.c | 2 +- net/sunrpc/stats.c | 2 +- net/sysctl_net.c | 2 +- net/unix/af_unix.c | 52 +- net/vmw_vsock/vmci_transport_notify.c | 30 +- net/vmw_vsock/vmci_transport_notify_qstate.c | 30 +- net/x25/sysctl_net_x25.c | 2 +- net/x25/x25_proc.c | 2 +- scripts/package/Makefile | 2 +- scripts/package/mkspec | 41 +- security/Kconfig | 369 +- security/apparmor/file.c | 4 +- security/apparmor/lsm.c | 8 +- security/commoncap.c | 36 +- security/min_addr.c | 2 + security/smack/smack_lsm.c | 8 +- security/tomoyo/file.c | 12 +- security/tomoyo/mount.c | 4 + security/tomoyo/tomoyo.c | 20 +- security/yama/Kconfig | 2 +- security/yama/yama_lsm.c | 4 +- sound/synth/emux/emux_seq.c | 14 +- sound/usb/line6/driver.c | 40 +- sound/usb/line6/toneport.c | 12 +- tools/gcc/.gitignore | 1 + tools/gcc/Makefile | 12 + tools/gcc/gen-random-seed.sh | 8 + tools/gcc/randomize_layout_plugin.c | 930 +++ tools/gcc/size_overflow_plugin/.gitignore | 1 + .../size_overflow_plugin/size_overflow_hash.data | 459 ++- 511 files changed, 32631 insertions(+), 3196 deletions(-) commit a76adb92ce39aee8eec5a025c828030ad6135c6d Author: Brad Spengler Date: Tue Dec 15 14:31:49 2015 -0500 Update to pax-linux-4.3.3-test11.patch: - fixed a few compile regressions with the recent plugin changes, reported by spender - updated the size overflow hash table tools/gcc/latent_entropy_plugin.c | 2 +- .../size_overflow_plugin/size_overflow_hash.data | 66 +++++++++++++++++--- tools/gcc/stackleak_plugin.c | 2 +- tools/gcc/structleak_plugin.c | 6 +-- 4 files changed, 60 insertions(+), 16 deletions(-) commit f7284b1fc06628fcb2d35d2beecdea5454d46af9 Author: Brad Spengler Date: Tue Dec 15 11:50:24 2015 -0500 Apply structleak ICE fix for gcc < 4.9 tools/gcc/structleak_plugin.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) commit 92fe3eb9fd10ec7f7334decab1526989669b0287 Author: Brad Spengler Date: Tue Dec 15 07:57:06 2015 -0500 Update to pax-linux-4.3.1-test10.patch: - Emese fixed INDIRECT_REF and TARGET_MEM_REF handling in the initify plugin - Emese regenerated the size overflow hash tables for 4.3 - fixed some compat syscall exit paths to restore r12 under KERNEXEC/or - the latent entropy, stackleak and structleak plugins no longer split the entry block unnecessarily arch/x86/entry/entry_64.S | 2 +- arch/x86/entry/entry_64_compat.S | 15 +- scripts/package/builddeb | 2 +- tools/gcc/initify_plugin.c | 11 +- tools/gcc/latent_entropy_plugin.c | 20 +- .../disable_size_overflow_hash.data | 4 + .../size_overflow_plugin/size_overflow_hash.data | 5345 +++++++++++--------- tools/gcc/stackleak_plugin.c | 26 +- tools/gcc/structleak_plugin.c | 21 +- 9 files changed, 3079 insertions(+), 2367 deletions(-) commit 5bd245cb687319079c2f1c0d6a1170791ed1ed2c Merge: b5847e6 3548341 Author: Brad Spengler Date: Tue Dec 15 07:47:56 2015 -0500 Merge branch 'linux-4.3.y' into pax-4_3 Conflicts: net/unix/af_unix.c commit b5847e6a896c5d99191135ca4d7c3b6be8f116ff Author: Brad Spengler Date: Wed Dec 9 23:11:36 2015 -0500 Update to pax-linux-4.3.1-test9.patch: - fixed __get_user on x86 to lie less about the size of the load, reported by peetaur (https://forums.grsecurity.net/viewtopic.php?f=3&t=4332) - Emese fixed an intentional overflow caused by gcc, reported by saironiq (https://forums.grsecurity.net/viewtopic.php?f=3&t=4333) - Emese fixed a false positive overflow report in the forcedeth driver, reported by fx3 (https://forums.grsecurity.net/viewtopic.php?t=4334) - Emese fixed a false positive overflow report in KVM's emulator, reported by fx3 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4336) - Emese fixed the initify plugin to detect some captured use of __func__, reported by Rasmus Villemoes - constrained shmmax and shmall to avoid triggering size overflow checks, reported by Mathias Krause - the checker plugin can partially handle sparse's locking context annotations, it's context insensitive and thus not exactly useful for now, also see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=59856 Makefile | 6 + arch/x86/include/asm/compat.h | 4 + arch/x86/include/asm/dma.h | 2 + arch/x86/include/asm/pmem.h | 2 +- arch/x86/include/asm/uaccess.h | 20 +- arch/x86/kernel/apic/vector.c | 6 +- arch/x86/kernel/cpu/mtrr/generic.c | 6 +- arch/x86/kernel/cpu/perf_event_intel.c | 28 +- arch/x86/kernel/head_64.S | 1 - arch/x86/kvm/i8259.c | 10 +- arch/x86/kvm/ioapic.c | 2 + arch/x86/kvm/x86.c | 2 + arch/x86/lib/usercopy_64.c | 2 +- arch/x86/mm/mpx.c | 4 +- arch/x86/mm/pageattr.c | 7 + drivers/base/devres.c | 4 +- drivers/base/power/runtime.c | 6 +- drivers/base/regmap/regmap.c | 4 +- drivers/block/drbd/drbd_receiver.c | 4 +- drivers/block/drbd/drbd_worker.c | 6 +- drivers/char/virtio_console.c | 6 +- drivers/md/dm.c | 12 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/macvtap.c | 4 +- drivers/video/fbdev/core/fbmem.c | 10 +- fs/compat.c | 3 +- fs/coredump.c | 2 +- fs/dcache.c | 13 +- fs/fhandle.c | 2 +- fs/file.c | 14 +- fs/fs-writeback.c | 11 +- fs/overlayfs/copy_up.c | 2 +- fs/readdir.c | 3 +- fs/super.c | 3 +- include/linux/compiler.h | 36 ++- include/linux/rcupdate.h | 8 + include/linux/sched.h | 4 +- include/linux/seqlock.h | 10 + include/linux/spinlock.h | 17 +- include/linux/srcu.h | 5 +- include/linux/syscalls.h | 2 +- include/linux/writeback.h | 3 +- include/uapi/linux/swab.h | 6 +- ipc/ipc_sysctl.c | 6 + kernel/exit.c | 25 +- kernel/resource.c | 4 +- kernel/signal.c | 12 +- kernel/user.c | 2 +- kernel/workqueue.c | 6 +- lib/rhashtable.c | 4 +- net/compat.c | 2 +- net/ipv4/xfrm4_mode_transport.c | 2 +- security/keys/internal.h | 8 +- security/keys/keyring.c | 4 - sound/core/seq/seq_clientmgr.c | 8 +- sound/core/seq/seq_compat.c | 2 +- sound/core/seq/seq_memory.c | 6 +- tools/gcc/checker_plugin.c | 415 +++++++++++++++++++- tools/gcc/gcc-common.h | 1 + tools/gcc/initify_plugin.c | 33 ++- .../disable_size_overflow_hash.data | 1 + .../size_overflow_plugin/size_overflow_hash.data | 1 - 62 files changed, 708 insertions(+), 140 deletions(-) commit f2634c2f6995f4231616f24ed016f890c701f939 Merge: 1241bff 5f8b236 Author: Brad Spengler Date: Wed Dec 9 21:50:47 2015 -0500 Merge branch 'linux-4.3.y' into pax-4_3 Conflicts: arch/x86/kernel/fpu/xstate.c arch/x86/kernel/head_64.S commit 1241bff82e3d7dadb05de0a60b8d2822afc6547c Author: Brad Spengler Date: Sun Dec 6 08:44:56 2015 -0500 Update to pax-linux-4.3-test8.patch: - fixed integer truncation check in md introduced by upstream commits 284ae7cab0f7335c9e0aa8992b28415ef1a54c7c and 58c0fed400603a802968b23ddf78f029c5a84e41, reported by BeiKed9o (https://forums.grsecurity.net/viewtopic.php?f=3&t=4328) - gcc plugin compilation problems will now also produce the output of the checking script to make diagnosis easier, reported by hunger - Emese fixed a false positive size overflow report in __vhost_add_used_n, reported by quasar366 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4329) - fixed a potential integer truncation error in the raid1 code caught by the size overflow plugin, reported by d1b (https://forums.grsecurity.net/viewtopic.php?f=3&t=4331) Makefile | 5 +++ drivers/md/md.c | 5 ++- drivers/md/raid1.c | 2 +- fs/proc/task_mmu.c | 3 ++ .../disable_size_overflow_hash.data | 4 ++- .../size_overflow_plugin/intentional_overflow.c | 32 ++++++++++++++++--- .../size_overflow_plugin/size_overflow_hash.data | 2 - .../size_overflow_plugin/size_overflow_plugin.c | 2 +- 8 files changed, 43 insertions(+), 12 deletions(-) commit cce6a9f9bdd27096632ca1c0246dcc07f2eb1a18 Author: Brad Spengler Date: Fri Dec 4 14:24:12 2015 -0500 Initial import of pax-linux-4.3-test7.patch Documentation/dontdiff | 47 +- Documentation/kbuild/makefiles.txt | 39 +- Documentation/kernel-parameters.txt | 28 + Makefile | 108 +- arch/alpha/include/asm/atomic.h | 10 + arch/alpha/include/asm/elf.h | 7 + arch/alpha/include/asm/pgalloc.h | 6 + arch/alpha/include/asm/pgtable.h | 11 + arch/alpha/kernel/module.c | 2 +- arch/alpha/kernel/osf_sys.c | 8 +- arch/alpha/mm/fault.c | 141 +- arch/arm/Kconfig | 2 +- arch/arm/include/asm/atomic.h | 320 +- arch/arm/include/asm/cache.h | 5 +- arch/arm/include/asm/cacheflush.h | 2 +- arch/arm/include/asm/checksum.h | 14 +- arch/arm/include/asm/cmpxchg.h | 4 + arch/arm/include/asm/cpuidle.h | 2 +- arch/arm/include/asm/domain.h | 22 +- arch/arm/include/asm/elf.h | 9 +- arch/arm/include/asm/fncpy.h | 2 + arch/arm/include/asm/futex.h | 10 + arch/arm/include/asm/kmap_types.h | 2 +- arch/arm/include/asm/mach/dma.h | 2 +- arch/arm/include/asm/mach/map.h | 16 +- arch/arm/include/asm/outercache.h | 2 +- arch/arm/include/asm/page.h | 3 +- arch/arm/include/asm/pgalloc.h | 20 + arch/arm/include/asm/pgtable-2level-hwdef.h | 4 +- arch/arm/include/asm/pgtable-2level.h | 3 + arch/arm/include/asm/pgtable-3level.h | 3 + arch/arm/include/asm/pgtable.h | 54 +- arch/arm/include/asm/smp.h | 2 +- arch/arm/include/asm/tls.h | 3 + arch/arm/include/asm/uaccess.h | 79 +- arch/arm/include/uapi/asm/ptrace.h | 2 +- arch/arm/kernel/armksyms.c | 2 +- arch/arm/kernel/cpuidle.c | 2 +- arch/arm/kernel/entry-armv.S | 109 +- arch/arm/kernel/entry-common.S | 40 +- arch/arm/kernel/entry-header.S | 55 + arch/arm/kernel/fiq.c | 3 + arch/arm/kernel/module-plts.c | 7 +- arch/arm/kernel/module.c | 38 +- arch/arm/kernel/patch.c | 2 + arch/arm/kernel/process.c | 90 +- arch/arm/kernel/reboot.c | 1 + arch/arm/kernel/setup.c | 20 +- arch/arm/kernel/signal.c | 35 +- arch/arm/kernel/smp.c | 2 +- arch/arm/kernel/tcm.c | 4 +- arch/arm/kernel/vmlinux.lds.S | 6 +- arch/arm/kvm/arm.c | 8 +- arch/arm/lib/copy_page.S | 1 + arch/arm/lib/csumpartialcopyuser.S | 4 +- arch/arm/lib/delay.c | 2 +- arch/arm/lib/uaccess_with_memcpy.c | 4 +- arch/arm/mach-exynos/suspend.c | 6 +- arch/arm/mach-mvebu/coherency.c | 4 +- arch/arm/mach-omap2/board-n8x0.c | 2 +- arch/arm/mach-omap2/omap-mpuss-lowpower.c | 4 +- arch/arm/mach-omap2/omap-smp.c | 1 + arch/arm/mach-omap2/omap-wakeupgen.c | 2 +- arch/arm/mach-omap2/omap_device.c | 4 +- arch/arm/mach-omap2/omap_device.h | 4 +- arch/arm/mach-omap2/omap_hwmod.c | 4 +- arch/arm/mach-omap2/powerdomains43xx_data.c | 5 +- arch/arm/mach-omap2/wd_timer.c | 6 +- arch/arm/mach-shmobile/platsmp-apmu.c | 5 +- arch/arm/mach-tegra/cpuidle-tegra20.c | 2 +- arch/arm/mach-tegra/irq.c | 1 + arch/arm/mach-ux500/pm.c | 1 + arch/arm/mach-zynq/platsmp.c | 1 + arch/arm/mm/Kconfig | 6 +- arch/arm/mm/alignment.c | 8 + arch/arm/mm/cache-l2x0.c | 2 +- arch/arm/mm/context.c | 10 +- arch/arm/mm/fault.c | 146 + arch/arm/mm/fault.h | 12 + arch/arm/mm/init.c | 39 + arch/arm/mm/ioremap.c | 4 +- arch/arm/mm/mmap.c | 30 +- arch/arm/mm/mmu.c | 162 +- arch/arm/net/bpf_jit_32.c | 3 + arch/arm/plat-iop/setup.c | 2 +- arch/arm/plat-omap/sram.c | 2 + arch/arm64/include/asm/atomic.h | 10 + arch/arm64/include/asm/percpu.h | 8 +- arch/arm64/include/asm/pgalloc.h | 5 + arch/arm64/include/asm/uaccess.h | 1 + arch/arm64/mm/dma-mapping.c | 2 +- arch/avr32/include/asm/elf.h | 8 +- arch/avr32/include/asm/kmap_types.h | 4 +- arch/avr32/mm/fault.c | 27 + arch/frv/include/asm/atomic.h | 10 + arch/frv/include/asm/kmap_types.h | 2 +- arch/frv/mm/elf-fdpic.c | 3 +- arch/ia64/Makefile | 1 + arch/ia64/include/asm/atomic.h | 10 + arch/ia64/include/asm/elf.h | 7 + arch/ia64/include/asm/pgalloc.h | 12 + arch/ia64/include/asm/pgtable.h | 13 +- arch/ia64/include/asm/spinlock.h | 2 +- arch/ia64/include/asm/uaccess.h | 27 +- arch/ia64/kernel/module.c | 45 +- arch/ia64/kernel/palinfo.c | 2 +- arch/ia64/kernel/sys_ia64.c | 7 + arch/ia64/kernel/vmlinux.lds.S | 2 +- arch/ia64/mm/fault.c | 32 +- arch/ia64/mm/init.c | 15 +- arch/m32r/lib/usercopy.c | 6 + arch/mips/cavium-octeon/dma-octeon.c | 2 +- arch/mips/include/asm/atomic.h | 368 +- arch/mips/include/asm/elf.h | 7 + arch/mips/include/asm/exec.h | 2 +- arch/mips/include/asm/hw_irq.h | 2 +- arch/mips/include/asm/local.h | 57 + arch/mips/include/asm/page.h | 2 +- arch/mips/include/asm/pgalloc.h | 5 + arch/mips/include/asm/pgtable.h | 3 + arch/mips/include/asm/uaccess.h | 1 + arch/mips/kernel/binfmt_elfn32.c | 7 + arch/mips/kernel/binfmt_elfo32.c | 7 + arch/mips/kernel/irq-gt641xx.c | 2 +- arch/mips/kernel/irq.c | 6 +- arch/mips/kernel/pm-cps.c | 2 +- arch/mips/kernel/process.c | 12 - arch/mips/kernel/sync-r4k.c | 24 +- arch/mips/kernel/traps.c | 13 +- arch/mips/mm/fault.c | 25 + arch/mips/mm/mmap.c | 51 +- arch/mips/sgi-ip27/ip27-nmi.c | 6 +- arch/mips/sni/rm200.c | 2 +- arch/mips/vr41xx/common/icu.c | 2 +- arch/mips/vr41xx/common/irq.c | 4 +- arch/parisc/include/asm/atomic.h | 10 + arch/parisc/include/asm/elf.h | 7 + arch/parisc/include/asm/pgalloc.h | 6 + arch/parisc/include/asm/pgtable.h | 11 + arch/parisc/include/asm/uaccess.h | 4 +- arch/parisc/kernel/module.c | 50 +- arch/parisc/kernel/sys_parisc.c | 15 + arch/parisc/kernel/traps.c | 4 +- arch/parisc/mm/fault.c | 140 +- arch/powerpc/include/asm/atomic.h | 329 +- arch/powerpc/include/asm/elf.h | 12 + arch/powerpc/include/asm/exec.h | 2 +- arch/powerpc/include/asm/kmap_types.h | 2 +- arch/powerpc/include/asm/local.h | 46 + arch/powerpc/include/asm/mman.h | 2 +- arch/powerpc/include/asm/page.h | 8 +- arch/powerpc/include/asm/page_64.h | 7 +- arch/powerpc/include/asm/pgalloc-64.h | 7 + arch/powerpc/include/asm/pgtable.h | 1 + arch/powerpc/include/asm/pte-hash32.h | 1 + arch/powerpc/include/asm/reg.h | 1 + arch/powerpc/include/asm/smp.h | 2 +- arch/powerpc/include/asm/spinlock.h | 42 +- arch/powerpc/include/asm/uaccess.h | 141 +- arch/powerpc/kernel/Makefile | 5 + arch/powerpc/kernel/exceptions-64e.S | 4 +- arch/powerpc/kernel/exceptions-64s.S | 2 +- arch/powerpc/kernel/module_32.c | 15 +- arch/powerpc/kernel/process.c | 46 - arch/powerpc/kernel/signal_32.c | 2 +- arch/powerpc/kernel/signal_64.c | 2 +- arch/powerpc/kernel/traps.c | 21 + arch/powerpc/kernel/vdso.c | 5 +- arch/powerpc/lib/usercopy_64.c | 18 - arch/powerpc/mm/fault.c | 56 +- arch/powerpc/mm/mmap.c | 16 + arch/powerpc/mm/slice.c | 13 +- arch/powerpc/platforms/cell/spufs/file.c | 4 +- arch/s390/include/asm/atomic.h | 10 + arch/s390/include/asm/elf.h | 7 + arch/s390/include/asm/exec.h | 2 +- arch/s390/include/asm/uaccess.h | 13 +- arch/s390/kernel/module.c | 22 +- arch/s390/kernel/process.c | 24 - arch/s390/mm/mmap.c | 16 + arch/score/include/asm/exec.h | 2 +- arch/score/kernel/process.c | 5 - arch/sh/mm/mmap.c | 22 +- arch/sparc/include/asm/atomic_64.h | 110 +- arch/sparc/include/asm/cache.h | 2 +- arch/sparc/include/asm/elf_32.h | 7 + arch/sparc/include/asm/elf_64.h | 7 + arch/sparc/include/asm/pgalloc_32.h | 1 + arch/sparc/include/asm/pgalloc_64.h | 1 + arch/sparc/include/asm/pgtable.h | 4 + arch/sparc/include/asm/pgtable_32.h | 15 +- arch/sparc/include/asm/pgtsrmmu.h | 5 + arch/sparc/include/asm/setup.h | 4 +- arch/sparc/include/asm/spinlock_64.h | 35 +- arch/sparc/include/asm/thread_info_32.h | 1 + arch/sparc/include/asm/thread_info_64.h | 2 + arch/sparc/include/asm/uaccess.h | 1 + arch/sparc/include/asm/uaccess_32.h | 28 +- arch/sparc/include/asm/uaccess_64.h | 24 +- arch/sparc/kernel/Makefile | 2 +- arch/sparc/kernel/prom_common.c | 2 +- arch/sparc/kernel/smp_64.c | 8 +- arch/sparc/kernel/sys_sparc_32.c | 2 +- arch/sparc/kernel/sys_sparc_64.c | 52 +- arch/sparc/kernel/traps_64.c | 27 +- arch/sparc/lib/Makefile | 2 +- arch/sparc/lib/atomic_64.S | 57 +- arch/sparc/lib/ksyms.c | 6 +- arch/sparc/mm/Makefile | 2 +- arch/sparc/mm/fault_32.c | 292 + arch/sparc/mm/fault_64.c | 486 + arch/sparc/mm/hugetlbpage.c | 22 +- arch/sparc/mm/init_64.c | 10 +- arch/tile/include/asm/atomic_64.h | 10 + arch/tile/include/asm/uaccess.h | 4 +- arch/um/Makefile | 4 + arch/um/include/asm/kmap_types.h | 2 +- arch/um/include/asm/page.h | 3 + arch/um/include/asm/pgtable-3level.h | 1 + arch/um/kernel/process.c | 16 - arch/x86/Kconfig | 15 +- arch/x86/Kconfig.cpu | 6 +- arch/x86/Kconfig.debug | 4 +- arch/x86/Makefile | 13 +- arch/x86/boot/Makefile | 3 + arch/x86/boot/bitops.h | 4 +- arch/x86/boot/boot.h | 2 +- arch/x86/boot/compressed/Makefile | 3 + arch/x86/boot/compressed/efi_stub_32.S | 16 +- arch/x86/boot/compressed/efi_thunk_64.S | 4 +- arch/x86/boot/compressed/head_32.S | 4 +- arch/x86/boot/compressed/head_64.S | 12 +- arch/x86/boot/compressed/misc.c | 11 +- arch/x86/boot/cpucheck.c | 16 +- arch/x86/boot/header.S | 6 +- arch/x86/boot/memory.c | 2 +- arch/x86/boot/video-vesa.c | 1 + arch/x86/boot/video.c | 2 +- arch/x86/crypto/aes-x86_64-asm_64.S | 4 + arch/x86/crypto/aesni-intel_asm.S | 106 +- arch/x86/crypto/blowfish-x86_64-asm_64.S | 7 + arch/x86/crypto/camellia-aesni-avx-asm_64.S | 10 + arch/x86/crypto/camellia-aesni-avx2-asm_64.S | 10 + arch/x86/crypto/camellia-x86_64-asm_64.S | 7 + arch/x86/crypto/cast5-avx-x86_64-asm_64.S | 51 +- arch/x86/crypto/cast6-avx-x86_64-asm_64.S | 25 +- arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 4 +- arch/x86/crypto/ghash-clmulni-intel_asm.S | 4 + arch/x86/crypto/salsa20-x86_64-asm_64.S | 4 + arch/x86/crypto/serpent-avx-x86_64-asm_64.S | 9 + arch/x86/crypto/serpent-avx2-asm_64.S | 9 + arch/x86/crypto/serpent-sse2-x86_64-asm_64.S | 4 + arch/x86/crypto/sha1_ssse3_asm.S | 10 +- arch/x86/crypto/sha256-avx-asm.S | 2 + arch/x86/crypto/sha256-avx2-asm.S | 2 + arch/x86/crypto/sha256-ssse3-asm.S | 2 + arch/x86/crypto/sha512-avx-asm.S | 2 + arch/x86/crypto/sha512-avx2-asm.S | 2 + arch/x86/crypto/sha512-ssse3-asm.S | 2 + arch/x86/crypto/twofish-avx-x86_64-asm_64.S | 25 +- arch/x86/crypto/twofish-x86_64-asm_64-3way.S | 4 + arch/x86/crypto/twofish-x86_64-asm_64.S | 3 + arch/x86/entry/calling.h | 86 +- arch/x86/entry/common.c | 13 +- arch/x86/entry/entry_32.S | 351 +- arch/x86/entry/entry_64.S | 619 +- arch/x86/entry/entry_64_compat.S | 159 +- arch/x86/entry/thunk_64.S | 2 + arch/x86/entry/vdso/Makefile | 2 +- arch/x86/entry/vdso/vdso2c.h | 8 +- arch/x86/entry/vdso/vma.c | 41 +- arch/x86/entry/vsyscall/vsyscall_64.c | 16 +- arch/x86/entry/vsyscall/vsyscall_emu_64.S | 2 +- arch/x86/ia32/ia32_signal.c | 23 +- arch/x86/ia32/sys_ia32.c | 42 +- arch/x86/include/asm/alternative-asm.h | 43 +- arch/x86/include/asm/alternative.h | 4 +- arch/x86/include/asm/apic.h | 2 +- arch/x86/include/asm/apm.h | 4 +- arch/x86/include/asm/atomic.h | 230 +- arch/x86/include/asm/atomic64_32.h | 100 + arch/x86/include/asm/atomic64_64.h | 164 +- arch/x86/include/asm/bitops.h | 18 +- arch/x86/include/asm/boot.h | 2 +- arch/x86/include/asm/cache.h | 5 +- arch/x86/include/asm/checksum_32.h | 12 +- arch/x86/include/asm/cmpxchg.h | 39 + arch/x86/include/asm/compat.h | 2 +- arch/x86/include/asm/cpufeature.h | 17 +- arch/x86/include/asm/desc.h | 78 +- arch/x86/include/asm/desc_defs.h | 6 + arch/x86/include/asm/div64.h | 2 +- arch/x86/include/asm/elf.h | 33 +- arch/x86/include/asm/emergency-restart.h | 2 +- arch/x86/include/asm/fpu/internal.h | 42 +- arch/x86/include/asm/fpu/types.h | 6 +- arch/x86/include/asm/futex.h | 14 +- arch/x86/include/asm/hw_irq.h | 4 +- arch/x86/include/asm/i8259.h | 2 +- arch/x86/include/asm/io.h | 22 +- arch/x86/include/asm/irqflags.h | 5 + arch/x86/include/asm/kprobes.h | 9 +- arch/x86/include/asm/local.h | 106 +- arch/x86/include/asm/mman.h | 15 + arch/x86/include/asm/mmu.h | 14 +- arch/x86/include/asm/mmu_context.h | 114 +- arch/x86/include/asm/module.h | 17 +- arch/x86/include/asm/nmi.h | 19 +- arch/x86/include/asm/page.h | 1 + arch/x86/include/asm/page_32.h | 12 +- arch/x86/include/asm/page_64.h | 14 +- arch/x86/include/asm/paravirt.h | 46 +- arch/x86/include/asm/paravirt_types.h | 15 +- arch/x86/include/asm/pgalloc.h | 23 + arch/x86/include/asm/pgtable-2level.h | 2 + arch/x86/include/asm/pgtable-3level.h | 7 + arch/x86/include/asm/pgtable.h | 128 +- arch/x86/include/asm/pgtable_32.h | 14 +- arch/x86/include/asm/pgtable_32_types.h | 24 +- arch/x86/include/asm/pgtable_64.h | 23 +- arch/x86/include/asm/pgtable_64_types.h | 5 + arch/x86/include/asm/pgtable_types.h | 26 +- arch/x86/include/asm/preempt.h | 2 +- arch/x86/include/asm/processor.h | 57 +- arch/x86/include/asm/ptrace.h | 13 +- arch/x86/include/asm/realmode.h | 4 +- arch/x86/include/asm/reboot.h | 10 +- arch/x86/include/asm/rmwcc.h | 84 +- arch/x86/include/asm/rwsem.h | 60 +- arch/x86/include/asm/segment.h | 27 +- arch/x86/include/asm/smap.h | 43 + arch/x86/include/asm/smp.h | 14 +- arch/x86/include/asm/stackprotector.h | 4 +- arch/x86/include/asm/stacktrace.h | 32 +- arch/x86/include/asm/switch_to.h | 4 +- arch/x86/include/asm/sys_ia32.h | 6 +- arch/x86/include/asm/thread_info.h | 27 +- arch/x86/include/asm/tlbflush.h | 77 +- arch/x86/include/asm/uaccess.h | 192 +- arch/x86/include/asm/uaccess_32.h | 28 +- arch/x86/include/asm/uaccess_64.h | 169 +- arch/x86/include/asm/word-at-a-time.h | 2 +- arch/x86/include/asm/x86_init.h | 10 +- arch/x86/include/asm/xen/page.h | 2 +- arch/x86/include/uapi/asm/e820.h | 2 +- arch/x86/kernel/Makefile | 2 +- arch/x86/kernel/acpi/boot.c | 4 +- arch/x86/kernel/acpi/sleep.c | 4 + arch/x86/kernel/acpi/wakeup_32.S | 6 +- arch/x86/kernel/alternative.c | 124 +- arch/x86/kernel/apic/apic.c | 4 +- arch/x86/kernel/apic/apic_flat_64.c | 6 +- arch/x86/kernel/apic/apic_noop.c | 2 +- arch/x86/kernel/apic/bigsmp_32.c | 2 +- arch/x86/kernel/apic/io_apic.c | 8 +- arch/x86/kernel/apic/msi.c | 2 +- arch/x86/kernel/apic/probe_32.c | 4 +- arch/x86/kernel/apic/vector.c | 4 +- arch/x86/kernel/apic/x2apic_cluster.c | 2 +- arch/x86/kernel/apic/x2apic_phys.c | 2 +- arch/x86/kernel/apic/x2apic_uv_x.c | 2 +- arch/x86/kernel/apm_32.c | 21 +- arch/x86/kernel/asm-offsets.c | 20 + arch/x86/kernel/asm-offsets_64.c | 1 + arch/x86/kernel/cpu/Makefile | 4 - arch/x86/kernel/cpu/amd.c | 2 +- arch/x86/kernel/cpu/bugs_64.c | 2 + arch/x86/kernel/cpu/common.c | 202 +- arch/x86/kernel/cpu/intel_cacheinfo.c | 14 +- arch/x86/kernel/cpu/mcheck/mce.c | 34 +- arch/x86/kernel/cpu/mcheck/p5.c | 3 + arch/x86/kernel/cpu/mcheck/winchip.c | 3 + arch/x86/kernel/cpu/microcode/intel.c | 4 +- arch/x86/kernel/cpu/mtrr/main.c | 2 +- arch/x86/kernel/cpu/mtrr/mtrr.h | 2 +- arch/x86/kernel/cpu/perf_event.c | 10 +- arch/x86/kernel/cpu/perf_event_amd_iommu.c | 2 +- arch/x86/kernel/cpu/perf_event_intel.c | 6 +- arch/x86/kernel/cpu/perf_event_intel_bts.c | 6 +- arch/x86/kernel/cpu/perf_event_intel_cqm.c | 4 +- arch/x86/kernel/cpu/perf_event_intel_pt.c | 44 +- arch/x86/kernel/cpu/perf_event_intel_rapl.c | 2 +- arch/x86/kernel/cpu/perf_event_intel_uncore.c | 2 +- arch/x86/kernel/cpu/perf_event_intel_uncore.h | 2 +- arch/x86/kernel/crash_dump_64.c | 2 +- arch/x86/kernel/doublefault.c | 8 +- arch/x86/kernel/dumpstack.c | 24 +- arch/x86/kernel/dumpstack_32.c | 25 +- arch/x86/kernel/dumpstack_64.c | 62 +- arch/x86/kernel/e820.c | 4 +- arch/x86/kernel/early_printk.c | 1 + arch/x86/kernel/espfix_64.c | 44 +- arch/x86/kernel/fpu/core.c | 24 +- arch/x86/kernel/fpu/init.c | 40 +- arch/x86/kernel/fpu/regset.c | 22 +- arch/x86/kernel/fpu/signal.c | 20 +- arch/x86/kernel/fpu/xstate.c | 8 +- arch/x86/kernel/ftrace.c | 18 +- arch/x86/kernel/head64.c | 14 +- arch/x86/kernel/head_32.S | 235 +- arch/x86/kernel/head_64.S | 173 +- arch/x86/kernel/i386_ksyms_32.c | 12 + arch/x86/kernel/i8259.c | 10 +- arch/x86/kernel/io_delay.c | 2 +- arch/x86/kernel/ioport.c | 2 +- arch/x86/kernel/irq.c | 8 +- arch/x86/kernel/irq_32.c | 45 +- arch/x86/kernel/jump_label.c | 10 +- arch/x86/kernel/kgdb.c | 21 +- arch/x86/kernel/kprobes/core.c | 28 +- arch/x86/kernel/kprobes/opt.c | 16 +- arch/x86/kernel/ksysfs.c | 2 +- arch/x86/kernel/kvmclock.c | 20 +- arch/x86/kernel/ldt.c | 25 + arch/x86/kernel/livepatch.c | 12 +- arch/x86/kernel/machine_kexec_32.c | 6 +- arch/x86/kernel/mcount_64.S | 19 +- arch/x86/kernel/module.c | 78 +- arch/x86/kernel/msr.c | 2 +- arch/x86/kernel/nmi.c | 34 +- arch/x86/kernel/nmi_selftest.c | 4 +- arch/x86/kernel/paravirt-spinlocks.c | 2 +- arch/x86/kernel/paravirt.c | 45 +- arch/x86/kernel/paravirt_patch_64.c | 8 + arch/x86/kernel/pci-calgary_64.c | 2 +- arch/x86/kernel/pci-iommu_table.c | 2 +- arch/x86/kernel/pci-swiotlb.c | 2 +- arch/x86/kernel/process.c | 80 +- arch/x86/kernel/process_32.c | 29 +- arch/x86/kernel/process_64.c | 14 +- arch/x86/kernel/ptrace.c | 20 +- arch/x86/kernel/pvclock.c | 8 +- arch/x86/kernel/reboot.c | 44 +- arch/x86/kernel/reboot_fixups_32.c | 2 +- arch/x86/kernel/relocate_kernel_64.S | 3 +- arch/x86/kernel/setup.c | 29 +- arch/x86/kernel/setup_percpu.c | 29 +- arch/x86/kernel/signal.c | 17 +- arch/x86/kernel/smp.c | 2 +- arch/x86/kernel/smpboot.c | 29 +- arch/x86/kernel/step.c | 6 +- arch/x86/kernel/sys_i386_32.c | 184 + arch/x86/kernel/sys_x86_64.c | 22 +- arch/x86/kernel/tboot.c | 14 +- arch/x86/kernel/time.c | 8 +- arch/x86/kernel/tls.c | 7 +- arch/x86/kernel/tracepoint.c | 4 +- arch/x86/kernel/traps.c | 53 +- arch/x86/kernel/tsc.c | 2 +- arch/x86/kernel/uprobes.c | 2 +- arch/x86/kernel/vm86_32.c | 6 +- arch/x86/kernel/vmlinux.lds.S | 153 +- arch/x86/kernel/x8664_ksyms_64.c | 6 +- arch/x86/kernel/x86_init.c | 6 +- arch/x86/kvm/cpuid.c | 21 +- arch/x86/kvm/emulate.c | 2 +- arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/paging_tmpl.h | 2 +- arch/x86/kvm/svm.c | 10 +- arch/x86/kvm/vmx.c | 62 +- arch/x86/kvm/x86.c | 42 +- arch/x86/lguest/boot.c | 3 +- arch/x86/lib/atomic64_386_32.S | 164 + arch/x86/lib/atomic64_cx8_32.S | 98 +- arch/x86/lib/checksum_32.S | 99 +- arch/x86/lib/clear_page_64.S | 3 + arch/x86/lib/cmpxchg16b_emu.S | 3 + arch/x86/lib/copy_page_64.S | 14 +- arch/x86/lib/copy_user_64.S | 66 +- arch/x86/lib/csum-copy_64.S | 14 +- arch/x86/lib/csum-wrappers_64.c | 8 +- arch/x86/lib/getuser.S | 74 +- arch/x86/lib/insn.c | 8 +- arch/x86/lib/iomap_copy_64.S | 2 + arch/x86/lib/memcpy_64.S | 6 + arch/x86/lib/memmove_64.S | 3 +- arch/x86/lib/memset_64.S | 3 + arch/x86/lib/mmx_32.c | 243 +- arch/x86/lib/msr-reg.S | 2 + arch/x86/lib/putuser.S | 87 +- arch/x86/lib/rwsem.S | 6 +- arch/x86/lib/usercopy_32.c | 359 +- arch/x86/lib/usercopy_64.c | 20 +- arch/x86/math-emu/fpu_aux.c | 2 +- arch/x86/math-emu/fpu_entry.c | 4 +- arch/x86/math-emu/fpu_system.h | 2 +- arch/x86/mm/Makefile | 4 + arch/x86/mm/extable.c | 26 +- arch/x86/mm/fault.c | 570 +- arch/x86/mm/gup.c | 6 +- arch/x86/mm/highmem_32.c | 6 + arch/x86/mm/hugetlbpage.c | 24 +- arch/x86/mm/init.c | 111 +- arch/x86/mm/init_32.c | 111 +- arch/x86/mm/init_64.c | 46 +- arch/x86/mm/iomap_32.c | 4 + arch/x86/mm/ioremap.c | 52 +- arch/x86/mm/kmemcheck/kmemcheck.c | 4 +- arch/x86/mm/mmap.c | 40 +- arch/x86/mm/mmio-mod.c | 10 +- arch/x86/mm/numa.c | 2 +- arch/x86/mm/pageattr.c | 38 +- arch/x86/mm/pat.c | 12 +- arch/x86/mm/pat_rbtree.c | 2 +- arch/x86/mm/pf_in.c | 10 +- arch/x86/mm/pgtable.c | 214 +- arch/x86/mm/pgtable_32.c | 3 + arch/x86/mm/setup_nx.c | 7 + arch/x86/mm/tlb.c | 4 + arch/x86/mm/uderef_64.c | 37 + arch/x86/net/bpf_jit.S | 11 + arch/x86/net/bpf_jit_comp.c | 13 +- arch/x86/oprofile/backtrace.c | 6 +- arch/x86/oprofile/nmi_int.c | 8 +- arch/x86/oprofile/op_model_amd.c | 8 +- arch/x86/oprofile/op_model_ppro.c | 7 +- arch/x86/oprofile/op_x86_model.h | 2 +- arch/x86/pci/intel_mid_pci.c | 2 +- arch/x86/pci/irq.c | 8 +- arch/x86/pci/pcbios.c | 144 +- arch/x86/platform/efi/efi_32.c | 24 + arch/x86/platform/efi/efi_64.c | 26 +- arch/x86/platform/efi/efi_stub_32.S | 64 +- arch/x86/platform/efi/efi_stub_64.S | 2 + arch/x86/platform/intel-mid/intel-mid.c | 5 +- arch/x86/platform/intel-mid/intel_mid_weak_decls.h | 6 +- arch/x86/platform/intel-mid/mfld.c | 4 +- arch/x86/platform/intel-mid/mrfl.c | 2 +- arch/x86/platform/intel-quark/imr_selftest.c | 2 +- arch/x86/platform/olpc/olpc_dt.c | 2 +- arch/x86/power/cpu.c | 11 +- arch/x86/realmode/init.c | 10 +- arch/x86/realmode/rm/Makefile | 3 + arch/x86/realmode/rm/header.S | 4 +- arch/x86/realmode/rm/reboot.S | 4 + arch/x86/realmode/rm/trampoline_32.S | 12 +- arch/x86/realmode/rm/trampoline_64.S | 3 +- arch/x86/realmode/rm/wakeup_asm.S | 5 +- arch/x86/tools/Makefile | 2 +- arch/x86/tools/relocs.c | 96 +- arch/x86/um/mem_32.c | 2 +- arch/x86/um/tls_32.c | 2 +- arch/x86/xen/enlighten.c | 50 +- arch/x86/xen/mmu.c | 19 +- arch/x86/xen/smp.c | 16 +- arch/x86/xen/xen-asm_32.S | 2 +- arch/x86/xen/xen-head.S | 11 + arch/x86/xen/xen-ops.h | 2 - block/bio.c | 4 +- block/blk-iopoll.c | 2 +- block/blk-map.c | 2 +- block/blk-softirq.c | 2 +- block/bsg.c | 12 +- block/compat_ioctl.c | 4 +- block/genhd.c | 9 +- block/partitions/efi.c | 8 +- block/scsi_ioctl.c | 29 +- crypto/cryptd.c | 4 +- crypto/pcrypt.c | 2 +- crypto/zlib.c | 12 +- drivers/acpi/acpi_video.c | 2 +- drivers/acpi/apei/apei-internal.h | 2 +- drivers/acpi/apei/ghes.c | 4 +- drivers/acpi/bgrt.c | 6 +- drivers/acpi/blacklist.c | 4 +- drivers/acpi/bus.c | 4 +- drivers/acpi/device_pm.c | 4 +- drivers/acpi/ec.c | 2 +- drivers/acpi/pci_slot.c | 2 +- drivers/acpi/processor_idle.c | 2 +- drivers/acpi/processor_pdc.c | 2 +- drivers/acpi/sleep.c | 2 +- drivers/acpi/sysfs.c | 4 +- drivers/acpi/thermal.c | 2 +- drivers/acpi/video_detect.c | 7 +- drivers/ata/libata-core.c | 12 +- drivers/ata/libata-scsi.c | 2 +- drivers/ata/libata.h | 2 +- drivers/ata/pata_arasan_cf.c | 4 +- drivers/atm/adummy.c | 2 +- drivers/atm/ambassador.c | 8 +- drivers/atm/atmtcp.c | 14 +- drivers/atm/eni.c | 10 +- drivers/atm/firestream.c | 8 +- drivers/atm/fore200e.c | 14 +- drivers/atm/he.c | 18 +- drivers/atm/horizon.c | 4 +- drivers/atm/idt77252.c | 36 +- drivers/atm/iphase.c | 34 +- drivers/atm/lanai.c | 12 +- drivers/atm/nicstar.c | 46 +- drivers/atm/solos-pci.c | 4 +- drivers/atm/suni.c | 4 +- drivers/atm/uPD98402.c | 16 +- drivers/atm/zatm.c | 6 +- drivers/base/bus.c | 4 +- drivers/base/devtmpfs.c | 8 +- drivers/base/node.c | 2 +- drivers/base/platform-msi.c | 20 +- drivers/base/power/domain.c | 11 +- drivers/base/power/sysfs.c | 2 +- drivers/base/power/wakeup.c | 8 +- drivers/base/regmap/regmap-debugfs.c | 11 +- drivers/base/syscore.c | 4 +- drivers/block/cciss.c | 28 +- drivers/block/cciss.h | 2 +- drivers/block/cpqarray.c | 28 +- drivers/block/cpqarray.h | 2 +- drivers/block/drbd/drbd_bitmap.c | 2 +- drivers/block/drbd/drbd_int.h | 8 +- drivers/block/drbd/drbd_main.c | 12 +- drivers/block/drbd/drbd_nl.c | 4 +- drivers/block/drbd/drbd_receiver.c | 34 +- drivers/block/drbd/drbd_worker.c | 8 +- drivers/block/pktcdvd.c | 4 +- drivers/block/rbd.c | 2 +- drivers/bluetooth/btwilink.c | 2 +- drivers/bus/arm-cci.c | 12 +- drivers/cdrom/cdrom.c | 11 +- drivers/cdrom/gdrom.c | 1 - drivers/char/agp/compat_ioctl.c | 2 +- drivers/char/agp/frontend.c | 4 +- drivers/char/agp/intel-gtt.c | 4 +- drivers/char/hpet.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 8 +- drivers/char/ipmi/ipmi_si_intf.c | 8 +- drivers/char/mem.c | 47 +- drivers/char/nvram.c | 2 +- drivers/char/pcmcia/synclink_cs.c | 16 +- drivers/char/random.c | 12 +- drivers/char/sonypi.c | 11 +- drivers/char/tpm/tpm_acpi.c | 3 +- drivers/char/tpm/tpm_eventlog.c | 4 +- drivers/char/virtio_console.c | 4 +- drivers/clk/clk-composite.c | 2 +- drivers/clk/samsung/clk.h | 2 +- drivers/clk/socfpga/clk-gate.c | 9 +- drivers/clk/socfpga/clk-pll.c | 9 +- drivers/clk/ti/clk.c | 8 +- drivers/cpufreq/acpi-cpufreq.c | 17 +- drivers/cpufreq/cpufreq-dt.c | 4 +- drivers/cpufreq/cpufreq.c | 30 +- drivers/cpufreq/cpufreq_governor.c | 2 +- drivers/cpufreq/cpufreq_governor.h | 4 +- drivers/cpufreq/cpufreq_ondemand.c | 10 +- drivers/cpufreq/intel_pstate.c | 33 +- drivers/cpufreq/p4-clockmod.c | 12 +- drivers/cpufreq/sparc-us3-cpufreq.c | 67 +- drivers/cpufreq/speedstep-centrino.c | 7 +- drivers/cpuidle/driver.c | 2 +- drivers/cpuidle/dt_idle_states.c | 2 +- drivers/cpuidle/governor.c | 2 +- drivers/cpuidle/sysfs.c | 2 +- drivers/crypto/hifn_795x.c | 4 +- drivers/devfreq/devfreq.c | 4 +- drivers/dma/sh/shdma-base.c | 4 +- drivers/dma/sh/shdmac.c | 2 +- drivers/edac/edac_device.c | 4 +- drivers/edac/edac_mc_sysfs.c | 2 +- drivers/edac/edac_pci.c | 4 +- drivers/edac/edac_pci_sysfs.c | 22 +- drivers/edac/mce_amd.h | 2 +- drivers/firewire/core-card.c | 6 +- drivers/firewire/core-device.c | 2 +- drivers/firewire/core-transaction.c | 1 + drivers/firewire/core.h | 1 + drivers/firmware/dmi-id.c | 2 +- drivers/firmware/dmi_scan.c | 12 +- drivers/firmware/efi/cper.c | 8 +- drivers/firmware/efi/efi.c | 12 +- drivers/firmware/efi/efivars.c | 2 +- drivers/firmware/efi/runtime-map.c | 2 +- drivers/firmware/google/gsmi.c | 2 +- drivers/firmware/google/memconsole.c | 7 +- drivers/firmware/memmap.c | 2 +- drivers/firmware/psci.c | 2 +- drivers/gpio/gpio-davinci.c | 6 +- drivers/gpio/gpio-em.c | 2 +- drivers/gpio/gpio-ich.c | 2 +- drivers/gpio/gpio-omap.c | 4 +- drivers/gpio/gpio-rcar.c | 2 +- drivers/gpio/gpio-vr41xx.c | 2 +- drivers/gpio/gpiolib.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 6 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 90 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.h | 8 +- .../drm/amd/amdkfd/kfd_device_queue_manager_cik.c | 14 +- .../drm/amd/amdkfd/kfd_device_queue_manager_vi.c | 14 +- drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.h | 2 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 16 +- drivers/gpu/drm/drm_crtc.c | 2 +- drivers/gpu/drm/drm_drv.c | 2 +- drivers/gpu/drm/drm_fops.c | 12 +- drivers/gpu/drm/drm_global.c | 14 +- drivers/gpu/drm/drm_info.c | 13 +- drivers/gpu/drm/drm_ioc32.c | 13 +- drivers/gpu/drm/drm_ioctl.c | 2 +- drivers/gpu/drm/gma500/mdfld_dsi_dpi.c | 10 +- drivers/gpu/drm/i810/i810_drv.h | 4 +- drivers/gpu/drm/i915/i915_dma.c | 2 +- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 4 +- drivers/gpu/drm/i915/i915_gem_gtt.c | 16 +- drivers/gpu/drm/i915/i915_gem_gtt.h | 6 +- drivers/gpu/drm/i915/i915_ioc32.c | 10 +- drivers/gpu/drm/i915/intel_display.c | 26 +- drivers/gpu/drm/imx/imx-drm-core.c | 2 +- drivers/gpu/drm/mga/mga_drv.h | 4 +- drivers/gpu/drm/mga/mga_ioc32.c | 10 +- drivers/gpu/drm/mga/mga_irq.c | 8 +- drivers/gpu/drm/nouveau/nouveau_bios.c | 2 +- drivers/gpu/drm/nouveau/nouveau_drm.h | 1 - drivers/gpu/drm/nouveau/nouveau_ioc32.c | 2 +- drivers/gpu/drm/nouveau/nouveau_vga.c | 2 +- drivers/gpu/drm/omapdrm/Makefile | 2 +- drivers/gpu/drm/qxl/qxl_cmd.c | 12 +- drivers/gpu/drm/qxl/qxl_debugfs.c | 8 +- drivers/gpu/drm/qxl/qxl_drv.h | 8 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 10 +- drivers/gpu/drm/qxl/qxl_irq.c | 16 +- drivers/gpu/drm/qxl/qxl_ttm.c | 38 +- drivers/gpu/drm/r128/r128_cce.c | 2 +- drivers/gpu/drm/r128/r128_drv.h | 4 +- drivers/gpu/drm/r128/r128_ioc32.c | 10 +- drivers/gpu/drm/r128/r128_irq.c | 4 +- drivers/gpu/drm/r128/r128_state.c | 4 +- drivers/gpu/drm/radeon/mkregtable.c | 4 +- drivers/gpu/drm/radeon/radeon_device.c | 2 +- drivers/gpu/drm/radeon/radeon_drv.h | 2 +- drivers/gpu/drm/radeon/radeon_ioc32.c | 12 +- drivers/gpu/drm/radeon/radeon_irq.c | 6 +- drivers/gpu/drm/radeon/radeon_state.c | 4 +- drivers/gpu/drm/radeon/radeon_ttm.c | 4 +- drivers/gpu/drm/tegra/dc.c | 2 +- drivers/gpu/drm/tegra/dsi.c | 2 +- drivers/gpu/drm/tegra/hdmi.c | 2 +- drivers/gpu/drm/tegra/sor.c | 7 +- drivers/gpu/drm/tilcdc/Makefile | 6 +- drivers/gpu/drm/ttm/ttm_memory.c | 4 +- drivers/gpu/drm/ttm/ttm_page_alloc.c | 18 +- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 18 +- drivers/gpu/drm/udl/udl_fb.c | 1 - drivers/gpu/drm/via/via_drv.h | 4 +- drivers/gpu/drm/via/via_irq.c | 18 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_irq.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_marker.c | 2 +- drivers/gpu/vga/vga_switcheroo.c | 4 +- drivers/hid/hid-core.c | 4 +- drivers/hid/hid-sensor-custom.c | 2 +- drivers/hv/channel.c | 2 +- drivers/hv/hv.c | 4 +- drivers/hv/hv_balloon.c | 18 +- drivers/hv/hyperv_vmbus.h | 2 +- drivers/hwmon/acpi_power_meter.c | 6 +- drivers/hwmon/applesmc.c | 2 +- drivers/hwmon/asus_atk0110.c | 10 +- drivers/hwmon/coretemp.c | 2 +- drivers/hwmon/dell-smm-hwmon.c | 2 +- drivers/hwmon/ibmaem.c | 2 +- drivers/hwmon/iio_hwmon.c | 2 +- drivers/hwmon/nct6683.c | 6 +- drivers/hwmon/nct6775.c | 6 +- drivers/hwmon/pmbus/pmbus_core.c | 10 +- drivers/hwmon/sht15.c | 12 +- drivers/hwmon/via-cputemp.c | 2 +- drivers/i2c/busses/i2c-amd756-s4882.c | 2 +- drivers/i2c/busses/i2c-nforce2-s4985.c | 2 +- drivers/i2c/i2c-dev.c | 2 +- drivers/ide/ide-cd.c | 2 +- drivers/ide/ide-disk.c | 2 +- drivers/iio/industrialio-core.c | 2 +- drivers/iio/magnetometer/ak8975.c | 2 +- drivers/infiniband/core/cm.c | 32 +- drivers/infiniband/core/fmr_pool.c | 20 +- drivers/infiniband/core/uverbs_cmd.c | 3 + drivers/infiniband/hw/cxgb4/mem.c | 4 +- drivers/infiniband/hw/mlx4/mad.c | 2 +- drivers/infiniband/hw/mlx4/mcg.c | 2 +- drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 +- drivers/infiniband/hw/mthca/mthca_cmd.c | 8 +- drivers/infiniband/hw/mthca/mthca_main.c | 2 +- drivers/infiniband/hw/mthca/mthca_mr.c | 6 +- drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/nes/nes.c | 4 +- drivers/infiniband/hw/nes/nes.h | 40 +- drivers/infiniband/hw/nes/nes_cm.c | 62 +- drivers/infiniband/hw/nes/nes_mgt.c | 8 +- drivers/infiniband/hw/nes/nes_nic.c | 40 +- drivers/infiniband/hw/nes/nes_verbs.c | 10 +- drivers/infiniband/hw/qib/qib.h | 1 + drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 2 +- drivers/input/gameport/gameport.c | 4 +- drivers/input/input.c | 4 +- drivers/input/joystick/sidewinder.c | 1 + drivers/input/joystick/xpad.c | 4 +- drivers/input/misc/ims-pcu.c | 4 +- drivers/input/mouse/psmouse.h | 2 +- drivers/input/mousedev.c | 2 +- drivers/input/serio/serio.c | 4 +- drivers/input/serio/serio_raw.c | 4 +- drivers/input/touchscreen/htcpen.c | 2 +- drivers/iommu/arm-smmu-v3.c | 2 +- drivers/iommu/arm-smmu.c | 43 +- drivers/iommu/io-pgtable-arm.c | 101 +- drivers/iommu/io-pgtable.c | 11 +- drivers/iommu/io-pgtable.h | 19 +- drivers/iommu/iommu.c | 2 +- drivers/iommu/ipmmu-vmsa.c | 13 +- drivers/iommu/irq_remapping.c | 2 +- drivers/irqchip/irq-gic.c | 2 +- drivers/irqchip/irq-i8259.c | 2 +- drivers/irqchip/irq-renesas-intc-irqpin.c | 2 +- drivers/irqchip/irq-renesas-irqc.c | 2 +- drivers/isdn/capi/capi.c | 10 +- drivers/isdn/gigaset/interface.c | 8 +- drivers/isdn/gigaset/usb-gigaset.c | 2 +- drivers/isdn/hardware/avm/b1.c | 4 +- drivers/isdn/i4l/isdn_common.c | 2 + drivers/isdn/i4l/isdn_tty.c | 22 +- drivers/isdn/icn/icn.c | 2 +- drivers/isdn/mISDN/dsp_cmx.c | 2 +- drivers/lguest/core.c | 10 +- drivers/lguest/page_tables.c | 2 +- drivers/lguest/x86/core.c | 12 +- drivers/lguest/x86/switcher_32.S | 27 +- drivers/md/bcache/closure.h | 2 +- drivers/md/bitmap.c | 2 +- drivers/md/dm-ioctl.c | 2 +- drivers/md/dm-raid1.c | 18 +- drivers/md/dm-stats.c | 6 +- drivers/md/dm-stripe.c | 10 +- drivers/md/dm-table.c | 2 +- drivers/md/dm-thin-metadata.c | 4 +- drivers/md/dm.c | 16 +- drivers/md/md.c | 26 +- drivers/md/md.h | 6 +- drivers/md/persistent-data/dm-space-map-metadata.c | 4 +- drivers/md/persistent-data/dm-space-map.h | 1 + drivers/md/raid1.c | 4 +- drivers/md/raid10.c | 18 +- drivers/md/raid5.c | 22 +- drivers/media/dvb-core/dvbdev.c | 2 +- drivers/media/dvb-frontends/af9033.h | 2 +- drivers/media/dvb-frontends/dib3000.h | 2 +- drivers/media/dvb-frontends/dib7000p.h | 2 +- drivers/media/dvb-frontends/dib8000.h | 2 +- drivers/media/pci/cx88/cx88-video.c | 6 +- drivers/media/pci/ivtv/ivtv-driver.c | 2 +- drivers/media/pci/solo6x10/solo6x10-core.c | 2 +- drivers/media/pci/solo6x10/solo6x10-p2m.c | 2 +- drivers/media/pci/solo6x10/solo6x10.h | 2 +- drivers/media/pci/tw68/tw68-core.c | 2 +- drivers/media/platform/omap/omap_vout.c | 11 +- drivers/media/platform/s5p-tv/mixer.h | 2 +- drivers/media/platform/s5p-tv/mixer_grp_layer.c | 2 +- drivers/media/platform/s5p-tv/mixer_reg.c | 2 +- drivers/media/platform/s5p-tv/mixer_video.c | 24 +- drivers/media/platform/s5p-tv/mixer_vp_layer.c | 2 +- drivers/media/radio/radio-cadet.c | 2 + drivers/media/radio/radio-maxiradio.c | 2 +- drivers/media/radio/radio-shark.c | 2 +- drivers/media/radio/radio-shark2.c | 2 +- drivers/media/radio/radio-si476x.c | 2 +- drivers/media/radio/wl128x/fmdrv_common.c | 2 +- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 12 +- drivers/media/v4l2-core/v4l2-device.c | 4 +- drivers/media/v4l2-core/v4l2-ioctl.c | 13 +- drivers/memory/omap-gpmc.c | 21 +- drivers/message/fusion/mptsas.c | 34 +- drivers/mfd/ab8500-debugfs.c | 2 +- drivers/mfd/kempld-core.c | 2 +- drivers/mfd/max8925-i2c.c | 2 +- drivers/mfd/tps65910.c | 2 +- drivers/mfd/twl4030-irq.c | 9 +- drivers/mfd/wm5110-tables.c | 2 +- drivers/mfd/wm8998-tables.c | 2 +- drivers/misc/c2port/core.c | 4 +- drivers/misc/kgdbts.c | 4 +- drivers/misc/lis3lv02d/lis3lv02d.c | 8 +- drivers/misc/lis3lv02d/lis3lv02d.h | 2 +- drivers/misc/mic/scif/scif_rb.c | 8 +- drivers/misc/sgi-gru/gruhandles.c | 4 +- drivers/misc/sgi-gru/gruprocfs.c | 8 +- drivers/misc/sgi-gru/grutables.h | 154 +- drivers/misc/sgi-xp/xp.h | 2 +- drivers/misc/sgi-xp/xpc.h | 3 +- drivers/misc/sgi-xp/xpc_main.c | 2 +- drivers/mmc/card/block.c | 2 +- drivers/mmc/host/dw_mmc.h | 2 +- drivers/mmc/host/mmci.c | 4 +- drivers/mmc/host/omap_hsmmc.c | 4 +- drivers/mmc/host/sdhci-esdhc-imx.c | 7 +- drivers/mmc/host/sdhci-s3c.c | 8 +- drivers/mtd/chips/cfi_cmdset_0020.c | 2 +- drivers/mtd/nand/denali.c | 1 + drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 2 +- drivers/mtd/nftlmount.c | 1 + drivers/mtd/sm_ftl.c | 2 +- drivers/net/bonding/bond_netlink.c | 2 +- drivers/net/caif/caif_hsi.c | 2 +- drivers/net/can/Kconfig | 2 +- drivers/net/can/dev.c | 2 +- drivers/net/can/vcan.c | 2 +- drivers/net/dummy.c | 2 +- drivers/net/ethernet/8390/ax88796.c | 4 +- drivers/net/ethernet/altera/altera_tse_main.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-common.h | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-dcb.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-desc.c | 27 +- drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 143 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 64 +- drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 10 +- drivers/net/ethernet/amd/xgbe/xgbe-main.c | 15 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 27 +- drivers/net/ethernet/amd/xgbe/xgbe-ptp.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe.h | 10 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c | 11 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 3 +- drivers/net/ethernet/broadcom/tg3.h | 1 + drivers/net/ethernet/cavium/liquidio/lio_ethtool.c | 6 +- drivers/net/ethernet/cavium/liquidio/lio_main.c | 11 +- drivers/net/ethernet/chelsio/cxgb3/l2t.h | 2 +- drivers/net/ethernet/dec/tulip/de4x5.c | 4 +- drivers/net/ethernet/emulex/benet/be_main.c | 2 +- drivers/net/ethernet/faraday/ftgmac100.c | 2 + drivers/net/ethernet/faraday/ftmac100.c | 2 + drivers/net/ethernet/intel/i40e/i40e_ptp.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 7 +- drivers/net/ethernet/neterion/vxge/vxge-config.c | 7 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 4 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c | 12 +- .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 +- drivers/net/ethernet/realtek/r8169.c | 8 +- drivers/net/ethernet/sfc/ptp.c | 2 +- drivers/net/ethernet/stmicro/stmmac/mmc_core.c | 4 +- drivers/net/ethernet/via/via-rhine.c | 2 +- drivers/net/geneve.c | 2 +- drivers/net/hyperv/hyperv_net.h | 2 +- drivers/net/hyperv/rndis_filter.c | 4 +- drivers/net/ifb.c | 2 +- drivers/net/ipvlan/ipvlan_core.c | 2 +- drivers/net/macvlan.c | 20 +- drivers/net/macvtap.c | 6 +- drivers/net/nlmon.c | 2 +- drivers/net/phy/phy_device.c | 6 +- drivers/net/ppp/ppp_generic.c | 4 +- drivers/net/slip/slhc.c | 2 +- drivers/net/team/team.c | 4 +- drivers/net/tun.c | 7 +- drivers/net/usb/hso.c | 23 +- drivers/net/usb/r8152.c | 2 +- drivers/net/usb/sierra_net.c | 4 +- drivers/net/virtio_net.c | 2 +- drivers/net/vrf.c | 2 +- drivers/net/vxlan.c | 4 +- drivers/net/wimax/i2400m/rx.c | 2 +- drivers/net/wireless/airo.c | 2 +- drivers/net/wireless/at76c50x-usb.c | 2 +- drivers/net/wireless/ath/ath10k/ce.c | 6 +- drivers/net/wireless/ath/ath10k/htc.c | 7 +- drivers/net/wireless/ath/ath10k/htc.h | 4 +- drivers/net/wireless/ath/ath9k/ar9002_mac.c | 36 +- drivers/net/wireless/ath/ath9k/ar9003_mac.c | 64 +- drivers/net/wireless/ath/ath9k/hw.h | 4 +- drivers/net/wireless/ath/ath9k/main.c | 22 +- drivers/net/wireless/ath/wil6210/wil_platform.h | 2 +- drivers/net/wireless/b43/phy_lp.c | 2 +- drivers/net/wireless/iwlegacy/3945-mac.c | 4 +- drivers/net/wireless/iwlwifi/dvm/debugfs.c | 34 +- drivers/net/wireless/iwlwifi/pcie/trans.c | 4 +- drivers/net/wireless/mac80211_hwsim.c | 28 +- drivers/net/wireless/rndis_wlan.c | 2 +- drivers/net/wireless/rt2x00/rt2x00.h | 2 +- drivers/net/wireless/rt2x00/rt2x00queue.c | 4 +- drivers/net/wireless/ti/wl1251/sdio.c | 12 +- drivers/net/wireless/ti/wl12xx/main.c | 8 +- drivers/net/wireless/ti/wl18xx/main.c | 6 +- drivers/nfc/nfcwilink.c | 2 +- drivers/of/fdt.c | 4 +- drivers/oprofile/buffer_sync.c | 8 +- drivers/oprofile/event_buffer.c | 2 +- drivers/oprofile/oprof.c | 2 +- drivers/oprofile/oprofile_stats.c | 10 +- drivers/oprofile/oprofile_stats.h | 10 +- drivers/oprofile/oprofilefs.c | 6 +- drivers/oprofile/timer_int.c | 2 +- drivers/parport/procfs.c | 4 +- drivers/pci/host/pci-host-generic.c | 24 +- drivers/pci/hotplug/acpiphp_ibm.c | 4 +- drivers/pci/hotplug/cpcihp_generic.c | 6 +- drivers/pci/hotplug/cpcihp_zt5550.c | 14 +- drivers/pci/hotplug/cpqphp_nvram.c | 2 + drivers/pci/hotplug/pci_hotplug_core.c | 6 +- drivers/pci/hotplug/pciehp_core.c | 2 +- drivers/pci/msi.c | 22 +- drivers/pci/pci-sysfs.c | 6 +- drivers/pci/pci.h | 2 +- drivers/pci/pcie/aspm.c | 6 +- drivers/pci/pcie/portdrv_pci.c | 2 +- drivers/pci/probe.c | 2 +- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 2 +- drivers/pinctrl/pinctrl-at91.c | 5 +- drivers/platform/chrome/chromeos_pstore.c | 2 +- drivers/platform/x86/alienware-wmi.c | 4 +- drivers/platform/x86/compal-laptop.c | 2 +- drivers/platform/x86/hdaps.c | 2 +- drivers/platform/x86/ibm_rtl.c | 2 +- drivers/platform/x86/intel_oaktrail.c | 2 +- drivers/platform/x86/msi-laptop.c | 16 +- drivers/platform/x86/msi-wmi.c | 2 +- drivers/platform/x86/samsung-laptop.c | 2 +- drivers/platform/x86/samsung-q10.c | 2 +- drivers/platform/x86/sony-laptop.c | 14 +- drivers/platform/x86/thinkpad_acpi.c | 2 +- drivers/pnp/pnpbios/bioscalls.c | 14 +- drivers/pnp/pnpbios/core.c | 2 +- drivers/power/pda_power.c | 7 +- drivers/power/power_supply.h | 4 +- drivers/power/power_supply_core.c | 7 +- drivers/power/power_supply_sysfs.c | 6 +- drivers/power/reset/at91-reset.c | 9 +- drivers/powercap/powercap_sys.c | 136 +- drivers/ptp/ptp_private.h | 2 +- drivers/ptp/ptp_sysfs.c | 2 +- drivers/regulator/core.c | 4 +- drivers/regulator/max8660.c | 6 +- drivers/regulator/max8973-regulator.c | 16 +- drivers/regulator/mc13892-regulator.c | 8 +- drivers/rtc/rtc-armada38x.c | 7 +- drivers/rtc/rtc-cmos.c | 4 +- drivers/rtc/rtc-ds1307.c | 2 +- drivers/rtc/rtc-m48t59.c | 4 +- drivers/rtc/rtc-test.c | 6 +- drivers/scsi/be2iscsi/be_main.c | 2 +- drivers/scsi/bfa/bfa_fcpim.h | 2 +- drivers/scsi/bfa/bfa_ioc.h | 4 +- drivers/scsi/fcoe/fcoe_sysfs.c | 12 +- drivers/scsi/hosts.c | 4 +- drivers/scsi/hpsa.c | 38 +- drivers/scsi/hpsa.h | 2 +- drivers/scsi/libfc/fc_exch.c | 50 +- drivers/scsi/libsas/sas_ata.c | 2 +- drivers/scsi/lpfc/lpfc.h | 8 +- drivers/scsi/lpfc/lpfc_debugfs.c | 18 +- drivers/scsi/lpfc/lpfc_init.c | 6 +- drivers/scsi/lpfc/lpfc_scsi.c | 10 +- drivers/scsi/megaraid/megaraid_sas.h | 2 +- drivers/scsi/mpt2sas/mpt2sas_scsih.c | 8 +- drivers/scsi/pmcraid.c | 20 +- drivers/scsi/pmcraid.h | 8 +- drivers/scsi/qla2xxx/qla_attr.c | 4 +- drivers/scsi/qla2xxx/qla_gbl.h | 4 +- drivers/scsi/qla2xxx/qla_os.c | 6 +- drivers/scsi/qla4xxx/ql4_def.h | 2 +- drivers/scsi/qla4xxx/ql4_os.c | 6 +- drivers/scsi/scsi.c | 2 +- drivers/scsi/scsi_lib.c | 8 +- drivers/scsi/scsi_sysfs.c | 2 +- drivers/scsi/scsi_transport_fc.c | 8 +- drivers/scsi/scsi_transport_iscsi.c | 6 +- drivers/scsi/scsi_transport_srp.c | 6 +- drivers/scsi/sd.c | 6 +- drivers/scsi/sg.c | 2 +- drivers/scsi/sr.c | 21 +- drivers/soc/tegra/fuse/fuse-tegra.c | 2 +- drivers/spi/spi.c | 2 +- drivers/staging/android/timed_output.c | 6 +- drivers/staging/comedi/comedi_fops.c | 8 +- drivers/staging/fbtft/fbtft-core.c | 2 +- drivers/staging/fbtft/fbtft.h | 2 +- drivers/staging/gdm724x/gdm_tty.c | 2 +- drivers/staging/iio/accel/lis3l02dq_ring.c | 2 +- drivers/staging/iio/adc/ad7280a.c | 4 +- drivers/staging/lustre/lnet/selftest/brw_test.c | 12 +- drivers/staging/lustre/lnet/selftest/framework.c | 4 - drivers/staging/lustre/lnet/selftest/ping_test.c | 14 +- drivers/staging/lustre/lustre/include/lustre_dlm.h | 2 +- drivers/staging/lustre/lustre/include/obd.h | 2 +- drivers/staging/octeon/ethernet-rx.c | 20 +- drivers/staging/octeon/ethernet.c | 8 +- drivers/staging/rdma/ipath/ipath_rc.c | 6 +- drivers/staging/rdma/ipath/ipath_ruc.c | 6 +- drivers/staging/rtl8188eu/include/hal_intf.h | 2 +- drivers/staging/rtl8712/rtl871x_io.h | 2 +- drivers/staging/sm750fb/sm750.c | 14 +- drivers/staging/unisys/visorbus/visorbus_private.h | 4 +- drivers/target/sbp/sbp_target.c | 4 +- drivers/thermal/cpu_cooling.c | 9 +- drivers/thermal/int340x_thermal/int3400_thermal.c | 6 +- drivers/thermal/of-thermal.c | 17 +- drivers/thermal/x86_pkg_temp_thermal.c | 2 +- drivers/tty/cyclades.c | 6 +- drivers/tty/hvc/hvc_console.c | 14 +- drivers/tty/hvc/hvcs.c | 21 +- drivers/tty/hvc/hvsi.c | 22 +- drivers/tty/hvc/hvsi_lib.c | 4 +- drivers/tty/ipwireless/tty.c | 27 +- drivers/tty/moxa.c | 2 +- drivers/tty/n_gsm.c | 4 +- drivers/tty/n_tty.c | 3 +- drivers/tty/pty.c | 4 +- drivers/tty/rocket.c | 6 +- drivers/tty/serial/8250/8250_core.c | 10 +- drivers/tty/serial/ifx6x60.c | 2 +- drivers/tty/serial/ioc4_serial.c | 6 +- drivers/tty/serial/kgdb_nmi.c | 4 +- drivers/tty/serial/kgdboc.c | 32 +- drivers/tty/serial/msm_serial.c | 4 +- drivers/tty/serial/samsung.c | 9 +- drivers/tty/serial/serial_core.c | 8 +- drivers/tty/synclink.c | 34 +- drivers/tty/synclink_gt.c | 28 +- drivers/tty/synclinkmp.c | 34 +- drivers/tty/tty_io.c | 2 +- drivers/tty/tty_ldisc.c | 8 +- drivers/tty/tty_port.c | 22 +- drivers/uio/uio.c | 13 +- drivers/usb/atm/cxacru.c | 2 +- drivers/usb/atm/usbatm.c | 24 +- drivers/usb/class/cdc-acm.h | 2 +- drivers/usb/core/devices.c | 6 +- drivers/usb/core/devio.c | 12 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/sysfs.c | 2 +- drivers/usb/core/usb.c | 2 +- drivers/usb/early/ehci-dbgp.c | 16 +- drivers/usb/gadget/function/u_serial.c | 22 +- drivers/usb/gadget/udc/dummy_hcd.c | 2 +- drivers/usb/host/ehci-hcd.c | 2 +- drivers/usb/host/ehci-hub.c | 4 +- drivers/usb/host/ehci-q.c | 4 +- drivers/usb/host/fotg210-hcd.c | 2 +- drivers/usb/host/fusbh200-hcd.c | 2 +- drivers/usb/host/hwa-hc.c | 2 +- drivers/usb/host/ohci-hcd.c | 2 +- drivers/usb/host/r8a66597.h | 2 +- drivers/usb/host/uhci-hcd.c | 2 +- drivers/usb/host/xhci-pci.c | 2 +- drivers/usb/host/xhci.c | 2 +- drivers/usb/misc/appledisplay.c | 4 +- drivers/usb/serial/console.c | 8 +- drivers/usb/storage/transport.c | 2 +- drivers/usb/storage/usb.c | 2 +- drivers/usb/storage/usb.h | 2 +- drivers/usb/usbip/vhci.h | 2 +- drivers/usb/usbip/vhci_hcd.c | 6 +- drivers/usb/usbip/vhci_rx.c | 2 +- drivers/usb/wusbcore/wa-hc.h | 4 +- drivers/usb/wusbcore/wa-xfer.c | 2 +- drivers/vfio/vfio.c | 2 +- drivers/vhost/vringh.c | 20 +- drivers/video/backlight/kb3886_bl.c | 2 +- drivers/video/console/fbcon.c | 2 +- drivers/video/fbdev/aty/aty128fb.c | 2 +- drivers/video/fbdev/aty/atyfb_base.c | 8 +- drivers/video/fbdev/aty/mach64_cursor.c | 5 +- drivers/video/fbdev/core/fb_defio.c | 6 +- drivers/video/fbdev/core/fbmem.c | 2 +- drivers/video/fbdev/hyperv_fb.c | 4 +- drivers/video/fbdev/i810/i810_accel.c | 1 + drivers/video/fbdev/matrox/matroxfb_base.c | 2 +- drivers/video/fbdev/mb862xx/mb862xxfb_accel.c | 16 +- drivers/video/fbdev/nvidia/nvidia.c | 27 +- drivers/video/fbdev/omap2/dss/display.c | 8 +- drivers/video/fbdev/s1d13xxxfb.c | 6 +- drivers/video/fbdev/smscufx.c | 4 +- drivers/video/fbdev/udlfb.c | 36 +- drivers/video/fbdev/uvesafb.c | 52 +- drivers/video/fbdev/vesafb.c | 58 +- drivers/video/fbdev/via/via_clock.h | 2 +- drivers/xen/events/events_base.c | 6 +- drivers/xen/evtchn.c | 4 +- fs/Kconfig.binfmt | 2 +- fs/afs/inode.c | 4 +- fs/aio.c | 2 +- fs/autofs4/waitq.c | 2 +- fs/befs/endian.h | 6 +- fs/binfmt_aout.c | 23 +- fs/binfmt_elf.c | 670 +- fs/binfmt_elf_fdpic.c | 4 +- fs/block_dev.c | 2 +- fs/btrfs/ctree.c | 9 +- fs/btrfs/delayed-inode.c | 9 +- fs/btrfs/delayed-inode.h | 6 +- fs/btrfs/file.c | 10 +- fs/btrfs/inode.c | 14 +- fs/btrfs/super.c | 2 +- fs/btrfs/sysfs.c | 2 +- fs/btrfs/tests/free-space-tests.c | 8 +- fs/btrfs/tree-log.h | 2 +- fs/buffer.c | 2 +- fs/cachefiles/bind.c | 6 +- fs/cachefiles/daemon.c | 8 +- fs/cachefiles/internal.h | 12 +- fs/cachefiles/namei.c | 2 +- fs/cachefiles/proc.c | 12 +- fs/ceph/dir.c | 12 +- fs/ceph/super.c | 4 +- fs/cifs/cifs_debug.c | 12 +- fs/cifs/cifsfs.c | 8 +- fs/cifs/cifsglob.h | 54 +- fs/cifs/file.c | 10 +- fs/cifs/misc.c | 4 +- fs/cifs/smb1ops.c | 80 +- fs/cifs/smb2ops.c | 84 +- fs/cifs/smb2pdu.c | 3 +- fs/coda/cache.c | 10 +- fs/compat.c | 4 +- fs/compat_binfmt_elf.c | 2 + fs/compat_ioctl.c | 12 +- fs/configfs/dir.c | 10 +- fs/coredump.c | 16 +- fs/dcache.c | 51 +- fs/ecryptfs/inode.c | 2 +- fs/ecryptfs/miscdev.c | 2 +- fs/exec.c | 362 +- fs/ext2/xattr.c | 5 +- fs/ext4/ext4.h | 20 +- fs/ext4/mballoc.c | 44 +- fs/ext4/resize.c | 16 +- fs/ext4/super.c | 4 +- fs/ext4/xattr.c | 5 +- fs/fhandle.c | 3 +- fs/file.c | 4 +- fs/fs_struct.c | 8 +- fs/fscache/cookie.c | 40 +- fs/fscache/internal.h | 202 +- fs/fscache/object.c | 26 +- fs/fscache/operation.c | 38 +- fs/fscache/page.c | 110 +- fs/fscache/stats.c | 348 +- fs/fuse/cuse.c | 10 +- fs/fuse/dev.c | 4 +- fs/gfs2/glock.c | 22 +- fs/gfs2/glops.c | 4 +- fs/gfs2/quota.c | 6 +- fs/hugetlbfs/inode.c | 13 +- fs/inode.c | 4 +- fs/jffs2/erase.c | 3 +- fs/jffs2/wbuf.c | 3 +- fs/jfs/super.c | 2 +- fs/kernfs/dir.c | 2 +- fs/kernfs/file.c | 20 +- fs/libfs.c | 10 +- fs/lockd/clntproc.c | 4 +- fs/namei.c | 16 +- fs/namespace.c | 16 +- fs/nfs/callback_xdr.c | 2 +- fs/nfs/inode.c | 6 +- fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfs4xdr.c | 2 +- fs/nfsd/nfscache.c | 11 +- fs/nfsd/vfs.c | 6 +- fs/nls/nls_base.c | 26 +- fs/nls/nls_euc-jp.c | 6 +- fs/nls/nls_koi8-ru.c | 6 +- fs/notify/fanotify/fanotify_user.c | 4 +- fs/notify/notification.c | 4 +- fs/ntfs/dir.c | 2 +- fs/ntfs/super.c | 6 +- fs/ocfs2/localalloc.c | 2 +- fs/ocfs2/ocfs2.h | 10 +- fs/ocfs2/suballoc.c | 12 +- fs/ocfs2/super.c | 20 +- fs/pipe.c | 72 +- fs/posix_acl.c | 4 +- fs/proc/array.c | 20 + fs/proc/base.c | 4 +- fs/proc/kcore.c | 34 +- fs/proc/meminfo.c | 2 +- fs/proc/nommu.c | 2 +- fs/proc/proc_sysctl.c | 26 +- fs/proc/task_mmu.c | 39 +- fs/proc/task_nommu.c | 4 +- fs/proc/vmcore.c | 16 +- fs/qnx6/qnx6.h | 4 +- fs/quota/netlink.c | 4 +- fs/read_write.c | 2 +- fs/reiserfs/do_balan.c | 2 +- fs/reiserfs/procfs.c | 2 +- fs/reiserfs/reiserfs.h | 4 +- fs/seq_file.c | 4 +- fs/splice.c | 43 +- fs/squashfs/xattr.c | 12 +- fs/sysv/sysv.h | 2 +- fs/tracefs/inode.c | 8 +- fs/udf/misc.c | 2 +- fs/ufs/swab.h | 4 +- fs/userfaultfd.c | 2 +- fs/xattr.c | 21 + fs/xfs/libxfs/xfs_bmap.c | 2 +- fs/xfs/xfs_dir2_readdir.c | 7 +- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_linux.h | 4 +- include/asm-generic/4level-fixup.h | 2 + include/asm-generic/atomic-long.h | 156 +- include/asm-generic/atomic64.h | 12 + include/asm-generic/bitops/__fls.h | 2 +- include/asm-generic/bitops/fls.h | 2 +- include/asm-generic/bitops/fls64.h | 4 +- include/asm-generic/bug.h | 6 +- include/asm-generic/cache.h | 4 +- include/asm-generic/emergency-restart.h | 2 +- include/asm-generic/kmap_types.h | 4 +- include/asm-generic/local.h | 13 + include/asm-generic/pgtable-nopmd.h | 18 +- include/asm-generic/pgtable-nopud.h | 15 +- include/asm-generic/pgtable.h | 16 + include/asm-generic/sections.h | 1 + include/asm-generic/uaccess.h | 16 + include/asm-generic/vmlinux.lds.h | 15 +- include/crypto/algapi.h | 2 +- include/drm/drmP.h | 16 +- include/drm/drm_crtc_helper.h | 2 +- include/drm/drm_mm.h | 2 +- include/drm/i915_pciids.h | 2 +- include/drm/intel-gtt.h | 4 +- include/drm/ttm/ttm_memory.h | 2 +- include/drm/ttm/ttm_page_alloc.h | 1 + include/keys/asymmetric-subtype.h | 2 +- include/linux/atmdev.h | 4 +- include/linux/atomic.h | 17 +- include/linux/audit.h | 2 +- include/linux/average.h | 2 +- include/linux/binfmts.h | 3 +- include/linux/bitmap.h | 2 +- include/linux/bitops.h | 8 +- include/linux/blkdev.h | 2 +- include/linux/blktrace_api.h | 2 +- include/linux/cache.h | 8 + include/linux/cdrom.h | 1 - include/linux/cleancache.h | 2 +- include/linux/clk-provider.h | 1 + include/linux/compat.h | 6 +- include/linux/compiler-gcc.h | 28 +- include/linux/compiler.h | 157 +- include/linux/configfs.h | 2 +- include/linux/cpufreq.h | 3 +- include/linux/cpuidle.h | 5 +- include/linux/cpumask.h | 14 +- include/linux/crypto.h | 4 +- include/linux/ctype.h | 2 +- include/linux/dcache.h | 4 +- include/linux/decompress/mm.h | 2 +- include/linux/devfreq.h | 2 +- include/linux/device.h | 7 +- include/linux/dma-mapping.h | 2 +- include/linux/efi.h | 1 + include/linux/elf.h | 2 + include/linux/err.h | 4 +- include/linux/extcon.h | 2 +- include/linux/fb.h | 3 +- include/linux/fdtable.h | 2 +- include/linux/fs.h | 5 +- include/linux/fs_struct.h | 2 +- include/linux/fscache-cache.h | 2 +- include/linux/fscache.h | 2 +- include/linux/fsnotify.h | 2 +- include/linux/genhd.h | 4 +- include/linux/genl_magic_func.h | 2 +- include/linux/gfp.h | 12 +- include/linux/highmem.h | 12 + include/linux/hwmon-sysfs.h | 6 +- include/linux/i2c.h | 1 + include/linux/if_pppox.h | 2 +- include/linux/init.h | 12 +- include/linux/init_task.h | 7 + include/linux/interrupt.h | 6 +- include/linux/iommu.h | 2 +- include/linux/ioport.h | 2 +- include/linux/ipc.h | 2 +- include/linux/irq.h | 5 +- include/linux/irqdesc.h | 2 +- include/linux/irqdomain.h | 3 + include/linux/jiffies.h | 16 +- include/linux/key-type.h | 2 +- include/linux/kgdb.h | 6 +- include/linux/kmemleak.h | 4 +- include/linux/kobject.h | 3 +- include/linux/kobject_ns.h | 2 +- include/linux/kref.h | 2 +- include/linux/libata.h | 2 +- include/linux/linkage.h | 1 + include/linux/list.h | 15 + include/linux/lockref.h | 26 +- include/linux/math64.h | 10 +- include/linux/mempolicy.h | 7 + include/linux/mm.h | 102 +- include/linux/mm_types.h | 20 + include/linux/mmiotrace.h | 4 +- include/linux/mmzone.h | 2 +- include/linux/mod_devicetable.h | 4 +- include/linux/module.h | 69 +- include/linux/moduleloader.h | 16 + include/linux/moduleparam.h | 4 +- include/linux/net.h | 2 +- include/linux/netdevice.h | 7 +- include/linux/netfilter.h | 2 +- include/linux/netfilter/nfnetlink.h | 2 +- include/linux/nls.h | 4 +- include/linux/notifier.h | 3 +- include/linux/oprofile.h | 4 +- include/linux/padata.h | 2 +- include/linux/pci_hotplug.h | 3 +- include/linux/percpu.h | 2 +- include/linux/perf_event.h | 12 +- include/linux/pipe_fs_i.h | 8 +- include/linux/pm.h | 1 + include/linux/pm_domain.h | 4 +- include/linux/pm_runtime.h | 2 +- include/linux/pnp.h | 2 +- include/linux/poison.h | 4 +- include/linux/power/smartreflex.h | 2 +- include/linux/ppp-comp.h | 2 +- include/linux/preempt.h | 21 + include/linux/proc_ns.h | 2 +- include/linux/psci.h | 2 +- include/linux/quota.h | 2 +- include/linux/random.h | 19 +- include/linux/rculist.h | 16 + include/linux/reboot.h | 14 +- include/linux/regset.h | 3 +- include/linux/relay.h | 2 +- include/linux/rio.h | 2 +- include/linux/rmap.h | 4 +- include/linux/sched.h | 72 +- include/linux/sched/sysctl.h | 1 + include/linux/semaphore.h | 2 +- include/linux/seq_file.h | 1 + include/linux/signal.h | 2 +- include/linux/skbuff.h | 12 +- include/linux/slab.h | 47 +- include/linux/slab_def.h | 14 +- include/linux/slub_def.h | 2 +- include/linux/smp.h | 2 + include/linux/sock_diag.h | 2 +- include/linux/sonet.h | 2 +- include/linux/sunrpc/addr.h | 8 +- include/linux/sunrpc/clnt.h | 2 +- include/linux/sunrpc/svc.h | 2 +- include/linux/sunrpc/svc_rdma.h | 18 +- include/linux/sunrpc/svcauth.h | 2 +- include/linux/swapops.h | 10 +- include/linux/swiotlb.h | 3 +- include/linux/syscalls.h | 21 +- include/linux/syscore_ops.h | 2 +- include/linux/sysctl.h | 3 +- include/linux/sysfs.h | 9 +- include/linux/sysrq.h | 3 +- include/linux/tcp.h | 14 +- include/linux/thread_info.h | 7 + include/linux/tty.h | 4 +- include/linux/tty_driver.h | 2 +- include/linux/tty_ldisc.h | 2 +- include/linux/types.h | 16 + include/linux/uaccess.h | 6 +- include/linux/uio_driver.h | 2 +- include/linux/unaligned/access_ok.h | 24 +- include/linux/usb.h | 12 +- include/linux/usb/hcd.h | 1 + include/linux/usb/renesas_usbhs.h | 2 +- include/linux/vermagic.h | 21 +- include/linux/vga_switcheroo.h | 8 +- include/linux/vmalloc.h | 7 +- include/linux/vmstat.h | 24 +- include/linux/xattr.h | 5 +- include/linux/zlib.h | 3 +- include/media/v4l2-dev.h | 2 +- include/media/v4l2-device.h | 2 +- include/net/9p/transport.h | 2 +- include/net/bluetooth/l2cap.h | 2 +- include/net/bonding.h | 2 +- include/net/caif/cfctrl.h | 6 +- include/net/flow.h | 2 +- include/net/genetlink.h | 2 +- include/net/gro_cells.h | 2 +- include/net/inet_connection_sock.h | 2 +- include/net/inet_sock.h | 2 +- include/net/inetpeer.h | 2 +- include/net/ip_fib.h | 2 +- include/net/ip_vs.h | 8 +- include/net/ipv6.h | 2 +- include/net/irda/ircomm_tty.h | 1 + include/net/iucv/af_iucv.h | 2 +- include/net/llc_c_ac.h | 2 +- include/net/llc_c_ev.h | 4 +- include/net/llc_c_st.h | 2 +- include/net/llc_s_ac.h | 2 +- include/net/llc_s_st.h | 2 +- include/net/mac80211.h | 4 +- include/net/neighbour.h | 2 +- include/net/net_namespace.h | 18 +- include/net/netlink.h | 2 +- include/net/netns/conntrack.h | 6 +- include/net/netns/ipv4.h | 4 +- include/net/netns/ipv6.h | 4 +- include/net/netns/xfrm.h | 2 +- include/net/ping.h | 2 +- include/net/protocol.h | 4 +- include/net/rtnetlink.h | 2 +- include/net/sctp/checksum.h | 4 +- include/net/sctp/sm.h | 4 +- include/net/sctp/structs.h | 2 +- include/net/sock.h | 12 +- include/net/tcp.h | 8 +- include/net/xfrm.h | 13 +- include/rdma/iw_cm.h | 2 +- include/scsi/libfc.h | 3 +- include/scsi/scsi_device.h | 6 +- include/scsi/scsi_driver.h | 2 +- include/scsi/scsi_transport_fc.h | 3 +- include/scsi/sg.h | 2 +- include/sound/compress_driver.h | 2 +- include/sound/soc.h | 4 +- include/trace/events/irq.h | 4 +- include/uapi/linux/a.out.h | 8 + include/uapi/linux/bcache.h | 5 +- include/uapi/linux/byteorder/little_endian.h | 28 +- include/uapi/linux/connector.h | 2 +- include/uapi/linux/elf.h | 28 + include/uapi/linux/screen_info.h | 3 +- include/uapi/linux/swab.h | 6 +- include/uapi/linux/xattr.h | 4 + include/video/udlfb.h | 8 +- include/video/uvesafb.h | 1 + init/Kconfig | 2 +- init/Makefile | 3 + init/do_mounts.c | 14 +- init/do_mounts.h | 8 +- init/do_mounts_initrd.c | 30 +- init/do_mounts_md.c | 6 +- init/init_task.c | 4 + init/initramfs.c | 38 +- init/main.c | 30 +- ipc/compat.c | 4 +- ipc/ipc_sysctl.c | 8 +- ipc/mq_sysctl.c | 4 +- ipc/sem.c | 4 +- ipc/shm.c | 6 + kernel/audit.c | 8 +- kernel/auditsc.c | 4 +- kernel/bpf/core.c | 7 +- kernel/capability.c | 3 + kernel/compat.c | 38 +- kernel/debug/debug_core.c | 16 +- kernel/debug/kdb/kdb_main.c | 4 +- kernel/events/core.c | 26 +- kernel/events/internal.h | 10 +- kernel/events/uprobes.c | 2 +- kernel/exit.c | 2 +- kernel/fork.c | 167 +- kernel/futex.c | 11 +- kernel/futex_compat.c | 2 +- kernel/gcov/base.c | 7 +- kernel/irq/manage.c | 2 +- kernel/irq/msi.c | 19 +- kernel/irq/spurious.c | 2 +- kernel/jump_label.c | 5 + kernel/kallsyms.c | 37 +- kernel/kexec.c | 3 +- kernel/kmod.c | 8 +- kernel/kprobes.c | 4 +- kernel/ksysfs.c | 2 +- kernel/locking/lockdep.c | 7 +- kernel/locking/mutex-debug.c | 12 +- kernel/locking/mutex-debug.h | 4 +- kernel/locking/mutex.c | 6 +- kernel/module.c | 422 +- kernel/notifier.c | 17 +- kernel/padata.c | 4 +- kernel/panic.c | 5 +- kernel/pid.c | 2 +- kernel/pid_namespace.c | 2 +- kernel/power/process.c | 12 +- kernel/profile.c | 14 +- kernel/ptrace.c | 8 +- kernel/rcu/rcutorture.c | 60 +- kernel/rcu/tiny.c | 4 +- kernel/rcu/tree.c | 44 +- kernel/rcu/tree.h | 14 +- kernel/rcu/tree_plugin.h | 14 +- kernel/rcu/tree_trace.c | 12 +- kernel/sched/auto_group.c | 4 +- kernel/sched/core.c | 45 +- kernel/sched/fair.c | 2 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 12 +- kernel/smpboot.c | 4 +- kernel/softirq.c | 12 +- kernel/sys.c | 10 +- kernel/sysctl.c | 34 +- kernel/time/alarmtimer.c | 2 +- kernel/time/posix-cpu-timers.c | 4 +- kernel/time/posix-timers.c | 24 +- kernel/time/timer.c | 2 +- kernel/time/timer_stats.c | 10 +- kernel/trace/blktrace.c | 6 +- kernel/trace/ftrace.c | 15 +- kernel/trace/ring_buffer.c | 96 +- kernel/trace/trace.c | 2 +- kernel/trace/trace.h | 2 +- kernel/trace/trace_clock.c | 4 +- kernel/trace/trace_events.c | 1 - kernel/trace/trace_functions_graph.c | 4 +- kernel/trace/trace_mmiotrace.c | 8 +- kernel/trace/trace_output.c | 10 +- kernel/trace/trace_seq.c | 2 +- kernel/trace/trace_stack.c | 2 +- kernel/user_namespace.c | 2 +- kernel/utsname_sysctl.c | 2 +- kernel/watchdog.c | 2 +- kernel/workqueue.c | 2 +- lib/Kconfig.debug | 8 +- lib/Makefile | 2 +- lib/bitmap.c | 8 +- lib/bug.c | 2 + lib/debugobjects.c | 2 +- lib/decompress_bunzip2.c | 3 +- lib/decompress_unlzma.c | 4 +- lib/div64.c | 4 +- lib/dma-debug.c | 4 +- lib/inflate.c | 2 +- lib/ioremap.c | 4 +- lib/kobject.c | 4 +- lib/list_debug.c | 126 +- lib/lockref.c | 44 +- lib/percpu-refcount.c | 2 +- lib/radix-tree.c | 2 +- lib/random32.c | 2 +- lib/show_mem.c | 2 +- lib/strncpy_from_user.c | 2 +- lib/strnlen_user.c | 2 +- lib/swiotlb.c | 2 +- lib/usercopy.c | 6 + lib/vsprintf.c | 12 +- mm/Kconfig | 6 +- mm/backing-dev.c | 4 +- mm/debug.c | 3 + mm/filemap.c | 2 +- mm/gup.c | 13 +- mm/highmem.c | 6 +- mm/hugetlb.c | 70 +- mm/internal.h | 1 + mm/maccess.c | 4 +- mm/madvise.c | 37 + mm/memory-failure.c | 6 +- mm/memory.c | 424 +- mm/mempolicy.c | 25 + mm/mlock.c | 15 +- mm/mm_init.c | 2 +- mm/mmap.c | 582 +- mm/mprotect.c | 137 +- mm/mremap.c | 39 +- mm/nommu.c | 21 +- mm/page-writeback.c | 2 +- mm/page_alloc.c | 49 +- mm/percpu.c | 2 +- mm/process_vm_access.c | 14 +- mm/rmap.c | 45 +- mm/shmem.c | 19 +- mm/slab.c | 109 +- mm/slab.h | 22 +- mm/slab_common.c | 86 +- mm/slob.c | 218 +- mm/slub.c | 102 +- mm/sparse-vmemmap.c | 4 +- mm/sparse.c | 2 +- mm/swap.c | 2 + mm/swapfile.c | 12 +- mm/util.c | 6 + mm/vmalloc.c | 114 +- mm/vmstat.c | 12 +- net/8021q/vlan.c | 5 +- net/8021q/vlan_netlink.c | 2 +- net/9p/mod.c | 4 +- net/9p/trans_fd.c | 2 +- net/atm/atm_misc.c | 8 +- net/atm/lec.h | 2 +- net/atm/proc.c | 6 +- net/atm/resources.c | 4 +- net/ax25/sysctl_net_ax25.c | 2 +- net/batman-adv/bat_iv_ogm.c | 8 +- net/batman-adv/fragmentation.c | 2 +- net/batman-adv/soft-interface.c | 8 +- net/batman-adv/types.h | 6 +- net/bluetooth/hci_sock.c | 2 +- net/bluetooth/l2cap_core.c | 6 +- net/bluetooth/l2cap_sock.c | 12 +- net/bluetooth/rfcomm/sock.c | 4 +- net/bluetooth/rfcomm/tty.c | 4 +- net/bridge/br_netlink.c | 2 +- net/bridge/netfilter/ebtables.c | 6 +- net/caif/cfctrl.c | 11 +- net/caif/chnl_net.c | 2 +- net/can/af_can.c | 2 +- net/can/gw.c | 6 +- net/ceph/messenger.c | 4 +- net/compat.c | 24 +- net/core/datagram.c | 2 +- net/core/dev.c | 16 +- net/core/filter.c | 2 +- net/core/flow.c | 6 +- net/core/neighbour.c | 4 +- net/core/net-sysfs.c | 2 +- net/core/net_namespace.c | 8 +- net/core/netpoll.c | 4 +- net/core/rtnetlink.c | 15 +- net/core/scm.c | 14 +- net/core/skbuff.c | 8 +- net/core/sock.c | 28 +- net/core/sock_diag.c | 15 +- net/core/sysctl_net_core.c | 22 +- net/decnet/af_decnet.c | 1 + net/decnet/sysctl_net_decnet.c | 4 +- net/dsa/dsa.c | 2 +- net/hsr/hsr_netlink.c | 2 +- net/ieee802154/6lowpan/core.c | 2 +- net/ieee802154/6lowpan/reassembly.c | 14 +- net/ipv4/af_inet.c | 2 +- net/ipv4/devinet.c | 18 +- net/ipv4/fib_frontend.c | 6 +- net/ipv4/fib_semantics.c | 2 +- net/ipv4/inet_connection_sock.c | 4 +- net/ipv4/inet_timewait_sock.c | 2 +- net/ipv4/inetpeer.c | 2 +- net/ipv4/ip_fragment.c | 15 +- net/ipv4/ip_gre.c | 6 +- net/ipv4/ip_sockglue.c | 2 +- net/ipv4/ip_vti.c | 4 +- net/ipv4/ipconfig.c | 6 +- net/ipv4/ipip.c | 4 +- net/ipv4/netfilter/arp_tables.c | 12 +- net/ipv4/netfilter/ip_tables.c | 12 +- net/ipv4/ping.c | 14 +- net/ipv4/raw.c | 14 +- net/ipv4/route.c | 32 +- net/ipv4/sysctl_net_ipv4.c | 22 +- net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_probe.c | 2 +- net/ipv4/udp.c | 10 +- net/ipv4/xfrm4_policy.c | 18 +- net/ipv6/addrconf.c | 18 +- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/icmp.c | 2 +- net/ipv6/ip6_fib.c | 4 +- net/ipv6/ip6_gre.c | 10 +- net/ipv6/ip6_tunnel.c | 4 +- net/ipv6/ip6_vti.c | 4 +- net/ipv6/ipv6_sockglue.c | 2 +- net/ipv6/netfilter/ip6_tables.c | 12 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 14 +- net/ipv6/ping.c | 33 +- net/ipv6/raw.c | 17 +- net/ipv6/reassembly.c | 13 +- net/ipv6/route.c | 2 +- net/ipv6/sit.c | 4 +- net/ipv6/sysctl_net_ipv6.c | 2 +- net/ipv6/udp.c | 6 +- net/ipv6/xfrm6_policy.c | 17 +- net/irda/ircomm/ircomm_tty.c | 18 +- net/iucv/af_iucv.c | 4 +- net/iucv/iucv.c | 2 +- net/key/af_key.c | 4 +- net/l2tp/l2tp_eth.c | 38 +- net/l2tp/l2tp_ip.c | 2 +- net/l2tp/l2tp_ip6.c | 2 +- net/mac80211/cfg.c | 8 +- net/mac80211/ieee80211_i.h | 3 +- net/mac80211/iface.c | 20 +- net/mac80211/main.c | 2 +- net/mac80211/pm.c | 4 +- net/mac80211/rate.c | 2 +- net/mac80211/sta_info.c | 2 +- net/mac80211/util.c | 8 +- net/mpls/af_mpls.c | 6 +- net/netfilter/ipset/ip_set_core.c | 2 +- net/netfilter/ipvs/ip_vs_conn.c | 6 +- net/netfilter/ipvs/ip_vs_core.c | 4 +- net/netfilter/ipvs/ip_vs_ctl.c | 14 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 2 +- net/netfilter/ipvs/ip_vs_sync.c | 6 +- net/netfilter/ipvs/ip_vs_xmit.c | 4 +- net/netfilter/nf_conntrack_acct.c | 2 +- net/netfilter/nf_conntrack_ecache.c | 2 +- net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_proto.c | 2 +- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_conntrack_timestamp.c | 2 +- net/netfilter/nf_log.c | 10 +- net/netfilter/nf_sockopt.c | 4 +- net/netfilter/nfnetlink_log.c | 4 +- net/netfilter/nft_compat.c | 9 +- net/netfilter/xt_statistic.c | 8 +- net/netlink/af_netlink.c | 4 +- net/openvswitch/vport-internal_dev.c | 2 +- net/packet/af_packet.c | 8 +- net/phonet/pep.c | 6 +- net/phonet/socket.c | 2 +- net/phonet/sysctl.c | 2 +- net/rds/cong.c | 6 +- net/rds/ib.h | 2 +- net/rds/ib_cm.c | 2 +- net/rds/ib_recv.c | 4 +- net/rds/iw.h | 2 +- net/rds/iw_cm.c | 2 +- net/rds/iw_recv.c | 4 +- net/rds/rds.h | 2 +- net/rds/tcp.c | 2 +- net/rds/tcp_send.c | 2 +- net/rxrpc/af_rxrpc.c | 2 +- net/rxrpc/ar-ack.c | 14 +- net/rxrpc/ar-call.c | 2 +- net/rxrpc/ar-connection.c | 2 +- net/rxrpc/ar-connevent.c | 2 +- net/rxrpc/ar-input.c | 4 +- net/rxrpc/ar-internal.h | 8 +- net/rxrpc/ar-local.c | 2 +- net/rxrpc/ar-output.c | 4 +- net/rxrpc/ar-peer.c | 2 +- net/rxrpc/ar-proc.c | 4 +- net/rxrpc/ar-transport.c | 2 +- net/rxrpc/rxkad.c | 4 +- net/sched/sch_generic.c | 4 +- net/sctp/ipv6.c | 6 +- net/sctp/protocol.c | 10 +- net/sctp/sm_sideeffect.c | 2 +- net/sctp/socket.c | 21 +- net/sctp/sysctl.c | 10 +- net/socket.c | 18 +- net/sunrpc/auth_gss/svcauth_gss.c | 4 +- net/sunrpc/clnt.c | 4 +- net/sunrpc/sched.c | 4 +- net/sunrpc/svc.c | 4 +- net/sunrpc/svcauth_unix.c | 2 +- net/sunrpc/xprtrdma/svc_rdma.c | 38 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 +- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_transport.c | 10 +- net/tipc/netlink_compat.c | 12 +- net/tipc/subscr.c | 2 +- net/unix/af_unix.c | 7 +- net/unix/sysctl_net_unix.c | 2 +- net/wireless/wext-core.c | 19 +- net/xfrm/xfrm_policy.c | 16 +- net/xfrm/xfrm_state.c | 33 +- net/xfrm/xfrm_sysctl.c | 2 +- scripts/Kbuild.include | 2 +- scripts/Makefile.build | 2 +- scripts/Makefile.clean | 3 +- scripts/Makefile.host | 69 +- scripts/basic/fixdep.c | 12 +- scripts/dtc/checks.c | 14 +- scripts/dtc/data.c | 6 +- scripts/dtc/flattree.c | 8 +- scripts/dtc/livetree.c | 4 +- scripts/gcc-plugin.sh | 51 + scripts/headers_install.sh | 1 + scripts/kallsyms.c | 4 +- scripts/kconfig/lkc.h | 5 +- scripts/kconfig/menu.c | 2 +- scripts/kconfig/symbol.c | 6 +- scripts/link-vmlinux.sh | 2 +- scripts/mod/file2alias.c | 14 +- scripts/mod/modpost.c | 25 +- scripts/mod/modpost.h | 6 +- scripts/mod/sumversion.c | 2 +- scripts/module-common.lds | 4 + scripts/package/builddeb | 1 + scripts/pnmtologo.c | 6 +- scripts/sortextable.h | 6 +- scripts/tags.sh | 2 +- security/Kconfig | 692 +- security/integrity/ima/ima.h | 4 +- security/integrity/ima/ima_api.c | 2 +- security/integrity/ima/ima_fs.c | 4 +- security/integrity/ima/ima_queue.c | 2 +- security/keys/key.c | 18 +- security/selinux/avc.c | 6 +- security/selinux/include/xfrm.h | 2 +- security/yama/yama_lsm.c | 2 +- sound/aoa/codecs/onyx.c | 7 +- sound/aoa/codecs/onyx.h | 1 + sound/core/oss/pcm_oss.c | 18 +- sound/core/pcm_compat.c | 2 +- sound/core/pcm_native.c | 4 +- sound/core/sound.c | 2 +- sound/drivers/mts64.c | 14 +- sound/drivers/opl4/opl4_lib.c | 2 +- sound/drivers/portman2x4.c | 3 +- sound/firewire/amdtp.c | 4 +- sound/firewire/amdtp.h | 4 +- sound/firewire/isight.c | 10 +- sound/firewire/scs1x.c | 8 +- sound/oss/sb_audio.c | 2 +- sound/oss/swarm_cs4297a.c | 6 +- sound/pci/hda/hda_codec.c | 2 +- sound/pci/ymfpci/ymfpci.h | 2 +- sound/pci/ymfpci/ymfpci_main.c | 12 +- sound/soc/codecs/sti-sas.c | 10 +- sound/soc/soc-ac97.c | 6 +- sound/soc/xtensa/xtfpga-i2s.c | 2 +- tools/gcc/Makefile | 42 + tools/gcc/checker_plugin.c | 150 + tools/gcc/colorize_plugin.c | 215 + tools/gcc/constify_plugin.c | 571 + tools/gcc/gcc-common.h | 812 + tools/gcc/initify_plugin.c | 552 + tools/gcc/kallocstat_plugin.c | 188 + tools/gcc/kernexec_plugin.c | 549 + tools/gcc/latent_entropy_plugin.c | 470 + tools/gcc/size_overflow_plugin/.gitignore | 2 + tools/gcc/size_overflow_plugin/Makefile | 28 + .../disable_size_overflow_hash.data |12422 ++++++++++++ .../generate_size_overflow_hash.sh | 103 + .../insert_size_overflow_asm.c | 416 + .../size_overflow_plugin/intentional_overflow.c | 1010 + .../size_overflow_plugin/remove_unnecessary_dup.c | 137 + tools/gcc/size_overflow_plugin/size_overflow.h | 323 + .../gcc/size_overflow_plugin/size_overflow_debug.c | 194 + .../size_overflow_plugin/size_overflow_hash.data |20735 ++++++++++++++++++++ .../size_overflow_hash_aux.data | 92 + tools/gcc/size_overflow_plugin/size_overflow_ipa.c | 1226 ++ .../gcc/size_overflow_plugin/size_overflow_misc.c | 505 + .../size_overflow_plugin/size_overflow_plugin.c | 318 + .../size_overflow_plugin_hash.c | 352 + .../size_overflow_plugin/size_overflow_transform.c | 749 + .../size_overflow_transform_core.c | 1010 + tools/gcc/stackleak_plugin.c | 436 + tools/gcc/structleak_plugin.c | 287 + tools/include/linux/compiler.h | 8 + tools/lib/api/Makefile | 2 +- tools/perf/util/include/asm/alternative-asm.h | 3 + tools/virtio/linux/uaccess.h | 2 +- virt/kvm/kvm_main.c | 42 +- 1944 files changed, 66925 insertions(+), 8949 deletions(-) commit 87790bbd0d8dc2bd7fd86cb947e32886db9e9766 Author: Matthew Wilcox Date: Tue Feb 2 16:57:52 2016 -0800 radix-tree: fix race in gang lookup If the indirect_ptr bit is set on a slot, that indicates we need to redo the lookup. Introduce a new function radix_tree_iter_retry() which forces the loop to retry the lookup by setting 'slot' to NULL and turning the iterator back to point at the problematic entry. This is a pretty rare problem to hit at the moment; the lookup has to race with a grow of the radix tree from a height of 0. The consequences of hitting this race are that gang lookup could return a pointer to a radix_tree_node instead of a pointer to whatever the user had inserted in the tree. Fixes: cebbd29e1c2f ("radix-tree: rewrite gang lookup using iterator") Signed-off-by: Matthew Wilcox Cc: Hugh Dickins Cc: Ohad Ben-Cohen Cc: Konstantin Khlebnikov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/radix-tree.h | 16 ++++++++++++++++ lib/radix-tree.c | 12 ++++++++++-- 2 files changed, 26 insertions(+), 2 deletions(-) commit bf628043b4589c910919a0f221ae7f42aa8cea93 Author: Hannes Frederic Sowa Date: Wed Feb 3 02:11:03 2016 +0100 unix: correctly track in-flight fds in sending process user_struct The commit referenced in the Fixes tag incorrectly accounted the number of in-flight fds over a unix domain socket to the original opener of the file-descriptor. This allows another process to arbitrary deplete the original file-openers resource limit for the maximum of open files. Instead the sending processes and its struct cred should be credited. To do so, we add a reference counted struct user_struct pointer to the scm_fp_list and use it to account for the number of inflight unix fds. Fixes: 712f4aad406bb1 ("unix: properly account for FDs passed over unix sockets") Reported-by: David Herrmann Cc: David Herrmann Cc: Willy Tarreau Cc: Linus Torvalds Suggested-by: Linus Torvalds Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller include/net/af_unix.h | 4 ++-- include/net/scm.h | 1 + net/core/scm.c | 7 +++++++ net/unix/af_unix.c | 4 ++-- net/unix/garbage.c | 8 ++++---- 5 files changed, 16 insertions(+), 8 deletions(-) commit e830db443ff78d70b7b63536e688d73907face0c Author: Mike Kravetz Date: Fri Jan 15 16:57:37 2016 -0800 fs/hugetlbfs/inode.c: fix bugs in hugetlb_vmtruncate_list() Hillf Danton noticed bugs in the hugetlb_vmtruncate_list routine. The argument end is of type pgoff_t. It was being converted to a vaddr offset and passed to unmap_hugepage_range. However, end was also being used as an argument to the vma_interval_tree_foreach controlling loop. In addition, the conversion of end to vaddr offset was incorrect. hugetlb_vmtruncate_list is called as part of a file truncate or fallocate hole punch operation. When truncating a hugetlbfs file, this bug could prevent some pages from being unmapped. This is possible if there are multiple vmas mapping the file, and there is a sufficiently sized hole between the mappings. The size of the hole between two vmas (A,B) must be such that the starting virtual address of B is greater than (ending virtual address of A << PAGE_SHIFT). In this case, the pages in B would not be unmapped. If pages are not properly unmapped during truncate, the following BUG is hit: kernel BUG at fs/hugetlbfs/inode.c:428! In the fallocate hole punch case, this bug could prevent pages from being unmapped as in the truncate case. However, for hole punch the result is that unmapped pages will not be removed during the operation. For hole punch, it is also possible that more pages than desired will be unmapped. This unnecessary unmapping will cause page faults to reestablish the mappings on subsequent page access. Fixes: 1bfad99ab (" hugetlbfs: hugetlb_vmtruncate_list() needs to take a range")Reported-by: Hillf Danton Signed-off-by: Mike Kravetz Cc: Hugh Dickins Cc: Naoya Horiguchi Cc: Davidlohr Bueso Cc: Dave Hansen Cc: [4.3] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/hugetlbfs/inode.c | 19 +++++++++++-------- 1 files changed, 11 insertions(+), 8 deletions(-) commit cdb3ba4a9113b779347387f3b6c6ea72dd4db12f Author: Takashi Iwai Date: Thu Feb 4 17:06:13 2016 +0100 ALSA: timer: Fix leftover link at closing In ALSA timer core, the active timer instance is managed in active_list linked list. Each element is added / removed dynamically at timer start, stop and in timer interrupt. The problem is that snd_timer_interrupt() has a thinko and leaves the element in active_list when it's the last opened element. This eventually leads to list corruption or use-after-free error. This hasn't been revealed because we used to delete the list forcibly in snd_timer_stop() in the past. However, the recent fix avoids the double-stop behavior (in commit [f784beb75ce8: ALSA: timer: Fix link corruption due to double start or stop]), and this leak hits reality. This patch fixes the link management in snd_timer_interrupt(). Now it simply unlinks no matter which stream is. BugLink: http://lkml.kernel.org/r/CACT4Y+Yy2aukHP-EDp8-ziNqNNmb-NTf=jDWXMP7jB8HDa2vng@mail.gmail.com Reported-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/timer.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit 47d9647902f6a2f46a2be1e0140ba0f6f8c06008 Author: Konstantin Khlebnikov Date: Fri Feb 5 15:37:01 2016 -0800 radix-tree: fix oops after radix_tree_iter_retry Helper radix_tree_iter_retry() resets next_index to the current index. In following radix_tree_next_slot current chunk size becomes zero. This isn't checked and it tries to dereference null pointer in slot. Tagged iterator is fine because retry happens only at slot 0 where tag bitmask in iter->tags is filled with single bit. Fixes: 46437f9a554f ("radix-tree: fix race in gang lookup") Signed-off-by: Konstantin Khlebnikov Cc: Matthew Wilcox Cc: Hugh Dickins Cc: Ohad Ben-Cohen Cc: Jeremiah Mahler Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/radix-tree.h | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) commit 95b5dcb3c01958502af00b0bc0da1d906aae11a2 Merge: 438be0b 256aeaf Author: Brad Spengler Date: Sun Feb 7 08:29:33 2016 -0500 Merge branch 'pax-test' into grsec-test commit 256aeaf87c22de8edf1f03682a572c590ae07771 Author: Brad Spengler Date: Sun Feb 7 08:29:09 2016 -0500 Update to pax-linux-4.3.5-test28.patch: - fixed an integer truncation bug in numa_clear_kernel_node_hotplug caught by the size overflow plugin, reported by x14sg1 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4374) - spender fixed UDEREF on arm arch/arm/Kconfig | 1 + arch/arm/include/asm/domain.h | 21 ++++++++- arch/arm/include/asm/futex.h | 9 ---- arch/arm/include/asm/thread_info.h | 3 + arch/arm/include/asm/uaccess.h | 81 +++++++++++++++--------------------- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/kernel/process.c | 2 +- arch/arm/mm/alignment.c | 8 ---- arch/x86/mm/numa.c | 2 +- security/Kconfig | 1 - 10 files changed, 60 insertions(+), 70 deletions(-) commit 438be0bd112bd17942b2628c53054dc1007558a1 Author: Brad Spengler Date: Sat Feb 6 19:50:31 2016 -0500 Fix a number of issues caused by the upstream merging of a UDEREF ripoff resulting in unbootable ARM systems reported on the forums arch/arm/Kconfig | 1 + arch/arm/include/asm/domain.h | 21 ++++++++- arch/arm/include/asm/futex.h | 9 ---- arch/arm/include/asm/thread_info.h | 3 + arch/arm/include/asm/uaccess.h | 81 +++++++++++++++--------------------- arch/arm/kernel/entry-armv.S | 2 +- arch/arm/kernel/process.c | 2 +- arch/arm/mm/alignment.c | 8 ---- security/Kconfig | 1 - 9 files changed, 59 insertions(+), 69 deletions(-) commit 4ffdd5ef1f87e611af1efb4f251ada92abe9f4c0 Author: Brad Spengler Date: Sat Feb 6 11:21:53 2016 -0500 Fix another compiler warning net/ipv4/tcp_input.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) commit 30b5b7bc0fd67d458bdd5ab35e4689769eabd2ed Author: Brad Spengler Date: Sat Feb 6 11:16:12 2016 -0500 Fix two compiler warnings kernel/pid.c | 5 ++--- kernel/ptrace.c | 3 ++- 2 files changed, 4 insertions(+), 4 deletions(-) commit dda4d2a21914c480750f10bd55c6e3203d415d8d Author: Brad Spengler Date: Wed Feb 3 21:22:40 2016 -0500 Apply fix for integer truncation in NUMA init code, reported by x14sg1 on the forums: https://forums.grsecurity.net/viewtopic.php?f=3&t=4374 arch/x86/mm/numa.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 477505f7c893cb6a2c3e22f83eefd9c985d7b3ca Merge: a781740 016d0d8 Author: Brad Spengler Date: Wed Feb 3 21:20:58 2016 -0500 Merge branch 'pax-test' into grsec-test commit 016d0d81a8dd4be1304c82a68e0ccf425868f467 Author: Brad Spengler Date: Wed Feb 3 21:20:10 2016 -0500 Update to pax-linux-4.3.5-test27.patch: - fixed a bunch of potential REFCOUNT false positives, reported by Emese - restored padding in fpregs_state for storing AVX-512 state in the future - constified netlink_dump_control - added const version of debug_gimple_stmt for gcc plugins, by Emese - Emese fixed a bug in initify that could have initified too much - Emese fixed a false positive intentional integer overflow in xfrm4_extract_header, reported by corsac arch/x86/include/asm/fpu/types.h | 1 + arch/x86/include/asm/mmu_context.h | 2 +- block/blk-cgroup.c | 18 ++-- block/cfq-iosched.c | 4 +- crypto/crypto_user.c | 8 ++- drivers/acpi/apei/ghes.c | 6 +- drivers/char/ipmi/ipmi_ssif.c | 12 ++-- drivers/gpu/drm/amd/scheduler/gpu_scheduler.c | 2 +- drivers/gpu/drm/amd/scheduler/gpu_scheduler.h | 2 +- drivers/gpu/drm/amd/scheduler/sched_fence.c | 2 +- drivers/infiniband/core/netlink.c | 5 +- drivers/infiniband/hw/cxgb4/device.c | 6 +- drivers/infiniband/hw/cxgb4/iw_cxgb4.h | 2 +- drivers/md/bcache/alloc.c | 2 +- drivers/md/bcache/bcache.h | 10 +- drivers/md/bcache/btree.c | 2 +- drivers/md/bcache/io.c | 10 +- drivers/md/bcache/journal.c | 2 +- drivers/md/bcache/stats.c | 26 +++--- drivers/md/bcache/stats.h | 16 ++-- drivers/md/bcache/super.c | 2 +- drivers/md/bcache/sysfs.c | 20 +++--- drivers/md/dm-cache-target.c | 98 ++++++++++++------------ drivers/md/dm-raid.c | 2 +- drivers/md/md.c | 6 +- drivers/md/md.h | 2 +- drivers/md/raid1.c | 2 +- drivers/md/raid10.c | 2 +- drivers/md/raid5.c | 4 +- drivers/media/pci/zoran/zoran.h | 1 - drivers/media/pci/zoran/zoran_driver.c | 3 - drivers/net/ethernet/sfc/selftest.c | 20 +++--- drivers/net/irda/vlsi_ir.c | 18 ++-- drivers/net/irda/vlsi_ir.h | 14 ++-- drivers/net/wireless/ath/carl9170/carl9170.h | 6 +- drivers/net/wireless/ath/carl9170/debug.c | 6 +- drivers/net/wireless/ath/carl9170/main.c | 10 +- drivers/net/wireless/ath/carl9170/tx.c | 4 +- drivers/net/wireless/iwlwifi/mvm/d3.c | 4 +- drivers/net/wireless/iwlwifi/mvm/tx.c | 2 +- drivers/scsi/hptiop.c | 2 - drivers/scsi/hptiop.h | 1 - drivers/scsi/ipr.c | 6 +- drivers/scsi/ipr.h | 2 +- drivers/scsi/qla2xxx/qla_target.c | 10 +- drivers/scsi/qla2xxx/qla_target.h | 2 +- fs/btrfs/ctree.c | 2 +- fs/btrfs/ctree.h | 4 +- fs/btrfs/delayed-ref.c | 4 +- fs/btrfs/disk-io.c | 4 +- fs/btrfs/file.c | 4 +- fs/btrfs/raid56.c | 32 ++++---- fs/btrfs/tests/btrfs-tests.c | 2 +- fs/btrfs/transaction.c | 2 +- fs/btrfs/tree-log.c | 8 +- fs/btrfs/volumes.c | 14 ++-- fs/btrfs/volumes.h | 22 +++--- fs/jbd2/commit.c | 2 +- fs/jbd2/transaction.c | 4 +- fs/ocfs2/dlm/dlmcommon.h | 4 +- fs/ocfs2/dlm/dlmdebug.c | 10 +- fs/ocfs2/dlm/dlmdomain.c | 4 +- fs/ocfs2/dlm/dlmmaster.c | 4 +- include/acpi/ghes.h | 2 +- include/linux/blk-cgroup.h | 24 +++--- include/linux/jbd2.h | 2 +- include/linux/netlink.h | 12 ++-- include/net/cfg802154.h | 2 +- include/net/mac80211.h | 2 +- include/net/neighbour.h | 2 +- kernel/rcu/tree_plugin.h | 4 +- net/batman-adv/routing.c | 4 +- net/batman-adv/soft-interface.c | 2 +- net/batman-adv/translation-table.c | 14 ++-- net/batman-adv/types.h | 2 +- net/core/neighbour.c | 14 ++-- net/core/rtnetlink.c | 2 +- net/ipv4/arp.c | 2 +- net/ipv4/inet_diag.c | 4 +- net/ipv4/xfrm4_state.c | 4 +- net/ipv6/ndisc.c | 2 +- net/mac80211/cfg.c | 2 +- net/mac80211/debugfs_key.c | 2 +- net/mac80211/key.c | 4 +- net/mac80211/tx.c | 2 +- net/mac80211/wpa.c | 10 +- net/mac802154/iface.c | 4 +- net/netfilter/ipset/ip_set_core.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 22 +++--- net/netfilter/nf_tables_api.c | 13 ++-- net/netfilter/nfnetlink_acct.c | 7 +- net/netfilter/nfnetlink_cthelper.c | 2 +- net/netfilter/nfnetlink_cttimeout.c | 2 +- net/netlink/af_netlink.c | 10 ++- net/netlink/diag.c | 2 +- net/netlink/genetlink.c | 14 ++-- net/packet/af_packet.c | 18 ++-- net/packet/diag.c | 2 +- net/packet/internal.h | 6 +- net/unix/diag.c | 2 +- net/xfrm/xfrm_user.c | 2 +- security/apparmor/include/policy.h | 2 +- security/apparmor/policy.c | 4 +- sound/core/seq/seq_clientmgr.c | 2 +- sound/core/seq/seq_fifo.c | 6 +- sound/core/seq/seq_fifo.h | 2 +- tools/gcc/gcc-common.h | 24 ++++-- tools/gcc/initify_plugin.c | 7 +- tools/lib/api/Makefile | 2 +- 109 files changed, 399 insertions(+), 391 deletions(-) commit a7817402ac837b1aee07fac42537a02097055098 Author: Matt Fleming Date: Fri Jan 29 11:36:10 2016 +0000 x86/mm/pat: Avoid truncation when converting cpa->numpages to address There are a couple of nasty truncation bugs lurking in the pageattr code that can be triggered when mapping EFI regions, e.g. when we pass a cpa->pgd pointer. Because cpa->numpages is a 32-bit value, shifting left by PAGE_SHIFT will truncate the resultant address to 32-bits. Viorel-Cătălin managed to trigger this bug on his Dell machine that provides a ~5GB EFI region which requires 1236992 pages to be mapped. When calling populate_pud() the end of the region gets calculated incorrectly in the following buggy expression, end = start + (cpa->numpages << PAGE_SHIFT); And only 188416 pages are mapped. Next, populate_pud() gets invoked for a second time because of the loop in __change_page_attr_set_clr(), only this time no pages get mapped because shifting the remaining number of pages (1048576) by PAGE_SHIFT is zero. At which point the loop in __change_page_attr_set_clr() spins forever because we fail to map progress. Hitting this bug depends very much on the virtual address we pick to map the large region at and how many pages we map on the initial run through the loop. This explains why this issue was only recently hit with the introduction of commit a5caa209ba9c ("x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down") It's interesting to note that safe uses of cpa->numpages do exist in the pageattr code. If instead of shifting ->numpages we multiply by PAGE_SIZE, no truncation occurs because PAGE_SIZE is a UL value, and so the result is unsigned long. To avoid surprises when users try to convert very large cpa->numpages values to addresses, change the data type from 'int' to 'unsigned long', thereby making it suitable for shifting by PAGE_SHIFT without any type casting. The alternative would be to make liberal use of casting, but that is far more likely to cause problems in the future when someone adds more code and fails to cast properly; this bug was difficult enough to track down in the first place. Reported-and-tested-by: Viorel-Cătălin Răpițeanu Acked-by: Borislav Petkov Cc: Sai Praneeth Prakhya Cc: Signed-off-by: Matt Fleming Link: https://bugzilla.kernel.org/show_bug.cgi?id=110131 Link: http://lkml.kernel.org/r/1454067370-10374-1-git-send-email-matt@codeblueprint.co.uk Signed-off-by: Thomas Gleixner arch/x86/mm/pageattr.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit 64dd9d7a67a742fda257cdd16510c29e695c34b5 Author: Jan Beulich Date: Tue Jan 26 04:15:18 2016 -0700 x86/mm: Fix types used in pgprot cacheability flags translations For PAE kernels "unsigned long" is not suitable to hold page protection flags, since _PAGE_NX doesn't fit there. This is the reason for quite a few W+X pages getting reported as insecure during boot (observed namely for the entire initrd range). Fixes: 281d4078be ("x86: Make page cache mode a real type") Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/56A7635602000078000CAFF1@prv-mh.provo.novell.com Signed-off-by: Thomas Gleixner arch/x86/include/asm/pgtable_types.h | 6 ++---- 1 files changed, 2 insertions(+), 4 deletions(-) commit bb9a3a9df0d8dfc96d521676e64c42b37ba22aea Merge: 682d661 f74425b Author: Brad Spengler Date: Sun Jan 31 15:06:25 2016 -0500 Merge branch 'pax-test' into grsec-test Conflicts: drivers/net/slip/slhc.c include/linux/sched.h net/unix/af_unix.c sound/core/timer.c commit f74425b5705bfe52aff9e97659ef10c4a14176c3 Merge: d14af1f 849a2d3 Author: Brad Spengler Date: Sun Jan 31 15:02:55 2016 -0500 Merge branch 'linux-4.3.y' into pax-test Conflicts: arch/x86/include/asm/mmu_context.h commit 682d6611d75542e351c973c8dd74a99d3966c073 Author: Brad Spengler Date: Sat Jan 30 13:05:03 2016 -0500 Based on a report from Mathias Krause, fix up a number of additional instances of ulong overflow when passing in values to gr_learn_resource by saturating to ULONG_MAX mm/mlock.c | 11 ++++++++--- mm/mmap.c | 16 +++++++++++++--- 2 files changed, 21 insertions(+), 6 deletions(-) commit adb52e95fb9ad4ac9c56cd5d47bd668f47c33096 Author: Jann Horn Date: Sat Dec 26 06:00:48 2015 +0100 seccomp: always propagate NO_NEW_PRIVS on tsync Before this patch, a process with some permissive seccomp filter that was applied by root without NO_NEW_PRIVS was able to add more filters to itself without setting NO_NEW_PRIVS by setting the new filter from a throwaway thread with NO_NEW_PRIVS. Signed-off-by: Jann Horn Cc: stable@vger.kernel.org Signed-off-by: Kees Cook kernel/seccomp.c | 22 +++++++++++----------- 1 files changed, 11 insertions(+), 11 deletions(-) commit b85450498a3bbf269441c8963d7574bb3079c838 Merge: 59c216f d14af1f Author: Brad Spengler Date: Fri Jan 29 20:54:13 2016 -0500 Merge branch 'pax-test' into grsec-test commit d14af1f1dd66511f3f0674deee2b572972012b39 Author: Brad Spengler Date: Fri Jan 29 20:53:51 2016 -0500 Update to pax-linux-4.3.4-test26.patch: - Emese fixed a few intentional overflows introduced by gcc, reported by StalkR (https://forums.grsecurity.net/viewtopic.php?f=3&t=4370) fs/cifs/file.c | 2 +- fs/gfs2/file.c | 2 +- .../size_overflow_plugin/intentional_overflow.c | 96 ++++++++++++++++++-- tools/gcc/size_overflow_plugin/size_overflow.h | 2 + .../size_overflow_plugin/size_overflow_plugin.c | 4 +- .../size_overflow_plugin/size_overflow_transform.c | 6 +- .../size_overflow_transform_core.c | 5 + 7 files changed, 102 insertions(+), 15 deletions(-) commit 59c216f13587eacdd692386b7a403ae78ed84fb6 Author: Brad Spengler Date: Wed Jan 27 17:57:21 2016 -0500 Fix a size_overflow report reported by Mathias Krause in our truncation of an loff_t to an unsigned long when being passed to gr_learn_resource() (as all resource checks are against unsigned long values) fs/attr.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) commit 70636c6ad60fc1db3af764ecc789b827b7497a97 Author: Yuchung Cheng Date: Wed Jan 6 12:42:38 2016 -0800 tcp: fix zero cwnd in tcp_cwnd_reduction Patch 3759824da87b ("tcp: PRR uses CRB mode by default and SS mode conditionally") introduced a bug that cwnd may become 0 when both inflight and sndcnt are 0 (cwnd = inflight + sndcnt). This may lead to a div-by-zero if the connection starts another cwnd reduction phase by setting tp->prior_cwnd to the current cwnd (0) in tcp_init_cwnd_reduction(). To prevent this we skip PRR operation when nothing is acked or sacked. Then cwnd must be positive in all cases as long as ssthresh is positive: 1) The proportional reduction mode inflight > ssthresh > 0 2) The reduction bound mode a) inflight == ssthresh > 0 b) inflight < ssthresh sndcnt > 0 since newly_acked_sacked > 0 and inflight < ssthresh Therefore in all cases inflight and sndcnt can not both be 0. We check invalid tp->prior_cwnd to avoid potential div0 bugs. In reality this bug is triggered only with a sequence of less common events. For example, the connection is terminating an ECN-triggered cwnd reduction with an inflight 0, then it receives reordered/old ACKs or DSACKs from prior transmission (which acks nothing). Or the connection is in fast recovery stage that marks everything lost, but fails to retransmit due to local issues, then receives data packets from other end which acks nothing. Fixes: 3759824da87b ("tcp: PRR uses CRB mode by default and SS mode conditionally") Reported-by: Oleksandr Natalenko Signed-off-by: Yuchung Cheng Signed-off-by: Neal Cardwell Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/tcp_input.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) commit dac1da2bedbb43195d371c7a192cfeeb45683df0 Author: Eric Dumazet Date: Sun Jan 24 13:53:50 2016 -0800 af_unix: fix struct pid memory leak Dmitry reported a struct pid leak detected by a syzkaller program. Bug happens in unix_stream_recvmsg() when we break the loop when a signal is pending, without properly releasing scm. Fixes: b3ca9b02b007 ("net: fix multithreaded signal handling in unix recv routines") Reported-by: Dmitry Vyukov Signed-off-by: Eric Dumazet Cc: Rainer Weikusat Signed-off-by: David S. Miller net/unix/af_unix.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit 15cc47f127520d1ac0c1fe76d993c2c27f0f2571 Author: Hannes Frederic Sowa Date: Fri Jan 22 01:39:43 2016 +0100 pptp: fix illegal memory access caused by multiple bind()s Several times already this has been reported as kasan reports caused by syzkaller and trinity and people always looked at RCU races, but it is much more simple. :) In case we bind a pptp socket multiple times, we simply add it to the callid_sock list but don't remove the old binding. Thus the old socket stays in the bucket with unused call_id indexes and doesn't get cleaned up. This causes various forms of kasan reports which were hard to pinpoint. Simply don't allow multiple binds and correct error handling in pptp_bind. Also keep sk_state bits in place in pptp_connect. Fixes: 00959ade36acad ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)") Cc: Dmitry Kozlov Cc: Sasha Levin Cc: Dmitry Vyukov Reported-by: Dmitry Vyukov Cc: Dave Jones Reported-by: Dave Jones Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller drivers/net/ppp/pptp.c | 34 ++++++++++++++++++++++++---------- 1 files changed, 24 insertions(+), 10 deletions(-) commit e2b7b8c66851c85188fa6dab2d2b2a6c85bc7332 Author: Brad Spengler Date: Tue Jan 26 18:17:10 2016 -0500 Add info about cpupower/powertop to GRKERNSEC_KMEM, was present on our wiki but was removed from the config help at some point grsecurity/Kconfig | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) commit ce2e88efa000fc32bfcd84098f57c8ed8310fefc Author: Thomas Egerer Date: Mon Jan 25 12:58:44 2016 +0100 ipv4+ipv6: Make INET*_ESP select CRYPTO_ECHAINIV The ESP algorithms using CBC mode require echainiv. Hence INET*_ESP have to select CRYPTO_ECHAINIV in order to work properly. This solves the issues caused by a misconfiguration as described in [1]. The original approach, patching crypto/Kconfig was turned down by Herbert Xu [2]. [1] https://lists.strongswan.org/pipermail/users/2015-December/009074.html [2] http://marc.info/?l=linux-crypto-vger&m=145224655809562&w=2 Signed-off-by: Thomas Egerer Acked-by: Herbert Xu Signed-off-by: David S. Miller net/ipv4/Kconfig | 1 + net/ipv6/Kconfig | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) commit fca5a303155ea67d28aece0caf2b03ffc3b2668d Merge: 904114c 6339c1f Author: Brad Spengler Date: Tue Jan 26 18:08:40 2016 -0500 Merge branch 'pax-test' into grsec-test commit 6339c1f9a9beafd417bf9f04d4b257e62aeb45b7 Author: Brad Spengler Date: Tue Jan 26 18:07:51 2016 -0500 Update to pax-linux-4.3.4-test25.patch: - fixed incorrect handling of VM_DONTCOPY during fork that would trigger a consistency check in the vma mirroring logic, reported by Mathias Krause - fixed init_new_context on !MODIFY_LDT_SYSCALL configs, reported by tjh (https://forums.grsecurity.net/viewtopic.php?f=3&t=4368) - fixed a few REFCOUNT false positives in SNMP related statistics arch/x86/Kconfig | 2 +- arch/x86/include/asm/mmu_context.h | 17 +++++++++++++++++ include/net/snmp.h | 10 +++++----- kernel/fork.c | 11 +++++++++-- net/ipv4/proc.c | 8 ++++---- net/ipv6/addrconf.c | 4 ++-- net/ipv6/proc.c | 10 +++++----- 7 files changed, 43 insertions(+), 19 deletions(-) commit 904114c2fce3fdff5d57e763da56a78960db4e19 Author: Al Viro Date: Fri Jan 22 18:08:52 2016 -0500 make sure that freeing shmem fast symlinks is RCU-delayed Cc: stable@vger.kernel.org # v4.2+ Signed-off-by: Al Viro include/linux/shmem_fs.h | 5 +---- mm/shmem.c | 9 ++++----- 2 files changed, 5 insertions(+), 9 deletions(-) commit ab86adee64312a2f827dd516cb199521327943ed Author: Sasha Levin Date: Mon Jan 18 19:23:51 2016 -0500 netfilter: nf_conntrack: use safer way to lock all buckets When we need to lock all buckets in the connection hashtable we'd attempt to lock 1024 spinlocks, which is way more preemption levels than supported by the kernel. Furthermore, this behavior was hidden by checking if lockdep is enabled, and if it was - use only 8 buckets(!). Fix this by using a global lock and synchronize all buckets on it when we need to lock them all. This is pretty heavyweight, but is only done when we need to resize the hashtable, and that doesn't happen often enough (or at all). Signed-off-by: Sasha Levin Acked-by: Jesper Dangaard Brouer Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Conflicts: net/netfilter/nfnetlink_cttimeout.c include/net/netfilter/nf_conntrack_core.h | 8 ++---- net/netfilter/nf_conntrack_core.c | 38 +++++++++++++++++++++------- net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 2 +- 4 files changed, 33 insertions(+), 17 deletions(-) commit 37014723527225481c720484bb788a1a6358072f Author: Willy Tarreau Date: Mon Jan 18 16:36:09 2016 +0100 pipe: limit the per-user amount of pages allocated in pipes On no-so-small systems, it is possible for a single process to cause an OOM condition by filling large pipes with data that are never read. A typical process filling 4000 pipes with 1 MB of data will use 4 GB of memory. On small systems it may be tricky to set the pipe max size to prevent this from happening. This patch makes it possible to enforce a per-user soft limit above which new pipes will be limited to a single page, effectively limiting them to 4 kB each, as well as a hard limit above which no new pipes may be created for this user. This has the effect of protecting the system against memory abuse without hurting other users, and still allowing pipes to work correctly though with less data at once. The limit are controlled by two new sysctls : pipe-user-pages-soft, and pipe-user-pages-hard. Both may be disabled by setting them to zero. The default soft limit allows the default number of FDs per process (1024) to create pipes of the default size (64kB), thus reaching a limit of 64MB before starting to create only smaller pipes. With 256 processes limited to 1024 FDs each, this results in 1024*64kB + (256*1024 - 1024) * 4kB = 1084 MB of memory allocated for a user. The hard limit is disabled by default to avoid breaking existing applications that make intensive use of pipes (eg: for splicing). Reported-by: socketpair@gmail.com Reported-by: Tetsuo Handa Mitigates: CVE-2013-4312 (Linux 2.0+) Suggested-by: Linus Torvalds Signed-off-by: Willy Tarreau Signed-off-by: Al Viro Documentation/sysctl/fs.txt | 23 +++++++++++++++++++++ fs/pipe.c | 47 +++++++++++++++++++++++++++++++++++++++++- include/linux/pipe_fs_i.h | 4 +++ include/linux/sched.h | 1 + kernel/sysctl.c | 14 ++++++++++++ 5 files changed, 87 insertions(+), 2 deletions(-) commit 51645fa198d194f746651dcfbc5f24a4cf8b9fb8 Merge: 540f2af 7791ecb Author: Brad Spengler Date: Sat Jan 23 10:57:11 2016 -0500 Merge branch 'pax-test' into grsec-test commit 7791ecb84f840343a5646236fd0d34e1fb450793 Merge: 470069c 399588c Author: Brad Spengler Date: Sat Jan 23 10:56:47 2016 -0500 Merge branch 'linux-4.3.y' into pax-test commit 540f2affebd42cdc26a699208ab4f1cb0cb75e33 Author: Brad Spengler Date: Tue Jan 19 21:18:47 2016 -0500 Update size_overflow hash table .../size_overflow_plugin/size_overflow_hash.data | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) commit 7e649765626a28437f573f0fbe7a51a04615f041 Author: Brad Spengler Date: Tue Jan 19 20:29:46 2016 -0500 Backport fix from: https://lkml.org/lkml/2015/12/13/187 fs/ext4/extents.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 53b859cd0a5f5b6ad54fe0c879dfedaa3c5a3005 Author: Jann Horn Date: Tue Jan 5 18:27:30 2016 +0100 compat_ioctl: don't call do_ioctl under set_fs(KERNEL_DS) This replaces all code in fs/compat_ioctl.c that translated ioctl arguments into a in-kernel structure, then performed do_ioctl under set_fs(KERNEL_DS), with code that allocates data on the user stack and can call the VFS ioctl handler under USER_DS. This is done as a hardening measure because the caller does not know what kind of ioctl handler will be invoked, only that no corresponding compat_ioctl handler exists and what the ioctl command number is. The accidental invocation of an unlocked_ioctl handler that unexpectedly calls copy_to_user could be a severe security issue. Signed-off-by: Jann Horn Signed-off-by: Al Viro Conflicts: fs/compat_ioctl.c fs/compat_ioctl.c | 130 ++++++++++++++++++++++++++++------------------------- 1 files changed, 68 insertions(+), 62 deletions(-) commit 3e89e770ae27e931cd1583f021abac41eeebc3e7 Author: Al Viro Date: Thu Jan 7 09:53:30 2016 -0500 compat_ioctl: don't pass fd around when not needed Signed-off-by: Al Viro fs/compat_ioctl.c | 103 ++++++++++++++++++++++++++-------------------------- fs/internal.h | 7 ++++ fs/ioctl.c | 4 +- include/linux/fs.h | 2 - 4 files changed, 61 insertions(+), 55 deletions(-) commit 9d4e04082752d4d2d68445c4e6faf33a2613df55 Author: Jann Horn Date: Tue Jan 5 18:27:29 2016 +0100 compat_ioctl: don't look up the fd twice In code in fs/compat_ioctl.c that translates ioctl arguments into a in-kernel structure, then performs sys_ioctl, possibly under set_fs(KERNEL_DS), this commit changes the sys_ioctl calls to do_ioctl calls. do_ioctl is a new function that does the same thing as sys_ioctl, but doesn't look up the fd again. This change is made to avoid (potential) security issues because of ioctl handlers that accept one of the ioctl commands I2C_FUNCS, VIDEO_GET_EVENT, MTIOCPOS, MTIOCGET, TIOCGSERIAL, TIOCSSERIAL, RTC_IRQP_READ, RTC_EPOCH_READ. This can happen for multiple reasons: - The ioctl command number could be reused. - The ioctl handler might not check the full ioctl command. This is e.g. true for drm_ioctl. - The ioctl handler is very special, e.g. cuse_file_ioctl The real issue is that set_fs(KERNEL_DS) is used here, but that's fixed in a separate commit "compat_ioctl: don't call do_ioctl under set_fs(KERNEL_DS)". This change mitigates potential security issues by preventing a race that permits invocation of unlocked_ioctl handlers under KERNEL_DS through compat code even if a corresponding compat_ioctl handler exists. So far, no way has been identified to use this to damage kernel memory without having CAP_SYS_ADMIN in the init ns (with the capability, doing reads/writes at arbitrary kernel addresses should be easy through CUSE's ioctl handler with FUSE_IOCTL_UNRESTRICTED set). [AV: two missed sys_ioctl() taken care of] Signed-off-by: Jann Horn Signed-off-by: Al Viro fs/compat_ioctl.c | 122 +++++++++++++++++++++++++++++----------------------- 1 files changed, 68 insertions(+), 54 deletions(-) commit 5bf9e1ed4ebb278cd956ba142914fc04a024309c Author: Vasily Kulikov Date: Fri Jan 15 16:57:55 2016 -0800 include/linux/poison.h: use POISON_POINTER_DELTA for poison pointers TIMER_ENTRY_STATIC is defined as a poison pointers which should point to nowhere. Redefine them using POISON_POINTER_DELTA arithmetics to make sure they really point to non-mappable area declared by the target architecture. Signed-off-by: Vasily Kulikov Acked-by: Thomas Gleixner Cc: Solar Designer Cc: "Kirill A. Shutemov" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Conflicts: include/linux/poison.h include/linux/poison.h | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 60f2e0a05ab8f56c804a9334a23e2b446305d110 Author: Brad Spengler Date: Tue Jan 19 19:41:44 2016 -0500 Fix ARM compilation, reported by Austin Sepp grsecurity/grsec_sig.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit e15383743443dc43460a2fd73e0db0b608610dca Author: Takashi Iwai Date: Mon Jan 18 13:52:47 2016 +0100 ALSA: hrtimer: Fix stall by hrtimer_cancel() hrtimer_cancel() waits for the completion from the callback, thus it must not be called inside the callback itself. This was already a problem in the past with ALSA hrtimer driver, and the early commit [fcfdebe70759: ALSA: hrtimer - Fix lock-up] tried to address it. However, the previous fix is still insufficient: it may still cause a lockup when the ALSA timer instance reprograms itself in its callback. Then it invokes the start function even in snd_timer_interrupt() that is called in hrtimer callback itself, results in a CPU stall. This is no hypothetical problem but actually triggered by syzkaller fuzzer. This patch tries to fix the issue again. Now we call hrtimer_try_to_cancel() at both start and stop functions so that it won't fall into a deadlock, yet giving some chance to cancel the queue if the functions have been called outside the callback. The proper hrtimer_cancel() is called in anyway at closing, so this should be enough. Reported-and-tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/hrtimer.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) commit 12d874daf706e6e7c1ae709141859c809599297e Author: Takashi Iwai Date: Tue Jan 12 12:38:02 2016 +0100 ALSA: seq: Fix missing NULL check at remove_events ioctl snd_seq_ioctl_remove_events() calls snd_seq_fifo_clear() unconditionally even if there is no FIFO assigned, and this leads to an Oops due to NULL dereference. The fix is just to add a proper NULL check. Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/seq/seq_clientmgr.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 2eb0632df1351378946507e7ef7ba0682632a7b5 Author: Takashi Iwai Date: Tue Jan 12 15:36:27 2016 +0100 ALSA: seq: Fix race at timer setup and close ALSA sequencer code has an open race between the timer setup ioctl and the close of the client. This was triggered by syzkaller fuzzer, and a use-after-free was caught there as a result. This patch papers over it by adding a proper queue->timer_mutex lock around the timer-related calls in the relevant code path. Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/seq/seq_queue.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) commit b9e55ab955e59b4a636d78a748be90334a48b485 Author: Takashi Iwai Date: Thu Jan 14 16:30:58 2016 +0100 ALSA: timer: Harden slave timer list handling A slave timer instance might be still accessible in a racy way while operating the master instance as it lacks of locking. Since the master operation is mostly protected with timer->lock, we should cope with it while changing the slave instance, too. Also, some linked lists (active_list and ack_list) of slave instances aren't unlinked immediately at stopping or closing, and this may lead to unexpected accesses. This patch tries to address these issues. It adds spin lock of timer->lock (either from master or slave, which is equivalent) in a few places. For avoiding a deadlock, we ensure that the global slave_active_lock is always locked at first before each timer lock. Also, ack and active_list of slave instances are properly unlinked at snd_timer_stop() and snd_timer_close(). Last but not least, remove the superfluous call of _snd_timer_stop() at removing slave links. This is a noop, and calling it may confuse readers wrt locking. Further cleanup will follow in a later patch. Actually we've got reports of use-after-free by syzkaller fuzzer, and this hopefully fixes these issues. Reported-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/timer.c | 18 ++++++++++++++---- 1 files changed, 14 insertions(+), 4 deletions(-) commit f1ce0547bdfda1b42ae8a66c222f2a897cbe1586 Author: Takashi Iwai Date: Wed Jan 13 17:48:01 2016 +0100 ALSA: timer: Fix race among timer ioctls ALSA timer ioctls have an open race and this may lead to a use-after-free of timer instance object. A simplistic fix is to make each ioctl exclusive. We have already tread_sem for controlling the tread, and extend this as a global mutex to be applied to each ioctl. The downside is, of course, the worse concurrency. But these ioctls aren't to be parallel accessible, in anyway, so it should be fine to serialize there. Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/timer.c | 32 +++++++++++++++++++------------- 1 files changed, 19 insertions(+), 13 deletions(-) commit 8347d8461ed48a98f9c76cc3cfcdad8217d314bc Author: Takashi Iwai Date: Wed Jan 13 21:35:06 2016 +0100 ALSA: timer: Fix double unlink of active_list ALSA timer instance object has a couple of linked lists and they are unlinked unconditionally at snd_timer_stop(). Meanwhile snd_timer_interrupt() unlinks it, but it calls list_del() which leaves the element list itself unchanged. This ends up with unlinking twice, and it was caught by syzkaller fuzzer. The fix is to use list_del_init() variant properly there, too. Reported-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Cc: Signed-off-by: Takashi Iwai sound/core/timer.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 243aebb7ae71d6e11ea9880faa893d1d0d60cd75 Author: Hannes Frederic Sowa Date: Mon Jan 18 18:03:48 2016 +0100 ovs: limit ovs recursions in ovs_execute_actions to not corrupt stack It was seen that defective configurations of openvswitch could overwrite the STACK_END_MAGIC and cause a hard crash of the kernel because of too many recursions within ovs. This problem arises due to the high stack usage of openvswitch. The rest of the kernel is fine with the current limit of 10 (RECURSION_LIMIT). We use the already existing recursion counter in ovs_execute_actions to implement an upper bound of 5 recursions. Cc: Pravin Shelar Cc: Simon Horman Cc: Eric Dumazet Cc: Simon Horman Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller net/openvswitch/actions.c | 19 ++++++++++++++----- 1 files changed, 14 insertions(+), 5 deletions(-) commit 8080793479c6d5befe37a67b1dbd9e4e0a61af96 Author: Ursula Braun Date: Tue Jan 19 10:41:33 2016 +0100 af_iucv: Validate socket address length in iucv_sock_bind() Signed-off-by: Ursula Braun Reported-by: Dmitry Vyukov Reviewed-by: Evgeny Cherkashin Signed-off-by: David S. Miller net/iucv/af_iucv.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) commit 50a383c1c91ed7409c3cbdd41e662d6891463d1b Author: Brad Spengler Date: Tue Jan 19 19:32:54 2016 -0500 Apply the same fix as everyone else for the recent keys vulnerability that is unexploitable under PAX_REFCOUNT Make a couple more changes that no one else can/will include/linux/key-type.h | 4 ++-- ipc/msgutil.c | 4 ++-- security/keys/internal.h | 2 +- security/keys/process_keys.c | 1 + 4 files changed, 6 insertions(+), 5 deletions(-) commit b56c3a63f431c193400aee17543021950bd14bc4 Merge: 38b1a3d 470069c Author: Brad Spengler Date: Sun Jan 17 18:30:19 2016 -0500 Merge branch 'pax-test' into grsec-test commit 470069cfedef2180313233d275be5901bd6d1135 Author: Brad Spengler Date: Sun Jan 17 18:29:59 2016 -0500 Update to pax-linux-4.3.3-test22.patch: - Emesed fixed a gcc induced intentional integer overflow in asix_rx_fixup_internal, reported by thomas callison caffrey - fixed some more fallout from the drm_drivers constification, reported by Colin Childs and Toralf Foerster drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 14 ++++---------- drivers/gpu/drm/drm_pci.c | 3 +++ drivers/gpu/drm/gma500/psb_drv.c | 4 ---- drivers/gpu/drm/i915/i915_drv.c | 16 ++++++++-------- drivers/gpu/drm/nouveau/nouveau_drm.c | 6 +++--- drivers/gpu/drm/radeon/radeon_drv.c | 4 +--- drivers/net/usb/asix_common.c | 3 ++- include/drm/drmP.h | 1 + 8 files changed, 22 insertions(+), 29 deletions(-) commit 38b1a3d676f407865c3d41840df8213c5ad639c1 Author: Brad Spengler Date: Sun Jan 17 12:33:53 2016 -0500 As reported by Luis Ressel, the Kconfig help for GRKERNSEC_BRUTE mentioned banning execution of suid/sgid binaries, though the kernel source clearly only mentions banning execution of suid binaries. Since there's no reason for us to not ban execution of sgid binaries as well, make the implementation match the Kconfig description. fs/exec.c | 4 ++-- grsecurity/grsec_sig.c | 27 ++++++++++++++------------- include/linux/sched.h | 4 ++-- 3 files changed, 18 insertions(+), 17 deletions(-) commit 8c3bcb7dbf7f606acfa0983e81f0f928da1f1ace Merge: d141a86 ea4a835 Author: Brad Spengler Date: Sat Jan 16 14:12:22 2016 -0500 Merge branch 'pax-test' into grsec-test Conflicts: drivers/gpu/drm/i810/i810_drv.c commit ea4a835328ada6513ac013986764d6caea8cd348 Author: Brad Spengler Date: Sat Jan 16 14:11:30 2016 -0500 Update to pax-linux-4.3.3-test21.patch: - fixed some fallout from the drm_drivers constification, reported by spender drivers/gpu/drm/armada/armada_drv.c | 3 +-- drivers/gpu/drm/exynos/exynos_drm_drv.c | 1 - drivers/gpu/drm/i810/i810_dma.c | 2 +- drivers/gpu/drm/i810/i810_drv.c | 6 +++++- drivers/gpu/drm/i810/i810_drv.h | 2 +- 5 files changed, 8 insertions(+), 6 deletions(-) commit d141a86fd66194bc3f896b6809b189e2f12a9a83 Author: Brad Spengler Date: Sat Jan 16 13:16:36 2016 -0500 compile fix drivers/gpu/drm/i810/i810_dma.c | 2 +- drivers/gpu/drm/i810/i810_drv.c | 4 +++- drivers/gpu/drm/i810/i810_drv.h | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) commit 0d9dc4b25ea32c14561bcfe6b5b24f1b00fe0270 Merge: 5fa135d bbda879 Author: Brad Spengler Date: Sat Jan 16 12:59:22 2016 -0500 Merge branch 'pax-test' into grsec-test commit bbda87914edf63e27fb46670bf3a373f2b963c73 Author: Brad Spengler Date: Sat Jan 16 12:58:04 2016 -0500 Update to pax-linux-4.3.3-test20.patch: - constified drm_driver - Emese fixed a special case in handling __func__ in the initify plugin - Emese fixed a false positive size overflow report in handling inbufBits, reported by Martin Filo (https://bugs.gentoo.org/show_bug.cgi?id=567048) - fixed regression that caused perf to not resolve kernel code addresses under KERNEXEC/i386, reported by minipli arch/x86/kernel/cpu/perf_event.h | 2 +- arch/x86/kernel/cpu/perf_event_intel_ds.c | 7 +- arch/x86/kernel/cpu/perf_event_intel_lbr.c | 4 +- arch/x86/kernel/uprobes.c | 2 +- arch/x86/mm/mpx.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 8 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 +- drivers/gpu/drm/drm_pci.c | 6 +- drivers/gpu/drm/gma500/psb_drv.c | 5 +- drivers/gpu/drm/i915/i915_dma.c | 2 +- drivers/gpu/drm/i915/i915_drv.c | 15 ++-- drivers/gpu/drm/i915/i915_drv.h | 2 +- drivers/gpu/drm/i915/i915_irq.c | 88 ++++++++++---------- drivers/gpu/drm/mga/mga_drv.c | 5 +- drivers/gpu/drm/mga/mga_drv.h | 2 +- drivers/gpu/drm/mga/mga_state.c | 2 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 13 ++-- drivers/gpu/drm/qxl/qxl_drv.c | 8 ++- drivers/gpu/drm/qxl/qxl_ioctl.c | 2 +- drivers/gpu/drm/r128/r128_drv.c | 4 +- drivers/gpu/drm/r128/r128_drv.h | 2 +- drivers/gpu/drm/r128/r128_state.c | 2 +- drivers/gpu/drm/radeon/radeon_drv.c | 17 +++- drivers/gpu/drm/radeon/radeon_drv.h | 2 +- drivers/gpu/drm/radeon/radeon_kms.c | 2 +- drivers/gpu/drm/radeon/radeon_state.c | 2 +- drivers/gpu/drm/savage/savage_bci.c | 2 +- drivers/gpu/drm/savage/savage_drv.c | 5 +- drivers/gpu/drm/savage/savage_drv.h | 2 +- drivers/gpu/drm/sis/sis_drv.c | 5 +- drivers/gpu/drm/sis/sis_drv.h | 2 +- drivers/gpu/drm/sis/sis_mm.c | 2 +- drivers/gpu/drm/via/via_dma.c | 2 +- drivers/gpu/drm/via/via_drv.c | 5 +- drivers/gpu/drm/via/via_drv.h | 2 +- include/drm/drmP.h | 2 +- mm/slab.c | 2 +- net/sunrpc/xprtrdma/svc_rdma.c | 6 +- tools/gcc/initify_plugin.c | 15 +++- .../disable_size_overflow_hash.data | 1 + .../size_overflow_plugin/size_overflow_hash.data | 3 +- 42 files changed, 156 insertions(+), 110 deletions(-) commit 5fa135dc116350e0205c39ef65eaf6496ed2748a Author: Brad Spengler Date: Sat Jan 16 12:19:23 2016 -0500 compile fix grsecurity/grsec_sig.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) commit a9090fa58f33f75c7450fda5721a9b13625a47d9 Author: Brad Spengler Date: Sat Jan 16 12:10:37 2016 -0500 As pointed out by Jann Horn, some distros are starting to circumvent previous assumptions about the attainability of a user to control multiple UIDs by handing out suid binaries that allow a user to run processes (including exploits) under a number of other pre-defined UIDs. As this could potentially be used to bypass GRKERNSEC_BRUTE (though it would have to involve some code path that doesn't involve locks) fix that here by ensuring no more than 8 users on a system can be banned before a reboot is required. If more are banned, a panic is triggered. grsecurity/grsec_sig.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) commit a8d37776e9521c567ebff6730d49312f72435f08 Author: Eric Dumazet Date: Thu Dec 3 11:12:07 2015 -0800 proc: add a reschedule point in proc_readfd_common() User can pass an arbitrary large buffer to getdents(). It is typically a 32KB buffer used by libc scandir() implementation. When scanning /proc/{pid}/fd, we can hold cpu way too long, so add a cond_resched() to be kind with other tasks. We've seen latencies of more than 50ms on real workloads. Signed-off-by: Eric Dumazet Cc: Alexander Viro Signed-off-by: Al Viro fs/proc/fd.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit 0adba75f8708f13b1f5d98ebe3fc2fb961e100c8 Author: Rabin Vincent Date: Tue Jan 12 20:17:08 2016 +0100 net: bpf: reject invalid shifts On ARM64, a BUG() is triggered in the eBPF JIT if a filter with a constant shift that can't be encoded in the immediate field of the UBFM/SBFM instructions is passed to the JIT. Since these shifts amounts, which are negative or >= regsize, are invalid, reject them in the eBPF verifier and the classic BPF filter checker, for all architectures. Signed-off-by: Rabin Vincent Acked-by: Alexei Starovoitov Acked-by: Daniel Borkmann Signed-off-by: David S. Miller kernel/bpf/verifier.c | 10 ++++++++++ net/core/filter.c | 5 +++++ 2 files changed, 15 insertions(+), 0 deletions(-) commit c248e115a73496625a1c64660d0eeefd67e55cbf Author: Marcelo Ricardo Leitner Date: Fri Jan 8 11:00:54 2016 -0200 sctp: fix use-after-free in pr_debug statement Dmitry Vyukov reported a use-after-free in the code expanded by the macro debug_post_sfx, which is caused by the use of the asoc pointer after it was freed within sctp_side_effect() scope. This patch fixes it by allowing sctp_side_effect to clear that asoc pointer when the TCB is freed. As Vlad explained, we also have to cover the SCTP_DISPOSITION_ABORT case because it will trigger DELETE_TCB too on that same loop. Also, there were places issuing SCTP_CMD_INIT_FAILED and ASSOC_FAILED but returning SCTP_DISPOSITION_CONSUME, which would fool the scheme above. Fix it by returning SCTP_DISPOSITION_ABORT instead. The macro is already prepared to handle such NULL pointer. Reported-by: Dmitry Vyukov Signed-off-by: Marcelo Ricardo Leitner Acked-by: Vlad Yasevich Signed-off-by: David S. Miller net/sctp/sm_sideeffect.c | 11 ++++++----- net/sctp/sm_statefuns.c | 17 ++++------------- 2 files changed, 10 insertions(+), 18 deletions(-) commit 395ea8a9e73e184fc14153a033000bccf4213213 Author: willy tarreau Date: Sun Jan 10 07:54:56 2016 +0100 unix: properly account for FDs passed over unix sockets It is possible for a process to allocate and accumulate far more FDs than the process' limit by sending them over a unix socket then closing them to keep the process' fd count low. This change addresses this problem by keeping track of the number of FDs in flight per user and preventing non-privileged processes from having more FDs in flight than their configured FD limit. Reported-by: socketpair@gmail.com Reported-by: Tetsuo Handa Mitigates: CVE-2013-4312 (Linux 2.0+) Suggested-by: Linus Torvalds Acked-by: Hannes Frederic Sowa Signed-off-by: Willy Tarreau Signed-off-by: David S. Miller include/linux/sched.h | 1 + net/unix/af_unix.c | 24 ++++++++++++++++++++---- net/unix/garbage.c | 13 ++++++++----- 3 files changed, 29 insertions(+), 9 deletions(-) commit cb207ab8fbd71dcfc4a49d533aba8085012543fd Author: Sasha Levin Date: Thu Jan 7 14:52:43 2016 -0500 net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory proc_dostring() needs an initialized destination string, while the one provided in proc_sctp_do_hmac_alg() contains stack garbage. Thus, writing to cookie_hmac_alg would strlen() that garbage and end up accessing invalid memory. Fixes: 3c68198e7 ("sctp: Make hmac algorithm selection for cookie generation dynamic") Signed-off-by: Sasha Levin Signed-off-by: David S. Miller net/sctp/sysctl.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 4014e09faf0fe9054119624ccfff1236e886b554 Author: Quentin Casasnovas Date: Tue Nov 24 17:13:21 2015 -0500 RDS: fix race condition when sending a message on unbound socket commit 8c7188b23474cca017b3ef354c4a58456f68303a upstream. Sasha's found a NULL pointer dereference in the RDS connection code when sending a message to an apparently unbound socket. The problem is caused by the code checking if the socket is bound in rds_sendmsg(), which checks the rs_bound_addr field without taking a lock on the socket. This opens a race where rs_bound_addr is temporarily set but where the transport is not in rds_bind(), leading to a NULL pointer dereference when trying to dereference 'trans' in __rds_conn_create(). Vegard wrote a reproducer for this issue, so kindly ask him to share if you're interested. I cannot reproduce the NULL pointer dereference using Vegard's reproducer with this patch, whereas I could without. Complete earlier incomplete fix to CVE-2015-6937: 74e98eb08588 ("RDS: verify the underlying transport exists before creating a connection") Cc: David S. Miller Reviewed-by: Vegard Nossum Reviewed-by: Sasha Levin Acked-by: Santosh Shilimkar Signed-off-by: Quentin Casasnovas Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby Conflicts: net/rds/send.c net/rds/connection.c | 6 ------ 1 files changed, 0 insertions(+), 6 deletions(-) commit 206df8d01104344d7588d801016a281a4cd25556 Author: Sasha Levin Date: Tue Sep 8 10:53:40 2015 -0400 RDS: verify the underlying transport exists before creating a connection There was no verification that an underlying transport exists when creating a connection, this would cause dereferencing a NULL ptr. It might happen on sockets that weren't properly bound before attempting to send a message, which will cause a NULL ptr deref: [135546.047719] kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN [135546.051270] Modules linked in: [135546.051781] CPU: 4 PID: 15650 Comm: trinity-c4 Not tainted 4.2.0-next-20150902-sasha-00041-gbaa1222-dirty #2527 [135546.053217] task: ffff8800835bc000 ti: ffff8800bc708000 task.ti: ffff8800bc708000 [135546.054291] RIP: __rds_conn_create (net/rds/connection.c:194) [135546.055666] RSP: 0018:ffff8800bc70fab0 EFLAGS: 00010202 [135546.056457] RAX: dffffc0000000000 RBX: 0000000000000f2c RCX: ffff8800835bc000 [135546.057494] RDX: 0000000000000007 RSI: ffff8800835bccd8 RDI: 0000000000000038 [135546.058530] RBP: ffff8800bc70fb18 R08: 0000000000000001 R09: 0000000000000000 [135546.059556] R10: ffffed014d7a3a23 R11: ffffed014d7a3a21 R12: 0000000000000000 [135546.060614] R13: 0000000000000001 R14: ffff8801ec3d0000 R15: 0000000000000000 [135546.061668] FS: 00007faad4ffb700(0000) GS:ffff880252000000(0000) knlGS:0000000000000000 [135546.062836] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [135546.063682] CR2: 000000000000846a CR3: 000000009d137000 CR4: 00000000000006a0 [135546.064723] Stack: [135546.065048] ffffffffafe2055c ffffffffafe23fc1 ffffed00493097bf ffff8801ec3d0008 [135546.066247] 0000000000000000 00000000000000d0 0000000000000000 ac194a24c0586342 [135546.067438] 1ffff100178e1f78 ffff880320581b00 ffff8800bc70fdd0 ffff880320581b00 [135546.068629] Call Trace: [135546.069028] ? __rds_conn_create (include/linux/rcupdate.h:856 net/rds/connection.c:134) [135546.069989] ? rds_message_copy_from_user (net/rds/message.c:298) [135546.071021] rds_conn_create_outgoing (net/rds/connection.c:278) [135546.071981] rds_sendmsg (net/rds/send.c:1058) [135546.072858] ? perf_trace_lock (include/trace/events/lock.h:38) [135546.073744] ? lockdep_init (kernel/locking/lockdep.c:3298) [135546.074577] ? rds_send_drop_to (net/rds/send.c:976) [135546.075508] ? __might_fault (./arch/x86/include/asm/current.h:14 mm/memory.c:3795) [135546.076349] ? __might_fault (mm/memory.c:3795) [135546.077179] ? rds_send_drop_to (net/rds/send.c:976) [135546.078114] sock_sendmsg (net/socket.c:611 net/socket.c:620) [135546.078856] SYSC_sendto (net/socket.c:1657) [135546.079596] ? SYSC_connect (net/socket.c:1628) [135546.080510] ? trace_dump_stack (kernel/trace/trace.c:1926) [135546.081397] ? ring_buffer_unlock_commit (kernel/trace/ring_buffer.c:2479 kernel/trace/ring_buffer.c:2558 kernel/trace/ring_buffer.c:2674) [135546.082390] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749) [135546.083410] ? trace_event_raw_event_sys_enter (include/trace/events/syscalls.h:16) [135546.084481] ? do_audit_syscall_entry (include/trace/events/syscalls.h:16) [135546.085438] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749) [135546.085515] rds_ib_laddr_check(): addr 36.74.25.172 ret -99 node type -1 Acked-by: Santosh Shilimkar Signed-off-by: Sasha Levin Signed-off-by: David S. Miller net/rds/connection.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) commit 173fa03f05cf0ad485d49a42cbdee8844d3a689a Author: Steven Rostedt (Red Hat) Date: Tue Jan 5 20:32:47 2016 -0500 ftrace/module: Call clean up function when module init fails early If the module init code fails after calling ftrace_module_init() and before calling do_init_module(), we can suffer from a memory leak. This is because ftrace_module_init() allocates pages to store the locations that ftrace hooks are placed in the module text. If do_init_module() fails, it still calls the MODULE_GOING notifiers which will tell ftrace to do a clean up of the pages it allocated for the module. But if load_module() fails before then, the pages allocated by ftrace_module_init() will never be freed. Call ftrace_release_mod() on the module if load_module() fails before getting to do_init_module(). Link: http://lkml.kernel.org/r/567CEA31.1070507@intel.com Reported-by: "Qiu, PeiyangX" Fixes: a949ae560a511 "ftrace/module: Hardcode ftrace_module_init() call into load_module()" Cc: stable@vger.kernel.org # v2.6.38+ Acked-by: Rusty Russell Signed-off-by: Steven Rostedt include/linux/ftrace.h | 1 + kernel/module.c | 6 ++++++ 2 files changed, 7 insertions(+), 0 deletions(-) commit 1e5a4a81a4c16c8ac2e264b88a02cc2f42ed0399 Author: Francesco Ruggeri Date: Wed Jan 6 00:18:48 2016 -0800 net: possible use after free in dst_release dst_release should not access dst->flags after decrementing __refcnt to 0. The dst_entry may be in dst_busy_list and dst_gc_task may dst_destroy it before dst_release gets a chance to access dst->flags. Fixes: d69bbf88c8d0 ("net: fix a race in dst_release()") Fixes: 27b75c95f10d ("net: avoid RCU for NOCACHE dst") Signed-off-by: Francesco Ruggeri Acked-by: Eric Dumazet Signed-off-by: David S. Miller net/core/dst.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) commit bfb0455793dd4e0f0b49d34a68b3249ab55565cc Author: Alan Date: Wed Jan 6 14:55:02 2016 +0000 mkiss: fix scribble on freed memory commit d79f16c046086f4fe0d42184a458e187464eb83e fixed a user triggerable scribble on free memory but added a new one which allows the user to scribble even more and user controlled data into freed space. As with 6pack we need to halt the queue before we free the buffers, because the transmit logic is not protected by the semaphore. Signed-off-by: Alan Cox Signed-off-by: David S. Miller drivers/net/hamradio/mkiss.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) commit 5cbbcbd32dc1949470f61d342503808fa9555276 Author: David Miller Date: Thu Dec 17 16:05:49 2015 -0500 mkiss: Fix use after free in mkiss_close(). Need to do the unregister_device() after all references to the driver private have been done. Signed-off-by: David S. Miller drivers/net/hamradio/mkiss.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit b00171576794a98068e069a660f0991a6a5190ff Author: One Thousand Gnomes Date: Tue Jan 5 11:51:25 2016 +0000 6pack: fix free memory scribbles commit acf673a3187edf72068ee2f92f4dc47d66baed47 fixed a user triggerable free memory scribble but in doing so replaced it with a different one that allows the user to control the data and scribble even more. sixpack_close is called by the tty layer in tty context. The tty context is protected by sp_get() and sp_put(). However network layer activity via sp_xmit() is not protected this way. We must therefore stop the queue otherwise the user gets to dump a buffer mostly of their choice into freed kernel pages. Signed-off-by: Alan Cox Signed-off-by: David S. Miller drivers/net/hamradio/6pack.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) commit 5b64a833907cd230a3106aeba2304b2c1bcd116d Author: David Miller Date: Thu Dec 17 16:05:32 2015 -0500 6pack: Fix use after free in sixpack_close(). Need to do the unregister_device() after all references to the driver private have been done. Also we need to use del_timer_sync() for the timers so that we don't have any asynchronous references after the unregister. Signed-off-by: David S. Miller drivers/net/hamradio/6pack.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) commit 4f9d532742656b3613d579220fd10c78f24ba37b Author: Rabin Vincent Date: Tue Jan 5 16:23:07 2016 +0100 net: filter: make JITs zero A for SKF_AD_ALU_XOR_X The SKF_AD_ALU_XOR_X ancillary is not like the other ancillary data instructions since it XORs A with X while all the others replace A with some loaded value. All the BPF JITs fail to clear A if this is used as the first instruction in a filter. This was found using american fuzzy lop. Add a helper to determine if A needs to be cleared given the first instruction in a filter, and use this in the JITs. Except for ARM, the rest have only been compile-tested. Fixes: 3480593131e0 ("net: filter: get rid of BPF_S_* enum") Signed-off-by: Rabin Vincent Acked-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller arch/arm/net/bpf_jit_32.c | 16 +--------------- arch/mips/net/bpf_jit.c | 16 +--------------- arch/powerpc/net/bpf_jit_comp.c | 13 ++----------- arch/sparc/net/bpf_jit_comp.c | 17 ++--------------- include/linux/filter.h | 19 +++++++++++++++++++ 5 files changed, 25 insertions(+), 56 deletions(-) commit 570d88f8acfffda92b89ae2e1c47320d47256034 Author: John Fastabend Date: Tue Jan 5 09:11:36 2016 -0800 net: sched: fix missing free per cpu on qstats When a qdisc is using per cpu stats (currently just the ingress qdisc) only the bstats are being freed. This also free's the qstats. Fixes: b0ab6f92752b9f9d8 ("net: sched: enable per cpu qstats") Signed-off-by: John Fastabend Acked-by: Eric Dumazet Acked-by: Daniel Borkmann Signed-off-by: David S. Miller net/sched/sch_generic.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) commit 32c0ebc51857ee83470a10dcb234d308a0ed1881 Author: Rabin Vincent Date: Tue Jan 5 18:34:04 2016 +0100 ARM: net: bpf: fix zero right shift The LSR instruction cannot be used to perform a zero right shift since a 0 as the immediate value (imm5) in the LSR instruction encoding means that a shift of 32 is perfomed. See DecodeIMMShift() in the ARM ARM. Make the JIT skip generation of the LSR if a zero-shift is requested. This was found using american fuzzy lop. Signed-off-by: Rabin Vincent Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller arch/arm/net/bpf_jit_32.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) commit 51f5d291750285efa4d4bbe84e5ec23dc00c8d2d Author: Brad Spengler Date: Wed Jan 6 20:35:57 2016 -0500 Don't perform hidden lookups in RBAC against the directory of a file being opened with O_CREAT, reported by Karl Witt Conflicts: fs/namei.c fs/namei.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) commit 5a8266a6b2769ccdb447256f95bc2577a73cccd1 Author: Hannes Frederic Sowa Date: Tue Jan 5 10:46:00 2016 +0100 bridge: Only call /sbin/bridge-stp for the initial network namespace [I stole this patch from Eric Biederman. He wrote:] > There is no defined mechanism to pass network namespace information > into /sbin/bridge-stp therefore don't even try to invoke it except > for bridge devices in the initial network namespace. > > It is possible for unprivileged users to cause /sbin/bridge-stp to be > invoked for any network device name which if /sbin/bridge-stp does not > guard against unreasonable arguments or being invoked twice on the > same network device could cause problems. [Hannes: changed patch using netns_eq] Cc: Eric W. Biederman Signed-off-by: Eric W. Biederman Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller net/bridge/br_stp_if.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) commit 650d535cc39f0aeff2f57e60b6617be25d3ef48b Author: Marcelo Ricardo Leitner Date: Wed Dec 23 16:28:40 2015 -0200 sctp: use GFP_USER for user-controlled kmalloc Commit cacc06215271 ("sctp: use GFP_USER for user-controlled kmalloc") missed two other spots. For connectx, as it's more likely to be used by kernel users of the API, it detects if GFP_USER should be used or not. Fixes: cacc06215271 ("sctp: use GFP_USER for user-controlled kmalloc") Reported-by: Dmitry Vyukov Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller net/sctp/socket.c | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-) commit 5718a1f63c41fc156f729783423b002763779d04 Author: Florian Westphal Date: Thu Dec 31 14:26:33 2015 +0100 connector: bump skb->users before callback invocation Dmitry reports memleak with syskaller program. Problem is that connector bumps skb usecount but might not invoke callback. So move skb_get to where we invoke the callback. Reported-by: Dmitry Vyukov Signed-off-by: Florian Westphal Signed-off-by: David S. Miller drivers/connector/connector.c | 11 +++-------- 1 files changed, 3 insertions(+), 8 deletions(-) commit 2e6372e6a97f8d642416899861f91777f44f13b7 Author: Rainer Weikusat Date: Sun Jan 3 18:56:38 2016 +0000 af_unix: Fix splice-bind deadlock On 2015/11/06, Dmitry Vyukov reported a deadlock involving the splice system call and AF_UNIX sockets, http://lists.openwall.net/netdev/2015/11/06/24 The situation was analyzed as (a while ago) A: socketpair() B: splice() from a pipe to /mnt/regular_file does sb_start_write() on /mnt C: try to freeze /mnt wait for B to finish with /mnt A: bind() try to bind our socket to /mnt/new_socket_name lock our socket, see it not bound yet decide that it needs to create something in /mnt try to do sb_start_write() on /mnt, block (it's waiting for C). D: splice() from the same pipe to our socket lock the pipe, see that socket is connected try to lock the socket, block waiting for A B: get around to actually feeding a chunk from pipe to file, try to lock the pipe. Deadlock. on 2015/11/10 by Al Viro, http://lists.openwall.net/netdev/2015/11/10/4 The patch fixes this by removing the kern_path_create related code from unix_mknod and executing it as part of unix_bind prior acquiring the readlock of the socket in question. This means that A (as used above) will sb_start_write on /mnt before it acquires the readlock, hence, it won't indirectly block B which first did a sb_start_write and then waited for a thread trying to acquire the readlock. Consequently, A being blocked by C waiting for B won't cause a deadlock anymore (effectively, both A and B acquire two locks in opposite order in the situation described above). Dmitry Vyukov() tested the original patch. Signed-off-by: Rainer Weikusat Signed-off-by: David S. Miller Conflicts: net/unix/af_unix.c net/unix/af_unix.c | 70 +++++++++++++++++++++++++++++++-------------------- 1 files changed, 42 insertions(+), 28 deletions(-) commit 2e729e557c571f3253e32472cd7d382ac16cf1c3 Author: Qiu Peiyang Date: Thu Dec 31 13:11:28 2015 +0800 tracing: Fix setting of start_index in find_next() When we do cat /sys/kernel/debug/tracing/printk_formats, we hit kernel panic at t_show. general protection fault: 0000 [#1] PREEMPT SMP CPU: 0 PID: 2957 Comm: sh Tainted: G W O 3.14.55-x86_64-01062-gd4acdc7 #2 RIP: 0010:[] [] t_show+0x22/0xe0 RSP: 0000:ffff88002b4ebe80 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 RDX: 0000000000000004 RSI: ffffffff81fd26a6 RDI: ffff880032f9f7b1 RBP: ffff88002b4ebe98 R08: 0000000000001000 R09: 000000000000ffec R10: 0000000000000000 R11: 000000000000000f R12: ffff880004d9b6c0 R13: 7365725f6d706400 R14: ffff880004d9b6c0 R15: ffffffff82020570 FS: 0000000000000000(0000) GS:ffff88003aa00000(0063) knlGS:00000000f776bc40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000f6c02ff0 CR3: 000000002c2b3000 CR4: 00000000001007f0 Call Trace: [] seq_read+0x2f6/0x3e0 [] vfs_read+0x9b/0x160 [] SyS_read+0x49/0xb0 [] ia32_do_call+0x13/0x13 ---[ end trace 5bd9eb630614861e ]--- Kernel panic - not syncing: Fatal exception When the first time find_next calls find_next_mod_format, it should iterate the trace_bprintk_fmt_list to find the first print format of the module. However in current code, start_index is smaller than *pos at first, and code will not iterate the list. Latter container_of will get the wrong address with former v, which will cause mod_fmt be a meaningless object and so is the returned mod_fmt->fmt. This patch will fix it by correcting the start_index. After fixed, when the first time calls find_next_mod_format, start_index will be equal to *pos, and code will iterate the trace_bprintk_fmt_list to get the right module printk format, so is the returned mod_fmt->fmt. Link: http://lkml.kernel.org/r/5684B900.9000309@intel.com Cc: stable@vger.kernel.org # 3.12+ Fixes: 102c9323c35a8 "tracing: Add __tracepoint_string() to export string pointers" Signed-off-by: Qiu Peiyang Signed-off-by: Steven Rostedt kernel/trace/trace_printk.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit 0994af4b1930f32aa493dc08145cd304f8bfc8f4 Author: Al Viro Date: Mon Dec 28 20:47:08 2015 -0500 [PATCH] arm: fix handling of F_OFD_... in oabi_fcntl64() Cc: stable@vger.kernel.org # 3.15+ Reviewed-by: Jeff Layton Signed-off-by: Al Viro arch/arm/kernel/sys_oabi-compat.c | 73 +++++++++++++++++++------------------ 1 files changed, 37 insertions(+), 36 deletions(-) commit 4ed030f65dcf3e6b0128032a49a7d75f947fa351 Merge: de243c2 3adc55a Author: Brad Spengler Date: Tue Jan 5 18:10:10 2016 -0500 Merge branch 'pax-test' into grsec-test commit 3adc55a5acfa429c2a7cc883aef08b960c0079b0 Author: Brad Spengler Date: Tue Jan 5 18:08:53 2016 -0500 Update to pax-linux-4.3.3-test16.patch: - small cleanup in entry_64.S on x86 - Emese fixed the initify plugin to recursively check variable initializers, reported by Rasmus Villemoes - fixed an integer truncation of a partially uninitialized value bug in em_pop_sreg, reported by fx3 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4354) - fixed alternatives patching of call insns under KERNEXEC/i386, reported by fly_a320 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4305) and TTgrsec (https://forums.grsecurity.net/viewtopic.php?f=3&t=4353) - fixed a size overflow false positive that triggered in tcp_parse_options on arm, reported by iamb (https://forums.grsecurity.net/viewtopic.php?f=3&t=4350&p=15917#p15916) - fixed a boot crash on amd64 with KERNEXEC/OR and CONTEXT_TRACKING, reported by Klaus Kusche (https://bugs.gentoo.org/show_bug.cgi?id=570420) arch/x86/entry/entry_64.S | 60 +++++----- arch/x86/kernel/alternative.c | 2 +- arch/x86/kvm/emulate.c | 4 +- tools/gcc/initify_plugin.c | 123 +++++++++---------- .../disable_size_overflow_hash.data | 4 +- .../size_overflow_plugin/size_overflow_hash.data | 2 - 6 files changed, 93 insertions(+), 102 deletions(-) commit de243c26efd0e423ca92db825af2c3f8eb1ca043 Author: Brad Spengler Date: Tue Dec 29 18:01:24 2015 -0500 It was noticed during an internal audit that the code under GRKERNSEC_PROC_MEMMAP which aimed to enforce a 16MB minimum on RLIMIT_DATA for suid/sgid binaries only did so if RLIMIT_DATA was set lower than PAGE_SIZE. This addition was only supplemental as GRKERNSEC_BRUTE is the main defense against suid/sgid attacks and the flaw above would only eliminate the extra entropy provided for the brk-managed heap, still leaving it with the minimum of 16-bit entropy for mmap on x86 and 28 on x64. mm/mmap.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) commit 8e264cfe47e5f08cdc9ed009a630277206cd2534 Merge: 436201b 2584340 Author: Brad Spengler Date: Mon Dec 28 20:30:01 2015 -0500 Merge branch 'pax-test' into grsec-test commit 2584340eab494e64ec1bf9eb5b0d1ae31f926306 Author: Brad Spengler Date: Mon Dec 28 20:29:28 2015 -0500 Update to pax-linux-4.3.3-test14.patch: - fixed an integer sign conversion error in i2c_dw_pci_probe caught by the size overflow plugin, reported by Jean Lucas and ganymede (https://forums.grsecurity.net/viewtopic.php?f=3&t=4349) - fixed shutdown crash with tboot and KERNEXEC, reported by perfinion - fixed a few false positive and one real size overflow reports in hyperv, reported by hunger - fixed compile regressions on armv5, reported by iamb (https://forums.grsecurity.net/viewtopic.php?f=3&t=4350) - fixed an assert in the initify plugin that triggered in vic_register on arm arch/arm/include/asm/atomic.h | 7 +++++-- arch/arm/include/asm/domain.h | 5 ++--- arch/x86/kernel/tboot.c | 14 +++++++++----- drivers/hv/channel.c | 4 +--- drivers/i2c/busses/i2c-designware-pcidrv.c | 2 +- drivers/net/hyperv/rndis_filter.c | 3 +-- fs/exec.c | 4 ++-- include/linux/atomic.h | 15 --------------- net/core/skbuff.c | 3 ++- tools/gcc/initify_plugin.c | 4 +++- 10 files changed, 26 insertions(+), 35 deletions(-) commit 436201b6626b488d173c8076447000077c27b84a Author: David Howells Date: Fri Dec 18 01:34:26 2015 +0000 KEYS: Fix race between read and revoke This fixes CVE-2015-7550. There's a race between keyctl_read() and keyctl_revoke(). If the revoke happens between keyctl_read() checking the validity of a key and the key's semaphore being taken, then the key type read method will see a revoked key. This causes a problem for the user-defined key type because it assumes in its read method that there will always be a payload in a non-revoked key and doesn't check for a NULL pointer. Fix this by making keyctl_read() check the validity of a key after taking semaphore instead of before. I think the bug was introduced with the original keyrings code. This was discovered by a multithreaded test program generated by syzkaller (http://github.com/google/syzkaller). Here's a cleaned up version: #include #include #include void *thr0(void *arg) { key_serial_t key = (unsigned long)arg; keyctl_revoke(key); return 0; } void *thr1(void *arg) { key_serial_t key = (unsigned long)arg; char buffer[16]; keyctl_read(key, buffer, 16); return 0; } int main() { key_serial_t key = add_key("user", "%", "foo", 3, KEY_SPEC_USER_KEYRING); pthread_t th[5]; pthread_create(&th[0], 0, thr0, (void *)(unsigned long)key); pthread_create(&th[1], 0, thr1, (void *)(unsigned long)key); pthread_create(&th[2], 0, thr0, (void *)(unsigned long)key); pthread_create(&th[3], 0, thr1, (void *)(unsigned long)key); pthread_join(th[0], 0); pthread_join(th[1], 0); pthread_join(th[2], 0); pthread_join(th[3], 0); return 0; } Build as: cc -o keyctl-race keyctl-race.c -lkeyutils -lpthread Run as: while keyctl-race; do :; done as it may need several iterations to crash the kernel. The crash can be summarised as: BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 IP: [] user_read+0x56/0xa3 ... Call Trace: [] keyctl_read_key+0xb6/0xd7 [] SyS_keyctl+0x83/0xe0 [] entry_SYSCALL_64_fastpath+0x12/0x6f Reported-by: Dmitry Vyukov Signed-off-by: David Howells Tested-by: Dmitry Vyukov Cc: stable@vger.kernel.org Signed-off-by: James Morris security/keys/keyctl.c | 18 +++++++++--------- 1 files changed, 9 insertions(+), 9 deletions(-) commit 195cea04477025da4a2078bd3e1fb7c4e11206c2 Author: Brad Spengler Date: Tue Dec 22 20:44:01 2015 -0500 Add new kernel command-line param: pax_size_overflow_report_only If a user triggers a size_overflow violation that makes it difficult to obtain the call trace without serial console/net console, they can use this option to provide that information to us Documentation/kernel-parameters.txt | 5 +++++ fs/exec.c | 12 +++++++++--- init/main.c | 11 +++++++++++ 3 files changed, 25 insertions(+), 3 deletions(-) commit 4254a8da5851df8c08cdca5c392916e8c105408d Author: WANG Cong Date: Mon Dec 21 10:55:45 2015 -0800 addrconf: always initialize sysctl table data When sysctl performs restrict writes, it allows to write from a middle position of a sysctl file, which requires us to initialize the table data before calling proc_dostring() for the write case. Fixes: 3d1bec99320d ("ipv6: introduce secret_stable to ipv6_devconf") Reported-by: Sasha Levin Acked-by: Hannes Frederic Sowa Tested-by: Sasha Levin Signed-off-by: Cong Wang Signed-off-by: David S. Miller net/ipv6/addrconf.c | 11 ++++------- 1 files changed, 4 insertions(+), 7 deletions(-) commit f8002863fb06c363180637046947a78a6ccb3d33 Author: WANG Cong Date: Wed Dec 16 23:39:04 2015 -0800 net: check both type and procotol for tcp sockets Dmitry reported the following out-of-bound access: Call Trace: [] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:294 [] sock_setsockopt+0x1284/0x13d0 net/core/sock.c:880 [< inline >] SYSC_setsockopt net/socket.c:1746 [] SyS_setsockopt+0x1fe/0x240 net/socket.c:1729 [] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 This is because we mistake a raw socket as a tcp socket. We should check both sk->sk_type and sk->sk_protocol to ensure it is a tcp socket. Willem points out __skb_complete_tx_timestamp() needs to fix as well. Reported-by: Dmitry Vyukov Cc: Willem de Bruijn Cc: Eric Dumazet Signed-off-by: Cong Wang Acked-by: Willem de Bruijn Signed-off-by: David S. Miller net/core/skbuff.c | 3 ++- net/core/sock.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) commit bd6b3399804470a4ad8f34229469ca149dceba3d Author: Colin Ian King Date: Fri Dec 18 14:22:01 2015 -0800 proc: fix -ESRCH error when writing to /proc/$pid/coredump_filter Writing to /proc/$pid/coredump_filter always returns -ESRCH because commit 774636e19ed51 ("proc: convert to kstrto*()/kstrto*_from_user()") removed the setting of ret after the get_proc_task call and incorrectly left it as -ESRCH. Instead, return 0 when successful. Example breakage: echo 0 > /proc/self/coredump_filter bash: echo: write error: No such process Fixes: 774636e19ed51 ("proc: convert to kstrto*()/kstrto*_from_user()") Signed-off-by: Colin Ian King Acked-by: Kees Cook Cc: [4.3+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/base.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit b28aca2b99ed08546778355fb9402c503ff9b29e Author: Junichi Nomura Date: Tue Dec 22 10:23:44 2015 -0700 block: ensure to split after potentially bouncing a bio blk_queue_bio() does split then bounce, which makes the segment counting based on pages before bouncing and could go wrong. Move the split to after bouncing, like we do for blk-mq, and the we fix the issue of having the bio count for segments be wrong. Fixes: 54efd50bfd87 ("block: make generic_make_request handle arbitrarily sized bios") Cc: stable@vger.kernel.org Tested-by: Artem S. Tashkinov Signed-off-by: Jens Axboe block/blk-core.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) commit e62a25e917a9e5b35ddd5b4f1b5e5e30fbd2e84c Merge: f6f63ae ec72fa5 Author: Brad Spengler Date: Tue Dec 22 19:46:26 2015 -0500 Merge branch 'pax-test' into grsec-test commit ec72fa5f8d9cb4e223bad1b8b5c2e1071c222f2a Author: Brad Spengler Date: Tue Dec 22 19:45:51 2015 -0500 Update to pax-linux-4.3.3-test13.patch: - Emese fixed a (probably) false positive integer truncation in xfs_da_grow_inode_int, reported by jdkbx (http://forums.grsecurity.net/viewtopic.php?f=3&t=4346) - fixed a size overflow in btrfs/try_merge_map, reported by Alex W (https://bugs.archlinux.org/task/47173) and mathias and dwokfur (https://forums.grsecurity.net/viewtopic.php?f=3&t=4344) arch/arm/mm/fault.c | 2 +- arch/x86/mm/fault.c | 2 +- fs/btrfs/extent_map.c | 8 ++++++-- fs/xfs/libxfs/xfs_da_btree.c | 4 +++- 4 files changed, 11 insertions(+), 5 deletions(-) commit f6f63ae154cd45028add1dc41957878060d77fbf Author: Brad Spengler Date: Thu Dec 17 18:43:44 2015 -0500 ptrace_has_cap() checks whether the current process should be treated as having a certain capability for ptrace checks against another process. Until now, this was equivalent to has_ns_capability(current, target_ns, CAP_SYS_PTRACE). However, if a root-owned process wants to enter a user namespace for some reason without knowing who owns it and therefore can't change to the namespace owner's uid and gid before entering, as soon as it has entered the namespace, the namespace owner can attach to it via ptrace and thereby gain access to its uid and gid. While it is possible for the entering process to switch to the uid of a claimed namespace owner before entering, causing the attempt to enter to fail if the claimed uid is wrong, this doesn't solve the problem of determining an appropriate gid. With this change, the entering process can first enter the namespace and then safely inspect the namespace's properties, e.g. through /proc/self/{uid_map,gid_map}, assuming that the namespace owner doesn't have access to uid 0. Signed-off-by: Jann Horn kernel/ptrace.c | 30 +++++++++++++++++++++++++----- 1 files changed, 25 insertions(+), 5 deletions(-) commit e314f0fb63020f61543b401ff594e953c2c304e5 Author: tadeusz.struk@intel.com Date: Tue Dec 15 10:46:17 2015 -0800 net: fix uninitialized variable issue msg_iocb needs to be initialized on the recv/recvfrom path. Otherwise afalg will wrongly interpret it as an async call. Cc: stable@vger.kernel.org Reported-by: Harald Freudenberger Signed-off-by: Tadeusz Struk Signed-off-by: David S. Miller net/socket.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) commit a3f56a43ad56b8fcaf04f6327636ed2f5970de3b Merge: dfa764c 142edcf Author: Brad Spengler Date: Wed Dec 16 21:01:17 2015 -0500 Merge branch 'pax-test' into grsec-test commit 142edcf1005a57fb8887823565cf0bafad2f313c Author: Brad Spengler Date: Wed Dec 16 21:00:57 2015 -0500 Update to pax-linux-4.3.3-test12.patch: - Emese fixed a size overflow false positive in reiserfs/leaf_paste_entries, reported by Christian Apeltauer (https://bugs.gentoo.org/show_bug.cgi?id=568046) - fixed a bunch of int/size_t mismatches in the drivers/tty/n_tty.c code causing size overflow false positives, reported by Toralf Förster, mathias (https://forums.grsecurity.net/viewtopic.php?f=3&t=4342), N8Fear (https://forums.grsecurity.net/viewtopic.php?f=3&t=4341) drivers/tty/n_tty.c | 16 ++++++++-------- .../disable_size_overflow_hash.data | 2 ++ .../size_overflow_plugin/size_overflow_hash.data | 6 ++---- 3 files changed, 12 insertions(+), 12 deletions(-) commit dfa764cc549892a5bfc1083cac78b99032cae577 Author: Hannes Frederic Sowa Date: Tue Dec 15 22:59:12 2015 +0100 ipv6: automatically enable stable privacy mode if stable_secret set Bjørn reported that while we switch all interfaces to privacy stable mode when setting the secret, we don't set this mode for new interfaces. This does not make sense, so change this behaviour. Fixes: 622c81d57b392cc ("ipv6: generation of stable privacy addresses for link-local and autoconf") Reported-by: Bjørn Mork Cc: Bjørn Mork Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller net/ipv6/addrconf.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) commit c2815a1fee03f222273e77c14e43f960da06f35a Author: Brad Spengler Date: Wed Dec 16 13:03:38 2015 -0500 Work around upstream limitation on the number of thread info flags causing a compilation error Reported by fabled at http://forums.grsecurity.net/viewtopic.php?f=3&t=4339 arch/arm/kernel/entry-common.S | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-) commit 8c9ae168e09ae49324d709d76d73d9fc4ca477e1 Author: Brad Spengler Date: Tue Dec 15 19:03:41 2015 -0500 Initial import of grsecurity 3.1 for Linux 4.3.3 Documentation/dontdiff | 2 + Documentation/kernel-parameters.txt | 7 + Documentation/sysctl/kernel.txt | 15 + Makefile | 18 +- arch/alpha/include/asm/cache.h | 4 +- arch/alpha/kernel/osf_sys.c | 12 +- arch/arc/Kconfig | 1 + arch/arm/Kconfig | 1 + arch/arm/Kconfig.debug | 1 + arch/arm/include/asm/thread_info.h | 7 +- arch/arm/kernel/process.c | 4 +- arch/arm/kernel/ptrace.c | 9 + arch/arm/kernel/traps.c | 7 +- arch/arm/mm/Kconfig | 2 +- arch/arm/mm/fault.c | 40 +- arch/arm/mm/mmap.c | 8 +- arch/arm/net/bpf_jit_32.c | 51 +- arch/arm64/Kconfig.debug | 1 + arch/avr32/include/asm/cache.h | 4 +- arch/blackfin/Kconfig.debug | 1 + arch/blackfin/include/asm/cache.h | 3 +- arch/cris/include/arch-v10/arch/cache.h | 3 +- arch/cris/include/arch-v32/arch/cache.h | 3 +- arch/frv/include/asm/cache.h | 3 +- arch/frv/mm/elf-fdpic.c | 4 +- arch/hexagon/include/asm/cache.h | 6 +- arch/ia64/Kconfig | 1 + arch/ia64/include/asm/cache.h | 3 +- arch/ia64/kernel/sys_ia64.c | 2 + arch/ia64/mm/hugetlbpage.c | 2 + arch/m32r/include/asm/cache.h | 4 +- arch/m68k/include/asm/cache.h | 4 +- arch/metag/mm/hugetlbpage.c | 1 + arch/microblaze/include/asm/cache.h | 3 +- arch/mips/Kconfig | 1 + arch/mips/include/asm/cache.h | 3 +- arch/mips/include/asm/thread_info.h | 11 +- arch/mips/kernel/irq.c | 3 + arch/mips/kernel/ptrace.c | 9 + arch/mips/mm/mmap.c | 4 +- arch/mn10300/proc-mn103e010/include/proc/cache.h | 4 +- arch/mn10300/proc-mn2ws0050/include/proc/cache.h | 4 +- arch/openrisc/include/asm/cache.h | 4 +- arch/parisc/include/asm/cache.h | 5 +- arch/parisc/kernel/sys_parisc.c | 4 + arch/powerpc/Kconfig | 1 + arch/powerpc/include/asm/cache.h | 4 +- arch/powerpc/include/asm/thread_info.h | 5 +- arch/powerpc/kernel/Makefile | 2 + arch/powerpc/kernel/irq.c | 3 + arch/powerpc/kernel/process.c | 10 +- arch/powerpc/kernel/ptrace.c | 14 + arch/powerpc/kernel/traps.c | 5 + arch/powerpc/mm/slice.c | 2 +- arch/s390/Kconfig.debug | 1 + arch/s390/include/asm/cache.h | 4 +- arch/score/include/asm/cache.h | 4 +- arch/sh/include/asm/cache.h | 3 +- arch/sh/mm/mmap.c | 6 +- arch/sparc/include/asm/cache.h | 4 +- arch/sparc/include/asm/pgalloc_64.h | 1 + arch/sparc/include/asm/thread_info_64.h | 8 +- arch/sparc/kernel/process_32.c | 6 +- arch/sparc/kernel/process_64.c | 8 +- arch/sparc/kernel/ptrace_64.c | 14 + arch/sparc/kernel/sys_sparc_64.c | 8 +- arch/sparc/kernel/syscalls.S | 8 +- arch/sparc/kernel/traps_32.c | 8 +- arch/sparc/kernel/traps_64.c | 28 +- arch/sparc/kernel/unaligned_64.c | 2 +- arch/sparc/mm/fault_64.c | 2 +- arch/sparc/mm/hugetlbpage.c | 15 +- arch/tile/Kconfig | 1 + arch/tile/include/asm/cache.h | 3 +- arch/tile/mm/hugetlbpage.c | 2 + arch/um/include/asm/cache.h | 3 +- arch/unicore32/include/asm/cache.h | 6 +- arch/x86/Kconfig | 21 + arch/x86/Kconfig.debug | 2 + arch/x86/entry/common.c | 14 + arch/x86/entry/entry_32.S | 2 +- arch/x86/entry/entry_64.S | 2 +- arch/x86/ia32/ia32_aout.c | 2 + arch/x86/include/asm/floppy.h | 20 +- arch/x86/include/asm/fpu/types.h | 69 +- arch/x86/include/asm/io.h | 2 +- arch/x86/include/asm/page.h | 12 +- arch/x86/include/asm/paravirt_types.h | 23 +- arch/x86/include/asm/processor.h | 12 +- arch/x86/include/asm/thread_info.h | 6 +- arch/x86/include/asm/uaccess.h | 2 +- arch/x86/kernel/dumpstack.c | 10 +- arch/x86/kernel/dumpstack_32.c | 2 +- arch/x86/kernel/dumpstack_64.c | 2 +- arch/x86/kernel/ioport.c | 13 + arch/x86/kernel/irq_32.c | 3 + arch/x86/kernel/irq_64.c | 4 + arch/x86/kernel/ldt.c | 18 + arch/x86/kernel/msr.c | 10 + arch/x86/kernel/ptrace.c | 14 + arch/x86/kernel/signal.c | 9 +- arch/x86/kernel/sys_i386_32.c | 9 +- arch/x86/kernel/sys_x86_64.c | 8 +- arch/x86/kernel/traps.c | 5 + arch/x86/kernel/verify_cpu.S | 1 + arch/x86/kernel/vm86_32.c | 15 + arch/x86/kvm/svm.c | 14 +- arch/x86/mm/fault.c | 12 +- arch/x86/mm/hugetlbpage.c | 15 +- arch/x86/mm/init.c | 66 +- arch/x86/mm/init_32.c | 6 +- arch/x86/net/bpf_jit_comp.c | 4 + arch/x86/platform/efi/efi_64.c | 2 +- arch/x86/xen/Kconfig | 1 + arch/xtensa/variants/dc232b/include/variant/core.h | 2 +- arch/xtensa/variants/fsf/include/variant/core.h | 3 +- crypto/ablkcipher.c | 2 +- crypto/blkcipher.c | 2 +- crypto/scatterwalk.c | 10 +- drivers/acpi/acpica/hwxfsleep.c | 11 +- drivers/acpi/custom_method.c | 4 + drivers/block/cciss.h | 30 +- drivers/block/smart1,2.h | 40 +- drivers/cdrom/cdrom.c | 2 +- drivers/char/Kconfig | 4 +- drivers/char/genrtc.c | 1 + drivers/char/ipmi/ipmi_si_intf.c | 8 +- drivers/char/mem.c | 17 + drivers/char/random.c | 5 +- drivers/cpufreq/sparc-us3-cpufreq.c | 2 - drivers/crypto/nx/nx-aes-ccm.c | 2 +- drivers/crypto/nx/nx-aes-gcm.c | 2 +- drivers/crypto/talitos.c | 2 +- drivers/firewire/ohci.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 70 +- drivers/gpu/drm/nouveau/nouveau_ttm.c | 28 +- drivers/gpu/drm/ttm/ttm_bo_manager.c | 10 +- drivers/gpu/drm/virtio/virtgpu_ttm.c | 10 +- drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 10 +- drivers/hid/hid-wiimote-debug.c | 2 +- drivers/infiniband/hw/nes/nes_cm.c | 22 +- drivers/iommu/Kconfig | 1 + drivers/iommu/amd_iommu.c | 14 +- drivers/isdn/gigaset/bas-gigaset.c | 32 +- drivers/isdn/gigaset/ser-gigaset.c | 32 +- drivers/isdn/gigaset/usb-gigaset.c | 32 +- drivers/isdn/hisax/config.c | 2 +- drivers/isdn/hisax/hfc_pci.c | 2 +- drivers/isdn/hisax/hfc_sx.c | 2 +- drivers/isdn/hisax/q931.c | 6 +- drivers/isdn/i4l/isdn_concap.c | 6 +- drivers/isdn/i4l/isdn_x25iface.c | 16 +- drivers/md/bcache/Kconfig | 1 + drivers/md/raid5.c | 8 + drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +- drivers/media/platform/sti/c8sectpfe/Kconfig | 1 + drivers/media/platform/vivid/vivid-osd.c | 1 + drivers/media/radio/radio-cadet.c | 5 +- drivers/media/usb/dvb-usb/cinergyT2-core.c | 91 +- drivers/media/usb/dvb-usb/cinergyT2-fe.c | 182 +- drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 37 +- drivers/media/usb/dvb-usb/technisat-usb2.c | 75 +- drivers/message/fusion/mptbase.c | 9 + drivers/misc/sgi-xp/xp_main.c | 12 +- drivers/net/ethernet/brocade/bna/bna_enet.c | 8 +- drivers/net/ppp/pppoe.c | 14 +- drivers/net/ppp/pptp.c | 6 + drivers/net/slip/slhc.c | 3 + drivers/net/wan/lmc/lmc_media.c | 97 +- drivers/net/wan/x25_asy.c | 6 +- drivers/net/wan/z85230.c | 24 +- drivers/net/wireless/ath/ath9k/Kconfig | 1 - drivers/net/wireless/zd1211rw/zd_usb.c | 2 +- drivers/pci/pci-sysfs.c | 2 +- drivers/pci/proc.c | 9 + drivers/platform/x86/asus-wmi.c | 12 + drivers/rtc/rtc-dev.c | 3 + drivers/scsi/bfa/bfa_fcs.c | 19 +- drivers/scsi/bfa/bfa_fcs_lport.c | 29 +- drivers/scsi/bfa/bfa_modules.h | 12 +- drivers/scsi/hpsa.h | 40 +- drivers/staging/dgnc/dgnc_mgmt.c | 1 + drivers/staging/lustre/lustre/ldlm/ldlm_flock.c | 2 +- drivers/staging/lustre/lustre/libcfs/module.c | 10 +- drivers/target/target_core_sbc.c | 17 +- drivers/target/target_core_transport.c | 14 +- drivers/tty/serial/uartlite.c | 4 +- drivers/tty/sysrq.c | 2 +- drivers/tty/vt/keyboard.c | 22 +- drivers/uio/uio.c | 6 +- drivers/usb/core/hub.c | 5 + drivers/usb/gadget/function/f_uac1.c | 1 + drivers/usb/gadget/function/u_uac1.c | 1 + drivers/usb/host/hwa-hc.c | 9 +- drivers/usb/usbip/vhci_sysfs.c | 2 +- drivers/video/fbdev/arcfb.c | 2 +- drivers/video/fbdev/matrox/matroxfb_DAC1064.c | 10 +- drivers/video/fbdev/matrox/matroxfb_Ti3026.c | 5 +- drivers/video/fbdev/sh_mobile_lcdcfb.c | 6 +- drivers/video/logo/logo_linux_clut224.ppm | 2720 ++++----- drivers/xen/xenfs/xenstored.c | 5 + firmware/Makefile | 2 + firmware/WHENCE | 20 +- firmware/bnx2/bnx2-mips-06-6.2.3.fw.ihex | 5804 +++++++++++++++++ firmware/bnx2/bnx2-mips-09-6.2.1b.fw.ihex | 6496 ++++++++++++++++++++ fs/9p/vfs_inode.c | 4 +- fs/attr.c | 1 + fs/autofs4/waitq.c | 9 + fs/binfmt_aout.c | 7 + fs/binfmt_elf.c | 50 +- fs/compat.c | 20 +- fs/coredump.c | 17 +- fs/dcache.c | 3 + fs/debugfs/inode.c | 11 +- fs/exec.c | 219 +- fs/ext2/balloc.c | 4 +- fs/ext2/super.c | 8 +- fs/ext4/balloc.c | 4 +- fs/fcntl.c | 4 + fs/fhandle.c | 3 +- fs/file.c | 4 + fs/filesystems.c | 4 + fs/fs_struct.c | 20 +- fs/hugetlbfs/inode.c | 5 +- fs/inode.c | 8 +- fs/kernfs/dir.c | 6 + fs/mount.h | 4 +- fs/namei.c | 286 +- fs/namespace.c | 24 + fs/nfsd/nfscache.c | 2 +- fs/open.c | 38 + fs/overlayfs/inode.c | 11 +- fs/overlayfs/super.c | 6 +- fs/pipe.c | 2 +- fs/posix_acl.c | 15 +- fs/proc/Kconfig | 10 +- fs/proc/array.c | 69 +- fs/proc/base.c | 186 +- fs/proc/cmdline.c | 4 + fs/proc/devices.c | 4 + fs/proc/fd.c | 17 +- fs/proc/generic.c | 64 + fs/proc/inode.c | 17 + fs/proc/internal.h | 11 +- fs/proc/interrupts.c | 4 + fs/proc/kcore.c | 3 + fs/proc/meminfo.c | 7 +- fs/proc/namespaces.c | 4 +- fs/proc/proc_net.c | 31 + fs/proc/proc_sysctl.c | 52 +- fs/proc/root.c | 8 + fs/proc/stat.c | 69 +- fs/proc/task_mmu.c | 66 +- fs/readdir.c | 19 + fs/reiserfs/item_ops.c | 24 +- fs/reiserfs/super.c | 4 + fs/select.c | 2 + fs/seq_file.c | 30 +- fs/splice.c | 8 + fs/stat.c | 20 +- fs/sysfs/dir.c | 30 +- fs/sysv/inode.c | 11 +- fs/utimes.c | 7 + fs/xattr.c | 26 +- grsecurity/Kconfig | 1182 ++++ grsecurity/Makefile | 54 + grsecurity/gracl.c | 2757 +++++++++ grsecurity/gracl_alloc.c | 105 + grsecurity/gracl_cap.c | 127 + grsecurity/gracl_compat.c | 269 + grsecurity/gracl_fs.c | 448 ++ grsecurity/gracl_ip.c | 386 ++ grsecurity/gracl_learn.c | 207 + grsecurity/gracl_policy.c | 1786 ++++++ grsecurity/gracl_res.c | 68 + grsecurity/gracl_segv.c | 304 + grsecurity/gracl_shm.c | 40 + grsecurity/grsec_chdir.c | 19 + grsecurity/grsec_chroot.c | 467 ++ grsecurity/grsec_disabled.c | 445 ++ grsecurity/grsec_exec.c | 189 + grsecurity/grsec_fifo.c | 26 + grsecurity/grsec_fork.c | 23 + grsecurity/grsec_init.c | 290 + grsecurity/grsec_ipc.c | 48 + grsecurity/grsec_link.c | 65 + grsecurity/grsec_log.c | 340 + grsecurity/grsec_mem.c | 48 + grsecurity/grsec_mount.c | 65 + grsecurity/grsec_pax.c | 47 + grsecurity/grsec_proc.c | 20 + grsecurity/grsec_ptrace.c | 30 + grsecurity/grsec_sig.c | 236 + grsecurity/grsec_sock.c | 244 + grsecurity/grsec_sysctl.c | 488 ++ grsecurity/grsec_time.c | 16 + grsecurity/grsec_tpe.c | 78 + grsecurity/grsec_usb.c | 15 + grsecurity/grsum.c | 64 + include/linux/binfmts.h | 5 +- include/linux/bitops.h | 2 +- include/linux/capability.h | 13 + include/linux/compiler-gcc.h | 5 + include/linux/compiler.h | 8 + include/linux/cred.h | 8 +- include/linux/dcache.h | 5 +- include/linux/fs.h | 24 +- include/linux/fs_struct.h | 2 +- include/linux/fsnotify.h | 6 + include/linux/gracl.h | 342 + include/linux/gracl_compat.h | 156 + include/linux/gralloc.h | 9 + include/linux/grdefs.h | 140 + include/linux/grinternal.h | 230 + include/linux/grmsg.h | 118 + include/linux/grsecurity.h | 255 + include/linux/grsock.h | 19 + include/linux/ipc.h | 2 +- include/linux/ipc_namespace.h | 2 +- include/linux/kallsyms.h | 18 +- include/linux/kmod.h | 5 + include/linux/kobject.h | 2 +- include/linux/lsm_hooks.h | 4 +- include/linux/mm.h | 12 + include/linux/mm_types.h | 4 +- include/linux/module.h | 5 +- include/linux/mount.h | 2 +- include/linux/msg.h | 2 +- include/linux/netfilter/xt_gradm.h | 9 + include/linux/path.h | 4 +- include/linux/perf_event.h | 13 +- include/linux/pid_namespace.h | 2 +- include/linux/printk.h | 2 +- include/linux/proc_fs.h | 22 +- include/linux/proc_ns.h | 2 +- include/linux/ptrace.h | 24 +- include/linux/random.h | 2 +- include/linux/rbtree_augmented.h | 4 +- include/linux/scatterlist.h | 12 +- include/linux/sched.h | 114 +- include/linux/security.h | 1 + include/linux/sem.h | 2 +- include/linux/seq_file.h | 5 + include/linux/shm.h | 6 +- include/linux/skbuff.h | 3 + include/linux/slab.h | 9 - include/linux/sysctl.h | 8 +- include/linux/thread_info.h | 6 +- include/linux/tty.h | 2 +- include/linux/tty_driver.h | 4 +- include/linux/uidgid.h | 5 + include/linux/user_namespace.h | 2 +- include/linux/utsname.h | 2 +- include/linux/vermagic.h | 16 +- include/linux/vmalloc.h | 20 +- include/net/af_unix.h | 2 +- include/net/dst.h | 33 + include/net/ip.h | 2 +- include/net/neighbour.h | 2 +- include/net/net_namespace.h | 2 +- include/net/sock.h | 4 +- include/target/target_core_base.h | 2 +- include/trace/events/fs.h | 53 + include/uapi/linux/personality.h | 1 + init/Kconfig | 4 +- init/main.c | 35 +- ipc/mqueue.c | 1 + ipc/msg.c | 3 +- ipc/sem.c | 3 +- ipc/shm.c | 26 +- ipc/util.c | 6 + kernel/auditsc.c | 2 +- kernel/bpf/syscall.c | 8 +- kernel/capability.c | 41 +- kernel/cgroup.c | 5 +- kernel/compat.c | 1 + kernel/configs.c | 11 + kernel/cred.c | 112 +- kernel/events/core.c | 16 +- kernel/exit.c | 10 +- kernel/fork.c | 86 +- kernel/futex.c | 6 +- kernel/futex_compat.c | 2 +- kernel/kallsyms.c | 9 + kernel/kcmp.c | 8 +- kernel/kexec_core.c | 2 +- kernel/kmod.c | 95 +- kernel/kprobes.c | 7 +- kernel/ksysfs.c | 2 + kernel/locking/lockdep_proc.c | 10 +- kernel/module.c | 108 +- kernel/panic.c | 4 +- kernel/pid.c | 23 +- kernel/power/Kconfig | 2 + kernel/printk/printk.c | 20 +- kernel/ptrace.c | 56 +- kernel/resource.c | 10 + kernel/sched/core.c | 11 +- kernel/signal.c | 37 +- kernel/sys.c | 64 +- kernel/sysctl.c | 172 +- kernel/taskstats.c | 6 + kernel/time/posix-timers.c | 8 + kernel/time/time.c | 5 + kernel/time/timekeeping.c | 3 + kernel/time/timer_list.c | 13 +- kernel/time/timer_stats.c | 10 +- kernel/trace/Kconfig | 2 + kernel/trace/trace_syscalls.c | 8 + kernel/user_namespace.c | 15 + lib/Kconfig.debug | 13 +- lib/Kconfig.kasan | 2 +- lib/is_single_threaded.c | 3 + lib/list_debug.c | 65 +- lib/nlattr.c | 2 + lib/rbtree.c | 4 +- lib/vsprintf.c | 39 +- localversion-grsec | 1 + mm/Kconfig | 8 +- mm/Kconfig.debug | 1 + mm/filemap.c | 1 + mm/kmemleak.c | 4 +- mm/memory.c | 2 +- mm/mempolicy.c | 12 +- mm/migrate.c | 3 +- mm/mlock.c | 6 +- mm/mmap.c | 93 +- mm/mprotect.c | 8 + mm/oom_kill.c | 28 +- mm/page_alloc.c | 2 +- mm/process_vm_access.c | 8 +- mm/shmem.c | 36 +- mm/slab.c | 14 +- mm/slab_common.c | 2 +- mm/slob.c | 12 + mm/slub.c | 33 +- mm/util.c | 3 + mm/vmalloc.c | 129 +- mm/vmstat.c | 29 +- net/appletalk/atalk_proc.c | 2 +- net/atm/lec.c | 6 +- net/atm/mpoa_caches.c | 42 +- net/bluetooth/sco.c | 3 + net/can/bcm.c | 2 +- net/can/proc.c | 2 +- net/core/dev_ioctl.c | 7 +- net/core/filter.c | 8 +- net/core/net-procfs.c | 17 +- net/core/pktgen.c | 2 +- net/core/sock.c | 3 +- net/core/sysctl_net_core.c | 2 +- net/decnet/dn_dev.c | 2 +- net/ipv4/devinet.c | 6 +- net/ipv4/inet_hashtables.c | 4 + net/ipv4/ip_input.c | 7 + net/ipv4/ip_sockglue.c | 3 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- net/ipv4/netfilter/nf_nat_pptp.c | 2 +- net/ipv4/route.c | 6 +- net/ipv4/tcp_input.c | 4 +- net/ipv4/tcp_ipv4.c | 29 +- net/ipv4/tcp_minisocks.c | 9 +- net/ipv4/tcp_timer.c | 11 + net/ipv4/udp.c | 24 + net/ipv6/addrconf.c | 13 +- net/ipv6/proc.c | 2 +- net/ipv6/tcp_ipv6.c | 26 +- net/ipv6/udp.c | 7 + net/ipx/ipx_proc.c | 2 +- net/irda/irproc.c | 2 +- net/llc/llc_proc.c | 2 +- net/netfilter/Kconfig | 10 + net/netfilter/Makefile | 1 + net/netfilter/nf_conntrack_core.c | 8 + net/netfilter/xt_gradm.c | 51 + net/netfilter/xt_hashlimit.c | 4 +- net/netfilter/xt_recent.c | 2 +- net/sched/sch_api.c | 2 +- net/sctp/socket.c | 4 +- net/socket.c | 75 +- net/sunrpc/Kconfig | 1 + net/sunrpc/cache.c | 2 +- net/sunrpc/stats.c | 2 +- net/sysctl_net.c | 2 +- net/unix/af_unix.c | 52 +- net/vmw_vsock/vmci_transport_notify.c | 30 +- net/vmw_vsock/vmci_transport_notify_qstate.c | 30 +- net/x25/sysctl_net_x25.c | 2 +- net/x25/x25_proc.c | 2 +- scripts/package/Makefile | 2 +- scripts/package/mkspec | 41 +- security/Kconfig | 369 +- security/apparmor/file.c | 4 +- security/apparmor/lsm.c | 8 +- security/commoncap.c | 36 +- security/min_addr.c | 2 + security/smack/smack_lsm.c | 8 +- security/tomoyo/file.c | 12 +- security/tomoyo/mount.c | 4 + security/tomoyo/tomoyo.c | 20 +- security/yama/Kconfig | 2 +- security/yama/yama_lsm.c | 4 +- sound/synth/emux/emux_seq.c | 14 +- sound/usb/line6/driver.c | 40 +- sound/usb/line6/toneport.c | 12 +- tools/gcc/.gitignore | 1 + tools/gcc/Makefile | 12 + tools/gcc/gen-random-seed.sh | 8 + tools/gcc/randomize_layout_plugin.c | 930 +++ tools/gcc/size_overflow_plugin/.gitignore | 1 + .../size_overflow_plugin/size_overflow_hash.data | 459 ++- 511 files changed, 32631 insertions(+), 3196 deletions(-) commit a76adb92ce39aee8eec5a025c828030ad6135c6d Author: Brad Spengler Date: Tue Dec 15 14:31:49 2015 -0500 Update to pax-linux-4.3.3-test11.patch: - fixed a few compile regressions with the recent plugin changes, reported by spender - updated the size overflow hash table tools/gcc/latent_entropy_plugin.c | 2 +- .../size_overflow_plugin/size_overflow_hash.data | 66 +++++++++++++++++--- tools/gcc/stackleak_plugin.c | 2 +- tools/gcc/structleak_plugin.c | 6 +-- 4 files changed, 60 insertions(+), 16 deletions(-) commit f7284b1fc06628fcb2d35d2beecdea5454d46af9 Author: Brad Spengler Date: Tue Dec 15 11:50:24 2015 -0500 Apply structleak ICE fix for gcc < 4.9 tools/gcc/structleak_plugin.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) commit 92fe3eb9fd10ec7f7334decab1526989669b0287 Author: Brad Spengler Date: Tue Dec 15 07:57:06 2015 -0500 Update to pax-linux-4.3.1-test10.patch: - Emese fixed INDIRECT_REF and TARGET_MEM_REF handling in the initify plugin - Emese regenerated the size overflow hash tables for 4.3 - fixed some compat syscall exit paths to restore r12 under KERNEXEC/or - the latent entropy, stackleak and structleak plugins no longer split the entry block unnecessarily arch/x86/entry/entry_64.S | 2 +- arch/x86/entry/entry_64_compat.S | 15 +- scripts/package/builddeb | 2 +- tools/gcc/initify_plugin.c | 11 +- tools/gcc/latent_entropy_plugin.c | 20 +- .../disable_size_overflow_hash.data | 4 + .../size_overflow_plugin/size_overflow_hash.data | 5345 +++++++++++--------- tools/gcc/stackleak_plugin.c | 26 +- tools/gcc/structleak_plugin.c | 21 +- 9 files changed, 3079 insertions(+), 2367 deletions(-) commit 5bd245cb687319079c2f1c0d6a1170791ed1ed2c Merge: b5847e6 3548341 Author: Brad Spengler Date: Tue Dec 15 07:47:56 2015 -0500 Merge branch 'linux-4.3.y' into pax-4_3 Conflicts: net/unix/af_unix.c commit b5847e6a896c5d99191135ca4d7c3b6be8f116ff Author: Brad Spengler Date: Wed Dec 9 23:11:36 2015 -0500 Update to pax-linux-4.3.1-test9.patch: - fixed __get_user on x86 to lie less about the size of the load, reported by peetaur (https://forums.grsecurity.net/viewtopic.php?f=3&t=4332) - Emese fixed an intentional overflow caused by gcc, reported by saironiq (https://forums.grsecurity.net/viewtopic.php?f=3&t=4333) - Emese fixed a false positive overflow report in the forcedeth driver, reported by fx3 (https://forums.grsecurity.net/viewtopic.php?t=4334) - Emese fixed a false positive overflow report in KVM's emulator, reported by fx3 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4336) - Emese fixed the initify plugin to detect some captured use of __func__, reported by Rasmus Villemoes - constrained shmmax and shmall to avoid triggering size overflow checks, reported by Mathias Krause - the checker plugin can partially handle sparse's locking context annotations, it's context insensitive and thus not exactly useful for now, also see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=59856 Makefile | 6 + arch/x86/include/asm/compat.h | 4 + arch/x86/include/asm/dma.h | 2 + arch/x86/include/asm/pmem.h | 2 +- arch/x86/include/asm/uaccess.h | 20 +- arch/x86/kernel/apic/vector.c | 6 +- arch/x86/kernel/cpu/mtrr/generic.c | 6 +- arch/x86/kernel/cpu/perf_event_intel.c | 28 +- arch/x86/kernel/head_64.S | 1 - arch/x86/kvm/i8259.c | 10 +- arch/x86/kvm/ioapic.c | 2 + arch/x86/kvm/x86.c | 2 + arch/x86/lib/usercopy_64.c | 2 +- arch/x86/mm/mpx.c | 4 +- arch/x86/mm/pageattr.c | 7 + drivers/base/devres.c | 4 +- drivers/base/power/runtime.c | 6 +- drivers/base/regmap/regmap.c | 4 +- drivers/block/drbd/drbd_receiver.c | 4 +- drivers/block/drbd/drbd_worker.c | 6 +- drivers/char/virtio_console.c | 6 +- drivers/md/dm.c | 12 +- drivers/net/ethernet/nvidia/forcedeth.c | 4 +- drivers/net/macvtap.c | 4 +- drivers/video/fbdev/core/fbmem.c | 10 +- fs/compat.c | 3 +- fs/coredump.c | 2 +- fs/dcache.c | 13 +- fs/fhandle.c | 2 +- fs/file.c | 14 +- fs/fs-writeback.c | 11 +- fs/overlayfs/copy_up.c | 2 +- fs/readdir.c | 3 +- fs/super.c | 3 +- include/linux/compiler.h | 36 ++- include/linux/rcupdate.h | 8 + include/linux/sched.h | 4 +- include/linux/seqlock.h | 10 + include/linux/spinlock.h | 17 +- include/linux/srcu.h | 5 +- include/linux/syscalls.h | 2 +- include/linux/writeback.h | 3 +- include/uapi/linux/swab.h | 6 +- ipc/ipc_sysctl.c | 6 + kernel/exit.c | 25 +- kernel/resource.c | 4 +- kernel/signal.c | 12 +- kernel/user.c | 2 +- kernel/workqueue.c | 6 +- lib/rhashtable.c | 4 +- net/compat.c | 2 +- net/ipv4/xfrm4_mode_transport.c | 2 +- security/keys/internal.h | 8 +- security/keys/keyring.c | 4 - sound/core/seq/seq_clientmgr.c | 8 +- sound/core/seq/seq_compat.c | 2 +- sound/core/seq/seq_memory.c | 6 +- tools/gcc/checker_plugin.c | 415 +++++++++++++++++++- tools/gcc/gcc-common.h | 1 + tools/gcc/initify_plugin.c | 33 ++- .../disable_size_overflow_hash.data | 1 + .../size_overflow_plugin/size_overflow_hash.data | 1 - 62 files changed, 708 insertions(+), 140 deletions(-) commit f2634c2f6995f4231616f24ed016f890c701f939 Merge: 1241bff 5f8b236 Author: Brad Spengler Date: Wed Dec 9 21:50:47 2015 -0500 Merge branch 'linux-4.3.y' into pax-4_3 Conflicts: arch/x86/kernel/fpu/xstate.c arch/x86/kernel/head_64.S commit 1241bff82e3d7dadb05de0a60b8d2822afc6547c Author: Brad Spengler Date: Sun Dec 6 08:44:56 2015 -0500 Update to pax-linux-4.3-test8.patch: - fixed integer truncation check in md introduced by upstream commits 284ae7cab0f7335c9e0aa8992b28415ef1a54c7c and 58c0fed400603a802968b23ddf78f029c5a84e41, reported by BeiKed9o (https://forums.grsecurity.net/viewtopic.php?f=3&t=4328) - gcc plugin compilation problems will now also produce the output of the checking script to make diagnosis easier, reported by hunger - Emese fixed a false positive size overflow report in __vhost_add_used_n, reported by quasar366 (https://forums.grsecurity.net/viewtopic.php?f=3&t=4329) - fixed a potential integer truncation error in the raid1 code caught by the size overflow plugin, reported by d1b (https://forums.grsecurity.net/viewtopic.php?f=3&t=4331) Makefile | 5 +++ drivers/md/md.c | 5 ++- drivers/md/raid1.c | 2 +- fs/proc/task_mmu.c | 3 ++ .../disable_size_overflow_hash.data | 4 ++- .../size_overflow_plugin/intentional_overflow.c | 32 ++++++++++++++++--- .../size_overflow_plugin/size_overflow_hash.data | 2 - .../size_overflow_plugin/size_overflow_plugin.c | 2 +- 8 files changed, 43 insertions(+), 12 deletions(-) commit cce6a9f9bdd27096632ca1c0246dcc07f2eb1a18 Author: Brad Spengler Date: Fri Dec 4 14:24:12 2015 -0500 Initial import of pax-linux-4.3-test7.patch Documentation/dontdiff | 47 +- Documentation/kbuild/makefiles.txt | 39 +- Documentation/kernel-parameters.txt | 28 + Makefile | 108 +- arch/alpha/include/asm/atomic.h | 10 + arch/alpha/include/asm/elf.h | 7 + arch/alpha/include/asm/pgalloc.h | 6 + arch/alpha/include/asm/pgtable.h | 11 + arch/alpha/kernel/module.c | 2 +- arch/alpha/kernel/osf_sys.c | 8 +- arch/alpha/mm/fault.c | 141 +- arch/arm/Kconfig | 2 +- arch/arm/include/asm/atomic.h | 320 +- arch/arm/include/asm/cache.h | 5 +- arch/arm/include/asm/cacheflush.h | 2 +- arch/arm/include/asm/checksum.h | 14 +- arch/arm/include/asm/cmpxchg.h | 4 + arch/arm/include/asm/cpuidle.h | 2 +- arch/arm/include/asm/domain.h | 22 +- arch/arm/include/asm/elf.h | 9 +- arch/arm/include/asm/fncpy.h | 2 + arch/arm/include/asm/futex.h | 10 + arch/arm/include/asm/kmap_types.h | 2 +- arch/arm/include/asm/mach/dma.h | 2 +- arch/arm/include/asm/mach/map.h | 16 +- arch/arm/include/asm/outercache.h | 2 +- arch/arm/include/asm/page.h | 3 +- arch/arm/include/asm/pgalloc.h | 20 + arch/arm/include/asm/pgtable-2level-hwdef.h | 4 +- arch/arm/include/asm/pgtable-2level.h | 3 + arch/arm/include/asm/pgtable-3level.h | 3 + arch/arm/include/asm/pgtable.h | 54 +- arch/arm/include/asm/smp.h | 2 +- arch/arm/include/asm/tls.h | 3 + arch/arm/include/asm/uaccess.h | 79 +- arch/arm/include/uapi/asm/ptrace.h | 2 +- arch/arm/kernel/armksyms.c | 2 +- arch/arm/kernel/cpuidle.c | 2 +- arch/arm/kernel/entry-armv.S | 109 +- arch/arm/kernel/entry-common.S | 40 +- arch/arm/kernel/entry-header.S | 55 + arch/arm/kernel/fiq.c | 3 + arch/arm/kernel/module-plts.c | 7 +- arch/arm/kernel/module.c | 38 +- arch/arm/kernel/patch.c | 2 + arch/arm/kernel/process.c | 90 +- arch/arm/kernel/reboot.c | 1 + arch/arm/kernel/setup.c | 20 +- arch/arm/kernel/signal.c | 35 +- arch/arm/kernel/smp.c | 2 +- arch/arm/kernel/tcm.c | 4 +- arch/arm/kernel/vmlinux.lds.S | 6 +- arch/arm/kvm/arm.c | 8 +- arch/arm/lib/copy_page.S | 1 + arch/arm/lib/csumpartialcopyuser.S | 4 +- arch/arm/lib/delay.c | 2 +- arch/arm/lib/uaccess_with_memcpy.c | 4 +- arch/arm/mach-exynos/suspend.c | 6 +- arch/arm/mach-mvebu/coherency.c | 4 +- arch/arm/mach-omap2/board-n8x0.c | 2 +- arch/arm/mach-omap2/omap-mpuss-lowpower.c | 4 +- arch/arm/mach-omap2/omap-smp.c | 1 + arch/arm/mach-omap2/omap-wakeupgen.c | 2 +- arch/arm/mach-omap2/omap_device.c | 4 +- arch/arm/mach-omap2/omap_device.h | 4 +- arch/arm/mach-omap2/omap_hwmod.c | 4 +- arch/arm/mach-omap2/powerdomains43xx_data.c | 5 +- arch/arm/mach-omap2/wd_timer.c | 6 +- arch/arm/mach-shmobile/platsmp-apmu.c | 5 +- arch/arm/mach-tegra/cpuidle-tegra20.c | 2 +- arch/arm/mach-tegra/irq.c | 1 + arch/arm/mach-ux500/pm.c | 1 + arch/arm/mach-zynq/platsmp.c | 1 + arch/arm/mm/Kconfig | 6 +- arch/arm/mm/alignment.c | 8 + arch/arm/mm/cache-l2x0.c | 2 +- arch/arm/mm/context.c | 10 +- arch/arm/mm/fault.c | 146 + arch/arm/mm/fault.h | 12 + arch/arm/mm/init.c | 39 + arch/arm/mm/ioremap.c | 4 +- arch/arm/mm/mmap.c | 30 +- arch/arm/mm/mmu.c | 162 +- arch/arm/net/bpf_jit_32.c | 3 + arch/arm/plat-iop/setup.c | 2 +- arch/arm/plat-omap/sram.c | 2 + arch/arm64/include/asm/atomic.h | 10 + arch/arm64/include/asm/percpu.h | 8 +- arch/arm64/include/asm/pgalloc.h | 5 + arch/arm64/include/asm/uaccess.h | 1 + arch/arm64/mm/dma-mapping.c | 2 +- arch/avr32/include/asm/elf.h | 8 +- arch/avr32/include/asm/kmap_types.h | 4 +- arch/avr32/mm/fault.c | 27 + arch/frv/include/asm/atomic.h | 10 + arch/frv/include/asm/kmap_types.h | 2 +- arch/frv/mm/elf-fdpic.c | 3 +- arch/ia64/Makefile | 1 + arch/ia64/include/asm/atomic.h | 10 + arch/ia64/include/asm/elf.h | 7 + arch/ia64/include/asm/pgalloc.h | 12 + arch/ia64/include/asm/pgtable.h | 13 +- arch/ia64/include/asm/spinlock.h | 2 +- arch/ia64/include/asm/uaccess.h | 27 +- arch/ia64/kernel/module.c | 45 +- arch/ia64/kernel/palinfo.c | 2 +- arch/ia64/kernel/sys_ia64.c | 7 + arch/ia64/kernel/vmlinux.lds.S | 2 +- arch/ia64/mm/fault.c | 32 +- arch/ia64/mm/init.c | 15 +- arch/m32r/lib/usercopy.c | 6 + arch/mips/cavium-octeon/dma-octeon.c | 2 +- arch/mips/include/asm/atomic.h | 368 +- arch/mips/include/asm/elf.h | 7 + arch/mips/include/asm/exec.h | 2 +- arch/mips/include/asm/hw_irq.h | 2 +- arch/mips/include/asm/local.h | 57 + arch/mips/include/asm/page.h | 2 +- arch/mips/include/asm/pgalloc.h | 5 + arch/mips/include/asm/pgtable.h | 3 + arch/mips/include/asm/uaccess.h | 1 + arch/mips/kernel/binfmt_elfn32.c | 7 + arch/mips/kernel/binfmt_elfo32.c | 7 + arch/mips/kernel/irq-gt641xx.c | 2 +- arch/mips/kernel/irq.c | 6 +- arch/mips/kernel/pm-cps.c | 2 +- arch/mips/kernel/process.c | 12 - arch/mips/kernel/sync-r4k.c | 24 +- arch/mips/kernel/traps.c | 13 +- arch/mips/mm/fault.c | 25 + arch/mips/mm/mmap.c | 51 +- arch/mips/sgi-ip27/ip27-nmi.c | 6 +- arch/mips/sni/rm200.c | 2 +- arch/mips/vr41xx/common/icu.c | 2 +- arch/mips/vr41xx/common/irq.c | 4 +- arch/parisc/include/asm/atomic.h | 10 + arch/parisc/include/asm/elf.h | 7 + arch/parisc/include/asm/pgalloc.h | 6 + arch/parisc/include/asm/pgtable.h | 11 + arch/parisc/include/asm/uaccess.h | 4 +- arch/parisc/kernel/module.c | 50 +- arch/parisc/kernel/sys_parisc.c | 15 + arch/parisc/kernel/traps.c | 4 +- arch/parisc/mm/fault.c | 140 +- arch/powerpc/include/asm/atomic.h | 329 +- arch/powerpc/include/asm/elf.h | 12 + arch/powerpc/include/asm/exec.h | 2 +- arch/powerpc/include/asm/kmap_types.h | 2 +- arch/powerpc/include/asm/local.h | 46 + arch/powerpc/include/asm/mman.h | 2 +- arch/powerpc/include/asm/page.h | 8 +- arch/powerpc/include/asm/page_64.h | 7 +- arch/powerpc/include/asm/pgalloc-64.h | 7 + arch/powerpc/include/asm/pgtable.h | 1 + arch/powerpc/include/asm/pte-hash32.h | 1 + arch/powerpc/include/asm/reg.h | 1 + arch/powerpc/include/asm/smp.h | 2 +- arch/powerpc/include/asm/spinlock.h | 42 +- arch/powerpc/include/asm/uaccess.h | 141 +- arch/powerpc/kernel/Makefile | 5 + arch/powerpc/kernel/exceptions-64e.S | 4 +- arch/powerpc/kernel/exceptions-64s.S | 2 +- arch/powerpc/kernel/module_32.c | 15 +- arch/powerpc/kernel/process.c | 46 - arch/powerpc/kernel/signal_32.c | 2 +- arch/powerpc/kernel/signal_64.c | 2 +- arch/powerpc/kernel/traps.c | 21 + arch/powerpc/kernel/vdso.c | 5 +- arch/powerpc/lib/usercopy_64.c | 18 - arch/powerpc/mm/fault.c | 56 +- arch/powerpc/mm/mmap.c | 16 + arch/powerpc/mm/slice.c | 13 +- arch/powerpc/platforms/cell/spufs/file.c | 4 +- arch/s390/include/asm/atomic.h | 10 + arch/s390/include/asm/elf.h | 7 + arch/s390/include/asm/exec.h | 2 +- arch/s390/include/asm/uaccess.h | 13 +- arch/s390/kernel/module.c | 22 +- arch/s390/kernel/process.c | 24 - arch/s390/mm/mmap.c | 16 + arch/score/include/asm/exec.h | 2 +- arch/score/kernel/process.c | 5 - arch/sh/mm/mmap.c | 22 +- arch/sparc/include/asm/atomic_64.h | 110 +- arch/sparc/include/asm/cache.h | 2 +- arch/sparc/include/asm/elf_32.h | 7 + arch/sparc/include/asm/elf_64.h | 7 + arch/sparc/include/asm/pgalloc_32.h | 1 + arch/sparc/include/asm/pgalloc_64.h | 1 + arch/sparc/include/asm/pgtable.h | 4 + arch/sparc/include/asm/pgtable_32.h | 15 +- arch/sparc/include/asm/pgtsrmmu.h | 5 + arch/sparc/include/asm/setup.h | 4 +- arch/sparc/include/asm/spinlock_64.h | 35 +- arch/sparc/include/asm/thread_info_32.h | 1 + arch/sparc/include/asm/thread_info_64.h | 2 + arch/sparc/include/asm/uaccess.h | 1 + arch/sparc/include/asm/uaccess_32.h | 28 +- arch/sparc/include/asm/uaccess_64.h | 24 +- arch/sparc/kernel/Makefile | 2 +- arch/sparc/kernel/prom_common.c | 2 +- arch/sparc/kernel/smp_64.c | 8 +- arch/sparc/kernel/sys_sparc_32.c | 2 +- arch/sparc/kernel/sys_sparc_64.c | 52 +- arch/sparc/kernel/traps_64.c | 27 +- arch/sparc/lib/Makefile | 2 +- arch/sparc/lib/atomic_64.S | 57 +- arch/sparc/lib/ksyms.c | 6 +- arch/sparc/mm/Makefile | 2 +- arch/sparc/mm/fault_32.c | 292 + arch/sparc/mm/fault_64.c | 486 + arch/sparc/mm/hugetlbpage.c | 22 +- arch/sparc/mm/init_64.c | 10 +- arch/tile/include/asm/atomic_64.h | 10 + arch/tile/include/asm/uaccess.h | 4 +- arch/um/Makefile | 4 + arch/um/include/asm/kmap_types.h | 2 +- arch/um/include/asm/page.h | 3 + arch/um/include/asm/pgtable-3level.h | 1 + arch/um/kernel/process.c | 16 - arch/x86/Kconfig | 15 +- arch/x86/Kconfig.cpu | 6 +- arch/x86/Kconfig.debug | 4 +- arch/x86/Makefile | 13 +- arch/x86/boot/Makefile | 3 + arch/x86/boot/bitops.h | 4 +- arch/x86/boot/boot.h | 2 +- arch/x86/boot/compressed/Makefile | 3 + arch/x86/boot/compressed/efi_stub_32.S | 16 +- arch/x86/boot/compressed/efi_thunk_64.S | 4 +- arch/x86/boot/compressed/head_32.S | 4 +- arch/x86/boot/compressed/head_64.S | 12 +- arch/x86/boot/compressed/misc.c | 11 +- arch/x86/boot/cpucheck.c | 16 +- arch/x86/boot/header.S | 6 +- arch/x86/boot/memory.c | 2 +- arch/x86/boot/video-vesa.c | 1 + arch/x86/boot/video.c | 2 +- arch/x86/crypto/aes-x86_64-asm_64.S | 4 + arch/x86/crypto/aesni-intel_asm.S | 106 +- arch/x86/crypto/blowfish-x86_64-asm_64.S | 7 + arch/x86/crypto/camellia-aesni-avx-asm_64.S | 10 + arch/x86/crypto/camellia-aesni-avx2-asm_64.S | 10 + arch/x86/crypto/camellia-x86_64-asm_64.S | 7 + arch/x86/crypto/cast5-avx-x86_64-asm_64.S | 51 +- arch/x86/crypto/cast6-avx-x86_64-asm_64.S | 25 +- arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 4 +- arch/x86/crypto/ghash-clmulni-intel_asm.S | 4 + arch/x86/crypto/salsa20-x86_64-asm_64.S | 4 + arch/x86/crypto/serpent-avx-x86_64-asm_64.S | 9 + arch/x86/crypto/serpent-avx2-asm_64.S | 9 + arch/x86/crypto/serpent-sse2-x86_64-asm_64.S | 4 + arch/x86/crypto/sha1_ssse3_asm.S | 10 +- arch/x86/crypto/sha256-avx-asm.S | 2 + arch/x86/crypto/sha256-avx2-asm.S | 2 + arch/x86/crypto/sha256-ssse3-asm.S | 2 + arch/x86/crypto/sha512-avx-asm.S | 2 + arch/x86/crypto/sha512-avx2-asm.S | 2 + arch/x86/crypto/sha512-ssse3-asm.S | 2 + arch/x86/crypto/twofish-avx-x86_64-asm_64.S | 25 +- arch/x86/crypto/twofish-x86_64-asm_64-3way.S | 4 + arch/x86/crypto/twofish-x86_64-asm_64.S | 3 + arch/x86/entry/calling.h | 86 +- arch/x86/entry/common.c | 13 +- arch/x86/entry/entry_32.S | 351 +- arch/x86/entry/entry_64.S | 619 +- arch/x86/entry/entry_64_compat.S | 159 +- arch/x86/entry/thunk_64.S | 2 + arch/x86/entry/vdso/Makefile | 2 +- arch/x86/entry/vdso/vdso2c.h | 8 +- arch/x86/entry/vdso/vma.c | 41 +- arch/x86/entry/vsyscall/vsyscall_64.c | 16 +- arch/x86/entry/vsyscall/vsyscall_emu_64.S | 2 +- arch/x86/ia32/ia32_signal.c | 23 +- arch/x86/ia32/sys_ia32.c | 42 +- arch/x86/include/asm/alternative-asm.h | 43 +- arch/x86/include/asm/alternative.h | 4 +- arch/x86/include/asm/apic.h | 2 +- arch/x86/include/asm/apm.h | 4 +- arch/x86/include/asm/atomic.h | 230 +- arch/x86/include/asm/atomic64_32.h | 100 + arch/x86/include/asm/atomic64_64.h | 164 +- arch/x86/include/asm/bitops.h | 18 +- arch/x86/include/asm/boot.h | 2 +- arch/x86/include/asm/cache.h | 5 +- arch/x86/include/asm/checksum_32.h | 12 +- arch/x86/include/asm/cmpxchg.h | 39 + arch/x86/include/asm/compat.h | 2 +- arch/x86/include/asm/cpufeature.h | 17 +- arch/x86/include/asm/desc.h | 78 +- arch/x86/include/asm/desc_defs.h | 6 + arch/x86/include/asm/div64.h | 2 +- arch/x86/include/asm/elf.h | 33 +- arch/x86/include/asm/emergency-restart.h | 2 +- arch/x86/include/asm/fpu/internal.h | 42 +- arch/x86/include/asm/fpu/types.h | 6 +- arch/x86/include/asm/futex.h | 14 +- arch/x86/include/asm/hw_irq.h | 4 +- arch/x86/include/asm/i8259.h | 2 +- arch/x86/include/asm/io.h | 22 +- arch/x86/include/asm/irqflags.h | 5 + arch/x86/include/asm/kprobes.h | 9 +- arch/x86/include/asm/local.h | 106 +- arch/x86/include/asm/mman.h | 15 + arch/x86/include/asm/mmu.h | 14 +- arch/x86/include/asm/mmu_context.h | 114 +- arch/x86/include/asm/module.h | 17 +- arch/x86/include/asm/nmi.h | 19 +- arch/x86/include/asm/page.h | 1 + arch/x86/include/asm/page_32.h | 12 +- arch/x86/include/asm/page_64.h | 14 +- arch/x86/include/asm/paravirt.h | 46 +- arch/x86/include/asm/paravirt_types.h | 15 +- arch/x86/include/asm/pgalloc.h | 23 + arch/x86/include/asm/pgtable-2level.h | 2 + arch/x86/include/asm/pgtable-3level.h | 7 + arch/x86/include/asm/pgtable.h | 128 +- arch/x86/include/asm/pgtable_32.h | 14 +- arch/x86/include/asm/pgtable_32_types.h | 24 +- arch/x86/include/asm/pgtable_64.h | 23 +- arch/x86/include/asm/pgtable_64_types.h | 5 + arch/x86/include/asm/pgtable_types.h | 26 +- arch/x86/include/asm/preempt.h | 2 +- arch/x86/include/asm/processor.h | 57 +- arch/x86/include/asm/ptrace.h | 13 +- arch/x86/include/asm/realmode.h | 4 +- arch/x86/include/asm/reboot.h | 10 +- arch/x86/include/asm/rmwcc.h | 84 +- arch/x86/include/asm/rwsem.h | 60 +- arch/x86/include/asm/segment.h | 27 +- arch/x86/include/asm/smap.h | 43 + arch/x86/include/asm/smp.h | 14 +- arch/x86/include/asm/stackprotector.h | 4 +- arch/x86/include/asm/stacktrace.h | 32 +- arch/x86/include/asm/switch_to.h | 4 +- arch/x86/include/asm/sys_ia32.h | 6 +- arch/x86/include/asm/thread_info.h | 27 +- arch/x86/include/asm/tlbflush.h | 77 +- arch/x86/include/asm/uaccess.h | 192 +- arch/x86/include/asm/uaccess_32.h | 28 +- arch/x86/include/asm/uaccess_64.h | 169 +- arch/x86/include/asm/word-at-a-time.h | 2 +- arch/x86/include/asm/x86_init.h | 10 +- arch/x86/include/asm/xen/page.h | 2 +- arch/x86/include/uapi/asm/e820.h | 2 +- arch/x86/kernel/Makefile | 2 +- arch/x86/kernel/acpi/boot.c | 4 +- arch/x86/kernel/acpi/sleep.c | 4 + arch/x86/kernel/acpi/wakeup_32.S | 6 +- arch/x86/kernel/alternative.c | 124 +- arch/x86/kernel/apic/apic.c | 4 +- arch/x86/kernel/apic/apic_flat_64.c | 6 +- arch/x86/kernel/apic/apic_noop.c | 2 +- arch/x86/kernel/apic/bigsmp_32.c | 2 +- arch/x86/kernel/apic/io_apic.c | 8 +- arch/x86/kernel/apic/msi.c | 2 +- arch/x86/kernel/apic/probe_32.c | 4 +- arch/x86/kernel/apic/vector.c | 4 +- arch/x86/kernel/apic/x2apic_cluster.c | 2 +- arch/x86/kernel/apic/x2apic_phys.c | 2 +- arch/x86/kernel/apic/x2apic_uv_x.c | 2 +- arch/x86/kernel/apm_32.c | 21 +- arch/x86/kernel/asm-offsets.c | 20 + arch/x86/kernel/asm-offsets_64.c | 1 + arch/x86/kernel/cpu/Makefile | 4 - arch/x86/kernel/cpu/amd.c | 2 +- arch/x86/kernel/cpu/bugs_64.c | 2 + arch/x86/kernel/cpu/common.c | 202 +- arch/x86/kernel/cpu/intel_cacheinfo.c | 14 +- arch/x86/kernel/cpu/mcheck/mce.c | 34 +- arch/x86/kernel/cpu/mcheck/p5.c | 3 + arch/x86/kernel/cpu/mcheck/winchip.c | 3 + arch/x86/kernel/cpu/microcode/intel.c | 4 +- arch/x86/kernel/cpu/mtrr/main.c | 2 +- arch/x86/kernel/cpu/mtrr/mtrr.h | 2 +- arch/x86/kernel/cpu/perf_event.c | 10 +- arch/x86/kernel/cpu/perf_event_amd_iommu.c | 2 +- arch/x86/kernel/cpu/perf_event_intel.c | 6 +- arch/x86/kernel/cpu/perf_event_intel_bts.c | 6 +- arch/x86/kernel/cpu/perf_event_intel_cqm.c | 4 +- arch/x86/kernel/cpu/perf_event_intel_pt.c | 44 +- arch/x86/kernel/cpu/perf_event_intel_rapl.c | 2 +- arch/x86/kernel/cpu/perf_event_intel_uncore.c | 2 +- arch/x86/kernel/cpu/perf_event_intel_uncore.h | 2 +- arch/x86/kernel/crash_dump_64.c | 2 +- arch/x86/kernel/doublefault.c | 8 +- arch/x86/kernel/dumpstack.c | 24 +- arch/x86/kernel/dumpstack_32.c | 25 +- arch/x86/kernel/dumpstack_64.c | 62 +- arch/x86/kernel/e820.c | 4 +- arch/x86/kernel/early_printk.c | 1 + arch/x86/kernel/espfix_64.c | 44 +- arch/x86/kernel/fpu/core.c | 24 +- arch/x86/kernel/fpu/init.c | 40 +- arch/x86/kernel/fpu/regset.c | 22 +- arch/x86/kernel/fpu/signal.c | 20 +- arch/x86/kernel/fpu/xstate.c | 8 +- arch/x86/kernel/ftrace.c | 18 +- arch/x86/kernel/head64.c | 14 +- arch/x86/kernel/head_32.S | 235 +- arch/x86/kernel/head_64.S | 173 +- arch/x86/kernel/i386_ksyms_32.c | 12 + arch/x86/kernel/i8259.c | 10 +- arch/x86/kernel/io_delay.c | 2 +- arch/x86/kernel/ioport.c | 2 +- arch/x86/kernel/irq.c | 8 +- arch/x86/kernel/irq_32.c | 45 +- arch/x86/kernel/jump_label.c | 10 +- arch/x86/kernel/kgdb.c | 21 +- arch/x86/kernel/kprobes/core.c | 28 +- arch/x86/kernel/kprobes/opt.c | 16 +- arch/x86/kernel/ksysfs.c | 2 +- arch/x86/kernel/kvmclock.c | 20 +- arch/x86/kernel/ldt.c | 25 + arch/x86/kernel/livepatch.c | 12 +- arch/x86/kernel/machine_kexec_32.c | 6 +- arch/x86/kernel/mcount_64.S | 19 +- arch/x86/kernel/module.c | 78 +- arch/x86/kernel/msr.c | 2 +- arch/x86/kernel/nmi.c | 34 +- arch/x86/kernel/nmi_selftest.c | 4 +- arch/x86/kernel/paravirt-spinlocks.c | 2 +- arch/x86/kernel/paravirt.c | 45 +- arch/x86/kernel/paravirt_patch_64.c | 8 + arch/x86/kernel/pci-calgary_64.c | 2 +- arch/x86/kernel/pci-iommu_table.c | 2 +- arch/x86/kernel/pci-swiotlb.c | 2 +- arch/x86/kernel/process.c | 80 +- arch/x86/kernel/process_32.c | 29 +- arch/x86/kernel/process_64.c | 14 +- arch/x86/kernel/ptrace.c | 20 +- arch/x86/kernel/pvclock.c | 8 +- arch/x86/kernel/reboot.c | 44 +- arch/x86/kernel/reboot_fixups_32.c | 2 +- arch/x86/kernel/relocate_kernel_64.S | 3 +- arch/x86/kernel/setup.c | 29 +- arch/x86/kernel/setup_percpu.c | 29 +- arch/x86/kernel/signal.c | 17 +- arch/x86/kernel/smp.c | 2 +- arch/x86/kernel/smpboot.c | 29 +- arch/x86/kernel/step.c | 6 +- arch/x86/kernel/sys_i386_32.c | 184 + arch/x86/kernel/sys_x86_64.c | 22 +- arch/x86/kernel/tboot.c | 14 +- arch/x86/kernel/time.c | 8 +- arch/x86/kernel/tls.c | 7 +- arch/x86/kernel/tracepoint.c | 4 +- arch/x86/kernel/traps.c | 53 +- arch/x86/kernel/tsc.c | 2 +- arch/x86/kernel/uprobes.c | 2 +- arch/x86/kernel/vm86_32.c | 6 +- arch/x86/kernel/vmlinux.lds.S | 153 +- arch/x86/kernel/x8664_ksyms_64.c | 6 +- arch/x86/kernel/x86_init.c | 6 +- arch/x86/kvm/cpuid.c | 21 +- arch/x86/kvm/emulate.c | 2 +- arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/paging_tmpl.h | 2 +- arch/x86/kvm/svm.c | 10 +- arch/x86/kvm/vmx.c | 62 +- arch/x86/kvm/x86.c | 42 +- arch/x86/lguest/boot.c | 3 +- arch/x86/lib/atomic64_386_32.S | 164 + arch/x86/lib/atomic64_cx8_32.S | 98 +- arch/x86/lib/checksum_32.S | 99 +- arch/x86/lib/clear_page_64.S | 3 + arch/x86/lib/cmpxchg16b_emu.S | 3 + arch/x86/lib/copy_page_64.S | 14 +- arch/x86/lib/copy_user_64.S | 66 +- arch/x86/lib/csum-copy_64.S | 14 +- arch/x86/lib/csum-wrappers_64.c | 8 +- arch/x86/lib/getuser.S | 74 +- arch/x86/lib/insn.c | 8 +- arch/x86/lib/iomap_copy_64.S | 2 + arch/x86/lib/memcpy_64.S | 6 + arch/x86/lib/memmove_64.S | 3 +- arch/x86/lib/memset_64.S | 3 + arch/x86/lib/mmx_32.c | 243 +- arch/x86/lib/msr-reg.S | 2 + arch/x86/lib/putuser.S | 87 +- arch/x86/lib/rwsem.S | 6 +- arch/x86/lib/usercopy_32.c | 359 +- arch/x86/lib/usercopy_64.c | 20 +- arch/x86/math-emu/fpu_aux.c | 2 +- arch/x86/math-emu/fpu_entry.c | 4 +- arch/x86/math-emu/fpu_system.h | 2 +- arch/x86/mm/Makefile | 4 + arch/x86/mm/extable.c | 26 +- arch/x86/mm/fault.c | 570 +- arch/x86/mm/gup.c | 6 +- arch/x86/mm/highmem_32.c | 6 + arch/x86/mm/hugetlbpage.c | 24 +- arch/x86/mm/init.c | 111 +- arch/x86/mm/init_32.c | 111 +- arch/x86/mm/init_64.c | 46 +- arch/x86/mm/iomap_32.c | 4 + arch/x86/mm/ioremap.c | 52 +- arch/x86/mm/kmemcheck/kmemcheck.c | 4 +- arch/x86/mm/mmap.c | 40 +- arch/x86/mm/mmio-mod.c | 10 +- arch/x86/mm/numa.c | 2 +- arch/x86/mm/pageattr.c | 38 +- arch/x86/mm/pat.c | 12 +- arch/x86/mm/pat_rbtree.c | 2 +- arch/x86/mm/pf_in.c | 10 +- arch/x86/mm/pgtable.c | 214 +- arch/x86/mm/pgtable_32.c | 3 + arch/x86/mm/setup_nx.c | 7 + arch/x86/mm/tlb.c | 4 + arch/x86/mm/uderef_64.c | 37 + arch/x86/net/bpf_jit.S | 11 + arch/x86/net/bpf_jit_comp.c | 13 +- arch/x86/oprofile/backtrace.c | 6 +- arch/x86/oprofile/nmi_int.c | 8 +- arch/x86/oprofile/op_model_amd.c | 8 +- arch/x86/oprofile/op_model_ppro.c | 7 +- arch/x86/oprofile/op_x86_model.h | 2 +- arch/x86/pci/intel_mid_pci.c | 2 +- arch/x86/pci/irq.c | 8 +- arch/x86/pci/pcbios.c | 144 +- arch/x86/platform/efi/efi_32.c | 24 + arch/x86/platform/efi/efi_64.c | 26 +- arch/x86/platform/efi/efi_stub_32.S | 64 +- arch/x86/platform/efi/efi_stub_64.S | 2 + arch/x86/platform/intel-mid/intel-mid.c | 5 +- arch/x86/platform/intel-mid/intel_mid_weak_decls.h | 6 +- arch/x86/platform/intel-mid/mfld.c | 4 +- arch/x86/platform/intel-mid/mrfl.c | 2 +- arch/x86/platform/intel-quark/imr_selftest.c | 2 +- arch/x86/platform/olpc/olpc_dt.c | 2 +- arch/x86/power/cpu.c | 11 +- arch/x86/realmode/init.c | 10 +- arch/x86/realmode/rm/Makefile | 3 + arch/x86/realmode/rm/header.S | 4 +- arch/x86/realmode/rm/reboot.S | 4 + arch/x86/realmode/rm/trampoline_32.S | 12 +- arch/x86/realmode/rm/trampoline_64.S | 3 +- arch/x86/realmode/rm/wakeup_asm.S | 5 +- arch/x86/tools/Makefile | 2 +- arch/x86/tools/relocs.c | 96 +- arch/x86/um/mem_32.c | 2 +- arch/x86/um/tls_32.c | 2 +- arch/x86/xen/enlighten.c | 50 +- arch/x86/xen/mmu.c | 19 +- arch/x86/xen/smp.c | 16 +- arch/x86/xen/xen-asm_32.S | 2 +- arch/x86/xen/xen-head.S | 11 + arch/x86/xen/xen-ops.h | 2 - block/bio.c | 4 +- block/blk-iopoll.c | 2 +- block/blk-map.c | 2 +- block/blk-softirq.c | 2 +- block/bsg.c | 12 +- block/compat_ioctl.c | 4 +- block/genhd.c | 9 +- block/partitions/efi.c | 8 +- block/scsi_ioctl.c | 29 +- crypto/cryptd.c | 4 +- crypto/pcrypt.c | 2 +- crypto/zlib.c | 12 +- drivers/acpi/acpi_video.c | 2 +- drivers/acpi/apei/apei-internal.h | 2 +- drivers/acpi/apei/ghes.c | 4 +- drivers/acpi/bgrt.c | 6 +- drivers/acpi/blacklist.c | 4 +- drivers/acpi/bus.c | 4 +- drivers/acpi/device_pm.c | 4 +- drivers/acpi/ec.c | 2 +- drivers/acpi/pci_slot.c | 2 +- drivers/acpi/processor_idle.c | 2 +- drivers/acpi/processor_pdc.c | 2 +- drivers/acpi/sleep.c | 2 +- drivers/acpi/sysfs.c | 4 +- drivers/acpi/thermal.c | 2 +- drivers/acpi/video_detect.c | 7 +- drivers/ata/libata-core.c | 12 +- drivers/ata/libata-scsi.c | 2 +- drivers/ata/libata.h | 2 +- drivers/ata/pata_arasan_cf.c | 4 +- drivers/atm/adummy.c | 2 +- drivers/atm/ambassador.c | 8 +- drivers/atm/atmtcp.c | 14 +- drivers/atm/eni.c | 10 +- drivers/atm/firestream.c | 8 +- drivers/atm/fore200e.c | 14 +- drivers/atm/he.c | 18 +- drivers/atm/horizon.c | 4 +- drivers/atm/idt77252.c | 36 +- drivers/atm/iphase.c | 34 +- drivers/atm/lanai.c | 12 +- drivers/atm/nicstar.c | 46 +- drivers/atm/solos-pci.c | 4 +- drivers/atm/suni.c | 4 +- drivers/atm/uPD98402.c | 16 +- drivers/atm/zatm.c | 6 +- drivers/base/bus.c | 4 +- drivers/base/devtmpfs.c | 8 +- drivers/base/node.c | 2 +- drivers/base/platform-msi.c | 20 +- drivers/base/power/domain.c | 11 +- drivers/base/power/sysfs.c | 2 +- drivers/base/power/wakeup.c | 8 +- drivers/base/regmap/regmap-debugfs.c | 11 +- drivers/base/syscore.c | 4 +- drivers/block/cciss.c | 28 +- drivers/block/cciss.h | 2 +- drivers/block/cpqarray.c | 28 +- drivers/block/cpqarray.h | 2 +- drivers/block/drbd/drbd_bitmap.c | 2 +- drivers/block/drbd/drbd_int.h | 8 +- drivers/block/drbd/drbd_main.c | 12 +- drivers/block/drbd/drbd_nl.c | 4 +- drivers/block/drbd/drbd_receiver.c | 34 +- drivers/block/drbd/drbd_worker.c | 8 +- drivers/block/pktcdvd.c | 4 +- drivers/block/rbd.c | 2 +- drivers/bluetooth/btwilink.c | 2 +- drivers/bus/arm-cci.c | 12 +- drivers/cdrom/cdrom.c | 11 +- drivers/cdrom/gdrom.c | 1 - drivers/char/agp/compat_ioctl.c | 2 +- drivers/char/agp/frontend.c | 4 +- drivers/char/agp/intel-gtt.c | 4 +- drivers/char/hpet.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 8 +- drivers/char/ipmi/ipmi_si_intf.c | 8 +- drivers/char/mem.c | 47 +- drivers/char/nvram.c | 2 +- drivers/char/pcmcia/synclink_cs.c | 16 +- drivers/char/random.c | 12 +- drivers/char/sonypi.c | 11 +- drivers/char/tpm/tpm_acpi.c | 3 +- drivers/char/tpm/tpm_eventlog.c | 4 +- drivers/char/virtio_console.c | 4 +- drivers/clk/clk-composite.c | 2 +- drivers/clk/samsung/clk.h | 2 +- drivers/clk/socfpga/clk-gate.c | 9 +- drivers/clk/socfpga/clk-pll.c | 9 +- drivers/clk/ti/clk.c | 8 +- drivers/cpufreq/acpi-cpufreq.c | 17 +- drivers/cpufreq/cpufreq-dt.c | 4 +- drivers/cpufreq/cpufreq.c | 30 +- drivers/cpufreq/cpufreq_governor.c | 2 +- drivers/cpufreq/cpufreq_governor.h | 4 +- drivers/cpufreq/cpufreq_ondemand.c | 10 +- drivers/cpufreq/intel_pstate.c | 33 +- drivers/cpufreq/p4-clockmod.c | 12 +- drivers/cpufreq/sparc-us3-cpufreq.c | 67 +- drivers/cpufreq/speedstep-centrino.c | 7 +- drivers/cpuidle/driver.c | 2 +- drivers/cpuidle/dt_idle_states.c | 2 +- drivers/cpuidle/governor.c | 2 +- drivers/cpuidle/sysfs.c | 2 +- drivers/crypto/hifn_795x.c | 4 +- drivers/devfreq/devfreq.c | 4 +- drivers/dma/sh/shdma-base.c | 4 +- drivers/dma/sh/shdmac.c | 2 +- drivers/edac/edac_device.c | 4 +- drivers/edac/edac_mc_sysfs.c | 2 +- drivers/edac/edac_pci.c | 4 +- drivers/edac/edac_pci_sysfs.c | 22 +- drivers/edac/mce_amd.h | 2 +- drivers/firewire/core-card.c | 6 +- drivers/firewire/core-device.c | 2 +- drivers/firewire/core-transaction.c | 1 + drivers/firewire/core.h | 1 + drivers/firmware/dmi-id.c | 2 +- drivers/firmware/dmi_scan.c | 12 +- drivers/firmware/efi/cper.c | 8 +- drivers/firmware/efi/efi.c | 12 +- drivers/firmware/efi/efivars.c | 2 +- drivers/firmware/efi/runtime-map.c | 2 +- drivers/firmware/google/gsmi.c | 2 +- drivers/firmware/google/memconsole.c | 7 +- drivers/firmware/memmap.c | 2 +- drivers/firmware/psci.c | 2 +- drivers/gpio/gpio-davinci.c | 6 +- drivers/gpio/gpio-em.c | 2 +- drivers/gpio/gpio-ich.c | 2 +- drivers/gpio/gpio-omap.c | 4 +- drivers/gpio/gpio-rcar.c | 2 +- drivers/gpio/gpio-vr41xx.c | 2 +- drivers/gpio/gpiolib.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 6 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 90 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.h | 8 +- .../drm/amd/amdkfd/kfd_device_queue_manager_cik.c | 14 +- .../drm/amd/amdkfd/kfd_device_queue_manager_vi.c | 14 +- drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.h | 2 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 16 +- drivers/gpu/drm/drm_crtc.c | 2 +- drivers/gpu/drm/drm_drv.c | 2 +- drivers/gpu/drm/drm_fops.c | 12 +- drivers/gpu/drm/drm_global.c | 14 +- drivers/gpu/drm/drm_info.c | 13 +- drivers/gpu/drm/drm_ioc32.c | 13 +- drivers/gpu/drm/drm_ioctl.c | 2 +- drivers/gpu/drm/gma500/mdfld_dsi_dpi.c | 10 +- drivers/gpu/drm/i810/i810_drv.h | 4 +- drivers/gpu/drm/i915/i915_dma.c | 2 +- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 4 +- drivers/gpu/drm/i915/i915_gem_gtt.c | 16 +- drivers/gpu/drm/i915/i915_gem_gtt.h | 6 +- drivers/gpu/drm/i915/i915_ioc32.c | 10 +- drivers/gpu/drm/i915/intel_display.c | 26 +- drivers/gpu/drm/imx/imx-drm-core.c | 2 +- drivers/gpu/drm/mga/mga_drv.h | 4 +- drivers/gpu/drm/mga/mga_ioc32.c | 10 +- drivers/gpu/drm/mga/mga_irq.c | 8 +- drivers/gpu/drm/nouveau/nouveau_bios.c | 2 +- drivers/gpu/drm/nouveau/nouveau_drm.h | 1 - drivers/gpu/drm/nouveau/nouveau_ioc32.c | 2 +- drivers/gpu/drm/nouveau/nouveau_vga.c | 2 +- drivers/gpu/drm/omapdrm/Makefile | 2 +- drivers/gpu/drm/qxl/qxl_cmd.c | 12 +- drivers/gpu/drm/qxl/qxl_debugfs.c | 8 +- drivers/gpu/drm/qxl/qxl_drv.h | 8 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 10 +- drivers/gpu/drm/qxl/qxl_irq.c | 16 +- drivers/gpu/drm/qxl/qxl_ttm.c | 38 +- drivers/gpu/drm/r128/r128_cce.c | 2 +- drivers/gpu/drm/r128/r128_drv.h | 4 +- drivers/gpu/drm/r128/r128_ioc32.c | 10 +- drivers/gpu/drm/r128/r128_irq.c | 4 +- drivers/gpu/drm/r128/r128_state.c | 4 +- drivers/gpu/drm/radeon/mkregtable.c | 4 +- drivers/gpu/drm/radeon/radeon_device.c | 2 +- drivers/gpu/drm/radeon/radeon_drv.h | 2 +- drivers/gpu/drm/radeon/radeon_ioc32.c | 12 +- drivers/gpu/drm/radeon/radeon_irq.c | 6 +- drivers/gpu/drm/radeon/radeon_state.c | 4 +- drivers/gpu/drm/radeon/radeon_ttm.c | 4 +- drivers/gpu/drm/tegra/dc.c | 2 +- drivers/gpu/drm/tegra/dsi.c | 2 +- drivers/gpu/drm/tegra/hdmi.c | 2 +- drivers/gpu/drm/tegra/sor.c | 7 +- drivers/gpu/drm/tilcdc/Makefile | 6 +- drivers/gpu/drm/ttm/ttm_memory.c | 4 +- drivers/gpu/drm/ttm/ttm_page_alloc.c | 18 +- drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 18 +- drivers/gpu/drm/udl/udl_fb.c | 1 - drivers/gpu/drm/via/via_drv.h | 4 +- drivers/gpu/drm/via/via_irq.c | 18 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 8 +- drivers/gpu/drm/vmwgfx/vmwgfx_irq.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_marker.c | 2 +- drivers/gpu/vga/vga_switcheroo.c | 4 +- drivers/hid/hid-core.c | 4 +- drivers/hid/hid-sensor-custom.c | 2 +- drivers/hv/channel.c | 2 +- drivers/hv/hv.c | 4 +- drivers/hv/hv_balloon.c | 18 +- drivers/hv/hyperv_vmbus.h | 2 +- drivers/hwmon/acpi_power_meter.c | 6 +- drivers/hwmon/applesmc.c | 2 +- drivers/hwmon/asus_atk0110.c | 10 +- drivers/hwmon/coretemp.c | 2 +- drivers/hwmon/dell-smm-hwmon.c | 2 +- drivers/hwmon/ibmaem.c | 2 +- drivers/hwmon/iio_hwmon.c | 2 +- drivers/hwmon/nct6683.c | 6 +- drivers/hwmon/nct6775.c | 6 +- drivers/hwmon/pmbus/pmbus_core.c | 10 +- drivers/hwmon/sht15.c | 12 +- drivers/hwmon/via-cputemp.c | 2 +- drivers/i2c/busses/i2c-amd756-s4882.c | 2 +- drivers/i2c/busses/i2c-nforce2-s4985.c | 2 +- drivers/i2c/i2c-dev.c | 2 +- drivers/ide/ide-cd.c | 2 +- drivers/ide/ide-disk.c | 2 +- drivers/iio/industrialio-core.c | 2 +- drivers/iio/magnetometer/ak8975.c | 2 +- drivers/infiniband/core/cm.c | 32 +- drivers/infiniband/core/fmr_pool.c | 20 +- drivers/infiniband/core/uverbs_cmd.c | 3 + drivers/infiniband/hw/cxgb4/mem.c | 4 +- drivers/infiniband/hw/mlx4/mad.c | 2 +- drivers/infiniband/hw/mlx4/mcg.c | 2 +- drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 +- drivers/infiniband/hw/mthca/mthca_cmd.c | 8 +- drivers/infiniband/hw/mthca/mthca_main.c | 2 +- drivers/infiniband/hw/mthca/mthca_mr.c | 6 +- drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/nes/nes.c | 4 +- drivers/infiniband/hw/nes/nes.h | 40 +- drivers/infiniband/hw/nes/nes_cm.c | 62 +- drivers/infiniband/hw/nes/nes_mgt.c | 8 +- drivers/infiniband/hw/nes/nes_nic.c | 40 +- drivers/infiniband/hw/nes/nes_verbs.c | 10 +- drivers/infiniband/hw/qib/qib.h | 1 + drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 2 +- drivers/input/gameport/gameport.c | 4 +- drivers/input/input.c | 4 +- drivers/input/joystick/sidewinder.c | 1 + drivers/input/joystick/xpad.c | 4 +- drivers/input/misc/ims-pcu.c | 4 +- drivers/input/mouse/psmouse.h | 2 +- drivers/input/mousedev.c | 2 +- drivers/input/serio/serio.c | 4 +- drivers/input/serio/serio_raw.c | 4 +- drivers/input/touchscreen/htcpen.c | 2 +- drivers/iommu/arm-smmu-v3.c | 2 +- drivers/iommu/arm-smmu.c | 43 +- drivers/iommu/io-pgtable-arm.c | 101 +- drivers/iommu/io-pgtable.c | 11 +- drivers/iommu/io-pgtable.h | 19 +- drivers/iommu/iommu.c | 2 +- drivers/iommu/ipmmu-vmsa.c | 13 +- drivers/iommu/irq_remapping.c | 2 +- drivers/irqchip/irq-gic.c | 2 +- drivers/irqchip/irq-i8259.c | 2 +- drivers/irqchip/irq-renesas-intc-irqpin.c | 2 +- drivers/irqchip/irq-renesas-irqc.c | 2 +- drivers/isdn/capi/capi.c | 10 +- drivers/isdn/gigaset/interface.c | 8 +- drivers/isdn/gigaset/usb-gigaset.c | 2 +- drivers/isdn/hardware/avm/b1.c | 4 +- drivers/isdn/i4l/isdn_common.c | 2 + drivers/isdn/i4l/isdn_tty.c | 22 +- drivers/isdn/icn/icn.c | 2 +- drivers/isdn/mISDN/dsp_cmx.c | 2 +- drivers/lguest/core.c | 10 +- drivers/lguest/page_tables.c | 2 +- drivers/lguest/x86/core.c | 12 +- drivers/lguest/x86/switcher_32.S | 27 +- drivers/md/bcache/closure.h | 2 +- drivers/md/bitmap.c | 2 +- drivers/md/dm-ioctl.c | 2 +- drivers/md/dm-raid1.c | 18 +- drivers/md/dm-stats.c | 6 +- drivers/md/dm-stripe.c | 10 +- drivers/md/dm-table.c | 2 +- drivers/md/dm-thin-metadata.c | 4 +- drivers/md/dm.c | 16 +- drivers/md/md.c | 26 +- drivers/md/md.h | 6 +- drivers/md/persistent-data/dm-space-map-metadata.c | 4 +- drivers/md/persistent-data/dm-space-map.h | 1 + drivers/md/raid1.c | 4 +- drivers/md/raid10.c | 18 +- drivers/md/raid5.c | 22 +- drivers/media/dvb-core/dvbdev.c | 2 +- drivers/media/dvb-frontends/af9033.h | 2 +- drivers/media/dvb-frontends/dib3000.h | 2 +- drivers/media/dvb-frontends/dib7000p.h | 2 +- drivers/media/dvb-frontends/dib8000.h | 2 +- drivers/media/pci/cx88/cx88-video.c | 6 +- drivers/media/pci/ivtv/ivtv-driver.c | 2 +- drivers/media/pci/solo6x10/solo6x10-core.c | 2 +- drivers/media/pci/solo6x10/solo6x10-p2m.c | 2 +- drivers/media/pci/solo6x10/solo6x10.h | 2 +- drivers/media/pci/tw68/tw68-core.c | 2 +- drivers/media/platform/omap/omap_vout.c | 11 +- drivers/media/platform/s5p-tv/mixer.h | 2 +- drivers/media/platform/s5p-tv/mixer_grp_layer.c | 2 +- drivers/media/platform/s5p-tv/mixer_reg.c | 2 +- drivers/media/platform/s5p-tv/mixer_video.c | 24 +- drivers/media/platform/s5p-tv/mixer_vp_layer.c | 2 +- drivers/media/radio/radio-cadet.c | 2 + drivers/media/radio/radio-maxiradio.c | 2 +- drivers/media/radio/radio-shark.c | 2 +- drivers/media/radio/radio-shark2.c | 2 +- drivers/media/radio/radio-si476x.c | 2 +- drivers/media/radio/wl128x/fmdrv_common.c | 2 +- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 12 +- drivers/media/v4l2-core/v4l2-device.c | 4 +- drivers/media/v4l2-core/v4l2-ioctl.c | 13 +- drivers/memory/omap-gpmc.c | 21 +- drivers/message/fusion/mptsas.c | 34 +- drivers/mfd/ab8500-debugfs.c | 2 +- drivers/mfd/kempld-core.c | 2 +- drivers/mfd/max8925-i2c.c | 2 +- drivers/mfd/tps65910.c | 2 +- drivers/mfd/twl4030-irq.c | 9 +- drivers/mfd/wm5110-tables.c | 2 +- drivers/mfd/wm8998-tables.c | 2 +- drivers/misc/c2port/core.c | 4 +- drivers/misc/kgdbts.c | 4 +- drivers/misc/lis3lv02d/lis3lv02d.c | 8 +- drivers/misc/lis3lv02d/lis3lv02d.h | 2 +- drivers/misc/mic/scif/scif_rb.c | 8 +- drivers/misc/sgi-gru/gruhandles.c | 4 +- drivers/misc/sgi-gru/gruprocfs.c | 8 +- drivers/misc/sgi-gru/grutables.h | 154 +- drivers/misc/sgi-xp/xp.h | 2 +- drivers/misc/sgi-xp/xpc.h | 3 +- drivers/misc/sgi-xp/xpc_main.c | 2 +- drivers/mmc/card/block.c | 2 +- drivers/mmc/host/dw_mmc.h | 2 +- drivers/mmc/host/mmci.c | 4 +- drivers/mmc/host/omap_hsmmc.c | 4 +- drivers/mmc/host/sdhci-esdhc-imx.c | 7 +- drivers/mmc/host/sdhci-s3c.c | 8 +- drivers/mtd/chips/cfi_cmdset_0020.c | 2 +- drivers/mtd/nand/denali.c | 1 + drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 2 +- drivers/mtd/nftlmount.c | 1 + drivers/mtd/sm_ftl.c | 2 +- drivers/net/bonding/bond_netlink.c | 2 +- drivers/net/caif/caif_hsi.c | 2 +- drivers/net/can/Kconfig | 2 +- drivers/net/can/dev.c | 2 +- drivers/net/can/vcan.c | 2 +- drivers/net/dummy.c | 2 +- drivers/net/ethernet/8390/ax88796.c | 4 +- drivers/net/ethernet/altera/altera_tse_main.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-common.h | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-dcb.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-desc.c | 27 +- drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 143 +- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 64 +- drivers/net/ethernet/amd/xgbe/xgbe-ethtool.c | 10 +- drivers/net/ethernet/amd/xgbe/xgbe-main.c | 15 +- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 27 +- drivers/net/ethernet/amd/xgbe/xgbe-ptp.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe.h | 10 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c | 11 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h | 3 +- drivers/net/ethernet/broadcom/tg3.h | 1 + drivers/net/ethernet/cavium/liquidio/lio_ethtool.c | 6 +- drivers/net/ethernet/cavium/liquidio/lio_main.c | 11 +- drivers/net/ethernet/chelsio/cxgb3/l2t.h | 2 +- drivers/net/ethernet/dec/tulip/de4x5.c | 4 +- drivers/net/ethernet/emulex/benet/be_main.c | 2 +- drivers/net/ethernet/faraday/ftgmac100.c | 2 + drivers/net/ethernet/faraday/ftmac100.c | 2 + drivers/net/ethernet/intel/i40e/i40e_ptp.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 7 +- drivers/net/ethernet/neterion/vxge/vxge-config.c | 7 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 4 +- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c | 12 +- .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 +- drivers/net/ethernet/realtek/r8169.c | 8 +- drivers/net/ethernet/sfc/ptp.c | 2 +- drivers/net/ethernet/stmicro/stmmac/mmc_core.c | 4 +- drivers/net/ethernet/via/via-rhine.c | 2 +- drivers/net/geneve.c | 2 +- drivers/net/hyperv/hyperv_net.h | 2 +- drivers/net/hyperv/rndis_filter.c | 4 +- drivers/net/ifb.c | 2 +- drivers/net/ipvlan/ipvlan_core.c | 2 +- drivers/net/macvlan.c | 20 +- drivers/net/macvtap.c | 6 +- drivers/net/nlmon.c | 2 +- drivers/net/phy/phy_device.c | 6 +- drivers/net/ppp/ppp_generic.c | 4 +- drivers/net/slip/slhc.c | 2 +- drivers/net/team/team.c | 4 +- drivers/net/tun.c | 7 +- drivers/net/usb/hso.c | 23 +- drivers/net/usb/r8152.c | 2 +- drivers/net/usb/sierra_net.c | 4 +- drivers/net/virtio_net.c | 2 +- drivers/net/vrf.c | 2 +- drivers/net/vxlan.c | 4 +- drivers/net/wimax/i2400m/rx.c | 2 +- drivers/net/wireless/airo.c | 2 +- drivers/net/wireless/at76c50x-usb.c | 2 +- drivers/net/wireless/ath/ath10k/ce.c | 6 +- drivers/net/wireless/ath/ath10k/htc.c | 7 +- drivers/net/wireless/ath/ath10k/htc.h | 4 +- drivers/net/wireless/ath/ath9k/ar9002_mac.c | 36 +- drivers/net/wireless/ath/ath9k/ar9003_mac.c | 64 +- drivers/net/wireless/ath/ath9k/hw.h | 4 +- drivers/net/wireless/ath/ath9k/main.c | 22 +- drivers/net/wireless/ath/wil6210/wil_platform.h | 2 +- drivers/net/wireless/b43/phy_lp.c | 2 +- drivers/net/wireless/iwlegacy/3945-mac.c | 4 +- drivers/net/wireless/iwlwifi/dvm/debugfs.c | 34 +- drivers/net/wireless/iwlwifi/pcie/trans.c | 4 +- drivers/net/wireless/mac80211_hwsim.c | 28 +- drivers/net/wireless/rndis_wlan.c | 2 +- drivers/net/wireless/rt2x00/rt2x00.h | 2 +- drivers/net/wireless/rt2x00/rt2x00queue.c | 4 +- drivers/net/wireless/ti/wl1251/sdio.c | 12 +- drivers/net/wireless/ti/wl12xx/main.c | 8 +- drivers/net/wireless/ti/wl18xx/main.c | 6 +- drivers/nfc/nfcwilink.c | 2 +- drivers/of/fdt.c | 4 +- drivers/oprofile/buffer_sync.c | 8 +- drivers/oprofile/event_buffer.c | 2 +- drivers/oprofile/oprof.c | 2 +- drivers/oprofile/oprofile_stats.c | 10 +- drivers/oprofile/oprofile_stats.h | 10 +- drivers/oprofile/oprofilefs.c | 6 +- drivers/oprofile/timer_int.c | 2 +- drivers/parport/procfs.c | 4 +- drivers/pci/host/pci-host-generic.c | 24 +- drivers/pci/hotplug/acpiphp_ibm.c | 4 +- drivers/pci/hotplug/cpcihp_generic.c | 6 +- drivers/pci/hotplug/cpcihp_zt5550.c | 14 +- drivers/pci/hotplug/cpqphp_nvram.c | 2 + drivers/pci/hotplug/pci_hotplug_core.c | 6 +- drivers/pci/hotplug/pciehp_core.c | 2 +- drivers/pci/msi.c | 22 +- drivers/pci/pci-sysfs.c | 6 +- drivers/pci/pci.h | 2 +- drivers/pci/pcie/aspm.c | 6 +- drivers/pci/pcie/portdrv_pci.c | 2 +- drivers/pci/probe.c | 2 +- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 2 +- drivers/pinctrl/pinctrl-at91.c | 5 +- drivers/platform/chrome/chromeos_pstore.c | 2 +- drivers/platform/x86/alienware-wmi.c | 4 +- drivers/platform/x86/compal-laptop.c | 2 +- drivers/platform/x86/hdaps.c | 2 +- drivers/platform/x86/ibm_rtl.c | 2 +- drivers/platform/x86/intel_oaktrail.c | 2 +- drivers/platform/x86/msi-laptop.c | 16 +- drivers/platform/x86/msi-wmi.c | 2 +- drivers/platform/x86/samsung-laptop.c | 2 +- drivers/platform/x86/samsung-q10.c | 2 +- drivers/platform/x86/sony-laptop.c | 14 +- drivers/platform/x86/thinkpad_acpi.c | 2 +- drivers/pnp/pnpbios/bioscalls.c | 14 +- drivers/pnp/pnpbios/core.c | 2 +- drivers/power/pda_power.c | 7 +- drivers/power/power_supply.h | 4 +- drivers/power/power_supply_core.c | 7 +- drivers/power/power_supply_sysfs.c | 6 +- drivers/power/reset/at91-reset.c | 9 +- drivers/powercap/powercap_sys.c | 136 +- drivers/ptp/ptp_private.h | 2 +- drivers/ptp/ptp_sysfs.c | 2 +- drivers/regulator/core.c | 4 +- drivers/regulator/max8660.c | 6 +- drivers/regulator/max8973-regulator.c | 16 +- drivers/regulator/mc13892-regulator.c | 8 +- drivers/rtc/rtc-armada38x.c | 7 +- drivers/rtc/rtc-cmos.c | 4 +- drivers/rtc/rtc-ds1307.c | 2 +- drivers/rtc/rtc-m48t59.c | 4 +- drivers/rtc/rtc-test.c | 6 +- drivers/scsi/be2iscsi/be_main.c | 2 +- drivers/scsi/bfa/bfa_fcpim.h | 2 +- drivers/scsi/bfa/bfa_ioc.h | 4 +- drivers/scsi/fcoe/fcoe_sysfs.c | 12 +- drivers/scsi/hosts.c | 4 +- drivers/scsi/hpsa.c | 38 +- drivers/scsi/hpsa.h | 2 +- drivers/scsi/libfc/fc_exch.c | 50 +- drivers/scsi/libsas/sas_ata.c | 2 +- drivers/scsi/lpfc/lpfc.h | 8 +- drivers/scsi/lpfc/lpfc_debugfs.c | 18 +- drivers/scsi/lpfc/lpfc_init.c | 6 +- drivers/scsi/lpfc/lpfc_scsi.c | 10 +- drivers/scsi/megaraid/megaraid_sas.h | 2 +- drivers/scsi/mpt2sas/mpt2sas_scsih.c | 8 +- drivers/scsi/pmcraid.c | 20 +- drivers/scsi/pmcraid.h | 8 +- drivers/scsi/qla2xxx/qla_attr.c | 4 +- drivers/scsi/qla2xxx/qla_gbl.h | 4 +- drivers/scsi/qla2xxx/qla_os.c | 6 +- drivers/scsi/qla4xxx/ql4_def.h | 2 +- drivers/scsi/qla4xxx/ql4_os.c | 6 +- drivers/scsi/scsi.c | 2 +- drivers/scsi/scsi_lib.c | 8 +- drivers/scsi/scsi_sysfs.c | 2 +- drivers/scsi/scsi_transport_fc.c | 8 +- drivers/scsi/scsi_transport_iscsi.c | 6 +- drivers/scsi/scsi_transport_srp.c | 6 +- drivers/scsi/sd.c | 6 +- drivers/scsi/sg.c | 2 +- drivers/scsi/sr.c | 21 +- drivers/soc/tegra/fuse/fuse-tegra.c | 2 +- drivers/spi/spi.c | 2 +- drivers/staging/android/timed_output.c | 6 +- drivers/staging/comedi/comedi_fops.c | 8 +- drivers/staging/fbtft/fbtft-core.c | 2 +- drivers/staging/fbtft/fbtft.h | 2 +- drivers/staging/gdm724x/gdm_tty.c | 2 +- drivers/staging/iio/accel/lis3l02dq_ring.c | 2 +- drivers/staging/iio/adc/ad7280a.c | 4 +- drivers/staging/lustre/lnet/selftest/brw_test.c | 12 +- drivers/staging/lustre/lnet/selftest/framework.c | 4 - drivers/staging/lustre/lnet/selftest/ping_test.c | 14 +- drivers/staging/lustre/lustre/include/lustre_dlm.h | 2 +- drivers/staging/lustre/lustre/include/obd.h | 2 +- drivers/staging/octeon/ethernet-rx.c | 20 +- drivers/staging/octeon/ethernet.c | 8 +- drivers/staging/rdma/ipath/ipath_rc.c | 6 +- drivers/staging/rdma/ipath/ipath_ruc.c | 6 +- drivers/staging/rtl8188eu/include/hal_intf.h | 2 +- drivers/staging/rtl8712/rtl871x_io.h | 2 +- drivers/staging/sm750fb/sm750.c | 14 +- drivers/staging/unisys/visorbus/visorbus_private.h | 4 +- drivers/target/sbp/sbp_target.c | 4 +- drivers/thermal/cpu_cooling.c | 9 +- drivers/thermal/int340x_thermal/int3400_thermal.c | 6 +- drivers/thermal/of-thermal.c | 17 +- drivers/thermal/x86_pkg_temp_thermal.c | 2 +- drivers/tty/cyclades.c | 6 +- drivers/tty/hvc/hvc_console.c | 14 +- drivers/tty/hvc/hvcs.c | 21 +- drivers/tty/hvc/hvsi.c | 22 +- drivers/tty/hvc/hvsi_lib.c | 4 +- drivers/tty/ipwireless/tty.c | 27 +- drivers/tty/moxa.c | 2 +- drivers/tty/n_gsm.c | 4 +- drivers/tty/n_tty.c | 3 +- drivers/tty/pty.c | 4 +- drivers/tty/rocket.c | 6 +- drivers/tty/serial/8250/8250_core.c | 10 +- drivers/tty/serial/ifx6x60.c | 2 +- drivers/tty/serial/ioc4_serial.c | 6 +- drivers/tty/serial/kgdb_nmi.c | 4 +- drivers/tty/serial/kgdboc.c | 32 +- drivers/tty/serial/msm_serial.c | 4 +- drivers/tty/serial/samsung.c | 9 +- drivers/tty/serial/serial_core.c | 8 +- drivers/tty/synclink.c | 34 +- drivers/tty/synclink_gt.c | 28 +- drivers/tty/synclinkmp.c | 34 +- drivers/tty/tty_io.c | 2 +- drivers/tty/tty_ldisc.c | 8 +- drivers/tty/tty_port.c | 22 +- drivers/uio/uio.c | 13 +- drivers/usb/atm/cxacru.c | 2 +- drivers/usb/atm/usbatm.c | 24 +- drivers/usb/class/cdc-acm.h | 2 +- drivers/usb/core/devices.c | 6 +- drivers/usb/core/devio.c | 12 +- drivers/usb/core/hcd.c | 4 +- drivers/usb/core/sysfs.c | 2 +- drivers/usb/core/usb.c | 2 +- drivers/usb/early/ehci-dbgp.c | 16 +- drivers/usb/gadget/function/u_serial.c | 22 +- drivers/usb/gadget/udc/dummy_hcd.c | 2 +- drivers/usb/host/ehci-hcd.c | 2 +- drivers/usb/host/ehci-hub.c | 4 +- drivers/usb/host/ehci-q.c | 4 +- drivers/usb/host/fotg210-hcd.c | 2 +- drivers/usb/host/fusbh200-hcd.c | 2 +- drivers/usb/host/hwa-hc.c | 2 +- drivers/usb/host/ohci-hcd.c | 2 +- drivers/usb/host/r8a66597.h | 2 +- drivers/usb/host/uhci-hcd.c | 2 +- drivers/usb/host/xhci-pci.c | 2 +- drivers/usb/host/xhci.c | 2 +- drivers/usb/misc/appledisplay.c | 4 +- drivers/usb/serial/console.c | 8 +- drivers/usb/storage/transport.c | 2 +- drivers/usb/storage/usb.c | 2 +- drivers/usb/storage/usb.h | 2 +- drivers/usb/usbip/vhci.h | 2 +- drivers/usb/usbip/vhci_hcd.c | 6 +- drivers/usb/usbip/vhci_rx.c | 2 +- drivers/usb/wusbcore/wa-hc.h | 4 +- drivers/usb/wusbcore/wa-xfer.c | 2 +- drivers/vfio/vfio.c | 2 +- drivers/vhost/vringh.c | 20 +- drivers/video/backlight/kb3886_bl.c | 2 +- drivers/video/console/fbcon.c | 2 +- drivers/video/fbdev/aty/aty128fb.c | 2 +- drivers/video/fbdev/aty/atyfb_base.c | 8 +- drivers/video/fbdev/aty/mach64_cursor.c | 5 +- drivers/video/fbdev/core/fb_defio.c | 6 +- drivers/video/fbdev/core/fbmem.c | 2 +- drivers/video/fbdev/hyperv_fb.c | 4 +- drivers/video/fbdev/i810/i810_accel.c | 1 + drivers/video/fbdev/matrox/matroxfb_base.c | 2 +- drivers/video/fbdev/mb862xx/mb862xxfb_accel.c | 16 +- drivers/video/fbdev/nvidia/nvidia.c | 27 +- drivers/video/fbdev/omap2/dss/display.c | 8 +- drivers/video/fbdev/s1d13xxxfb.c | 6 +- drivers/video/fbdev/smscufx.c | 4 +- drivers/video/fbdev/udlfb.c | 36 +- drivers/video/fbdev/uvesafb.c | 52 +- drivers/video/fbdev/vesafb.c | 58 +- drivers/video/fbdev/via/via_clock.h | 2 +- drivers/xen/events/events_base.c | 6 +- drivers/xen/evtchn.c | 4 +- fs/Kconfig.binfmt | 2 +- fs/afs/inode.c | 4 +- fs/aio.c | 2 +- fs/autofs4/waitq.c | 2 +- fs/befs/endian.h | 6 +- fs/binfmt_aout.c | 23 +- fs/binfmt_elf.c | 670 +- fs/binfmt_elf_fdpic.c | 4 +- fs/block_dev.c | 2 +- fs/btrfs/ctree.c | 9 +- fs/btrfs/delayed-inode.c | 9 +- fs/btrfs/delayed-inode.h | 6 +- fs/btrfs/file.c | 10 +- fs/btrfs/inode.c | 14 +- fs/btrfs/super.c | 2 +- fs/btrfs/sysfs.c | 2 +- fs/btrfs/tests/free-space-tests.c | 8 +- fs/btrfs/tree-log.h | 2 +- fs/buffer.c | 2 +- fs/cachefiles/bind.c | 6 +- fs/cachefiles/daemon.c | 8 +- fs/cachefiles/internal.h | 12 +- fs/cachefiles/namei.c | 2 +- fs/cachefiles/proc.c | 12 +- fs/ceph/dir.c | 12 +- fs/ceph/super.c | 4 +- fs/cifs/cifs_debug.c | 12 +- fs/cifs/cifsfs.c | 8 +- fs/cifs/cifsglob.h | 54 +- fs/cifs/file.c | 10 +- fs/cifs/misc.c | 4 +- fs/cifs/smb1ops.c | 80 +- fs/cifs/smb2ops.c | 84 +- fs/cifs/smb2pdu.c | 3 +- fs/coda/cache.c | 10 +- fs/compat.c | 4 +- fs/compat_binfmt_elf.c | 2 + fs/compat_ioctl.c | 12 +- fs/configfs/dir.c | 10 +- fs/coredump.c | 16 +- fs/dcache.c | 51 +- fs/ecryptfs/inode.c | 2 +- fs/ecryptfs/miscdev.c | 2 +- fs/exec.c | 362 +- fs/ext2/xattr.c | 5 +- fs/ext4/ext4.h | 20 +- fs/ext4/mballoc.c | 44 +- fs/ext4/resize.c | 16 +- fs/ext4/super.c | 4 +- fs/ext4/xattr.c | 5 +- fs/fhandle.c | 3 +- fs/file.c | 4 +- fs/fs_struct.c | 8 +- fs/fscache/cookie.c | 40 +- fs/fscache/internal.h | 202 +- fs/fscache/object.c | 26 +- fs/fscache/operation.c | 38 +- fs/fscache/page.c | 110 +- fs/fscache/stats.c | 348 +- fs/fuse/cuse.c | 10 +- fs/fuse/dev.c | 4 +- fs/gfs2/glock.c | 22 +- fs/gfs2/glops.c | 4 +- fs/gfs2/quota.c | 6 +- fs/hugetlbfs/inode.c | 13 +- fs/inode.c | 4 +- fs/jffs2/erase.c | 3 +- fs/jffs2/wbuf.c | 3 +- fs/jfs/super.c | 2 +- fs/kernfs/dir.c | 2 +- fs/kernfs/file.c | 20 +- fs/libfs.c | 10 +- fs/lockd/clntproc.c | 4 +- fs/namei.c | 16 +- fs/namespace.c | 16 +- fs/nfs/callback_xdr.c | 2 +- fs/nfs/inode.c | 6 +- fs/nfsd/nfs4proc.c | 2 +- fs/nfsd/nfs4xdr.c | 2 +- fs/nfsd/nfscache.c | 11 +- fs/nfsd/vfs.c | 6 +- fs/nls/nls_base.c | 26 +- fs/nls/nls_euc-jp.c | 6 +- fs/nls/nls_koi8-ru.c | 6 +- fs/notify/fanotify/fanotify_user.c | 4 +- fs/notify/notification.c | 4 +- fs/ntfs/dir.c | 2 +- fs/ntfs/super.c | 6 +- fs/ocfs2/localalloc.c | 2 +- fs/ocfs2/ocfs2.h | 10 +- fs/ocfs2/suballoc.c | 12 +- fs/ocfs2/super.c | 20 +- fs/pipe.c | 72 +- fs/posix_acl.c | 4 +- fs/proc/array.c | 20 + fs/proc/base.c | 4 +- fs/proc/kcore.c | 34 +- fs/proc/meminfo.c | 2 +- fs/proc/nommu.c | 2 +- fs/proc/proc_sysctl.c | 26 +- fs/proc/task_mmu.c | 39 +- fs/proc/task_nommu.c | 4 +- fs/proc/vmcore.c | 16 +- fs/qnx6/qnx6.h | 4 +- fs/quota/netlink.c | 4 +- fs/read_write.c | 2 +- fs/reiserfs/do_balan.c | 2 +- fs/reiserfs/procfs.c | 2 +- fs/reiserfs/reiserfs.h | 4 +- fs/seq_file.c | 4 +- fs/splice.c | 43 +- fs/squashfs/xattr.c | 12 +- fs/sysv/sysv.h | 2 +- fs/tracefs/inode.c | 8 +- fs/udf/misc.c | 2 +- fs/ufs/swab.h | 4 +- fs/userfaultfd.c | 2 +- fs/xattr.c | 21 + fs/xfs/libxfs/xfs_bmap.c | 2 +- fs/xfs/xfs_dir2_readdir.c | 7 +- fs/xfs/xfs_ioctl.c | 2 +- fs/xfs/xfs_linux.h | 4 +- include/asm-generic/4level-fixup.h | 2 + include/asm-generic/atomic-long.h | 156 +- include/asm-generic/atomic64.h | 12 + include/asm-generic/bitops/__fls.h | 2 +- include/asm-generic/bitops/fls.h | 2 +- include/asm-generic/bitops/fls64.h | 4 +- include/asm-generic/bug.h | 6 +- include/asm-generic/cache.h | 4 +- include/asm-generic/emergency-restart.h | 2 +- include/asm-generic/kmap_types.h | 4 +- include/asm-generic/local.h | 13 + include/asm-generic/pgtable-nopmd.h | 18 +- include/asm-generic/pgtable-nopud.h | 15 +- include/asm-generic/pgtable.h | 16 + include/asm-generic/sections.h | 1 + include/asm-generic/uaccess.h | 16 + include/asm-generic/vmlinux.lds.h | 15 +- include/crypto/algapi.h | 2 +- include/drm/drmP.h | 16 +- include/drm/drm_crtc_helper.h | 2 +- include/drm/drm_mm.h | 2 +- include/drm/i915_pciids.h | 2 +- include/drm/intel-gtt.h | 4 +- include/drm/ttm/ttm_memory.h | 2 +- include/drm/ttm/ttm_page_alloc.h | 1 + include/keys/asymmetric-subtype.h | 2 +- include/linux/atmdev.h | 4 +- include/linux/atomic.h | 17 +- include/linux/audit.h | 2 +- include/linux/average.h | 2 +- include/linux/binfmts.h | 3 +- include/linux/bitmap.h | 2 +- include/linux/bitops.h | 8 +- include/linux/blkdev.h | 2 +- include/linux/blktrace_api.h | 2 +- include/linux/cache.h | 8 + include/linux/cdrom.h | 1 - include/linux/cleancache.h | 2 +- include/linux/clk-provider.h | 1 + include/linux/compat.h | 6 +- include/linux/compiler-gcc.h | 28 +- include/linux/compiler.h | 157 +- include/linux/configfs.h | 2 +- include/linux/cpufreq.h | 3 +- include/linux/cpuidle.h | 5 +- include/linux/cpumask.h | 14 +- include/linux/crypto.h | 4 +- include/linux/ctype.h | 2 +- include/linux/dcache.h | 4 +- include/linux/decompress/mm.h | 2 +- include/linux/devfreq.h | 2 +- include/linux/device.h | 7 +- include/linux/dma-mapping.h | 2 +- include/linux/efi.h | 1 + include/linux/elf.h | 2 + include/linux/err.h | 4 +- include/linux/extcon.h | 2 +- include/linux/fb.h | 3 +- include/linux/fdtable.h | 2 +- include/linux/fs.h | 5 +- include/linux/fs_struct.h | 2 +- include/linux/fscache-cache.h | 2 +- include/linux/fscache.h | 2 +- include/linux/fsnotify.h | 2 +- include/linux/genhd.h | 4 +- include/linux/genl_magic_func.h | 2 +- include/linux/gfp.h | 12 +- include/linux/highmem.h | 12 + include/linux/hwmon-sysfs.h | 6 +- include/linux/i2c.h | 1 + include/linux/if_pppox.h | 2 +- include/linux/init.h | 12 +- include/linux/init_task.h | 7 + include/linux/interrupt.h | 6 +- include/linux/iommu.h | 2 +- include/linux/ioport.h | 2 +- include/linux/ipc.h | 2 +- include/linux/irq.h | 5 +- include/linux/irqdesc.h | 2 +- include/linux/irqdomain.h | 3 + include/linux/jiffies.h | 16 +- include/linux/key-type.h | 2 +- include/linux/kgdb.h | 6 +- include/linux/kmemleak.h | 4 +- include/linux/kobject.h | 3 +- include/linux/kobject_ns.h | 2 +- include/linux/kref.h | 2 +- include/linux/libata.h | 2 +- include/linux/linkage.h | 1 + include/linux/list.h | 15 + include/linux/lockref.h | 26 +- include/linux/math64.h | 10 +- include/linux/mempolicy.h | 7 + include/linux/mm.h | 102 +- include/linux/mm_types.h | 20 + include/linux/mmiotrace.h | 4 +- include/linux/mmzone.h | 2 +- include/linux/mod_devicetable.h | 4 +- include/linux/module.h | 69 +- include/linux/moduleloader.h | 16 + include/linux/moduleparam.h | 4 +- include/linux/net.h | 2 +- include/linux/netdevice.h | 7 +- include/linux/netfilter.h | 2 +- include/linux/netfilter/nfnetlink.h | 2 +- include/linux/nls.h | 4 +- include/linux/notifier.h | 3 +- include/linux/oprofile.h | 4 +- include/linux/padata.h | 2 +- include/linux/pci_hotplug.h | 3 +- include/linux/percpu.h | 2 +- include/linux/perf_event.h | 12 +- include/linux/pipe_fs_i.h | 8 +- include/linux/pm.h | 1 + include/linux/pm_domain.h | 4 +- include/linux/pm_runtime.h | 2 +- include/linux/pnp.h | 2 +- include/linux/poison.h | 4 +- include/linux/power/smartreflex.h | 2 +- include/linux/ppp-comp.h | 2 +- include/linux/preempt.h | 21 + include/linux/proc_ns.h | 2 +- include/linux/psci.h | 2 +- include/linux/quota.h | 2 +- include/linux/random.h | 19 +- include/linux/rculist.h | 16 + include/linux/reboot.h | 14 +- include/linux/regset.h | 3 +- include/linux/relay.h | 2 +- include/linux/rio.h | 2 +- include/linux/rmap.h | 4 +- include/linux/sched.h | 72 +- include/linux/sched/sysctl.h | 1 + include/linux/semaphore.h | 2 +- include/linux/seq_file.h | 1 + include/linux/signal.h | 2 +- include/linux/skbuff.h | 12 +- include/linux/slab.h | 47 +- include/linux/slab_def.h | 14 +- include/linux/slub_def.h | 2 +- include/linux/smp.h | 2 + include/linux/sock_diag.h | 2 +- include/linux/sonet.h | 2 +- include/linux/sunrpc/addr.h | 8 +- include/linux/sunrpc/clnt.h | 2 +- include/linux/sunrpc/svc.h | 2 +- include/linux/sunrpc/svc_rdma.h | 18 +- include/linux/sunrpc/svcauth.h | 2 +- include/linux/swapops.h | 10 +- include/linux/swiotlb.h | 3 +- include/linux/syscalls.h | 21 +- include/linux/syscore_ops.h | 2 +- include/linux/sysctl.h | 3 +- include/linux/sysfs.h | 9 +- include/linux/sysrq.h | 3 +- include/linux/tcp.h | 14 +- include/linux/thread_info.h | 7 + include/linux/tty.h | 4 +- include/linux/tty_driver.h | 2 +- include/linux/tty_ldisc.h | 2 +- include/linux/types.h | 16 + include/linux/uaccess.h | 6 +- include/linux/uio_driver.h | 2 +- include/linux/unaligned/access_ok.h | 24 +- include/linux/usb.h | 12 +- include/linux/usb/hcd.h | 1 + include/linux/usb/renesas_usbhs.h | 2 +- include/linux/vermagic.h | 21 +- include/linux/vga_switcheroo.h | 8 +- include/linux/vmalloc.h | 7 +- include/linux/vmstat.h | 24 +- include/linux/xattr.h | 5 +- include/linux/zlib.h | 3 +- include/media/v4l2-dev.h | 2 +- include/media/v4l2-device.h | 2 +- include/net/9p/transport.h | 2 +- include/net/bluetooth/l2cap.h | 2 +- include/net/bonding.h | 2 +- include/net/caif/cfctrl.h | 6 +- include/net/flow.h | 2 +- include/net/genetlink.h | 2 +- include/net/gro_cells.h | 2 +- include/net/inet_connection_sock.h | 2 +- include/net/inet_sock.h | 2 +- include/net/inetpeer.h | 2 +- include/net/ip_fib.h | 2 +- include/net/ip_vs.h | 8 +- include/net/ipv6.h | 2 +- include/net/irda/ircomm_tty.h | 1 + include/net/iucv/af_iucv.h | 2 +- include/net/llc_c_ac.h | 2 +- include/net/llc_c_ev.h | 4 +- include/net/llc_c_st.h | 2 +- include/net/llc_s_ac.h | 2 +- include/net/llc_s_st.h | 2 +- include/net/mac80211.h | 4 +- include/net/neighbour.h | 2 +- include/net/net_namespace.h | 18 +- include/net/netlink.h | 2 +- include/net/netns/conntrack.h | 6 +- include/net/netns/ipv4.h | 4 +- include/net/netns/ipv6.h | 4 +- include/net/netns/xfrm.h | 2 +- include/net/ping.h | 2 +- include/net/protocol.h | 4 +- include/net/rtnetlink.h | 2 +- include/net/sctp/checksum.h | 4 +- include/net/sctp/sm.h | 4 +- include/net/sctp/structs.h | 2 +- include/net/sock.h | 12 +- include/net/tcp.h | 8 +- include/net/xfrm.h | 13 +- include/rdma/iw_cm.h | 2 +- include/scsi/libfc.h | 3 +- include/scsi/scsi_device.h | 6 +- include/scsi/scsi_driver.h | 2 +- include/scsi/scsi_transport_fc.h | 3 +- include/scsi/sg.h | 2 +- include/sound/compress_driver.h | 2 +- include/sound/soc.h | 4 +- include/trace/events/irq.h | 4 +- include/uapi/linux/a.out.h | 8 + include/uapi/linux/bcache.h | 5 +- include/uapi/linux/byteorder/little_endian.h | 28 +- include/uapi/linux/connector.h | 2 +- include/uapi/linux/elf.h | 28 + include/uapi/linux/screen_info.h | 3 +- include/uapi/linux/swab.h | 6 +- include/uapi/linux/xattr.h | 4 + include/video/udlfb.h | 8 +- include/video/uvesafb.h | 1 + init/Kconfig | 2 +- init/Makefile | 3 + init/do_mounts.c | 14 +- init/do_mounts.h | 8 +- init/do_mounts_initrd.c | 30 +- init/do_mounts_md.c | 6 +- init/init_task.c | 4 + init/initramfs.c | 38 +- init/main.c | 30 +- ipc/compat.c | 4 +- ipc/ipc_sysctl.c | 8 +- ipc/mq_sysctl.c | 4 +- ipc/sem.c | 4 +- ipc/shm.c | 6 + kernel/audit.c | 8 +- kernel/auditsc.c | 4 +- kernel/bpf/core.c | 7 +- kernel/capability.c | 3 + kernel/compat.c | 38 +- kernel/debug/debug_core.c | 16 +- kernel/debug/kdb/kdb_main.c | 4 +- kernel/events/core.c | 26 +- kernel/events/internal.h | 10 +- kernel/events/uprobes.c | 2 +- kernel/exit.c | 2 +- kernel/fork.c | 167 +- kernel/futex.c | 11 +- kernel/futex_compat.c | 2 +- kernel/gcov/base.c | 7 +- kernel/irq/manage.c | 2 +- kernel/irq/msi.c | 19 +- kernel/irq/spurious.c | 2 +- kernel/jump_label.c | 5 + kernel/kallsyms.c | 37 +- kernel/kexec.c | 3 +- kernel/kmod.c | 8 +- kernel/kprobes.c | 4 +- kernel/ksysfs.c | 2 +- kernel/locking/lockdep.c | 7 +- kernel/locking/mutex-debug.c | 12 +- kernel/locking/mutex-debug.h | 4 +- kernel/locking/mutex.c | 6 +- kernel/module.c | 422 +- kernel/notifier.c | 17 +- kernel/padata.c | 4 +- kernel/panic.c | 5 +- kernel/pid.c | 2 +- kernel/pid_namespace.c | 2 +- kernel/power/process.c | 12 +- kernel/profile.c | 14 +- kernel/ptrace.c | 8 +- kernel/rcu/rcutorture.c | 60 +- kernel/rcu/tiny.c | 4 +- kernel/rcu/tree.c | 44 +- kernel/rcu/tree.h | 14 +- kernel/rcu/tree_plugin.h | 14 +- kernel/rcu/tree_trace.c | 12 +- kernel/sched/auto_group.c | 4 +- kernel/sched/core.c | 45 +- kernel/sched/fair.c | 2 +- kernel/sched/sched.h | 2 +- kernel/signal.c | 12 +- kernel/smpboot.c | 4 +- kernel/softirq.c | 12 +- kernel/sys.c | 10 +- kernel/sysctl.c | 34 +- kernel/time/alarmtimer.c | 2 +- kernel/time/posix-cpu-timers.c | 4 +- kernel/time/posix-timers.c | 24 +- kernel/time/timer.c | 2 +- kernel/time/timer_stats.c | 10 +- kernel/trace/blktrace.c | 6 +- kernel/trace/ftrace.c | 15 +- kernel/trace/ring_buffer.c | 96 +- kernel/trace/trace.c | 2 +- kernel/trace/trace.h | 2 +- kernel/trace/trace_clock.c | 4 +- kernel/trace/trace_events.c | 1 - kernel/trace/trace_functions_graph.c | 4 +- kernel/trace/trace_mmiotrace.c | 8 +- kernel/trace/trace_output.c | 10 +- kernel/trace/trace_seq.c | 2 +- kernel/trace/trace_stack.c | 2 +- kernel/user_namespace.c | 2 +- kernel/utsname_sysctl.c | 2 +- kernel/watchdog.c | 2 +- kernel/workqueue.c | 2 +- lib/Kconfig.debug | 8 +- lib/Makefile | 2 +- lib/bitmap.c | 8 +- lib/bug.c | 2 + lib/debugobjects.c | 2 +- lib/decompress_bunzip2.c | 3 +- lib/decompress_unlzma.c | 4 +- lib/div64.c | 4 +- lib/dma-debug.c | 4 +- lib/inflate.c | 2 +- lib/ioremap.c | 4 +- lib/kobject.c | 4 +- lib/list_debug.c | 126 +- lib/lockref.c | 44 +- lib/percpu-refcount.c | 2 +- lib/radix-tree.c | 2 +- lib/random32.c | 2 +- lib/show_mem.c | 2 +- lib/strncpy_from_user.c | 2 +- lib/strnlen_user.c | 2 +- lib/swiotlb.c | 2 +- lib/usercopy.c | 6 + lib/vsprintf.c | 12 +- mm/Kconfig | 6 +- mm/backing-dev.c | 4 +- mm/debug.c | 3 + mm/filemap.c | 2 +- mm/gup.c | 13 +- mm/highmem.c | 6 +- mm/hugetlb.c | 70 +- mm/internal.h | 1 + mm/maccess.c | 4 +- mm/madvise.c | 37 + mm/memory-failure.c | 6 +- mm/memory.c | 424 +- mm/mempolicy.c | 25 + mm/mlock.c | 15 +- mm/mm_init.c | 2 +- mm/mmap.c | 582 +- mm/mprotect.c | 137 +- mm/mremap.c | 39 +- mm/nommu.c | 21 +- mm/page-writeback.c | 2 +- mm/page_alloc.c | 49 +- mm/percpu.c | 2 +- mm/process_vm_access.c | 14 +- mm/rmap.c | 45 +- mm/shmem.c | 19 +- mm/slab.c | 109 +- mm/slab.h | 22 +- mm/slab_common.c | 86 +- mm/slob.c | 218 +- mm/slub.c | 102 +- mm/sparse-vmemmap.c | 4 +- mm/sparse.c | 2 +- mm/swap.c | 2 + mm/swapfile.c | 12 +- mm/util.c | 6 + mm/vmalloc.c | 114 +- mm/vmstat.c | 12 +- net/8021q/vlan.c | 5 +- net/8021q/vlan_netlink.c | 2 +- net/9p/mod.c | 4 +- net/9p/trans_fd.c | 2 +- net/atm/atm_misc.c | 8 +- net/atm/lec.h | 2 +- net/atm/proc.c | 6 +- net/atm/resources.c | 4 +- net/ax25/sysctl_net_ax25.c | 2 +- net/batman-adv/bat_iv_ogm.c | 8 +- net/batman-adv/fragmentation.c | 2 +- net/batman-adv/soft-interface.c | 8 +- net/batman-adv/types.h | 6 +- net/bluetooth/hci_sock.c | 2 +- net/bluetooth/l2cap_core.c | 6 +- net/bluetooth/l2cap_sock.c | 12 +- net/bluetooth/rfcomm/sock.c | 4 +- net/bluetooth/rfcomm/tty.c | 4 +- net/bridge/br_netlink.c | 2 +- net/bridge/netfilter/ebtables.c | 6 +- net/caif/cfctrl.c | 11 +- net/caif/chnl_net.c | 2 +- net/can/af_can.c | 2 +- net/can/gw.c | 6 +- net/ceph/messenger.c | 4 +- net/compat.c | 24 +- net/core/datagram.c | 2 +- net/core/dev.c | 16 +- net/core/filter.c | 2 +- net/core/flow.c | 6 +- net/core/neighbour.c | 4 +- net/core/net-sysfs.c | 2 +- net/core/net_namespace.c | 8 +- net/core/netpoll.c | 4 +- net/core/rtnetlink.c | 15 +- net/core/scm.c | 14 +- net/core/skbuff.c | 8 +- net/core/sock.c | 28 +- net/core/sock_diag.c | 15 +- net/core/sysctl_net_core.c | 22 +- net/decnet/af_decnet.c | 1 + net/decnet/sysctl_net_decnet.c | 4 +- net/dsa/dsa.c | 2 +- net/hsr/hsr_netlink.c | 2 +- net/ieee802154/6lowpan/core.c | 2 +- net/ieee802154/6lowpan/reassembly.c | 14 +- net/ipv4/af_inet.c | 2 +- net/ipv4/devinet.c | 18 +- net/ipv4/fib_frontend.c | 6 +- net/ipv4/fib_semantics.c | 2 +- net/ipv4/inet_connection_sock.c | 4 +- net/ipv4/inet_timewait_sock.c | 2 +- net/ipv4/inetpeer.c | 2 +- net/ipv4/ip_fragment.c | 15 +- net/ipv4/ip_gre.c | 6 +- net/ipv4/ip_sockglue.c | 2 +- net/ipv4/ip_vti.c | 4 +- net/ipv4/ipconfig.c | 6 +- net/ipv4/ipip.c | 4 +- net/ipv4/netfilter/arp_tables.c | 12 +- net/ipv4/netfilter/ip_tables.c | 12 +- net/ipv4/ping.c | 14 +- net/ipv4/raw.c | 14 +- net/ipv4/route.c | 32 +- net/ipv4/sysctl_net_ipv4.c | 22 +- net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_probe.c | 2 +- net/ipv4/udp.c | 10 +- net/ipv4/xfrm4_policy.c | 18 +- net/ipv6/addrconf.c | 18 +- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/icmp.c | 2 +- net/ipv6/ip6_fib.c | 4 +- net/ipv6/ip6_gre.c | 10 +- net/ipv6/ip6_tunnel.c | 4 +- net/ipv6/ip6_vti.c | 4 +- net/ipv6/ipv6_sockglue.c | 2 +- net/ipv6/netfilter/ip6_tables.c | 12 +- net/ipv6/netfilter/nf_conntrack_reasm.c | 14 +- net/ipv6/ping.c | 33 +- net/ipv6/raw.c | 17 +- net/ipv6/reassembly.c | 13 +- net/ipv6/route.c | 2 +- net/ipv6/sit.c | 4 +- net/ipv6/sysctl_net_ipv6.c | 2 +- net/ipv6/udp.c | 6 +- net/ipv6/xfrm6_policy.c | 17 +- net/irda/ircomm/ircomm_tty.c | 18 +- net/iucv/af_iucv.c | 4 +- net/iucv/iucv.c | 2 +- net/key/af_key.c | 4 +- net/l2tp/l2tp_eth.c | 38 +- net/l2tp/l2tp_ip.c | 2 +- net/l2tp/l2tp_ip6.c | 2 +- net/mac80211/cfg.c | 8 +- net/mac80211/ieee80211_i.h | 3 +- net/mac80211/iface.c | 20 +- net/mac80211/main.c | 2 +- net/mac80211/pm.c | 4 +- net/mac80211/rate.c | 2 +- net/mac80211/sta_info.c | 2 +- net/mac80211/util.c | 8 +- net/mpls/af_mpls.c | 6 +- net/netfilter/ipset/ip_set_core.c | 2 +- net/netfilter/ipvs/ip_vs_conn.c | 6 +- net/netfilter/ipvs/ip_vs_core.c | 4 +- net/netfilter/ipvs/ip_vs_ctl.c | 14 +- net/netfilter/ipvs/ip_vs_lblc.c | 2 +- net/netfilter/ipvs/ip_vs_lblcr.c | 2 +- net/netfilter/ipvs/ip_vs_sync.c | 6 +- net/netfilter/ipvs/ip_vs_xmit.c | 4 +- net/netfilter/nf_conntrack_acct.c | 2 +- net/netfilter/nf_conntrack_ecache.c | 2 +- net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_proto.c | 2 +- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_conntrack_timestamp.c | 2 +- net/netfilter/nf_log.c | 10 +- net/netfilter/nf_sockopt.c | 4 +- net/netfilter/nfnetlink_log.c | 4 +- net/netfilter/nft_compat.c | 9 +- net/netfilter/xt_statistic.c | 8 +- net/netlink/af_netlink.c | 4 +- net/openvswitch/vport-internal_dev.c | 2 +- net/packet/af_packet.c | 8 +- net/phonet/pep.c | 6 +- net/phonet/socket.c | 2 +- net/phonet/sysctl.c | 2 +- net/rds/cong.c | 6 +- net/rds/ib.h | 2 +- net/rds/ib_cm.c | 2 +- net/rds/ib_recv.c | 4 +- net/rds/iw.h | 2 +- net/rds/iw_cm.c | 2 +- net/rds/iw_recv.c | 4 +- net/rds/rds.h | 2 +- net/rds/tcp.c | 2 +- net/rds/tcp_send.c | 2 +- net/rxrpc/af_rxrpc.c | 2 +- net/rxrpc/ar-ack.c | 14 +- net/rxrpc/ar-call.c | 2 +- net/rxrpc/ar-connection.c | 2 +- net/rxrpc/ar-connevent.c | 2 +- net/rxrpc/ar-input.c | 4 +- net/rxrpc/ar-internal.h | 8 +- net/rxrpc/ar-local.c | 2 +- net/rxrpc/ar-output.c | 4 +- net/rxrpc/ar-peer.c | 2 +- net/rxrpc/ar-proc.c | 4 +- net/rxrpc/ar-transport.c | 2 +- net/rxrpc/rxkad.c | 4 +- net/sched/sch_generic.c | 4 +- net/sctp/ipv6.c | 6 +- net/sctp/protocol.c | 10 +- net/sctp/sm_sideeffect.c | 2 +- net/sctp/socket.c | 21 +- net/sctp/sysctl.c | 10 +- net/socket.c | 18 +- net/sunrpc/auth_gss/svcauth_gss.c | 4 +- net/sunrpc/clnt.c | 4 +- net/sunrpc/sched.c | 4 +- net/sunrpc/svc.c | 4 +- net/sunrpc/svcauth_unix.c | 2 +- net/sunrpc/xprtrdma/svc_rdma.c | 38 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 +- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 2 +- net/sunrpc/xprtrdma/svc_rdma_transport.c | 10 +- net/tipc/netlink_compat.c | 12 +- net/tipc/subscr.c | 2 +- net/unix/af_unix.c | 7 +- net/unix/sysctl_net_unix.c | 2 +- net/wireless/wext-core.c | 19 +- net/xfrm/xfrm_policy.c | 16 +- net/xfrm/xfrm_state.c | 33 +- net/xfrm/xfrm_sysctl.c | 2 +- scripts/Kbuild.include | 2 +- scripts/Makefile.build | 2 +- scripts/Makefile.clean | 3 +- scripts/Makefile.host | 69 +- scripts/basic/fixdep.c | 12 +- scripts/dtc/checks.c | 14 +- scripts/dtc/data.c | 6 +- scripts/dtc/flattree.c | 8 +- scripts/dtc/livetree.c | 4 +- scripts/gcc-plugin.sh | 51 + scripts/headers_install.sh | 1 + scripts/kallsyms.c | 4 +- scripts/kconfig/lkc.h | 5 +- scripts/kconfig/menu.c | 2 +- scripts/kconfig/symbol.c | 6 +- scripts/link-vmlinux.sh | 2 +- scripts/mod/file2alias.c | 14 +- scripts/mod/modpost.c | 25 +- scripts/mod/modpost.h | 6 +- scripts/mod/sumversion.c | 2 +- scripts/module-common.lds | 4 + scripts/package/builddeb | 1 + scripts/pnmtologo.c | 6 +- scripts/sortextable.h | 6 +- scripts/tags.sh | 2 +- security/Kconfig | 692 +- security/integrity/ima/ima.h | 4 +- security/integrity/ima/ima_api.c | 2 +- security/integrity/ima/ima_fs.c | 4 +- security/integrity/ima/ima_queue.c | 2 +- security/keys/key.c | 18 +- security/selinux/avc.c | 6 +- security/selinux/include/xfrm.h | 2 +- security/yama/yama_lsm.c | 2 +- sound/aoa/codecs/onyx.c | 7 +- sound/aoa/codecs/onyx.h | 1 + sound/core/oss/pcm_oss.c | 18 +- sound/core/pcm_compat.c | 2 +- sound/core/pcm_native.c | 4 +- sound/core/sound.c | 2 +- sound/drivers/mts64.c | 14 +- sound/drivers/opl4/opl4_lib.c | 2 +- sound/drivers/portman2x4.c | 3 +- sound/firewire/amdtp.c | 4 +- sound/firewire/amdtp.h | 4 +- sound/firewire/isight.c | 10 +- sound/firewire/scs1x.c | 8 +- sound/oss/sb_audio.c | 2 +- sound/oss/swarm_cs4297a.c | 6 +- sound/pci/hda/hda_codec.c | 2 +- sound/pci/ymfpci/ymfpci.h | 2 +- sound/pci/ymfpci/ymfpci_main.c | 12 +- sound/soc/codecs/sti-sas.c | 10 +- sound/soc/soc-ac97.c | 6 +- sound/soc/xtensa/xtfpga-i2s.c | 2 +- tools/gcc/Makefile | 42 + tools/gcc/checker_plugin.c | 150 + tools/gcc/colorize_plugin.c | 215 + tools/gcc/constify_plugin.c | 571 + tools/gcc/gcc-common.h | 812 + tools/gcc/initify_plugin.c | 552 + tools/gcc/kallocstat_plugin.c | 188 + tools/gcc/kernexec_plugin.c | 549 + tools/gcc/latent_entropy_plugin.c | 470 + tools/gcc/size_overflow_plugin/.gitignore | 2 + tools/gcc/size_overflow_plugin/Makefile | 28 + .../disable_size_overflow_hash.data |12422 ++++++++++++ .../generate_size_overflow_hash.sh | 103 + .../insert_size_overflow_asm.c | 416 + .../size_overflow_plugin/intentional_overflow.c | 1010 + .../size_overflow_plugin/remove_unnecessary_dup.c | 137 + tools/gcc/size_overflow_plugin/size_overflow.h | 323 + .../gcc/size_overflow_plugin/size_overflow_debug.c | 194 + .../size_overflow_plugin/size_overflow_hash.data |20735 ++++++++++++++++++++ .../size_overflow_hash_aux.data | 92 + tools/gcc/size_overflow_plugin/size_overflow_ipa.c | 1226 ++ .../gcc/size_overflow_plugin/size_overflow_misc.c | 505 + .../size_overflow_plugin/size_overflow_plugin.c | 318 + .../size_overflow_plugin_hash.c | 352 + .../size_overflow_plugin/size_overflow_transform.c | 749 + .../size_overflow_transform_core.c | 1010 + tools/gcc/stackleak_plugin.c | 436 + tools/gcc/structleak_plugin.c | 287 + tools/include/linux/compiler.h | 8 + tools/lib/api/Makefile | 2 +- tools/perf/util/include/asm/alternative-asm.h | 3 + tools/virtio/linux/uaccess.h | 2 +- virt/kvm/kvm_main.c | 42 +- 1944 files changed, 66925 insertions(+), 8949 deletions(-)