[gentoo-commits] proj/hardened-patchset:master commit in: 3.2.45/, 2.6.32/, 3.9.4/

[Anthony G. Basile]

commit:     eda95dd2718f4d0606694398aaaf1fd652b5f712
Author:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Sun Jun  2 19:19:23 2013 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Sun Jun  2 19:19:23 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=eda95dd2

Grsec/PaX: 2.9.1-{2.6.32.60,3.2.45,3.9.4}-201306011536

---
 2.6.32/0000_README                                 |   2 +-
 ..._grsecurity-2.9.1-2.6.32.60-201306011535.patch} |  26 +-
 3.2.45/0000_README                                 |   2 +-
 ...420_grsecurity-2.9.1-3.2.46-201306011535.patch} | 350 +++++++++------------
 3.9.4/0000_README                                  |   2 +-
 ...4420_grsecurity-2.9.1-3.9.4-201306011536.patch} |  61 +++-
 6 files changed, 224 insertions(+), 219 deletions(-)

diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 1fce241..4edfd58 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -34,7 +34,7 @@ Patch:	1059_linux-2.6.32.60.patch
 From:	http://www.kernel.org
 Desc:	Linux 2.6.32.59
 
-Patch:	4420_grsecurity-2.9.1-2.6.32.60-201305301924.patch
+Patch:	4420_grsecurity-2.9.1-2.6.32.60-201306011535.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201305301924.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201306011535.patch
similarity index 99%
rename from 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201305301924.patch
rename to 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201306011535.patch
index 220fd66..eb29409 100644
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201305301924.patch
+++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201306011535.patch
@@ -71445,6 +71445,20 @@ index e941367..b631f5a 100644
  
  	ret = uio_get_minor(idev);
  	if (ret)
+diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
+index 56802d2..420c771 100644
+--- a/drivers/usb/atm/cxacru.c
++++ b/drivers/usb/atm/cxacru.c
+@@ -580,7 +580,8 @@ static int cxacru_cm_get_array(struct cxacru_data *instance, enum cxacru_cm_requ
+ {
+ 	int ret, len;
+ 	__le32 *buf;
+-	int offb, offd;
++	int offb;
++	unsigned int offd;
+ 	const int stride = CMD_PACKET_SIZE / (4 * 2) - 1;
+ 	int buflen =  ((size - 1) / stride + 1 + size * 2) * 4;
+ 
 diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
 index fbea856..06efea6 100644
 --- a/drivers/usb/atm/usbatm.c
@@ -111118,7 +111132,7 @@ index aaca868..2ebecdc 100644
  		err = -EPERM;
  		goto out;
 diff --git a/mm/mlock.c b/mm/mlock.c
-index 2d846cf..8d5cdd8 100644
+index 2d846cf..ca1e492 100644
 --- a/mm/mlock.c
 +++ b/mm/mlock.c
 @@ -13,6 +13,7 @@
@@ -111195,7 +111209,7 @@ index 2d846cf..8d5cdd8 100644
  	if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
  		error = do_mlock(start, len, 1);
  	up_write(&current->mm->mmap_sem);
-@@ -528,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
+@@ -528,16 +525,21 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
  static int do_mlockall(int flags)
  {
  	struct vm_area_struct * vma, * prev = NULL;
@@ -111213,17 +111227,15 @@ index 2d846cf..8d5cdd8 100644
  	for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
 -		unsigned int newflags;
 +		unsigned long newflags;
- 
++
 +#ifdef CONFIG_PAX_SEGMEXEC
 +		if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
 +			break;
 +#endif
-+
-+		BUG_ON(vma->vm_end > TASK_SIZE);
+ 
  		newflags = vma->vm_flags | VM_LOCKED;
  		if (!(flags & MCL_CURRENT))
- 			newflags &= ~VM_LOCKED;
-@@ -570,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
+@@ -570,6 +572,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
  	lock_limit >>= PAGE_SHIFT;
  
  	ret = -ENOMEM;

diff --git a/3.2.45/0000_README b/3.2.45/0000_README
index c1bb1b0..00f8a3a 100644
--- a/3.2.45/0000_README
+++ b/3.2.45/0000_README
@@ -98,7 +98,7 @@ Patch:	1044_linux-3.2.45.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.45
 
-Patch:	4420_grsecurity-2.9.1-3.2.45-201305301925.patch
+Patch:	4420_grsecurity-2.9.1-3.2.46-201306011535.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/3.2.45/4420_grsecurity-2.9.1-3.2.45-201305301925.patch b/3.2.45/4420_grsecurity-2.9.1-3.2.46-201306011535.patch
similarity index 99%
rename from 3.2.45/4420_grsecurity-2.9.1-3.2.45-201305301925.patch
rename to 3.2.45/4420_grsecurity-2.9.1-3.2.46-201306011535.patch
index 4aeabd6..6555c18 100644
--- a/3.2.45/4420_grsecurity-2.9.1-3.2.45-201305301925.patch
+++ b/3.2.45/4420_grsecurity-2.9.1-3.2.46-201306011535.patch
@@ -196,10 +196,10 @@ index dfa6fc6..fad9813 100644
 +zconf.lex.c
  zoffset.h
 diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index 897f223..cbe33de 100644
+index 2ba8272..187c634 100644
 --- a/Documentation/kernel-parameters.txt
 +++ b/Documentation/kernel-parameters.txt
-@@ -853,6 +853,9 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+@@ -859,6 +859,9 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
  	gpt		[EFI] Forces disk with valid GPT signature but
  			invalid Protective MBR to be treated as GPT.
  
@@ -209,7 +209,7 @@ index 897f223..cbe33de 100644
  	hashdist=	[KNL,NUMA] Large hashes allocated during boot
  			are distributed across NUMA nodes.  Defaults on
  			for 64-bit NUMA, off otherwise.
-@@ -1954,6 +1957,18 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+@@ -1960,6 +1963,18 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
  			the specified number of seconds.  This is to be used if
  			your oopses keep scrolling off the screen.
  
@@ -262,7 +262,7 @@ index 88fd7f5..b318a78 100644
  ==============================================================
  
 diff --git a/Makefile b/Makefile
-index 9072fee..85e58c2 100644
+index f600582..30efca3 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -19064,7 +19064,7 @@ index 8c96897..be66bfa 100644
  			return -EPERM;
  	}
 diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
-index 429e0c9..17b3ece 100644
+index fb2eb32..62793bd 100644
 --- a/arch/x86/kernel/irq.c
 +++ b/arch/x86/kernel/irq.c
 @@ -18,7 +18,7 @@
@@ -19088,19 +19088,15 @@ index 429e0c9..17b3ece 100644
  #endif
  	return 0;
  }
-@@ -159,10 +159,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
+@@ -159,7 +159,7 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
  
  u64 arch_irq_stat(void)
  {
 -	u64 sum = atomic_read(&irq_err_count);
 +	u64 sum = atomic_read_unchecked(&irq_err_count);
- 
- #ifdef CONFIG_X86_IO_APIC
--	sum += atomic_read(&irq_mis_count);
-+	sum += atomic_read_unchecked(&irq_mis_count);
- #endif
  	return sum;
  }
+ 
 diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
 index 7209070..cbcd71a 100644
 --- a/arch/x86/kernel/irq_32.c
@@ -22372,7 +22368,7 @@ index 94a4672..5c6b853 100644
  
  	local_irq_disable();
 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 407789b..8bde3e2 100644
+index aac5ea7..266eda9 100644
 --- a/arch/x86/kvm/vmx.c
 +++ b/arch/x86/kvm/vmx.c
 @@ -1099,12 +1099,12 @@ static void vmcs_write64(unsigned long field, u64 value)
@@ -22447,7 +22443,7 @@ index 407789b..8bde3e2 100644
  
  	rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
  	vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
-@@ -6172,6 +6186,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6178,6 +6192,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  		"jmp .Lkvm_vmx_return \n\t"
  		".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
  		".Lkvm_vmx_return: "
@@ -22460,7 +22456,7 @@ index 407789b..8bde3e2 100644
  		/* Save guest registers, load host registers, keep flags */
  		"mov %0, %c[wordsize](%%"R"sp) \n\t"
  		"pop %0 \n\t"
-@@ -6220,6 +6240,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6226,6 +6246,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  #endif
  		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
  		[wordsize]"i"(sizeof(ulong))
@@ -22472,7 +22468,7 @@ index 407789b..8bde3e2 100644
  	      : "cc", "memory"
  		, R"ax", R"bx", R"di", R"si"
  #ifdef CONFIG_X86_64
-@@ -6248,7 +6273,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6254,7 +6279,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  		}
  	}
  
@@ -29528,7 +29524,7 @@ index 153407c..611cba9 100644
 -}
 -__setup("vdso=", vdso_setup);
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 044f5d9..d4e3e58 100644
+index 5189fe8..d937469 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
 @@ -86,8 +86,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -29540,7 +29536,7 @@ index 044f5d9..d4e3e58 100644
  RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
  __read_mostly int xen_have_vector_callback;
  EXPORT_SYMBOL_GPL(xen_have_vector_callback);
-@@ -367,8 +365,7 @@ static void xen_load_gdt(const struct desc_ptr *dtr)
+@@ -382,8 +380,7 @@ static void xen_load_gdt(const struct desc_ptr *dtr)
  {
  	unsigned long va = dtr->address;
  	unsigned int size = dtr->size + 1;
@@ -29550,7 +29546,7 @@ index 044f5d9..d4e3e58 100644
  	int f;
  
  	/*
-@@ -416,8 +413,7 @@ static void __init xen_load_gdt_boot(const struct desc_ptr *dtr)
+@@ -431,8 +428,7 @@ static void __init xen_load_gdt_boot(const struct desc_ptr *dtr)
  {
  	unsigned long va = dtr->address;
  	unsigned int size = dtr->size + 1;
@@ -29560,7 +29556,7 @@ index 044f5d9..d4e3e58 100644
  	int f;
  
  	/*
-@@ -425,7 +421,7 @@ static void __init xen_load_gdt_boot(const struct desc_ptr *dtr)
+@@ -440,7 +436,7 @@ static void __init xen_load_gdt_boot(const struct desc_ptr *dtr)
  	 * 8-byte entries, or 16 4k pages..
  	 */
  
@@ -29569,7 +29565,7 @@ index 044f5d9..d4e3e58 100644
  	BUG_ON(va & ~PAGE_MASK);
  
  	for (f = 0; va < dtr->address + size; va += PAGE_SIZE, f++) {
-@@ -1057,30 +1053,30 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
+@@ -1072,30 +1068,30 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
  #endif
  };
  
@@ -29607,7 +29603,7 @@ index 044f5d9..d4e3e58 100644
  {
  	if (pm_power_off)
  		pm_power_off();
-@@ -1181,7 +1177,17 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1196,7 +1192,17 @@ asmlinkage void __init xen_start_kernel(void)
  	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
  
  	/* Work out if we support NX */
@@ -29626,7 +29622,7 @@ index 044f5d9..d4e3e58 100644
  
  	xen_setup_features();
  
-@@ -1212,13 +1218,6 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1227,13 +1233,6 @@ asmlinkage void __init xen_start_kernel(void)
  
  	machine_ops = xen_machine_ops;
  
@@ -29640,7 +29636,7 @@ index 044f5d9..d4e3e58 100644
  	xen_smp_init();
  
  #ifdef CONFIG_ACPI_NUMA
-@@ -1403,7 +1402,7 @@ static int __cpuinit xen_hvm_cpu_notify(struct notifier_block *self,
+@@ -1418,7 +1417,7 @@ static int __cpuinit xen_hvm_cpu_notify(struct notifier_block *self,
  	return NOTIFY_OK;
  }
  
@@ -31890,7 +31886,7 @@ index af2a250..0fdeb75 100644
  	cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
  		(int)((char *)tl - (char *)reply->tag_list);
 diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
-index 43beaca..32e74a7 100644
+index 13cbdd3..d374957 100644
 --- a/drivers/block/drbd/drbd_receiver.c
 +++ b/drivers/block/drbd/drbd_receiver.c
 @@ -894,7 +894,7 @@ retry:
@@ -31969,7 +31965,7 @@ index 43beaca..32e74a7 100644
  	atomic_inc(&e->epoch->active);
  	spin_unlock(&mdev->epoch_lock);
  
-@@ -3638,7 +3638,7 @@ struct data_cmd {
+@@ -3637,7 +3637,7 @@ struct data_cmd {
  	int expect_payload;
  	size_t pkt_size;
  	drbd_cmd_handler_f function;
@@ -31978,7 +31974,7 @@ index 43beaca..32e74a7 100644
  
  static struct data_cmd drbd_cmd_handler[] = {
  	[P_DATA]	    = { 1, sizeof(struct p_data), receive_Data },
-@@ -3885,7 +3885,7 @@ static void drbd_disconnect(struct drbd_conf *mdev)
+@@ -3884,7 +3884,7 @@ static void drbd_disconnect(struct drbd_conf *mdev)
  	D_ASSERT(list_empty(&mdev->done_ee));
  
  	/* ok, no more ee's on the fly, it is safe to reset the epoch_size */
@@ -31987,7 +31983,7 @@ index 43beaca..32e74a7 100644
  	D_ASSERT(list_empty(&mdev->current_epoch->list));
  }
  
-@@ -4493,7 +4493,7 @@ static int got_skip(struct drbd_conf *mdev, struct p_header80 *h)
+@@ -4492,7 +4492,7 @@ static int got_skip(struct drbd_conf *mdev, struct p_header80 *h)
  struct asender_cmd {
  	size_t pkt_size;
  	int (*process)(struct drbd_conf *mdev, struct p_header80 *h);
@@ -32173,22 +32169,6 @@ index 14d49e4..d331fd8 100644
  		  struct hpet_info *info)
  {
  	struct hpet_timer __iomem *timer;
-diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
-index 3ed20e8..92ce302 100644
---- a/drivers/char/ipmi/ipmi_bt_sm.c
-+++ b/drivers/char/ipmi/ipmi_bt_sm.c
-@@ -95,9 +95,9 @@ struct si_sm_data {
- 	enum bt_states	state;
- 	unsigned char	seq;		/* BT sequence number */
- 	struct si_sm_io	*io;
--	unsigned char	write_data[IPMI_MAX_MSG_LENGTH];
-+	unsigned char	write_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
- 	int		write_count;
--	unsigned char	read_data[IPMI_MAX_MSG_LENGTH];
-+	unsigned char	read_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
- 	int		read_count;
- 	int		truncated;
- 	long		timeout;	/* microseconds countdown */
 diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
 index 58c0e63..46c16bf 100644
 --- a/drivers/char/ipmi/ipmi_msghandler.c
@@ -32432,7 +32412,7 @@ index da3cfee..a5a6606 100644
  
  	*ppos = i;
 diff --git a/drivers/char/random.c b/drivers/char/random.c
-index 8ae9235..788c4ba 100644
+index b651733..788c4ba 100644
 --- a/drivers/char/random.c
 +++ b/drivers/char/random.c
 @@ -269,8 +269,13 @@
@@ -32494,43 +32474,20 @@ index 8ae9235..788c4ba 100644
  
  	/* Hold lock while accounting */
  	spin_lock_irqsave(&r->lock, flags);
-@@ -889,19 +903,25 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
- 	if (r->entropy_count / 8 < min + reserved) {
- 		nbytes = 0;
- 	} else {
-+		int entropy_count, orig;
-+retry:
-+		entropy_count = orig = ACCESS_ONCE(r->entropy_count);
- 		/* If limited, never pull more than available */
--		if (r->limit && nbytes + reserved >= r->entropy_count / 8)
--			nbytes = r->entropy_count/8 - reserved;
-+		if (r->limit && nbytes + reserved >= entropy_count / 8)
-+			nbytes = entropy_count/8 - reserved;
- 
--		if (r->entropy_count / 8 >= nbytes + reserved)
--			r->entropy_count -= nbytes*8;
--		else
--			r->entropy_count = reserved;
--
--		if (r->entropy_count < random_write_wakeup_thresh) {
+@@ -906,10 +920,8 @@ retry:
+ 				goto retry;
+ 		}
+ 
+-		if (entropy_count < random_write_wakeup_thresh) {
 -			wake_up_interruptible(&random_write_wait);
 -			kill_fasync(&fasync, SIGIO, POLL_OUT);
-+		if (entropy_count / 8 >= nbytes + reserved) {
-+			entropy_count -= nbytes*8;
-+			if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
-+				goto retry;
-+		} else {
-+			entropy_count = reserved;
-+			if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
-+				goto retry;
- 		}
-+
+-		}
 +		if (entropy_count < random_write_wakeup_thresh)
 +			wakeup_write = 1;
  	}
  
  	DEBUG_ENT("debiting %d entropy credits from %s%s\n",
-@@ -909,6 +929,11 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
+@@ -917,6 +929,11 @@ retry:
  
  	spin_unlock_irqrestore(&r->lock, flags);
  
@@ -32542,7 +32499,7 @@ index 8ae9235..788c4ba 100644
  	return nbytes;
  }
  
-@@ -978,6 +1003,21 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+@@ -986,6 +1003,21 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
  {
  	ssize_t ret = 0, i;
  	__u8 tmp[EXTRACT_SIZE];
@@ -32564,7 +32521,7 @@ index 8ae9235..788c4ba 100644
  
  	xfer_secondary_pool(r, nbytes);
  	nbytes = account(r, nbytes, min, reserved);
-@@ -986,8 +1026,6 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+@@ -994,8 +1026,6 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
  		extract_buf(r, tmp);
  
  		if (fips_enabled) {
@@ -32573,7 +32530,7 @@ index 8ae9235..788c4ba 100644
  			spin_lock_irqsave(&r->lock, flags);
  			if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
  				panic("Hardware RNG duplicated output!\n");
-@@ -1028,7 +1066,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
+@@ -1036,7 +1066,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
  
  		extract_buf(r, tmp);
  		i = min_t(int, nbytes, EXTRACT_SIZE);
@@ -32582,7 +32539,7 @@ index 8ae9235..788c4ba 100644
  			ret = -EFAULT;
  			break;
  		}
-@@ -1105,6 +1143,7 @@ static void init_std_data(struct entropy_store *r)
+@@ -1113,6 +1143,7 @@ static void init_std_data(struct entropy_store *r)
  
  	r->entropy_count = 0;
  	r->entropy_total = 0;
@@ -32590,7 +32547,7 @@ index 8ae9235..788c4ba 100644
  	mix_pool_bytes(r, &now, sizeof(now), NULL);
  	for (i = r->poolinfo->POOLBYTES; i > 0; i -= sizeof(rv)) {
  		if (!arch_get_random_long(&rv))
-@@ -1379,7 +1418,7 @@ EXPORT_SYMBOL(generate_random_uuid);
+@@ -1387,7 +1418,7 @@ EXPORT_SYMBOL(generate_random_uuid);
  #include <linux/sysctl.h>
  
  static int min_read_thresh = 8, min_write_thresh;
@@ -32599,7 +32556,7 @@ index 8ae9235..788c4ba 100644
  static int max_write_thresh = INPUT_POOL_WORDS * 32;
  static char sysctl_bootid[16];
  
-@@ -1395,7 +1434,7 @@ static char sysctl_bootid[16];
+@@ -1403,7 +1434,7 @@ static char sysctl_bootid[16];
  static int proc_do_uuid(ctl_table *table, int write,
  			void __user *buffer, size_t *lenp, loff_t *ppos)
  {
@@ -33403,10 +33360,10 @@ index 4cd392d..4b629e1 100644
  	iounmap(buf);
  	return 0;
 diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
-index b15c0aa..9a15a68 100644
+index 2a64e69..ac8fe51 100644
 --- a/drivers/firmware/efivars.c
 +++ b/drivers/firmware/efivars.c
-@@ -1233,7 +1233,7 @@ efivar_create_sysfs_entry(struct efivars *efivars,
+@@ -1221,7 +1221,7 @@ efivar_create_sysfs_entry(struct efivars *efivars,
  static int
  create_efivars_bin_attributes(struct efivars *efivars)
  {
@@ -33415,7 +33372,7 @@ index b15c0aa..9a15a68 100644
  	int error;
  
  	/* new_var */
-@@ -1425,7 +1425,7 @@ out:
+@@ -1413,7 +1413,7 @@ out:
  }
  EXPORT_SYMBOL_GPL(register_efivars);
  
@@ -33905,10 +33862,10 @@ index 9b4e5c6..d7ec240 100644
  	mutex_unlock(&dev->struct_mutex);
  
 diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
-index c77fc67..4057c13 100644
+index ca67338..0003ba7 100644
 --- a/drivers/gpu/drm/i915/i915_dma.c
 +++ b/drivers/gpu/drm/i915/i915_dma.c
-@@ -1166,7 +1166,7 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev)
+@@ -1172,7 +1172,7 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev)
  	bool can_switch;
  
  	spin_lock(&dev->count_lock);
@@ -33918,7 +33875,7 @@ index c77fc67..4057c13 100644
  	return can_switch;
  }
 diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 20cd295..052b178 100644
+index 144d37c..bf1110f 100644
 --- a/drivers/gpu/drm/i915/i915_drv.h
 +++ b/drivers/gpu/drm/i915/i915_drv.h
 @@ -320,7 +320,7 @@ typedef struct drm_i915_private {
@@ -33930,7 +33887,7 @@ index 20cd295..052b178 100644
  
  	/* protects the irq masks */
  	spinlock_t irq_lock;
-@@ -898,7 +898,7 @@ struct drm_i915_gem_object {
+@@ -897,7 +897,7 @@ struct drm_i915_gem_object {
  	 * will be page flipped away on the next vblank.  When it
  	 * reaches 0, dev_priv->pending_flip_queue will be woken up.
  	 */
@@ -33939,7 +33896,7 @@ index 20cd295..052b178 100644
  };
  
  #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
-@@ -1275,7 +1275,7 @@ extern int intel_setup_gmbus(struct drm_device *dev);
+@@ -1274,7 +1274,7 @@ extern int intel_setup_gmbus(struct drm_device *dev);
  extern void intel_teardown_gmbus(struct drm_device *dev);
  extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
  extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
@@ -39511,10 +39468,10 @@ index d0893e4..14b0d44 100644
         .init = loopback_net_init,
  };
 diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
-index 544ac06..0064ab3 100644
+index 301b39e..345c414 100644
 --- a/drivers/net/macvlan.c
 +++ b/drivers/net/macvlan.c
-@@ -789,13 +789,15 @@ static const struct nla_policy macvlan_policy[IFLA_MACVLAN_MAX + 1] = {
+@@ -790,13 +790,15 @@ static const struct nla_policy macvlan_policy[IFLA_MACVLAN_MAX + 1] = {
  int macvlan_link_register(struct rtnl_link_ops *ops)
  {
  	/* common fields */
@@ -39537,7 +39494,7 @@ index 544ac06..0064ab3 100644
  
  	return rtnl_link_register(ops);
  };
-@@ -851,7 +853,7 @@ static int macvlan_device_event(struct notifier_block *unused,
+@@ -852,7 +854,7 @@ static int macvlan_device_event(struct notifier_block *unused,
  	return NOTIFY_DONE;
  }
  
@@ -42546,7 +42503,7 @@ index 7735027..30eed13 100644
  
  	pDevice->apdev->type = ARPHRD_IEEE80211;
 diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
-index 51b5adf..098e320 100644
+index df8ea25..47dd9c6 100644
 --- a/drivers/staging/vt6656/hostap.c
 +++ b/drivers/staging/vt6656/hostap.c
 @@ -80,14 +80,13 @@ static int          msglevel                =MSG_LEVEL_INFO;
@@ -42630,6 +42587,48 @@ index 3effde2..dda7d46 100644
  			if (hdr->flags & ISCSI_FLAG_CMD_FINAL)
  				if (--cmd->outstanding_r2ts < 1) {
  					iscsit_stop_dataout_timer(cmd);
+diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
+index 5b77316..db313ba 100644
+--- a/drivers/target/iscsi/iscsi_target_parameters.c
++++ b/drivers/target/iscsi/iscsi_target_parameters.c
+@@ -713,9 +713,9 @@ static int iscsi_add_notunderstood_response(
+ 	}
+ 	INIT_LIST_HEAD(&extra_response->er_list);
+ 
+-	strncpy(extra_response->key, key, strlen(key) + 1);
+-	strncpy(extra_response->value, NOTUNDERSTOOD,
+-			strlen(NOTUNDERSTOOD) + 1);
++	strlcpy(extra_response->key, key, sizeof(extra_response->key));
++	strlcpy(extra_response->value, NOTUNDERSTOOD,
++		sizeof(extra_response->value));
+ 
+ 	list_add_tail(&extra_response->er_list,
+ 			&param_list->extra_response_list);
+@@ -1572,8 +1572,6 @@ int iscsi_decode_text_input(
+ 
+ 		if (phase & PHASE_SECURITY) {
+ 			if (iscsi_check_for_auth_key(key) > 0) {
+-				char *tmpptr = key + strlen(key);
+-				*tmpptr = '=';
+ 				kfree(tmpbuf);
+ 				return 1;
+ 			}
+diff --git a/drivers/target/iscsi/iscsi_target_parameters.h b/drivers/target/iscsi/iscsi_target_parameters.h
+index 6a37fd6..83eed65 100644
+--- a/drivers/target/iscsi/iscsi_target_parameters.h
++++ b/drivers/target/iscsi/iscsi_target_parameters.h
+@@ -1,8 +1,10 @@
+ #ifndef ISCSI_PARAMETERS_H
+ #define ISCSI_PARAMETERS_H
+ 
++#include <scsi/iscsi_proto.h>
++
+ struct iscsi_extra_response {
+-	char key[64];
++	char key[KEY_MAXLEN];
+ 	char value[32];
+ 	struct list_head er_list;
+ } ____cacheline_aligned;
 diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
 index 6845228..df77141 100644
 --- a/drivers/target/target_core_tmr.c
@@ -42977,10 +42976,10 @@ index d190269..f59727e 100644
  		return NULL;
  	}
 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
-index 8481aae..e1a589c 100644
+index 0f8a785..64c35dd 100644
 --- a/drivers/tty/n_tty.c
 +++ b/drivers/tty/n_tty.c
-@@ -2124,6 +2124,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
+@@ -2132,6 +2132,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
  {
  	*ops = tty_ldisc_N_TTY;
  	ops->owner = NULL;
@@ -43384,7 +43383,7 @@ index a783d53..cb30d94 100644
  	ret = uio_get_minor(idev);
  	if (ret)
 diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
-index a845f8b..4f54072 100644
+index 9497171..bfeecaf 100644
 --- a/drivers/usb/atm/cxacru.c
 +++ b/drivers/usb/atm/cxacru.c
 @@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev,
@@ -48549,7 +48548,7 @@ index 8d4d53d..d0dec4c 100644
  		do_chunk_alloc(trans, root->fs_info->extent_root,
  			       num_bytes, data, CHUNK_ALLOC_FORCE);
 diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index c04f02c..f5c9e2e 100644
+index 618ae6f..118fe0c 100644
 --- a/fs/btrfs/ioctl.c
 +++ b/fs/btrfs/ioctl.c
 @@ -2733,9 +2733,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
@@ -50682,7 +50681,7 @@ index 60b6ca5..bfa15a7 100644
  
  	/* locality groups */
 diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 7b18563..4dc0cd9 100644
+index 9243103..750691a 100644
 --- a/fs/ext4/mballoc.c
 +++ b/fs/ext4/mballoc.c
 @@ -1794,7 +1794,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
@@ -50694,7 +50693,7 @@ index 7b18563..4dc0cd9 100644
  
  		break;
  	}
-@@ -2088,7 +2088,7 @@ repeat:
+@@ -2092,7 +2092,7 @@ repeat:
  			ac->ac_status = AC_STATUS_CONTINUE;
  			ac->ac_flags |= EXT4_MB_HINT_FIRST;
  			cr = 3;
@@ -50703,7 +50702,7 @@ index 7b18563..4dc0cd9 100644
  			goto repeat;
  		}
  	}
-@@ -2595,25 +2595,25 @@ int ext4_mb_release(struct super_block *sb)
+@@ -2599,25 +2599,25 @@ int ext4_mb_release(struct super_block *sb)
  	if (sbi->s_mb_stats) {
  		ext4_msg(sb, KERN_INFO,
  		       "mballoc: %u blocks %u reqs (%u success)",
@@ -50739,7 +50738,7 @@ index 7b18563..4dc0cd9 100644
  	}
  
  	free_percpu(sbi->s_locality_groups);
-@@ -3097,16 +3097,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
+@@ -3101,16 +3101,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
  	struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
  
  	if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
@@ -50762,7 +50761,7 @@ index 7b18563..4dc0cd9 100644
  	}
  
  	if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
-@@ -3510,7 +3510,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
+@@ -3514,7 +3514,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
  	trace_ext4_mb_new_inode_pa(ac, pa);
  
  	ext4_mb_use_inode_pa(ac, pa);
@@ -50771,7 +50770,7 @@ index 7b18563..4dc0cd9 100644
  
  	ei = EXT4_I(ac->ac_inode);
  	grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
-@@ -3570,7 +3570,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
+@@ -3574,7 +3574,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
  	trace_ext4_mb_new_group_pa(ac, pa);
  
  	ext4_mb_use_group_pa(ac, pa);
@@ -50780,7 +50779,7 @@ index 7b18563..4dc0cd9 100644
  
  	grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
  	lg = ac->ac_lg;
-@@ -3659,7 +3659,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
+@@ -3663,7 +3663,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
  		 * from the bitmap and continue.
  		 */
  	}
@@ -50789,7 +50788,7 @@ index 7b18563..4dc0cd9 100644
  
  	return err;
  }
-@@ -3677,7 +3677,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
+@@ -3681,7 +3681,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
  	ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
  	BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
  	mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
@@ -50861,39 +50860,6 @@ index cc386b2..22725d2 100644
  
  static int __init ext4_init_feat_adverts(void)
  {
-diff --git a/fs/fat/inode.c b/fs/fat/inode.c
-index 808cac7..fc33ca1 100644
---- a/fs/fat/inode.c
-+++ b/fs/fat/inode.c
-@@ -1238,6 +1238,19 @@ static int fat_read_root(struct inode *inode)
- 	return 0;
- }
- 
-+static unsigned long calc_fat_clusters(struct super_block *sb)
-+{
-+	struct msdos_sb_info *sbi = MSDOS_SB(sb);
-+
-+	/* Divide first to avoid overflow */
-+	if (sbi->fat_bits != 12) {
-+		unsigned long ent_per_sec = sb->s_blocksize * 8 / sbi->fat_bits;
-+		return ent_per_sec * sbi->fat_length;
-+	}
-+
-+	return sbi->fat_length * sb->s_blocksize * 8 / sbi->fat_bits;
-+}
-+
- /*
-  * Read the super block of an MS-DOS FS.
-  */
-@@ -1434,7 +1447,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
- 		sbi->fat_bits = (total_clusters > MAX_FAT12) ? 16 : 12;
- 
- 	/* check that FAT table does not overflow */
--	fat_clusters = sbi->fat_length * sb->s_blocksize * 8 / sbi->fat_bits;
-+	fat_clusters = calc_fat_clusters(sb);
- 	total_clusters = min(total_clusters, fat_clusters - FAT_START_ENT);
- 	if (total_clusters > MAX_FAT(sb)) {
- 		if (!silent)
 diff --git a/fs/fat/namei_msdos.c b/fs/fat/namei_msdos.c
 index 216b419..350a088 100644
 --- a/fs/fat/namei_msdos.c
@@ -53723,10 +53689,10 @@ index 1943898..396c460 100644
 -
  #endif /* CONFIG_NFS_V4 */
 diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
-index 08921b8..e60b7da 100644
+index e065497..258fa11 100644
 --- a/fs/nfsd/nfs4proc.c
 +++ b/fs/nfsd/nfs4proc.c
-@@ -1037,7 +1037,7 @@ struct nfsd4_operation {
+@@ -1048,7 +1048,7 @@ struct nfsd4_operation {
  	char *op_name;
  	/* Try to get response size before operation */
  	nfsd4op_rsize op_rsize_bop;
@@ -68269,12 +68235,12 @@ index 75f53f8..5c7972d 100644
  	unsigned int offset, size_t len);
  
 diff --git a/include/linux/efi.h b/include/linux/efi.h
-index 8469f3f..41618bb 100644
+index 88c953d..48685de 100644
 --- a/include/linux/efi.h
 +++ b/include/linux/efi.h
-@@ -477,6 +477,7 @@ struct efivar_operations {
+@@ -486,6 +486,7 @@ struct efivar_operations {
  	efi_set_variable_t *set_variable;
- 	efi_query_variable_info_t *query_variable_info;
+ 	efi_query_variable_store_t *query_variable_store;
  };
 +typedef struct efivar_operations __no_const efivar_operations_no_const;
  
@@ -71188,7 +71154,7 @@ index 29e217a..1dee1dd 100644
  
  /**
 diff --git a/include/linux/rculist.h b/include/linux/rculist.h
-index d079290..fa711cb 100644
+index 6f95e24..68fe817 100644
 --- a/include/linux/rculist.h
 +++ b/include/linux/rculist.h
 @@ -39,6 +39,9 @@ static inline void __list_add_rcu(struct list_head *new,
@@ -73298,7 +73264,7 @@ index c2e542b..6ca975b 100644
  extern __u32 secure_ipv6_id(const __be32 daddr[4]);
  extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
 diff --git a/include/net/sock.h b/include/net/sock.h
-index ddf523c..1f06685 100644
+index e6454b6..cda5eaf 100644
 --- a/include/net/sock.h
 +++ b/include/net/sock.h
 @@ -278,7 +278,7 @@ struct sock {
@@ -73310,7 +73276,7 @@ index ddf523c..1f06685 100644
  	int			sk_rcvbuf;
  
  	struct sk_filter __rcu	*sk_filter;
-@@ -1404,7 +1404,7 @@ static inline void sk_nocaps_add(struct sock *sk, int flags)
+@@ -1416,7 +1416,7 @@ static inline void sk_nocaps_add(struct sock *sk, int flags)
  }
  
  static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
@@ -73319,7 +73285,7 @@ index ddf523c..1f06685 100644
  					   int copy, int offset)
  {
  	if (skb->ip_summed == CHECKSUM_NONE) {
-@@ -1666,7 +1666,7 @@ static inline void sk_stream_moderate_sndbuf(struct sock *sk)
+@@ -1678,7 +1678,7 @@ static inline void sk_stream_moderate_sndbuf(struct sock *sk)
  	}
  }
  
@@ -73329,7 +73295,7 @@ index ddf523c..1f06685 100644
  static inline struct page *sk_stream_alloc_page(struct sock *sk)
  {
 diff --git a/include/net/tcp.h b/include/net/tcp.h
-index 0768715..3fedeb4 100644
+index fe46019..1422c5a 100644
 --- a/include/net/tcp.h
 +++ b/include/net/tcp.h
 @@ -470,7 +470,7 @@ extern void tcp_retransmit_timer(struct sock *sk);
@@ -75746,7 +75712,7 @@ index dc7bc08..4601964 100644
  
  	/* Don't allow clients that don't understand the native
 diff --git a/kernel/kmod.c b/kernel/kmod.c
-index d6fe08a..fb66cab 100644
+index a16dac1..fb66cab 100644
 --- a/kernel/kmod.c
 +++ b/kernel/kmod.c
 @@ -64,7 +64,7 @@ static void free_modprobe_argv(struct subprocess_info *info)
@@ -75874,19 +75840,7 @@ index d6fe08a..fb66cab 100644
  
  		/*
  		 * If ret is 0, either ____call_usermodehelper failed and the
-@@ -467,6 +520,11 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info,
- 	int retval = 0;
- 
- 	helper_lock();
-+	if (!sub_info->path) {
-+		retval = -EINVAL;
-+		goto out;
-+	}
-+
- 	if (sub_info->path[0] == '\0')
- 		goto out;
- 
-@@ -507,7 +565,7 @@ EXPORT_SYMBOL(call_usermodehelper_exec);
+@@ -512,7 +565,7 @@ EXPORT_SYMBOL(call_usermodehelper_exec);
  static int proc_cap_handler(struct ctl_table *table, int write,
  			 void __user *buffer, size_t *lenp, loff_t *ppos)
  {
@@ -78060,7 +78014,7 @@ index 3d9f31c..7fefc9e 100644
  
  	default:
 diff --git a/kernel/sched.c b/kernel/sched.c
-index d08c9f4..9a9af37 100644
+index d93369a..700af59 100644
 --- a/kernel/sched.c
 +++ b/kernel/sched.c
 @@ -5046,7 +5046,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible);
@@ -78148,7 +78102,7 @@ index d08c9f4..9a9af37 100644
  
  	/*
  	 * In the intermediate directories, both the child directory and
-@@ -6661,19 +6665,22 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
+@@ -6661,22 +6665,25 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
  	 * will always be set. In the lowest directory the names are
  	 * static strings and all have proc handlers.
  	 */
@@ -78171,13 +78125,16 @@ index d08c9f4..9a9af37 100644
 +	kfree(tablep);
  }
  
+ static int min_load_idx = 0;
+ static int max_load_idx = CPU_LOAD_IDX_MAX-1;
+ 
  static void
 -set_table_entry(struct ctl_table *entry,
 +set_table_entry(ctl_table_no_const *entry,
  		const char *procname, void *data, int maxlen,
- 		mode_t mode, proc_handler *proc_handler)
- {
-@@ -6687,7 +6694,7 @@ set_table_entry(struct ctl_table *entry,
+ 		mode_t mode, proc_handler *proc_handler,
+ 		bool load_idx)
+@@ -6696,7 +6703,7 @@ set_table_entry(struct ctl_table *entry,
  static struct ctl_table *
  sd_alloc_ctl_domain_table(struct sched_domain *sd)
  {
@@ -78186,7 +78143,7 @@ index d08c9f4..9a9af37 100644
  
  	if (table == NULL)
  		return NULL;
-@@ -6722,9 +6729,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
+@@ -6731,9 +6738,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
  	return table;
  }
  
@@ -78198,7 +78155,7 @@ index d08c9f4..9a9af37 100644
  	struct sched_domain *sd;
  	int domain_num = 0, i;
  	char buf[32];
-@@ -6751,11 +6758,13 @@ static struct ctl_table_header *sd_sysctl_header;
+@@ -6760,11 +6767,13 @@ static struct ctl_table_header *sd_sysctl_header;
  static void register_sched_domain_sysctl(void)
  {
  	int i, cpu_num = num_possible_cpus();
@@ -78213,7 +78170,7 @@ index d08c9f4..9a9af37 100644
  
  	if (entry == NULL)
  		return;
-@@ -6778,8 +6787,12 @@ static void unregister_sched_domain_sysctl(void)
+@@ -6787,8 +6796,12 @@ static void unregister_sched_domain_sysctl(void)
  	if (sd_sysctl_header)
  		unregister_sysctl_table(sd_sysctl_header);
  	sd_sysctl_header = NULL;
@@ -78228,7 +78185,7 @@ index d08c9f4..9a9af37 100644
  }
  #else
  static void register_sched_domain_sysctl(void)
-@@ -6877,7 +6890,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
+@@ -6886,7 +6899,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
   * happens before everything else.  This has to be lower priority than
   * the notifier in the perf_event subsystem, though.
   */
@@ -79321,7 +79278,7 @@ index 0b537f2..40d6c20 100644
  		return -ENOMEM;
  	return 0;
 diff --git a/kernel/timer.c b/kernel/timer.c
-index c219db6..894cecb 100644
+index f2f71d7..dd26ca7 100644
 --- a/kernel/timer.c
 +++ b/kernel/timer.c
 @@ -1306,7 +1306,7 @@ void update_process_times(int user_tick)
@@ -80742,7 +80699,7 @@ index 2a07f97..2cdc054 100644
  	set_page_address(page, (void *)vaddr);
  
 diff --git a/mm/huge_memory.c b/mm/huge_memory.c
-index 470cbb4..9fd73bc 100644
+index d80ac4b..9fd73bc 100644
 --- a/mm/huge_memory.c
 +++ b/mm/huge_memory.c
 @@ -704,7 +704,7 @@ out:
@@ -80754,20 +80711,6 @@ index 470cbb4..9fd73bc 100644
  		return VM_FAULT_OOM;
  	/* if an huge pmd materialized from under us just retry later */
  	if (unlikely(pmd_trans_huge(*pmd)))
-@@ -1937,7 +1937,12 @@ static void collapse_huge_page(struct mm_struct *mm,
- 		pte_unmap(pte);
- 		spin_lock(&mm->page_table_lock);
- 		BUG_ON(!pmd_none(*pmd));
--		set_pmd_at(mm, address, pmd, _pmd);
-+		/*
-+		 * We can only use set_pmd_at when establishing
-+		 * hugepmds and never for establishing regular pmds that
-+		 * points to regular pagetables. Use pmd_populate for that
-+		 */
-+		pmd_populate(mm, pmd, pmd_pgtable(_pmd));
- 		spin_unlock(&mm->page_table_lock);
- 		anon_vma_unlock(vma->anon_vma);
- 		goto out;
 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
 index 70b4733..ab692a7 100644
 --- a/mm/hugetlb.c
@@ -81917,7 +81860,7 @@ index 4d1e637..9e0a005 100644
  		err = -EPERM;
  		goto out;
 diff --git a/mm/migrate.c b/mm/migrate.c
-index 180d97f..c75ef28 100644
+index e1052d1..61c9e50 100644
 --- a/mm/migrate.c
 +++ b/mm/migrate.c
 @@ -1376,6 +1376,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
@@ -81946,7 +81889,7 @@ index 180d97f..c75ef28 100644
  		err = -EPERM;
  		goto out;
 diff --git a/mm/mlock.c b/mm/mlock.c
-index 4f4f53b..de8e432 100644
+index 4f4f53b..02d443a 100644
 --- a/mm/mlock.c
 +++ b/mm/mlock.c
 @@ -13,6 +13,7 @@
@@ -81996,7 +81939,7 @@ index 4f4f53b..de8e432 100644
  	if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
  		error = do_mlock(start, len, 1);
  	up_write(&current->mm->mmap_sem);
-@@ -523,17 +533,23 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
+@@ -523,17 +533,22 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
  static int do_mlockall(int flags)
  {
  	struct vm_area_struct * vma, * prev = NULL;
@@ -82019,11 +81962,10 @@ index 4f4f53b..de8e432 100644
 +			break;
 +#endif
 +
-+		BUG_ON(vma->vm_end > TASK_SIZE);
  		newflags = vma->vm_flags | VM_LOCKED;
  		if (!(flags & MCL_CURRENT))
  			newflags &= ~VM_LOCKED;
-@@ -566,6 +582,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
+@@ -566,6 +581,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
  	lock_limit >>= PAGE_SHIFT;
  
  	ret = -ENOMEM;
@@ -86845,7 +86787,7 @@ index 925991a..209a505 100644
  #ifdef CONFIG_INET
  static u32 seq_scale(u32 seq)
 diff --git a/net/core/sock.c b/net/core/sock.c
-index 2c73adf..d7698ef 100644
+index 8a2c2dd..3ba3cf1 100644
 --- a/net/core/sock.c
 +++ b/net/core/sock.c
 @@ -289,7 +289,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
@@ -86958,7 +86900,7 @@ index 2c73adf..d7698ef 100644
  		return -EFAULT;
  lenout:
  	if (put_user(len, optlen))
-@@ -2039,7 +2039,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+@@ -2027,7 +2027,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
  	 */
  	smp_wmb();
  	atomic_set(&sk->sk_refcnt, 1);
@@ -86967,7 +86909,7 @@ index 2c73adf..d7698ef 100644
  }
  EXPORT_SYMBOL(sock_init_data);
  
-@@ -2576,7 +2576,7 @@ static __net_exit void proto_exit_net(struct net *net)
+@@ -2564,7 +2564,7 @@ static __net_exit void proto_exit_net(struct net *net)
  }
  
  
@@ -88670,7 +88612,7 @@ index 166a57c..dc4e6b8 100644
  	struct ctl_table *ipv6_icmp_table;
  	int err;
 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index db10805..42998ba 100644
+index c69358c..d1e5855 100644
 --- a/net/ipv6/tcp_ipv6.c
 +++ b/net/ipv6/tcp_ipv6.c
 @@ -93,6 +93,10 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
@@ -88773,7 +88715,7 @@ index db10805..42998ba 100644
  
  static int tcp6_seq_show(struct seq_file *seq, void *v)
 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index 8c25419..47a51ae 100644
+index 20f0812..7d4ede1 100644
 --- a/net/ipv6/udp.c
 +++ b/net/ipv6/udp.c
 @@ -50,6 +50,10 @@
@@ -89845,10 +89787,10 @@ index 3df7c5a..8f324b0 100644
  		*uaddr_len = sizeof(struct sockaddr_ax25);
  	}
 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 835fcea..d9fb2db 100644
+index 5a70215..379f8ee 100644
 --- a/net/packet/af_packet.c
 +++ b/net/packet/af_packet.c
-@@ -1684,7 +1684,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1670,7 +1670,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
  
  	spin_lock(&sk->sk_receive_queue.lock);
  	po->stats.tp_packets++;
@@ -89857,7 +89799,7 @@ index 835fcea..d9fb2db 100644
  	__skb_queue_tail(&sk->sk_receive_queue, skb);
  	spin_unlock(&sk->sk_receive_queue.lock);
  	sk->sk_data_ready(sk, skb->len);
-@@ -1693,7 +1693,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1679,7 +1679,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
  drop_n_acct:
  	spin_lock(&sk->sk_receive_queue.lock);
  	po->stats.tp_drops++;
@@ -89866,7 +89808,7 @@ index 835fcea..d9fb2db 100644
  	spin_unlock(&sk->sk_receive_queue.lock);
  
  drop_n_restore:
-@@ -2623,6 +2623,7 @@ out:
+@@ -2609,6 +2609,7 @@ out:
  
  static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
  {
@@ -89874,7 +89816,7 @@ index 835fcea..d9fb2db 100644
  	struct sock_exterr_skb *serr;
  	struct sk_buff *skb, *skb2;
  	int copied, err;
-@@ -2644,8 +2645,9 @@ static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
+@@ -2630,8 +2631,9 @@ static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
  	sock_recv_timestamp(msg, sk, skb);
  
  	serr = SKB_EXT_ERR(skb);
@@ -89885,7 +89827,7 @@ index 835fcea..d9fb2db 100644
  
  	msg->msg_flags |= MSG_ERRQUEUE;
  	err = copied;
-@@ -3276,7 +3278,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3262,7 +3264,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
  	case PACKET_HDRLEN:
  		if (len > sizeof(int))
  			len = sizeof(int);
@@ -89894,7 +89836,7 @@ index 835fcea..d9fb2db 100644
  			return -EFAULT;
  		switch (val) {
  		case TPACKET_V1:
-@@ -3326,7 +3328,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3312,7 +3314,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
  
  	if (put_user(len, optlen))
  		return -EFAULT;
@@ -91030,7 +90972,7 @@ index bfddd68..567429b 100644
 -/* Make 'mount -t rpc_pipefs ...' autoload this module. */
 -MODULE_ALIAS("rpc_pipefs");
 diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
-index dc6af27..e3fba77 100644
+index 206c61e..e3641fb 100644
 --- a/net/sunrpc/sched.c
 +++ b/net/sunrpc/sched.c
 @@ -240,9 +240,9 @@ static int rpc_wait_bit_killable(void *word)

diff --git a/3.9.4/0000_README b/3.9.4/0000_README
index 236a360..1cbe9a3 100644
--- a/3.9.4/0000_README
+++ b/3.9.4/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.9.1-3.9.4-201305301927.patch
+Patch:	4420_grsecurity-2.9.1-3.9.4-201306011536.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/3.9.4/4420_grsecurity-2.9.1-3.9.4-201305301927.patch b/3.9.4/4420_grsecurity-2.9.1-3.9.4-201306011536.patch
similarity index 99%
rename from 3.9.4/4420_grsecurity-2.9.1-3.9.4-201305301927.patch
rename to 3.9.4/4420_grsecurity-2.9.1-3.9.4-201306011536.patch
index 06e925c..9a1a55c 100644
--- a/3.9.4/4420_grsecurity-2.9.1-3.9.4-201305301927.patch
+++ b/3.9.4/4420_grsecurity-2.9.1-3.9.4-201306011536.patch
@@ -42751,6 +42751,48 @@ index adbe5a8..d387359 100644
  extern void tmem_register_hostops(struct tmem_hostops *m);
  
  /* core tmem accessor functions */
+diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
+index ca2be40..93ae910 100644
+--- a/drivers/target/iscsi/iscsi_target_parameters.c
++++ b/drivers/target/iscsi/iscsi_target_parameters.c
+@@ -712,9 +712,9 @@ static int iscsi_add_notunderstood_response(
+ 	}
+ 	INIT_LIST_HEAD(&extra_response->er_list);
+ 
+-	strncpy(extra_response->key, key, strlen(key) + 1);
+-	strncpy(extra_response->value, NOTUNDERSTOOD,
+-			strlen(NOTUNDERSTOOD) + 1);
++	strlcpy(extra_response->key, key, sizeof(extra_response->key));
++	strlcpy(extra_response->value, NOTUNDERSTOOD,
++		sizeof(extra_response->value));
+ 
+ 	list_add_tail(&extra_response->er_list,
+ 			&param_list->extra_response_list);
+@@ -1583,8 +1583,6 @@ int iscsi_decode_text_input(
+ 
+ 		if (phase & PHASE_SECURITY) {
+ 			if (iscsi_check_for_auth_key(key) > 0) {
+-				char *tmpptr = key + strlen(key);
+-				*tmpptr = '=';
+ 				kfree(tmpbuf);
+ 				return 1;
+ 			}
+diff --git a/drivers/target/iscsi/iscsi_target_parameters.h b/drivers/target/iscsi/iscsi_target_parameters.h
+index 1e1b750..2c536a0 100644
+--- a/drivers/target/iscsi/iscsi_target_parameters.h
++++ b/drivers/target/iscsi/iscsi_target_parameters.h
+@@ -1,8 +1,10 @@
+ #ifndef ISCSI_PARAMETERS_H
+ #define ISCSI_PARAMETERS_H
+ 
++#include <scsi/iscsi_proto.h>
++
+ struct iscsi_extra_response {
+-	char key[64];
++	char key[KEY_MAXLEN];
+ 	char value[32];
+ 	struct list_head er_list;
+ } ____cacheline_aligned;
 diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
 index 2e4d655..fd72e68 100644
 --- a/drivers/target/target_core_device.c
@@ -44036,7 +44078,7 @@ index c8b9262..7e824e6 100644
  	ret = uio_get_minor(idev);
  	if (ret)
 diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
-index b7eb86a..36d28af 100644
+index b7eb86a..c00402f 100644
 --- a/drivers/usb/atm/cxacru.c
 +++ b/drivers/usb/atm/cxacru.c
 @@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev,
@@ -44048,6 +44090,16 @@ index b7eb86a..36d28af 100644
  			return -EINVAL;
  		pos += tmp;
  
+@@ -686,7 +686,8 @@ static int cxacru_cm_get_array(struct cxacru_data *instance, enum cxacru_cm_requ
+ {
+ 	int ret, len;
+ 	__le32 *buf;
+-	int offb, offd;
++	int offb;
++	unsigned int offd;
+ 	const int stride = CMD_PACKET_SIZE / (4 * 2) - 1;
+ 	int buflen =  ((size - 1) / stride + 1 + size * 2) * 4;
+ 
 diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
 index 35f10bf..6a38a0b 100644
 --- a/drivers/usb/atm/usbatm.c
@@ -81515,7 +81567,7 @@ index 3bbaf5d..299b0e9 100644
  		err = -EPERM;
  		goto out;
 diff --git a/mm/mlock.c b/mm/mlock.c
-index 79b7cf7..c60424f 100644
+index 79b7cf7..9944291 100644
 --- a/mm/mlock.c
 +++ b/mm/mlock.c
 @@ -13,6 +13,7 @@
@@ -81565,7 +81617,7 @@ index 79b7cf7..c60424f 100644
  	if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
  		error = do_mlock(start, len, 1);
  	up_write(&current->mm->mmap_sem);
-@@ -500,6 +510,12 @@ static int do_mlockall(int flags)
+@@ -500,6 +510,11 @@ static int do_mlockall(int flags)
  	for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
  		vm_flags_t newflags;
  
@@ -81574,11 +81626,10 @@ index 79b7cf7..c60424f 100644
 +			break;
 +#endif
 +
-+		BUG_ON(vma->vm_end > TASK_SIZE);
  		newflags = vma->vm_flags & ~VM_LOCKED;
  		if (flags & MCL_CURRENT)
  			newflags |= VM_LOCKED;
-@@ -532,6 +548,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
+@@ -532,6 +547,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
  	lock_limit >>= PAGE_SHIFT;
  
  	ret = -ENOMEM;