[gentoo-commits] linux-patches r1413 - hardened/2.6/trunk/2.6.26

[Gordon Malm (gengor)]

Author: gengor
Date: 2008-12-03 00:31:33 +0000 (Wed, 03 Dec 2008)
New Revision: 1413

Added:
   hardened/2.6/trunk/2.6.26/1401_cgroups-fix-invalid-cgrp-dentry-before-cgroup-has-been-completely-removed.patch
   hardened/2.6/trunk/2.6.26/1402_cpqarry-fix-return-value-of-cpqarray_init.patch
   hardened/2.6/trunk/2.6.26/1403_ext3-wait-on-all-pending-commits-in-ext3_sync_fs.patch
   hardened/2.6/trunk/2.6.26/1404_hid-fix-incorrent-length-condition-in-hidraw_write.patch
   hardened/2.6/trunk/2.6.26/1405_i-oat-fix-async_tx.callback-checking.patch
   hardened/2.6/trunk/2.6.26/1406_i-oat-fix-channel-resources-free-for-not-allocated-channels.patch
   hardened/2.6/trunk/2.6.26/1407_i-oat-fix-dma_pin_iovec_pages-error-handling.patch
   hardened/2.6/trunk/2.6.26/1408_jffs2-fix-lack-of-locking-in-thread_should_wake.patch
   hardened/2.6/trunk/2.6.26/1409_jffs2-fix-race-condition-in-jffs2_lzo_compress.patch
   hardened/2.6/trunk/2.6.26/1410_keys-make-request-key-instantiate-the-per-user-keyrings.patch
   hardened/2.6/trunk/2.6.26/1411_md-linear-fix-a-division-by-zero-bug-for-very-small-arrays.patch
   hardened/2.6/trunk/2.6.26/1412_mmc-increase-sd-write-timeout-for-crappy-cards.patch
   hardened/2.6/trunk/2.6.26/1413_net-unix-fix-inflight-counting-bug-in-garbage-collector.patch
   hardened/2.6/trunk/2.6.26/1414_acpi-avoid-empty-file-name-in-sysfs.patch
   hardened/2.6/trunk/2.6.26/1415_block-fix-nr_phys_segments-miscalculation-bug.patch
   hardened/2.6/trunk/2.6.26/1416_dm-raid1-flush-workqueue-before-destruction.patch
   hardened/2.6/trunk/2.6.26/1417_net-fix-proc-net-snmp-as-memory-corruptor.patch
   hardened/2.6/trunk/2.6.26/1418_touch_mnt_namespace-when-the-mount-flags-change.patch
   hardened/2.6/trunk/2.6.26/1419_usb-don-t-register-endpoints-for-interfaces-that-are-going-away.patch
   hardened/2.6/trunk/2.6.26/1420_usb-ehci-fix-divide-by-zero-bug.patch
   hardened/2.6/trunk/2.6.26/1421_usb-ehci-fix-handling-of-dead-controllers.patch
   hardened/2.6/trunk/2.6.26/1422_usb-fix-ps3-usb-shutdown-problems.patch
   hardened/2.6/trunk/2.6.26/1423_v4l-dvb-cve-2008-5033-fix-oops-on-tvaudio-when-controlling-bass-treble.patch
   hardened/2.6/trunk/2.6.26/1503_inotify-fix-watch-removal-or-umount-races.patch
   hardened/2.6/trunk/2.6.26/4455_grsec-make-PAX_REFCOUNT-conditional-on-x86.patch
   hardened/2.6/trunk/2.6.26/4460_pax-fix-mmap-BUG_ON-task-size-check.patch
   hardened/2.6/trunk/2.6.26/4465_pax-fix-false-RLIMIT_STACK-warnings.patch
Modified:
   hardened/2.6/trunk/2.6.26/0000_README
Log:
Update 2.6.26 trunk/

Modified: hardened/2.6/trunk/2.6.26/0000_README
===================================================================
--- hardened/2.6/trunk/2.6.26/0000_README	2008-11-28 15:37:18 UTC (rev 1412)
+++ hardened/2.6/trunk/2.6.26/0000_README	2008-12-03 00:31:33 UTC (rev 1413)
@@ -3,22 +3,20 @@
 
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1006_linux-2.6.26.7.patch
-From:	http://www.kernel.org
-Desc:	Linux 2.6.26.7
+Patch:	1401* -> 1413*
+From	http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git;
+	a=commit;h=ff413e9814b3914ddf3d4634e9a6cc1c6b21e787
+Desc:	Backported subset of 2.6.27.6 -stable release patches
 
-Patch:	1007_linux-2.6.26.8.patch
-From:	http://www.kernel.org
-Desc:	Linux 2.6.26.8
+Patch:	1414* -> 1423*
+From	http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git;
+	a=commit;h=526550b7f86d9d395ee1b27ed804e6ffc3feb17c
+Desc:	Backported subset of 2.6.27.7 -stable release patches
 
-Patch:	1503_hfsplus-check-read_mapping_page-return-value.patch
-From:	Eric Sesterhenn <snakebyte@×××.de>
-Desc:	hfsplus: check return value of read_mapping_page()
+Patch:	1503_inotify-fix-watch-removal-or-umount-races.patch
+From:	Al Viro <viro@×××××××××××××××.uk>
+Desc:	Fix inotify watch removal/umount races (bug #248754)
 
-Patch:	1504_hfsplus-fix-buffer-overflow-with-a-corrupted-image.patch
-From:	Eric Sesterhenn <snakebyte@×××.de>
-Desc:	hfsplus: fix buffer overflow when mounting corrupted image
-
 Patch:	4420_grsec-2.1.12-2.6.26.6-200810131006.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
@@ -60,3 +58,15 @@
 Patch:	4450_pax-2.6.26.7-test32-to-test33.patch
 From:	Gordon Malm <gengor@g.o>
 Desc:	Adds PaX changes from pax-2.6.26.7-test33
+
+Patch:	4455_grsec-make-PAX_REFCOUNT-conditional-on-x86.patch
+From:	Gordon Malm <gengor@g.o>
+Desc:	Make selection of PAX_REFCOUNT depend on X86 (bug #246763)
+
+Patch:	4460_pax-fix-mmap-BUG_ON-task-size-check.patch
+From:	Gordon Malm <gengor@g.o>
+Desc:	Fix incorrect vma task size check under SEGMEXEC
+
+Patch:	4465_pax-fix-false-RLIMIT_STACK-warnings.patch
+From:	Gordon Malm <gengor@g.o>
+Desc:	Fix false-positive RLIMIT_STACK warnings

Added: hardened/2.6/trunk/2.6.26/1401_cgroups-fix-invalid-cgrp-dentry-before-cgroup-has-been-completely-removed.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1401_cgroups-fix-invalid-cgrp-dentry-before-cgroup-has-been-completely-removed.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1401_cgroups-fix-invalid-cgrp-dentry-before-cgroup-has-been-completely-removed.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,65 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From jejb@××××××.org  Mon Nov 10 15:14:35 2008
+From: Li Zefan <lizf@××××××××××.com>
+Date: Fri, 7 Nov 2008 00:05:48 GMT
+Subject: cgroups: fix invalid cgrp->dentry before cgroup has been completely removed
+To: stable@××××××.org
+Message-ID: <200811070005.mA705mbU003066@×××××××××××.org>
+
+From: Li Zefan <lizf@××××××××××.com>
+
+commit 24eb089950ce44603b30a3145a2c8520e2b55bb1 upstream
+
+This fixes an oops when reading /proc/sched_debug.
+
+A cgroup won't be removed completely until finishing cgroup_diput(), so we
+shouldn't invalidate cgrp->dentry in cgroup_rmdir().  Otherwise, when a
+group is being removed while cgroup_path() gets called, we may trigger
+NULL dereference BUG.
+
+The bug can be reproduced:
+
+ # cat test.sh
+ #!/bin/sh
+ mount -t cgroup -o cpu xxx /mnt
+ for (( ; ; ))
+ {
+	mkdir /mnt/sub
+	rmdir /mnt/sub
+ }
+ # ./test.sh &
+ # cat /proc/sched_debug
+
+BUG: unable to handle kernel NULL pointer dereference at 00000038
+IP: [<c045a47f>] cgroup_path+0x39/0x90
+..
+Call Trace:
+ [<c0420344>] ? print_cfs_rq+0x6e/0x75d
+ [<c0421160>] ? sched_debug_show+0x72d/0xc1e
+..
+
+Signed-off-by: Li Zefan <lizf@××××××××××.com>
+Acked-by: Paul Menage <menage@××××××.com>
+Cc: Peter Zijlstra <a.p.zijlstra@××××××.nl>
+Cc: Ingo Molnar <mingo@××××.hu>
+Signed-off-by: Andrew Morton <akpm@××××××××××××××××.org>
+Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ kernel/cgroup.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -2443,7 +2443,6 @@ static int cgroup_rmdir(struct inode *un
+ 	list_del(&cgrp->sibling);
+ 	spin_lock(&cgrp->dentry->d_lock);
+ 	d = dget(cgrp->dentry);
+-	cgrp->dentry = NULL;
+ 	spin_unlock(&d->d_lock);
+ 
+ 	cgroup_d_remove_dir(d);

Added: hardened/2.6/trunk/2.6.26/1402_cpqarry-fix-return-value-of-cpqarray_init.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1402_cpqarry-fix-return-value-of-cpqarray_init.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1402_cpqarry-fix-return-value-of-cpqarray_init.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,55 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From 2197d18ded232ef6eef63cce57b6b21eddf1b7b6 Mon Sep 17 00:00:00 2001
+From: Andrey Borzenkov <arvidjaar@××××.ru>
+Date: Thu, 6 Nov 2008 12:53:15 -0800
+Subject: cpqarry: fix return value of cpqarray_init()
+
+From: Andrey Borzenkov <arvidjaar@××××.ru>
+
+commit 2197d18ded232ef6eef63cce57b6b21eddf1b7b6 upstream.
+
+As reported by Dick Gevers on Compaq ProLiant:
+
+Oct 13 18:06:51 dvgcpl kernel: Compaq SMART2 Driver (v 2.6.0)
+Oct 13 18:06:51 dvgcpl kernel: sys_init_module: 'cpqarray'->init
+suspiciously returned 1, it should follow 0/-E convention
+Oct 13 18:06:51 dvgcpl kernel: sys_init_module: loading module anyway...
+Oct 13 18:06:51 dvgcpl kernel: Pid: 315, comm: modprobe Not tainted
+2.6.27-desktop-0.rc8.2mnb #1
+Oct 13 18:06:51 dvgcpl kernel:  [<c0380612>] ? printk+0x18/0x1e
+Oct 13 18:06:51 dvgcpl kernel:  [<c0158f85>] sys_init_module+0x155/0x1c0
+Oct 13 18:06:51 dvgcpl kernel:  [<c0103f06>] syscall_call+0x7/0xb
+Oct 13 18:06:51 dvgcpl kernel:  =======================
+
+Make it return 0 on success and -ENODEV if no array was found.
+
+Reported-by: Dick Gevers <dvgevers@××××××.nl>
+Signed-off-by: Andrey Borzenkov <arvidjaar@××××.ru>
+Cc: Jens Axboe <jens.axboe@××××××.com>
+Signed-off-by: Andrew Morton <akpm@××××××××××××××××.org>
+Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ drivers/block/cpqarray.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/block/cpqarray.c
++++ b/drivers/block/cpqarray.c
+@@ -567,7 +567,12 @@ static int __init cpqarray_init(void)
+ 			num_cntlrs_reg++;
+ 	}
+ 
+-	return(num_cntlrs_reg);
++	if (num_cntlrs_reg)
++		return 0;
++	else {
++		pci_unregister_driver(&cpqarray_pci_driver);
++		return -ENODEV;
++	}
+ }
+ 
+ /* Function to find the first free pointer into our hba[] array */

Added: hardened/2.6/trunk/2.6.26/1403_ext3-wait-on-all-pending-commits-in-ext3_sync_fs.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1403_ext3-wait-on-all-pending-commits-in-ext3_sync_fs.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1403_ext3-wait-on-all-pending-commits-in-ext3_sync_fs.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,82 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From jejb@××××××.org  Mon Nov 10 15:08:55 2008
+From: Arthur Jones <ajones@××××××××.com>
+Date: Fri, 7 Nov 2008 00:05:17 GMT
+Subject: ext3: wait on all pending commits in ext3_sync_fs
+To: stable@××××××.org
+Message-ID: <200811070005.mA705Htq002320@×××××××××××.org>
+
+From: Arthur Jones <ajones@××××××××.com>
+
+commit c87591b719737b4e91eb1a9fa8fd55a4ff1886d6 upstream
+
+In ext3_sync_fs, we only wait for a commit to finish if we started it, but
+there may be one already in progress which will not be synced.
+
+In the case of a data=ordered umount with pending long symlinks which are
+delayed due to a long list of other I/O on the backing block device, this
+causes the buffer associated with the long symlinks to not be moved to the
+inode dirty list in the second phase of fsync_super.  Then, before they
+can be dirtied again, kjournald exits, seeing the UMOUNT flag and the
+dirty pages are never written to the backing block device, causing long
+symlink corruption and exposing new or previously freed block data to
+userspace.
+
+This can be reproduced with a script created
+by Eric Sandeen <sandeen@××××××.com>:
+
+	#!/bin/bash
+
+	umount /mnt/test2
+	mount /dev/sdb4 /mnt/test2
+	rm -f /mnt/test2/*
+	dd if=/dev/zero of=/mnt/test2/bigfile bs=1M count=512
+	touch
+	/mnt/test2/thisisveryveryveryveryveryveryveryveryveryveryveryveryveryveryveryverylongfilename
+	ln -s
+	/mnt/test2/thisisveryveryveryveryveryveryveryveryveryveryveryveryveryveryveryverylongfilename
+	/mnt/test2/link
+	umount /mnt/test2
+	mount /dev/sdb4 /mnt/test2
+	ls /mnt/test2/
+	umount /mnt/test2
+
+To ensure all commits are synced, we flush all journal commits now when
+sync_fs'ing ext3.
+
+Signed-off-by: Arthur Jones <ajones@××××××××.com>
+Cc: Eric Sandeen <sandeen@××××××.com>
+Cc: Theodore Ts'o <tytso@×××.edu>
+Cc: <linux-ext4@×××××××××××.org>
+Signed-off-by: Andrew Morton <akpm@××××××××××××××××.org>
+Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ fs/ext3/super.c |   11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/fs/ext3/super.c
++++ b/fs/ext3/super.c
+@@ -2365,13 +2365,12 @@ static void ext3_write_super (struct sup
+ 
+ static int ext3_sync_fs(struct super_block *sb, int wait)
+ {
+-	tid_t target;
+-
+ 	sb->s_dirt = 0;
+-	if (journal_start_commit(EXT3_SB(sb)->s_journal, &target)) {
+-		if (wait)
+-			log_wait_commit(EXT3_SB(sb)->s_journal, target);
+-	}
++	if (wait)
++		ext3_force_commit(sb);
++	else
++		journal_start_commit(EXT3_SB(sb)->s_journal, NULL);
++
+ 	return 0;
+ }
+ 

Added: hardened/2.6/trunk/2.6.26/1404_hid-fix-incorrent-length-condition-in-hidraw_write.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1404_hid-fix-incorrent-length-condition-in-hidraw_write.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1404_hid-fix-incorrent-length-condition-in-hidraw_write.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,48 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From jkosina@××××.cz  Tue Nov 11 15:52:41 2008
+From: Jiri Kosina <jkosina@××××.cz>
+Date: Tue, 11 Nov 2008 23:45:38 +0100 (CET)
+Subject: HID: fix incorrent length condition in hidraw_write()
+To: stable@××××××.org
+Cc: Paul Stoffregen <paul@××××.com>
+Message-ID: <alpine.LNX.1.10.0811112344180.24889@××××××××××.cz>
+
+From: Jiri Kosina <jkosina@××××.cz>
+
+upstream commit 2b107d629dc0c35de606bb7b010b829cd247a93a
+
+From: Jiri Kosina <jkosina@××××.cz>
+
+The bound check on the buffer length
+
+	if (count > HID_MIN_BUFFER_SIZE)
+
+is of course incorrent, the proper check is
+
+	if (count > HID_MAX_BUFFER_SIZE)
+
+Fix it.
+
+Reported-by: Jerry Ryle <jerry@×××××××××.com>
+Signed-off-by: Jiri Kosina <jkosina@××××.cz>
+Cc: Paul Stoffregen <paul@××××.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ drivers/hid/hidraw.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -113,7 +113,7 @@ static ssize_t hidraw_write(struct file 
+ 	if (!dev->hid_output_raw_report)
+ 		return -ENODEV;
+ 
+-	if (count > HID_MIN_BUFFER_SIZE) {
++	if (count > HID_MAX_BUFFER_SIZE) {
+ 		printk(KERN_WARNING "hidraw: pid %d passed too large report\n",
+ 				task_pid_nr(current));
+ 		return -EINVAL;

Added: hardened/2.6/trunk/2.6.26/1405_i-oat-fix-async_tx.callback-checking.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1405_i-oat-fix-async_tx.callback-checking.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1405_i-oat-fix-async_tx.callback-checking.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,48 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+Note: Backported to earlier kernels. Original message included below.
+
+---
+
+From jejb@××××××.org  Tue Nov 11 10:17:05 2008
+From: Maciej Sosnowski <maciej.sosnowski@×××××.com>
+Date: Tue, 11 Nov 2008 17:50:05 GMT
+Subject: I/OAT: fix async_tx.callback checking
+To: jejb@××××××.org, stable@××××××.org
+Message-ID: <200811111750.mABHo5Ai025612@×××××××××××.org>
+
+From: Maciej Sosnowski <maciej.sosnowski@×××××.com>
+
+commit 12ccea24e309d815d058cdc6ee8bf2c4b85f0c5f upstream
+
+async_tx.callback should be checked for the first
+not the last descriptor in the chain.
+
+Signed-off-by: Maciej Sosnowski <maciej.sosnowski@×××××.com>
+Signed-off-by: David S. Miller <davem@×××××××××.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ drivers/dma/ioat_dma.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/ioat_dma.c
++++ b/drivers/dma/ioat_dma.c
+@@ -251,7 +251,7 @@ static dma_cookie_t ioat1_tx_submit(stru
+ 	} while (len && (new = ioat1_dma_get_next_descriptor(ioat_chan)));
+ 
+ 	hw->ctl = IOAT_DMA_DESCRIPTOR_CTL_CP_STS;
+-	if (new->async_tx.callback) {
++	if (first->async_tx.callback) {
+ 		hw->ctl |= IOAT_DMA_DESCRIPTOR_CTL_INT_GN;
+ 		if (first != new) {
+ 			/* move callback into to last desc */
+@@ -336,7 +336,7 @@ static dma_cookie_t ioat2_tx_submit(stru
+ 	} while (len && (new = ioat2_dma_get_next_descriptor(ioat_chan)));
+ 
+ 	hw->ctl = IOAT_DMA_DESCRIPTOR_CTL_CP_STS;
+-	if (new->async_tx.callback) {
++	if (first->async_tx.callback) {
+ 		hw->ctl |= IOAT_DMA_DESCRIPTOR_CTL_INT_GN;
+ 		if (first != new) {
+ 			/* move callback into to last desc */

Added: hardened/2.6/trunk/2.6.26/1406_i-oat-fix-channel-resources-free-for-not-allocated-channels.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1406_i-oat-fix-channel-resources-free-for-not-allocated-channels.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1406_i-oat-fix-channel-resources-free-for-not-allocated-channels.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,54 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+Note: Backported to earlier kernels.  Original message below.
+
+---
+
+From jejb@××××××.org  Tue Nov 11 10:15:37 2008
+From: Maciej Sosnowski <maciej.sosnowski@×××××.com>
+Date: Tue, 11 Nov 2008 17:50:09 GMT
+Subject: I/OAT: fix channel resources free for not allocated channels
+To: stable@××××××.org
+Message-ID: <200811111750.mABHo9IU025655@×××××××××××.org>
+
+From: Maciej Sosnowski <maciej.sosnowski@×××××.com>
+
+commit c3d4f44f50b65b0b0290e357f8739cfb3f4bcaca upstream
+
+If the ioatdma driver is loaded but not used it does not allocate descriptors.
+Before it frees channel resources it should first be sure
+that they have been previously allocated.
+
+Signed-off-by: Maciej Sosnowski <maciej.sosnowski@×××××.com>
+Tested-by: Tom Picard <tom.s.picard@×××××.com>
+Signed-off-by: Dan Williams <dan.j.williams@×××××.com>
+Signed-off-by: David S. Miller <davem@×××××××××.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ drivers/dma/ioat_dma.c |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/dma/ioat_dma.c
++++ b/drivers/dma/ioat_dma.c
+@@ -524,6 +524,12 @@ static void ioat_dma_free_chan_resources
+ 	struct ioat_desc_sw *desc, *_desc;
+ 	int in_use_descs = 0;
+ 
++	/* Before freeing channel resources first check
++	* if they have been previously allocated for this channel.
++	*/
++	if (ioat_chan->desccount == 0)
++		return;
++
+ 	tasklet_disable(&ioat_chan->cleanup_task);
+ 	ioat_dma_memcpy_cleanup(ioat_chan);
+ 
+@@ -585,6 +591,7 @@ static void ioat_dma_free_chan_resources
+ 	ioat_chan->last_completion = ioat_chan->completion_addr = 0;
+ 	ioat_chan->pending = 0;
+ 	ioat_chan->dmacount = 0;
++	ioat_chan->desccount = 0;
+ }
+ 
+ /**

Added: hardened/2.6/trunk/2.6.26/1407_i-oat-fix-dma_pin_iovec_pages-error-handling.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1407_i-oat-fix-dma_pin_iovec_pages-error-handling.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1407_i-oat-fix-dma_pin_iovec_pages-error-handling.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,89 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From jejb@××××××.org  Tue Nov 11 10:16:31 2008
+From: Maciej Sosnowski <maciej.sosnowski@×××××.com>
+Date: Tue, 11 Nov 2008 17:50:07 GMT
+Subject: I/OAT: fix dma_pin_iovec_pages() error handling
+To: stable@××××××.org
+Message-ID: <200811111750.mABHo7v5025633@×××××××××××.org>
+
+From: Maciej Sosnowski <maciej.sosnowski@×××××.com>
+
+commit c2c0b4c5434c0a25f7f7796b29155d53805909f5 upstream
+
+Error handling needs to be modified in dma_pin_iovec_pages().
+It should return NULL instead of ERR_PTR
+(pinned_list is checked for NULL in tcp_recvmsg() to determine
+if iovec pages have been successfully pinned down).
+In case of error for the first iovec,
+local_list->nr_iovecs needs to be initialized.
+
+Signed-off-by: Maciej Sosnowski <maciej.sosnowski@×××××.com>
+Signed-off-by: David S. Miller <davem@×××××××××.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ drivers/dma/iovlock.c |   17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+--- a/drivers/dma/iovlock.c
++++ b/drivers/dma/iovlock.c
+@@ -55,7 +55,6 @@ struct dma_pinned_list *dma_pin_iovec_pa
+ 	int nr_iovecs = 0;
+ 	int iovec_len_used = 0;
+ 	int iovec_pages_used = 0;
+-	long err;
+ 
+ 	/* don't pin down non-user-based iovecs */
+ 	if (segment_eq(get_fs(), KERNEL_DS))
+@@ -72,23 +71,21 @@ struct dma_pinned_list *dma_pin_iovec_pa
+ 	local_list = kmalloc(sizeof(*local_list)
+ 		+ (nr_iovecs * sizeof (struct dma_page_list))
+ 		+ (iovec_pages_used * sizeof (struct page*)), GFP_KERNEL);
+-	if (!local_list) {
+-		err = -ENOMEM;
++	if (!local_list)
+ 		goto out;
+-	}
+ 
+ 	/* list of pages starts right after the page list array */
+ 	pages = (struct page **) &local_list->page_list[nr_iovecs];
+ 
++	local_list->nr_iovecs = 0;
++
+ 	for (i = 0; i < nr_iovecs; i++) {
+ 		struct dma_page_list *page_list = &local_list->page_list[i];
+ 
+ 		len -= iov[i].iov_len;
+ 
+-		if (!access_ok(VERIFY_WRITE, iov[i].iov_base, iov[i].iov_len)) {
+-			err = -EFAULT;
++		if (!access_ok(VERIFY_WRITE, iov[i].iov_base, iov[i].iov_len))
+ 			goto unpin;
+-		}
+ 
+ 		page_list->nr_pages = num_pages_spanned(&iov[i]);
+ 		page_list->base_address = iov[i].iov_base;
+@@ -109,10 +106,8 @@ struct dma_pinned_list *dma_pin_iovec_pa
+ 			NULL);
+ 		up_read(&current->mm->mmap_sem);
+ 
+-		if (ret != page_list->nr_pages) {
+-			err = -ENOMEM;
++		if (ret != page_list->nr_pages)
+ 			goto unpin;
+-		}
+ 
+ 		local_list->nr_iovecs = i + 1;
+ 	}
+@@ -122,7 +117,7 @@ struct dma_pinned_list *dma_pin_iovec_pa
+ unpin:
+ 	dma_unpin_iovec_pages(local_list);
+ out:
+-	return ERR_PTR(err);
++	return NULL;
+ }
+ 
+ void dma_unpin_iovec_pages(struct dma_pinned_list *pinned_list)

Added: hardened/2.6/trunk/2.6.26/1408_jffs2-fix-lack-of-locking-in-thread_should_wake.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1408_jffs2-fix-lack-of-locking-in-thread_should_wake.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1408_jffs2-fix-lack-of-locking-in-thread_should_wake.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,51 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From jejb@××××××.org  Tue Nov 11 09:53:44 2008
+From: David Woodhouse <David.Woodhouse@×××××.com>
+Date: Fri, 7 Nov 2008 00:08:59 GMT
+Subject: JFFS2: Fix lack of locking in thread_should_wake()
+To: stable@××××××.org
+Message-ID: <200811070008.mA708xQE008191@×××××××××××.org>
+
+From: David Woodhouse <David.Woodhouse@×××××.com>
+
+commit b27cf88e9592953ae292d05324887f2f44979433 upstream
+
+The thread_should_wake() function trawls through the list of 'very
+dirty' eraseblocks, determining whether the background GC thread should
+wake. Doing this without holding the appropriate locks is a bad idea.
+
+OLPC Trac #8615
+
+Signed-off-by: David Woodhouse <David.Woodhouse@×××××.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ fs/jffs2/background.c |   10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/fs/jffs2/background.c
++++ b/fs/jffs2/background.c
+@@ -85,15 +85,15 @@ static int jffs2_garbage_collect_thread(
+ 	for (;;) {
+ 		allow_signal(SIGHUP);
+ 	again:
++		spin_lock(&c->erase_completion_lock);
+ 		if (!jffs2_thread_should_wake(c)) {
+ 			set_current_state (TASK_INTERRUPTIBLE);
++			spin_unlock(&c->erase_completion_lock);
+ 			D1(printk(KERN_DEBUG "jffs2_garbage_collect_thread sleeping...\n"));
+-			/* Yes, there's a race here; we checked jffs2_thread_should_wake()
+-			   before setting current->state to TASK_INTERRUPTIBLE. But it doesn't
+-			   matter - We don't care if we miss a wakeup, because the GC thread
+-			   is only an optimisation anyway. */
+ 			schedule();
+-		}
++		} else
++			spin_unlock(&c->erase_completion_lock);
++
+ 
+ 		/* This thread is purely an optimisation. But if it runs when
+ 		   other things could be running, it actually makes things a

Added: hardened/2.6/trunk/2.6.26/1409_jffs2-fix-race-condition-in-jffs2_lzo_compress.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1409_jffs2-fix-race-condition-in-jffs2_lzo_compress.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1409_jffs2-fix-race-condition-in-jffs2_lzo_compress.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,70 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From jejb@××××××.org  Tue Nov 11 09:53:08 2008
+From: Geert Uytterhoeven <Geert.Uytterhoeven@×××××××.com>
+Date: Fri, 7 Nov 2008 00:08:19 GMT
+Subject: JFFS2: fix race condition in jffs2_lzo_compress()
+To: stable@××××××.org
+Message-ID: <200811070008.mA708Jdo007031@×××××××××××.org>
+
+From: Geert Uytterhoeven <Geert.Uytterhoeven@×××××××.com>
+
+commit dc8a0843a435b2c0891e7eaea64faaf1ebec9b11 upstream
+
+deflate_mutex protects the globals lzo_mem and lzo_compress_buf.  However,
+jffs2_lzo_compress() unlocks deflate_mutex _before_ it has copied out the
+compressed data from lzo_compress_buf.  Correct this by moving the mutex
+unlock after the copy.
+
+In addition, document what deflate_mutex actually protects.
+
+Signed-off-by: Geert Uytterhoeven <Geert.Uytterhoeven@×××××××.com>
+Acked-by: Richard Purdie <rpurdie@××××××××××.com>
+Signed-off-by: Andrew Morton <akpm@××××××××××××××××.org>
+Signed-off-by: David Woodhouse <David.Woodhouse@×××××.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ fs/jffs2/compr_lzo.c |   15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/fs/jffs2/compr_lzo.c
++++ b/fs/jffs2/compr_lzo.c
+@@ -19,7 +19,7 @@
+ 
+ static void *lzo_mem;
+ static void *lzo_compress_buf;
+-static DEFINE_MUTEX(deflate_mutex);
++static DEFINE_MUTEX(deflate_mutex);	/* for lzo_mem and lzo_compress_buf */
+ 
+ static void free_workspace(void)
+ {
+@@ -49,18 +49,21 @@ static int jffs2_lzo_compress(unsigned c
+ 
+ 	mutex_lock(&deflate_mutex);
+ 	ret = lzo1x_1_compress(data_in, *sourcelen, lzo_compress_buf, &compress_size, lzo_mem);
+-	mutex_unlock(&deflate_mutex);
+-
+ 	if (ret != LZO_E_OK)
+-		return -1;
++		goto fail;
+ 
+ 	if (compress_size > *dstlen)
+-		return -1;
++		goto fail;
+ 
+ 	memcpy(cpage_out, lzo_compress_buf, compress_size);
+-	*dstlen = compress_size;
++	mutex_unlock(&deflate_mutex);
+ 
++	*dstlen = compress_size;
+ 	return 0;
++
++ fail:
++	mutex_unlock(&deflate_mutex);
++	return -1;
+ }
+ 
+ static int jffs2_lzo_decompress(unsigned char *data_in, unsigned char *cpage_out,

Added: hardened/2.6/trunk/2.6.26/1410_keys-make-request-key-instantiate-the-per-user-keyrings.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1410_keys-make-request-key-instantiate-the-per-user-keyrings.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1410_keys-make-request-key-instantiate-the-per-user-keyrings.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,63 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From 1f8f5cf6e4f038552a3e47b66085452c08556d71 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@××××××.com>
+Date: Mon, 10 Nov 2008 19:00:05 +0000
+Subject: KEYS: Make request key instantiate the per-user keyrings
+
+From: David Howells <dhowells@××××××.com>
+
+commit 1f8f5cf6e4f038552a3e47b66085452c08556d71 upstream
+
+Make request_key() instantiate the per-user keyrings so that it doesn't oops
+if it needs to get hold of the user session keyring because there isn't a
+session keyring in place.
+
+Signed-off-by: David Howells <dhowells@××××××.com>
+Tested-by: Steve French <smfrench@×××××.com>
+Tested-by: Rutger Nijlunsing <rutger.nijlunsing@×××××.com>
+Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ security/keys/internal.h     |    1 +
+ security/keys/process_keys.c |    2 +-
+ security/keys/request_key.c  |    4 ++++
+ 3 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/security/keys/internal.h
++++ b/security/keys/internal.h
+@@ -107,6 +107,7 @@ extern key_ref_t search_process_keyrings
+ 
+ extern struct key *find_keyring_by_name(const char *name, bool skip_perm_check);
+ 
++extern int install_user_keyrings(struct task_struct *tsk);
+ extern int install_thread_keyring(struct task_struct *tsk);
+ extern int install_process_keyring(struct task_struct *tsk);
+ 
+--- a/security/keys/process_keys.c
++++ b/security/keys/process_keys.c
+@@ -40,7 +40,7 @@ struct key_user root_key_user = {
+ /*
+  * install user and user session keyrings for a particular UID
+  */
+-static int install_user_keyrings(struct task_struct *tsk)
++int install_user_keyrings(struct task_struct *tsk)
+ {
+ 	struct user_struct *user = tsk->user;
+ 	struct key *uid_keyring, *session_keyring;
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -74,6 +74,10 @@ static int call_sbin_request_key(struct 
+ 
+ 	kenter("{%d},{%d},%s", key->serial, authkey->serial, op);
+ 
++	ret = install_user_keyrings(tsk);
++	if (ret < 0)
++		goto error_alloc;
++
+ 	/* allocate a new session keyring */
+ 	sprintf(desc, "_req.%u", key->serial);
+ 

Added: hardened/2.6/trunk/2.6.26/1411_md-linear-fix-a-division-by-zero-bug-for-very-small-arrays.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1411_md-linear-fix-a-division-by-zero-bug-for-very-small-arrays.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1411_md-linear-fix-a-division-by-zero-bug-for-very-small-arrays.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,51 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+Note: Changed patch slightly to eliminate fuzz.
+
+---
+
+From jejb@××××××.org  Tue Nov 11 09:47:32 2008
+From: Andre Noll <maan@×××××××××××.org>
+Date: Fri, 7 Nov 2008 00:07:46 GMT
+Subject: md: linear: Fix a division by zero bug for very small arrays.
+To: stable@××××××.org
+Message-ID: <200811070007.mA707k6d006270@×××××××××××.org>
+
+From: Andre Noll <maan@×××××××××××.org>
+
+commit f1cd14ae52985634d0389e934eba25b5ecf24565 upstream
+
+Date: Thu, 6 Nov 2008 19:41:24 +1100
+Subject: md: linear: Fix a division by zero bug for very small arrays.
+
+We currently oops with a divide error on starting a linear software
+raid array consisting of at least two very small (< 500K) devices.
+
+The bug is caused by the calculation of the hash table size which
+tries to compute sector_div(sz, base) with "base" being zero due to
+the small size of the component devices of the array.
+
+Fix this by requiring the hash spacing to be at least one which
+implies that also "base" is non-zero.
+
+This bug has existed since about 2.6.14.
+
+Signed-off-by: Andre Noll <maan@×××××××××××.org>
+Signed-off-by: NeilBrown <neilb@××××.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ drivers/md/linear.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/linear.c
++++ b/drivers/md/linear.c
+@@ -157,6 +157,8 @@ static linear_conf_t *linear_conf(mddev_
+ 
+ 	min_spacing = conf->array_size;
+ 	sector_div(min_spacing, PAGE_SIZE/sizeof(struct dev_info *));
++	if (min_spacing == 0)
++		min_spacing = 1;
+ 
+ 	/* min_spacing is the minimum spacing that will fit the hash
+ 	 * table in one PAGE.  This may be much smaller than needed.

Added: hardened/2.6/trunk/2.6.26/1412_mmc-increase-sd-write-timeout-for-crappy-cards.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1412_mmc-increase-sd-write-timeout-for-crappy-cards.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1412_mmc-increase-sd-write-timeout-for-crappy-cards.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,42 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From 493890e75d98810a3470b4aae23be628ee5e9667 Mon Sep 17 00:00:00 2001
+From: Pierre Ossman <drzeus@××××××.cx>
+Date: Sun, 26 Oct 2008 12:37:25 +0100
+Subject: mmc: increase SD write timeout for crappy cards
+
+From: Pierre Ossman <drzeus@××××××.cx>
+
+commit 493890e75d98810a3470b4aae23be628ee5e9667 upstream.
+
+It seems that some cards are slightly out of spec and occasionally
+will not be able to complete a write in the alloted 250 ms [1].
+Incease the timeout slightly to allow even these cards to function
+properly.
+
+[1] http://lkml.org/lkml/2008/9/23/390
+
+Signed-off-by: Pierre Ossman <drzeus@××××××.cx>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ drivers/mmc/core/core.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -280,7 +280,11 @@ void mmc_set_data_timeout(struct mmc_dat
+ 			(card->host->ios.clock / 1000);
+ 
+ 		if (data->flags & MMC_DATA_WRITE)
+-			limit_us = 250000;
++			/*
++			 * The limit is really 250 ms, but that is
++			 * insufficient for some crappy cards.
++			 */
++			limit_us = 300000;
+ 		else
+ 			limit_us = 100000;
+ 

Added: hardened/2.6/trunk/2.6.26/1413_net-unix-fix-inflight-counting-bug-in-garbage-collector.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1413_net-unix-fix-inflight-counting-bug-in-garbage-collector.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1413_net-unix-fix-inflight-counting-bug-in-garbage-collector.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,213 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+Backported to earlier kernels.  Original message included below.
+
+---
+
+From jejb@××××××.org  Tue Nov 11 09:59:05 2008
+From: Miklos Szeredi <mszeredi@××××.cz>
+Date: Sun, 9 Nov 2008 19:50:02 GMT
+Subject: net: unix: fix inflight counting bug in garbage collector
+To: stable@××××××.org
+Message-ID: <200811091950.mA9Jo2iL003804@×××××××××××.org>
+
+From: Miklos Szeredi <mszeredi@××××.cz>
+
+commit 6209344f5a3795d34b7f2c0061f49802283b6bdd upstream
+
+Previously I assumed that the receive queues of candidates don't
+change during the GC.  This is only half true, nothing can be received
+from the queues (see comment in unix_gc()), but buffers could be added
+through the other half of the socket pair, which may still have file
+descriptors referring to it.
+
+This can result in inc_inflight_move_tail() erronously increasing the
+"inflight" counter for a unix socket for which dec_inflight() wasn't
+previously called.  This in turn can trigger the "BUG_ON(total_refs <
+inflight_refs)" in a later garbage collection run.
+
+Fix this by only manipulating the "inflight" counter for sockets which
+are candidates themselves.  Duplicating the file references in
+unix_attach_fds() is also needed to prevent a socket becoming a
+candidate for GC while the skb that contains it is not yet queued.
+
+Reported-by: Andrea Bittau <a.bittau@×××××××××.uk>
+Signed-off-by: Miklos Szeredi <mszeredi@××××.cz>
+Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ include/net/af_unix.h |    1 +
+ net/unix/af_unix.c    |   31 ++++++++++++++++++++++++-------
+ net/unix/garbage.c    |   49 +++++++++++++++++++++++++++++++++++++------------
+ 3 files changed, 62 insertions(+), 19 deletions(-)
+
+--- a/include/net/af_unix.h
++++ b/include/net/af_unix.h
+@@ -54,6 +54,7 @@ struct unix_sock {
+         atomic_t                inflight;
+         spinlock_t		lock;
+ 	unsigned int		gc_candidate : 1;
++	unsigned int		gc_maybe_cycle : 1;
+         wait_queue_head_t       peer_wait;
+ };
+ #define unix_sk(__sk) ((struct unix_sock *)__sk)
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1302,14 +1302,23 @@ static void unix_destruct_fds(struct sk_
+ 	sock_wfree(skb);
+ }
+ 
+-static void unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
++static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+ {
+ 	int i;
++
++	/*
++	 * Need to duplicate file references for the sake of garbage
++	 * collection.  Otherwise a socket in the fps might become a
++	 * candidate for GC while the skb is not yet queued.
++	 */
++	UNIXCB(skb).fp = scm_fp_dup(scm->fp);
++	if (!UNIXCB(skb).fp)
++		return -ENOMEM;
++
+ 	for (i=scm->fp->count-1; i>=0; i--)
+ 		unix_inflight(scm->fp->fp[i]);
+-	UNIXCB(skb).fp = scm->fp;
+ 	skb->destructor = unix_destruct_fds;
+-	scm->fp = NULL;
++	return 0;
+ }
+ 
+ /*
+@@ -1368,8 +1377,11 @@ static int unix_dgram_sendmsg(struct kio
+ 		goto out;
+ 
+ 	memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
+-	if (siocb->scm->fp)
+-		unix_attach_fds(siocb->scm, skb);
++	if (siocb->scm->fp) {
++		err = unix_attach_fds(siocb->scm, skb);
++		if (err)
++			goto out_free;
++	}
+ 	unix_get_secdata(siocb->scm, skb);
+ 
+ 	skb_reset_transport_header(skb);
+@@ -1538,8 +1550,13 @@ static int unix_stream_sendmsg(struct ki
+ 		size = min_t(int, size, skb_tailroom(skb));
+ 
+ 		memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
+-		if (siocb->scm->fp)
+-			unix_attach_fds(siocb->scm, skb);
++		if (siocb->scm->fp) {
++			err = unix_attach_fds(siocb->scm, skb);
++			if (err) {
++				kfree_skb(skb);
++				goto out_err;
++			}
++		}
+ 
+ 		if ((err = memcpy_fromiovec(skb_put(skb,size), msg->msg_iov, size)) != 0) {
+ 			kfree_skb(skb);
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -186,8 +186,17 @@ static void scan_inflight(struct sock *x
+ 				 */
+ 				struct sock *sk = unix_get_socket(*fp++);
+ 				if (sk) {
+-					hit = true;
+-					func(unix_sk(sk));
++					struct unix_sock *u = unix_sk(sk);
++
++					/*
++					 * Ignore non-candidates, they could
++					 * have been added to the queues after
++					 * starting the garbage collection
++					 */
++					if (u->gc_candidate) {
++						hit = true;
++						func(u);
++					}
+ 				}
+ 			}
+ 			if (hit && hitlist != NULL) {
+@@ -249,11 +258,11 @@ static void inc_inflight_move_tail(struc
+ {
+ 	atomic_inc(&u->inflight);
+ 	/*
+-	 * If this is still a candidate, move it to the end of the
+-	 * list, so that it's checked even if it was already passed
+-	 * over
++	 * If this still might be part of a cycle, move it to the end
++	 * of the list, so that it's checked even if it was already
++	 * passed over
+ 	 */
+-	if (u->gc_candidate)
++	if (u->gc_maybe_cycle)
+ 		list_move_tail(&u->link, &gc_candidates);
+ }
+ 
+@@ -267,6 +276,7 @@ void unix_gc(void)
+ 	struct unix_sock *next;
+ 	struct sk_buff_head hitlist;
+ 	struct list_head cursor;
++	LIST_HEAD(not_cycle_list);
+ 
+ 	spin_lock(&unix_gc_lock);
+ 
+@@ -282,10 +292,14 @@ void unix_gc(void)
+ 	 *
+ 	 * Holding unix_gc_lock will protect these candidates from
+ 	 * being detached, and hence from gaining an external
+-	 * reference.  This also means, that since there are no
+-	 * possible receivers, the receive queues of these sockets are
+-	 * static during the GC, even though the dequeue is done
+-	 * before the detach without atomicity guarantees.
++	 * reference.  Since there are no possible receivers, all
++	 * buffers currently on the candidates' queues stay there
++	 * during the garbage collection.
++	 *
++	 * We also know that no new candidate can be added onto the
++	 * receive queues.  Other, non candidate sockets _can_ be
++	 * added to queue, so we must make sure only to touch
++	 * candidates.
+ 	 */
+ 	list_for_each_entry_safe(u, next, &gc_inflight_list, link) {
+ 		int total_refs;
+@@ -299,6 +313,7 @@ void unix_gc(void)
+ 		if (total_refs == inflight_refs) {
+ 			list_move_tail(&u->link, &gc_candidates);
+ 			u->gc_candidate = 1;
++			u->gc_maybe_cycle = 1;
+ 		}
+ 	}
+ 
+@@ -325,14 +340,24 @@ void unix_gc(void)
+ 		list_move(&cursor, &u->link);
+ 
+ 		if (atomic_read(&u->inflight) > 0) {
+-			list_move_tail(&u->link, &gc_inflight_list);
+-			u->gc_candidate = 0;
++			list_move_tail(&u->link, &not_cycle_list);
++			u->gc_maybe_cycle = 0;
+ 			scan_children(&u->sk, inc_inflight_move_tail, NULL);
+ 		}
+ 	}
+ 	list_del(&cursor);
+ 
+ 	/*
++	 * not_cycle_list contains those sockets which do not make up a
++	 * cycle.  Restore these to the inflight list.
++	 */
++	while (!list_empty(&not_cycle_list)) {
++		u = list_entry(not_cycle_list.next, struct unix_sock, link);
++		u->gc_candidate = 0;
++		list_move_tail(&u->link, &gc_inflight_list);
++	}
++
++	/*
+ 	 * Now gc_candidates contains only garbage.  Restore original
+ 	 * inflight counters for these as well, and remove the skbuffs
+ 	 * which are creating the cycle(s).

Added: hardened/2.6/trunk/2.6.26/1414_acpi-avoid-empty-file-name-in-sysfs.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1414_acpi-avoid-empty-file-name-in-sysfs.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1414_acpi-avoid-empty-file-name-in-sysfs.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,81 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From 4feba70a2c1a1a0c96909f657f48b2e11e682370 Mon Sep 17 00:00:00 2001
+From: Peter Gruber <nokos@×××.net>
+Date: Mon, 27 Oct 2008 23:59:36 -0400
+Subject: ACPI: avoid empty file name in sysfs
+
+From: Peter Gruber <nokos@×××.net>
+
+commit 4feba70a2c1a1a0c96909f657f48b2e11e682370 upstream.
+
+Since commit bc45b1d39a925b56796bebf8a397a0491489d85c acpi tables are
+allowed to have an empty signature and /sys/firmware/acpi/tables uses the
+signature as filename.  Applications using naive recursion through /sys
+loop forever.  A possible solution would be: (replacing the zero length
+filename with the string "NULL")
+
+http://bugzilla.kernel.org/show_bug.cgi?id=11539
+
+Acked-by: Zhang Rui <rui.zhang@×××××.com>
+Signed-off-by: Andrew Morton <akpm@××××××××××××××××.org>
+Signed-off-by: Len Brown <len.brown@×××××.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ drivers/acpi/system.c |   25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+--- a/drivers/acpi/system.c
++++ b/drivers/acpi/system.c
+@@ -78,9 +78,15 @@ static ssize_t acpi_table_show(struct ko
+ 	    container_of(bin_attr, struct acpi_table_attr, attr);
+ 	struct acpi_table_header *table_header = NULL;
+ 	acpi_status status;
++	char name[ACPI_NAME_SIZE];
++
++	if (strncmp(table_attr->name, "NULL", 4))
++		memcpy(name, table_attr->name, ACPI_NAME_SIZE);
++	else
++		memcpy(name, "\0\0\0\0", 4);
+ 
+ 	status =
+-	    acpi_get_table(table_attr->name, table_attr->instance,
++	    acpi_get_table(name, table_attr->instance,
+ 			   &table_header);
+ 	if (ACPI_FAILURE(status))
+ 		return -ENODEV;
+@@ -95,21 +101,24 @@ static void acpi_table_attr_init(struct 
+ 	struct acpi_table_header *header = NULL;
+ 	struct acpi_table_attr *attr = NULL;
+ 
+-	memcpy(table_attr->name, table_header->signature, ACPI_NAME_SIZE);
++	if (table_header->signature[0] != '\0')
++		memcpy(table_attr->name, table_header->signature,
++			ACPI_NAME_SIZE);
++	else
++		memcpy(table_attr->name, "NULL", 4);
+ 
+ 	list_for_each_entry(attr, &acpi_table_attr_list, node) {
+-		if (!memcmp(table_header->signature, attr->name,
+-			    ACPI_NAME_SIZE))
++		if (!memcmp(table_attr->name, attr->name, ACPI_NAME_SIZE))
+ 			if (table_attr->instance < attr->instance)
+ 				table_attr->instance = attr->instance;
+ 	}
+ 	table_attr->instance++;
+ 
+ 	if (table_attr->instance > 1 || (table_attr->instance == 1 &&
+-					 !acpi_get_table(table_header->
+-							 signature, 2,
+-							 &header)))
+-		sprintf(table_attr->name + 4, "%d", table_attr->instance);
++					!acpi_get_table
++					(table_header->signature, 2, &header)))
++		sprintf(table_attr->name + ACPI_NAME_SIZE, "%d",
++			table_attr->instance);
+ 
+ 	table_attr->attr.size = 0;
+ 	table_attr->attr.read = acpi_table_show;

Added: hardened/2.6/trunk/2.6.26/1415_block-fix-nr_phys_segments-miscalculation-bug.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1415_block-fix-nr_phys_segments-miscalculation-bug.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1415_block-fix-nr_phys_segments-miscalculation-bug.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,126 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From knikanth@××××.de  Thu Nov 13 14:07:47 2008
+From: FUJITA Tomonori <fujita.tomonori@××××××××××.jp>
+Date: Wed, 12 Nov 2008 11:33:54 +0530
+Subject: block: fix nr_phys_segments miscalculation bug
+To: Greg KH <greg@×××××.com>
+Cc: stable@××××××.org, FUJITA Tomonori <fujita.tomonori@××××××××××.jp>
+Message-ID: <200811121133.55404.knikanth@××××.de>
+Content-Disposition: inline
+
+From: FUJITA Tomonori <fujita.tomonori@××××××××××.jp>
+
+commit 8677142710516d986d932d6f1fba7be8382c1fec upstream
+backported by Nikanth Karthikesan <knikanth@××××.de> to the 2.6.27.y tree.
+
+block: fix nr_phys_segments miscalculation bug
+
+This fixes the bug reported by Nikanth Karthikesan <knikanth@××××.de>:
+
+http://lkml.org/lkml/2008/10/2/203
+
+The root cause of the bug is that blk_phys_contig_segment
+miscalculates q->max_segment_size.
+
+blk_phys_contig_segment checks:
+
+req->biotail->bi_size + next_req->bio->bi_size > q->max_segment_size
+
+But blk_recalc_rq_segments might expect that req->biotail and the
+previous bio in the req are supposed be merged into one
+segment. blk_recalc_rq_segments might also expect that next_req->bio
+and the next bio in the next_req are supposed be merged into one
+segment. In such case, we merge two requests that can't be merged
+here. Later, blk_rq_map_sg gives more segments than it should.
+
+We need to keep track of segment size in blk_recalc_rq_segments and
+use it to see if two requests can be merged. This patch implements it
+in the similar way that we used to do for hw merging (virtual
+merging).
+
+Signed-off-by: FUJITA Tomonori <fujita.tomonori@××××××××××.jp>
+Signed-off-by: Jens Axboe <jens.axboe@××××××.com>
+Cc: Nikanth Karthikesan <knikanth@××××.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ block/blk-merge.c   |   19 +++++++++++++++++--
+ include/linux/bio.h |    7 +++++++
+ 2 files changed, 24 insertions(+), 2 deletions(-)
+
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -95,6 +95,9 @@ new_hw_segment:
+ 			nr_hw_segs++;
+ 		}
+ 
++		if (nr_phys_segs == 1 && seg_size > rq->bio->bi_seg_front_size)
++			rq->bio->bi_seg_front_size = seg_size;
++
+ 		nr_phys_segs++;
+ 		bvprv = bv;
+ 		seg_size = bv->bv_len;
+@@ -106,6 +109,10 @@ new_hw_segment:
+ 		rq->bio->bi_hw_front_size = hw_seg_size;
+ 	if (hw_seg_size > rq->biotail->bi_hw_back_size)
+ 		rq->biotail->bi_hw_back_size = hw_seg_size;
++	if (nr_phys_segs == 1 && seg_size > rq->bio->bi_seg_front_size)
++		rq->bio->bi_seg_front_size = seg_size;
++	if (seg_size > rq->biotail->bi_seg_back_size)
++		rq->biotail->bi_seg_back_size = seg_size;
+ 	rq->nr_phys_segments = nr_phys_segs;
+ 	rq->nr_hw_segments = nr_hw_segs;
+ }
+@@ -133,7 +140,8 @@ static int blk_phys_contig_segment(struc
+ 
+ 	if (!BIOVEC_PHYS_MERGEABLE(__BVEC_END(bio), __BVEC_START(nxt)))
+ 		return 0;
+-	if (bio->bi_size + nxt->bi_size > q->max_segment_size)
++	if (bio->bi_seg_back_size + nxt->bi_seg_front_size >
++	    q->max_segment_size)
+ 		return 0;
+ 
+ 	/*
+@@ -377,6 +385,8 @@ static int ll_merge_requests_fn(struct r
+ {
+ 	int total_phys_segments;
+ 	int total_hw_segments;
++	unsigned int seg_size =
++		req->biotail->bi_seg_back_size + next->bio->bi_seg_front_size;
+ 
+ 	/*
+ 	 * First check if the either of the requests are re-queued
+@@ -392,8 +402,13 @@ static int ll_merge_requests_fn(struct r
+ 		return 0;
+ 
+ 	total_phys_segments = req->nr_phys_segments + next->nr_phys_segments;
+-	if (blk_phys_contig_segment(q, req->biotail, next->bio))
++	if (blk_phys_contig_segment(q, req->biotail, next->bio)) {
++		if (req->nr_phys_segments == 1)
++			req->bio->bi_seg_front_size = seg_size;
++		if (next->nr_phys_segments == 1)
++			next->biotail->bi_seg_back_size = seg_size;
+ 		total_phys_segments--;
++	}
+ 
+ 	if (total_phys_segments > q->max_phys_segments)
+ 		return 0;
+--- a/include/linux/bio.h
++++ b/include/linux/bio.h
+@@ -98,6 +98,13 @@ struct bio {
+ 	unsigned int		bi_size;	/* residual I/O count */
+ 
+ 	/*
++	 * To keep track of the max segment size, we account for the
++	 * sizes of the first and last mergeable segments in this bio.
++	 */
++	unsigned int            bi_seg_front_size;
++	unsigned int            bi_seg_back_size;
++
++	/*
+ 	 * To keep track of the max hw size, we account for the
+ 	 * sizes of the first and last virtually mergeable segments
+ 	 * in this bio

Added: hardened/2.6/trunk/2.6.26/1416_dm-raid1-flush-workqueue-before-destruction.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1416_dm-raid1-flush-workqueue-before-destruction.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1416_dm-raid1-flush-workqueue-before-destruction.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,34 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From 18776c7316545482a02bfaa2629a2aa1afc48357 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@××××××.com>
+Date: Thu, 13 Nov 2008 23:38:52 +0000
+Subject: dm raid1: flush workqueue before destruction
+
+From: Mikulas Patocka <mpatocka@××××××.com>
+
+commit 18776c7316545482a02bfaa2629a2aa1afc48357 upstream.
+
+We queue work on keventd queue --- so this queue must be flushed in the
+destructor. Otherwise, keventd could access mirror_set after it was freed.
+
+Signed-off-by: Mikulas Patocka <mpatocka@××××××.com>
+Signed-off-by: Alasdair G Kergon <agk@××××××.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ drivers/md/dm-raid1.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/dm-raid1.c
++++ b/drivers/md/dm-raid1.c
+@@ -1598,6 +1598,7 @@ static void mirror_dtr(struct dm_target 
+ 
+ 	del_timer_sync(&ms->timer);
+ 	flush_workqueue(ms->kmirrord_wq);
++	flush_scheduled_work();
+ 	dm_kcopyd_client_destroy(ms->kcopyd_client);
+ 	destroy_workqueue(ms->kmirrord_wq);
+ 	free_context(ms, ti, ms->nr_mirrors);

Added: hardened/2.6/trunk/2.6.26/1417_net-fix-proc-net-snmp-as-memory-corruptor.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1417_net-fix-proc-net-snmp-as-memory-corruptor.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1417_net-fix-proc-net-snmp-as-memory-corruptor.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,104 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+Note: Backported to earlier kernels. Original message included below.
+
+---
+
+From b971e7ac834e9f4bda96d5a96ae9abccd01c1dd8 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <dada1@×××××××××.com>
+Date: Mon, 10 Nov 2008 21:43:08 -0800
+Subject: net: fix /proc/net/snmp as memory corruptor
+
+From: Eric Dumazet <dada1@×××××××××.com>
+
+commit b971e7ac834e9f4bda96d5a96ae9abccd01c1dd8 upstream.
+
+icmpmsg_put() can happily corrupt kernel memory, using a static
+table and forgetting to reset an array index in a loop.
+
+Remove the static array since its not safe without proper locking.
+
+Signed-off-by: Alexey Dobriyan <adobriyan@×××××.com>
+Signed-off-by: Eric Dumazet <dada1@×××××××××.com>
+Signed-off-by: David S. Miller <davem@×××××××××.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ net/ipv4/proc.c |   58 ++++++++++++++++++++++++++++----------------------------
+ 1 file changed, 30 insertions(+), 28 deletions(-)
+
+--- a/net/ipv4/proc.c
++++ b/net/ipv4/proc.c
+@@ -262,42 +262,44 @@ static const struct snmp_mib snmp4_net_l
+ 	SNMP_MIB_SENTINEL
+ };
+ 
+-static void icmpmsg_put(struct seq_file *seq)
++static void icmpmsg_put_line(struct seq_file *seq, unsigned long *vals,
++				unsigned short *type, int count)
+ {
+-#define PERLINE	16
+-
+-	int j, i, count;
+-	static int out[PERLINE];
+-
+-	count = 0;
+-	for (i = 0; i < ICMPMSG_MIB_MAX; i++) {
+-
+-		if (snmp_fold_field((void **) icmpmsg_statistics, i))
+-			out[count++] = i;
+-		if (count < PERLINE)
+-			continue;
++	int j;
+ 
+-		seq_printf(seq, "\nIcmpMsg:");
+-		for (j = 0; j < PERLINE; ++j)
+-			seq_printf(seq, " %sType%u", i & 0x100 ? "Out" : "In",
+-					i & 0xff);
+-		seq_printf(seq, "\nIcmpMsg: ");
+-		for (j = 0; j < PERLINE; ++j)
+-			seq_printf(seq, " %lu",
+-				snmp_fold_field((void **) icmpmsg_statistics,
+-				out[j]));
+-		seq_putc(seq, '\n');
+-	}
+ 	if (count) {
+ 		seq_printf(seq, "\nIcmpMsg:");
+ 		for (j = 0; j < count; ++j)
+-			seq_printf(seq, " %sType%u", out[j] & 0x100 ? "Out" :
+-				"In", out[j] & 0xff);
++			seq_printf(seq, " %sType%u",
++				type[j] & 0x100 ? "Out" : "In",
++				type[j] & 0xff);
+ 		seq_printf(seq, "\nIcmpMsg:");
+ 		for (j = 0; j < count; ++j)
+-			seq_printf(seq, " %lu", snmp_fold_field((void **)
+-				icmpmsg_statistics, out[j]));
++			seq_printf(seq, " %lu", vals[j]);
++	}
++}
++
++static void icmpmsg_put(struct seq_file *seq)
++{
++#define PERLINE	16
++
++	int i, count;
++	unsigned short type[PERLINE];
++	unsigned long vals[PERLINE], val;
++
++	count = 0;
++	for (i = 0; i < ICMPMSG_MIB_MAX; i++) {
++		val = snmp_fold_field((void **) icmpmsg_statistics, i);
++		if (val) {
++			type[count] = i;
++			vals[count++] = val;
++		}
++		if (count == PERLINE) {
++			icmpmsg_put_line(seq, vals, type, count);
++			count = 0;
++		}
+ 	}
++	icmpmsg_put_line(seq, vals, type, count);
+ 
+ #undef PERLINE
+ }

Added: hardened/2.6/trunk/2.6.26/1418_touch_mnt_namespace-when-the-mount-flags-change.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1418_touch_mnt_namespace-when-the-mount-flags-change.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1418_touch_mnt_namespace-when-the-mount-flags-change.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,43 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From 0e55a7cca4b66f625d67b292f80b6a976e77c51b Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@×××××.com>
+Date: Fri, 26 Sep 2008 19:01:20 -0700
+Subject: touch_mnt_namespace when the mount flags change
+
+From: Dan Williams <dan.j.williams@×××××.com>
+
+commit 0e55a7cca4b66f625d67b292f80b6a976e77c51b upstream
+
+Daemons that need to be launched while the rootfs is read-only can now
+poll /proc/mounts to be notified when their O_RDWR requests may no
+longer end in EROFS.
+
+Cc: Kay Sievers <kay.sievers@××××.org>
+Cc: Neil Brown <neilb@××××.de>
+Signed-off-by: Dan Williams <dan.j.williams@×××××.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ fs/namespace.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1553,8 +1553,13 @@ static noinline int do_remount(struct na
+ 	if (!err)
+ 		nd->path.mnt->mnt_flags = mnt_flags;
+ 	up_write(&sb->s_umount);
+-	if (!err)
++	if (!err) {
+ 		security_sb_post_remount(nd->path.mnt, flags, data);
++
++		spin_lock(&vfsmount_lock);
++		touch_mnt_namespace(nd->path.mnt->mnt_ns);
++		spin_unlock(&vfsmount_lock);
++	}
+ 	return err;
+ }
+ 

Added: hardened/2.6/trunk/2.6.26/1419_usb-don-t-register-endpoints-for-interfaces-that-are-going-away.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1419_usb-don-t-register-endpoints-for-interfaces-that-are-going-away.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1419_usb-don-t-register-endpoints-for-interfaces-that-are-going-away.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,75 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+Note: Backported to kernel 2.6.26.  Original message included below.
+
+---
+
+From 352d026338378b1f13f044e33c1047da6e470056 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@×××××××××××××××.edu>
+Date: Wed, 29 Oct 2008 15:16:58 -0400
+Subject: USB: don't register endpoints for interfaces that are going away
+
+From: Alan Stern <stern@×××××××××××××××.edu>
+
+commit 352d026338378b1f13f044e33c1047da6e470056 upstream.
+
+This patch (as1155) fixes a bug in usbcore.  When interfaces are
+deleted, either because the device was disconnected or because of a
+configuration change, the extra attribute files and child endpoint
+devices may get left behind.  This is because the core removes them
+before calling device_del().  But during device_del(), after the
+driver is unbound the core will reinstall altsetting 0 and recreate
+those extra attributes and children.
+
+The patch prevents this by adding a flag to record when the interface
+is in the midst of being unregistered.  When the flag is set, the
+attribute files and child devices will not be created.
+
+Signed-off-by: Alan Stern <stern@×××××××××××××××.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ drivers/usb/core/message.c |    1 +
+ drivers/usb/core/sysfs.c   |    2 +-
+ include/linux/usb.h        |    2 ++
+ 3 files changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1091,6 +1091,7 @@ void usb_disable_device(struct usb_devic
+ 				continue;
+ 			dev_dbg(&dev->dev, "unregistering interface %s\n",
+ 				interface->dev.bus_id);
++			interface->unregistering = 1;
+ 			usb_remove_sysfs_intf_files(interface);
+ 			device_del(&interface->dev);
+ 		}
+--- a/drivers/usb/core/sysfs.c
++++ b/drivers/usb/core/sysfs.c
+@@ -816,7 +816,7 @@ int usb_create_sysfs_intf_files(struct u
+ 	struct usb_host_interface *alt = intf->cur_altsetting;
+ 	int retval;
+ 
+-	if (intf->sysfs_files_created)
++	if (intf->sysfs_files_created || intf->unregistering)
+ 		return 0;
+ 
+ 	/* The interface string may be present in some altsettings
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -108,6 +108,7 @@ enum usb_interface_condition {
+  *	(in probe()), bound to a driver, or unbinding (in disconnect())
+  * @is_active: flag set when the interface is bound and not suspended.
+  * @sysfs_files_created: sysfs attributes exist
++ * @unregistering: flag set when the interface is being unregistered
+  * @needs_remote_wakeup: flag set when the driver requires remote-wakeup
+  *	capability during autosuspend.
+  * @dev: driver model's view of this device
+@@ -159,6 +160,7 @@ struct usb_interface {
+ 	enum usb_interface_condition condition;		/* state of binding */
+ 	unsigned is_active:1;		/* the interface is not suspended */
+ 	unsigned sysfs_files_created:1;	/* the sysfs attributes exist */
++	unsigned unregistering:1;	/* unregistration is in progress */
+ 	unsigned needs_remote_wakeup:1;	/* driver requires remote wakeup */
+ 
+ 	struct device dev;		/* interface specific device info */

Added: hardened/2.6/trunk/2.6.26/1420_usb-ehci-fix-divide-by-zero-bug.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1420_usb-ehci-fix-divide-by-zero-bug.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1420_usb-ehci-fix-divide-by-zero-bug.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,46 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From 372dd6e8ed924e876f3beb598721e813ad7fa323 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@×××××××××××××××.edu>
+Date: Wed, 12 Nov 2008 17:02:57 -0500
+Subject: USB: EHCI: fix divide-by-zero bug
+
+From: Alan Stern <stern@×××××××××××××××.edu>
+
+commit 372dd6e8ed924e876f3beb598721e813ad7fa323 upstream.
+
+This patch (as1164) fixes a bug in the EHCI scheduler.  The interval
+value it uses is already in linear format, not logarithmically coded.
+The existing code can sometimes crash the system by trying to divide
+by zero.
+
+Signed-off-by: Alan Stern <stern@×××××××××××××××.edu>
+Cc: David Brownell <david-b@×××××××.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ drivers/usb/host/ehci-sched.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -918,7 +918,7 @@ iso_stream_init (
+ 		 */
+ 		stream->usecs = HS_USECS_ISO (maxp);
+ 		bandwidth = stream->usecs * 8;
+-		bandwidth /= 1 << (interval - 1);
++		bandwidth /= interval;
+ 
+ 	} else {
+ 		u32		addr;
+@@ -951,7 +951,7 @@ iso_stream_init (
+ 		} else
+ 			stream->raw_mask = smask_out [hs_transfers - 1];
+ 		bandwidth = stream->usecs + stream->c_usecs;
+-		bandwidth /= 1 << (interval + 2);
++		bandwidth /= interval << 3;
+ 
+ 		/* stream->splits gets created from raw_mask later */
+ 		stream->address = cpu_to_hc32(ehci, addr);

Added: hardened/2.6/trunk/2.6.26/1421_usb-ehci-fix-handling-of-dead-controllers.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1421_usb-ehci-fix-handling-of-dead-controllers.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1421_usb-ehci-fix-handling-of-dead-controllers.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,93 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From 67b2e029743a52670d77864723b4d0d40f7733b5 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@×××××××××××××××.edu>
+Date: Wed, 12 Nov 2008 17:04:53 -0500
+Subject: USB: EHCI: fix handling of dead controllers
+
+From: Alan Stern <stern@×××××××××××××××.edu>
+
+commit 67b2e029743a52670d77864723b4d0d40f7733b5 upstream.
+
+This patch (as1165) makes a few small changes in the logic used by
+ehci-hcd when it encounters a controller error:
+
+	Instead of printing out the masked status, it prints the
+	original status as read directly from the hardware.
+
+	It doesn't check for the STS_HALT status bit before taking
+	action.  The mere fact that the STS_FATAL bit is set means
+	that something bad has happened and the controller needs to
+	be reset.  With the old code this test could never succeed
+	because the STS_HALT bit was masked out from the status.
+
+I anticipate that this will prevent the occasional "irq X: nobody cared"
+problem people encounter when their EHCI controllers die.
+
+Signed-off-by: Alan Stern <stern@×××××××××××××××.edu>
+Cc: David Brownell <david-b@×××××××.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ drivers/usb/host/ehci-hcd.c |   25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -643,7 +643,7 @@ static int ehci_run (struct usb_hcd *hcd
+ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
+ {
+ 	struct ehci_hcd		*ehci = hcd_to_ehci (hcd);
+-	u32			status, pcd_status = 0, cmd;
++	u32			status, masked_status, pcd_status = 0, cmd;
+ 	int			bh;
+ 
+ 	spin_lock (&ehci->lock);
+@@ -656,14 +656,14 @@ static irqreturn_t ehci_irq (struct usb_
+ 		goto dead;
+ 	}
+ 
+-	status &= INTR_MASK;
+-	if (!status) {			/* irq sharing? */
++	masked_status = status & INTR_MASK;
++	if (!masked_status) {		/* irq sharing? */
+ 		spin_unlock(&ehci->lock);
+ 		return IRQ_NONE;
+ 	}
+ 
+ 	/* clear (just) interrupts */
+-	ehci_writel(ehci, status, &ehci->regs->status);
++	ehci_writel(ehci, masked_status, &ehci->regs->status);
+ 	cmd = ehci_readl(ehci, &ehci->regs->command);
+ 	bh = 0;
+ 
+@@ -731,19 +731,18 @@ static irqreturn_t ehci_irq (struct usb_
+ 
+ 	/* PCI errors [4.15.2.4] */
+ 	if (unlikely ((status & STS_FATAL) != 0)) {
++		ehci_err(ehci, "fatal error\n");
+ 		dbg_cmd (ehci, "fatal", ehci_readl(ehci,
+ 						   &ehci->regs->command));
+ 		dbg_status (ehci, "fatal", status);
+-		if (status & STS_HALT) {
+-			ehci_err (ehci, "fatal error\n");
++		ehci_halt(ehci);
+ dead:
+-			ehci_reset (ehci);
+-			ehci_writel(ehci, 0, &ehci->regs->configured_flag);
+-			/* generic layer kills/unlinks all urbs, then
+-			 * uses ehci_stop to clean up the rest
+-			 */
+-			bh = 1;
+-		}
++		ehci_reset(ehci);
++		ehci_writel(ehci, 0, &ehci->regs->configured_flag);
++		/* generic layer kills/unlinks all urbs, then
++		 * uses ehci_stop to clean up the rest
++		 */
++		bh = 1;
+ 	}
+ 
+ 	if (bh)

Added: hardened/2.6/trunk/2.6.26/1422_usb-fix-ps3-usb-shutdown-problems.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1422_usb-fix-ps3-usb-shutdown-problems.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1422_usb-fix-ps3-usb-shutdown-problems.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,64 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From ddcb01ff9bf49c4dbbb058423559f7bc90b89374 Mon Sep 17 00:00:00 2001
+From: Geoff Levand <geoffrey.levand@×××××××.com>
+Date: Fri, 31 Oct 2008 13:52:54 -0700
+Subject: USB: Fix PS3 USB shutdown problems
+
+From: Geoff Levand <geoffrey.levand@×××××××.com>
+
+commit ddcb01ff9bf49c4dbbb058423559f7bc90b89374 upstream.
+
+Add ehci_shutdown() or ohci_shutdown() calls to the USB
+PS3 bus glue.  ehci_shutdown() and ohci_shutdown() do some
+controller specific cleanups not done by usb_remove_hcd().
+
+Fixes errors on shutdown or reboot similar to these:
+
+  ps3-ehci-driver sb_07: HC died; cleaning up
+  irq 51: nobody cared (try booting with the "irqpoll" option)
+
+Related bugzilla reports:
+
+  http://bugzilla.kernel.org/show_bug.cgi?id=11819
+  http://bugzilla.terrasoftsolutions.com/show_bug.cgi?id=317
+
+Signed-off-by: Geoff Levand <geoffrey.levand@×××××××.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ drivers/usb/host/ehci-ps3.c |    1 +
+ drivers/usb/host/ohci-ps3.c |    3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/ehci-ps3.c
++++ b/drivers/usb/host/ehci-ps3.c
+@@ -205,6 +205,7 @@ static int ps3_ehci_remove(struct ps3_sy
+ 
+ 	tmp = hcd->irq;
+ 
++	ehci_shutdown(hcd);
+ 	usb_remove_hcd(hcd);
+ 
+ 	ps3_system_bus_set_driver_data(dev, NULL);
+--- a/drivers/usb/host/ohci-ps3.c
++++ b/drivers/usb/host/ohci-ps3.c
+@@ -192,7 +192,7 @@ fail_start:
+ 	return result;
+ }
+ 
+-static int ps3_ohci_remove (struct ps3_system_bus_device *dev)
++static int ps3_ohci_remove(struct ps3_system_bus_device *dev)
+ {
+ 	unsigned int tmp;
+ 	struct usb_hcd *hcd =
+@@ -205,6 +205,7 @@ static int ps3_ohci_remove (struct ps3_s
+ 
+ 	tmp = hcd->irq;
+ 
++	ohci_shutdown(hcd);
+ 	usb_remove_hcd(hcd);
+ 
+ 	ps3_system_bus_set_driver_data(dev, NULL);

Added: hardened/2.6/trunk/2.6.26/1423_v4l-dvb-cve-2008-5033-fix-oops-on-tvaudio-when-controlling-bass-treble.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1423_v4l-dvb-cve-2008-5033-fix-oops-on-tvaudio-when-controlling-bass-treble.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1423_v4l-dvb-cve-2008-5033-fix-oops-on-tvaudio-when-controlling-bass-treble.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,135 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From 01a1a3cc1e3fbe718bd06a2a5d4d1a2d0fb4d7d9 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@××××××.com>
+Date: Fri, 14 Nov 2008 10:46:59 -0300
+Subject: V4L/DVB (9624): CVE-2008-5033: fix OOPS on tvaudio when controlling bass/treble
+
+From: Mauro Carvalho Chehab <mchehab@××××××.com>
+
+commit 01a1a3cc1e3fbe718bd06a2a5d4d1a2d0fb4d7d9 upstream.
+
+This bug were supposed to be fixed by 5ba2f67afb02c5302b2898949ed6fc3b3d37dcf1,
+where a call to NULL happens.
+
+Not all tvaudio chips allow controlling bass/treble. So, the driver
+has a table with a flag to indicate if the chip does support it.
+
+Unfortunately, the handling of this logic were broken for a very long
+time (probably since the first module version). Due to that, an OOPS
+were generated for devices that don't support bass/treble.
+
+This were the resulting OOPS message before the patch, with debug messages
+enabled:
+
+tvaudio' 1-005b: VIDIOC_S_CTRL
+BUG: unable to handle kernel NULL pointer dereference at 00000000
+IP: [<00000000>]
+*pde = 22fda067 *pte = 00000000
+Oops: 0000 [#1] SMP
+Modules linked in: snd_hda_intel snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device
+snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_hwdep snd soundcore tuner_simple tuner_types tea5767 tuner
+tvaudio bttv bridgebnep rfcomm l2cap bluetooth it87 hwmon_vid hwmon fuse sunrpc ipt_REJECT
+nf_conntrack_ipv4 iptable_filter ip_tables ip6t_REJECT xt_tcpudp nf_conntrack_ipv6 xt_state nf_conntrack
+ip6table_filter ip6_tables x_tables ipv6 dm_mirrordm_multipath dm_mod configfs videodev v4l1_compat
+ir_common 8139cp compat_ioctl32 v4l2_common 8139too videobuf_dma_sg videobuf_core mii btcx_risc tveeprom
+i915 button snd_page_alloc serio_raw drm pcspkr i2c_algo_bit i2c_i801 i2c_core iTCO_wdt
+iTCO_vendor_support sr_mod cdrom sg ata_generic pata_acpi ata_piix libata sd_mod scsi_mod ext3 jbdmbcache
+uhci_hcd ohci_hcd ehci_hcd [last unloaded: soundcore]
+
+Pid: 15413, comm: qv4l2 Not tainted (2.6.25.14-108.fc9.i686 #1)
+EIP: 0060:[<00000000>] EFLAGS: 00210246 CPU: 0
+EIP is at 0x0
+EAX: 00008000 EBX: ebd21600 ECX: e2fd9ec4 EDX: 00200046
+ESI: f8c0f0c4 EDI: f8c0f0c4 EBP: e2fd9d50 ESP: e2fd9d2c
+ DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
+Process qv4l2 (pid: 15413, ti=e2fd9000 task=ebe44000 task.ti=e2fd9000)
+Stack: f8c0c6ae e2ff2a00 00000d00 e2fd9ec4 ebc4e000 e2fd9d5c f8c0c448 00000000
+       f899c12a e2fd9d5c f899c154 e2fd9d68 e2fd9d80 c0560185 e2fd9d88 f8f3e1d8
+       f8f3e1dc ebc4e034 f8f3e18c e2fd9ec4 00000000 e2fd9d90 f899c286 c008561c
+Call Trace:
+ [<f8c0c6ae>] ? chip_command+0x266/0x4b6 [tvaudio]
+ [<f8c0c448>] ? chip_command+0x0/0x4b6 [tvaudio]
+ [<f899c12a>] ? i2c_cmd+0x0/0x2f [i2c_core]
+ [<f899c154>] ? i2c_cmd+0x2a/0x2f [i2c_core]
+ [<c0560185>] ? device_for_each_child+0x21/0x49
+ [<f899c286>] ? i2c_clients_command+0x1c/0x1e [i2c_core]
+ [<f8f283d8>] ? bttv_call_i2c_clients+0x14/0x16 [bttv]
+ [<f8f23601>] ? bttv_s_ctrl+0x1bc/0x313 [bttv]
+ [<f8f23445>] ? bttv_s_ctrl+0x0/0x313 [bttv]
+ [<f8b6096d>] ? __video_do_ioctl+0x1f84/0x3726 [videodev]
+ [<c05abb4e>] ? sock_aio_write+0x100/0x10d
+ [<c041b23e>] ? kmap_atomic_prot+0x1dd/0x1df
+ [<c043a0c9>] ? enqueue_hrtimer+0xc2/0xcd
+ [<c04f4fa4>] ? copy_from_user+0x39/0x121
+ [<f8b622b9>] ? __video_ioctl2+0x1aa/0x24a [videodev]
+ [<c04054fd>] ? do_notify_resume+0x768/0x795
+ [<c043c0f7>] ? getnstimeofday+0x34/0xd1
+ [<c0437b77>] ? autoremove_wake_function+0x0/0x33
+ [<f8b62368>] ? video_ioctl2+0xf/0x13 [videodev]
+ [<c048c6f0>] ? vfs_ioctl+0x50/0x69
+ [<c048c942>] ? do_vfs_ioctl+0x239/0x24c
+ [<c048c995>] ? sys_ioctl+0x40/0x5b
+ [<c0405bf2>] ? syscall_call+0x7/0xb
+ [<c0620000>] ? cpuid4_cache_sysfs_exit+0x3d/0x69
+ =======================
+Code:  Bad EIP value.
+EIP: [<00000000>] 0x0 SS:ESP 0068:e2fd9d2c
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@××××××.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@××××.de>
+
+---
+ drivers/media/video/tvaudio.c |   15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/drivers/media/video/tvaudio.c
++++ b/drivers/media/video/tvaudio.c
+@@ -1576,13 +1576,13 @@ static int tvaudio_get_ctrl(struct CHIPS
+ 		return 0;
+ 	}
+ 	case V4L2_CID_AUDIO_BASS:
+-		if (desc->flags & CHIP_HAS_BASSTREBLE)
++		if (!(desc->flags & CHIP_HAS_BASSTREBLE))
+ 			break;
+ 		ctrl->value = chip->bass;
+ 		return 0;
+ 	case V4L2_CID_AUDIO_TREBLE:
+-		if (desc->flags & CHIP_HAS_BASSTREBLE)
+-			return -EINVAL;
++		if (!(desc->flags & CHIP_HAS_BASSTREBLE))
++			break;
+ 		ctrl->value = chip->treble;
+ 		return 0;
+ 	}
+@@ -1642,16 +1642,15 @@ static int tvaudio_set_ctrl(struct CHIPS
+ 		return 0;
+ 	}
+ 	case V4L2_CID_AUDIO_BASS:
+-		if (desc->flags & CHIP_HAS_BASSTREBLE)
++		if (!(desc->flags & CHIP_HAS_BASSTREBLE))
+ 			break;
+ 		chip->bass = ctrl->value;
+ 		chip_write(chip,desc->bassreg,desc->bassfunc(chip->bass));
+ 
+ 		return 0;
+ 	case V4L2_CID_AUDIO_TREBLE:
+-		if (desc->flags & CHIP_HAS_BASSTREBLE)
+-			return -EINVAL;
+-
++		if (!(desc->flags & CHIP_HAS_BASSTREBLE))
++			break;
+ 		chip->treble = ctrl->value;
+ 		chip_write(chip,desc->treblereg,desc->treblefunc(chip->treble));
+ 
+@@ -1695,7 +1694,7 @@ static int chip_command(struct i2c_clien
+ 				break;
+ 			case V4L2_CID_AUDIO_BASS:
+ 			case V4L2_CID_AUDIO_TREBLE:
+-				if (desc->flags & CHIP_HAS_BASSTREBLE)
++				if (!(desc->flags & CHIP_HAS_BASSTREBLE))
+ 					return -EINVAL;
+ 				break;
+ 			default:

Added: hardened/2.6/trunk/2.6.26/1503_inotify-fix-watch-removal-or-umount-races.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/1503_inotify-fix-watch-removal-or-umount-races.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/1503_inotify-fix-watch-removal-or-umount-races.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,571 @@
+Added-By: Gordon Malm <gengor@g.o>
+
+---
+
+From: Al Viro <viro@×××××××××××××××.uk>
+Date: Sat, 15 Nov 2008 01:15:43 +0000 (+0000)
+Subject: Fix inotify watch removal/umount races
+X-Git-Tag: v2.6.28-rc5~1
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=8f7b0ba1c853919b85b54774775f567f30006107
+
+Fix inotify watch removal/umount races
+
+Inotify watch removals suck violently.
+
+To kick the watch out we need (in this order) inode->inotify_mutex and
+ih->mutex.  That's fine if we have a hold on inode; however, for all
+other cases we need to make damn sure we don't race with umount.  We can
+*NOT* just grab a reference to a watch - inotify_unmount_inodes() will
+happily sail past it and we'll end with reference to inode potentially
+outliving its superblock.
+
+Ideally we just want to grab an active reference to superblock if we
+can; that will make sure we won't go into inotify_umount_inodes() until
+we are done.  Cleanup is just deactivate_super().
+
+However, that leaves a messy case - what if we *are* racing with
+umount() and active references to superblock can't be acquired anymore?
+We can bump ->s_count, grab ->s_umount, which will almost certainly wait
+until the superblock is shut down and the watch in question is pining
+for fjords.  That's fine, but there is a problem - we might have hit the
+window between ->s_active getting to 0 / ->s_count - below S_BIAS (i.e.
+the moment when superblock is past the point of no return and is heading
+for shutdown) and the moment when deactivate_super() acquires
+->s_umount.
+
+We could just do drop_super() yield() and retry, but that's rather
+antisocial and this stuff is luser-triggerable.  OTOH, having grabbed
+->s_umount and having found that we'd got there first (i.e.  that
+->s_root is non-NULL) we know that we won't race with
+inotify_umount_inodes().
+
+So we could grab a reference to watch and do the rest as above, just
+with drop_super() instead of deactivate_super(), right? Wrong.  We had
+to drop ih->mutex before we could grab ->s_umount.  So the watch
+could've been gone already.
+
+That still can be dealt with - we need to save watch->wd, do idr_find()
+and compare its result with our pointer.  If they match, we either have
+the damn thing still alive or we'd lost not one but two races at once,
+the watch had been killed and a new one got created with the same ->wd
+at the same address.  That couldn't have happened in inotify_destroy(),
+but inotify_rm_wd() could run into that.  Still, "new one got created"
+is not a problem - we have every right to kill it or leave it alone,
+whatever's more convenient.
+
+So we can use idr_find(...) == watch && watch->inode->i_sb == sb as
+"grab it and kill it" check.  If it's been our original watch, we are
+fine, if it's a newcomer - nevermind, just pretend that we'd won the
+race and kill the fscker anyway; we are safe since we know that its
+superblock won't be going away.
+
+And yes, this is far beyond mere "not very pretty"; so's the entire
+concept of inotify to start with.
+
+Signed-off-by: Al Viro <viro@×××××××××××××××.uk>
+Acked-by: Greg KH <greg@×××××.com>
+Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
+---
+
+diff --git a/fs/inotify.c b/fs/inotify.c
+index 690e725..7bbed1b 100644
+--- a/fs/inotify.c
++++ b/fs/inotify.c
+@@ -106,6 +106,20 @@ void get_inotify_watch(struct inotify_watch *watch)
+ }
+ EXPORT_SYMBOL_GPL(get_inotify_watch);
+ 
++int pin_inotify_watch(struct inotify_watch *watch)
++{
++	struct super_block *sb = watch->inode->i_sb;
++	spin_lock(&sb_lock);
++	if (sb->s_count >= S_BIAS) {
++		atomic_inc(&sb->s_active);
++		spin_unlock(&sb_lock);
++		atomic_inc(&watch->count);
++		return 1;
++	}
++	spin_unlock(&sb_lock);
++	return 0;
++}
++
+ /**
+  * put_inotify_watch - decrements the ref count on a given watch.  cleans up
+  * watch references if the count reaches zero.  inotify_watch is freed by
+@@ -124,6 +138,13 @@ void put_inotify_watch(struct inotify_watch *watch)
+ }
+ EXPORT_SYMBOL_GPL(put_inotify_watch);
+ 
++void unpin_inotify_watch(struct inotify_watch *watch)
++{
++	struct super_block *sb = watch->inode->i_sb;
++	put_inotify_watch(watch);
++	deactivate_super(sb);
++}
++
+ /*
+  * inotify_handle_get_wd - returns the next WD for use by the given handle
+  *
+@@ -479,6 +500,112 @@ void inotify_init_watch(struct inotify_watch *watch)
+ }
+ EXPORT_SYMBOL_GPL(inotify_init_watch);
+ 
++/*
++ * Watch removals suck violently.  To kick the watch out we need (in this
++ * order) inode->inotify_mutex and ih->mutex.  That's fine if we have
++ * a hold on inode; however, for all other cases we need to make damn sure
++ * we don't race with umount.  We can *NOT* just grab a reference to a
++ * watch - inotify_unmount_inodes() will happily sail past it and we'll end
++ * with reference to inode potentially outliving its superblock.  Ideally
++ * we just want to grab an active reference to superblock if we can; that
++ * will make sure we won't go into inotify_umount_inodes() until we are
++ * done.  Cleanup is just deactivate_super().  However, that leaves a messy
++ * case - what if we *are* racing with umount() and active references to
++ * superblock can't be acquired anymore?  We can bump ->s_count, grab
++ * ->s_umount, which will almost certainly wait until the superblock is shut
++ * down and the watch in question is pining for fjords.  That's fine, but
++ * there is a problem - we might have hit the window between ->s_active
++ * getting to 0 / ->s_count - below S_BIAS (i.e. the moment when superblock
++ * is past the point of no return and is heading for shutdown) and the
++ * moment when deactivate_super() acquires ->s_umount.  We could just do
++ * drop_super() yield() and retry, but that's rather antisocial and this
++ * stuff is luser-triggerable.  OTOH, having grabbed ->s_umount and having
++ * found that we'd got there first (i.e. that ->s_root is non-NULL) we know
++ * that we won't race with inotify_umount_inodes().  So we could grab a
++ * reference to watch and do the rest as above, just with drop_super() instead
++ * of deactivate_super(), right?  Wrong.  We had to drop ih->mutex before we
++ * could grab ->s_umount.  So the watch could've been gone already.
++ *
++ * That still can be dealt with - we need to save watch->wd, do idr_find()
++ * and compare its result with our pointer.  If they match, we either have
++ * the damn thing still alive or we'd lost not one but two races at once,
++ * the watch had been killed and a new one got created with the same ->wd
++ * at the same address.  That couldn't have happened in inotify_destroy(),
++ * but inotify_rm_wd() could run into that.  Still, "new one got created"
++ * is not a problem - we have every right to kill it or leave it alone,
++ * whatever's more convenient.
++ *
++ * So we can use idr_find(...) == watch && watch->inode->i_sb == sb as
++ * "grab it and kill it" check.  If it's been our original watch, we are
++ * fine, if it's a newcomer - nevermind, just pretend that we'd won the
++ * race and kill the fscker anyway; we are safe since we know that its
++ * superblock won't be going away.
++ *
++ * And yes, this is far beyond mere "not very pretty"; so's the entire
++ * concept of inotify to start with.
++ */
++
++/**
++ * pin_to_kill - pin the watch down for removal
++ * @ih: inotify handle
++ * @watch: watch to kill
++ *
++ * Called with ih->mutex held, drops it.  Possible return values:
++ * 0 - nothing to do, it has died
++ * 1 - remove it, drop the reference and deactivate_super()
++ * 2 - remove it, drop the reference and drop_super(); we tried hard to avoid
++ * that variant, since it involved a lot of PITA, but that's the best that
++ * could've been done.
++ */
++static int pin_to_kill(struct inotify_handle *ih, struct inotify_watch *watch)
++{
++	struct super_block *sb = watch->inode->i_sb;
++	s32 wd = watch->wd;
++
++	spin_lock(&sb_lock);
++	if (sb->s_count >= S_BIAS) {
++		atomic_inc(&sb->s_active);
++		spin_unlock(&sb_lock);
++		get_inotify_watch(watch);
++		mutex_unlock(&ih->mutex);
++		return 1;	/* the best outcome */
++	}
++	sb->s_count++;
++	spin_unlock(&sb_lock);
++	mutex_unlock(&ih->mutex); /* can't grab ->s_umount under it */
++	down_read(&sb->s_umount);
++	if (likely(!sb->s_root)) {
++		/* fs is already shut down; the watch is dead */
++		drop_super(sb);
++		return 0;
++	}
++	/* raced with the final deactivate_super() */
++	mutex_lock(&ih->mutex);
++	if (idr_find(&ih->idr, wd) != watch || watch->inode->i_sb != sb) {
++		/* the watch is dead */
++		mutex_unlock(&ih->mutex);
++		drop_super(sb);
++		return 0;
++	}
++	/* still alive or freed and reused with the same sb and wd; kill */
++	get_inotify_watch(watch);
++	mutex_unlock(&ih->mutex);
++	return 2;
++}
++
++static void unpin_and_kill(struct inotify_watch *watch, int how)
++{
++	struct super_block *sb = watch->inode->i_sb;
++	put_inotify_watch(watch);
++	switch (how) {
++	case 1:
++		deactivate_super(sb);
++		break;
++	case 2:
++		drop_super(sb);
++	}
++}
++
+ /**
+  * inotify_destroy - clean up and destroy an inotify instance
+  * @ih: inotify handle
+@@ -490,11 +617,15 @@ void inotify_destroy(struct inotify_handle *ih)
+ 	 * pretty.  We cannot do a simple iteration over the list, because we
+ 	 * do not know the inode until we iterate to the watch.  But we need to
+ 	 * hold inode->inotify_mutex before ih->mutex.  The following works.
++	 *
++	 * AV: it had to become even uglier to start working ;-/
+ 	 */
+ 	while (1) {
+ 		struct inotify_watch *watch;
+ 		struct list_head *watches;
++		struct super_block *sb;
+ 		struct inode *inode;
++		int how;
+ 
+ 		mutex_lock(&ih->mutex);
+ 		watches = &ih->watches;
+@@ -503,8 +634,10 @@ void inotify_destroy(struct inotify_handle *ih)
+ 			break;
+ 		}
+ 		watch = list_first_entry(watches, struct inotify_watch, h_list);
+-		get_inotify_watch(watch);
+-		mutex_unlock(&ih->mutex);
++		sb = watch->inode->i_sb;
++		how = pin_to_kill(ih, watch);
++		if (!how)
++			continue;
+ 
+ 		inode = watch->inode;
+ 		mutex_lock(&inode->inotify_mutex);
+@@ -518,7 +651,7 @@ void inotify_destroy(struct inotify_handle *ih)
+ 
+ 		mutex_unlock(&ih->mutex);
+ 		mutex_unlock(&inode->inotify_mutex);
+-		put_inotify_watch(watch);
++		unpin_and_kill(watch, how);
+ 	}
+ 
+ 	/* free this handle: the put matching the get in inotify_init() */
+@@ -719,7 +852,9 @@ void inotify_evict_watch(struct inotify_watch *watch)
+ int inotify_rm_wd(struct inotify_handle *ih, u32 wd)
+ {
+ 	struct inotify_watch *watch;
++	struct super_block *sb;
+ 	struct inode *inode;
++	int how;
+ 
+ 	mutex_lock(&ih->mutex);
+ 	watch = idr_find(&ih->idr, wd);
+@@ -727,9 +862,12 @@ int inotify_rm_wd(struct inotify_handle *ih, u32 wd)
+ 		mutex_unlock(&ih->mutex);
+ 		return -EINVAL;
+ 	}
+-	get_inotify_watch(watch);
++	sb = watch->inode->i_sb;
++	how = pin_to_kill(ih, watch);
++	if (!how)
++		return 0;
++
+ 	inode = watch->inode;
+-	mutex_unlock(&ih->mutex);
+ 
+ 	mutex_lock(&inode->inotify_mutex);
+ 	mutex_lock(&ih->mutex);
+@@ -740,7 +878,7 @@ int inotify_rm_wd(struct inotify_handle *ih, u32 wd)
+ 
+ 	mutex_unlock(&ih->mutex);
+ 	mutex_unlock(&inode->inotify_mutex);
+-	put_inotify_watch(watch);
++	unpin_and_kill(watch, how);
+ 
+ 	return 0;
+ }
+diff --git a/include/linux/inotify.h b/include/linux/inotify.h
+index bd57857..37ea289 100644
+--- a/include/linux/inotify.h
++++ b/include/linux/inotify.h
+@@ -134,6 +134,8 @@ extern void inotify_remove_watch_locked(struct inotify_handle *,
+ 					struct inotify_watch *);
+ extern void get_inotify_watch(struct inotify_watch *);
+ extern void put_inotify_watch(struct inotify_watch *);
++extern int pin_inotify_watch(struct inotify_watch *);
++extern void unpin_inotify_watch(struct inotify_watch *);
+ 
+ #else
+ 
+@@ -228,6 +230,15 @@ static inline void put_inotify_watch(struct inotify_watch *watch)
+ {
+ }
+ 
++extern inline int pin_inotify_watch(struct inotify_watch *watch)
++{
++	return 0;
++}
++
++extern inline void unpin_inotify_watch(struct inotify_watch *watch)
++{
++}
++
+ #endif	/* CONFIG_INOTIFY */
+ 
+ #endif	/* __KERNEL __ */
+diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
+index 8ba0e0d..8b50944 100644
+--- a/kernel/audit_tree.c
++++ b/kernel/audit_tree.c
+@@ -24,6 +24,7 @@ struct audit_chunk {
+ 	struct list_head trees;		/* with root here */
+ 	int dead;
+ 	int count;
++	atomic_long_t refs;
+ 	struct rcu_head head;
+ 	struct node {
+ 		struct list_head list;
+@@ -56,7 +57,8 @@ static LIST_HEAD(prune_list);
+  * tree is refcounted; one reference for "some rules on rules_list refer to
+  * it", one for each chunk with pointer to it.
+  *
+- * chunk is refcounted by embedded inotify_watch.
++ * chunk is refcounted by embedded inotify_watch + .refs (non-zero refcount
++ * of watch contributes 1 to .refs).
+  *
+  * node.index allows to get from node.list to containing chunk.
+  * MSB of that sucker is stolen to mark taggings that we might have to
+@@ -121,6 +123,7 @@ static struct audit_chunk *alloc_chunk(int count)
+ 	INIT_LIST_HEAD(&chunk->hash);
+ 	INIT_LIST_HEAD(&chunk->trees);
+ 	chunk->count = count;
++	atomic_long_set(&chunk->refs, 1);
+ 	for (i = 0; i < count; i++) {
+ 		INIT_LIST_HEAD(&chunk->owners[i].list);
+ 		chunk->owners[i].index = i;
+@@ -129,9 +132,8 @@ static struct audit_chunk *alloc_chunk(int count)
+ 	return chunk;
+ }
+ 
+-static void __free_chunk(struct rcu_head *rcu)
++static void free_chunk(struct audit_chunk *chunk)
+ {
+-	struct audit_chunk *chunk = container_of(rcu, struct audit_chunk, head);
+ 	int i;
+ 
+ 	for (i = 0; i < chunk->count; i++) {
+@@ -141,14 +143,16 @@ static void __free_chunk(struct rcu_head *rcu)
+ 	kfree(chunk);
+ }
+ 
+-static inline void free_chunk(struct audit_chunk *chunk)
++void audit_put_chunk(struct audit_chunk *chunk)
+ {
+-	call_rcu(&chunk->head, __free_chunk);
++	if (atomic_long_dec_and_test(&chunk->refs))
++		free_chunk(chunk);
+ }
+ 
+-void audit_put_chunk(struct audit_chunk *chunk)
++static void __put_chunk(struct rcu_head *rcu)
+ {
+-	put_inotify_watch(&chunk->watch);
++	struct audit_chunk *chunk = container_of(rcu, struct audit_chunk, head);
++	audit_put_chunk(chunk);
+ }
+ 
+ enum {HASH_SIZE = 128};
+@@ -176,7 +180,7 @@ struct audit_chunk *audit_tree_lookup(const struct inode *inode)
+ 
+ 	list_for_each_entry_rcu(p, list, hash) {
+ 		if (p->watch.inode == inode) {
+-			get_inotify_watch(&p->watch);
++			atomic_long_inc(&p->refs);
+ 			return p;
+ 		}
+ 	}
+@@ -194,17 +198,49 @@ int audit_tree_match(struct audit_chunk *chunk, struct audit_tree *tree)
+ 
+ /* tagging and untagging inodes with trees */
+ 
+-static void untag_chunk(struct audit_chunk *chunk, struct node *p)
++static struct audit_chunk *find_chunk(struct node *p)
++{
++	int index = p->index & ~(1U<<31);
++	p -= index;
++	return container_of(p, struct audit_chunk, owners[0]);
++}
++
++static void untag_chunk(struct node *p)
+ {
++	struct audit_chunk *chunk = find_chunk(p);
+ 	struct audit_chunk *new;
+ 	struct audit_tree *owner;
+ 	int size = chunk->count - 1;
+ 	int i, j;
+ 
++	if (!pin_inotify_watch(&chunk->watch)) {
++		/*
++		 * Filesystem is shutting down; all watches are getting
++		 * evicted, just take it off the node list for this
++		 * tree and let the eviction logics take care of the
++		 * rest.
++		 */
++		owner = p->owner;
++		if (owner->root == chunk) {
++			list_del_init(&owner->same_root);
++			owner->root = NULL;
++		}
++		list_del_init(&p->list);
++		p->owner = NULL;
++		put_tree(owner);
++		return;
++	}
++
++	spin_unlock(&hash_lock);
++
++	/*
++	 * pin_inotify_watch() succeeded, so the watch won't go away
++	 * from under us.
++	 */
+ 	mutex_lock(&chunk->watch.inode->inotify_mutex);
+ 	if (chunk->dead) {
+ 		mutex_unlock(&chunk->watch.inode->inotify_mutex);
+-		return;
++		goto out;
+ 	}
+ 
+ 	owner = p->owner;
+@@ -221,7 +257,7 @@ static void untag_chunk(struct audit_chunk *chunk, struct node *p)
+ 		inotify_evict_watch(&chunk->watch);
+ 		mutex_unlock(&chunk->watch.inode->inotify_mutex);
+ 		put_inotify_watch(&chunk->watch);
+-		return;
++		goto out;
+ 	}
+ 
+ 	new = alloc_chunk(size);
+@@ -263,7 +299,7 @@ static void untag_chunk(struct audit_chunk *chunk, struct node *p)
+ 	inotify_evict_watch(&chunk->watch);
+ 	mutex_unlock(&chunk->watch.inode->inotify_mutex);
+ 	put_inotify_watch(&chunk->watch);
+-	return;
++	goto out;
+ 
+ Fallback:
+ 	// do the best we can
+@@ -277,6 +313,9 @@ Fallback:
+ 	put_tree(owner);
+ 	spin_unlock(&hash_lock);
+ 	mutex_unlock(&chunk->watch.inode->inotify_mutex);
++out:
++	unpin_inotify_watch(&chunk->watch);
++	spin_lock(&hash_lock);
+ }
+ 
+ static int create_chunk(struct inode *inode, struct audit_tree *tree)
+@@ -387,13 +426,6 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
+ 	return 0;
+ }
+ 
+-static struct audit_chunk *find_chunk(struct node *p)
+-{
+-	int index = p->index & ~(1U<<31);
+-	p -= index;
+-	return container_of(p, struct audit_chunk, owners[0]);
+-}
+-
+ static void kill_rules(struct audit_tree *tree)
+ {
+ 	struct audit_krule *rule, *next;
+@@ -431,17 +463,10 @@ static void prune_one(struct audit_tree *victim)
+ 	spin_lock(&hash_lock);
+ 	while (!list_empty(&victim->chunks)) {
+ 		struct node *p;
+-		struct audit_chunk *chunk;
+ 
+ 		p = list_entry(victim->chunks.next, struct node, list);
+-		chunk = find_chunk(p);
+-		get_inotify_watch(&chunk->watch);
+-		spin_unlock(&hash_lock);
+-
+-		untag_chunk(chunk, p);
+ 
+-		put_inotify_watch(&chunk->watch);
+-		spin_lock(&hash_lock);
++		untag_chunk(p);
+ 	}
+ 	spin_unlock(&hash_lock);
+ 	put_tree(victim);
+@@ -469,7 +494,6 @@ static void trim_marked(struct audit_tree *tree)
+ 
+ 	while (!list_empty(&tree->chunks)) {
+ 		struct node *node;
+-		struct audit_chunk *chunk;
+ 
+ 		node = list_entry(tree->chunks.next, struct node, list);
+ 
+@@ -477,14 +501,7 @@ static void trim_marked(struct audit_tree *tree)
+ 		if (!(node->index & (1U<<31)))
+ 			break;
+ 
+-		chunk = find_chunk(node);
+-		get_inotify_watch(&chunk->watch);
+-		spin_unlock(&hash_lock);
+-
+-		untag_chunk(chunk, node);
+-
+-		put_inotify_watch(&chunk->watch);
+-		spin_lock(&hash_lock);
++		untag_chunk(node);
+ 	}
+ 	if (!tree->root && !tree->goner) {
+ 		tree->goner = 1;
+@@ -878,7 +895,7 @@ static void handle_event(struct inotify_watch *watch, u32 wd, u32 mask,
+ static void destroy_watch(struct inotify_watch *watch)
+ {
+ 	struct audit_chunk *chunk = container_of(watch, struct audit_chunk, watch);
+-	free_chunk(chunk);
++	call_rcu(&chunk->head, __put_chunk);
+ }
+ 
+ static const struct inotify_operations rtree_inotify_ops = {
+diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
+index b7d354e..9fd85a4 100644
+--- a/kernel/auditfilter.c
++++ b/kernel/auditfilter.c
+@@ -1094,8 +1094,8 @@ static void audit_inotify_unregister(struct list_head *in_list)
+ 	list_for_each_entry_safe(p, n, in_list, ilist) {
+ 		list_del(&p->ilist);
+ 		inotify_rm_watch(audit_ih, &p->wdata);
+-		/* the put matching the get in audit_do_del_rule() */
+-		put_inotify_watch(&p->wdata);
++		/* the unpin matching the pin in audit_do_del_rule() */
++		unpin_inotify_watch(&p->wdata);
+ 	}
+ }
+ 
+@@ -1389,9 +1389,13 @@ static inline int audit_del_rule(struct audit_entry *entry,
+ 				/* Put parent on the inotify un-registration
+ 				 * list.  Grab a reference before releasing
+ 				 * audit_filter_mutex, to be released in
+-				 * audit_inotify_unregister(). */
+-				list_add(&parent->ilist, &inotify_list);
+-				get_inotify_watch(&parent->wdata);
++				 * audit_inotify_unregister().
++				 * If filesystem is going away, just leave
++				 * the sucker alone, eviction will take
++				 * care of it.
++				 */
++				if (pin_inotify_watch(&parent->wdata))
++					list_add(&parent->ilist, &inotify_list);
+ 			}
+ 		}
+ 	}

Added: hardened/2.6/trunk/2.6.26/4455_grsec-make-PAX_REFCOUNT-conditional-on-x86.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/4455_grsec-make-PAX_REFCOUNT-conditional-on-x86.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/4455_grsec-make-PAX_REFCOUNT-conditional-on-x86.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,32 @@
+From: Gordon Malm <gengor@g.o>
+
+Make selection of PAX_REFCOUNT depend on X86.
+PAX_REFCOUNT is an X86-only feature.
+
+Fixes bug #246763.
+
+Thanks to Tom Lloyd for reporting.
+
+This patch is present in upstream grsecurity patches as of
+grsecurity-2.1.12-2.6.27.7-200811201849.patch.
+
+--- a/grsecurity/Kconfig
++++ b/grsecurity/Kconfig
+@@ -77,7 +77,7 @@ config GRKERNSEC_MEDIUM
+ 	select PAX_RANDUSTACK
+ 	select PAX_ASLR
+ 	select PAX_RANDMMAP
+-	select PAX_REFCOUNT
++	select PAX_REFCOUNT if (X86)
+ 
+ 	help
+ 	  If you say Y here, several features in addition to those included
+@@ -155,7 +155,7 @@ config GRKERNSEC_HIGH
+ 	select PAX_EMUTRAMP if (PARISC)
+ 	select PAX_EMUSIGRT if (PARISC)
+ 	select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
+-	select PAX_REFCOUNT
++	select PAX_REFCOUNT if (X86)
+ 	help
+ 	  If you say Y here, many of the features of grsecurity will be
+ 	  enabled, which will protect you against many kinds of attacks

Added: hardened/2.6/trunk/2.6.26/4460_pax-fix-mmap-BUG_ON-task-size-check.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/4460_pax-fix-mmap-BUG_ON-task-size-check.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/4460_pax-fix-mmap-BUG_ON-task-size-check.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,22 @@
+From: Gordon Malm <gengor@g.o>
+
+Fix incorrect vma task size check under SEGMEXEC.
+
+Fixes bug #246607.
+
+Thanks to Hugo Mildenberger for reporting and PaX Team for the fix.
+
+This patch is present in upstream grsecurity patches as of
+pax-linux-2.6.27.7-test22.patch.
+
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1719,7 +1719,7 @@ struct vm_area_struct *pax_find_mirror_v
+ 		BUG_ON(vma->vm_mirror);
+ 		return NULL;
+ 	}
+-	BUG_ON(vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < vma->vm_start - SEGMEXEC_TASK_SIZE - 1);
++	BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
+ 	vma_m = vma->vm_mirror;
+ 	BUG_ON(!vma_m || vma_m->vm_mirror != vma);
+ 	BUG_ON(vma->vm_file != vma_m->vm_file);

Added: hardened/2.6/trunk/2.6.26/4465_pax-fix-false-RLIMIT_STACK-warnings.patch
===================================================================
--- hardened/2.6/trunk/2.6.26/4465_pax-fix-false-RLIMIT_STACK-warnings.patch	                        (rev 0)
+++ hardened/2.6/trunk/2.6.26/4465_pax-fix-false-RLIMIT_STACK-warnings.patch	2008-12-03 00:31:33 UTC (rev 1413)
@@ -0,0 +1,88 @@
+From: Gordon Malm <gengor@g.o>
+
+Fix false-positive RLIMIT_STACK warnings.
+
+Thanks to PaX Team for the heads up.
+
+This patch is present in upstream grsecurity patches as of
+pax-linux-2.6.27.7-test22.patch.
+
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -844,16 +844,14 @@ not_pax_fault:
+ 		goto good_area;
+ 	if (!(vma->vm_flags & VM_GROWSDOWN))
+ 		goto bad_area;
+-	if (error_code & PF_USER) {
+-		/*
+-		 * Accessing the stack below %sp is always a bug.
+-		 * The large cushion allows instructions like enter
+-		 * and pusha to work.  ("enter $65535,$31" pushes
+-		 * 32 pointers and then decrements %sp by 65535.)
+-		 */
+-		if (address + 65536 + 32 * sizeof(unsigned long) < regs->sp)
+-			goto bad_area;
+-	}
++	/*
++	 * Accessing the stack below %sp is always a bug.
++	 * The large cushion allows instructions like enter
++	 * and pusha to work.  ("enter $65535,$31" pushes
++	 * 32 pointers and then decrements %sp by 65535.)
++	 */
++	if (address + 65536 + 32 * sizeof(unsigned long) < regs->sp)
++		goto bad_area;
+ 
+ #ifdef CONFIG_PAX_SEGMEXEC
+ 	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -39,7 +39,6 @@
+ #include <linux/cn_proc.h>
+ #include <linux/mutex.h>
+ #include <linux/futex.h>
+-#include <linux/compat.h>
+ #include <linux/pipe_fs_i.h>
+ #include <linux/audit.h> /* for audit_free() */
+ #include <linux/resource.h>
+@@ -1058,14 +1057,6 @@ NORET_TYPE void do_exit(long code)
+ 		exit_itimers(tsk->signal);
+ 	}
+ 	acct_collect(code, group_dead);
+-#ifdef CONFIG_FUTEX
+-	if (unlikely(tsk->robust_list))
+-		exit_robust_list(tsk);
+-#ifdef CONFIG_COMPAT
+-	if (unlikely(tsk->compat_robust_list))
+-		compat_exit_robust_list(tsk);
+-#endif
+-#endif
+ 	if (group_dead)
+ 		tty_audit_exit();
+ 	if (unlikely(tsk->audit_context))
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -36,6 +36,7 @@
+ #include <linux/syscalls.h>
+ #include <linux/jiffies.h>
+ #include <linux/futex.h>
++#include <linux/compat.h>
+ #include <linux/task_io_accounting_ops.h>
+ #include <linux/rcupdate.h>
+ #include <linux/ptrace.h>
+@@ -514,6 +515,16 @@ void mm_release(struct task_struct *tsk,
+ {
+ 	struct completion *vfork_done = tsk->vfork_done;
+ 
++	/* Get rid of any futexes when releasing the mm */
++#ifdef CONFIG_FUTEX
++	if (unlikely(tsk->robust_list))
++		exit_robust_list(tsk);
++#ifdef CONFIG_COMPAT
++	if (unlikely(tsk->compat_robust_list))
++		compat_exit_robust_list(tsk);
++#endif
++#endif
++
+ 	/* Get rid of any cached register state */
+ 	deactivate_mm(tsk, mm);
+ 
\ No newline at end of file