grsec: Apply grsecurity-3.0-3.14.25-201412040016.patch

commit b0928449ad9f170bafa931ed5ca1d13ee8eace3f
Author: Andrew Morton <akpm@linux-foundation.org>
Date:   Tue Dec 2 15:59:31 2014 -0800

    drivers/input/evdev.c: don't kfree() a vmalloc address

    If kzalloc() failed and then evdev_open_device() fails, evdev_open()
    will pass a vmalloc'ed pointer to kfree.

    This might fix https://bugzilla.kernel.org/show_bug.cgi?id=88401, where
    there was a crash in kfree().

    Reported-by: Christian Casteyde <casteyde.christian@free.fr>
    Belatedly-Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Cc: Henrik Rydberg <rydberg@euromail.se>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 drivers/input/evdev.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

commit 769ee85c77d75bb99e274c41839b0e0d6503ee81
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Tue May 6 14:02:53 2014 -0400

    nick kvfree() from apparmor

    too many places open-code it

    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

 include/linux/mm.h                   |    2 ++
 mm/util.c                            |   10 ++++++++++
 security/apparmor/include/apparmor.h |    1 -
 security/apparmor/lib.c              |   14 --------------
 4 files changed, 12 insertions(+), 15 deletions(-)

commit 05b53293e80b694b5c8ca15cd98bac24e556632b
Author: Thomas Graf <tgraf@suug.ch>
Date:   Wed Nov 26 13:42:17 2014 +0100

    net: Validate IFLA_BRIDGE_MODE attribute length

    Payload is currently accessed blindly and may exceed valid message
    boundaries.

    Fixes: a77dcb8c8 ("be2net: set and query VEB/VEPA mode of the PF interface")
    Fixes: 815cccbf1 ("ixgbe: add setlink, getlink support to ixgbe and ixgbevf")
    Cc: Ajit Khaparde <ajit.khaparde@emulex.com>
    Cc: John Fastabend <john.r.fastabend@intel.com>
    Signed-off-by: Thomas Graf <tgraf@suug.ch>
    Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Acked-by: John Fastabend <john.r.fastabend@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

 drivers/net/ethernet/emulex/benet/be_main.c   |    3 +++
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c |    3 +++
 2 files changed, 6 insertions(+), 0 deletions(-)

commit 422b14820d1548a7a4be21e07bbcadf913eeae1d
Author: Thomas Graf <tgraf@suug.ch>
Date:   Wed Nov 26 13:42:16 2014 +0100

    bridge: Validate IFLA_BRIDGE_FLAGS attribute length

    Payload is currently accessed blindly and may exceed valid message
    boundaries.

    Fixes: 407af3299 ("bridge: Add netlink interface to configure vlans on bridge ports")
    Cc: Vlad Yasevich <vyasevic@redhat.com>
    Signed-off-by: Thomas Graf <tgraf@suug.ch>
    Signed-off-by: David S. Miller <davem@davemloft.net>

 net/core/rtnetlink.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

commit 545b27325d689dca6cdf96f67def3715110c48d6
Author: Seth Forshee <seth.forshee@canonical.com>
Date:   Tue Nov 25 20:28:24 2014 -0600

    xen-netfront: Remove BUGs on paged skb data which crosses a page boundary

    These BUGs can be erroneously triggered by frags which refer to
    tail pages within a compound page. The data in these pages may
    overrun the hardware page while still being contained within the
    compound page, but since compound_order() evaluates to 0 for tail
    pages the assertion fails. The code already iterates through
    subsequent pages correctly in this scenario, so the BUGs are
    unnecessary and can be removed.

    Fixes: f36c374782e4 ("xen/netfront: handle compound page fragments on transmit")
    Cc: <stable@vger.kernel.org> # 3.7+
    Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
    Reviewed-by: David Vrabel <david.vrabel@citrix.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

 drivers/net/xen-netfront.c |    5 -----
 1 files changed, 0 insertions(+), 5 deletions(-)

commit 9264712d407a4235e522185e834181364680b6ea
Author: Daniel Forrest <dan.forrest@ssec.wisc.edu>
Date:   Tue Dec 2 15:59:42 2014 -0800

    mm: fix anon_vma_clone() error treatment

    Andrew Morton noticed that the error return from anon_vma_clone() was
    being dropped and replaced with -ENOMEM (which is not itself a bug
    because the only error return value from anon_vma_clone() is -ENOMEM).

    I did an audit of callers of anon_vma_clone() and discovered an actual
    bug where the error return was being lost.  In __split_vma(), between
    Linux 3.11 and 3.12 the code was changed so the err variable is used
    before the call to anon_vma_clone() and the default initial value of
    -ENOMEM is overwritten.  So a failure of anon_vma_clone() will return
    success since err at this point is now zero.

    Below is a patch which fixes this bug and also propagates the error
    return value from anon_vma_clone() in all cases.

    Fixes: ef0855d334e1 ("mm: mempolicy: turn vma_set_policy() into vma_dup_policy()")
    Signed-off-by: Daniel Forrest <dan.forrest@ssec.wisc.edu>
    Reviewed-by: Michal Hocko <mhocko@suse.cz>
    Cc: Konstantin Khlebnikov <koct9i@gmail.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Tim Hartrick <tim@edgecast.com>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Michel Lespinasse <walken@google.com>
    Cc: Vlastimil Babka <vbabka@suse.cz>
    Cc: <stable@vger.kernel.org>	[3.12+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 mm/mmap.c |   10 +++++++---
 mm/rmap.c |    6 ++++--
 2 files changed, 11 insertions(+), 5 deletions(-)

commit 5b20198c53fa3422504f8237d69636efffc953f5
Author: Hugh Dickins <hughd@google.com>
Date:   Tue Dec 2 15:59:39 2014 -0800

    mm: fix swapoff hang after page migration and fork

    I've been seeing swapoff hangs in recent testing: it's cycling around
    trying unsuccessfully to find an mm for some remaining pages of swap.

    I have been exercising swap and page migration more heavily recently,
    and now notice a long-standing error in copy_one_pte(): it's trying to
    add dst_mm to swapoff's mmlist when it finds a swap entry, but is doing
    so even when it's a migration entry or an hwpoison entry.

    Which wouldn't matter much, except it adds dst_mm next to src_mm,
    assuming src_mm is already on the mmlist: which may not be so.  Then if
    pages are later swapped out from dst_mm, swapoff won't be able to find
    where to replace them.

    There's already a !non_swap_entry() test for stats: move that up before
    the swap_duplicate() and the addition to mmlist.

    Signed-off-by: Hugh Dickins <hughd@google.com>
    Cc: Kelley Nielsen <kelleynnn@gmail.com>
    Cc: <stable@vger.kernel.org>	[2.6.18+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 mm/memory.c |   26 +++++++++++++-------------
 1 files changed, 13 insertions(+), 13 deletions(-)

commit ef9d34871c5dedf9d14361c93dffa96dbb3066ec
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Tue Dec 2 15:59:37 2014 -0800

    fat: fix oops on corrupted vfat fs

    a) don't bother with ->d_time for positives - we only check it for
       negatives anyway.

    b) make sure to set it at unlink and rmdir time - at *that* point
       soon-to-be negative dentry matches then-current directory contents

    c) don't go into renaming of old alias in vfat_lookup() unless it
       has the same parent (which it will, unless we are seeing corrupted
       image)

    [hirofumi@mail.parknet.co.jp: make change minimum, don't call d_move() for dir]
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
    Cc: <stable@vger.kernel.org>	[3.17.x]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 fs/fat/namei_vfat.c |   20 +++++++++++---------
 1 files changed, 11 insertions(+), 9 deletions(-)

commit 632d934d3f8e4b1badb567d417c25cb1936a293a
Author: Andrew Morton <akpm@linux-foundation.org>
Date:   Tue Dec 2 15:59:28 2014 -0800

    mm/vmpressure.c: fix race in vmpressure_work_fn()

    In some android devices, there will be a "divide by zero" exception.
    vmpr->scanned could be zero before spin_lock(&vmpr->sr_lock).

    Addresses https://bugzilla.kernel.org/show_bug.cgi?id=88051

    [akpm@linux-foundation.org: neaten]
    Reported-by: ji_ang <ji_ang@163.com>
    Cc: Anton Vorontsov <anton.vorontsov@linaro.org>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 mm/vmpressure.c |    8 +++++---
 1 files changed, 5 insertions(+), 3 deletions(-)

commit 75f61b76c5c1fa03d7042cb531d2157efbc916d4
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Dec 2 07:26:25 2014 -0500

    change name

 security/Kconfig |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

commit 23df2bcff0e427c06e0c179ce075da882874bd1d
Author: Brad Spengler <spender@grsecurity.net>
Date:   Tue Dec 2 07:24:49 2014 -0500

    add Hyper-V to auto-configuration

 security/Kconfig |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

Signature-tree: 521a9c2386136b795b20213bfc0f30a85b5a2598