[gentoo-commits] proj/hardened-patchset:master commit in: 2.6.32/, 3.3.7/, 3.2.18/

[Anthony G. Basile]

commit:     c45578be354c1ce6ae67b344e406fa59856eacec
Author:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Sat Jun  2 15:10:38 2012 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Sat Jun  2 15:10:38 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=c45578be

Grsec/PaX: 2.9-{2.6.32.59,3.2.18,3.3.7}-201206011935

---
 2.6.32/0000_README                                 |    2 +-
 ...20_grsecurity-2.9-2.6.32.59-201206011934.patch} |  277 ++++++++--------
 3.2.18/0000_README                                 |    2 +-
 ... 4420_grsecurity-2.9-3.2.18-201206011935.patch} |  357 +++++++++++---------
 3.3.7/0000_README                                  |    2 +-
 ...> 4420_grsecurity-2.9-3.3.7-201206011935.patch} |  344 ++++++++++---------
 6 files changed, 519 insertions(+), 465 deletions(-)

diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 6bb8c69..4b5c6dc 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -30,7 +30,7 @@ Patch:	1058_linux-2.6.32.59.patch
 From:	http://www.kernel.org
 Desc:	Linux 2.6.32.59
 
-Patch:	4420_grsecurity-2.9-2.6.32.59-201205271952.patch
+Patch:	4420_grsecurity-2.9-2.6.32.59-201206011934.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/2.6.32/4420_grsecurity-2.9-2.6.32.59-201205271952.patch b/2.6.32/4420_grsecurity-2.9-2.6.32.59-201206011934.patch
similarity index 99%
rename from 2.6.32/4420_grsecurity-2.9-2.6.32.59-201205271952.patch
rename to 2.6.32/4420_grsecurity-2.9-2.6.32.59-201206011934.patch
index dc0f735..d2b4115 100644
--- a/2.6.32/4420_grsecurity-2.9-2.6.32.59-201205271952.patch
+++ b/2.6.32/4420_grsecurity-2.9-2.6.32.59-201206011934.patch
@@ -213,7 +213,7 @@ index 613da5d..4fe3eda 100644
  M:	Liam Girdwood <lrg@××××××××××××.uk>
  M:	Mark Brown <broonie@×××××××××××××××××××××××.com>
 diff --git a/Makefile b/Makefile
-index 3a9a721..563f9e9 100644
+index 3a9a721..683dc09 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -221,8 +221,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -228,20 +228,7 @@ index 3a9a721..563f9e9 100644
  
  # Decide whether to build built-in, modular, or both.
  # Normally, just do built-in.
-@@ -334,9 +335,10 @@ CFLAGS_GCOV	= -fprofile-arcs -ftest-coverage
- 
- # Use LINUXINCLUDE when you must reference the include/ directory.
- # Needed to be compatible with the O= option
--LINUXINCLUDE    := -Iinclude \
-+LINUXINCLUDE    := -isystem include \
-                    $(if $(KBUILD_SRC),-Iinclude2 -I$(srctree)/include) \
--                   -I$(srctree)/arch/$(hdr-arch)/include               \
-+                   -isystem arch/$(hdr-arch)/include               \
-+                   -isystem include/generated \
-                    -include include/linux/autoconf.h
- 
- KBUILD_CPPFLAGS := -D__KERNEL__
-@@ -376,8 +378,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn --exc
+@@ -376,8 +377,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn --exc
  # Rules shared between *config targets and build targets
  
  # Basic helpers built in scripts/
@@ -252,32 +239,16 @@ index 3a9a721..563f9e9 100644
  	$(Q)$(MAKE) $(build)=scripts/basic
  
  # To avoid any implicit rule to kick in, define an empty command.
-@@ -403,8 +405,8 @@ endif
+@@ -403,7 +404,7 @@ endif
  # of make so .config is not included in this case either (for *config).
  
  no-dot-config-targets := clean mrproper distclean \
 -			 cscope TAGS tags help %docs check% \
--			 include/linux/version.h headers_% \
 +			 cscope gtags TAGS tags help %docs check% \
-+			 include/generated/linux/version.h headers_% \
+ 			 include/linux/version.h headers_% \
  			 kernelrelease kernelversion
  
- config-targets := 0
-@@ -447,11 +449,11 @@ include $(srctree)/arch/$(SRCARCH)/Makefile
- export KBUILD_DEFCONFIG KBUILD_KCONFIG
- 
- config: scripts_basic outputmakefile FORCE
--	$(Q)mkdir -p include/linux include/config
-+	$(Q)mkdir -p include/generated/linux include/config
- 	$(Q)$(MAKE) $(build)=scripts/kconfig $@
- 
- %config: scripts_basic outputmakefile FORCE
--	$(Q)mkdir -p include/linux include/config
-+	$(Q)mkdir -p include/generated/linux include/config
- 	$(Q)$(MAKE) $(build)=scripts/kconfig $@
- 
- else
-@@ -526,6 +528,55 @@ else
+@@ -526,6 +527,55 @@ else
  KBUILD_CFLAGS	+= -O2
  endif
  
@@ -333,7 +304,7 @@ index 3a9a721..563f9e9 100644
  include $(srctree)/arch/$(SRCARCH)/Makefile
  
  ifneq ($(CONFIG_FRAME_WARN),0)
-@@ -647,7 +698,7 @@ export mod_strip_cmd
+@@ -647,7 +697,7 @@ export mod_strip_cmd
  
  
  ifeq ($(KBUILD_EXTMOD),)
@@ -342,7 +313,7 @@ index 3a9a721..563f9e9 100644
  
  vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
  		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-@@ -868,6 +919,8 @@ vmlinux.o: $(modpost-init) $(vmlinux-main) FORCE
+@@ -868,6 +918,8 @@ vmlinux.o: $(modpost-init) $(vmlinux-main) FORCE
  
  # The actual objects are generated when descending, 
  # make sure no implicit rule kicks in
@@ -351,7 +322,7 @@ index 3a9a721..563f9e9 100644
  $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
  
  # Handle descending into subdirectories listed in $(vmlinux-dirs)
-@@ -877,7 +930,7 @@ $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
+@@ -877,7 +929,7 @@ $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
  # Error messages still appears in the original language
  
  PHONY += $(vmlinux-dirs)
@@ -360,23 +331,7 @@ index 3a9a721..563f9e9 100644
  	$(Q)$(MAKE) $(build)=$@
  
  # Build the kernel release string
-@@ -970,12 +1023,14 @@ ifneq ($(KBUILD_SRC),)
- 	    mkdir -p include2;                                          \
- 	    ln -fsn $(srctree)/include/asm-$(SRCARCH) include2/asm;     \
- 	fi
-+	$(Q)for dir in $(srctree)/include/* ; do ln -fsn $$dir include/`basename $$dir` ; done
-+	$(Q)ln -fsn $(srctree)/arch/$(SRCARCH)/include/asm arch/$(SRCARCH)/include;
- endif
- 
- # prepare2 creates a makefile if using a separate output directory
- prepare2: prepare3 outputmakefile
- 
--prepare1: prepare2 include/linux/version.h include/linux/utsrelease.h \
-+prepare1: prepare2 include/generated/linux/version.h include/linux/utsrelease.h \
-                    include/asm include/config/auto.conf
- 	$(cmd_crmodverdir)
- 
-@@ -986,6 +1041,7 @@ prepare0: archprepare FORCE
+@@ -986,6 +1038,7 @@ prepare0: archprepare FORCE
  	$(Q)$(MAKE) $(build)=. missing-syscalls
  
  # All the preparing..
@@ -384,25 +339,7 @@ index 3a9a721..563f9e9 100644
  prepare: prepare0
  
  # The asm symlink changes when $(ARCH) changes.
-@@ -1045,7 +1101,7 @@ define filechk_version.h
- 	echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))';)
- endef
- 
--include/linux/version.h: $(srctree)/Makefile FORCE
-+include/generated/linux/version.h: $(srctree)/Makefile FORCE
- 	$(call filechk,version.h)
- 
- include/linux/utsrelease.h: include/config/kernel.release FORCE
-@@ -1088,7 +1144,7 @@ hdr-dir = $(strip                                                         \
- hdr-dst = $(if $(KBUILD_HEADERS), dst=include/asm-$(hdr-arch), dst=include/asm)
- 
- PHONY += __headers
--__headers: include/linux/version.h scripts_basic FORCE
-+__headers: include/generated/linux/version.h scripts_basic FORCE
- 	$(Q)$(MAKE) $(build)=scripts scripts/unifdef
- 
- PHONY += headers_install_all
-@@ -1127,6 +1183,8 @@ all: modules
+@@ -1127,6 +1180,8 @@ all: modules
  #	using awk while concatenating to the final file.
  
  PHONY += modules
@@ -411,7 +348,7 @@ index 3a9a721..563f9e9 100644
  modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux)
  	$(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
  	@$(kecho) '  Building modules, stage 2.';
-@@ -1136,7 +1194,7 @@ modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux)
+@@ -1136,7 +1191,7 @@ modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux)
  
  # Target to prepare building external modules
  PHONY += modules_prepare
@@ -420,12 +357,8 @@ index 3a9a721..563f9e9 100644
  
  # Target to install modules
  PHONY += modules_install
-@@ -1198,10 +1256,10 @@ CLEAN_FILES +=	vmlinux System.map \
- # Directories & files removed with 'make mrproper'
- MRPROPER_DIRS  += include/config include2 usr/include include/generated
- MRPROPER_FILES += .config .config.old include/asm .version .old_version \
--                  include/linux/autoconf.h include/linux/version.h      \
-+                  include/linux/autoconf.h include/generated/linux/version.h      \
+@@ -1201,7 +1256,7 @@ MRPROPER_FILES += .config .config.old include/asm .version .old_version \
+                   include/linux/autoconf.h include/linux/version.h      \
                    include/linux/utsrelease.h                            \
                    include/linux/bounds.h include/asm*/asm-offsets.h     \
 -		  Module.symvers Module.markers tags TAGS cscope*
@@ -433,7 +366,7 @@ index 3a9a721..563f9e9 100644
  
  # clean - Delete most, but leave enough to build external modules
  #
-@@ -1245,7 +1303,7 @@ distclean: mrproper
+@@ -1245,7 +1300,7 @@ distclean: mrproper
  	@find $(srctree) $(RCS_FIND_IGNORE) \
  		\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
  		-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
@@ -442,7 +375,7 @@ index 3a9a721..563f9e9 100644
  		-o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
  		-type f -print | xargs rm -f
  
-@@ -1292,6 +1350,7 @@ help:
+@@ -1292,6 +1347,7 @@ help:
  	@echo  '  modules_prepare - Set up for building external modules'
  	@echo  '  tags/TAGS	  - Generate tags file for editors'
  	@echo  '  cscope	  - Generate cscope index'
@@ -450,7 +383,7 @@ index 3a9a721..563f9e9 100644
  	@echo  '  kernelrelease	  - Output the release version string'
  	@echo  '  kernelversion	  - Output the version stored in Makefile'
  	@echo  '  headers_install - Install sanitised kernel headers to INSTALL_HDR_PATH'; \
-@@ -1393,6 +1452,8 @@ PHONY += $(module-dirs) modules
+@@ -1393,6 +1449,8 @@ PHONY += $(module-dirs) modules
  $(module-dirs): crmodverdir $(objtree)/Module.symvers
  	$(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
  
@@ -459,7 +392,7 @@ index 3a9a721..563f9e9 100644
  modules: $(module-dirs)
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1448,7 +1509,7 @@ endif # KBUILD_EXTMOD
+@@ -1448,7 +1506,7 @@ endif # KBUILD_EXTMOD
  quiet_cmd_tags = GEN     $@
        cmd_tags = $(CONFIG_SHELL) $(srctree)/scripts/tags.sh $@
  
@@ -468,7 +401,7 @@ index 3a9a721..563f9e9 100644
  	$(call cmd,tags)
  
  # Scripts to check various things for consistency
-@@ -1513,17 +1574,21 @@ else
+@@ -1513,17 +1571,21 @@ else
          target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
  endif
  
@@ -494,7 +427,7 @@ index 3a9a721..563f9e9 100644
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
  %.symtypes: %.c prepare scripts FORCE
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1533,11 +1598,15 @@ endif
+@@ -1533,11 +1595,15 @@ endif
  	$(cmd_crmodverdir)
  	$(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
  	$(build)=$(build-dir)
@@ -26865,7 +26798,7 @@ index f46c3407..f7e72b0 100644
  	}
  	if (mm->get_unmapped_area == arch_get_unmapped_area)
 diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index 73ffd55..10ae23f 100644
+index 73ffd55..e2f0e1d 100644
 --- a/arch/x86/mm/init.c
 +++ b/arch/x86/mm/init.c
 @@ -13,6 +13,7 @@
@@ -26931,7 +26864,7 @@ index 73ffd55..10ae23f 100644
  	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
  		return 0;
  	if (!page_is_ram(pagenr))
-@@ -377,8 +396,116 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
+@@ -377,8 +396,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
  #endif
  }
  
@@ -26948,7 +26881,7 @@ index 73ffd55..10ae23f 100644
 +	}
 +	if (ebda_addr && ebda_size) {
 +		ebda_start = ebda_addr >> PAGE_SHIFT;
-+		ebda_end = min(PAGE_ALIGN(ebda_addr + ebda_size), 0xa0000) >> PAGE_SHIFT;
++		ebda_end = min((unsigned int)PAGE_ALIGN(ebda_addr + ebda_size), (unsigned int)0xa0000) >> PAGE_SHIFT;
 +	} else {
 +		ebda_start = 0x9f000 >> PAGE_SHIFT;
 +		ebda_end = 0xa0000 >> PAGE_SHIFT;
@@ -26968,6 +26901,12 @@ index 73ffd55..10ae23f 100644
 +	int cpu;
 +#endif
 +#endif
++#ifndef CONFIG_X86_PAE
++	pgd_t *pgd;
++	pud_t *pud;
++	pmd_t *pmd;
++	unsigned long addr, end;
++#endif
 +
 +	gr_init_ebda();
 +
@@ -27011,11 +26950,6 @@ index 73ffd55..10ae23f 100644
 +#endif
 +
 +#else
-+	pgd_t *pgd;
-+	pud_t *pud;
-+	pmd_t *pmd;
-+	unsigned long addr, end;
-+
 +	/* PaX: make kernel code/rodata read-only, rest non-executable */
 +	for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
 +		pgd = pgd_offset_k(addr);
@@ -32606,6 +32540,25 @@ index 989429c..2272b00 100644
  	.name		= memory_uevent_name,
  	.uevent		= memory_uevent,
  };
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 1fe5536..6c2ca13 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -390,11 +390,9 @@ static ssize_t print_nodes_state(enum node_states state, char *buf)
+ {
+ 	int n;
+ 
+-	n = nodelist_scnprintf(buf, PAGE_SIZE, node_states[state]);
+-	if (n > 0 && PAGE_SIZE > n + 1) {
+-		*(buf + n++) = '\n';
+-		*(buf + n++) = '\0';
+-	}
++	n = nodelist_scnprintf(buf, PAGE_SIZE-2, node_states[state]);
++	buf[n++] = '\n';
++	buf[n] = '\0';
+ 	return n;
+ }
+ 
 diff --git a/drivers/base/sys.c b/drivers/base/sys.c
 index 3f202f7..61c4a6f 100644
 --- a/drivers/base/sys.c
@@ -91654,7 +91607,7 @@ index 0f8fae3..66af9b1 100644
  		get_task_struct(p);
  		read_unlock(&tasklist_lock);
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 4bde56f..8976a8f 100644
+index 4bde56f..8f14dad 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -253,7 +253,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
@@ -91677,6 +91630,15 @@ index 4bde56f..8976a8f 100644
  	mm->map_count = 0;
  	cpumask_clear(mm_cpumask(mm));
  	mm->mm_rb = RB_ROOT;
+@@ -318,7 +318,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+ 		}
+ 		charge = 0;
+ 		if (mpnt->vm_flags & VM_ACCOUNT) {
+-			unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
++			unsigned long len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
+ 			if (security_vm_enough_memory(len))
+ 				goto fail_nomem;
+ 			charge = len;
 @@ -335,6 +335,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
  		tmp->vm_flags &= ~VM_LOCKED;
  		tmp->vm_mm = mm;
@@ -96277,7 +96239,7 @@ index 9c1e627..5ca9447 100644
  	set_page_address(page, (void *)vaddr);
  
 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 5e1e508..f6cc035 100644
+index 5e1e508..bd43b5e 100644
 --- a/mm/hugetlb.c
 +++ b/mm/hugetlb.c
 @@ -1694,6 +1694,15 @@ static void hugetlb_vm_op_open(struct vm_area_struct *vma)
@@ -96414,12 +96376,13 @@ index 5e1e508..f6cc035 100644
  	}
  
  	/*
-@@ -2423,6 +2487,9 @@ int hugetlb_reserve_pages(struct inode *inode,
+@@ -2423,6 +2487,10 @@ int hugetlb_reserve_pages(struct inode *inode,
  	if (!vma || vma->vm_flags & VM_MAYSHARE)
  		region_add(&inode->i_mapping->private_list, from, to);
  	return 0;
 +out_err:
-+	resv_map_put(vma);
++	if (vma)
++		resv_map_put(vma);
 +	return ret;
  }
  
@@ -100145,7 +100108,7 @@ index e48b493..24a601d 100644
  	mm->unmap_area = arch_unmap_area;
  }
 diff --git a/mm/vmalloc.c b/mm/vmalloc.c
-index f34ffd0..1a7ff39 100644
+index f34ffd0..6a3753d 100644
 --- a/mm/vmalloc.c
 +++ b/mm/vmalloc.c
 @@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
@@ -100375,6 +100338,17 @@ index f34ffd0..1a7ff39 100644
  	if ((PAGE_SIZE-1) & (unsigned long)addr)
  		return -EINVAL;
  
+@@ -2250,8 +2323,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
+ 		return NULL;
+ 	}
+ 
+-	vms = kzalloc(sizeof(vms[0]) * nr_vms, gfp_mask);
+-	vas = kzalloc(sizeof(vas[0]) * nr_vms, gfp_mask);
++	vms = kcalloc(nr_vms, sizeof(vms[0]), gfp_mask);
++	vas = kcalloc(nr_vms, sizeof(vas[0]), gfp_mask);
+ 	if (!vas || !vms)
+ 		goto err_free;
+ 
 diff --git a/mm/vmstat.c b/mm/vmstat.c
 index 42d76c6..5643dc4 100644
 --- a/mm/vmstat.c
@@ -101448,6 +101422,19 @@ index f095659..537313b 100644
  	if (get_user(len, optlen))
  		return -EFAULT;
  
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index ce1ce82..8825bcd 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -5632,6 +5632,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+ 			goto discard;
+ 
+ 		if (th->syn) {
++			if (th->fin)
++				goto discard;
+ 			if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
+ 				return 1;
+ 
 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
 index 6fc7961..33bad4a 100644
 --- a/net/ipv4/tcp_ipv4.c
@@ -104255,29 +104242,6 @@ index 1ac414f..a1c1451 100644
  # Remove .so files from "xxx-objs"
  host-cobjs	:= $(filter-out %.so,$(host-cobjs))
  
-diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
-index ffdafb2..4a55d60 100644
---- a/scripts/Makefile.lib
-+++ b/scripts/Makefile.lib
-@@ -145,15 +145,15 @@ __a_flags	=                          $(call flags,_a_flags)
- __cpp_flags     =                          $(call flags,_cpp_flags)
- endif
- 
--c_flags        = -Wp,-MD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
-+c_flags        = -Wp,-MD,$(depfile) $(LINUXINCLUDE) $(NOSTDINC_FLAGS)     \
- 		 $(__c_flags) $(modkern_cflags)                           \
- 		 -D"KBUILD_STR(s)=\#s" $(basename_flags) $(modname_flags) \
- 		  $(debug_flags)
- 
--a_flags        = -Wp,-MD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
-+a_flags        = -Wp,-MD,$(depfile) $(LINUXINCLUDE) $(NOSTDINC_FLAGS)     \
- 		 $(__a_flags) $(modkern_aflags)
- 
--cpp_flags      = -Wp,-MD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
-+cpp_flags      = -Wp,-MD,$(depfile) $(LINUXINCLUDE) $(NOSTDINC_FLAGS)     \
- 		 $(__cpp_flags)
- 
- ld_flags       = $(LDFLAGS) $(ldflags-y)
 diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
 index 6bf21f8..c0546b3 100644
 --- a/scripts/basic/fixdep.c
@@ -106885,10 +106849,10 @@ index 0000000..ee950d0
 +}
 diff --git a/tools/gcc/constify_plugin.c b/tools/gcc/constify_plugin.c
 new file mode 100644
-index 0000000..88a7438
+index 0000000..89b7f56
 --- /dev/null
 +++ b/tools/gcc/constify_plugin.c
-@@ -0,0 +1,303 @@
+@@ -0,0 +1,328 @@
 +/*
 + * Copyright 2011 by Emese Revfy <re.emese@×××××.com>
 + * Copyright 2011 by PaX Team <pageexec@××××××××.hu>
@@ -106929,24 +106893,47 @@ index 0000000..88a7438
 +int plugin_is_GPL_compatible;
 +
 +static struct plugin_info const_plugin_info = {
-+	.version	= "201111150100",
++	.version	= "201205300030",
 +	.help		= "no-constify\tturn off constification\n",
 +};
 +
-+static void constify_type(tree type);
-+static bool walk_struct(tree node);
++static void deconstify_tree(tree node);
++
++static void deconstify_type(tree type)
++{
++	tree field;
++
++	for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
++		tree type = TREE_TYPE(field);
++
++		if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
++			continue;
++		if (!TYPE_READONLY(type))
++			continue;
++
++		deconstify_tree(field);
++	}
++	TYPE_READONLY(type) = 0;
++	C_TYPE_FIELDS_READONLY(type) = 0;
++}
 +
-+static tree deconstify_type(tree old_type)
++static void deconstify_tree(tree node)
 +{
-+	tree new_type, field;
++	tree old_type, new_type, field;
++
++	old_type = TREE_TYPE(node);
++
++	gcc_assert(TYPE_READONLY(old_type) && (TYPE_QUALS(old_type) & TYPE_QUAL_CONST));
 +
 +	new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
 +	TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
 +	for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
 +		DECL_FIELD_CONTEXT(field) = new_type;
-+	TYPE_READONLY(new_type) = 0;
-+	C_TYPE_FIELDS_READONLY(new_type) = 0;
-+	return new_type;
++
++	deconstify_type(new_type);
++
++	TREE_READONLY(node) = 0;
++	TREE_TYPE(node) = new_type;
 +}
 +
 +static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
@@ -106990,14 +106977,19 @@ index 0000000..88a7438
 +	}
 +
 +	if (TREE_CODE(*node) == TYPE_DECL) {
-+		TREE_TYPE(*node) = deconstify_type(type);
-+		TREE_READONLY(*node) = 0;
++		deconstify_tree(*node);
 +		return NULL_TREE;
 +	}
 +
 +	return NULL_TREE;
 +}
 +
++static void constify_type(tree type)
++{
++	TYPE_READONLY(type) = 1;
++	C_TYPE_FIELDS_READONLY(type) = 1;
++}
++
 +static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
 +{
 +	*no_add_attrs = true;
@@ -107048,12 +107040,6 @@ index 0000000..88a7438
 +	register_attribute(&do_const_attr);
 +}
 +
-+static void constify_type(tree type)
-+{
-+	TYPE_READONLY(type) = 1;
-+	C_TYPE_FIELDS_READONLY(type) = 1;
-+}
-+
 +static bool is_fptr(tree field)
 +{
 +	tree ptr = TREE_TYPE(field);
@@ -107068,11 +107054,14 @@ index 0000000..88a7438
 +{
 +	tree field;
 +
-+	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node)))
++	if (TYPE_FIELDS(node) == NULL_TREE)
 +		return false;
 +
-+	if (TYPE_FIELDS(node) == NULL_TREE)
++	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node))) {
++		gcc_assert(!TYPE_READONLY(node));
++		deconstify_type(node);
 +		return false;
++	}
 +
 +	for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
 +		tree type = TREE_TYPE(field);
@@ -118457,7 +118446,7 @@ index 0000000..6e18418
 +};
 diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
 new file mode 100644
-index 0000000..b378515
+index 0000000..555bf8d
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin.c
 @@ -0,0 +1,1185 @@
@@ -118680,7 +118669,7 @@ index 0000000..b378515
 +	const char *curfunc = NAME(func);
 +
 +	new_hash = get_hash_num(curfunc, filename, 0);
-+	inform(loc, "Function %s is missing from the size_overflow hash table +%s+%d+%u+%s+", curfunc, curfunc, argnum, new_hash, filename);
++//	inform(loc, "Function %s is missing from the size_overflow hash table +%s+%d+%u+%s+", curfunc, curfunc, argnum, new_hash, filename);
 +}
 +
 +static void check_missing_attribute(tree arg)

diff --git a/3.2.18/0000_README b/3.2.18/0000_README
index 54c0168..9daad3a 100644
--- a/3.2.18/0000_README
+++ b/3.2.18/0000_README
@@ -10,7 +10,7 @@ Patch:	1017_linux-3.2.18.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.18
 
-Patch:	4420_grsecurity-2.9-3.2.18-201205271952.patch
+Patch:	4420_grsecurity-2.9-3.2.18-201206011935.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/3.2.18/4420_grsecurity-2.9-3.2.18-201205271952.patch b/3.2.18/4420_grsecurity-2.9-3.2.18-201206011935.patch
similarity index 99%
rename from 3.2.18/4420_grsecurity-2.9-3.2.18-201205271952.patch
rename to 3.2.18/4420_grsecurity-2.9-3.2.18-201206011935.patch
index 19b4d90..e73e583 100644
--- a/3.2.18/4420_grsecurity-2.9-3.2.18-201205271952.patch
+++ b/3.2.18/4420_grsecurity-2.9-3.2.18-201206011935.patch
@@ -195,7 +195,7 @@ index 81c287f..d456d02 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index add68f1..07ef80b 100644
+index add68f1..3fac8b3 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -210,19 +210,6 @@ index add68f1..07ef80b 100644
  
  # Decide whether to build built-in, modular, or both.
  # Normally, just do built-in.
-@@ -357,9 +358,9 @@ CFLAGS_GCOV	= -fprofile-arcs -ftest-coverage
- 
- # Use LINUXINCLUDE when you must reference the include/ directory.
- # Needed to be compatible with the O= option
--LINUXINCLUDE    := -I$(srctree)/arch/$(hdr-arch)/include \
--                   -Iarch/$(hdr-arch)/include/generated -Iinclude \
--                   $(if $(KBUILD_SRC), -I$(srctree)/include) \
-+LINUXINCLUDE    := -isystem arch/$(hdr-arch)/include \
-+		   -isystem arch/$(hdr-arch)/include/generated -isystem include \
-+                   -isystem include/generated \
-                    -include $(srctree)/include/linux/kconfig.h
- 
- KBUILD_CPPFLAGS := -D__KERNEL__
 @@ -407,8 +408,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn --exc
  # Rules shared between *config targets and build targets
  
@@ -234,29 +221,6 @@ index add68f1..07ef80b 100644
  	$(Q)$(MAKE) $(build)=scripts/basic
  	$(Q)rm -f .tmp_quiet_recordmcount
  
-@@ -442,7 +443,7 @@ asm-generic:
- 
- no-dot-config-targets := clean mrproper distclean \
- 			 cscope gtags TAGS tags help %docs check% coccicheck \
--			 include/linux/version.h headers_% \
-+			 include/generated/linux/version.h headers_% \
- 			 kernelversion %src-pkg
- 
- config-targets := 0
-@@ -485,11 +486,11 @@ include $(srctree)/arch/$(SRCARCH)/Makefile
- export KBUILD_DEFCONFIG KBUILD_KCONFIG
- 
- config: scripts_basic outputmakefile FORCE
--	$(Q)mkdir -p include/linux include/config
-+	$(Q)mkdir -p include/generated/linux include/config
- 	$(Q)$(MAKE) $(build)=scripts/kconfig $@
- 
- %config: scripts_basic outputmakefile FORCE
--	$(Q)mkdir -p include/linux include/config
-+	$(Q)mkdir -p include/generated/linux include/config
- 	$(Q)$(MAKE) $(build)=scripts/kconfig $@
- 
- else
 @@ -564,6 +565,55 @@ else
  KBUILD_CFLAGS	+= -O2
  endif
@@ -340,23 +304,7 @@ index add68f1..07ef80b 100644
  	$(Q)$(MAKE) $(build)=$@
  
  # Store (new) KERNELRELASE string in include/config/kernel.release
-@@ -970,12 +1022,14 @@ ifneq ($(KBUILD_SRC),)
- 		echo "  in the '$(srctree)' directory.";\
- 		/bin/false; \
- 	fi;
-+	$(Q)for dir in $(srctree)/include/* ; do ln -fsn $$dir include/`basename $$dir` ; done
-+	$(Q)ln -fsn $(srctree)/arch/$(SRCARCH)/include/asm arch/$(SRCARCH)/include;
- endif
- 
- # prepare2 creates a makefile if using a separate output directory
- prepare2: prepare3 outputmakefile asm-generic
- 
--prepare1: prepare2 include/linux/version.h include/generated/utsrelease.h \
-+prepare1: prepare2 include/generated/linux/version.h include/generated/utsrelease.h \
-                    include/config/auto.conf
- 	$(cmd_crmodverdir)
- 
-@@ -985,6 +1039,7 @@ prepare0: archprepare FORCE
+@@ -985,6 +1037,7 @@ prepare0: archprepare FORCE
  	$(Q)$(MAKE) $(build)=.
  
  # All the preparing..
@@ -364,25 +312,7 @@ index add68f1..07ef80b 100644
  prepare: prepare0
  
  # Generate some files
-@@ -1008,7 +1063,7 @@ define filechk_version.h
- 	echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))';)
- endef
- 
--include/linux/version.h: $(srctree)/Makefile FORCE
-+include/generated/linux/version.h: $(srctree)/Makefile FORCE
- 	$(call filechk,version.h)
- 
- include/generated/utsrelease.h: include/config/kernel.release FORCE
-@@ -1047,7 +1102,7 @@ hdr-inst := -rR -f $(srctree)/scripts/Makefile.headersinst obj
- hdr-dst = $(if $(KBUILD_HEADERS), dst=include/asm-$(hdr-arch), dst=include/asm)
- 
- PHONY += __headers
--__headers: include/linux/version.h scripts_basic asm-generic FORCE
-+__headers: include/generated/linux/version.h scripts_basic asm-generic FORCE
- 	$(Q)$(MAKE) $(build)=scripts build_unifdef
- 
- PHONY += headers_install_all
-@@ -1086,6 +1141,8 @@ all: modules
+@@ -1086,6 +1139,8 @@ all: modules
  #	using awk while concatenating to the final file.
  
  PHONY += modules
@@ -391,7 +321,7 @@ index add68f1..07ef80b 100644
  modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
  	$(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
  	@$(kecho) '  Building modules, stage 2.';
-@@ -1101,7 +1158,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
+@@ -1101,7 +1156,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
  
  # Target to prepare building external modules
  PHONY += modules_prepare
@@ -400,16 +330,7 @@ index add68f1..07ef80b 100644
  
  # Target to install modules
  PHONY += modules_install
-@@ -1160,7 +1217,7 @@ CLEAN_FILES +=	vmlinux System.map \
- MRPROPER_DIRS  += include/config usr/include include/generated          \
-                   arch/*/include/generated
- MRPROPER_FILES += .config .config.old .version .old_version             \
--                  include/linux/version.h                               \
-+                  include/generated/linux/version.h                               \
- 		  Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS
- 
- # clean - Delete most, but leave enough to build external modules
-@@ -1198,6 +1255,7 @@ distclean: mrproper
+@@ -1198,6 +1253,7 @@ distclean: mrproper
  		\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
  		-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
  		-o -name '.*.rej' \
@@ -417,7 +338,7 @@ index add68f1..07ef80b 100644
  		-o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
  		-type f -print | xargs rm -f
  
-@@ -1358,6 +1416,8 @@ PHONY += $(module-dirs) modules
+@@ -1358,6 +1414,8 @@ PHONY += $(module-dirs) modules
  $(module-dirs): crmodverdir $(objtree)/Module.symvers
  	$(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
  
@@ -426,7 +347,7 @@ index add68f1..07ef80b 100644
  modules: $(module-dirs)
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1484,17 +1544,21 @@ else
+@@ -1484,17 +1542,21 @@ else
          target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
  endif
  
@@ -452,7 +373,7 @@ index add68f1..07ef80b 100644
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
  %.symtypes: %.c prepare scripts FORCE
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1504,11 +1568,15 @@ endif
+@@ -1504,11 +1566,15 @@ endif
  	$(cmd_crmodverdir)
  	$(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
  	$(build)=$(build-dir)
@@ -24812,7 +24733,7 @@ index f581a18..a269cab 100644
  	}
  	if (mm->get_unmapped_area == arch_get_unmapped_area)
 diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index 87488b9..6371e97 100644
+index 87488b9..f6222dc 100644
 --- a/arch/x86/mm/init.c
 +++ b/arch/x86/mm/init.c
 @@ -15,6 +15,8 @@
@@ -24872,7 +24793,7 @@ index 87488b9..6371e97 100644
  	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
  		return 0;
  	if (!page_is_ram(pagenr))
-@@ -370,8 +399,116 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
+@@ -370,8 +399,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
  #endif
  }
  
@@ -24889,7 +24810,7 @@ index 87488b9..6371e97 100644
 +	}
 +	if (ebda_addr && ebda_size) {
 +		ebda_start = ebda_addr >> PAGE_SHIFT;
-+		ebda_end = min(PAGE_ALIGN(ebda_addr + ebda_size), 0xa0000) >> PAGE_SHIFT;
++		ebda_end = min((unsigned int)PAGE_ALIGN(ebda_addr + ebda_size), (unsigned int)0xa0000) >> PAGE_SHIFT;
 +	} else {
 +		ebda_start = 0x9f000 >> PAGE_SHIFT;
 +		ebda_end = 0xa0000 >> PAGE_SHIFT;
@@ -24909,6 +24830,12 @@ index 87488b9..6371e97 100644
 +	int cpu;
 +#endif
 +#endif
++#ifndef CONFIG_X86_PAE
++	pgd_t *pgd;
++	pud_t *pud;
++	pmd_t *pmd;
++	unsigned long addr, end;
++#endif
 +
 +	gr_init_ebda();
 +
@@ -24952,11 +24879,6 @@ index 87488b9..6371e97 100644
 +#endif
 +
 +#else
-+	pgd_t *pgd;
-+	pud_t *pud;
-+	pmd_t *pmd;
-+	unsigned long addr, end;
-+
 +	/* PaX: make kernel code/rodata read-only, rest non-executable */
 +	for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
 +		pgd = pgd_offset_k(addr);
@@ -28801,6 +28723,25 @@ index a4760e0..51283cf 100644
  	if (err)
  		printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
  	else
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 5693ece..ef7c1f9 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -587,11 +587,9 @@ static ssize_t print_nodes_state(enum node_states state, char *buf)
+ {
+ 	int n;
+ 
+-	n = nodelist_scnprintf(buf, PAGE_SIZE, node_states[state]);
+-	if (n > 0 && PAGE_SIZE > n + 1) {
+-		*(buf + n++) = '\n';
+-		*(buf + n++) = '\0';
+-	}
++	n = nodelist_scnprintf(buf, PAGE_SIZE-2, node_states[state]);
++	buf[n++] = '\n';
++	buf[n] = '\0';
+ 	return n;
+ }
+ 
 diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
 index caf995f..6f76697 100644
 --- a/drivers/base/power/wakeup.c
@@ -33422,6 +33363,19 @@ index 1f355bb..43f1fea 100644
  				return -EFAULT;
  		} else
  			memcpy(msg, buf, count);
+diff --git a/drivers/leds/leds-mc13783.c b/drivers/leds/leds-mc13783.c
+index b3393a9..33f6979 100644
+--- a/drivers/leds/leds-mc13783.c
++++ b/drivers/leds/leds-mc13783.c
+@@ -280,7 +280,7 @@ static int __devinit mc13783_led_probe(struct platform_device *pdev)
+ 		return -EINVAL;
+ 	}
+ 
+-	led = kzalloc(sizeof(*led) * pdata->num_leds, GFP_KERNEL);
++	led = kcalloc(pdata->num_leds, sizeof(*led), GFP_KERNEL);
+ 	if (led == NULL) {
+ 		dev_err(&pdev->dev, "failed to alloc memory\n");
+ 		return -ENOMEM;
 diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
 index b5fdcb7..5b6c59f 100644
 --- a/drivers/lguest/core.c
@@ -63573,6 +63527,27 @@ index 58969b2..ead129b 100644
  
  /**
   * preempt_notifier - key for installing preemption notifiers
+diff --git a/include/linux/printk.h b/include/linux/printk.h
+index f0e22f7..82dd544 100644
+--- a/include/linux/printk.h
++++ b/include/linux/printk.h
+@@ -94,6 +94,8 @@ void early_printk(const char *fmt, ...);
+ extern int printk_needs_cpu(int cpu);
+ extern void printk_tick(void);
+ 
++extern int kptr_restrict;
++
+ #ifdef CONFIG_PRINTK
+ asmlinkage __printf(1, 0)
+ int vprintk(const char *fmt, va_list args);
+@@ -112,7 +114,6 @@ extern bool printk_timed_ratelimit(unsigned long *caller_jiffies,
+ 
+ extern int printk_delay_msec;
+ extern int dmesg_restrict;
+-extern int kptr_restrict;
+ 
+ void log_buf_kexec_setup(void);
+ void __init setup_log_buf(int early);
 diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
 index 643b96c..ef55a9c 100644
 --- a/include/linux/proc_fs.h
@@ -66792,7 +66767,7 @@ index 5a8a66e..ded4680 100644
  {
  	struct signal_struct *sig = current->signal;
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 26f1ab0..e483ce2 100644
+index 26f1ab0..30d564b 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -282,7 +282,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
@@ -66817,7 +66792,7 @@ index 26f1ab0..e483ce2 100644
 +
 +	charge = 0;
 +	if (mpnt->vm_flags & VM_ACCOUNT) {
-+		unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
++		unsigned long len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
 +		if (security_vm_enough_memory(len))
 +			goto fail_nomem;
 +		charge = len;
@@ -69873,7 +69848,7 @@ index 481611f..0754d86 100644
  				break;
  			}
 diff --git a/kernel/sysctl.c b/kernel/sysctl.c
-index ea7ec7f..57501f0 100644
+index ea7ec7f..5b76fb9 100644
 --- a/kernel/sysctl.c
 +++ b/kernel/sysctl.c
 @@ -86,6 +86,13 @@
@@ -69890,7 +69865,18 @@ index ea7ec7f..57501f0 100644
  
  /* External variables not in a header file. */
  extern int sysctl_overcommit_memory;
-@@ -191,6 +198,7 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
+@@ -165,10 +172,8 @@ static int proc_taint(struct ctl_table *table, int write,
+ 			       void __user *buffer, size_t *lenp, loff_t *ppos);
+ #endif
+ 
+-#ifdef CONFIG_PRINTK
+ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
+ 				void __user *buffer, size_t *lenp, loff_t *ppos);
+-#endif
+ 
+ #ifdef CONFIG_MAGIC_SYSRQ
+ /* Note: sysrq code uses it's own private copy */
+@@ -191,6 +196,7 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
  }
  
  #endif
@@ -69898,7 +69884,7 @@ index ea7ec7f..57501f0 100644
  
  static struct ctl_table root_table[];
  static struct ctl_table_root sysctl_table_root;
-@@ -220,6 +228,20 @@ extern struct ctl_table epoll_table[];
+@@ -220,6 +226,20 @@ extern struct ctl_table epoll_table[];
  int sysctl_legacy_va_layout;
  #endif
  
@@ -69919,7 +69905,7 @@ index ea7ec7f..57501f0 100644
  /* The default sysctl tables: */
  
  static struct ctl_table root_table[] = {
-@@ -266,6 +288,22 @@ static int max_extfrag_threshold = 1000;
+@@ -266,6 +286,22 @@ static int max_extfrag_threshold = 1000;
  #endif
  
  static struct ctl_table kern_table[] = {
@@ -69942,7 +69928,7 @@ index ea7ec7f..57501f0 100644
  	{
  		.procname	= "sched_child_runs_first",
  		.data		= &sysctl_sched_child_runs_first,
-@@ -550,7 +588,7 @@ static struct ctl_table kern_table[] = {
+@@ -550,7 +586,7 @@ static struct ctl_table kern_table[] = {
  		.data		= &modprobe_path,
  		.maxlen		= KMOD_PATH_LEN,
  		.mode		= 0644,
@@ -69951,7 +69937,7 @@ index ea7ec7f..57501f0 100644
  	},
  	{
  		.procname	= "modules_disabled",
-@@ -717,16 +755,20 @@ static struct ctl_table kern_table[] = {
+@@ -717,16 +753,20 @@ static struct ctl_table kern_table[] = {
  		.extra1		= &zero,
  		.extra2		= &one,
  	},
@@ -69973,7 +69959,7 @@ index ea7ec7f..57501f0 100644
  	{
  		.procname	= "ngroups_max",
  		.data		= &ngroups_max,
-@@ -1216,6 +1258,13 @@ static struct ctl_table vm_table[] = {
+@@ -1216,6 +1256,13 @@ static struct ctl_table vm_table[] = {
  		.proc_handler	= proc_dointvec_minmax,
  		.extra1		= &zero,
  	},
@@ -69987,7 +69973,7 @@ index ea7ec7f..57501f0 100644
  #else
  	{
  		.procname	= "nr_trim_pages",
-@@ -1720,6 +1769,17 @@ static int test_perm(int mode, int op)
+@@ -1720,6 +1767,17 @@ static int test_perm(int mode, int op)
  int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
  {
  	int mode;
@@ -70005,7 +69991,7 @@ index ea7ec7f..57501f0 100644
  
  	if (root->permissions)
  		mode = root->permissions(root, current->nsproxy, table);
-@@ -2124,6 +2184,16 @@ int proc_dostring(struct ctl_table *table, int write,
+@@ -2124,6 +2182,16 @@ int proc_dostring(struct ctl_table *table, int write,
  			       buffer, lenp, ppos);
  }
  
@@ -70022,7 +70008,7 @@ index ea7ec7f..57501f0 100644
  static size_t proc_skip_spaces(char **buf)
  {
  	size_t ret;
-@@ -2229,6 +2299,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
+@@ -2229,6 +2297,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
  	len = strlen(tmp);
  	if (len > *size)
  		len = *size;
@@ -70031,7 +70017,23 @@ index ea7ec7f..57501f0 100644
  	if (copy_to_user(*buf, tmp, len))
  		return -EFAULT;
  	*size -= len;
-@@ -2545,8 +2617,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
+@@ -2421,7 +2491,6 @@ static int proc_taint(struct ctl_table *table, int write,
+ 	return err;
+ }
+ 
+-#ifdef CONFIG_PRINTK
+ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
+ 				void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+@@ -2430,7 +2499,6 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
+ 
+ 	return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+ }
+-#endif
+ 
+ struct do_proc_dointvec_minmax_conv_param {
+ 	int *min;
+@@ -2545,8 +2613,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
  			*i = val;
  		} else {
  			val = convdiv * (*i) / convmul;
@@ -70044,7 +70046,7 @@ index ea7ec7f..57501f0 100644
  			err = proc_put_long(&buffer, &left, val, false);
  			if (err)
  				break;
-@@ -2941,6 +3016,12 @@ int proc_dostring(struct ctl_table *table, int write,
+@@ -2941,6 +3012,12 @@ int proc_dostring(struct ctl_table *table, int write,
  	return -ENOSYS;
  }
  
@@ -70057,7 +70059,7 @@ index ea7ec7f..57501f0 100644
  int proc_dointvec(struct ctl_table *table, int write,
  		  void __user *buffer, size_t *lenp, loff_t *ppos)
  {
-@@ -2997,6 +3078,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
+@@ -2997,6 +3074,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
  EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
  EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
  EXPORT_SYMBOL(proc_dostring);
@@ -70978,7 +70980,7 @@ index 0000000..7cd6065
 @@ -0,0 +1 @@
 +-grsec
 diff --git a/mm/Kconfig b/mm/Kconfig
-index 011b110..b492af2 100644
+index 011b110..fad8776 100644
 --- a/mm/Kconfig
 +++ b/mm/Kconfig
 @@ -241,10 +241,10 @@ config KSM
@@ -70995,6 +70997,15 @@ index 011b110..b492af2 100644
  	  This is the portion of low virtual memory which should be protected
  	  from userspace allocation.  Keeping a user from writing to low pages
  	  can help reduce the impact of kernel NULL pointer bugs.
+@@ -274,7 +274,7 @@ config MEMORY_FAILURE
+ 
+ config HWPOISON_INJECT
+ 	tristate "HWPoison pages injector"
+-	depends on MEMORY_FAILURE && DEBUG_KERNEL && PROC_FS
++	depends on MEMORY_FAILURE && DEBUG_KERNEL && PROC_FS && !GRKERNSEC
+ 	select PROC_PAGE_MONITOR
+ 
+ config NOMMU_INITIAL_TRIM_EXCESS
 diff --git a/mm/filemap.c b/mm/filemap.c
 index 03c5b0e..a01e793 100644
 --- a/mm/filemap.c
@@ -71075,7 +71086,7 @@ index 8f005e9..1cb1036 100644
  	/* if an huge pmd materialized from under us just retry later */
  	if (unlikely(pmd_trans_huge(*pmd)))
 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 7120c2e..be2947e 100644
+index 7120c2e..c8312c8 100644
 --- a/mm/hugetlb.c
 +++ b/mm/hugetlb.c
 @@ -2068,6 +2068,15 @@ static void hugetlb_vm_op_open(struct vm_area_struct *vma)
@@ -71222,12 +71233,13 @@ index 7120c2e..be2947e 100644
  	}
  
  	/*
-@@ -2915,6 +2982,9 @@ int hugetlb_reserve_pages(struct inode *inode,
+@@ -2915,6 +2982,10 @@ int hugetlb_reserve_pages(struct inode *inode,
  	if (!vma || vma->vm_flags & VM_MAYSHARE)
  		region_add(&inode->i_mapping->private_list, from, to);
  	return 0;
 +out_err:
-+	resv_map_put(vma);
++	if (vma)
++		resv_map_put(vma);
 +	return ret;
  }
  
@@ -75156,7 +75168,7 @@ index 136ac4f..f917fa9 100644
  	mm->unmap_area = arch_unmap_area;
  }
 diff --git a/mm/vmalloc.c b/mm/vmalloc.c
-index 27be2f0..8535fe1 100644
+index 27be2f0..879f150 100644
 --- a/mm/vmalloc.c
 +++ b/mm/vmalloc.c
 @@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
@@ -75344,6 +75356,17 @@ index 27be2f0..8535fe1 100644
  	if ((PAGE_SIZE-1) & (unsigned long)addr)
  		return -EINVAL;
  
+@@ -2350,8 +2413,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
+ 		return NULL;
+ 	}
+ 
+-	vms = kzalloc(sizeof(vms[0]) * nr_vms, GFP_KERNEL);
+-	vas = kzalloc(sizeof(vas[0]) * nr_vms, GFP_KERNEL);
++	vms = kcalloc(nr_vms, sizeof(vms[0]), GFP_KERNEL);
++	vas = kcalloc(nr_vms, sizeof(vas[0]), GFP_KERNEL);
+ 	if (!vas || !vms)
+ 		goto err_free;
+ 
 diff --git a/mm/vmstat.c b/mm/vmstat.c
 index 8fd603b..cf0d930 100644
 --- a/mm/vmstat.c
@@ -76687,6 +76710,19 @@ index 94cdbc5..0cb0063 100644
  		if (peer->tcp_ts_stamp) {
  			ts = peer->tcp_ts;
  			tsage = get_seconds() - peer->tcp_ts_stamp;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 9726927..32e6ca2 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -5836,6 +5836,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+ 			goto discard;
+ 
+ 		if (th->syn) {
++			if (th->fin)
++				goto discard;
+ 			if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
+ 				return 1;
+ 
 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
 index de69cec..74908e1 100644
 --- a/net/ipv4/tcp_ipv4.c
@@ -79276,28 +79312,6 @@ index 1ac414f..a1c1451 100644
  # Remove .so files from "xxx-objs"
  host-cobjs	:= $(filter-out %.so,$(host-cobjs))
  
-diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
-index 5d986d9..5fc5f79 100644
---- a/scripts/Makefile.lib
-+++ b/scripts/Makefile.lib
-@@ -144,14 +144,14 @@ __a_flags	=                          $(call flags,_a_flags)
- __cpp_flags     =                          $(call flags,_cpp_flags)
- endif
- 
--c_flags        = -Wp,-MD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
-+c_flags        = -Wp,-MD,$(depfile) $(LINUXINCLUDE) $(NOSTDINC_FLAGS)     \
- 		 $(__c_flags) $(modkern_cflags)                           \
- 		 -D"KBUILD_STR(s)=\#s" $(basename_flags) $(modname_flags)
- 
--a_flags        = -Wp,-MD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
-+a_flags        = -Wp,-MD,$(depfile) $(LINUXINCLUDE) $(NOSTDINC_FLAGS)     \
- 		 $(__a_flags) $(modkern_aflags)
- 
--cpp_flags      = -Wp,-MD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
-+cpp_flags      = -Wp,-MD,$(depfile) $(LINUXINCLUDE) $(NOSTDINC_FLAGS)     \
- 		 $(__cpp_flags)
- 
- ld_flags       = $(LDFLAGS) $(ldflags-y)
 diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
 index cb1f50c..cef2a7c 100644
 --- a/scripts/basic/fixdep.c
@@ -81516,10 +81530,10 @@ index 0000000..ee950d0
 +}
 diff --git a/tools/gcc/constify_plugin.c b/tools/gcc/constify_plugin.c
 new file mode 100644
-index 0000000..88a7438
+index 0000000..89b7f56
 --- /dev/null
 +++ b/tools/gcc/constify_plugin.c
-@@ -0,0 +1,303 @@
+@@ -0,0 +1,328 @@
 +/*
 + * Copyright 2011 by Emese Revfy <re.emese@×××××.com>
 + * Copyright 2011 by PaX Team <pageexec@××××××××.hu>
@@ -81560,24 +81574,47 @@ index 0000000..88a7438
 +int plugin_is_GPL_compatible;
 +
 +static struct plugin_info const_plugin_info = {
-+	.version	= "201111150100",
++	.version	= "201205300030",
 +	.help		= "no-constify\tturn off constification\n",
 +};
 +
-+static void constify_type(tree type);
-+static bool walk_struct(tree node);
++static void deconstify_tree(tree node);
 +
-+static tree deconstify_type(tree old_type)
++static void deconstify_type(tree type)
 +{
-+	tree new_type, field;
++	tree field;
++
++	for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
++		tree type = TREE_TYPE(field);
++
++		if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
++			continue;
++		if (!TYPE_READONLY(type))
++			continue;
++
++		deconstify_tree(field);
++	}
++	TYPE_READONLY(type) = 0;
++	C_TYPE_FIELDS_READONLY(type) = 0;
++}
++
++static void deconstify_tree(tree node)
++{
++	tree old_type, new_type, field;
++
++	old_type = TREE_TYPE(node);
++
++	gcc_assert(TYPE_READONLY(old_type) && (TYPE_QUALS(old_type) & TYPE_QUAL_CONST));
 +
 +	new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
 +	TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
 +	for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
 +		DECL_FIELD_CONTEXT(field) = new_type;
-+	TYPE_READONLY(new_type) = 0;
-+	C_TYPE_FIELDS_READONLY(new_type) = 0;
-+	return new_type;
++
++	deconstify_type(new_type);
++
++	TREE_READONLY(node) = 0;
++	TREE_TYPE(node) = new_type;
 +}
 +
 +static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
@@ -81621,14 +81658,19 @@ index 0000000..88a7438
 +	}
 +
 +	if (TREE_CODE(*node) == TYPE_DECL) {
-+		TREE_TYPE(*node) = deconstify_type(type);
-+		TREE_READONLY(*node) = 0;
++		deconstify_tree(*node);
 +		return NULL_TREE;
 +	}
 +
 +	return NULL_TREE;
 +}
 +
++static void constify_type(tree type)
++{
++	TYPE_READONLY(type) = 1;
++	C_TYPE_FIELDS_READONLY(type) = 1;
++}
++
 +static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
 +{
 +	*no_add_attrs = true;
@@ -81679,12 +81721,6 @@ index 0000000..88a7438
 +	register_attribute(&do_const_attr);
 +}
 +
-+static void constify_type(tree type)
-+{
-+	TYPE_READONLY(type) = 1;
-+	C_TYPE_FIELDS_READONLY(type) = 1;
-+}
-+
 +static bool is_fptr(tree field)
 +{
 +	tree ptr = TREE_TYPE(field);
@@ -81699,11 +81735,14 @@ index 0000000..88a7438
 +{
 +	tree field;
 +
-+	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node)))
++	if (TYPE_FIELDS(node) == NULL_TREE)
 +		return false;
 +
-+	if (TYPE_FIELDS(node) == NULL_TREE)
++	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node))) {
++		gcc_assert(!TYPE_READONLY(node));
++		deconstify_type(node);
 +		return false;
++	}
 +
 +	for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
 +		tree type = TREE_TYPE(field);
@@ -96243,7 +96282,7 @@ index 0000000..2c6f298
 +};
 diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
 new file mode 100644
-index 0000000..4154daf
+index 0000000..92b8ee6
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin.c
 @@ -0,0 +1,1188 @@
@@ -96469,7 +96508,7 @@ index 0000000..4154daf
 +	const char *curfunc = NAME(func);
 +
 +	new_hash = get_hash_num(curfunc, filename, 0);
-+	inform(loc, "Function %s is missing from the size_overflow hash table +%s+%d+%u+%s+", curfunc, curfunc, argnum, new_hash, filename);
++//	inform(loc, "Function %s is missing from the size_overflow hash table +%s+%d+%u+%s+", curfunc, curfunc, argnum, new_hash, filename);
 +}
 +
 +static void check_missing_attribute(tree arg)

diff --git a/3.3.7/0000_README b/3.3.7/0000_README
index 705a5d3..4499d08 100644
--- a/3.3.7/0000_README
+++ b/3.3.7/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.9-3.3.7-201205271953.patch
+Patch:	4420_grsecurity-2.9-3.3.7-201206011935.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/3.3.7/4420_grsecurity-2.9-3.3.7-201205271953.patch b/3.3.7/4420_grsecurity-2.9-3.3.7-201206011935.patch
similarity index 99%
rename from 3.3.7/4420_grsecurity-2.9-3.3.7-201205271953.patch
rename to 3.3.7/4420_grsecurity-2.9-3.3.7-201206011935.patch
index 07eb40a..8787b62 100644
--- a/3.3.7/4420_grsecurity-2.9-3.3.7-201205271953.patch
+++ b/3.3.7/4420_grsecurity-2.9-3.3.7-201206011935.patch
@@ -195,7 +195,7 @@ index d99fd9c..8689fef 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 073f74f..a689ddf 100644
+index 073f74f..02aebe9 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -210,19 +210,6 @@ index 073f74f..a689ddf 100644
  
  # Decide whether to build built-in, modular, or both.
  # Normally, just do built-in.
-@@ -357,9 +358,9 @@ CFLAGS_GCOV	= -fprofile-arcs -ftest-coverage
- 
- # Use LINUXINCLUDE when you must reference the include/ directory.
- # Needed to be compatible with the O= option
--LINUXINCLUDE    := -I$(srctree)/arch/$(hdr-arch)/include \
--                   -Iarch/$(hdr-arch)/include/generated -Iinclude \
--                   $(if $(KBUILD_SRC), -I$(srctree)/include) \
-+LINUXINCLUDE    := -isystem arch/$(hdr-arch)/include \
-+                   -isystem arch/$(hdr-arch)/include/generated -isystem include \
-+                   -isystem include/generated \
-                    -include $(srctree)/include/linux/kconfig.h
- 
- KBUILD_CPPFLAGS := -D__KERNEL__
 @@ -407,8 +408,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn --exc
  # Rules shared between *config targets and build targets
  
@@ -234,29 +221,6 @@ index 073f74f..a689ddf 100644
  	$(Q)$(MAKE) $(build)=scripts/basic
  	$(Q)rm -f .tmp_quiet_recordmcount
  
-@@ -442,7 +443,7 @@ asm-generic:
- 
- no-dot-config-targets := clean mrproper distclean \
- 			 cscope gtags TAGS tags help %docs check% coccicheck \
--			 include/linux/version.h headers_% archheaders \
-+			 include/generated/linux/version.h headers_% archheaders \
- 			 kernelversion %src-pkg
- 
- config-targets := 0
-@@ -485,11 +486,11 @@ include $(srctree)/arch/$(SRCARCH)/Makefile
- export KBUILD_DEFCONFIG KBUILD_KCONFIG
- 
- config: scripts_basic outputmakefile FORCE
--	$(Q)mkdir -p include/linux include/config
-+	$(Q)mkdir -p include/generated/linux include/config
- 	$(Q)$(MAKE) $(build)=scripts/kconfig $@
- 
- %config: scripts_basic outputmakefile FORCE
--	$(Q)mkdir -p include/linux include/config
-+	$(Q)mkdir -p include/generated/linux include/config
- 	$(Q)$(MAKE) $(build)=scripts/kconfig $@
- 
- else
 @@ -564,6 +565,55 @@ else
  KBUILD_CFLAGS	+= -O2
  endif
@@ -340,23 +304,7 @@ index 073f74f..a689ddf 100644
  	$(Q)$(MAKE) $(build)=$@
  
  # Store (new) KERNELRELASE string in include/config/kernel.release
-@@ -970,12 +1022,14 @@ ifneq ($(KBUILD_SRC),)
- 		echo "  in the '$(srctree)' directory.";\
- 		/bin/false; \
- 	fi;
-+	$(Q)for dir in $(srctree)/include/* ; do ln -fsn $$dir include/`basename $$dir` ; done
-+	$(Q)ln -fsn $(srctree)/arch/$(SRCARCH)/include/asm arch/$(SRCARCH)/include;
- endif
- 
- # prepare2 creates a makefile if using a separate output directory
- prepare2: prepare3 outputmakefile asm-generic
- 
--prepare1: prepare2 include/linux/version.h include/generated/utsrelease.h \
-+prepare1: prepare2 include/generated/linux/version.h include/generated/utsrelease.h \
-                    include/config/auto.conf
- 	$(cmd_crmodverdir)
- 
-@@ -985,6 +1039,7 @@ prepare0: archprepare FORCE
+@@ -985,6 +1037,7 @@ prepare0: archprepare FORCE
  	$(Q)$(MAKE) $(build)=.
  
  # All the preparing..
@@ -364,25 +312,7 @@ index 073f74f..a689ddf 100644
  prepare: prepare0
  
  # Generate some files
-@@ -1008,7 +1063,7 @@ define filechk_version.h
- 	echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))';)
- endef
- 
--include/linux/version.h: $(srctree)/Makefile FORCE
-+include/generated/linux/version.h: $(srctree)/Makefile FORCE
- 	$(call filechk,version.h)
- 
- include/generated/utsrelease.h: include/config/kernel.release FORCE
-@@ -1050,7 +1105,7 @@ PHONY += archheaders
- archheaders:
- 
- PHONY += __headers
--__headers: include/linux/version.h scripts_basic asm-generic archheaders FORCE
-+__headers: include/generated/linux/version.h scripts_basic asm-generic archheaders FORCE
- 	$(Q)$(MAKE) $(build)=scripts build_unifdef
- 
- PHONY += headers_install_all
-@@ -1089,6 +1144,8 @@ all: modules
+@@ -1089,6 +1142,8 @@ all: modules
  #	using awk while concatenating to the final file.
  
  PHONY += modules
@@ -391,7 +321,7 @@ index 073f74f..a689ddf 100644
  modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
  	$(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
  	@$(kecho) '  Building modules, stage 2.';
-@@ -1104,7 +1161,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
+@@ -1104,7 +1159,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
  
  # Target to prepare building external modules
  PHONY += modules_prepare
@@ -400,16 +330,7 @@ index 073f74f..a689ddf 100644
  
  # Target to install modules
  PHONY += modules_install
-@@ -1163,7 +1220,7 @@ CLEAN_FILES +=	vmlinux System.map \
- MRPROPER_DIRS  += include/config usr/include include/generated          \
-                   arch/*/include/generated
- MRPROPER_FILES += .config .config.old .version .old_version             \
--                  include/linux/version.h                               \
-+                  include/generated/linux/version.h                               \
- 		  Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS
- 
- # clean - Delete most, but leave enough to build external modules
-@@ -1201,6 +1258,7 @@ distclean: mrproper
+@@ -1201,6 +1256,7 @@ distclean: mrproper
  		\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
  		-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
  		-o -name '.*.rej' \
@@ -417,7 +338,7 @@ index 073f74f..a689ddf 100644
  		-o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
  		-type f -print | xargs rm -f
  
-@@ -1361,6 +1419,8 @@ PHONY += $(module-dirs) modules
+@@ -1361,6 +1417,8 @@ PHONY += $(module-dirs) modules
  $(module-dirs): crmodverdir $(objtree)/Module.symvers
  	$(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
  
@@ -426,7 +347,7 @@ index 073f74f..a689ddf 100644
  modules: $(module-dirs)
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1487,17 +1547,21 @@ else
+@@ -1487,17 +1545,21 @@ else
          target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
  endif
  
@@ -452,7 +373,7 @@ index 073f74f..a689ddf 100644
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
  %.symtypes: %.c prepare scripts FORCE
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1507,11 +1571,15 @@ endif
+@@ -1507,11 +1569,15 @@ endif
  	$(cmd_crmodverdir)
  	$(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
  	$(build)=$(build-dir)
@@ -24753,7 +24674,7 @@ index 8ecbb4b..a269cab 100644
  	}
  	if (mm->get_unmapped_area == arch_get_unmapped_area)
 diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index 6cabf65..00139c4 100644
+index 6cabf65..9976a56 100644
 --- a/arch/x86/mm/init.c
 +++ b/arch/x86/mm/init.c
 @@ -17,6 +17,8 @@
@@ -24813,7 +24734,7 @@ index 6cabf65..00139c4 100644
  	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
  		return 0;
  	if (!page_is_ram(pagenr))
-@@ -372,8 +401,116 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
+@@ -372,8 +401,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
  #endif
  }
  
@@ -24830,7 +24751,7 @@ index 6cabf65..00139c4 100644
 +	}
 +	if (ebda_addr && ebda_size) {
 +		ebda_start = ebda_addr >> PAGE_SHIFT;
-+		ebda_end = min(PAGE_ALIGN(ebda_addr + ebda_size), 0xa0000) >> PAGE_SHIFT;
++		ebda_end = min((unsigned int)PAGE_ALIGN(ebda_addr + ebda_size), (unsigned int)0xa0000) >> PAGE_SHIFT;
 +	} else {
 +		ebda_start = 0x9f000 >> PAGE_SHIFT;
 +		ebda_end = 0xa0000 >> PAGE_SHIFT;
@@ -24850,6 +24771,12 @@ index 6cabf65..00139c4 100644
 +	int cpu;
 +#endif
 +#endif
++#ifndef CONFIG_X86_PAE
++	pgd_t *pgd;
++	pud_t *pud;
++	pmd_t *pmd;
++	unsigned long addr, end;
++#endif
 +
 +	gr_init_ebda();
 +
@@ -24893,11 +24820,6 @@ index 6cabf65..00139c4 100644
 +#endif
 +
 +#else
-+	pgd_t *pgd;
-+	pud_t *pud;
-+	pmd_t *pmd;
-+	unsigned long addr, end;
-+
 +	/* PaX: make kernel code/rodata read-only, rest non-executable */
 +	for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
 +		pgd = pgd_offset_k(addr);
@@ -28775,6 +28697,25 @@ index 8493536..31adee0 100644
  	if (err)
  		printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
  	else
+diff --git a/drivers/base/node.c b/drivers/base/node.c
+index 90aa2a1..af1a177 100644
+--- a/drivers/base/node.c
++++ b/drivers/base/node.c
+@@ -592,11 +592,9 @@ static ssize_t print_nodes_state(enum node_states state, char *buf)
+ {
+ 	int n;
+ 
+-	n = nodelist_scnprintf(buf, PAGE_SIZE, node_states[state]);
+-	if (n > 0 && PAGE_SIZE > n + 1) {
+-		*(buf + n++) = '\n';
+-		*(buf + n++) = '\0';
+-	}
++	n = nodelist_scnprintf(buf, PAGE_SIZE-2, node_states[state]);
++	buf[n++] = '\n';
++	buf[n] = '\0';
+ 	return n;
+ }
+ 
 diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
 index caf995f..6f76697 100644
 --- a/drivers/base/power/wakeup.c
@@ -33275,6 +33216,19 @@ index 1f355bb..43f1fea 100644
  				return -EFAULT;
  		} else
  			memcpy(msg, buf, count);
+diff --git a/drivers/leds/leds-mc13783.c b/drivers/leds/leds-mc13783.c
+index 8bc4915..4cc6a2e 100644
+--- a/drivers/leds/leds-mc13783.c
++++ b/drivers/leds/leds-mc13783.c
+@@ -280,7 +280,7 @@ static int __devinit mc13783_led_probe(struct platform_device *pdev)
+ 		return -EINVAL;
+ 	}
+ 
+-	led = kzalloc(sizeof(*led) * pdata->num_leds, GFP_KERNEL);
++	led = kcalloc(pdata->num_leds, sizeof(*led), GFP_KERNEL);
+ 	if (led == NULL) {
+ 		dev_err(&pdev->dev, "failed to alloc memory\n");
+ 		return -ENOMEM;
 diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
 index b5fdcb7..5b6c59f 100644
 --- a/drivers/lguest/core.c
@@ -62840,6 +62794,27 @@ index 58969b2..ead129b 100644
  
  /**
   * preempt_notifier - key for installing preemption notifiers
+diff --git a/include/linux/printk.h b/include/linux/printk.h
+index f0e22f7..82dd544 100644
+--- a/include/linux/printk.h
++++ b/include/linux/printk.h
+@@ -94,6 +94,8 @@ void early_printk(const char *fmt, ...);
+ extern int printk_needs_cpu(int cpu);
+ extern void printk_tick(void);
+ 
++extern int kptr_restrict;
++
+ #ifdef CONFIG_PRINTK
+ asmlinkage __printf(1, 0)
+ int vprintk(const char *fmt, va_list args);
+@@ -112,7 +114,6 @@ extern bool printk_timed_ratelimit(unsigned long *caller_jiffies,
+ 
+ extern int printk_delay_msec;
+ extern int dmesg_restrict;
+-extern int kptr_restrict;
+ 
+ void log_buf_kexec_setup(void);
+ void __init setup_log_buf(int early);
 diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
 index 85c5073..51fac8b 100644
 --- a/include/linux/proc_fs.h
@@ -65944,7 +65919,7 @@ index 46c8b14..d868958 100644
  {
  	struct signal_struct *sig = current->signal;
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 423d5a4..4608ecf 100644
+index 423d5a4..881923e 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -285,7 +285,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
@@ -65969,7 +65944,7 @@ index 423d5a4..4608ecf 100644
 +
 +	charge = 0;
 +	if (mpnt->vm_flags & VM_ACCOUNT) {
-+		unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
++		unsigned long len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
 +		if (security_vm_enough_memory(len))
 +			goto fail_nomem;
 +		charge = len;
@@ -68963,7 +68938,7 @@ index 888d227..f04b318 100644
  				break;
  			}
 diff --git a/kernel/sysctl.c b/kernel/sysctl.c
-index f03a6ef..5fcc8af 100644
+index f03a6ef..735d95c 100644
 --- a/kernel/sysctl.c
 +++ b/kernel/sysctl.c
 @@ -86,6 +86,13 @@
@@ -68980,7 +68955,18 @@ index f03a6ef..5fcc8af 100644
  
  /* External variables not in a header file. */
  extern int sysctl_overcommit_memory;
-@@ -191,6 +198,7 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
+@@ -165,10 +172,8 @@ static int proc_taint(struct ctl_table *table, int write,
+ 			       void __user *buffer, size_t *lenp, loff_t *ppos);
+ #endif
+ 
+-#ifdef CONFIG_PRINTK
+ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
+ 				void __user *buffer, size_t *lenp, loff_t *ppos);
+-#endif
+ 
+ #ifdef CONFIG_MAGIC_SYSRQ
+ /* Note: sysrq code uses it's own private copy */
+@@ -191,6 +196,7 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
  }
  
  #endif
@@ -68988,7 +68974,7 @@ index f03a6ef..5fcc8af 100644
  
  static struct ctl_table root_table[];
  static struct ctl_table_root sysctl_table_root;
-@@ -220,6 +228,20 @@ extern struct ctl_table epoll_table[];
+@@ -220,6 +226,20 @@ extern struct ctl_table epoll_table[];
  int sysctl_legacy_va_layout;
  #endif
  
@@ -69009,7 +68995,7 @@ index f03a6ef..5fcc8af 100644
  /* The default sysctl tables: */
  
  static struct ctl_table root_table[] = {
-@@ -266,6 +288,22 @@ static int max_extfrag_threshold = 1000;
+@@ -266,6 +286,22 @@ static int max_extfrag_threshold = 1000;
  #endif
  
  static struct ctl_table kern_table[] = {
@@ -69032,7 +69018,7 @@ index f03a6ef..5fcc8af 100644
  	{
  		.procname	= "sched_child_runs_first",
  		.data		= &sysctl_sched_child_runs_first,
-@@ -550,7 +588,7 @@ static struct ctl_table kern_table[] = {
+@@ -550,7 +586,7 @@ static struct ctl_table kern_table[] = {
  		.data		= &modprobe_path,
  		.maxlen		= KMOD_PATH_LEN,
  		.mode		= 0644,
@@ -69041,7 +69027,7 @@ index f03a6ef..5fcc8af 100644
  	},
  	{
  		.procname	= "modules_disabled",
-@@ -717,16 +755,20 @@ static struct ctl_table kern_table[] = {
+@@ -717,16 +753,20 @@ static struct ctl_table kern_table[] = {
  		.extra1		= &zero,
  		.extra2		= &one,
  	},
@@ -69063,7 +69049,7 @@ index f03a6ef..5fcc8af 100644
  	{
  		.procname	= "ngroups_max",
  		.data		= &ngroups_max,
-@@ -1225,6 +1267,13 @@ static struct ctl_table vm_table[] = {
+@@ -1225,6 +1265,13 @@ static struct ctl_table vm_table[] = {
  		.proc_handler	= proc_dointvec_minmax,
  		.extra1		= &zero,
  	},
@@ -69077,7 +69063,7 @@ index f03a6ef..5fcc8af 100644
  #else
  	{
  		.procname	= "nr_trim_pages",
-@@ -1729,6 +1778,17 @@ static int test_perm(int mode, int op)
+@@ -1729,6 +1776,17 @@ static int test_perm(int mode, int op)
  int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
  {
  	int mode;
@@ -69095,7 +69081,7 @@ index f03a6ef..5fcc8af 100644
  
  	if (root->permissions)
  		mode = root->permissions(root, current->nsproxy, table);
-@@ -2133,6 +2193,16 @@ int proc_dostring(struct ctl_table *table, int write,
+@@ -2133,6 +2191,16 @@ int proc_dostring(struct ctl_table *table, int write,
  			       buffer, lenp, ppos);
  }
  
@@ -69112,7 +69098,7 @@ index f03a6ef..5fcc8af 100644
  static size_t proc_skip_spaces(char **buf)
  {
  	size_t ret;
-@@ -2238,6 +2308,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
+@@ -2238,6 +2306,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
  	len = strlen(tmp);
  	if (len > *size)
  		len = *size;
@@ -69121,7 +69107,23 @@ index f03a6ef..5fcc8af 100644
  	if (copy_to_user(*buf, tmp, len))
  		return -EFAULT;
  	*size -= len;
-@@ -2554,8 +2626,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
+@@ -2430,7 +2500,6 @@ static int proc_taint(struct ctl_table *table, int write,
+ 	return err;
+ }
+ 
+-#ifdef CONFIG_PRINTK
+ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
+ 				void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+@@ -2439,7 +2508,6 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
+ 
+ 	return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+ }
+-#endif
+ 
+ struct do_proc_dointvec_minmax_conv_param {
+ 	int *min;
+@@ -2554,8 +2622,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
  			*i = val;
  		} else {
  			val = convdiv * (*i) / convmul;
@@ -69134,7 +69136,7 @@ index f03a6ef..5fcc8af 100644
  			err = proc_put_long(&buffer, &left, val, false);
  			if (err)
  				break;
-@@ -2950,6 +3025,12 @@ int proc_dostring(struct ctl_table *table, int write,
+@@ -2950,6 +3021,12 @@ int proc_dostring(struct ctl_table *table, int write,
  	return -ENOSYS;
  }
  
@@ -69147,7 +69149,7 @@ index f03a6ef..5fcc8af 100644
  int proc_dointvec(struct ctl_table *table, int write,
  		  void __user *buffer, size_t *lenp, loff_t *ppos)
  {
-@@ -3006,6 +3087,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
+@@ -3006,6 +3083,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
  EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
  EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
  EXPORT_SYMBOL(proc_dostring);
@@ -70036,7 +70038,7 @@ index 0000000..7cd6065
 @@ -0,0 +1 @@
 +-grsec
 diff --git a/mm/Kconfig b/mm/Kconfig
-index e338407..49b5b7a 100644
+index e338407..4210331 100644
 --- a/mm/Kconfig
 +++ b/mm/Kconfig
 @@ -247,10 +247,10 @@ config KSM
@@ -70053,6 +70055,15 @@ index e338407..49b5b7a 100644
  	  This is the portion of low virtual memory which should be protected
  	  from userspace allocation.  Keeping a user from writing to low pages
  	  can help reduce the impact of kernel NULL pointer bugs.
+@@ -280,7 +280,7 @@ config MEMORY_FAILURE
+ 
+ config HWPOISON_INJECT
+ 	tristate "HWPoison pages injector"
+-	depends on MEMORY_FAILURE && DEBUG_KERNEL && PROC_FS
++	depends on MEMORY_FAILURE && DEBUG_KERNEL && PROC_FS && !GRKERNSEC
+ 	select PROC_PAGE_MONITOR
+ 
+ config NOMMU_INITIAL_TRIM_EXCESS
 diff --git a/mm/filemap.c b/mm/filemap.c
 index b662757..3081ddd 100644
 --- a/mm/filemap.c
@@ -70133,7 +70144,7 @@ index 8f7fc39..69bf1e9 100644
  	/* if an huge pmd materialized from under us just retry later */
  	if (unlikely(pmd_trans_huge(*pmd)))
 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index fece520..7fad868 100644
+index fece520..e10da7f 100644
 --- a/mm/hugetlb.c
 +++ b/mm/hugetlb.c
 @@ -2146,6 +2146,15 @@ static void hugetlb_vm_op_open(struct vm_area_struct *vma)
@@ -70280,12 +70291,13 @@ index fece520..7fad868 100644
  	}
  
  	/*
-@@ -3009,6 +3076,9 @@ int hugetlb_reserve_pages(struct inode *inode,
+@@ -3009,6 +3076,10 @@ int hugetlb_reserve_pages(struct inode *inode,
  	if (!vma || vma->vm_flags & VM_MAYSHARE)
  		region_add(&inode->i_mapping->private_list, from, to);
  	return 0;
 +out_err:
-+	resv_map_put(vma);
++	if (vma)
++		resv_map_put(vma);
 +	return ret;
  }
  
@@ -74088,7 +74100,7 @@ index 136ac4f..f917fa9 100644
  	mm->unmap_area = arch_unmap_area;
  }
 diff --git a/mm/vmalloc.c b/mm/vmalloc.c
-index 86ce9a5..fc9fb61 100644
+index 86ce9a5..550d03c 100644
 --- a/mm/vmalloc.c
 +++ b/mm/vmalloc.c
 @@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
@@ -74287,6 +74299,17 @@ index 86ce9a5..fc9fb61 100644
  	if ((PAGE_SIZE-1) & (unsigned long)addr)
  		return -EINVAL;
  
+@@ -2375,8 +2442,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
+ 		return NULL;
+ 	}
+ 
+-	vms = kzalloc(sizeof(vms[0]) * nr_vms, GFP_KERNEL);
+-	vas = kzalloc(sizeof(vas[0]) * nr_vms, GFP_KERNEL);
++	vms = kcalloc(nr_vms, sizeof(vms[0]), GFP_KERNEL);
++	vas = kcalloc(nr_vms, sizeof(vas[0]), GFP_KERNEL);
+ 	if (!vas || !vms)
+ 		goto err_free2;
+ 
 diff --git a/mm/vmstat.c b/mm/vmstat.c
 index f600557..1459fc8 100644
 --- a/mm/vmstat.c
@@ -78186,28 +78209,6 @@ index 1ac414f..a1c1451 100644
  # Remove .so files from "xxx-objs"
  host-cobjs	:= $(filter-out %.so,$(host-cobjs))
  
-diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
-index 00c368c..bb3f3e9 100644
---- a/scripts/Makefile.lib
-+++ b/scripts/Makefile.lib
-@@ -144,14 +144,14 @@ __a_flags	=                          $(call flags,_a_flags)
- __cpp_flags     =                          $(call flags,_cpp_flags)
- endif
- 
--c_flags        = -Wp,-MD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
-+c_flags        = -Wp,-MD,$(depfile) $(LINUXINCLUDE) $(NOSTDINC_FLAGS)     \
- 		 $(__c_flags) $(modkern_cflags)                           \
- 		 -D"KBUILD_STR(s)=\#s" $(basename_flags) $(modname_flags)
- 
--a_flags        = -Wp,-MD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
-+a_flags        = -Wp,-MD,$(depfile) $(LINUXINCLUDE) $(NOSTDINC_FLAGS)     \
- 		 $(__a_flags) $(modkern_aflags)
- 
--cpp_flags      = -Wp,-MD,$(depfile) $(NOSTDINC_FLAGS) $(LINUXINCLUDE)     \
-+cpp_flags      = -Wp,-MD,$(depfile) $(LINUXINCLUDE) $(NOSTDINC_FLAGS)     \
- 		 $(__cpp_flags)
- 
- ld_flags       = $(LDFLAGS) $(ldflags-y)
 diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
 index cb1f50c..cef2a7c 100644
 --- a/scripts/basic/fixdep.c
@@ -80350,10 +80351,10 @@ index 0000000..ee950d0
 +}
 diff --git a/tools/gcc/constify_plugin.c b/tools/gcc/constify_plugin.c
 new file mode 100644
-index 0000000..88a7438
+index 0000000..89b7f56
 --- /dev/null
 +++ b/tools/gcc/constify_plugin.c
-@@ -0,0 +1,303 @@
+@@ -0,0 +1,328 @@
 +/*
 + * Copyright 2011 by Emese Revfy <re.emese@×××××.com>
 + * Copyright 2011 by PaX Team <pageexec@××××××××.hu>
@@ -80394,24 +80395,47 @@ index 0000000..88a7438
 +int plugin_is_GPL_compatible;
 +
 +static struct plugin_info const_plugin_info = {
-+	.version	= "201111150100",
++	.version	= "201205300030",
 +	.help		= "no-constify\tturn off constification\n",
 +};
 +
-+static void constify_type(tree type);
-+static bool walk_struct(tree node);
++static void deconstify_tree(tree node);
 +
-+static tree deconstify_type(tree old_type)
++static void deconstify_type(tree type)
 +{
-+	tree new_type, field;
++	tree field;
++
++	for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
++		tree type = TREE_TYPE(field);
++
++		if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
++			continue;
++		if (!TYPE_READONLY(type))
++			continue;
++
++		deconstify_tree(field);
++	}
++	TYPE_READONLY(type) = 0;
++	C_TYPE_FIELDS_READONLY(type) = 0;
++}
++
++static void deconstify_tree(tree node)
++{
++	tree old_type, new_type, field;
++
++	old_type = TREE_TYPE(node);
++
++	gcc_assert(TYPE_READONLY(old_type) && (TYPE_QUALS(old_type) & TYPE_QUAL_CONST));
 +
 +	new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
 +	TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
 +	for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
 +		DECL_FIELD_CONTEXT(field) = new_type;
-+	TYPE_READONLY(new_type) = 0;
-+	C_TYPE_FIELDS_READONLY(new_type) = 0;
-+	return new_type;
++
++	deconstify_type(new_type);
++
++	TREE_READONLY(node) = 0;
++	TREE_TYPE(node) = new_type;
 +}
 +
 +static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
@@ -80455,14 +80479,19 @@ index 0000000..88a7438
 +	}
 +
 +	if (TREE_CODE(*node) == TYPE_DECL) {
-+		TREE_TYPE(*node) = deconstify_type(type);
-+		TREE_READONLY(*node) = 0;
++		deconstify_tree(*node);
 +		return NULL_TREE;
 +	}
 +
 +	return NULL_TREE;
 +}
 +
++static void constify_type(tree type)
++{
++	TYPE_READONLY(type) = 1;
++	C_TYPE_FIELDS_READONLY(type) = 1;
++}
++
 +static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
 +{
 +	*no_add_attrs = true;
@@ -80513,12 +80542,6 @@ index 0000000..88a7438
 +	register_attribute(&do_const_attr);
 +}
 +
-+static void constify_type(tree type)
-+{
-+	TYPE_READONLY(type) = 1;
-+	C_TYPE_FIELDS_READONLY(type) = 1;
-+}
-+
 +static bool is_fptr(tree field)
 +{
 +	tree ptr = TREE_TYPE(field);
@@ -80533,11 +80556,14 @@ index 0000000..88a7438
 +{
 +	tree field;
 +
-+	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node)))
++	if (TYPE_FIELDS(node) == NULL_TREE)
 +		return false;
 +
-+	if (TYPE_FIELDS(node) == NULL_TREE)
++	if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node))) {
++		gcc_assert(!TYPE_READONLY(node));
++		deconstify_type(node);
 +		return false;
++	}
 +
 +	for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
 +		tree type = TREE_TYPE(field);
@@ -95204,7 +95230,7 @@ index 0000000..ce7366b
 +};
 diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
 new file mode 100644
-index 0000000..4154daf
+index 0000000..92b8ee6
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin.c
 @@ -0,0 +1,1188 @@
@@ -95430,7 +95456,7 @@ index 0000000..4154daf
 +	const char *curfunc = NAME(func);
 +
 +	new_hash = get_hash_num(curfunc, filename, 0);
-+	inform(loc, "Function %s is missing from the size_overflow hash table +%s+%d+%u+%s+", curfunc, curfunc, argnum, new_hash, filename);
++//	inform(loc, "Function %s is missing from the size_overflow hash table +%s+%d+%u+%s+", curfunc, curfunc, argnum, new_hash, filename);
 +}
 +
 +static void check_missing_attribute(tree arg)