23 files changed, 201 insertions, 139 deletions

diff --git a/Makefile b/Makefile
index 4572f106e30b..878d7aa3d2dd 100644
--- a/Makefile
+++ b/Makefile
@@ -1399,7 +1399,7 @@ quiet_cmd_rmfiles = $(if $(wildcard $(rm-files)),CLEAN   $(wildcard $(rm-files))
 # Run depmod only if we have System.map and depmod is executable
 quiet_cmd_depmod = DEPMOD  $(KERNELRELEASE)
       cmd_depmod = $(CONFIG_SHELL) $(srctree)/scripts/depmod.sh $(DEPMOD) \
-                   $(KERNELRELEASE) "$(patsubst "%",%,$(CONFIG_SYMBOL_PREFIX))"
+                   $(KERNELRELEASE) "$(patsubst y,_,$(CONFIG_HAVE_UNDERSCORE_SYMBOL_PREFIX))"
 
 # Create temporary dir for module support files
 # clean it up only when building all modules
diff --git a/arch/Kconfig b/arch/Kconfig
index 99f0e17df429..dd0e8eb8042f 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -381,6 +381,12 @@ config MODULES_USE_ELF_REL
           Modules only use ELF REL relocations.  Modules with ELF RELA
           relocations will give an error.
 
+config HAVE_UNDERSCORE_SYMBOL_PREFIX
+        bool
+        help
+          Some architectures generate an _ in front of C symbols; things like
+          module loading and assembly files need to know about this.
+
 #
 # ABI hall of shame
 #
diff --git a/arch/blackfin/Kconfig b/arch/blackfin/Kconfig
index c3f2e0bc644a..453ebe46b065 100644
--- a/arch/blackfin/Kconfig
+++ b/arch/blackfin/Kconfig
@@ -1,7 +1,3 @@
-config SYMBOL_PREFIX
-        string
-        default "_"
-
 config MMU
         def_bool n
 
@@ -33,6 +29,7 @@ config BLACKFIN
         select ARCH_HAVE_CUSTOM_GPIO_H
         select ARCH_WANT_OPTIONAL_GPIOLIB
         select HAVE_UID16
+        select HAVE_UNDERSCORE_SYMBOL_PREFIX
         select VIRT_TO_BUS
         select ARCH_WANT_IPC_PARSE_VERSION
         select HAVE_GENERIC_HARDIRQS
diff --git a/arch/h8300/Kconfig b/arch/h8300/Kconfig
index 79250de1b12a..303e4f9a79d1 100644
--- a/arch/h8300/Kconfig
+++ b/arch/h8300/Kconfig
@@ -12,10 +12,7 @@ config H8300
         select MODULES_USE_ELF_RELA
         select OLD_SIGSUSPEND3
         select OLD_SIGACTION
-
-config SYMBOL_PREFIX
-        string
-        default "_"
+        select HAVE_UNDERSCORE_SYMBOL_PREFIX
 
 config MMU
         bool
diff --git a/arch/metag/Kconfig b/arch/metag/Kconfig
index b06b41861aac..6f16c1469327 100644
--- a/arch/metag/Kconfig
+++ b/arch/metag/Kconfig
@@ -1,7 +1,3 @@
-config SYMBOL_PREFIX
-        string
-        default "_"
-
 config METAG
         def_bool y
         select EMBEDDED
@@ -28,6 +24,7 @@ config METAG
         select HAVE_OPROFILE
         select HAVE_PERF_EVENTS
         select HAVE_SYSCALL_TRACEPOINTS
+        select HAVE_UNDERSCORE_SYMBOL_PREFIX
         select IRQ_DOMAIN
         select MODULES_USE_ELF_RELA
         select OF
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index 7fabc4c01993..facbf26bc6bb 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -373,6 +373,9 @@ int rsa_extract_mpi(void *context, size_t hdrlen,
         return 0;
 }
 
+/* The keyIdentifier in AuthorityKeyIdentifier SEQUENCE is tag(CONT,PRIM,0) */
+#define SEQ_TAG_KEYID (ASN1_CONT << 6)
+
 /*
  * Process certificate extensions that are used to qualify the certificate.
  */
@@ -407,21 +410,57 @@ int x509_process_extension(void *context, size_t hdrlen,
         }
 
         if (ctx->last_oid == OID_authorityKeyIdentifier) {
+                size_t key_len;
+
                 /* Get hold of the CA key fingerprint */
                 if (vlen < 5)
                         return -EBADMSG;
-                if (v[0] != (ASN1_SEQ | (ASN1_CONS << 5)) ||
-                    v[1] != vlen - 2 ||
-                    v[2] != (ASN1_CONT << 6) ||
-                    v[3] != vlen - 4)
+
+                /* Authority Key Identifier must be a Constructed SEQUENCE */
+                if (v[0] != (ASN1_SEQ | (ASN1_CONS << 5)))
                         return -EBADMSG;
-                v += 4;
-                vlen -= 4;
 
-                f = kmalloc(vlen * 2 + 1, GFP_KERNEL);
+                /* Authority Key Identifier is not indefinite length */
+                if (unlikely(vlen == ASN1_INDEFINITE_LENGTH))
+                        return -EBADMSG;
+
+                if (vlen < ASN1_INDEFINITE_LENGTH) {
+                        /* Short Form length */
+                        if (v[1] != vlen - 2 ||
+                            v[2] != SEQ_TAG_KEYID ||
+                            v[3] > vlen - 4)
+                                return -EBADMSG;
+
+                        key_len = v[3];
+                        v += 4;
+                } else {
+                        /* Long Form length */
+                        size_t seq_len = 0;
+                        size_t sub = v[1] - ASN1_INDEFINITE_LENGTH;
+
+                        if (sub > 2)
+                                return -EBADMSG;
+
+                        /* calculate the length from subsequent octets */
+                        v += 2;
+                        for (i = 0; i < sub; i++) {
+                                seq_len <<= 8;
+                                seq_len |= v[i];
+                        }
+
+                        if (seq_len != vlen - 2 - sub ||
+                            v[sub] != SEQ_TAG_KEYID ||
+                            v[sub + 1] > vlen - 4 - sub)
+                                return -EBADMSG;
+
+                        key_len = v[sub + 1];
+                        v += (sub + 2);
+                }
+
+                f = kmalloc(key_len * 2 + 1, GFP_KERNEL);