9 files changed, 98 insertions, 22 deletions

diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index ed206fd88cca..e81175ef25f8 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -249,7 +249,7 @@ static void untag_chunk(struct node *p)
                 list_del_rcu(&chunk->hash);
                 spin_unlock(&hash_lock);
                 spin_unlock(&entry->lock);
-                fsnotify_destroy_mark(entry);
+                fsnotify_destroy_mark(entry, audit_tree_group);
                 goto out;
         }
 
@@ -291,7 +291,7 @@ static void untag_chunk(struct node *p)
                 owner->root = new;
         spin_unlock(&hash_lock);
         spin_unlock(&entry->lock);
-        fsnotify_destroy_mark(entry);
+        fsnotify_destroy_mark(entry, audit_tree_group);
         fsnotify_put_mark(&new->mark);  /* drop initial reference */
         goto out;
 
@@ -331,7 +331,7 @@ static int create_chunk(struct inode *inode, struct audit_tree *tree)
                 spin_unlock(&hash_lock);
                 chunk->dead = 1;
                 spin_unlock(&entry->lock);
-                fsnotify_destroy_mark(entry);
+                fsnotify_destroy_mark(entry, audit_tree_group);
                 fsnotify_put_mark(entry);
                 return 0;
         }
@@ -412,7 +412,7 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
                 spin_unlock(&chunk_entry->lock);
                 spin_unlock(&old_entry->lock);
 
-                fsnotify_destroy_mark(chunk_entry);
+                fsnotify_destroy_mark(chunk_entry, audit_tree_group);
 
                 fsnotify_put_mark(chunk_entry);
                 fsnotify_put_mark(old_entry);
@@ -443,7 +443,7 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
         spin_unlock(&hash_lock);
         spin_unlock(&chunk_entry->lock);
         spin_unlock(&old_entry->lock);
-        fsnotify_destroy_mark(old_entry);
+        fsnotify_destroy_mark(old_entry, audit_tree_group);
         fsnotify_put_mark(chunk_entry); /* drop initial reference */
         fsnotify_put_mark(old_entry); /* pair to fsnotify_find mark_entry */
         return 0;
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index 9a9ae6e3d290..4a599f699adc 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -350,7 +350,7 @@ static void audit_remove_parent_watches(struct audit_parent *parent)
         }
         mutex_unlock(&audit_filter_mutex);
 
-        fsnotify_destroy_mark(&parent->mark);
+        fsnotify_destroy_mark(&parent->mark, audit_watch_group);
 }
 
 /* Get path information necessary for adding watches. */
@@ -457,7 +457,7 @@ void audit_remove_watch_rule(struct audit_krule *krule)
 
                 if (list_empty(&parent->watches)) {
                         audit_get_parent(parent);
-                        fsnotify_destroy_mark(&parent->mark);
+                        fsnotify_destroy_mark(&parent->mark, audit_watch_group);
                         audit_put_parent(parent);
                 }
         }
diff --git a/kernel/fork.c b/kernel/fork.c
index 85f6d536608d..a31b823b3c2d 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1613,7 +1613,6 @@ long do_fork(unsigned long clone_flags,
         return nr;
 }
 
-#ifdef CONFIG_GENERIC_KERNEL_THREAD
 /*
  * Create a kernel thread.
  */
@@ -1622,7 +1621,6 @@ pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
         return do_fork(flags|CLONE_VM|CLONE_UNTRACED, (unsigned long)fn,
                 (unsigned long)arg, NULL, NULL);
 }
-#endif
 
 #ifdef __ARCH_WANT_SYS_FORK
 SYSCALL_DEFINE0(fork)
diff --git a/kernel/kcmp.c b/kernel/kcmp.c
index 30b7b225306c..e30ac0fe61c3 100644
--- a/kernel/kcmp.c
+++ b/kernel/kcmp.c
@@ -4,6 +4,7 @@
 #include <linux/string.h>
 #include <linux/random.h>
 #include <linux/module.h>
+#include <linux/ptrace.h>
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/cache.h>
diff --git a/kernel/kmod.c b/kernel/kmod.c
index 1c317e386831..0023a87e8de6 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -219,9 +219,9 @@ static int ____call_usermodehelper(void *data)
 
         commit_creds(new);
 
-        retval = kernel_execve(sub_info->path,
-                               (const char *const *)sub_info->argv,
-                               (const char *const *)sub_info->envp);
+        retval = do_execve(sub_info->path,
+                           (const char __user *const __user *)sub_info->argv,
+                           (const char __user *const __user *)sub_info->envp);
         if (!retval)
                 return 0;
 
diff --git a/kernel/modsign_pubkey.c b/kernel/modsign_pubkey.c
index 045504fffbb2..2b6e69909c39 100644
--- a/kernel/modsign_pubkey.c
+++ b/kernel/modsign_pubkey.c
@@ -34,18 +34,15 @@ static __init int module_verify_init(void)
 {
         pr_notice("Initialise module verification\n");
 
-        modsign_keyring = key_alloc(&key_type_keyring, ".module_sign",
-                                    KUIDT_INIT(0), KGIDT_INIT(0),
-                                    current_cred(),
-                                    (KEY_POS_ALL & ~KEY_POS_SETATTR) |
-                                    KEY_USR_VIEW | KEY_USR_READ,
-                                    KEY_ALLOC_NOT_IN_QUOTA);
+        modsign_keyring = keyring_alloc(".module_sign",
+                                        KUIDT_INIT(0), KGIDT_INIT(0),
+                                        current_cred(),
+                                        ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                                         KEY_USR_VIEW | KEY_USR_READ),
+                                        KEY_ALLOC_NOT_IN_QUOTA, NULL);
         if (IS_ERR(modsign_keyring))
                 panic("Can't allocate module signing keyring\n");
 
-        if (key_instantiate_and_link(modsign_keyring, NULL, 0, NULL, NULL) < 0)
-                panic("Can't instantiate module signing keyring\n");
-
         return 0;
 }
 
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index d73840271dce..a278cad1d5d6 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -9,6 +9,7 @@
 #include <asm/uaccess.h>
 #include <linux/kernel_stat.h>
 #include <trace/events/timer.h>
+#include <linux/random.h>
 
 /*
  * Called after updating RLIMIT_CPU to run cpu timer and update
@@ -470,6 +471,8 @@ static void cleanup_timers(struct list_head *head,
  */
 void posix_cpu_timers_exit(struct task_struct *tsk)
 {
+        add_device_randomness((const void*) &tsk->se.sum_exec_runtime,
+                                                sizeof(unsigned long long));
         cleanup_timers(tsk->cpu_timers,
                        tsk->utime, tsk->stime, tsk->se.sum_exec_runtime);
 
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 4603d6cb9e25..5eea8707234a 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -793,8 +793,11 @@ unsigned int sysctl_numa_balancing_scan_delay = 1000;
 
 static void task_numa_placement(struct task_struct *p)
 {
-        int seq = ACCESS_ONCE(p->mm->numa_scan_seq);
+        int seq;
 
+        if (!p->mm)     /* for example, ksmd faulting in a user's mm */
+                return;
+        seq = ACCESS_ONCE(p->mm->numa_scan_seq);
         if (p->numa_scan_seq == seq)
                 return;
         p->numa_scan_seq = seq;
diff --git a/kernel/signal.c b/kernel/signal.c
index 580a91e63471..7aaa51d8e5b8 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -31,6 +31,7 @@
 #include <linux/nsproxy.h>
 #include <linux/user_namespace.h>
 #include <linux/uprobes.h>
+#include <linux/compat.h>
 #define CREATE_TRACE_POINTS
 #include <trace/events/signal.h>
 
@@ -3094,6 +3095,79 @@ do_sigaltstack (const stack_t __user *uss, stack_t __user *uoss, unsigned long s
 out:
         return error;
 }
+#ifdef CONFIG_GENERIC_SIGALTSTACK
+SYSCALL_DEFINE2(sigaltstack,const stack_t __user *,uss, stack_t __user *,uoss)
+{
+        return do_sigaltstack(uss, uoss, current_user_stack_pointer());
+}
+#endif
+
+int restore_altstack(const stack_t __user *uss)
+{
+        int err = do_sigaltstack(uss, NULL, current_user_stack_pointer());
+        /* squash all but EFAULT for now */
+        return err == -EFAULT ? err : 0;
+}
+
+int __save_altstack(stack_t __user *uss, unsigned long sp)
+{
+        struct task_struct *t = current;
+        return  __put_user((void __user *)t->sas_ss_sp, &uss->ss_sp) |
+                __put_user(sas_ss_flags(sp), &uss->ss_flags) |
+                __put_user(t->sas_ss_size, &uss->ss_size);
+}
+
+#ifdef CONFIG_COMPAT
+#ifdef CONFIG_GENERIC_SIGALTSTACK
+asmlinkage long compat_sys_sigaltstack(const compat_stack_t __user *uss_ptr,
+                                       compat_stack_t __user *uoss_ptr)
+{
+        stack_t uss, uoss;
+        int ret;
+        mm_segment_t seg;
+
+        if (uss_ptr) {
+                compat_stack_t uss32;
+
+                memset(&uss, 0, sizeof(stack_t));
+                if (copy_from_user(&uss32, uss_ptr, sizeof(compat_stack_t)))
+                        return -EFAULT;
+                uss.ss_sp = compat_ptr(uss32.ss_sp);
+                uss.ss_flags = uss32.ss_flags;
+                uss.ss_size = uss32.ss_size;
+        }
+        seg = get_fs();
+        set_fs(KERNEL_DS);
+        ret = do_sigaltstack((stack_t __force __user *) (uss_ptr ? &uss : NULL),
+                             (stack_t __force __user *) &uoss,
+                             compat_user_stack_pointer());
+        set_fs(seg);
+        if (ret >= 0 && uoss_ptr)  {
+                if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(compat_stack_t)) ||
+                    __put_user(ptr_to_compat(uoss.ss_sp), &uoss_ptr->ss_sp) ||
+                    __put_user(uoss.ss_flags, &uoss_ptr->ss_flags) ||
+                    __put_user(uoss.ss_size, &uoss_ptr->ss_size))
+                        ret = -EFAULT;
+        }
+        return ret;
+}
+
+int compat_restore_altstack(const compat_stack_t __user *uss)
+{
+        int err = compat_sys_sigaltstack(uss, NULL);
+        /* squash all but -EFAULT for now */
+        return err == -EFAULT ? err : 0;
+}
+
+int __compat_save_altstack(compat_stack_t __user *uss, unsigned long sp)
+{
+        struct task_struct *t = current;
+        return  __put_user(ptr_to_compat((void __user *)t->sas_ss_sp), &uss->ss_sp) |
+                __put_user(sas_ss_flags(sp), &uss->ss_flags) |
+                __put_user(t->sas_ss_size, &uss->ss_size);
+}
+#endif
+#endif
 
 #ifdef __ARCH_WANT_SYS_SIGPENDING