[gentoo-commits] proj/hardened-patchset:master commit in: 3.8.1/, 2.6.32/, 3.8.0/, 3.2.39/

[Anthony G. Basile]

commit:     f073d69f9356c708891d8c939bce531b5cd82aa0
Author:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Sat Mar  2 15:30:31 2013 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Sat Mar  2 15:30:31 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=f073d69f

Grsec/PaX: 2.9.1-{2.6.32.60,3.2.39,3.8.1}-201303012253

---
 ..._grsecurity-2.9.1-2.6.32.60-201303012253.patch} |  196 +++++-
 3.2.39/0000_README                                 |    2 +-
 ...420_grsecurity-2.9.1-3.2.39-201303012254.patch} |  301 +++++++--
 {3.8.0 => 3.8.1}/0000_README                       |    2 +-
 .../4420_grsecurity-2.9.1-3.8.1-201303012255.patch |  672 +++++++++-----------
 {3.8.0 => 3.8.1}/4425_grsec_remove_EI_PAX.patch    |    0
 .../4430_grsec-remove-localversion-grsec.patch     |    0
 {3.8.0 => 3.8.1}/4435_grsec-mute-warnings.patch    |    0
 .../4440_grsec-remove-protected-paths.patch        |    0
 .../4450_grsec-kconfig-default-gids.patch          |    0
 .../4465_selinux-avc_audit-log-curr_ip.patch       |    0
 {3.8.0 => 3.8.1}/4470_disable-compat_vdso.patch    |    0
 12 files changed, 701 insertions(+), 472 deletions(-)

diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201302271816.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201303012253.patch
similarity index 99%
rename from 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201302271816.patch
rename to 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201303012253.patch
index ee04841..ee59351 100644
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201302271816.patch
+++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201303012253.patch
@@ -19276,6 +19276,91 @@ index 9dbb527..9fe4f21 100644
  	if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
  		return -EFAULT;
  
+diff --git a/arch/x86/kernel/head.c b/arch/x86/kernel/head.c
+index 3e66bd3..6d6adbe 100644
+--- a/arch/x86/kernel/head.c
++++ b/arch/x86/kernel/head.c
+@@ -4,8 +4,6 @@
+ #include <asm/setup.h>
+ #include <asm/bios_ebda.h>
+ 
+-#define BIOS_LOWMEM_KILOBYTES 0x413
+-
+ /*
+  * The BIOS places the EBDA/XBDA at the top of conventional
+  * memory, and usually decreases the reported amount of
+@@ -15,17 +13,30 @@
+  * chipset: reserve a page before VGA to prevent PCI prefetch
+  * into it (errata #56). Usually the page is reserved anyways,
+  * unless you have no PS/2 mouse plugged in.
++ *
++ * This functions is deliberately very conservative.  Losing
++ * memory in the bottom megabyte is rarely a problem, as long
++ * as we have enough memory to install the trampoline.  Using
++ * memory that is in use by the BIOS or by some DMA device
++ * the BIOS didn't shut down *is* a big problem.
+  */
++
++#define BIOS_LOWMEM_KILOBYTES	0x413
++#define LOWMEM_CAP		0x9f000U	/* Absolute maximum */
++#define INSANE_CUTOFF		0x20000U	/* Less than this = insane */
++
+ void __init reserve_ebda_region(void)
+ {
+ 	unsigned int lowmem, ebda_addr;
+ 
+-	/* To determine the position of the EBDA and the */
+-	/* end of conventional memory, we need to look at */
+-	/* the BIOS data area. In a paravirtual environment */
+-	/* that area is absent. We'll just have to assume */
+-	/* that the paravirt case can handle memory setup */
+-	/* correctly, without our help. */
++	/*
++	 * To determine the position of the EBDA and the
++	 * end of conventional memory, we need to look at
++	 * the BIOS data area. In a paravirtual environment
++	 * that area is absent. We'll just have to assume
++	 * that the paravirt case can handle memory setup
++	 * correctly, without our help.
++	 */
+ 	if (paravirt_enabled())
+ 		return;
+ 
+@@ -36,19 +47,23 @@ void __init reserve_ebda_region(void)
+ 	/* start of EBDA area */
+ 	ebda_addr = get_bios_ebda();
+ 
+-	/* Fixup: bios puts an EBDA in the top 64K segment */
+-	/* of conventional memory, but does not adjust lowmem. */
+-	if ((lowmem - ebda_addr) <= 0x10000)
+-		lowmem = ebda_addr;
++	/*
++	 * Note: some old Dells seem to need 4k EBDA without
++	 * reporting so, so just consider the memory above 0x9f000
++	 * to be off limits (bugzilla 2990).
++	 */
+ 
+-	/* Fixup: bios does not report an EBDA at all. */
+-	/* Some old Dells seem to need 4k anyhow (bugzilla 2990) */
+-	if ((ebda_addr == 0) && (lowmem >= 0x9f000))
+-		lowmem = 0x9f000;
++	/* If the EBDA address is below 128K, assume it is bogus */
++	if (ebda_addr < INSANE_CUTOFF)
++		ebda_addr = LOWMEM_CAP;
+ 
+-	/* Paranoia: should never happen, but... */
+-	if ((lowmem == 0) || (lowmem >= 0x100000))
+-		lowmem = 0x9f000;
++	/* If lowmem is less than 128K, assume it is bogus */
++	if (lowmem < INSANE_CUTOFF)
++		lowmem = LOWMEM_CAP;
++
++	/* Use the lower of the lowmem and EBDA markers as the cutoff */
++	lowmem = min(lowmem, ebda_addr);
++	lowmem = min(lowmem, LOWMEM_CAP); /* Absolute cap */
+ 
+ 	/* reserve all memory between lowmem and the 1MB mark */
+ 	reserve_early_overlap_ok(lowmem, 0x100000, "BIOS reserved");
 diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
 index 4f8e250..df24706 100644
 --- a/arch/x86/kernel/head32.c
@@ -100702,10 +100787,18 @@ index 0000000..3891139
 +
 +#endif /* _LINUX_SYSLOG_H */
 diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h
-index 99adcdc..09207eb 100644
+index 99adcdc..377249a 100644
 --- a/include/linux/sysrq.h
 +++ b/include/linux/sysrq.h
-@@ -35,7 +35,7 @@ struct sysrq_key_op {
+@@ -15,6 +15,7 @@
+ #define _LINUX_SYSRQ_H
+ 
+ #include <linux/errno.h>
++#include <linux/compiler.h>
+ 
+ struct pt_regs;
+ struct tty_struct;
+@@ -35,7 +36,7 @@ struct sysrq_key_op {
  	char *help_msg;
  	char *action_msg;
  	int enable_mask;
@@ -110252,7 +110345,7 @@ index 2d846cf..8d5cdd8 100644
  	    capable(CAP_IPC_LOCK))
  		ret = do_mlockall(flags);
 diff --git a/mm/mmap.c b/mm/mmap.c
-index 4b80cbf..1415bd8 100644
+index 4b80cbf..89f7b42 100644
 --- a/mm/mmap.c
 +++ b/mm/mmap.c
 @@ -29,6 +29,7 @@
@@ -111136,7 +111229,7 @@ index 4b80cbf..1415bd8 100644
  		size = vma->vm_end - address;
  		grow = (vma->vm_start - address) >> PAGE_SHIFT;
  
-@@ -1689,10 +1982,22 @@ static int expand_downwards(struct vm_area_struct *vma,
+@@ -1689,21 +1982,60 @@ static int expand_downwards(struct vm_area_struct *vma,
  			if (!error) {
  				vma->vm_start = address;
  				vma->vm_pgoff -= grow;
@@ -111159,7 +111252,60 @@ index 4b80cbf..1415bd8 100644
  	return error;
  }
  
-@@ -1768,6 +2073,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
+ int expand_stack_downwards(struct vm_area_struct *vma, unsigned long address)
+ {
++	struct vm_area_struct *prev;
++
++	address &= PAGE_MASK;
++	prev = vma->vm_prev;
++	if (prev && prev->vm_end == address) {
++		if (!(prev->vm_flags & VM_GROWSDOWN))
++			return -ENOMEM;
++	}
+ 	return expand_downwards(vma, address);
+ }
+ 
++/*
++ * Note how expand_stack() refuses to expand the stack all the way to
++ * abut the next virtual mapping, *unless* that mapping itself is also
++ * a stack mapping. We want to leave room for a guard page, after all
++ * (the guard page itself is not added here, that is done by the
++ * actual page faulting logic)
++ *
++ * This matches the behavior of the guard page logic (see mm/memory.c:
++ * check_stack_guard_page()), which only allows the guard page to be
++ * removed under these circumstances.
++ */
+ #ifdef CONFIG_STACK_GROWSUP
+ int expand_stack(struct vm_area_struct *vma, unsigned long address)
+ {
++	struct vm_area_struct *next;
++
++	address &= PAGE_MASK;
++	next = vma->vm_next;
++	if (next && next->vm_start == address + PAGE_SIZE) {
++		if (!(next->vm_flags & VM_GROWSUP))
++			return -ENOMEM;
++	}
+ 	return expand_upwards(vma, address);
+ }
+ 
+@@ -1727,6 +2059,14 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
+ #else
+ int expand_stack(struct vm_area_struct *vma, unsigned long address)
+ {
++	struct vm_area_struct *prev;
++
++	address &= PAGE_MASK;
++	prev = vma->vm_prev;
++	if (prev && prev->vm_end == address) {
++		if (!(prev->vm_flags & VM_GROWSDOWN))
++			return -ENOMEM;
++	}
+ 	return expand_downwards(vma, address);
+ }
+ 
+@@ -1768,6 +2108,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
  	do {
  		long nrpages = vma_pages(vma);
  
@@ -111173,7 +111319,7 @@ index 4b80cbf..1415bd8 100644
  		mm->total_vm -= nrpages;
  		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
  		vma = remove_vma(vma);
-@@ -1813,6 +2125,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -1813,6 +2160,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
  	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
  	vma->vm_prev = NULL;
  	do {
@@ -111190,7 +111336,7 @@ index 4b80cbf..1415bd8 100644
  		rb_erase(&vma->vm_rb, &mm->mm_rb);
  		mm->map_count--;
  		tail_vma = vma;
-@@ -1840,10 +2162,25 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1840,10 +2197,25 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	struct mempolicy *pol;
  	struct vm_area_struct *new;
  
@@ -111216,7 +111362,7 @@ index 4b80cbf..1415bd8 100644
  	if (mm->map_count >= sysctl_max_map_count)
  		return -ENOMEM;
  
-@@ -1851,6 +2188,16 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1851,6 +2223,16 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	if (!new)
  		return -ENOMEM;
  
@@ -111233,7 +111379,7 @@ index 4b80cbf..1415bd8 100644
  	/* most fields are the same, copy all, and then fixup */
  	*new = *vma;
  
-@@ -1861,8 +2208,29 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1861,8 +2243,29 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
  	}
  
@@ -111263,7 +111409,7 @@ index 4b80cbf..1415bd8 100644
  		kmem_cache_free(vm_area_cachep, new);
  		return PTR_ERR(pol);
  	}
-@@ -1883,6 +2251,28 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1883,6 +2286,28 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	else
  		vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
  
@@ -111292,7 +111438,7 @@ index 4b80cbf..1415bd8 100644
  	return 0;
  }
  
-@@ -1891,11 +2281,30 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1891,11 +2316,30 @@ int split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
   * work.  This now handles partial unmappings.
   * Jeremy Fitzhardinge <jeremy@××××.org>
   */
@@ -111323,7 +111469,7 @@ index 4b80cbf..1415bd8 100644
  	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
  		return -EINVAL;
  
-@@ -1959,6 +2368,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+@@ -1959,6 +2403,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
  	/* Fix up all other VM information */
  	remove_vma_list(mm, vma);
  
@@ -111332,7 +111478,7 @@ index 4b80cbf..1415bd8 100644
  	return 0;
  }
  
-@@ -1971,22 +2382,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+@@ -1971,22 +2417,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
  
  	profile_munmap(addr);
  
@@ -111361,7 +111507,7 @@ index 4b80cbf..1415bd8 100644
  /*
   *  this is really a simplified "do_mmap".  it only handles
   *  anonymous maps.  eventually we may be able to do some
-@@ -2000,6 +2407,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2000,6 +2442,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	struct rb_node ** rb_link, * rb_parent;
  	pgoff_t pgoff = addr >> PAGE_SHIFT;
  	int error;
@@ -111369,7 +111515,7 @@ index 4b80cbf..1415bd8 100644
  
  	len = PAGE_ALIGN(len);
  	if (!len)
-@@ -2011,16 +2419,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2011,16 +2454,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  
  	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
  
@@ -111401,7 +111547,7 @@ index 4b80cbf..1415bd8 100644
  		locked += mm->locked_vm;
  		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
  		lock_limit >>= PAGE_SHIFT;
-@@ -2037,22 +2459,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2037,22 +2494,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	/*
  	 * Clear old maps.  this also does some error checking for us
  	 */
@@ -111428,7 +111574,7 @@ index 4b80cbf..1415bd8 100644
  		return -ENOMEM;
  
  	/* Can we just expand an old private anonymous mapping? */
-@@ -2066,7 +2488,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2066,7 +2523,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	 */
  	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
  	if (!vma) {
@@ -111437,7 +111583,7 @@ index 4b80cbf..1415bd8 100644
  		return -ENOMEM;
  	}
  
-@@ -2078,11 +2500,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2078,11 +2535,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	vma->vm_page_prot = vm_get_page_prot(flags);
  	vma_link(mm, vma, prev, rb_link, rb_parent);
  out:
@@ -111452,7 +111598,7 @@ index 4b80cbf..1415bd8 100644
  	return addr;
  }
  
-@@ -2129,8 +2552,10 @@ void exit_mmap(struct mm_struct *mm)
+@@ -2129,8 +2587,10 @@ void exit_mmap(struct mm_struct *mm)
  	 * Walk the list again, actually closing and freeing it,
  	 * with preemption enabled, without holding any MM locks.
  	 */
@@ -111464,7 +111610,7 @@ index 4b80cbf..1415bd8 100644
  
  	BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
  }
-@@ -2144,6 +2569,10 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
+@@ -2144,6 +2604,10 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
  	struct vm_area_struct * __vma, * prev;
  	struct rb_node ** rb_link, * rb_parent;
  
@@ -111475,7 +111621,7 @@ index 4b80cbf..1415bd8 100644
  	/*
  	 * The vm_pgoff of a purely anonymous vma should be irrelevant
  	 * until its first write fault, when page's anon_vma and index
-@@ -2166,7 +2595,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
+@@ -2166,7 +2630,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
  	if ((vma->vm_flags & VM_ACCOUNT) &&
  	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
  		return -ENOMEM;
@@ -111498,7 +111644,7 @@ index 4b80cbf..1415bd8 100644
  	return 0;
  }
  
-@@ -2184,6 +2628,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2184,6 +2663,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	struct rb_node **rb_link, *rb_parent;
  	struct mempolicy *pol;
  
@@ -111507,7 +111653,7 @@ index 4b80cbf..1415bd8 100644
  	/*
  	 * If anonymous vma has not yet been faulted, update new pgoff
  	 * to match new location, to increase its chance of merging.
-@@ -2227,6 +2673,35 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2227,6 +2708,35 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	return new_vma;
  }
  
@@ -111543,7 +111689,7 @@ index 4b80cbf..1415bd8 100644
  /*
   * Return true if the calling process may expand its vm space by the passed
   * number of pages
-@@ -2238,6 +2713,12 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+@@ -2238,6 +2748,12 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
  
  	lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
  
@@ -111556,7 +111702,7 @@ index 4b80cbf..1415bd8 100644
  	if (cur + npages > lim)
  		return 0;
  	return 1;
-@@ -2307,6 +2788,22 @@ int install_special_mapping(struct mm_struct *mm,
+@@ -2307,6 +2823,22 @@ int install_special_mapping(struct mm_struct *mm,
  	vma->vm_start = addr;
  	vma->vm_end = addr + len;
  

diff --git a/3.2.39/0000_README b/3.2.39/0000_README
index b8fcdf1..2831c66 100644
--- a/3.2.39/0000_README
+++ b/3.2.39/0000_README
@@ -74,7 +74,7 @@ Patch:	1039_linux-3.2.39.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.39
 
-Patch:	4420_grsecurity-2.9.1-3.2.39-201302271819.patch
+Patch:	4420_grsecurity-2.9.1-3.2.39-201303012254.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/3.2.39/4420_grsecurity-2.9.1-3.2.39-201302271819.patch b/3.2.39/4420_grsecurity-2.9.1-3.2.39-201303012254.patch
similarity index 99%
rename from 3.2.39/4420_grsecurity-2.9.1-3.2.39-201302271819.patch
rename to 3.2.39/4420_grsecurity-2.9.1-3.2.39-201303012254.patch
index b220f78..12bbb30 100644
--- a/3.2.39/4420_grsecurity-2.9.1-3.2.39-201302271819.patch
+++ b/3.2.39/4420_grsecurity-2.9.1-3.2.39-201303012254.patch
@@ -17637,6 +17637,91 @@ index c9a281f..3658fbe 100644
  	if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
  		return -EFAULT;
  
+diff --git a/arch/x86/kernel/head.c b/arch/x86/kernel/head.c
+index af0699b..f6c4674 100644
+--- a/arch/x86/kernel/head.c
++++ b/arch/x86/kernel/head.c
+@@ -5,8 +5,6 @@
+ #include <asm/setup.h>
+ #include <asm/bios_ebda.h>
+ 
+-#define BIOS_LOWMEM_KILOBYTES 0x413
+-
+ /*
+  * The BIOS places the EBDA/XBDA at the top of conventional
+  * memory, and usually decreases the reported amount of
+@@ -16,17 +14,30 @@
+  * chipset: reserve a page before VGA to prevent PCI prefetch
+  * into it (errata #56). Usually the page is reserved anyways,
+  * unless you have no PS/2 mouse plugged in.
++ *
++ * This functions is deliberately very conservative.  Losing
++ * memory in the bottom megabyte is rarely a problem, as long
++ * as we have enough memory to install the trampoline.  Using
++ * memory that is in use by the BIOS or by some DMA device
++ * the BIOS didn't shut down *is* a big problem.
+  */
++
++#define BIOS_LOWMEM_KILOBYTES	0x413
++#define LOWMEM_CAP		0x9f000U	/* Absolute maximum */
++#define INSANE_CUTOFF		0x20000U	/* Less than this = insane */
++
+ void __init reserve_ebda_region(void)
+ {
+ 	unsigned int lowmem, ebda_addr;
+ 
+-	/* To determine the position of the EBDA and the */
+-	/* end of conventional memory, we need to look at */
+-	/* the BIOS data area. In a paravirtual environment */
+-	/* that area is absent. We'll just have to assume */
+-	/* that the paravirt case can handle memory setup */
+-	/* correctly, without our help. */
++	/*
++	 * To determine the position of the EBDA and the
++	 * end of conventional memory, we need to look at
++	 * the BIOS data area. In a paravirtual environment
++	 * that area is absent. We'll just have to assume
++	 * that the paravirt case can handle memory setup
++	 * correctly, without our help.
++	 */
+ 	if (paravirt_enabled())
+ 		return;
+ 
+@@ -37,19 +48,23 @@ void __init reserve_ebda_region(void)
+ 	/* start of EBDA area */
+ 	ebda_addr = get_bios_ebda();
+ 
+-	/* Fixup: bios puts an EBDA in the top 64K segment */
+-	/* of conventional memory, but does not adjust lowmem. */
+-	if ((lowmem - ebda_addr) <= 0x10000)
+-		lowmem = ebda_addr;
++	/*
++	 * Note: some old Dells seem to need 4k EBDA without
++	 * reporting so, so just consider the memory above 0x9f000
++	 * to be off limits (bugzilla 2990).
++	 */
+ 
+-	/* Fixup: bios does not report an EBDA at all. */
+-	/* Some old Dells seem to need 4k anyhow (bugzilla 2990) */
+-	if ((ebda_addr == 0) && (lowmem >= 0x9f000))
+-		lowmem = 0x9f000;
++	/* If the EBDA address is below 128K, assume it is bogus */
++	if (ebda_addr < INSANE_CUTOFF)
++		ebda_addr = LOWMEM_CAP;
+ 
+-	/* Paranoia: should never happen, but... */
+-	if ((lowmem == 0) || (lowmem >= 0x100000))
+-		lowmem = 0x9f000;
++	/* If lowmem is less than 128K, assume it is bogus */
++	if (lowmem < INSANE_CUTOFF)
++		lowmem = LOWMEM_CAP;
++
++	/* Use the lower of the lowmem and EBDA markers as the cutoff */
++	lowmem = min(lowmem, ebda_addr);
++	lowmem = min(lowmem, LOWMEM_CAP); /* Absolute cap */
+ 
+ 	/* reserve all memory between lowmem and the 1MB mark */
+ 	memblock_x86_reserve_range(lowmem, 0x100000, "* BIOS reserved");
 diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
 index 3bb0850..55a56f4 100644
 --- a/arch/x86/kernel/head32.c
@@ -36501,6 +36586,27 @@ index a0895bf..b451f5b 100644
  	.owner		= THIS_MODULE,
  	.open		= timblogiw_open,
  	.release	= timblogiw_close,
+diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
+index 668f5c6..65df5f2 100644
+--- a/drivers/memstick/host/r592.c
++++ b/drivers/memstick/host/r592.c
+@@ -454,7 +454,7 @@ static int r592_transfer_fifo_pio(struct r592_device *dev)
+ /* Executes one TPC (data is read/written from small or large fifo) */
+ static void r592_execute_tpc(struct r592_device *dev)
+ {
+-	bool is_write = dev->req->tpc >= MS_TPC_SET_RW_REG_ADRS;
++	bool is_write;
+ 	int len, error;
+ 	u32 status, reg;
+ 
+@@ -463,6 +463,7 @@ static void r592_execute_tpc(struct r592_device *dev)
+ 		return;
+ 	}
+ 
++	is_write = dev->req->tpc >= MS_TPC_SET_RW_REG_ADRS;
+ 	len = dev->req->long_data ?
+ 		dev->req->sg.length : dev->req->data_len;
+ 
 diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
 index e9c6a60..daf6a33 100644
 --- a/drivers/message/fusion/mptbase.c
@@ -50020,7 +50126,7 @@ index 8392cb8..80d6193 100644
  	memcpy(c->data, &cookie, 4);
  	c->len=4;
 diff --git a/fs/locks.c b/fs/locks.c
-index fcc50ab..c3dacf2 100644
+index fcc50ab..c3dacf26 100644
 --- a/fs/locks.c
 +++ b/fs/locks.c
 @@ -2075,16 +2075,16 @@ void locks_remove_flock(struct file *filp)
@@ -50045,7 +50151,7 @@ index fcc50ab..c3dacf2 100644
  
  	lock_flocks();
 diff --git a/fs/namei.c b/fs/namei.c
-index 9680cef..d098ba0 100644
+index 9680cef..d943724 100644
 --- a/fs/namei.c
 +++ b/fs/namei.c
 @@ -279,16 +279,32 @@ int generic_permission(struct inode *inode, int mask)
@@ -50138,21 +50244,19 @@ index 9680cef..d098ba0 100644
  			put_link(nd, &link, cookie);
  		}
  	}
-@@ -1624,6 +1644,21 @@ static int path_lookupat(int dfd, const char *name,
+@@ -1624,6 +1644,19 @@ static int path_lookupat(int dfd, const char *name,
  	if (!err)
  		err = complete_walk(nd);
  
-+	if (!(nd->flags & LOOKUP_PARENT)) {
++	if (!err && !(nd->flags & LOOKUP_PARENT)) {
 +#ifdef CONFIG_GRKERNSEC
 +		if (flags & LOOKUP_RCU) {
-+			if (!err)
-+				path_put(&nd->path);
++			path_put(&nd->path);
 +			err = -ECHILD;
 +		} else
 +#endif
 +		if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
-+			if (!err)
-+				path_put(&nd->path);
++			path_put(&nd->path);
 +			err = -ENOENT;
 +		}
 +	}
@@ -50160,7 +50264,7 @@ index 9680cef..d098ba0 100644
  	if (!err && nd->flags & LOOKUP_DIRECTORY) {
  		if (!nd->inode->i_op->lookup) {
  			path_put(&nd->path);
-@@ -1651,6 +1686,15 @@ static int do_path_lookup(int dfd, const char *name,
+@@ -1651,6 +1684,15 @@ static int do_path_lookup(int dfd, const char *name,
  		retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
  
  	if (likely(!retval)) {
@@ -50176,7 +50280,7 @@ index 9680cef..d098ba0 100644
  		if (unlikely(!audit_dummy_context())) {
  			if (nd->path.dentry && nd->inode)
  				audit_inode(name, nd->path.dentry);
-@@ -1784,7 +1828,13 @@ struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
+@@ -1784,7 +1826,13 @@ struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
  	if (!len)
  		return ERR_PTR(-EACCES);
  
@@ -50190,7 +50294,7 @@ index 9680cef..d098ba0 100644
  	while (len--) {
  		c = *(const unsigned char *)name++;
  		if (c == '/' || c == '\0')
-@@ -2048,6 +2098,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
+@@ -2048,6 +2096,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
  	if (flag & O_NOATIME && !inode_owner_or_capable(inode))
  		return -EPERM;
  
@@ -50204,7 +50308,7 @@ index 9680cef..d098ba0 100644
  	return 0;
  }
  
-@@ -2083,7 +2140,7 @@ static inline int open_to_namei_flags(int flag)
+@@ -2083,7 +2138,7 @@ static inline int open_to_namei_flags(int flag)
  /*
   * Handle the last step of open()
   */
@@ -50213,7 +50317,7 @@ index 9680cef..d098ba0 100644
  			    const struct open_flags *op, const char *pathname)
  {
  	struct dentry *dir = nd->path.dentry;
-@@ -2109,16 +2166,44 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2109,16 +2164,44 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
  		error = complete_walk(nd);
  		if (error)
  			return ERR_PTR(error);
@@ -50258,7 +50362,7 @@ index 9680cef..d098ba0 100644
  		audit_inode(pathname, dir);
  		goto ok;
  	}
-@@ -2134,18 +2219,37 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2134,18 +2217,37 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
  					!symlink_ok);
  		if (error < 0)
  			return ERR_PTR(error);
@@ -50297,7 +50401,7 @@ index 9680cef..d098ba0 100644
  		audit_inode(pathname, nd->path.dentry);
  		goto ok;
  	}
-@@ -2180,6 +2284,17 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2180,6 +2282,17 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
  	/* Negative dentry, just create the file */
  	if (!dentry->d_inode) {
  		int mode = op->mode;
@@ -50315,7 +50419,7 @@ index 9680cef..d098ba0 100644
  		if (!IS_POSIXACL(dir->d_inode))
  			mode &= ~current_umask();
  		/*
-@@ -2203,6 +2318,8 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2203,6 +2316,8 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
  		error = vfs_create(dir->d_inode, dentry, mode, nd);
  		if (error)
  			goto exit_mutex_unlock;
@@ -50324,7 +50428,7 @@ index 9680cef..d098ba0 100644
  		mutex_unlock(&dir->d_inode->i_mutex);
  		dput(nd->path.dentry);
  		nd->path.dentry = dentry;
-@@ -2212,6 +2329,19 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2212,6 +2327,19 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
  	/*
  	 * It already exists.
  	 */
@@ -50344,7 +50448,7 @@ index 9680cef..d098ba0 100644
  	mutex_unlock(&dir->d_inode->i_mutex);
  	audit_inode(pathname, path->dentry);
  
-@@ -2230,11 +2360,17 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2230,11 +2358,17 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
  	if (!path->dentry->d_inode)
  		goto exit_dput;
  
@@ -50363,7 +50467,7 @@ index 9680cef..d098ba0 100644
  	/* Why this, you ask?  _Now_ we might have grown LOOKUP_JUMPED... */
  	error = complete_walk(nd);
  	if (error)
-@@ -2242,6 +2378,12 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2242,6 +2376,12 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
  	error = -EISDIR;
  	if (S_ISDIR(nd->inode->i_mode))
  		goto exit;
@@ -50376,7 +50480,7 @@ index 9680cef..d098ba0 100644
  ok:
  	if (!S_ISREG(nd->inode->i_mode))
  		will_truncate = 0;
-@@ -2314,7 +2456,7 @@ static struct file *path_openat(int dfd, const char *pathname,
+@@ -2314,7 +2454,7 @@ static struct file *path_openat(int dfd, const char *pathname,
  	if (unlikely(error))
  		goto out_filp;
  
@@ -50385,7 +50489,7 @@ index 9680cef..d098ba0 100644
  	while (unlikely(!filp)) { /* trailing symlink */
  		struct path link = path;
  		void *cookie;
-@@ -2329,8 +2471,9 @@ static struct file *path_openat(int dfd, const char *pathname,
+@@ -2329,8 +2469,9 @@ static struct file *path_openat(int dfd, const char *pathname,
  		error = follow_link(&link, nd, &cookie);
  		if (unlikely(error))
  			filp = ERR_PTR(error);
@@ -50397,7 +50501,7 @@ index 9680cef..d098ba0 100644
  		put_link(nd, &link, cookie);
  	}
  out:
-@@ -2424,6 +2567,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path
+@@ -2424,6 +2565,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path
  	*path = nd.path;
  	return dentry;
  eexist:
@@ -50409,7 +50513,7 @@ index 9680cef..d098ba0 100644
  	dput(dentry);
  	dentry = ERR_PTR(-EEXIST);
  fail:
-@@ -2446,6 +2594,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname, struct pat
+@@ -2446,6 +2592,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname, struct pat
  }
  EXPORT_SYMBOL(user_path_create);
  
@@ -50430,7 +50534,7 @@ index 9680cef..d098ba0 100644
  int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
  {
  	int error = may_create(dir, dentry);
-@@ -2513,6 +2675,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
+@@ -2513,6 +2673,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
  	error = mnt_want_write(path.mnt);
  	if (error)
  		goto out_dput;
@@ -50448,7 +50552,7 @@ index 9680cef..d098ba0 100644
  	error = security_path_mknod(&path, dentry, mode, dev);
  	if (error)
  		goto out_drop_write;
-@@ -2530,6 +2703,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
+@@ -2530,6 +2701,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
  	}
  out_drop_write:
  	mnt_drop_write(path.mnt);
@@ -50458,7 +50562,7 @@ index 9680cef..d098ba0 100644
  out_dput:
  	dput(dentry);
  	mutex_unlock(&path.dentry->d_inode->i_mutex);
-@@ -2579,12 +2755,21 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
+@@ -2579,12 +2753,21 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
  	error = mnt_want_write(path.mnt);
  	if (error)
  		goto out_dput;
@@ -50480,7 +50584,7 @@ index 9680cef..d098ba0 100644
  out_dput:
  	dput(dentry);
  	mutex_unlock(&path.dentry->d_inode->i_mutex);
-@@ -2664,6 +2849,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
+@@ -2664,6 +2847,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
  	char * name;
  	struct dentry *dentry;
  	struct nameidata nd;
@@ -50489,7 +50593,7 @@ index 9680cef..d098ba0 100644
  
  	error = user_path_parent(dfd, pathname, &nd, &name);
  	if (error)
-@@ -2692,6 +2879,15 @@ static long do_rmdir(int dfd, const char __user *pathname)
+@@ -2692,6 +2877,15 @@ static long do_rmdir(int dfd, const char __user *pathname)
  		error = -ENOENT;
  		goto exit3;
  	}
@@ -50505,7 +50609,7 @@ index 9680cef..d098ba0 100644
  	error = mnt_want_write(nd.path.mnt);
  	if (error)
  		goto exit3;
-@@ -2699,6 +2895,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
+@@ -2699,6 +2893,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
  	if (error)
  		goto exit4;
  	error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
@@ -50514,7 +50618,7 @@ index 9680cef..d098ba0 100644
  exit4:
  	mnt_drop_write(nd.path.mnt);
  exit3:
-@@ -2761,6 +2959,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+@@ -2761,6 +2957,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
  	struct dentry *dentry;
  	struct nameidata nd;
  	struct inode *inode = NULL;
@@ -50523,7 +50627,7 @@ index 9680cef..d098ba0 100644
  
  	error = user_path_parent(dfd, pathname, &nd, &name);
  	if (error)
-@@ -2783,6 +2983,16 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+@@ -2783,6 +2981,16 @@ static long do_unlinkat(int dfd, const char __user *pathname)
  		if (!inode)
  			goto slashes;
  		ihold(inode);
@@ -50540,7 +50644,7 @@ index 9680cef..d098ba0 100644
  		error = mnt_want_write(nd.path.mnt);
  		if (error)
  			goto exit2;
-@@ -2790,6 +3000,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+@@ -2790,6 +2998,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
  		if (error)
  			goto exit3;
  		error = vfs_unlink(nd.path.dentry->d_inode, dentry);
@@ -50549,7 +50653,7 @@ index 9680cef..d098ba0 100644
  exit3:
  		mnt_drop_write(nd.path.mnt);
  	exit2:
-@@ -2865,10 +3077,18 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
+@@ -2865,10 +3075,18 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
  	error = mnt_want_write(path.mnt);
  	if (error)
  		goto out_dput;
@@ -50568,7 +50672,7 @@ index 9680cef..d098ba0 100644
  out_drop_write:
  	mnt_drop_write(path.mnt);
  out_dput:
-@@ -2940,6 +3160,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -2940,6 +3158,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
  {
  	struct dentry *new_dentry;
  	struct path old_path, new_path;
@@ -50576,7 +50680,7 @@ index 9680cef..d098ba0 100644
  	int how = 0;
  	int error;
  
-@@ -2963,7 +3184,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -2963,7 +3182,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
  	if (error)
  		return error;
  
@@ -50585,7 +50689,7 @@ index 9680cef..d098ba0 100644
  	error = PTR_ERR(new_dentry);
  	if (IS_ERR(new_dentry))
  		goto out;
-@@ -2974,13 +3195,30 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -2974,13 +3193,30 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
  	error = mnt_want_write(new_path.mnt);
  	if (error)
  		goto out_dput;
@@ -50616,7 +50720,7 @@ index 9680cef..d098ba0 100644
  	dput(new_dentry);
  	mutex_unlock(&new_path.dentry->d_inode->i_mutex);
  	path_put(&new_path);
-@@ -3208,6 +3446,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
+@@ -3208,6 +3444,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
  	if (new_dentry == trap)
  		goto exit5;
  
@@ -50629,7 +50733,7 @@ index 9680cef..d098ba0 100644
  	error = mnt_want_write(oldnd.path.mnt);
  	if (error)
  		goto exit5;
-@@ -3217,6 +3461,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
+@@ -3217,6 +3459,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
  		goto exit6;
  	error = vfs_rename(old_dir->d_inode, old_dentry,
  				   new_dir->d_inode, new_dentry);
@@ -50639,7 +50743,7 @@ index 9680cef..d098ba0 100644
  exit6:
  	mnt_drop_write(oldnd.path.mnt);
  exit5:
-@@ -3242,6 +3489,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
+@@ -3242,6 +3487,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
  
  int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
  {
@@ -50648,7 +50752,7 @@ index 9680cef..d098ba0 100644
  	int len;
  
  	len = PTR_ERR(link);
-@@ -3251,7 +3500,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
+@@ -3251,7 +3498,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
  	len = strlen(link);
  	if (len > (unsigned) buflen)
  		len = buflen;
@@ -68145,10 +68249,18 @@ index 703cfa33..0b8ca72ac 100644
  			 void __user *, size_t *, loff_t *);
  extern int proc_dointvec_minmax(struct ctl_table *, int,
 diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h
-index 7faf933..eb6f5e3 100644
+index 7faf933..c1ad32c 100644
 --- a/include/linux/sysrq.h
 +++ b/include/linux/sysrq.h
-@@ -36,7 +36,7 @@ struct sysrq_key_op {
+@@ -15,6 +15,7 @@
+ #define _LINUX_SYSRQ_H
+ 
+ #include <linux/errno.h>
++#include <linux/compiler.h>
+ #include <linux/types.h>
+ 
+ /* Enable/disable SYSRQ support by default (0==no, 1==yes). */
+@@ -36,7 +37,7 @@ struct sysrq_key_op {
  	char *help_msg;
  	char *action_msg;
  	int enable_mask;
@@ -74209,7 +74321,7 @@ index ea7ec7f..23d4094 100644
  EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
  EXPORT_SYMBOL(register_sysctl_table);
 diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
-index a650694..aaeeb20 100644
+index a650694..d0c4f42 100644
 --- a/kernel/sysctl_binary.c
 +++ b/kernel/sysctl_binary.c
 @@ -989,7 +989,7 @@ static ssize_t bin_intvec(struct file *file,
@@ -74266,7 +74378,19 @@ index a650694..aaeeb20 100644
  		set_fs(old_fs);
  		if (result < 0)
  			goto out;
-@@ -1233,7 +1233,7 @@ static ssize_t bin_dn_node_address(struct file *file,
+@@ -1194,9 +1194,10 @@ static ssize_t bin_dn_node_address(struct file *file,
+ 
+ 		/* Convert the decnet address to binary */
+ 		result = -EIO;
+-		nodep = strchr(buf, '.') + 1;
++		nodep = strchr(buf, '.');
+ 		if (!nodep)
+ 			goto out;
++		++nodep;
+ 
+ 		area = simple_strtoul(buf, NULL, 10);
+ 		node = simple_strtoul(nodep, NULL, 10);
+@@ -1233,7 +1234,7 @@ static ssize_t bin_dn_node_address(struct file *file,
  				le16_to_cpu(dnaddr) & 0x3ff);
  
  		set_fs(KERNEL_DS);
@@ -76968,7 +77092,7 @@ index 4f4f53b..de8e432 100644
  	    capable(CAP_IPC_LOCK))
  		ret = do_mlockall(flags);
 diff --git a/mm/mmap.c b/mm/mmap.c
-index eae90af..09d8f77 100644
+index eae90af..0704837 100644
 --- a/mm/mmap.c
 +++ b/mm/mmap.c
 @@ -30,6 +30,7 @@
@@ -77851,7 +77975,7 @@ index eae90af..09d8f77 100644
  		size = vma->vm_end - address;
  		grow = (vma->vm_start - address) >> PAGE_SHIFT;
  
-@@ -1786,11 +2080,22 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -1786,18 +2080,48 @@ int expand_downwards(struct vm_area_struct *vma,
  			if (!error) {
  				vma->vm_start = address;
  				vma->vm_pgoff -= grow;
@@ -77874,7 +77998,48 @@ index eae90af..09d8f77 100644
  	khugepaged_enter_vma_merge(vma);
  	return error;
  }
-@@ -1860,6 +2165,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
+ 
++/*
++ * Note how expand_stack() refuses to expand the stack all the way to
++ * abut the next virtual mapping, *unless* that mapping itself is also
++ * a stack mapping. We want to leave room for a guard page, after all
++ * (the guard page itself is not added here, that is done by the
++ * actual page faulting logic)
++ *
++ * This matches the behavior of the guard page logic (see mm/memory.c:
++ * check_stack_guard_page()), which only allows the guard page to be
++ * removed under these circumstances.
++ */
+ #ifdef CONFIG_STACK_GROWSUP
+ int expand_stack(struct vm_area_struct *vma, unsigned long address)
+ {
++	struct vm_area_struct *next;
++
++	address &= PAGE_MASK;
++	next = vma->vm_next;
++	if (next && next->vm_start == address + PAGE_SIZE) {
++		if (!(next->vm_flags & VM_GROWSUP))
++			return -ENOMEM;
++	}
+ 	return expand_upwards(vma, address);
+ }
+ 
+@@ -1820,6 +2144,14 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
+ #else
+ int expand_stack(struct vm_area_struct *vma, unsigned long address)
+ {
++	struct vm_area_struct *prev;
++
++	address &= PAGE_MASK;
++	prev = vma->vm_prev;
++	if (prev && prev->vm_end == address) {
++		if (!(prev->vm_flags & VM_GROWSDOWN))
++			return -ENOMEM;
++	}
+ 	return expand_downwards(vma, address);
+ }
+ 
+@@ -1860,6 +2192,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
  	do {
  		long nrpages = vma_pages(vma);
  
@@ -77888,7 +78053,7 @@ index eae90af..09d8f77 100644
  		mm->total_vm -= nrpages;
  		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
  		vma = remove_vma(vma);
-@@ -1905,6 +2217,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -1905,6 +2244,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
  	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
  	vma->vm_prev = NULL;
  	do {
@@ -77905,7 +78070,7 @@ index eae90af..09d8f77 100644
  		rb_erase(&vma->vm_rb, &mm->mm_rb);
  		mm->map_count--;
  		tail_vma = vma;
-@@ -1933,14 +2255,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1933,14 +2282,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	struct vm_area_struct *new;
  	int err = -ENOMEM;
  
@@ -77939,7 +78104,7 @@ index eae90af..09d8f77 100644
  	/* most fields are the same, copy all, and then fixup */
  	*new = *vma;
  
-@@ -1953,6 +2294,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1953,6 +2321,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
  	}
  
@@ -77962,7 +78127,7 @@ index eae90af..09d8f77 100644
  	pol = mpol_dup(vma_policy(vma));
  	if (IS_ERR(pol)) {
  		err = PTR_ERR(pol);
-@@ -1978,6 +2335,42 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1978,6 +2362,42 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	else
  		err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
  
@@ -78005,7 +78170,7 @@ index eae90af..09d8f77 100644
  	/* Success. */
  	if (!err)
  		return 0;
-@@ -1990,10 +2383,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -1990,10 +2410,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  			removed_exe_file_vma(mm);
  		fput(new->vm_file);
  	}
@@ -78025,7 +78190,7 @@ index eae90af..09d8f77 100644
  	kmem_cache_free(vm_area_cachep, new);
   out_err:
  	return err;
-@@ -2006,6 +2407,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2006,6 +2434,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  	      unsigned long addr, int new_below)
  {
@@ -78041,7 +78206,7 @@ index eae90af..09d8f77 100644
  	if (mm->map_count >= sysctl_max_map_count)
  		return -ENOMEM;
  
-@@ -2017,11 +2427,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2017,11 +2454,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
   * work.  This now handles partial unmappings.
   * Jeremy Fitzhardinge <jeremy@××××.org>
   */
@@ -78072,7 +78237,7 @@ index eae90af..09d8f77 100644
  	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
  		return -EINVAL;
  
-@@ -2096,6 +2525,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+@@ -2096,6 +2552,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
  	/* Fix up all other VM information */
  	remove_vma_list(mm, vma);
  
@@ -78081,7 +78246,7 @@ index eae90af..09d8f77 100644
  	return 0;
  }
  
-@@ -2108,22 +2539,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+@@ -2108,22 +2566,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
  
  	profile_munmap(addr);
  
@@ -78110,7 +78275,7 @@ index eae90af..09d8f77 100644
  /*
   *  this is really a simplified "do_mmap".  it only handles
   *  anonymous maps.  eventually we may be able to do some
-@@ -2137,6 +2564,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2137,6 +2591,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	struct rb_node ** rb_link, * rb_parent;
  	pgoff_t pgoff = addr >> PAGE_SHIFT;
  	int error;
@@ -78118,7 +78283,7 @@ index eae90af..09d8f77 100644
  
  	len = PAGE_ALIGN(len);
  	if (!len)
-@@ -2148,16 +2576,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2148,16 +2603,30 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  
  	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
  
@@ -78150,7 +78315,7 @@ index eae90af..09d8f77 100644
  		locked += mm->locked_vm;
  		lock_limit = rlimit(RLIMIT_MEMLOCK);
  		lock_limit >>= PAGE_SHIFT;
-@@ -2174,22 +2616,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2174,22 +2643,22 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	/*
  	 * Clear old maps.  this also does some error checking for us
  	 */
@@ -78177,7 +78342,7 @@ index eae90af..09d8f77 100644
  		return -ENOMEM;
  
  	/* Can we just expand an old private anonymous mapping? */
-@@ -2203,7 +2645,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2203,7 +2672,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	 */
  	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
  	if (!vma) {
@@ -78186,7 +78351,7 @@ index eae90af..09d8f77 100644
  		return -ENOMEM;
  	}
  
-@@ -2217,11 +2659,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2217,11 +2686,12 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
  	vma_link(mm, vma, prev, rb_link, rb_parent);
  out:
  	perf_event_mmap(vma);
@@ -78201,7 +78366,7 @@ index eae90af..09d8f77 100644
  	return addr;
  }
  
-@@ -2268,8 +2711,10 @@ void exit_mmap(struct mm_struct *mm)
+@@ -2268,8 +2738,10 @@ void exit_mmap(struct mm_struct *mm)
  	 * Walk the list again, actually closing and freeing it,
  	 * with preemption enabled, without holding any MM locks.
  	 */
@@ -78213,7 +78378,7 @@ index eae90af..09d8f77 100644
  
  	BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
  }
-@@ -2283,6 +2728,13 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
+@@ -2283,6 +2755,13 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
  	struct vm_area_struct * __vma, * prev;
  	struct rb_node ** rb_link, * rb_parent;
  
@@ -78227,7 +78392,7 @@ index eae90af..09d8f77 100644
  	/*
  	 * The vm_pgoff of a purely anonymous vma should be irrelevant
  	 * until its first write fault, when page's anon_vma and index
-@@ -2305,7 +2757,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
+@@ -2305,7 +2784,22 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
  	if ((vma->vm_flags & VM_ACCOUNT) &&
  	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
  		return -ENOMEM;
@@ -78250,7 +78415,7 @@ index eae90af..09d8f77 100644
  	return 0;
  }
  
-@@ -2323,6 +2790,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2323,6 +2817,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	struct rb_node **rb_link, *rb_parent;
  	struct mempolicy *pol;
  
@@ -78259,7 +78424,7 @@ index eae90af..09d8f77 100644
  	/*
  	 * If anonymous vma has not yet been faulted, update new pgoff
  	 * to match new location, to increase its chance of merging.
-@@ -2373,6 +2842,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2373,6 +2869,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	return NULL;
  }
  
@@ -78299,7 +78464,7 @@ index eae90af..09d8f77 100644
  /*
   * Return true if the calling process may expand its vm space by the passed
   * number of pages
-@@ -2384,6 +2886,12 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+@@ -2384,6 +2913,12 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
  
  	lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
  
@@ -78312,7 +78477,7 @@ index eae90af..09d8f77 100644
  	if (cur + npages > lim)
  		return 0;
  	return 1;
-@@ -2454,6 +2962,22 @@ int install_special_mapping(struct mm_struct *mm,
+@@ -2454,6 +2989,22 @@ int install_special_mapping(struct mm_struct *mm,
  	vma->vm_start = addr;
  	vma->vm_end = addr + len;
  

diff --git a/3.8.0/0000_README b/3.8.1/0000_README
similarity index 96%
rename from 3.8.0/0000_README
rename to 3.8.1/0000_README
index a9cab40..517c0e6 100644
--- a/3.8.0/0000_README
+++ b/3.8.1/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.9.1-3.8.0-201302271810.patch
+Patch:	4420_grsecurity-2.9.1-3.8.1-201303012255.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/3.8.0/4420_grsecurity-2.9.1-3.8.0-201302271810.patch b/3.8.1/4420_grsecurity-2.9.1-3.8.1-201303012255.patch
similarity index 99%
rename from 3.8.0/4420_grsecurity-2.9.1-3.8.0-201302271810.patch
rename to 3.8.1/4420_grsecurity-2.9.1-3.8.1-201303012255.patch
index 24c501f..b69296b 100644
--- a/3.8.0/4420_grsecurity-2.9.1-3.8.0-201302271810.patch
+++ b/3.8.1/4420_grsecurity-2.9.1-3.8.1-201303012255.patch
@@ -252,7 +252,7 @@ index 6c72381..2fe9ae4 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index d69266c..e4f6593 100644
+index 746c856..c014cfa 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -5494,10 +5494,10 @@ index fc987a1..6e068ef 100644
  #endif
  
 diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
-index ee99f23..802b0a1 100644
+index 7df49fa..38b62bf 100644
 --- a/arch/parisc/include/asm/pgtable.h
 +++ b/arch/parisc/include/asm/pgtable.h
-@@ -212,6 +212,17 @@ struct vm_area_struct;
+@@ -218,6 +218,17 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
  #define PAGE_EXECREAD   __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
  #define PAGE_COPY       PAGE_EXECREAD
  #define PAGE_RWX        __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
@@ -9071,7 +9071,7 @@ index e98bfda..ea8d221 100644
  		if (!(vma->vm_flags & (VM_READ | VM_EXEC)))
  			goto bad_area;
 diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
-index 097aee7..5ca6697 100644
+index 5062ff3..e0b75f3 100644
 --- a/arch/sparc/mm/fault_64.c
 +++ b/arch/sparc/mm/fault_64.c
 @@ -21,6 +21,9 @@
@@ -9827,7 +9827,7 @@ index ad8f795..2c7eec6 100644
  /*
   * Memory returned by kmalloc() may be used for DMA, so we must make
 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 225543b..f12405b 100644
+index 0694d09..b58b3aa 100644
 --- a/arch/x86/Kconfig
 +++ b/arch/x86/Kconfig
 @@ -238,7 +238,7 @@ config X86_HT
@@ -9874,7 +9874,7 @@ index 225543b..f12405b 100644
  	default 0x40000000 if VMSPLIT_1G
  	default 0xC0000000
  	depends on X86_32
-@@ -1546,6 +1547,7 @@ config SECCOMP
+@@ -1542,6 +1543,7 @@ config SECCOMP
  
  config CC_STACKPROTECTOR
  	bool "Enable -fstack-protector buffer overflow detection"
@@ -9882,7 +9882,7 @@ index 225543b..f12405b 100644
  	---help---
  	  This option turns on the -fstack-protector GCC feature. This
  	  feature puts, at the beginning of functions, a canary value on
-@@ -1603,6 +1605,7 @@ config KEXEC_JUMP
+@@ -1599,6 +1601,7 @@ config KEXEC_JUMP
  config PHYSICAL_START
  	hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP)
  	default "0x1000000"
@@ -9890,7 +9890,7 @@ index 225543b..f12405b 100644
  	---help---
  	  This gives the physical address where the kernel is loaded.
  
-@@ -1666,6 +1669,7 @@ config X86_NEED_RELOCS
+@@ -1662,6 +1665,7 @@ config X86_NEED_RELOCS
  config PHYSICAL_ALIGN
  	hex "Alignment value to which kernel should be aligned" if X86_32
  	default "0x1000000"
@@ -9898,7 +9898,7 @@ index 225543b..f12405b 100644
  	range 0x2000 0x1000000
  	---help---
  	  This value puts the alignment restrictions on physical address
-@@ -1741,9 +1745,10 @@ config DEBUG_HOTPLUG_CPU0
+@@ -1737,9 +1741,10 @@ config DEBUG_HOTPLUG_CPU0
  	  If unsure, say N.
  
  config COMPAT_VDSO
@@ -19375,6 +19375,91 @@ index 1d41402..af9a46a 100644
  	if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
  		return -EFAULT;
  
+diff --git a/arch/x86/kernel/head.c b/arch/x86/kernel/head.c
+index 48d9d4e..992f442 100644
+--- a/arch/x86/kernel/head.c
++++ b/arch/x86/kernel/head.c
+@@ -5,8 +5,6 @@
+ #include <asm/setup.h>
+ #include <asm/bios_ebda.h>
+ 
+-#define BIOS_LOWMEM_KILOBYTES 0x413
+-
+ /*
+  * The BIOS places the EBDA/XBDA at the top of conventional
+  * memory, and usually decreases the reported amount of
+@@ -16,17 +14,30 @@
+  * chipset: reserve a page before VGA to prevent PCI prefetch
+  * into it (errata #56). Usually the page is reserved anyways,
+  * unless you have no PS/2 mouse plugged in.
++ *
++ * This functions is deliberately very conservative.  Losing
++ * memory in the bottom megabyte is rarely a problem, as long
++ * as we have enough memory to install the trampoline.  Using
++ * memory that is in use by the BIOS or by some DMA device
++ * the BIOS didn't shut down *is* a big problem.
+  */
++
++#define BIOS_LOWMEM_KILOBYTES	0x413
++#define LOWMEM_CAP		0x9f000U	/* Absolute maximum */
++#define INSANE_CUTOFF		0x20000U	/* Less than this = insane */
++
+ void __init reserve_ebda_region(void)
+ {
+ 	unsigned int lowmem, ebda_addr;
+ 
+-	/* To determine the position of the EBDA and the */
+-	/* end of conventional memory, we need to look at */
+-	/* the BIOS data area. In a paravirtual environment */
+-	/* that area is absent. We'll just have to assume */
+-	/* that the paravirt case can handle memory setup */
+-	/* correctly, without our help. */
++	/*
++	 * To determine the position of the EBDA and the
++	 * end of conventional memory, we need to look at
++	 * the BIOS data area. In a paravirtual environment
++	 * that area is absent. We'll just have to assume
++	 * that the paravirt case can handle memory setup
++	 * correctly, without our help.
++	 */
+ 	if (paravirt_enabled())
+ 		return;
+ 
+@@ -37,19 +48,23 @@ void __init reserve_ebda_region(void)
+ 	/* start of EBDA area */
+ 	ebda_addr = get_bios_ebda();
+ 
+-	/* Fixup: bios puts an EBDA in the top 64K segment */
+-	/* of conventional memory, but does not adjust lowmem. */
+-	if ((lowmem - ebda_addr) <= 0x10000)
+-		lowmem = ebda_addr;
++	/*
++	 * Note: some old Dells seem to need 4k EBDA without
++	 * reporting so, so just consider the memory above 0x9f000
++	 * to be off limits (bugzilla 2990).
++	 */
+ 
+-	/* Fixup: bios does not report an EBDA at all. */
+-	/* Some old Dells seem to need 4k anyhow (bugzilla 2990) */
+-	if ((ebda_addr == 0) && (lowmem >= 0x9f000))
+-		lowmem = 0x9f000;
++	/* If the EBDA address is below 128K, assume it is bogus */
++	if (ebda_addr < INSANE_CUTOFF)
++		ebda_addr = LOWMEM_CAP;
+ 
+-	/* Paranoia: should never happen, but... */
+-	if ((lowmem == 0) || (lowmem >= 0x100000))
+-		lowmem = 0x9f000;
++	/* If lowmem is less than 128K, assume it is bogus */
++	if (lowmem < INSANE_CUTOFF)
++		lowmem = LOWMEM_CAP;
++
++	/* Use the lower of the lowmem and EBDA markers as the cutoff */
++	lowmem = min(lowmem, ebda_addr);
++	lowmem = min(lowmem, LOWMEM_CAP); /* Absolute cap */
+ 
+ 	/* reserve all memory between lowmem and the 1MB mark */
+ 	memblock_reserve(lowmem, 0x100000 - lowmem);
 diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
 index c18f59d..9c0c9f6 100644
 --- a/arch/x86/kernel/head32.c
@@ -33144,7 +33229,7 @@ index 9d7732b..0b1a793 100644
  	.priority = 1,
  };
 diff --git a/drivers/dma/sh/shdma.c b/drivers/dma/sh/shdma.c
-index 3315e4b..fc38316 100644
+index b70709b..1d8d02a 100644
 --- a/drivers/dma/sh/shdma.c
 +++ b/drivers/dma/sh/shdma.c
 @@ -476,7 +476,7 @@ static int sh_dmae_nmi_handler(struct notifier_block *self,
@@ -33683,7 +33768,7 @@ index 6e0acad..93c8289 100644
  	int front_offset;
  } drm_i810_private_t;
 diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
-index 9d4a2c2..32a119f 100644
+index 8a7c48b..72effc2 100644
 --- a/drivers/gpu/drm/i915/i915_debugfs.c
 +++ b/drivers/gpu/drm/i915/i915_debugfs.c
 @@ -496,7 +496,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
@@ -33709,7 +33794,7 @@ index 99daa89..84ebd44 100644
  	return can_switch;
  }
 diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 12ab3bd..b3bed3b 100644
+index 7339a4b..445aaba 100644
 --- a/drivers/gpu/drm/i915/i915_drv.h
 +++ b/drivers/gpu/drm/i915/i915_drv.h
 @@ -656,7 +656,7 @@ typedef struct drm_i915_private {
@@ -33868,10 +33953,10 @@ index fe84338..a863190 100644
  	iir = I915_READ(IIR);
  
 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index da1ad9c..10d368b 100644
+index 80aa1fc..1ede041 100644
 --- a/drivers/gpu/drm/i915/intel_display.c
 +++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -2244,7 +2244,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb)
+@@ -2255,7 +2255,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb)
  
  	wait_event(dev_priv->pending_flip_queue,
  		   atomic_read(&dev_priv->mm.wedged) ||
@@ -33880,7 +33965,7 @@ index da1ad9c..10d368b 100644
  
  	/* Big Hammer, we also need to ensure that any pending
  	 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
-@@ -7109,8 +7109,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
+@@ -7122,8 +7122,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
  
  	obj = work->old_fb_obj;
  
@@ -33890,7 +33975,7 @@ index da1ad9c..10d368b 100644
  	wake_up(&dev_priv->pending_flip_queue);
  
  	queue_work(dev_priv->wq, &work->work);
-@@ -7477,7 +7476,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
+@@ -7490,7 +7489,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
  	/* Block clients from rendering to the new back buffer until
  	 * the flip occurs and the object is no longer visible.
  	 */
@@ -33899,7 +33984,7 @@ index da1ad9c..10d368b 100644
  	atomic_inc(&intel_crtc->unpin_work_count);
  
  	ret = dev_priv->display.queue_flip(dev, crtc, fb, obj);
-@@ -7494,7 +7493,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
+@@ -7507,7 +7506,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
  
  cleanup_pending:
  	atomic_dec(&intel_crtc->unpin_work_count);
@@ -36566,6 +36651,27 @@ index 9382895..ac8093c 100644
  
  /* debug */
  static int dvb_usb_dw2102_debug;
+diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
+index 29b2172..a7c5b31 100644
+--- a/drivers/memstick/host/r592.c
++++ b/drivers/memstick/host/r592.c
+@@ -454,7 +454,7 @@ static int r592_transfer_fifo_pio(struct r592_device *dev)
+ /* Executes one TPC (data is read/written from small or large fifo) */
+ static void r592_execute_tpc(struct r592_device *dev)
+ {
+-	bool is_write = dev->req->tpc >= MS_TPC_SET_RW_REG_ADRS;
++	bool is_write;
+ 	int len, error;
+ 	u32 status, reg;
+ 
+@@ -463,6 +463,7 @@ static void r592_execute_tpc(struct r592_device *dev)
+ 		return;
+ 	}
+ 
++	is_write = dev->req->tpc >= MS_TPC_SET_RW_REG_ADRS;
+ 	len = dev->req->long_data ?
+ 		dev->req->sg.length : dev->req->data_len;
+ 
 diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
 index fb69baa..cf7ad22 100644
 --- a/drivers/message/fusion/mptbase.c
@@ -37609,7 +37715,7 @@ index daec9b0..6428fcb 100644
  }
  EXPORT_SYMBOL(free_mdio_bitbang);
 diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
-index 0b2706a..ba1430d 100644
+index 508570e..f706dc7 100644
 --- a/drivers/net/ppp/ppp_generic.c
 +++ b/drivers/net/ppp/ppp_generic.c
 @@ -999,7 +999,6 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
@@ -40670,7 +40776,7 @@ index f9d2850..b006f04 100644
  	tty_port_tty_set(&ch->port, tty);
  	mutex_lock(&ch->port.mutex);
 diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
-index dcc0430..040bef9 100644
+index bfd6771..e0d93c4 100644
 --- a/drivers/tty/n_gsm.c
 +++ b/drivers/tty/n_gsm.c
 @@ -1636,7 +1636,7 @@ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr)
@@ -40682,7 +40788,7 @@ index dcc0430..040bef9 100644
  		kfree(dlci);
  		return NULL;
  	}
-@@ -2924,7 +2924,7 @@ static int gsmtty_open(struct tty_struct *tty, struct file *filp)
+@@ -2936,7 +2936,7 @@ static int gsmtty_open(struct tty_struct *tty, struct file *filp)
  	struct gsm_dlci *dlci = tty->driver_data;
  	struct tty_port *port = &dlci->port;
  
@@ -41521,19 +41627,6 @@ index 681765b..d3ccdf2 100644
  		if (!perm) {
  			ret = -EPERM;
  			goto reterr;
-diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
-index 8fd8968..3614c9c 100644
---- a/drivers/tty/vt/vt.c
-+++ b/drivers/tty/vt/vt.c
-@@ -539,7 +539,7 @@ static void insert_char(struct vc_data *vc, unsigned int nr)
- {
- 	unsigned short *p = (unsigned short *) vc->vc_pos;
- 
--	scr_memmovew(p + nr, p, (vc->vc_cols - vc->vc_x) * 2);
-+	scr_memmovew(p + nr, p, (vc->vc_cols - vc->vc_x - nr) * 2);
- 	scr_memsetw(p, vc->vc_video_erase_char, nr * 2);
- 	vc->vc_need_wrap = 0;
- 	if (DO_UPDATE(vc))
 diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
 index 5110f36..8dc0a74 100644
 --- a/drivers/uio/uio.c
@@ -42024,7 +42117,7 @@ index 5c3960d..15cf8fc 100644
  		goto out1;
  	}
 diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
-index 3ff0105..7589d98 100644
+index dc61c12..e29796e 100644
 --- a/drivers/video/fbmem.c
 +++ b/drivers/video/fbmem.c
 @@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
@@ -46262,7 +46355,7 @@ index b96fc6c..431d628 100644
  	__bio_for_each_segment(bvec, bio, i, 0) {
  		char *addr = page_address(bvec->bv_page);
 diff --git a/fs/block_dev.c b/fs/block_dev.c
-index 172f849..6efbf24 100644
+index 78333a3..23dcb4d 100644
 --- a/fs/block_dev.c
 +++ b/fs/block_dev.c
 @@ -651,7 +651,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
@@ -50192,7 +50285,7 @@ index 916da8c..1588998 100644
  					    next->d_inode->i_ino, 
  					    dt_type(next->d_inode)) < 0)
 diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
-index 54f9e6c..9ed908c 100644
+index 52e5120..808936e 100644
 --- a/fs/lockd/clntproc.c
 +++ b/fs/lockd/clntproc.c
 @@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt_cancel_ops;
@@ -50235,7 +50328,7 @@ index a94e331..060bce3 100644
  
  	lock_flocks();
 diff --git a/fs/namei.c b/fs/namei.c
-index 43a97ee..117e7e4 100644
+index 43a97ee..4e585fd 100644
 --- a/fs/namei.c
 +++ b/fs/namei.c
 @@ -319,16 +319,32 @@ int generic_permission(struct inode *inode, int mask)
@@ -50338,21 +50431,19 @@ index 43a97ee..117e7e4 100644
  			put_link(nd, &link, cookie);
  		}
  	}
-@@ -1986,6 +2004,21 @@ static int path_lookupat(int dfd, const char *name,
+@@ -1986,6 +2004,19 @@ static int path_lookupat(int dfd, const char *name,
  	if (!err)
  		err = complete_walk(nd);
  
-+	if (!(nd->flags & LOOKUP_PARENT)) {
++	if (!err && !(nd->flags & LOOKUP_PARENT)) {
 +#ifdef CONFIG_GRKERNSEC
 +		if (flags & LOOKUP_RCU) {
-+			if (!err)
-+				path_put(&nd->path);
++			path_put(&nd->path);
 +			err = -ECHILD;
 +		} else
 +#endif
 +		if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
-+			if (!err)
-+				path_put(&nd->path);
++			path_put(&nd->path);
 +			err = -ENOENT;
 +		}
 +	}
@@ -50360,7 +50451,7 @@ index 43a97ee..117e7e4 100644
  	if (!err && nd->flags & LOOKUP_DIRECTORY) {
  		if (!nd->inode->i_op->lookup) {
  			path_put(&nd->path);
-@@ -2013,8 +2046,17 @@ static int filename_lookup(int dfd, struct filename *name,
+@@ -2013,8 +2044,17 @@ static int filename_lookup(int dfd, struct filename *name,
  		retval = path_lookupat(dfd, name->name,
  						flags | LOOKUP_REVAL, nd);
  
@@ -50379,7 +50470,7 @@ index 43a97ee..117e7e4 100644
  	return retval;
  }
  
-@@ -2392,6 +2434,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
+@@ -2392,6 +2432,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
  	if (flag & O_NOATIME && !inode_owner_or_capable(inode))
  		return -EPERM;
  
@@ -50393,7 +50484,7 @@ index 43a97ee..117e7e4 100644
  	return 0;
  }
  
-@@ -2613,7 +2662,7 @@ looked_up:
+@@ -2613,7 +2660,7 @@ looked_up:
   * cleared otherwise prior to returning.
   */
  static int lookup_open(struct nameidata *nd, struct path *path,
@@ -50402,7 +50493,7 @@ index 43a97ee..117e7e4 100644
  			const struct open_flags *op,
  			bool got_write, int *opened)
  {
-@@ -2648,6 +2697,17 @@ static int lookup_open(struct nameidata *nd, struct path *path,
+@@ -2648,6 +2695,17 @@ static int lookup_open(struct nameidata *nd, struct path *path,
  	/* Negative dentry, just create the file */
  	if (!dentry->d_inode && (op->open_flag & O_CREAT)) {
  		umode_t mode = op->mode;
@@ -50420,7 +50511,7 @@ index 43a97ee..117e7e4 100644
  		if (!IS_POSIXACL(dir->d_inode))
  			mode &= ~current_umask();
  		/*
-@@ -2669,6 +2729,8 @@ static int lookup_open(struct nameidata *nd, struct path *path,
+@@ -2669,6 +2727,8 @@ static int lookup_open(struct nameidata *nd, struct path *path,
  				   nd->flags & LOOKUP_EXCL);
  		if (error)
  			goto out_dput;
@@ -50429,7 +50520,7 @@ index 43a97ee..117e7e4 100644
  	}
  out_no_open:
  	path->dentry = dentry;
-@@ -2683,7 +2745,7 @@ out_dput:
+@@ -2683,7 +2743,7 @@ out_dput:
  /*
   * Handle the last step of open()
   */
@@ -50438,7 +50529,7 @@ index 43a97ee..117e7e4 100644
  		   struct file *file, const struct open_flags *op,
  		   int *opened, struct filename *name)
  {
-@@ -2712,16 +2774,44 @@ static int do_last(struct nameidata *nd, struct path *path,
+@@ -2712,16 +2772,44 @@ static int do_last(struct nameidata *nd, struct path *path,
  		error = complete_walk(nd);
  		if (error)
  			return error;
@@ -50483,7 +50574,7 @@ index 43a97ee..117e7e4 100644
  		audit_inode(name, dir, 0);
  		goto finish_open;
  	}
-@@ -2770,7 +2860,7 @@ retry_lookup:
+@@ -2770,7 +2858,7 @@ retry_lookup:
  		 */
  	}
  	mutex_lock(&dir->d_inode->i_mutex);
@@ -50492,7 +50583,7 @@ index 43a97ee..117e7e4 100644
  	mutex_unlock(&dir->d_inode->i_mutex);
  
  	if (error <= 0) {
-@@ -2794,11 +2884,28 @@ retry_lookup:
+@@ -2794,11 +2882,28 @@ retry_lookup:
  		goto finish_open_created;
  	}
  
@@ -50522,7 +50613,7 @@ index 43a97ee..117e7e4 100644
  
  	/*
  	 * If atomic_open() acquired write access it is dropped now due to
-@@ -2839,6 +2946,11 @@ finish_lookup:
+@@ -2839,6 +2944,11 @@ finish_lookup:
  			}
  		}
  		BUG_ON(inode != path->dentry->d_inode);
@@ -50534,7 +50625,7 @@ index 43a97ee..117e7e4 100644
  		return 1;
  	}
  
-@@ -2848,7 +2960,6 @@ finish_lookup:
+@@ -2848,7 +2958,6 @@ finish_lookup:
  		save_parent.dentry = nd->path.dentry;
  		save_parent.mnt = mntget(path->mnt);
  		nd->path.dentry = path->dentry;
@@ -50542,7 +50633,7 @@ index 43a97ee..117e7e4 100644
  	}
  	nd->inode = inode;
  	/* Why this, you ask?  _Now_ we might have grown LOOKUP_JUMPED... */
-@@ -2857,6 +2968,22 @@ finish_lookup:
+@@ -2857,6 +2966,22 @@ finish_lookup:
  		path_put(&save_parent);
  		return error;
  	}
@@ -50565,7 +50656,7 @@ index 43a97ee..117e7e4 100644
  	error = -EISDIR;
  	if ((open_flag & O_CREAT) && S_ISDIR(nd->inode->i_mode))
  		goto out;
-@@ -2955,7 +3082,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
+@@ -2955,7 +3080,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
  	if (unlikely(error))
  		goto out;
  
@@ -50574,7 +50665,7 @@ index 43a97ee..117e7e4 100644
  	while (unlikely(error > 0)) { /* trailing symlink */
  		struct path link = path;
  		void *cookie;
-@@ -2973,7 +3100,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
+@@ -2973,7 +3098,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
  		error = follow_link(&link, nd, &cookie);
  		if (unlikely(error))
  			break;
@@ -50583,7 +50674,7 @@ index 43a97ee..117e7e4 100644
  		put_link(nd, &link, cookie);
  	}
  out:
-@@ -3073,8 +3200,12 @@ struct dentry *kern_path_create(int dfd, const char *pathname,
+@@ -3073,8 +3198,12 @@ struct dentry *kern_path_create(int dfd, const char *pathname,
  		goto unlock;
  
  	error = -EEXIST;
@@ -50597,7 +50688,7 @@ index 43a97ee..117e7e4 100644
  	/*
  	 * Special case - lookup gave negative, but... we had foo/bar/
  	 * From the vfs_mknod() POV we just have a negative dentry -
-@@ -3126,6 +3257,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname,
+@@ -3126,6 +3255,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname,
  }
  EXPORT_SYMBOL(user_path_create);
  
@@ -50618,7 +50709,7 @@ index 43a97ee..117e7e4 100644
  int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
  {
  	int error = may_create(dir, dentry);
-@@ -3188,6 +3333,17 @@ retry:
+@@ -3188,6 +3331,17 @@ retry:
  
  	if (!IS_POSIXACL(path.dentry->d_inode))
  		mode &= ~current_umask();
@@ -50636,7 +50727,7 @@ index 43a97ee..117e7e4 100644
  	error = security_path_mknod(&path, dentry, mode, dev);
  	if (error)
  		goto out;
-@@ -3204,6 +3360,8 @@ retry:
+@@ -3204,6 +3358,8 @@ retry:
  			break;
  	}
  out:
@@ -50645,7 +50736,7 @@ index 43a97ee..117e7e4 100644
  	done_path_create(&path, dentry);
  	if (retry_estale(error, lookup_flags)) {
  		lookup_flags |= LOOKUP_REVAL;
-@@ -3256,9 +3414,16 @@ retry:
+@@ -3256,9 +3412,16 @@ retry:
  
  	if (!IS_POSIXACL(path.dentry->d_inode))
  		mode &= ~current_umask();
@@ -50662,7 +50753,7 @@ index 43a97ee..117e7e4 100644
  	done_path_create(&path, dentry);
  	if (retry_estale(error, lookup_flags)) {
  		lookup_flags |= LOOKUP_REVAL;
-@@ -3339,6 +3504,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
+@@ -3339,6 +3502,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
  	struct filename *name;
  	struct dentry *dentry;
  	struct nameidata nd;
@@ -50671,7 +50762,7 @@ index 43a97ee..117e7e4 100644
  	unsigned int lookup_flags = 0;
  retry:
  	name = user_path_parent(dfd, pathname, &nd, lookup_flags);
-@@ -3371,10 +3538,21 @@ retry:
+@@ -3371,10 +3536,21 @@ retry:
  		error = -ENOENT;
  		goto exit3;
  	}
@@ -50693,7 +50784,7 @@ index 43a97ee..117e7e4 100644
  exit3:
  	dput(dentry);
  exit2:
-@@ -3440,6 +3618,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+@@ -3440,6 +3616,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
  	struct dentry *dentry;
  	struct nameidata nd;
  	struct inode *inode = NULL;
@@ -50702,7 +50793,7 @@ index 43a97ee..117e7e4 100644
  	unsigned int lookup_flags = 0;
  retry:
  	name = user_path_parent(dfd, pathname, &nd, lookup_flags);
-@@ -3466,10 +3646,22 @@ retry:
+@@ -3466,10 +3644,22 @@ retry:
  		if (!inode)
  			goto slashes;
  		ihold(inode);
@@ -50725,7 +50816,7 @@ index 43a97ee..117e7e4 100644
  exit2:
  		dput(dentry);
  	}
-@@ -3547,9 +3739,17 @@ retry:
+@@ -3547,9 +3737,17 @@ retry:
  	if (IS_ERR(dentry))
  		goto out_putname;
  
@@ -50743,7 +50834,7 @@ index 43a97ee..117e7e4 100644
  	done_path_create(&path, dentry);
  	if (retry_estale(error, lookup_flags)) {
  		lookup_flags |= LOOKUP_REVAL;
-@@ -3623,6 +3823,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -3623,6 +3821,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
  {
  	struct dentry *new_dentry;
  	struct path old_path, new_path;
@@ -50751,7 +50842,7 @@ index 43a97ee..117e7e4 100644
  	int how = 0;
  	int error;
  
-@@ -3646,7 +3847,7 @@ retry:
+@@ -3646,7 +3845,7 @@ retry:
  	if (error)
  		return error;
  
@@ -50760,7 +50851,7 @@ index 43a97ee..117e7e4 100644
  					(how & LOOKUP_REVAL));
  	error = PTR_ERR(new_dentry);
  	if (IS_ERR(new_dentry))
-@@ -3658,11 +3859,28 @@ retry:
+@@ -3658,11 +3857,28 @@ retry:
  	error = may_linkat(&old_path);
  	if (unlikely(error))
  		goto out_dput;
@@ -50789,7 +50880,7 @@ index 43a97ee..117e7e4 100644
  	done_path_create(&new_path, new_dentry);
  	if (retry_estale(error, how)) {
  		how |= LOOKUP_REVAL;
-@@ -3908,12 +4126,21 @@ retry:
+@@ -3908,12 +4124,21 @@ retry:
  	if (new_dentry == trap)
  		goto exit5;
  
@@ -50811,7 +50902,7 @@ index 43a97ee..117e7e4 100644
  exit5:
  	dput(new_dentry);
  exit4:
-@@ -3945,6 +4172,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
+@@ -3945,6 +4170,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
  
  int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
  {
@@ -50820,7 +50911,7 @@ index 43a97ee..117e7e4 100644
  	int len;
  
  	len = PTR_ERR(link);
-@@ -3954,7 +4183,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
+@@ -3954,7 +4181,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
  	len = strlen(link);
  	if (len > (unsigned) buflen)
  		len = buflen;
@@ -50837,7 +50928,7 @@ index 43a97ee..117e7e4 100644
  out:
  	return len;
 diff --git a/fs/namespace.c b/fs/namespace.c
-index 55605c5..f2908c8 100644
+index a51054f..f9b53e5 100644
 --- a/fs/namespace.c
 +++ b/fs/namespace.c
 @@ -1215,6 +1215,9 @@ static int do_umount(struct mount *mnt, int flags)
@@ -50850,7 +50941,7 @@ index 55605c5..f2908c8 100644
  		return retval;
  	}
  
-@@ -1234,9 +1237,20 @@ static int do_umount(struct mount *mnt, int flags)
+@@ -1234,6 +1237,9 @@ static int do_umount(struct mount *mnt, int flags)
  	br_write_unlock(&vfsmount_lock);
  	up_write(&namespace_sem);
  	release_mounts(&umount_list);
@@ -50860,85 +50951,7 @@ index 55605c5..f2908c8 100644
  	return retval;
  }
  
-+/* 
-+ * Is the caller allowed to modify his namespace?
-+ */
-+static inline bool may_mount(void)
-+{
-+	return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);
-+}
-+
- /*
-  * Now umount can handle mount points as well as block devices.
-  * This is important for filesystems which use unnamed block devices.
-@@ -1255,6 +1269,9 @@ SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
- 	if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
- 		return -EINVAL;
- 
-+	if (!may_mount())
-+		return -EPERM;
-+
- 	if (!(flags & UMOUNT_NOFOLLOW))
- 		lookup_flags |= LOOKUP_FOLLOW;
- 
-@@ -1268,10 +1285,6 @@ SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
- 	if (!check_mnt(mnt))
- 		goto dput_and_out;
- 
--	retval = -EPERM;
--	if (!ns_capable(mnt->mnt_ns->user_ns, CAP_SYS_ADMIN))
--		goto dput_and_out;
--
- 	retval = do_umount(mnt, flags);
- dput_and_out:
- 	/* we mustn't call path_put() as that would clear mnt_expiry_mark */
-@@ -1295,7 +1308,7 @@ SYSCALL_DEFINE1(oldumount, char __user *, name)
- 
- static int mount_is_safe(struct path *path)
- {
--	if (ns_capable(real_mount(path->mnt)->mnt_ns->user_ns, CAP_SYS_ADMIN))
-+	if (may_mount())
- 		return 0;
- 	return -EPERM;
- #ifdef notyet
-@@ -1633,7 +1646,7 @@ static int do_change_type(struct path *path, int flag)
- 	int type;
- 	int err = 0;
- 
--	if (!ns_capable(mnt->mnt_ns->user_ns, CAP_SYS_ADMIN))
-+	if (!may_mount())
- 		return -EPERM;
- 
- 	if (path->dentry != path->mnt->mnt_root)
-@@ -1797,7 +1810,7 @@ static int do_move_mount(struct path *path, const char *old_name)
- 	struct mount *p;
- 	struct mount *old;
- 	int err = 0;
--	if (!ns_capable(real_mount(path->mnt)->mnt_ns->user_ns, CAP_SYS_ADMIN))
-+	if (!may_mount())
- 		return -EPERM;
- 	if (!old_name || !*old_name)
- 		return -EINVAL;
-@@ -1933,16 +1946,14 @@ static int do_new_mount(struct path *path, const char *fstype, int flags,
- 			int mnt_flags, const char *name, void *data)
- {
- 	struct file_system_type *type;
--	struct user_namespace *user_ns;
-+	struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
- 	struct vfsmount *mnt;
- 	int err;
- 
- 	if (!fstype)
- 		return -EINVAL;
- 
--	/* we need capabilities... */
--	user_ns = real_mount(path->mnt)->mnt_ns->user_ns;
--	if (!ns_capable(user_ns, CAP_SYS_ADMIN))
-+	if (!may_mount())
- 		return -EPERM;
- 
- 	type = get_fs_type(fstype);
-@@ -2282,6 +2293,16 @@ long do_mount(const char *dev_name, const char *dir_name,
+@@ -2287,6 +2293,16 @@ long do_mount(const char *dev_name, const char *dir_name,
  		   MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
  		   MS_STRICTATIME);
  
@@ -50955,7 +50968,7 @@ index 55605c5..f2908c8 100644
  	if (flags & MS_REMOUNT)
  		retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
  				    data_page);
-@@ -2296,6 +2317,9 @@ long do_mount(const char *dev_name, const char *dir_name,
+@@ -2301,6 +2317,9 @@ long do_mount(const char *dev_name, const char *dir_name,
  				      dev_name, data_page);
  dput_out:
  	path_put(&path);
@@ -50965,16 +50978,7 @@ index 55605c5..f2908c8 100644
  	return retval;
  }
  
-@@ -2567,7 +2591,7 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
- 	struct mount *new_mnt, *root_mnt;
- 	int error;
- 
--	if (!ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN))
-+	if (!may_mount())
- 		return -EPERM;
- 
- 	error = user_path_dir(new_root, &new);
-@@ -2582,6 +2606,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
+@@ -2587,6 +2606,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
  	if (error)
  		goto out2;
  
@@ -50986,7 +50990,7 @@ index 55605c5..f2908c8 100644
  	get_fs_root(current->fs, &root);
  	error = lock_mount(&old);
  	if (error)
-@@ -2785,7 +2814,7 @@ static int mntns_install(struct nsproxy *nsproxy, void *ns)
+@@ -2790,7 +2814,7 @@ static int mntns_install(struct nsproxy *nsproxy, void *ns)
  	    !nsown_capable(CAP_SYS_ADMIN))
  		return -EPERM;
  
@@ -67510,10 +67514,18 @@ index 14a8ff2..21fe4c7 100644
  			 void __user *, size_t *, loff_t *);
  extern int proc_dointvec_minmax(struct ctl_table *, int,
 diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h
-index 7faf933..eb6f5e3 100644
+index 7faf933..c1ad32c 100644
 --- a/include/linux/sysrq.h
 +++ b/include/linux/sysrq.h
-@@ -36,7 +36,7 @@ struct sysrq_key_op {
+@@ -15,6 +15,7 @@
+ #define _LINUX_SYSRQ_H
+ 
+ #include <linux/errno.h>
++#include <linux/compiler.h>
+ #include <linux/types.h>
+ 
+ /* Enable/disable SYSRQ support by default (0==no, 1==yes). */
+@@ -36,7 +37,7 @@ struct sysrq_key_op {
  	char *help_msg;
  	char *action_msg;
  	int enable_mask;
@@ -68218,7 +68230,7 @@ index fdeb85a..0c554d5 100644
  
  /* Structure to track chunk fragments that have been acked, but peer
 diff --git a/include/net/sock.h b/include/net/sock.h
-index 182ca99..b7dc290 100644
+index 25afaa0..8bb0070 100644
 --- a/include/net/sock.h
 +++ b/include/net/sock.h
 @@ -322,7 +322,7 @@ struct sock {
@@ -70501,7 +70513,7 @@ index c535f33..1d768f9 100644
  			else
  				new_fs = fs;
 diff --git a/kernel/futex.c b/kernel/futex.c
-index 19eb089..b8c65ea 100644
+index 8879430..31696f1 100644
 --- a/kernel/futex.c
 +++ b/kernel/futex.c
 @@ -54,6 +54,7 @@
@@ -70524,7 +70536,7 @@ index 19eb089..b8c65ea 100644
  	/*
  	 * The futex address must be "naturally" aligned.
  	 */
-@@ -2733,6 +2739,7 @@ static int __init futex_init(void)
+@@ -2731,6 +2737,7 @@ static int __init futex_init(void)
  {
  	u32 curval;
  	int i;
@@ -70532,7 +70544,7 @@ index 19eb089..b8c65ea 100644
  
  	/*
  	 * This will fail and we want it. Some arch implementations do
-@@ -2744,8 +2751,11 @@ static int __init futex_init(void)
+@@ -2742,8 +2749,11 @@ static int __init futex_init(void)
  	 * implementation, the non-functional ones will return
  	 * -ENOSYS.
  	 */
@@ -70570,7 +70582,7 @@ index 9b22d03..6295b62 100644
  				prev->next = info->next;
  			else
 diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
-index 6db7a5e..0d600bd 100644
+index cdd5607..c3fc919 100644
 --- a/kernel/hrtimer.c
 +++ b/kernel/hrtimer.c
 @@ -1407,7 +1407,7 @@ void hrtimer_peek_ahead_timers(void)
@@ -72054,10 +72066,10 @@ index f2c6a68..4922d97 100644
  {
  	struct pid *pid;
 diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
-index a278cad..bff5bd3 100644
+index 942ca27..111e609 100644
 --- a/kernel/posix-cpu-timers.c
 +++ b/kernel/posix-cpu-timers.c
-@@ -1557,14 +1557,14 @@ struct k_clock clock_posix_cpu = {
+@@ -1576,14 +1576,14 @@ struct k_clock clock_posix_cpu = {
  
  static __init int init_posix_cpu_timers(void)
  {
@@ -73884,7 +73896,7 @@ index c88878d..99d321b 100644
  EXPORT_SYMBOL(proc_doulongvec_minmax);
  EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
 diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
-index 5a63844..25dfc5c 100644
+index 5a63844..a199f50 100644
 --- a/kernel/sysctl_binary.c
 +++ b/kernel/sysctl_binary.c
 @@ -989,7 +989,7 @@ static ssize_t bin_intvec(struct file *file,
@@ -73941,7 +73953,19 @@ index 5a63844..25dfc5c 100644
  		set_fs(old_fs);
  		if (result < 0)
  			goto out;
-@@ -1233,7 +1233,7 @@ static ssize_t bin_dn_node_address(struct file *file,
+@@ -1194,9 +1194,10 @@ static ssize_t bin_dn_node_address(struct file *file,
+ 
+ 		/* Convert the decnet address to binary */
+ 		result = -EIO;
+-		nodep = strchr(buf, '.') + 1;
++		nodep = strchr(buf, '.');
+ 		if (!nodep)
+ 			goto out;
++		++nodep;
+ 
+ 		area = simple_strtoul(buf, NULL, 10);
+ 		node = simple_strtoul(nodep, NULL, 10);
+@@ -1233,7 +1234,7 @@ static ssize_t bin_dn_node_address(struct file *file,
  				le16_to_cpu(dnaddr) & 0x3ff);
  
  		set_fs(KERNEL_DS);
@@ -74931,6 +74955,26 @@ index 5e396ac..58d5de1 100644
  		err_printk(dev, NULL, "DMA-API: device driver maps memory from"
  				"stack [addr=%p]\n", addr);
  }
+diff --git a/lib/idr.c b/lib/idr.c
+index 6482390..ca5aa00 100644
+--- a/lib/idr.c
++++ b/lib/idr.c
+@@ -625,7 +625,14 @@ void *idr_get_next(struct idr *idp, int *nextidp)
+ 			return p;
+ 		}
+ 
+-		id += 1 << n;
++		/*
++		 * Proceed to the next layer at the current level.  Unlike
++		 * idr_for_each(), @id isn't guaranteed to be aligned to
++		 * layer boundary at this point and adding 1 << n may
++		 * incorrectly skip IDs.  Make sure we jump to the
++		 * beginning of the next layer using round_up().
++		 */
++		id = round_up(id + 1, 1 << n);
+ 		while (n < fls(id)) {
+ 			n += IDR_BITS;
+ 			p = *--paa;
 diff --git a/lib/inflate.c b/lib/inflate.c
 index 013a761..c28f3fc 100644
 --- a/lib/inflate.c
@@ -76511,7 +76555,7 @@ index c9bd528..da8d069 100644
  	    capable(CAP_IPC_LOCK))
  		ret = do_mlockall(flags);
 diff --git a/mm/mmap.c b/mm/mmap.c
-index d1e4124..32a6988 100644
+index d1e4124..7d36e4f 100644
 --- a/mm/mmap.c
 +++ b/mm/mmap.c
 @@ -32,6 +32,7 @@
@@ -77257,7 +77301,51 @@ index d1e4124..32a6988 100644
  				spin_unlock(&vma->vm_mm->page_table_lock);
  
  				perf_event_mmap(vma);
-@@ -2236,6 +2544,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2169,9 +2477,28 @@ int expand_downwards(struct vm_area_struct *vma,
+ 	return error;
+ }
+ 
++/*
++ * Note how expand_stack() refuses to expand the stack all the way to
++ * abut the next virtual mapping, *unless* that mapping itself is also
++ * a stack mapping. We want to leave room for a guard page, after all
++ * (the guard page itself is not added here, that is done by the
++ * actual page faulting logic)
++ *
++ * This matches the behavior of the guard page logic (see mm/memory.c:
++ * check_stack_guard_page()), which only allows the guard page to be
++ * removed under these circumstances.
++ */
+ #ifdef CONFIG_STACK_GROWSUP
+ int expand_stack(struct vm_area_struct *vma, unsigned long address)
+ {
++	struct vm_area_struct *next;
++
++	address &= PAGE_MASK;
++	next = vma->vm_next;
++	if (next && next->vm_start == address + PAGE_SIZE) {
++		if (!(next->vm_flags & VM_GROWSUP))
++			return -ENOMEM;
++	}
+ 	return expand_upwards(vma, address);
+ }
+ 
+@@ -2194,6 +2521,14 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
+ #else
+ int expand_stack(struct vm_area_struct *vma, unsigned long address)
+ {
++	struct vm_area_struct *prev;
++
++	address &= PAGE_MASK;
++	prev = vma->vm_prev;
++	if (prev && prev->vm_end == address) {
++		if (!(prev->vm_flags & VM_GROWSDOWN))
++			return -ENOMEM;
++	}
+ 	return expand_downwards(vma, address);
+ }
+ 
+@@ -2236,6 +2571,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
  	do {
  		long nrpages = vma_pages(vma);
  
@@ -77271,7 +77359,7 @@ index d1e4124..32a6988 100644
  		if (vma->vm_flags & VM_ACCOUNT)
  			nr_accounted += nrpages;
  		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
-@@ -2281,6 +2596,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2281,6 +2623,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
  	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
  	vma->vm_prev = NULL;
  	do {
@@ -77288,7 +77376,7 @@ index d1e4124..32a6988 100644
  		vma_rb_erase(vma, &mm->mm_rb);
  		mm->map_count--;
  		tail_vma = vma;
-@@ -2312,14 +2637,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2312,14 +2664,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	struct vm_area_struct *new;
  	int err = -ENOMEM;
  
@@ -77322,7 +77410,7 @@ index d1e4124..32a6988 100644
  	/* most fields are the same, copy all, and then fixup */
  	*new = *vma;
  
-@@ -2332,6 +2676,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2332,6 +2703,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
  	}
  
@@ -77345,7 +77433,7 @@ index d1e4124..32a6988 100644
  	pol = mpol_dup(vma_policy(vma));
  	if (IS_ERR(pol)) {
  		err = PTR_ERR(pol);
-@@ -2354,6 +2714,36 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2354,6 +2741,36 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  	else
  		err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
  
@@ -77382,7 +77470,7 @@ index d1e4124..32a6988 100644
  	/* Success. */
  	if (!err)
  		return 0;
-@@ -2363,10 +2753,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2363,10 +2780,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  		new->vm_ops->close(new);
  	if (new->vm_file)
  		fput(new->vm_file);
@@ -77402,7 +77490,7 @@ index d1e4124..32a6988 100644
  	kmem_cache_free(vm_area_cachep, new);
   out_err:
  	return err;
-@@ -2379,6 +2777,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
+@@ -2379,6 +2804,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
  int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  	      unsigned long addr, int new_below)
  {
@@ -77418,7 +77506,7 @@ index d1e4124..32a6988 100644
  	if (mm->map_count >= sysctl_max_map_count)
  		return -ENOMEM;
  
-@@ -2390,11 +2797,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2390,11 +2824,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
   * work.  This now handles partial unmappings.
   * Jeremy Fitzhardinge <jeremy@××××.org>
   */
@@ -77449,7 +77537,7 @@ index d1e4124..32a6988 100644
  	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
  		return -EINVAL;
  
-@@ -2469,6 +2895,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+@@ -2469,6 +2922,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
  	/* Fix up all other VM information */
  	remove_vma_list(mm, vma);
  
@@ -77458,7 +77546,7 @@ index d1e4124..32a6988 100644
  	return 0;
  }
  
-@@ -2477,6 +2905,13 @@ int vm_munmap(unsigned long start, size_t len)
+@@ -2477,6 +2932,13 @@ int vm_munmap(unsigned long start, size_t len)
  	int ret;
  	struct mm_struct *mm = current->mm;
  
@@ -77472,7 +77560,7 @@ index d1e4124..32a6988 100644
  	down_write(&mm->mmap_sem);
  	ret = do_munmap(mm, start, len);
  	up_write(&mm->mmap_sem);
-@@ -2490,16 +2925,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+@@ -2490,16 +2952,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
  	return vm_munmap(addr, len);
  }
  
@@ -77489,7 +77577,7 @@ index d1e4124..32a6988 100644
  /*
   *  this is really a simplified "do_mmap".  it only handles
   *  anonymous maps.  eventually we may be able to do some
-@@ -2513,6 +2938,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2513,6 +2965,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	struct rb_node ** rb_link, * rb_parent;
  	pgoff_t pgoff = addr >> PAGE_SHIFT;
  	int error;
@@ -77497,7 +77585,7 @@ index d1e4124..32a6988 100644
  
  	len = PAGE_ALIGN(len);
  	if (!len)
-@@ -2520,16 +2946,30 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2520,16 +2973,30 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  
  	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
  
@@ -77529,7 +77617,7 @@ index d1e4124..32a6988 100644
  		locked += mm->locked_vm;
  		lock_limit = rlimit(RLIMIT_MEMLOCK);
  		lock_limit >>= PAGE_SHIFT;
-@@ -2546,21 +2986,20 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2546,21 +3013,20 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	/*
  	 * Clear old maps.  this also does some error checking for us
  	 */
@@ -77554,7 +77642,7 @@ index d1e4124..32a6988 100644
  		return -ENOMEM;
  
  	/* Can we just expand an old private anonymous mapping? */
-@@ -2574,7 +3013,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2574,7 +3040,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	 */
  	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
  	if (!vma) {
@@ -77563,7 +77651,7 @@ index d1e4124..32a6988 100644
  		return -ENOMEM;
  	}
  
-@@ -2588,11 +3027,12 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2588,11 +3054,12 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	vma_link(mm, vma, prev, rb_link, rb_parent);
  out:
  	perf_event_mmap(vma);
@@ -77578,7 +77666,7 @@ index d1e4124..32a6988 100644
  	return addr;
  }
  
-@@ -2650,6 +3090,7 @@ void exit_mmap(struct mm_struct *mm)
+@@ -2650,6 +3117,7 @@ void exit_mmap(struct mm_struct *mm)
  	while (vma) {
  		if (vma->vm_flags & VM_ACCOUNT)
  			nr_accounted += vma_pages(vma);
@@ -77586,7 +77674,7 @@ index d1e4124..32a6988 100644
  		vma = remove_vma(vma);
  	}
  	vm_unacct_memory(nr_accounted);
-@@ -2666,6 +3107,13 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2666,6 +3134,13 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
  	struct vm_area_struct *prev;
  	struct rb_node **rb_link, *rb_parent;
  
@@ -77600,7 +77688,7 @@ index d1e4124..32a6988 100644
  	/*
  	 * The vm_pgoff of a purely anonymous vma should be irrelevant
  	 * until its first write fault, when page's anon_vma and index
-@@ -2689,7 +3137,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2689,7 +3164,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
  	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
  		return -ENOMEM;
  
@@ -77622,7 +77710,7 @@ index d1e4124..32a6988 100644
  	return 0;
  }
  
-@@ -2709,6 +3171,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2709,6 +3198,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	struct mempolicy *pol;
  	bool faulted_in_anon_vma = true;
  
@@ -77631,7 +77719,7 @@ index d1e4124..32a6988 100644
  	/*
  	 * If anonymous vma has not yet been faulted, update new pgoff
  	 * to match new location, to increase its chance of merging.
-@@ -2775,6 +3239,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2775,6 +3266,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	return NULL;
  }
  
@@ -77671,7 +77759,7 @@ index d1e4124..32a6988 100644
  /*
   * Return true if the calling process may expand its vm space by the passed
   * number of pages
-@@ -2786,6 +3283,12 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+@@ -2786,6 +3310,12 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
  
  	lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
  
@@ -77684,7 +77772,7 @@ index d1e4124..32a6988 100644
  	if (cur + npages > lim)
  		return 0;
  	return 1;
-@@ -2856,6 +3359,22 @@ int install_special_mapping(struct mm_struct *mm,
+@@ -2856,6 +3386,22 @@ int install_special_mapping(struct mm_struct *mm,
  	vma->vm_start = addr;
  	vma->vm_end = addr + len;
  
@@ -77707,136 +77795,6 @@ index d1e4124..32a6988 100644
  	vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
  	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
  
-diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c
-index 8a5ac8c..f5c3d96 100644
---- a/mm/mmu_notifier.c
-+++ b/mm/mmu_notifier.c
-@@ -37,49 +37,51 @@ static struct srcu_struct srcu;
- void __mmu_notifier_release(struct mm_struct *mm)
- {
- 	struct mmu_notifier *mn;
--	struct hlist_node *n;
- 	int id;
- 
- 	/*
--	 * SRCU here will block mmu_notifier_unregister until
--	 * ->release returns.
-+	 * srcu_read_lock() here will block synchronize_srcu() in
-+	 * mmu_notifier_unregister() until all registered
-+	 * ->release() callouts this function makes have
-+	 * returned.
- 	 */
- 	id = srcu_read_lock(&srcu);
--	hlist_for_each_entry_rcu(mn, n, &mm->mmu_notifier_mm->list, hlist)
--		/*
--		 * if ->release runs before mmu_notifier_unregister it
--		 * must be handled as it's the only way for the driver
--		 * to flush all existing sptes and stop the driver
--		 * from establishing any more sptes before all the
--		 * pages in the mm are freed.
--		 */
--		if (mn->ops->release)
--			mn->ops->release(mn, mm);
--	srcu_read_unlock(&srcu, id);
--
- 	spin_lock(&mm->mmu_notifier_mm->lock);
- 	while (unlikely(!hlist_empty(&mm->mmu_notifier_mm->list))) {
- 		mn = hlist_entry(mm->mmu_notifier_mm->list.first,
- 				 struct mmu_notifier,
- 				 hlist);
-+
- 		/*
--		 * We arrived before mmu_notifier_unregister so
--		 * mmu_notifier_unregister will do nothing other than
--		 * to wait ->release to finish and
--		 * mmu_notifier_unregister to return.
-+		 * Unlink.  This will prevent mmu_notifier_unregister()
-+		 * from also making the ->release() callout.
- 		 */
- 		hlist_del_init_rcu(&mn->hlist);
-+		spin_unlock(&mm->mmu_notifier_mm->lock);
-+
-+		/*
-+		 * Clear sptes. (see 'release' description in mmu_notifier.h)
-+		 */
-+		if (mn->ops->release)
-+			mn->ops->release(mn, mm);
-+
-+		spin_lock(&mm->mmu_notifier_mm->lock);
- 	}
- 	spin_unlock(&mm->mmu_notifier_mm->lock);
- 
- 	/*
--	 * synchronize_srcu here prevents mmu_notifier_release to
--	 * return to exit_mmap (which would proceed freeing all pages
--	 * in the mm) until the ->release method returns, if it was
--	 * invoked by mmu_notifier_unregister.
--	 *
--	 * The mmu_notifier_mm can't go away from under us because one
--	 * mm_count is hold by exit_mmap.
-+	 * All callouts to ->release() which we have done are complete.
-+	 * Allow synchronize_srcu() in mmu_notifier_unregister() to complete
-+	 */
-+	srcu_read_unlock(&srcu, id);
-+
-+	/*
-+	 * mmu_notifier_unregister() may have unlinked a notifier and may
-+	 * still be calling out to it.	Additionally, other notifiers
-+	 * may have been active via vmtruncate() et. al. Block here
-+	 * to ensure that all notifier callouts for this mm have been
-+	 * completed and the sptes are really cleaned up before returning
-+	 * to exit_mmap().
- 	 */
- 	synchronize_srcu(&srcu);
- }
-@@ -294,31 +296,31 @@ void mmu_notifier_unregister(struct mmu_notifier *mn, struct mm_struct *mm)
- {
- 	BUG_ON(atomic_read(&mm->mm_count) <= 0);
- 
-+	spin_lock(&mm->mmu_notifier_mm->lock);
- 	if (!hlist_unhashed(&mn->hlist)) {
--		/*
--		 * SRCU here will force exit_mmap to wait ->release to finish
--		 * before freeing the pages.
--		 */
- 		int id;
- 
-+		/*
-+		 * Ensure we synchronize up with __mmu_notifier_release().
-+		 */
- 		id = srcu_read_lock(&srcu);
--		/*
--		 * exit_mmap will block in mmu_notifier_release to
--		 * guarantee ->release is called before freeing the
--		 * pages.
--		 */
--		if (mn->ops->release)
--			mn->ops->release(mn, mm);
--		srcu_read_unlock(&srcu, id);
- 
--		spin_lock(&mm->mmu_notifier_mm->lock);
- 		hlist_del_rcu(&mn->hlist);
- 		spin_unlock(&mm->mmu_notifier_mm->lock);
--	}
-+
-+		if (mn->ops->release)
-+			mn->ops->release(mn, mm);
-+
-+		/*
-+		 * Allow __mmu_notifier_release() to complete.
-+		 */
-+		srcu_read_unlock(&srcu, id);
-+	} else
-+		spin_unlock(&mm->mmu_notifier_mm->lock);
- 
- 	/*
--	 * Wait any running method to finish, of course including
--	 * ->release if it was run by mmu_notifier_relase instead of us.
-+	 * Wait for any running method to finish, including ->release() if it
-+	 * was run by __mmu_notifier_release() instead of us.
- 	 */
- 	synchronize_srcu(&srcu);
- 
 diff --git a/mm/mprotect.c b/mm/mprotect.c
 index 94722a4..9837984 100644
 --- a/mm/mprotect.c
@@ -78441,7 +78399,7 @@ index 2c78f8c..9e9c624 100644
  	struct anon_vma_chain *avc;
  	struct anon_vma *anon_vma;
 diff --git a/mm/shmem.c b/mm/shmem.c
-index 5dd56f6..994b702 100644
+index efd0b3a..994b702 100644
 --- a/mm/shmem.c
 +++ b/mm/shmem.c
 @@ -31,7 +31,7 @@
@@ -78490,31 +78448,7 @@ index 5dd56f6..994b702 100644
  	return simple_xattr_set(&info->xattrs, name, value, size, flags);
  }
  
-@@ -2487,6 +2501,7 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data)
- 	unsigned long inodes;
- 	int error = -EINVAL;
- 
-+	config.mpol = NULL;
- 	if (shmem_parse_options(data, &config, true))
- 		return error;
- 
-@@ -2511,8 +2526,13 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data)
- 	sbinfo->max_inodes  = config.max_inodes;
- 	sbinfo->free_inodes = config.max_inodes - inodes;
- 
--	mpol_put(sbinfo->mpol);
--	sbinfo->mpol        = config.mpol;	/* transfers initial ref */
-+	/*
-+	 * Preserve previous mempolicy unless mpol remount option was specified.
-+	 */
-+	if (config.mpol) {
-+		mpol_put(sbinfo->mpol);
-+		sbinfo->mpol = config.mpol;	/* transfers initial ref */
-+	}
- out:
- 	spin_unlock(&sbinfo->stat_lock);
- 	return error;
-@@ -2556,8 +2576,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
+@@ -2562,8 +2576,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
  	int err = -ENOMEM;
  
  	/* Round up to L1_CACHE_BYTES to resist false sharing */
@@ -80788,7 +80722,7 @@ index bc131d4..029e378 100644
  EXPORT_SYMBOL(sock_init_data);
  
 diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
-index 602cd63..0a699b1 100644
+index 750f44f..0a699b1 100644
 --- a/net/core/sock_diag.c
 +++ b/net/core/sock_diag.c
 @@ -15,20 +15,27 @@ static DEFINE_MUTEX(sock_diag_table_mutex);
@@ -80841,14 +80775,11 @@ index 602cd63..0a699b1 100644
  static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
  {
  	int err;
-@@ -121,12 +113,20 @@ static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
- 	if (nlmsg_len(nlh) < sizeof(*req))
+@@ -124,12 +116,17 @@ static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 	if (req->sdiag_family >= AF_MAX)
  		return -EINVAL;
  
 -	hndl = sock_diag_lock_handler(req->sdiag_family);
-+	if (req->sdiag_family >= AF_MAX)
-+		return -EINVAL;
-+
 +	if (sock_diag_handlers[req->sdiag_family] == NULL)
 +		request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
 +				NETLINK_SOCK_DIAG, req->sdiag_family);
@@ -81176,7 +81107,7 @@ index 17c5e06..1b91206 100644
  
  	case IPT_SO_GET_ENTRIES:
 diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
-index 6f9c072..38ea6c6 100644
+index dc454cc..5bb917f 100644
 --- a/net/ipv4/ping.c
 +++ b/net/ipv4/ping.c
 @@ -844,7 +844,7 @@ static void ping_format_sock(struct sock *sp, struct seq_file *f,
@@ -85360,19 +85291,6 @@ index 6ece7f2..ecdb55c 100644
  					goto error;
  
  				buflen -= tmp;
-diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
-index 20e4bf5..58dfe08 100644
---- a/security/keys/process_keys.c
-+++ b/security/keys/process_keys.c
-@@ -367,6 +367,8 @@ key_ref_t search_my_process_keyrings(struct key_type *type,
- 
- 		switch (PTR_ERR(key_ref)) {
- 		case -EAGAIN: /* no key */
-+			if (ret)
-+				break;
- 		case -ENOKEY: /* negative key */
- 			ret = key_ref;
- 			break;
 diff --git a/security/min_addr.c b/security/min_addr.c
 index f728728..6457a0c 100644
 --- a/security/min_addr.c

diff --git a/3.8.0/4425_grsec_remove_EI_PAX.patch b/3.8.1/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 3.8.0/4425_grsec_remove_EI_PAX.patch
rename to 3.8.1/4425_grsec_remove_EI_PAX.patch

diff --git a/3.8.0/4430_grsec-remove-localversion-grsec.patch b/3.8.1/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 3.8.0/4430_grsec-remove-localversion-grsec.patch
rename to 3.8.1/4430_grsec-remove-localversion-grsec.patch

diff --git a/3.8.0/4435_grsec-mute-warnings.patch b/3.8.1/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 3.8.0/4435_grsec-mute-warnings.patch
rename to 3.8.1/4435_grsec-mute-warnings.patch

diff --git a/3.8.0/4440_grsec-remove-protected-paths.patch b/3.8.1/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 3.8.0/4440_grsec-remove-protected-paths.patch
rename to 3.8.1/4440_grsec-remove-protected-paths.patch

diff --git a/3.8.0/4450_grsec-kconfig-default-gids.patch b/3.8.1/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 3.8.0/4450_grsec-kconfig-default-gids.patch
rename to 3.8.1/4450_grsec-kconfig-default-gids.patch

diff --git a/3.8.0/4465_selinux-avc_audit-log-curr_ip.patch b/3.8.1/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 3.8.0/4465_selinux-avc_audit-log-curr_ip.patch
rename to 3.8.1/4465_selinux-avc_audit-log-curr_ip.patch

diff --git a/3.8.0/4470_disable-compat_vdso.patch b/3.8.1/4470_disable-compat_vdso.patch
similarity index 100%
rename from 3.8.0/4470_disable-compat_vdso.patch
rename to 3.8.1/4470_disable-compat_vdso.patch