Merge branch 'security-fixes' into fixes

4 files changed, 14 insertions, 9 deletions

diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index d40d0ef389db..9cbe70c8b0ef 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -357,7 +357,8 @@ ENDPROC(__pabt_svc)
         .endm
 
         .macro  kuser_cmpxchg_check
-#if !defined(CONFIG_CPU_32v6K) && !defined(CONFIG_NEEDS_SYSCALL_FOR_CMPXCHG)
+#if !defined(CONFIG_CPU_32v6K) && defined(CONFIG_KUSER_HELPERS) && \
+    !defined(CONFIG_NEEDS_SYSCALL_FOR_CMPXCHG)
 #ifndef CONFIG_MMU
 #warning "NPTL on non MMU needs fixing"
 #else
diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
index 25442f451148..fc7920288a3d 100644
--- a/arch/arm/kernel/fiq.c
+++ b/arch/arm/kernel/fiq.c
@@ -84,17 +84,13 @@ int show_fiq_list(struct seq_file *p, int prec)
 
 void set_fiq_handler(void *start, unsigned int length)
 {
-#if defined(CONFIG_CPU_USE_DOMAINS)
-        void *base = (void *)0xffff0000;
-#else
         void *base = vectors_page;
-#endif
         unsigned offset = FIQ_OFFSET;
 
         memcpy(base + offset, start, length);
+        if (!cache_is_vipt_nonaliasing())
+                flush_icache_range(base + offset, offset + length);
         flush_icache_range(0xffff0000 + offset, 0xffff0000 + offset + length);
-        if (!vectors_high())
-                flush_icache_range(offset, offset + length);
 }
 
 int claim_fiq(struct fiq_handler *f)
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index d9f5cd4e533f..e186ee1e63f6 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -53,7 +53,12 @@ armpmu_map_cache_event(const unsigned (*cache_map)
 static int
 armpmu_map_hw_event(const unsigned (*event_map)[PERF_COUNT_HW_MAX], u64 config)
 {
-        int mapping = (*event_map)[config];
+        int mapping;
+
+        if (config >= PERF_COUNT_HW_MAX)
+                return -EINVAL;
+
+        mapping = (*event_map)[config];
         return mapping == HW_OP_UNSUPPORTED ? -ENOENT : mapping;
 }
 
@@ -253,6 +258,9 @@ validate_event(struct pmu_hw_events *hw_events,
         struct arm_pmu *armpmu = to_arm_pmu(event->pmu);
         struct pmu *leader_pmu = event->group_leader->pmu;
 
+        if (is_software_event(event))
+                return 1;
+
         if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF)
                 return 1;
 
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 536c85fe72a8..94f6b05f9e24 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -462,7 +462,7 @@ int in_gate_area_no_mm(unsigned long addr)
 {
         return in_gate_area(NULL, addr);
 }
-#define is_gate_vma(vma)        ((vma) = &gate_vma)
+#define is_gate_vma(vma)        ((vma) == &gate_vma)
 #else
 #define is_gate_vma(vma)        0
 #endif