grsec: Apply grsecurity-3.0-3.17.1-201410281754.patch

commit f782e7c4f9b32a41485203bfa7e02c8057c26f90
Author: Will Deacon <will.deacon@arm.com>
Date:   Tue Oct 28 13:16:28 2014 -0700

    zap_pte_range: update addr when forcing flush after TLB batching faiure

    When unmapping a range of pages in zap_pte_range, the page being
    unmapped is added to an mmu_gather_batch structure for asynchronous
    freeing. If we run out of space in the batch structure before the range
    has been completely unmapped, then we break out of the loop, force a
    TLB flush and free the pages that we have batched so far. If there are
    further pages to unmap, then we resume the loop where we left off.

    Unfortunately, we forget to update addr when we break out of the loop,
    which causes us to truncate the range being invalidated as the end
    address is exclusive. When we re-enter the loop at the same address, the
    page has already been freed and the pte_present test will fail, meaning
    that we do not reconsider the address for invalidation.

    This patch fixes the problem by incrementing addr by the PAGE_SIZE
    before breaking out of the loop on batch failure.

    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 mm/memory.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

commit 31bf45ac526cd677844b3fe0fbbc498302973e0c
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Thu Oct 23 13:26:21 2014 -0400

    fix inode leaks on d_splice_alias() failure exits

    d_splice_alias() callers expect it to either stash the inode reference
    into a new alias, or drop the inode reference.  That makes it possible
    to just return d_splice_alias() result from ->lookup() instance, without
    any extra housekeeping required.

    Unfortunately, that should include the failure exits.  If d_splice_alias()
    returns an error, it leaves the dentry it has been given negative and
    thus it *must* drop the inode reference.  Easily fixed, but it goes way
    back and will need backporting.

    Cc: stable@vger.kernel.org
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

 fs/dcache.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

Signature-tree: ed3468dfaf8e3129ed442a9b0daa00b42e5b3d25