Grsec/PaX: 2.9.1-{2.6.32.59,3.2.23,3.4.5}-20120716180720120716

15 files changed, 408 insertions, 313 deletions

diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 4c6a85a..314261e 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -30,7 +30,7 @@ Patch:	1058_linux-2.6.32.59.patch
 From:	http://www.kernel.org
 Desc:	Linux 2.6.32.59
 
-Patch:	4420_grsecurity-2.9.1-2.6.32.59-201207150915.patch
+Patch:	4420_grsecurity-2.9.1-2.6.32.59-201207161806.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201207150915.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201207161806.patch
index 06ab77c..ffb303b 100644
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201207150915.patch
+++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.59-201207161806.patch
@@ -67496,7 +67496,7 @@ index a240b6f..4ce16ef 100644
  	.store	= btrfs_root_attr_store,
  };
 diff --git a/fs/buffer.c b/fs/buffer.c
-index 6fa5302..395d9f6 100644
+index 6fa5302..abbfa0b 100644
 --- a/fs/buffer.c
 +++ b/fs/buffer.c
 @@ -25,6 +25,7 @@
@@ -67507,6 +67507,47 @@ index 6fa5302..395d9f6 100644
  #include <linux/blkdev.h>
  #include <linux/file.h>
  #include <linux/quotaops.h>
+@@ -1091,6 +1092,9 @@ grow_buffers(struct block_device *bdev, sector_t block, int size)
+ static struct buffer_head *
+ __getblk_slow(struct block_device *bdev, sector_t block, int size)
+ {
++	int ret;
++	struct buffer_head *bh;
++
+ 	/* Size must be multiple of hard sectorsize */
+ 	if (unlikely(size & (bdev_logical_block_size(bdev)-1) ||
+ 			(size < 512 || size > PAGE_SIZE))) {
+@@ -1103,20 +1107,21 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size)
+ 		return NULL;
+ 	}
+ 
+-	for (;;) {
+-		struct buffer_head * bh;
+-		int ret;
++retry:
++	bh = __find_get_block(bdev, block, size);
++	if (bh)
++		return bh;
+ 
++	ret = grow_buffers(bdev, block, size);
++	if (ret == 0) {
++		free_more_memory();
++		goto retry;
++	} else if (ret > 0) {
+ 		bh = __find_get_block(bdev, block, size);
+ 		if (bh)
+ 			return bh;
+-
+-		ret = grow_buffers(bdev, block, size);
+-		if (ret < 0)
+-			return NULL;
+-		if (ret == 0)
+-			free_more_memory();
+ 	}
++	return NULL;
+ }
+ 
+ /*
 diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
 index 3797e00..ce776f6 100644
 --- a/fs/cachefiles/bind.c
@@ -93081,10 +93122,36 @@ index 0f8fae3..66af9b1 100644
  		get_task_struct(p);
  		read_unlock(&tasklist_lock);
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 4bde56f..21a5033 100644
+index 4bde56f..3b4eec9 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
-@@ -253,7 +253,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
+@@ -239,21 +239,26 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
+ 	}
+ 
+  	err = arch_dup_task_struct(tsk, orig);
+-	if (err)
+-		goto out;
++	/*
++	 * We defer looking at err, because we will need this setup
++	 * for the clean up path to work correctly.
++	 */
+ 
+ 	tsk->stack = ti;
+-
+-	err = prop_local_init_single(&tsk->dirties);
+-	if (err)
+-		goto out;
+-
+ 	setup_thread_stack(tsk, orig);
++
++	if (err)
++		goto out;
++
++	err = prop_local_init_single(&tsk->dirties);
++	if (err)
++		goto out;
++
+ 	stackend = end_of_stack(tsk);
  	*stackend = STACK_END_MAGIC;	/* for overflow detection */
  
  #ifdef CONFIG_CC_STACKPROTECTOR
@@ -93093,7 +93160,7 @@ index 4bde56f..21a5033 100644
  #endif
  
  	/* One for us, one for whoever does the "release_task()" (usually parent) */
-@@ -293,8 +293,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -293,8 +298,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
  	mm->locked_vm = 0;
  	mm->mmap = NULL;
  	mm->mmap_cache = NULL;
@@ -93104,7 +93171,7 @@ index 4bde56f..21a5033 100644
  	mm->map_count = 0;
  	cpumask_clear(mm_cpumask(mm));
  	mm->mm_rb = RB_ROOT;
-@@ -318,7 +318,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -318,7 +323,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
  		}
  		charge = 0;
  		if (mpnt->vm_flags & VM_ACCOUNT) {
@@ -93113,7 +93180,7 @@ index 4bde56f..21a5033 100644
  			if (security_vm_enough_memory(len))
  				goto fail_nomem;
  			charge = len;
-@@ -335,6 +335,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -335,6 +340,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
  		tmp->vm_flags &= ~VM_LOCKED;
  		tmp->vm_mm = mm;
  		tmp->vm_next = tmp->vm_prev = NULL;
@@ -93121,7 +93188,7 @@ index 4bde56f..21a5033 100644
  		anon_vma_link(tmp);
  		file = tmp->vm_file;
  		if (file) {
-@@ -384,6 +385,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -384,6 +390,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
  		if (retval)
  			goto out;
  	}
@@ -93153,7 +93220,7 @@ index 4bde56f..21a5033 100644
  	/* a new mm has just been created */
  	arch_dup_mmap(oldmm, mm);
  	retval = 0;
-@@ -734,13 +760,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
+@@ -734,13 +765,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
  			write_unlock(&fs->lock);
  			return -EAGAIN;
  		}
@@ -93169,7 +93236,7 @@ index 4bde56f..21a5033 100644
  	return 0;
  }
  
-@@ -1033,12 +1060,16 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+@@ -1033,12 +1065,16 @@ static struct task_struct *copy_process(unsigned long clone_flags,
  	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
  #endif
  	retval = -EAGAIN;
@@ -93188,7 +93255,7 @@ index 4bde56f..21a5033 100644
  
  	retval = copy_creds(p, clone_flags);
  	if (retval < 0)
-@@ -1233,6 +1264,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+@@ -1233,6 +1269,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
  	/* Need tasklist lock for parent etc handling! */
  	write_lock_irq(&tasklist_lock);
  
@@ -93198,7 +93265,7 @@ index 4bde56f..21a5033 100644
  	/* CLONE_PARENT re-uses the old parent */
  	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
  		p->real_parent = current->real_parent;
-@@ -1299,7 +1333,8 @@ bad_fork_free_pid:
+@@ -1299,7 +1338,8 @@ bad_fork_free_pid:
  	if (pid != &init_struct_pid)
  		free_pid(pid);
  bad_fork_cleanup_io:
@@ -93208,7 +93275,7 @@ index 4bde56f..21a5033 100644
  bad_fork_cleanup_namespaces:
  	exit_task_namespaces(p);
  bad_fork_cleanup_mm:
-@@ -1333,6 +1368,8 @@ bad_fork_cleanup_count:
+@@ -1333,6 +1373,8 @@ bad_fork_cleanup_count:
  bad_fork_free:
  	free_task(p);
  fork_out:
@@ -93217,7 +93284,7 @@ index 4bde56f..21a5033 100644
  	return ERR_PTR(retval);
  }
  
-@@ -1426,6 +1463,8 @@ long do_fork(unsigned long clone_flags,
+@@ -1426,6 +1468,8 @@ long do_fork(unsigned long clone_flags,
  		if (clone_flags & CLONE_PARENT_SETTID)
  			put_user(nr, parent_tidptr);
  
@@ -93226,7 +93293,7 @@ index 4bde56f..21a5033 100644
  		if (clone_flags & CLONE_VFORK) {
  			p->vfork_done = &vfork;
  			init_completion(&vfork);
-@@ -1558,7 +1597,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1558,7 +1602,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
  		return 0;
  
  	/* don't need lock here; in the worst case we'll do useless copy */
@@ -93235,7 +93302,7 @@ index 4bde56f..21a5033 100644
  		return 0;
  
  	*new_fsp = copy_fs_struct(fs);
-@@ -1681,7 +1720,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -1681,7 +1725,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
  			fs = current->fs;
  			write_lock(&fs->lock);
  			current->fs = new_fs;
diff --git a/2.6.32/4450_grsec-kconfig-default-gids.patch b/2.6.32/4450_grsec-kconfig-default-gids.patch
index 038bb2e..3bf6bd2 100644
--- a/2.6.32/4450_grsec-kconfig-default-gids.patch
+++ b/2.6.32/4450_grsec-kconfig-default-gids.patch
@@ -73,7 +73,7 @@ diff -Nuar a/grsecurity/Kconfig b/Kconfig
 diff -Nuar a/security/Kconfig b/security/Kconfig
 --- a/security/Kconfig	2012-07-01 12:51:41.000000000 -0400
 +++ b/security/Kconfig	2012-07-01 13:00:23.000000000 -0400
-@@ -186,7 +186,7 @@
+@@ -187,7 +187,7 @@
  
  config GRKERNSEC_PROC_GID
  	int "GID exempted from /proc restrictions"
diff --git a/3.2.23/0000_README b/3.2.23/0000_README
index 79f060b..9f100ed 100644
--- a/3.2.23/0000_README
+++ b/3.2.23/0000_README
@@ -10,7 +10,7 @@ Patch:	1022_linux-3.2.23.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.23
 
-Patch:	4420_grsecurity-2.9.1-3.2.23-201207122159.patch
+Patch:	4420_grsecurity-2.9.1-3.2.23-201207161806.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.23/4420_grsecurity-2.9.1-3.2.23-201207122159.patch b/3.2.23/4420_grsecurity-2.9.1-3.2.23-201207161806.patch
index 7052c62..7e92b92 100644
--- a/3.2.23/4420_grsecurity-2.9.1-3.2.23-201207122159.patch
+++ b/3.2.23/4420_grsecurity-2.9.1-3.2.23-201207161806.patch
@@ -43549,6 +43549,51 @@ index cfb5543..1ae7347 100644
  
  	if (!del) {
  		spin_lock(&rc->reloc_root_tree.lock);
+diff --git a/fs/buffer.c b/fs/buffer.c
+index c807931..4115eca 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -1087,6 +1087,9 @@ grow_buffers(struct block_device *bdev, sector_t block, int size)
+ static struct buffer_head *
+ __getblk_slow(struct block_device *bdev, sector_t block, int size)
+ {
++	int ret;
++	struct buffer_head *bh;
++
+ 	/* Size must be multiple of hard sectorsize */
+ 	if (unlikely(size & (bdev_logical_block_size(bdev)-1) ||
+ 			(size < 512 || size > PAGE_SIZE))) {
+@@ -1099,20 +1102,21 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size)
+ 		return NULL;
+ 	}
+ 
+-	for (;;) {
+-		struct buffer_head * bh;
+-		int ret;
++retry:
++	bh = __find_get_block(bdev, block, size);
++	if (bh)
++		return bh;
+ 
++	ret = grow_buffers(bdev, block, size);
++	if (ret == 0) {
++		free_more_memory();
++		goto retry;
++	} else if (ret > 0) {
+ 		bh = __find_get_block(bdev, block, size);
+ 		if (bh)
+ 			return bh;
+-
+-		ret = grow_buffers(bdev, block, size);
+-		if (ret < 0)
+-			return NULL;
+-		if (ret == 0)
+-			free_more_memory();
+ 	}
++	return NULL;
+ }
+ 
+ /*
 diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
 index 622f469..e8d2d55 100644
 --- a/fs/cachefiles/bind.c
@@ -47162,9 +47207,18 @@ index 8392cb8..80d6193 100644
  	memcpy(c->data, &cookie, 4);
  	c->len=4;
 diff --git a/fs/locks.c b/fs/locks.c
-index 0d68f1f..f216b79 100644
+index 0d68f1f..3114738 100644
 --- a/fs/locks.c
 +++ b/fs/locks.c
+@@ -1465,7 +1465,7 @@ int generic_setlease(struct file *filp, long arg, struct file_lock **flp)
+ 	case F_WRLCK:
+ 		return generic_add_lease(filp, arg, flp);
+ 	default:
+-		BUG();
++		return -EINVAL;
+ 	}
+ }
+ EXPORT_SYMBOL(generic_setlease);
 @@ -2075,16 +2075,16 @@ void locks_remove_flock(struct file *filp)
  		return;
  
@@ -47929,6 +47983,19 @@ index c587e2d..3641eaa 100644
  
 -const struct inode_operations ntfs_empty_inode_ops = {};
 +const struct inode_operations ntfs_empty_inode_ops __read_only;
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index 07ee5b4..1c7d45e 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -1950,7 +1950,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
+ 	if (ret < 0)
+ 		mlog_errno(ret);
+ 
+-	if (file->f_flags & O_SYNC)
++	if (file && (file->f_flags & O_SYNC))
+ 		handle->h_sync = 1;
+ 
+ 	ocfs2_commit_trans(osb, handle);
 diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
 index 210c352..a174f83 100644
 --- a/fs/ocfs2/localalloc.c
@@ -62988,7 +63055,7 @@ index 1d1b1e1..2a13c78 100644
  
  #define pmdp_clear_flush_notify(__vma, __address, __pmdp)		\
 diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
-index 188cb2f..d78409b 100644
+index 188cb2f..d401c76 100644
 --- a/include/linux/mmzone.h
 +++ b/include/linux/mmzone.h
 @@ -369,7 +369,7 @@ struct zone {
@@ -63000,6 +63067,15 @@ index 188cb2f..d78409b 100644
  
  	/*
  	 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
+@@ -652,7 +652,7 @@ typedef struct pglist_data {
+ 					     range, including holes */
+ 	int node_id;
+ 	wait_queue_head_t kswapd_wait;
+-	struct task_struct *kswapd;
++	struct task_struct *kswapd;	/* Protected by lock_memory_hotplug() */
+ 	int kswapd_max_order;
+ 	enum zone_type classzone_idx;
+ } pg_data_t;
 diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
 index 468819c..17b9db3 100644
 --- a/include/linux/mod_devicetable.h
@@ -66679,10 +66755,30 @@ index 5a8a66e..ded4680 100644
  {
  	struct signal_struct *sig = current->signal;
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 79ee71f..2101311 100644
+index 79ee71f..5662f54 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
-@@ -282,7 +282,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
+@@ -270,19 +270,24 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
+ 	}
+ 
+ 	err = arch_dup_task_struct(tsk, orig);
+-	if (err)
+-		goto out;
+ 
++	/*
++	 * We defer looking at err, because we will need this setup
++	 * for the clean up path to work correctly.
++	 */
+ 	tsk->stack = ti;
+-
+ 	setup_thread_stack(tsk, orig);
++
++	if (err)
++		goto out;
++
+ 	clear_user_return_notifier(tsk);
+ 	clear_tsk_need_resched(tsk);
+ 	stackend = end_of_stack(tsk);
  	*stackend = STACK_END_MAGIC;	/* for overflow detection */
  
  #ifdef CONFIG_CC_STACKPROTECTOR
@@ -66691,7 +66787,7 @@ index 79ee71f..2101311 100644
  #endif
  
  	/*
-@@ -306,13 +306,78 @@ out:
+@@ -306,13 +311,78 @@ out:
  }
  
  #ifdef CONFIG_MMU
@@ -66772,7 +66868,7 @@ index 79ee71f..2101311 100644
  
  	down_write(&oldmm->mmap_sem);
  	flush_cache_dup_mm(oldmm);
-@@ -324,8 +389,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -324,8 +394,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
  	mm->locked_vm = 0;
  	mm->mmap = NULL;
  	mm->mmap_cache = NULL;
@@ -66783,7 +66879,7 @@ index 79ee71f..2101311 100644
  	mm->map_count = 0;
  	cpumask_clear(mm_cpumask(mm));
  	mm->mm_rb = RB_ROOT;
-@@ -341,8 +406,6 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -341,8 +411,6 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
  
  	prev = NULL;
  	for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
@@ -66792,7 +66888,7 @@ index 79ee71f..2101311 100644
  		if (mpnt->vm_flags & VM_DONTCOPY) {
  			long pages = vma_pages(mpnt);
  			mm->total_vm -= pages;
-@@ -350,54 +413,11 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -350,54 +418,11 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
  								-pages);
  			continue;
  		}
@@ -66851,7 +66947,7 @@ index 79ee71f..2101311 100644
  
  		/*
  		 * Link in the new vma and copy the page table entries.
-@@ -420,6 +440,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -420,6 +445,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
  		if (retval)
  			goto out;
  	}
@@ -66883,7 +66979,7 @@ index 79ee71f..2101311 100644
  	/* a new mm has just been created */
  	arch_dup_mmap(oldmm, mm);
  	retval = 0;
-@@ -428,14 +473,6 @@ out:
+@@ -428,14 +478,6 @@ out:
  	flush_tlb_mm(oldmm);
  	up_write(&oldmm->mmap_sem);
  	return retval;
@@ -66898,7 +66994,7 @@ index 79ee71f..2101311 100644
  }
  
  static inline int mm_alloc_pgd(struct mm_struct *mm)
-@@ -647,6 +684,26 @@ struct mm_struct *get_task_mm(struct task_struct *task)
+@@ -647,6 +689,26 @@ struct mm_struct *get_task_mm(struct task_struct *task)
  }
  EXPORT_SYMBOL_GPL(get_task_mm);
  
@@ -66925,7 +67021,7 @@ index 79ee71f..2101311 100644
  /* Please note the differences between mmput and mm_release.
   * mmput is called whenever we stop holding onto a mm_struct,
   * error success whatever.
-@@ -832,13 +889,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
+@@ -832,13 +894,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
  			spin_unlock(&fs->lock);
  			return -EAGAIN;
  		}
@@ -66941,7 +67037,7 @@ index 79ee71f..2101311 100644
  	return 0;
  }
  
-@@ -1102,6 +1160,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+@@ -1102,6 +1165,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
  	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
  #endif
  	retval = -EAGAIN;
@@ -66951,7 +67047,7 @@ index 79ee71f..2101311 100644
  	if (atomic_read(&p->real_cred->user->processes) >=
  			task_rlimit(p, RLIMIT_NPROC)) {
  		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
-@@ -1318,6 +1379,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+@@ -1318,6 +1384,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
  	/* Need tasklist lock for parent etc handling! */
  	write_lock_irq(&tasklist_lock);
  
@@ -66961,7 +67057,7 @@ index 79ee71f..2101311 100644
  	/* CLONE_PARENT re-uses the old parent */
  	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
  		p->real_parent = current->real_parent;
-@@ -1425,6 +1489,8 @@ bad_fork_cleanup_count:
+@@ -1425,6 +1494,8 @@ bad_fork_cleanup_count:
  bad_fork_free:
  	free_task(p);
  fork_out:
@@ -66970,7 +67066,7 @@ index 79ee71f..2101311 100644
  	return ERR_PTR(retval);
  }
  
-@@ -1525,6 +1591,8 @@ long do_fork(unsigned long clone_flags,
+@@ -1525,6 +1596,8 @@ long do_fork(unsigned long clone_flags,
  		if (clone_flags & CLONE_PARENT_SETTID)
  			put_user(nr, parent_tidptr);
  
@@ -66979,7 +67075,7 @@ index 79ee71f..2101311 100644
  		if (clone_flags & CLONE_VFORK) {
  			p->vfork_done = &vfork;
  			init_completion(&vfork);
-@@ -1634,7 +1702,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1634,7 +1707,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
  		return 0;
  
  	/* don't need lock here; in the worst case we'll do useless copy */
@@ -66988,7 +67084,7 @@ index 79ee71f..2101311 100644
  		return 0;
  
  	*new_fsp = copy_fs_struct(fs);
-@@ -1723,7 +1791,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -1723,7 +1796,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
  			fs = current->fs;
  			spin_lock(&fs->lock);
  			current->fs = new_fs;
@@ -75232,6 +75328,30 @@ index eeba3bb..820e22e 100644
  	if (!vas || !vms)
  		goto err_free;
  
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index fbe2d2c..72cf498 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3090,14 +3090,17 @@ int kswapd_run(int nid)
+ }
+ 
+ /*
+- * Called by memory hotplug when all memory in a node is offlined.
++ * Called by memory hotplug when all memory in a node is offlined.  Caller must
++ * hold lock_memory_hotplug().
+  */
+ void kswapd_stop(int nid)
+ {
+ 	struct task_struct *kswapd = NODE_DATA(nid)->kswapd;
+ 
+-	if (kswapd)
++	if (kswapd) {
+ 		kthread_stop(kswapd);
++		NODE_DATA(nid)->kswapd = NULL;
++	}
+ }
+ 
+ static int __init kswapd_init(void)
 diff --git a/mm/vmstat.c b/mm/vmstat.c
 index 8fd603b..cf0d930 100644
 --- a/mm/vmstat.c
diff --git a/3.2.23/4450_grsec-kconfig-default-gids.patch b/3.2.23/4450_grsec-kconfig-default-gids.patch
index 545e82e..0ab1250 100644
--- a/3.2.23/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.23/4450_grsec-kconfig-default-gids.patch
@@ -12,7 +12,7 @@ from shooting themselves in the foot.
 diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
 --- a/grsecurity/Kconfig	2011-12-12 16:54:30.000000000 -0500
 +++ b/grsecurity/Kconfig	2011-12-12 16:55:09.000000000 -0500
-@@ -443,7 +443,7 @@
+@@ -249,7 +249,7 @@
  config GRKERNSEC_PROC_GID
  	int "GID for special group"
  	depends on GRKERNSEC_PROC_USERGROUP
diff --git a/3.4.4/2600_FW_MIPS_FILE_06_regression.patch b/3.4.4/2600_FW_MIPS_FILE_06_regression.patch
deleted file mode 100644
index 0ad48d4..0000000
--- a/3.4.4/2600_FW_MIPS_FILE_06_regression.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Naur linux-3.4.2-hardened.orig//drivers/net/ethernet/broadcom/bnx2.c linux-3.4.2-hardened/drivers/net/ethernet/broadcom/bnx2.c
---- linux-3.4.2-hardened.orig//drivers/net/ethernet/broadcom/bnx2.c	2012-05-20 22:29:13.000000000 +0000
-+++ linux-3.4.2-hardened/drivers/net/ethernet/broadcom/bnx2.c	2012-07-03 11:38:35.437623841 +0000
-@@ -59,7 +59,7 @@
- #define DRV_MODULE_NAME		"bnx2"
- #define DRV_MODULE_VERSION	"2.2.1"
- #define DRV_MODULE_RELDATE	"Dec 18, 2011"
--#define FW_MIPS_FILE_06		"bnx2/bnx2-mips-06-6.2.3.fw"
-+#define FW_MIPS_FILE_06		"bnx2/bnx2-mips-06-6.2.1.fw"
- #define FW_RV2P_FILE_06		"bnx2/bnx2-rv2p-06-6.0.15.fw"
- #define FW_MIPS_FILE_09		"bnx2/bnx2-mips-09-6.2.1b.fw"
- #define FW_RV2P_FILE_09_Ax	"bnx2/bnx2-rv2p-09ax-6.0.17.fw"
diff --git a/3.4.4/0000_README b/3.4.5/0000_README
index f73a168..eaa4858 100644
--- a/3.4.4/0000_README
+++ b/3.4.5/0000_README
@@ -2,11 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	2600_FW_MIPS_FILE_06_regression.patch
-From:	Anthony G. Basile <blueness@gentoo.org>
-Desc:	Fix regressions against bnx2 firmware
-
-Patch:	4420_grsecurity-2.9.1-3.4.4-201207122200.patch
+Patch:	4420_grsecurity-2.9.1-3.4.5-201207161807.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.4.4/4420_grsecurity-2.9.1-3.4.4-201207122200.patch b/3.4.5/4420_grsecurity-2.9.1-3.4.5-201207161807.patch
index 826a3d4..43c8a0f 100644
--- a/3.4.4/4420_grsecurity-2.9.1-3.4.4-201207122200.patch
+++ b/3.4.5/4420_grsecurity-2.9.1-3.4.5-201207161807.patch
@@ -229,7 +229,7 @@ index c1601e5..08557ce 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 058320d..817f7ad 100644
+index a2e69a0..cc487da 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -8595,7 +8595,7 @@ index 07b3a68..bd2a388 100644
  	set_fs(KERNEL_DS);
  	has_dumped = 1;
 diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
-index a69245b..6d145f4 100644
+index 4f5bfac..e1ef0d3 100644
 --- a/arch/x86/ia32/ia32_signal.c
 +++ b/arch/x86/ia32/ia32_signal.c
 @@ -168,7 +168,7 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr,
@@ -10191,7 +10191,7 @@ index 99480e5..d81165b 100644
  	({								\
  	        __typeof__ (*(ptr)) __ret = (inc);			\
 diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
-index 340ee49..4238ced 100644
+index f91e80f..7f9bd27 100644
 --- a/arch/x86/include/asm/cpufeature.h
 +++ b/arch/x86/include/asm/cpufeature.h
 @@ -371,7 +371,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
@@ -11294,67 +11294,10 @@ index 98391db..8f6984e 100644
  
  static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
 diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
-index effff47..bbb8295 100644
+index cb00ccc..17e9054 100644
 --- a/arch/x86/include/asm/pgtable-3level.h
 +++ b/arch/x86/include/asm/pgtable-3level.h
-@@ -31,6 +31,56 @@ static inline void native_set_pte(pte_t *ptep, pte_t pte)
- 	ptep->pte_low = pte.pte_low;
- }
- 
-+#define  __HAVE_ARCH_READ_PMD_ATOMIC
-+/*
-+ * pte_offset_map_lock on 32bit PAE kernels was reading the pmd_t with
-+ * a "*pmdp" dereference done by gcc. Problem is, in certain places
-+ * where pte_offset_map_lock is called, concurrent page faults are
-+ * allowed, if the mmap_sem is hold for reading. An example is mincore
-+ * vs page faults vs MADV_DONTNEED. On the page fault side
-+ * pmd_populate rightfully does a set_64bit, but if we're reading the
-+ * pmd_t with a "*pmdp" on the mincore side, a SMP race can happen
-+ * because gcc will not read the 64bit of the pmd atomically. To fix
-+ * this all places running pmd_offset_map_lock() while holding the
-+ * mmap_sem in read mode, shall read the pmdp pointer using this
-+ * function to know if the pmd is null nor not, and in turn to know if
-+ * they can run pmd_offset_map_lock or pmd_trans_huge or other pmd
-+ * operations.
-+ *
-+ * Without THP if the mmap_sem is hold for reading, the
-+ * pmd can only transition from null to not null while read_pmd_atomic runs.
-+ * So there's no need of literally reading it atomically.
-+ *
-+ * With THP if the mmap_sem is hold for reading, the pmd can become
-+ * THP or null or point to a pte (and in turn become "stable") at any
-+ * time under read_pmd_atomic, so it's mandatory to read it atomically
-+ * with cmpxchg8b.
-+ */
-+#ifndef CONFIG_TRANSPARENT_HUGEPAGE
-+static inline pmd_t read_pmd_atomic(pmd_t *pmdp)
-+{
-+	pmdval_t ret;
-+	u32 *tmp = (u32 *)pmdp;
-+
-+	ret = (pmdval_t) (*tmp);
-+	if (ret) {
-+		/*
-+		 * If the low part is null, we must not read the high part
-+		 * or we can end up with a partial pmd.
-+		 */
-+		smp_rmb();
-+		ret |= ((pmdval_t)*(tmp + 1)) << 32;
-+	}
-+
-+	return __pmd(ret);
-+}
-+#else /* CONFIG_TRANSPARENT_HUGEPAGE */
-+static inline pmd_t read_pmd_atomic(pmd_t *pmdp)
-+{
-+	return __pmd(atomic64_read((atomic64_t *)pmdp));
-+}
-+#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
-+
- static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
- {
- 	set_64bit((unsigned long long *)(ptep), native_pte_val(pte));
-@@ -38,12 +88,16 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
+@@ -92,12 +92,16 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
  
  static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
  {
@@ -18885,7 +18828,7 @@ index 42eb330..139955c 100644
  
  	return ret;
 diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
-index d840e69..98e9581 100644
+index 3034ee5..7cfbfa6 100644
 --- a/arch/x86/kernel/reboot.c
 +++ b/arch/x86/kernel/reboot.c
 @@ -35,7 +35,7 @@ void (*pm_power_off)(void);
@@ -18968,7 +18911,7 @@ index d840e69..98e9581 100644
  }
  #ifdef CONFIG_APM_MODULE
  EXPORT_SYMBOL(machine_real_restart);
-@@ -556,7 +586,7 @@ void __attribute__((weak)) mach_reboot_fixups(void)
+@@ -564,7 +594,7 @@ void __attribute__((weak)) mach_reboot_fixups(void)
   * try to force a triple fault and then cycle between hitting the keyboard
   * controller and doing that
   */
@@ -18977,7 +18920,7 @@ index d840e69..98e9581 100644
  {
  	int i;
  	int attempt = 0;
-@@ -680,13 +710,13 @@ void native_machine_shutdown(void)
+@@ -688,13 +718,13 @@ void native_machine_shutdown(void)
  #endif
  }
  
@@ -18993,7 +18936,7 @@ index d840e69..98e9581 100644
  {
  	printk("machine restart\n");
  
-@@ -695,7 +725,7 @@ static void native_machine_restart(char *__unused)
+@@ -703,7 +733,7 @@ static void native_machine_restart(char *__unused)
  	__machine_emergency_restart(0);
  }
  
@@ -19002,7 +18945,7 @@ index d840e69..98e9581 100644
  {
  	/* stop other cpus and apics */
  	machine_shutdown();
-@@ -706,7 +736,7 @@ static void native_machine_halt(void)
+@@ -714,7 +744,7 @@ static void native_machine_halt(void)
  	stop_this_cpu(NULL);
  }
  
@@ -19011,7 +18954,7 @@ index d840e69..98e9581 100644
  {
  	if (pm_power_off) {
  		if (!reboot_force)
-@@ -715,6 +745,7 @@ static void native_machine_power_off(void)
+@@ -723,6 +753,7 @@ static void native_machine_power_off(void)
  	}
  	/* a fallback in case there is no PM info available */
  	tboot_shutdown(TB_SHUTDOWN_HALT);
@@ -30449,10 +30392,10 @@ index de43194..a14c4cc 100644
  	for (i = 0; i < count; i++) {
  		char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
 diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index f57e5cf..c82f79d 100644
+index 26c67a7..8d4cbcb 100644
 --- a/drivers/gpu/drm/i915/i915_irq.c
 +++ b/drivers/gpu/drm/i915/i915_irq.c
-@@ -472,7 +472,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
+@@ -496,7 +496,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
  	u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir;
  	struct drm_i915_master_private *master_priv;
  
@@ -30461,7 +30404,7 @@ index f57e5cf..c82f79d 100644
  
  	/* disable master interrupt before clearing iir  */
  	de_ier = I915_READ(DEIER);
-@@ -563,7 +563,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
+@@ -579,7 +579,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
  	struct drm_i915_master_private *master_priv;
  	u32 bsd_usr_interrupt = GT_BSD_USER_INTERRUPT;
  
@@ -30470,7 +30413,7 @@ index f57e5cf..c82f79d 100644
  
  	if (IS_GEN6(dev))
  		bsd_usr_interrupt = GT_GEN6_BSD_USER_INTERRUPT;
-@@ -1292,7 +1292,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
+@@ -1291,7 +1291,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
  	int ret = IRQ_NONE, pipe;
  	bool blc_event = false;
  
@@ -30479,7 +30422,7 @@ index f57e5cf..c82f79d 100644
  
  	iir = I915_READ(IIR);
  
-@@ -1803,7 +1803,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
+@@ -1802,7 +1802,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
  {
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  
@@ -30488,7 +30431,7 @@ index f57e5cf..c82f79d 100644
  
  	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
  	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
-@@ -1980,7 +1980,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev)
+@@ -1979,7 +1979,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev)
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  	int pipe;
  
@@ -33453,10 +33396,10 @@ index 1c2063c..9639970 100644
  
  struct md_personality
 diff --git a/drivers/md/persistent-data/dm-space-map-checker.c b/drivers/md/persistent-data/dm-space-map-checker.c
-index 50ed53b..4f29d7d 100644
+index fc90c11..c8cd9a9 100644
 --- a/drivers/md/persistent-data/dm-space-map-checker.c
 +++ b/drivers/md/persistent-data/dm-space-map-checker.c
-@@ -159,7 +159,7 @@ static void ca_destroy(struct count_array *ca)
+@@ -167,7 +167,7 @@ static int ca_commit(struct count_array *old, struct count_array *new)
  /*----------------------------------------------------------------*/
  
  struct sm_checker {
@@ -33466,7 +33409,7 @@ index 50ed53b..4f29d7d 100644
  	struct count_array old_counts;
  	struct count_array counts;
 diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c
-index fc469ba..2d91555 100644
+index 3d0ed53..35dc592 100644
 --- a/drivers/md/persistent-data/dm-space-map-disk.c
 +++ b/drivers/md/persistent-data/dm-space-map-disk.c
 @@ -23,7 +23,7 @@
@@ -33526,7 +33469,7 @@ index d7e9577..faa512f2 100644
  					       "md/raid1:%s: read error corrected "
  					       "(%d sectors at %llu on %s)\n",
 diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index d037adb..ed17dc9 100644
+index a954c95..6e7a21c 100644
 --- a/drivers/md/raid10.c
 +++ b/drivers/md/raid10.c
 @@ -1684,7 +1684,7 @@ static void end_sync_read(struct bio *bio, int error)
@@ -33589,10 +33532,10 @@ index d037adb..ed17dc9 100644
  
  			rdev_dec_pending(rdev, mddev);
 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index f351422..85c01bb 100644
+index 73a5800..2b0e3b1 100644
 --- a/drivers/md/raid5.c
 +++ b/drivers/md/raid5.c
-@@ -1686,18 +1686,18 @@ static void raid5_end_read_request(struct bio * bi, int error)
+@@ -1694,18 +1694,18 @@ static void raid5_end_read_request(struct bio * bi, int error)
  				(unsigned long long)(sh->sector
  						     + rdev->data_offset),
  				bdevname(rdev->bdev, b));
@@ -33615,7 +33558,7 @@ index f351422..85c01bb 100644
  		if (test_bit(R5_ReadRepl, &sh->dev[i].flags))
  			printk_ratelimited(
  				KERN_WARNING
-@@ -1726,7 +1726,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
+@@ -1734,7 +1734,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
  				(unsigned long long)(sh->sector
  						     + rdev->data_offset),
  				bdn);
@@ -34561,7 +34504,7 @@ index d783f4f..97fa1b0 100644
  	{"D-Link DFE-550FX 100Mbps Fiber-optics Adapter"},
  	{"D-Link DFE-580TX 4 port Server Adapter"},
 diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
-index 528a886..e6a98a3 100644
+index 1bbf6b3..430dcd0 100644
 --- a/drivers/net/ethernet/emulex/benet/be_main.c
 +++ b/drivers/net/ethernet/emulex/benet/be_main.c
 @@ -403,7 +403,7 @@ static void accumulate_16bit_val(u32 *acc, u16 val)
@@ -34924,7 +34867,7 @@ index 4a518a3..936b334 100644
  #define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath)				\
  		((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next)
 diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
-index ce6b44d..74f10c2 100644
+index 161e045..0bb5b86 100644
 --- a/drivers/net/ethernet/realtek/r8169.c
 +++ b/drivers/net/ethernet/realtek/r8169.c
 @@ -708,17 +708,17 @@ struct rtl8169_private {
@@ -35033,19 +34976,6 @@ index d6be64b..5d97e3b 100644
  
  	/* Ignore return since this msg is optional. */
  	rndis_filter_send_request(dev, request);
-diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
-index cb8fd50..003ec38 100644
---- a/drivers/net/macvtap.c
-+++ b/drivers/net/macvtap.c
-@@ -528,6 +528,8 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
- 		}
- 		base = (unsigned long)from->iov_base + offset1;
- 		size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
-+		if (i + size >= MAX_SKB_FRAGS)
-+			return -EFAULT;
- 		num_pages = get_user_pages_fast(base, size, 0, &page[i]);
- 		if ((num_pages != size) ||
- 		    (num_pages > MAX_SKB_FRAGS - skb_shinfo(skb)->nr_frags))
 diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
 index 21d7151..8034208 100644
 --- a/drivers/net/ppp/ppp_generic.c
@@ -35246,7 +35176,7 @@ index 2d2a688..35f2372 100644
  				    hso_start_serial_device(serial_table[i], GFP_NOIO);
  				hso_kick_transmit(dev2ser(serial_table[i]));
 diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
-index c54b7d37..af1f359 100644
+index 420d69b..74f90a2 100644
 --- a/drivers/net/wireless/ath/ath.h
 +++ b/drivers/net/wireless/ath/ath.h
 @@ -119,6 +119,7 @@ struct ath_ops {
@@ -36534,7 +36464,7 @@ index aceffad..c35c08d 100644
  	fc_frame_free(fp);
  }
 diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
-index 441d88a..689ad71 100644
+index d109cc3..09f4e7d 100644
 --- a/drivers/scsi/libsas/sas_ata.c
 +++ b/drivers/scsi/libsas/sas_ata.c
 @@ -529,7 +529,7 @@ static struct ata_port_operations sas_sata_ops = {
@@ -42695,6 +42625,51 @@ index 646ee21..f020f87 100644
  
  	if (!del) {
  		spin_lock(&rc->reloc_root_tree.lock);
+diff --git a/fs/buffer.c b/fs/buffer.c
+index ad5938c..0bc1bed 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -1036,6 +1036,9 @@ grow_buffers(struct block_device *bdev, sector_t block, int size)
+ static struct buffer_head *
+ __getblk_slow(struct block_device *bdev, sector_t block, int size)
+ {
++	int ret;
++	struct buffer_head *bh;
++
+ 	/* Size must be multiple of hard sectorsize */
+ 	if (unlikely(size & (bdev_logical_block_size(bdev)-1) ||
+ 			(size < 512 || size > PAGE_SIZE))) {
+@@ -1048,20 +1051,21 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size)
+ 		return NULL;
+ 	}
+ 
+-	for (;;) {
+-		struct buffer_head * bh;
+-		int ret;
++retry:
++	bh = __find_get_block(bdev, block, size);
++	if (bh)
++		return bh;
+ 
++	ret = grow_buffers(bdev, block, size);
++	if (ret == 0) {
++		free_more_memory();
++		goto retry;
++	} else if (ret > 0) {
+ 		bh = __find_get_block(bdev, block, size);
+ 		if (bh)
+ 			return bh;
+-
+-		ret = grow_buffers(bdev, block, size);
+-		if (ret < 0)
+-			return NULL;
+-		if (ret == 0)
+-			free_more_memory();
+ 	}
++	return NULL;
+ }
+ 
+ /*
 diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
 index 622f469..e8d2d55 100644
 --- a/fs/cachefiles/bind.c
@@ -43455,10 +43430,10 @@ index ab35b11..b30af66 100644
  		/* Free the char* */
  		kfree(buf);
 diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
-index 3a06f40..f7af544 100644
+index c0038f6..47ab347 100644
 --- a/fs/ecryptfs/miscdev.c
 +++ b/fs/ecryptfs/miscdev.c
-@@ -345,7 +345,7 @@ check_list:
+@@ -355,7 +355,7 @@ check_list:
  		goto out_unlock_msg_ctx;
  	i = PKT_TYPE_SIZE + PKT_CTR_SIZE;
  	if (msg_ctx->msg) {
@@ -43490,7 +43465,7 @@ index b2a34a1..162fa69 100644
  	return rc;
  }
 diff --git a/fs/exec.c b/fs/exec.c
-index b1fd202..582240d 100644
+index 29e5f84..ec81452 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
 @@ -55,6 +55,15 @@
@@ -46206,9 +46181,18 @@ index 8392cb8..80d6193 100644
  	memcpy(c->data, &cookie, 4);
  	c->len=4;
 diff --git a/fs/locks.c b/fs/locks.c
-index 0d68f1f..f216b79 100644
+index 0d68f1f..3114738 100644
 --- a/fs/locks.c
 +++ b/fs/locks.c
+@@ -1465,7 +1465,7 @@ int generic_setlease(struct file *filp, long arg, struct file_lock **flp)
+ 	case F_WRLCK:
+ 		return generic_add_lease(filp, arg, flp);
+ 	default:
+-		BUG();
++		return -EINVAL;
+ 	}
+ }
+ EXPORT_SYMBOL(generic_setlease);
 @@ -2075,16 +2075,16 @@ void locks_remove_flock(struct file *filp)
  		return;
  
@@ -47087,7 +47071,7 @@ index 5d22872..523db20 100644
  		kfree(link);
  }
 diff --git a/fs/open.c b/fs/open.c
-index 5720854..ccfe124 100644
+index 3f1108b..822d7f7 100644
 --- a/fs/open.c
 +++ b/fs/open.c
 @@ -31,6 +31,8 @@
@@ -48737,7 +48721,7 @@ index 0cbd049..cab1127 100644
  
  	if (op) {
 diff --git a/fs/splice.c b/fs/splice.c
-index f847684..156619e 100644
+index 5cac690..f833a99 100644
 --- a/fs/splice.c
 +++ b/fs/splice.c
 @@ -194,7 +194,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
@@ -48761,7 +48745,7 @@ index f847684..156619e 100644
  	}
  
  	pipe_unlock(pipe);
-@@ -560,7 +560,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
+@@ -563,7 +563,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -48770,7 +48754,7 @@ index f847684..156619e 100644
  	set_fs(old_fs);
  
  	return res;
-@@ -575,7 +575,7 @@ static ssize_t kernel_write(struct file *file, const char *buf, size_t count,
+@@ -578,7 +578,7 @@ static ssize_t kernel_write(struct file *file, const char *buf, size_t count,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -48779,7 +48763,7 @@ index f847684..156619e 100644
  	set_fs(old_fs);
  
  	return res;
-@@ -626,7 +626,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
+@@ -630,7 +630,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
  			goto err;
  
  		this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
@@ -48788,7 +48772,7 @@ index f847684..156619e 100644
  		vec[i].iov_len = this_len;
  		spd.pages[i] = page;
  		spd.nr_pages++;
-@@ -845,10 +845,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
+@@ -849,10 +849,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
  int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
  {
  	while (!pipe->nrbufs) {
@@ -48801,7 +48785,7 @@ index f847684..156619e 100644
  			return 0;
  
  		if (sd->flags & SPLICE_F_NONBLOCK)
-@@ -1181,7 +1181,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+@@ -1185,7 +1185,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
  		 * out of the pipe right after the splice_to_pipe(). So set
  		 * PIPE_READERS appropriately.
  		 */
@@ -48810,7 +48794,7 @@ index f847684..156619e 100644
  
  		current->splice_pipe = pipe;
  	}
-@@ -1733,9 +1733,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1738,9 +1738,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  			ret = -ERESTARTSYS;
  			break;
  		}
@@ -48822,7 +48806,7 @@ index f847684..156619e 100644
  			if (flags & SPLICE_F_NONBLOCK) {
  				ret = -EAGAIN;
  				break;
-@@ -1767,7 +1767,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1772,7 +1772,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  	pipe_lock(pipe);
  
  	while (pipe->nrbufs >= pipe->buffers) {
@@ -48831,7 +48815,7 @@ index f847684..156619e 100644
  			send_sig(SIGPIPE, current, 0);
  			ret = -EPIPE;
  			break;
-@@ -1780,9 +1780,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1785,9 +1785,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  			ret = -ERESTARTSYS;
  			break;
  		}
@@ -48843,7 +48827,7 @@ index f847684..156619e 100644
  	}
  
  	pipe_unlock(pipe);
-@@ -1818,14 +1818,14 @@ retry:
+@@ -1823,14 +1823,14 @@ retry:
  	pipe_double_lock(ipipe, opipe);
  
  	do {
@@ -48860,7 +48844,7 @@ index f847684..156619e 100644
  			break;
  
  		/*
-@@ -1922,7 +1922,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+@@ -1927,7 +1927,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
  	pipe_double_lock(ipipe, opipe);
  
  	do {
@@ -48869,7 +48853,7 @@ index f847684..156619e 100644
  			send_sig(SIGPIPE, current, 0);
  			if (!ret)
  				ret = -EPIPE;
-@@ -1967,7 +1967,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+@@ -1972,7 +1972,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
  	 * return EAGAIN if we have the potential of some data in the
  	 * future, otherwise just return 0
  	 */
@@ -59394,49 +59378,10 @@ index 810431d..0ec4804f 100644
   * (puds are folded into pgds so this doesn't get actually called,
   * but the define is needed for a generic inline function.)
 diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
-index 125c54e..e95c18e 100644
+index c7ec2cd..909d125 100644
 --- a/include/asm-generic/pgtable.h
 +++ b/include/asm-generic/pgtable.h
-@@ -446,6 +446,18 @@ static inline int pmd_write(pmd_t pmd)
- #endif /* __HAVE_ARCH_PMD_WRITE */
- #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
- 
-+#ifndef  __HAVE_ARCH_READ_PMD_ATOMIC
-+static inline pmd_t read_pmd_atomic(pmd_t *pmdp)
-+{
-+	/*
-+	 * Depend on compiler for an atomic pmd read. NOTE: this is
-+	 * only going to work, if the pmdval_t isn't larger than
-+	 * an unsigned long.
-+	 */
-+	return *pmdp;
-+}
-+#endif /* __HAVE_ARCH_READ_PMD_ATOMIC */
-+
- /*
-  * This function is meant to be used by sites walking pagetables with
-  * the mmap_sem hold in read mode to protect against MADV_DONTNEED and
-@@ -459,11 +471,17 @@ static inline int pmd_write(pmd_t pmd)
-  * undefined so behaving like if the pmd was none is safe (because it
-  * can return none anyway). The compiler level barrier() is critically
-  * important to compute the two checks atomically on the same pmdval.
-+ *
-+ * For 32bit kernels with a 64bit large pmd_t this automatically takes
-+ * care of reading the pmd atomically to avoid SMP race conditions
-+ * against pmd_populate() when the mmap_sem is hold for reading by the
-+ * caller (a special atomic read not done by "gcc" as in the generic
-+ * version above, is also needed when THP is disabled because the page
-+ * fault can populate the pmd from under us).
-  */
- static inline int pmd_none_or_trans_huge_or_clear_bad(pmd_t *pmd)
- {
--	/* depend on compiler for an atomic pmd read */
--	pmd_t pmdval = *pmd;
-+	pmd_t pmdval = read_pmd_atomic(pmd);
- 	/*
- 	 * The barrier will stabilize the pmdval in a register or on
- 	 * the stack so that it will stop changing under the code.
-@@ -503,6 +521,14 @@ static inline int pmd_trans_unstable(pmd_t *pmd)
+@@ -531,6 +531,14 @@ static inline int pmd_trans_unstable(pmd_t *pmd)
  #endif
  }
  
@@ -61813,10 +61758,10 @@ index 74aa71b..4ae97ba 100644
  #endif /* __KERNEL__ */
  #endif /* _LINUX_MM_H */
 diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
-index 3cc3062..efeaeb7 100644
+index b35752f..41075a0 100644
 --- a/include/linux/mm_types.h
 +++ b/include/linux/mm_types.h
-@@ -252,6 +252,8 @@ struct vm_area_struct {
+@@ -262,6 +262,8 @@ struct vm_area_struct {
  #ifdef CONFIG_NUMA
  	struct mempolicy *vm_policy;	/* NUMA policy for the VMA */
  #endif
@@ -61825,7 +61770,7 @@ index 3cc3062..efeaeb7 100644
  };
  
  struct core_thread {
-@@ -326,7 +328,7 @@ struct mm_struct {
+@@ -336,7 +338,7 @@ struct mm_struct {
  	unsigned long def_flags;
  	unsigned long nr_ptes;		/* Page table pages */
  	unsigned long start_code, end_code, start_data, end_data;
@@ -61834,7 +61779,7 @@ index 3cc3062..efeaeb7 100644
  	unsigned long arg_start, arg_end, env_start, env_end;
  
  	unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */
-@@ -388,6 +390,24 @@ struct mm_struct {
+@@ -398,6 +400,24 @@ struct mm_struct {
  #ifdef CONFIG_CPUMASK_OFFSTACK
  	struct cpumask cpumask_allocation;
  #endif
@@ -61880,7 +61825,7 @@ index 1d1b1e1..2a13c78 100644
  
  #define pmdp_clear_flush_notify(__vma, __address, __pmdp)		\
 diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
-index dff7115..0e001c8 100644
+index 5f6806b..49db2b2 100644
 --- a/include/linux/mmzone.h
 +++ b/include/linux/mmzone.h
 @@ -380,7 +380,7 @@ struct zone {
@@ -62722,10 +62667,10 @@ index 92808b8..c28cac4 100644
  
  /* shm_mode upper byte flags */
 diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
-index c168907..c7756db 100644
+index c1bae8d..2dbcd31 100644
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -666,7 +666,7 @@ static inline struct skb_shared_hwtstamps *skb_hwtstamps(struct sk_buff *skb)
+@@ -663,7 +663,7 @@ static inline struct skb_shared_hwtstamps *skb_hwtstamps(struct sk_buff *skb)
   */
  static inline int skb_queue_empty(const struct sk_buff_head *list)
  {
@@ -62734,7 +62679,7 @@ index c168907..c7756db 100644
  }
  
  /**
-@@ -679,7 +679,7 @@ static inline int skb_queue_empty(const struct sk_buff_head *list)
+@@ -676,7 +676,7 @@ static inline int skb_queue_empty(const struct sk_buff_head *list)
  static inline bool skb_queue_is_last(const struct sk_buff_head *list,
  				     const struct sk_buff *skb)
  {
@@ -62743,7 +62688,7 @@ index c168907..c7756db 100644
  }
  
  /**
-@@ -692,7 +692,7 @@ static inline bool skb_queue_is_last(const struct sk_buff_head *list,
+@@ -689,7 +689,7 @@ static inline bool skb_queue_is_last(const struct sk_buff_head *list,
  static inline bool skb_queue_is_first(const struct sk_buff_head *list,
  				      const struct sk_buff *skb)
  {
@@ -62752,7 +62697,7 @@ index c168907..c7756db 100644
  }
  
  /**
-@@ -1587,7 +1587,7 @@ static inline int pskb_network_may_pull(struct sk_buff *skb, unsigned int len)
+@@ -1584,7 +1584,7 @@ static inline int pskb_network_may_pull(struct sk_buff *skb, unsigned int len)
   * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
   */
  #ifndef NET_SKB_PAD
@@ -63441,10 +63386,10 @@ index 6c469db..7743b8e 100644
  
  #endif
 diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
-index b94765e..053f68b 100644
+index 2040bff..f4c0733 100644
 --- a/include/net/inetpeer.h
 +++ b/include/net/inetpeer.h
-@@ -48,8 +48,8 @@ struct inet_peer {
+@@ -51,8 +51,8 @@ struct inet_peer {
  	 */
  	union {
  		struct {
@@ -63455,7 +63400,7 @@ index b94765e..053f68b 100644
  			__u32				tcp_ts;
  			__u32				tcp_ts_stamp;
  		};
-@@ -115,11 +115,11 @@ static inline int inet_getid(struct inet_peer *p, int more)
+@@ -118,11 +118,11 @@ static inline int inet_getid(struct inet_peer *p, int more)
  	more++;
  	inet_peer_refcheck(p);
  	do {
@@ -63707,10 +63652,10 @@ index 8f9dfba..610ab6c 100644
  	u8			       qfull;
  	enum fc_lport_state	       state;
 diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
-index 6efb2e1..cdad57f 100644
+index ba96988..ecf2eb9 100644
 --- a/include/scsi/scsi_device.h
 +++ b/include/scsi/scsi_device.h
-@@ -162,9 +162,9 @@ struct scsi_device {
+@@ -163,9 +163,9 @@ struct scsi_device {
  	unsigned int max_device_blocked; /* what device_blocked counts down from  */
  #define SCSI_DEFAULT_DEVICE_BLOCKED	3
  
@@ -65260,7 +65205,7 @@ index fd126f8..70b755b 100644
  
  	/*
 diff --git a/kernel/exit.c b/kernel/exit.c
-index d8bd3b42..26bd8dc 100644
+index 9d81012..d7911f1 100644
 --- a/kernel/exit.c
 +++ b/kernel/exit.c
 @@ -59,6 +59,10 @@
@@ -65312,7 +65257,7 @@ index d8bd3b42..26bd8dc 100644
  	/*
  	 * If we were started as result of loading a module, close all of the
  	 * user space pages.  We don't need them, and if we didn't close them
-@@ -900,6 +919,8 @@ void do_exit(long code)
+@@ -901,6 +920,8 @@ void do_exit(long code)
  	struct task_struct *tsk = current;
  	int group_dead;
  
@@ -65321,7 +65266,7 @@ index d8bd3b42..26bd8dc 100644
  	profile_task_exit(tsk);
  
  	WARN_ON(blk_needs_flush_plug(tsk));
-@@ -916,7 +937,6 @@ void do_exit(long code)
+@@ -917,7 +938,6 @@ void do_exit(long code)
  	 * mm_release()->clear_child_tid() from writing to a user-controlled
  	 * kernel address.
  	 */
@@ -65329,7 +65274,7 @@ index d8bd3b42..26bd8dc 100644
  
  	ptrace_event(PTRACE_EVENT_EXIT, code);
  
-@@ -977,6 +997,9 @@ void do_exit(long code)
+@@ -978,6 +998,9 @@ void do_exit(long code)
  	tsk->exit_code = code;
  	taskstats_exit(tsk, group_dead);
  
@@ -65339,7 +65284,7 @@ index d8bd3b42..26bd8dc 100644
  	exit_mm(tsk);
  
  	if (group_dead)
-@@ -1093,7 +1116,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
+@@ -1094,7 +1117,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
   * Take down every thread in the group.  This is called by fatal signals
   * as well as by sys_exit_group (below).
   */
@@ -65349,10 +65294,30 @@ index d8bd3b42..26bd8dc 100644
  {
  	struct signal_struct *sig = current->signal;
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 8163333..42d41de 100644
+index 8163333..aee97f3 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
-@@ -286,7 +286,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
+@@ -274,19 +274,24 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
+ 	}
+ 
+ 	err = arch_dup_task_struct(tsk, orig);
+-	if (err)
+-		goto out;
+ 
++	/*
++	 * We defer looking at err, because we will need this setup
++	 * for the clean up path to work correctly.
++	 */
+ 	tsk->stack = ti;
+-
+ 	setup_thread_stack(tsk, orig);
++
++	if (err)
++		goto out;
++
+ 	clear_user_return_notifier(tsk);
+ 	clear_tsk_need_resched(tsk);
+ 	stackend = end_of_stack(tsk);
  	*stackend = STACK_END_MAGIC;	/* for overflow detection */
  
  #ifdef CONFIG_CC_STACKPROTECTOR
@@ -65361,7 +65326,7 @@ index 8163333..42d41de 100644
  #endif
  
  	/*
-@@ -310,13 +310,78 @@ out:
+@@ -310,13 +315,78 @@ out:
  }
  
  #ifdef CONFIG_MMU
@@ -65442,7 +65407,7 @@ index 8163333..42d41de 100644
  
  	down_write(&oldmm->mmap_sem);
  	flush_cache_dup_mm(oldmm);
-@@ -328,8 +393,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -328,8 +398,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
  	mm->locked_vm = 0;
  	mm->mmap = NULL;
  	mm->mmap_cache = NULL;
@@ -65453,7 +65418,7 @@ index 8163333..42d41de 100644
  	mm->map_count = 0;
  	cpumask_clear(mm_cpumask(mm));
  	mm->mm_rb = RB_ROOT;
-@@ -345,8 +410,6 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -345,8 +415,6 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
  
  	prev = NULL;
  	for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
@@ -65462,7 +65427,7 @@ index 8163333..42d41de 100644
  		if (mpnt->vm_flags & VM_DONTCOPY) {
  			long pages = vma_pages(mpnt);
  			mm->total_vm -= pages;
-@@ -354,54 +417,11 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -354,54 +422,11 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
  								-pages);
  			continue;
  		}
@@ -65521,7 +65486,7 @@ index 8163333..42d41de 100644
  
  		/*
  		 * Link in the new vma and copy the page table entries.
-@@ -424,6 +444,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
+@@ -424,6 +449,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
  		if (retval)
  			goto out;
  	}
@@ -65553,7 +65518,7 @@ index 8163333..42d41de 100644
  	/* a new mm has just been created */
  	arch_dup_mmap(oldmm, mm);
  	retval = 0;
-@@ -432,14 +477,6 @@ out:
+@@ -432,14 +482,6 @@ out:
  	flush_tlb_mm(oldmm);
  	up_write(&oldmm->mmap_sem);
  	return retval;
@@ -65568,7 +65533,7 @@ index 8163333..42d41de 100644
  }
  
  static inline int mm_alloc_pgd(struct mm_struct *mm)
-@@ -676,8 +713,8 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
+@@ -676,8 +718,8 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
  		return ERR_PTR(err);
  
  	mm = get_task_mm(task);
@@ -65579,7 +65544,7 @@ index 8163333..42d41de 100644
  		mmput(mm);
  		mm = ERR_PTR(-EACCES);
  	}
-@@ -899,13 +936,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
+@@ -899,13 +941,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
  			spin_unlock(&fs->lock);
  			return -EAGAIN;
  		}
@@ -65595,7 +65560,7 @@ index 8163333..42d41de 100644
  	return 0;
  }
  
-@@ -1172,6 +1210,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+@@ -1172,6 +1215,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
  	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
  #endif
  	retval = -EAGAIN;
@@ -65605,7 +65570,7 @@ index 8163333..42d41de 100644
  	if (atomic_read(&p->real_cred->user->processes) >=
  			task_rlimit(p, RLIMIT_NPROC)) {
  		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
-@@ -1392,6 +1433,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+@@ -1392,6 +1438,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
  	/* Need tasklist lock for parent etc handling! */
  	write_lock_irq(&tasklist_lock);
  
@@ -65615,7 +65580,7 @@ index 8163333..42d41de 100644
  	/* CLONE_PARENT re-uses the old parent */
  	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
  		p->real_parent = current->real_parent;
-@@ -1502,6 +1546,8 @@ bad_fork_cleanup_count:
+@@ -1502,6 +1551,8 @@ bad_fork_cleanup_count:
  bad_fork_free:
  	free_task(p);
  fork_out:
@@ -65624,7 +65589,7 @@ index 8163333..42d41de 100644
  	return ERR_PTR(retval);
  }
  
-@@ -1602,6 +1648,8 @@ long do_fork(unsigned long clone_flags,
+@@ -1602,6 +1653,8 @@ long do_fork(unsigned long clone_flags,
  		if (clone_flags & CLONE_PARENT_SETTID)
  			put_user(nr, parent_tidptr);
  
@@ -65633,7 +65598,7 @@ index 8163333..42d41de 100644
  		if (clone_flags & CLONE_VFORK) {
  			p->vfork_done = &vfork;
  			init_completion(&vfork);
-@@ -1700,7 +1748,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1700,7 +1753,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
  		return 0;
  
  	/* don't need lock here; in the worst case we'll do useless copy */
@@ -65642,7 +65607,7 @@ index 8163333..42d41de 100644
  		return 0;
  
  	*new_fsp = copy_fs_struct(fs);
-@@ -1789,7 +1837,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -1789,7 +1842,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
  			fs = current->fs;
  			spin_lock(&fs->lock);
  			current->fs = new_fs;
@@ -68941,10 +68906,10 @@ index 0fa92f6..89950b2 100644
  	struct ftrace_func_probe *entry;
  	struct ftrace_page *pg;
 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index 464a96f..bc0bd88 100644
+index 55e4d4c..8c915ec 100644
 --- a/kernel/trace/trace.c
 +++ b/kernel/trace/trace.c
-@@ -4312,10 +4312,9 @@ static const struct file_operations tracing_dyn_info_fops = {
+@@ -4316,10 +4316,9 @@ static const struct file_operations tracing_dyn_info_fops = {
  };
  #endif
  
@@ -68956,7 +68921,7 @@ index 464a96f..bc0bd88 100644
  	static int once;
  
  	if (d_tracer)
-@@ -4335,10 +4334,9 @@ struct dentry *tracing_init_dentry(void)
+@@ -4339,10 +4338,9 @@ struct dentry *tracing_init_dentry(void)
  	return d_tracer;
  }
  
@@ -69704,19 +69669,10 @@ index d53adf9..03a24bf 100644
  	set_fs(old_fs);
  
 diff --git a/mm/madvise.c b/mm/madvise.c
-index 1ccbba5..819f7d5 100644
+index 55f645c..4f3fd75 100644
 --- a/mm/madvise.c
 +++ b/mm/madvise.c
-@@ -13,6 +13,8 @@
- #include <linux/hugetlb.h>
- #include <linux/sched.h>
- #include <linux/ksm.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
- 
- /*
-  * Any behaviour which results in changes to the vma->vm_flags needs to
-@@ -45,6 +47,10 @@ static long madvise_behavior(struct vm_area_struct * vma,
+@@ -46,6 +46,10 @@ static long madvise_behavior(struct vm_area_struct * vma,
  	pgoff_t pgoff;
  	unsigned long new_flags = vma->vm_flags;
  
@@ -69727,7 +69683,7 @@ index 1ccbba5..819f7d5 100644
  	switch (behavior) {
  	case MADV_NORMAL:
  		new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
-@@ -116,6 +122,13 @@ success:
+@@ -117,6 +121,13 @@ success:
  	/*
  	 * vm_flags is protected by the mmap_sem held in write mode.
  	 */
@@ -69741,7 +69697,7 @@ index 1ccbba5..819f7d5 100644
  	vma->vm_flags = new_flags;
  
  out:
-@@ -174,6 +187,11 @@ static long madvise_dontneed(struct vm_area_struct * vma,
+@@ -175,6 +186,11 @@ static long madvise_dontneed(struct vm_area_struct * vma,
  			     struct vm_area_struct ** prev,
  			     unsigned long start, unsigned long end)
  {
@@ -69753,7 +69709,7 @@ index 1ccbba5..819f7d5 100644
  	*prev = vma;
  	if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
  		return -EINVAL;
-@@ -186,6 +204,21 @@ static long madvise_dontneed(struct vm_area_struct * vma,
+@@ -187,6 +203,21 @@ static long madvise_dontneed(struct vm_area_struct * vma,
  		zap_page_range(vma, start, end - start, &details);
  	} else
  		zap_page_range(vma, start, end - start, NULL);
@@ -69775,47 +69731,15 @@ index 1ccbba5..819f7d5 100644
  	return 0;
  }
  
-@@ -203,16 +236,17 @@ static long madvise_remove(struct vm_area_struct *vma,
- 	struct address_space *mapping;
- 	loff_t offset, endoff;
- 	int error;
-+	struct file *f;
- 
- 	*prev = NULL;	/* tell sys_madvise we drop mmap_sem */
- 
- 	if (vma->vm_flags & (VM_LOCKED|VM_NONLINEAR|VM_HUGETLB))
- 		return -EINVAL;
- 
--	if (!vma->vm_file || !vma->vm_file->f_mapping
--		|| !vma->vm_file->f_mapping->host) {
--			return -EINVAL;
--	}
-+	f = vma->vm_file;
-+
-+	if (!f || !f->f_mapping || !f->f_mapping->host)
-+		return -EINVAL;
- 
- 	if ((vma->vm_flags & (VM_SHARED|VM_WRITE)) != (VM_SHARED|VM_WRITE))
- 		return -EACCES;
-@@ -224,10 +258,16 @@ static long madvise_remove(struct vm_area_struct *vma,
- 	endoff = (loff_t)(end - vma->vm_start - 1)
- 			+ ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
- 
--	/* vmtruncate_range needs to take i_mutex */
-+	/* vmtruncate_range needs to take i_mutex. We need to
-+	* explicitly grab a reference because the vma (and hence the
-+	* vma's reference to the file) can go away as soon as we drop
-+	* mmap_sem.
-+	*/
-+	get_file(f);
- 	up_read(&current->mm->mmap_sem);
+@@ -238,6 +269,7 @@ static long madvise_remove(struct vm_area_struct *vma,
  	error = vmtruncate_range(mapping->host, offset, endoff);
+ 	fput(f);
  	down_read(&current->mm->mmap_sem);
 +	fput(f);
  	return error;
  }
  
-@@ -384,6 +424,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
+@@ -394,6 +426,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
  	if (end < start)
  		goto out;
  
@@ -72566,7 +72490,7 @@ index 5b5ad58..0f77903 100644
  	struct anon_vma_chain *avc;
  	struct anon_vma *anon_vma;
 diff --git a/mm/shmem.c b/mm/shmem.c
-index f99ff3e..faea8b6 100644
+index 9d65a02..7c877e7 100644
 --- a/mm/shmem.c
 +++ b/mm/shmem.c
 @@ -31,7 +31,7 @@
@@ -72587,7 +72511,7 @@ index f99ff3e..faea8b6 100644
  
  struct shmem_xattr {
  	struct list_head list;	/* anchored by shmem_inode_info->xattr_list */
-@@ -2235,8 +2235,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
+@@ -2236,8 +2236,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
  	int err = -ENOMEM;
  
  	/* Round up to L1_CACHE_BYTES to resist false sharing */
@@ -74227,7 +74151,7 @@ index e4fbfd6..6a6ac94 100644
  
  	return err;
 diff --git a/net/core/dev.c b/net/core/dev.c
-index 99e1d75..adf968a 100644
+index 533c586..f78a55f 100644
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
 @@ -1136,9 +1136,13 @@ void dev_load(struct net *net, const char *name)
@@ -74271,7 +74195,7 @@ index 99e1d75..adf968a 100644
  
  #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
  
-@@ -2898,7 +2902,7 @@ enqueue:
+@@ -2877,7 +2881,7 @@ enqueue:
  
  	local_irq_restore(flags);
  
@@ -74280,7 +74204,7 @@ index 99e1d75..adf968a 100644
  	kfree_skb(skb);
  	return NET_RX_DROP;
  }
-@@ -2970,7 +2974,7 @@ int netif_rx_ni(struct sk_buff *skb)
+@@ -2949,7 +2953,7 @@ int netif_rx_ni(struct sk_buff *skb)
  }
  EXPORT_SYMBOL(netif_rx_ni);
  
@@ -74289,7 +74213,7 @@ index 99e1d75..adf968a 100644
  {
  	struct softnet_data *sd = &__get_cpu_var(softnet_data);
  
-@@ -3258,7 +3262,7 @@ ncls:
+@@ -3237,7 +3241,7 @@ ncls:
  	if (pt_prev) {
  		ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
  	} else {
@@ -74298,7 +74222,7 @@ index 99e1d75..adf968a 100644
  		kfree_skb(skb);
  		/* Jamal, now you will not able to escape explaining
  		 * me how you were going to use this. :-)
-@@ -3818,7 +3822,7 @@ void netif_napi_del(struct napi_struct *napi)
+@@ -3797,7 +3801,7 @@ void netif_napi_del(struct napi_struct *napi)
  }
  EXPORT_SYMBOL(netif_napi_del);
  
@@ -74307,7 +74231,7 @@ index 99e1d75..adf968a 100644
  {
  	struct softnet_data *sd = &__get_cpu_var(softnet_data);
  	unsigned long time_limit = jiffies + 2;
-@@ -4288,8 +4292,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v)
+@@ -4267,8 +4271,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v)
  		else
  			seq_printf(seq, "%04x", ntohs(pt->type));
  
@@ -74321,7 +74245,7 @@ index 99e1d75..adf968a 100644
  	}
  
  	return 0;
-@@ -5839,7 +5848,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
+@@ -5818,7 +5827,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
  	} else {
  		netdev_stats_to_stats64(storage, &dev->stats);
  	}
@@ -74446,7 +74370,7 @@ index 611c5ef..88f6d6d 100644
  	{
  		int new_fd;
 diff --git a/net/core/sock.c b/net/core/sock.c
-index b2e14c0..6651b32 100644
+index 0f8402e..f0b6338 100644
 --- a/net/core/sock.c
 +++ b/net/core/sock.c
 @@ -340,7 +340,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
@@ -74521,7 +74445,7 @@ index b2e14c0..6651b32 100644
  		return -EFAULT;
  lenout:
  	if (put_user(len, optlen))
-@@ -2128,7 +2128,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+@@ -2131,7 +2131,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
  	 */
  	smp_wmb();
  	atomic_set(&sk->sk_refcnt, 1);
@@ -74668,7 +74592,7 @@ index 984ec65..97ac518 100644
  			inet_twsk_deschedule(tw, death_row);
  			while (twrefcnt) {
 diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
-index d4d61b6..b81aec8 100644
+index dfba343..c827d50 100644
 --- a/net/ipv4/inetpeer.c
 +++ b/net/ipv4/inetpeer.c
 @@ -487,8 +487,8 @@ relookup:
@@ -75574,10 +75498,10 @@ index 6b9d5a0..4dffaf1 100644
  	seq_printf(m, "Max header size: %d\n", self->max_header_size);
  
 diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
-index 07d7d55..541de95 100644
+index cd6f7a9..e63fe89 100644
 --- a/net/iucv/af_iucv.c
 +++ b/net/iucv/af_iucv.c
-@@ -783,10 +783,10 @@ static int iucv_sock_autobind(struct sock *sk)
+@@ -782,10 +782,10 @@ static int iucv_sock_autobind(struct sock *sk)
  
  	write_lock_bh(&iucv_sk_list.lock);
  
diff --git a/3.4.4/4430_grsec-remove-localversion-grsec.patch b/3.4.5/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.4.4/4430_grsec-remove-localversion-grsec.patch
+++ b/3.4.5/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.4.4/4435_grsec-mute-warnings.patch b/3.4.5/4435_grsec-mute-warnings.patch
index e85abd6..e85abd6 100644
--- a/3.4.4/4435_grsec-mute-warnings.patch
+++ b/3.4.5/4435_grsec-mute-warnings.patch
diff --git a/3.4.4/4440_grsec-remove-protected-paths.patch b/3.4.5/4440_grsec-remove-protected-paths.patch
index 637934a..637934a 100644
--- a/3.4.4/4440_grsec-remove-protected-paths.patch
+++ b/3.4.5/4440_grsec-remove-protected-paths.patch
diff --git a/3.4.4/4450_grsec-kconfig-default-gids.patch b/3.4.5/4450_grsec-kconfig-default-gids.patch
index 6d092db..50ba671 100644
--- a/3.4.4/4450_grsec-kconfig-default-gids.patch
+++ b/3.4.5/4450_grsec-kconfig-default-gids.patch
@@ -73,7 +73,7 @@ diff -Nuar a/grsecurity/Kconfig b/Kconfig
 diff -Nuar a/security/Kconfig b/security/Kconfig
 --- a/security/Kconfig	2012-07-01 12:51:41.000000000 -0400
 +++ b/security/Kconfig	2012-07-01 13:00:23.000000000 -0400
-@@ -186,7 +186,7 @@
+@@ -187,7 +187,7 @@
  
  config GRKERNSEC_PROC_GID
  	int "GID exempted from /proc restrictions"
diff --git a/3.4.4/4465_selinux-avc_audit-log-curr_ip.patch b/3.4.5/4465_selinux-avc_audit-log-curr_ip.patch
index 48acad7..48acad7 100644
--- a/3.4.4/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.4.5/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.4.4/4470_disable-compat_vdso.patch b/3.4.5/4470_disable-compat_vdso.patch
index 2a637c1..2a637c1 100644
--- a/3.4.4/4470_disable-compat_vdso.patch
+++ b/3.4.5/4470_disable-compat_vdso.patch