[gentoo-commits] proj/hardened-patchset:master commit in: 4.2.5/

[Anthony G. Basile]

commit:     62e8f25d6636b09b18cb25cb1bb491cc026b5b08
Author:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Tue Nov  3 08:24:26 2015 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Tue Nov  3 08:24:26 2015 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-patchset.git/commit/?id=62e8f25d

grsecurity-3.1-4.2.5-201511021814

 4.2.5/0000_README                                  |   2 +-
 ...> 4420_grsecurity-3.1-4.2.5-201511021814.patch} | 318 +++++++++++++++------
 2 files changed, 232 insertions(+), 88 deletions(-)

diff --git a/4.2.5/0000_README b/4.2.5/0000_README
index 0d8d90f..35d5d28 100644
--- a/4.2.5/0000_README
+++ b/4.2.5/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.1-4.2.5-201510290852.patch
+Patch:	4420_grsecurity-3.1-4.2.5-201511021814.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/4.2.5/4420_grsecurity-3.1-4.2.5-201510290852.patch b/4.2.5/4420_grsecurity-3.1-4.2.5-201511021814.patch
similarity index 99%
rename from 4.2.5/4420_grsecurity-3.1-4.2.5-201510290852.patch
rename to 4.2.5/4420_grsecurity-3.1-4.2.5-201511021814.patch
index db09c8a..52245c5 100644
--- a/4.2.5/4420_grsecurity-3.1-4.2.5-201510290852.patch
+++ b/4.2.5/4420_grsecurity-3.1-4.2.5-201511021814.patch
@@ -25173,7 +25173,7 @@ index d25097c..e2df353 100644
  		return MXCSR_DEFAULT;
  	}
 diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
-index d14e9ac..f1334f8 100644
+index d14e9ac..13442f0 100644
 --- a/arch/x86/kernel/fpu/init.c
 +++ b/arch/x86/kernel/fpu/init.c
 @@ -42,7 +42,7 @@ static void fpu__init_cpu_generic(void)
@@ -25229,17 +25229,7 @@ index d14e9ac..f1334f8 100644
  
  /*
   * Set up the xstate_size based on the legacy FPU context size.
-@@ -300,6 +265,9 @@ static void __init fpu__init_system_ctx_switch(void)
- 		}
- 	}
- 
-+	/* XXX: Temporarily forcing eager FPU mode */
-+	eagerfpu = ENABLE;
-+
- 	if (eagerfpu == ENABLE)
- 		setup_force_cpu_cap(X86_FEATURE_EAGER_FPU);
- 
-@@ -331,7 +299,6 @@ void __init fpu__init_system(struct cpuinfo_x86 *c)
+@@ -331,7 +296,6 @@ void __init fpu__init_system(struct cpuinfo_x86 *c)
  	fpu__init_system_generic();
  	fpu__init_system_xstate_size_legacy();
  	fpu__init_system_xstate();
@@ -27814,7 +27804,7 @@ index adf0392..88a7576 100644
  		dma_generic_free_coherent(dev, size, vaddr, dma_addr, attrs);
  }
 diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
-index c27cad7..47e3f47 100644
+index c27cad7..cc494be 100644
 --- a/arch/x86/kernel/process.c
 +++ b/arch/x86/kernel/process.c
 @@ -15,6 +15,7 @@
@@ -27843,7 +27833,7 @@ index c27cad7..47e3f47 100644
  };
  EXPORT_PER_CPU_SYMBOL(cpu_tss);
  
-@@ -75,17 +78,35 @@ void idle_notifier_unregister(struct notifier_block *n)
+@@ -75,17 +78,37 @@ void idle_notifier_unregister(struct notifier_block *n)
  EXPORT_SYMBOL_GPL(idle_notifier_unregister);
  #endif
  
@@ -27866,8 +27856,10 @@ index c27cad7..47e3f47 100644
  {
 -	memcpy(dst, src, arch_task_struct_size);
 +	*dst = *src;
- 
++
 +	dst->thread.fpu.state = kmem_cache_alloc_node(fpregs_state_cachep, GFP_KERNEL, tsk_fork_get_node(src));
++	memcpy(dst->thread.fpu.state, src->thread.fpu.state, xstate_size);
+ 
  	return fpu__copy(&dst->thread.fpu, &src->thread.fpu);
  }
  
@@ -27880,7 +27872,7 @@ index c27cad7..47e3f47 100644
  /*
   * Free current thread data structures etc..
   */
-@@ -97,7 +118,7 @@ void exit_thread(void)
+@@ -97,7 +120,7 @@ void exit_thread(void)
  	struct fpu *fpu = &t->fpu;
  
  	if (bp) {
@@ -27889,7 +27881,7 @@ index c27cad7..47e3f47 100644
  
  		t->io_bitmap_ptr = NULL;
  		clear_thread_flag(TIF_IO_BITMAP);
-@@ -117,6 +138,9 @@ void flush_thread(void)
+@@ -117,6 +140,9 @@ void flush_thread(void)
  {
  	struct task_struct *tsk = current;
  
@@ -27899,7 +27891,7 @@ index c27cad7..47e3f47 100644
  	flush_ptrace_hw_breakpoint(tsk);
  	memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
  
-@@ -258,7 +282,7 @@ static void __exit_idle(void)
+@@ -258,7 +284,7 @@ static void __exit_idle(void)
  void exit_idle(void)
  {
  	/* idle loop has pid 0 */
@@ -27908,7 +27900,7 @@ index c27cad7..47e3f47 100644
  		return;
  	__exit_idle();
  }
-@@ -311,7 +335,7 @@ bool xen_set_default_idle(void)
+@@ -311,7 +337,7 @@ bool xen_set_default_idle(void)
  	return ret;
  }
  #endif
@@ -27917,7 +27909,7 @@ index c27cad7..47e3f47 100644
  {
  	local_irq_disable();
  	/*
-@@ -488,16 +512,40 @@ static int __init idle_setup(char *str)
+@@ -488,16 +514,40 @@ static int __init idle_setup(char *str)
  }
  early_param("idle", idle_setup);
  
@@ -49948,9 +49940,18 @@ index e8c96b8..516a96c 100644
  	  Say Y here if you want to support for Freescale FlexCAN.
  
 diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
-index aede704..b516b4d 100644
+index aede704..ca734ed 100644
 --- a/drivers/net/can/dev.c
 +++ b/drivers/net/can/dev.c
+@@ -915,7 +915,7 @@ static int can_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ 	     nla_put(skb, IFLA_CAN_BITTIMING_CONST,
+ 		     sizeof(*priv->bittiming_const), priv->bittiming_const)) ||
+ 
+-	    nla_put(skb, IFLA_CAN_CLOCK, sizeof(cm), &priv->clock) ||
++	    nla_put(skb, IFLA_CAN_CLOCK, sizeof(priv->clock), &priv->clock) ||
+ 	    nla_put_u32(skb, IFLA_CAN_STATE, state) ||
+ 	    nla_put(skb, IFLA_CAN_CTRLMODE, sizeof(cm), &cm) ||
+ 	    nla_put_u32(skb, IFLA_CAN_RESTART_MS, priv->restart_ms) ||
 @@ -961,7 +961,7 @@ static int can_newlink(struct net *src_net, struct net_device *dev,
  	return -EOPNOTSUPP;
  }
@@ -51028,6 +51029,19 @@ index e5ba040..d47531c 100644
  	smp_mb();
  
  	/* need lock to prevent incorrect read while modifying cyclecounter */
+diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+index 0a32020..2177e56 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+@@ -2398,7 +2398,7 @@ int mlx4_multi_func_init(struct mlx4_dev *dev)
+ 			}
+ 		}
+ 
+-		memset(&priv->mfunc.master.cmd_eqe, 0, dev->caps.eqe_size);
++		memset(&priv->mfunc.master.cmd_eqe, 0, sizeof(struct mlx4_eqe));
+ 		priv->mfunc.master.cmd_eqe.type = MLX4_EVENT_TYPE_CMD;
+ 		INIT_WORK(&priv->mfunc.master.comm_work,
+ 			  mlx4_master_comm_channel);
 diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
 index c10d98f..72914c6 100644
 --- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -51043,6 +51057,19 @@ index c10d98f..72914c6 100644
  
  	netdev_tx_completed_queue(ring->tx_queue, packets, bytes);
  
+diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
+index 8e81e53..ad8f95d 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
++++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
+@@ -196,7 +196,7 @@ static void slave_event(struct mlx4_dev *dev, u8 slave, struct mlx4_eqe *eqe)
+ 		return;
+ 	}
+ 
+-	memcpy(s_eqe, eqe, dev->caps.eqe_size - 1);
++	memcpy(s_eqe, eqe, sizeof(struct mlx4_eqe) - 1);
+ 	s_eqe->slave_id = slave;
+ 	/* ensure all information is written before setting the ownersip bit */
+ 	dma_wmb();
 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
 index 40206da..9d94643 100644
 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -53012,9 +53039,18 @@ index f66be86..6cbcabb 100644
  
  /**
 diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
-index 312f23a..d21181c 100644
+index 312f23a..8c8b922 100644
 --- a/drivers/pci/pci-sysfs.c
 +++ b/drivers/pci/pci-sysfs.c
+@@ -216,7 +216,7 @@ static ssize_t numa_node_store(struct device *dev,
+ 	if (ret)
+ 		return ret;
+ 
+-	if (!node_online(node))
++	if (node >= MAX_NUMNODES || !node_online(node))
+ 		return -EINVAL;
+ 
+ 	add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
 @@ -1140,7 +1140,7 @@ static int pci_create_attr(struct pci_dev *pdev, int num, int write_combine)
  {
  	/* allocate attribute structure, piggyback attribute name */
@@ -74263,7 +74299,7 @@ index 0000000..43d7c4f
 +:1095D00080000A8080000A00800009808000090065
 +:00000001FF
 diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
-index 2d0cbbd..a6d6149 100644
+index 2d0cbbd..a6d61492 100644
 --- a/fs/Kconfig.binfmt
 +++ b/fs/Kconfig.binfmt
 @@ -103,7 +103,7 @@ config HAVE_AOUT
@@ -81535,8 +81571,35 @@ index e33dab2..cdbdad9 100644
  		}
  	}
  	putname(tmp);
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 84d693d..871fcb6 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -81,11 +81,11 @@ static int ovl_copy_up_data(struct path *old, struct path *new, loff_t len)
+ 	if (len == 0)
+ 		return 0;
+ 
+-	old_file = ovl_path_open(old, O_RDONLY);
++	old_file = ovl_path_open(old, O_LARGEFILE | O_RDONLY);
+ 	if (IS_ERR(old_file))
+ 		return PTR_ERR(old_file);
+ 
+-	new_file = ovl_path_open(new, O_WRONLY);
++	new_file = ovl_path_open(new, O_LARGEFILE | O_WRONLY);
+ 	if (IS_ERR(new_file)) {
+ 		error = PTR_ERR(new_file);
+ 		goto out_fput;
+@@ -267,7 +267,7 @@ out:
+ 
+ out_cleanup:
+ 	ovl_cleanup(wdir, newdentry);
+-	goto out;
++	goto out2;
+ }
+ 
+ /*
 diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
-index d9da5a4..7ced3c7 100644
+index d9da5a4..f9b5b82 100644
 --- a/fs/overlayfs/inode.c
 +++ b/fs/overlayfs/inode.c
 @@ -346,6 +346,9 @@ struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags)
@@ -81549,8 +81612,18 @@ index d9da5a4..7ced3c7 100644
  	type = ovl_path_real(dentry, &realpath);
  	if (ovl_open_need_copy_up(file_flags, type, realpath.dentry)) {
  		err = ovl_want_write(dentry);
+@@ -363,6 +366,9 @@ struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags)
+ 		ovl_path_upper(dentry, &realpath);
+ 	}
+ 
++	if (realpath.dentry->d_flags & DCACHE_OP_SELECT_INODE)
++		return realpath.dentry->d_op->d_select_inode(realpath.dentry, file_flags);
++
+ 	return d_backing_inode(realpath.dentry);
+ }
+ 
 diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
-index 79073d6..0eb5c27 100644
+index 79073d6..6fc10e4 100644
 --- a/fs/overlayfs/super.c
 +++ b/fs/overlayfs/super.c
 @@ -172,7 +172,7 @@ void ovl_path_lower(struct dentry *dentry, struct path *path)
@@ -81562,7 +81635,15 @@ index 79073d6..0eb5c27 100644
  }
  
  int ovl_want_write(struct dentry *dentry)
-@@ -879,8 +879,8 @@ static unsigned int ovl_split_lowerdirs(char *str)
+@@ -544,6 +544,7 @@ static void ovl_put_super(struct super_block *sb)
+ 	mntput(ufs->upper_mnt);
+ 	for (i = 0; i < ufs->numlower; i++)
+ 		mntput(ufs->lower_mnt[i]);
++	kfree(ufs->lower_mnt);
+ 
+ 	kfree(ufs->config.lowerdir);
+ 	kfree(ufs->config.upperdir);
+@@ -879,8 +880,8 @@ static unsigned int ovl_split_lowerdirs(char *str)
  
  static int ovl_fill_super(struct super_block *sb, void *data, int silent)
  {
@@ -81573,6 +81654,14 @@ index 79073d6..0eb5c27 100644
  	struct dentry *root_dentry;
  	struct ovl_entry *oe;
  	struct ovl_fs *ufs;
+@@ -1048,6 +1049,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+ 		oe->lowerstack[i].dentry = stack[i].dentry;
+ 		oe->lowerstack[i].mnt = ufs->lower_mnt[i];
+ 	}
++	kfree(stack);
+ 
+ 	root_dentry->d_fsdata = oe;
+ 
 diff --git a/fs/pipe.c b/fs/pipe.c
 index 8865f79..bd2c79b 100644
 --- a/fs/pipe.c
@@ -82879,12 +82968,34 @@ index 92e6726..a600d4fa 100644
  	.priority = 0,
  };
 diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
-index d3ebf2e..6ad42d1 100644
+index d3ebf2e..abe1823 100644
 --- a/fs/proc/meminfo.c
 +++ b/fs/proc/meminfo.c
-@@ -194,7 +194,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
- 		vmi.used >> 10,
- 		vmi.largest_chunk >> 10
+@@ -27,7 +27,6 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
+ {
+ 	struct sysinfo i;
+ 	unsigned long committed;
+-	struct vmalloc_info vmi;
+ 	long cached;
+ 	long available;
+ 	unsigned long pagecache;
+@@ -49,8 +48,6 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
+ 	if (cached < 0)
+ 		cached = 0;
+ 
+-	get_vmalloc_info(&vmi);
+-
+ 	for (lru = LRU_BASE; lru < NR_LRU_LISTS; lru++)
+ 		pages[lru] = global_page_state(NR_LRU_BASE + lru);
+ 
+@@ -191,10 +188,10 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
+ 		K(vm_commit_limit()),
+ 		K(committed),
+ 		(unsigned long)VMALLOC_TOTAL >> 10,
+-		vmi.used >> 10,
+-		vmi.largest_chunk >> 10
++		0ul, // used to be vmalloc 'used'
++		0ul  // used to be vmalloc 'largest_chunk'
  #ifdef CONFIG_MEMORY_FAILURE
 -		, atomic_long_read(&num_poisoned_pages) << (PAGE_SHIFT - 10)
 +		, atomic_long_read_unchecked(&num_poisoned_pages) << (PAGE_SHIFT - 10)
@@ -97005,7 +97116,7 @@ index a76c917..63b52db 100644
  asmlinkage long compat_sys_lookup_dcookie(u32, u32, char __user *, compat_size_t);
  /*
 diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
-index dfaa7b3..d8bb2a0 100644
+index dfaa7b3..58cebfb 100644
 --- a/include/linux/compiler-gcc.h
 +++ b/include/linux/compiler-gcc.h
 @@ -116,8 +116,8 @@
@@ -97058,17 +97169,6 @@ index dfaa7b3..d8bb2a0 100644
  /*
   * Mark a position in code as unreachable.  This can be used to
   * suppress control flow warnings after asm blocks that transfer
-@@ -237,6 +266,10 @@
- #define KASAN_ABI_VERSION 3
- #endif
- 
-+#if GCC_VERSION >= 50000
-+//#define CC_HAVE_BUILTIN_OVERFLOW
-+#endif
-+
- #endif	/* gcc version >= 40000 specific checks */
- 
- #if !defined(__noclone)
 diff --git a/include/linux/compiler.h b/include/linux/compiler.h
 index e08a6ae..2e5e776 100644
 --- a/include/linux/compiler.h
@@ -100708,30 +100808,6 @@ index b2a0f15..4d7da32 100644
   
  /** create a directory */
  struct dentry *oprofilefs_mkdir(struct dentry *parent, char const *name);
-diff --git a/include/linux/overflow-arith.h b/include/linux/overflow-arith.h
-new file mode 100644
-index 0000000..e12ccf8
---- /dev/null
-+++ b/include/linux/overflow-arith.h
-@@ -0,0 +1,18 @@
-+#pragma once
-+
-+#include <linux/kernel.h>
-+
-+#ifdef CC_HAVE_BUILTIN_OVERFLOW
-+
-+#define overflow_usub __builtin_usub_overflow
-+
-+#else
-+
-+static inline bool overflow_usub(unsigned int a, unsigned int b,
-+				 unsigned int *res)
-+{
-+	*res = a - b;
-+	return *res > a ? true : false;
-+}
-+
-+#endif
 diff --git a/include/linux/padata.h b/include/linux/padata.h
 index 4386946..f50c615 100644
 --- a/include/linux/padata.h
@@ -102802,7 +102878,7 @@ index b483abd..af305ad 100644
  #endif
  #endif /* _LINUX_VGA_SWITCHEROO_H_ */
 diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
-index 0ec5983..d5888bb 100644
+index 0ec5983..66d8171 100644
 --- a/include/linux/vmalloc.h
 +++ b/include/linux/vmalloc.h
 @@ -18,6 +18,14 @@ struct vm_area_struct;		/* vma defining user mapping in mm_types.h */
@@ -102848,6 +102924,29 @@ index 0ec5983..d5888bb 100644
  
  /*
   *	Internals.  Dont't use..
+@@ -182,22 +195,10 @@ pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms)
+ # endif
+ #endif
+ 
+-struct vmalloc_info {
+-	unsigned long   used;
+-	unsigned long   largest_chunk;
+-};
+-
+ #ifdef CONFIG_MMU
+ #define VMALLOC_TOTAL (VMALLOC_END - VMALLOC_START)
+-extern void get_vmalloc_info(struct vmalloc_info *vmi);
+ #else
+-
+ #define VMALLOC_TOTAL 0UL
+-#define get_vmalloc_info(vmi)			\
+-do {						\
+-	(vmi)->used = 0;			\
+-	(vmi)->largest_chunk = 0;		\
+-} while (0)
+ #endif
+ 
+ #endif /* _LINUX_VMALLOC_H */
 diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
 index 82e7db7..f8ce3d0 100644
 --- a/include/linux/vmstat.h
@@ -117219,7 +117318,7 @@ index 68ff8a5..40c7a70 100644
  
  	if (len > buflen)
 diff --git a/mm/vmalloc.c b/mm/vmalloc.c
-index 2faaa29..c816cf4 100644
+index 2faaa29..7ac7a6d 100644
 --- a/mm/vmalloc.c
 +++ b/mm/vmalloc.c
 @@ -40,20 +40,65 @@ struct vfree_deferred {
@@ -117565,6 +117664,59 @@ index 2faaa29..c816cf4 100644
  
  	if (v->nr_pages)
  		seq_printf(m, " pages=%d", v->nr_pages);
+@@ -2688,52 +2844,5 @@ static int __init proc_vmalloc_init(void)
+ }
+ module_init(proc_vmalloc_init);
+ 
+-void get_vmalloc_info(struct vmalloc_info *vmi)
+-{
+-	struct vmap_area *va;
+-	unsigned long free_area_size;
+-	unsigned long prev_end;
+-
+-	vmi->used = 0;
+-	vmi->largest_chunk = 0;
+-
+-	prev_end = VMALLOC_START;
+-
+-	rcu_read_lock();
+-
+-	if (list_empty(&vmap_area_list)) {
+-		vmi->largest_chunk = VMALLOC_TOTAL;
+-		goto out;
+-	}
+-
+-	list_for_each_entry_rcu(va, &vmap_area_list, list) {
+-		unsigned long addr = va->va_start;
+-
+-		/*
+-		 * Some archs keep another range for modules in vmalloc space
+-		 */
+-		if (addr < VMALLOC_START)
+-			continue;
+-		if (addr >= VMALLOC_END)
+-			break;
+-
+-		if (va->flags & (VM_LAZY_FREE | VM_LAZY_FREEING))
+-			continue;
+-
+-		vmi->used += (va->va_end - va->va_start);
+-
+-		free_area_size = addr - prev_end;
+-		if (vmi->largest_chunk < free_area_size)
+-			vmi->largest_chunk = free_area_size;
+-
+-		prev_end = va->va_end;
+-	}
+-
+-	if (VMALLOC_END - prev_end > vmi->largest_chunk)
+-		vmi->largest_chunk = VMALLOC_END - prev_end;
+-
+-out:
+-	rcu_read_unlock();
+-}
+ #endif
+ 
 diff --git a/mm/vmstat.c b/mm/vmstat.c
 index 4f5cd97..9fb715a 100644
 --- a/mm/vmstat.c
@@ -120773,29 +120925,18 @@ index 69f4f68..1f97524 100644
  	.maxtype	= IFLA_GRE_MAX,
  	.policy		= ip6gre_policy,
 diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index d5f7716..b4b3821 100644
+index d5f7716..7da025a 100644
 --- a/net/ipv6/ip6_output.c
 +++ b/net/ipv6/ip6_output.c
-@@ -28,6 +28,7 @@
- 
- #include <linux/errno.h>
- #include <linux/kernel.h>
-+#include <linux/overflow-arith.h>
- #include <linux/string.h>
- #include <linux/socket.h>
- #include <linux/net.h>
-@@ -581,7 +582,10 @@ int ip6_fragment(struct sock *sk, struct sk_buff *skb,
+@@ -581,6 +581,8 @@ int ip6_fragment(struct sock *sk, struct sk_buff *skb,
  		if (np->frag_size)
  			mtu = np->frag_size;
  	}
--	mtu -= hlen + sizeof(struct frag_hdr);
-+
-+	if (overflow_usub(mtu, hlen + sizeof(struct frag_hdr), &mtu) ||
-+	    mtu <= 7)
++	if (mtu < hlen + sizeof(struct frag_hdr) + 8)
 +		goto fail_toobig;
+ 	mtu -= hlen + sizeof(struct frag_hdr);
  
  	frag_id = ipv6_select_ident(net, &ipv6_hdr(skb)->daddr,
- 				    &ipv6_hdr(skb)->saddr);
 diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
 index 2e67b66..b816b34 100644
 --- a/net/ipv6/ip6_tunnel.c
@@ -144927,10 +145068,10 @@ index 0000000..37e2e91
 +#endif
 diff --git a/tools/gcc/size_overflow_plugin/intentional_overflow.c b/tools/gcc/size_overflow_plugin/intentional_overflow.c
 new file mode 100644
-index 0000000..f888be6
+index 0000000..62eb578
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/intentional_overflow.c
-@@ -0,0 +1,944 @@
+@@ -0,0 +1,947 @@
 +/*
 + * Copyright 2011-2015 by Emese Revfy <re.emese@×××××.com>
 + * Licensed under the GPL v2, or (at your option) v3
@@ -145138,6 +145279,9 @@ index 0000000..f888be6
 +	switch (TREE_CODE(node)) {
 +	case COMPONENT_REF:
 +		cur_decl = search_field_decl(node);
++		// !!! temporarily ignore bitfield types
++		if (DECL_BIT_FIELD_TYPE(cur_decl))
++			return MARK_YES;
 +		if (is_turn_off_intentional_attr(cur_decl))
 +			return MARK_TURN_OFF;
 +		if (is_end_intentional_intentional_attr(cur_decl))
@@ -169141,7 +169285,7 @@ index 0000000..6075e8f
 +
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
 new file mode 100644
-index 0000000..b6d179f
+index 0000000..a82cc026
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
 @@ -0,0 +1,318 @@
@@ -169176,7 +169320,7 @@ index 0000000..b6d179f
 +tree size_overflow_type_TI;
 +
 +static struct plugin_info size_overflow_plugin_info = {
-+	.version	= "20151026",
++	.version	= "20151029",
 +	.help		= "no-size-overflow\tturn off size overflow checking\n",
 +};
 +