--- /dev/null
+From dbdb22754fde671dc93d2fae06f8be113d47f2fb Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Fri, 9 May 2014 10:49:03 +0200
+Subject: sched: Disallow sched_attr::sched_policy < 0
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit dbdb22754fde671dc93d2fae06f8be113d47f2fb upstream.
+
+The scheduler uses policy=-1 to preserve the current policy state to
+implement sys_sched_setparam(), this got exposed to userspace by
+accident through sys_sched_setattr(), cure this.
+
+Reported-by: Michael Kerrisk <mtk.manpages@gmail.com>
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+Acked-by: Michael Kerrisk <mtk.manpages@gmail.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: http://lkml.kernel.org/r/20140509085311.GJ30445@twins.programming.kicks-ass.net
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/sched/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -3683,6 +3683,9 @@ SYSCALL_DEFINE3(sched_setattr, pid_t, pi
+ if (sched_copy_attr(uattr, &attr))
+ return -EFAULT;
+
++ if (attr.sched_policy < 0)
++ return -EINVAL;
++
+ rcu_read_lock();
+ retval = -ESRCH;
+ p = find_process_by_pid(pid);
--- /dev/null
+From 143cf23df25b7082cd706c3c53188e741e7881c3 Mon Sep 17 00:00:00 2001
+From: Michael Kerrisk <mtk.manpages@gmail.com>
+Date: Fri, 9 May 2014 16:54:15 +0200
+Subject: sched: Make sched_setattr() correctly return -EFBIG
+
+From: Michael Kerrisk <mtk.manpages@gmail.com>
+
+commit 143cf23df25b7082cd706c3c53188e741e7881c3 upstream.
+
+The documented[1] behavior of sched_attr() in the proposed man page text is:
+
+ sched_attr::size must be set to the size of the structure, as in
+ sizeof(struct sched_attr), if the provided structure is smaller
+ than the kernel structure, any additional fields are assumed
+ '0'. If the provided structure is larger than the kernel structure,
+ the kernel verifies all additional fields are '0' if not the
+ syscall will fail with -E2BIG.
+
+As currently implemented, sched_copy_attr() returns -EFBIG for
+for this case, but the logic in sys_sched_setattr() converts that
+error to -EFAULT. This patch fixes the behavior.
+
+[1] http://thread.gmane.org/gmane.linux.kernel/1615615/focus=1697760
+
+Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: http://lkml.kernel.org/r/536CEC17.9070903@gmail.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/sched/core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -3680,8 +3680,9 @@ SYSCALL_DEFINE3(sched_setattr, pid_t, pi
+ if (!uattr || pid < 0 || flags)
+ return -EINVAL;
+
+- if (sched_copy_attr(uattr, &attr))
+- return -EFAULT;
++ retval = sched_copy_attr(uattr, &attr);
++ if (retval)
++ return retval;
+
+ if (attr.sched_policy < 0)
+ return -EINVAL;